ML20106B802
| ML20106B802 | |
| Person / Time | |
|---|---|
| Site: | Clinton  |
| Issue date: | 09/30/1992 |
| From: | ILLINOIS POWER CO. |
| To: | |
| Shared Package | |
| ML20106B800 | List: |
| References | |
| NUDOCS 9210050177 | |
| Download: ML20106B802 (450) | |
Text
{{#Wiki_filter:- I L L E N O liS POVJER Clin::on Power S"ation
!nc!ividua, Plant Examina: ion i Fina Reaort September 1992 i
j 88A R8s u 35888261 PDR p
- - .. . ,, . . = .
l CPS INDIVIDUAL PLANT EXAMINATION TABLE OF CONTENTS I Section Title Eaga
- 1. Executive Summary................................. 1-1 1.1 Background and Objectives.................... 1-1 1.2 Plant Familiarization........ ............... 1-4 1.3 Overall Methodology.......................... 1-5 !
l 1.4 Summary of Major Findings.................... 3-7 ' 1.4.1 Clinton Specific Level 1 Analysis..... 1-7 1.4.2 Clinton Specific Level 2 Analysis.... 1-15 1.4.3 Containment Performance Findings. . . . . 1-16 1.4.4 Consistency With Other PRA's......... 1-19
- 2. Examination Description........................... 2-1 2.1 Introduction................................. 2-1 2.2 Conformance with Generic Letter and Supporting Materia 1.......................... 2-1 2.3 General Methodology...........................?.-2 2.3.1 Initiating Events..................... 2-2 2.3.2 Event Trees........................... 2-3 2.3.3 Fault Trees.......... ................ 2-3 2.3.4 Data Analysis......................... 2-5 2.3.5 Quantification........................ 2-6 2.3.6 Containment Analysis.................. 2-6 2.3.7 Documentation......................... 2-8 2.4 Information Assembly......................... 2-9 2.4.1 Plant Layout.......................... 2-9 2.4.2 IPE/PRA Review....................... 2-10 2.4.3 Reference Documentation ............. 2-11
,4.4 Walkdowns............................ 2 .
i 1 A.
L l f CPS INDIVIDUAL PLANT EXAMINATION TABLE OF CONTENTS Section Title Paqe
- 3. Front-End Analysis................................ 3-1 3.1 Accident Sequence Delineation................ 3-1 3.1.1 Initiating Events..................... 3-1 3.1.2 Front-Line Event Trees............... 3-15 3.1.3 Special Event Trees................... 3-33 3.1.4 Support System Event Trees........... 3-34 3.1.5 Sequence Grouping and Back-End Interfaces........................... 3-34 r 3.2 System Analysis............................. 3-63 3.2.1 System Descriptions.................. 3-63 3.2.2 Fault Tree Methodology............... 3-91 3.2.3 Dependency Matrices.................. 3-94 3.3 Sequence Quantification.................... 3-162 3.3.1 List of Generic Data . . . . . . . . . . . . . . . . 3-164 3.3.2 Plant-Specific Data and Analysis.... 3-165 3.3.3 Human Failure Data (Generic and Plant-Specific)..................... 3-167 3.3.4 Common-Cause Failure Data........... 3-183 3.3.5 Quantification of Unavailability of Systems and Functions. . . . . . . . . . . . 3-185 3.3.6. Generation of Support System States and Quantification of Their Probabilities....................... 3-187 3.3.7 Quantification of Sequence Frequencies......................... 3-187 3.3.8 Internal Flooding Analysis.......... 3-182 3.4 Results and Screening Process.............. 3-212 3.4.1 Application of Generic Letter Screening Criteria.................. 3-213 3.4.2 Vulnerability Screening............. 3-228 11
i l CPS INDIVIDUAL PLANT EXAMINATION TABLE OF CONTENTS l Section Title Paqo 3.4.3 Decay Heat Removal Evaluation....... 3-229 l 3.4.4 Unresolved Safety' Issue-and Generic Safety Issue Screening.............. 3-232
- 4. Back-End Analysis......................... ....... 4-1 4.1 Plant Data and Plant Description............. 4-7 4.1.1 Clinton Power Station Containment..... 4-3 4.1.2 Containment Systems................... 4-5 4.1.3 Systems Credited After Containment Failure.............................. 4-11 4.2 Plant Models and Methods for Physical Processes................................... 4-18 4.2.1 Plant Models.........'................ 4-18 4.2.2 General Assumptions.................. 4-18 4.3 Bins and Plant Damage States................ 4-22 4.3.1 Methodology.......................... 4-22 4.3.2 Front-to-Back End Interfaces......... 4-23 4.3.3 Plant Damage States.................. 4-24 4.3.4 Release Mode......................... 4-25 4.3.5 Assessment of Source Term Importance........................... 4-26 4.4 Containment Failure Cnaracterization........ 4-33 4.4.1 Direct Containment Bypass............ 4-33 4.4.2 Vessel Blowdown...................... 4-34 i 4.4.3 Steam Explosions..................... 4-35 r
- 4.4.4 Penetration Thermal Attack........... 4-39 t
L 4.4.5 Containment Isolation................ 4-40 4.4.6 Direct Containment Heating........... 4*41 4.4.7 Molten Core-Concrete Interaction..... 4-44 111
CPS INDIVIDUAL PLANT EXAMINATION TABLE OF CONTENTS Section Title Pace l 4.4.8 Hydrogen Combustion...................t-50 4 4.9 Containment Overpressurization....... 4-51 4.5 Containment Event Trees..................... 4-56 4.5.1 Introduction......................... 4-56 4.5.2 CET Headings......................... 4-57 4.5.3 Containment Event Trees.............. 4-60 4.5.4 Assumptions.......................... 4-60 4.5.5 Plant Damage States.................. 4-60 I
. 5. 6 Release Modes........................ 4-61 4.5.7 Source Terms......................... 4-61 4.6 Accident Progression and CET Quantification.............................. 4-68 4.6.1 Accident Progression................. 4-68 4.6.2 Accident Sequence Recovery Actions, Post Core Damage............ 4-71 4.6.3 CET Quantification................... 4-76 4.7 Radionuclide Releaso Characterization...... 4-110 4.7.1 Introduction........................ 4-110
- 5. Utility Participation and Project Reviews......... 5-1 5.1 IPE Program Organization..................... 5-1 5.2 Composition of Project Review Teams.......... 5-3 5.2.1 System Engineer Review................ 5-4 5.2.2 IPE Independent Review Team (IIRT).... 5-5 5.2.3 Senior Management Review Team......... 5-6 (SMRT) 5.2.4 Consultant Involvement................ 5-7 5.2.5 Engineering Assurance Review.......... 5-8 5.3 Areas of Review and Major Comments........... 5-8 5.4 Resolution of Comments....................... 5-8 iv
CPS INDIVIDUAL PLANT EXAMINATION TABLE OF CONTENTS Section Title Page m
- 6. Plant Improvements and Unique Safety Features..... 6-1 6.1 Introduction................................. 6-1 6.2 Clinton Unique Safety Features............... 6-2 6.2.1 Equipment Independence................ 6-2 6.2.2 Feedwater Delivery System. . . . . . . . . . . . . 6-3 6.2.3 Containment Design.................... 6-4 6.3 Ev-luation of Important Features Affecting Core Damage Risk............................. 6-4 6.3.1 Loss of Off-Site Power................ 6-5 6.3.2 High Pressure Core Spray Failures..... 6-6 6.3.3 Reactor Core Isolation Cooling Failures.............................. 6-7 6.3.4 Depressurization Failures............. 6-8 6.3.5 Transient Initiators................. 6-10 6.3.6 Failures of the Fire Protection System as a Core Cooling System...... 6-11 6.3.7 Poser Recovery Failures Under LOOP Conditions...................... 6-14 6.3.8 Shutdown Service Water Starting Edilure.............................. 6-15 6.4 Evaluation if Important Featdres Affecting Risk of Radioactivity Release From The Containment................................. 6-17 6.4.1 Loss of Off-Site Power............... 6-17 6.4.2 Recovery of AC Power................. 6-18 6.4.3 Failure to Isolate the Containment Under Station Blackout Conditions.... 6-19 6.4.4 High Pressure Core Spray and Reactor Core Isolation Cooling Failures...... 6-20 6.4.5 SCRAM Hardware Failures.............. 6-20 v
CPS I'DIVIDULL PLANT EXAMINATION TABLE OF CiDNTENTS.- ; Sect _on ' Title Page 6 . :, Additional Risk Evaluations................. 6-22 P 6.5.1 Preventive Maintenance Outage Time... 6-22 6.5.2 Adequacy of Safety Related DC Power Supplies....................... 6-23 6.5.3 Hydrogen Control Measures and Effects of Hydrogen Burns on Safety Equipment..................... 6-23 6.5.4 Containment Improvements............. 6-24 6.6 Model Improvements.......................... 6-25 6.6.1 Diesel Recovery Failures............. 6-25 6.6.2 Manual Initiation of Suppression Pool Cooling......................... 6-26 6.6.3 Other Improvements................... 6-26
- 7. Summary and Conclusions........................... 7-1 vi i
CPS-INDIVIDUAL PLANT EXAMINATION TABLE OF CONTENTS Ficure Title Pace 1.4-1 Core Damage Frequency by Initiator Category...... 1-11 1.4-2 Transient Core Damage Frequency by Specific Initiator ....................................... 1-12 1.4-3 Core Damage _ Frequency by Accident Class.......... 1-13 1.4-4 Containment Failure Fraction..................... 1-17 1.4-5 C9ntainment Failure ............................. 1-18 3.1-1 Transient Without Isolation Event Tree........... 3-46 3.1-2 Loss of Feedwater Event Tree..................... 3-47 i I 3.1-3 Luss-of Non-Safety DC Bus Event Tree............. 3-48 l i 3.1-4 Transient With Isolation Event Tree.............. 3-49 3.1-5 Loss of Instrument Air Event Tree'................ 3-50 i l 3.1-6 Loss of Service Water Event Tree. . . . . . . . . . . . . . . . . 3-51 3.1-7 Loss of Offsite Power Event Tree................. 3-52 3.1-8 Station Blackout Event Tree...................... 3-53 3.1-9 Small Break LOCA Event Tree...................... 3-54 3.1-10 Medium Break LOCA Event Tree..................... 3-55 3.1-11 Large Break LOCA Event Tree...................... 3-56 , 3.1-12 Interfacing System LOCA Event Tree. . . . . . . . . . . . . . . 3-57
- 3.1-13 Inadvertent Open Relief Valve Event Tree......... 3-58 i
l 3.1-14 Anticipated Transient Without Scram Event Tree
-Sheet A......................................... 3-59 3.1-15 Anticipated Transient Without Scram Event Tree
-Sheet B......................................... 3-60 3.1-16 Anticipated Transient _Without Scram Event Tree
-Sheet C......................................... 3-61 3.1-17 Anticipated Transient Without Scram Event Tree
-Sheet D......................................... 3-62 3.2-1 = Simplified Scram Logic.......................... 3-106 3.2-2 Division 1 Scram Seal-In/ Reset Logic............ 3-107
, vii L ,
CPS INDZVIDUAL PLANT EXAMINATION TABLE OF CONTENTS Ficurg Title Pace 3.2-3 Scram Dis.harge Volume.......................... 3-108 3.2-4 ARI/RR Pump Trip Logic.......................... 3-109 3.2-5 Division 1 Initiation Logic - Sheet 1........... 3-110 3.2-6 Division 1 Initiation Logic - Sheet 2........... 3-111 3.2-7 Division 1 Initiation Logic - Sheet 3........... 3-112 3.2-8 Division 2 Initiation Logic - Sheet 1........... 3-113 3.2-9 Division 2 Initiation Logic - Sheet 2........... 3-114 3.2-10 Division 2 Initiation Logic - Sheet 3........... 3-115 3.2-11 Divisions 3 and 4 Initiation Logic.............. 3-116 3.2-12 Reactor Core Isolation Cooling Initiation Logic. 3-117 3.2-13 Condensate System............................... 3-118 3.2-14 Condensate Polisher System...................... 3-119 3.2-15 Condensate Booster System....................... 3-120 3.2-16 Feedwater System................................ 3-121 3.2-17 Mait Steam System............................... 3-122 3.2-18 Condenser Air Removal System.................... 3-123 3.2-19 Off Gas System.................................. 3-124 3.2-20 Gland Seal Steam System Sheet 1............... 3-125 3.2-21 Gland Seal Steam System - Sheet 2............... 3-126 3.2-22 Circulating Water System........................ 3-127 3.2-23 High Pressure Core Spray System................. 3-128 3.2-24 Reactor Core Isolation Cooling System........... 3-129 3.2-25 Low Pressure Core Spray System.................. 3-130 3.2-26 Residual Heat Removal System.................... 3-131 3.2-27 Engineered Safety Feature Actuation Logic....... 3-132 3.2-28 ADS Actuation Logic............................. 3-133 viii
_- - . . . = _ .
' CPS INDIVIDUAL PLANT EXAMINATZON TABLE OF CONTENTS Ficure Title Pace 3.2-29 Standby Liquid Control System................... 3-134 3.2-30 Control Rod Drite System........................ 3-135 3.2-31 Containment Venhing to Spent Fuel Storage Pool.. 3-136 3.2-32 Containment Venting to Spent Fuel Storage Pool.. 3-137 3.2-33 Auxiliary Power System - Sheet 1................ 3-138 3.2-34 Auxiliary Power System - Sheet 2. . . . . . . . . . . . . . . . 3-139 3.2-35 Auxiliary Power System - Sheet 3. . . . . . . . . . . . . . . . 3-14 0 3.2-36 Auxiliary Power System - Sheet 4. . . . . . . . . . . . . . . . 3-141 3.2-37 Division 1 DC Distribution System............... 3-142 3.2-38 Division 2 DC Distribution System............... 3-143 3.2-39 Division 3 DC Distribution System............... 3-144 3.2-40 Division 4 DC Distribution System............... 3-145 3.2-41 Balance of Plant DC Distribution System ....... 3-146 Sheet 1 3.2-42 Balance of Plant DC Distribution System ....... 3-147 Sheet 2 3.2-43 Division 1 Shutdown Service Water System . . . . . . 3-148 Sheet 1 3.2-44 Division 1 Shutdewn Service Water System ...... 3-149 Sheet 2 l
3.2-45 Division 2 Shutdown Service Water System . . . . . . 3-150 Sheet 1 l 3.2-46 Division 2 Shutdown Service Water System .......3-151 Sheet 2 3.2-47 Division 3 Shutdown Service Water System........ 3-152 3.2-48 Plant Service Water System - Sheet 1........... 3-153 3.2-49 Plant Service Water System - Sheet 2............ 3-154 3.2-50 Plant Service Water System - Sheet 3............ 3-155 3.2-51 Plant Service Water System - Sheet 4............ 3-156-3.2-52 Instrument Air / Service Air System............... 3-157 ix l l ! _~
CPS INDIVIDUAL PLANT EXAMINATION TABLE'OF CONTENTS Fiuure Title Pace 3.2-53 Component Cooling Water System.................. 3-158 3.2-54 Turbine Building Closed Cooling Water System.... 3-159 3.2-55 Fire Protection System.......................... 3-160 3.2-56 Containment CCP Vent Pathway. . . . . . . . . . . . . . . . . . . . 3-161 4.1-1 Clinton Containment.............................. 4-14 4.1-2 SRV Discharge Locations . . . . . . . . . . . . . . . . . . . . . . . . . . 4 -15 4.1-3 Typical SRV Quencher............................. 4-16 4.1-4 Containment Combustible Gas Control Flowpath..... 4-17 4.3-1 Containment Release Mode Example................. 4-32 4.4-1 Cumulative Probability Distribution Function for Failure of the CPS Containment............... 4-55 4.5-1 C l a s s I A C ET . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 - 6 2 4.5-2 Class IB CET..................................... 4-63 4.5-3 Class ID CET..................................... 4-64 4.5-4 Class IIIB CET................................... 4-65 4.5-5 Class IIIC CET................................... 4-66 4.5-6 Class IV CET..................................... 4-67 4.6-1 Typical High Pressure RPV Failure Sequence....... 4-93 4.6-2 Typical High Pressure RPV Failure Sequence....... 4-94 4.6-3 Typical High Pressure RPV Failure Sequence....... 4-95 4.6-4 Typical Station Black Out Sequence............... 4-96 4.6-5 Typical Station Black Out Sequence............... 4-97 4.6-6 Typical Station Black Out Sequence. . . . . . . . . . . . . . . 4-98 4.6-7 Typical Low Pressure RPV Failure Sequence........ 4-99 4.6-8 Typical Low Pressure RPV Failure Sequence........ 4-100 4.6-9 Typical Low Pressure RPV Failure Sequence........ 4-101 4.6-10 Typical High Pressure RPV Failure LOCA Sequence.. 4-102 4.6-11 Typical High Pressure RPV Failure LOCA Sequence.. 4-103 X
CPS INDIVIDUAL PLANT EXAMENATION Tant? ^F COWit:NTS 4.6-12 Typical High Pressure RPV Failure LOCA Sequence.. 4-104 4.6-13 Typical-Low Pressure LOCA Sequence............... 4-105 4.6-14 Typical Low Pressure LOCA Sequence............... 4-106 4.6-15 Typical Low Pressure LOCA Sequence............... 4-107 4.6-16 Typical ATWS Sequence............................ 4-108 4.6-17 Typical ATWS Sequence............................ 4-109 4.7-1 Containment Failure Graphs....................... 4-115 S.1-1 Organizational Chart of IPE Team. . . . . . . . . . . . . . . . . 5-9 5.2-1 Organizational Chart of SMRT.................... 5-10 l l i l r Xi
s CPS INDIVIDUAL PLANT EXAMINATION TABLE OF CONTENTS
'Lltblq Title Pace 1.4-1 Core Damage Frequency by Initiator................ 1-9 1,4-2 Core Damage Frequency by Initiator Category...... 1-10 1.4-3 Core Damage Frequency by Accident Class.......... 1-10 1.4-4 Dominant Accident Sequences...................... 1-14 2.4-1 Reference Documentation.......................... 2-12 3.1-1 Initiating Event Grouping Guidelines............. 3-36 3.1-2 CPS Initiating Events with Initiating Event Frequencies and Event Tree Designators........... 3-37 3.1-3 Clinton IPE Interfacing Systems LOCA Fre qu e n c i e s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 - 3 9 3.1-4 Comparison of Industry and Clinton Plant Specific Transient Frequency Data'................ 3-40 3.1-5 CPS Front-Line and Critical Support Systems...... 3-41 3.1.6 Accident Sequence Classes........................ 3-42 3.1.7 Accident Sequence Subclasses..................... 3-44 3.2-1 CPS IPE Fault Trees ............................. 3-95 3.2-2 Components / Failure Modes / Transfers Included in the PRA Fault Trees.................. 3-96 3.2-3 Initiating Event to Front-line System De Matrix.................................. pendency ......... 3-97 3.2-4 Front-Line System to Frontline System Dependency Matrix............................... 3-100 3.2-5 Front-Line to Support System De Matrix......................... pendency................. 3-103 3.3-1 Generic Component Failure Rate Data............. 3-192 3.3-2 Restoration and Calibration Errors ............. 3-195 3.3-3 Post-Initiator Human Interactions .............. 3-197 j i
3.3-4 Sensitivity Analysis of Important Human ) Interactions.................................... 3-198 l 3.3-5 Results of Detailed Human Reliability Analysis.. 3-199 l l xii l l
CPS INDIVIDUAL PLANT EXAMINATION TABLE OF CONTENTS I Table Title Pace 3.3-6 List of Major HRA Events Based Upon the CPS Sensitivity Analysis. . . . . . . . . 3-200 3.3-7 Non-Recovery Probabilities for Significant Basic Eveats.................................... 3-201 3.3-8 Conditional Probabilities for Recovery of Off-Site Power.................................. 3-204 3.3-9 Time-Phased Recovery for Short Term Station Blackout Se quence TLU1U2. . . . . . . . . . . . . . . . . . . . . . . . 3-2 0 5 3.3-10 Time-Phased Recovery for Long Tern Station Blackout Sequence TLU1L4 DG1DG2. . . . . . . . . . . . . . . . . . 3 -2 05 3.3-11 Common Cause Component Groups................... 3-206 3.3-12 Common Cause Failure Rate Estimates............. 3-207 3.3-13 Maintenance Unavailabilities Derived From Plant Data............................................ 3-209 3.3-14 Internal Flooding Event Data.................... 3-211 3.4-1 Core Damage Frequency by Accident Class......... 3-233 3.4-2 Accident Sequences Contributing to Core Damage Frequency Which Meet the Screening Criteria..... 3-234 3.4-3 Internal Flooding Dominant Core Damage Sequences 3-235 4-1 Comparison of BWR-6 Containment Capacities........ 4-1 4.1-1 Principal Dimensions and Parameters for CPS Containment.............................. 4-13 4.3-1 Front-to-Back End Interface...................... 4-27 4.3-2 Level 1 to Level 2 System Dependencies. . . . . . . . . . . 4-28 4.3-3 Plant Damage State Codes......................... 4-29 4.3-4 Release Modes.................................... 4-30 4.3-5 Level 2 Release Categories....................... 4-31 4.4-1 Drywell and Containment Penetration Elastomers... 4-54 4.6-1 Time-Phased Recovery for Station Blackout Sequence TLU1U3.................................. 4-92 4.6-2 Tiwa-Phased Recovery for Station Blackout S e qu e n c e T LU 1 L4 DG 1 DG 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 - 9 2 xiii
! CPS INDIVIDUAL PLANT EXAMINATION TABLE OF CONTENTS I l Table Title Pace 4.7-1 Source Term Release Data........................ 4-112 4.7-2 Containment Sequence Performance Summary........ 4-114 6-1 Basic Events With Highest Fussel-Vesely Importance Measures for Core Damage cutsets...... 6-27 6-2 Basic Events With Highest Fussel-Vesely Importance Measures for Class 1B Core Damage CutsetS................................... 6-28 6-3 Basic Events With Highest Pussel-Vesely Importance Measures for Class 1A Core Damage Cutsets................................... 6-30 ,_ 6-4 Basic Events With Highest Fussel-Vesely Importance Measures for Containment Failure Cutsets.................................. 6-31
't a
xiv
CPS INDIVIDUAL PLANT EXAMINATION ACRONYMS ACRONYM MEANING AC Alternating Current ADS Automatic Depressurization System ARI Alternate Rod Insertion ARSAP Advanced Reactor Sovere Accident Program ASE1 Accident Sequence Evaluation Program ATWS Anticipated Transient Without Scram BOP Balance of Plant (non-NSSS systems) BWR Boiling Water Reactor BWROG Boiling Water Reactor Owner's Group CA Condenser Vacuum System CAPTA Cor7 uter Aided Fault Tree Analysis CB Condensate Booster (system) - CCF Common Cause Failure CCI Core-Concrete Interaction CD Condensate (system) < CDF Core Damage Frequency CET Containment Event Tree CM Corrective Maintenance CPS Clinton ower Station CRD Control ' od Drive (system) CS Containmeit Spray (mode of RHR) CSF Critical Safety Function CW Circulating Water System CY Cycled Condensate (system) DC Direct Current (supply or system) DCH Direct Containment Heating DDT Deflagration to Detonation Transition DG Diesel Generator ECCS Emergency Core Cooling System (s) EOP Emergency Operating Procedure EPG Emergency Procedure Guidelir.es EPRI Electric Power Research Institute ERAT Emergency Reserve Auxiliary Transformer ESW Extremely Severe Weather (>l25 mph) ET Event Tree FP Fire Protection (system) FT Fault Tree PTR Fail to Run FTS Fail-to Start
! Feedwater (system)
GE General Electric Company GESSAR General Electric Standard Safety Analysis Report GG Grand Gulf (Nuclear Station) GS Main Turbine Gland ial System GSI Generic Safety 1ssue HCOG Hydrogen Control Owner's Group HEP Humar. Error Probability HP High Pressure Core Spray HPCS High Pressure Core Spray HRA Human Reliability Analysis HVAC Heating, Ventilation, and Air Conditioning xv
- .- . - - - -. -- ~ .. - . - .
CPS INDIVIDUAL PLANT EXAMZNATION ACRONYMS ACRONYM MEANING IA Instrument Air-IDCOR Industry Degraded Core Rulemaking Effort IE Initiating Event IIRT IPE Independent Review Team > IN ECCS/RCIC/ARI/n'; Initiation Logic IORV Inadvertent Open Relief Valve IPE Individual Plant Examination IPEEE Individual Plant Examination for External Events IPEM Individual Plant Evaluation Methodology (by IDCOR) ISLOCA Interfacing System LOCA IST Independent Sub-Tree LCO Limiting Conditions for Operation (Technical Specifications) LLOCA Large IDCA LLRT Local Leak Rate Test LOCA Loss of Coolant Accident LOOP Loss c Offsite Power LP Low Pressure Core Spray LPCI Low Pressure Coolant Injection (Mode of RHR) LPCS Low Pressure Core Spray LTSB- Long Tern Station Blackout MAAP- Modular Accident Analysis Program MGL Multiple Greek Letter Common Cause Probability Model MIDCA Medium LOCA MOV Motor-Operated Valve MS Main Steam (system) y MSCWL Minimum-Steam Cooling Water Level l MSIV Main Steam Isolation Valve MWth Mega-Watts, Thermal NB Nuclear Boiler (system) NPSH- Net Positive Suction Head NSAC Nuclear Safety Analysis Center NSED Nuclear Station Engineering Department NSPS Nuclear System Protection System NSSS Nuclear Steam Supply System OG Off Gas System OS Operational Schematic Drawings OSP Off-Site Power l PCS Power Conversion System (BOP) l PDS Plant Damage State l PM Preventive Maintenance ! PRA Probabilistic Risk Assessment. PSF Performance Shaping Factor (s) PWR Pressurized Water Reactor 1 RAT Reserve Auxiliary Transformer RCIC Reactor Core Isolation Cooling System RD -Control Rod Drive (system) ; RFP Recovery _ Failure Prohsbility ) RH Residual Heat-Removal (system) RHR Posidual Heat Removal (system) ; RI Reactor Core-Isolation Cooling System l xvi l l
-. -. -. .- ~ - - . _ . .- - .
CPS INDIVIDUAL PLANT EXAMINATION ACRONYMS ACRONYM MEANING RPS Reactor Protection System RPT Recirculation Pump Trip RPV Reactor Pressure Vessel RT Reactor Water Cleanup System RWCU Reactor Water Cleanup System S&L Sargent & Lundy (Plant Designer) SA Service Air SBO Station Black Out SC Standby Liquid Control (system) SCRAM Safety Control Rod Axe Man (Rapid Reactor Shut Down) SE. System Engineer SETS Set Equation Transformation System SJAE ' Steam Jet Air Ejector S LC Standby Liquid Control (system) SLOCA Small LOCA SMRT Senior Management Review Team SPC Suppression Pool Cool).ng (mode -of_RHR) SPMU Suppression Pool MhXe-Up , SRO Senior Reactor Operator l SRV Main Steam Safety Relief Valve SSPR Safety System Performance Review STA Shift Technical Advisor STSB Short-Term Station Blackout SX Shutdown Service Water (system) TBCCW Turbine Building Closed Cooling Water l TOAF Top of Active Fuel (Reactor Water Level) UAT Unit Auxiliery Transformer UHC Ultimate Hydrogen Concentration USAR Updated Safety Analysis Report USI Unresolved Safety Issue WS Plant Service Water l l i-l xvii i
. ._ __. _ _ _ _ .- _._ _ _ .__ __ _m -- _ . - _ . _ _ _ . . . ~ _ _.
CPS INDIVIDUAL '/LANT EXAMINATION GLOSSARY Accident Class Core damage bin for similar effects on containment systems and function, grouping of end states for level 1 event trees. Accident Secuence A specific path through the event trees representing a unique combination of success or failuro of the headings. The headings represent the systems . functions necessary to mitigate the consequences of the accident. Cutset A combination of failures which, if they all occur, will cause the undesirable outcome being evaluated to occur. For example, a core damage cutset'is a combination of failures that can cause core damage. Independent Cub-Tree Portions of a fault tree that may be repeated in different parts of a fault tree or on different trees but always in the same form. Idnacified as an entity by the quantification-software and subsequently treated as a value for computational officiency. Plant Damace State Bin of combinations of core damage and containment conditions from the end state of containment event trees. Release-Mode Description of containment failure made and fission product release pathway bins, such as scrubbed or not, early or late, etc. i l-xvill
CPS INDIVIDUAL PLANT EXAMINATION EXECUTIVE
SUMMARY
- 1. EXECUTIVE
SUMMARY
This document provides the results of the Individual Plant Examination (IPE) of internal accident initiating events performed for Illinois Power Company's (IP's) Clinton Power Station in response to the August 1985 NRC Policy Statement on issues related to severe accidents in NUREG-1070 and 10CFR50. A comprehensive and systematic plant analysis has been performed, employing the accepted principles of Level I and II Probabilistic Risk Assessment (PRA). The focus of this analysis was to identify the existence of any potential plant vulnerabilities to severe accidents and determine cost-effective safety improvements that could reduce or eliminate the ir,>act of any such vulnerabilities. No such vulnerabilities were found. Instead the IPE has shown that the Clinton Power Station has been well designed and that its containment is robust. The safety improvements identified by the IPE involved only small reductions in the overall plant risk. 1.1 Backcround and Obiectives The Severe Accident Policy Statement issued in 1985 and implemented by the NRC staff in its Generic Letter 88-20 stated that on the basis of information available at that time, existing nuclear plants pose "no undue risk" to the health and safety of the public. Thus, the Commission found that its announced intention to conduct rulemaking was unwarranted at that time and rescinded the rulemaking notification. The commission's conclusion of "no undue risk" was based upon' extensive actions taken as a result of the Three Mile Island action plan (NUREG-0737) and joint investigation by NRC and the industry-sponsored IDCOR 1 program of the large body of available information on 1 (IDCOR - Industry Degraded Core Rulemaking Program began in 1981 and concluded in 1988. It worked in cooperation with the PRC to resolve the issues of Nuclear Plant Safety with regard to severe accidents) 1-1
--e,,-u--mr ,,wr-n,- -
va- v--,r- -r-r,w <- -,,-rw,-*~e,-- <--m----e,--~m m------- - - , - -
CPS INDIVIDUAL PLANT EXAMINATION EXECUTIVE
SUMMARY
severe accidents.- The iniormation evaluated included NRC and industry-sponsored research, published PRAs_and operating experience. The investigation was conducted on four representative nuclear plants by IDCOR and six by NRC. On the basis of the results of these investigations, the generic-conclusion of "no undue risk" was developed. Although the Severe Accident Policy rescinded rulemaking, the Commission noted that the NRC staff, while performing PRAs on certain plants, had found instances of relatively plant-unique vulnerabilities that were cc rectable at low cost. The Ccimission concluded that these systematic studies should be done at other plants to determine whether plant-unique vulnerabilities existed and to identify cost-effective means to eliminate or mitigate them. In November 1988, the NRC staff issued Generic Letter 88-20 to formally request that each utility perform a systematic plant examination under 10CFR50.54 (f) to satisfy the intent of the policy. The Goncric Letter requested the search for vulnerabilities, the identification of potential improvemer m, and the implementation of improvements that the utility believes to be appropriate. It also requested that each utility develop an overall appreciation for Severe Accident Behavior. In August of 1989, *he NRC issued the specific guidance for-utility IPE performance and submittals in a supplement to the Generic Letter (NUREG-1335). The CPS IPE offort was begun in 1989 and the first phase, the analysis of int 6rnally initiated accident events, has been completed. IP's Clinton Power Station (CPS) IPE was performed to develop an improved understanding of the plant's response to potential accident conditions-by CPS personnel and to identify any significant vulnerabilities to severe accidents that may have - been unknowingly included in the Clinton design. The specific 1-2
-- - , - . - - .. . - . . - - - - . - . ~ . - . . . . . . , . . . . . , _ . - - . . -
CPS INDIVIDUAL PLANT EXAMINATION EXECUTIVE
SUMMARY
l
-objectives of the IPE are summarized below. Each of these objectives is addressed by the report sections indicated in parentheses. - Identify any dominant accident sequence that occurs with a frequency significantly higher than similar sequences at other plants which may therefore identify potential plant weaknesses (Section 1.4). - Identify the potential accident sequences that contribute to the overall core damage frequency (Section 1.4).
Identify any instances of unusually poor containment performance for these dominant accident sequences (Section 1.4). Identify any cost-effective modifications to the plant design, operating procedures, training or maintenance practices that would reduce the likelihood of any accident sequence identified to be highly significant (Sections 6.3 and-6.4). Maximize participation in the evaluation process by CPS personnel and-communicate the results of the IPE to departments and personnel that can use the information. Ensure that the implications of_the IPE findings are l- understood by CPS management and personnel (Section 5.1). Establish a realistic estimate of the frequency of a_ core damage event (Section 3.4). l
' Determine the' timing and nature of any radionuclide releases to the environment that might be associated with the identified dominant accident sequences (Section 4.6).
1-3 I. i l
CPS INDIVIDUAL'PLRNT EXAMINATION EXECUTIVE
SUMMARY
Develop risk-based-tools and documentation to ensure the IPE-can be maintained and understood by IPE personnel and to support resolution of future operational, safety, or regulatory issues for CPS. 1.2 Plant Familiarization Illinois Power assembled an IPE team from among the plant operations and engineering staff. This team brought to the IPE project an extensive background in CPS design, systeus, operating procedures, and technical specifications. Plant information was assembled from a variety of sources such as piping and electrical drawings, operating and emergency procedures, vendor manuals, and system descriptions. This information was analyzed for applicability and summarized in the IPE system notebooks. Plant walkdowns were conducted which provided additional familiarization with system layouts, conditions under which the systems must operate, and the physical arrangement of support systems and the opportunity to verify the overall accuracy of plant system information. The IPE csam mainteined its integration in the CPS organization through continually participating in ongoing activities such as requalification training and proficiency watches. This contact with other CPS organizations allowed maintenance of a thorough familiarization with plant status, planned design changes, plant history, and plant problems throughout the performance-of the-IPE. The IPE in-house review team is also composed of knowledgeable plant personnel who are intimately familiar with and active in all aspects of the plant design and operation. The individuals and organizations composing the CPS IPE team and review teams are discussed further in Sections 5.1 and 5.2. 1-4
. - . . ~ - - .- .
CPS INDIVIDUAL PLANT EXAMINATION EXECUTIVE
SUMMARY
-Detailed discussion of information assembly is provided in-Section 2.4. The composition of the IPE and in-house review teams allowed continuous access to on-shift operating crews, the plant engineering staff and to most plant areas. This access resulted ; in the application of the PRA to situations in which plant mndifications have been contemplated. The usefulness of the CPS PRA has thus been demonstrated, and it is intended to be a living document used to support future plant operations. 1.3 overall Methodolqqy The IPE program for the Clinton Power Station is based on level 1 and level 2 PRA methods described in the followi7g NUREGS. NUREG/CR-2300, "PRA Procedures Guide" NUREG/CR-2815, "Probabilistic Safety Analysis Procedures Guide", and NUREG-1335, " Individual Plant Examination Submittal Guidance". The CPS level 1 study started by determining initiating events, which are occurrences that-can disrupt normal plant operation and rasult in a plant trip. A logic diagram (event tree) was constructed for each initiating event using nodes (branches) to depict success or fcilure of various systems or actions used to mitigate the unwanted offects of the initiating event. Individual system fault-trea models.were developed and then linked to properly. account for system dependenvies due to
- initiating events. The CPS level 1 model is based on a large-fault tree and small event tree approach..
Single component failure probabilitics were included as well as common cause failure data. .The " Multiple Greek Letter" - (MGL) method was used to model common cause failure. 1-5
CPS INDIVIDUAL PLANT EXAMINATION EXECUTIVE
SUMMARY
Human error events were modeled in the fault trees as occurring prior to or after an initiating event. Screening values were used during the initial quantification to determine which huwan errors were significant. The human errors determined to be importent were-then evaluated in detail with the methodology described in NUREG/CR-4771, " Accident Sequence Evaluation Program ( AS EP) " . Plant specific data were collected and used to calculate system unavailabilities and to support success criteria. Industry data were used for situations in which insufficient CPS data existed. ~ Containment Event Trees (CETs) were developed to characterize the containment response to severe accidents for the level 2 or "back-end" analysis. Certain severe accident phenomena sere examined in detail, using past industrv or CPS experiences, analytical work and CPS-specific parameters. Phenomenology evaluation summaries were developed for these phenomena to describe their applicability to Clinton and, if necessary, incorporation into the appropriate CET headings. The level 1 and level 2 portions of the IPE were integrated by using the same analysts to perform both evaluations and continuing the sequence equations from the level 1 results through the sequences in the CETs. This assured continuity, consistency, and accuracy of the overall project. A variety of software was used during the course of the IPE study. The Electric Power Research Institute's (EPRI's) Computer Aided Fault Tree Analysis (CAFTA) program was used for development and linking of the system fault trees and f manipulations of the results-(cutsets) developed from the fault trees. .The personal computer (PC) version of Sets Equation Transformation System (PCSETS) software was used to generate the system and level 1 sequence equatim:s from the fault and event trees and then solve the equations in order to determine 1-6
CPS-INDIVIDUAL PLANT EXAMINATION EXECUTIVE
SUMMARY
- numerical frequencies for each sequence. Another EPRI code, the Modular Accident Analysis Program (MAAP) , was used to support success criteria and to determine best estimate analysis of reacte- nd containment response during accident sequences.
PCSETS was-used-to quantify the CETs, carrying the level 1 equations through to final containment results. A review and update of the level 1 system models and documentation to incorporate recent modifications, procedure changes, and recent operating history were conducted prior to final quantification of the front-end analysis. This was done to ensure that the IPE accurately modeled the current plant conf igurati'- . Sensitivity studies were conducted to assess the impact of key assumptions. A more detailed discussion of the methodology used and the products developed by the IPE study is found in Section 2.3. 1.4 Summarv of'Maior Findinas 1.4.1 Clinton-Specific Level 1 Analysis No vulnerabilities or new or unusual means were discoveree by which core damage or containment failure could occur. The overall mean core damage frequency (CDF) for CPS'is 2.6 x 10-5 -per reactor year. This includes internal flooding, but not other external events such as earthquakes. These wi>l be analyzed in the Individual Plant Examination for External Events (IPEEE). The CPS CDF for internal events is well below the NRC's proposed safety goal of 1 X 10-4 .per year. The Clinton-IPE l results were thoroughly examined for design conditions and ! operating modes that contribute unduly to core damage or poor containment performance. The most significant contributor to core damage was determined to be station blackout (SBO) . This result is typical for many boiling water reactor (BWR) PIUus. The low probability of this sequence shows good plant capability to l-7 l
CPS INDIVIDUAL PLANT EXAMINATIO!i EXECUTIVE
SUMMARY
l respond to this potentially hazardous loss of power event. Chapter 6 provides additional discussion on significant sequences ! a n d .4.n s i g h t s . Figures 1.4-1 through 1.4-3 and Tables 1.4-1 through 1.4-3 show that station blackout and transients are the most significant contributors to CDF. CDF due to anticipated transients without i SCRAM (ATWS), loss of coolant accidents (14CA) , and intnrnal flooding are of much less importance. Of the set of core damage sequences composing the overall CDF, six sequences, as shown on Tabla 1.4-4, were above the sequence screening criteria from Appendix 2 of Generic Letter 88-20 of 1.0E-6 per reactor year. These and other sequences which CPS i considers important are examined in more detail in Section 3.4.1. A breakdown of CDF by initiating events is presented in the following 'able. 1-8
____ ._m. __ _ _ _. . . _ _ _ _ _ _ _ _ . _ . _ . _ . _ _ . _ _ . , _ _ _ . _ _ _ _ _ _ . _ _ _ _ . i i CPS INDIVIDUAL PLANT EXAMINATION EXECUTIVE SUMMAhY TABLE 1.4-1 I CORE DAfMGE EEEQUEILQX._RUlilTI Atoll ; Initiating Coro Porcent : Event Damago of lui.tiatinq. Event Freqqqngy* Er.c.51Rengy* Total Transienta Without Itzolation 4.7 4.8E-06 IL4 1 With Isolation 1.7 4.2E-06 16% Lono of Foodwater 0.6 9.6E-07 41 Loss of DC Bus 1.39E-02 1.2E-06 5% Loss of Inctrument Air 4.32E-03 1.0E-00 01 ; Lous of Servico Water 1.75E-03 1.9E-07 11 Total Transienta 1.1E-05 43% Loss of Off-Sito Power Non-SBO 0.4OE-02 2.4E-06 91 SBO N/A 9.0E-06 37% Total LOOP 1.2E-05 461, i Loss of Coolant Accidenta Largo 1.00E-04 <1 E-09 0% Modium 3.00E-04 1.3E-08 0% Small 1.00E-03 <1 E-09 01 IORV 1.00E-01 1.1E-06 41 Total LOCA 1.01E-01 1.1E-06 4% ATWS N/A 1.4E-07 11. Interfacing System LOCA 5.00E-06 <1 E-09 0% Internal riooding 1.6E-06 6% 1 I Total Coro Damage Frequency 2.6E-05/Roactor Year o
- Frequencico are por reactor year 1 .. ._u.---- . - _ , - - - - . . , . . . - -. a ;. -. - - . . . . . . , . , . , - .- -.- --_-,-:
CPS I!1DIVIDUAL PIAllT EXAMillATIOli EXECUTIVE
SUMMARY
TAllLE 1. 4-2 , CORE DAlihGE_fl[EQUEl'CY BY lt11TIATQ1LCATEGold , Coro Porcent Damage of Initihtor Class fregunngy Total , Tranniento (including non-SDO 1.4E-05 52% ISOP) 14CA (including IORV & ISI4CA) 1.1E-06 41. Silo 9.8E-06 37% ATWS 1.4E-07 11, Internal Flooding 1.6E-06 61 TABLE 1. 4-3 C, ORE DAMAGE FREOUEllCY BLACCIDEliT CLASji Coro Porcont Damage of Aggidspt Cla55 EI22MfDGY TQtal 4 Transients - high pressure (IA) 9.BE-06 37% Station Blackout (IB) 9.8E-06 37% 211, Transiento - low pressure (ID) 5.7E-06 IECAs - high pressure (IIIB) 1.3E-08 0% l, IDCAs - low pronouro (IIIC) 1.1E-06 4% i ATWS ovents (IV) 1.4E-07 1% Containment bypana (V) <1'.0E-09 0% Overall Cora Damage Frequency 2.6E-05/ reactor year Pio Charts developed from the above data are shown in Figuros 1,4-1, 1.4-2, and 1.4-3. i 1-10
- - . -, . , - =., . . ' , ,,-,,,~,,,,,,,.,_.,,--- n- .--e-n- ..,,_,_,-,-,----m- , , , , , , . . ,e-.,...v.N,.-,,,., ,,.,,n,- -,,-n, r. . , . , , ,
CPS INDIVIDUAL PLANT EXAMINATION EXECUTIVE
SUMMARY
CORE DAMAGE FREQUENCY 1.4E-05 L2% 1RANStENIS (INCLUDING NON SDO LOOP)
"r, .,m . .r%.,..c%. n W_ lr , a,#. ,
j$3M[f *
- h. ,, . ?, ,'q' $ % g g{
b 7b Mpi
.b;plbm;',7;@ftY, a;a n d.i7e. y wafY IS@I:.
f'flvMC'vQ5
. qs m,a t:W..
_I y ,~N
.~.j_ f(i{ ,. . u uas.?~9:_f '. *+
; , ? y a 's 4
;',.,c,"Af,m. Qs's44.Y, %.
-4 9,,.
N6% ;, f., " , ' ~af 'Flipko .>,l<';.s o A .4l- (
?Y! .h , 'l .$if 2 k. y'f.$lkfe;u;p,.?l';7lfl :-; k$Y -i{hlEgn r.
spi gln. ' ,.. .p
; 3?..?;thiidM..+g'N,.n) a;;%@NI?Aew M,1 $2*EN IIvlir "Ni
&&w#. q -;p y-1.1E-06 4%
'/,/,f . '
, 1.0E-00 0 %
g / INTERNAL FLOODING LOCA (INCLUDING IORV ANJ ISLOCA) 1.4E-07 1%
ATWS N
\ /
/
N % % ;_. s,/ 9BE 00 37% STATION DLACK OUT Figure 1.4-1 Core Damago Frequency by Initiator Category 1-11
_____ ___ _______ . . . _ _ . . __ ._..m . _ _ CPS INDIVIDUAL PLANT EXAMINATION Olein v;. qupgy CORE DAMAGE FREQUENCY TRANSIENTS WITH POWER cot #ERSION SYSTEM INITIALLY AVAILABLE BE 06 35% p
/
,3v
. ?-
TRANSIENTS WITH ,
$/5 ISOtATION %g , ,g- ;{ik
- 4.2E 00 30% y
/2 4E40 18t6
\
/ LOSS OF 0 F-SITE
\ :/ POWER (fCN-SDO) s LOSS OF PLANT SERVICE WATER 9.6E-07 7% ~y 1.9E47 1%
! LOSS OF FEEDWATER 1 PE 06 9% i LOSS OF NON SAFETY DC DUS I l l Figure 1.4-2 Transient Core-Damage Frequency by Specific Initiator 1-12 l
, CPS INDIVIDUAL PLANT EXAMINATIO!{ EXECUTIVE
SUMMARY
CORE DAMAGE FREQUENCY 9.BE-00 37% TRANSIENTS - HGH PRESSURE l^
/ O r g, ,2Q '
Q ! ;,'.,
. ey k
1.4E 07 1% ATWS - CLASS N 1.1E @ 4% LOCA LOW PRESS - tilC 9 BEM 37% STATION BLACK OUT CLASS 1D 0l
/
\('
N, N- /5.7EM 21% N ,j TRANSIENTS LOW PRESSURE CLASS 1D Figure 1.4-3 Corc Damage Frequency by Accident Class 1-13
CPS INDIVIDUAL PLANT EXAMINATION EXECUTIVE SUM 14ARY TABLE 1.4-4 Dominant Accident Secuences Frecuency/ Scauenca Descrintion Percent TLU1U3 Short-term Station Blackout, 5.24E-06/ initiated by Loss Of Off-site Power, 20.1% SCRAM successful, both division 1 &2 Diesel Generators fail, HPCS & RCIC fall. TLU1L4 DG1DG2 Long-tsrm SBO, initiated by LOOP, 4.59E-06/ SCRAM successful, division 1 &2 17.6% DGs fail, HPCS fai" RCIC runs until battery fail. T202UX1 Transient without isolation, all 3.39E-06/ high pressure injection fails, 13.0% depressurization fails, low pressure injection systems not able to be effective. T3U2UX1 Identical to T2U2UX1, except main 3.03E-06/ condenser is also lost; results are 11.6% the same. INTERNAL Combination of several scenarios, 1.60E-06/ FLOODING predominantly Feedwater line break 6.1% in steam tunnel which disables RCIC as well as Feedwater DCQ2U2UV Loss of non-safety DC bus with SCRAM 1.14E-06/ caused by loss of PW control, main 4.4% condenser is lost, all injection sources lost T4Q1U1V Open relief valve initiator with loss 1.06E-06/ of feedwater delivery & ay.1 high and 4.1% low pressure injection syi.tems. In many cases, ts.11ure of7 injection is because of lack of T power. These sequences are included here inz.?ad of in the SBO
! sequences *because of the LOCA effects of the open relief valve.
1-14
CPS INDIVIDUAL PIANT EXAMINATION EXECUTIVE
SUMMARY
No soquences fall into accident Class II (Loss of containment i lloat Removal) becauan analyals (Section 3.1.2.3) shows that the Emergency Core Cooling System (ECCS) pumps are capable of pumping from the supprossion pool even under saturated conditions. The analysis of CDP yields, in addition to the identification of sequence contributions, a way to measure the importanco of various systems in avorting core damago. No singlo component, l system, or action was found to predominato in contribution to 1 coro damago. The following llat shows the moat important nyatoms ; from this analysis. liigh Prosauro Core Spray Hoactor Core Isolation Cooling Diosol Generatorn Automatic Depressurization System Firo Protection Injection The human interaction ovents which have the greatont offect on coro damago frequency are as followat Manual reactor deprosaurization. Rocovery of off-sito power and diosol generatora and-Manual back-up to the automatic atart of the shutdown service water pumps 1.4.2 GilAtom .flpasifig LgIq.l_LAulyAla The level 1 coro damago stato acquences are binned (grouped) based on the potential impact on containmont functions'so that the level 1 results are carried over into the containment analysis. Thoso bins are illustrated in Figure 1.4-3. Dotails of the binning procosa are contained in Section 4.3. 1-15
CPS INDIVIDUAL PLANT EXAMINATION EXECUTIVE
SUMMARY
Event trees were then constructed to evaluate actious or events that directly affect containment performance. An individual l containment event tree (CET) was then constructed to model each l accident class. Progression through the CETs eventually reaches an end condition referenced as a plant damage state. -l l 1.4.3 Containment Performance Findinas For plant damage states for which containment failure occurs, the ! l radionuclido release modo is also determined for use in the calculation of the radionuclide release source term. The containment fails in only 5% of the sequences in which core - damage occurs (Figure 1.4-4). The conditional containment failure frequency is very small for CPS prim'arily because the containment is very large compared to similar plants and has greater strength than other BWR-6 plants because of additional concreto reinforcement. Figure 1.4-5 shows the fractions of containment failures that fall into various classifications. The upper left figure shows the containment conditions at the end of the sequence (plant damage stato, Section 4.3.3). The upper right figure shows the fraction by releeJe mode (i.e., scrubbed or not, etc., Section 4.3.4). The lower figure shows the fractions that can be classified as moderate release (ST II) or major release (ST III) (Section 4.3.5). As the figuro shows, the frequency of major release is 7.52E-7, which is well below the NRC goal of 1.0E-6. Further analysis of insights relating to containment failure is q included in Section 6.4. 'I i l l l 1 I l 1-16 i
CPS INDIVIDUAL PLANT EXAMINATION EXECUTIVE SUMMAllY CONTAINMENT FAILURE 9 ne P!P,;;.
, , p.
, ;. 4% {ff"% 9 ?<
i f $$1.'
.. > . g. , ,, . J '
],, ., ;: .' n . '.,,.',:' - : s .
, g . ' -
.- 6 r.h.Y ' ? .
' : ,. . /
.I ' ' ,' .
Os$ii . a..
,_e
('jphh[p;: t :Q', $, v if (,, s,. ; ,,. . .' * ': .. 7f . " k' .[b 2LC-0595%a-jh'('W/4 N @. 5 .,h .." h .. CONI AINMLNi' p ; ,4? .. NON FAllOFIE 'v, C,-
- 4-
?...- . *- ..,,g, p p; ... -
7..
,4 1,3E.co Sg
,.i74 y . '-
3 ' . * - .. . - CONTAINMENT FAILUllE , =. ' ~ 1 :. > :. a , 4 , . g.)
,,'.- : . ., , a.1 l u . .> .x
,*., ...:.. .e..a f .: ".,$, ..g.,. .. ,, ..i . ' f y!
- # ' '- . . h ,' .
A. - 1 . .. .
;m .
c - > ?. p
* %..y.. , .. ger,; 3-l '4 g: -
9-o;%R(.g4egy4 COflE DAM AGE EVENTS Lf!ADING 10 CONTAINMENT f All.UllC 1 l l Figure 1.4-4 Containment Failuro Frnetion 1-17
CPS INDIVIDUAL PLANT EXAMINATION EXECUTIVE
SUMMARY
CONTAINMENT FAILURE 41E41 3?% INBl 7 DE41 55% OAE d
~
N s occe 3% s oc co 3% HOHI D6 s 1 aE41 to% . HCIE N C6 g j 'E4741 32% D5 7 0C47 55% CCWf AWMENT F AA.UFE CCNTAWMENT F AltUF1E BY "LANT DAMAGE ST. BY FELLASE MODE ROAE w n- cwt == atwo "* A1 me acwt - HVBi *e - m u cwt -e.a te re.- s C6 = s i.w e6 w .9.cwtw. ,.. a HCIE ..w mv w ews am w a., D5 m w as. w mu -cwt w. ..w HOHI w w w cwt .m, m ee s .* D6 wwwm % w mtwe w e 5 3E4F 41%
,. fl. s,lps$..! . SIlli
.:lk.}j$$ )[*
tyif *l
.W ST II I 15E47 Se%
l ( CONTANMENT F ALUFC BY Sour 1CE TUW i ST 11 i in va . i is %v STul.in % .is w - l l l i Figure 1.4-5 1-18 l
l CPS IllDIVIDUAL PIANT EXAMIllATIOli EXECUTIVE
SUMMARY
1.4.4 Consistency With Other PRAg
)
l Several PRAs have been performed on a variety of plants over the years. These studies resulted in core damage frequency estimates from 2.8E-4 to 4.0E-6. Many of these studies were for PWRs. The BWR results ranged from 5.5E-5 to 4.0E-6. The CPS result of 2.6E-5 falls within both ranges. Other BWR-6 studies, including Kuosheng and Perry, ranged from 3.4E-5 to 4E-6. l l l l l l 1-19
t I i
~l I
P TilIS PAGE INTENTIONALLY LEFT BLANK l I I r
+
'l 1
r we t* -
*9--, e +r-,- * * - +ss ,- W --: --E,--,+w-- - - < - -+,e -w-v,. - -n.---- = .- w ~.v=-=e----- --A-.i---==------=*- + = - = - ~ -
- CPS INDIVIDUAL PLANT EXAMINATION DESCRIPTION
- 2. EXAMINATION DESCRIPTION 2.1 Introduction This section describes how the IPE analysis was performed in order to ensure that the objecti/es of NRC Generic Letter 88-20 were met. In addition to compliance with the Generic Letter, the IPE was developed to provide a decision optimization tool that can be used to aid in achieving corporate goals related to the continuation and enhancement of the safe, reliable, and efficient operation of the plant.
2.2 Conformance with Generic Letter and BuoDortina Hof.erial The program objectives for the CPS IPE are as follows:
- 1) Develop an overall appreciation of severe accident behavior,
- 2) Understand the most likely severe accident sequences that could occur at the Clinton Power Station,
- 3) Gain a more quantitative understanding of the overall probability of core damage and radioactive material releases, and
- 4) If indicated, reduce the overall probability of core damage and radioactive material releases by appropriate modification'to hardware and procedures.
To accomplish the IPE program objectives, a level 1 PRA was performed with containment performance analysis in accordance with Generic Letter 88-20. The evaluation was performed and controlled by a team of IP engineers intimately familiar with CPS._ An independent in-house review was performed at several key stages of the process. Review and technical advice were supplied, as necessary, by consultants. Specific information on the team makeup, structure, and experience level, and the review processes is included in Sections S.I. and 5.2. Containment 2-1 ,
CPS INDIVIDUAL PLANT EXAMINATION DESCRIPTION severe accident phenomenological issues, as identified in Generic Letter 88-20, were analyzed during the course of the CPS IPE. Other specific issues, such as unresolved safety issue (USI) A-45, " Shutdown Decay Heat Removal Requirements", were also addressed in the CPS IPE. This submittal is formatted in accordance with the guidance of NUREG-1335, " Individual Plant Examination Submittal Guidance". The CPS IPE results will be used in an Accident Management Program as guidance on this matter is developed. 2.3 General _Methodol29Y The Level 1 PRA conforms to guidelines provided in NUREG/CR-2300, "PRA Procedures Guide"; NUREG/CR-2815, "Probabilistic Safety Analysis Procedures Guide"; and NUREG-1335, " Individual Plant Examination Submittal Guidance". The following paragraphs highlight the main topics of the methodology used to perform the CPS evaluation. 2.3.1 1Ditiatino Eventa The CPS IPE study was started with a review of industry and plant-specific data to determine what occurrences can disrupt normal plant operation sufficiently to induce a plant trip. CPS Licensee Event Reports (LERs) were reviewed for events which did happen (or could have happened) at power and caused (or could have caused) a plant shutdown. Industry data included other published PRAs, NUREGs, EPRI documents, etc., in addition to domestic BWR-6 LERs. 2-2
CPS INDIVIDUAL PLANT EXAMINATION DESCRIPTION There were three phases in the initiating event identification process (1) identification of possible events as indicated above, (2) grouping of the identified events based on their similarity for modeling and impact on risk, and (3) quantification of the frequency of initiating events. The initiating events that are identified in Section 3.1 were used to develop the CPS event trees. 2.3.2 Event Trees The Level 1 event trees model the plant's major systems or functions that are available to prevent core damage for a given initiating event. Event trees generally stort with an initiating event and are logic diagrams using branches'(nodes) to depict success or failure of various systems or actions used to mitigate the effects of the initiating event. Each combination of successes and failures, called accident acquences, was evaluated to determine whether it would lead to core damage. Event trees were developed for each of the initiating event groups. The level 1 event trees address event sequences up to the point at L which core cooling is lost. The event trees are basad on the small event tree approach which includes certain operator actions, where appropriate. 2.3.3 Fault Trees In order to evaluate the branches of the event trees, system failure diagrams were developed. These diagrams of systems are called fault trees and contain detailed system failure information. Section 3.2 discusses the front-line and support l systems modeled during this study. Fault trees were developed for each of the front-line and support systems. These system fault trees were then linked to properly account for system dependencies under different initiating events. 2-3
CPS INDIVIDUAL PLANT EXAMINATION DESCRIPTZON Failure modes in the fault troen include hardware failures, ; maintenance unavailabilities, support and dependency failures, common cause failures, and human errors. In order to facilitate future applications of the IPE, maintenance unavailabilities are separated into two subgroups, preventive and corrective, either of which can rause a component to be unavailable when required during plant operation. Restoration from maintenance errors is also modeled for cases in which component non-operability is not readily apparent. The treatment of dependent failures is considered throughout the analysis. Dependencies between components tend to increase the frequency of multiple, concurrent component ~ failures. Since essentially all important accident sequences that can be postulated for nuclear reactor systems involve the hypothesized failure of multiple components, systems, and containment barriers, dependent-failure analysis is an extremely important aspect of the PRA study. Dependent failures are included in the IPE by two primary methods, fault tree linking and common cause modeling. .In addition, dependency among human failure actions is included in the sequence evaluation as discussed in Section 3.3.3.1.7. Fault tree linking ensures that all support system and front-line interconnection dependencies in each fault tree are complete. Common cause failure analysis involves defining cdditional events to be included in the system fault trees, The primary benefit from this analysis is the modeling, in the fault trees, of potential failure of redundant components from a single event.- This is a more realistic treatment of the important combinatioas ' of failures for plant I ik than one in which the failures of redundant components are assumed to be independent events. 2-4
= _ _ . _ . _ _____ _ ._ _ .._. _ _ . . _ . . _ _ _ . _ . . _ . _ _ _ _ _ _ _ _ . . . _ . _ _ _ _ _ _ _ - _
CPS INDIVIDUAL PIANT EXAMINATION DESCRIPTION common cause failure analysis used the " Multiple Grook Lotter" (HGL) model to defino conditional probabilities of the failure of additional components in a comioon causo group, given that at least one has failed. Human Hollability Analysis is necessary to considor the human tasks that are parformed under normal and abnormal operating conditions. Thu tasku considered fall into throo groups as follows:
- 1) Pro-accident errors, such as impropor calibration and failure to rostore equipment after maintenance or testing.
- 2) Operator acts of omission, which are failures to tako required actions. (Acts of commission, taking incorrect or wrong actions whero nono are required, are not modoled.)
- 3) Ropair and recovery of failed systems.
Errors might be mado during or alter maititonanco, calibration, or , tosting in the normal oporation of the plant and may occur both incido or outside the main control room. For abnormal operations, most of the safoty-eignificant arrors modolod occur in the main control room. 2.3.4 QAtA.A11glypig After the development of tho fault troos, probabilition were assigned to each of the modelod component or human failuros. Those probabilities woro required in order to datorLine the overall failuro probability of a syctom. Data for quantitativo l ovaluattan or the models woro collected at various stages of the study. Even though limited operating history for clinton was availablo, plata-specific dsta were analyzed and unod in appropriato canon. Industry generic data woro used for most compenont failure ratos. The methodology used to analyze data , 2-S l
___ ..__.__.--,_.__~.__.. _ _ ___.__.._.__ . ____. ___ CPS INDIVIDUAL PLANT EXAMINATION DESORIPT ION has been docamented in order to provide the foundation for future updates of the PRA as more plant-specific data becomms availab13.
?. 3.5 Quantifi93119D After failure probabilities are determined for each basic event, the fault tree and event tree models are solved. This is done using PCSETS. Each system is first solved with all its l dependencies. Then the event tree headings are solved by combining systems as necessary (e.g. , V [ low pressur3 injection; heading - Low Pressure Core Spray, Residual Heat Removal, Condensate, and Condensate Booster) . Then, each acquence on the event trees is solved by combining the initiation frequency with appropriate system failures and successes based on the event tree structure . SETS is also used to combine similar sequences (i.e.,
all high pressure sequences) and to apply recoveries. Recoveries include both restoration of faulted systems and power recover) based on empirical data; and use of additinnal systems per procedure, such as Control Rod Drive (CRD) and Firo rotection. Finally, SETS is used to create cutsets which are , ported into the CAFTA cutuet editor for review and evaluati0n , 2.3.6 Containment Analysis The general approach in the containment analysis is the simplified containt.ent performance methodology discussed in EPRI RP 3114-29, Geno-ic Framework for Individual Plant Examination (IPE) back-end (level 2) analysis". This methodology starts with a review of the plant conditions existing in the various level 1 l event tree ered states that identify core damage. These end states were than grouped (binned) by common thermal-hydraulic, l equipment availability and timing characteristics. Tlua various groups of level 1 event tree end states, called accident classes, form the beginning states for the containment event trees (CETs). l 2-6
~,
CPS INDIVIDUAL PLANT EXAMINATION DESCRI PTION r CETs provide a quantitative logic model for examining the _ spectrum of plausible severe accident progresuions and provide g the framework for evaluating the deterministic outcomen of specific accident asquences. 4
- y. The CET structure emphasizes whet an operator can see and control rather than phenomena (e.g.c "Is reactor at high or low 1 prassure?" versus, "Does direct containment heating occur or g nut?") . Therefore, the headings on the CETs emphasize sources of l
water and metnods to control production and renoval of energy. Progression through the CETs eventually reaches a plant damage state (CET cnd state) . For seque'..cos in which containment failure occurs, the releaue moda is also determined for use in
~
the calculation of the radionoclide release source term. Release mode defines whether the release is scrubbed or not, timing of the release, and size of the release. Accident sequences are grouped by plant-damage states, and containment _ failure / release modes are combined into release categories for off-site consequence analysis. The Modular Accident Analyses Program (MAAP) was the principal tool used to determine the end state of each CET nequence. CET end states and containment release modos are discussed in more detail in the back-end analysis, Section 4.3. CETs have a structure similar to that of the level 1 ovent trees. However, the CETs begin with an end state from the level 1 analysis and represent containment performance as well as radionuclide release source term estimates resulting from containment failure. Containment phenomenology issues, including the specific issues identified in Generic Letter 88-20, Attachment 2, were evaluated for applicability to Clinton. Where applicable, they have been included in the appropriate CET headings. The present understanding of some severe accident phenomena is still limited. Therefore, the generic framework employed in this study was i 2-7
_ . _ . ~ - .. . - - - - - - - . = . - - - - - . - - - . . , l CPS INDIVIDUAL PIANT EXAMINATION DESCRII* PION i i designed to facilitato nonnitivity analynos to reflect different i viewpoints on the novoro accident phonomena. The phenomenology l 1anuon woro ovaluated in dotall, not only for applicability to l CPS, but also for the extent of tho impact of cortain lunuon on the containment results. 2.3.7 Dssluiten.tAtion In order to capture the thought proconnes and methods as the ntudy progrannod, roporto woro developed during the different stagon of the ntudy. Thono reporta are referred to an interim products and include the following: Initiating Evonto Hoport Event Troo Hoport Syntom Pault Tree Report Data Analynia Report Quantification Roport Containment Analysis Hoport System Hotobookn woro developed during the courno of the IPE to - document information unod in the study. Each of the abovo-11nted reporto has boon reviewed an doncribed in Section 5.I for accuracy and complotononu. Thono reporta form part of the nocond tier of documentation and servo as the foundation for future applications and updaton. They are ntructured specifically to document methods which can be ened for subsequent applicationn. , Information from theno reportu han boon directly used in development of thin nubmittal. 2-0
+- l 1 l CPS INDIVIDUAL PLANT EZ3MINATION DESCRIPTION 2.4 Information Assemb1v i 2.4.1 Plant Layout Clinton is a Boiling Water Reactor (BWR) rated at 2894 megawatts the rmal (MWt). It is a BWR-6 with a Mark III containment. Some of the major plant features include the following:
- Inventory Make-uo Systems
- 4 motor driven low pressure ECCS tra .. (LPCS & LPCI) rated approximately 5000 gpm each.
1 motor driven high pressure ECCS train (HPCS) rated approximately 5000 gpm. 1 steam driven high pressure system (RCIC) rated approximately 600 gpm. Feodwater delivery system consisting of 2 turbine driven and 1 motor driven pump with 4 sets of motor driven condensate / condensate booster pumps. Mpin Steam System 16 s=toty/ relief valves, 7 of which are Automatic
>$ pressurization System (ADS) Valves.
35% turbine bypass capability. Electric Power Systems l 4 off-site power circuits (3 lines at 345 kV through the switchyard and 1 line at 138 kv bypassing the switchyard). l l 3 emergency, safety-related AC buses, 3 standby diesels, l l 4 safety-related batteries. 1 L 2 non-safety-related batteries. 4 hour battery life (with load shedding). Dedicated switchyard with 2 separate buses. 2-9 , I
----c- - ,,- + --
CPS INDIVIDUAL PLANT EXAMINATION DESCRIPTION CPS Mark III Containment Steel-lined reinforced concgete centainment, with a Volume of 1,550,000 ft Drywell structure with a volume of 246,500 ft 3 enclosed by the containment. Suppression pool with a volume of 135,700 ft 3 , which communicates between the drywell and containment. 2 trains of containment spray, suppression pool cooling or shutdown heat removal. A reinforced concrete basemat of over 10 feet in depth. Various support systems which are directly necessary to support front-line system operation, including cooling water, air, room cooling, are not mentioned here explicitly but are included in the IPE model. The IPE is based on the plant as described in the USAR and currently configured and operated. 2.4.2 IPE/PRR Revity No previous PRA evaluation has been performed on CPS. However, two BWR-6 PRAs were reviewed as part of this project. These were the Kuosheng PRA and NUREG 4550 on Grand Gulf. PRAs have been previously completed for several different reactor types using different risk analysis methods. These sources were carefully screened to determine applicability of the information to Clinton. A source that was reviewed extensively throughout the IPE for applicability to Clinton was the documentation of the NRC risk study performed on Grand Gulf, another BWR-6. System comparisons between the two plants were performed and documented in the IPE system notebooks. Generally, the CPS IPE used more detailed system models incorporating more common cause failures, human , Lctions, and support system dependencies. Several balance of 2-10
CPS INDIVIDUAL PLANT EXAMINATION DESCRIPTION plant (BOP) syntom modola were constructed for CPS that the Grand Gulf study did not includo. A second important source of inf,*mation was the Boiling Water Roactor Owners Group (BWROG) IPE sabcommituoo. Sinco 1989, representativos of the four domestic BWR-6s have boon sharing IPE insights, problems, and results. Potentially significant dopondenclos or insights found at any of the BWR-6 plants woro reviewed for applicability to the other planta. If a difference was found, then the reasono for the dif ference voro determined for greator understanding. Another useful ocurce of information was an EPRI IPE Technical Ansintanco Package. This source included a'ropository of prior PRA results, including NUREG-1150, as well ao summarica of NRC reviews of earlier industry-sponsorod PRAs. The IDCOR Technical Report 86.3, "IPE Methodology", providos a source of information from previously published PRAn. Those packagos, along with the results of the Grand Gulf PRA, wor 1 referenced frequently during the course of the CPS IPE cffort. Comparisons were also made to results of PRAs that woro issued by the BWR Owners' Group and by jadividual utilities, such as the Kuosheng Nuclear Station Unit 1 PRA, mentioned previously. Reference works woro used to gain insights from the analynia techniques and assumptions used by the studios, rather than the numerical resulto. 2.4.3 R91919n29_Ro_9.Am9Atailen Documenta used during the course of thin IPE are listed below. Thoso documents are maintained either in the IPE team library, on-sito departmental librarios, or on the Illinois Power mainframo computer. 2-11
- _- -. ~- - . .- _ _ . - - - - . - - . - - . . . - _
CPS INDIVIDUAL PLANT EXAMINATION DESCnIPTION TABLE 2.4-1 REFERENCE DOCUMENTATION DOCUMENT INFORMATION i System Descriptions General System Design capabilities, Operating . Features Clinton Drawings System Components and Pipin8 and Instrument Drawings System Interconnections Electrical Drawings Vendor Drawings Master Equipment List Instrument and Equipment Lists Hardware Characteristics Maintenance Work Requests CPS-Specific Failure Data Operations Tagout Logs Systein an'd Component Unavailability data Surveillance Logs Test Frequencies Updated Safety Analysis Report Initiating Events, Success Criteria, and Plant Response - Technical Specifications Test Frequencies Procedures System Operations, Normal Maintenance Activities, Off-Normal Operator Actions, and Emergency riant Information Maintenance Licensee Event Reports, Initiating Events, Failure Post Scram Trip Reviews, and Data and Plant Response Significant Operating Event Reports Nuclear Power Reliability Generic Failure Data Data System (NPRDS) Other Reports BVR Owners Group Submittai contents, Nuclear Safety Analysis Center Organization, Guidance, , Industry Degraded Core Rulemaking and Technical Details. j Electric Power Research Instituto l NUREC (Various)
- j. Nuclear Management and Resources Council I
2-12
CPS INDIVIDUAL PLANT EXAMINATION DESCllIITION TABLE 2.4-1 (Cont'd) ILEYERLdCE DOCiffiEl[TATlQli ) DOCUMENI 11illf M TipB Computer based Modular Accident Success Criteria Analysis Prograin (MAAP) . EPRI NP 3835, "Deterialnation of Success Criteria Several IRR llcalist.ic Success Criteria for PRA" _ 2-13
CPS INDIVIDUAL PLANT EXAMINATION DESCRIPTION l l 2.4.4 Walkdowns Plant walkdowns were performed for ths IPE to verify system informe. ion accuracy, identify spatial or unusual characteristics of individual components or their locations, and identify potential recovery actions. A flooding walkdown determined both the sources and potential effects of ficoding including Interfacing System Loss of Coolant Accident (ISLOCA) effects. Internal flooding data were collected to supplement the Sargent & Lundy Internal Flooding Report. The containment and drywell walkdowns were conducted to evaluate building characteristics and validate Modular Accident Analysis Program (HAAP) parameter file information. A Human Reliability Assessment (HRA) walkdown included an expert in this field to assist the IPE team. Simulator walkdowns by a member of the IPE team and a consultant were also included for operator actions, both when an operating crew was in training and when no simulations were in progress. Documentation of observations and insights obtained during the walkdowns was accomplished mainly through the use of checklists. A walkdown report was developed from the observations of the walkdowns and includes the checklists. A videotaped recording of the containment and some of the ECCS rooms is part of the IPE reference documentation. The walkdowns provided an overall verification of system models, operator actions, and flooding events. The IPE team, located at the plant site, performed additional walkdowns as necessary to answer specific questions as they arose. The combination of interim products, referenced documents, and collective experience of the IPE team provides an excellent foundation for the IPE and future PRA analyses and applications. It is IP's intent to periodically update the CPS PRA and use it to improve plant safety and economy. 2-14
. -- , ._. ~ , - -
-- - _ --- ~- - . __ _ _ - . . _ _ , - . . - . . ..
CPS INDIVIDUAL PLANT EXAMINATION ACCIDENT SEQUENCE DELINEATION
- 3. Front-End Analysis This section contains a description of the Clinton Power Station (CPS) Level 1 Probabilistic Risk Assessmer.t (PRA). A discussion on the identification of CFJ initiating events. development of fault troos, and quantification results is included.
3.1 Accident.. Sequence Delineation 3.1.1 Initiatina Events The first step taken in the development of the CPS accident sequence definitions was the identification of initiating events. An initiating event results in a reactor tr'p,i either automatically or by manual action. A reactor trip is definel as a rapid shutdown of the reactor and does not include controlled oraerly shutdowns such as those required by technical specifications. The study considered only those events which can occur during power operation. Initiating events which have occurred during plant shutdown or refueling were also reviewed to determine if they could initiate a reactor trip during power operatior,. l The CPS Individual Plant Examination (IPE) team developed a comprehensive initiating event list to assure completeness of the CPS PRA. This list was used to define the accident sequence event trees which, in turn, were used to determine what system fault trees were necessary. The initiating event identification process began by defining the general categories of plant events to be considered as initiating events in the PRA. This task consistad of the following four sub-tasks:
- a. Developing an initiating event identification flow chart.
3-1
CPS INDIVIDUAL PLANT EXAMINATION ACCIDENT SEQUENCE DELINEATION
- b. Reviewing existing PRAs and other indus*.ry information sourCOs.
- c. Reviewing CPS operating experience and the operating experience of plants with similar design. This included a review of Licensee Event Reports (LERs) from the other domestic Boiling Water Reactor (BWR) Mark III plants; River Bend, Grand Gulf, and Perry.
i
- d. Obtaining feedback from IPE team members and plant operating '
personnel. The initiating events were then grouped based on their general effect on the plant. Initiating event grouping guidelines, shown in Table 3.1-1, were used to accomplish this task. The four categories used at C 3 are 1) loss of coolant accidents (LOCAs),
- 2) Transients, 3) Special Initiators, 4) Other. The "other" category includes anticipated transient without SCRAM (ATWS) and station blackout (SBO). The above categories were analyzed as part of the internal events PRA. External events, with the exception of internal flooding, are not part of the CPS IPE.
External events will be studied and reported separately in the CPS Individual Plant Examination for External Events (IPEEE). Critical support system failures are treated as initiating events if their failure results in a reactor trip and causes the degradation or loss of one or more front-line systems. These events are called special initiators. Critical support syatems that meet this definition include Plant Service Water (WS), Instrument Air (IA), and non-safety D.C power. A description of the front-lina and support systems is contained.in Section 3.2. Table 3.1-2 lists the initiating events in their appropriate grouping, along with the initiating event frequency. Justification for grouping the initiating events in this manner is as follows: 3-2
. _ _ _ _ _ . _ _ _ _ _ _ , - -- _-_-_ ~ .
sCPS INDIVIDUAL PLANT EXAMINATION -ACCIDENT SEQUENCE-DELINEATION 3 .1'.1.1 Loss of Coolant Accidents-(LOCAs) This category is divided into two sub-categories which have significantly different effects on plant response.- These sub-categories are Ioss of Coolant Accidents (LOCAs) which release primary system coolant inside containment and LOCAs which release primary system coolant outside containment. The initiating _ events causing a loss of primary system inventory inside containment were further sub-divided into small, medium and large break LOCAs, and inadvertent / stuck open relief valve. The subcategory of LOCA identified which would release primary ' coolant outside the containment is an interfacing system LOCA (ISLOCA). The definition of these events is as follows:
- 1. Small Break LOCA - A break in a primary system in which the capacity the Reactor Core Isolation Cooling (RCIC) system is sufficient to maintain coverage of the core.
The reactor does not rapidly depressurize.
- 2. Medium Break LOCA - A break in a primary system in which the capacity of the RCIC System is not sufficient-to maintain coverage of the core. If the High Pressure Core Spray (HPCS) system is unavailable, the reactor must be depressurized so that low pressure injection systems can be used.
- 3. Larce Break LOCA - A break in a primary system in v=ich the reactor vessel will rapidly depressurize and the low pressure injection systems are used to maintain coverage of the core.
- 4. Interfacina System LOCA - A' breach of a high-pressure to low pressure interface on; systems that connect'with the primary system and penetrate the primary containment.
3-3 l
_ ._ .. . __ _ _ . . . _ _ , . _ _ _ _ --._..m_ . _ _ _
. CPS! INDIVIDUAL PLANT EXAMINATION ACCIDENT SEQUENCE DELINEATION-
- 5. Inadvertent / Stuck Ooen Safety Relief Valve (IORVE -
While this event is initiated as a transient, it is included here because many of the characteristics of-this event are similar-to-other types of LOCAs. These events occur when a safety relief valve. opens or remains open when not required due to operator error or l equipment failure. The resulting uncontrolled steam. flow from the reactor vessel is such that the capacity of the RCIC system is insufficient to maintain coverage of the core. 3.1.1.2 Transients Transients are events in which the loss or degradation of a system or function results in a reactor SCRAM. Transients anslyzed include the following:
- 1. Loss of Off-site Power (10021 - All power to the plant from external sources (345 KV and 138 KV transmission lines) is lost due to off-site or onsite failures.
Modeling the loss of off-site power (LOOP) in this E ' manner is conservative because the, loss of the 138 KV source alone would not cause a reactor SCRAM and the safety related buses would remain' energized from the 345 KV source. The loss of=the 345 KV source alone-would lead to a reactor SCRAM, but the safety related g buses would remain energized from the 138 KV source. However, since specific data was not available to t quantify the loss of only one bus, the loss of both-sources was=modeled.- Note that this event assumes that either the division-1 or 2 diesel generator l successfully starts.and' runs. If neither succeeds then-the event is evaluated as a station blackout (SBO). 4 1
- 2. Loss of Feedwater - A transient that causcs a complete-or partial loss of Feedwater (FW) flow to the reactor
( 3-4
. CPS INDIVIDUAL PLRNT EXAMINATION ACCIDENT. SEQUENCE DELINEATION resulting in a reactor SCRAM due to low reactor water level. Events in this group include the following:
a) Loss of All Feedwater - The simultaneous loss of all main FW flow to the reactor (Except that loss of FW caused by a loss of off-site po*ar was modeled in the Loss of Off-site Power Event). b) Low Feodwater Flow - Insufficient FW flow to the I reactor for a given reactor power resulting in a SCRAM on low reactor water level. Included are all events which lead to insufficient FW flow except those which result from a loss of an operating FW pump. l c) Partial Loss of Feedwater - The loss of one FW' ! pump, one Condensate (CD) pump or one Condensate Booster (CB) pump resulting in a reduction of FW l flow to the reactor. The reactor SCRAMS on low reactor water level'.
- 3. Transients with Isolation - The isolation of the L reactor from the main condenser so that the main l condenser is not available as a heat sink for reactor vessel pressure / temperature control after a reactor SCRAM. In this situation, the safety relief valves (SRVs), RCIC, and Emergency Core Cooling (ECCS) systems are used for reactor pressure / temperature control.
Events in this group include the following: a) Main Steam Isolation Valve (MSIV) Closure - The L closure of all main steam isolation valves (MSIVs) either automatically or by operator action. I 3-5 l-
CPS INDIVIDUAL PLANT EXAMINATION ACCIDENT SEQUENCE DELINEATION b) Inadvertellt ClDmire of One liS1Y - The closure of one MSIV due to operator error or equipment failure, c) Partial MSIV Closure - The partial closure of ono MSIV due to operator error or equipment failure. d) Loss of Condensor Vacuum - Vacuum in the main condenser is lost due to equipment failuro. The MSIVs will eventually close, o) Turbine Trio with Turbine Bypass Valve Failure - An automatic or manual trip of the main turbine with the turbine bypass valves failing to open. Events included are generator load rejection and an inten>'.onal turbine trip. f) Igrbine Bypass Valves Fail Onen - The inadvertent opening of turbino bypass valvos due to equipment failure or operator error. This results in a decrease in the reactor vessel level, MSIV closure on low main stream line pressure, and reactor SCRAM. g) Turbine Pressure Reculator Failure. - The controlling pressure regulator or backup presouro regulator fails in an open or closed direction. Failure in the open direction will cause the main turbino control valves and bypass valves to open resulting in a low main steam lino pressure isolation of the main condenser. Failure in the closed direction will result in closure of the main turbino control valves and inhibit opening of the turbine bypass valves. This causes high reactor pressure. 3-6
CPS INDIVIDUAL PLANT EXAMINATION ACCIDENT SEQUENCE DELINEATION
- 4. Transients Without Isolation - The main condenser remains potentially available as a heat sink for reactor vessel pressure /temperaturc control after a reactor SCRAM. The main condenser is considered only potentially available because other failures independent of the tran'sient without isolation initiator may eventually cause a loss of the main condenser. Events in this group include:
a) Manual Shutdown - The initiation of a manual SCRAM either as required by plant events or due to operator error. b) Turbine Trin with Turbine Bvoass Valves Onen - An automatic or manual trip of the main turbine either due to equipment failure or operator error. The turbine bypass valves function as designed. Events included are generator load rejections and intentional main turbine trips, c) Reactor Recirculation Control Failure - The failure of a flow controller, either in one _ Reactor Recirculation (RR) loop or the master flow controller, causing an increase or decrease in flow to the reactor core. An increase in flow results in a high neutron flux SCRAM of the reactor. A decrease in flow results in a reactor vessel level transient with a reduction in reactor power. The main condenser remains available as a heat sink in either case, d) Trio of Both Reactor Recirculation Pumos - The simultaneous loss of both RR pumps and resultant reactor vessel level swell, l l 3-7
CPS INDIVIDUAL PLANT EXAMINATION. ACCIDENT SEQUENCE DELINEATION e) Abnormal Startuo of an Idle Reactor Recirculation Pump - An idle RR pump starts at an improper power and flow condition resulting in a neutron flux spike. f) Feedwater Flow Increase - An event that causes an inadvertent increase in FW flow at power resulting in a hign reactor vessel water level and/or neutron flux spike. g) Loss of Feedwater Heatina - The loss of FW heating such that the reactor vessel receives cooler feodwater causing an increase in reactor power. h) Inadvertent Startun of the Hich Pressure Core Sorav System - The High Pressure Core Spray (HPCS) system inadvertently starts, supplying high pressure, cold water to the reactor vessel resulting in a water level transient and possibly high neutron flux.
- 1) Rod Withdrawal at Power - This transient occurs when one or more control rods are inadvertently withdrawn when the reactor is operating.
3.1.1.3 Boecial Initiators Special Initiators are the failure of a support system which adversely affects a front-line system and results in a reactor SCRAM. Events in this category include the following:
- 1) Loss of Instrument Air - A loss of Instrument Air (IA)-
results in balance of plant (BOP) equipment and system-failures. In this case, FW control would be lost and-the reactor would automatically SCRAM on low reactor-water level. A partial loss of IA (i.e., loss of IA to 3-8
. . - . - -- = . - - -
CPS INDIVIDUAL PLANT EXAMINATION ACCIDENT SEQUENCE DELINEATION , the containment)' would result in the closure of the MSIVs, reactor SCRAM, and the loss of the main condensor as a heat sink.
- 2. Loss of Service Water - A loss of Plant Service Water (WS) causes a loss of cooling to plant components.
Various DOP equipment and system failures occur.
- 3. Ipss of Non-Safety DC Bus - This event is defined as the loss of a single bus of non-safety DC power. A loss of FW control and automatic reactor SCRAM would occur on a high or low reactor water loval.
- 4. Internal Flooding - A break in a system pipo or component which could cause flooding in an area that would disable important equipment. Flooding could also be caused by the failure to properly restore equipment after maintenance or tagging errors. A flood in one area could affect important equipment in another area.
Although internal flooding meets the definition of a special initiator, it was not treated with an ovent tree like the other special initiators because it really is a composito of many scenarios. The treatment of internal flooding is discusaed in section 3.3.8. 3.1.1.4 Qther These events are not initiating events but events that cause-a particular challenge to safety systems subsequent to or in conjunction with another initiating event. Included in this _ group are the following:
- 1. Anticioqted Transient Without SCRAM (ATWS) - The failure of the reactor to SCRAM either manually or automatically after the occurrence of another initiating event.
3-9 H
CPS INDIVIDUAL PLANT EXAMINATION ACCIDENT SEQUENCE DELINEATION
- 2. Station Blackout (SBO) - The failure of the division 1 and 2 diesel generators to start or to run af ter ,
starting concurrent with a loss of off-site power. 3.1.1.5 Ini_tL4_ tina Event Data Initiating event _ frequencies are in units of average frequency per calendar year of plant operation. Methods of estimating initiating event frequencies differ among the different categories of initiators because of plant design, plant operating history and industry experience. Some initiating events, such as anticipated transients, can be expected to occur during the life of a plant. After several years of operating experience, the initiating event frequency for these events can be derived from plant-specific data. Some initiators are less common so that a frequency based on plant specific data would not be meaningful. The frequency of some of these initiators is assumed to relate strongly to plant-specific features so that averages based on industry data are not applicable. For example, industry experience with loss of off-site power shows a correlation between the event frequency and plant exposure to severe weather as well as grid stability. The initiating event frequency for CPS was derived from industry data and the location of the CPS site. Other initiators, which are not expected to occur over the life of the plant, have little accumulated data to derive a frequency estimate. An example is a loss of coolant accident (LOCA) which has not occurred at a boiling water reactor (DNR). Therefore, LOCA frequencies are based on data from other industries. Interfacing system LOCA frequencies are based on plant-specific modeling of potential scenarios based on precursor events in nuclear plant industry experience. 3-10
CPS INDIVIDUAL PLANT EXAMINATION ACCIDENT SEQUENCE DELINEATION , i The following is a brief discussion on the derivation of initiating event frequencies used in the CPS IPE. The initiating event frequencies for the_ CPS IPE are included in Table 3.1-2. 3.1.1.5.1 Loss of Coolant Accidents (LOCA) inside Containmant ) This category includes large, medium and small LOCAs. No plant-specific or industry data exists which directly applies to the CPS IPE. Several different industry sources such as PRAs performed at other plants were reviewed to determine the source of the initiator frequencies. The initiating event frequencies in the WASH-1400, "A Reactor Safety Study", have a factor of 10 uncertainty. Since the LOCA initiators in the other reports fell within this uncertainty range and the values from WASH-1400 were used in the Grand Gulf PRA, it was decided to also use these frequencies in the CPS IPE. 3.1.1.5.2 LO9A Outside Containment l The LOCA outside containment modeled in the CPS IPE is the interfacing system LOCA (ISLOCA) . This scenario can arise only if specific combinations of component failures or human errors occur in specific plant systems.- The frequency of the scenario is estimated by modeling the series of events that must occur, assessing the likelihood of each event, and using the model to estimate-the expected frequency of the initiator. The methods of NUREG/CR-5124, " Interfacing Systems LOCA, Boiling Water Reactors", with additional input from WASH-1400, " Reactor Safety Study", the IDCOR DWR IPE Methodology (IPEM), EPRI pipe failure data, and the GESSAR PRA, were used to perform this analyr.is. The analysis began by considering the containment penetrations to identify which lines are succeptible to ISLOCA. Lines eliminated from further consideration include high energy lines, lines with a diameter of lessfthan one and one half inches, Control Rod 3-11
CPS INDIVIDUAL PLANT EXAMINATION ACCIDENT SEQUENCE-DELINEATION Drive (CRD) injection lines, lines connected to primary systems ! with a normally closed isolation valve, lines not connected to primary systems, and open ended lines that could not be overpressurized. An analyais was performed on the remaining lines to determine the ISLOCA ' initiating event frequency. Table 3.1-3 identifies those lines susceptible to ISLOCA and tho initiating event frequency for each. 3.1.1.5.3 LpJs of Of f-pite Power (If2QF1 A total loss of off-site power (LCCP) has not occurred at CPS so the frequency for this initiating event was determined using. the model and data in NUREG/CR-1032, " Evaluation of Station Blackout Accidents at Nuclear Power Plants". Supporting data from Nuclear Management and Resources Council (NUMARC) 87-00, " Guidelines and Technical Basis for NUMARC Initiative Addressing Station Blackout at Light Water Reactors," was also used. The frequency of LOOP is evaluated from the following four variables: l
- 1) Grid-related factors
- 2) Extremely severe weather factors
- 3) Severe weather factors
- 4) Plant contered factors Grid related off-site power events are those related to insufficient generation, excessive loads, or dynamic instability.
Extremely severe weather factors are the probability of storms occurring with winds greater than 125 mph. Severe weathem factors consider the probability of storms that include excessive snowfall, tornadoes, other storms with-winds between 75 and 124 mph, and salt spray. Plant-contered factors for LOOP include 3-12
CPS INDIVIDUAL PLANT EXAMINATION ACCIDENT SEQUENCE-DELINEATION ovents such as switching errors, hardware failures, design deficiencies, and local weather induced effects such as lightning strikes. The total LOOP initiating event frequency was derived by summing the frequency contributions from the four frequency factors discussed above. 3.1.1.5.4 Tranglent Initiators Transient initiating events occur with greater frequency than other initiators and are expected to occur during the life of the plaat. Plants with soveral years of operating history can derive va13d transient initiator frequency estimates based on plant-specific data. CPS has boon operating only a few years so industry data was used primarily. The CPS IPE uses data from NUREG/CR-4550, " Analysis of Core Damage Frequency Grand Gulf, Unit 1 Internal Events". The transient initiators in this report were based on industry data compiled in NUREG/CR-3862, " Development of Transient Initiating Event Frequencies foi use in Probabilistic Risk Assessments". To determine if significar.t deviations exist between these estimates and the limited CPS data, CPS-specific-initiator frequencies were derived and compared with Grand Gulf data. In each case, the industry estimates fell within the confidence bands associated with the CPS data. Table 3.l~4 contains the results of the analysis. 3-13
CPS INDIVIDUAL PLANT EXAMINATION ACCIDENT SEQUENCE DELINEATION As CPS accumulates more years of operating data, plant-specific estimates will be developed to replace the industry estimates , when the PRA is updated. 3.1.1.5.5 special InitiatoE2 Included in this category are support system failures that lead to a reactor SCRAM and cause the unavailability of front-line systems. Initiator frequencies were based on plant data, if available, or quantification of a system model. Industry data for these initiators are not easily applied because support systems have different configurations, success criteria, and operating conditions at different plants. The following is a brief discussion of the initiating event frequency for the special initiators. Loss of Plant Service Water - The Plant Service Water (WS) system i consists of three pumps which pump lake water through two strainers to cool BOP loads. Two pumps are normally running with the third in standby. The system fails if all three pumps fail. Other system failure modes include plugging of the intake travelling screens or discharge strainers. This simplified WS system model was used to determine the initiating event frequency. L l The CPS estimate is lower than the estimate in the boiling water reactor (BWR) individual plant examination methodology (IPEM). The IPEM estimate is conservative and is based on an empirical estimate _from a database with no loss of WS events occurring in I over 400 years of plant operation. Additionally, since the design of WS systems varies from plant to plant, it-is difficult to apply generic estimates to a specific plant. The Crand Gulf L analysis does not include this initiating event. l 3-14'
CPS INDIVIDUAL PLANT EXAMINATION ACCIDENT SEQUENCE DELINEATION Loss of a Non-Safety DC Bus - An ovent of this type did occur at CPS during the first year of operation. However, using one event to develop an initiator frequency would distort the event. Therefore, data from NUREG-0666, "A Probabilistic Safety Analysis of DC Power Supply Requirement for Nuclear Power Plants" was used. The values for the loss of a DC bus from a combination of hardware failures and a LOOP was combined with the loss of a DC bus due to operator and maintenance errors to arrive at an initiator frequency. Although the NUREG addresses safety-related buses, it is appropriate to use these values for the CPS IPE because the models in the NUREG are similar to the non-safety DC buses at CPS. The frequency obtained from the NUREG was increased based on the actual event that occurred at CPS. This initiator was not included in the Grand Gulf analysis.
- Loss of Instrument Air - A fault tree model was developed for the CPS Instrument Air (IA) system. This model was quantified to estimate the IA system unavailability during power operation by removing events such as LOOP which would be the result of another initiator.
The Grand Gulf analysis initiator frequency estimate was based on a simple model that assessed the probability that all the compressors in the system are unavailable. However, other failures in the system could result in a loss of IA so a frequency estimate based only on compressor failures does not accurately model the system. 3.1.2. Front-Line Event Trees Event trees are logic diagrams which depict the success or failure of various systems or actions which may result in core damage. The initiating event frequencies together with the probabilities of the system successes and failures were evaluated to determine the overall probability of core damage. 3-15
. _ ~ _ __ _ _ - -, -
CPS: INDIVIDUAL PLANT EXAMINATION ACCIDENT SEQUENCE-
. DELINEATION Pigure 3.1-1 through 3.1-17 are the event trees used to represent the CPS response to the transient and accident initiators identified in the previous section. The functional headings of the_ event trees are defined and important assumptions made in the development sf the event trees are identified in this section.
A mission time of twenty-four hours is assumed for the level 1 accident sequencoc. Many events are resolved in much less time, but systems required to operate for long periods of time will be modeled as failing if they do not operate for the entire mission time. The basis for this assumption is that after twenty-four hours the amount of decay heat that must be removed to prevent core damage has been reduced such that a significant amount of time is available to repair critical equipment. Alternate systems could also be used at this point to remove decay heat. Additionally, after twenty-four hours, a substantial amount of resources would be availabic to resolve the-problem which initially caused the scenario. Therefore, the probability of-repair or restoration of systems which failed or were unavailable { early in the event is high. Likewise, the probability that alternate systems which perform the saxe critical safety function l could be put into service is high. A twenty-four hour mission time has been used in other similar studies which have shown that there is a negligible increase in risk when the mission time is i extended beyond twenty-four hours. i 3.1.2.1 Critical Safety Functions Critical safety functions (CSFs) are defined as those conditions which, if_satisfico, limit the potential for breaching (or mitigate challenges to) the fission product barriors, namely the fuel cladding, the reactor coolant pressure boundary and the { containment. These barriers can be fulfilled by automatic i initiation of plant systems, by passive system performance, or by I operator action. ,i 3-16 ,
i CPS INDIVIDUAL PLANT EXAMINATION ACCIDENT SEQUENCE = DELINEATION This section provides a general description of each CSF considered in the CPS IPE. The CSFs that provido the framework-for the safe operation of CPS include the following:
- 1. Reactivity control
- 2. Reactor pressure vessel (RPV) pressure control
- 3. High pressure coolant injection
- 4. RPV depressurization
- 5. Low pressure coolant injection
- 6. Containment pressure control Each CSF is described below.
Reactivity Control - During postulated accident sequences, an important safety function is to insert a sufficient amount of l negative reactivity to bring the reactor subcritical. After a transient, this is normally done by automatically or manually initiating a SCRAM signal which causes the rapid insertion of control rods.
-The Reactor Protection System (RPS) and Control Rod Drive (CRD)
System are the systems designed to insert negative reactivity. Since both are highly reliable systems, reactivity control is not broken down further in the event trees except for anticipated l transient without SCRAM (ATWS). If an automatic SCRAM is not-successful, then the event is transferred to the ATWS event tree for further analysis. There are basic events for the fajlure to l SCRAM due to a mechanical failure and the failure to SCRAM due to an electrical failure. The backup for the mechanical failure is the injection of a neutron absorber solution by the Standby Liquid Control (SLC) system. The backup for the electrical ! 3-17
CPS INDIVIDUAL PLANT EXAMINATION ACCIDENT SEQUENCE DELINEATION failure is SLC and the Alternate Rod Insertion (ARI) system. The Reactor Recirculation (RR) Pump Trip (RPT) system assures that the RR pumps trip to reduce reactor power. The safety relief valves (SRVs) can be used to dump steam into the supprecsion pool if the main condenser is not available. Success for reactivity control is automatic or manual insertion of all control rods to at least positior. 00 or insertion of all except a maximum of eight rods, each at least twc enlls apart. Reactor Pressure Vessel (RPV) Pressure Control - P.eactor pressure vessel (RPV) pressure control is necessary to ensure that nuclear system pressure does not increase to the point at which the integrity of the reactor coolant pressure boundary could be lost. There are a number of transients in which the main steam isolation valves (MSIVs) close and the main co. denser is not available. The SRVs are then used to control RPV pressure. At least one of the sixteen SRVs must function to successfully control RPV pressure. Additionally, the SRVs must also close. Otherwise, the Reactor Core Isolation Cooling (RCIC) system does not have the steam pressure to enable it to make up the coolant inventory loss. If the SRVs do not close, analysis would transfer to the inadvertent / stuck open relief valve event tree. Success for pressure control is that at least one of the 16 SRV's opens to prevent reactor pressure vessel overpressurization for all initiators except ATWS. For ATWS at least four SRV's must function. Any SRVs that open must also close so that RCIC is able to function. With the MSIVs open, the Circulating Water (CW) system operating, and vacuum maintained, the turbine bypass valves may be opened to use the main condenser as a heat sink. 3-18
~ . . . - -. . .
CPS INDIVIDUAL PLANT EXAMINATION ACCIDENT SEQUENCE DELINEATION High Pressure Coolant Iniection - The high pressure coolant injection systems provide reactor coolant makeup after a transient without depressurizing the RPV. Transients such as a turbine trip will require inventory makeup at the rate of boil off from decay heat generation. Success for high pressure injection is operation of the Feedwater (FW) delivery system, the High Pressure Core Spray (HPCS), or RCIC system. If these systems do not function properly, it would be necessary to depressurize the RPV so that low pressure systems could provide makeup. Credit was also taken for the Control Rod Drive (CRD) system providing high pressure make-up after a reactor SCRAM. CRD is used only after some other system has successfully functioned for some period of time so that the decay heat generation rate is reduced. RPV Depressurization - The RPV is depressurized by manually or automatically opening SRVs so that low pressure systems can provide reactor coolant makeup. This is accomplished with the Automatic Depressurization System (ADS). One relief valve is required to function in order to successfully depressurize the reactor in time to allow low pressure systems to function preventing core damage. The relief valves are located on the Main Steam (MS) lines in the drywell and ditcharge to the
- suppression pool. In a large break loss of coolant accident
! (LOCA), the RPV would rapidly depressurize so the SRVs would not be required to function. l Emergency Operating Procedures (EOPs) direct the' operator to
-manually control reactor pressurize using SRV's if needed. The EOP's also direct the operators to inhibit ADS during an ATWS or t-l if reactor vessel water level cannot be held above the top of the l active fuel. Successful manual operation of SRVs is assumed for any event in which high pressure injection is lost and low L
3-19
CPS INDIVIDUAL PLANT EXAMINATION ACCIDENT SEQUENCE DELINEATION reactor vessel water level occurs. The functioning of an SRV when reactor pressure reaches the SRV setpoint is not affected by operating the valves manually. Low-Pressure Coolant Iniection - Lov pressure coolant injection is used following depressurization of the RPV below the maximum operating pressure for there systems, through normal cooldown, actuation of ADS or a large break LOCA. The low pressure injection systems can provide adequate core cooling once the RPV is depressurized. The systems used for low pressure coolant injection include the following:
- 1) The Residual Heat Removal (RHR) system operating in the low pressure coolant injection (LPCI) mode.
- 2) Low Pressure Core Spray (LPCS).
- 3) Condensate Booster (CB) pumps in conjunction with the Condensate (CD) pumps
- 4) CD Pumps without CB
- 5) The diesel driven fire pumps in conjunction with the Plant Service Water, (WS) Shutdown Service Water (SX) and RHR system niping and valves.
Each system can inject water into the vessel once reactor pressure is reduced to the operating range of that system. The fire pumps require several hours to align before injection into the RPV can begin. The fire pumps as an injection source are not modeled as a front-line system but are used as a recovery upon delayed failure of'other systems. 3-20
CPS INDIVIDUAL PLANT EXAMINATION ACCIDENT SEQUENCE DELINEATION Success for low pressure injection is successful operation of H LPCS or any one of the three low pressure Coolant Injection I (LPCI) traint or CD/CD. Containment Pressure Control- Containment heat removal is required to maintain containment pressure below pressure limits and ensure that containment integrity is maintained. Venting the containment is an alternate method of heat removal / pressure control. Decay heat is normally removed through the main condenser. This requires that the MSIVs remain open and the MS, CD, CD, FW, Condenser Air Removal (CA), and Circulating Water (CW) Systems be in service. If the main condenser is not available, the RHR system is used to remove decay heat. There are three operating modes of the RHR system for removing decay heat. They are shutdown cooling, suppression pool cooling, and containment spray. Once the RPV has been depressurized., the ! RHR system can be placed in shutdown cooling to remove heat from 1 the reactor core. If the dRVs were used to depressurize the reactor or if the RCIC system were in operation, then at least 4 one loop of the RHR system is aligned in the suppression pool cooling mode to remove heat from containment. If there is a large break LOCA and pressure is increasing'inside containment, the RHR system can be aligned to the containment spray mode. , Suction is taken from the suppression pool and discharged through the heat exchangers to spray headers in the containment dome. Successful decay neat removal depends on successful operation of either the Plant Service Water (WS) or Shutdown Service Water j (SX) systems. l-l Only the suppression pool cooling mode of RHR is modeled in the level 1 PRA and only as support for successful RCIC operation. The shutdown cooling mode of RHR is not included in the model because it is not needed to prevent core damage during the 24 3-21
CPS INDIVIDUAL PLANT EXAMINATION As, TDENT SEQUENCE DELINEATION hour mission time of the IPE. The containment sy.ay function is modeled in the containment analysis because its primary function is to maintain containment integrity. l Success for containment heat removal is successful operation of one train of RHR in the suppression pool cooling mode. In the event that the main condenser ano che RHR system are not available to remove heat or non-condensible gas production has resulted in increasing containment pressure, the containment must be vented to maintain integrity. There are six vent paths available but only the largest three are modeled. The other three do not have sufficient capacity, by themselves, to vent containment. The three modeled paths are l') The RHR system through the Puel Pool Cooling and Cleanup (FC) system and through the spent fuel pool, 2) The FC system through the spent fuel . pool, 3) Tnrough a hole cut in the exterior duct work in the Containment Continuous Purge systems. 3.1.2.2 Level 1 Event Ttgen For each initiating event, including Anticipateo Transient Without SCRAM (ATWS) and station blackout (SBO) identified in section 3.1.1 but r -.cluding internal flooding, -an event tree was constructed. The level 1 event trees are described below: Anticipated Transients and Special Initiators - The form of the event tree for each of these initiating events is.similar. Three of-these events which have identical structure and the corresponding figures are as follows: I Transient without Isolation (Figure 3.1-1) Loss of Feedwater (Figure 3.1-2) Loss of a non-Safety DC Bus (Figure 3.1-3) l 3-22
CPS INDIVIDUAL PLANT. EXAMINATION ACCIDENT SEQUENCE DELINEATION Once the initiating event has occurred, the reactor automatically SCRAMS. If an automatic SCRAM does not occur. the sequence transfers to the ATWS event tree. After a successful SCRAM, the event tree evaluates the availa>211ty of the main condenser as a heat sink. If the main condenser is available,_then the event tree transfers to RCIC inioction, high pressure injection, depressurization of the reactor and finally low pressure injection. If the main cond ,ser is not available, the event tree transfers to pressure cvntrol using the SRVs. After successful operation of the SRVs (success includes both opening and closing), the event tree nroceeds as above except that suppression pool cooling mus be available to support successful RCIC operation.. If no SRVs open, then the sequence transfers to the large break loss of coolant accident (LOCA) event tree because some component in the primary system will fail resulting in a loss of reactor coolant with depressurization. If a SRV opens but fails to close, then the sequence transfers to the inadvertent / stuck open relief valve event tree. There is another group of identically structured event trees in this category. These event trees and the corresponding figure numbers are as follows: Transient with Isolation (Figure 3.1-4) Loss of Instrument Air (Figure 3.1-5) Loss of Service Water (Figure 3.1-6) These~ event trees are similar to the other event trees in this
. group except that the availability of the main condenser sequence .is not included. In these events, the main steam isolation valves (MSIVs) close, isolating the reactor from the main condenser. ' Pressure is controlled with the SRVs.
Loss of Off-si*.e Power (LOOP) - Since on-site and off-site power sources havn 1 significant effect on the front-line & support systems, t! loss of of f-site power (LOOP) event tree is significancly different from other event trees (Figure 3.1-7). 3-23
y__ _ _ _ _ _ - - - _ CPS INDIVIDUAL PLANT EXAMINATION ACCIDENT SEQUENCE DELINEATION once o'f-site power is lost, the reactor automatically SCRAMS. If an automatic SCRAM does not occur, than the sequence transfers to the ATWS event tree. After a successful SCRAM, the event tree medols reactor pressure control. A branch is added which evaluates the probability that off-site power is recovered within one-half hour. If off-site power is recovered within one-half hour then the sequence transfers to the transient with isolation event tree. Industry experience shows that many LOOP events are short duration and analysis shows that core damage can be averted if injection can be started in less than a half-hour. The status of the division 1 and 2 diesel generators is then evaluated. If neither diesel generator is available then the sequence transfers to the station blackout (SBO) event tree for further analysis. If either diesel generator is available, then the LOOP event tree continues through high pressure injection with the PCIC system, with suppression pool cooling, HPCS, manual depressurization, and finally low pressure injection. System availabilities in these event trees differ depending on whether one or two diesel generators are available. The main condenser and FW delivery systems will be lost early in the event. Once off-site power is recovered, the probability of system unavailability may be different from values used earlier because operators must take actions such as starting a pump to recover lost systems. These actions are dependent on location of the equipment and plant conditions which would affect system unavabilability. While CPS recognized different ope'Itor dependencies, they could not be fully incorporated into the models. Station Blackout (SBO) - The event tree is entered from the LOOP event tree after both the division 1 and 2 diesel generators fail to start or fail to run (Figure 3.1-8). The event tree evaluates the success of HPCS providing makeup. HPCS is dependant on the 3-24
. _. ~ . __ __ . _ _ _ _. _ _ _ _ . _ . _ . . - __ - . - _ ._ _ _
CPS INDIVIDUAL PLANT EXAMINATION- ACCIDENT SEQUENCE DELINEATION: division 3 diesel generator which may_ be available under SBO
. conditions. If HPCS fails, then RCIC is evaluated. RCIC depends on only-DC power in the short term. Recovery'of off-site power and the-division 1 or 2-diesel generator is evaluated ~next=."
After recovery of off-site power, the event tree evaluates core cooling maintenanca using FW and suppression pool cooling., If these are not successful, then the reactor _is manually
-depressurized and core cooling is maintained with low pressure in.iection systems.
If off-site power is not recovered but a diesel generator is, then suppression pool cooling is placed in service. This is to support operation of RCIC. The event trees proceed as above except that FW is not'available. FW is not supported by the diesel generators. Loss of Coolant Accidents _(LOCAs) - The event trees for LOCA initiating events vary depending on the size of the pipe break. All five LOCA event trees transfer to the ATWS event tree if an automatic SCRAM is not successful. A description of the five event trees is as follows:
- 1. Small Break LOCA - A small break LOCA does-not depressurize-
]
the reactor to the point at which low pressure systems can provide-makeup (Figure 3.1-9). High pressure' injection _ systems initially provide makeup. If FW fails, then RCIC provides makeup with suppression pool-cooling in operation. If RCIC fails,Ethen HPCS provides makeup. If HPCS fails, then the reactor'must_be manually'depressurized before low pressure injection systems can supply makeup.
-2. Medium Break LOCA - A medium break LOCA also does not depressurize the reactor to-the point at which low pressure injection systems can provide makeup (Figure 3.1-10). .
Additionally, RCIC does not have sufficient capacity to maintain coverage of the core. FW is not available'because 3-25
CPS INDIVIDUAL PLANT EXAMINATION ACCIDENT SEQUENCE DELINEATION makeup to the condenser maybe insufficient. Therefore, the medium break LOCA is similar to the small break LOCA event tree except FW, RCIC and suppression pool cooling are not included.
- 3. Laroe Break LOCA - A large break LOCA depressurizes the reactor to the point which low pressure injection systems can provide makeup (Figure 3.1-11). HPCS can also supply makeup. The large break LOCA is similar to the medium break LOCA except that manual depressurizatica of the reactor is not required.
- 4. Interfacina System LOCA - An interfacing system LOCA does not depressurize the reactor to the point at which low pressure injection systems can provide makeup (Figure 3.1-12). RCIC capacity is insufficient to provide makeup. The interfacing system LOCA event tree is similar to the small break LOCA event tree except that RCIC and suppression pool cooling are not included.
- 5. Inadvertent / Stuck Open Relief Valve (IORV) - An inadvertent / stuck open relief valve (IORV) results in uncontrolled steam flow to the suppression pool depressurizing the reactor. RCIC capacity is insufficient to provide make up (Figure 3.1-13). FW makeup is evaluated first. If FW is not successful, then HPCS and finally low pressure injection systems are used to provide makeup.
There is no need to depressurize before placing low pressure injection systems in service since only one SRV is needed to depressurize the reactor prior to placing these systems in ; service. Antiginated Transients without SCRAM (ATWS) - All of the event l trees except station black out transfer to the ATWS event trees ) on a failure to SCRAM (Figures 3.1-14 through 3.1-17). The j frequency of these initiators when coupled with the failure to 3-26
CPS INDIVIDUAL PLANT EXAMINATION ACCIDENT SEQUENCE DELINEATION insert control rods, results in initiators with a very low frequency of occurrence. However, ATWS could result in a challenge to containment in addition to the demands on the core cooling systems. The ATWS tree starts with a manual SCRAM or Alternate Rod Insertion (ARI). If these actions are successful then the event proceeds as a normal cooldown. If the reactor is not shutdown, the event tree proceeds to reactor pressure control using the safety relief valves (SRVs). If the SRVs fail to open then the event proceeds as an ATWS with a large break loss of coolant accident (LOCA). The event tree proceeds to power control even if SRV operation is not successful (open/cloce). Both branches of this event tree from this point are iden'tical. The first event under power control is Reactor Recirculatic (RR) pump trip. This action will reduce reactor power but not bring the reactor subcritical. The next event is injection of a
- r. itron absorber with the Standby Liquid Control (S LC) system.
Ir SLC is successful, the sequence continues to inhibiting the Automatic Depressurization System (ADS). If successful, the sequence continues on sheet B on a path similar to the transient _ without isolation event tree (Figure 3.1-15), except that the pressure control questions have already been evaluated and RCIC _ is not included. If ADS is not inhibited, the sequence continues on sheet C on a path similar to a large break LOCA event tree (Figure 3.1-16). If both trains of SLC are not successful, then one train of SLC is sufficient to shut down the reactor. However in this case, the operator has less time to start SLC in order to prevent containment failure. The sequence then proceeds as above through inhibiting ADS to shutdown. If SLC is not successful, then the event tree proceeds to the manual insertion of control rods. If successful, the event tree proceeds to a sequence similar to a large break LOCA. If not successful, the sequence proceeds to l 3-27
CPS INDIVIDUAL PLANT EXAMINATION ACCIDENT SEQUENCE DELINEATION short D (Figure 3.1-17). Reactor power is reduced by lowering leve4 in the reactor. The sequence then proceeds similar to a transient without isolation sequence without pressure control using SRVs or RCIC. However whether lowering reactor vessel level is successful or not, core damage is assumed to result unless the main condenser and feedwater system are available. The other branches on this sheet were retained for evaluation of potential impact on containment response. 3.1.2.3 ARD.MRiptions Below are a number of assumptions used in developing the event tree success criteria. Assumptions that apply to specific event trees are included with the specific event 'ree t to which they apply.
- 1. Low Pressure Core Spray (LPCS), High Pressure Core Spray (HPCS), and Residual Heat Removel (RHR) Pumps (in the low pressure coolant injection (LPCI) mode) do not lose suction after loss of containment heat removal or containment depressurization following containment venting or containment failure unicus the failure is in the suppression pool. If the suppression pool were at saturation conditions, analysis (USAR 6.3.1.1.3) shows that sufficient not positive auction head remains available.
- 2. Loss of the steam suppression system (i.e., bypassing the suppression pool) is postu3ated to occur only after drywell temperature reaches 700*F because of potential penetration failure. This temperature occurs only after core damage.
Loss of steam suppression could 'also be postulated to occur either by bypassing the suppression pool or by a loss of pool inventory. Bypass of the drywell at lower temperatures is not considered feasible because two vacuum breakers in ) series which are used to vent into the drywell would have to fail. Loss of suppression pool inventory, such that the i 3-28 I
CPS INDIVIDUAL PLANT EXAMINATION ACCIDENT SEQUENCE DELINEATION weir vents become uncovered, is only expected to occur if containment pressure reaches 93.75 psig. Failure of Emergency Core Cooling System (ECCS) suction piping which penetrates containment below the suppression pool water level is not considered credible because this piping is exposed to low pressure conditions and is seismically qualified. The treatment of steam suppression capability is consistent with the assumption made for Grand Gulf in NUREG/CR-4500.
- 3. The Reactor Core Isolation Cooling (RCIC) system is assumed to fail when suppression pool temperature reaches 155'F because oil temperature for the RCIC pump must be maintained below 175*F. This requirement is cont'ined a in the RCIC operating procedures and discussed in the vendor manual.
The difference in temperatures is to account for inefficiencies in the lube oil cooler heat exchanger. Net positive suction head and turbine discharge back pressure are also affected at higher temperatures. Therefore the RCIC system is assumed to fail after some period.of operation if suppression pool cooling is unavailable.
- 4. Upper pool dump is not required fce maintaining adequate net positive suction head for the Emergency Core Cooling System l (ECCS) pumps ir. the event of various loss of coolant accidents (LOCAs). A conservative calculation was performed to determine the minimum suppression pool inventory following a LOCA. This calculation assumed that the drywell volume to the top of the weir wall was completely filled with water from the suppression pool following a LOCA.
Additionally, the suppression pool inventory was assumed to be further reduced by ECCS System operat !on to restore reactor vessel inventory. This calculation proved that the supprr on pool inventory is sufficient to provide adequate NPSH _11 ECCS purps and maintain adequate weir vent coverage. 3-29
- - . - . . - - . . - . - . . . - - - . - - . - ._. - - - - ... ~ .. - - - . - . .__
CPS IllDIVIDUAL PLANT EXAMINATION ACCIDENT SEQUENCE DELINEATION
- 5. Coro damage is assumed to be averted if the cora is continuously covered to at least two-thirds the length of the active fuel. It is also assumed that core damago is averted if the duration that water level is below this limit is less than four minutes. This is based on conservative ,
calculations assuming heatup of an uncovered core with no spray or steam cooling for a decay heat level typical of conditions immediately after reactor trip. Calculations predict a small amount of cladding dan ,a (<10%) under these conditions. For some cases in which the above critoria could not be met, Modular Accident Analysis Program (h1\P) simulations were used to determine if core damage occurred, and the extent of the damage.
- 6. The amount of water required to remove decay heat two minutes after shutdown is 597.9 gallons per minute (gpm).
After 102 minutes, 200 gpm are required, and after 24.5 hours 100 gpm are required based on a simplified decay heat calcu)ation method. These flow rates were used to estabi'.sh the systens that could be used to maintain reactor' inventory under alffee.it scenarios. Subsequent MAAP simulations indicc r 9 tnat Cortrol r 2 rive (CRD) with one pump running (140 gpm 0 1000 psi) is aquate after ono hour to avert core damage, assuming ree-tor vessel level started at level 8.
- 7. Each SRV can relieve 15,086 pounds of steam per minute at 1136 psig. 1820 gallons per minute (gpm) of makeup is required to maintain reactor inventory under these l conditions. Calculations were performed to determine the number of functioning SRVs necessary to reduce reactor l
3-30 1 . , - - _ - _ - - . - _ . , -
CPS INDIVIDUAL PLANT EXAMINATION ACCIDENT SEQUENCE DELINEATION pressure. One SRV is adequate to depressurize the reactor sufficiently to allow low pressure systems (L?CS, LPcI, Condensate (CD) with condensato Dooster (CD)) to provide l adequate make-up to the reactor in time to prevent core damage.
- 8. The Cycled condensato (CY) system can prc, vide 951 gpr. to the main condenser if there is no main condenser vacuum. 1683 gpm can be provided if main condonner vacuum is present.
For events in which make-up to the main condenser, from the main steam or CY systems, is at least as great as the flow needed to the reactor, the Feedwater (FW) system is modeled into the sequer.co.
- 9. In general, the PW system to dependent upon operation of the CD and CD systems to maintain adequate not positive sur ion head at the FW pumps. CD and the CD/CD combination can supply water to the reactor if the reactor is depressurized and if a flow path through the CD, CD and.FW systems is available. With one CD pump running, up to 6000 gpm can be l-provided to the reactor at 60 poig reactor prassure. With one CD and one CD pump running, up to 9000 gpm can be provided to the reactor at 300 poig reactor pressure.
- 10. Shutdown Service Water (SX) can provide up to 1000 gpm to I the reactor through the RHR system when the reactor pressure is below 50 psig. Achieving this flow rate would requisc ,
the isolation of all other heat loads except diesel generator cooling and the control room heating, ventilating and' air conditioning (HVAC) heat exchangers. This i requirement for heat load isolation is not presently incorporated in CPS procedures so SX flow to the reactor was not modeled in the IPE. 3-31 3 I L
-_..,,.,--.____..-_._-__..,_.__,.__,,_.__.,,,m. .. ....., _,,..._ ;,__ ,.,.,, ,,,_.,--,.,_m,,'- , , , , .,,_,-,.,_,7 - ~ , ,
CPS IllDIVIDUAL PLANT EXAMINATION ACCIDENT SEQUENCE DELil4EATION
- 11. The Control 1(od Drive (CitD) and the Standby Liquid Control (SLC) syntoms can deliver water to the vennel at normal operating pronuurou. Thouo ayutoma are potential uourcou of .
high prouuura coolant injection. The CI(D nyutom'a flow rate to +-ho coro, following a roactor SCRAM, in about 140 gpm with one pump running and reactor pronouro at 1000 puig, and about 150 gpm with two pumpu running. Thora la not a significant incronuo in flow with two pumpu in operation tocauno of high flow runintance in the linou. The SLC purrn can each provido approximately 42 gpm. Thono ayutoma - togethor are capablo of maintaining coolant inventory one hour after a reactor trip.
- 12. Although the ECCS logic automatically initiaton the Automatic Depronuurization Uyutom (ADS) timor on high drywell pronuuro or low reactor water levol conditions, omorgoney operating procedurou (E0pu) direct the operator to inhibit ADS during an anticipated trannient without SCHAM (ATWS) or a tranulent in which the ruactor vennel lovel cannot be maintained groator than -162.5 inchon (top of activo fuel). If deprouaurization in nubsequently required, an additional operator action lu nooded to initiate ADS or
~
to open the required number of SHVu. The annouument of the depronuurization function in tho .9S ovont treou annumou that the operator iollown proceduros and succounfully inhibita ADS.
- 13. The Fire Protection (Fp) nyutom can provido adequato flow to the reactor vousel (o.g., 600 gpm at approximately 73 pulg) to provido core cooling. The flow path in through plant Service Water (WS) to SX and IdlH. This alignmont requirou neveral hourn to accompliuh. Therefore, FP was only conuidored an a core cooling succeau path for uoquencou in which novoral houru of core cooling have boon provided by another ayutom.
3-32 . 1
_ _ , _ . . ~ _ _ _ _ . _ . _ _ _ _ _ . _ _ _ . - _ . _ _ _ . . . _ _ _ _ _ _ _ _ _ __ . CPS INDIVIDUAL PLANT EXAMINATION ACCIDENT SEQUENCE DELINEATION ,
- 14. In roma event trees, headings representing individual :
systams or groups of systems are arranged in an order that is not precisely consistent with the expected chronological order of initiation. This is done to simplify the quantification and is permissible if the reordering does not affect the success critoria for systems considered later in the event tree, i.e., no system dependencies found in the ; event troe logic. For example, in the transient without isolation event tree, the success or failure of the RCIC system is considered before the success or failure of other injection sources. This is even before FW which would normally be the first system operators would consider. The order of those systems in the event tree does not affect the core damage sequences
- and the success or failure of RCIC does not affect the other core cooling systems (Motor Driven FW pump, HPCS, LPCI, LPCS, etc.). However if core cooling systems were considered ahead of reactor SCRAM or pressure control systams (main condenser, SRVs), this would create probican in correctly evaluating core damage sequences, as the success critoria for core cooling is strongly affected by ,
the success or failure of the SCRAM and pressure control functions. 3.1.3 Special_Eygnt Trees ! Special attention van applied to the anticipated transient j without scram (ATWS) and to the station blackout (SBO) event i trees. The ATWS event tree contains more detail than most event trees because the emergency operating procedures (EOP) require a
.significant amount of operator action. These events include the various methods to control reactor power such as initiation of l Standby Liquid Control (SLC). manually inserting control rods,-
reactor water level control, and inhibiting the Automatic l i 3-33 l
CPS INDIVIDUAL PLAPT EXAMINATION ACCIDENT SEQUENCE DELINEATION Depressurization System (ADS). ATWS ovents could result in a challenge to containment in addition to the demands on core cooling. The SDO event tree evaluates various recoveries of off-site and onsite power sources before evaluating status of core cooling. This is because analysis has shown that if an injection source can Le restored in a half hour, core damage will be averted. Additionally, industry experience has shown that loss of off-site power (LOOP) events are usually of short duration. k 3.1.4 gypport System. Event TrcqR Farit tree linking was used to model the support systems and their interdependencies for the CPS PRA. Pault trees for the support systems wera developed concurrently with the front-line systems. The support system fault treu. were then linked with the front-line systems. In this way, support systems are explicitly modeled with front-line system rault trees, and no support system event trees are required. Table 3.1-5 outlines which CPS systems are considered front-line and which are considered support. Fault trees and their quantification are
~
discussed in subsequent sections of this report. p 3.1.5 gagggnce G m ping _gnd Dack-End E t.orfaces The accident sequences leading to core damage are categorized into classes and subclasses. Grouping or binning of similar core damage acquences into classes is performed based on the following criteria: Containment integrity primary system inte ity 3-34
l CPS INDIVIDUAL PLANT EXAMINATION ACCIDENT SEQUENCE DELINEATION Relativo timing of core damage. Primary system pressure Failure of critical functions leading to core damage. The core damage sequence bins used in the Clinton Power Station (CPS) Individual Plant Examination (IPE) follow the guidance contained in Nuclear Management & Resources Council (NUMARC) 91-04, " Severe Accident Issue Closure Guidelines". The core damage bins are called accident classes and serve as input to the Level 2 Containment Analysis. Table 3.1-6 illustrates the grouping process. The five classes are further divided into subclasses based upon the unavailability of key functions. Table 3.1-7 provides a description of those sub-classes. In summary, the event tree sequence end states are either a safe shutdown condition or one in which core damage occurs. The core damage sequences are binned to provide a discrete representation of the spectrum of possible core damage states. The core damage
~
classes provide the entry conditions to the containment event trees discussed in Chapter 4. 3-35
2 CPS INDIV2 DUAL PLANT EXAMINATION ACCIDENT SEQUENCE DELINEATION l TABLE 3.1-1 INITI&IING EVENT CROUPING G'JIDELINEE The following guidelinea were used to group initiating events for detailed evaluation. If any of the following criteria is met, the initiating event is put into a new group.
- 1. Plant response following the event cannot be adequately characterized by an event tree for any other initiating event.
- 2. Hitigating system requirements following the initiating event are unique.
- 3. The event directly degrades the operation of important mitigating systems (front line or support) in a manner that cannot be adequately addressed by another initiating event, j 4
- 4. The event directly degrades the operation of iaportant mitignting systems in a manner that is significantly different than for other initiating events.
- 5. Operator response to the initiating event is unique due to any of the -
following reasons: (1) plant response following the initiating event requires unique operator actions; (2) the initiating event disables instrumentation which is required for successful operator action; or (3) the initiating event changes the likelihood of successful operator performance by some other mechanism.
- 6. The event alters the physical environment in which mitigating systems or operators must function in a manner that cannot be adequately addressed by another initiating event.
*/ . The event affects the consequences of core damage in a manner that cannot be adequately addressed by an event tree for another initiating event. (Specifically, the amount of radioactive material released beyond the primary system pressure boundary, either on site or off-site, is significantly different; the timing of the release is significantly different; the systems available to prevent or mitigate a release are significantly different, etc.)
t i- 3-36 l-
. _ . _ _ _ _ _ _ _ _ > _ _ _ _ . . _ _ . _ _ . _ _ _ . . _ .. ~ ._._. -
CPS INDIVIDUAL PLANT EXAMINATION ACCIDENT SEQUENCE , DELINEATION , i TAB 12 L 1 2 > CPS _INIIIATING EVENT 1 WITil INITI6IlFC EVEh,'LfBEQHENCIES AHj} EVENT TREE DESICNATORS Initiating Event Initiatine Event Frequency *
- 1. Loss of Coolant Accidents (LDCA)
S2 - Small Break LOCA , 1.00E 03 S1 - Medium Break LOCA 3.00E-04 A - Large Break thCA 1.00E+04 T9 - Interfacing System lhCA 5.00E 06 74 - Inadvertent / Stuck Open Safety Relief Valve (10RV) 1.00F. 01
- 2. Transients TP - loss of Offsite Power (includos transients due 8.4E 02 to both external sources and onsite failures, but not station blackout)
T5 Loss of Feedwater 0.6 Total Loss of Feedwater Low Feedwater Flow Partial loss of Feedwater T3 Transient With Isolation 1.7 i Main Steam Isolation Valve (MSIV) Closure i (all MSIVs close) Inadvertent Closure of One MSIV Partial MSIV Closure Loss of Condensar Vacutun I Turbine Trip with Turbine Bypass Valve Failure (including ienerator load rejection and intentional turbine trip) Turbine Bypass Valves Fails Open Turbine Pressure Regulator Failure (open and closed)
- Per Reactor Year-o l
L 3-37 l
l CPS INDIVIDUAL PLANT EXAMINATION ACCIDENT SEQUENCE DELINEATION ' TABL.E 3.1-2 (cont.) )
.QPS INITI AllNG EVENTS VITil INITIATING EVENT FRE00ENCIES
- 2. Transients (C2.DL'.id T2 - Transient Without Isolation 4.7 l Hanual Shutdown Turbine Trip with Turbine Bypass Valves Open (including generator load rejection .
and intentional turbine trip) Reactor Recirculation Control Failure (increasing and decreasing flow) Trip of Both Reactor Recirculation Pumps i Abnormal Startup of Idle Reactor Recirculation Pump Feedwater Flow Increase i Loss of Feedwater llenting Inadvertent Startup of the liigh Pressure Core Spray System , Control Rod Withdrawal at Power
- 3. Soccini Initiators IA - Loss of Instrument Air 4.32E 03 SW less of Service Water 1.75E 03 i DC - Loss of Non Safety DC Bus 1.39E-02 4 Other ATW - Anticipated Transient Without Scram (AWS)
- TL - Station Blackout (loss of off site power with the simultaneous failure of tbo division 1 and 2 diesel generators)- ,
- There is not an initiating event for station blackout or AWS.
The station blackout event tree is entered from the loss of all off-site power event tree in the event that division I and II diesel generators do not function. The ATUS tree is entered in the case in which any other transient occurs and a. SCRAM is not .i successful. l l l l 1 i l u l; 3-38 l .- l , _ . . . . - , - . . _ _ _ _ _ . _ _ _ - . _ _ - . _ _ _ - . _ . _ _ _ . _ _ _ _ _ . _ . _ _ _ _ . _ _
l CPS INDIVIDUAL PLANT EXAMINATION ACCIDENT SEQUENCE DELINEATION TAB 1.E 3.1-3 GMh10N _IPE INT 1}tfAQJNG SYSTENS LOGA_Ilt2Qygggjgg Fragency per Lire Total Freg.ercy lyg1Chuder of Lires) (per vnt) (ter veer) LPCI Injutton Lirwe (3) 4.9E 8 1.67E 7 - LPCS In hetton Line (1) 2.86t+8 2.86t 8 Ahut&=m Coot tre Suction tirw (1) 2.54E 6 2.$4t 6 RPV Need Spray Lire (1) 4,94g.11 RCic Ptmp suction 4.5H 11 LPCI Loop B 4.11E 12 HPCS $1rw (1) 1.98E 9 , 1.9M 9 f echster Lires (2) - 2.28E 6 shutth n Cooling Return Lines (2) 3. 74t-11 3.31E 11 TOTAL ISLOCA FREQUENCY $.00E 6 t L i (. I 3-39 i
, . , _ . _ _ . . - _ , _ _ - . . - _ . . _ , .- _ . . _ - - . . . . . . _ _ . - . - . . - . ~ _ . . _ . . . _
CPS' INDIVIDUAL PLANT EXAMINATION ACCIDENT SEQUENT DELINEATION TABLE 3.1-4 COMPARISON OF INDUSTRY AND CLINTON PLANT SPECIFIC TRANSIENT FREOUENCY DATA NUREC/CR-4550 NUMBER OF EVENTS PIANT SPECIFIC 904 CONFIDENC TRANSIENT CATECORY ESTIMATE (cer vr.11 IN CLINTON DATA ESTIMATE (cer vr.11 S'TERVAL Transient Without 4.7 11 3.8 2.1, 6.3 Isolation Transient With 1.7 5 1.7 0.68, 3.6 Isolation Loss of Feedwater 0.6 1 0.34 0.018, 1.6 Inadvertent Open 0.1 0 0.17 3 --- 1.0 Relief Valve Notes:
- 1. All frequencies are per reactor year. Clinton plant data covers 11/24/87 through 7/12/90 (2.89 years).
- 2. Confidence. Interval bounds are lower and upper 95% confidence limits. No lower limit is calculable for zero events in the data.
- 3. Clinton plant-specific inadvertent open relief valve frequency estimate, based on zero events, was derived by assuming 0.5
- events" have occurred (to avoid a trivial solution), and calculating the frequsney estimate with this as the numerator.
3-40
- . . . ___ _. - .- . . . -. . - . - . _- -. ~ - - . - - . - . . - - . . _ _ CPS INDIVIDUAL PLANT EXAMINATION ACCIDENT SEQUENCE , DELINEATION l TABLE 3.1 5 l CPS FRONT-LU(EED CRITICAL GPPORT SYSTEMS l Front Line Systgag ; l
- 1. Reactor Protection System (RP) '
- 2. Main Feedwater Systers (W)
- 3. High Pressure Core Spray Systern (llP)
- 4. Reactor Core Isolation Cooling System (RI)
- 5. Low Pressure Core Spray System (LP)
- 6. Residual liest Removal system (RilR) including Low Pressure Coolant Injection (LPCI), Containment Spray, Suppression Pool Cooling, and Shutdown Cooling.
- 7. Automatic Depressurization System (ADS)
- 8. Condensate System (CD)
- 9. Condensate Booster (CB)
- 10. Standby Liquid Control System (SLC)
Critical Suncort Systems
- 1. Auxiliary AC Power System /Onsite, Offsite, Switchyard (AP/SY)
- 2. Emergency AC Power System (DC)
- 3. DC Power System (DC)
- 4. Shutdown Service Water System (SX)
- 5. Plant Service Water System (WS)
- 6. Service / Instrument Air System (SA/IA)
- 7. Coroponent Cot, ling Water System (CC)
- 8. Turbine Building Closed Cooling Water System (VT)
- 9. Essential Switchgear IIeat Remeval System (VX)
- 10. Fire Protection System (FP)
- 11. ECCS Equipment Room HVAC (VY) 3-41
i l. 4 4 CPS XNDIVIDUAL PIANT EXAMINATION ACCfDENT SEQUENCE DELINEATION Table 3.1-6 ACCIDENT SEOUENCE CLASSES ACCIDENT j . CLASS PHYSICAL BASIS REPRESENTATIVE DESICNATOR DESCRIPTION FOR CLASSIFICATION ACCIDENT SEQUENCES Class I Transients Fuel will melt rapidly if cooling Transients involving loss of high Involving Loss of systems are not recovered; pressure inventory makeup and failure Coolant. Makeup containment ic. intact at low to depressurize RPV; transients 3 pressure initially and at core melt; involving loss of b th high and low release pathway early in the event is pressure injection. from the vessel to the suppression pool through SRVs
~ Class Il Transients Fu,.1 will melt relatively slowly due Not applicable at CPS.
Involving Ioss of to lower decay heat level if cooling . Contain:nent Heat systems are not recovered; Removal containment is breached prior to core
- melt; release pathway is from the vessel to-the suppression pool through SRVs during initial stages of core damage l Class III IDCAs Fuel will relt rapidly if cooling Large and medium IDCAs with systems are not recovered; insufficient high or low pressure
- containment intact at core melt, but coolant makeup; small and medium initially at high internal pressure; IDCAs with failure of the SRVs to involves a release from the vessel to actuate and loss of high pressure the dryvell ' inventory makeup; RPV failure with ? insufficient coolant makeup Class IV ATVS Fuel vill melt rapidly if cooling Transients involving loss of SCRAM systems are not recovered; function and backup reactivity ' containment fails prior to core melt control l- due to overpressure; initial release i pathway is from the vessel to the suppression pool through SRVs 3-42
CPS INDIVIDUAL' PLANT' EXAMINATION ACCIDENT SEQUENCE 1 DELINEATION Table 3.1-6 , ACCIDENT SEOUENCE CLASSES ACCIDENT CLASS PHYSICAL BASIS REPRESENTATIVE DESIGNATOR DESCRIPTION FOR CIASSIFICATION ACCIDENI SEQUENCES 1 Class V Unisolated IDCAs Fuel vill melt rapidly if cooling IDCAs outside containment with 4- Outside systems are nat recovered; insufficient coolant makeup; j Containment containment failed from initiation of interfacing system IDCAs with j accident due to containment bypass insufficient coolant makeup j involves a release pathway from the 4 vessel which bypasses the containment i, 4 h 4 S 4 i I i e 3-43
CPS INDIVIDUAL PLANT EXAMINATION ACCIDENT SEQUENCE DELINEATION Table 3.1-7 ACCIDENT SEOUENCE SUBCLASSES ACCIDENT ACCIDENT SEQUENCE SEQUENCE CLASS SUBCLASS DEFINITION CLASS I A Accident Sequences Involving Loss of Inventory Makeup in which Reactor Pressure Remains high B Accident Sequences Involving a Loss of AC Power and Loss of Coolant Inventory Makeup C Accident Sequences Involving a
~
Failure to Scram (ATWS) with a Coincident Loss of All Inventory Makeup D Accident Sequences Involving a Loss of Coolant Inventory Makeup in which Reactor Pressure has been Successfully Reduced to Low pressure. CLASS II - Accident Sequences Involving a Loss of Containment Heat Removal CIASS III A Accident Sequences Initiated by Reactor Pressure Vessel Rupture where Containment Integrity is not Breached in the Initial Phases of the Accident B Accident Sequences Initiated or Resulting in Small or Medium LOCAs for Which the Reactor Pressure Vessel is not Depressurized C Accident Sequences Initiated cr Resulting in Medium or Large LOCAs for which the Reactor Pressure Vessel is Depressurized and All Low Pressure Injection Fails 3-44
CPS INDIVIDUAL PIANT EXAMINATION ACCIDENT SEQUENCE DELINEATION Table 3.1-7 ACCIDENT SEQUENCE SUBCLASSES ACCIDENT ACCIDENT SEQUENCE SEQUENCE CLASS SUBCLASS DEFINITION CLASS III (Cont.) D Accident Sequences which are Initiated by a LOCA or Reactor Pressure Vessel Failure and for which the Vapor suppression System has failed, Challenging the Containment Integrity CLASS IV - Accident Sequences Involving Failure to Scram and Failure to Inject Boron Leading to a High Pressure challenge to the Containment Resulting from Power Generation into the Containment. CLAGS V - Unisolated LOCA Outside Containment 3-45
} CPS INDIVIDUAL PLANT EXAMINATION ACCIDENT SEQUENCE DELINEAT".ON i
i N J Infilaron saE aCt r e t t y PatssumE CD*TodL SYS?fe$ nIsw PsES$UAE 5,5fim5 #1TM SUPPOa7 ' lcm PnE55umE sv$7EuS ACCIDENT SEDL(mCE ;SEQUEmCE infautwCv trqa mz tat j Crgirvt atfp MFQESS Class CESIGNaTQQ , teams 1ENT automatic mate sarETY SAFETY AC.IC $UPPDESSID #ISw manual ton mI t **9U T SCpau CONDf 4SEE v et, vt $ v al vE $ fe POOL PDEssunt DEpptSSuGI POES5UnE Isot aT ION . MEaf 5JMM CDEM CL OSE Mat I'iJE C T I ON Zaf10M INECTIDM da 7 / avi nE m->v at 72 Cl GP e D U2 m u at
- Om 'T2 l
OR 12/U2 i
; tu T2/u2/U ID IS/U2/U/Y 9 3SE -9 Ia f2/v2/u/mt 3. r4-6 C% T2/92
- 0* T2/52/m l Cu f2/G2/m/U l IC : T2/22/m/u/w S OtE-7 ga 72/92/m/u/=1 n.ect.7
--s 0* T2/42/U2 Det 12/G2/U2rd I
10 '2/V/c2/u/v 6 03E-7 Ia 72/G2/U2/9/u3 1 GaE-7
!DAv 72/G2/3 Toan+/En TC IDAv LLOCa 72/g2/w t eamST E R ?G LL0ta ,
4 ar.s v2/C, 3.a et. n aims . i
- i Ficure 3.1-1 Transient Without Isolation ,
Event Tree ; 3-46
CPS INDIVIDUAL PLANT EXAMINATION ACCIDENT SEQUENCE DELINEATION J 1
- =:- r ett.n } me strivu. s*s'I*s ti a2:Mw? f51At<tratktste (eta as em eatss a c:= zo ses t=s e c> rox l i-Is- pat ssf-E 5'STE*s *:?- SWOS* !I Le* N.: -sE54 m eess ems ,!:ss:3-.:n stit<t e a
1
, nu.stes e-am e :..
s:= t.r e . -.:=
- -a sr= s..c r+t,s i sn j =:1:
i$ =-n ~-= r sr:: ' m s.- set
-*w.- I wasu: t ==r sn*
t e- ; I
. i 3
i . e e e r, -t a r sI*= : t= f..rt.ts 1:st
-4 a ?
at-2.at Iu:T:> re 13 ; :=m* :3 r i j l, 1 ' i
*$ $ :3 ! C2 i w i 2 9 U2 !
- I C ! 81 ! W f i
t 1
, ; o. i, 1 . .
! :. !sm i ! I :. l rs:enu l
! ':2 ..f w a ".z. s t-,
,Ia l '5 6_; .:ent ' s est -7
, I*
Ts rW
- t. . j, s u..
4 - g j t # i
- p.
1:u:.~ 4 l t ' :: 1sem v. 3m,
!a 7
4 2 s. u. ., o. i i re -> a i : 1 I i, Da : s t&? ?ut t 1 j I i
- ts /SUc2 %
1 i
- - 1 t umr. ,. s.t-e .
t !
'ta -'tt- nr e w ssia ess-7 ,
f b ic=v f5t M /D *t.=sst= T: Inte i g
- 7 L L "lc a ?218ssft 3 T: LL CA 1
i {' ?? / 02 't i
!.<.s
; ; 3 :r .a-s<t= : .s ,
1 i e i a f i i j i I Fiqure 3.1-2 e 1 l i Loss of Feedwater Event Tree i 1 3-47 1 3
. - . ~ . - . . . , - -
4 1 1 i CPS INDIVIDUAL PIANT EXAMINATION ACCIDENT SEQUENCE DELINEATION 1 'I i I . 6 j .i B 3 Imitfa?O2 DE ACT f v! ? v ' enES$UcE Com?DCL S v5 f f #5 w!&w PLE550LE Sr5TE=5 mITrs $UFFCar (c= DetssuW Srs'te$ .aCCitEnt grQ49Ct SE 9t/E =CE F RE 3yt %C , IME as
- c' 6 CON T D0t #1?" fM 8CE SS -
Ct ass CE MLasarrn i LOS$ OF aJfDust!C waf% S AF E f t SaFEff ACIC StG#E83$13 M f Ga+ maanvat tes t
~
4 OC tt 39E - Staam CC=LE ntE n m at =E S betwf5 mph PGE stent .DiPzwS5 cal PCE S KSE i 2/2'l *E s f 5tha Opt = CLD5E = Ear ig;Ecftom Zaf!OM IAEC1:09 DE w3s at DC C1 02 m P :J2 # 5 I R1 W 3 DR DC/ud j s
- [*
. 1 O* DC!titiu [
I I_ ID .CC/'2/Uit J
- E-9 la Oc/u2/ urns e E.S !
va DC/b2 y C* CC/G2fs
, 08 OC/GJ/w/U 1 to GC/32/=h>?v a 3RE -6 4 la OC/37/#/b/bt t OSE-9 i C* OC/ M/c2 j
DE DC/CP/U2/u
} ID CC /4? f"J2 /U/W 2 t eE -6 I f
Ia OC/G2/92/u/mi 8 GSE -9
- j 102v DC/E2/p TestsFEn 73 gens noc a oc/sr/= tan =sFEn to ttoca
[ ar s cucs tsa s,En to ar.s 7 Fiqure 3.1-3 I Loss of Non-Safety DC Bus Event Tree 3 - _ ., _ _
ACCIDENT SEQUENCE CPS INDIVIDUAL PLANT EXAMINATION DELINEATION i :s: :* :e j et : :,:r :' ! -: ; =>tss; =t s = t -s .: - sm r i t:- w su sm t-s .! &::::Es* .; P+3 u:~ w:t:= f stux: ' =( u < - "aa'*= ! > i c: , u :=esw=e s3t s c.s n
.:-tows ;.s: .
i t r s tus : t e.- ji. :- :: r-sirt - i cc:: is s:c=ss:: : -:3- - Aw ^ - l t- I
' ~ a::_
. : -. , sc - - ! sirt.t
.a; 3 , s ac.-t s ;
~t a -
< :murnss.cc
- ~
i :< rma~uce::~ me
; : su s::::'
.x i
- sa .r::s ! i :st 4 ct:st ;
i Di *: < '- t 12 7 ^ c* ? ! ; c . o s . n er - > , 4 4
- - , a' s
- .3.. '
I
? ! >
1 -. 1 i \
- t... . ,
} a st ~ i
'J e = ;c -
, :A 3.'_.e t .
f i :. p ..e l i i . - w a :. t 4
..: 4 ,m .
lsm-
! 4 i :a *: 'O . J B ! ! 3 :M~5 I I t
> :c, ; r2 - -22.,srts : ::e .
\
i ; L:CA <
- a A%"f EE 'O L L C A j
' * ) ' e* 4 I
1 1
. .-s ( , :: !: .ssrt= r: . .s i !
F l 1, 1 i i Ficure 3.1-4 Transient With Isolation Event Tree 3-49
w
- CPS INDIVXDUAL PIANT EXAMINATION ACCIDENT SEQUENCE DELINEATION i
I; Sr>5<r m:'<
- z Irr.roa . atacts.riv :
eo ru m ss e c> tact es ts.,s !'-:s- racssuat s sic-s a:r- s raca
' t:= =atss e s stt-s
. - cc m ss !.:::
ieur P,
' St t m s ,?=~"~;=
i'E' "' * *
. t toss ce ; et etc sacr. sa trr .c t: it seemsst: -rw
' puiE5 -as i- tr= ! .
e scha- vaoEs
- PC'JL W ; OE M 55 Lei DaE SECE - ! -
r aat=Cu I ns.t x_ v nt vE,5 r%e:r:> zarts est : test t t war EE.Cu A
- w:r:w { 4 3rav[ i j
- . t c: j e 1 a ! - o ! is ! <
i 1
. J O*' f;& $
1 > e 4 1 > ;tu ;
! t t
" C. )in;w?a i i i 1
i ) '
} ::
, li ni-iwr t s on-e i
i I t
;& g la/=/ws: Id E-3
- ; t- liam
- j c- , u am r- , i )
l l I: ;ta.w ev/w ( < t-e I It Imrd /b/ni < c-9 I
;trs< j ram -
ima s ta r Ira. i j .LLOCa ta/= g ?Ea . *ta TC LLCCa I aims Ia/03 T*a W Ea TO A?mS t Ficure 3.1-5 i Loss of Instrument Air Event Tree 1 l 3-50
1 CPS INDIVIDUAL PLANT EXAMINATION ACCIDENT SEQUENCE DELINEATION 3 a t 4 ') IwIriarca atactrvtry possSuma etwrax *:s++ paESSvaE sysrE=s alta stcacar ' to= paESSLAE sF3rEws ' CC f CE=* ' SECRE T E StatTE rpE2. tty tota av va; CD'e f act SeSTEMS mIT* DE*M ES CLASS CEYIs%arcr. LCSS 8.V aurCwarIC taFErr SAFE?Y ACIC EUDPM SSIO N I &' paNUni I lcm SERVICE SCrisa t at vES waLwfS N PDA 8%E SSLS:E CEPAESSest . PaESSLc? WarEn ;* 2 MN CLCSE *{ a r IN'EcrIces ZarION I'ssE CrICM E-4/Rf1 M C* at SW l Cs
- P LT
- I O si W l
, on , to J Cu Sm/s L
, Cu Sulu!U ID Sm/m/u/v < E -9 i
. ta Sata /U/tt
- E-9 OK Sa /W l C* Sm AJ /O 10 : Sm/u2/UN t SAE-7 la 'S=/L2/U/tt
- E -9 f
- Imv Sm/= raavsrta re rCa< i LLCCa Sw/m rmaNSFEa 70 LLOCa arms we
- i raa w En to arms g
i 1
- Ficure 3.1-6 i Loss of Service Water l
Event Tree 3-51 I
'=
ACCIDENT SEQUENCE CPS-INDIVIDUAL' PLANT EXAMINATION DELINEATION 1 Ltko esE59pr sesf*ms aCCf 3E=f 57 3ur w'T SES.itect fetauf %v trta as eat pegssuat Ct>sf A04 *Cere goo wtse pee 55uet S*Sefet alta suppsat m a ta Ot onE SS hs55 CL 5 E*a rDA I.et T I 4?tpm etsCtretty at.tewg av f es==.,s t a CDevoot 5 ' 51r es 5-patss i cas tse ma=vM tce seDampt Oft i ce RCIC DE8*t 55te! *EE 51+.,a g L059 0F ep?cma?IC Sartf' Sart te 33 egfsEL PocL mat o f *mE 5 5L*t TMJE Cr 3 ys SCman vaivf 3 v at vt s Orf.stti CoaE $paaf 2af10m mLL 08'55* Opt a C(.CSE 8*8 8 St en st e*>w aL E PC=ER it etterter GE -2 /WV1 *f
- DG OF = Ut f* C1 m
- LE t3 *9 *s==*.iF E B 'O fas=11t=* et ta 130Laf f 0m De t'/L 3 De **P.9/s Det ' ?* dt t / * *. 9
- D M/t t d e/t t tv S OBE-F In *Fr.1/w/Vt/RS 2 Mt-T
*m Wit ti;12 Ce 19ft s!'4 2ivt I to raft e n2nus v ns-r na r,.,L uamm e sn-,
,mtm 1.a.src. to sr.,re- .t aco n 3.c
,,,, t.a-s,e= r2 no .
n:.. L(3C4 TP/m fBa>S8EW TF L&BTet LOCA a.m. ,,4r I vs s, . to . es Floure 3.1-7 Loss of Off-site Power Event Tree I 3-52 l- _ _ _ _ _ _ _.4
i CPS INDIVIDUAL PLANT EXAMI. NATION ACCIDENT SEQUENCE DELINEATION 4 Tea.sST E R WIGN PRE 55W Sv5? Ems pomEm aECDwE8* aCT!345 CDmE CCOLt=G CEpaESTUS Ctet CDDt! att !DEas? SE 3sA mCE SEQUE4CE FRE*JA=Cy tpf m en wat
# ROM LCOP esa !
- T E % ACE 2 a t t Jse meg wa!mtEen Cta55 Ok515NafDR
$?a7 ION w!GM #01C mE COVE R RE CCvCR RECtuf a SupeE55!0m FEECmaFEa m astsat (ca
- StaC*Duf pnE% sone DF F S! ? E 0:e t DIw 2 POOL +Ea7 1MCTIDM DEPatssua! pnES$ung 4 (t att* CD9E Sppay PCmEm O!E SE L CIE SE L eE=Dvat IAT*3e 1%JE C 7 IDW 3/8 78 E,EME Es f DR GEMEAdf02 TL Ut til La DG1 OG2 e2 D1 81 W Om 'TL 1
t Cur ' TL fJt 9 om 7:./us/m2 DE iL /U 3 /*2 /Q t 10 ?L/U1/m2/Gl% < E-9 4 I < E-9 la TL/01/#2/G'/El CE ?L /'J1/t d 4 Da it /U S /L a /=2 13 *L /U1/L 4 / eJ! v 4 E-@ F ta A /U t /L o r =2/ e t < E-3 On TL/UtA a/DG7 4
& C# YL /U 1/l a /8.NE.T 4 f
! 20 TL /u t 7t a /CGJ r wi/* < E -2 4
1a rL/u vL m czi.er., < E -, 1 g D* ?L /U t /L a /OG 1 8
' 10 TL /J t / . 4 /CG 3 / u < E-g ta TL rut; L 4 /CGt / u t
- E-9 4
., re it/u1/La/OGt/tG2 a ME-5 1 j I r Ig tL /tst /ul S 2aE-6 i 3 i i Fiqure 3.1-8 i, Station Blackout Event Tree l 3-53 r k
ACCIDENT SEQUENCE CPS INDIVIDUAL PLANT EXAMINATION DELINEATION I l LO= PCESSt:Ar SYSTE=S Cla55 I SE75NCE rnE9 Xv trEn c et vc1 REACTIVITV HIM PAESSUAE SYSTE=S mITM SUDPCCT *ITH SupFOmf fSFOUENCE CESIG%atCA l INITIATQA I CO** ? A OL l 5#CLESSID *IGH *ANUAL L C es i SwALL AUTOwATIC FEECnATEA CEAC?On DEenE59AI PCE S5UAE INJECTION CCAE fu PCOL PSEssumE BEE EE SCAAu MAY CCDE Socay 7ATION INJECTION LOCA {1E- ISOLATION CCOLING PEwCvAL I 3/Avi
- U1 zh v C1 G U2 l 52 C*. 52 CW S2/3 Or 52/3/m CE -
52/0/h/L1 I IIIC 52/G/a/32/v < E-9 i IIIB 'S2/ /m'U1/mi < E-9 C* SS 'G,"J2 Os 52/Gru2A.'t I IIIC SC/3/U2/U1/* ' E-9 III9 52/ 0/r ra /U I/ z * < E-9 ATm3 52/C1 TAANSFEu 70 arms Ficure 3.1-9 Small Break IDCA Event Tree 3-54
. : _ : r_ c__ __ .
ACCIDENT SEQUENCE CPS INDIVIDUAL PLANT EXAMINATION DELINEATION f ';GuE'CE FREGUENCY (CEG Cu v A) INITIATOR PEACTIVITV HIGH PAESS LOW PAESSULE SYSTEMS CLASSfSEG;ENCE CE5 I GP2 A T C4 i CC'4T ACL URE SYSTEu WITH SUPPCOT ! I i VEDIUM AUTOMATIC HIGH MANUAL LCa i PCESSup; I BAEAV SCAAM PRESSURE 'OEPRESSURI LOCA (SE- CORE SPAAY ZATION INJECTION I I 4 / A y) 1 xi l v Si l Ci U1 l ! i . I I CK S1 4 i (
'C" }Si/U1 1
i l I I l IIIr c;/g;/v 8< E_g I l i l
, \
l I IIIe Si/ui/<i l: i 34C-9 l i 1ATns '51/C: I =n..;rta Tc ATwS u I
! ! i i .
!. i I
1 l figure 3.1-10 Medium Break LOCA Event Tree l 3-55 i l l k- _ _ __
- ,il l r :
, , , ; -+ , t ) h.i, 3 t tii l!i i EN .
CO ) NI R . IT UA Y . QE X - EN A SI L A . TE E ND P E ( D Z Y C C . C N S A E w . U T G A E R O F T E :; _ C E N F . _ E U 9 S N Q E A E R S < T ,
' i A
C , ET CA NN V EG / Ur I 1 I Gg U U C EE / / / A SC A A A A 1 C 1 D I e S 1 e S C S . kr A I W aT 6 L K K I T 3 e 5 C G O I A rt - e Bn3
}
r e US N u ev SM EG c gE SE AI i r ET F a RS UT PY seSC G V L E L SE EJ W AN OE PI . LA SA Y S E' E PA ET A P N RS HU O PY GS S 2 I S IS E U T H HE P A GE R O N IA P C I HU M I A Y X T C E I L I T V O T M R 4 A N I T T vR I C A C ON CC I A C S P E T U L R A A f1 f U . D R - Z O E V T EK(I) I A GA Y D I AE A/A A N T AR I LB C4 I - N O S I L P C
CPS INDIVIDUAL PLANT EXAMINATION ACCIDENT SEQUENCE $ DELINEATION I a j.- INITIATOA GEACTIVITY C0AE COOLING SYSTEMS CLA*S SEGUENCE I SEGUENCE FAEGUENCY (PEA At tAl CONTAOL DESIGNATCA INTEAFACIN MANUAL CA FEEDWATEA HIGH MANUAL LOh G SYSTEM AUTOMATIC INJECTION PAESSUAE OEPGESSUAI PAESSUAE LOCA $CAAM COGE SPAAY ZATICN INJECTION i 4 (5. O OE-6) T9 C 01 U1 X1 '! V
.OK T9 C w. 79/Gi L , os T9/G1/ui I
'IIIC T9.G1/01/v < E-9 IIIB T9 /G1/U1/ x 2 < E-9 ATwS T9/C TAANSF2A TO ATwS i
l Ficure 3.1-12 1
. Interfacing System IDCA i Event Tree 3-57
$ ['3%f g
= .. . . . . ,
ACCIDENT SEQUENCE CPS INDIVIDUAL PLANT EXAMINATION DELINEATION HIGH PRESSUAE SYSTEMS LOW PRESSU CLASS SEGUENCE ccOUENCE FREGUENCY (PEA AX YA) l INITIATOA REACTIVITY DESIGN;.TC l CONTPOL WITH SUPPOAT RE SYSTEMS l INADVERTEf4 AUTOMATIC FEEOWATEA HIGH LOW i T OPEN SCAAM ItiJECTION PAESSUAE PRESSUAE AELIEF COAE SPAAY INJECTION VALVE 01 U1 V T4 C1 OK T4 i 1 OK T4/01 OK T4/01/U2 IIIC T4/01/U1/V 1. 06E -5 ATWS T4/C1 TRAf1SFE4 TO ATW5 l i OP.V . :4 .11 Inadves.ein open Relief Valve Event Tree 3-58
t CPS INDIVIDUAL PLANT. EXAMINATION ACCIDENT SEQUENCE I DELTNEATION-
.ma-w t . q-. ,=ss ,e-.
smeJSGDem
..c. etass s. ~ .o st - 4 ---c -t -
etsa tea *Om Teams !f =1 maatsat sa* tf e saa t t e ar cierw a s s t amos. p=E s aa le f= et semam cm = = =( s *assums sC* t+eu est vEs gigs w s ame s t amos e avec teatr re
? moo
= (2 t. I sa i opt e crosa Fat
- cD* ' era, tt gammes wg gwwavtem ea *a /syp cc.ou te esat g a v on, t a ran t s
**- cs -, .. n c, e,a ., ce
! af tasse a te e sat-a
, e a..ms ..a . .. s t . e C a v a/cs/ ag tseawe n ve s4t f C I y
e a t = /cs/cm vea.wte se s.ett e f I e av >cens/as .. we e *o s4t r c C a re/cs/CE/cra teamSFta 70 saatt? c I e avons/cansa/cs vaa=wra to e.sts o
, a ar./cs/cs van =was to 64ev e I ,,,,,,,,,,,,
a e ,,,,,,,,,3,,,,e g e afm/3/cs/rP tasepte 9914(18 I c <=amwee to s.ee , c av /cs/cs/cr/sr
, c avans/cs/ca/cra eaa-srte ec s4tv c It af e/cs/cs/ca/CFa /cs e t -6
, e avons/p ***=wta te s45 e e 1 !
c are/cs/* /ma tsawwt* Te $4t? c i y e ave /cs/en/ca vaanyta to s4f t a
'[
' I
- c ste/cs/s /ca/mi vnawsrae to s.et* c j C ates ts/*s /c2/c ia Yaanyta to s.ett c EL AFe/cs/93/c3/C2a/cs Femmyta *g set? 3
, e ar /cs/es/cs teamsate to saatti e I
c av=/cwp:/cs/sr ta.=sete to saget c , y e av./cs/en/ts/cm inanyf= to s.ett S , C sta/Cs/*s/Cs/ct/ag teamsyta te saett c j c atens/* /cs/ca/cas vaanwee to s-ett c 19 ate /Cs/n/cs./cElcts/cs < t -9
** afm/cs/ es e t-e gates et Local Fioure 3a1-14 Anticipated Transient Without Scram Event Tree-Sheet A 3-59
ACCIDENT SEQUENCE CPS INDIVIDUAL PLANT EXAMINATION -DELINEATION COAE COOLIrJG SYSTEMS CLASS SEGUENCE SEGUENCE FPEGUENCY (PEA AX Y4) TAAtiSFEA DESIGtlATOA ATwS HIGH M A Ir4 FEEDHATEA HIGH MANUAL LOW PAESSUAE T CONDENSEA INJECTIOt1 PAESSUAE DEPAESSUAI PAESSUAE AANSFER (7 HEAT SINK INJECTICt4 ZATIOr4 INJECTION
.35E-5/A()
0 U Xi V 0 G2 OK B OK 8/G OK B/0/U ID 8/0/0/V <E-1 IA B/0/U/X1 < E-9 OK B/G2 CK- B/02/U
)ID B/G2/U/V < E-9 IA '2/U/X1 < E-9 Ficure 3.I-15 Articipated. Transient Without Scram Event Tree-Sheet B 3-60 o -_ __ . . ,
' CPS INDIVIDUAL PLANT EXAMINATION ACCIDENT SEQUENCE DELINEATION TRANSFER CORE COOLING SYSTEMS CLASS SEQUENCE SEQUENCE FAEGUENCY (PE A ' AX YA)
DESIGNATOR ATWS LOW 'HIGH LOW PRESEUAE T PRESSUAE PRESSURE RANSFER (7 Ir4JECTION INJECTION
. 34E-7/ AY)
C U V DV C i j OK C/U t ID C/d/V < E-9 l t Ficure 3.1-16 Anticipated Transient Without Scram Event Tree-Sheet C 3-61
CPS INDIVIDUAL PLANT EXAMINATION . ACCIDENT SEQUENCE DELINEATION-TAANSFEA PC=En nESPONSE SYSTEWS ! CLASS SF OLE *JE SE3UENCE FCEG?KNCY (PE A C4 YAJ CONTACL lOE31GNATOA ATW$ NO ATnS MAIN FEE 0wATEA SuPPRESSIO +4 I GH AEACTGA LC= SauTD0hN T hATEA CO* CENSE A I CECTION N DOOL PAE SSJ AE DEPAESSUAI NESSUCC AANSFEA (2 LE'.EL +E A T SINK CDOL!bG I NECTION ZATION INJECTION 42E-?/AY) CONTROL 0 f H2 'G2 l G "i l O 11 V cx a IV . C./ G $ 28E-8 IV D/G/U < E-9 i
, IV C/G/U/v < E-3 l IV C/G/u/K! < E-3 IV D/3/* < E-9 IV O/G2 7 15E-e IV C/C2/U <E-9 IV D/G2/U/V < E-9 IV C/02/U/X1 < E-9
'- IV O/G2/w 5 57E-9 IV D/H1 5 45E-9 figure 3.1-17 Anticipated Transiert Without '
Scram Event Tree-Sheer. D 3-62
l CPS INDIVIDUAL PLANT EXAMINATION SYSTEMS 3.2 Rystem Analysia This section provides a brief description of front-line and support systems as well as a discussion on how they were modeled in the Clinton Power Station (CPS) Individual Plant Examination (IPE). Also included is a discussion on the methods used to ; develop this information. 3.2.1 System DescriD31gna System notebooks were developed for each of the systems modeled in the IPE. T,hese notebooks are used as a collection point for the various pieces of information which describe the function of a system as well as its effect on core dama'eg frequency. The primary documents reviewed by the IPE analysts were the CPS piping and instrumentation drawings, electrical schematics, operating procedures, system description and one-line drawings. These docu'ments describe the normal operation of the system as well as abnormal line ups that can be used to mitigate a transient. The system descriptions in the Updated Safety Analysis Report (USAR) and other design criteria and documents. were also reviewed. These information sources provide a basic understanding of system operation. The system models were reviewed by the system engineers in order to verify that modeling was correct and to incorporate insights from operations and failure history. The systems were also walked down in order to develop further insights on spatial dependencies such as room cooling, potential flooding sources, etc. A system narrative was developed using the information referenced above. This narrative is a summary and describes the specific system functions modeled in the IPE. Also included are 3-63
CPS INDTVIDUAL PLANT EXAMINATION SYSTEMS interfaces and dependencies, success criteria, and significant assumptions made in developing the system models. The following is a brief description-of systems modeled in the IPE. 3.2.1.1 Reactor Protection System (RPS). Cqn. trol Rod Drive (CRD) and Emercency Core Coolina Systems (ECCS) Initiation The Reactor Protection System (RPS) initiates a rapid insertion of control rods (SCRAM) to shutdown the reactor if monitored system variables exceed pre-established limits. This action prevents the reactor from operating under conditions which threaten the integrity of the fuel cladding', the reactor coolant pressure boundary, or the containment building. The RPS is primarily a logic system utilizing solid state components. The RPS is divided into four divisions which use four input sensor channels for each trip function (Figure 3.2-1). When more than four sensors are utilized for a trip function, the signals are combined into four input channels. Each instrument inputs to each of the divisions for that parameter. A signal from any two instruments for a parameter is required to produce a SCRAM signal (2 out of 4 logic). T'.te signal can only be reset in the main control room after 10 seconds and after the abnormal condition that initially caused the SCRAM signal is cleared (Figure 3.2-2). The RPS SCRAM signal de-energizes the A and B solenoids of the SCRAM pilot valves, SCRAM discharge volume (SDV) vent and drain pilot valves, and energizes the solenoids for the back up SCRAM valves _(Figure 3.2-3). When the SCRAM pilot solenoids are de-energized, air is rapidly vented from the Control Rod Drive (CRD) System SCRAM valves causing them'to open. The opening of the SCRAM valves results in a large differential pressure across-the CRD piston, caused by applying high pressure water on the bottom 3-64
CPS INDIVIDUAL PLANT EXAMINATION SYSTEMS of the piston and the venting of the top side to the SCRAM discharge volume. The differential pressure causes rapid insertion of control rods into the core, thereby shutting down the reactor. Section 3.2.1.10 describes CRD as an injection source. The Alternate Rod Insertion (ARI) subsystem is another method to t initiate a SCRAM independent of the RPS. The purpose of this system is to mitigate the consequences of an Anticipated Transient Without Scram (ATWS). Thc ARI-actuates on low reactor level or high reactor pressure. This system operates on a two ! out of two logic (Figure 3.2-4). When a trip signal is initiated, solenoid operated SCRAM pilot air header vent valves open to exhaust air from the pilot air head'er (the three way solenoid valve actuates to block the instrument air supply) and i actuates two solenoid operated valves per system. The pilot air header vent valves also allow air to be exhausted from the air header to the SCRAM discharge volume vent and drain valves permitting these valves to close. These actions will rapidly reduce the water pressure on the top side of the CRD piston which will permit the control rods to be inserted into the core. The ARI subsystem is modeled in the IPE with a single estimated l failure probability. The RPS system is modeled as two basic l ovents. One is the failure to SCRAM resulting from an electrical failure and the other is the failure to SCRAM resulting from a mechanical failure. The failure probability for these events was taken from NUREG/CR-4550, Analysis of-Core Damage Frequency: Grand Gulf, Unit 1 Internal Events. i I The Emergency Core Cooling Systems (ECCS) initiation system includes the automatic initiation logic for the High Pressure Core Spray (HPCS), Low Pressure Core Spray (LPCS), Residual Heat Removal .(RHR) , Reactor Core Isolation Cooling (RCIC), and diesel generators (DGs). L i i 3-65
J CPS INDIVIDUAL PLANT EXAMINATION SYSTEMS I The ECCS initiation system consists of four divisions which monitor reactor water level, and drywell and containment pressure. If abnormal conditions are detected, an initiation signal is sont to the ECCS, RCIC, _or DG systems as appropriate. The signal is sealed-in until the abnormal condition clears. LPCS and the "A" loop of RHR will automatically start in the low pressure injection (LPCI) mode if a low reactor vessel level of
-145.5" (Level 1) or high drywell pressure (1.68 psig) is detected. These paramotors are monitored by'four sensors which are physically separated from each other. These sensors are supplied by the division 1 DC bus. The output of these sensors are electrically combined in a series parallel configuration.
This arrangement precludes the possibility that one single failure will prevent or cause an initiation (Figure 3.2-5). The division 1 containment spray will initiate automatically if all of the following conditions are detected:
- 1. LPCI initiated for 10.17 minutes (either automatically or manually).
- 2. High drywell pressure (1.68 psig).
- 3. High containment pressure (22.3 psia).
Each of the above pressure paramotors is monitored by two sensors. A trip of either sensor will cause a valid signal for that parameter. This precludes the possibility that a single tailure will prevent an initiation (Figures 3.2-6 and 3.2-7). The "D" and "C" loops of RHR are initiated in the LPCI mode in a manner similar to LPCS and RHR "A". Four separate instruments are used to monitor the same parameters and are physically separated from one another. These sensors are supplied by the division 2 DC bus. The logic is also similar to division 1 (Figure 3.2-8). 3-66 I
CPS-INDIVIDUAL PLANT EXAMINATION SYSTEMS The division 2 loop of the containment spray is initiated in a manner similar to' division 1. Different instruments than those used in division 1 are used to monitor the same parameters. Those inrtruments are physically separated from one another and are fod from the division 2 DC bus. The logic in also similar to division 1 (Figuros 3.2-9 and 3.2-10). HPCS initiation occurs if a low reactor water level of -45.5" (lovel 2) or high drywell pressuro is detected. Each paramotor is monitored by four sensors which are physically and electrically separated from each other. The sensors are supplied by the Division 3 and 4 DC bussos. The output of the sensors is combined in a series-parallel combination known as one out of two taken twico logic. This logic precludes th'e single failure of one sensor from preventing an initiation signal (Figure 3.2-11). RCIC is automatically initiated if a low reactor level of -45.5" (level 2) is detected. This paramotor is monitored by four sensors which also supply the initiation logic for division 1 and 2 LPCI. The output from these consors is combinoa in a series-parallel configuration known as one out of two taken twico logic (Figure 3.2-12). The ECCS initiation system is modeled in the IPE by the transmitters which sense reactor and containment parameters. The trip modules and the rest of the circuitry are not included in the codel. This simplification is not expected to significantly affect the probability of failure because of the reliability and continual self-test feature of the solid stato logic. These initiation logic circuits were modelod'together to facilitato common cause modeling betwoon the-divisions. Additionally, only the automatic initiation logic is modeled. Manual initiation, if 4 modeled, is included with the system fault trees or in recovery actions. Finally, although drywell pressure signals were built into the models, they were later disabled for HPCS, LPCS, and LPCI initiation, in order to facilitate quantification. This 3-67
CPS INDIVIDUAL PLANT EXAMINATZON SYSTEMS deletion was shown to be acceptable by the fact that ECCS initiation. failure events are relatively unimportant in the final results. 3.2.1.2 Feedwater Deliverv System The Feedwater (FW) delivery system provides continuously purified, heated, pressurized water from the main condenser hotwell to the reactor pressure vessel (RPV) during normal plant operation. Following a reactor trip, the FW delivery system provides a source of high pressure coolant. This is the normal means of ensuring proper reactor coolant inventory control during power operation and reactor shutdown and cooldown. The systems that are included in the FW delivery system' include Condensate (CD), Condensate Polisher (CP), Condensate Booster (CB) , and FW. Four CD pumps, each rated at 33% capacity, take suction on the main condenser hotwell from a common suction header. Three of the four are normally running while the fourth is in standby. The pumps discharge water through the tube side of the steam packing exhausters, steam jet air ejectors (SJAEs) and off gas < recombiners. Finally, the discharge reaches nine condensate polishers. The condensate polishers can be bypassed and the water discharged to the suction of the CB pumps (Figure 3.2-13). The condensate polishers (Figure 3.2-14) purify the water by filtration and ion exchange and discharge to the suction of the CB pumps (Figure 3.2-15). There are four CB pumps rated at 33% capacity which discharge through tuo FW heater trains of 50% capacity each (Figure 3.2-15). Three of the four CB pumps are normally running. Each train consists of a heater drain cooler and five FW heaters. The heated water is discharged to the suction of two 50% capacity turbine' driven reactor feed pumps (TDRFP) and a 33% capacity motor driven reactor feed pump (MDRFP). 3-68
CPS INDIVIDUAL FLANT EXAMINATION SYSTEMS The feedpumps discharge into a common header which supplies two high pressure FW heaters. The FW heaters discharge into a common header and then split into two lines beforc passing through containment penetrations and to the reactor. There are two containment isolation check valves in each line, one outside containment and the other inside the drywell (Figure 3.2-16). The CD pumps can be used to inject into the RPV, when RPV pressure is less than approximately 725 psig. One pair of CD and CB pumps are used in this mode. The CD pumps can also be used to inject into the RPV if pressure is less than 250 psig. Any one of the three feedpumps can be used for decay heat removal if the main condenser is available as a heat sink. If the main condenser is unavailable, makeup to the RPV can still be provided if water from the cycled condensate storage tank is used to provide makeup to the hotwell. The FW Delivery System is modeled with two CD, two CB, and one FW pump initially running. Credit is taken for a TDRFP running only in an Anticipated Transient Without Scram (AThS) scenario. All other events rely on the MDRFP being started, because steam flow is assumed insufficient to operate the TDRFPs for the 24 hour mission time in the IPE. Also modeled is one CB and one CD pump or one CD pump providing injection if the reactor can be sufficiently depressurized. All CP flow paths have been modeled as one basic event which is several flow paths plugged. Flow diversion has also been modeled since eleven potentially significant bypass flow paths exist. These flow paths could open as result of a support system failure such as loss of Instrument Air (IA) or loss of control power. These events would cause l valves to fail open and result in diversion of flow back to the main condenser. l 3.2.1.3 Main Steam 3-69
CPS INDIVIDUAL PLANT EXAMINATION SYSTEMS The Main Steam (MS) system delivers steam from the RPV to the main turbine during normal plant operation. After a reactor SCRAM, the MS system is the preferred method of removing decay heat from the RPV via the turbine bypass valves to the main condenser. Sixteen safety relief valves are located on the four MS lines before the inboard main steam isolation valves (MSIVs). Systems required for decay heat removal include MS, Condenser Air Removal (CA) , Of f Gas (OG), Turbine Gland Seal (GS) and Circulating Water (CW). The main condenser is designed to condense the turbine exhaust steam and turbine bypass steam. It can accept up to 35% of rated steam flow through the bypass valves during normal and transient conditions. A vacuum must exist in the main condenser in order for it to perform this function. The CD, CW, and GS systems must operate successfully as well as either the CA or OG systems, to maintain condenser vacuum. The MS system consists of four main steam lines starting at the RPV, penetrating the containment with inboard and outboard MSIVs and an outboard motor operated valve (MOV). Downstream of the MOV, the lines terminate at an equalizing header thit distributes steam to the main turbine, bypass valve manifolds, steam jet air ejectors (SJAE), GS system, and TDRFPs (Figure 3.2-17). Two SJAE trains are designed to remove non-condensible gases from the main condenser and exhaust to the OG System. Only one SJAE is required during normal plant operation. Two mechanical condenser vacuum pumps are also available to establish condenser vacuum when reactor power is less than 5%. One pump is sufficient to perform this function (Figure 3.2-18). The OG system processes and controls the release of effluents from the SJAE trains. This is accomplished by processing the gases through components such as the recombiners, cooling condenser, gas dryers, charcoal adsorbers, and high efficiency 3-70
CPS I.4DIVIDUAL PLANT EXAMINATION SYSTEM 3 particulate (llEPA) filters. The OG system exhausts to the plant ventilation stack (Figure 3.1-19). The GS System is designed to prevent air leakage into and radioactive steam leakage out of the main turbine. It provides non-radioactive anal steam to the main turbine shaft glands and valve stems (main stop, control, combined stop and intercept) from the normal seal steam source (steam seal evaporator) . Heating steam is provided to the steam seal evaporator by MS or seventh Lcago extraction steam. In the event that the normal steam source is lost, seal steam can be supplied by the Auxiliary Steam (AS) boilers or directly from the MS system (Figures 3.2-20 and 3.2-21). The CW System is designed to deliver cooling water from Clinton Lake to the main condenser for condensing steam from the main turbine exhaust. The CW system is able to provide cooling water during normal and transient conditions. Although the CW System is not required to perform nuclear safety related functions, it is required when the main condenser is used as a heat sink. Four MS lines and three CW pumps are modeled in the CPS IPE. One MS line and one CW pump are necessary to remove decay heat. Additionally, one SJAE train or vacuum pump is in service to maintain condenser vacuum (Figure 3.2-22). Safety Relief Valves and the Automatic Depressurization System (ADS) are not included in this model. These are discussed in section 3.2.1.8. 3.2.1.4 Hich Prosp_4rg,_ Core BDray (}1F_qal The High Pressure Core Spray (HPCS) consists of a single motor-driven centrifugal pump which discharges through a series of valves and piping to a spray sparger located inside the reactor vessel (Refer to Figure 3.2-23). The system is designed to operate from normal off-site auxiliary power or from a i 3-71
CPS INDIVIDUAb PLANT EXAMINATION SYSTEMS dedicated standby diesel generator. A keep full system ensures that the system is full of water to eliminate water hammer and ensure immediate response on system startup. HPCS pump suction is either from the Reactor Core Isolation Cooling (RCIC) storage tank (primary source) or the suppression pool. If water level in the RCIC storage tank is low, or a high suppression pool level is detected, suction is automatically transferred to the suppression pool. The HPCS system is designed to pump water into the reactor vessel over a wide range of pressures. Flow rates vary from 467 gallons per minute (gpm) at 1177 psid to 5010 gpm at 363 psid with a total runout flow of 6400 gpm at atmospheri~c conditions. The system is designed to deliver rated flow into the reactor vessel within 27 seconds of an initiation signal. HPCS will automatically initiate on a level 2 low reactor water level signal (-45.5") or a high drywell pressure (1.68 psig). The system can also be manually initiated. When the HPCS pump receives an initiation signal, the minimum flow valve opens and diverts flow to the suppression pool. The valve closes when a normal discharge flow path is available which passes a minimum of 625 gpm. This protects the pump from damage if a normal flow path is not available. Operation of the HPCS at the rated flow rates will provide emergency core cooling, aid in reactor vessel depressurization, and maintain vessel level following a large and medium break loss of coolant accident (LOCA). The HPCS pump, motor, valves and keep full system are modeled in the CPS IPE. The initiation circuitry is modeled as part of the Emergency Core Cooling System initiation circuitry model. 3.2.1.5 Reactor Core Isolation Coolina 3-72 i l l
._________________________________________________________U
. .. _. -- . = - . __ - . -
l CPS INDIVIDUAL PLANT EXAMINATION SYSTEMS The Reactor Core Isolation Cooling (RCIC) consists of a turbine driven pump that receives its motive power from reactor decay heat and/or reactor fission steam. The steam is exhausted to the , suppression pool. The pump discharges to the reactor pressure vessel (RPV) head spray. Suction sources for the pump include the RCIC storage tank (primary source) or the suppression pool (Figure 3.2-24). RCIC will automatically initiate on a level 2 low reactor water level signal (-45.5") or high drywell pressure (1.68 psig) and supply make up water from the RCIC storage tank. The system can also be manually initiated. Injection will terminate when RPV watc; reaches +52" (level 8). When a low R'CIC storage tank level or a high suppression pool level is detected, suction will automatically switch to the suppression pool. The RCIC pump is protected by a minimum flow valve which will allow flow to the suppression pool. If RCIC pump discharge pressure is greater than 125 psig and flow is less than 120 gpm, the minimum flow valve will open. When flow reaches 240 gpe, the minimum flow valve closes. The RCIC system is designed to assure that sufficient reactor vessel water inventory is maintained so that adequate core cooling is assured. The operation of this system will prevent core damage under the following conditions:
- 1. The reactor vessel is isolated and maintained in hot standby,
- 2. The reactor vessel is isolated and coolant flow from the'Feedwater (FW) delivery system is lost.
- 3. A SCRAM is initiated due to the loss of normal FW flow and the reactor is not depressurized to the point at 3-73
CPS-INDIVIDUAL PLANT EXAMINATION SYSTEMS which the Residual Heat Removal (RHR) system can be placed in shutdown cooling. Flow from the RCIC system is sufficient to supply make up for a smalL break LOCA. The RCIC gland seal system prevents the leakage of radioactive steam past the RCIC turbine seals into the room. However, the gland seal compressor is designed to trip when reactor water level reaches level 2. The tripping of this compressor is assumed not to affect the length of time that the pump may continue to operate provided room cooling is available. The RCIC pump, tank, turbine, valves, and fill system are all modeled in the Individual Plant Examination (IPE). Initiation circuitry for RCIC is included in the Emergency Core Cooling System initiation circuitry fault tree. 3.2.1.6 Low Pressure Core Spray The Low Pressure Core Spray (LPCS) system consists of a centrifugal, four stage vertical pump that takes suction from the suppression pool. The discharge of the pump is routed into a spray sparger directly over the reactor core (Figure 3.2-25). l l The LPCS is designed to provide a high quantity of water at low pressure. The system provides about 5,000 gpm to the core and will automatically initiate when reactor pressure vessel (RPV) level reaches -145.5" (level 1) or a high drywell pressure (1.68 psig) signal is received. The system can also be initiated manually. Water cannat be. injected into the vessel until the RPV injection valve receloes an open signal. This signal is generated when RPV pressure decreases to 472 psig. Additionally, i the injection check valve will not open until LPCS pressure is ( i 1 l 3-74
CPS INDIVIDUAL-PLANT EEAMINATION SYSTEMS greater than reactor pressure. The pump is protected from damage 'when not-injecting to the RPV by a minimum flow line that allows water to be recirculated back to the suppression pool. , There are interconnections between the LPCS and the "A" train of the Residual Heat Removal (RHR) system. A suction line 'I connection between the LPCS pump suction and-the suction of the A RHR pump is provided to allow full flow RPV to RPV testing of the LPCS System. A spectacle flange is installed between the two systems when testing is not in progress. A keep full system is d shared between the LPCS and the "A" RHR systems ae are flushing lines, minimum flow lines, and test return lines. The LPCS pump, motor, and valve interdependencies are modeled where appropriate in the Individual Plant Examination. Initiation circuitry for LPCS is modeled in the Emergency Core Cooling System initiation circuitry fault tree. 3.2.1.7 Residual Heat Removal The Residual Heat Removal (RHR) is composed of three trains of safety related components. Trains "A" and "B" are able to operate in 4 modes tus follows:
- 1) low pressure coolant injection (LPCI), 2) containment spray, 3) suppression pool cooling, and 4) shutdown cooling. Train "C" will only operate in the LPCI mode.
-Each RHR Train'is independent (Fiaure 3.2-26) with the following exceptions: 1) RHR "A" and "B" trains share a common shutdown cooling suction line, 2) RHR "B" and "C" share a common power source, room cooling water supply, and a common fill pump. Junt "A"-also shares a fill system and. room cooling water supply with the Low Pressure Core Spray (LPCS) system. The LPCI mode of RHR is designed to pump. water directly fronLthe suppression pool to the' reactor core if reactor pressure is below 472 psig. When-initiated, the pumps are protected by a minimum flow line that diverts flow back to the suppression pool until the LPCI injection valve opens. The LPCI injection valve will 3-75
CPS INDIVIDUAL PLANT EXAMINATION SYSTEMS not open until it receives an open permissive signal when reactor pressure is below 472 prig. Additionally, the injection check valve will not open until RHR pressure is greater than reactor pressure. Initiation logic for LPCI is inclucod , the ECCS initiating events model. The systems can be manuuu y initiated if the pumps fail to start automatically. The containment spray mode uses the "A" or "B" RHR pump to pump water from the suppression pool through the respective heat exchanger to the containment spray header. Operation in this mode reduces temperature in the containment building. The system initiates 10 minutes after LPCI initiates and a signal for high drywell and containment pressure (1.68 and 7.6 psig respectively) is received. The delay allows LPCI to ensure that the core remains covered. Upon receipt of the initiation signal, train A will initiate immediately while train B has a 90 second delay. Containment spray can also be initiated manually. The suppression pool cooling mode is similar to the containment spray mode except that the water is discharged directly to the suppl.ssion pool. The reactor injection valves and containment spray valvis remain closed. This mode of operation removes heat from operatlan of the safety relief valves or Reactor Core Isolation Cooling (RCIC). This mode of operation must be manually initiated. The shutdown cooling mode is used to cool the reactor core when reactor pressure is below 135 psig. The "A" or "B" RHR pump takes suction from the "B" Reactor Recirculation (RR) line and discharges through the respective heat exchanger back to the reactor via the foodwater system. Shutdown cooling must be manually initiated. 3-76
CPS INDIVIDUAL PLANT EXAMINATION SYSTEMS The LPCI and suppression pool cooling modes of RHR are modeled in the front end analysis of the Individual Plant Examination. The containment spray mode-of RHR is modeled in the back end analysis. Shutdown cooling was not modeled because it is not needed to prevent core damage during the 24 hour mission time of the IPE. Automatic initiation of the RHR modes is modeled in the Emergency Core Cooling System initiation circuitry fault tree. One RHR heat exchan.qer is n1cessary to ensure propor system operation in all modes except LPCI. 3.2.1.8 hutomatic DeDressurization 8vstem (ADS) The Automatic Depressurization System (ADS) is composed of seven safety relief valves (GRVs) each with an as'sociated air accumulator; a parallel bank of twelve air amplifiers; and two divisions of backup air bottles with associated control circuitry. When open, the SRVs discharge steam from the reactor pressure vessel (RPV) to the suppression pool. The purpose of the ADS system is to reduce reactor pressure in the event of a Loss of Coolant Accident (LOCA) coincident with a failure of the High Pressure Core Spray (HPCS) system so that Low Pressure Coolant Injection (LPCI) systems are able to inject water into the RPV (Figure 3.2-26). Two low level setpoint SRVs are also included in the model because they are connected to the backup air supply. ADS control circuitry sends an open signal to both of the sole-r.; ids for each of the seven SRVs. The open signal is produced in several ways (Figures 3.2-27 and 3.2-28). If reactor level is l sensed at level 1 and level 3 concurrent with high drywell pressure, ADS will initiate 105 seconds after receiving the signal. The time delay allows HPCS to reflood the vessel. If a level 1 and level 3 low reactor water level is sensed without high drywell pressure, ADS will initiate after six minutes. This is an initiation sequence for accidents that do not involve a pipe break inside the drywell. Also included is a permissive 3-77 i
CPS INDIVIDUAL PLANT EXAMINATIO!/ SYSTEMS interlock that allows ADS to initiate after at'least one of the three Residual Heat Removal (RHR) pumpa have started in the LPCI Mode or the Low Pressure core Spray (LPCS) pump has started. In practice, the CPr EoP's direct the operators to inhibit the automatic actuation function of the ADD system. This requires ADS actuations to be manually initiated. Upon actuation an open signal is sont to both solenoids on each SRV, however only one solenoid is necessary for the SRV to open. Analysis has shown that only one of the nine modeled SRVu is required for successful system operation. The motive powoc for each SRV is provided by the Instrument Air (IA) system. The IA system pressure is raised by air amplifiers to SRV operating pressure. If the IA system is lost, each SRV is connected to one of two separate divisions of compressed air bottles. The ADS / Low Low Setpoint ( ADS /LLS) motor-operated backup air supply isolation valves can be opened from the Main control Room. Each ADS /LLS SRV has an air accumulator that will allow SRV operation if both the normal and back up air supply.woro lost. These air accumulators provide for uninterrupted operation of the SRVs in the event the motor-operated valves cannot be opened during loss of power, and allow sufficient time for operator action to manually open the valves. However, the air accumulators are assumed to be inadequate for the entire missiot. time of the SRVs and are not included in the system model as a source of compressed air. The remaining 7 SRVs are capable of being operated as power operated relief valves. These valves have air accumulators which are smaller and are not connected to the backup air supplies. The-valves will open automatically upon receipt of a high reactor pressure signal from the Nuclear Doller system. Additionally, the valves will open automatically without.the benefit of an air supply to prevent overpressurization of the RPV. These valves would be isolated from their normal sources of IA upon a level 2 low reactor water level. This level 2 signal will be present 3-78
CPS INDIVIDUAL PLANT EXAMINATION SYSTEMS under accident conditions when ADS wculd be required. Since these SRVs are not connected to the backup supply and their accumulators are not large enough to supply air for the entire mission time, they are not included in the model, 3.2.1.9 Etandby Liquid Control (SLC) System The Standby Liquid Control (S LC) System cor. cists of two injection pumps and a storage tank that contains a neutron absorber solution (sodium pentaborate). This system provides a method to shutdown the reactor if a sufficient number of control rods can not be inserted (Figure 3.2-29). A common suction header ,.mes from the storage tank and branches into two lines with a normally closed motor operated valve on each. Two parallel positive displacement pumps rated at 43 gallons per minute at 1220 psig. pump the solution into the reactor via the High Pressure Core Spray sparger. Downstream of the pumps are two explosive valves. A crosstie exists between the discharge lines upstream of the explosive valves se that flow from the pumps will reach the reactor if an explosive valve fails to open. The system can only be manually initiated. Both pumps are modeled in the Individual Plant Examination (IPE). j Successful reactor shutdown is achieved if one or both pumps operate and inject the neutron absorber solution into the reactor-pressure vessel, although the time available for the operator to manually start-this system is less if only one pump functions, t ! 3.2.1.10 Control Rod Drive'(CRD) Iniection The Control' Rod Drive (CRD) System, under normal plant operating conditions, provides a means of controlling reactor power by inserting and withdrawing control rods from the reactor core. 3-79
CPS XNDIVIDUAL PLANT EXNMINATION SYSTEMS The system consists of two 100% capacity pumps that supply water to the Hydraulic Control Units (HCUs). The HCUs are used to control the flow of water to the control rod drives (Figure 3.2-30). As part of the design, the CRD system provides a small continuous flow of purified water to the reactor vessel (approximately 47 gpm). This flow provides cooling for the CRD mechanismo. The flow of water to the reactor could be increased to approximately 150 gpm to provide makeup to the reactor. To achieve this higher _ system flow rate the sta'. - ay pump would have to be manually placed in service and flow control valves opened. If the operators took no action to increase CRD flow, CRD flow would automatically increase to approximately 140 gpm after a reactor SCRAM at rated pressure. This is the flow rate used in the IPE model. The CRD system has been modeled to provide post SCRAM flow to the reactor vessel. Other functions of the system such as level control and a source of cooling water for the Reactor Recirculation (RR) pump seals have not been modeled. 3.2.1.11 Containment Vent Capability - Emergency containment venting is used during accident conditions when all other decay heat removal mechanisms are inadequate, when primary containment pressure is well beyond calculated values for any design basis accident, when containment structural integrity 4 is directly or indirectly threatened, or as a method to reduce hydrogen concentration with the containment. The CPS containment control emergency operating procedure (EOP) directs the operator to vent the containment via any path not necessary for core 'coling when containment pressure approaches 45 psig and suppress.on pool level is less than 54 feet. If containment pressure exceeds the above limit, then the operator 3-80
CPS INDIVIDUAL PLANT EXAMINATION SYSTEMS is directed to vent via all available paths regardless of whether or not the system is necessary for core cooling. There are six possible paths to vent the containment, but only three are of sufficient size to independently vent the containment when pressurized due to decay heat, up to 40 hours following a SCRAM. The three vent paths modeled are described below. The flow path for venting containment to the spent fuel pool via the RHR system is through the containment spray sparger, through the RHR piping to the RH/FC system cross connection, through the FC system to the spent fuel pool (Figure 3.2-31). All valves that must be opened are modeled in the IPE. The flow path for venting containment to the spent fuel pool via the FC system is through the scuppers and skimmers in the upper containment pool, down the FC return header to the spent fuel pool (Figure 3.2-32). All valves that must be opened are modeled in the IPE. Both of the above paths allow the releases to be scrubbed by water in the spent fuel pool. The flot path for venting the containment through the CCP system is through the CCP system piping then through a hole cut into the duct work (Figure 3.2-56). This results in an unscrubbed release . to the atmosphere. Both Containment Guilding Ventilation (VR) l t system valves and cutting of the hole are modeled in the IPE. 3.2.1.12 gydrocen__Ionitera The Hydrogen Igniter (HI) system is used to maintain post accident hydrogen concentration below 4%. The HI system contains 115 glow plug type ignitors split into two independently powered divisions. The ignitors are located throughout the drywell and 3-81
CPS INDIVIDUAL PLANT EXAMINATION SYSTEMS containment with at least one igniter from each division located with a maximum separation distance of 30 ft. In each general area. The igr4tur system is designed to conduct a slow burn of any hydrogen present in the drywell and containment. The complete system is modeled in the IPE, 3.2.1.13 Lyxiliary AC Power System (On-site, Off-site and Switchyar41 The Auxiliary Power (AP) system at Clinton Power Station includes all major Alternating Current (AC) power supplies. Safety-related buses are supplied from two off-site power sources and three on-site diesel generators. The non-safety buses can be supplied by one off-site source and, when the unit is operating, from the output of the main generator through the unit auxiliary transformers (UATs) (Figures 3.2-53, 3.2-34, 3.2-35, and 3.2-36). After a plant trip, the non-safety buses automatically switch to the Reserve Auxiliary Transformer (RAT). Off-site power sources consist of a 345 KV switchyard feeding the RAT and a 138 KV transmission line serving the energency reserve auxiliary transformer (ERAT). The 345 KV switchyard is fed from three independent transmission lines each terminating in a breaker and a half ring bus. This provides redundancy and flexibility in switching power sources. The RAT feeds 6.9 KV non-safety and 4.16 KV non-safety and safety related buses. The 138 KV transmission line, which is fed from two different substations and is independent of the switchyard, feeds the ERAT which in turn feeds the safety-related 4.16 KV buses. The normal supply for the safety-related buses is-the RAT. If the p; is lost, the bus automatically transfers to the ERAT, if available, or to its respective diesel generator. 3-82
s CPS INDIVIDUAL PLANT EXAMINATION SYSTEMS The'onsite emergency power sources are three diesel generators with-their independent auxiliaries. The division 1 and 2 diesel generators are tandem 12 and 16 cylinder diesel engines with a generating capacity near 4 Megawatts-(MW) at 4.16 KV. The Division III diesel generator is a single 16 cylinder diesel engine with a capacity of just over 2 MW at 4.16 KV. Each diesel generator is located in an isolated room with independent fuel supplies, cooling water supp)ies, heating ventilating and air conditioning systems, air start systems and other utilities. The diesel generators wi.1 automatically start if one of the following signals is received:
- 1. Loss of off-site power
- 2. Low reactor water level (lovel 2 for Division 3, level 1 for Divinions 1 and 2)
- 3. High drywell pressure
- 4. Degraded bus voltage After each diesel generator has accelerated to approximately the rated frequency and voltage, the feed breaker will close if normal off-site power has not been restored. Each diesel generator, once started, must be manually shutdown.
The system is modeled in the IPE with the RAT and ERAT available unless a loss of off-site power (LOOP) is initiated. Auto transfer of the non-safety buses from the UATs to the RAT after a plant trip is also included in the model. 3.2.1.14 Rirect Current (DC) and Nuclear System Protection System (NSPB) Power Supplies The Direct Current (DC) power system at Clinton Power Station (CPS) consists =of six-independent 125 VDC battery systems with their chargers, motor control centers and auxiliaries. There are eight 120 volt Alternating Current (AC) buses supplied 3-83 l
cps INDIVIDUAL PLANT EXAMINATION . SYSTEMS independently by various solid-state inverters. Four of the DC and inverter supplied buses are safety related with safety related power supplies. Two additional buses are safety related, although they are supplied by multiple non-safety power sources. The remaining two buses are non-safety related (Figures 3.2-37 through 3.2-42). Each divisional battery is designed to supply all necessary loads on its bus for four hours following a loss of its AC power supply if load shedding is performed by the operators within one hour. Each battery charger is designed to supply all loads on its bus l and simultaneously charge the respective battery. The four safety related battery chargers are supplied from their respectivo divisional safety related AC sources. There are no cross connections between these buses. Ilowever the two non-nafety DC buses can be manually cross connected. ! The four safety related 120 volt AC buses supply the Nuclear System Protection System (NSPS). Each NSPS bus is supplied by its own inverter. An alternato power supply is provided from a safety related AC bus. Each inverter contains a solid state selector switch for the supply. The DC battery and inverter source is the normal supply, however the selector switch will automatically transfer to the AC source if the inverter output is unavailable or is out of specification. Additionally, there is a j manual transfer switch in the event the solid stato selector switch fails. There are two non-divisional safety related inverter supplied j buses for loads such as the main steam isolation valves and SCRAM solenoids. These buses have inverters powered by the non-safety related batteries with backup from an AC supply. These invertern have a manual transfer switch. l The last two inverter supplied buses are for balance of plant 1 ( Bop) loads, such as the process computer, and are similarly l 3-84 L-. . - - - . . - - . . - - - . . - - - . . . . . - - - . - - - -. ..-
CPS INDIVIDUAL PLANT EXAMINATION SYSTEMS supplied from the two non-safety related DC buses with a solid-state and manual bypass supplies from an AC bus. The batteries, battery chargers, and inverters systems are modeled in the Individual Plant Examination. The support systems modeled include the AC power supplies and three redundant cooling systems for each inverter. 3.2.1.15 Shutdot t Service Water System (SI) The Shutdown Service Water System (SX) provides cooling water to safety related equipment used to maintain the reactor and containment in a safe condition when the normal balance of plant (BOP) systems are not capable of performing their intended functions. Cooling loads typically served by SX include the Residual Heat Removal (RHR) heat exchangers, the emergency diesel generator heat exchangers, the RHR pump seal coolers, and numerope r.ruu sieclui;2. These coolers are used to cool areas of N06 plant where safety related equipment with significant heat loads are located. Coolers are provided in arsas such as Emergency Core Cooling System (ECCS) rooms, Reactor Core Isolation Cooling room, safety related switchgear areas, and Standby Gas Treatment Rooms. These cooling system dependencies are modeled in the Individual Plant Examination. The SX system is composed of three independent subsystems corresponding to the U ree electrical safety divisions. Each division consists of a pump that takes suction from the ulti. heat sink and pumps through basket type strainers to the cool ag loads (Figures 3.2-43 through 3.2-47). During normal plant operation, the SX system in in standby and the Plant Service Water System (WS) provides flow to each SX division through crosstie valves. Upon receipt of a Loss of , Coolant Accident (LOCA) signal (high drywell pressure or low reactor water level) the SX pumps start and the WS/SX cross tie 3-85
CPS INDIVIDUAL PLANT EXAMINATION SYSTEMS , valves close. The SX pumps will alno start upon receipt of low i header pressure signal. This would occur under loss of off-site power (Loop) conditions, for example, when the WS pumps would be ! unavailable. The pumps can also be manually started. These are the functions of the X system modeled in the Individual Plant , Examination. > The SX 9ystem also can supply coeling flow to the control room cnillers, fuel pool cooling heat exchangers and reactor recirculstion pump seals and motor bearings; and make up water to the reactor pressure vessel, suppression pool, or opent fuel pocls. These functions have not been modeled in the Individual Plant Examination. 3.2.1.16 Plant Service Water System U:8) t - The Plant Service Water (WS) system is a large capacity lake water cooling nystem that supplies cooling flow to primarily balance of plant (bop) systems. The WS system also supplies cooling flow to safet*/ related loads during normal plant operation through cross ties to the SX system (Figures 3.2-48 to 3.2-51). The system consis-:.s of three pumps which take suction from the lake and discharge into a ccamon header. Lake water flows through two strainers both of which are usually in service, and into the plant. During winter months only one pump would normally n.e required. During summer months, two pumps would normally be required for full power operation but up to three can be used. For the purposes of the Clinton Power Station IFE only one WS pump and one WS strainer is needed to supply the necessary flow to'those support systems in service. 3-86
- x. _ _ _ . . - _ _ - . _ , _ _ _ _ . _ . . _ _ . - . _ - - . . _ . - - - _ . _ . . - . _ _ . , ~ . _ . - _ _ . . ~ .
J CPS IND&VIDUAL PLANT EXAMINATION WSTEMS l 3.2.1.17 garvice Air /lustrument Air (DA/JAL The Service Air System (SA) provides a source of clean dry air to the Instrument Air System (IA) and to various other plant components. The IA system la the source of clean dry, compressed air for plant instrumentation and operation of pneumatic equipment. The system consists of three centrifugal, four stage compressors that discharge into a common header. The header discharges into three identical Service Air (SA) dryers and then into various ring headers (Refer to Figure 3.2-52). The compressors are sized so that only one compressor is necessary to supply normal system loads and maintain IA and SA system pressure between 80 and 100 psig. While one compressor is running, one of the remaining two is in standby. The third la isolated. The standby compressor will automatically start if system pressure drops below 80 poig. The dryers are dual chamber desiccant type rated at 1836 scfm at 120*F and 130 psig at a dowpoint of -40'F. If system pressure drops below 70 psig, the drying chambers isolate and an automatic bypass valva opens to prevent reducing the efficiency of the desiccant beds. The dryers are alco equipped with pre- and after-cartridge filters. The SA dryer outlet header supplies the IA ring headers on two different branches. The first branch consists of the turbine l building ring header supplying the auxiliary / fuel building ring header. The second branch consists of the radwaste ring header supplying the contTol building ring header. Containment and drywell ring head <ra are supplied from the auxiliary / fuel building ring header. The two branches are cross connected between the auxiliary / fuel building and control building ring headers. The radwaste and control building ring headers are F 3-87 i
CPS INDIVIDUAL PLANT EXAMINATION SYSTEMS equipped with auto isolation valves which close when air pressure in either header drops to 70 psig. Auto isolation valves are not provided in the turbine building or auxiliary / fuel building ring headers so that IA supplies to loads in the containment and drywell are most reliable. The three SA compressors, the SA dryers, and the ring headers are modeled in the Individual Plant Examination. 3.2.1.18 Compongpt Ccoling Water Syatem (CC) The Component Cooing Water (CC) system is a closed cooling water system consisting of three pumps and two heat exchangers which remove heat from plant equipment. Examples of served equipment include the Service Air (SA) compressors and Reactor Recirculation (RR) pump seal coolers. Plant Service Water (WS) cools the CC System (Figure 3.2-53). CC water is discharged from the three pumps into a common header. Two heat exchangers operate in parallel botseen the pump discharge header and a common system header. Two pumps are normally in service with both heat cxchangers. One pump and one heat exchanger are necessary to remove the required heat load and are modeled in the IPE. 3.2.1.19 Turbine Buildina closed Coolina Water System (WT) The Turbine building Closed Cooling Water (WT) System is a closed cooling system serving major components in the turbine building. Example components served include the Coc ansate Booster pumps and motor driven Feedwater pump. WT is cooled by Plant Service Water (Figure 3.2-54). 3-88
\
l CPS INDIVIDUAL PLANT EXAMINATION SYSTEMS Two pumps discharge to a common header which in turn discharges j to two heat exchangers. Normally one pump and one heat exchanger is required for system operation. One of each in service to remove heat loads is modeled in the IPE. 3.2.1.20 Fire Proteglion (FP) The primary purpose of the Fire Protection (PP) System is to detect and extinguish a fire throughout the plant and adjoining structures. The system consists of three diesel driven fire pumps, a keep full pump, and an extensive network of ring headers throughout the plant and site connecting to fire hose stand pipes and sprinkler systems (Figure 3.2-55). One of the diesel fire pumps is located in the make up water pumph'ouse and is normally valved out of service. The remaining two pumps, located in the scre3nhouse, will start when a drop in system pressure is detected. They can also be manually started. The FP system is cross cennected to the WS system. This cross connection allows the fire pumps to be used as a source of injection into the reactor pressure vessel. The flow path would be through FP, into WS and into SX and finally into RHR. A check valve between the VE ind FP system would need to be disassembled to use this injectit.4 iiurce. This is the only function of the FP system modeled in the Individual Plant Examination. 3.2.1.21 Containment Isolation The Containment and Reactor Vessel Isolation Control (CRVIC) system providen the instrumentation required to actuate the closure of containment isolation valves in the event of gross fuel cladding failures and/or breach of the reactor coolant pressure boundary. This prevents the gross release of radioactive material to the environment by closing isolation j valves F i lch isolate piping that penetrates primary and secondary 3-89 ,
i CPS IND8VZDUAL PLANT EXAMINATION SYSTEMS l containment and/or the drywell whanover monitored parameters l exceed limits. i During normal plant operation, the CRVIC logic systems are energized. When abnormal conditiones are detected, the associated logic channel trips to the deeneroized state and initiates group isolations. The isolation signals from the CRVIC system are assigned to 20 individual groups. Each group has specific parameters which feed its isolation logic. Groups 1 through 13 are containment , isolation, groups 14 through 18 are drywell isolation and group 19 is secondary containment isolation. Group 20 is miscellaneous valves which close on a containment isolation signal but are not containment isolation valves. Four sensor channels (one for each division) are provided for + each parameter in the group 1 Main Steam (MS) isolation logic. With one exception, these channels feed into a two out of four logic configuration resulting in closure of all inboard and outboard MSIVs. The exception is the MS line high flow trip function which has four sensors, one for each division, on each main steam line. Any two out of four on any line, will result in the closure of all MSIVs. For all remaining groups, a trip in the division 1 logic will cause closure of the outboard isolation valves and division 2 logic will close the inboard isolation valves. The logic is generally one of two taken twice. The Containment isolation is successful if either the inboard or outboard isolation valve in each line closes. The CRVIC system includes the following instrumentation-subsystems. 3-90
CPS INDIVIDUAL PLANT EXAMINATION SYSTEMS i
- 1. Reactor vessel low water level
- 2. liigh MS line radiation
- 3. liigh MS line flow
- 4. Low MS line pressure
- 5. Low main condenser vacuum
- 6. liigh MS tunnel ambient temperature
- 7. liigh turbine building area temperature
- 8. High drywell pressure
- 9. High Reactor Water Cleanup (RWCU) flow
- 10. liigh RWCU area temperature
- 11. High Residual llent Removal (RllR) system area temperature
!? Ittgh Reactor Core Isolation Cooling (RCIC) room temperature
- 13. Low RCIC steam line pressure
- 14. liigh RCIC steam linc flow
- 15. Iligh RCIC turbine diaphragm pressure
- 16. liigh RCIC steam tunnel temperature
- 17. High radiation in ventilation ayutems penetrating secondary containment
- 18. liigh containment pressure System components were included in the model if the failure could potentially disable the system. Components which have more than one failure mode which could disable the system have each failure mode modeled individually. Components whose failure rates are extremely low were not included in the model.
3.2.2 Fault TIpe Methodolony Fault trees were used in the probabilistic risk assessment (PRA) to model plant systems and to determine system failure probabilities. The fault trees were then linked together to accurately reflect intersystem dependencies. They were then quantified to determine core damage probabilities as dictated by 1 3-91
s.____._m._ CPS INDIVIDUAL PLANT EXAMINATION SYSTEMS t event tree logic. Pault troos developed for the Clinton Power F Station (CPS) Individual Plant Examination (IPE) are shown in ; Table 3.2-1. Front-line systems are generally charactorized as providing a critical safety function relating to accident mitigation. Examples include reactor depressurization or coolant injection. support systems provide functions necessary to ensure operability l of front-lino systems. System fault trees woro developed using the Electric Power Roscarch Institute (EPRI) Computer Aided Fault Tree Analysis (CAPTA) fault tree manager. Those fault trees were ' linked togethor with CAPTA and then quantified using the personal computer version of Set Equation Transformation System (PCSETS). The front-lino system fault trees were devo' loped to allow the support system fault tree to be linked directly into the logic when quantification is performed. This assures that system interdependencies are correctly modeled. A primo consideration in developing fault troos le the level of detail to be included. One critorion is the availability of reliability data for components. For examplo it is noi necessary to model a pump down to its bearings or a control circuit down to its contacts if reliability data for these smaller components are not available. If all failures of the pump and control circuit are included in one failure of interest (e.g., pump fails to start), then that is the level of detail used. l Data were also used to determine what component / failures to model based on relative importance. Faults associated with passive components, such as pipes or manual valves, were eliminated from - further consideration if, for examplo, the system contains a pump with a particular failure mode of lE-2 compared with IE-7 for pipe rupture, or 1E-5 for the manual valvo failing to remain open. These passive failure modes do not contribute 3-92
CPS INDIVIDUAL PLANT EXAMINATION SYSTEMS significantly to the system failure rate when compared to the pump failure and are excluded from the model. Transfers are used to connect different sections of a fault tree or to connect one fault tree to another. Transfers are also used to duplicato logic that may appear two or more timos in a fault troo. For any situation in which a front-lino system requires a support system in order to function correctly, a transfer from the appropriato portion of the fault tree for that support system is used. A basic event describes a component fault or human error that requires no further development. Basic events were not defined below the level of detail for which component failure data was available. For example, plant records are typically maintained for motor operated valves failing to open or closo, but not for all the specific causes of failure. Thorofore, motor operated valvos woro not modeled in detail. Each basic event was assigned a failuro probability before an estimato of the system failure probability could be determined. Generic data was used for component rollability data except for the diosol generators. Plant specific data was used for the diosol generators as well as maintenance intervals and system downtimo for the other systems. Table 3.2-2 is a summary of components and failure modos for basic events that were generally included in the fault tron models. The timo required to fail a component is an important considoration. Failure of a support requiremont such as motive or control power typically results in immodlato component failure. However, failure of support requirements such as loss of lubrication or seal failure may allow the component to operate for some period of time and accomplish its required function. To assess the affect that redundant components have on the total failure probability for a system, common cysso failure was 3-93
CPS INDIVIDUAL PLANT EXAMINATION SYSTEMS considered. The approach for modeling and quantifying common cause failures is discussed in Section 3.3.4. High Pressure core Spray (HPCS), Low Pressure core Spray (LPCS), Reactor Core Isolation Cooling-(RCIC), Alternato Rod Insertion (ARI), and Residuil Heat Removal (RHR) initiation logic were included in one model along with the auto start logic for the , ] diesel generators. The initiation logic was modeled in this manner because one train of logic produces an initiation signal ; for more than one system. This method accurately reflects system dependencies. For example Division 1, supplies an initiation 4 signal to LPCS, RHR "A", and RCIC, Division 2 supplies an initiation signal to RCIC and RHR "B", and "C" Divisions 3 and 4 provide an initiation signal to HPCS. This also facilitated common cause failure modeling for similar components. 3.2.3 Denendency >1pLtirig_e3 Dependency matrices are shown in Tables 3.2-3 through 3.2-5. Table 3.2-3 shows which initiating events have an influence on a front-line system. Table 3.2-4 shows which rront-line systems have an influence on other front-line systems. Table 3,2-5 shows which support systems have an influence on front-line systems. These tables are useful for visualizing dependencies and performing a completeness review. To ensure that all intended links between various fault trees were included in the model, a. computer program was developed that checks inputs to each gate from another fault tree to ensure that all required inputs actually exist. 3-94
CPS INDIVIDUAL PLAFa EXAMINATION SYSTEMS Te.ble 3.2-1 CES IPE Fault Treen Front Line Syslama Foodwater Dolivery (includes Feodwater, Condensato Dooster, Condensate, and Feedwater Control) High Prosaure Coro Soray Low Prosauro Core Spray Main Steam (includes Main Steam, Main Condonsor, Condonsor Air Removal, and Circulating Wator) Automatic Depressurization (includos Safety Relief Valvos and Air Accumulators Back-up Air Bottles) Residual Heat Removal (includos Low Pressuro coolant Injection, containment Spray, and Suppression Pool Cooling) Reactor Core Isolation Co,. ling Emergency Core Cooling System /Alternato Rod Insertion Initiation Standby Liquid Control Fire Protection (as an injection sourco) Control Rod Drive (as an injection sourco) Hydrogen Ignitors Containment Venting Containment Isolation Sunngrt Systems Auxiliary Power (includes Auxiliary Power, Switchyard, Diosol Generator, Diosol Oil, and Diosol Ventilation) Direct Current Po or (includes Invertor, Nuclear System Protection System Power Supplies, and Switchgear Heat Removal) Instrument Air (does not include Automatic Depressurization System Air) Shutdown Service Water (includes Emergency Core Cooling System Heat Removal) Miscellaneous support (includes Plant Service Water, Turbino Building Closed Cooling Water, Plant Chilled Water, and Component Cooling Water) 3-95
CPS INDIVIDUAL PLANT EXAMINATION SYSTEMS s Table 3.2-2 ,, Cgaponents/ Fall.ure Modes /Transfern Included in the PRA Fault TI.S.ES , ConRQDant Egtlutt jiggg SugypyL _ Svs t un Pump *, Fan *, Fails to Start Lube 011 Cooling Air Corspressor* Fails to Run AC DC (May be rsquired for breaker operation) Diesel Generator Fails to Start Engine ':ooling Fails to Run DC HVAC _ Diesel Oil Hotor Operated Valve
- Fails to Open AC Fails to Close DC Changes Position Plugged Air Operated Valve Fails to Open AC or DC (Includes Solenoid Fails to Close (for Solenoid Valva) Fails to Remain Open Operation)
Fails to Reinain Closed Instrweent Air Plugged Check rails to open Valve Falls to Close Manual leakage Valvo Plugged Fails to Open _ Filter / Screen / Plugged Heat Exchanger Bus, Output failure AC Battery, Inverter DC Charger, Transformer Basket Strainer Plugged AC Motor Fails to Run Motor Falls to Start Analog Trip Modulo Failure
- Associated circuit breakers were not explicitly inodeled for these components although those in the power distribution systern were modeled..
3-96
TABLE 3.2-3 O T m INITIATING EVENT TO FRONT-LINE DEPENDENCY SYSTEM MATRIX i j l l U 4! i .\i l llPCS EHH RCIO SLC FP RD HI (,. w INITIATING EVENT LPCS MS v
- g i lv - :
5 p C y F X [$$dg,37ta M) f f MOD D(2c) f f P(5) T X(le) c(20) ! X f,$pfyt3r 4 a X(19) Loss or DC Xtis) P(7) P(7) D(17) X P(7) X lX I i X l $ M i ! Less or ; l l X D(2.) l l ! FEEDWATER I Z TRANSIENT WITli X f H
!souTloN P(l) ! l X(4) X(4) X(4) X(4)
@'$EBREAK X(5) w 1 u D X(8) X(8) X{4) X(4 ) Xl4.5) X(4) ycjW DREAK X(5) '
i o LL BREAK X(4) X(4,8); X(4) l 1 4 X(8) X{8) L[oy3 l INADVERTENT / y(4) y(4) y(4) x(4) OPEN SEV P(22) P(13) X M I POWER X X P(IS) X
% P(22) P(13) X D(12) F(14) 'X P(11)
STATION DLACKOUT X P(10) I ANTICIP ATED TI4NSIENT f 71T!!OUT SCRAM l l I TRANSIENT WIT!!OUT i ! ISOLATION i
@) @) MI M4) M4) M4) M 41
! I3 y ( A b @) P(9) + 4 4
L 7 i i l l 4 i i m u i i 03 X - COMPLETE DEPENDENCE - Front-lane system net available fc!!o=ing initiation. $ d P - PARTIAL DEPENDENCE - Front-1:ne system partially unavailable following initiator (e g. one loop er division availablet D - DELAYED DEPENDENCE - Delayed impact on front-1:ne system unavailability (e.g. loss of component cooling). g
r CPS INDIVIDUAL PLANT EXAMINATION SYSTEMS Table 3.2-3 Initiatina Event to Front-line System Dependency Matrix (1) The turbine driven reactor feed pumps would not be available. However, the motor driven pump would be available for reactor makeup. (2) The Main Steam Isolation Valves (MSIVs) will eventually close since Feedwater (FW), Condensate Booster (CB) and Condensato (CD) are not able to pump down the hotwell. (3) If either the Division 1 or 2 Diesel Generator fails to start then only one of two containment Isolation Valves would close. (4) System capacity is insufficient for makeup in this transj ent. (5) Capacity in hotwell is insufficient to bring plant to safe shutdown condition. Makoop can be made from the cycled condensato storage tank but makeup rate is also insufficient. (6) Instrument Air (IA) is needed to open Containment Continuous Purge (CCP) valves. (7) Ioss of DC will provont the starting or stopping of an Emergency Core Cooling System (ECCS) pump but it will not trip a running pump. (8) System will not inject into the reactor unless the reactor is depressurized. (9) System would be unavailable if the boundary break occurred in that system. (10) High Pressure Core Spray (HPCS) is available if Division III diesel generator is available. Station blackout only considers loss of off-site power with Division I and II diesel generators unavailable as defined by NUMARC 87-00,
" Guidelines and Technical Basis for NUMARC Initiatives Addressing Station Blackout at Light Water Reactors".
(11) Fire Protection is available as an injection source if both ^ HPCS and RCIC have failed and reactor pressure is low. However, it would take several hours to align the system for injection. (12) RCIC will fail in 4 hours upon battery depletion. 3-98 _ _ _ _ _ _ _ _ _ _ _ _ _ _ - . _ _ - . _ - . _ _ . - - - - - - - - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - - - _ _ _____________o
CPS IllDIVIDUAL PLAllT EXAMIllATIOli SYSTEMS Table 3.2-3 (Cont.) Initiatina EysAt_to Front-lijle System [$..endency Matrix (13) Availability of ADS would be reduced because under loss of off-site power or station blackout conditions, Instrument Air (IA), which is the r.ormal air source, would be unavailable. The backup air bottles would be needed. (14) Emergency core cooling initiation would be available as long as the batteries are available. Operators to complete shedding DC loads within one hour of a station blackout to prolong battery life. (15) Only one containment vent path through the Fuel Pool Cooling and Cleanup (FC) System in available under station blackout condition. (16) Loss of either non-safety DC bus -esults in loss of FW. (17) Depending on which DC bus is lost, one or two circulating water pumps would be lost. This could lead to loss of main condenser as a heat sink. (10) Loss of IA results in loss of condenser vacuum and main steam isolation valve (MSIV) closure. (19) FW would be lost because air operated control valves fail open resulting in a flow diversion. (20) Automatic Depressurization (ADS) would be lost once the air in the backup air bottles was expended. (21) Loss of Plant Service Water (WS) results in a total loss of balance of plant equipment. (22) Under loss of off-site power or station blackout conditions, the MSIVs would closo due to a loss of IA. (23) Operators are not allowed to use systems to inject into the reactor shroud during an anticipated transient without SCRAM (ATWS) until reactor water level is lowered to below top of active fuel and the reactor is depressurized. i l 3-99
O@ O ey et 1 =$3+ k~ 3: D m h$ . j,l
) -
1 0 0 2 - ( P d
) e 3 e t. 3 s
t 3 ( g - L I ( t y O x - R ii1 , T N O 1 C H T . N .i ) e E L ) ) ) l M 0 9 8 b N 1 t l a I l ( t ( A P X X . ia S T N mv e a C y ) t y on
) ) s X C 0 7 I
8 1 1 l s i R f3 ( P ( I ( X e i v s T n - A i i d. l M ) ) ) ) )
)
t
- r -
S 8 i 9 9 a 4 n o Y W ( c ( ( t ( 1 o p C F D P P x ( x r eo f N r t E ) )
) ) ) e e D P 2 s 2 2 h n N N F 5
( P 1 ( x t P 1 ( t x oo t E O I f g P IT C o . e y E E D ) e ( r t i D J C ) s 5 u g i l N / X 2 i ni a b l M I D Pt ( E C P f a - i l E R ,. g l e av T l l U n of a S S I ) ) o ) ) ) g
) i n
Y S C 5 s 7 8 E P ( t 1 i 1 w o e u S t ( 4 R I P P P ( x g y ( X ll l b P o a m .
- E f l e 2
3 NI W O S )
)
o ) le i a s v y t E L L C s t 5 b a s L - P L t P ( ( P l a n e B P l u n A T a v ly i-T N e l l . O p
) ) )
6 t a t n R g 6 c o i t o F r p g ( P ( P t ( n r r A D a O mp f n T te mo s D y et
)
t R 7 M N C ( s s y ac E O I D e s p T T n C i e m S E l n i Y J W
) ) - i l d -
S N t 2 t n - e I ( ( x ( P o t y E E R r n a l N F o e U I L S ) ) )
- Fr D _
S -
- E I
R 3 1 1 4 E - _ R ( D ( g p C E E T P x N C C N I E D NE E N O I N C D DN R I P E _ F H P N H E E EP D E D PE E D T C E L L A D E h S P T A I Y s M R L O A E C P D
$^R P - - -
"C R X P D g
T "N N
/
v a s S I D C j st E V T D s C C / M P R C s P H I R W F R C D A P I P I D C P F S M % I H N C u Hoo -
CPS INDIVIDUAL PLANT EXAMINATION SYSTEMS Table 3.2-4 Front-Line System to Front-Ling _ System Denendency Matrix (1) Loss of Condensato (CD) or Condonsato Dooster (CD) will cause loss of Feedwater (FW). (2) Closure of the main steam isolation valves (MSIVs) will limit the amount of makeup available from the hotwell and will cause a loss of steam to the turbine driven reactor feed pumps. Makeup is available from the cycled condensato storage tank. (3) Reactor Core Isolation Cooling (RCIC) does not have the , capacity to provido water at a sufficient rate to make up ! the inventory lost from a stuck open relief valve at normal operating pressure. Additionally, if ADS successfully reduced pressure than RCIC sould be unavailable. (4) If RCIC provides high pressure injecti'on, then suppression pool coo'ing must be provided within 24 hours. (5) Low pressure injection systems cannot provido injection if reactor vessel pressure cannot be reduced using Automatic Depressurization (ADS)/ Safety Roliof Valves (SRVs) or main condenser. (6) ADS wi?1 not automatically initiato unloss a signal is received that at least one Residual Heat Removal (RHR) pump starts in the Low Pressure Coolant Injection (LPCI) mode or the Low Pressuro Coro Spray (LPCS) pump started. (7) Pump- la normally aligned to the cyclod condonsato storage tank. Suction can be switched to the CD system if the cycled condensato tank is not available. (8) The main condonner_ relies on the CD/CB systems to remove condensato from the hotwell. (9). The MSIVs receive an automatic isolation _upon recolpt of a t low reactor water level (level 1) signal. This signal also causes the LPCS and the RHR pumps to start in the LPCI modoe l The main condenser would be lost as a heat sink.
- (10) The "A" RHR loop shares a keep full pump and full flow test line with the_LPCS system.
(11)' Steam supply for the RCIC turbino is from the "A" main steam-i line before the inboard MSIV. l L 3-101
CPS INDIVIDUAL PLANT EXAMINATION SYSTEMS Table 3.2-4 (Cont.) Erpnt-11_no System to Frpnt-Line Syntem Depensiency _ Matrix (12) Fire protection can be aligncl to inject water into the reactor pressure vessel througn Plant Service Water (WS) to Shutdown Service Water (SX) to the "B" RHR loop in the LPCI mode. (13) CD must be available to remove condensato from the main condonsor. (14) One main steam line and one Circulating Water (CW) pump must be available to remove decay hont from the reactor via the main condensor after a plant trip. (15) The RHR, in conjunction with the Fuel Pool cooling and Cleanup System (FC), provido a flow path for venting the containment to the spent fuel pool. (16) If containment pressure rises above 55 psig, the SRVs will not remain open. (17) A loop of RHR can not operato in the containment spray and LPCI mode concurrently (18) When RHR is used for containment venting, that loop can not be used for LPCI or containment spray. E (19) A loop of RHR can not operato in the supprossion pool cooling and LPCI modo cor. currently. (20) Containment venting requires isolated valves to be opened. (21) Failure of SRVs/ ADS could result in a MS lino rupture. 3-102 i
\
CPS INDIVIDUAL PIA 13T EXAMINATION SYSTEMS N c
- - c. r a_
e c c r , , c _. _ . . . _ . - =. .. ..,_ . . . .- . j g . ._ _4 .~ .-- --i..
.-.. . . . . . = . __._~_- . . . - .~a..~ e, 4
y . - - . . - . . - . - -.. . . .- . -_ . . . - . .- .._.-.. , . . -- r - .. 3 . . - g ; 1- - - E. . g g -
. x_ .
5 , s t -.,.a-. e.p:._ ._ . _ ._ . .__ ._ _ _- -- - - . -_ _.. 2 . e , ., .,
. . .. - _ . ., . . . _. _ _. . - r -
y =_ =_ _ 11 u u a
,.;vt 1a
,. c g, a 1 i L 4 E E U T j *.
- e. _. ._ _ _ ._ _ _ __
13.f,
, e - - .
- n j _y _
t M. g nL U ..__ __ _. . . _ _. __ _._ _ _ . . _ . .. . _ _ _ ._. _... _ _ jy-c ..
= ;
o 0 f *
- Q A
* .,5k
.9
- w r;,j art e s
. - - g- 2 -
,x -
=. ___ _._ __ _.___ _._._ __ _ _ 1*i:
s g . - =__ , m. - . 2;t . - t 1r n . 8. c,, g . _ . . -. -- - . _- - - - . . _ 2 1 J, Io i6 e h a g &
- tt ,3 r ; , ,
e s i. - i ; i., x* - v. U K w
- j -[ <. ,J I u,
vo
.+
= ,
,i a
8 - a g
, i'i . .
r e, ~.<e" A e - -
- a. . e a -
1a <<ss, 1 = , a 4; i 8 h._, E _,_,E _-.___. A E - g
- gg9 .
.rea
=
.. ~
,g e., g g 1 . -
r, u _. _- E
- _ . ,~ _.. ._. .
- i. , e e a r r r t y a a
_ m t _ = a e a _ o a E E y ! l l E E 5 K E 1 1 f l i l l i e l ! ! r oi l e t . 3-103
. . - . ~
CPS INDIVIDJAL PLANT EXAMINATION SYSTEMS Table 3.2-5 Front-Line to Supoprt System DoDendency Matrix (1) Condensate Booster (CB)/Condensato (CD) minimum flow valves fail open on a loss of Instrument Air (IA). (2) Shutdown Service Water (SX) is the primary source of room cooling. The pump will continue to run for a period of time after SX is lost. (3) Supplies power to the pump room cooling fan, keep full pump and system isolation motor operated valves. (4) Plant Service Water (WS) provides a back up source of
- cooling.
I- (5) IA is used to operato drain valves while the system is in standby. IA is not needed when the system is in operation. ! Turbine Building Closed Cooling Water (WT) provides cooling (6) water to all motor driven pumps for lube oil cooling. ("i ) Provides cooling to the Turbine oil (TO) System which is used for the flow regulating valve on the motor driven reactor feed pump. (8) Instrument air would have to be restored to flow control valves 1C11F00?A and B if reactor low water level isolations had occurred to maximize the use of the Control Rod Drive (CRD) pumps as an injection source. (9) 480 VAC is needed to open the valves to the backup air accumulators. (10) Can be used to recharge air accumulators. (11) Shutdown Service Water (SX) provides cooling water to the pump motor lube oil cooler. SX is also a source of cooling water for room cooling. The pumps will continue to run for a period of time after SX is lost. , i (12) Fire Protection (FP) can be aligned to inject into the j reactor pressure vessel through WS_to SX to the "B" loop of I the Residual Heat Removal (RHR) System in the Low Pressure ! Core Injection _(LPCI) mode if reactor pressure is low. Division II 480 VAC power is needed to open motor operated , valves that are normally closed. 3-104
\ _ _ _ _ _ _ _ _ . . _ _ _ _ - . _ . _ . _ . _ . - _ _ - . _ - . _ _ _ . . . _ _ -
CPS INDIVIDUAL PLANT EXAMINATION SYSTEMS Table 3.2-5 (Cont.) Front-Line to SuppgI.t_ System Denendencv__ Matrix (13) SX providos cooling to the "A" and "D" RHR heat exchangers. SX also supplies cooling water to the RHR pump motor lubo oil coolers and room cooling. The pumps will continue to run for a period of time after room cooling is lost. (14) IA providos a source of air to the main steam isolation valvo (MSIV) air. accumulators. (15) AC and DC power must be available to run one Circulating Water (CW) pump and to operato various motor operated valves. (16) The 480 VAC system is normally used to provido power to the containment Continuous Purgo (CCP) , RHR, and Fuel Pool Cooling ar cleanup System (FC) valves. Containment isolation valvos require both Division 1 and Division 2 to operato. If 480 VAC is not available then backup measures are available to open the valvos. (17) IA is normally used to open CCP Containment isolation valves. If IA is not available then backup monsures are available to open tho valves. (10) FC provides a flow path for venting the containment to the spent fuel pool either by itself or with the RHR system. (19) The CCP system providos the piping and isolation valvos for vonting the coi inment directly to the atmosphere. (20) A loss of balance of plant (BOP) AC and DC power results in an automatic reactor SCRAM. A loss of two Nuclear System Protection System (NSPS) power supplies result in an automatic reactor SCRAM. (21) Divisions 3 and 4 supply an initiation signal to the High Pressuro-Core Spray (HPCS) system. l (22) Division 1 and 2 supply an initiation signal to the Reactor l Core Isolation Cooling System. l l I l l l l 3-105 r /
CPS INDIVIDUAL PLANT EXAMINATION SYSTEMS lll8 !!!8 lill lill el-l! 11-!! Ill! til!
- n. ni .
ii iii si, iii j!! ll$ r! j! ll; i >>l j! ll5 j!! IlE I oo E EE do EE EE ao EE EE i aoE EE f l-1 +ali [-1 +ali l-1 .aji l1 +a[3i i;I n 1 ! i. ! : 1 ii l li l i- " li l i- -- li l i- - li i i- - ili ili i i ! i i i il: I ils Q 1, I, 1: ', 't le it it it "t it 6 15 i; li; i; it it i; !; 1: i hkh
@ h.l F;. : E:
li ll 4 4 ,~4
!,9if Y cf 'T li i t ,1 , is r is e
! ! }
a
,9 wres si k>iAA
;)
. i ll'of7 lh' I!I'!lIllll li!!ltel l I_l! h !!i !!!j!!' ! O Figure 3,2-1 Simplified Scram Logic 3-106
\
k l 1 CPS INDIVIDUAL PLANT EXAMINATION SYSTEMS
.sg W
A 00b e, Os? # kE54 r% rh . . e, [ v
~
'^
em ()
._. . m
~
d* em 1 rm Ib t --. I p
^ 8 O /%
g ^8 _, 8 #as E$ddsc^ dan 9yh"ns ss $=3 8 3 e -i s r3 l W Pu ?3$?**6EM a a a m w < $_5 $N - ! e o EEEw a: e e .-2sgl dd 3 E gy gy
^
Figure 3.2-2 Division 1 Scram Scal-In/ Reset Logic l l 3-107
CPS IllDIVIDUAL PLAliT EXAMI!fATIOli SYSTEMS e ,'+- U -. ATVS . D % Ir-' SYSTEM 2 *9 i e-s* - I 4--*- - H g0sa r404_], 8-A _. .- ATVS .*-'EA-I % I L ~* SYSTEM i .% 10 e itCU'S 'IF405A g F404 A T TD VALYE Nt
'I
, -- M--% r i o2 A ..ATVS ..A
/ L' T ') ^ ,0 1D* VALVE 3
} ] RPS h S --'r l *On 4020 l F40lis
- -M- : r- ~~
ATVS fl10A f4030 SYSTEM 2 CfiMT f6o9 __ k oc % A S A {0 g *y RPS A___ l T401 A RPS RPS ATV4
._ 4 _ H F402A SYSTfM 1 F403A ^
--b J-b d F100 F010 b{mjf;g fp, bpf;'fgj Rc pse.ss badg@
E RPS RPS k e. ** - 2 RPS m? hr I ar I __.nr 11g 1 t? hrJ j 1G 1 16n 20H su WH NoFi wu j ariiY 16) A 0 @ ^ B A IC
$ ]
37 RCl*"$D t$_.31- ! ,, s? A a IL4G 2
-t J-L J { T rial r011 RE l
l'igure 3.2-3 Scram Discharge Volume 3-108 L ._
CPS INDIVIDUAL PLANT EXAMINATION SYSTEMS ____._c lE6iH p-b.tfD . . - _ , - _ . _ -
- l. .
- IrllH FlCCI K1 Ar2d . K10A r; ; Vi?A IC11 1C11-S300t 5300 ;; A p.tE
*I- L1:>.
K2 K2E 22-I:A 2Ar2I 10 A ;K10 A L'1: tAlt4 ) rgoA p, DC 1DO I DIST Pfil 1 RV+G KIL A / K15E / K10 A / h K17^ ) AI7E /
^ -] ] ] Imra ] ] __4 SYS TEti l itilTIATiott GYSilti i It41TI Allord <
( Auto SE Al-Itd) (11tiLR SE Al-tN) ) 1EST -- TEST y 9 7p . 1 K12E" .- f.
, RESET K 12E, ,<{; Ki 1 K2Aa, gg 3-~ ggg-- K2'A" K2C'
_;K12A Kl[y y ~f[{,.j ggg3 (JIi!3fjj _. K2E'. (0)
@ > \ @ @ @@
kt2A K12C K13 A r[ , @ Kl6 AK2SA V25E (IMl I2ill (2)il Chi')
$YSTiti 1 TEST SYST[ti 1 ACTIVE RPT SUdSOR STATUS PVR 110N I I I 3 Kl2A K12A -
', K12A .
o w- (Ohl K20A R e _1. __ Eid@K19A _I. __ 1 ,_ 0)(2ill K21A 15A K15E / K 15 A' ~K 15E , / "i:15AKISE / EQkl $9kl C o 00l I < SOkl C 0 1 AQL1 [0Q C E 7 E10 ETO O CTO lL10 l E10 ETO I I l ICll-F40l A SCR AM VLV PILOT ICll f 404 A SCR At1 VLV PILOT 1Cll-f 405 A SCR At1 YLV PILOT AIR HOR DLOCK AIR HOR VENT AIR HD!t VENT I I K120 , K12E h (R
")
0 (R 1 __ Ifill ' K22A .1. __ (fifl K23A K17A Kl7E _, __
! ~ K17 A K17E ,, !
r ., _- ,, - . _ EOL.l[fOkl C 0 EM E9U C 0~ E10 l L10 LIO L10 1 l ICi t-f 402 A SDV YENT Vt.V PILOT VENT 'Cll-f 403 A $0V OR AIN VLV PILOT VENT Figure 3.2-4 ARI/RR Pump Trip Logic 3-109
CPS INDIVIDUAL PLANT EXAMINATION SYSTEMS
=
eng$
& N4 &
n - e eu sig sagsnam xx 4:= Nw 3 eL";
" 's f*
$$ gd< s- -g 5888885 myyttt 83
-t 885I $-
mttare Nd u s 9. 0 R9 is sence"ty"a 5 t" sect *h sh.2ge
- t 8 S "5 Ed ud dwwwwwww 8tw dww8$r A A A A A 1 1 A n l l l l l l H3*5-nn 7. . .. . ... .. ) g ,
AA n;, O >
<c. an ee <- m o -
<c<-
n c u- en a w mm lT e' a- , _ Lesis == G!a3-sig 3 s4o -,-
>qy..l- n sm C
il 11 f: < eo U Nn IN " *
@ oe HH
- k. N
[ A b n e:=
=
N < n A n H> O
~
fr 17 fr 1-N d m d a m m o 3, m m m
! O- -- s ! O-
- u >- -H ! O-s -
! O< - -s
- u r4 rW tw 3@5 US x QS. EU ~
d S 8 5 % $ # a y N w $' n a 5 2 Fe a E6 $9 d 59 a
'E j 3) E$ $q Eh Ij E4 5 e
E e s x e s x e !"
<r u 'ro sc c ja a 8 8 Figure 3.2-5 l Division 1 Initiation Logic I Sheet 1 l
i 3-110
~, ,. .-..
- . ....... _ - - - - - . . - - - ~ . .-. . . - - . - -
CPS- INDIVIDUAL PLANT E'A_. .JATION - SYSTEMS h 5 E k@ba us v & ses p=0 n d aW5 wa< 495
-po 0
a
- g8 0"Eg m E@w hoW (%
i m 8 : M I y 7 ~ s ,r- ,
/
MMo (% l x W m :
>p "5s5@C hg8 /
i
/
/E a r3 ;
g 'Sdo n _m i !7 8 g :
---./
<g L' ~
5 n-5 8 A .
/ 2 'ME8- V-]*
o o "8od o u ! x <8m t
"dd t- c s a>$$
<o s.e us uo w-- gg e e o >
&av ~5v m-e m
-- g .3 w N/ N/
S v f
. L, -- s -
y y / rw E U
.s l15 Q<
-----> .gi a 8 --
, ra .,'
%) %ma a
8 mL i J
<> -- n - n O 0- 0 0-
/t u v v v a
1r a a a. a o- *- h(yj k <-
. "V - ,y I< [h b 'b h s oa< - L:
'E o g .,[U .g o g
1 l a v : W 4 W 4 5
- o 5 s
'r- Ee Fn Ee "N
a Ed E Ele
$'s ug \ - n e n Figure 3,2-6 Division 1 Initiation Logic
--sheet 2
, 3-111
O CONTAtirENT SPRAY *A* hFIGI $ DlVILPCI)
- OPEN 1EI24027A s MAhuAL INITIAT10N ....., INITIATICtd Z
( _ o
- art 1 DEPRESS j _
_. A CLOSE TE12402eA H 4
- @EN IE12406eA C IE1240144 >
CCNTAlteENT spray A- t* SE AL-IN RESET
- OPEN IE12402tA 3
-O b a -- - > 1._./ 1 4 r
IE!24003A L hM hFIG1 N -
"3 E t 404S A
- Hi DR f*' ELL PRESS 1E12-F047 OPEN km O
+
ni CONTAl?#1ENT PRESS XMTR ATM y
- ~ +-3 m 1E12-N062A N662A
- START DIV 1 SX PUNP
" Q p iii ers "C HI CONTAlfrENT PRESS -
-mj *
=
FIG 2 RfA 'A' PUNP U #"W w
- XP1TR AIn -
u IEt2-N062C N662C I
~lG 21E12-FO '.2A D
U A 0 B 0 C 10.17 ftN TD
~~
h^* { 4 i OPEN
^ ~"
w : ,, 0
- iE12-F04SA 0
- f AFTER TD)
FIG 1 j Div 1 LPCI INITIATION
-s ,
) D ARrf ;
y CLOSE W
- Dtv1 CONTA:NMENT SPRAY
_ j IE12-F024 READY TO RESET i OfpRESS j CONTAD&1ENT SPRAY A- Legepd DEL AY Tir1ER RESET FIG 1 = Figure 3.2-5 $ i FIG 2 = Figure 3.2-6 L'
O
*:1 L1 TO ADS H
Z 9 -> TO:
-SLWRESS:014 C
H
.Xt1TR I ATM P00L M4 E4P 1821410915 , N6918 TO RC;C LEVEL 1 >
RX WATER LEVEL Y DETECT 10rt ta CRVICS - CRVICS(CROUP 17) 3 h TO ADS Z % TR!PDR nTIL y C CH1LER B
- RHR S/C M
^
) MAPCAL tmTI ATICP4 TPPS DRWTtt X f ARM DEPRESS } FANS S & D Q XMTR 16214409 4 ATM N694 j , y j d O
U M j3 l % STAR T DfESEL $ Hi DRYWELL PRESS i j GEr*9ATm 6 (n C w :Y H n 3 -*- CLO5E O tE12401 t S [ $U g c _ _7 1E t 2402tB p., w d rt
*u _ _ _ . . _
TO ADS -j - 1E 1240873
" g" .N 2 t E I240515 1E124CSIB
>~
O W !E t 2-FC6SS a RESET tE t 24021 XMTR - ATM A { 1821-N09W N594
'r O
Hi DRWTLL PRESS
- *~
tE124027S O!V 2 IEt2-f0283 TO ADS IMTIATIOJ g SEAL-e4 o-- "" 182144091F N59ff LEVR 'l __T s-so-e - LPCl IMD ADOJ SPRAY 2
,E, _-F0243 S g
RX WATER LEVEL T SEAL-IN READY PERMISSIVE *< C4v CS To RESET y L M to i
O
't:f in H
Z Div 2 LPCI 0 Div2 INITIATION SIGNAL y CQ4 tat c1EHT h SPpAY !!4tTIATlG4
,s pcpan o; N START H
g Atu SLE -* M
- RtwC' START g gg ggg V PUMP h
y N* d L F S SEC TD . pHR C' PUMP
)"Od"RR$EANRM y P-
< RHR *B PUMP / M g, M en lH t1ANUAL OVERRICE ALA - RHR s* PUMP
{2
/
C04TRa SWITCH
~ H z
tEl2-f042S TO STOP > p. IN MAWAl d y m"p p' H OVERRIDE ALARM js pHR C* PUMP g o g Z g (D D C0t4 TROL S'A1TCH P G "' g OtV 2 C0rJTAtNMENT % TO STOP P, # p". '[ --
"a". SpgAgitt'lAT10t4 /
U - O CLOSE 4 1E12-f0428 1E12-F042B 4 h (C5NT90L SW1TCH
$ OPEN 1E12-F042B 4_ ~I TO CLOSE 1E12-F042C N----' _7
- tNMANUAL OvERR:DE AL ARM Ax PRESSURE Trip CKT I
,,2,.se,>e ,169 8 1R,P m 2i 1E12-f042C L ~ _
m ,,, To m0S,_ __. 3__,, , Op Et4 ,.,, 2C
~J to ME 6 UN TR,P CKT 1 e
1821-H07BS N697F TRIP CKT 2
O COiTAlWENT SPRAY "B"- __ MAffJAL NITIATIO4 O-) DN 2 LPCI INITIATipH
- OPEN 1E12 '0273 3
y g
^ SS
-.
- CLOSE 1E12-f 02SS o *---* e i 7 e4
__j j + COEN 1E12406S: @ IE12401e :p L"* CCt4TA!NMENT SPRAY T A CPEN 1E12402SS SEAL-IN RESET y 7 N g _.- / u ::
< 1E f 24003 ]T~ _._ CLCSE M e hFIS4 __
CGEN r t ,,,j ;E12-f M 3 y g HI DAYWELL PRESS TEt24047 2 U$ M4 HI CCNTA!!c1ENT PRESS 90 SEC
.XMTR ATM TD 8 w hsk !E12-N0623 N6523
- STAAT D*V 2 SX PUMP g p
8P ggu HI CCNTANMENT PRESS m -m g > FfG 5 RHR T P'JMP
=
- y7*g XMTR ATM ni 1E12-N0520 N662D w O29IG 5 IE1240-123
+9 %/
Oo U p A B. C A l10.17 MN TD ' 3 [ C 0 0 1 (C 7
~,
OPEN
,1E 12402S Otv 2 CCNTA tdNT cppAy gggt.gy
)
~
{ g .,. .c
<ArTER TD) hFfG4 3
DIV 2 LPCI lNITI ATICri
, V, 7 o i
j Ard' : t
=
__/ v j -- CLOSE DIV2 CCr4TANMENT SPRAY PEADY TO MSET l _[_ j lE t 2-F024
. m
{ DEPRESS _j C04TAlt:1ENT spray T < C(LAY TIMER RESET M 8 ' M 2 V2
ra { l ,o tn
= H 3
gpCS SEAL-N
=
H XMTE - N6D READY TO RESET g IS21-N067D H Daf4LL PRESS ~ -> CtCM C2' 1010 ATM 1E124011 h XMTR ~ 1E224023 NtS7C 7 1B21-N067C _%opCN (E22-f00 t U r a DRYwEtt PRESS g h
- r- j START Div 3 DtESEl sn4ERATOR y
-> STApr pry 3 Sx PUMP g
r e1TR ATM x O 1$2;-N067G N6673 t@CS PUMP CCNTROL SviTCH hH H DRYWELL FEES 3 TO STOP V 3
~
m gg G #M g3n twTIATG u g$c le2i-Nz78 N567H 5 ARM LEPRESS ppggpynp 2 4 a] Hi DRf*TLL PPESs i ga o_.-o i c ;
/ IN MANJAL
\ ,Ena m tAan
~
~Y L ... . : 1 o :2 p
XMTR jg21-N073G
~
^ w' N673G c'Ie--
m
-J
( EEVEL 2 - l CP g3 p RX WATER LEVEL SEAL-N 4 L START r RESET ygyp ATM @ pgnp b ~ N673H _7 r 1821-N073H Rx WATER LEVEL LEVEL 2
-j HPCS INITIATION 1E22-F004
) '
O HPCSHf M22-F004 f.O LEVEL 0 LEVEL h e E TO E '" xnyn ATM SEAL-lH OVERR 0E ALARM 1S21-No7;D H573D -- A (EVEL 2 HPCS Hi T 1 Rx WATER LEVEL
- LEVEL RESET um r- "" L_.-. __ orL".
1521-t4373C Rx WATER LEVEL
.1, N5730 LEVEL 6 D , ge HPCS H1 WATER
=
7 3
*' EVEL RE ADY TO SESE T h
_. I
CPS INDIVIDUAL PLANT EXAMINATION SYSTEMS n p A _a?? dgg gi 0 if0 s Gyg!jg!' TT ~~ a a Pgw
,, g g ~~
MR u
$g $
25 se W- $h s ^ s $1 - sis $$ g8 e 7_ sa 1> i s eu << o<s-
?& OO o -- Y "
Hgg ow 3 t 33 _
=g du
.t tsa. c BSsadWW so a .c -
o o JL db Jk Y. Ig
-a ,,,
c_ d C =.i c o vg < r id _c F A "Efe 28. sve
- f. ,, " 0_ M "
( . . . . . . .
...)
a y m.i v rr --
. a. ._
i . p o o [ j 2 t- - - - - 1 eT u n a a e z" e
" se as se su 0
h,,
<y <g <s <s a
e 1 ,( i g-s s s
. hJ
,5 dy O O O O Figure 3.2-12 Reactor Core Isolation Cooling Initiation Logic 3-117 ,
1 l l CPS INDIVIDUAL PLANT EXAMINATION SYSTEMS i w . 1 2 JN,lej! se- a gg m
)( ................
, , ..gp1 el!__ 5 ml
- ll 5 m --
_,qi s-Il!5 __
!!ijyb
-- y I
!!K !!I Kj Mi
- = :. =
*b j __
E!!_ g
~'
T v 3 lE ~'hh
-- T c
-J r < l . u _. I "
2 h _,$[ 2 l 2 h
, _.i(
E g 0 a 1P 1p 1P q, illi Figure 3.2-13 Condensate System 3-118
CPS INDIVIDUAL PLANT EXAMINATION SYSTEMS 5g IIr
,5
! l P!
el SE e b is1 es,cg -I: Is t 0 @ s [ +-- I,
,11
- o I i
< il .-s h-2 5
- - m a
LU !?HtF-* g it s -< +- QG i
. , ---am el
@'~
.i l5 3* l(*p o h M ~,
, 4 ' ,
M Htt f - g
- 8' . .; (, . .
@ i @ !
g s.igp.. ..... ,
< Nm , ! j !, ;
5
% bh~'l g Ih
& J e-"RD :"' lip-s sgm ' it n
i ei 3: a g. Figure 3.2-14 Condensate Polisher System 3-119
CPS INDIVIDUAL PIANT EXAMINATION SYSTEMS I t 8 II I Af Xls ls X[s . S I
,+ Ji 9
f - 9 l
/ 3 bSf3 2
!.,l d !!" fSl3lI __
isl, s.
!:sls 3
-{ lSls sl: !sjn
~
~TTA e s14 w 9
l~ 9 f t s l8 lL g i o J n ! sh: /l lll5 s/ lll5 M i s $ S
! 1]i
,aj in- i!f>< ,i "t !
i!
! $ ! [
F I
!i:lli r- <- v L' i -I 'll
- vi -IF'll= i-I 'll 1
; Xi -4 f Xi
, e =
}X,8 X,i*j!
i i! it5 - 1 8 l
= = 11!
52
!!! I Figure 3.2-15 Condensate Booster System 3-120 l
CPS IllDIVIDUAL PLANT EXAMINATIOli SYSTEMS X!s X!$ 1,1 g 2 8 ( o s Zi - Zi _ 9 r)
$ [
9
._.$(
.r llb[t . : 91I mi -
91 - V
$f 1.
9 f-i fi 3 'T j __f-{ t - }th: 9 a -- 11 11
- [' -- -
l 2 i (( 9 i/ $}I$2 i I[f-
- f. , y 9 t :-g - 3 j -g 9 jy
- ~ ~
13$ id4!!h)WIIdWiiDI 3 .r , g e Figure 3.2-16 Foodwater System 3-121
CPS INDIVIDUAL PLANT EXAMINATION- SYSTEMS 3 E
!) <8 !
IsEs). S=W,jlllgi l llllll h! " h! " t l $!
+ "
d t__ , [ , l I l8l I I il I I M l5ll d "L" !!It glI! iI - _ _
!i h t 29
,!I M X~! g fg EI-M f!I I
g pa"=lt tei$Ryeat i-bi s ~ 9 t a 1kh .25_ . _ _
,-8!_.kD
-. kh SI S
-_! k r.-- ~_ , . _. _1,g r .__ _-. . ,
kh=5f+ 5fkh lkh5f -
- f 4
.=_, ;a ,= i
,-=__ ,_
$ k -
? !
__4 7 h 8
.= -
.=-g
!,.h_=_2 g -
?;(g Dili+
un.Ta n~m AETED ~ AETED 8
.mnin= 3 (D5IE if II -kIkb
""a* ""1 f""* "" ggd] Uf 5Y
~
4 0 45f ~
. sa_~nm3 stq y kiig3h _ >-
Figure 3.2-17 Main Steam System 3-122 l
CPS INDIVIDUAL PLANT EXAMINATION SYSTEMS
' ll " il t@
gj ~ h E,. te- f bapf i U l BiF{g? illi = ! EIPll,i EUk y!i 1A I A A pon !
*},* A i.a pq_ 'T h --
pq '307 o, r p 8 pj,2 al-f!;0 7--)@j,11-)i, I 7-- --
- - =
"gog -
lc5 yT1: zTi: 30 hk
.. .............., kk j
l ! !! q0 '.i, g 5 kN ., 3 P
- T '
0 liwo c T'" i
!. . . .E.M. .E.3. . .!. . . . . ." . . l5g g gl 35 Q -
-: : 2 ll1 "u >}
sn i T, F.T h
- .=>< ,s ;v '
L l g! !!5 f l
- ll+olp4 oo l
_m g"'llC
*--N-( )
Figure 3.2-18 Condenser Alr Removal System 3-123
p l CPS INDIVIDUAL PLANT EXAMINATION SYSTEMS ED %
, x -
m, f!II EB_. i ED X-kin in VE 8 3, i I!! - I I I I E 0 li " le s"Rcl11 EDe 9p-
,< > >5, O $<$lE s I
e*j<[!! O f, IlI "J "g i I N ll1 7 T Ah M X- 8
. islg ,
ER ED W< ., >< j 4 t k! k! -
. > l ,
flif il! u !li v] v' illel ill it Figure 3.2-19 Off Gas System 3-124
CPS INDIVIDUAL l'LANT EXAMINATION SYSTEMS a-o
..Y 5 ./ 'u-ou v, n 4 u
OOC
>- u - $3 i o I
I p
~ '
~g p-y v.
- h-(g[ 'g',8 4_.. __ j i o mm-(A .-- -
9 -
!_ ~'
Y. J.:?, r. ,
-- a. . n,
).g ;
p _ _
,, (L_p ,g u .J m
a.., ,2o h a T - e c y3
- E ~ y$) .I '~> Q .o
-u-6 g
{Q ., _.- .1 L g f'>
?e h, 7
7; '-- A J 2 d - 2 'u'i -7
- G W 6 f o~
e 2 .. ag 4 astgA f a M-9d >,e t b; 63 ib N ooc
>- o .
0; sr p A
$y 74 \
aJ 4 t' \
~ ~ >
- a r, g,, t v3 y (, 3, p, R v. < ,o
,, s S.,54 y4 10 El * -
-6%
b k $
,w ./ o m v' b
, ~,
y l (-Ig,i -~/.- (f~o
- > m, 2,
E- ]/ n us > C jk
?
L v;, m 0 s[$
- 2: ": \/ e r ' / :-
C 'u% ' 7s r Js .74_g fx Q
<4 ,,,
a o
,r4 111
. >- 5 u r --. $ <
p, p U w k-f *u~, m 4 'd Ikw 0 8 %.es2 'g A sme Figure 3.2-20 Gland Seal Steam System Sheet 1 3-125
, ;: t !
- l [ i ; ' ,; !f ,' ! ;
n5m H :<SOC:>& dM M%%Hoz m*mj . m t - y
> h i V
R
./B E N
=
Y
-w R
T4 C f A r~ 1 E I 4 E 9EI R S B 7 VS iV N R G VI ySN E S C E D I U > C m - E D
- N E
N N R t' O O E 3 L S 8 V C C\ P Y a N 5 E D0 1 W
- b y ,
EN 5 PO 0 SC 1 b r Vf
\
/ -
B C JgJ. 2 /
~/E V - ,-
,
- A y & E
,
- 5 -
_ R N R R AC S 2 E I _ 3 E G S B E 2 R Vt C > N E R U v i C mSN E EO W0 E SA I C m- u D 5 N5 N T N PL SB 10 E1 P O a D0 C EN5 V O\L C l POG SC1 b y / i y y SA
& \t_
/
+T
-' b RC E1 E
/ E IN B
R EO5 PL0 SB1 W0 S IG T U E T N P I T B R S U U
, NH I PX HE H
A n b > y E s n c
- _ o
> * > m" n o
- - c A ;
1 f P f d:i 2 V /. F-' F 3 4 R V C b' V C C Lg Vy [f1 ' 1 ' 1 C
\>
r V -
' g y B 1
V 2 4 r i f T P f S A Vd S y S F " R R - H DE MA E I
~
H - r u 4dno u
- udP W:3O moWH $$U M:$< af gD m:rmh u ueU *
' ,) ' !
CPS INDIVIDUAL PLANT EXAMINATION SYSTEMS E
!?8 e a
C~ N - D{'4]hu C e og C . ?_ ~b fj d
$4 t 35 1 l0 10 kd5
$ C~- 9j DDlg Oh,J& C
~~~
shy ? 4
'l
. h*b'd 1s -s.8 .
9 'It f3"" Ob O f-b b s r ,, 1 N h b Nd/ I) k 3 LA k' : = >- N .
,~~N j, "I,I b [ $ E, s1],$ l- *[j n :=,
uc.._ 1 1 1 9j , 3 $ ,,~ *2 i - b , b e h"f :, . . 0%)& o DDl{ r)5 b I: 3
- 1) E
- - m II 6: e i
O j (UDlf IN]f [tblf I l) $ ~ Elk ~ Qf !! PI{ - pa s l3'II 2;. g {i ' .*
- 2. ;
y e Figure 3.2-22 Circulating Water System 3-127
CPS INDIVIDUAL PLANT EXAMINATION SYSTEMS Yb~ D ! __ E
? .
dT 1r.
- M -
j dE
.- o DM
}$ _
C{ ]I hk h! h._ ! I Di l (j f~ M .: Q C
-2 ~
O-fg! w smu mmmmm- ummm muy
* ?
R
& Nmuu axmuumuumz 7 ;
3 -- s p s in ! $ M 3 il R g
\x awwi D
R
~
l wwwwwwls 1 35 '!s
< s I
l Figure 3,2-23 i Iligh Pressure Core Spray System l 3-128
CPS INDIVIDUAL PLANT EXAMINATION SYSTEMS. c,
.- o.,
u-~~ 9 t,. n 4:=mv---~.--
.rw
, i. -
geggi Ye gt.
- era- g u _
N!. II_L*.'::*a ~~ Me. tw V84WE N 4 *,'"Q" ng mm
'"T
-H-Hlh
. g. = g 4
.: ._ y ""
{ '__ $. ..-
=
_L .
-:o.= ~
- ua
/ _
.. . m m ., nn - g
< m. g un. un
~~N$ 9_". .
(-~ u=a=nsn 3E[] , Figure 3.2-24 Reactor Core Isolation Cooling System 3-129.
l CPS INDIVIDUAL: PLANT EXAMINATION.- SYSTEMS r lif ) ' 111:
- is = sji TT 8
(!
"g5
=t: ;q illll 4!! . ,
,, 10i p o 4g e
7 1 .
~ '*
l V5-{$ EH :_g.ES !l _.
@ u E3 1
= 5 Q-.-lll h ** <1 4
- Ig I M4 C ,, W o
IS X4 -
+
=l g -;
3 g
=ltj --c : *- -
ci ~~ Jy' tj -- - -------
-------- ; ?
. m j.
g+-h J _ el.4 - -
=m gig xs p g 3 (! l o d, Figure 3.2-25 Low Pressure Core Spray System 3-130
CPS-INDIVIDUAL. PLANT EXAMINATION SYSTEMS
.=.= ..
1 I II J+- 4 4-[
- 1 ED' 4 ", ,l
~
G , Mi 1 a
- , ,1
,i
- >;< _. m I
I
,q) :1 [I (i)' yM !!![I
' ._4 n:
' yI I
,I (D; bi '
f (' X1 :1 m Bi r-m; j[g3; 8
. "T), i i 1 ,l u
d g , T__
* :t; ef om ,
g_!_c,!c ,
)
t zig; 11 I
- ~2_I i- 9 ~~1..Z ::I
)
,, i ,, , ,.
s _
> 4 s % ll ::i =
1 I
~a 2i l
_.4 -l ,J[i" _g
-a a M >I<
[I v af i l ,, f-si][ih- [ . . . . _. ___ m
! u l,
T__ l I, XI 21 1, "_ 1[g s 2,
,i w_
@dH' 1
r li11; I
<3 7--- IKl x}l '
1
.g '.'
Figure 3.2-26 Residual Heat Removal System 3-131
CPS INDIVIDUAL PLANT EXAMINATION SYSTEMS C gh bd N d' WB d4 <<<<<< << <<E m mW 5 $ $4 uj m ~ os : n e soog" S U oooo NW ao MNW o o pt a n
'ky < t; g $$ $4 sg ttttttt it 8 s n# 99 $w ,D00000s $ 500 8""
m t t4"g> <I*g
- dw4W6$ <w B E5 Ed MU dWWWWWWW SWW dWWo r $z A a a n 4 A A a l l l '-
)[
~
8 b g>
<5 u- E <>
~ *p@s br Tsum hpM fh a l- Aa ga: v5p5>Ei hbE2WScao a4 "1 a- r o 2 ,,
2* n SR$" am r t
- f. " "
BTO oguo A s U r=
-- ._ n < > .
O O b o TT 1T 1T d m o m $m
--l mj o- -p g o-- j .O- -!
5 g4 nW nW E 43 <Sz QSz 45-m m p m m d 5 0a
# E a V E e
W 3 e a
$e9t a W
&oR d ct w R *f d 69t ag NM 4 *s d NR N M <
9 3 9 $ 9 9 3 E I I E E E R R Figure 3.2-27 Engineered Safety Feature Actuation Logic 3-132
-CPS INDIVIDUAL-PLANT EXAMINATION SYSTEMS ! i es . i"e g 5 Q g _s Q Q h h D 0 S ! ! 5! ! l~p ll+I !iiil-1"! I . lli!!! all!i li ! QEliIlil!...I! 'j!.N illi !!!...l..!Eli Ili () i Q i!ql () il
. ll!i a'il i, l nll;i. ,
g 4 gg, grb f !c Q ilii oll O !c I}' s- 11 11
$i s e?"? e _dlrl ff '
,y e i. ee Figure 3.2-28 ADS Actuation Logic
( T' . .1 of 2) 3-133
. . .... ._. - - ~ . . . . . .. .
CPS INDIVIDUAL' PLANT; EXAMINATION _. SYSTEMS q h 1 - kh '
, o t
a sv d > dlE ~~ kh I
/;E .
gy- - , e i I GD
': ]El I-II IIdi i
^
; 5E y g y4
/.i a
o 1 l_ l[! la
' 'f' gjj ::i H!l5I ( MI!II 4
G o II < xe I n i
)[I '$ "l
! j g e'E -
e . 3 ,,,-
- 1 ::1 o .. n a
TI C > < !< , .. .. . kl E 8
!!i- % sh!.glli. .
Figure 3.2-29. Standby Liquid Control System 4 4 3-134
L CPS INDIVIDUAL PLANT EXAMINATION SYSTEMS I Tn". M r m. u.. 1 s,s , P kE" *
-,s
. v m .o uma l
n n- i bag, g ._ , . . . , 1 rtAn
= s
- ', a s
w- . 0 _4_'a m l ,. , -i,, M , 9 i
)(a m ggg dMI '
wm
" naur-- -* m,m yo,,
Z
,as_ ; . .. ;
"'X-0
.E""a
, , .TREr*
I ("~"" ) CH 1 l l .5, = s_ &,, ._&. i 11 _ ,
,amm w y
.cm.
=-
3 ND%)
'2T*
rsumq r =,i ei., m Figure 3.2-30 Control Rod Drive System 3-135
CPS INDIVIDUAL PLANT EXAMINATION SYSTEMS wnAv wArnt n
'ATA~A~AM A
[ t2 l oMA E 12 ro37A - j L l E12Fco3A f, M] Est rG42A C it.fw? A 4 _, __ M rmo vuln
^ ha m .-
Q : - H, - u.rgvAs.<e. Et2'fo63A E 12(04AA T o l'W W -
-> p 4" "'
f12 F024A int 2 rom m To Egiert Fuel f%ot acwo srct n M
<-H y --.e, '[' ***'*
iremeA ircor4 rmore itx To Ceak
! > Cecrage f%at 7
*- ircore IFC,1:tel Figure 3.2-31 Containment Venting to Spent Fuel Storage Pool 3-136
CPS INDIVIDUAL PLANT EXAMINATION SYSTEMS IIIIII usyrn soot sxs.wrns To Surgo f ares JL
)(trcoi2A
)
_g g _ If CI3S IfC007 1 FOX 10 IFC0120 iroma :: (*Wn) u To tim ruel Pod M
*~
Main tser IIC021 Figure 3.2-32 Containment Venting To Spent Fuel Storage Pool 3-137
<.M O
*0 L1 H
Z O M TO 345 KY < M S4WFO A C (OCthTOi TO 345 KV 345 Kk > TO 138 KV M4 M6 C TRAN1 LPE :2% IfWG Cm y 4 k 133 KV 345 KV = mm LM 8 mm mmmm 22 KV MA24 22 KV
> 4.16 KV DER 1eDKV 4.1s KV mg NM @ NM M M c my g mmmm AUX m m e m m TRAf4S10 X X g 4.16 XV 5.9 KV TRANS 1 A 4.15 KV 6.9 KV g
[M (MT4 4,,, gy 201A )501A 4,13 Ky 201B )S01E g D ^ BUS 1 A EUS 19 > 0 8 u mMf
- T M n
- 0 0
C c 221A I219 Z i PO PO o *O
> D CD dhu M Desc SW
, ; O G ;
0:50 EN VC2 g o *J RT 14 201 A1 201 81 201C1 RT 4 M 'I g PC l IET4 l l 1 o U2 O CEOSW 3 ET 14 21 A1 221 B1 221 C1 1 . 416 KV 416 KV . . 415 KV NM DSC WO m
" BUS 1 A1 2 . " SUS 121
" BUS 1C1.
DG1A DG1B DG1 C i 1 DEsa. DE2L CEsEL GEN 1A GEN 13 GENIC
?C oc W 0 0 % D DC2 D$0SW DGOSW RT 15 521 A 521 E RT 5 03 O i 0 '<
.E9 KV BUS 1 A EGKVBUS1B Lj 9
m
CPS INDIVIDUAL PLANT EXAMINATION SYSTEMS 9
$6 ,o 8 07@ <@) 0$ $
ba 9 9 5 5 8 a o mo - > 9 y 4 o- g 2 0 6 o
~
n &h 2
- is g5 m U_
~
gs5 S 5 U$< 3 a,
-4'!B) ~
e E (n->> lf$ !"? eS a 3k >c A @ n e 5 m 9 n
; n ,o us g,
2 NN hEo b.. y) 5 o MC O g, ?
$ ~n @%)
$8 s . f.
4T9>- m
- m 8-t :a m E 6 g9 m -
? D = <w m3 4 lg$m 3
Ca>> 5 5 a [E E !* I a S "p
] -
aa <n"st - tm>>- 3h 5 9 Et s' / 5" o - 0 5<
, & <h E h6 E!
e; (-%) e N 3 ([->>-
< m N m a n <
; a y x< m -
" D 5 Eh <R E gy ya 0
u
~
r 4 g 50 m bG (% 0
" $ 0 E8 T% x kk G^4 Figure 3.2-34 Auxiliary Power System Sheet 2 l
l l 3-139
%t HZOH go 2
; 5 n M* gHoz ) 2 s t
U<o06MMu g M p , N
, c. *, ,
e 4, - g M r
, y x, , m.
u,
. e., ,
n ~' r e . " 1 _' ~- 9 ,. J. . sy u 5 m _,_
,u , i . ,1 4 _
., . S
- u. ,_
, N u.
s i s
. xo u ,,-
a e
. - m. TR A
_ nu u.
. ani -
r a a m .m .I s 1 a 4 m, 1 a s i a ) .
'.[p aU C.-
l l. s-s ; m. i ;
; j
.' ,. ~ r e
l *M^' sa" m m . u w O^u, 4 s.
- 2 '
i x. ,, '
- u. , , u
*s s
= L","'".
wa ' ."g,,
, n
, .e wF o n n s & "
yC' u a n. u. s
. . eg m~eu, s s
_ .=~ u.= 1s ,
"s t
[$_
"^
u. m_ =' o o s g .i M i r ;. '/ -
- u. w w* t s
a .s r. 4 s j - s. n a 3 1 1 4 n ., -
- s.
u
,c _
. w ,
, m ,s , ,
i_ m. n,. .~ - a .
. u J 1
c
.u , u s.
r r A a J .u 4 ~ a. t
- , .R
. T um
- r. t. .
s
- u. -
.s m d .
g2 u,u .
. . ~
mm --
.. e i j, . .
M 7 s a a M
- s. m.
G - e -
,um _
A
>Cx U [%Cno".
k yog.1 nt gxt:cg taeO" w 2 _
/ _
uIH$ _ Y
- CPS INDIVIDUAL PJ\NT EXAMINATION SYSTEMS t
\
a x 3E hY/ a m 7 xa 2 $ 4 ae y m Py 0 Iy f,1 h g ~ h= E d ( /) -- 7-)) U[I Iddh"h ar gf m e xx
- D 5
o T I a Q oa m <h w > E" = ag ng ? gu - 5 5 "X }f - bk )b <hN)
~'
j[ W, e L3 xe 3 $ R$ Y % 3f f, R$ 3 9
# 9/
^~
Tr 3h , 52'
'n ~
n hk- , x Q u hh b U a R., 5 x /^ s ".
\(o.-))/
o o a, m 2 4
]{ >
][ F4 W
5 mm5 -(24)- 3t
< x Ed 5 -
4 a 35 3 a
~
8 7" R
~ - c 6, W x & *
( Nn x0 25 j( T "\\// 9 En a
~
(* *~)b hh g- ~ - as K04 -- jg F4 Figure 3.2-36 Auxiliary Power System Sheet 4 3-141
\
O "J ta H (10C01E) % 125V DC U
- BATTERY 1A
~ NS <
H
/
g (1DC-8C6ct ) (OAP54EB) PC (1AP72E) > COfJ.BUXL MCC E2 PM_ a 430V AUX. St.DG. UCC 1 A1 e Caa MT C (tr C-81505) O NU MCR
- b) WJ OA b h
< o -
4 1 1 I' h
}) M NSPS DIV.1 0 X
h REG.100.TRANSF. 9 . _ _ 125 V DC . uCC1.', (1DC13E) k M H 480-120V Iff.ISKVA fy m
} [ 80 a =
fm 125V gg MN oc (1RPO1E) ? ST pc
;-- % 3 c 7 CHARGER 1A y W DM o 0 1DC06E O
%v C :::
I * (D < _ P Li NS
$ Q ,u TEST C <
%g C (ID AC602) h CW (1D C6c3) pus (IDC-BA501) 175 V DC W. PFF.1 A finC130
[4 O
. WW iSOL ' '
1LCADS D l /* % TRANSF. o)C81 9 l cn I l
< ; u.enm , .
h l 120 VAC ma m , . d l WK : 1 ' a SOLID STATE i
' 8# TRANSF. SWITCH j lt#. I STATIC N l
BYP, SW.1 A . e e_(1C71-S001 A) en (1C71 P001 A) M rLDADS (8
>3 M
tn
CPS IllDIVIDUAL PIAllT EXAMIllATIOli SYSTEMS E
,h m Ed A -
dlE 5 a
;8 d- 5" 8 8
)f 5
- .Q 9 C Y
= c g G 2 h o EM 92 +
9 " g 6 g
$ '8 c c! o E D +
gg eW W @ O
- c' "
h ! ypj g g gj ,....................g r 9 h S c------ , ! l l l l '* NO<E- E
-k _
l l l
-fg; i l u
lh
.g e
!! e i ! l> 5 o 0 I !
l0 $ g8
$ -CD--'
Ao c 9M h !' 5
~
b j55
> - [e,f %,h
! 5 ~
M l 8
- 9g- i !
*8 N. A., l , l
<- Q 'j j gd ! !
1 ba W a o oy -. o
^ h W i
'e hh L %l _,
B. t i3t
-e ,
85Ell aga
$E![ e.....................
bI g , ae O$ O l li! L i Figure 3.2-38 Division 2 DC Distribution System 1 l 3-143 ) 1
CPS INDIVIDUAL PIINT EXAMINATION SYSTEMS 4 o - g. 8" , - Ns n n 5 T
'?
r o oh ;i : 53'
@$ a5=
_g-
. e g3 !5 YA u l=
' , gg '
o ! AO o
-u :
f f- 2 l 0:
=b ,! ,
q g g
.! T'd h...................,do a
50 l- , do . 7.a. ., n
+
l l l , C by-<GbdQ ff r------ 7 ,!S 05
. :: : : 4
~
,i se n
- l. fs. ~i
!! o l
4N= U !-
!b
. <n-- as ..
30 g :[ ,~e h9 !! O-
- h "J
M! O l
. .. 8 ,
e........ ....................u. , , Ohag$ !d !o ! _e
~8 :d 3' gnN :'
N' "n* 3h l lf P 9 E! s0 3N iig i3t !4!!
~W il -
i
- i. . . . . . . . . . . st . . . . . . . . i. .!
3 I l l l T1oure 3.2-39 Division 3 DC Distribution System l 3-144
.O (I)
(1DC039 H 12SV DC g ______ BATTERY 10 H H 1 O ( 1AP75E ) L C i AUL BLDG.MCC 1B1 ( 1AP75E ) t* GRD. DET M M E 181 g RECORDFD T_ c = f (1DC-BA507) y r \OJ Og ACR v% g m r
}) 1 I
y ) ~ e M i O p NSPS DIV. 4 Og
* " @ X
/
REG.150.TRANSF. _ _ _ 125 V DC . LtCC1D (1DC15E) 2 i OH y 4 8 0-120V t/.1SKVA mm {fm 2 = 125V kH BATTERY Og (tR% ST 1C -- r QMAGER1D u OM Myv
+c n 1DC0eE S
~
$ hw TES, ACR U1 M=
hY NS PMS (1DC-BA504) (10C-8CO3)
%a 125 V DC DIST. PNL 10 (1DC15E) p _________
w l c ' iSot l N ' % TRANSF. ) cat TtcAcS e CD '
%< ' e m 8 um -------- , .
$ l 120 VAC l l s , nm i .
l tcm l l e SOUD STATE s e i
,a BYP TRANSF.Sv4TCH _______j e
, INV. / STATIC /C e a BYP. SW.1D f l
'e (1 C71-S0010)
- _______. ________________. ________________s tn NSPS 120 VAC PWR DIST PNL D BUS .c gn (1C71-P001D) tLOADS h
3 us
CPS INDIVIDUAL PLANT EXAMINATION SYSTEMS g .
-y" ln 9 9 -
l
**n N T*Ob-O i 3, -
?.
{ w{
- i $
,. g o a e!i l_ _ _ _ _ _ _N-
~8-B ,
_ _ _ _5 ., ,, n 0D [g, i! nu g p' a 8,: anon m; coo : 34 i__ __, , l
!i !li-ittelt!,
a
!j!
r-- i <, u l9 (5 9 l =l!o ni l i;l i n . h_ o s-D-
- o
,@ oj-o ok -
[5 -o oPjl41b-oj--o..-> ' i i .
. i - t _ _ _i t____. i l .
- i a fJ a L____0___________, o '
i
^
G8{ E 8 3 lM6 l l
$ 0 C u i 0 e c..
c 9 O gw a6a w A "o o-/
~
a O p;- i
.g ..
l l l oN-C5-CJg -D--- - o gs o
> 6
- o_. a D' S O 2 6 n " ,. ai v-O h Ao c j, &
5 ee o Ee g
" 8 a h. . g 8 g.
< > ,f
> g 4 o%
n
"-- U $ @
u-Y U a
;n? .g
- w. u i 2 cc 2 i
in o
- t- ~
^
fdbb .,o A o of M g- 3 C o. e% lh 8x _! V J E9l- j$. u-ev-ia b fi
!,Ib e
l
. ~
l L..........................._...- l$ Pigure 3.2-41 Dalance of Plant DC Distribution System Shoot 1 3-146
CPS INDIVIDUAL PIANT EXAMINATION SYSTEMS l lu
" O h l 9 ~
l5 e u !.n <T _ u !.8 _rg eg A a, 3 5 A t r3 -m6 -lc< A. -- _: & O m o 4 liw
$0B $T l 3 l$ l$ R d . - .> ca
. .n
.- r.
. a-c_...................._____......
2 a B Q
-II31--@ ,7 w
8
.s ,mn "
n AQ/ _B
-a
*N o e
~
e
~l o e5 dm a a E8s w
o 94 Uhhc 54^, w *3 tp, O 5 9 O e Siik E 5- 5
~
E a dO
~& 9 0 > s a w e I l l
- W C 3-Co 37M f m3 sm o
.. ,9/ N "s~- y
- i
- i
~
*6y 'l 9(pl3 l
5 o j m ' gpl______________j
'g m 9 r-- r----l 8 __ & i __;
5 y , o ogg 3_ g g m g), r------ --ll l ~l s Q> o {} lc _ _ _i i i 5 a I 'd' 43 Q O :i m hislF i i d as l Sg s f_ E 8.- -_J ej I E 8 f S 9 l9 T!? _ s!! 5 n5 nS Yl g So in ne >
%m$
"*nNPO i ( i l
-g* i a .
i - i 8 c_____________________________________i Figure 3.2-42 Balance of Plant DC Distribution System Sheet 2 3-147
l CPS INDIVIDUAL PLANT EXAMINATION SYSTEMS ! [ [ E " I h
=
gj m Ellg i m l, >- ll
; m
- m m , ,
_ =T - 5ll = 1 " a' . thi;j i T
~ '
....= j ...bI l
~
' eg.ui
- pgh yi -
,3 .,. ,
i E];
~
Pi i T 1...L. 1. 1., !"= _ i N i 5iT : Tii IlE 'l bi l!! / g / i i ,g T i I m
~ i
( 8_-Xln'
- , : : i is! i i T Hllgr I JF T-=r- j i
l':f
- -T !
t_ E]*,,- u ":: 1 i [m E3
==
i
-! m e
;, gq -
$ %41
~
= BD4!- -
q s !E.. ... ..N. !., ' r= 1 i Q yl E T -
"I l]!i / i: ! @Ds : LED-Rvi. .
'l,! ,i ,il el
- =
I i i! 3ai - < 11 - -
- gi:.:p....:p..!
m_ .,tS g...... g... m
,: gI Agg
, ,. m
;. =
af e g
~
k
$fm ~8f d EFbi ll!]ED-$1' I I
k ghbi N ' ! Il* ! - -
$ '!! l /
- s j g ll 1 i
n !!!,.-- .
=
;g h [ " l=" .........t il El' .:i l[ '
t1
, 4 g
' ~
h ! N y t7 [ o a
) {g B s -
=
Figure 3.2-43 Division 1 Shutdown Service Water System Sheet 1 3-148
CPS INDIVIDUAL PLANT EXAMINATION SYSTEMS m to t sr 8 l l NN l CORA90ADH CUHh2AaDR lN l CCAtACTIKIGAS CCNTROL SYSTEM gg l
- rccu CCa.tn Con.CnmET - - - uu 1 LO LO E E 8:0_
7 1SX088A ISX0egA 1VR093
. OfV.1 SWGR u y g HEAT RDOVAL ,,o C
~~~ Y CCHOUCID UET 4 4
u
> JNy -h y S CC 1YXOGC A 1 SA h ,,,,y p nou . A. A lA i f,,,, p TO *D* \
' FGURE3 /
RHR PUW SEM.COCtEl1A
] nGURE1 /
> h -->
1SX029A FRCWA *C* \ _, 1E12C002A FGunEt f _ 1SX073A ECCS RHR 1 A PUMP h 'O ROOM COL CADWCTS nOA r--------~~~; RRE I m
'f a lA PfcTECTod C
1 [ [ SYSTEM 1SXD71A e 1VY02S l TO SGTS CHARCOAL DED 4 if WM DME NDA
/ !1ru
, r, 2 -m_
un FROM'O' h p !-- --------.* iSX027A FGURE 1 f 4 l RRE ECCS RCIC PUMP 3 PROTECTD4 y ROOM ColLCABWET ISX074A SYSTEM go TO MAN CCtRDOL ROOM
- ISX037 1r HVAC GUPPLY AIR MLTER 3 yyg43 ^ TRAN CHARCOAL DED
'2 % ECCSLPCS PUMP h 77 RO ISX076A p .O.M. ----=. C.OL CADWET.S
- TO MAN CURROL ROCWA 3 ' >- HVAC MAKE.UP 16 '/ ! gA
^
h . f ,T"" TRAN CHARCOAL DEO V_h iSx107A if l L .,[ 1VY01S b' f F' ' 2 y oc FTO A ul;
- i. . .. .. . .. .\. .[. '
N iSX033 4 r, 1SX105A RAE paarta SYSTEM V > I U > Figure 3.2-44 Division 1 Shutdown Service Water System Sheet 2 3-149
CPS INDIVIDUAL PLANT EXAMINATION SYSTEMS-
" J e "
Igj! c qi l l]l fjf i9 [kr " gl l[
. [
82 n r m
- l.
l u o >+ n m ll g ; m si
; =Y ir i i "
- T' 'hs!
.hi;j .th;;] " "
j- wR -; f3 lt
- - E;]: . :
.1. . . A. .
2.. t 6 ie/ 1,._ ii
'! l
! ElE i kn l -
!.7...y ]. -
i}i ! .N..7..,b p E]n i , E] dlI!I!_Ib. y r_w : c=" ; u T i -m
= + gj l+/ :
,i s
=
i i
= i gsj l)!!
I E}-$vi - E[H v! f --- k N,5
~ ~
, [tl"Til .
i *
,.m.....A... $j Ill j )'! N[!$-f.8! ! !! j I~
Ia: - i!
,p J i ~i n
- si:h
*t 7 ... 4 ..: ;!i ijy I! "! !. "
I j;c [ ;i,
,g al ,g! u 7..=p gg g,l
- {f.g ge -
F 8[ffk' o g k e r - N o
-N8! !!!D$! lli .s i,$"\
ire t _ a Qgl I' 51 = . u: .
.I! m . E 11!!- JIit'.. r.:$lbl fit
" ~
l 4, S m lifm , E! - Figure 3.2-45
- Division 2 Shutdown Service Water System Sheet 1 3-150
CPS INDIVIDUAL PLANT EXAMINATION SYSTEMS st)
=r cornADAAun ConA,ssaan h CC4.41GTuiGAS CCrnT+CL SWTUJ m
- - FOOeJ CXXLrn CX>L CN'#4ET -
ko u) LO ko An { u !>L G - -DTc .
/ V ?> :>ki--oTa-+ }
1SX0880 1SX0890 IVR12S g
- OfV. 2 SWGR s n HEAT RDAOVAL go CCycDctn Lr4ti 4
] y a
Ar -A 1YXOCCD iSX02tB h
> j $
A FROM*A* \ MHPUMP IA 1P TO *D* \ FGJRE 3 f FCURE 3 / SEAL COOLER 1B LO k (J m
~~+ '
f 1LX0*90 r, FROM *C" 1E12C002A FOURE 3 / iSX0730 ECCS RHR 10 PUMP JL LO RCOA COL WP4ETS FrOA e gA p 4 he N[ [ SYSTEM 1SX0710 1VYO65 l TO SGTS CHARCOAL.DCD V
' kWAJAL Dell >GE SY3TDA
- * ' 'y - -*
AU FROM *D* MGURE3 / ( !............ 1SX0270 1A UDA RHR PUMP SER. 4 ME y CCOLER 1C 1SX0740
, SYSTDA LO [ q3 e p E -mmTM 1E124002C > HVAC CUPPLY AIR FIL1TJi
'> > ECCS RHR 1C PuAP 13 0 0 r
_ m - muranmA V AO LI> , hd(( e e
\
1WO7S
.[,
l 1A b
> HVAC MAKE4)P TTIAIN CHARCOAL DED rm_ e LO 1SX107D if L / TC 2 , pgj
!............' 1Sx027C -; ula nRE F' PnoTEcToa 1SX10$D SYSTEM V p V 3 Figure 3.2-46 Division 2 Shutdown Service Water System Shoot 2 1
3-151
O i M t/2 U
~
I C SSW PUMP 5008J 1C MMMET k i LO - I 7 m u h Pufgr - 1YHC7SC U l l
< SERVC WATER Mg o.
Y T I 3 m I%I 4 h y
- 1SX014C J W KC. 5 m
Z e l ISXO1FC 1SX008C etSa t u GENUMTOR 1C ~ m l m MP T""T I a b[ # g a b I I I 7 C q OEARL*G L':l:'J R1GWG strm.t4 N'O L"- RO 1SX004C g MC.
" ^ h f 1SXD01C IA 1SXCCEC l h* SERVICEWATER STRA24ER 1C d
.! Of PUMP 1C I U CIV.3 ShTTCHGEA51
! ! 1SXMPC M HEAT FEuoVAL gg) . ,
m _ _ CCtDDctGLRET
~ l u o, Qu 1S C 1SX013 TVXO6CC i 0 I E f r- ' D f
BACG/ ASH I 1VYCSSA e O, r a < m 7 V V m 1SXC41A l y m - Y TO DGOWCE ECCS HPCS PJMP TWISA e TO MT COL CABANET 1 A & 19 TO ULTauATE i U ACCIDENT HEAI S!NM CmCtAATPG Y g3unen T ' ' ' ? ' ' ' ' ' ' '. WATF71 4 NTAKE SYSTEu M* -f b AREA 1VY0sS8
* ' i l e rm
* ~
- 1SXC418 C/3 I J w *< {
e
' y !
m ! x t L1 I
CPS INDIVIDUAL PLANT EXAMINATION SYSTEMS 3,
- --- \
l 4. - m
@ N e- *
' ,[L q
)
g
'a E
~ /v N f 7g ll!b 1o mb A
rOn 0 0
-shi!9 sis $
~
3t
' .\
7 - i i 5'=.ln _E _s B e
+! e4lI I T-rr- - .
+j l
~ ,
a T L__ f - y,
! . kk g g 9*!"N)E >- d u @
t x;
$6 a --
f !!Di
$7 T j o5 Y < <
A gy g
-.-D<}
'S i
wn a -- a r - e, g I <- 33 L ! , o$ Eg e as e / N 04 a f m$ 'r 2 t -- h >45Y$g'Y q $ d5
-g @*- - a m
7 r n g
~
5 E Eg a-5j!
- e gem : e s5991 get i i
*r esse s S$$,
$$$c - 1 I
C Figure 3.2-48 Plant Service Water System Sheet 1 3-153
._ ~ . - - _ . . _ - ._ .- _ . ~ . - . . , _ _ _ _ _ - _ _ _ _ . - . _ . - . . _ _ . , _ , - . _ -
CPS INDIVIDUAL PLANT EXAMZNATION SYSTEMS FRO 1 CuiTR(t DUltDING T0 COUNTING ROOM C0C04 SING LHT (F60. 3) CONTRQ. N OVl M ~ OW019 F 0~ - t1 ORA 01CA N gg BRIAntlNG AIR CCrfRESSORS FRori sx W'023 ORA 01CB -M SY.S.i.t..M...
. - . ...-. . D..IE.S.E.L..G..E.N..E.R.A..T..O.R..B..U.IL.D..I.NG............
SERVICL DULIDING COP. [(1119 DOOM AC yRui CeIF 2 CODlNSER
-cGrj
" ~
But Ki OVS07CA -
,I ,9' IWS072A SERVICE BUILDlHG HVAC g_
OVS07CS - s' ,7 IV.A)728 SERVICE BullDiNG FUEL BUILDING h TURBINE FRG1SXDiVI > C00ENSER (flG 2 IvPO O I %0^ PUMPOWN _
+
c, o tydli - v to 1 I DRYhRL CHitLERS g h 99 mm
\ q 0W FROM SX DIV 2 i CCtOENSER
,9 8 Wk
,M 3 IWS0668 IVP04C8 .a .tps FNN -
NN LNT - 11 ll Nm C NN C Of. M o eo t7 oe HH Q D.4 NN Figure 3.2-51 Plant Service Water System Sheet 4 3-156
CPS INDIVIDUAL PLANT EXAMINATION SYSTEMS 041 - o-gi i = n 5 a l s 8 lI II . a i
>] , ,
Qi l 5 " ' { __.} i} ta r-1
! g i 44 i
,iii i
gs vi n i k-- i i n j.
- i. {g4 ve i -
l ! j
>8118"i ikl! ! I l! ! it j!gi n - -
!'I !*3iti 2
!*,!! !**, i3!
2 i ep! e 5;;
$ti9 5;;
his5;
! _ =k ! w$ $ bk
*b$! h$! $!
IT II ' fi II
- 2.... . . . ... .. x.. .'.-f '
lio liin lio
% -22h -@
2 si e si i. .... .. si gS ..... g g 'g 8h 8
~
E&el BsHa1 L4rgt iiii ilia il:a Figure 3.2-52 Instrument Air / Service Air System 3-157 , _______m_ _ _ _ _ _ . _ _ _ _ _ _ _ _ _ _ _ . _ _ _ _ _ _ . _ _ _ _ _ . . _ _ _ _ _ ______ _ _ ___ _ _ _ _ _ _
r _- I CPS INDIVIDUAL PLANT EXAMINATION SYSTEMS o o 4. o o o o o o o o o o o 4, e ll l- l ia e a it1p: !lE, i ! i 4 Ed;Illji ljj lflP
!l ljl9 lia a o o o o o
!!illli ii 4, o o o o a o o a, si' 12Hi!-Ilin'l[E
==
t 1
't
;I
., o o T:!
N @ M .< . s . . o h .f -
-h g h 4
{E ..... . g. o , i l S e 53--+1n -><--
~~
j p ..... 7 S (c)l
. E_ "
Figure 3.2-53 Component cooling Water System 3-1f.1 l
- - - _ _ - _ -. -- _- u
CPS INDIVIDUAL PLANT EXAMINATIOff SYSTEMS l l U T !! 80f' f ( , Ced- (Co0 . l)5l ,54- 3cM- , I ll
" Col di shir St ed-*
"rF I 'M l!!!!i
).c4 h i
.q- l ,
; e j M co lj!! -cm-alil,a = ~
44' nd l1;!p 44- 1
! ti si H I M 44-+ h J,_ f((l
[ j b M lll . ! -cto--+ i i
~*~
~
!:iliI i
T il p i j I
! i om. l3;;
H I 5+34'5 i
~~
col - - etc B+;$-!! -
" +--- 00n "2 11011-1 il _
lll ++- g,ll*~
- ~ , , =
1 xI 1 1
@ !K _.
+ . . 08l!'l [
,3 e lld5O lf p T l\k I-T ._,
-ce> p3-
-l3lllj.g,.
IU! ,u l - Figure 3.2-54 Turbino Building Closed Cooling Water System 3-159
CPS INDIVIDUAL PLANT EXAMINATION SYSTEMS ,
~ '~
_L l li l I I
'
- T T,T
- w 3 x x x 1
~
g g' I Ii l ji({ { 1: v t it i ll r ii
-t I 73 I, itT, -
T T xT { x x ,;; cj;; x _x
!d L
43 li 2 't t e
' ft IU s. -
ltSo{ht I sete
~l l g
h A* fill fX '$ o - x
** kI lgl l _u
- h i r+ x x g-~lui dV t
D!I D!! E k k E I ill Figure 3.2-55 Fire Protection System i 3-160
CPS INDIVIDUAL PLANT EXAMINATIOtt SYSTEMS t k. el,l 4 Aa e
'Y e
$. . s- l 4t _
4 c i l
.T 4
'@:'4 u 9
kk 5
*E h
.N
$0,fk *
- t a fd
".5 ~' rd
.m
-a s% >
.i$
?%
5 v4 0 t" A e-1 4 m) g A O Figure 3.2-56 Containment CCP Vent Pathway 3-161
b 1 CPS INDIVIDUAL PLANT EXAMINATION LEVEL 1 QUANTIFICATZOM 3.3 giqu!1nat__QMAntif1 eat 19A This section discusses the derivation of component failure probabilitieu assigned to basic events in the Clinton Power Station (CPS) Probabilistic Risk Assessment (PRA) and the quantification of the system models and event tree sequences using this data. The basic event probabilities represent the likelihood that components modeled in the fault trees are unavailable due to hardware failure or out of service due to maintenance or testing. Failure events are defined by a specific component and failure mode (e.g., pump fails to start, valve , f ai) 2 to remain open, etc.). Failure probabilities can be determined from plant specific or generic data. The use of plant specific data is preferred because this would allow a greater potential to gain insights into CPS's response to transients. However, due to the limited operating experience at CPS (<6 years), inherent uncertainties in plant specific data leave generic data as the best choice. Plant specific or generic component failure rates fall into one of two categorica.
- 1. D2 mand failurgn - a component fails to perform its intended function on demand (e.g., pump fails to start, valve fails to open).
- 2. Time dopendent failures - failures occur at a constant rate in time, the probability of failure is independent of the time of previous failures, if any.
l The demand failure probability model assumes a constant probability of failure at each demand .cn1 a component regardless ' of the time between demands. However, the generic demand failure probability estimates include failures that occur between demands, but are only discovered when a component is called on to l perform its intended function. This type of failure is more 1 3-162 1 1
, . y---.--,n_,.--,. m ,, .y,_,,,y ,,y., m.....-my,_._,,y,_..,,y,..m,._r. m.,._, . . , . , , _ _ , . . , - . . . . , , r. ,,
CPS INDIVIDUAL PLANT EXAMINATION LEVEL 1 QUANTIFICATION likely to occur if the time between demands is long. Therefore, the actual unavailability of components due to demand failure is not completely independent of the time between demands. Conversely, if components are operated on demand several times in a short period, then the probability of failure is not completely proportional to the number of demands. The failure mechanism occurring between demands is not as likely on a per demand basis when the interval between demands is short. This affects the assignment of demand failure probabilities to components that undergo multiple demands such as safety relief valves (SRVs). These refinements to the generic demand failure were not exploited, however. The constant time failure rate model assumes failures occur at a constant rate in time; the probability of failura in an interval is independent of the time of a potential previous failure. The time between failures follows an exponential distribution. The model parameter estimated is the hourly rate of component' failure. one version of this model assumes that the status of the component is checked periodically. Periodic tests verify the operability of the components, but the component remains failed between the time it initially fails and discovery of the failure , during testing. If it is assumed that failures occur with uniform likelihood between tests, then-the average-time the standby component is unavailable is approximated as the product of the failure rate and one-half the time between tests (lambda x test interval /2). This version of the time failure rate model-was applied to standby and passive failure modes such as failure of manual, motor operated, and air-operated valves to remain j open. Valve position is verified by periodic system flow tests.
- In another version of the constant time failure rate model_used-for components that slut operate for a substantial period of time
, after starting or must remain in a changed state, unavailability l 1s approximated as the product of failure rate and mission time. 3-163
CPS INDIVIDUAL PLANT EXAMINATION LEVEL 1 QUANTIFICATION I Mission time is defined as the time that a component is required l 1 to operate successfully. This version of the model is used for the failure to run of pumps or diesel generators, failure of valves to remain open or closed, and filters or heat exchangers becoming plugged. For the CPS IPE, the mission timo is 24 hours. 3.3.1 Ligt of Gengrig Data Generic estimates were used in most casos to derive the failure probabilities for the Clinton Power Station (CPS) Probabilistic Risk Assessment (PRA) basic events. These estimates Woro obtained from industry recognized sources. The decision to use generic rather than plant specific d3ta was. based on two major factors:
- 1. CPS had been operating for approximately six calendar years >
when the basic event probabilities were derived. This short period of time is unlikely to provide sufficient data for most plant specific estimates in the PRA. It is expected that those failuro ratos over time will not be statistically different from generic data.
- 2. Component failure data from the first years of plant operation is typically excluded from failure rate estimates because componente typit211y experience a higher than normal number of failures during thic break-in period. This data is usually not representative of component long term reliability and is not used to predict future'rollability.
The sources of generic failure rate data used for the CPS IPE are as follows:
- 1. NUREG lR-4550, Volume 1, Revision 1, " Analysis of Coro Damage Frequency Grand Gulf Unit 1 - Internal Events",
3-164. ,
CPS INDIVIDUAL PLANT EXAMINATIOa LEVEL 1 QUANTIFICATION
- 2. NUREG/CR-2815, "Probabilistic Safety Analysis Procedures Guide"
- 3. Institute of Electrical and Electronics Engineers (IEEE) Standard 500, "IEEE Guide to the Collection and Presentation of Electrical, Electronic, and Sonning Components Rollability Data for Nuclear Power Gonorating Stations".
- 4. General Electric reliability data reports.
Table 3.3-1 provides the events which used generic data and the source of the data. 3.3.2 Plant-Specific Data and_Analysia Components and systems can be out of service either because of failure or for maintenance and testing. The following is a brief discussion on the derivation of data for those two categories. 3.3.2.1 Failure Rateg Plant-specific failure rato estimates were derived for the failure of the dicsol generators to start. The dicsol generators have boon started a sufficient number of timos (306) during the plant operating history (9/1/86 - 3/7/92) for surveillanco testing to determino a plant-specific failure rato estimate. Generic data was used for other components. The number of valid start failures and demands for each diesel was determined from plant logs. Post maintenance testing and l trouble shooting starts were not counted as valid demands. If a L diosol successfully started but did not start within a prescribed time, this failure was not counted as a valid failure for the purpose of this study. 3-165 t-
- . . . - . - _ - - _ _ - . - . - . _ _ - _.- .- ~ _ - _ . .. CPS INDIVIDUAL PLANT EXAMINATION LEVEL 1 QUANTIFICATION The number of valid start failures and demands for each diesel was reviewed to dotormine if there was a marked difference in reliability for each diesel. No such differnecos were found. The data for all three diosols were combined to datormino a single failure rato estimato for all three diosols. This resulted in a domand failuro probability estimate of 2.0E-02 which comparon closely with the generic estimate of 3E-02 in ; NUREG/CR-4550. 3.3.2.2 Maint_qAance and Testiing There are two general categorios of maintenance actions:
- 1. Egntinelv scheduled maintenange - Maintenance occurring periodically which is intended to ensure that a component operatos at peak officiency (proventative maintenanco).
Examples include oil changes, boaring replacement, filter replacement, etc.
- 2. Unscheduled maintenance - Maintenance involving repair or replacement of a component due to failure during normal operation or upon detection during periodic testing (corrective maintenanco).
Unscheduled maintenance activities usually require a longer-period of timo to completo than scheduled activities. The frequency of both scheduled and unscheduled maintenanco can vary significantly from system to system depending on operating philosophy, e.g., waiting until scheduled outages rather than taking components out of servico during normal plant operations. Plant specific data was used to derive the fraction of time a given component or train of equipment could be expected to bo out of service for maintenance. Plant data was assembled for the timo period 10/15/87 through 1/4/92, exclusivo of planned and forced outages. 3-166
l CPS INDIVIDUAL PLANT EXAMINATION LEVEL 1 QUANTIFICATION Testing actions refer to periodic operations or inspections of components that verify they can perform their intended function. These acts are usually performed to satisfy requirements j contained in the CPS technical specifications. In many cases the systems are designed to automatically realign if an accident sequence were to occur during a routine test and, if so, testing time was not counted as unavailable time. Information used to derive component unavailability during testing was obtained from a review of CPS surveillance procedures. 3.3.3 Human Failure Data (Generic and Plant-Specific) Human error has been included in the Clinton Power Station (CPS) probabilistic risk assessment (PRA) in several ways. First, routine actions such es testing and maintenance result in the unavailability of systems and equipment. Second, errors made by personnel, either before, during, or after an event, could affect the outcome. Recovery actions possibly taken to restore failed equipment or to correct errors are also included. The human reliability analysis (HRA) for the CPS PRA entails the estimation of human error probabilities (HEPs) for various operator and other plant staff actions which affect the model. These personnel actions are called human interactions (HI). The HI basic events were identified and' defined in the deve topment of both the system models (fault trees) and the failure sequences (event trees). 3.3.3.1 Tyggy of Human Errors Modeled l _ Numerous human interactions are relevant to the successful operation of plant systems modeled in the CPS PRA. Those interactions which hr' s crucial ef fect on systems, trains, or components are represenced by human error events in the fault trees. Additionally, some operator actions are modeled 3-167 i
- ~- - - . - - - - - - . - - - . - - - - - - - - - - -
CPS INDIVIDUAL PLANT EXAMINATION LEVEL 1 QUANTIFICATION l individually as event tree headings, particularly in the station blackout (SBO) and anticipated transient without SCRAM (ATWS) event trees. Three categories of human interactions were considered for the CPS PRA model. These are Pre-initiating event interaction,
- Human actions which lead to an event, and Post-initiating event interactions.
The first category includes failures to restore equipment properly following testing or maintenance and failure to calibrate instruments correctly. Human errors that lead to initiating events are captured in the initiating event frequency estimates derived for accident sequence quantification. Since initiating event frequencies are determined empirically, these events will not be discussed further. Finally, the post-initiating event human interactions include operators failing to take the necessary action to ensure successful system operation. This includes failures to initiate system operation manually, failure to take actions to ensure continued system operability during the system mission time, and restoration of failed systems. 3.3.3.1.1 Pre-Initiation , A number of systems and components are susceptible to the failure l to properly restore following testing and maintenance, or improper instrument calibrations. Provisions may exist for I automatic override of the system to the required configuration when an initiating event occurs. If this occurs, the restoration error event is eliminated from the fault treo, If the system is normally manually started and the-steps required to start the system include the necessary lineups, then the improper restoration' error was not included, Otherwise if the system is not automatically aligned to its proper configuration, the probability that the system will not be manually restored 3-168-
CPS INDIVIDUAL PLANT EXAMINATION LEVEL 1 QUANTZFICATION following test or maintenance was determined. Table 3.3-2 contains the restoration and calibration error probabilities. There is a total of approximately 131 pre-initiation events in the models. 3.3.3.1.2 Post-Initiation Post-initiator events include two categories, procedural actions and restoration of failed components or systems. The first type of action relates to proceduralized actions that are taken by the operator in response to an event. These are primarily in the emergency operating procedures (EOPs), but include steps in support procedures. They include manual alignment of systems into configurations different from their normal (design) alignment; For, example, the alignment of the Fire Protection (FP) system as a source of injection to the reactor vessel or manual starting of the Standby Liquid Control (SLC) system. There are about 33 procedural enatits modeled. Table 3.3-3 contains these post-initiator hutaan $nteraction probabilities. The second type of action involves the repair or restoration of systems assumed in the event trees or fault trees to have failed. For example, recovery factors can be applied to the restoration or repair of the Residual Heat Removal (RHR) or the diesel generators after failure has been previously assumed. There are j about 44 repair or recovery actions.- These are further discussed in-section 3.3.3.2. l t 3-169 l
- - , - ,, - ..: - - . . = - . - . .
CPS INDIVIDUAL PLANT EXAMINATZON LEVEL 1 QUANTIFICATION 2.3.3.1.3 Human Error Probability i l l The determination of human error probabilities (HEP) followed two I general methods. The first method is for pre-initiator actions and post-initiator actions that are proceduralized. This method is described in the following sections. A different method was used for recovery of failed components and systems. This method is described in section 3.3.3.2.1. The determination of the appropriate human error probability (HEP) for each identified operator action was accomplished in five major steps. First, a conservative screening value was derived for each human interaction using the methodology discussed below. After quantification, a sensitivity analysis was performed to identify the more important actions. These were then analyzed using a more detailed human error evaluation method. Fourthly, a dependency analysis wrs performed to account for the interaction when the operating crew must accomplish two or more actions in one sequence. Finally, near the end of the project after the models had been refined over several months, sensitivity analysis were reperformed. These steps and the results are discussed below: 3.3.3.1.4 ScLegaino HRA The screening methodology develops HEPs that are conservative in comparison to estinates that might be realized by following more detailed methods. The method relies principally on the NUREG/CR-1278, " Handbook of Human Reliability Analysis with Emphasis on Nuclear Power Plants", developed by Swain and Guttman. This document explains the basic terms, discusses performance-shaping factors, and human performance models. The various models allow the development of HEPs under a variety of conditions that may be encountered in nuclear plants. 3-170
i CPS INDIVIDUAL PLANT EXAMINATION LEVEL 1 QUANTIFICATION l Later methods have attempted to refine the ideas presented in NUREG/CR-1278 by developing more detailed human performance models and including supporting data (for examplo, by observing training exercises and ovaluating the responses). These generally have tended to produco lower failure estimates than direct application of NUREG/CR-1278. Three categorios of human actions were considered for assigning screening analysis HEPs. These categories are as follows:
- 1) Failure to align systems and/or components properly following test or maintenanco; ,
- 2) Manual alignment of systems into configurations different from their normal alignment; and
- 3) Actions that are taken by the operator in response to a transient that are specified by the Emergency Operating Procedures and the satellite procedures.
To treat these categories of human actions consistently, an HRA guideline was prepared for the CPS IPE derived mainly from NUREG/CR-1278. This was necessary because NUREG/CR-1278 contains such a large amount of information on human failures that there may be several interpretations of the data or methods used to apply the data. The guidelines for the rcreening HRA consist of flow charts and tables designed to determine which of the human actions are involved, then assess the conditions, performance shaping factors, or the particular situation. For examplo, the flow charts ask whether the action is a simple manual-task specified by EOPs, whether the available time to accomplish the action to provent core damage' is short, whether suf ficient information is available to correctly diagnose the situation, and whether the stress of the initiator is high. Based on the responses to these questions, the analyst 3-171
l , CPS INDIVIDUAL PLANT EXAMINATION LEVEL 1 QUANTIFICATION is either routed to tables of time dependent values of HEPs or led to an assigned HEP value. These values are taken from the information presented in the NUREG. The model utilized in the HRA guideline for the time dependent HEPs for routine operator actions performing simple tasks was taken from the industry degraded core rulemaking committee (IDCOR) individual plant examination methodology (IPEM) for , i boiling w7ter reactors (BWRs). The methodology taken from this k report was actually derived from and applied consistently with NUREG/CR-1278. The data taken from NUREG/CR-1278 was extrapolated in the IDCOR Technical Report 86.3B1, Individual Plant Evaluation Methodology for Boiling Water Reactors, Volumes I& II, cover the very early period of time,after an event occurred while remaining consistent with basic HEPs in WASH-1400 and NUREG/CR-1278 (i.e., operater Tctions required within the first minute were assigned a HEP of 1.0). Thus the CPS screening process is essentially based on the models and conditions specified in NUREG/CR-1278. 3.3.3.1.5 HRA Sensitivity After core damage sequences were quantified using screening HEPs, the core damage sequence frequency results were reviewed to determine the significant human actions which should be subjected to detailed analysis and derivation of more representative HEP. The purpose in performing more detailed HRA evaluation on those human actions determined to be significant was to assure that the plant procedures, training and equipment were appropriately represented by the HRA model. In addition, constructing a detailed HRA analysis that fairly represents the plant allows more appropriate insights to be drawn. Two primary criteria were used to select human actions for more detailed analysis. 3-172
CPS INDIVIDUAL PLANT EXAMINATION LEVEL ~1 QUANTIFICATION-First, actions were selected that appeared to have a significant i ,- affect on the core damage frequency. Detailed analysis of every action could lead to a refinement in core damage frequency and a more thorough understanding of the plant's ability to withstand accidents through its operation, training and equipment. However, many possible human errors have an inconsequential effect on plant risk. With limited time and resources, only those errors that could have a significant impact on core damage frequency were considered for detailed analysis. Human interactions which had a Fussell-Vesely importance meaf. < of greater than or equal to 0.1 were selected for sensitir i a( analysis. If the sensitivity study resulted in a change _n - damage frequency greater than SE-06, the human interaction
-selected for the more detailed analysis.
Second, the core damage sequence results were examined to see if potentially non-conservative HEP estimates for any operator actions could have led to non-conservative sequence quant.ification results. Table 3.3-4 contains the sensitivity. analysis-of important human interactions. 3.3.3.1.6 Detailed .HEh For the detailed analysis, the derivation of HEPs was performed according to the Accident Sequence Evaluation Program ( ACEP)- human reliability analysis method as described in-NUREG/CR-4772,
" Accident Sequence Evaluation Program Human Reliability Analysis Procedure". This method bases human error probability estimates on the time available to complete the action, the procedural guidelines available for the action, the training of operators on the action, the stress associated with the action, and the-potential for different operating crew members to correct mistakes. These characteristics were assessed for each action 3-173
CPS INDIVIDUAL PLANT EXAMINATION LEVEL 1 CUANTIFICATION analyzed under this method, and probability estimates were
- derived.
The techniques that have been developed for human reliability analysis involve the following steps: 1) breaking down the human action into smaller constituent actions, 2) evaluating the likelihood of errors in these individual actions, and 3) deriving the total human error probability by combining the probabilities of the individual action errors. The error probabilities are derived by considering performance shaping factors (PSFs) that influence the likelihood of errors. PSPs considered include procedures, training, the complexity of the required action, the time available to perform the action, and the 1.ikely stress of the situation. The first step of the ASEP methodology is to specify the initial conditions and assumptions that apply to each individual human action. Next, applicable emergency, off-normal, operating and annunciator procedures were reviewed. Aspects of procedures that affect task performance include the following: Existence of symptom-oriented EOPs 4 , The degree-to which non-EOP procedures are required The clarity of the referenced procedures How uell the procedures " tic" together How the individual procedures are organized-internally Review of procedures allows an assessment of the quality of the guidance given to the operators when a particular action is required. If procedures offer clear and unambiguous guidance, a lower probability is assigned; if procedures do not clearly point toward appropriate action, then a higher failure probability is assigned. 3-174
.m---n- , , , - - - ,.r,--, m -n,- ,
CPS-INDIVIDUAL PLANT EXAMINATION LEVEL 1 QUANTIFICATION The plant procedures also provided the basis for determining what ; subtasks composed the modeled actions. Many of the modeled human actions required an operator to perform multiple tasks or require two operators to perform tasks in parallel. Another area that affects the assignment of human error probabilities in the ASEP method is operating crew training. In general, actions that are emphasized in training receive lower HEP assignments, while actions that are not covered receive higher HEP assignments. Following the procedure and training review, an in-depth system analysis of annunciators and itrumentation was performed to identify which indications provide signals that allow and/or assist in the diagnoris of an event. From the set of all indications that occur as a result of a modeled event, a single signal which is viewed as the earliest or most informative signal was chosen as the " compelling" signal. The ASEP procedure utilizes several time intervals in the calculation of the diagnosis HEP. These intervals are as follows: Ta - Time needed to reach a particular location and perform a required action once a correct diagnosis of an-initiating event has been made. Tm - Maximum time availabie for diagnosis and performance of an action following the initiating event that will prevent core damage. Td - Maximum time available for diagnosis which will still allow performance of the specific human action. Td equals Tm~ Ta-3-175
.- _ m-.. _ - . _ . _ _ . _ _ _ . . _ - . _ . _ . _ _ . _ _ . - _ _._._._ _
CPS INDIVIDUAL PLANT EXAMINATION: LEVEL-1 QUANTJFICATION
- Ta_was measured'through actual walkdowns of equipment for- ,
locations outside the main control room, and by operator and training -instructor's estimates for actions performed inside 7the main control room. Tm-was determined using the Modular Accident: Analysis Program- (MAAP) and a variety of system / equipment _ r specific engineering calculations. Computation of an overall HEP using the ASEP methodology involves the calculation of HEPs specifically related to' diagnosis, performance, and performance recovery. A careful selection process for appropriate HEPs was carried out using ASEP. Each human action selected for the detailed HRA was , evaluated against six performance shaping factors. In addition, an interview was held in the f.PS simulator with an operating crew, (control room and unit attendants) and two training instructors. The human actions under analysis and their associated PSFs were reviewed by the crew and instructors. Utilizing comments from the crew-and instructors with.the' documents referenced above, the ASEP methodology was applied for the six selected actions. Table 3.3-5 contains the results of this analysis. 4 As part of the Detailed HRA, an expert consultant, D.G._Hoecker, of Westinghouse Electria Corporation, was retained to perform an additional revj ew of the: detailed -HIUL process and results. His-conclusion was-that the detailed HRA was properly _ performed and his results corroborated the results obtained by the CPS ASEP application. 3.3.3.1.7 Assessment of Dependency __Amona Human Error Ever*ia_ Since the operating crew must detect, diagnose, decide, and act upon all actions:which take place early in tho' scenario, it is reasonable to assume that interaction among'HIs'is possible. It is possible that groups of human actions in the IPE models are dependent, so that the. conditional probability of one human-error-given that others have occurred would be higher than the unconditional probability of a single human error. If 176 ^
CPS INDIVIDUAL PLANT EXAMINATYON LEVEL 1 QUANTIFICATION combinations of dependent humar error events occur in core damage sequence cut sets, then assigning to each event its unconditional HEP would underestimate the probability of that sequence cut set. The HRA included investigation of dependent post-initiator human c_rors. HEPs were adjusted for combinations of dependent events found in the core damage sequence cut sets. The first step in this investigation was to determine the combinations of human error events that occur together in sequence cut sets. These combinations were determined by setting all HEPs to 1.0 for potentially dependent human error events. The IPE models were quantified with these HEPs and sequence cut sets were derived. Because the HEPs were set to 1, no potentially dependent combinations of human error events were lost as a result of truncation. The resulting sequence cut sets were searched for combinations of human error events, and any combinations were noted. The degree of dependence between such events was assessed and conditional HEPs for the events given occurrence of the other events in the combination were assessed. The five levels of dependency described in NUREG/CR-1278 were employed. The following factors were consiocred:
- Coincidence or close proximity in time
- Same procedure or EOP path
- Common diagnosis of need for operator action The formulae from the Technique for Human Error Rate Prediction (THERP) (NUREG-2254, " Handbook of Human Reliability Analysis with Emphasis on Nuclear Power Plants") dependency nodel were used to determine the conditional HEP for dependent actions.
3-177
CPS INDIVIDUAL-PLANT EXAMINATION LEVEL 1 QUANTIFICATION For those cutsets which had two . cur more dependent human actions, the dependent failure probability was inserted into_the cutsets in place of the 1.0 value that had been applied to investigate these actions. The remaining HIs were reset to their prior value (screening or detailed HRA as appropriate). After these replacements, the cutsets were re-evaluated. 3.3.3.1.8 Einal HRA Analysis Since the HRA sensitivity analysis described earlier (3.3.3.1.5) was completed relatively early in the project (before several model refinements and recoveries were completed), the HRA sensitivity analysis was reperformed. All HEPs were reset to the original screening values and the model was requantified. The importance measures uf basic events ir. the core damage results were analyzed. All post initiator HRA events with an achievement or reduction worth equal to or greater than 1.1 were retained for further review. These events have the potential for changing core damage frequency results by as much as ten percent in either direction. These events are shown in Table 3.3-6. Easic events 6 to 12 in Table 3.3-6 were derived from empirical data as described in section 3.3.3.2.1 and were not considered further for detailed HRA. Basic events 2-through 5 in Table 3.3-6 were the result of the previous detailed HRA (3.3.3.1.6). Basic event 1 is a newly identified event resulting from this analysis. This event was scrutinized using the ASEP screening methodology. It was discovered that this event had a non-conservative value (based on the ASEP screening) which was corrected for in the final results. 3.3.3.2 Recovery Acilons Initial quantification results are generally conservative for several reasons. One is that many initial failures can be , recovered by probable operator action. The initial sequence cut 3-178
CPS INDIVIDUAL PLANT EXAMINATION LEVEL 1 QUANTIFICATION sets were examined to assess the events which contribute most to cora damage frequency. These events were examined to define recovery actions and assign probabilities of successful recovery. Three types of recoveries of failed components were considered as follows:
- 1. Repair and restoration of failed components, such as a pump that fails to start or a valve that fails to stroke.
- 2. Manual initiation of systems for cases in which automatic initiation has failed and other manual system recoveries from the main control room.
- 3. Use of altet.iate systems or actions, such as using Fire Protection (FP) or Control Rod Drive (CRD) as injection sources.
These are discussed oelow. 3.3.3.2.1 Repair and Restoration of Failed Components Basic events with Fussell-Vesely importance values greater than or equal to 1.0E-02 were initially considered in the recovery analysis. For components in systems that act directly as potential core cooling sources, the correct time threshold for recovery is approximately one-half hour. Th1s is based on CPS MAAP analysis, which shows that no significant core damage results following a transient with no injection for one-half hour. For components related to room cooling for injection systems, an appropriate time threshold is 4 hours. If such components fail, then several hours pass before injection system components in the affected rooms potentially fail because of high temperatures. 3-179
.m-CPS INDIVIDUAL PLANT EXAMINATION LEVEL 1 QUANTIFICATION Diesel generator recovery probabilities were initially determined for one and four hours, corresponding to the time considered in the event tree for AC power recovery in time to prevent battery depletion.
The Recovery Failure Probabilities (RFPs) for significant component failure basic events were determined by utilizing the results from Electric Power Research Institute (EPRI) RP-3000-34, draft report, " Faulted Systems Recovery Experience". This method classified components into three categories by system, failure mode, and equipment type. If data for more than one category fit the component being considered for recovery, then the most appropriate value was chosen by considering the composition of the data used to derive the non-recovery probability in each ca tego ry . The results are tabulated in Table 3.3-7. Up to two recoveries per cut set have been included in this study, based on the demonstrated capability of CPS to control multiple field teams during emergency exercises, including graded exercises. 3.3.3.2.1.1 Re_c_qYem of Lon _9C Feedwatqr EPRI RP-3000-34, " Faulted Systems Recovery Exper.ience", had no data for recoveries of foodwater. Therefore, to quantify the recovery from loss of Feedwater (FW) initiator, the operat}ng experience of other BWR's was evaluated to estimate the probability that FW can be recovered rapidly. Using this dat a, a recovery failure probability of .21 was obtained. 3.3.3.2.1.2 Recovery _pf AQ Power Supallog Several recovery probabilitics of off-site power were developed for different time periods using NUREG-1032, " Evaluation of Station Blackout Accidents at Nuclear Power Plants". These values are contained in Table 3.3-8. h time-phased recovery was utilized for station blackout cut sets. Station blackout (SBO) 3-180
__ _ _ _. _ _ _ _ . - . _ . - . _ _ _ _m CPS IN'.=IVIDUAL PLANT EXAMINATION LEVEL 1 QUANTIFICATION sequences involving failure to recover AC Power (off-site or division 1 or 2 diesel generators) include some failures that can occur at any point in time over the 24 hour mission time following the loss of off-site power (LOOP) initiator. An example of the above is the failure of the diesel generators to run. Depending on when in the mission time those failures occur, more time may be available for AC power recovery; i consequently the probability of failing to recover AC power may be lower. For example, if a diesel generator fails to run after running successfully for 4 hours, the amount of time available for off-site power recovery in increased by 4 hours. Because the probability of recovering off-site power increases markedly over time after the LOOP initiator, the time at which the diesel fails has a significant effect on the overall probability of any sequence cut set involving the diesel failure and LOOP. Probabilities were derived for cut sets involving diesel generator failure to run events along with failure to recover off-site or failed diesels, taking into account a time-phased recovery probability. These probabilities are for the diesel failure and the failure to recover off-site power and the failure to recover the failed diesel. Tables 3.3-9 and 3.3-10 list the time-phased' recoveries for the two applicable station blackout sequences. 3.3.3.2.2 E= ual Initiation R3covery Events To determine the failure probability for the manual initiation of Emergency Core Cooling Systems (ECCS) recovery action, the methodology _from IDCOR Technical Report 86,3B1, " Individual Plant Examination Methodology for Boiling Water Reactors", was used. This is the guidance used in the screening analysis discussed in-Section 3.3.3.1.4. A MAAP simulation which involved a transient with no injection shows that the operator would have approximately 12 minutes before-reactor water level would reach the top of active fuel. This results in a failure to recover probability of 0.009. 3-181 ,
CPS INDIVIDUAL PLANT EXAMINATION LEVEL 1 QUANTIFICATION For manual' initiation of Division I or II Shutdown Service Water (SX), the initial screening value obtained as described in Section 3.3.3.1.4 was retained. 3.3.3.2.3 Recovery tisina Alternate Systems j l In the event of loss of all safety-related injection systems (i.e., a common cause Shutdown Service Water (SX) failure) and loss of Condensate (CD)/Feedwater (FW) (such as by DC bus
)
failure), Control Rod Drive (CRD) could be used for make-up. l This is possible because SX failures would not disable primary j injection systems for several hours, even though diesel generator engine cooling would be lost. During this time, decay heat would decrease to a point at which CRD injection is adequate with no operator action. For these cases, a recovery based on CRD system reliability is added. In a similar fashion for sequences in which delayed failure of injection systems has occurred and reactor depressurization is available. The fire protection system was applied as an injection recovery source. 3.3.3.2.4 Recovery Sensitivity NUREG-1335, " Individual Plant Examination: Submittal Guidance" states: ... any sequence that drops below the core damage frequency criteria (of 1E-07] because the frequency has been reduced by more than an order of magnitude by credit taken for human recovery actions should be discussed (in the IPE submittal)." Therefore, a special sensitivity analysis was done in which any recovery actions with a value of less than .1 was set to 0.1. The total model was requantified with these values. The frequency of each sequence was compared to the frequency for the base case. l 3-182
ji-l CPS INDIVIDUAL PLANT EXAMINATION LEVEL 1 QUANTIFICATION ~ i The'results'of thisfanalysis showed that'none of the base caseL
.probabilitiesLwas changed by an order of magnitude. The-frequency of-one sequence, T5Q2629V (loss of feedwater),
increased by a. factor of 5.8. Several other sequences increased
' by less than a factor of 2 and overall cc > damage frequency increased by only 4%..
3.3 4 GERR9n-cause Failure Data This section discusses the evaluation of component common cause failure probabilities. Common cause failures represent the failure of multiple redundant components from a common failure mechanism. Common cause failure probabilit les are treated as basic events in the level 1 Probabilistic Risk Assessment (PRA)'. The common cause failure analysis is part of a wider-evaluation-aimed at analyzing and estimating-the effects of dependencies in and among plant systems. Important dependencies are those which compromise the redundancy of a system's ability to prevent or mitigate a severe accident.
-The common cause failure analysis identified those dependencies which are not explicitly-evaluated in other parts of the PRA.
Listed below are' dependencies explicitly treated in other phases of the PRA and their method of-treatment. i-Succort System Decendenciga - Transfers to support system fault trees are: included at appropriate points inLsystem-fault trees. E Linking fault trees during fault tree reduction and-cut set h generation ensures such depend =ncies are expressed correctly in; PRA results. 3-183
CPS INDIVIDUAL PLANT EXAMINATION LEVEL 1 QUANTIFICATION Shared companpnts Amono Front-line Systems - This type of dependency is evaluated correctly by linking fault trees in the sequence quantification phase of the analysis in the same manner as support system dependencies. liggan Errors - Some human error dependencies are included in the common cause failure evaluation. Human crrors such as incorrect calibration of sensors or instruments are included as basic events in system inodels. Human errors such as failure to restore components to service af ter isolation for maintenance are also explicitly included as basic events in system models. Operator errors occurring subsequent to an accident initiator are explicitly treated in plant sequence models as discussed in , Section 3.3.3.1.7. MaintenanE9_ add Testino - Unavailability of multiple components due to preventive maintenance, repair (unscheduled, corrective maintenance), and testing are included as separate eventa in the system fault tree. However, multiple unavailabilities which are prohibited by technical specifications have been excluded. External __Eventa - Dependencies among component failures due to the effects of external events (earthquake, fire, external flood, tornado, and heavy wind) are excluded from the PRA at this time. The effects of these events will be evaluated in the Individual Plant Examination for External Events (IPEEE). The common cause failure analysis involves defining additional basic events that represent common cause failures of components, and adding them to the system fault trees. Common caur- events are defined and their probabilities estimated in order to capture the dependency among component failures (both within a system and among separate systems) arising from causes other than those listed above. Some additional causes include common design, manufacturer, installation errors,-adverse environment, internal physical' similarities such as identica? perts, and human errors , during maintenance, testing, or operation. 3-184
-v- n v-* y ,w + -,+w w -<-w. - - - - - - - - -
CPS INDIVIDUAL PLANT EXAMINATION LEVEL 1 QUANTIFICATION The common cause failure analysis for the CPS PRA used the multiple Greek Ictter (MGL) model. This model's parameturs (the
. Greek letters beta, gamma, delta, etc.) are defined as conditional probabilities of failure of additional components.
For example, the MGL parameter beta is defined as the probability f the common cause failure of two components in a common cause group given that one has failed; gamma is defined as the probability of the common cause failure of three components, given the failure of at least two. The basic event probabilities of the common cause events were the product of the single component failure probability estimated from plant data or generic sources and the MGL estimates. The component groups for which common cause events were defined are largely those that have proved important in previous PRAs and reliability studies. Table 3.3-11 r'ovides these component groups. After common cause events were included in the system models, probability estimates were calculated for each event for fault tree qtantification ano cut set generation. This required analysis of generic industry data tc terive parr'eter estimates for the model. Table 3.3-12 summarizes the results of the CPS common cause failure analysis. Common cause failure probabilities are derived from the failure rates discussed in section 3.3.1. The common cause failure rates can be per demand or per hour depending on the failure mode. 3.3.5 Ouantification_of Uravailability of Systems and Funct.iong Maintenance unavailabilities represent the probability that
- system trains are inoperable because of the performance of maintenance. Only maintenance activities that can disable the 3-185
CPS-INDIVIDUAL PLANT EXAMINATION LEVEL 1 QUANTIFICATION train's function were-considered in deriving these unavailabilities. Plant specific data was used to determine maintenance unavailabilities for the CPS PRA. Unavailabilities were derived separately for preventive and corrective maintenance so that the effects of either one on core damage frequency can be determined. Preventive maintenance consists of periodic maintenance activities that disable or isolate a train, causing it to be unavailable without recovery actions. Corrective maintenance consists of unscheduled activities that are performed in response to specific problems or conditions noted in the train's components. Corrective maintenance includes both planned and unplanned maintenance activities. Recovery actions are required to return the train to service. Maintenance unavailabilities are estimated using plant data as the product of average maintenance frequency and average maintenance duration. The tag out log for the period 10/15/87 through 1/4/92 was the primary source of data used for system unavailability data. The raw data required screening to reduce the data to a set appropriate for estimating unavailabilities. The criteria used to reduce the raw data were as follows:
- 1. Maintenance performed during cold shutcown was eliminated.
Maintenance performed partially during plant operation and partially during cold shutdown was counted, but only the portion performed during plant operation was used in the estimate.
- 2. Maintenance that did not disable or isolate a train was not counted towards maintenance unavailability estimates.
3-186
._ _ __ - _ _ _ _-_ --__--__-O
-CPS INDIVIDUAL PLANT EXAMINATION LEVEL 1 QUANTZFICATION If no maintenance events were found in the data for a rain and performance of preventive _or corrective maintenance is possible during plant operation, then the unavailability estimate was based on data from similar trains or systems. For examplo, estimates for safety-related DC battery chargers preventative mairitonance were based on t' i non-safety battery chargers because the safety related DC battery chargers have not been removed from service during plant operation.
Table 3.3-13 contains the maintenance unavailabilities used in the PRA which were derived from CPS-plant data. 3.3.6 Generation of Support System States and Ouantification of TAcir Probabilities Fault troos were developed for support systems required by front-line syctems. The effect that support system component failure had on front-line systems and coquences was modeled lar linking I the support system fault tree directly into the front-line and l other affected support systems. The use of the linking process climinates the need to produce support state event tree models to account for the affects of support systems. l 3.3.7 Quantification of Sequence Frequencies After the system fault trees were completed,-minimal cutset-equations for the top events were produced. Equations-for the-functional headings of the fault trees were derived-for L situations in which combinations of more than one fault tree top event for a given safety function was required. The functional' L equations for the headings in the level 1 event trees-were then 1 combined with the various initiating events to produce core-damage frequencies. 3-187 i
CPS INDIVIDUAL PLANT EXAMINATION LEVEL 1 QUANTIFICATION The computer Aided Fault Tree Analysis (CAFTA) program was used to develop and link the fault trees. The personal computer version of Set Equation Transformation System (PCSETS).was used to quantify the fault trees. Cutsets for systems and functions were retained down to 1.0E-09, with one exception. The low pressure injection function consisting of Low Pressure Core Spray (LPCS), three trains of Residual Heat Removal (RHR), and Condensate / Condensate Booster (CD/CB) systems could be retained to only 7.5E-09 because of computer limitations. Cutsets for level 1 sequences were retained to 1.1E-09 because of computer limit &tions. The linked fault tree methodology, as.used by PCSETS, properly models situations in which the same heading may appear twice in a sequence due to a transfer. The quantification software ensures that the failure of a component is counted onl/ once. For example, in the transient with isolation tree, if SRVs don't open, a transfer to the large break LOCA tree occurs. For this sequance, the question of whether a SCRAM is successful occurs twice, once on the transient with isolation event tree and again on the large break lOCA event tree. The linked fault tree methodology only considers it once. 3.3.8 Internal Floodina Analysis The Clinton Power Station (CPS) Individual Plant Examination (IPE) internal flooding analysis was conducted to determine the likelihood of core damage sequences initiated by flooding of equipment needed for core cooling or other critical safety functions. Flooding can be initiated by piping leaks, tank overfilling, maintenance errors, mispositioned valves, or pump seal leaks. 3-188
e Ea- --4 .,- - -- u .J.m 4ht.4: .__ CPS INDIVIDUAL PLANT EXAMYNATION LEVEL 1 QUANTIFICATION Plant locations were included in the flooding analysis if a flood in that location could lead to a SCRAM or shutdown requiring core cooling systems. Plant walkdowns, Sargent &'Lundy Report
" Internal Flooding Calculations", and input by the IPE Senior .
Reactor Operator were used to analyze and screen plant locations for vulnerabilities to flooding and determine what equipment would be effected by flooding. The components and systems that could fail if submerged by a flood were identified. The frequency of flooding at these locations was estimated based on the components (piping, valves, components undergoing maintenance, etc.) that could rupture and cause a flood. If thc flood could p?opagate to other locations, as identified by walkdowns and analysis performed, then components and systems that may be submerged and fail in those locations were also identified. Flood zones . ;he containment building were not included in this analysis. No safe shutdown system or component could be found'that voidd be disabled by submergence due to any credible flood originating in the containment. Estimation of the frequency (per year) of a flood in the locatione neeting the criteria outlined above was determined by summing tha frequency of component failures (pipe breaks, catastrophic valve ruptures, etc.) and the frequency of isolation failures related to maintenance activities. The frequency of , component failures was estimated by considering the components in each location using failure cata in Table 3.3-14. A section of piping was defined as a run of pipe between major discontinuities (e.g., pumps,_ valves, etc.). A section of piping may have any number of welds, flanges or bonds. Maintenance data evaluated for each location included activities that opened the system as well as maintenance on electrical components or instruments that did not cause a system breach. The frequency of maintenance activities in a location were derived from the CPS specific maintenance unavailability data for systems and components in a specific location. Since it was not 3-189
CPS INDIVIDUAL PLANT EXAMINATION LEVEL 1 QUANTIFICATION possible to determine from the data which activities actually breached a sy. em, engineering judgement was used to determine that less than 50% of the maintenance activities would be in this category. The maintenance frequency estimates were multiplied by 0.5 to account for this effect. The maintenance freq1ency estimates were also multiplied by an estimate of the probability of an operator failing to isolate the system prior to maintenance. This would create the potential for water to flow from a line that was opened for maintenance. A factor of 0.003 was derived for maintenance on safety systems and 0.01 for balance of plant systems. The difference reflects the more extensive requirements for safety systems. Also considered was the effect a flood in one location could have on equipment in an adjacent location. If a location was connected to another location that could flood, then it was assumed that equipment in the adjacent location were failed by the flood. Connections that could lead to flood propagation include doorways, hatches, stairwells and shared floor drains. These connections were verified by a review of drawings as well as plant walkdowns. Propagation of flooding from one area to another through an intermediate area or areas was also considered. For each area, an initiating event was developed for groups of one or more systems in each area. The Plant Service Water (WS) and Plant Chilled Water (WO) systems run throughout the plant. These systems run through locations where no safe shutdown equipment is located. Including an initiating event for each area in the plant for tne WS and WO systems would result in unrealistically high flooding frequencies which would distort the flood analysis. If a rupture of a WS or WO line could affect other systems modeled in the IPE, then the analysis was performed as described. A system wide initiator of lE-03 per reactor year was included in the model to account for the fact that a rupture in one of these systems could occur in an area where no critical 3-190
a CPS INDIVIDUAL PLANT ~EXAMINATZGN LEVEL 1 QUANTIFICATION-equipment was located. This is the same frequency used for a small break-loss of coolant accident (LOCA) and is conservative because a rupture would probably be isolated before the system was lost. Upon completion of the flooding initiator analysis, sequence quantification was performed using the internal events sequence results as a basis. Failures postulated to occur as a result of the flood were-related to components represented by basic events in the sequenco cut sets. Detailed results from the Ilooding analysis are provided in section 3.4.1.12. l 3-191
- . .~
i CPS INDIVIDUAL PLANT' EXAMINATION LEVEL 1 QUANTIFICATION Table 3.3 1 HJERIC CWOKMT FAILUeE RATE DAff failure Rete Cospnent type Estimate Data f elture Mode (per hour _ X ptr demand) Source J2 h Pwpe Dieset driven osup felle f 3 tun 8E 4/N NURE. CR 4550 vol.1 Rev.1 DIeeel driven pg f aite to etert M 2/D NUREG CR 4550 vol. 1 Rev. 1 Motor-driven pump f el t e t o rm 3E 5/W NUREG CR-4%0 vol.1 Rev.1 Motor driven pg feita to eter t 3E 3/D NUREG CR-4550 vol. 1 Rev. 1 Turbine-driven parap falte tu run (First hour) SE 3/M WUREG CR 4550 vol. 1 Rev. 1 Turbine driven pmp f elle to run 2E 5/N NUREG CR 2815 (ettsee@ent hours) furt.ine driven pmp f alle to etert 3E 2/D MUREG CR-4520 Vol. 1 Rev. 1 Velves: Alr op. vetve falle to close 2t 3/D WURtG CR 4550 vol.1 Rev.1 Alr op. velve felle to open 2E 3/D MUREG CR 4550 vot. 1 Rev. 1 Alr-op. volve plugged 1E 7/N NUREG CR 4550 vot.1 Rev.1 Air op. velve laproper trenefer SE 7/M WUREG Ck 4550 vol.1 Rev 1 (1} Air op. valve leprope closure 1E 7/M NUREG CR-4550 vol. 1 Rev. 1 Check volve feita to close 1E 3/D WUREG CR-4550 vol. 1 Rev. 1 Check volve falle to open 1E-4/D NUREG CR 4550 vol. 1 Rev. 1 Emptoelve velve felin to open 3E d/D NueEG CR 4550 vol. 1 Rev. 1 EmptoeNe volve plugged 1 E * ?, N NUREG CR 4550 vot. 1 Rev. 1 How contro' velve f aite to open 3E-3/D NUREG CR 4550 vol. 1 Rev. 1 Nydraulic vetve felle to open 2E-3/D NUREG CR 4550 vol.1 Rev.1 Nydroutic velve plugged it - // M NUREG Cs+4550 vc . 1 Rev. 1 Hydreutic valve leproper trenefer 1E 7/M NUREG CR 4550 vol. 1 Rev. 1 (2) - Motor-op. Seive falte to close 3t-3/D NUREG CR 4550 vol.1 Rev.1 Motor-op, valve feita to open 3E-3/D NUREG CR 4550 vol. 1 Rev. 1 Motor cp. volve plugged 1E 7/M NUREG CR 4550 vol. 1 Rev. 1 Motor-op. vetve leproper enefer SE 7/M NUREG CR 550 vol. 1 Rev. 1 (3) tafety relief velve f alle to oper' IE-2/D NUREG CR 4550 vol. 1 Rev. 1 Safety relief selve falle to ctrse 1.6E 2/D MUREG CR 4550 vol.1 Rev.1 Relief valve transier open 3.9E 6/N NUREG CR 4556 vol. 1 Rev. 1 Solenold volve falle to close 2E 3/D MUREG CR 4510 vol.1 Rev.1 Solenoid volve feita to open 2E 3/D NUREG CR 4550 vol. 1 Rev. 1 solenold valve plugged 1E 7/H NUREG CR 4550 Vol. 1 Rev. 1 Solenold vetve leproper trenefer 5E * //M WUREG CR 4550 vot. 1 Rev. 1 (1) Merwel valve felle to close 1E-4/D NUREG CR 4550 vol. 1 Rev. 1 (41 Manuel valve felle kr> open 1E 4/D NUREG CR*=550 vot 1 Rev. 1 Manuel valve plugged 1E-7/M NUREG CR 4550 vol. 1 Rev. 1 3-192
CPS INDIVIDUAL PLANT EXAMINATION LEVEL 1 QUANTIFICATION inbte 3.3 1 (Cont.) GENERIC COMPOWENT FAILUeE RATE DATA Fatture Rate Congxrwnt Type Estimate Date tt Mode li ure (tgrjour or Mr dmarrO $ouree Notg L Etoctr(cal Ccaponents: Battery charger outpJt f atture 1E 6/N NUREG CR 4550 Vol.1 Rev.1 DC bus felture 1E 7/M NUREG CR 4550 vol.1 Rev.1 AC bus failure 1E 7/M NUREG CR 4550 vol.1 Rev.1 Battery output failure 1E 6/N NUREG CR 4550 vol.1 Rev.1 Circuit breaker felts to close 3E 3/D NUREG CR 4550 vol. 1 Rev. 1 Circuit breaker falle to remain closed 1E 6/M WREG CR 4550 vol.1 Rev.1 Circuit breaker felts to open 3E-3/D NUREG CR 4550 vol. 1 Rev. 1 (51 Transformer falls to provide power 2E 6/M NUREG CR 4550 Vol. 1 Rev. 1 Dleael generator falta to tan 2E-3/M NUREG CR 4550 vol.1 Rev.1 Diesel generator falls to start 2E 2/D Plant Data inverter output f at tur e 1E 4/N NUREG CR 4550 Vol.1 Rev.1 Instrunentation armi Cora rol Cogxwwnts: ATM folla (any mode) 1.67E 6/N GE NSP$ Falture Report 190EC88 Dig. $1g. cond faite 1.79E 6/M GE NSPS Falture Report 190EC88 Logic saxiJte falls to operate 2.34E 6/N GE NSPS Falture Report 190ECS8 Flow swi tch f et t e any exale 3E 6/N NUREG CR 4550 vol. 1 Rev. 1 (61 Flow controtter falls to operate 'E 4/D WUREG CR 4550 vol. 1 Rev. 1 Tamperature transmitter algnal felts 3E-6/M NUfEG CR 4550 vol. 1 Rev. 1 !6) Limit switch falls open 6E-6/M NUREG CR 2815 Limit avltch felle closed 6E 6/N NUREG CR 2815 Levet switch felts to operrte 2.66E 6/M NUREG CR 4550 vol. 6 Rev. 1 Pressure switch falls to operate 2.66E 6/N NUREG CR-4550 vol. 6 Rev. 1 Relay switch falta to operate 3E 4/D NUREG CR 4550 vol. 6 Rev. 1
- Static transfer sultch felts oran 1E+3/D NUREG CH-4550 vol.1 Rev.1 Static transfer switch inproper transfer 1E-6/M NUREG CR 4550 vol. 1 Rev. 1 !T)
Metunt switch Falta 1E 6/M NUREG CR 2815 CVAC Copponents: Fan falls to run 1E-5/N WOREG CR 4550 Vol. 1 Rev. 1 Fan falls to start 3E 4/D - NUREG CR-4550 vol.1 Rev.1 Room cooter f alta to cperete 1.0E 6/M NUREG CR 4550 vol.1 Rev.1 Chiller unit f atte to run 2.4E-4/N lEEE*500/1984-Chiller unit falle to start 3E 4/D NUREG CR 4550 vol.1 Rev.1 l Denper falls to open 3E 3/D NUREG CR 4550 vol. 1 Rev. 1 Danper falls to close 3E 3/D NUREG CR 4500 vol.1 Rev.1 l t 3-193
b CPS INDIVIDUAL PLANT EXAMINATION LEVEL 1 QUANTIFICATION-- Table 3.3 1 (Cont.). GENERIC CCMPONENT F AILURE RATE DATA Failure Rate Component Type Estimate Date [g,lture Mode toer hour or oer demand) Source Notes
' Niscotteneous Componente:
Compressor felts to rui 2E 4/M NUREG CR-4550 vol. 1 Rev. 1 Ccapressor. faits to start 8E*2/D MUREG CR 4550 vol. 1 Rev. 1 Strainer / filter plugged- 3E 5/N NUREG CR 4550 vol.1 Rev. I' strainer setor feita to run 3E 5/N NUREG CR 4550 vol.1 Rev.1 181 Strainer motor falls to start 3E 3/D MUREG CR 4550 vol.1 Rev.1 (9? Heat excharger blockese 5.7E 6/M NUREG CR 4550 vol.1 Rev.1
- Orlflee plupeed 6E 7/M NUREG CR*2815 R @ture disk falls 3.9E-6/M NUREG CR 4550 vol.1 Rev.1 (10)
- Pipe / component leek 3E-6/M MUREG CR-4550 vol. 1 Rev. 1 (111 ,
Notes to Table 3.3.1: til Usee "elr operated valve spuriously opens" failure rate. (2) Usee "elr operated vetve spurlously closes" f ailure rate se hydreutic vetve date were ret eyeliable. [3] Usee " motor operated volve spurlously opene" felture rete. [4] Usee amenuel valve feita to open" felture rate. ($1 uses " circuit breaker felts to close" failure rate. (6) Uses " Instrumentation (sensor, transmitter, process switch) f ailure to operate" f elture rate. [7] Uses " circuit breaker felt to remain closed" failure rate. 181 Uses " motor-operated ptmp feita to rut" failure rate. [9] Uses " motor-operated valve felt to open" failure rete. [101 Uses " relief valve spurlous open" felture rate. [11] Uses "heet exchanger rtpture" failure rete. 3-194 1
CPS INDIVIDUAL PLANT EXAMINATION LEVEL 1 QUANTIFICATION Tebte 3.3-2 enigLAfl0N AND CAllBRAfl0N ERRORS OPERATOR ACTION FAILURE DisCUssl0N PRCS Falture to restore DG efter maintenance .003 screening Value Failure to restore FP prp af ter maintenance .003 screening Velve Falture to restore CD system af ter maintenance .003 screening Value Failure to restore C8 system af ter maintenance .003 screening Value falture to restore CP system after maintenance .003 screening value felture to restore FW system after maintenance .003 screening vetue NPCs not propee!'. rest J f rom maintenance .003 screening Value IA system not property restored from maintenance .003 screening Value LPCS systeen not property restored f rom maintmance .003 screening value Falture to restore 5x valve F032 after eialntenance .003 screening Vetue ICCS initiation logic divleton failure to property restore 003 screening value from maintenance HPCs initiation logic, failure to property restore frce .003 screening Value maintenance Contairment laoletion ct. . .a f at ture to restore f rom maintenance .003 screening value Falture to restore DG Initiation logic division after maintenance .003 Screening Value ARI initiation logic, falture to property r,4. ore from maintenance .003 screening Vetue RCIC, falture to property restore from maintenance .003 Screening Value falture to restore LPCI C after maintenance or testing .003 screening Value f atture to restore RK! A or a af ter maintenance or testing .003 screening vetue fatture to restore SLC train after meintenance or testing .003 Screening Value VA, VX, VY, VG, VM cooter leproperty restored from maintenance .003 Screening value RHR heat exchanger taproperty restored f rom maintenance .003 screening Value 3-195
l CPS INDIVIDUAL PLANT EXAMINATION LEVEL ..ANTIFICATION ' TabW 3,3 2 (Cont'd) RESTORATION A@ CAllBRATICW ERRORS OPERATCA ACTION FAILURE Discuss 10N PROB Failure to restore sX Division A, B, or C after maintenanco .003 screening value DG heat exchanger f rproperty restored frca maintenance .003 screening value Cooler 1E12C002A, 8, or C inproperty restored from maintenance .003 screening value Miscalibratica of HPCs flow transmitter .003 screening value RCIC tank tow level transmitter A, C E, G miscalibrated .003 screening value switch OPS 54038, 2Ps SA038 miscalibrated .01 Screening value switch I A052, I A053 miscalibrate<t .01 screening value switch 1Pst SA075 miscalibrated .01 Screening value switch 1PSL IA076 miscalibrated .01 screening value 3-196
CPS INDIVIDUAL PLANT EXAMINATION LEVEL 1 QUANTIFICATION Table 3.3 3 POST-INITIATOR M N N INTE2 ACTIONS OPERATOR ACTION FAILURE DISCUS $10N PROS Felture to initiate RHR Suppression Pool Cooling .05 Low stress; conplex procedare; routine task Operator f ailure to open air bottle isolation t alve .12 Low stress; sisple; Failure to line @ isolated SA Compressor rcotinely performed / Fallure to place SA co mressor in standby practiced Operator falls to (frw Lp Isolated SA dryer Operator felts to tine up CC to vacum pums Falture to line op vacusa pums Operator falls to align MS seat steem line Operator falls to ation $JAE B Operators Fait to Shed Battery Loads .9 Mgh stress Falture to Start RHR Shutdown Cooling 003 Low stress; ecaplex procedure; routine task Operator Falls to Restart RCIC Comressor if Weeded .1 Low stress; slepte; outside control room (trenstents)
.5 Medium stress; sisple; outside control room (LOCA)
Operator f alls to Align FP System for Core injection .5 Nigh stress; conplex Operator falls to Initiate SLC AAB .01 High stress; staple; trained tpon Manual Rod Insertion Ef forts 1.0 Due to tricertainty regarding effectiveness of this step, given an ATWS 3-197
CPS INDIVIDUAL PINIT EXAMINATION LEVEL 1 QUANTIFICATION Table 3.3 4 SEustilviff ANALYSIS OF IMPoetANT HUMAN INTERACTION 1
$ ELECTED OPERATOR ACTION SCREENING MAGNITUDE OF CHANGE IN CORE FOR DETAILED HEP MEP CHANGE
- DAMAGE FREQUENCY HRA Masuotty initiating Div I or il sx 5.0E-1 5 1.5E 5 NO Operator mispositions UPs 1A syTanis switch 1.0 10 6.1E 6 NO Operator Falle to Place a Feedgwp Back in 8.LE-3 3 1.1E-5 YES
~
service Operator Falls to Manually Initiate AD5 2.8E-3 10 6.1E-5 YE5 HPC$ $ystem leproperty Restored Fran 3.0E 3 3 4.5E 6 ho Qalntenance Qiscalibration of HPCS Flow Transmitter 3.0E 3 3 Approx. 2E 6 NO Ctenon cause Miscalibretton of RCIC Tara 3.0E - 3 3 4.5E-6 NO Level Transmitters operator Falls to Restart RCIC Gland Seal 1.0E - 1 2 1.7E 5 YES Compressor *** Div 2, f ailure to Properly Restore From 3.0E 3 3 Approx 2E 6 NO Maintenance Operator Falls to initiate SLC A & 8 1.0E-2 ** ** YES Falture to Restore $X Division IA After 3.0E 3 3 Arprox. 1E 6 NO Maintenance Fallura to Restore SX Division 2 After 3.0E 3 3 Approx. 1E 6 No Maintenance Failure to Restore sr Division 3 After 3.0E-3 3 Approx. 1E 6 No Maintenance Common Cause Operator Falls to Manually 1.0E-1 2 7.3E 6 YES Open 15x014A, B, & C mocus Cooter IvuG75A Imroperty Restored 3.0E 3 3 Approx. hi 6 No from Maintenance toca cooler tvh07sa improperly Restored 3.0E 3 3 Approx. 1E 6 Ao from Maintenance 3-198 l
CPS INDIVIDUAL PLP.JT EXAMINATION LEVEL 1 QUANTIFICATION Table 3.3 4 (Cont'd) SENSITIVITY AkatTSIS OF IMPORTANT HUMAN INTEPACTIONS SELECTED OPERATOR ACTION SCREENING MAGNITUDE OF CHANGE IN CORE FOR DETAILED , NEP HEP CHANCE
- DAMAGE FREQUENCY HAA Room Cooler 1VH075C Imroperly Restored 3.0E 3 3 AFprox.1E 6 No from Milntenance Rocss Cooler 1VY08SA leproperty Restored 3.0E 3 3 4.5E 6 W <
from kalntenance DC Load she x ng per CPS 4200.01 Not 9.0E 1 10 1.8E-5 YES Successful
- Screening hunan error probabilities (NEPs) were divided ty the f actors in this colum to derive new HEPs. The HEPs were used in sensitivity studies to determine the resulting change in core damage frequency.
- to sensitivity anetysis performed, Engineering judgement was used to select this event because of its significance in ATVS sequences.
- Stboegaent analysis has determined that loss of the RCIC Bland Seal Conpressor does not rerder RCIC inoperable.
- to sensitivity anetysis performed, Engineering judgement was used to select this event because of its significance in ATVS sequences.
Table 3.3-5 RESULTS OF DETAILED WUMAN REll ABillTY ANALY$[S INITIAL FINAL SCREENING VALUE VALUE Oparator Falls to initiate SLC A & B 1.0E-2 4.03E-4 operator Falls to Maruelty Initiate ADS 2.8E 3 5.0E-4 Operator fails to Place a f eedpurp Back in Service 8.4E 4 5.0E 4 Consnon Cause Operator Falls to Marually Open 1Sx014A, B & C 1.CE-1 2.5E-3 DC Load Shedding per CPS 4200.01 Not successful 9.0E-1 2.98E 2 Operator Falls to Restart RCIC Glend Seal Co@ ressor 1.0E-1 1.0 *
- Subsequent analysis has determined that loss of the RCIC Bland Seal Contrassor does not render RCIC inoperable.
3-199
CPS INDIVIDUAL PLANT EXAMINATION LEVEL 1 QUANTIFICATION Table 3.3-6 List of Major HRA Events Based Uppp The CPS Sensitivity Analysis Basic Event Descriotion
- 1. RSPCOOLSWW Failure to initiate Residual Heat Removal (RHR) in Suppression Pool Cooling mode
- 2. PISIRESTRB HRA Dependent failure to reatc*e tripped Feedwater (FW) System
- 3. GADSMANSYW Operator fails to manually initiate the Automatic Depressurization Systta (ADS)
- 4. SAS01ABSWW Operator fails to initiate Standby Liquid Control (SLC) trains A L B
- 5. Y DCLOADSWH DC load shedding not successful l
- 6. D3DGCCDDRI Failure to recover from thc common cause failure of three diesel generator to run in one hour
- 7. BDGRUNDDR1 /wilure of time phased diesel run in one hear
- 8. DISTHPINJR operator fails to recover failed High Pressure Core Spray System
- 9. DISTRIINJR Operator fails to recover failed Reactor Core Isolation Cooling system
- 10. YLI Failure to recover off-site power within one-half hour of loss
- 11. YOSC,0AJWH Failure to recover off-site power within one hour
- 12. YOSOT04SWH Failure to recover off-site power within four hours
- i l
s s t 3-200-4 y ,m .n --- -.__..m-._. , . , . , . . .r,., ..-...r.% , y,.,,..w, . , ,.,,y- -.
l l 1 CPS INDIVIDUAL PLANT EXAMINATION LEVEL 1 QUANTIFICATION Tebte 3.3 7 WOW RECOVERY Pe0BAjI U tift FON SIGkfFICANT BAllt EVENTS Beelc Event Description Non-unme Recovery Predebility ADG01KrCGR .5 hour recovary: Diesel DG01Cn Falle to rm .3e ADG01trcGA 2 hour recoverv Diesel 0001tn Falle to rm .ie ADG01KrcG5 .5 hour recovery: Oletet DG01tn Falls to stort .3e eDG01KroGs 2 hour recovery: Diesel DGOIKn Falls to e'. ort .ie F1CD020AVC Condenser overflow volve ICD 020 f alls to close 0.90b FiCD039AVC $JAt ein flow to cor**4er velve ICD 039 f alls to close 0.90b FC8011rdVC Condenser flow return valve ICB011n falls to close 0.90b FCD031rAVC Min fIow volve 1C0031n f aita to ctone 0.90b FFWO10nAVC Condenser flow return vetve 1FWO10n felts to close 0.90b GCC1312NVo .5 hr recovery: Como cause felture of A05 contatronent tool 0.34c valves 013A/012A to open e GCC1312MVO 2 hr recovery: Cccinun cause fetture of AD$ ccritstrwent loot 0.28c vive 013A/012A to open GXCL60sRVO Cor.imm cause f ailure of et teest 6 of 9 $RVs to open 0.33c HPXC001MPR HPC$ pupp f alls to rm 0.57b NPXC001MPs HPCs pts, f aila to etert 0.60b HPXF004WVO HPCS Injection velve F004 fe!La to c4=n 0.34c HPEF012MVC HPCS pwp min flow valve f alls to close 0.34c l HPMF012HVO HPCS Min flow to stop pool valve f alle to oren 0.34c HP1F015WVO HPC$ Suppression pool suction valve falls to open given signal 0.34c HRITECCLSZ Contem cause f elture of RCic tank tevet treamitters to actuate 0.30c l IWO35CCLSZ Ccr==m cause f elture of RCIC ter* Levet switches to actuate 0.30c l IRIC001TPR RCIC psrp f alta to run 0.73c l l 3-203
CPS INDIVIDUAI, PIANT EicAMIliATION LEVEL 1 QUANTH ICATION table 3.3 T (Cont'd) pietjtCwtpf PR.2fillliitts f an sig[1f1CAwi SAtlC tytutt peels Event Description Won-kone becovery Probability IslC0011Pt DCic p m fette to etert 0.73c Itif031wv0 RCIC suction volve f elle to cgen 0.34c latf04Swvo Steam eig5)ly leolatice volve felle to oten 0.Xe inif06aMv0 BCIC furtaltw enhaust velve i r ' ells t o c5en 0.34c w RADCLCCMPS Crmmun cause SHR A, 9, ord s.G tell to et:,rt 0.60b WSABCCCMPR .5 hr recovery: Cce==m cause tJ ted of WS PMe A, S, ard C 0.58b W5ABCCCMPR 2 hr recovery: Ccemen cause f ailure of WS pge A, p, ard C 0.25b XBPitCCWC RHR heet enchanger bypass fitne velve f aits to c4=n cceente cause 0.13c XDPASCCGTX Corunon cause f ailure Olv 1 erd 7 discharge pressure Irstrtamentation 0.10c xD$PacCGYX Cceman cause f ailure Div.1 ? ard 3 discharge pressure 0.10c ins t rtswet et t on 4 25x003<WVi Mov 15x003n f aits to teneln r4=n 0.13e X5x004rMv1 Mov 15x004n felle to remain cyen 0.15c X$x010nAVG Discharge vetve isx010n f alls to c5en 0.36b XtX01PrePa Ptw 15x01Pn f elle to rm 0.25b x$x01PrMP5 Ptw 1$x01Pn f alls to stort 0.43b Xsx041nAVO Discharge volve itx041n felts to cgen 0.36b x1x063rWVO Olscharge volve 1sx063n f elle to c5mn 0.13c Xsx173rMv0 Min flow velve 1sx173n f aits to cgen 0.13c XtxABCCMPs Cceram cause feiture of su A ard B pws to rtn 0.43b 3-202 i
. . - - . = . . - . - - . _ - . - - - - _ - , - _ - - -
1 CPS IllDIVIDUAL PIA!JT EXAMlliATIOff IEVEL 1 QUAllTIFICATIOli fable 3.3.T (Cont'd) E%PICOVERY P!,gp1l11111[Lige,L.11[d[11Ji&W,1.,M1](lylgI) ; I feele tvent Desc r ipt ion son. Wene Retovery PrtAmbility W empW xx$x0?8Cfx f ailure of A ettelrer disch,'ya pressure Iretrtsmant (tX028) 0.10c xxtx030GTX Failure of 8 etretter discharge pressure Instrisment ($x030) 0.10c Watest a Value taken f rom system category of tiectric Power Desearch lnetitute (Ital) DP 300014, ,
"f outted Systems recovery tagorierre Draf t gegerta b Value taken f rtse f ailure mtde setegory of (Pal RP 3000 34 c value innen f rom type of ewigsnent category of (PRI 30@34 3-203 '
._._ _. .. . . - _ . _ _ . _ _ . _ _ - . _ . _ _ - . . _ _ . . _ _ _ . _ . . ..___..__m . _ . . _ _ . . _ _ . . _ _ . . _ . - . _ . - . . _ _ .
CPS INDIVIDUAL PU*NT EXAMINATION LEVEL 1 QUANTIFICATION Table 3.3-8 CONDITIONAL PROBABILITIE O R RECOVERY OF OFF-SITE POWER Fall to Rostore Given not Rostored Conditional Within (Hrs) Within (Hrn) Probability
.5 0 .421 1 0 .25 2 0 .049 3 0 .036 1
4 0 .023 l 5.25 0 .019 l 6 0 .018 . l 8 0 .012 16 0 .0061 1 .5 .594 i i 5.25 .5 .045 6 4 .78 3 1 .14 i 6 l l
.i i
3-204
CPS IllDIVIDUAL PLAllT EXAMIliATIOli LEVEL 1 QUAllTIFICATIOli fat,te 3.3 9 M E $*MA$[D &[(QyiRf f{W g $ ] Q M g G Q O y Qlfk_' 1LV1U2 DESCRIPflCm (IVIL i CONTAlbulki AECCNE R Y RECOVERY b DG01tA or B f ei t a t o rm .2 .34 DG01rc f alta to tun 1 .34 Cconaan tause f allut e of any 2 or all 3 Diesel Gemretors to rm .1 .34 Diesel A, B, or C fuel oil pro felts .538 .75 Ccene c ause f e l t ur e of any 2 or at t 3 D iesel f ue l ot t pg= to s t ar t .12 .47 Cuwan c ount f el t ur e of any 2 or e t t 3 O level f uel ot t pmm t o rm .3' .75 isble 3.3 10 ILME PHA}iD PtCOVERY R* towG 1ERM ST ATION BL ACKWT st0UtNCE f tvit40G1DC2 OtsCRIPitCm LEVLL 1 RECOVERY CONTA!WHthf RECOVERY 1 HOUR 4 HCUR 1 HOUR 4 HOUR DG011A, B, or C f aita ta rm .14 191 .52 .87 Com=n cause f ailure of any 2 or ett 3 .03 .09 .52 .57 Oleset Generators to run Oleset A, B, or C f uel ot t psp f elts .54 . ", 4 .81 .84 Commun cause f elture of any 2 or oli 3 .02 .19 42 .52 ) Oleset fuel ott pne to start Conimon cause f ailure of any 2 or ett 3 .0052 .078 .81 .64 Diesel fuel ott pqm to run
/
)
3-205 . 1 I
CPS INDIVIDUAL PLANT EXAMINATION LEVEL 1 QUANTIFICATION Table 3.3-11 l COMMON CAUSE COMPONENT GROUPS
- 1. Diesel generators (failure to start and run)
- 2. Pumps (failure to start and run)
- 3. Motor-operated valves (failure to open or close on demand)
- 4. Circuit breakers (failure to open or clese on demand)
- 5. Batteries 1 1
I
- 6. Battery chargers
- 7. Air-operated valves (failure to open or close on demand)
- 8. Safety relief valves (failure to open or reclose on demand)
- 9. Check-valves (failure to open on demand; failure to remain closed)
- 10. Instrumentation and cor, trol components (failure to send signal or acteate equipment) i i
l l 1 3-206
CPS INDIVIDUAL PlJdiT EXAMINATION LEVEL 1 QUANTIFICATION table 3.3 12 (MwLIA2}t F AItUet BAlt titlMJD lenuttlttt_itiL*eles- ter hader of Ctzguente f eiting dnruard (d) (py. ret /f ollwL8'dt i 2 3 4 pr hwr th) Eqtit Diesel gererator f eita to etert 2.9t 2 3.1f 4 2.9t. 4 " d Olesel ge<erstor f eite to em 1.9t-3 5.3t 5 3.4t 5 " h pHa/LPCs pw f ette to etert 2 . 71 3 5.It 5 0 1.1[ 4 d til RHa/LPCs pg feite to rm 2.M 5 6.1f 7 1.M 7 1.21 6 h thutdown service water pat 2.5t 3 4.4t 4 " " d (2) f elle to etert $hutdan service water pet 2.M 5 1.N 6 " " h (2) _ f alle to rm $tervAry titptd controt pm 2.St 3 5.0t-4 - ~ d f elle to start ord rm Circulottrig water pro 2.M 5 4.0t 7 1.3t 6 -- h felle to rm Chec k vet ve f ei t o t o osen 5. 01 4 5.0t 5 - - d Check valve f elle to close 9.M 4 4.0t 5 ' " d Alt op. valve f alle to cgerete 1.71 3 2.91 4 ' " d motor gi. volve felle to t$erate 6 vetve ormgi 2. N . 3 . 71 5 1.3t 6 7.4t 7 d (31 a 4 valve grm4) 2.M 3 6.25 4 4.2t 6 1.1t 5 d 3 velve gra p 2.M 3 9.4t 5 2.it 5 " d 2*velve grav 2.0t 3 1.Ot 3 " " d imploalve valve feita to open 2.0l-3 1.0L 3 " - d triverter f elle to t$erate 4-tri.orter gem 43 8.3t 5 4 . 51 6 5.3t-7 2.tt 6 h 2 trever ter grugi 8 . 71 5 1.31 5 -- ' h lettery charger f eita to operate 2 charger group 9M7 3.91t 8 ~ ~ h 4 charger grotgi 9.4t 7 1.3t 8 3.2t 9 1.3t 8 h Circuit t>reaker f alle to ($erate 2.9t 3 3.2t ! 3.0f =5 ~ h (c$en or close) teley falle to c$erete 2 relay grm ? 2.Bt 4 1. 7t 5 ' -- d 3 relay group 2.r; 4 8.3t 6 2.M L d 6 relay grmg> 2ME 4 3.5t 6 2. M - 7 3.M 7 d (4)
'en faite to etert 3'enarmo 2.5t 4 9.40 6 2.M 5 ' d 2 f en grots) 2.M 4 2.lf 5 " " d f an f eite to rm 3 f an grcagi 8.M 6 2.9t - 7 8.6t-7 " h 2 fan grots) 9.4t 6 6.3t 7 " " h Omger felle to rgerate 2.M 3 1,4t 4 7,1t-5 "
d (c4*n/close) CD/C8 pep f elle to rm 2.31 5 - 7,5t 6 - h CD/08 pep felle to stort 2.0E 3 -- 1.DE 3 -- d solenoid valve f et te :o wen 1.1t 3 1.2E-4 5.4t 4 " d levet sultch feita to c$erate 2.0t 6 3.11 8 6.9E 9 3.51 9 h 15] Proteure switch feite to (gerate 1.3f 6 2.21 8 "
- 6. 71 7 h levet tronomitter felle 7.M 7 4.7I 8 1.71 8 2.3E 8 h Preneure trenemitter falta 8.9E T 2.M 8 " 2,M 8 h 3-207
_ _ _ _ _ _ _ . _ _ _ _ _ . _ ~ _ _ . _ . . . . - . _ . _ _ - - _ _ -. - _ . _ . _ . _ _ - - . _ _ CPS INDIVIDUAL PLANT EXAMINATION LEVEL 1 QUANTIFICATION 4 Table 3.3-12 (Cont.) COMMON CAUSE FAILURE RATE ESTIMATES NOTES (1) The 3 RHR pumps and the LPCS pump are grouped together as a component common cause group. No record was found for exactly three pumps failing to start, leading to the MGL parameters estimate of zero. [2] Division I and II SX pumps are grouped together as a common cause group. Division III is considered independent, because of its physical separation from the other SX pumps and its substantial difference in size. [3] CCF Rate for 5 out of 6 motor-operated valves failing is 4.0E-7; rate for all 6 out of 6 MOVs failing is 7.2E-6. These failure rates are per demand. (4) CCF rate for 5 out of 6 relays failing is 8.7E-7; rate for 6 out of 6 failings 5.4E-6. Rates are per demand. [5] CCF rate for 5 of 8 pressure switches failing is 1.7E-9; rate for 6 of 8 in 1.4E-9; rate for 7 of 8 is 2.1E-9; rate for all 8 failing is 1.5E-8. Rates are per hour. 3 l l l l l 3-208
.m . ._ . _ _ _ . . . . . _ . . _ _ _ _ _ _ . . _ _ _ _ _ . _ . _ . _ _ _ _ _ _ _ _ . . . _ CPS INDIVIDUAL PLANT EXAMINATION LEVEL 1 QUANTIFICATION - Table 3.3 13 MAINTENANCE UNAVAILABILITIES DERIVED FROM CPS PIANT DATA l Maintenance Unavailability System / Train Corrective Preventive Notes t Water Leg Pumps 1.7E 3 2.7E 3 HPCS (HP) 8.8E 3 6.1E 3 LPCS (LP) 3.43E 3 1.72E 4 RCIC (RI) 6.3E 3 4.6E-3 RHR (RH) (per train) 2;86E 3 5.72E 4 Diesel Generators 2.63E 2 4.22E-3 Shutdown Service Water (SX) 7.9E 3 1.7E 3 [1] Service Air Compressors 1.44E 1 1.0E 2 Service Air Dryer Trains 8.64E 2 1.1E-2 Battery Chargers (safety related) 2.54E 4 1.27E 4 Battery Chargers (non safety) 1.0E 3 7.6E 4 Batteries (non safety) 7.5E 3 1.5E 3 Batteries (safety related) 3.8E-3 5.1E 6 DC Bus (safety-related) 1.9E 4 DC Bus (non safety) 3.8E 4 Inverters 8.8E 5 [2] Turbine Building Closed Cooling 1.4E-2 5.0E-3 Water (WT) Condensate (CD) 7.8E-2 9 b. . CD Train 1.3E 1 5.8E 3 Component Cooling Vater (CC) 2.6E 2 5.8E-3 Condensate Booster (CB) 5.1E 2 1.4E-2 CB Drain Cooler 2.0E-3 CB Heaters 2-5 2.0E-3 CB Train 9.5E-2 2.1E-2 Condensate Polishers (CP) 5.1E 4 5.6E 5 Plant Service Water (WS) 3.5E 2 5.1E 4 , WS Vater Seal Pumps 5.6E 2 7.5E 3 Plant Chilled Water (WO) 5.6E 2 5.6E 3 Feedwater Pump Trains 6.0E-2 1.03E 3 (motor driven) Feedwater Pump Trains 1.1E-2 3.4E-4 (turbine driven) Circulating Water (CW) 1.9E 2 2.3E ? Fire Protection (FP) 1.546-1 1,72E 3 Condenser Vacuum Pumps 1.5E 2 1.0E-2 Steam Jet Air Ejectors 2.3E 3 Off Gas Dryer Trains 3.84E-2 Automatic Depressurir.arion System 8.6E 4 3-209 , _ ._u __ _ _ _ . _ _ . . _ _ . . _ . . _ . _ . . _ _ . _ - - . . , .
i , CPS INDIVIDUAL PIANT EXAMINATION LEVEL 1 QUANTIFICATION 1 Table 3.3 13 (Cont.) ! l MAINTENANCE UNAVAILABILITIES DERIVED PROM CPS PIANT DATA Notes to Table 3.3-13: [1] SX filter PMs not included because of the existing bypass capability. Unavailability would be 1.25E 2 if these PHs were included. [2] No maintenance events (PM or CH) recorded in plant records. See calculation for unavailability estimate deviation. l l l l r l l l L 3-210 i '- . , .- - _ ._ _ _ _ - _ . _ . . _ . . . . ~ . _ . . . . . _ - ~ . - _ . . . ~ , , , . . -. __ ,--...,. -_ _ ,. . - _ - . . . . , .._,:_..,-..._--
CPS INDIVIDUAL' PLANT ~ EXAMINATION LEUEL 1 QUANTIFICATION Table 3.3-14 ' INTERNAL FICODING EVENT DATA ! Component Failure Mode Failure Rate Sources i Air Operated Valve Rupture 2.OE-7/hr NUREG/CR-1363 (BWR) i ; Manual Valve Rupture 3.0E-8/hr NUREG/CR-1363 (BWR) i 6 Motor-Operated Valve Rupture 8.0E-8/hr NUREG/CR-1365 (BWR) Check Valves Rupture 8.0E-8/hr NUREG/CR-1363 (BWR) i l Tank Rupture 2.7E-8/hr Seabrook PRA ! t Piping (>3" Diameter) Rupture 3.5E-10/section-hr WASH-1400 i (<3" Diameter) 8.5E-9/section-hr WASH-1400 r 3 Expansion Joints Rupture 2.5E-4/ expansion Oconee 3 PRA '
- joint-year ,
- i. !
l ' i a
?
b i
; i 5
3-211 !
e i CPS IllDIVIDUAL PIAllT EXAMIllATIOli LEVEL 1 RESULTS 3.4 Results_and Dereening Process This section sunmarizes the overall findings from the quantification of the Clinton Power Station (CPS) front-end analysis (level 1 probabilistic risk asscosment). Detailed descriptions of the dominant functional accident sequences are provided in this section. Dominant functional sequences are represented by accident clase and subclasses as defined in Section 3.1.5. Table 3.4-1 contains a summary of core damage f requency (CDP) by accident clauses. Specific items discussed for each sequence are as follows:
- 1. Description of accident progression, event timing, and containment failure modo ,splicable.
- 2. Efforts Uhich were made to make assumptions consistent with the best-estimate information and assumptions to which the results are sensitive.
- 3. Significant initiating events, human actions, and sensitive parameters. ,
The Individual Plant Examination (IPE) results focused on plant design features and operating characteristico most important to preventing core damage. The total CDF for CPS resulting from internal events and internal flooding is 2.6E-05 per reactor year. Coro damage is defined as reactor level less than two thirds the length of active fuel for more than 4 ninutes or Modular Accident Analysis Program results with fuel temperature of 2200'F or more. The Critical Safety Function success criteria are discussed in Section 3.1.2.1. 3-212 ( l l
CPS INDI /IDUAL PLANT EXAMINATION LEVEL 1 RESULTS ; 3.4.1 Applingii.on of Gelleric I,etter Scre.gninq _ Criteria The screening critoria contained in Appendix 2 of Generic Lotter 88-20, " Individual Plant Examination for Sovere Accident Vulnerabilities", was used to determino those accident sequences to be discussed in this section. The screening criteria are as follows:
- 1. Functional sequences with a coro dar.aga frequency greater than 1.0E-07 per reactor year. The functional coquences are grouped into accident classes. Within each accident damage class, nequences were generally identified by the dominant initiating ovonts.
- 2. Functional sequences that contribute 5% or more to CDP. Any sequence greator than 1.2E-06 per reactor year will be discussed. This critoria is enveloped by critorion 1 above.
- 3. Sequenceu determined by Illinois Power Company to be important contributors to CDF.
These screening critoria meet the requirements of NUREG 1335, and the sequences that meet this criteria are contained in Table 3.4-
- 2. Sequences below the screening value of 1.0E-07 were also l
reviewed to determine if any sequences had interesting insights l or differed substantially from the dominant sequences. There are some acquences above 1.0E-08 that are due to loss of a non-safety DC bus or anticipated transient without SCRAM (ATWS) but no new - insights were gained. No additional sequences were found that l met this criterion. The results of al.1 sequences are included in ( the event trees (Figures 3.1-1 through 3.1-17). The following is a brief discussion of the sequences in Table l 3.4-2: l l 2-213 '
l CPS INDIVIDUAL PLAllT EXAMIllATIOli LEVEL 1 RESULTS 3.4.1.1 Class 1A The sequences in this class include a loss of high pressure inventory makeup (UP,U) with a failure to depressurize the reactor vessel (X1). These sequences are typified by the symbols T,U2,U and X1 from the failure headings of the event trees presented in Section 3.1. Class 1A sequences had a total core damage frequency (CDF) of 9.8E-06 per reactor year or 37% of the internal events CDF, including internal flooding. Significant initiating events contributing to the class 1A CDP were transient without isolation (41%), transient with isolation (40%), loss of off-site power (12%), and loss of Feedwater (FW) (7%). For these sequences, reactivity control was successful (event tree heading C1) and the safety relief valves cycled (event tree headings M and P) to control reactor vessel pressure. Loss of the main condenser as a heat sink was the first functional failure tnat occurred for the transient without isolation event (event tree heading Q2). The event trees proceed in the same path for the remainder of the initiating events in this class. Loss of high pressure injection is the next failure that occurs. FW, Reactor Core Isolation Cooling (RCIC), and High Pressure Core Spray (HPCS) are unable to perform their safety function which is to maintain reactor water level because of equipment failure or maintenance unavailability fevent tree headings U2 and U). Failure of high pressure injection sources requires that the reactor vessel be depressurized when water level reaches the top of active fuel so that low pressure injection sources can restore water level. Operator action is required to depressurize the vessel since the emergency operating procedures (EOPs) require the operator to inhibit the Automatic Depressurization System (ADS) once the timer starts. However, in this sequence, depressuri:ing the reactor is not successful. Control Rod Drive (CRD) is providing makeup in the post-SCRAM mode. CRD alone can 3-214
_-_ _ ~ _ _ _ . _ . _ __ __ cps INDIV8 DUAL PLANT EXAMINATION LEVEL 1 RESULTS not supply sufficient makeup to keep the core covered unless high pressure systems operate successfully for a period of time. Without sufficient high capacity injection, water level will steadily decrease due to cycling of the SRVs until the core is uncovered and fuel damage occurs. Containment is intact at this point. Without reactor depressurization and high pressure injection other than CRD, active fuel will be uncovered in approximately 28 minutes. If CRD is not available, then fuel would be uncovered in approximately 25 minutes. Assumptions applicable to this class are as follows:
- 1. ADS la always inhibited by the operators as directed by EOPs. Inhibiting ADS, which makes depressurization a !
manually controlled action, is considered a conservative bounding assumption.
- 2. HPCS and RCIC were not recovered before core damage occurred.
- 3. The end state involves reactor water level below the top of active fuel, which is the initiation of core 'amage. This point was reached between 25 ano 32 minutes after the initiating event occurred depending on whether or not CRD is available for injection. Core damage was assumed to occur at this point, with containment intact. No environmental cor*4tions of concern existed within containment at the point of core damage.
l r i 3-215
CPS INDIVfDUAL PLANT EXAMINATION LEVEL 1 RESULTS
- 4. Failure of the rapid recovery of FW following the loss of FW '
initiating event was baced on the experience at other operating plants. Thic dat*t shows that of 14 loss of FW ovents, 11 were immediately recovered from the control room. !
- 5. The main steam isolation valvos (MSIVs) close on a low-low ,
reactor wat r level (lovel 1).
- 6. FW availability during manual shutdown or turbino trip is conservatively modeled. The Turbino Driven Reactor Foodpumps (TDRFP) are not included in the model. Only the Motor Driven Reactor Foodpump (MDRFP) is available to provido high pressure makeup through FW.
I
- 7. The potential for recovery of off-sito power within a half hour la considered fnr loss of off-sito power ovents. If recovery la successful, then the analysis continuou ar. a .
transient with isolation event and FW can also be recoverod.
- 8. ADS is assumed to be availablo for four hours after a loss of off-sito power initiating event provided the following occurs:
a) The back up air bottles are manually valved in. This operator action is shown as a basic event in the model. l b) If cff-sito power is rostorod, then the accumulators can be rocharged using Instrument Air (IA).
- 9. A loss of a non-safety DC bus results in a loss of FW.and a reactor SCRAM. '
l 3-216. l
. - . _ . . . . _ . - ~ . . . _ _ , . . . . . . _ , . _ . _ . - _ . _ . . . . - . , . . _ . . . , _ , , . _ . . . _. . _ . . . . - - . _ . _ _ , _ _ . -
CPS INDIV1 DUAL PLANT EXAMINATION LEVEL 1 RESULTS 5.4.1.2 glaut.g_LD Sequences in this class were characterized by a loss of off-site and on-site AC power and a loss of coolant inventory makeup. In addit' n to those events initiated by a loss of off-site power (LOOP), other initiating events combined with a subsequent random LOOP are included in this class. This is conservative in that in the event of a LOOP occuring several hours after the initial SCRAM, core decay heat loads would be much lower than immediately following the SCRAM and much longer recovery times would be available. These sequences were combined this way to facilitate the modeling of off-site power recovery. Following a LOOP, the division 1, 2, and 3 diesel generators rece'ive a start signal. If both division 1 and 2 diesel generators fall to s tart or start and fall to run, then a station blackout (SBO) occurs. This is the definition of SBO contained in Nuclear Management and Resources Council (NUMARC) 87-00, " Guidelines and Technical Bacin for Addressing Station Blackout at Light Water Reactors". Class 1B sequences make up approximately 37% of the total internal event core damage f requency (CDF) , including internal flooding, with a CDr.- from all Class 1B sequences of 9.8E-06 per reactor yem ' 3-217 i -- , _ _ _ . . _ . _ . _ _ _ . - ._. _ _ _ . . . . _ . . _ . , _ _ . . _ _ . - _ ~ _ . _ _ _ _ _ _
L i i CPS INDIVIDUAL PLANT EXAMINA"' ION LEVEL 1 RESULTS The SBO event tree is entered from the LOOP tree. A SCRAM and initial pressure control have already successfully occurred. If off-site power is not promptly recovered and the division 1 and 2 diesel generators f ail to start or run, then the SBO event tree , it entered. I The first functional failure that occurs is the loss of high pressure injection (event tree headings U1 and U3). The first systemic failure is failure of the High Pressure Core Spray (HPCS) system. This could be from the unavailability of the syctem because of maintenance or the failure of the division 3 diesel generator to start or run. A component failure in the HPCS system could also occur. The next systemic failure would be the failure of the Reactor Core Isolation Cooling (RCIC) system. . This would occur if the batteries were depleted, the batteries or tha RC.TC system were unavailable due to maintenance, or a failure 4 occurred in either the RCIC or DC system. Water level in the reactor would reach top of active fuel between 25 minutes and 5.25 hours depending on the length of time between the initiating event and the failure of RCIC. The next functional failures evaluated are recovery actions (event tree headinge L4, DG1, and DG2). Coro damage occurs I because R/IC has :: ailed due to an equipment f ailure or depletion ; of the batteries, and noither off-site power nor the division 1
)
or 2 diesel generators are recovered. Therefore no core cooling i systems are available. Assumptions applicable to this clans are as follows. i 3-218
l CPS INDIVIDUAL PLANT EXAMINATTON LEVEL 1 RESULTS
- 1. If AC power to the battery chargers is not available, then the batteries will eventually be depleted. No credit in the model in taken for replacing the batteries with other charged batteries.
- 2. The batteries are assumed to be available for four hours if load shedding is performed by the operators in one hoer. If load shedding is not performed, then the batteries are assumed to fail after one hour.
- 3. Low pressure injection systems are not available unless the off-site power is recovered, because air supplies for opening the SRV's to depressurize the reactor vessel would be depleted. The off site power or division 1 or 2 diesel generators need to be recovered to provide a power source for the low pressure injection systems.
- 4. If a random failure of HPCS and RCIC occurs early in the event, then level would reach top of active fuel in approximately 25 minutes after the initiating event. e
- 5. If RCIC is initially available, then aft < the batteries are depleted and if HPCS is not available, the level would reach top of active fuel in approximately 1.25 hours.
- 6. The diosol driven fire pumps could be used as a low pressure injection source. However, since it takes several hours to align for reactor injection, it is not modeled im this event (see #3 and section 3.1.2.3).
3-219
CPS INDIVIDUAL PLANT EXAMINATION LEVEL 1 RESULTS 3.4.1.3 91A32_1Q l Sequences in this class were characterized by an Anticipated Transient Without SCRAM (ATWS) with a coincident loss of all inventory makeup. All events in this class were included in the analysis for class IV, section 3.4.1.10. I 3.4.1.4 ," lass 1D Sequences in this class were characterized by an initiating transient with successful reactor depressurization but both high and low pressure inventory makeup systems are lost. Class ID sequences contributed 22% to the core damage frequency (CDF) at Clinton Power Station (CPS). The CDP, iracl'uding internal flooding, is 5.7E-6 por reactor year. Significant initiating events for the class ID accident class include loss of a non-sarety DC bus (21%), loss of off-sjte power (24%), transients without isolation (20%), transients with isolation (9%) and loss of foodwater (*/%). These accident sequences proceed similar te the Class 1A sequences except that depressurization is successful and after depressurization the low pressure injection systems also fail no that no makeup is available. Emergency operating procedures (EOPs) direct the operators not to depressurize the reactor until
! level is below the top of active fuel so the time to core damage is the same as high pressure events (approximately 25 to 32 minutes depending on the status injection from the of Control Rod Drive (CRD) Lystem).
Acaumptions associated with this class are as fc11 ova:
- 1. Shutdown Service Water (SX) could be aligned to provide low pressure makeup through the Residual Heat Removal (RHR) system. This source of injection is not modeled.
3-220 I _ _ . . _ _
CPS INDIVIDUAL PLANT EXAMINATIOli LEVEL 1 RESULTS
- 2. Dioaol driven fire pumps can be aligned to provide reactor vessel invantory makeup. Howover, sinco it takes several hours to align the fire pumps in this modo, this is included only as a recovery aft c some other system successfully operated for some period of timo.
- 3. CRD can provide makeup to preclude coro damage only if other systems have been removing decay heat for a period of timo.
- 4. If off-sito power is recovorou in 30 minutos then analysis contiriues as a transient with isolation event.
3.4.1.5 Q1333..II Events in thic class are characterized by a loss of containment herit removal. Analysis has shown that the Emergency Core Cooling System (ECCS) pumpes can take suction from the supprossion pool even under saturation conditions. This is discussed further ir , section 3.1.2.2, assumption 1. Thorofore this class of accident is not applicable to CPS. 3.4.1.6 Class IIIA This class contains accident sequences involving reactor vossol rupture and the failure of ECCS injection systems. Containment remains intact after the rupture. Those events woro evaluated as a large break loss of coolant accident (LOCA) as a Class IIIC sequence. 3.4.1.7 Class IIIB This class contains accident sequences resulting from small or medium LOCAs for which the reactor is not depressurized and inadequato coolant inventory makeup is available. 3-221
CPS INDIVIDUAL PLANT EXAMINATION LEVEL 1 RESULTS This class contributed much less than 1% of the CDP with a CDF of 1.3E-08 per reactor year. This is far below the criteria and CPS does not consider the possibility of a LOCA and all SRVs failing to open to be an significant contributor. 3.4.1.8 Class IIIC Accident sequences resulting from LOCAs for which reactor depressurization is caused by the event or is successful. Inadequate coolant inventory makeup is available from Emergency Core Cooling Syctems (ECCS), RCIC, or Feedwater Delivery systems. This class contributed approximately 4% of the tote.1 CDF with a CDF of 1.lE-06 per reactor year. The main contributor is an inadvertent / stuck open relief valve (IORV). The remaining sequences contribute less than 1.0E-09 per reactor year to the overall CDF. The important sequence in this class was characterized by an initiati' g event and a successful reactor SCRAM (event heading Cl). The tirst functional failure which occurs is the loss of high pressure injection systems (event heading Q1 and Ul). Both HPCS and the FW delivery systems fail. If either system succeeds, then core damage is averted. The next functional failure is failure of low pressure injection (event heading V). Tnis includes all three trains of LPCI, LPCS, CD and CB. If all these systems fail, then core damagu occurs. l Assumptions associated with this class are as follows:
- 1. RCIC does not have sufficient capacity to maintain coverage l of the core.
L u l
- 2. The reactor does not need to be depressurized for low f
L pressure coolant injection since the opening of one SRV is l sufficient to depressurize the reactor. 3-222 l l
CPS INDIVIDUAL PLANT EXAMINATION LEVEL 1 RESULTS
- 3. Corn damage occurs between twenty-five and thirty-two minutes after the initiating event, depending on the status .
1 of CRD ad an injection 9ource. i
- 4. Diesel driven fire pumps can be aligned to provide reactor vessel inventory makeup. However since it takes several hours to align the fire pumps in this modo, this is included only as a recovery for lang-term failures. ,
1 3.4.1.9 Class IIID l This class contains accident sequences initiated by a large break LOCA er reactor vessel rupture for which containment heat removal was inadequate. Large break LOCAu were evaluated in Class IIIC. 3.4.1.10 Class IV This class contains accident sequences involving an ATWS leading to containment failure due to high pressure end core damage resulting from subsequent loss of inventory makeup. These sequences contributed less than 1% of the total CDF with a frequency of 1.4E-07 per reactor year. Since the individual sequences which contribute to this CDF are less than 1.0E-07 this class will not be further discussed here. It should be noted that a significant percentage of containment failures result from ATWS events (see-section 4.6). 3.4.1.11 Class V This class contains accident sequences involving an unisolated LOCA outside containment coupled with the loss of inventory makeup. These sequences contributed much less than 1% of the , 3-223
I CPS INDEVIDUAL PLANT EXAMINATION LEVEL 1 RESULTS total CDP and were outside the screening criteria and will not be further discussed here. 3.4.1.12 IDLqrnal 71ooding The CPS IPE internal flooding analysis was conducted to investigate the likelihood of core damage sequences initiated by flooding of equipment needed for core cooling or other critical j safety functions. Areas of the plant that contain equipment j which meet the above criteria were analyzed to determine the likelihood of flooding and the affect on core damage frequency. I Piping and components in these areas were analyzed to determine which failures could contribute to flooding. This analysis is discussed in detail in Section 3.3.8. The total core damage frequency (CDF) for internal flooding events is estimated ct 1.6E-06 per reactor year. This represents approximately 6% of the total core damage frequency. Table 3.4-3 contains the five most significant sequences. Each of these five sequences is discussed below: 3.4.1.12.1 Peedwater Line Dreak in the Main Steam Tunnel A Feedwater (FW) line break in the main steau tunnel has the highest internal flooding core damage frequency and constitutes approximately 25 percent of the CPS internal flooding core damage frequency. The CDF from this scenario is 4.17E-07 por reactor year. This scenario involves a loss of FW injection and potentially affects Emergency Core Cooling System (ECCS) equipment located below the main steam tunnel. A two inch space between the containment wall and the floors and walls of auxiliary building allows water discharged from a line break to g drain to the Reactor Core Isolation Cooling (RCIC) pump-room. A conservative assumption was made that the gap is of sufficient ( 3-224
. - . - . . . - . . . - - . - ~ . . . . . ~ . . . - . . ~ . - - . . -
CPS INDIVIDUAL PLANT EXAMINI. TION LEVEL 1 RESULTS size so that flow to the RCIC room is not limited. Other paths allow water to flow into the Low Pressure Core Spray (LPCS) and the "A" Residual Heat Removal (RHR) pump rooms. Calculations roveal that if all the water from a FW line break entered only one room, the depth of the water would be 44 inches in the RCIC room, or 42 inches in the LPCS room, or 35 inches in the RHR "A" l room. This is a conservative assumption because it assumes th) ! , entire inventory fills one room. The FW inventory would actually be distributed among the three rooms with most of the inventory located in the RCIC room. Operators are not expected to quickly diagnose a FW line break. A variety of annunciators require diagnosis to reach this conclusion. This is based on simulator obs'ervations during FW line break scenarios. Emergency operating procedures (EOPs) do not require a FW isolation unless a line break is diagnosed by the operator. It is likely, therefore, that this diagnosis would take longer than the time to flood the RCIC room to the critical ' height of 42". This height is critical because it is the height of the RCIC lube oil cooler inlet motor operated valve. l Therefore, RCIC is conservatively assumed to fail before FW is isolated. The critical height for LPCS and RHH-"A" pump rooms is nine feet , which is much higher than the calculated flood level. During the ! initial flood analysis, it was assumed that LPCS and RHR "A" i failed because of the flood. _The core damage frequency for this flood scenario was recalculated assuming that LPCS and RHR "A" did not fail. No appreciable difference in core damage frequency
-was-found since the major effects of the scenario are loss of FW,
! Condensate Booster (CB), Condensate (CD), and RCIC. r l l l 3-225
CPS IllDIVIDUAL PLAllT BXAMIllATIOli LEVEL 1 RESULTS 3.4.1.12.2 QQMRqngnt_C9911 ndals r . ( CQLling_D EqAk .. O r M ain t9n anc u tt9I_i n__t hu_C Q_ hap _ uni _DnLE 9.9m Thin flood ac1 aarlo had a high CDF ontimato due to a high initiation frequency entimate. The initiating frequency was dominated by maintenance errors during Component Cooling Water (CC) pump maintenanco. This requires the failure to closo a CC punp manual inolation valvo (suction or dischargo) prior to maintenanco activition which open the system. Further nlysia indicates that if thin occurred, maintenance personno. ,ould be in clone proximity to the pump and would immediately detect the flood. It is also highly likely that the maintenanco personnel would shut the inclation valvon which are located close to the pumpn. Calculations indicate that water would reach a lovel of 5 inches cne hour after the initiation of the flood. It in highly likely that a flood initiated by a maintenanco error would be detected and recovered before water reached the level that would fail CC componnnts. Thoroforo, maintonenco errors woro removed from the flood initiator for thin area. The revised flood initiator frequency is 1.3E-02 por reactor year and the revised coro damage frequency la 1.5SE-07 por reactor y2ar. The major contribution to core damage for this flood initiator is loss of the Instrument Air (IA) compressors sinco CC coolo the IA compressors. Lona of IA leads to loan of FW and main steam isolation valvo (MSIV) closure. 3.4.1.12.3 plant 803Y.iPe W4 tar (WB) L1R9_3. TRAX _1D_the CQ hmp/ Tank _ Rosa A break in a Plant Service Water (NS) line in the CC pump / tank area has an initiator frequency of 1.4E-03 por reactor year. 3-226 l
CPS INDIVIDUAL PLANT EXAMINATION Lt: VEL 1 RESULTS i This results in a CDF of 2.24E-07 per reactor year. The primary effect from this initiator is the same as in Section 3.4.1.12.2, loss of the IA compressors because of a loss of CC. l 3.4.1.12.4 Eine Ruotures in the Hich Prosegre Core Borav (HPCS) PumD Room There are two dominant sequences which result in a floor in the High Pressure Core Spray (HPOS) room. They are a break in a Plant Service Water (WS) pipe or a break in a HPCS pipe. Floods in this room are important because the loss of HPCS significantly affects the core damage frequency. Upon detection of a WS line break, it is expected that the opera +.or would begin tripping WS pumps to mitigate the line break. If ar. unisolable leak occurred, all the running pumps would be tripped, resulting in a loss of WS. Loss of WS affects other potential core cooling sources such is FW, CD, and Control Rod Drive (CRD) because WS provides a source of cooling for these systems. The loss of WS also affects the probability of losing other ECCS systems, because WS is a back up to Shutdown Service Water (SX) system. A line break in the HPCS pump room results in a complete loss of HPCS because the break may not be isolable. If the break occurs on the HPCS suction line between the containment wa_1 and the first isolation valve, the leak is not isolable and the room would flood with suppression pool water. A break in a WS systei pipe has an initiating event frequency of 8.2E-05 per reactor year resulting in a CDF of 2.23E-07 per reactor year. A break in a HPCS system pipe has an initiating event frequency of 1.3E-02 resulting in a CDF of 1.79E-07 per reactor year. 3-227
CPS INDIVIDUAL PLANT EXAMINATION. LEVEL'1 RESULTS The above descri.')ed internal. flooding ' analysis addrog utt the-resolution of: unresolved safety issue A-17. Thin was: closed by generic listter.09-18 with the suggestion that licensees-review potential water intrusion and internal flooding as part of the-IPE. 3.4.2 vulnerability spreenino An nnalysis was performed to determine if any new vulnerabilities were discovered as a' result of the Individual Plant Examination ' (IPE). . The criteria used to determine if vulnerabilities exist are as follows: 4
- 1. Are there any new or unusual means by which core damage or containment failure occur as compared to those identified in other probabilis' isk assessments (PRAs)?
- 2. Do the results suggest that the Clinton Power Station '0PS) core damage frequency would not be able to meet the Nuclear Regulatory Commission's-(NRC) safety goal for core damage?
- 3. Are there any systems, components, or operator actions that control the core damage result (i.e., greater than 90%)?
None of these criteria lead to the identificationaof potential vulnerabilities for CPS. The accident classes that contribute to the potential for core damage are similar to those lientified in probabilistic_ risk assessments (PRAs)- of comparable facilities such as NUREG/CR-4550, " Analysis of Core Damage Frequency' Grand Gulf, Unit 1-Internal' Events". Also, while it dses not include the contribution from externa' events, the overall core damage frequency-of 2.6E-05 per reactor year is less than the NRC's safety goal for core damage of 1E-04 per reactor year. This leaves ample = margin for accommodating risks of other events such as earthquakes or fires. 3-228
, e . , , , , -- , .-,,v. - - , , .
ev
CPS 1NDIVIDUAL PLANT EXAMINATION LEVEL 1 RESULTS Another term frequently used is ;algnificant insight". In general, a significant insight is a system, component, or action which influences the results of this study more than other events. A significant insight may involve any of the following:
- 1. A unique safety feature which significantly drove risk either by limiting the potential for or contribution to core damage.
- 2. A ssut.ev .nteraction effe:t which had a relatively important
.i apui , on the overall results of this study.
- 3. A component failure mode or operntor action which had a significant impact on the results of a'n accident class or the overall results.
- 4. A failure or operator action worthy of consideration of a recommendation.
S. A critical operator action which had limited procedural guidance. Detailed discussion of insights discovered during the performance of the CPS IPE are prese7ted in Chapter 6. 3.4.3 Decay Heat-Removal Evaluation l 3.4.3.1 Introduction L An evaluation of decay heat removal capabilities has been performed as part of the Clinton Power Station (CPS) Individual ! Plant Examination (IPE). The purpose of this evaluation is to identify potential decay heat removal vulnerabilities that may exist during 24 hours after a plant trip and to examine whether 3-229
CPS INDIVIDUAL PLANT EXAMINATION LEVEL 1 RESULTS or not risks associated with the loss of decay heat removal can be lowered in a cost effective manner. This evaluation is requi.ed by Generic Letter 88-20, " Individual Plant Examination for Severe Accident Vulnerabilities". Following is a brief discussion of the decay heat removal functions at CPS. 3.4.3.2 Discussion Decay heat removal during the first twenty-four hours after a plant trip is accomplished by the following key functions.
- 1. After a plant trip without isolation of the main steam lines initiator, decay heat is removed through the main condenser.
This la accomplished with the Main Steam (MS) and Feedwater (FW) delivery systems (Condensate (CD), Condensate Booster (CB) and FW) . After the reactor has been depressurized the Residual Heat Removal (RHR) system is placed in the shutdown cooling mode.
- 2. After a plant trip due to a transient with isolation initiator, the MS and FW delivery systems will not be available to remove decay heat, RHR in the shutdown cooling mode would be used to remove decay heat after the reactor is depressurized using safety relief valves (SRVs) or Reactor Core Isolation Cooling (RCIC). If the reactor can not be depressurized, then RCIC along with Control Rod Drive (CRD) l is used to remove decay heat. Either train of RHR would 1
need to be inLthe suppression pool cooling mode sometime after RCIC is started.
- 3. After a loss of off-site power initiator, decay heat is removed as in the transient with isolation scenario. If the division 1 and 2 diesels fail to start, then RCIC is used to 3-230
CPS INDIVIDUAL PLANT EXAMINATION LEVEL 1 RESULTS remove decay heat. RCIC is successful for four hours if DC _ loads are shed by the operators t hin 1 hour of thn initiator.
- 4. The safety relief valves (SRVs) can be used to remove decay heat to the suppression pool. A source of reactor makeup water such as RLIC, High Pressure Core Spray (HPCS), Low Pressure Core Spray (LPCS), etc, would be used. If RHR Were not available in the suppression pool cooling mode, then heat from the containment would be removed by containment spray or venting.
3.4.3.3 Methodology The results of the lovel 1 analysis were used to evaluate the potential for loss of decay heat removal. The cutsets for the overall core damage frequency were used in this analysis. Failure of systems which cannot remove decay heat were eliminated from the model. These systems include HPCS, RCIC, LPCS, l Automatic Depressurization (ADS), and Fire Protection (FP) . The L l resulting core damage frequency due to loss of decay heat removal
-is estimated ut 5.2E-06 par reactor year.
Additional methods to rer.ove decay heat such as Reactor Water
' Cleanup (RWCU) blowing down to the main condenser and RHR lined up.through the Fuel Pool Cooling and cleanup (FC) system heat-exchangers were not included in the model. Therefore the model used for the loss of decay heat removal evaluation is conservative. If these additional methods of decay heat removal were added, the core damage frequency due to loss of decay heat removal could be reduced further.
l 3-231
CPS 1NDIVIDUAL PLANT EXAMINATION LEVEL 1 RESULTS-3.4.3.4 Q9Jtqlgalgna Unresolved Safety Issue A-45, " Shutdown Deca'; lleat Removal Requirements", recommends that core damage frequency because of failures of the decay heat removal systems should not be greater than lE-05 per reactor year. This analysis shows the core damage frequency due to the loss of decay heat removal at CPS is no greater 5.2E-06 per reactor year. No vulnerabilities were discovered during this analysis.- Since the CPS core damage frequency is much less than the target recommended by the Nuclear Regulatory Commission (NRC), no cost effective measures to further reduce the core camage frequency are anticipated. 3.4.4 Ilareps.ly_el,Epigj;V Issue and_ Generic Salgtv Issue Screening Other than Unresolved Safety Issue (USI), A-45, Shutdown lleat Removal Requirements, just discussed, there are no open Generic Safety Issues (GSI) for the Clinton Power Station. This USI was discussed in the previous section. l I i l 3-232 ! l
CPS INDIVIDUAL PLANT EXAMINATION LEVEL 1 RESULTS Table 3.4-1 Core Damage Precuency by Accident Class Core Percent Damage of Accident Class Frecuencl* Total Transients - high pressure (IA) 9.8E-06 37% Station Blackout (IB) 9.8E-06 37% Transienta - lov pressure (ID) 5.7E-06 22% _ LOCAa - high pressure (IIIB) 1.3E-08 0% LOCAs - low pressure (IIIC) 1.1E-06 4% ATWS events (IV) 1.4E-07 1% Containment bypass (V) <1.0E-09 0% Overall Ccro Damage 2.6E-05 Frequency
- Per reactor year s.
3-233
CPS INDIVIDUAL _ PLANT EXAMINATION LEVEL 1 RESULTS Table 3.4-2 Accident Seauences Contributina to Core DRqqae Freauency Which Meet liie Screenina Criterin Accident Accident Core Damage ClADR Secuence Frecuencv* Tyng IA T2U2UX1 3.4E-6 Transient Without Isolation T3U2UX1 3.0E-6 Transient With Isolation TPL1U2UlX1 8 dE-7 Loss of Off-Site Power T5Q2U2UX1 1.8E-7 Loss af Feedwater IB TLU1U3 5.2E-6 Short-Term Station Blackout TLU1L4 DG1DG2 4.6E-6 Long-Term Station Blackout ID DCQ2U2UV 1.1E-6 Loss of Non-Safety D.C. Bus TPL1U201V 7.7E-7 Loss of Off-site Power l TPL1WU1V 5 . 7 F.-7 Loss of Off-site Power T2Q2U2UV 6.0E-7 Transient Without Isolation T2Q2WUV 5.0E-7 Transient Without Isolation T3WUV 2.8E-7 Transient With Isolation T5U2UX1 4.6E-7 Loss of Feedwater l T5Q2WUV 3.5E-7 Loss of Feedwater III LOQU1V 1.06E-6 Inadvertent / Stuck Open Relief Valve i l
- Per Reactor Year L 3-234 l l .- _
CPS INDIVIDUAL PLANT EXAMINATION LEVEL 1 RESULTS Table 3.4-3 i Int 9rnal yloodina Drainant_ Core Damace Secuences Flood Location Core Damage Descrintion Frequency (Der reactor year)_ Feedwater Line Break in 4.17E-07 Main Steam Tunnel Component Cooling Water 1.55E-07 (CC) Line Break in the CC Pump and Tank Area (Control Building Elevation 762) Plant. Service Water 2.24E-07 (WS) Line Break in CC Pump and Tank Area WS Line Break in 2.23E-07 liigh Pressure Core Spray (IIPCS) Pump Room IIPCS Line Rupture in 1.79E-07 HPCS Pump Rooms 3-235
. . - - . - . . . . - - - . . , . - . . . . - - . - . . - - - - - - . - - - - . . _ . . . . . - = . - . - . ~ . . .
l ,- .) !' + 5 $ s
- t. v -
i . t t 7 i s 1 i a i-i TIIS PAGE l t INTENTIONALLY t, ' ] , LEFT ULMIK ) L e 1 T I i.( t i e t, i 1-44d i l ': l. 4 L I
)
? c 9 - .) - h .i e,ee e s--ome:-wmw,-=<~re-rm -w-n a em m e ev m ne m - . aa + -m-1 v, .~---aw . m ei m+n ,,- - - - e- -m----..,m-~ ---,-a,--nr.~.- ..,waw----.>.-,m aw - i.en e,- ---, nee--
CPS - INDIVIDUAL PIANT EXAMINATION CONTAINMENT DESCRIPTION
- 4. 11ACK-END ANALXEIS The previous sections of this report have described the methods used to arrive at the probability of core damaging events and the actions and events that are most likely contributors. This
-section describes the "back-end" analysis, that is, the process of obtaining an underutanding of potential challenges to the containment. This analysis evaluates the role of plant features and the effects of phenomena in preventing or mitigating challenges to containment integrity and limiting off-site releases. The impact of operator actions when dealing with challenges to the containment is also considered in the level 2 analysis.
The Clinton Power Station (CPS) containment analysis results show that the containment is particularly robust with a low conditional failure frequency and source term release as detailed in Section 4.7. Several significant factors contribute to this conclusion. First, the containment pressure capacity is very high (93.8 poig - see Section 4.4.9) with respect to other BWR-6s. Second, the CPS containment is very large with respect to the thermal rating of the reactor. Third, the suppression pool volume is also large with respect to the thermal rating of the reactor. Table 4-1 compares these factors. Table 4-1 C.omparison of BWR-6 ContalDaent Canacities GRAND RIVER CIS EUERY GULF __ DEND Estimated Containment Failure 93.8 64 67 63 Pressure (paig) Containment Free Volume 3
/ Thermal .62 .399 .36 .501 Power Rating (ft /kW)
Volume / Thermal .047 .033 .035 .044 SuppressionPoo}/kw) Power Rating (ft 4-1
CPS INDIVIDUAL PLANT EXAMINATION CONTAINMENT DESCRIPTION Tho CPS and Grand Gulf containment designs are similar in that both are steel lined, reinforced concrete structures. The River Bend and Perry containments are free-standing steel structures. The most notable difference between the CPS containment and the Grand Gulf containment, Other than those identified above, is that Grand Gulf used number 18 reinforcing steel on 18 inch centers and CPS used number 18 reinforcing steel on 12 inch centurb. 2
l CPS INDIVIDUAL PLANT EXAMINATION CONTAINMENT DESCRIPTION 4.1 Elgat_.DAtpt ARd._ElARLILgAgflatign This section describes the containment geometry and that of other structures internal to coatainment that are important in assessing a.overe accident progression. A discussion of systems and assumptionc regarding operability of equipm9nt in harsh environments is also provided. Table 4.1-1 tabulates some important dimensions and capacities for the containment, drywell and suppression pool. 4.1.1 plint 9A_EgyqI 8tAtion Contiinm_9At
/
CPS is a General Electric BWR-6 rated at 2894 Mwt with a Mark III Q containment as shown in Figure 4.1-1. This design incorporates a large pool of water, the suppression Pool, for condensing steam from the reactor vessel relief valves and from postulated pipe breaks. The containment consists of a right circular cylinder, 124 feet insido diameter, with a hemispherical domed roof and a flat base slab. The containment wall is constructed of reinforced concrete, completely lined internally with 1/4 inch thick steel plate. The lower section of the containment wall acts as the outer bounda : of the suppression pool. Two double-door airlocks provide for personnel access and a sealed equipment hatch is provided for movement of large equipment. All the power block structures are supported by a single common basemat. The basemat is considered to be an integral part of the containment boundary; it is constructed of reinforced concrete 9.7 feet thick. The drywell la also a right circular cylinder located within and concentric to the containment. The inside diameter of the drywell is 69 feet and the wall is steel-lincd reinforced concrete 5 feet thick. The drywell wall is rigidly attached to 4-3
CPS INDIVIDUAL PIANT EXAMINATION CONTAINMENT DESCRIPTION the containment basemat and has a 6 foot thick annular concrete slab top. A removable head is bolted over an opening in the top slab for access to the reactor vessel for refueling operations. The lower portion of the drywell wall is submerged in the suppression pool. Three rows of 27.5 inch diameter vents, 34 vents per row, penetrate the drywell wall below the normal level of the suppression pool. Access to the drywell is via a double-door airlock, a double-gasketed, flanged and bolted dished equipment hatch, and the removable steel head previously discussed. The suppression pool is supported by the containment basemat. ( The weir wall, located inside the drywell, forms the inner boundary of the suppression pool and is supported by the drywell sump floor. The weir wall is 1 feet, 10 inch thick reinforced concrete, steel clad on the suppression pool side. The inside diameter of the weir wall is 61 feet and the wall height is 23 feet, 9 inches above the basemat. The suppression pool is open to the atmosphere of containment and drywell, and contains approximately 146,000 ft 3 of water. The drywell sump floor is a donut shaped reinforced concrete _ slab, approximately 11 feet chick which rests on the basemat and supports the suppression pool weir wall and reactor pedestal. It is steel lined on the suppression pool side. The dryvell sump floor is bounded by the inner wall of the suppression pool with an outside diameter of 64 feet, 8 inches, and an inside diameter of 18 feet, 6 inches. The floor contains several drain sumps with a total volume of 720.5 ft3 The principal sump is the floor drain sump which has a volume of 569 ft 3 and is connected to the Pedestal Cavity by a 6 inch diameter pipe.
'1he Pedestal Cavity (void area bclow the Reactor Pressure Vessel and inside the dryNell floor) has a capacity of approximately 4-4 1
CPS INDIVIDUAL PLANT EXAMINATION CONTAINMENT DESCRIPTION = 2400 ft 3 from the cavity' floor to the' bottom of the opening for maintenance access. The Reactor Podostal supports the Reactor Pressuro Vossol and Reactor Shield Wall. The podestal consists of two concentric cylindrical steel shells connected by radial stool diaphragms. The annulus betwoon the shells is filled with concreta. The-top of the podestal consists of a ring girder on which the Roactor Pressuro Vessel rests. The vesse'. is bolted to the ring girder by 120, 3 inch diameter bolts. There are two openings through the pedestal shells for CRD piping, each measuring 44.3 ft2, and located 12.8 foot above the drywell floor. There is also a maintenance access opening measuring 18.6 ft2 The bottom of this opening is 9.1 foot above the podontal cavity floor and 12 inchos above the drywell floor (USAR, Figure 3.8-1). 4.1.2 ggni;31nqqILt_, Oya tema A description of the systems required to mitigate a severo accident are included in the front-end analysis section (Section 3.2) of this report. The majority of those systems are located external to the containment, and environmental extremos in containment and drywell during a savoro accident will not impair the capability of these systems to perform their:roquired safety function. The exceptions are: Inboard containment isolation valves for various systems, L Automatic Depressurization System (ADS), Combustible Gas Control System (CGCS), Drywell and Containment Atmosphere, Mixing i Hydrogen Ignitore, ! Suppression Pool, Suppression Pool Makeup, Containment Vent System, and Containment /Drywell Ventilation Systems. 4-5 i
. _ _ ._ . . . _ . . . , . . . . ~ , . . -
CPS INDIVIDUAL PLANT EXAMINATION CONTAINMENT DESCRIPTION A detailed discussion of each of these systems with associated assumptions is presented in the following paragraphs. 4 1.2.1 Inboard Containment Isolation Valves Included in this grouping are valves located on all lines which penetrate containment regardless of the safet; importance of the system. All of these isolation valves are qualified for accidents under the provisions of 10CFR50.49, but are assumed to fall under the extremes of a severe accident such as postulated in this report. However, all of these valves either move to the required position early in an event or are already in the required position and are therefore essumed to soccessfully complete their required safety function. This assumption is , valid for all events except Station Blackout (SBO). Under an SBO condition, all valves are either in or fail to the required position or are an integral part of a closed-loop system with the exception of two valves (1FC007 and 1FC008). 1FC008 is I the outboard isolation valve (located in the Fuel Building) for this concainment penetration. It provides a flow path from the upper pool skimmers to the Fuel Pool Cooling and Cleanup Surge ~ Tanks. Off-Normal Procedures address actions to check and, if necessary, manually close this valve. For success, only 1 of the 2 (inboard / outboard) isolation valves must move to the requt 1 position. 4.1.2.2 Automatic DepressurizatioD Bystem (ADS) Sixteen Safety-Relief Valycs (SRVs) are moor. Led on the main steam lines between the Reactor Pressure Vessel (RPV) and the-inboard Main Steam Isolation Valves (MSIVs). These SRVs are provided to prevent overpressurization of the RPV and, in the event of a need for makeup with concurrent loss of high pressure injection capability, to automatically depressurize the RPV to allow low 4-6 I
'l CPS-1NDIVIDUAL PLANT EXAMINATION CONTAINMENT DESCRIPI' ION pressure-systems to inject water into the vessel. The
-description of the ADS system and how it is modeled is in Section 3.2 1.8. .
The discharge of al] 16 SRVs is directed *o the suppression pool through discharge quencher assemblies to condense steam and scrub radionuclides. The . 9' ADS /LLS SRVs discharge into the suppression pool at locrtions as far as possible from ECCS pump suctions to prevent the pumps from-pumping hot water and to provide thermal mixing of pool water. The SRVs are fully qualified for accident conditions, even though they would not be required to actuata following kPV breach. Figure 4.1-2 shows the SRV locations relative to the main steam lines ared radial locations of the quenchers in the suppression pool. Figure 4.1-3 shows a typical SRV discharge quencher and the location relative to pool level and vont openings. 4.1.2.3 .Q2mb_q;Ltik19 Gas control System (CGCS) The Combustible Gas Contrcl System (CGCS) is designed to maintain the hydrogan concentratioa in the Grywell and containment atmospheres below the combustible hydrogen level during post-LOCA conditions. The CGCS is in a standby condition during normal piant operation. The system consists of three sub-systems, including the following: Drywell and Containment Atr .. nhere Mixing Hydrogen Ignitors Hydrogen Recombiners The Hydrogen Recombiners are located outside the containment boundary but were not considered in the IPE bacause of their low- , capacity. 4-7 l
, . - . , _ . - , - , - , .. ., .---, ,_ - - , _ ~ , , , _ _ , , , - - . . . . .. . . . - - , - - --. , _ _ . ,
-m _. _ _ _ _ . _ _ _ . _ _ _ . - _ _ ~ - _ . _ _ _ _ _ . . _ . _ . _ . ,. . _ _ _ _ . . . .
v CPS INDIVIDUAL PLANT EXAMINATION CONTAINMENT DESCRIPTION Drywell and Containment Atmosphere Mixing Two independent hydrogen mixing conpressors, located in conta ':mietnt , take suction from high in the drywell, and discharge through 6 inch diameter piping to sparger assemblies located below the surface of the suppression pool. This serves to scrub radionuclider and condense steam before release to containment atmosphere. In order to relieve the pressura differential caused by removing air from the drywell, four parallel sets of two in : series 10-inch diameter Vacuum Relief Valves begin opening at 0.2 psid and are fully open at 0.5 paid. This open circulation system mixes the atmosphere in the drywell and containment and di7di es hydrogen concentrations. No credit was taken for the Drywett and Contu3ncent Atmosphere Mixing l Compressors and Vacuum Relief Valves as a system capable of mitigating the severity of an accident because of the relatively low capacity of the system. Failure of two Vacuum Relief Valven in the same set would bypass the suppression pool and provide an-unscrubbed release path to the contalnment atmosphere. This scenario was evaluated and determined to have a negligible probability. Therefore, it was not modeled in the Containment Event Trees (CETs). See Figure 4.1-4 Containment Combustible Gas Control Flowpath.
. Hydrogen Ignitors The Hydrogen Ignitors are glow-plug type ignitors designed to maintain post-LOCA hydro?cn concentrations in the drywell and containment below 4% by a controlled burn of the hydrogen present in' localized areas. The ignitors are qualifiad for 330*F for 7 days and therefore are asaumed to remain operable fcr their required mission time. The ignitor system is described in section 3.2.1.12.
l 4-8
- __ ~ - - . __ .__ _ . _
I CPS INDIVIDUAL PLANT EXAMINATION CONTAINMENT DESCRIPTION barge quantiti,ea of hydrogen can be produced as a result of metal-water reaction in the Reactor Pressure Vescel during a degraded core event and from Core-Concrete Interaction (CCI) in the event the RPV is breached and corium material comes in contact with the Drywell Sump Floor or Reactor Vessel Pedestal Cavity. The hydrogen ignitors are designed to burn hydrogen at low concentrations, thereby maintaining the concentration below the detonable limit and preventing overpressurization that could occur as a result of a hydrogen detonation. CPS Emergency Operating Procedure EOP-7 requires the Hydrogen Ignitors to be , 1 turned off and/or not be energized if the .ydrogen concentrations j in containment /drywell are unknown or if io level exceeds the deflagration limits for a given containment pressure, j 4.1.2.4 IlgimLgy.sigJt_Popl q i I The Suppression Pool is an annular pool of domineralized water bounded on the outside by the containment wall and on the inside i by the weir wall. It contains 146,000 ft 3 of water, and the maximum deLign temperature is 185'F. l The Suppression Pool provides (a) a means to condense steam released in the drywell during a LOCA, (b) a heat sink for RCIC l turbine exhaust steam, (c) a heat sink for SRV discharge to prevent containment temperature and pressure excursions, and (d) a source of water to Emergency Core Cooling Systems. The L Suppression Pool is very effective in retaining fission products and condensible vapors from drywell venting and SRV discharges. The_ possibility of containment breach in the suppression pool arca was modeled in the containment Event Trees and truncated out L for all events except for'ATWS. It was calculated that 14% of containment failures from ovet pressure could be in the
- -- suppression pool area (section 4.4.9).- This low value is partially because the liner s a the suppression pool is made of stainless stee], which is more ductile than the carbon steel with which the remainder of containment is lined. Additionally, there 4-9 i
l
CPS INDIVTWAL PIANT EXAMINATION CONTAINMENT DESCRIPTION are fewer and less complex penetratl7ns in the suppression pool. A breach in this area resulting in a significant loss of volume beyond the capability of Suppression Pool Makeup systems could result in unscrubbed release to the containment atmosphere as well as loss of core cooling / containment spray capability. 4.1.2.5 @ ppleApipn Pqol Ma)Le_up The normal suporession pool fill / makeup is via a 6 inch diameter line from the Cycled Condensate Storage Tank. This system is used to initially fill the suppression pool and make up for evaporative losses. The emergency suppression pool makeup is via a gravity dump of a portion of the Upper Containment Pool through two 24 inch diameter lines. The volume in the upper pool is sufficient to account for all conceivable post-accident entrapment volumes and still maintajn long-tcrm coverage of the drywell vents. Neither t'c CY system supply or gravity dump of I the Upper Containment Pool were modeled because the suppression pool level is not expected to drop below that required to maintain NPSH to the ECCS pumps. 4.1.2.6 9pntAiDagnt Vent _flyatsla The purpose of emergency containment venting is to relieve containment pressure during accident conditions (1) when all other decay heat removal mechanisms combined are inadequate, (2) containment pressure is well beyond that calculated for any design basis nacident, or (3) the structural capability of the i containment is ;becatened, directly or indirectly. Additionally, containment venting is a means of removing hydrogen from the containment atmosphere. CPS Containment Centrol Emergency Operating Procedure (CPS 4402.01) directs the operator to vent the containment via any vent path not recessary for core cooling before containment pressure reaches specified limitn. If containment pressure 4-10
CPS INDIVIDUAL PLANT EXAMINATION CONTAINMENT DESCRIPTION exceeds the specified value the operator is instructed to vent the containment by all pathways regardless of whether the system used for venting is needed for core cooling. Modeling of containment venting is discussed in section 3.2.1.11, 4.1.2.7 pontainment/Drywell Ventilation The Containment HVAC system (VR), Drywell Purge system (VQ) , and Drywell Cooling System (VP) are not required or designed to function under Design Basis Accident conditions with the exception of their containment isolation valves. These systema have limited capacity and may not be available under Post-Accident conditions and therefore were not modeled. 4.1.3 Systems Credited After ContainmeUt Failure s The Core Spray and RHR systems were credited with continued operability following containment failure under all circumstances with the exception of loss of Suppression Pool level due to a breach of containment in the Suppression Laol. A breach into one of the adjacent ECCS pump rooms is assumed to flood the compartment and thus render the flooded trcin inoperable. Since cach ECCS room is separate and water-tight, the Suppressicn Pool water loss from uncontrolled flooding within any individual ECCS pump room is limited, and redundant equipment in adjacent rooms is protected from flooding. Flooding of the drywell inside the weir wall in conjunction with flooding of the largest ECCS pump room will result in Suppression Pool lovel dropping below the minimum drywell vent coverage level, but will not result in loss of suction for other ECCS pumps. A breach of containment in the Suppression Pool at a location other than an ECCS puxp room (e.g. into Fuel Building) could result in complete loss of Suppression Pool level. However, breach of the Suppression Pool into the Fuel Building is unlikely because there are fewer liner strain discontinuities in this area. 4-11 , 1
CPS INDIVIDUAL PLANT EXAMINATION CONTAINMENT DESCRIPI' ION - Other equipment of the Core Spray and RHR systems are either in their required positions, or ~ move to their required positions shortly after containment failure. It is assumed any harsh environmental conditions would not degrade these components during the short time between containment failure and component actuation. The suction and injection lines for these systems are expected to remain intact. Continued operation is assured with an assumed 50% suction strainer plugging (USAR section 6.2). 4-12
- . ~ . - - - . . . -. - .- .- . ~ .. ._- . - ~ - . .
CPS INDIVIDUAL PLANT EXAMINATIOli CONTAINMENT DESutIPTION I Table 4,1-1 Erincipal Dimensions and Parameters CC NUREC CPS '.50 Cont a irunent; lleight above baucmat (ft) 215 206.75 Inside diameter (ft) 124 124 Wall thickness (ft) 3 3.5 Dome thickness (ft) 2.5 2.5 Total free air volume (ft3) 1.55E+6- 1.4E+6 Design pressure - internal (psig) 15 15 Design pressure external (psig) 3 3 3 Cnat volume / thermal power rating (f t /kw) .62 .36 DBA peak response (psig)
~
3,7 -- Maximum leakage (t vol/ day) ,65 ,437 Internal Design Temperature (*F) 185 185 Drvvell Inside diameter (ft) 69 73 Wall thickness (ft) 5- 5 Top slab thickness (ft) 6 6 [- Design Pressure - Internal (psig) 30 30 l Design Pressure - Extmhal (Itaig) 17 17 Design dLiferent!,a1 pressgre (psid) 30 21 Total free air volume (ft ) 2,46E*5 2,7E+5
- Internal Design Temperature (*F) 330 330 DBA Peak Response (paig) 18,9 ---
Suvorenrion Posi Design Pressure (psig) 15 15 InternalDesignjemperature ('F) 185 .185 Water Volume (ft ) 1.46E+5- 1.36E45 Cont.3 Pool Volume / Thermal power rating 0.0504 0.035 (ft /kw) l 4-13 i l
a m '1 N .m 7, i'x sm7m,m, e r-P 3 rny23.x
.. 2 O am m7 2 I
e r= e"g. _~ mx cs m mm
- a. 1
. i mc.s.e . = , E ,.
m "w . , p T P I mn .m
=
c s , mw =,~=ma. em , u s o e e t w
=m u a
v cgWya m e ,e t R C S < < E << r a F Z D =w a T ~'S c r uau a m# a" (ema fOa,, 8 rr77 N -
- a rg E
M il' oo== " Lvg t
*E v N
I m-A m
- m T
N O C m e W,. , e%$wgm ma , % v wgf Mcg,m e w A , v t o 7 t
- r. a er e 2 ' ,., m n, *Ia . ln~ N >c
. L ,,
m -
%ua E::E::::E:E_ :: ::= :;:gE =_ - _ =E- =
- ::E:_:== :::: = E:: . y 2 e6, lt m s - = ,
m . - nr-mSc s e
. ey n c s l a ;4 g u
_goag 7 . N . - E A . T T. .. M T ,u - -ta R e N A D c c . c2 I e t A T T N _BS a4_m 7 7 2 2 1 4
. 14 N A ,- .
Dow O. e. 1 O C 3.;.
. sl 4 o
e C FI \ . ;, . 44 t r N . -.% . 4 N N G I r ,:.
. rru ug g s E.
S ts O T S I ji x [l~ .." 1 t i Fi
, 11 t ,
, 4 v- ,
N : [ :_~ t 1 _0W .0
~y.S t
I g, . L ., C v - j
<.i w ,l N
4 wq: - V@ O I ' T A N I M
--O
.y m
L ' A M X E m
. p- -
F D T N
- c -:-[
_\ D A 2e,F ' L / ~ y:.1> P / < L r A U D ;: N I , l V & I D N I S P C
CPS INDIVIDUAL PLANT EXAMINATXON CONTAINMENT DESCRIPTION ~~ o' r StJVMSSIO4 vocn. FCSIO F047A f* ' ^ m 10470 fM10 x 6 0 I A C TOSIG
" vis rwr V3 ## " VI q v4 v VI y, r0<it V' Vi4 g- V2 % l - vis k g;,9 7-- i gs v F04tr y A N mc .
l FCSIB I f041G
\,m,C F0416
/ 1
}
IN F04tC 100" - Noro n A m u vt -rwe VS- ro<7F - w-ro47A v13-rwc V2 -F04 tB V6- F0410 Vlo-F041A V t 4 - F04 tG V3 - FOSIS . V7 - F0470 Vll.-FCStG - VIS-f0 SIC V4 -F041F V8 - FCSIO V12 - FG4tt. Vt6 - F04 tC ' Figure 4.1-2 SRV Discharoe Locationg 4-15
CPS INDIVIDUAL PIANT EXAMINATION CONTAINMENT DESCRIPTZON Sua DeWJST LINE FROM
/SRY FROM SRY OtSOVRGC DRYWEL
- WRL h -
CDUMNMUU WRL Weg WPPRESSI0t(POOL WALL - OtSOMRGE OrEJOiER 4 w22,rvwQY HOLES (TYP.)
,-)
Figure -4.1-3 Tvolcal SRV Ouencher 4-16 i
___,______m.. _ . _ _ _ _ _ _ . _ _ _ _ _ _ _ _ _ _ _ _ _ m Z H CQ E4
- - E'
**sju 8 5 o$ o~ "4O M5 .
0 pac v 8 8
- i. c
- e IE u9c m
'm j$hA j' OQ 9"r
~ H N g$/\ i : < : o :. _.: D "$u E 4 E i a ~ o a $ .- u- s ; -sDs O E< E< d.-
-8 N a d,8 l u
> z5
-sa x "<
e L - ! 8 s/ s/ is i $58 E:::5 t: _; \ o-i : =
. o p n
- T C
~? , - [
y W "_ ! " _ .I_N. _ _ . _ MOh b b me <. Ebno F*4 o
- L 9
- 3 ..
t c y
.. ; ; ll o v i < I o u o l O o . o 8 - e
'**1*"'*** O 4 h M
! O c
T2 !: u2 o : 5 E no :! - -n : - . e 5 : : en : < E '
- c-
-m -
o l c H
- o o < o 5 -Y%
- i- e % 5 C e-4 1 A'8 n l<
y _ o 5
- E -
vvv 4 o
.Q w
v i l
* . 4 w a s e. ~.. ~ ~ , ~ ;~ ;a q:0:<:~ c;&:~-a:l r;&:&:&. n n ~ :~ : ~- ~ :~ . - -+ t:e:& - r~=~ s t. ~ e4 (n ILe D y y _. .' .
g i o
^f) a u o
sm ci c l u 4#3 h w><w p~ s a - C e4 l 2 -- ' # P., T T -- -- l 5 g ...4 ,. . . - ., ,~ .-, r u e, N e . O g C y I* i f e 7n Y$ o o o o
*~
SN j(@ x o
-- n g
. < o I
< o I I w -
!! 28 :
l Sn o* !. !. e v ~E i 0 o 8_ E-4 : o - 3 *"* h !# 0 z
- u r. -
- E as:
D Q H Q Z H M Q. O I
CPS INDIVIDUAL PLANT EXAMINATZON CONTAYNMENT MODELS 4.2 Plant Models gnd Methods for Physical Processes This section documents the analytical models used in the accident progression analysis. General assumptions used in the modeling of phenomenology are also described. 4.2.1 Plant Mqdelp The Modular Accident Analysis Program (MAAP) was the primary code used for the containment performance analysis. CPS specific _ data, including Containment, Drywell and Suppression Pool parameters, were used as input to the MAAP parameter file to provide the most accurate output achievable. The Computer Aided _ Fault Tree Analysis (CAFTA) and Set Equation Transformation System (SETS) were used for the containment systems and event tr.ce sequence quantification. 4.2.2 General Assumptions leportant assumptions used in the level 2 analysis in addition to those listed in section 3.1.2.3 are listed below.
- 1. Medium /large LOCAs and IORVs are assumed to depressurize the vessel without additional operator action.
+
- 2. For ATWS sequences, the Containment is assumed to fail prior to vessel failure or core damage, given unsuccessful SLC injection.
- 3. Suppression Pool bypass by loss of suppression pool inventory is modeled in the CETS. The radionuclide scrubbing capability of containment spray is not modeled upon loss of suppression pool inventory because the sprays are inoperable without suppression pool inventory. However the sprays may be available early in an event.
4-18 l 1
IS -l CPS INDIVIDUAL PLANT EXAMINATION CONTAINMENT MODELS 4.- The Late Injection heading on CET's is applicable to cooling core debrio after vessel failure.
- 5. A release of radionuelides is modeled as a certainty if containment isolation fails following core damage. The release will occur regardless of the operation of core cooling systems or the availability of containment systems, however the systems can affect the magnitude of the release.
- 6. Motor operators for containment inboard isolation valves are assumed to fail under the extreme environmental conditions postulated during a severe accident. However all of these valves are either in the required position or move to the required position early in an event, a'nd are assumed to complete the required function before degradation occurs.
This assumption is valid for all events except Station Blackout (SBO). See section 4.1.2.1 for the discussion of isolation in a SBO.
- 7. The Hydrogen Ignitors were assumed to maintalu hydrogen concentrations below the detonable limit if all ignitors in one division fail, and less than 6 ignitors-in the redundant divinion fail. This assumption is based on the results of l
the NSAC 106 study at the 1/4 scale test faciliti for hydrogen ignitions with additional conservatisms for Perry l l versus CPS configuration. l l l 4-19 l
CPS INDIVIDUAL PLANT EXAMIh rION CONTAINMENT MODELS l l
- 8. Potential for containment failure in tbs Suppression Pool area was modeled in the CET's.
- 9. Only three of the available six containment venting pathways ,
are modeled. All RHR, FC and VR system components that must : I reposition to initiate venting via the modeled pathways are also modeled. Pipe rupture in these systems is not modef.ed i as this fajlvre would not prevent venting of sne , containment. j i i . 10. Failure of drywell and containment penetrations due to I , reaction forces on the RPV during hign pressure blowdown is not a significant threat to containment integrity at CPS. Calculations show that under the worst case blowdown at.enatio, the thrust and lif t force are Insa than 10% of the reactor vessel holddown bolt and weight forces (section 4.4.2).
- 11. Direct Containment Heating (DCH) is not regarded as a significant challenge to containment integrity for CPS plant. Calculations show that for coro melt and vessel failure, this phenomenon will not lead to suppression pool saturation and will cause only a few psi increase in containment pressure. Containment pressurization due to DCH is not included in the Containment Event Trees (section 4.4.6). .
4-20 ;
i ' 2 CPS INDIVIDUAL PLANT EXAMINATION -CONTAINMENT MODELS i
- 12. Steam explosions were evaluated for both In-vessel and Ex-
[ vessel events as potential mechanisms for containment j
- failure. Neither of these sequences provide sufficient '
energy to breach containment, therefore the CETs for CPS do not include a node for in-vessel or ex-vessel steam explosions (section 4.4.3). 13 .. All Direct Containment Bypass (ISLOCA) sequences vanished in truncation in the level 1 analysis (section 3.4.1.1 and figures 3.1-12). ,
- 14. Containment Penetration failure because of thermal attack is E not eFpected at CPS. ThereJore containment penetration failure trom high temperature is not inclui.3 in the CETs (section 4.4.4).
- 15. Containment failure from a Molten Core-Concrete Interaction (McCI) has been shown not to be a likely failure mode. In the event the core is ejected into the Reactor Vessel cavity and is not coolable, the containment would have failed by l
i other means before basemat penetration occurs. Therefore, MCCI was not nodalized in the CPS CET's (section 4.4.7).
- 16. Hydrogen detonation and subsequent containment failure are
! of concern only during a long term SBo. A node for hydrogen control has been included in the CPS CET's (section 4.4.8). l l [ 17. The most probable containment failure location from L overpressure is a tear in-the liner above the suppression i pool at a penetration. The pressure at which the containment has a 50% probability-of failure was calculated to be approximately 93.8 psig (section 4.4.9). l c -i 4-21 s, - - . - - - ~--o,- w-w w vc.---ee a ~ ,- , ,,--o-<- , m -ow e,,m-- -a-rme,,-,-em -s e-r -c>> <ww-v no- e4 e-- - - - - - - + - - +-+~'det w- w w -~~
CPS I!1DIVIDUAL PIAllT EXAMIllATIOlt CollTAIllMEliT bills t 4.3 ]liRp_ILn4_ Plani _ILam aJ e_. e t a t e a This section covers the methodology and results of binning sequences from the front end analysis (level 1) for evaluation in the back end analysis (level 2) and binning of the results from the back end sequence quantification. The bins are organized by factors such as timing, reactor condition and containment conditions. A discuusion of the binning process is presented for the following level 1 and level 2 results: Accident Classes Containment Failure Modos Release Modes 4.3.1 }io M Lg A g l o_q y The level 2 analysis follows the EPRI simpliflad methodology discussed in RP 3114-29, " Generic Framework for Individual Plant Examination (IPE) Back-end (Level 2) Analysis". Containment tvent trees were constructed emphasizing things the operater could see and control, such as containment pressure and temperature, system operation, etc. A CET was developed for each accident class described in section 3.1.5. The sequence equations from the level 1 analysis for each accident class were used as input for each CET. a The CET sequences are built based on success or failure of the headings identified as listed above. The mission time used for the level 2 analysis was 48 hours, based on the high likelihood
- of repair and external resources in that tire period.
Each sequence in the CETs was quantified. Those that survived 2 truncation at lE-9 were all classified for plant damage state, re) ease modo, and source term, as discussed in sections 4.3.3,
/.3.4, and 4.3.5.
4-22
4 CPS IllDIVIDUAL p!)UIT EXAMIllATIOli COliTAIMMEllT BIlis r i 4.3.2 Zrgat-tp-RA9k End Interf ac_9ji! Five major classes of accidenis were used to categorize the level 1 accident sequence results. These categories were further subdivided into subclasses. The accident classes were previously discussed in paragraph 3.1.5. Those which had cutsets from the level 1 analysis are presented in Table 4.3-1. The predominant accident class and subclasses are dependent on failures identified in the level 1 sequences that are assumed to lead to core damage. These accident classes are convenient for characterizing the level I results and identifying plant design and operating characteristics that drive the potential for core damage. l The accident classes are also useful for .ransferring the results l of the icvel 1 PRA into the level 2 Concainment Event Trees (CET). This transfer is accomplished by simply using the equations from the level 1 sequences by accident class as inputs for each CET. Fault tree linking allows dependencies and failures important to the level I results to be carried directly into the level 2 sequence analysis. 5'ault trees developed .or the level 2 event tree headings which are similar to level 1 fault trees, allow for these dependencies to be represented in j the level 2 sequence analysis. The level 2 analysis contains l additional sequence and timing dependencies. Some systems that L may not have been modeled in level 1 sequences were modeled in , the level 2 analysis. For example, low pressure injection systems are of no help in preventing core damage if the vessel j cannot be depressurized, but may be useful for debris cooling l after vessel failure. Similarly, if a system had tailed and could not be recovered in time to prevent core damage, additional time is available for recovery in order to prevent containment
- failure. This additional conditional recovery is applied to the l appropriate failure events in the sequences. Table 4.3 2 ic provided to summarize these types of modeling dependencies, r
b i 4-23
CPS INDIVIDUAL PLANT EXAMINATION CONTAINMENT BINS 4.3.3 Elant_Damace States Plant Damage States (PDS) are identified for each sequence of the level 2 CET's which was not eliminated from consideration by truncation. A four letter code (A BB C) was used to identify the Plant Damage State (CET end state). These codes are identified in Table 4.3-3. The first letter (A) defines the state of the reactor at the time of vessel penetration, whether the event was recovered within the vessel or vessel penetration was assumed to occur at either high or low pressure. The second two letters (BB) are used to define the state of the containment at the end of each of the containment event tree sequences. Whether the containment is intact'or failed as a result of various savere accident phenomena is identified. The containment failure modes identified by this two letter code are pattorned after the phenomenological challenges identified in NUREG-2300, "PRA Procedures Guide". In this manner, the CET sequences are categorized into functional causes for containment failure much in the way the level 1 sequences were classified with respect to functional challenges to core cooling. The last letter (C) in the plant damage state identifier represents the timing of the event. It should be noted that the timing specified in.this identifier is relative to the onset of core damage. I l l 4-24
T CPS IllDIVIDUAL PIAllT EXAMIloATIOli CollTAIllMEli? Dill. 4.3.4 Rolname_)inds Tno release modo describos the type of releases for source term binning, and is shown for each sequence on the CET that was not climinated by truncation. The releano modo codos are alphanumeric (og. DS). The alphabetical designators are used to describe the containment status as follows, , 1. A - Containment or reactor vennel in intact at accident termination, t
- 2. B - Containment f ailure occurs with reloano scrubbed through the supprossion pool. ,
- 3. C - Containment failuro precodos or is concurrent with reactor vossol failure. The suppresolon pool is bypassed.
- 4. D - Containment failure is delayed after reactor vessel failure. The suppression pool is bypassed.
- 5. E - Radionuclides exit the reactor directly to atmosphore through an unisolated LOCA outsido containment.
Subcategories of the roloaso modos are identified by numeric designators 0-12. Generally speaking, odd numbers indicato a small containment failure and even numbers ind.icate a large containment failu o. Table 4.3-4 shows the relationship betwoon the various conditions of the containment and release locations. Figure 4.3-1 is~an example of a CET showing the Release Modo and the logia and assumptions used. 4-25 1
, -, ., .---..,n . . , , , - - - - , - - - , , - ~ , , , ., , , ~ , , , , , , - , , ~~,-
CPS-INDIVIDUAL PLANT EXAMINATION CONTAINMENT BINS 4.3.5 Agg.gapme' .g M qurce Term Importan2e Determination of t actual source term resulting from the level 2 sequences is bar d on the relative amounts of various types of fission products releasou from containment. Fission products are categorized into the following three groups:
- Noble Gases - This group includes inoet gases. A large fraction of this group is released during any containment failure scenario. From a hazard standpoint, they are relatively unimportant because of their chemically inert nature.
Volatiles - This group is composed of CsI, RbI, TcO2, CsOH - and Tc2 This group represents the greatest hazard because it contains the important cesium, Iodine and Tellurium isotopen. Non-Volatiles - This group is composed of Sro, moo 2, Dao, lanthanides, CeO 2, Sb and Uranium /transuranics. There is not ordinarily any large amount of these fission products released. The amount of these fission products released from containment in the level 2 sequences is calculated by the MAAP code. Using the release percentages of the different fission product categories, a release category is determined for each level 2 pequence. Table 4.3-5 presents the guidelines for determining the sequence release category. 4-26 g-
. .._.-. ._. . -....-..-.-,-.._ .-.u - _ _ .~,,-, , . . - . , . . . . . - . - - . . . . _ . - _ - . , , . _ _ _ , _ _ , .-..,..-------.rmm ,- -_y--.., , . ~ , <
l CPS INDIVIDUAL PLANT EXAMINATION CONTAIMMENT BINS l l l Table 4.3-1 Front-to-Barf. End Interface Containment ' Event Tree Innttt IA Class IA - containment intact at coro molt, . RPV at high pressure. IB Class IB - Containment intact at core molt, Station Blackout ID C). ass ID - Containment intact at core molt, RPV at low-prousure. IIIB Class IIIB - Small/ medium LOCA, No depressurization of RPV. IIIC Class IIIC -' Medium /large LDCA, RPV at low pressure. IV Class IV - ATWS
- Class V - IS LOCA, occurring outside ,
containment. No CET was developed for ISLOCA because all of thoue sequences truncated out in the lovel 1 analysis. I l Y l l l t l - 4-27 , l
, , , , - . , , , - - , ~ -.
, , . - ., , -, - , . . . , . - - - . . , ~ -. - - . . . . - , . . - - , - - - - --
4 i CPS INDIVIDUAL PLANT EXAMINATION CONTAINMENT BINS J Level 1 to Level 2 Systen Dependencies i
- ACCI' DEPRESS ***
- DEBRIS COOLING * * *
- l DENT ------- ----- ------------- - ------------------ ---- - -=-
CLASS ADS HPCS RCIC FW LPCS LPCI CD/CB CRD FP
==
IA' 1 1 4 1 6 6 6 9 11 IB 10 2 4 2 7 7 7 10 11 ID NR -1 4 1 1 1 1 9 9 IIIB 1 1 4 5 6 6 6 9 11 IIIC NR 1 4 1 1 1 1 9 9 u IV 1 3 4 1 3 3 6 8 6 i 1 KEY: . 1 FAILED IN LEVEL 1 (RECOVERABLE)- 2 FAILED (RECOVERABLF) OR NO POWER (RECOVERABLE) 3 ' SUPPRESSION POOL SUCTION SOURCE UNAVAILABLE 4 ' NOT CREDITED (HIGH STEAM LINE RADIATION) 5 INADEQUATE AT LEVEL 1, CREDITED IN LEVEL 2 , 6 AVAILABLE AFTER DEPRESSURIZATION OR VESSEL FAILURE 7 : NO POWER AT LEVEL 1, AVAILABLE AFTER POWER RECOVERY AND DEPRESSURIZATION OR
, VESSEL FAILURE 8 NOT CREDITED IN LEVEL 1, AVAILABLE IN LEVEL 2 9 INADEQUATE AIDNE, USED FOR DELAYED FAILURE RECOVERY IN LEVEL 1, ALIO'4ED FOR LEVEL 2 10 , NO POWER AT LEVEL 1, AVAILABLE AFTER POWER RECOVERY 11 INADEQUATE AIDNG, USED FOR DELAYED FAILURE RECOVERY IN LEVET 1, AVAILABLE AFTER DEPRESSURIZATION OR VESSEL FAILURE NR NOT REQUIRED Table 4.3-2 4-28
-mi +-- u +- m %- - es v w + -, -- a __ ,_.- M
CPD INDIVIDUAL PLAllT EXAMIllATIOli CollTAIliMEliT Dills Plant Damage State Cadsn i i A 10 the reactor status, either: R - Recover in vossal L - Vessel penotration at low RPV prosauro H - Vooool ponotration at high RPV prosauro DB is the containment statuo XX - Containment intact VS - Vent through supprossion pool VD - Vent bypassing supprossion pool OD - Overprousure failure due to decay heut OA - Overpressure failure due to ATWS : OH - Overprosauro failure due to hydrogen combustion ' OV - Overpronouro failure due to loss of vapor suppression CI - Containment loolation failure CD - Isolation failure with supproosion pool bypass C is the timing of the event: X - Not applicablo E - Early (< 6 hours) I - Intermediato (6 to 24 hours) L - Late (> 24 hours) CODE = A BD C ' Tablo 4.3-3 1 b 4-29
, _ , _ , _ _ . - , . . . . . . . . , , , . _ , ,,,,_,_,_m,-, , . , , _ . - , , _ , ..,,,-,_,__-..,_,_-_,.,,_m_- _ , , . . . . , , . . , , , - , - . _ . . , , , . ,
CPS INDIVIDUAL PLANT EXAMINATION CONTAINMENT BINS '! t
,- t
- RELEASE MODES RELEASE ;
SMALLCONTAINMENT FALUPE LARGE CONTA;NMENT FALURE j C' eiTAINMENT LOCATION
' FROM I
' 'UADS VESSEL BEFCP.EVESSEL DELAYED AFTER BEFOREVESSEL DELAYED AFTER I
! FAILURE VESSELFA! LURE FAILURE VESSEL FALURE i t
j ISOLATED A0 ! , INTACT ' VENTED A1 A2 l FAILED THRuse B1; B2 l ! . Wim vre;weLL C1 C2 i D1 D2 i SPRAY ORYWELL C3 C4
*" WEMELL i C5 d6 wmi 8"'^5 "
SUPPRESSION D3 - D4 NECTION , eca DRYWELL C7 C8 ! f i NO WETWEU. C9 C10 D5 D6 ! INJECrlON + DRYWEU. C11 C12 [ cont E1 E2 , BYPASS l 4 , l Table 4.3-
- l i ..-
2 4-30 i I -
_m____.m m...-__. . _ . . . _ _ . - _ _ _ . . . . _ _ _ . - - - . _ . _ _ . . . . _ _ . - - - . _ _ _ _ . _ . _ _ . _ _ _ _ . . _ _ CPS-INDIVIDUAL PLANT EXAMINATION CONTAINMENT DINS Table 4.3-5 Mvel 2 Release Catecories
.Cafgg.ory Noble Gases Rolatiles Non-Volatiles NR 0 0 0 I 5 100% 5 1% 50.1%
II $ 100% 1-10% 0.1-1.04 III $ 100% > 10% >1.0% , Utilizing this categorization scheme, a release category was assigned to each level 2 sequence that van not truncated out. Table 4.7-1 displays the cource term information for all evaluated sequences. It also includes the Plant Damage State, Release Mode, vessel failure time, and containment failure time.. Event timing was chlculated to within a few minutes. i o w t l i l t 4-31 ,
1 CONTAINMENT BINS CPS INDIVIDUAL PLAh"r EXAMINATION Release Mode Example
**ms t (c=q
- tem pes M AT =Ct SE3 Fles i etL *M4 58C 'taa
!= A*t rtwo t att Ct 578a? WWCim C3*1a tew = Ct%CSIPt10*
ait,Es AC Pent contag==En stactoa gas t wa rnf lees e=t a f ftalt ft Ecorta,a a FO Y CEPDt18te! P#I3a TO PCat e tse twtat CDes t peg fasa ag*C*at Cf 49.st. lafjom vtStit Rf CDet # # $ C# PCCL SW % El *# t *E = f
- ISOLA?!DC f attue s t=stttite evenst 811tt F a tt
- r. O 9 a en 9 F t t
#sta %tt 7. 3 5t .g so na I
l it C E *1 ft-9 s Tt t 3 et 06-9 YL5a 't. *9 I
- tn e ut -. t steg og et.g I
tt 0 ? es gg.9 {
\
_ f it OS el.tt-9 fte9 et et
- e uses it s e n s tt -4 ao ==
I tus e s . tt - e s . s -a - t so ==
.sas fus p
1 TLit 4t.04-9
- 1. -
itst 41.01 9 mvt t it ? - d.tCE*P 01 !! E seemt it s 3.?at-e 09 1f3 l y i
^
PDw! ?t!) t Sft-6 C1 !!I seCis 7t?a F . 0 3t * ? et 11 I l t Cta51 15 rU *!S S-06-vP tiescription - PC power recovery in time to prevet:t to prevent vessel fatture emsuccessful, containment isolat tort successful, no Rrv depresaurtratien,ifle*e power recovery & injection unsuccessfu', containment venting available re@ aired. Results - PPV failure occurred at 2.7 hours, peak dryvell temperature rea ded 1309r a.ith the onset of drywell penetrPtion seal failure from thennat attacg began et 13 hours using a e in* occurrinc at 11.4 hours, containment venti =>g vent path, peak containment pressure reached 22,4 rsig. Plant Damage State - fr,'3I selease ?? ode - Da :=.odeled as a containment failure instead of venting since suppression pool bypass occurs) Figure 4.3-1
, . . , 4-32. . . . . . . ..
I ! I CPS INDIVIDUAL PLAET EXIMZNATION CONTAZNMENT FAILURE 4.4 Containment Falluty CharA2terization i This section presents discussions of the various potential containment failure mechanisms and summaries of the evaluations wh?.ch worn performed to determine the applicability of the phenomena to the CPS Mark III containment. 4.4.1 Direct Containment Dvoagg Direct Containment Bypass refers to accident sequences that involve releases of fission products from the primary system directly to the outside of the Containment. Such scenarios require the occurrence of an opening in the primary system pressure boundary outside of the Containment that creates an unisolated flow path. Typical initiating events for such sequences include steam line breaks outside of Containment that are coincident with failura of the Main Steam Isolation Valves (MSIV) and low precsure system piping failures induced by inadvertent exposure to full primary system pressure, e.g., Interfacing System Loss of Cooling Accidents, IS LOCA. Subsequent cystem failures are required that prevent coolant make-up to the reactor vessel. Regardless of the hypothesized sequence of events, however, the common feature of all of these scenarios is that the substantial fission product retention capabilities of the Containment are ineffective. The screening criterion for Direct Containment Bypass sequences (Class V) is 1.0E-7 per year of reactor operation. For CPS, all Class V (ISLOCA) sequences truncated out in the level 1 analysis at 1.lE-9. The break locations considered were for all piping external to containrent that tie in directly to the Reactor Pressure Vessel or Recirculation System piping, including Main Steam and Feedwater piping in the steam tunnel (section 3.1.J.S.2) 4-13 .
, , .. --. . - . _ _ - - - --.. , , - - - - -s.,-
i CPS INDIVIDUAL PLANT EXAMINATION CONTAINMENT FAILURE j 4.4. YggARL)d.QyAgwm J' Vessel Blowdown is the high prassure ejection of the reactor vessel contenta, including molton core debris from a failed reactor vessel. The concern 18 that jet thrust forces would be large enough to cause vessel movement on its foundation and tear drywell and containment penetrations. An analysis was performed to assess whether the CPS RPV and supporting structures could l l withstand the upper bound thrust that would be expected at the l time of vessel breach. l 1 The forces from the upper bound combination of jet thrust from l the vessel penetration and lift forces from differential pressure between the pedestal area and the drywell were calculated to be 577,500 lbg assuming a 2 pai differential between the pedestal area and drywell, MAAP analysis supports the 2 psid value. The-forces opposing the blowdown force are the weight of the vosoci and internals, and the tensile strength of the 120 vessel holddown bolts. The holddown bolts force was calculated to be 102.6 million Ibf and the vessel / internals were estimated to , weigh 1 million pounds. Thus the forces opposing vessel movr ent are approximately 180 times the force that could cause tv a;' movement. A similar calculation was performed using 200 peid between the pedestal area and the drywell. Even using this extreme value, the holddown forces greatly exceed the forces that could cause vessel movement. 4 1 4-34
-_.~._..______._..,_._.__.._,_-,__..,__.__-__J
l CPS INDIVIDUAL PLANT EXAMINATION CONTAINMENT FAILURE Based on the proceding discussion and previous calculations, this issue does not represent a credible challengu to the containment integrity at CPS. The maximum amount of force that could be produced from vessel blowdown with uncertainties considered has been shown to be considerably less than the vessel holddown force from the bolts alone. 4.4.3 Higam_HgpLenienn Steam explosion events were evaluated for both in-vessel and ex-vessel as potential mechanirms for containment failure under severe accident conditions and, therefore, as potential causes for radioactive releases to the environment. 4.4.3.1 In-y_en.atel The issue for in-vessel steam explosione is whether an explosion of sufficient magnitude to fail the reactor vessel, with consequential failure of the containment, could occur. This was l addressed by evaluating the fundamental physical processas required to create an explosion that could result in vessel failure. The_ analysis closely follows the IDCOR assessment of this phenomenon and indicates that explosions of this magnitude are not likely to occur within the CPS! reactor vessel. This is in agreement with the findings of the HRC sponsored Steam ! Explosion Review Group (SERG) which concluded that the likelihood I of an in-vessel steam explosion leading to alpha mode containment failure, was very unlikely. Experimental evidence has demonstrated that a relatively high reactor coolant system pressure prevents explosions altogether. For conditions in which reactor pressure exceeds 150 psia, stean explosions are not considered possible. 4-35
CPS INDIVIDUAL PLANT EXAMINATION CONTAINMENT FAILURE For events in which reactor pressure is likely to be low, a number of conditions must be met in order to produce an energetic fuel-coolant interaction that might jeopardize the integrity of the reactor vessel Large amount of core dobris entering the lower plenum at once. Fragmentation of the hot material within the water in thn lower plenum. A trigger to nitiate the explosion. Bfficient energy transfer from the debris to the coolant. An overlying slug of water to transmit energy in a coherent fashion. The ability of the alug to be treasmitted through the upper structures within the reactor pressure vessel. All of these factors must have the right parameters to create an event with enough magnitude to rupture a reactor pressure vessel. The failure of any of them to achieve the proper conditions precludes the possibility of generating a missile that could presumably impact the containment boundary and thus induce an alpha-mode containment failure. At CPS, because of the lower core plate design, a large amount of core debris entering the lower plenum at one time is unlikely. The internal core configuration, steam separators and dryers greatly reduce the probability of a water slug reaching the vessel head with sufficient energy to disr? 1ce it. As a result, conditions which could lead to vessel rupture due to an in-vessel eteam explosion are not expected for CPS. In addition, the drywell head that is located above the RPV has a pool of water above-it. These'are barriers that would be in the path of c missile before the containment boundary is approached. In view of the Mark III design, the alpha mode failure mechanism is not a-credible containment failure mechanism. Consequently, 4-36
1 l CPS INDIVIDUAL PLANT EXAMINATION CONTAINMENT FA21URE I on the basis of design and the preceding discussion, no node was included for in-vessel eteam explosions in the CPS containment event trees. 4.4.1.2 Ex-vessel Ex-vessel steam explosions are theoretically possible and may be an important mechanism for the quenching of core debris discharged from the reactor vessel. There are two aspects to be addressedt (1) potential overpressure in the containment due to rapid steam generation and (2) shock waves which could be created by the interactions.
- 1. Containment Overpressure containment overpressurization may occur as a result of rapid and extensive steam generation because of molten metal deposition into a pool of water. For CPS, the following assumptions were used to calculate the pressure increase in drywell and containment.
molten material = \ the core; \ the lower cora plate; \ of CRD Mechtnisms; \ the lower vessel head Water = Vessel pedestal full of water up the lower edge ; of CRD cart opening. Drywell pressure increase, given the above conservative assumptions, is 1.036 psi. This value is well below tle design pressure of the drywell. Containment pressure increase was calculated by adding containment volume to the drywell/ pedestal volumes. The containment pressure increase is 0.15 psi. This value is well below the design pressure of 15 psig, and_is insignificant when compared to the containment expected failure pressure of 93.8 psig. 4-37
_ - . - - . - . . .- - - .._- - - . . ~ . - - . . - . . - . - - - _ . . - . - - CPS INDIVIDUAL PLANT EXAMINATION CONTAINMENT FAILURE : 1
?. . Shocx Waves :
Drywell failure could be postulated to occur as a result of shock waves generated during an ex-vessel steam explosion. . The same assumptions given above for containment overpressurization were used. Additionally, it was
- conservatively assumed that (1) a peak pressure nf 1450 psi occurs in the indcraction zone (2) vessel failure occurs '
within 5 ft of vessel vertical conter11ne and radially in line with tha pedestal opening to the drywell and (3) shock wave originates at the pedestal floor elevation. The distance to the dryweil wall is 32 feet, and calculations show the maximum peak '.nstantanco'm pressure rise at the drywell wall, at a Ir. cation >bove the-weir wall, is 3.6 psid, well below the design pressure. A similar calculation for shock wave pressure on the pedestal yielded a maximum peak instantaneous pressure on the pedestal wall uf 43.4 pai. This pressure is not expected to cause damage to the pedestal, the vessel lower head, or the vessel skirt. ; Pressure attenuation over distance was considered in the calculation, however obstacles in the path of the pressure wave which could also attenuate the pressure were no: considered. The two proceding paragraphs provide conservative estimates for the two pressurization mechanisms associated with potential ex-vessel steam explosions. The 1.036 poi increase due to pressurization and 3.6 psi pressure from shock waves, yloids approximas ily 4.6 psid at the drywell vall which has a design. preocure of 30 paid. This value is not detrimental to the integrity of the drywell and therefore the CETs for CPS do not include a node for ex-vessel steam explosion. 9 4-38
CPS INDIVIDUAL PLANT EXAMINATION CONTAINMENT FAILURE 4.4.4 Pera ira.tign Thermal AttagA Drywell and contair>uent electrical and mechanical penetrations may be exposed to high temperature following reactor vessel breach during a severe accident. Atmospheric heating of the drywell by molton core debris and the resulting high drywell gas temperature could affect the sealing capabilities of elastomers used in various drywell penetrations. This could result in eventual degradation of containment penetrations, ultimately allowing a release path to accondary containment. The degree and timing of this postulated failure mode is dependent on (1) the gas temperature achieved, (2) the duration, or exposure time at elevated temperature, and (3) the characteristics of the elastomeric materials involved. Drywell and containment penetrations have pathways that allow the atmosphere to come into direct contact with penetration inboard non-metallic seal materials. Heat transfor to the inboard seal material would be by convection as the high temperature gas comes in contact with exposed seal materials. lient transfer to the penetration outboard seal materials would be almost exclusively by conduction thror.gh the metallic parts of the penetration. The overall convect ive contribution to penetration outboard seal material is expected to remain small, even after significant degradation of penetration inboard seal material. Table 4.4-1 lists the various non-metallic laaterials in CPS drywell and containment penetrations, the tested temperature for each material, the expected temperature during severe accident conditions, and the anticipated life of the materials at the expected temperature as calculated by the Arrhenius equation. 4-39
F 1 1 l CPS IllDIVIDUAL PLAliT EXAMIllATIOli CollTAINMEllT FAILURE The life expectancy for the drywell matorials at 700*F oxconds two wookn. Thin its much longer than expected for a recovery of core cooling. The maximum containment temperaturo uoan in the MAAP runu wan j loan than the tented temperaturen for all but one nealing material, (illuco IDCASEAL) . This material ( LOCASEAL) was actually tested to 355'F for uhort periods of timo. It in the prennure retaining part of the containment oloctrical ponotrationn and railure in itnolf would not cauno a leak out of the containment. Itu life expectancy in the containment environment is 504 dayn. Failure of the containment becauno of penetration uoal failuren due to elevated temperaturen in not expected at CPU. Ilaned upon experimental data and CPS MAAP runu, under wornt caco conditions, drywoll temperature in orpocted to excond 700'F about 11 houru into an S!!O with no oporator actions. Dryvell non-mutallic nual degradation will not result in a significant increase in drywell leakage prior to 700* F. It in concluded that a relonso from the reactor to the drywell can propagate to the containment via drywoll ponottation failuron af ter drywell temperature reacher, 700'F. This reloano would bypnan.the suppronolon pool but would be retained within the containment sinco no_ containment punotration failure in expected because of elevated tougioraturen. Docause of this penetration failure, the drywell and nupprounion pool woro annutcod bypanned for unquencon in which drywell temperaturo excondu 700*F. 4.4.5 C9ntainmenkla91At19R Pailuro to inolato refera to neveral accident sequences that ( involva a mechanical or operational fallure to achieve containment isolation prior to the onnot of coro damage. 4-40
CPS INDIVIDUAL PLANT EXAMINATION CONTAINMENT FAILURE As described in section 4.1.2, only one of the two series isolation valves (inboard / outboard) is required to close to offect isolation. A Fault Tree (section 3.2.1.2) considering instrumentation power dependency, operator actions and valve failure was used to evaluate the probability that at least one of these valves would move to the required position early during an event, and.thus successfully complete its safety function. This i Fault Tree was used for all accident scenarios except for Station Blackout (SBO) when motive power would not be available. This method is probably conservative, considering the results of the following paragraph for SBo sequences. 1 An analysis was performed for each motor operated containment l isolation valve that is normally open during power operation, and would therefore not close during an SBO. The results of this analysis showed only one penetration, containing valves 1FC007 and 1FC008, which is the line between the upper pool skimmers and , Fuel Pool Cooling and Cleanup surge tank, that could be a potential bypass pathway and would require operator action to isolate. Existing Emergency Operating Procedures address operator actions to check and manually close, if necessary, isolation valvo 1FC008 located in this line. All other valves are either required to be open during accident sequences or are part of a closed-loop which would prevent release of containment atmosphere to the environment. Failure of containment to isolate is modeled as a branch in the CPS IPE Containment Svent Trees. 4.4.6 pirect Containment Heatjag Direct containment heating (DCH) is a potential early containment failure mode that would be expected to occur immediately after reactor vessel failure The largest potential for the occurrence of direct containment heating is expected during core melt sequences that maintain a high (greater than 200 psia) reactor 4-41 - i
- - . . . - _ . , , , - - - . _ . . , . . . . .. ,..m., , , _ . . . , , , . . ....m,_ ,,_,,..,_,.,m_ .,,,_,,.,r _._.,,..c.. .,,y., ,,. e,-.
CPS INDIVIDUAL PLANT EXAMINATION CONTAINMENT FAILURE r vessel pressure until the time of vessel failure. The containment failure mechanism associated with direct containment heating is overpressurization of the containment shall due to rapid increases in gas temperatures as the corium energy and - metal oxidation energy are released. The extent of pressurization depends upon the amount of debris which is discharged at vessel failure; the configuration of the plant which may enhance or hinder dispersal beyond the podostalt the frac ion of the debris which can be' finely fragmented and dispersed throughout the containment atmosphora; and the ability of debris to transfer heat into various areas of containment. BWR Mark III containments have several design characteristics that sigt.lficantly limit the magnitudo of the pressure rise associated with direct containment heating among which are: Supprossion Pool , Reactor Deprensurization System . The most significant means of proventing direct containment heating is to assure reactor depressurization (<200 paia). The CPS plant has sixteen SRVs, any one of which is capable of assuring low reactor proasure at the timo of vessel penetration. The CETs explicitly account-for the potential for depressurization with this system. The offects of direct containment heating apply only to those accident sequences in which depressurization is unsuccessful. The CPS containment also has the suppression pool to absorb the heat that is released from the reactor during blowdown. The
. suppression pool is very effective at removing the debrin mass and energy during the blowdown phase. Because of the rapid flows, however,-thoro could bc a cortain amount of debris that ,
escapes the scrubbing offect of the pool during the initial blowdown phase. The method by which this.could occur is that acrosola could be trapped within gas bubbles that do not condense l 4-42
, .- _ . _ _ . _ . _ _ _ . ~ _ . . _ _ . . _ _ ._ ,_ _. . ~ _ ~ , . .. . _ - - _ _ _ _a
CI-S INDIV8 DUAL PLANT EXAMINATION CONTAINMENT FAILURE or collapse during travel through the suppression pool. The mass of debris aerosols would be small, and likely to have been cooled somewhat by radiative heat transfer, thereby reducing the energy escaping the water scrubbing. Any impact on the thermal-hydraulic effects downstream of the suppression pool are not expscted to be significant since essentially all of the energy from the debris will remain in the pool. A calculation was performed in order to quantify the suppression pool temperature following a reactor vessel breach at high pressure. The assumptions used in this calculation were that \ the core, \ the lower core plata and 4 the lower vessel head were ejected; the suppression pool is at an initial temperature of 122.5'F; and all debris energy is transferred dirsctly to the suppression pool, with no energy lost to surrounding structures. The results of this calculation shows a suppression pool temperature increase of only 22.2*F. This increase does not raine the temperature of the suppression pool to saturation temperature and,.therefore, is not expected to produce any corresponding containment pressurization effects. DCH is not regarded as a significant containment integrity challenge for the CPS plant, based on the results of the above bounding calculations which show that for core melt and vessel failure, this phenomenon vill not lead to suppression pool saturation. 4.4.7 Holton Core-Concrete Interaction Molten core debris ejected from a failed reactor vessel would come into contact with the containment floor and may eventually erode a large enough volume of concrete that either (1) the reactor pedestal walls would lose their load-carrying capability; (2) the basem.t would be penetrated and core debris would exit the containment; or (3) sufficient non-condensible gases would be 4-43
CPS IllDIVIDUAL PLAllT EXAMIliATIOli CONTAIliMENT FAILURE generated to fail the containment on overpressure. The effect of j non-condensible gas build up la implicitly included in the prennuro calculations in MAAP and is not discussed further here. Extensive eroulon of concrete by high temperature core debris is a potential late containment failure mechanism that would be expected to occur many hours after reactor vessel failure and debria release into the containment. Two failure mechanisms are discuused as a result of concrete cronion, one is penetration of the containment basemat and the other is sufficient deterioration of the load-carrying capability of the pedestal walls that the reactor vessel moven and causen gross mechanical failures of penetrationn for piping connected to the reactor vessel. Both of thene containment failure mechaninma would be expected to result [ in lacge containment failure areas. In a BWR Mark III plant, the concrete surface that experiences the most sev',ce thermal attack in the pedestal floor. The heat transfer between the core debris and concrete drives the thermal decomposition and crosion of the concrete. The thermal attack on the concrete can be broken up into three dit'ferent phaces:
- 1. a short-term, localized attack as debris leaves the reactor '
pressure vessel;
- 2. an aggressive attack by high-temperature debrio immediately after the core material leaves the reactor; and
- 3. a long-term attack in which the debris temperature would remain essentially conntant and the rate of attack is ,
determined by the internal heat generation. Of the three dif ferent phases of thermal attack, the long torn behavior in the procens which ultimately results in threatening containment integrity. 4-44
CPS INDIVIDUAL PLAT 4T EXAMINATION CONTAINMENT FAILURE 4.4.7.1. Localized Attack Immediately after vessel failure, debris is discharged from the vessel into the pedestal region. This molten material induces an aggressive localized jet attack upon the concrete surface. The thermal attack is confined to the area where the jet impinges. Estimates of this attack based on analyses show the eroded depth to be perhaps 10 to 20 contimeters, depending upon the primary system conditions at vessel failure. This phase is the least damaging of the three phases, and no failures result during this phase. 4.4.7.2 hjLt_aSK_)2fj[igh-Temperature Dekgin After the jet attack, the reactor cavity or pedestal region may be ccvered by high-temperature debris which aggresuively attacks the concrete substrate. Free water, bound weber, and other gases generated by concrete decomposition are then released. The gases agitate the melted material and promote convective heat transfer between the debris and the concrete. The aggressive attack generally absorbs more energy than is generated by the decay power. Additional internal heat generation in the melt can result from the oxidation of metallic constituents by the gases released from the concrete substrate. Typically, the high-temperature, aggressive attack is driven by the internal heat generation from metal oxidation and to a lesser extent by the in'tial stored energy of the debris. This phase of concrete attack terminates when met oxidation is completed. The calculated depth of concreto erosion in the pedestal area at this time is 1.71 feet and in the floor drain sump, 2.34 feet. 4-45
CPS INDIVIDUAL PINiT EXAMINATION CONTAINMENT FAILURE 4.4.7.3 LQng-T9fmJt3AqX During the long-term attack, the debris remains at an essentially constant temperature, and the rate of attack is determined by the difference between the internal heat generation and the heat _ losses to the containment environment. These heat losses are principally due to convection of high-comperature gases throughout the containment. The resulting concrete attack rate la much reduced from tnit typical of the high-temperature attack phase and occurs over a much longer interval. It is apuumed that all of the corium will deponit in the pedestal cavity and, via 6" interconnecting piping, in the floor drain sump. This assumption yields a melt depth-in the pedestal cavity of 14.6 inches and in the floor drain sump, of 49.6 inches. The depth of molten debris bed in both the pedestal and floor drain nump are greater than the NRC defined coolable depth of 25 cm (approximately 10 inches). Volumetrically, 62% of the corium remains in the pedestal cavity and the remaining 38% is in the floor drain sump (including interconnecting piping). As previously stated, the core-concrete interaction is hypothesized to be able to cause containment failure by weakening the reactor pedestal sufficiently that the reactor vessel and attached piping moves and tears out associated penetrations through the drywell and containment shells, or by penetrating the containment floor through the basemat. , m The likelihood of experiencing the first of these potential failure modes, pedestal wall weakening, is expected to be negligible in i1WR plants equipped with Mark III containments, including CPS, due to the unique pedestal region geometry involved. The floor elevation of the pedestal region is far belos that of the drywell floor; for CPS, the difference is 8.1
. feet. In contrast, the greatest pedestal debris depth is expected to account for less *han 10% of this difference, or less 4-46
CPS INDIVIDUAL PLANT EXAMINATION CONTAINMENT FAILURE than 1.25 feet. It can be inferred from this situation that even assuming that sideward MCCI concrete erosion proceeds horizontally across the entire width of the pedestal wall, 5.67 feet in CPS cane, the pedestal wall vill remain physically attached to the drywell floor across a vertical distance of at least 6 feet around the entire circumference. For a failure to occur, wall loading due to its own deadweight and that of the reaci.or vessel, biological shield, and other miscel'.aneous atcached structures would have to generate shear stresses of sufficient magnitude to fail both the concrete and the imbedded steel reinforcing rods over the entire vertical attachment area between the podeatal wall and the drywell floor concrete. A thorough review of the applicable containment structural drawings, as well as direct observations made during the CPS primary containment walkdown, do not support the assumption that the potential shear loads would approach such levels. Although a detailed and exhaustive structural analysis of this topic has not been performed, the information available fully supports a judgement that MCCI sideward erosion will not significantly jeopardize the pedestal walls' vertical load carrying capability, and thus this particular failure modo need not be considered further. Because of the assumption that the corium goes into the pedestal and flows to the Reactor Floor (RF) sump after vessel failure, the corium is split between the pedestal and the sump. The elevation of the top of the corium is the same in both locations, but the depths of the corium are different because of different concrete clovations. The thickness of the basemat at these points is 10.2 feet under the sump and 13.2 feet under the pedestal. Calculst.ons show containment failure by basemat penetration (assuming non-coolable debris beds) in the pedestal cavity area would occur in 19.P days, and in the floor drain sump area, in 8.1 days. Considering the lesser, 8.1 days, its magnitude 4-47
CPS INDIVIDUAL PLANT EXAMINATION CONTAINMENT FAILURE clearly suggests that the potential for MCCI induced fission product releases from-the primary containment would exist only 4~ long aftor much more rapidly occurring mechanisms, such as contair ac t pressur. aation, have precipitated containment failure. Considering the magnitude of this estimate, combined with the vast amount of concrete erosion that must take place (in both downward and sideward directions) to reach basemat penetration, there is some doubt abaat the validity of the basic assumption that initially non-coolable debris beds will remain uncoolable-until containment breach occurs. As the debris bed grows by incorporating concrete decomposition products, it- trface area-to volume ratio will increase and the deca antration wi21 be diluted. It is therefo o 'mperat e , tne the alternct.O e outcome, specificalif tat ir. .. , non-coolable debris beda r.ould at some later pc- ..: acqu_re a coolable configurat'M5 thus allowing for the potential to terminate MCCI prior to containment breach. An evaluation was performed using CPS specific data to determine if a coolable configuration may be attained at some time following the initial mell and prior to basemat penetration. The i recalts of this evaluation concluded that it is highly likely that a coolable configuration would be attained aftet 3.78 days in the pedestal c?vity area during which time 3.76 feet of basemat erosion had occurred. A coolable configuration for the floor drain sump would occur in 7 days at wnich time 9.35 feet of the 10.2 foot thick bacemat had been eroded. This coolable
- configuration was based on melt spread into sidewards eroded areas, upward heat losses to drywell atmosphere from an increased surface-area, debris deccy power decline over time, and the ability of exposad concrete areas to accept additional decay power over an extended time.
a 1 4-48 i--
l
-CPS-INDIVIDUAL PLANT EXAMINATION COFTATNMENT FAILURE i It was also observed during the MCCI evaluation that aside from the containment failure timing question, the possibility that .
initially non-coolable debris beds could become coolable later can have a bearing on the overall number and location of containment release paths that may arise during severe accident sequences. If tne debris can be cooled prior to basemat penetration as the CPS evaluation cuggests, releases will be limited to gas space paths caused by phenomena other than MCCI. , conversely, should the debris remain non-coolable or if actions are not taken to assure that an adequate flow of cooling water is provided to the debris beds to compensate for boil off,- additiona'. releases to the ground below see basemat could eventually occur. In the CPS caue however, all indications are that such an outcome would be unlikely. For the majority of sequences, sufficient amounts of water wil. , either exist in.the pedestal cavity prior to vesse.1 failure or will enter this cavity (vjth tha debris) through the failed vessel to initially quench the debris. Energy removed from the debris beds in this fashion was not deducted from either the MCCI containment failure timing or termination evaluations. In addition, there are several CPS cooling water supplies, including firewater, that are thoroughly addressed in the plant's Emergency Operating Procedures (EOPej. An extensive time period is ! expected to be available (a m!..imum of 8.1 days) for actions to recover and activate these- facilities, and there is strong evidence that the debris will become coolable well within this time frame (at least 24 hours). The overall situation thus indicates that_tua-likelihood of realizing MCCI-induced basemat-penetration and related fission product releases is sufficiently-remote to eliminate the need for MCCI nodalization in the-CPS
.CETs.
l l l i 4-49 1
l CPS INDIVIDUAL PLANT EXAMINATION CONTAINMENT FAILURE 4.4.8 RyAxogen combustien Hydrogen combustion is one of two events with the potential for raising containment pressure to the failure point. The Hydrogen Ignitors are expected to remain operable during all events wi'h the exception of SBO, thua limiting hydrogen combustior, o Ircalized bcrns instead of global burns and detonation. The probability of failure of the hydrogen ignitors has been modeled by a Fault Tree (section J.2.1.12) Hydrogen ignition early in an SBO (within about the first 4 hours) will not result in containment failure because of the limited time for hydrogen generation. Hydrogen ignition later in an GBO or in other sequences with failed ignitors could result in failure of the containment. When this would occur is a function of the containment ambient pressure and the hydrogen concentration just before hydrogen ignition. Emergency Operatione Procedure EOP-7 directs operations personnel to de-energize tor not er.=r,ize) Hydrogen Ignitors if the hydrogen concentration is unknown or if the hydrogen concentration exceeds the deflagration limits for a given containment pressure. This analysis agrees with the HCOG position on hydrogen detonation at BWR Mark III containments. A node for hydrogen control has been included in the Containment Event Trees. 4.4.9 Containment Overpressurizalign Explicit consideration was given to the pntcatial for containment pressurization from various sources depending on the characteristics of the accident sequence in question. Pressurization challenges to the containment include the following: 1 50 l l
~_- - .. , - - . - -- .- ..--- --. -, . _
CPS-INDIVIDUAL PLANT EXAMINATION CONTAINMENT' FAILURE Vessel blowdown (4.4.2)
'- Steam generation from ATWS (SRVs)
Ex-vessel steam explosion (4.4.3) Hydrogen combustion (4.4.8) Non-Condensible gases produced by molten core-concrete interaction (MCCI) (4.4.7) Steam generation from decay heat only two of these events, hydrogen combustion and steam genere. tion from ATWS, were found to have any likely capability of raising containmant pressure to the failure point within the first 48 hours after event initiation. Failure of containment from hydrogen combustion could oc:ur under certain circumstances as early as 4 hours after event initiation, and failure from steam generation due to ATWS could occur approximately 2. hours after event initiation. Each of the components believed to be controlling the containment ultimate pressure capability were evaluated in order to determine a best estimate failure pressure along'with any uncertainties associated with each location. The CPS USAR overpressuriza* lon j analysis, section 3.8.1.4.8, (which is based on Sargent and Lundy l calculations for containment and Chicago Bridge & Iron assessments of the containment Equipment Hatch and Personnel Airlocks), and the results of Sandia National Laboratory 1/6th scale test of Reinforced Concreto Containments were used as the basis for probable failtre locations and pressures. The results of these evaluations were that the containment would have a 50% probability _of failure at 93.8 psig, with tia most-f_ .likely failure mode being a tear in the liner in the vicinity of a containment penetration.- The containment shell (rebar) is estimated to begin yielding at 95 poig at-the hoop reinforcem..nt l ut mid-height of containment, and be expected to fail (break) at l l
=4-51 . . _ _ . , , - - - - _ . . ~ _ . - - _ . _ . . , . ~ - . . . . -_ . .
CPS INDIVIDUAL PLANT EXAMINATION CONTAIMMENT FAILURE a significantly higher pressure. The containment equipment hatch and personnel airlocks were both estimated to have capabilities beyond that of the containment liner. Because of the large uncertainties associated with the foregoing estimates it is difficult to predict a specific failure location and failure pressure. Therefore, the estimated capabilities of the various controlling components along with the uncertainties associated with these estimates were combined using Monte Carlo methods to obtain the cumulative failure probability curve shown in Figure 4.4-1. As stated earlier in this report, the CPS Containment is particulacly robust because of the close spacing of reinforcing steel (i.e, 12 in center-lines). The phenomenological
- considerations are also not as critical because of the larger vo;.ume and lower power than other BWR-6s.
For purposes ei assigning a generalized size to the containment breach,:the following assumptions can be made. Feilures of the containmont shell or equipment hatch can be assumed to be gross failures, i.e., large failure that would rapidly depressurize the containment. Failures of the containment liner can be assumed to e be limited-in size, such that further containment pressurization would be prevented, or a gradual containment depressurization may occur. The equipment hatch and shell failure locations are above the suppression pool and as such would result in a " scrubbed" release. Liner failures are more likely to occur above the l suppression pool surface because the stainless steel liner in the suppression rool is more ductile than the carbon steel of which the rest of the liner is made and the calculated radial containment wall deflections are larger at the mid-height of the containment compared to the suppression pool area. In addition, the number and complexity of mechanical penetrations below the suppression pool surface is less which would tent'. to make liner 4-52
--_ _ _ ~
4 CPS-INDIVIDUAL'PIANT EXAMINATION CONTAINMENT FAZLURE failure less likely in the suppression pool. For these reasons it is assessed that_14% of the likely failures could be below the surface of the suppression pool and the remaining failures above the pool surface. Containment Overpressurization is not included as a node in the Containment Event Trees (CETs). However, during quantification of the CETs, information from the probability distribution function was considered in each sequence to determine the final containment end state. I i l. l l 4-53 l
CPS INDIVIDUAL PLANT EXAMINATION CONTAINMENT FAILURE Table 4.4-1 Drvwell anLfd2GA1Dagpt Penetration Elastomers
-Material Tested Tejn32 Exoected Temn Calculated Life Drvwell Disco SF-150NH 1900*F 700'F 8.14 yrs.
Silicone Rubber 437'F 700*F 17.8 days ContainEnt Disco LOCASEAL 266*F 300*F 503.74-days Viton 600*F 300'F 107.7 yta. Kapton 572*F 300'F 1.1E9 yrs Polysulfane 410*F 300*F 9.0E2 yrs. l-l. l i l I 4-54
~ CPS INDIVIDUAL PUdiT EXAMINATION CONTAINMENT-FAILURE l
l CUMULATIVE PROBABILITY DISTRIBUTION FUNCTION FOR FAH.URE OF THE CPS CONTAINMENT 110.00 % 100.00 % -- . , a a e-a a-a-vm..- m 90.00 % --
- / " ,I 1 80.00 %
- ,e o """o " '" o '
70.00 % _ y t.o 60.00%
/ /
[ M 50.00% _
,/ 7
/
C" /[ d 40.00 % / 30.00 % --
) /
'* 20.00 % / -- 10.00 % 2QY u f
- Y 0.00% 4,*w u-wiss*M4 >*l*9"Ja4wadfEUGMGGGGGHasnessa f 7IIT, 1 70 74 78 82 - 86 90 94 98 102 106 110 114 CONTAINMENT PRESSURE (PSIG)
-m IUTALFAILUREPROBABILIIY + FAILPROB CONTAINMENTSIELL
-* FAILUREPROB CONTLINER -e FAILPROB EQUIPMr.NTHATCH Figure 4.4-1 Cumulative Probability Distribution Function For Failure of the CPS Containment 4-55 ,
CPS INDIVIDUAL PLANT EXAMINATION CGNTAINMENT EVENT TREES l l 4.5 CRJLtAiRRent Ev9D1JI995 l 4.5.1 IntI94MgliSR As discussed in section 4.3.1, the general approac4 'Jsed in the construction of the CETs was to include headings for events and parameters that plant operators could detect or control. Progresalon through the CETa eventual'y reaches a plant damage state (PDS) (CET end state). Each plant damage state la represented by a four letter code which identifica RPV and containment status as well as aequence timing. The plant damage state codon were presented earlier in Table 4.3-3. For sequences in which containment failure occurs, the release modo is also determined for use in the calculation of the radionuclide release source term. A metrix claanifying possible release modes was presented earlier in Table 4.3-4. The athod for catngorizing source terms was presented in section 4. As discussed in acction 4.3.2, PC SETS was used to evaluate the branch and sequence frequencies of the Containment E/ent Trees. Systems auch ao containment venting and hydrogen ignition that were not included in the level 1 PRA were modeled and analyzed for their effect on containment performance. The Modular Accident Analysis Program (MAAP) code was used to determine CET sequence timing as well as plant damage states, release todea and radionuclide release source terms for -the sequences that survived frequency truncation. CETa have been prepared to address each level 1 PRA accident [ class. The event tree headings, assumptions, plant damage states, and release modes are described in the following paragraphs. 4-56
~
l CPS INDIVIDUAL PLANT EXAMENATION CONTAINMENT EVENT TREES 4.5.2 CET Hegdings This section discusses the headings used in the CETs. The headings describe actions or events which plant operators could detect or control and that have a direct effect on containment performance. CONTAINMENT ISOLATION - Applicable to CCT IA, IB, ID, IIIB, and IIIC. This branch addresses the closure of all required containment isolation valves. If all valves in a given penetration fail to close, the containment is assumod breached. Actuation of either one of the series valves (inboard oc outboard) for all penetrations is required for success in this heading. For CET IB (SBO), when motive power is not available, only one valve, 1FC008 - Outboard isolation valve on the line j from the upper pool skimmers to the Fuel Pool Cooling ar.d Cleanup (FC) surge tank, was cause for concern because it is not part of a closed-loop system and it is normally open. CPS ECPs direct verifying all isolations and manually closing any valves that l have not closed. REACTOR DEPRESSURIZATION - Applicable to CET IA, IB, IIIB, and l IV. This branch addresses reactor depressurization prior to the I core slumping to the bottom head. Even though core melt has begun, recovery of ads and operation of low pressure injection systems could terminate core melt within the vessel in a manner similar to the way the core melt sequence at Three Mile Island occurred. Failing arrest of damage in-vessel, depressurization l would limit the containment pressure spike should vessel failure l occur. l INJECTION PRIOR TO VESSEL FAILURE - Application to CET IA, IB, ID, IIIB, IIIC, and IV. This branch addresses injection into the j reactor vessel prior to vessel failure. Repair / recovery of L injaction systems could allow termination of core melt within the l 4-57 i
. - .. ~ - . _ _ . . - - - - --. .. - . . _ . . . .
l CPS INDIVIDUAL PLANT EXAMINATION CONTAINMENT EVENT TREES vessel or provido onough cooling to provent containment failure. Systema considered in this branch for all CETs are HPCS, FW, LPCS, T.PCI, CD, CD and CRD. Success for this heading is injection with.n 72 minu',os from event initiation. LATE INJECTION - Applicable to CET IA, ID, IIIB, IIIC. This branch addressos delafed injection into the reactor vessel. Injection is delayed for oither repair or recovery of systems that would normally to available, or due to delay in lining up a system for injection. Injection via the vessel onto core debrie below the vessel could provide enough cooling to provent containment failure. Based on MAAP runs, a delay of 4 hours was used before injection begins. Systems considered in this branch are HPCS, FW, LPCS, LPCI, CD, CB, FP and CRD. CONTAINMENT SPRI.Y IN EVENT OF POOL BYPASS - Applicable to CET IA, IB, ID, IIIB, IIIC and IV. This branch addressos initiation of the containment spray modo of RHR. The use of containment sprays can have a strong effect on any subsequent reloano due to radionuclido scrubbing in the containment airspace. HYDROGEN GAS CONTHOL - Applicable to CET IA, ID, IIIB and IIIC. Tnis branch addresses the availability of hydroger. ignitt c 3, and is included because hydrogen control has a strong offect on
- containment performance and any subsequent relcano source term.
For CET IB (SBO), success for this heading in disabling the ignitors prior to recovery of AC power, and not energizing ignitors if hydrogon concentrations are too high, or aro unknown. l 4-58 L_O i
CPS INDIVIDUAL PLANT EXAMINATION CONTAINMENT EVENT TREES CONTAINMENT VENTING - Applicable to CET IA, IB, ID, IIIB, and IIIC. This branch addresses the availability of containment venting capability. Selectively vet. ting the containment, rather than allowing the containment to fail, has a gror.t impact on the
.radionuclide release mode.
CONTAINMENT FAILS ABOVE SUPPRESSION POOL - Applicable to CET IA, I IB, ID, IIIB, IIIC and IV. This branch addresses the potential for the containment to fail above, rather than below, the surface of the cuppressi n pool. Failure of containment with concurr9nt f loss of the suppression pcol greatly affects the radionuclide release source term and containment heat removal capability. LONG TERM HEAT REMOVAL - Applicable to CET IA, IB, ID, IIIB, IIIC and IV. This branch primarily addresces the availability of the suppression pool cooling mode of RHR for sustained operation
-follcwing an accident. Other methods of heat removal, such as containment flooding, fuel pool cooling, feed and bleed, etc.
within 48 hours of event initiation, also contribute to success , in this heading. l AC POWER RECOVERY TO PREVENT VESSEL FAILURE - Applicable to CET ID (SBO) only. This branch addresses the recovery of AC power in time to prevent vessel failure. Success in 'his heading is recovery ot AC power within 40 minutes fror . vent initiation. l Several additional MAAP runs confirm the s inutes is a conservative interval. i l l 4-59
l l CPS INDIVIDUAL PLANT EXAMINATION CONTAINMENT } VENT TREES LATE POWER RECOVERY ANO INJECTION - Applicable to CET IB (SDO) s only. This branch addressos AC power recovery and injection into the reactor vessel-in time to avoid containment failuro. Injection in delayed for either repair and recovery of sy tems that would normally be available, ce due to delays in lining up a restem for injection. Injection via the vessel onto coro debris belcw the vessel could provido onough cooling to provent containment failure. Based on MAAP runs, a delay of 4 hours was uded before injectivn begins. SyJtems considered in this branch are HPCS, FW, LPCS, LPCI, CD, CB, FP, end CRD. _ SUPPRESSION POOL COOLING - Applicable to CET IV (ATWS) only - This branch addresses the immediato availability of the suppr*=ssion pool cooling modo of RUR. 4.5.3 92Rtainm9nt EvenLTI9_91 l The containment event trocs for all accident classes are shosn on L'igures 4. 5-1 through 4. 5-6. Note that there is no CET for accident class V because all of those sequences truncated out during the level 1 analysis. 4.5.4 Aq1gmpj;1pJ13 - 31gnificant assumptions used in the CETs woro previously identified in section 4.2.2. - 4.5.5 Plant _Da#Ago_DhqjeAg Potential damago states for the various CET sequences are shown on Tabic 4.3-3. The actual end states for the significant sequences are included on the CETs. 6 4-60
CPS INDIVIDUAL PLANT EXAMINATION CONTAYNMENT EVENT "T(EES 4.5.6 Release Modes The release mode is used to. describe the type of release for use in calculating the radionuclide source term. Table 4.3-4 contains the matrix of potential release nodes. Sequence release modes are included on the CETs. 4.5.7 Sourow Termg The source term release category is based on the amount of core material released outside the containment. Table 4.3-5 describes the source term release categories. Source term release categories are included on the CETs. t 4-61
CPS INDIVIDUAL PLANT EXAMINATION CONTAINMENT EVE?fT TREES Class IA CET l CLASS fa - Comf aiseaf w 84Act0e IMJECTID4 LaYf C T $ DEL A
- NFDAcGise COuta!MMEN CT Farts LD 4 TEG= PDS $f DutK E SEG PtJS aEL is0DE SAC vgn=
I C( 19 pt- T Cf PRE Shel ' PA f W 70 !M.ECf!DM != fvtmf Gas T vtw risti as0wf ataf C(508:Pf!> . M ITOLafiDN ZafION SE CF COntstOL SLFP PODL af Eval M E F E Cs O B a masa gaos 3.93 9 10 'NH
!a07 43 CE-9 ?
!a33 <f.0E-9 laJa <t.0E-9 l
RMaa last 2 E9t-6 10 N8i lat$ <s.CE-9
!ast <t CE-9 mus Ia10 a.72f-6 a0 WE 1831 <s,0E-9 la32 <s.ct-9 'i
!aal 4 0 . 08. a 9
!aSD 43 ct-w taSt <s.CE-9 IaS2 =t.CE-9
. 1&S3 <l.st-9 1
I tase 43.ct-9 g 18S8 <f.0E-9
!a57 <a.CC-9 Issa 49 CE-9 ii SS IA CET - This CET begins with the containment builoing intact at the time core melt L; gins. vi , reactor vessel is at high pressure. The : ore melt at high pressure sequences from all : 0.1-14CA non-ATWS transient initiators in the level 1 PRA were combined' to , establish the input frequency for this.CET.
Figure 4.5-1 4 1 4-62
CPS INDIVIDUAL PLANT EXAMINATION
~
CONTAIhW:,PT' EVENT TREFS-Class IB CET i C17 9 9E - ELP af Y D F 45uR2 Y *En f a i WENT F
- Ms? 104 Eni 'MJ 2 5* *" o" 2*"*
"!P/!";J ;M, t c* ** s , % " * * '
11 1 % .
! N G i F E Cs l D 9 4 f 93NE TL$1 7,$${-6 a$ MR l
TLC 2 <t CE-9 TLQ3 <f.C4-9 TLO4 <t of-9 TLCS <t Of-9 g TLC 6 41 02-9 YLO? <t CE-9
'LCS <t CE-9 TLCD <t CE-9 *
, g wux8 TLtd 1 27E-6 43 he TL*S <t 0E-9 Mens YLt6 1.5;i-7 a0 na TL17 <t ef-9 ,
TLs9 <t 9E-9 -
**w S I ?L5t 4 10E-7 05 II g
el TL52 J.74E-9 C5 It! !
~
i of TL53 1 SEE-9 C6 111 i 6CIE TLS4 ? 03E*7 at til l ' i CLASS-IB CET - This CET begins with the contairment' building intact'at the time core melt begins. A station blackout condition exists. The core melt sequences from the level 1 PRA that include the loss of off-site power and failure of the Division I and II diesels , are combined to determine the. input frequency for this CET Figure.4.5-2 4-63 s -
CPS INDIVIDUAL PIS.NT EXAMINATION CONTAINMENT EVENT TREES
.t r
1 Class ID CCT CLA3S 10 CONTaI M N I%ECT!Om La E l CT Spaav *vDA0 GEN CON' a ! ***E m C*m T 'LO% TER= ;DCT SE 3A%CE SEG.0c06 IREL *OCE SAC'7 Ease l CET 15. 7E - ! SAIDA 10 ImJE C f!ON I IM E v*ht GAS T vf **I% FAILS
- EAT OESCAIDTION 61 ISOLA!!OM VESSEL { CF POOL CG%iRCL A90VE AEw0 vat FAILIAt j 9tPs55 SLPS POOL I
- F I C1 l 0 l B A
, } E k i
'ca** IOc t '
3 C9E-6 I40 Na 3002 < ! OE- 9 '- 2003 <1.CC-9 I0ta <s CE-9 2015 <1.0E-9 4 20$$ <1.0E-9 4 L.e r r 'D41 2 93E-9 A0 8A
<t.0E-9 i k. 0 i s M 'IO43 <t.0E-9 Lust 2347 1 73E-6 ' A0 hrA 1049 < ! C{-9 -
f ---- Laux 2049 9.75E-e a0 %e j ID50 <t.OE-9 1051 <s.CE-9 . i t CLASS ID CET - This CET begins with the conthinment building intact at the time core melt begins. The reactor vessel is at low pressure. Th verious core melt at low pressure ] ' sequences from all non-LOCA non-ATWS transient initiators in the level 1 PRA were combined to establish the input frequency for this CET. Figure 4.5-3 i 4-64
l i
. CPS INDIVIDUAL PLANT EXAMINATION CONTADDEh"r EVENT TREES Class. IIB CET' 1
' CLast CL%fY ataa:Em l Cf paE55 INACT!DM AEACTOR ant L af t CT EM a w kvt806E m I CONYa! =*eEm
!!!b Crf t s M-os 153LaTICm '
4 parce ic ImxCTID= Iw Eufwi sas +t et wrIse e
*w?
a:1.s L:>uG M an
*4 a t 8C5 ST3UE=CE It sCRioT ICpt i
art va sg tgu j , 2ailD4 lSE3PCCS WE SSE L DF DOOL a n =t Fa!LOAE CO*s f AOL AE <
- k SY8ast . SUP* POOL s i l w S F Ct E l D l 9 a .
I
- a. 1 (B0 3 I 41 DE-C { f
! LB02 14 DE-9 '
1 I L903 <a CE-9 f f L915 < t CE-9 6 kuss ' LEM 3 4$1-9 aC %c f ; L f4 ? < t . 0E -9 , t R?9 4 3 CE -9 l I
- mur Le3s 3 cst-e 40 m f i .
LfM '<s DE-9 L933 41 LE-9 , L934 ~
<t CE -9 1
LE50 ; cf OE-9 ' I , i l' CLASS IIIB CET - This CET begins with the srall to nedium sized LOCA that does not .. depressurize the reactor vessel. The various level I PRA core nelt sequences involving 'l LOCAs that do not depressurize the 'Jassel were combined to detercline the input frequency for this CET. Figure 4.5-4 4-65 .i 4 I
. - - -- - = - .
CPS INDIVIDUAL PLANT EXAMINATION COMTAINMENT ETTENT TPPER t Class IIIC CET CLAS5 CCNTAIN*(N INJEC7!DM LATE Cf SFaar H v'JA%EM CC*T aIwE N Cw=T E LONG ?E M 005 S!OvETE lEEQP309 . ef.L wX:E ' 5< TE% l I PAIDA TO IN E vtM7 DESCA!rT ION IIIC CET T INJECT!DM Ga5 f VEN11% ; AILS HEAT 11.1 E - 67 ISOLATION VE SSEL OF POOL CONTACL .SCsE AE **01 AL FA!LUPE evPASS sis
- POct ,
H F E C1 j 0 s a { Lxmx LCof 9 OCE-7 A3 No LOO 2 <t CE-9 , LC01 <1.CE-9 LC14 <! CE-9 f LC15 <t 0E-9 l LCis 41.CE-G {LC3? <t CE-9 LYst LCa? 2 CBE-8 a -
=A LC43 ,
<1.0E-9 LCda <1 OE-9 i .
LCa6 <1.0E-9 l f. j i LCSC <1 M -9 l - l CLASS IIIC CET This CET begins.with the.redlun to large sized LOCA which depressurizes , the reactor vessel or a.cmall. LOCA with suc'.lessful depressurization. The various level.1 PRA core melt sequences involving LOCAs that depressurize the reactor vessel were combined. -[ t to' determine the input-frequency'for this CET. ! l rigure 4.5-5 t 1 b 4 CPS INDIVIDUAL PIANT EXAMINATION CONTAINMENT EVENT TREES Class IV CET CL 7:SS IV CNui A't ACT0 A INJECTION CT SPAAY EVENT FAILS StFPAESSIO l LONG TEAM PCS SEGUENCE SEG. PROB AEL w00E SA; TEAM DEPAESSUAI PAICA TO IN FVENT N POCL L HEAT DESCAIPTION ( AT wS) ABOVE ZATION VESSEL OF POOL (1,4E-71 CCOLING AEuCVAL SUPP POOL FAILUAE BYPASS FtILUAE A G F , C1 C l _ ACAE AT01 1.20-7 CS II AT02 <1.0E-9 ' l AT03 <1.0E-9 AT04 <!.0E-9 ATOS <1.0E-9 AGAE ATIS 1.02E-9 C6 I'I AT40 <1.CE-9 AT50 <!.0E-9 l CLASS IV CET - This CET begins with an ATWS. The ccitainment is assuraed failed from overpressure prior to core damage or vessel failure. The various ATWS sequences from all initiators were combined to determine the input frequency for this CET. Figure 4.5-6 4-67
- _ - = -
CPS IllDIVIDUAL PLAffT ZXAMINATION COllTAlliMEllT quANTIFICATIOil 4.6 A qsid en.t _ PI99 E9 a p ion _A t14_CliT_W an ti fi s n t19n Thin noction providen a brief doncription of the accident progrennion for t.ny nequencen in each CET that nurvived truncation at IF-9/ reactor year. Thin nection also dincunnen npocific containment nequence recovery actiona nince nubstantial time in available following core damage in which operatorn may roupc'id and prevent or mitigate containment failure. Thin noction discunnen the evaluations of nignificant CET _ nequencen, the onen that survived truncation. The frequencien of all nuch nequenceu as well au their renpoetive Plant Damago State (PDS), Heleane Moden (RM) and Source Termn (ST) are shown on the CETn ( t'lguren 4. 5-1 through 4. 5-6 of noction 4. 5) . 4.6.1 Aggi49nt_FIgggggg19n CET IA. liigh Prennure tranulent, non-IhCA, non-ATWS. None of the three algnificant nequencen in thin CET renult in a relcane from containment. In two of thene acquencen (IAOl, IA15), recovery in probable in-vennel. The third ouquence (IA30) in a vennel breach at high prennure (>200 pai) but the releano in - retained -n the containment. Containment prennure renulting frcm thin event reachen approximately 25 pula and in well below the containment failure prennure. Figuren 4.6-1, 4.6-2 and 4.6-3 nhow containment prennure, containment, and drywell temperaturen and containment hydrogen mann rrenent for a typical sequence on thin event tree (IA54). CET Id. Station Blackout (SDO). Four of the novon significant nequencen in this CET renult in a releane from containment (TLS1, 52, 53, 54). The first node for each of these nequencen annumen failure to rentore AC Power in time to prevent liPV breach. One of thene nequencen (TLS4 ) i r. a containment inolation failure renulting in a category III 4-68
CPS INDIVIDUAL PLANT EXAMINATION CONTAINMENT QUANTIFICATION release. The second sequence (TL51) is a delayed containment venting release (manually initiated) which bypasses the suppression. pool in order to prevent failure of the containment by overpressurization. This sequence results in a category II release. The remaining two sequences consider power recovery at 24 hours with an essentially simultaneous hydrogen burn that fails the containment by overpressurization. These sequences result in a Category III release. The only difference in these two sequences is failure above or below the surface of the suppression pool. Figures 4.6-4, 4.6-5, and 4.6-6, show the containment pressure, temperature, hydrogen mass present and drywell temperature for a typical sequence on this event trae , (TL51). Procedures CPS 4200.01, " Loss of AC Power", and CPS 4411.06, " Emergency Containment Venting, Pu'rging and Vac"um Relief", address-operator actions to manually actuate valves during 3B0 events. CET ID. Low Pressure Transient, non-LOCA, non-ATWS. None of the four significant sequences in this CET result in a release from containment. In two of those sequences, (ID47 and ID49) containment venting is available if required, but is assumed unused since containment pressure only reaches 32.7. psia. In this CET, all of the sequences for which senting is unsuccessful truncated out. Various procedures address arresting core damage in-vessel. Assuming failure to arrest damage in-ressel, none of these sequences provide conditions sufficient to challenge the containment integrity. Figures 4.6-7, 4.6-8,.and 4.6-9 show the containment pressure, temperature and hydrogen-as well as drywell temperature for a typical sequence on this event
- tree (ID47).
I 4-69
_. _ . _ _ _ _._ _ _ . _ _ . - _ _ _ . ___. . _ __ _ __m._. .___ _ CPS INDIVIDUAL PLANT EXAMINATION CONTAINMENT QUANTIFICATION CET IIIB. LOCA, RPV at high pressure (>200 psi). This.CET assumes a small to medium bized LOCA that does not~ depressurize the RPV along'with failure to depressurize. Neithei-of the two significant sequences in this CET result in a' release , from containment. Failure of containment to isolate at the first node on this CET truncated out. EOP-1, "RPV Control";-EOP-2,- i "RPV Flooding"; EOP-3, " Emergency RPV Depressurization", and EOP-7, " Hydrogen Control" address actions to recover from this event. Figures 4.6-10, 4.6-11, and 4.6-12 show the containment pressure, tt.7erature and hydrogen, and drywell temperature for a typical sequence on this Event Tree (LB31). CET IIIC. Medium to large LOCA, RPV at Low Pressure (<200 psi).. In this event, the LOCA is of sufficient si'ze, or operator action . is successful to depressurize the RPV. Only two of the identified sequences survived the truncation criteria, and neither of these. result in a containment failure or release to the environmert. As in CET IIIB, Containment Failure to Isolate at the first node truncated out. The same procedures identified for CET IIIB are also applicable for 'ch.e various sequences in this CET. Figures 4.6-13 through 4.6-15 show containment pressure, containment and drywell temperatures and containment hydrogen nass for a representative sequence (Lc42). CET IV. ATWS In this event, the containment is assumod to fail from overpressure prior to core-damage or vessel breach. Only-two of-the identified sequences (ATol, AT15) are significant and result in releases from containment. Both failures are classified as large-containment-failures caused by overpressurization from SRV discharge to suppression pool. In'one ofLthese sequences (AT15) the containment is assumed to fail below the surface of the suppression pool, allowing a category III release. -The other significant sequence is a containment failure above the level of 4-70
CPS INDIVIDUAL PLANT EXAMINATION CONTAINMENT QUANTIFICATION l the suppression pool, resulting in a category II release. CPS proc.3 dure s , CPS 4009.01, " Inadvertent Opening Safety / Relief Valve"; CPS 4411.06, " Emergency Containment Venting, Purging and Vacuum Relief"; CFS 4411-08, " Alternate Rod Insertion"; CPS . 4411.10, "EOP Standby Liquid Control Operation"; EOP-1A, "ATWS RPV Control"; and EOP-3, " Emergency Depressurization", address actions to recover from these events. These procedures direct activns to prevent containment failure from overprcssurization prior to reaching 45 psig. This value is well below the predicted containment failure pressure of 93.8 psig. Figures - 4.6-16 and 4.6-17 show the containment pressure and temperature as well as the drywell temperature for a typical sequence (ATol). Refer to section 4.2.1 for Plant Models used to support the Containment Event Trees. 4.6.2 JLg_qiAent Dem o_pce Regovery Actions, Post-Core Dam _ age Many of the systems used for mitigating an accident after core damage are the same ones that would have been used for preventing core damage. In the case that core damage has occurred, these systems must have 1.' led. However, in evaluating the sequences - for the containment Event Trees, additional time is available for recovery of these f ailed systems af ter core damage, but before vessel failure or in time to prevent containment failure. Recovery events may be applied to basic events which are recoverable o er time in order to reflect the improvea probability of success for these systems. Recovery by human intervention is addressed in the applicable Emergency Operating Procedure (Note: human error probabilities were developed to account for operatoi error in recoveries). CPS has fully implemented the recommendations of revision 4 of the BWROG Emergency Procedure Guidelines (EPG's) in it's EOPs. The procedures have been fully verified and validated, and extensive i 4-71
CPS INDIVIDUAL PLANT EXAM 1HATION CONTAINMEllT QUANTIFICATION trnining of appropriato pornonnel (including simulator training) han boon conducted. Thono procedural changen are incorporated into lennon plano for parlodic training. 4.6.2.1 E9xe r_Re co_Ye r199_t 9_Pr o ys nt_ Rout 9I__Yna n L hilur e E9119Einq_C9I9_ Damn 9e Timo-phaned recovorien woro (..nployed for AC electrical power recovory in the lovel 1 part of th IPE (nuction 3.3.3.3). This
~
resulted in different recoverien being applied to different acquencen and cut acts in the ntatira blackout acqueneca in the level 1 analyala. Different additional conditional recoverien woro applied to the containment Event Treo analynic in order to be accurato and maintain connintoney. Hocovery probabilition are banod on historical valuou from NUREG-1032, " Evaluation of Station Blackout Accidenta at Nuclear Power Plantu ... Final Hoport". The derivation of recovery failuro probabilition in dono in canon for which ) off-cito power in not rs ,vored within four houra,
- 2) battory load uhodding la not nucco suful and of f-sito power in not' recovered within I hour, and 3) High prennuro Coro Spray (HPCS) and Reactor Core Isolation Cooling (RCIC) both fail and off-nito power in not recovered within one-half hour. Both non-time-phaned and time-phaned recoveries woro employed, au van donc for the level 1 analysin.
The timo available to recover AC power in order to recover injection syntoma in timo to prevent reactor vensol failure following coro damage for high pronouro uoquencea in estimated at 4 - 7 .'
r 4 _; l' ,, i~ .-- q 4 x a,
'g.
IMAGE EVAL.U ATION
/ f &,
\ ~ TEST TARGET (MT-3) ,
}
. \ ,s' x1 ,/[/ cw' xgp a+ko ss s l.0 n
i20 l,l . . _ = m ta e c_2 1.2 5 l =a !!! 1.4 11
.i! !!!m I"br.6 a:
+ --
150mm - - - - - - - - - - - - l
+- . _ _ .
g -
. -- -.-w e %y 4y5 x f(k e 7 .g +3 Q
i c ..
-1 \
4 ; O y 1
+
s
- Igg e. Ng .
k' %-
A,p
+ 1 s s IMAGE EVALUATION
'o<
[g ' TEST TARGET (MT-3)
/
p No
, / v
, \.%(. s f?;
- . 4li
s
' s. %afc
'%p
' ~"
I.0
- 2 't
> . 2.0 i is
, i2 r - mm 150mm - - - - - - - -
4-c _ -- - - - .l I
<a Pyv
? \
ff>
+p, Y
e 3 74 Lg ;' 4
, ~
.y lcy !
Op
+
s
,y P' 5' + yb '
s
r /
; c;v /,'/ 4 l
<F .
~
S I
^g IMAGE EVALU ATION
/
[gf TEST TARGET (MT-3) s s\ s .
'd,C N '
h s \ /l@, 9l Q9' q IQ
- ua,a g(e
" ~ "
1.0 + ,, 4 1 20
; l.8 e=
l e t.6 {d .25!!!! l.4 m!r=s hwir i
+ isomm - - - - -- -W I --6' - ------ ---- - --- - -- *-
+ -
oy 4 ig ,s
*D; 4R%
s O 7 p' , N
*[.
Q,
,r u,
~
CPS INDIVIDUAL PLANT EXAMINATION CONTAINMENT QUANTIFICP. TION two hours. This was derived using MAAP, t;hich shows that vessel failure occurs approximately 2.6 hours after the start of a station blackout. Given that two hours 1 are available to recover off-site power to
-prevent reactor-vessel failrre ortte core damage han occurred, conditional probabilities were developed to extend the level 1 casen.-
The time-phased reco/eries of off-site power for the containmant analysis follow the same pattern as they aid for the level 1 sequences, keeping in mind that the recoveries at the later time are conditional on failure of recovery at the earlier times. Again, the recoveries must be sequence-dependent. The power recovery factors for combinations of loss of off site power and specific additional events are shown in Tables 4.6-1 and 4.6-2. 4.6.2.2 Power' Recoveries to Prevent Containment Failure for Containment Event Trees in Which Containment Isolstion is successful or for Late Iniection for Debris Cooline or Scrubbina on the Non-Isolated Cases Power recovery at approximately 4 hours in a sequence is based on the time at which restoration would not result in containment failure from a global hydrogen burn. Restoring power beyond the 4 hour time frame could cause a hydrogen burn of sufficient magnitude to initiate a pressure spike which could fail containment. A :anditional recovery failure probability of .469 was applied to .hs recovery at 4 hours. 1- Some time is allotted to align systems once power is restored. 4-73 f
CPS INDIVIDUAL PLANT EXAMINATION CONTAINMENT QUANTIFICATION 4.6.2.3 Recovery for Failure to Recover Injection Systems Before and After Reactor vessel Failure Followinc Core Damace1 All of the sequences leading to core damage resulted from railure of injection systems or depressurization and failure to recover them in time to prevent core damage. If injection systems are recovered even after core damage, reactor vessel failure can be averted if injection is restored within two hours for high pressure sequences. However, if the reactor is depressurized, only about 16 minutes are available between core damage and vessel failure, based on MAAP analysis. Even if injection systems are not recovered before vessel failure, containment failure can still be averted in most cases if injection is restored within thirteen hours (4 hours for SBO as indicated above). Because of these various times and effects, separate recovery factors are required far the cases in which core damage occurred at high or low pressure and for recovery after vessel failure. In addition, if the recovery of depressurization fails & the Containment Event Trees, low pressure systems are not available at all before vessel failure. However, all systems are potentially available after vessel failure. 4.6.2.4 Failure to Initiate Containment Spray Since containment spray is manually initiated, an HEP for this event was obtained by the HRA screening method described in section 3.3.3.1.4. A conditional recovery probability of .3 was applied for containment sprays. 4-74 (_ _
-CPS INDIVIDUAL PLANT EXAMINATION CONTAINMENT QURNTIFICATION 4.6.2.5 Failure to Isolate Containment in Case of Station Blackogt (BBO) A review of the containment penetrations which would be expected to be open during normal operation and would not close on loss of power identified only one line which could lead to containment bypass (section 4.1.2.1) The HEP for manually closing 1FC008 was determined by the methods described in section 3.3.3.1.4. The task is a manual alignment of a system, directed in procedure CPS 4200.01, performed in the Fuel Building, relatively simple, and at least one-half hour is available for the action, yielding a HEP of .4. Estimates of radiation levels in this location, while high, would not preclude aCCOsr. 4.6.2.6 Z,ailure to Recover Lona-Term Containment Heat Removal in~48-Hours Because no data is available for 48 hour recovery of power or failed equipment, a value for recovery at this point was estimated. By that time, all the resources of the Emergency Response Organization, not only CPS resources, but also state, local, and national agencies, as well as the Institute of Nuclear Power Operations (ld PO) , General Electric (GE), etc. would be available. Additionally, time would be available to ship any necessary equipment to the site. A failure to recover at this point was estimated to be lE-3. 4.6.2.7 EalJure to Open ADS Backup Air Bottles Isolation valve on Loss of Power The ADS /LLS motor-operated backup air supply isolation valves are opened from the Main Control Room if normal Instrument Air supply to the SRV's is lost. During Station Blackout, ,Jower is not available to open the MOV's, and operators must open the valves 4-75
CPS INDIVIDUAL PLANT EXAMINATION CONTAINMENT QUANTIFICATION manually before the rir accumulators are depleted. The HEP for this-action is 0.12. 4.6.2.8 Zgilure to Vent Containment Venting of containment is one of the methods to control containment pressure. Three separate vent paths were modeled. The HEP for venting of containment is .25. This action is included in the appropriate procedures, but is not s:quenced, leaving the timing to the judgement of the individual. 4.6.3 CET Ouantificatio13 4.6.3.1 8vstem Burvivability At CPS, the majority of equipment necessary for accident control is located outside the containment boundary, and will not be exposed to the extreme environmental conditions that are expected during a severe accident. The exceptions are identified in section 4.1.2. Plots generated from MAAP runs which describe important environmental parameters for various accident sequences are included as Figures 4.6-1 through 4.6-17. A brief discussion of the availability / survivability of each of these systems follows. Inboard Isolation valves - These valves and valve actuators are qualified for accidents under the provisions of 10CFR50.49. However, all of these valves are either in the required position to perform.the required safety function or move to the required position early in an event (except-during an SBO), and are expected to successfully complete their required safety function before any potential , degradation occurs. The valve actuators are qualified in
~
CPS EQ Binder EQ-CLO27 for 340*F, 100% Relative Humidity and l 2 x 10 8 RADS. l 4-76
CPS-INDIVIDUAL PLANT' EXAM 2 NATION CONTAINMENT QUANTIF2 CATION-l ADS Safetv/ Relief Valves - System / containment conditions-up to.the point at whj;h SRV's are no longer required (vessel failure) are below t5a accident conditions for which the SRV's have been qualified. Combustible Gas Control and Associated Components - The Drywell and Containment Mixing Compressors were not modeled because of limited capacity and are not discussed in this section.' However, the Vacuum Breakers must be addressed because they provide a path directly bypassing the Suppression Pool. The Vacuum Breaker elastomer seals are qualified in EQ Binder MEQ-CLO96 to 500*F for 65 hours. Under the severe conditions in the drywell, the inboard (drywell side) Vacuum Breaker seal is expected to fail early and the outboard (containment side) at some time later. Degradation of the inboard vacuum breaker seals is caused by direct contact with the drywell atmosphere. Initially, heat transfer to the outboard seal material would be exclusively by conduction through the-meta).lic parts of the vacuum breaker penetration. Even after failure of the inboard seal, convective heat transfer to the outbcard seal is expected to be small resulting in a significantly longer life for this seal. Seal failure and suppression pool bypass are assumed after drywell temperature reaches 700'F.
-The Hydrogen Igniters are qualified in EQ Binder EQ-CLO91.
They.were tested in 100% steam at 330*F for 3 hours, plus 300*F for 3 hours, plus 250*F for 7 days. Therefore the ignitors-located in the wetwell are expected to survive under all accident scenarios. Suoeression Pool and Suporession Pool Makeuo - The L suppression pool make up system was not modeled, and no credit was taken for operability. The 24 inch motor operated valves for Emergency Makeup are qualified for the 4-77
- - - - - . - - . - . -~ _ . -
-CPS 2NDIVIDUAL PLANT EXAMINATION CONTAINMENT QUANTIFICATZON 1
same environmental conditions identified earlier for inboard isolation valves. The suppression pool is anticipated to reach saturation temperature during certain accident sequences. Saturation conditions in the suppression pool do not affect the ability of the pumps drawing' suction from the pool-since all such pumps are designed to pump saturated mixtures (section 3.1.2.3). Electrical / Mechanical Penetrations - Other than the vacuum breakers discussed earlier, the vulnerable parts of drywell and containment penetrations are the elastomers used for sealing. Penetration Thermal Attack is described in detail in section 4.4.4 of this report. Surmarizing the data in that section, dryvell penetrations are expected to survive , for > 2 weeks at 700*F. Containment penetrations are not expected to fall due to temperature, humidity, and radiation. EQ Binders EQ-CLO37, 038 and 039 qualify the penetration seals at 253.5*F, 100% Relative Humidity, 20 psi pressure, and 2.2 x 10 8 RADS for a 40 year service life. Containment Vent System - The only parts of the containment Vent System impacted by severe accident conditions are motor-operated valves. The valves are qualified for the same environmental conditions identified earlier for inboard isolation valves. Venting via the Spent Fuel Pool, using RHR Containment Spray Spargers is through normally closed MOV 1E12F028A. If containment temperature exceeds 340'F, this valve may fail to open on demand, rendering this vent path inoperable. The other two vent paths utilize valves that are normally open,-or air operated valves that fail open, and would not impact the capability to vent during extreme environmental conditions. Containment /Drvwell Ventilation Systems - The Containment HVAC System (VR), DryNell Purge System (VQ), and Drywell Cooling System (VP) are not required or designed to operate 4-78
,.. _ _ , _ _ _ ___r
CPS INDIVIDUAL PLANT EXAMINATION CONTAIMMENT QUANTIFICATION_ l under severe accident conditions'with the exception of their containment' isolation valves. The isolation valves are addressed previously in this section. ' Instrumentation Renuired for Recoveries - Due to the nature of the recoveries the number of instruments required to perform these actions is very limited. This required instrumentation includes RPV Level instruments, RPV pressure instruments, containment pressure instruments, c antainment 1 hydrogen monitors, suppression pool level and temperature and containment isolation valve position indication. These instruments are all qualified to the requirement!. - 10CFR50.49, i.e., to perform their respective function during the most severe design basis accident. Based on the timing and containment conditions of the non-truncated level 2 sequences, this instrumentation would be available when required for the respective recovery. 4.6.3.2 Interfacina Syptem LOCA (ISLOCA) An ISLOCA is not regarded as a significant release mode for CPS. Due to the low frequency of occurrence and available recovery actions, all sequences involving an ISLOCA truncated out in the level 1 analysis (Section 3.1.2.2 and' Fig. 3.1-12 for ISLOCA Event Tree). 4.6.3.3 Phenomenolocical Uncertainties Section 4.4 discussed treatment of some phenomenological issues for the CPS Containment Analysis. The reported containment results are based on these-evaluations. Additional analysis was done to evaluate different assumptions or conditions.- Special attention was applied to developing insights into the attributes that affect the estimation of the low containment failure rate. Many MAAP runs were performed with varying parameters in order to determine sensitivity of modeling CPS containment performance to 4-79
L CPS INDIVIDUAL PLANT EXAMINATION CONTAINMENT QUANTIFICATION these various parameters. Cases for MAAP evaluation were based on the EPRI " Recommended Sensitivity Analysis for an IPE using MAAP 3.OB" as well as cases that appeared of concern to the analysis team, such as expected containment failure pressure. 4.6.3.3.1 Hydrocen Bensitivity to Channel Blockace MAAP is capable of modeling fuel channel blockage by the molten core material, thus preventing further flow in the blocked channels. Several MAAP runs were performed using a localized fuel coolant flow blockage option. The output is consistent with the result expected from the occurrence of local blockage. RPV failure occurs slightly sooner than the unblocked condition which is consistent with the reduction in steam cooling available in the core due to blockage (Note: the non-block option was used for all standard level 2 runs). Peak drywell temperatures are higher in the blockage case since the vessel fails earlier and therefore more decay heat is retained in the drywell. Hydrogen production is much higher in the no blockage case due to the enhanced contact of Zircaloy and water. This comparison shows that the no blockage model which was used for the basic level 2 analysis is conservative since, for most sequences, more than twice the mass of hydroget is generated than in the blockage case. For large break LOCAs, use of the blockage model has no material effect on hydrogen production. This result is due to the rapid loss of vessel inventory through the break which sharply limits the amount of hydrogen generated by the Zr metal-water reaction. The small difference in RPV failure time is consistent with the reduction in boiling and inventory loss that would be anticipated with certain core flow channels blocked. 4-80
CPS INDlVIDUAL PLANT EXAMINATION CONTAlloJNT QOA11TIFICATION 4.6.3.3.2 Bource Term Sensitivity to Containment Failure (Venti Size Two MAAP runs were performed using containment failure / vent areas differing from the initially assumed area of 0.1963 ft2 One run 1 assumed a failure area of 1.0 ft and the second used a value of 0.1 ft2 Venting in all runs was modeled to occur at the start of the run. Vessel failure and suppression pool bypass timings were essentially identical in all runs. The output from these MAAP runs showed no significant difference in the release source term by having a failure area larger than the default area. The source term calculated for the 1.0 ft 2 area was actually slightly ( smaller than the base case. Reduction of the vent size did, , however, reduce the resultant source by slightly less than an order of mao.itude. The 0.1 ft 2 failure run was reperformed over a longer time interval to determine if the source term would eventually reach approximately the same magnitude as the larger vent runs. A time frame of 72 hours was used and it was noted j that while the magnitude of the release was somewhat higher than I the 48 hour run, it was still significantly less than the larger containment vent size runs. 4.6.3.3.3 Ef fect on Containment Performance if In-vessel Recovery Faila l Two MAAF tuns were performed to examine the effect on the containment if in-vessel recovery were unsuccessful. The first differed from the second only in the time at which RPV injection was recovered. The first run initiated RPV injection at 180 minutes as opposed to the 72.2 minutes used in the second run. The results of these runs show that while failure to recover in-vessel did have an effect, it did not pose any significant additional risk to containment integrity. Hydrogen generation is only slightly higher than the recovery in-vessel case and the 4-81
. _ _ _ _ _- _. _ . _ . __ _ .- . _. - _ ~.. __ -
i CPS ANDIVICOAL PLANT EXAMINhTION CONTAINMENT QUANTIFICATION ! peak containment pressure of 28 psia is still far below the containment failure pressure.
- 4. 6. 3. 3. 4 Ef f ect of UslpA 111_qher_ ( than_GRD) Caploity Recoverv-Systema In order to limit the number of MAAP runs reqeired, but yet provide a bounding analysis, CRD, alone, was used as the poet accident injection source for all base case analyses.
Two MAAP runs were performed te snalyze the effect of using a higher capacity injection system than CRD. The first models a high pressure core damage sequence using HPCs as the recovered injection system. The second is a large LOCA sequence (low pressure) using HPCS as the recovered injection system. Use of HPCS versus CRD for those sequences most atrongly affected hydrogen generation. Significantly less hydrogen is generated using HPCS due to the much more rapid quenching of the fuel. t This behavicr is consistent with the fuel peak and average fuel temperature plots for the runs which show fuel temperatures reduced to approximately 500*F within a few minutes of HPCS initiation. Using the CRD system, fuel temperatures do not decrease to 500*F for approximately 7 hours following CRD initiation. ; 4.6.3.3.5 Effoot of Varyina_LOCA Bite in Clpss IIIC Benuences l Two MAAP runs were performed to model large break LOCAs with varying break sizes. The base case large break LOCA-utilized a break size equivalent to a shear break of a 18.155 inch I.D. pipe (Reactor Recirculation Pump Suction line) The first run i specified a break size equivalent to a 24 inch I.D. pipe and the second run specified a break size equivalent to a 10 inch I.D. ; pipe. 4-82
- - I
CPS INDIVIDUAL-PLANT EXAMINATION CONTAZNMENT QUANTIFICATION A review of these runs shows that the core and containment behavior is relatively insensitive to the size of the LOCA in the large break range. No significant differences were noted for the pa.ameters between the runs. 4.6.3.3.6 Effect on Fource Term of Leak Before Break A MAAP run was performed to determine the effect on the release source term for the containment leaking before gross failure. The run utilized a containment failure size of .054 ft2 to model containment leakage as compared to a sudden failure size of 0.1 ft2 Vessel failure and suppression pool timings were essentially the same in both runs. The leak before break scenario did, however, result in a significantly smaller source term than the base case over the period of analysis. 4.6.3.1.7 Effect of Decree of RevaDorization on the Bource Term A MAAP run was performed to determine the effect of reducing the revaporization vapor pressure multiplier on the resul. ant source term. A SBO sequence with the RPV failing at high pressure was chosen for this run. Analysis of the fission product release shows-that reduction of the revaporization vapor pressure multiplier by a factor of 10 resulted in a reduction in the radionuclide release by approximately a factor of.3. Level 2 analysis runs using the default revaporization vapor pressure multiplier are conservatively modeled in regards to revaporization. 4.6.3.3.8 Effect of Core Melt Procrossion on Revaporization/ Source Term A significant factor affecting primary system temperature and the degree of revaporization is the mass of fuel retained within the original core boundaries for an extended length of time. MAAP 4-83
CPS INDIVIDUAL PLANT EXAMINATION CONTAINMENT QUANTIFICATION predicts that a relatively large mass of fuel slumps to the lower plenum with a drawn out melt of the remaining core material. To analyze the effect of the remaining core material not remaining within the core after core slump, a MAAP run was performed to
" dump" the remainder of the core material after 80% of the core mass is in the lower plenum. ;
Review of these results showed a reduction in the resultant source term by a factor of roughly 2 to 10. Additionally, significantly higher drywell temperatures (1421'F vs 1139'F) were generated in the core dump scenario. 4.6.3.3.9 Eff.ect of Debris Coolability on Containment Performance To analyze the effect of the degree of core debris coolability on containment performance, two MAAP runs were performed utilizing different critical. heat flux parameter (FCHF) values. (FCHF is the critical heat flux parameter used in MAAP to calculate the heat transfer between debris and water) The first was performed with FCHF reduced to 0.10 and the second was performed with FCHF set to 0.02 to model an uncoolable core debris configuration. The original base run used an FCHF value of 0.14. All three of these base runs had temperature spikes in excess of 700*F at vessel failure but are not classified as suppression pool bypass (Penetration Thermal Attack) because of the. extremely short time that the drywell gass temperature remained above 700*F Comparison of the first run, with FCHF at 0.10 with the base case showed the results of the two runs were nearly identical. Correspondingly, it can be seen that moderate reductions in the critical heat flux parameter have a miniscule-effect on containment performance. Analysis of.the run with FCHF set to 0.02 (uncoolable case) showed a significant increase in hydrogen generation. Additionally, drywell gas temperature was slightly higher (300*F vs. 280*F) and containment presnure was j significantly higher (31 psig vs. 19.5 psig) than the base case 4-84 i
l CPS INDIVIDUAL PLANT EXAMINATION CONTAINMENT QURNTIFICATION at the sama point in time. While the uncoolable debris cooling caso did result in higher pressure values, the containment structure was still far from the failure threshold pressure (estimated 33 psig vs. 93.8 psig). 4.6.3.3.1C Effect of Rapid 8teamino Period Followina RPV Eailure Following RPV failure, a short period of rapid steaming can occur when molten corium drops into an existing pool of water. To determine the effect on containment pressure and hydrogen ignition (effect of possible steam inerting) from this rapid steaming, a MAAP run was performed with FCHF set to 2.0. Analysis of this run showed only a limited and insignificant effect on containment performance and hydrogen ignition from rapid steaming following RPV failure. 4.6.3.3.11 Effect of Varvinc Ven,t Timinc On Release Source Term To determine the effect on the fission product release of the timing of containment venting, two additional MAAP runs were performed. The first initiated venting at 6 hours and the second initiated venting at 24 hours. These runs were compared against the base case which initiated venting at 13 hours. Overall, vent timing had only a small and insignificant effect on the fission product release fractions. There appeared to be a small increase in the volatile fractions for later venting times which is assumed to be due to the higher containment (driving) pressure at the time of venting. Non-volati?.e species appeared ; to have slightly smaller release fractions for later vent times. This effect is assumed to be mainly a result of the increased time available for the slower reduction mechanisms associated with non-volatile radionuclides. 4-85
~
CPS INDIVIDUAL PLANT EXAMINATION CONTAINMENT QUANTIFICATION 4.6.3.3.12 Effect of DW Penetration Failure Bize-On Releage Source Term To determine the effect on the fission product release fraction of the size of the drywell penetration failure, two additional MAAP runs were performed. One run modeled the drywell penetration failure area at an initial 0.05 ft 2 and the second run modeled the failure area initially at 1.5 ft 2 The base case utilized an initial panebration failure size of 0.533 ft2 with an additional failure area of 0.533 ft 2 added at both 800*F and 2 900*F (Note: the failure area of 0.533 ft was based on a calculation of the area required to sustain choke flow from the drywell to contair. ment) . The two additional runs increased the failure size proportionally at 800*F and 900*F also. A review of the results shows very little effect on the source term from varying the drywell penetration seal failure area. A slight but insignificant reduction in the release fractions can be seen for the reduced-area case while the expanded area case iu ! essentially identical-to the base case. 4.6.3.3.13 Effect of Power Recovery Timinc On Containment Performance i i To analyze the effect of recovering power at some interim time ! during an SBO several MAAP runs were performed. Since it is ! assumed that energized equipment could provide an ignition source j for hydrogen combustion, this recovery can potentially have a strong effect on containment performance. The MAAP runs and i their respective recovery' times were as follows: TL52 Sequence T352 with recovery at 16 hrs. TL52 Sequence TL52 with recovery at 24 hrs. TL52-162 - Sequence TL52 with recovery at 16 hrs and parameter DXHIG set to 0.02 TL52-242 - Sequence TL52 with recovery at 24 hrs and parameter DXHIG set to 0.02 4-86
GPS-INDIVIDUAL PLANT EXAMINATION CONTAINMENT-QUANTIFICATION DXHIG is the MAAP parameter ior percent hydrogen-concentration at ' which combustion will occur without energized ignitors. Analysis of the MAAP runs showed that containment failure from overpressure occurred shortly after power recovery for all cases. The overpressure was a result of hydrogen combustion. Due to internal MAAP parameters outside of code limits, it was not possible to determine the release source term from the run output. To estimate the release, two additional runs were set up in which power was recovered at 16 and 24 hours but with MAAP parameter DXHIG kept at 0.99 and manual containment venting with a1 ft 2 area started at 16 or 24 hours as a'ppropriate. This circumvented the MAAP code problems and allowed a source term to be determined. While this source term has some degree of inaccuracy since the pressure spike associated with containment failure is not present, the long time period following failure should allow these estimation runs to approach the release fractions of the failure runs. Additionally, since the estimation runs resulted in the most severe release class (Class III), use of these estimates for sequence grouping will not result in any error in release category quantification. Peak drywell temperature and peak containment pressure both increased slightly for the 24 hour rostoration sequence. The release fractions for the 16 hour and 24 hour estimation runs are au follows: Egrameter 16 hour 24 hour Frac. Nobles 0.96 0.91 Frac. CsI/RbI 0.19 0.17 Frac. TeO2 1.1E-02 8.0E-03 Frac. CsOH 0.19 0.17 Frac. Te2 9.7E-03 2.5E-03 , Frac. Sr0 3.0E-06 8.5E-07 Frac. moo 2 1.2E-05 5.6E-06 Frac, Bao 2.8E-05 2.0E-05 4-87
._ _. . - . - _ ~__. - . . _ ..~.-. _ . _ _ - - . _ _ - . _ _ _ ._
I CPS INDIVIDUAL PLANT EXAMINATION CONTAINMENT QUANTIFICATION l Frac. Lanthanides 1.8E-07 4.6E Frac. CeO2 1.3E-06 3.2E-07 Frac. Sb 2.1E-02 6.6E-03 Frac. U/Trans U 5.5E-08 3.0E-08 Additional review of SBO scenarios, sequence modeling and recoveries determined that recovery of power to some equipment in containment during the period of interest (48 hours) was highly likely. This energization of equipment was viewed as having the potential to act as an ignition source. Correspondingly, the base case sequence modeling was changed to include power recovery at some point in the sequence by setting DXHIG to 0.0 at the desired time. Based on the power recovery runs at 16 and 24 hours, all of which , resulted in containment failure, an additional series of scoping runs was performed to determine at what point power could be recovered and still maintain containment integrity. These runs showed that at 4 hours, power could be recovered with concurrent hydrogen ignition without containment overpressure failure occurring from the hydrogen combustion pressure spike. 4.6.3.3.14 Effect of a Stuck Open BRV Concurrent With 2n BBO A MAAP run was performed to determine the effect on containment performance of a stuck open SRV occurring during an SBO. A comparison of this run with the base case SBO was performed. Review of the run results showed that while there is some difference in-the time of RPV failure and the peak temperature in the drywell, thare is little material difference from a containment performance standpoint. Hydrogen generation is almost identical in both cases and-the containment pressures generated in both runs.are far below the overpressure failure threshold, i i 4-88
CPS INDIVIDUAL' PLANT EXAMINATION CONTAINMENT QUANTIFICATION 4.6.3.3.15 Ef fect of a Larce Dreak LQCA With Concurrent SDQ A MAAP run was performed to determine the effect on containment performance of a large LOCA occurring simultaneously with a SBO. A comparison of this run with the base case LOCA event was performed. Review of these runs shows that the only significant difference between the two cases was in the mass of hydrogen generated. While the LOCA with SBO resulted in substantially more hydrogen present in containment than in the base case, the amount of hydrogen was insufficient to fail the containment as a rest.lt of a hydrogen burn. 4.6.3.3.16 Effect of Alterinc Hydrocen Concentrations In SqQ pecuences TVo MAAP runs were performed keeping the value of parameter DXHIG (% H2 ) at 0.0 and 0.02. Increasirg parameter DXHIG requires a higher hydrogen concentration be present for combustion to occur. Increasing DXHIG to a small positive value simulates the situation in which hydrogen igniters are not energized and the ignition source for hydrogen is energized equipment inside the containment. This treatment differs from the base case in that it used DXHIG set to 0.99 with power to containment off to simulate no ignition source. Using the default value of DXHIG (0.0) results in a lower peak hydrogen mass in containment. To a large degree this effect is due to a number of smaller hydrogen burns that consume hydrogen. The run which utilized a DXHIG of 0.02 has the offect of delaying hydrogen combustion until higher hydrogen concentrations are reached. Peak hydrogen masses in the different containment areas reflects a smaller amount of hydrogen removed through combustion in this run. Peak containment pressure is higher (58.2 psia vs. 31.8 psia or 29.9 psia) in this sequence than either of the other 4-89 l
h CPS INDIVIDUAL PLANT EXAMINATION CONTAINMENT QUANTIFICATION ! noted runs (i.e.-DXHIG at 0.0 or .99) due to a larger pressure spike associated with the delayed hydrogen burn (due to the larger DXHIG value), however this increased pressure is still significantly below the containment overpressure failure threshold. 4.6.3.3.17 Effect of a Reduced Containment Overpressure failure Threshold i A review of the MAAP runs performed for both tne level 2 analysis y and the previously mentioned sensitivity runs showed that none of the non-failure cases exceeded approximately 59 psia containment. pressure. Per the containment overpressurization summary evaluation, the probability of containment failure at this pressure is essentially zero. Correspondingly, fu. her analysis of the overpressurization threshold pressure would i.covide no additional insight. 4.6.3.3.18 Conclusion i A comparison of worst case scenarios to the base case revealed only one change of assumption (Effect of Debris Coolability) that significantly changed parameters that-could challenge containment integrity. However, if this assumption were applied to all CET sequences, it would not significantly increase the containment failure probability. - 4.6.3.4 containment Isolation Fw_ lure Analysis A detailed analysis was performed to determine the conditionr' probability that the containment would fail to isolate,.given # core melt sequence. The Fault Tree analysis discussed in Section 3.2.1.2.1 included power supply and instrumentation vulnerabilities due to miscalibration, failure to restore from maintenance and common mode failures. Each containment isolation 4-90
- - . _ _ . .- ~ _
CPS INDIVIDUAL PLANT EXAMINATION CONTAINMENT QUANTIFICATION
. valve is tested as part of the CPS Technical-Specification Surveillance Program at an 18 month frequency, and each valve is included in the CPS Inservice Inspection (ISI) Program. In addition, each valve is included in the Generic Letter 89-10 Program. Each motor-operated valve has a switch located in the Main control Room that bypasses the motor overload trip function.
The switches are in the " normal" (overload bypassed) position unless the valve is being tasted. l Only one line at CPS has the potential to provide a containment l bypass pathway during a Station Blackout event (valves 1FC007 and 1FC008) (Secticn 4.1. 2.1) . These valves are located in a 10 inch schedule 40 pipe line, with an inside diameter of 10.02 l'-hes 2 (.55 ft). Based on this information, the conditional probability of the containment failing to isolate in a SBO was calculated as 0.4 (Section 4.6.2.5). {- r f l 4-91 (
CPS INDIVIDUAL PLANT EXAMINATION CONTAINMENT QUANTIFICATION Table 4.6-1 Time-PhaJed Power Recovery For Station Blackout Secuence TLU1U3 DESCRIPTION LEVEL I CONTA!hMENT ret.0VE RY RECOVERY DG01KA or 8 f alls to rm .2 .34 J'G01r" f alIs to run .1 .34 Consnon cause f ailure of any 2 or all 3 Diesel Generators to rm .1 .34 Diesel A, B, or C fuel oil ptmp falls .538 .75 ccuenon cause f ailure of any 2 or all 3 Diesel fuel oil ptape to start .12 .47 Consnan cause f ailure of any 2 or all 3 Diesel fuel oil purps to rm .34 .75 Table 4.6-2 Time-Phased Power Zecovery For Station Blackout Secuence TLU1L4DG1DG2 DESCRIPTION LEVEL I REC 9VERY CONTAlkMENT RECOVERY 1 NOUR 4 HOUR 1 HOUR 4 HOUR DG01KA, B, or C f alls to run .14 .191 .52 .87 Connor cause f ailure of any 2 or all 3 .03 .09 .52 .87 Diesel Generators to rm Diesel A, B, or C fuel oil plap f alls .54 .54 .81 .84 Consnon cause f ailure of any 2 or all 3 .02 .19 .42 .52 Diesel fuel ell psps to start Consoon cause felure of any 2 or all 3 .0052 .078 .81 .84 Diesel fuel oil pmps to run l l 4-92 L
m . . _ _ __ _ . _ . - _ _ . CPS INDIVIDUAL PLANT EXAMINATION CONTAINMENT QUANTIFICATION-CLASS IA CET SEQUENCE 1654 TYPICAL HIGH PRESSURE RPV FAILURE SEQUENCE
. CONTAINMENT PRESSURE Mgi 4 . .
l 6 i i i g . . i i g i i i i g i i i i - e 1. - N m m i 4 _ Tit 1E OF RPV FtH LURE j
~ 1.
m . a~ - i _E.
-n
- _i g - :
El o :b 5 O 0) 1. : c- : C D L -
~ 2 i
I
- a. D F -E e i
~
i E S y bl _/ ,
- , , , I , , , , I , , , , I- , , , , I , , , ,
i
~O 10 20 30 40 50 TIME HR CONTAINMENT TEMPERATURE o, T o~ i
~
i i i j i i e i i i l 4 4 j i e i i j ~' . 6 i i _ Ln - o 1 tn - t : .. k g ; _ ._, o - --
- a. e : _-
E' o 1 O gn . ,,- o m - _ C o : C o - ~ m : F- 8 m 7 m o-o l i eo N -
@ 7 ,k ob, , , , I , , , , I , , , , ! , , , , l , , , , -b SO 10 20 30 40 50 tit 1E HR Figure 4.6-1 A Compt - Portion of containment below elevation 828' and above elevation 755#.
4-93
CPS INDIVIDUAL PLANT EXAMINATION CONTAINMENT QUANTIFICATION CLASS IA CET SEQUENCE IAS4 TYPICAL HIGH PRESSURE RPV FAILURE SEQUENCE DRYWELL TEMPERATURE 8_iii, ; . . . 4 i i i i . i i . . . i i i i i m . . TIME OF RPV FAILURE -
- u. g -
O . .. 8 .. .. x o ._ _
.h e : .
C - ..
- o . _ _ ._
H [ O - - L9 g -
.w }
~ ~
, I , , i I i , i I i , , I , ,
O ! ! i ! ! e e e So 10 20 30 40 50 TIME HR Figure 4.6-2 4-94
f 1 CPS INDIVIDUAL PLANT EXAMINATION CONTAINMENT QUANTIFICATION CLASS IA CET SEOUENCE IAS4 TYPICAL UlGH PRESSURE RPV FA1 LURE SEQUENCE CONTAINMENT HYDROGiN
-8.....;....i m
.i. 1 i
; 4 . . ,
C $ $ H - CL O - - E O - Time of RPV Failure _ b . Z - n, '. - z8 u_ g .. p- _ m . _ a .. 1 . b@ - - m J
~ ~
a 1 i i i i l i i i i l i i i i l i i i i i i i i i 0 10 20 30 40 50 1IME HR i Figure 4.6-3 i Compt A - Portion of containment, below elevation 828' and above elevation 755'. 4-95
- , - ~. - _
CPS INDIVIDUAL PLANT EXAMINATION CONTAINMENT QUANTIFICATION CLASS IB CET SEQUENCE TLSI TYPICAL STA110N BLACK OUT SEQUENCE CONTAINMENT PRESSURE
$;i i . . iiii;iiiijiiiiji i4 .
l W- : 4 2 : g 'Dcginning of Venting i.. ' m- -- ,4 -. am : .
" a '- a ct n : :
e - q. Ob . i - C 3 ~~~ i - o
~
i l 0- 5 h e : _. th .I
~ . %C; '"- % 4. M M M :.
y : i , , , I i i , e i , , , , I i , i i , , ,- i:
~o lo 20 30 40 So TIME HR CONTAINMENT TEMPERATURE i i i i 8
m i i i i i i i i i i
. . . i i . . .
i ,
' _ y-
- c. , -
g - o . o .- . C o _ f _ C OW *
}
b Pn
~
f ' k
. ,4-- --
' ' ' I ' ' ' ' I ' ' ' ' I ' ' ' ' I ' ' ' '
o So lo 20 30 40 50 TIME HR Figure 4.6-4 A compt - Portion of containment below elevation 828' and above elevation 755'. 4-96
CPS INDIVIDUAL PLANT EXIJtINATION CONTAINMENT QUANTIFICATION CLASS 10 CCT SEC.UENCC TLSt TYPICAL STATION BLACK OUT SEQUENCE m CONTAINMENT HYDROGEN J O i i i i i g a i 4 6 i a i i i v - l g 4 6 g i , .# # C ' M e-Beginning of VentiD9
- 9= o .
ga .L . 5
- . o __
O _
~
o - tr . o t g _- _
- u. -
o -
^
W
$ o0 li
~
' ' ' I i I ' ' ' ' ~
I I ' ' ' ' I 10 20 30 40 So TIME HR m CONTAINMENT HYDROGEN J 8..,ii; iia j i i
- N .
4 a m l 4 i i g i i 4 . . h .:~ /,/ i S8 88 h
- i "8 9 \ :
3g i N i Beginning of Venting E 28 us o i ~
~
o l O o v : -
@o :
c2o
^ -
E
- u. o :
aN . mO m-c o E O fl'I 10
' ' ' ' l 20 30 I ' ' ' '
40 I ' ' ' ' - i 50 TIME HR Figure 4.6-5 Compt B - Portion of containment above elevation 828', Compt A - Portion of containment below elevation 828' and above elevation 755'. 4-97
CPS INDIVIDUAL'PIANT EXAMINATION CONTAINM;NT QUANTIFICATION CLASS 18 CET SEQUENCE TL5] TYPICAL ST ATION BLACK OUT SEQUENCE c DRYWELL TEMPERATURE o o i i i . g . . . . j . . .4 g i i . g o - l' o _
-- 0 .
m . r 3 ' x . L s -
" o .
O .- [ _
.E F i i
ea . [ $ l u
' ' ' ' I ' ' ' ' I ' ' ' ' I ' ' ' ' I ' ' ' '
o O to 20 30 40 50 TINE HR l l Figure 4.6-6 4-98 ,
i CPS INDIVIDUAL PLANT EXAMINATION CONTAINMENT QUANTIFICATION CLASS ID CET SEQUENCE ID47 TYPICAL LOW PRESSURE RPV FAILURE SEQUENCE CONTAINMENT PRESSURE i i i , . .. . p, i i tn - v - ; o - (n v .: -
~
Q. : s a M .- [ E .
~_
o o -- OM .~. - C - 1. C N {
- a. oN tn 2 ..
' ' ! ' ' ' ' I ' ' ' ' ~
' ' ' ' I ' ' ' ' I ' '
o 30 40 50
~O 10 20 T It1E HR CONTAINMENT TEMPERATURE
, i .
- 8. .. i . . . . . . . j i i i i i
v . o _ .
- b. $ : 4 - Time of RPV Failure CL o -.--
E O . Om .. i O ,
~_
c o . C tnm
~
l' F o _ ! , o -
, m -
o - , o _ c tn . 1 - . I o M,,,,! , , . , I , , i i I , , , , I , , i i - 20 30 40 50 l 20 10 ! tit 1E HR Figure 4.6-7 I A compt - Portion of containment below elevation 828' and above elevation 755'. 4-99 l L
I CPS INDIVIDUAL P12.NT EXAMINATION - CONTAINMENT-QUANTIFICATION- .j l CLASS ID CET SEQUENCE 1047 TYPICAL LOW PRESSURE RPV FAILURE SEQUENCE c DRYWELL TEMPERATURE ', C
. 4 e i 4 . . i . i . 4 i . i 4 j 4 . a .
g ; g a . .. k o --_ _
-n o . .
x . .
-4 a . -
-g - - ,
c - .. . w
$o@ -
/
.Lb a
~,e i i I , , i i l i i i i ! , i , i i , , i i O 10 20 30 4J 50 TIME HR Figure 4.6-8 4-100
CPS INDIVIDUAL PLANT EXAMINATION CONTAINMENT QUANTIFICATION 1 CLASS (D CET SEQUENCE 1047 TYPICAL LOW PRESSURE RPV FAILURE SEQUENCE CONTAINMENT HYDROGEN m J O i . 4 . g
. . . i j . . . . g . . . .
j 4 4 . i, e
#i ~
p, O -
- a. o : 7 :
E - - . OOin - ..
.- 1 Z0 z v 7 / ~.
.to wo o0 m - --
x . - O .: :
>- 0 1 oo .
t : : oo o . . m- - th C O ' ' ' ' ;
=
r 0 10 20 30 no 50 TIME HR l l l l l l l Figure 4.6-9 l l Compt A'- portion of containment below elevation 828' and above elevation 755'. 4-101 l
CPS INDIVIDL'AL PIANT EXAMINATION CONTAIMMENT QUANTIFICATION CLASS 3D CET SEQUEMCE LD31 TYPICAL HIGH PRESSURE RPV FAILURE LOCA SEQUEtJCC CONTAINMENT PRESSURE
?.. .
ii ..ii . iiii i
. g -
. i m .
0- O - j Timo of RPV Failure . o
!Q y
_oN j' 5
- n. J :
m - ,
,e
~
, , , , , I , , , , I , , , i -
, , , , I , , , I o
~o 10 20 30 40 50 TIME HR CONTAINMENT TEMPERATURE 8
W
. ;ii .iiiiii . i . . . .
M Time of RPV Failuro h- O .' 7 s n . g . e - 0 o . o a . 4~. T . C o .
,_. o .
m . m . o -- .
' ' ' I ' ' ' ' I ' ' ' ' I ' ' ' ' I ' ' ' ' '
o -. So 10 20 30 40 50 TIME HR Figure 4,6-10 A compt - Portion of containment below clovation 828' and abovo solovation 755. 4-102 . _ _ , - - _ _ . . _ _ . . . _ ~ . . ~ . . -_ _.. .... _ ,,_._ _...... ....,. ~. _ .~ . ,.. = .
i CPS-INDIVIDUAL-PLANT EXAMINATION CONTAINMENT QUANTIFICATION CLASS 3B CET SEQUENCE L831 TYPICAL HlGH PRESSURE RPy FAILURE LOCA GE00ENCE O DRYWELL TEMPERATURE [3 . , .
; i ,
; 4 , , ,
o . a . e ,
-o : I
%o -
2 n . x . t . mo - o -- 1 _c. .- .
- s. o .
O --
~
. n .
O - o O o t- -- c4 . g , , i i I , i i i I , , i i l i i i l i i , i o 10 20 30 40 '5 0 - llME HR
+
6 Figure 4.6 ' 4-103 ,,. . . - _ . . . . , ,, , ......-a~_ -.,,-..-....-m,-,,,_..~,-, . . . , . . . - . , , , , - . _ _ . , , , _ . , , , _ , . _ - . , . _ . . _ , _ , _ - _ , ,
4 CPS INDIVIDUAL PLANT EXAMINATION CONTAINMENT QUANTIFICATION t CLASS 30 CEI SEcuENCE LB31 TYPICAL HIGH PRESSURE RPV FAlLURE LOCH SEQUENCE
"] CONTAINMENT HYDROGEN
,_ g , . . .
i z~ tal p -- -
)Z '
Eo r o o z~ O 7 QPm '/ '~ O 7 - ' l2J o O - tr ag __
~
I , (n o i i i i l i i i i l i i i i l i i i i l i i i i y o 10- 20 30 10 So E 11ME HR 1 Figure 4,6-12 4-104
CPS INDIVIDUAL PLANT EXAMINAT2ON CONTAINMENT QUANTIFICATION CLASS 3C CET SEQUENCE LC4? 1YPICAL LOW PRESSURE LOCA SEQUENCE CONTAINt1ENT PRESSURE ! O,iiiil s i e i j i e i i g i i i i g i 4 i
)
y _
~
- o -
mV . e -
- i 5g -
~
S -
~
g .. C y L '.
~
ao # _ o ' ' ' ' I ' ' ' ' I ' ' i i l i i t I i i e i "O 10 20 30 10 50 TIME HI. CONTAINMENT TEMPERATURE o o . 4 i i 4 j i 4 8 4 l 4 e i 4 e 4 i i g i i i i l ,_ Time of RPV Failure
~ . -
P8 : Om . 2 E : I c 0 T H o 1 i ~
,o o"
o f i, l f
.T f "
o 'I ! ' i i I i e- i e I , , , , l , , , , 90 10 20 30 40 50 TIME HR Figure 4.6-13 A compt - Portion of containment below elevation 828' and above elevation 755'. 4-105
.. _ . _ . _ __.._ _ _.- _ _ _ . _ . _ . _ . . _ . . _ . _ . . _ _ _ . - . . _ _ ._.m _ . - _
tM .THDIVID >% PIANT EXAMINATION CONTAINMENT QUANTIFICATION ( p . r E,
- i CLASS 3C CE1 SEQUENCE LC42 T YPICAL LO14 PRESSURE LOCA SEQUENCE DRYWELL TEMPERATURE O
O i i i i i ' 4 4 i ; i i ; l j 4 l
, 4 j i iii e _
k S 0 ^.~
/
[ . - *
/
/ .
$0 .
o!o t a F
/ -
-i
~
C w .
-n 8 F .
4
~
m O U 8 m . S - m : O ~ t f I f ! 1 1 1 1 l t t t t l 1 i 1 , l t , , , . S0 10 20 30 10 So T II1E HR l I l l l Figure 4.6-14 1 4-106 l
CPS I!JDIVIDUAL PIAllT EXAMI!JATIo!J CO!JTAI!1ME!JT QUA!JTIFICATIO!J CLfiSS 3C CE1 SEQUEf4CE LC42 1 YI'lCAL LOL4 PRESSURE LOC A SEQUENCE "j CON 1AINMENT HYDROGEN
'- 8 i . ,
j . . . . . . . j , . . i W '/,. Qv / u o -
/ ._
y G. / C / gg ._. j z
/
/
-. o - ,/ -.
m
/
~
2 U / og --
/ -
(L O
/
l .w I a _ pm ,v _
$~
(n a J' '
! ' I i ' ' ! I i ' ' i l i ! ! ! ! ! ' t i p 0 10 20 30 10 50 E
1IME HR i.,. l l l l l i Figure 4.6-15 4-107
CPS IllDIVIDUAL PIAliT EXAMIllATIOff COliTAlllMEliT OUAliTIFICATIO!1 CLASS IV CET SEQUENCE ATol TYPICAL AlWS SEQUENCE CONTAINMENT PRESSURE 3 .. l i i i i j i i i i l i i i i
~
o *
. M-Containment Failure --
i o> ; . i o : - I
\
._. co : : ; u) - R .l A% ~~ I "a o :_ . E w : 1. I J . t o o . C vi - fo* a i ' o i - m : :
~
o - m
~
' ' ' ' i ' ' ' ' i ' ' ' ' i ' ' ' f O
~0 5 10 15 20 TIME HR CONTA1NMENT TEMPERATURE g.. i i- i , i i i . j i i i i i
i i i i _ e .
- . e O -
~
v3
- u. m
~
& O --'
~
E o . o m . o .
~
q- . O ~
~~
C V)m
~l H O -
0 8 :: - e .: .. O _. . v) . g M, , , , I- , , , , I , , , , I , i i i 20 5 10 15 20 TIME HR Figure 4.6-16 A compt'- Portion of containment below elevation 828' and above elevation 755'. 4-108
i CPS INDIVIDUAL PLANT EXAMINATION CONTAINME!1T QUANTIFICATION l CLASS IV CET SEQUENCE AT01 TYPICAL A1WS SEQUENCE j DRYWELL TEMPERATURE o ' o . ' ' ' j i i
- 4 4 4 i i j i i i i e . l .
o - . k $ ..' -
}S*
A
- ~
t * %,N ,- T o : ~ cN : H o L o . _- e N - . o . .. U . . O . nn . _. o ' ' ' ' I ' ' ' ' I ' *
* + i l ' ' i t 20 5 10 15 20 tit 1E HR Figure 4.6-17 4-109 1
CPS INDIVIDUAL P1 ANT EXAMINATION CONTAINMENT SOURCE TERM 4.7 S211rg_g_,TRrm 4.7.1 IntIgAustign l The relonso modo associated witn each lovel 2 sequence is a l description of the performance of various containment structures and systems that can affect the magnitudo of a radionuclido ! reloano. The following questions regarding status of containment structures and systems datormine the releano modo:
- Containment building - Is the containment isolated, vented, failed or bypassod? If the containment building is failed, does the failure bypass the suppression pool? If the failure occurs in conjunction with supprossion pool bypass, is vennel injection or containment sprays availablo?
- Release location prior to vossol failuro - Is the rolcaso occurring in the drywell or the watwoll?
- Size of the containment failure - Does a largo or a small containment failure occur? Note: it is assumed that containment failure from ATWS or hydrogon combustion results in a largo containment failure. Failure to isolate in a small failure.
- Timing of the containment failuro - does containment failure occur before of after vessel failure?
Tablu 4.3-4 contains a matrix used to assign coquenco releano modos. Onco determined, the sequence releano modos provido a general means of categorizing release source terms. Source term categorios are based on the percent of core inventory. roloased to the environment. For additional detnll poo the discussion in section 4.3.L. 4-110 l 1
,- + c -- - m,-, -,-a, .,- n - -,-v -ve, - , --
CPS INDIVIDUAL PIANT EXAMINATION CONTAINMENT SOURCE TERM Baced on the level 2 quantification results, 20 sequences were identified as significant (1.0. survived truncation at 1E-9). No significant nequences woro identified in the class V (ISLOCA) event tree and no further analysis was performed on this class of events. These 20 sequences were all identified on the CETs, Figures 4.5-1 through 4.5-6. Tablo 4.7-2 summarizos the containment status and release categories for the 20 significant sequences ovaluated. Figure 4.7-1 graphically shows the Plant Damage States, the Accident Release Modos, and Accident Sourco Terms for casos in which containment failure occurred. A review of the source terms resulting from the containment failure sequences shows that the source terms are fairly largo (all Class II & III). notormination af thoso source terms doos, however, have a-number of conservatisms incorporated. For sequenco TL51, venting would be performed using a pathway through the spent fuel pool. The spent fuel pool would have essentially the same effect of scrubbing the volatilo and non-volatilo , fission products as the suppression pool and would significantly reduce the source term. This name offect would be soon for sequence TL54 since the containment inclation failuro path in a SDO would also be through the upont fuel pool. Another conservatism is involved in the modeling of failure of the drywell penetration seals from PTA. This modeling assumod complete failure of both the inner and outor seals when 700'F was reached inside the drywell. Failure of only the inner seal from PTA would slynificantly reduce the release source term in containment overpressure sequences (TL52, TL53) sinco loss of the volatilo fission products would be present in the containment airspace at containment failure. 4-111
_ _ . . . _ __ . _ _ _ -_ - - _ _ - . _.- - .-- .~-.- - -- - __ CPS INDIVIDUAL PLANT EXAMINATEON CONTAI.? MENT SOURCE TERM Table 4.7-1 Source Term Release Data (Fraction of Inventory Released to Environment) stouEkCE IA01 1A15 IA30 TLot TL14 TL16 TL51 TL52 TL53 TL54 pt nt On se state Rxxx Rxxx xxxx Rxxx xxxx wxxx nys! nowl nont uCIE , Release Mode A0 AD A0 A0 A0 A0 05 D6 D6 A1 RPY Falture Time N/A N/A 2.6HR N/A 2.7HE 2.6HR 2.7HR 2.6HR 2.6HR 2.6HR C1 Falture Time k/A N/A N/A N/A N/A N/A 13at 4.thR 4.1HR 0.0HR
*(VENT)
MostEt 0.0 0.0 0.0 0.0 0.0 0.0 0.65 0.91 0.91 0.98 VOLATILE S (Fraction of initial irwentory released) Cat, Rbt 0.0 0.0 0.0 0.0 0.0 0.0 4.2E 2 0.17 0.17 2.1E 1 ie02 0.0 0.0 0.0 0.0 0.0 0.0 5.9E 3 8.0E 3 8.0E 3 3.9E 3 CaOH 0.0 0.0 0.0 0.0 0.0 0.0 4.3E 2 0.17 0.17 2.1E 1 te2 0.0 0.0 0.0 0.0 0.0 0.0 8.9E 3 2.5E 3 2.5E 3 2.7E*2 WON YOLAflLES (Fraction of inittet inventory reisesed)
$ro -- 0.0 0.0 0.0 0.0 0.0 0.0 2.8E 5 8.5E 7 8.5E 7 6.6F 5 ;
i Mac2 0.0 0.0 0.0 0.0 0.0 0.0 1.bE 5 . 5.6E 6 5.6E 6 1.8E 5 -l l Ba0 0.0 0.0 0.0 0.0 0.0 0.0 7.iE 5 2.0E.5 2.0E 5 8.0E 5 Lanthanides 0.0 0.0 0.0 0.0 0.0 0.0 1.8E*7 4.6E 8 4.6E 8 3.1E 7 Ce02 0.0 0.f 0.0 0.0 0.0 0.0 1.4E 5 3.2E 7 3.2E 1 2.6E 5 sb 0.0 0.0 0.0 0.0 0.0 0.0 2.2E 2 6.6E 3 6.6E 3 $.0E 2 U/Trans U 0.0 0.0 0.0 0.0 0.0 0.0 2.6E 8 3.0E 8 3.0E 9 7.1E 8 Eelease Category mR ht hR mR ha ht lI !!! Ill III
- TL14 + No release in this sequence. The (vent) at contelrvaent f ailure time irdicates venting option was evallable Lut not used because contairvnent pressure did not reach venting pressure. No release f rdicates venting was not used.
4-112 i
.. - _ _ -_ . . . . . . . - - _ _ - , - - . ~ . _ , __ --_ _ .. ..-. _ _ _ .
CPS INDIVIDUAL PLANT EXAMINATION CONTAINMEMT SOURCE TERM Table 4.7-1 Spurce Term Release Data (Fraction of Inventory Released to Environment)
$(QUthCE 1001 1041 1047 ID49 LB26 LB31 LC01 LC42 A101 Atil Plant Damage State RXXX LXXX LXXX LXXX NXXX MXXX LXXX LXXX ROAE ROAE Reteese kode A0 A0 A0 A0 A0 A0 A0 A0 D4 D4 RPV f ailure fire N/A 1.6MR 1.6HR 1.6 0.9NR 0.87HR 0.89MR 0.89HR W/A N/A
~
C1 Failure Time N/A N/A N/A N/A N/A N/A N/A N/A 2.14HR 2.14HR Nostis 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.20 0.20 votAtitts (f raction of initlet inventory retcased) Col, Rbt 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 2.9t 2 >0.1 te02 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 < 1.0E 3 >0.1 CsoH 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 2.9C 2 >0.1 te2 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 < 1. DC 3 > 0.1 NON VOLAllLES (Fractim of init tet inventory released) tro 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 2.7t 5 >0.1 MaQ2 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.4E 3 >0.1 B n3 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 2.4E 4 >0.1 Lenthentdes 00 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.3( 7 >0.1 Coo 2 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 1.4E T >0.1
$b 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 3.9t 3 >0.1 U/frene U 0.0 0.0 0.0 0.0 0.0 0.0 0.0 <1.0E 3 *0.1 Release Category kt hR he NR NR ha hR hR li Ill 4-113
L CPS INDIVIDUAL PLANT EXAMINATION CONTAINMENT SOURCE TERM Table 4.7-2 Containment Secuence Performance Summary Number of Sequences Resulting in Each Category Containment Status Intact Egil Isolation Failure Vented 14 4 1 1 Release Category
~
No Relean.q Class I Clana II Class III 14 0 2 4 I i 9 4-114 l
l CPS INDIVIDUAL PLANT EXAMINATION CollTAINMENT SOURCE TERM i l CONTAINMENT FAILURE l 4.ir47 sz% hvBI r oE47 ss% A1
)
t scar 10% 'b
"~
ROAE D
~ ' '
s x ce s% a w ee as HOHI , D0 13E47 10% / HCIE 7.0E47 65% C6 /41E47 DS32% cONimuCwT rALUE CONimutNT F ARDE BY PLANT DAMAGE ST. DY FELLASE MODE ROAE w n-cuwv-*w Arwe r" A1 m w c=wr- o HVDI a: m ucuwt-=4.we.""* C6 m m.4 a., w w we cavi u,. ==n CE n- m a canv an =< e" D5 m w a - w r.a c==t u,.. eu e+ HOHI n - m wc=wt.. - e .ac t" D6 w ww we wwt u,.*w s 3E4F 41% ST in i STN
- 0. .fr-
- 7. scar se%
CONTAWMENT FALUFIE BY SOUFCE TEAM ST11 i-inv m .i.n % v l ST !!! in va . n wva l l l FIGURE 4.7-1 4-115
Y
]?
i i i
?
l a TIIIS PAGE INTENTIONALLY . LEFT DLMix f i i 1 P i l I i.
-w...y.-,- , y - , y.,[- s h - h . ,. ..w..~_ei_,,m ,. w. , _.5.y. ,,m ..m[ +%w.r._ ,er ..h,_.-___-,_...._,y .-.wh ,--,,..-,,y,., ,3 -.cw.y..,,,, . _ ,
1 CPS INDIVIDUAL PLANT EXAMINATION PARTICIPATION 5.0 illi1ity PArtigipAtiqAAnd_Ergject _ Reviewm 5.1 LPE Procrag_QIqaniXAtigA The Clinton Power Station IPE program was performed and managed by 1111nois Power Company. The entire IPE team is located at the plant site and the members have been involved in all aspects of
^
Clinton activities. IP Nuc1 car Statie','ingineering is the lead department for the program and all IPE team members are located a in this department. Two team members maintain active qualifications for performing shift duties in the main control room, one a Senior Reactor Operator (SRO) and the other a Shift Technical Advisor (STA). This involvement enhances the ability of the IPE team to remain well informed of actual plant conditions and assures accurate modeling. Licensing and Safety, Clinton Plant Staff, Quality Assurance, and Nuclear Training departments provided support during the study. A second team composed of senior IP personnel performed an independent review of the IPE products. This team was composed of supervisors and a director from the various on-site departments. Most of the review team held SRO licenses at CPS. Similar to the IPE team, all members of the review team are located at the plant site. A management oversight team was also formed with various department managers and a vice-president of IP to review IPE progress and interim product reports. All of these members are also located at the plant site. Consultants were used to augment technical expertise and provide technical advice, training, and review of the interim products. The consultants used were from the Individual Plant Evaluation Partnership (I PEP) which is composed of Tenera, L.P., Fauske ana Associates, and Westinghouse Electric Corporation. These organizations were the primary contractors to the Industry 5-1 _ _. __ _. _~_ _ _ _ . - _ _ _ - . _ _ _ _ _ _ . _ _ . . _ _ _ . _ _ , . . .
CPS INDIVIDUAL PLANT EXAMINATION PARTICIPATION Degraded Core Rulemaking (IDCOR) program and have had extensive experience in risk assessment and perspectives that come only from experience with analysis of many plants. The IPEP provided technical people that were experts in specific aspects of PRA and also provided a Senior Management Support Team to provide technical review of the IPE program products, periodic program direction review and management assistance as requested by the Program Manager. IPEP also provided HRA expertise to assist in I walkdowns, modeling, evaluating, and reviewing HRA aspects of the IPE. Technology transfer from the consultant to IP employees was considered a very important part of the IPE program. All of the major work tasks were performed by the CPS IPE team members. Technology was transferred and experience gained throughout the IPE program. This approach will enable IP to use and enhance the risk assessment tool without external dependency. , The IPE organization chart is presented in Figure 5.1-1. As mentioned earlier, the primary IPE team members have been at CPS since construction and Ltart-up testing. They are listed , below along with a brief deoctiption of their applicable experience: ! P. E. Walberg, Technical Lead, Bachelor of Science degree in ' Mechanical Engineering, 26 years experience in nuclear power in the following areas; nuclear navy, engineering, and licensing and safety. I E. E. Tiedemann, Project Engineer, Bachelor of Science degree in Mechanical Engineering,-active-STA certification, 74-years
-experience in nuclear power in the following areas construction, system engineering, and operations. !
, l i 5-2 l l
- __m.__
i CPS INDIVIDUAL PLANT-EXAMINATION PARTICIPATION C. H. Mathews, Project Engineer, Sachelor of Science degree in Nuclear Engineering, active SRO license, 12 years experience in nuclear power in the following arcast reactor engineering, plant operations, plant startup testing and control room simulation. , M. E. O'Flaherty, Project Engineer, Bachelor of Science degree in Nuclear Engineering, 11 years experience in nuclear power in the following areas; naval prototype operations, nuclear and reactor engineering. A. J. Hable, Project Engineer, Dachelor of Science degree in Mechanical Engineering, 10 years experience in nuclear power in
- the following areas; technical assessment of licensing issues and independent safety engineering group.
R. T. Herentes, Project Manager, Bachelor of Science degree, 20 years experience in nuclear power in the following areas; nuclear navy prototypes, conntruction, start-up, field engineering, and engineering projects. 5.2 E2rupf_gl.tiqn_pf Proiect__faview Tulga As indicated above, Illinois Power has had the primary role in each phase of the IPE, including overall project management, , detailed review of interim products at every step, and critical l l ana3ysis and evaluati,n of all results. The following sections . discuss the various review groups used in support of the 7PE project along with relevant information on the members. Nono of the IP review teams had previous PRA experience, but reviewed the IPE to ensure that it accurately modeled the CPS plant and the way it-is operated. As_the progran developed, IP review team members gained a substantial appreciation for PhA methods.- Tneir l direct involvement in the process is expected to pay significant dividends in any future PRA applications. The consultant team has extensive FRA experience and reviewed the various products L for consistency and adequacy with respect to PRA practices. l 5-3
CPS INDIV!PUAL PLANT EXAMINATION PARTICIPATION 5.2.1 RyjigsA_Enging.gr_1gtylaw The CPS Nuclear Station Engineering organization includes a systsm engineerir.g section. Each plant system is assigned to a systsa engineer. This system " export" maintains a notebook of design t'entures, char 6cturistics, operation, testing, etc. for the coLigned system. Thi: system notobook contains a system descriptior, which incluje9 the following:
- 1) USAR refcRoncoe
- 2) Technical Npoulfication requirements
- 3) Power supply list
- 4) System interlocks
- 5) Drawing, procedure, and equipment lists, and
- 6) Surveillance and maintenanco schedulos and history.
The syrtem description was used as one of the primary sources of modells, information for each system . The system engincor functioned as a consultant to the IPE system modeler to answer questions about design, capability, and function of the systam. He also reviewed each cystem model, including the fault tree and narrativo, in order to ensure that the system was accurately modelod. In order for the system engincors to do this job effectively, they were trained in PRA terminology and methods. Initial training for the system enginocru was conducted by
'Tonora, with subsequent training portormed by tho 1PE technical lead.
Comments generated oy the system ongincors during the course of this review were resolved and changes were made to the model as appropriato. 5-4 i
, _ n,. , . - , . , - - . , . . _ _-
CPS 1NDIVIDUAL PLANT EXAMINATION PARTICIPATION j 5.2.2 IPE Independent Review Team (IIKT) The IPE Independent Review Team (IIRT) is an internal group of experienced IP personnel at the supervisor and director level and
^
is located at the CPS site. The purpose of the team is to review the interim and final products that are listed in Section 2.3.7 l in order to assure accurate representation of CPS design,. operating history, operator response, maintenance and survoillance schedules, and recovery actions in the IPE study. In order co assure independence, none of the IIRT members were involved with producing any of the products reviewed. Training for the IIRT team was conducted at several stages as the IPE progressed and as products were made ready for review. This tr.ining was performed by the IPE Technical Lead with assistance rrom IPEP, and afterward in conjunction with the frequently held IIRT meetings over the two year span of IPE review. The IIRT is composed of six members. The chairman is the Director of Nuclear Safety, four of the other members have CPS SRO licenses, while the cixth member has extensjve maintenance experience. The IIRT members have diverse backgrounds and represent the following departments: operations, engineering, maintenance, licensing and safety, and nuclear training. The position titles , of the members are listed below along with a short summary of their experience. Director of Nuclear Safety (L&S), review team chairman, 20 years experience in BWR engineering and nuclear licensing, Master of
' Science degree in Nuclear Engineering.
Operations Task Coordinator (OPS), licensed SRO, 21 years nuclear navy and operations experience, including shift supervisor. 5-5
_ __ _ . ._ _ _ _ . . _ _ _ _ _ _ _ _ . . _ . . _ . _ _ _ . ___..__-.m.____.-__ - CPS INDIVIDUAL PLANT EXAMINATZON PARTICIPATION Genior Instructor-Training (NTD) , licenned SRO, 27 years ! experience in nuclear navy, operations, and nuclear training. Supervisor of NSSS Systems (NSED), licensed SRO, 14 years nuclear navy, operations, and engineering experience, Bachelor of Science degree in Nuclear Engineering. ' Supervisor of Nuclear Engineering (NSED), licensed SRO, 18 years nuclear fuels and reactor engineering experience, Master of Science degree in Nuclear Engineering. Supervisor C&I Maintenance (Maint), 18 years nuclear navy, CPS start-up, field engineering, and maintenance experience. The diverse background and extensive experience of this review group provided many substantive technical, editorial, and program enhancing comments during the course of the IPE evaluation. F 5.2.3 Senior Manaagment Review Teks (SMRT) The purpose of the Senior Management Review Team (SMRT) is to provide program oversight and to review prccress and results. The SMRT provided assurance that results were reasonable and bases for these results were adequately documented, facilitating future use by IP personnel. Insights developed during the course of the IPE study, including the capability of'the plant to respond to severe accidents, were presented to SMRT. The SMRT is made up of five department managers and is chaired by the Senior Vice-President of the Nuclear Program, see Figure 5.2-
- 1. The department managers involved are the managers of Clinton Power Statior., buclear Station Engineering, Quality Assurance, Licensing and Safety, and Nuclear Training. All SMRT members are located at the plant site.- Training of the SMRT on various aspects of the IPE was provided by the IPE. technical lead during the quarterly meetings.
5-6 t
CPS INDIVIDUAL PLANT EXAMINATION PARTICIPATION l 5.2.4 C9 Mall.tA11t._ LAY 2119RRAt The primo consultant for the Clinton IPE was the Individual Plant Evaluation Partnernhlp (IPEP) , ando up of Tonora, L.P., Fauske and Associaton, Inc. (FAI), and Wootinghouco Electric Corporation. Those organizations woro key contractora for the IDCOR program. As such, they have extensivo experience in PRA methods and applications. The primary intorface betwoon IP and the IPEP was the IPEP project advioor. Ho reported directly to the IP technical lead and norved as the focal point for all interaction betwoon IP and the IPEP. The IPEP had soveral major responsibilition.
- 1) Asulut in correct and consistent implomontation and interpretation of PRA guidance as applied to Clinton. <
- 2) Provide training to the IPE group and assist the technical load with providing training to review groups.
- 3) Provido an IPEP Senior Management Support Team (SMST) consisting of senior IDCOR people to provido a quasi-indopondent review of the CPS IPE. This role helps to provide the IPE with an industry overview parapoctivo.
l l 4) Provido a Human Rollability Assosoment (HRA) oxport to assist the IPE team with that portion of the ovaluation. I The role that the IPEP performed helped to ensure the program was conducted and managed in a mannor that fully natistica the intent of the IPE program, as well as produce an integrated and consistent packago of risk modois for uno-by IP personnel. 5-7
CPS INDIVIDUAL PLANT EXAMINATION PARTICIPATION 5.2.5 Enginey ing_.hysurance Review This review was performed by an on-sito group that reviewed IPE program compliance with applicable instructions and procedures. Documentation techniques were reviewed for interim products, calculations, and updatop to material. I 5.3 Areas of Review and 4. ioraCginagg11 tat The areas of review were previously discussed under the respective review teams in Sections 5.2 and 2.3.7. Primary comments concerned modeling accuracy, additional justification and explanation. 5.4 Eqag.Lution of Comatunta Comments were incorporated into the interim products at each stage of the project, before approval of each respective product. The final reports were more readable and more complete after inclusion of review teams' comments. This will assist the ongoing effort of the IPE as it will be easiar for additional IP personnel to use the results of the IPE study. To summarize, the independent review teams concluded that the study included sufficient information to constituto a thorough study that meets the intent of G.L. 88-20. 5-8
' ' ! !!L ,i' ;itl;, I' ! :> ii' t, L ! ,, fL l.
O HZOH<HUC> ,M>Z8 y s%>gHO% 3 9$ HHOM.n>9H0::2 D
.E t rOS nm eTN /m m ea hN trl a de c nT s .n s
. neae r _
e i t gl eT cT e pw tnie Pm i Ee _
.. 'I Enent l Pn _
ee iisu Pichr Ii _
. di caeF Iarco g nv HMD tuep n
. Ie n oT p E _
. A oS u .
. P L. s.C E C S I 0aS GN .
. s t e _
. r i
. o yrn rp rfo r
. op nft e
. iu ees tr t r
. nS HJl co r e e m u Pes a Ee Sta .e .
. . Eji C if l Pn ne EEA . Pov
. Ii
. P eT ..
. Ird g N . Em QD . . PA C O .
Pe A . n N I
. Ig .J.
. E
. J O T . a r J .
I A . n D . Y T Z .
. a r .
N A I . M O . A N N . . P I A . . M M G . . O A P . C X O . E . A T . w ) E T N .
. e S .
W N E . i PD . O A M P L E . v CEAOS .
. m P G re P SGTC .
la S A . oA V .N NL . sae r 1 i r . . mcT e - I L N ntmre.r.. . Pei Ee 1 O A A enaogrerr .
. I Etnt l Pn N U M . Seeiaegee .
Psnr I O .
. mTnngagg . Ii S
. I yc o g L I M .
Pe eaanaa . L V A .
. Ig SMnann .
Sep Tp n e I I P . a ( aMaa . E r D G . n . u u
. M MM . S g N G .
. a p .
I A . M v . i P . . F s . e . g . t . .
. l r mr s . a e .
r 3e e .
. c b .
e rg r _ ic l ga e na a _ Ee on K he W Pn
. Ii ra cL .
g PM e . . T T E n
. E A P .
s
. m
. De
.I Et s Ss Ny S
Ye i' ' . ,!;'i, ' i} ,i . , 1> ai! +. 3 +
CPS INDIVIDUAL PLANT EMAMINATIOli PARTICEPATIO!! 4 DL Ua E
"~ ."
hh 25 vu w L ts > e4 L O e s: 4 4 L t es u L CD > b Le U T.,,E
.. % 4. m E S*
vL
%o Crm 4. C &4 1
- m as M e L 66 -
Y Au n nm ~ a M Qu J Y Cb v e H
>W m Z <t Ao .
<N
)' ta%h>.. 2 k_ _,H 4 ca N.
s, % MLh 4 O4 - tf3 - a to ---~~ (* * % E %" CE O = uw > 4 ld, ar_~ -c
>b L
t, N
-- 4
_b 13 se O bN O as CL E Ef M h LD ot" -i L' V) O ' ,* H O' t CD CL y ~ t%E t%N L 15
% NN3 H$ . *
- b .w
._J 4 a J LtJ HJ U -
D n I C o m a tm t. (2 e+
*M eL a L
.b
- t. a e Me 4Ob a o
(* sa 3 -
.Oa as u 44&- &
heb - ebo S h ? ,* h ik J aw g Iq w S L C Go C K 44 4 X .W 4 L @w um D ra - O LO- 6 at G r as
** L Q C O L stl C a e L Es >=
e as O (J m na a
- rs,
- mMOM en th C ** (Dm C .E C 4.6 L a @ t L 4
- 4 v ** -@ et G+ C CD Ga -
4 C .O4m e4 O C '3 41 CE CD D D es @ ** mC4 - 42L L C W U1 C > es 3.*** a m -7 3 &- O wW 41 e 3 G 2 (L
.u.e'" U i
CPS INDIVIDUAL PLANT EXAMINATION IMPROVEMENTS 6.0 PLANT IMPRQYEliERTS AND UNIQUE 8AFETY PEATURER 5.1 Introduct(2D The purpose of this section is to present important features of the Clinton Power Station (CPS) design or operating practice that control the progression of core damage accidents and releases of radioactive material from the containment. Also identified are insights gained through performance of the IPE which could reduce or control plant risk. The second section of this chapter (6.2) discusses unique and/or important CPS safety features which are important for understanding the CPS IPE results. The third section of this chapter (6.3) discusses aspects of plant design and operation that arc important for controlling the plant's core damage risk. These features were identified by the relatively high importance measures for their associated basic events. Potential cost-effective changes are identified, where applicable, which could reduce the core damage risk associated with these plant features. However, it should be noted that no vulnerabilities have been identified, and therefore, no immediate changes are required (see Section 3.4.2). The fourth section of this chapter (6.4) discusses aspects of plant design and operation that are important for controlling the release of radioactive material from the containment in a severe accident. These features were ident4fied by the relatively high importance measures for their associated basic events. Potential cost-effective changes are identified, where applicable, which-could reduce the risk of radioactive release associated with these plant features. 6-1
CPS INDIVIDUAL PLANT EXAMINATION IMPROVEMENTS I The fifth section of this chapter (6.5) discusses issues to be addressed in the IPE which were identified by the Nuclear Regulatory Commission (NRC) in their correspondence with Illinois Power. Risk evaluations of these issues are provided as appropriate. The sixth section of this chapter (6.0) discusses some further , improvemonts that can be made to the CPS IPE model that have not been incorporated at the time of this report. 6.2 Uniaue__or ImDortant Bafety Features For Clinton PqygI Statign This section discusses CPS plant features that tend to have a positive effect on plant safety. Those features are not always obvious from a review of the cutsets produced during the quantification of the PnA because the PRA is quantified in " failure space", with the result being a list of combinations of failures (cutsets) that can cause core damage or containment radioactive release. 6.2.1 Eggipptent Independence CPS utilizes three safety-related civisions of core cooling equipment that each have their own emergency diessi generators and cooling water pumps. No division relios on another to the extent that if equipment in one division were to fail it would cause failure of another. Spatial separation of the divisions is such that major mechanical end electrical equipment of each division are located in separate rooms. No internal f;ooding sources were identified that could cause the loss of more than one division. The major things these divisions have in common are an off-site power supply (accounted for in the plant model by the LOOP initiator), the ultimate heat sink, the non-safety plant service 6-2
CPS INDIVIDUAL PLANT EXAMINATION IMPROVEMENTS vater system, the suppression pool, and the reac?or vessel. It is-very unlikely that any of these common factors could cause
' failure of all the safety-related divisions of equipment. These systems do have a similarity in design and components used, the same maintenance personnel, and the same operating personnel. -
These last three are accounted for in the IPE by common cause modeling. Balance of eiTnt (BOP) systems that can provide cooling water to the reactor (Feedwater, Condensate, Condensate Booster, Fire Protection and Control Rod Drive), are independent of the safety-related systems. Thay are located in different areas of the , plant and generally rely on different supportir.7 systems. .They do, however, (with the exception of Fire Protection) rely on the Plant Service Water system and the off-site power supplies which support the safety-related systema as well. The safety-re ated systems do not rely on Plant Service Water or off-sita power supplies exclusively because they can be supplied from the safety-related Shutdown Service Water system and the emergency diesel generators. The results of the CPS IPE support the canclusion that the CPS systems have a high degree of independence. The most likely combination of failures (cutset) leading to core damage l contributes less than 2% of the total core damage risk. If there were a stronger dependence among systems, one would very likely be able to liantify failure combinations that contribute heavily to the risk of core damage. 6.2.2 Feedwater Deliverv Bystem In addition to the two turbine driven reactor feedwater pumps (TDRFP. , CPS has a motor driven reactor feedwater pump (MDRFP). The MP- *P can supply water to the reactor regardless of the availat 11ty of motive steam and the main condenser, which are requiret for operation of the TDRFPs. Thus, the feedwater system l 6-3 l
CPS INDIVIDUAL PLANT EXAMINATION IMPROVEMENTS can provide core cooling water for transients with and without main steam line isolation. These transients account for the large majority of the initiating events the plant is expected to see. The value of the feedwater system as a core cooling system has been borne out by past CPS operating experience. In the approximately four and a half years CPS has been operating, only one instance has occurred in which a system other than feedwater was used for providing makeup water to-the reactor after a reactor shutdown. In this event, in which Main Steam Isolation Valve (MSIV) closure eviatually occurred, feedwater was used initially and was terminated minutes later in order to use RCIC for pressure and level control. The feedwater delivery system remained available and was subsequently put back into service after reactor pressure and level parameters stabilized. 6.2.3 Containment Design CPS has a strong containment design in that it has the largest free air volume and suppression pool volume to rated thermal power of any domestic Mark III containment. These factors allow for a slow:r containment pressurization for a given accident sequence. The pressure retention capability of the CPS containment is estimated to be approximately 94 psig (the pressure at which the containment is estimated to have a 50% chance of failing). See Section 4.4.6 for further details. Few core damage accident seguences exceeded the pressure retention capability of the containment within the 48-hour mission time for ; the containment analysis. j l 6.3 Evaluation of Imoortant Features Affectina Core Damace Risk L An evaluation was performed of the core daraage cutsets to analyze those basic events or independent sub-trees with the highest importance measures. The core damage cutsets are the summation of all the failure sequence cutsets from all the core damage l event trees. Thus, the importance measures for the core damage l l 6-4 j l
l 1 CPS INDIVIDUAL PLANT EXAMZNATION IMPROVEMENTS i i cutsets reflect those featuren which have the greatest effect on the overall core damage risk. In the following discussion,- if a particular plant feature has a much greater effect for a certain initiator or accident class, this will also be noted. Table 6-1 shows the basic events or independent sub-trees with the highest Fussel-Vesely importance measures. Conceptually, the Fussel-Vesely importance measure means that the associated basic event appears in cutsets that constitute a fraction of the total probability equal to the Fussel-Vesely value. (Thus, if the failure probhbility of a basic event with a Fussel-Vesely value of 0.1 can be reducou by a factor of four (75% reduction), a 7.5% reduction in the top evant probability would occur) . The basic events or independent sub-trees with the highest Fussel-Vesely importance measures are good candidates for reliability improvements. The following discussion identifies potentially cost-effective improvements or other actions to be evaluated by CPS as applicable. 6.3.1 Loss of Off-site Power The first two events, YLOOPXXTRX and YL1, are the Loss of Off-site Power (LOOP) initiator and the probability that off-site power will not be recovered in one half hour, respectively. i These events are contained in virtually every class 1B (Station Blackout) cutset. See Table 6-2 for class 1B Fussel-Vesely va ues. These events are also important-to a lesser extent to th; transients. See Table 6-3 for class 1A (High Pressure) Transients. Loss of Off-site Power sequences that did not meet the CPS definition for Station Blackout were classified as transients (class lA or 1D). Tha CPS definition for Station Blackout is a LOOP with both division-) and division 2 diesel generator failures. The LOOP initiator is significant because it makes unavailable all Balance of Plant (BOP) systems, which are powered from-the L 6-5 l .
, ~ . . .-, - . . . _ . . . . ~. . - . .- . . ... .
CPS INDIVIDUAL PLANT EXAMINATION IMPROVEMENTS off-site power supply after a generator trip. At the same time, it increases the likelihood of failure of safety-related systems because they now would depend on only their respective diesel generators for AC power. The LOOP initiator highlights the importance of activities associated with the switchyard and transmission system supplying CPS. Industry experience has demonstrated that the majority of LOOP events are caused by plant centered factors such as switching errors, hardware failures, design deficiencies, and local weather-induced effects. This insight has been provided to the CPS training department, and they are evaluating what changes are appropriate to be made to the training program for emphasizing the care that should be given to activities associated with the off-site power system. The LOOP initiator frequency used for CPS is 8.4E-2 ovents per year and was derived primarily from industry data for different types of LOOP failures that have occurred at other sites. The specifics of the CPS off-site power connections were not taken into account under this derivation. Data from NSAC (Nuclear Safety Analysis Center) 182, " Losses of Cff-Site Power at U.S. Nuclear Power Plants Through 1991", indicates that the industry hverage frequency for LOOP is approximately 0.03-0.04 events per unit year. Some of this difference can be accounted for by the difference in reporting the data on the basis of site years versus unit years. NSAC 182 uses the per unit basis because there have been few instances in which both units at a double unit site have lost off-site power at the same time. In aliy case, the strong off-site power supply design utilized at CPS makes the 8.4E-2 value conservative. 6.3.2 High Pressure Core Borav Failures The next two events, HISTINJECT and BISTHPINJR, are an independent sub-tree composed primarily of High Pressure Core 'f 6-6
CPS INDIVIDUAL PLANT EXAMINATION IMPROVEMENTS' Spray (HPCS)_ hardware failures and a basic event representing , recovery of HPCS failures. The HPCS system is important because it is a high pressure vessel inventory makeup system that is capable of responding to any initiating event. The HPCS system is not susceptible to the failures that can disable the BOP equipment (e.g. LOOP, loss of plant service water, and loss of BOP DC power). The basic events composing independent sub-tree HISTINJECT were reviewed to see if any cost-effective reliability improvements could be identified. Basic event HPXF314XVP, SUPPRESSION POOL SUCTION ISOLATION VALVE OBSTRUCTED, was identified as a candidata for improvement. Valve 1E22F314 is on the HPCS pump suction line from the suppression pool. Because there is no requirement to test the suction supply from the suppression pool in any normally scheduled surveillance run of the HPCS pump, it is possible tb^t obstructions of.the auction isolation valve or line could go undetected for the remaining life of the plant. Therefore, because of the failure model used, obstruction of the auction isolation valve had a relatively large estimated failure rate. To correct this situation, CPS could modify the surveillance procedure for HPCS to periodically test the suction line from the suppression pool. For example, testing this suction line flow path at an interval of once per four years would result in an estimated 12.8% reduction in overall core damage risk. A proposed procedure change to provide for periodic testing of the
~
HPCS suppression pool suction flow path has been provided to CPS plant staff, and they are evaluating it in their overall program for procedure maintenance. 6.3.3 Rgesigr Core Isolation _Cooline railures The next two events, IISTINJECT and BISTRIINJR, are an independent sub-tree composed primarily of Reactor Core Isolation Cooling'(RCIC) hardware failures and a basic event representing recovery of RCIC failures. Like HPCS, RCIC is important because 6-7
CPS INDIVIDUAL PLANT EXAMINATION IMPROVEMENTS
. it- is a high pressure vessel inventory makeup system that can provide water to the reactor even when conditions that can impair BOP equipment occur. Like HPCS, it does not rely on reactor depressurization for operation.
RCIC has a higher importance than HPCS in Station Blackout (SBO) sequences because, unlike HPCS, it does not have an immediate dependency on AC power or service water. HPCS relies on the division 3 diesel generator and Shutdown Service Water under LOOP conditions. These division 3 support systems also have some common cause failure potential with divisions 1 and 2 (divisions 1 and 2 must have failed for an SBO to occur), which RCIC does not. RCIC does nave long-term dependencies on AC power (e.g. RCIC room cooling, Suppression Pool cooling and power for the battery chargers), but because of the generally favorable prospects of AC power recovery over the time which RCIC would be able to run without AC power, this dependency is less significant. 6.3.4 peoressurization Failureg The seventh and twelfth events, CADSHANSYW and GISTADSHDW, are respectively, a basic event representing operator failure to manually depressurize the reactor and an independent sub-tree representing a group of Automatic Depressurization System (ADS) hardware failures. These events are important because, in the current plant PRA model, either one of these failures can render low pressure injection systems (i.e. Low Pressure Core Spray, Low Pressure Coolant Injection, Condensate Booster, Condensate, and even Fire Protection) unavailable for the large majority of initiating events. Consequently these two events appear in cutsets composing 93% of the class lA (high pressure transients) probability. 6-8
- - . . . . ~ . - . - - - . = .- -
CPS INDIVIDUAL PLANT EXAMINATION ZMPROVEMENTS Basic event GADSMANSYW, OPERATOR FAILS TO MANUALLY INITIATE ADS, has a high Fussel-Vesely importance measure even though it has a low failure probability (5E-4). The need for a manual depressurization is caused by the Emergency Operating Procedures (EOPs) that direct ADS to be inhibited for virtually all scenarios. As a result, when low pressure systems are needed, ADS needs to be manually initiated. Without being inhibited, ADS would be truly automatic. The failure probability for GADSMANSYW was determined through a detailed Human Reliability Assessment (HRA) of this activity (See Section 3.3.3 of this report for a discussion of the HRA methods). Manual initiation of ADS has a low failure rate because: It is proceduralized, It is a simple operator action, Operators are well trained on the performance of initiating ADS, and Operators understand the relationship of reactor pressure and injection capabilities of low pressure systems. 1 The technical bases for the EOPs provide justification for inhibiting the automatic initiation of ADS, and CPS does not intend to modify this aspect of the EOPs at the present time. Although this operator action has a low estimated failure rate, this is an operator action that deserves attention because an increase in the failure rate of this activity could cause a large increase in the risk of core damage. GADSMANSYW has a relatively high Achievement Worth of 480. The Achievement Worth importance measure is the factor by which the risk (in this case, risk of core damage) would increase if the basic event had a failure probability of 1 (failed on every occasion). Because this is a crucial operator action for which the failure probability needs to be maintained low, the importance of this action has been emphasized to the CPS training department, and they are 6-9
. .. . . .. - . .- -- - - ._ - - ~ - . - - - - .- CPS INDIVIDUAL PLANT EXAMINATION IMPROVEMENTS evaluating whether any changes are appropriate to be made to the training programs to continue this emphasis. GISTADSHDW represents a group of independent hardware failures associated with ADS. In the existing CPS PRA, the importance of ADS hardware failures is somewhat overstated because ADS was the only means of depressurization modeled, when in fact, there are other means available. For example, in situations in which the main condenser is available (which it would be under most transients) the reactor could be depressurized using the reactor pressure regulator which controls the turbine bypass valves. Alternately, the Turbine Driven Reactor Feedpumps (TDRFPs) could be run until they deplete sufficient steam pressure to allow the Condensate Booster system to supply the reactor without the feedwater pumps. (The TDRFPs have not been modeled as a high pressure makeup system for most scenarios because it is unclear whether the steam production rate of the reactor under decay heat conditions would produce sufficient steam to allow operation of the TDRFPs for the assumed 24-hour mission time.) The first of these methods (use of the pressure regulator) is far more typical of the way the reactor is depressurized during a normal shutdown of the plant. It is estimated that approximately a 3% reduction in calculated core damage risk could be obtained through the addition to the plant model of the pressure regulator as a means of depressurization. 6.3.5 Transient Initiatore The eighth and ninth events, YTRANSYTRX AND YTRANISTRX, are the transient without isolation and transient with isolation initiators, respectively. These are important because of the high frequency.of the initiators, 4.7 and 1.7 events per year, respectively. These are by far the most likely of all CPS initiating events. They emphasize the importance of reliable plant operation, not only in achieving the company's economic goals, but in improving plant safety as well. These initiating 6-10
CPS INDIVIDUAL PLANT EXAMINATION IMPROVEMENTS event frequencies are based on genoric industry data because of the relatively short operating experience of CPS (approximately five years). Although there have been wide variations in performance, CPS has generally seen an improving trend (i.e. a reduction in these transient frequencies) in recent years. 6.3.6 Failures of the Fire Protection System as a Core Coolinc System The Fire Protection (FP) system has been modeled as a long-term core cooling system for low pressure transient sequences in which some other core cooling system runs for a period of time. Low reactor vessel pressure is required because the fire protection system pumps are low pressure pumps. Another system is required to run for a period of time because use of the fire protection system requires removal of the internals from a check valve to allow fire protection water to be supplied to the Plant Service Water system from which it can be directed to the reactor. Long-term-type failures for which the Fire Protection system was used for recovery include failures such as loss of room cooling, or failures of RCIC because of the failure of suppression pool cooling. The importance of the Fire Protection system in low pressure transient sequences indicates that a large fraction of the low pressure core damage failure sequences involve these delayed failures. The importance of the FP system in these sequences is somewhat overstated; first, because these sequences are based on the assumption that lose of room cooling will necessarily cause failure of the equipment in the room being cooled, and second, because the FP system has been assumed to be the primary means of recovery for these failures. CPS utilizes individual ECCS and RCIC pump rooms each with their own room cooler supplied with cooling water from Shutdown Service Water. While this arrangement provides good separation between divisions and provides protection against flooding failures, it results in 6-11
CPS INDIVIDUAL PLANT EXAMINATION IMPROVEMENTS areas that are not as readily cooled through natural heat transfer mechanisms as are some of the more "open" designs. The equipment located in these rooms has been environmentally qualified for high temperatures because of design basis conditions such as Loss of Coolant Accidents and High Energy Line Breaks. The room temperature rise expected to occur as a result of loss of room cooling with the associated ECCS pump running is estimated to exceed the environmental qualification envelope of the room only after a number of hours. Therefore, without performing further analysis, the equipment in these rooms was assumed to fail. This approach is somewhat conservative in that exceeding the equipment qualification envelope will not necessarily cause failure of the equipment. Because, at minimum, several hours are available before equipment in these rooms would fall, sufficient time would be available to make fire protection water available to the reactor. This period of time could also be used to address the room temperature problem directly by fixing the source of the room cooling problems or by propping doors open and using temporary fans. The Fire Protection system's strength as a core cooling system is that it has few operational dependencies on other systems. Its operational dependenclos are limited to the piping and valves from other systems that are used to transport fire protection water to the reactor. Usefulness of the Fire Protection system as a core cooling system is diminished by the fact that it is a low pressure system, and therefore, relies on reactor depressurization and by the time it takes to align it to supply water to the reactor. For example, the Fire Protection system has minimal value in Station Blackout sequences because the ADS. SRVs will likely reclose after the batteries that support the ADS SRVs are depleted (see section 6.5.4.2). After the SRVs reclose,. the reactor would repressurize making Fire Protection injection unavailable. 6-12 (
i CPS INDIVIDUAL PLANT EXAMINATION IMPROVEMENTS To make the' Fire Protection' system more useful:as a core cooling system, a change to the piping could be made. Currently, to use Lthe Fire Protection system as a core cooling system, the-internals of check valve 1FP036 (a 12" check valve) have to be removed and the valva reassembled so that backflow can-occur from - the FP system into the Plant Service Water (WS) system. The check valve is installed such that WS is capable of fibwing into the FP system from WS but not in the opposite' direction. A bypass line could be installed around check valve 1FP036 with a normally closed valve in it. Then, if the FP system were required as a core cooling system, the bypass valve could be opened instead of performing tne time-consuming task of removing the check valve internals. This would have two effects in reducing the core damage risk. First, it would dramatically. reduce the amount of time required to align the FP system for injection into the reactor. This may make the FP system available for all low pressure sequences, because it is possible-that the FP system could be aligned in time to prevent core damage with no other injection systems available.- Second, it would make the alignment process more reliable (lesa failure prone) because opening a valve is much simpler than removing the internals from a check valve. L The reduction in core damage risk from such a change is estimated I as follows. If the failure rate for establishing flow from the Fire Protection system to the Plant. Service Water system can be reduced by a factor of two (from 0.5 to 0.25)-by installation of the check valve bypass line, this would result in approximately a-6% reduction in the risk of core damage. If, in addition to this reliability improvement, the FP system is applied to all low . L pressure sequences (i.e. to both short-term and long-term failures of other makeup systems), the core damage-risk would be reduced by a total (from both effects) of approximately 13%. To take credit for the FP system in instances in which the other reactor coolant makeup systems fail immediately would take a change in operating procedures and training. The plant operators 6-13 .
. __. _ ~ ___ . _ _ _ _ . .
_ _ _ - . - - _ .. - . - - . - .- - - - - . = . - . . . . . . . - CPS INDIVIDUAL PLANT EXAMINATION IMPROVEMENTS will very likely apply their efforts first to recovering some of the multiple equipment failures that would have occurred, rather than aligning the FP system for injection into the reactor. Thus, even though the operators could have aligned the FP system in time fo reactor injection if they had begun from the onset of the loss of reactor coolant makeup, any delays associated with other rec)very activities could make the availability of Fire Protection water too late to prevent core damage. To make Fire Protection available as a short-term cooling source would require procedure and training changes that would instill the operating philosophy of aligning the FP system 2mmediately for injection into the reactor when the lose of injection occurred. CPS will consider this hardware char.ge as a possible future improvement in the plant design. However, this evaluation will be held in abeyance until completion of the Individual Plant Examination for External Events (IPEEE) and development of the Severe Accident Management Plan. 6.3.7 Power Recovers Failures Under LOOP Co_ndiliana A number of power recovery basic events were used it. the CPS IPE (YDG2R04DGH is associated with recovering the division 2 diesel generator within four hours.). Some of these events are diesel generator recoveries, some are recoveries of off-site power, and some involve both. They accopnt for the increasing likelihood of recovering these power sources over time. These recovery events are sequence dependent and, in general, are conditional.on the other power recovery events contained in a given cutset. Collectively, they are responsible for a large reduction in the core damage risk due to Station Blackout. The power recovery factors were determined from empirical industry data regarding recovery of off-site power and electrical power systems. The risk reduction these power recovery factors provide shows the significance of these power recovery headings. 6-14 L ._
CPS INDIVIDUAL PLANT EXAMINATION IMPROVEMENTS Although the results of the IPE are not detailed enough to indicate which specific failures are most likely to occur, it would appear that a strong understanding of diesel generator and auxiliary power system operation would provide operations and maintenance personnel with the best opportunity for power recovery. The CPS Nuclear Training department has been made aware of this insight, and they are evaluating what changes are appropriate to be made to the training programs for diesel generator and auxiliary power system operation and maintenance. 6.3.8 HJLu_tdown Service Water 8tartina Faiblien Support system failures can contribute significantly to core damage sequences because they can disable several trains of core cooling systems. Therefore, fewer total independent failures would need to occur in order to cause core damage, and the resultant core damage cutnets tend to have higher probability. In addition to AC power systems discussed in some of the sections above, service water systems have also shown up as significant support systems. A typical combination of tallures would be an initiating event (e.g. LOOP) that causes failure of Plant Service Water, which is a non-safety system, followed by a combination of
~
failures that disable the Shutdown Service Water system (SX). One of the leading failure modes for the SX System in the CPS IPE is the failure of SX pumps to start when required. The three SX pumps receive start signals when IOCA conditions exist (high drywell pressure or low reactor water level) or when the associated SX header pressure switches sense low header pressure. Because scenarios exist which may not result in the generation of a LOCA signal until significantly af ter the initiating event, the LOCA start signals were not modeled. The low header pressure signals were modeled because these provide a direct indication of the need for an SX pump start. Failure of the SX pump start on low header pressure was evaluated as being significant (especially common cause failures of the header pressure , 6-15 l _ _. J
l l CPS INDIVIDUAL PLANT EXAMINATION IMPROVEMENTS instruments). Basic event BSXMANSTRT represents an operator action to recover from a failed SX discharge pressure instrument or instruments by manually starting the associated SX pump or pumps. The probability value used for BSXMANSTRT is 0.5 which is a Human Reliability Assessment screening value. To improve the likelihood of successfully responding to a failure of SX automatic initiation, the procedures that would be used to identify and respond to SX initiation failures were reviewed. - CPS procedure 3506.01, " Diesel Generator And Support Systems", was identified as a procedure in which improvement could be made. The diesel generators are particularly critical components in that they would fail within a short period ^of time without cooling water flow available because of their relatively high heat loads. CPS procedure 3506.01 already includes a provision to send an area. operator to the diesel generator room anytime a manual or automatic initiation of any of the diesels occurs. The area operator's presence in the room should be sufficient to detect a lack of cooling water supply to the diesel. To improve the likelihood that SX initiations will occur in time to prevent damage to the diesel generator, a proposed procedure change to
~
confirm that the SX pump han started when required has been provided to CPS plant staff, and they are evaluating it in their overall program for procedure maintenance. For non-LOOP sequences, the time available to detect a lack of SX flow would generally be much longer because the failures-associated with loss of room cooling would take longer to occur. Given the time available until failures would be expected to occur, the likelihood of detection in time to prevent equipment failures due to lack of room cooling is high. 6-16
\ .. .
CPS INDIVIDUAL PLANT EXAMINATION IMPROVEMENTS 6.4 Evaluation of ImDortant Features Affectinc Risk _21 Radioactive Release From the Containment l An evaluation was performed on the containment failure cutsets to analyze those bas.in events or independent sub-treco with the highest importance laeasures. Table 6-4 shows the basic events or independent sub-trees with the highest Fussel-Vesely values for the containment failure cutsets. These are the items that contribute most significantly to the containment radioactive release risk. The containment failure cutsets are the summation ; of all the containment failure sequence cutsets from all the containment failure event trees. Thus, the importance measures for the containment failure cutsets reflect those features which have the greatest effect on the overall containment radioactive release risk. 6.4.1 Loss of Off-site Power The Loss of Off-site Power (LOOP) initiator YLOOPXXTRX is the j dominant initiator leading to radioactive release from the ! containment. Event YL1 represents the probability that off-site power will not be recovered within 0.5 hours given that a LOOP has occurred. Station Blackout sequences, which originate from the LOOP initiator, can impair the containment isolation function ! because there are containment isolation valves that would fail l open under loss of power conditions. Containment isolation l valves would have to be manually isolated to ensure that a radioactive release from the containment would not occur. Because manually isolating valves that would not close 1 l automatically would involve local manual actions by area operators, this action has a high assumed failure rate. Other initiators have proven to be much less important because, with AC l power available, the likelihood of a successful containment isolation is fairly high. Once containment isolation has occurred, containment failure is required for a radioactive release. Because of the robust containment design at CPS, decay 6-17
CPS INDIVIDUAL PLANT EXAMINATION IMPROVEMENTS heat power levels alone will be insufficient to cause failure of l the containment due to overpressurization within the period 1
' covered by the containment analysis (48 hours after event i initiation). Under certain conditions, a hydrogen burn could cause a sufficient containment pressure rise to cause containment failure, but under non-Station Blackout conditions the hydrogen ignitors would generally be available to prevent the containment hydrogen concentration from reaching a level at which containment failure could occur due to a hydrogen burn.
The importance of the LOOP initiator to the occurrence of containment radioactive release reemphasizes the benafit of maintaining the exposuro to loss of off-site power events low. Care should be given to the performance of' activities involving the switchyard or the plant connection to the off-site power system. As mentioned above in Section 6.3.1, this insight has been transmitted to the CPS Nuclear Training department for emphasis to the plant operators. 6.4.2 Recovery of AC Power There are a number of basic events appearing in the conteinment failure cutsets that represent recovery of AC power sources after a specified period of time. The containment analysis used more of these power recoveries than did the core damage study because, in addition to the events that represent power recovery in time J to prevent core damage, the containment study also included events representing power recovery in time to protect radioactive release barriers once fuel damage has occurred (e.g., power recovery in time to prevent reactor vessel breach) . Some events involve recovery of off-site power, some represent recovery of l emergency diesel generators, and some represent both. In general, the recovery events are conditional on failure of previous recovery events. CollectivelyLthese power recovery events are important in preventing the release of radioactive materials from the containment. This is to be expected because 6-18 \
CPS INDIVIDUAL PLANT EXAMINATION IMPROVEMENTS , they are associated with SBO events which, as previously noted, are the leading risk contributor to radioactive release at' CPS. The recovery events show that, in addition to being able to prevent a Loss of Off-site Power or Station Blackout in the first place, the ability to recover power within a reasonable time period is also important. To provide the best opportunity for power recovery, a strong unde.rstanding of AC power system and diesel generator system operation would be beneficial. The CPS Nuclear Training department has been made aware of this insight, as meu loned in Section 6.3.7. 6.4.3 Failure to Isolate the Containment Under Station Blackout Conditions BNOSBOISOL is a recovery event representing the operato; actions to manually complete a containment isolation under Station Blackout (SBO) conditions. Many of the key containment isolation valves are closed during power operation. Others are air operated and fail closed upon loss of off-site power (e.g., the main steam isolation valves and the Containment Continuous Purge system isolation valves). Other containment penetrations involve closed piping systems through which radioactive material could i not pass unless a breach in the piping occurred. After these containment release paths are eliminated from consideration, only one release path remains. A containment release flow path would - exist in the Fuel Pool Cooling and Cleanup (FC) line that returns ' overflow water from the upper containment pools to the surge tanks which are located outside of the containment. This containment release path could be isolated by manually closing valve 1FC008 (a 10" gate valve), which is located in the Fuel Building. BNOSBOISOL represents the probability that-the operators will fail to isolate this containment release path in time to prevent a release of radioactive material frem the containment under SBO conditions. BNOSBOISOL has been assigned a failure probability of 0.4, which is an HRA screening value. 6-19
-CPS INDIVIDUAL PLANT EXAMINATIOM - IMPROVEMENTS This activity is covered in the Loss of AC Power procedure which directs that appropriate containment isolation valves be manually positioned as required. Valve 1FC008 is included in the list of containment isolation valves in this procedure. Time would generally be available for performing these manual isolations becauce about two hours elapse before significant amounts of radioactive material are released into the containment atmosphere. The key nature of valve 1FC008 for containment isolation in event of station blackout has been emphasized to the CPS training department, and they are evaluating what changes are appropriate te be made to the training programs concerning station blackout.
6.4.4 High Pressure Core BDrav and Reactor Core Isolation Coolina Failure 2 HPCS and RCIC failures are important failures associated with Station Blackout (See Table 6-2). Because SBO sequences are the dominant contributors to containment failures, HPCS and RCIC failures also show up as being important in preventing containment radioactive release. See the discussion on HPCS and RCIC failures in Section 6.3. 6.4.5 8 CRAM Hardware Failures Although Anticipated Transient Without SCRAM (ATWS) sequences contribute relatively little to the overall core damage risk, they are noticeable contributors to the risk of a radioactive release from the containment. Essentially, the containment systems are much better at responding to other sequences such that SBO and A*WS sequences are the primary core damage sequences left that contribute to a containment radioact;ve release. ATWS sequences appear in the containment failure cutsets because of the large amount of energy that can be produced by a reactor that has not been shutdown. If the main condenser heat sink 6-20 l - - -
CPS INDIVIDUAL PIANT EXAMINATION IMPROVEMENTS -becomes_ unavailable during ATWS sequences, this energy is . released to-the containment in the form of steam. Under these conditions, it has been assumed that containment heat removal systems would be inadequate to prevent containment heatup and pressurization (e.g., even both trains of suppression pool cooling together were assumed to be inadequate to remove the heat generated from an ATWS event witt loss of the main condenser) . With this large power input into the containment, the temperature of the suppression pool would increase and containment failure due to overpressurization would occur before the 48 hours assumed as the mission time for the containment analysis. An examination of the ATWS containment failure cutsets reveals the following general combinations of events that cause containment failure. A transient initiator with SCRAM hardware failures, failure of Standby Liquid control, and failures that impair the Feedwater/ Main Condenser combination. The Feedwater/ Main Condenser combination can remove energy from the containment at a sufficient rate to prevent safety relici valves from opening and the containment from being over-pressurized even if the reactor can not be shut down. SCRAM hardware failures (e.g. failures of the SCRAM discharge volume) are the primary means whereby an ATWS can occur. SCRAM initiation failures are less likely because multiple means of SCRAM initiation exist. Maintaining a highly reliable SCRAM
^
system is a good defense against ATWS cconarios. Care should be exercised in the maintenance and operation of SCRAM equipment, and any design changes to this equipment should be carefully reviewed for possible reductions in the reliability of this equipment. The impact of SCRAM system failures has been emphasized to the CPS training department, and they are evaluating what changes are appropriate to be made to the training programs concerning SCRAM hardware. 6-21
m CPS INDIVIDUAL PLANT. EXAMINATION IMPROVEMENTS 6.5 Additional Risk Evaluations Sections 6.3 and 6.4 discussed plant features which significantly affect the plant's risk as evidenced by the Fu. sol-Vesely importance measures for the ascociated basic events or indeper. dent sub-trees. This section discusses the safety significance of some other aspects of CPS that were evaluated in the process of performing the IPE. These issues were raised in various supplements to Generic Letter 88-20 or other correspondence from the NRC. 6.5.1 Preventive Maintenance Qptace Time Preventive maintenance outage basic events individually have relatively low Fussel-Vesely values such that they do not appear in the list of basic events with leading Fussel-Vesely values contained in Table 6-1. There are, however, a number of preventive maintenance events, so they collectively could be significant. CPS utilizes a 12-week rolling schedule for performing many preventive maintenance tasks. An evaluation was performed of the impact of the system outage times associated with the 12-week rolling schedule on the core damage probability. The results of this study show that even if the duration of out-of-service time for preventive maintenance for systems in the 12-week rolling schedule were reduced by a factor of two, the core damage probability would decrease by less than 5%. This analysis was simplified in that it neglected the increase in corrective m-intenance and random failure probability due to this reduction in preventive maintenance. Therefore, this estimated reduction in core damage probability is considered conservative. CPS concluded that the concept of the 12-weck rolling maintenance schedule is not a significant safety issue. 6-22 h- - .;
. . . ~ . . -- .~. - --, - . -
1 L CPS INDIVIDUAL PLANT EXAMINATION IMPROVEMENTS
-6.5.2 Adequacy'of Dafety-Relate 4_pc Power Suoplies 1 Generic Letter _91-06-requested inforLation concerning_ design and maintenance practices for DC power supplies (Unresc1ved Safety Issue A-30).- Illinois Power letter U-601899, dated October 28, -
1991, provided the CPS response to this requent with justification for the CPS design. In addition, the results of the IPE show that all DC failures, including equipment failures (e.g. breakers, batteries, and chargers), operator errors and maintenance ut. availabilities contribute to cutsets composing approximately S% of.the total core damage frequency. Therefore, no weakness in the CPS DC power supplies is evident. 6.5.3 Rydrocen Control Measures and Effects of Hydrocen Burns on Safety EcuiDment As part of-the closure in Unresolved Safety Issue A-48,_the NRC requested in NUREG 1417, " Safety Evaluation Report Related to Hydrogen Control Owners Group Assessment of Mark III containments", that licensees consider the evaluation of an alternate power supply for the hydrogen ignition system as part . of the IPE. Although the frequency of severe accident sequences leading to containment failure at CPS is very low,= it could be lowered further by installation of a backup power supply to the-ignitors. Sequences TL51, TL52 and TL531from Figure :4.5-e, which are now release sequences, could be eliminated as containment ~ failure sequences if the ignitors were continuously energized. This could result in a reduction of the containment release frequency from 1.2BE-6 to 8.76E-7, assuming a 90% availability of the alternate power source. Under the same assumptions, it would reduce-the frequency of a large release (class-III) from 7.52E-7 l
.tol7.4E-7.- However, the current large release frequency is below the NRC safety goal of less than 1E-6; therefore, CPS concluded that alternate ignitor power supplies are not justified.
6-23
CPS 2NDIVIDUAL PLANT EXAMINATION IMPROVEMENTS-6.5.4 E9AIAiDment ImpIg.y3mgRig Supplement 3 to Generic Letter 88-20 requested utilities with Mark III containments to evaluate backup power to the hydrogen ignitors; evaluate Mark I improvements from supplement 1 of Generic Letter 88-20; and evaluate containment heat removal as specified for Mark II containments. Each of these is discussed below. 6.5.4.1 Hydrocen Ionitor Backup _ Power The impact of backup power to hydrogen ignitors was previous; discussed in section 6.5.3. 6.5.4.2 Mark I Improvements Enclosure 2 to supplement 1 to Generic Letter 88-20 listed the following improvements to be considered in the IPEs. IMPROVEMEHI STATUS (a) Alternate Water Supply The Fire Protection System as defined in CPS procedures was included in the IPE. (See Section 6.3.6) (b) Enhanced Depressurization The backup air supply for Rollability the Automatic Depressurization System (ADS) hao been included in the IPE models. No backup currently exists for depletion of batteries for the ADS function.- Such a backup could reduce the frequency of sequence TLU1L4DG1DG2 on Figure 3.1-8 by approximately a factor of 2, reducing the core damage frequency of Station Blackout sequences by about 25% and overall core damage fregv :ncy by about 10%. Changes to extend the duration of the pc 2r supply for the ADS Safe'.y Relief Valves may 6-24
l CPS INDIVIDUAL PLANT EXAMINATION' IMPROVEMENTS ! be considered as part of the Severe Accident Management Plan. (c) Emergency Procedures CPS has fully implemented and Training Revision 4 to the BWR Emergency Procedure Guidelines ~ and this is reflected in the IPE. 6.5.4.3 Mark II containment Heat Removal Analysis discussed in section 3 demonstrated that adequate containment heat removal is not a significant factor in the CPS IPE except in ATWS scenarios. Venting and suppression pool cooling, although directed by Emergency Operating Procedures, have not been demonstrated as being effective in preventing containment failure for ATWS scenarios. As a result, credit for these was not taken in the IPE analysis. Despite this, the CPS containment failure probability is relatively low. 6.6 Model Improvements Some potential modeling improvements have been identified too late to be included in this report. Some of these would eliminate unnecessary conservatism in the results, while other improvements would make the models more accurate for future applications but are not expected to significantly change the results. Some of these have already been discussed in sections 6.3 and 6.4. However, two others are noteworthy. . 6.6.1 Diesel Recovery Pailutep. Some double counting of diesel recovery failures was detected in the IPE results (i.e., there are some cutsets that are illogical and could be eliminated). Elimination of the double counting could reduce the frequency of sequence TLUlL4DGlDG2 from 4.59E-6 to 3.9E-6, reducing the Station Blackout core damage frequency by about 7% and overall core damage frequency by about 3%. 6-25
CPS INDIVIDUAL PLANT EXAMINATION- IMPROVEMENTS 6.6.2- Manual Initiation of BuoDression Pool Coolinc Section 3.3.3.1.8 identified the importance of manual initiation of suppression pool cooling to the success of long-term RCIC operation. The Huma'.- Reliability Assessment (HRA) screening value assigned to this action is felt to be very conservative. It is expected that a detailed HRA would reduce itr frequency by about an order of magnitude. This would affect several sequences and it is expected that overall core damage frequency could be reduced by a'.,ut 4 percent. 6.6.3 Other ImDrovements Other potential modeling improvements would aid in future applications of the IPE, but would not likely have significant impact on overall core damage frequency or radioactivity release. 1 I I f l l l L 6-26 [
CPS YNDIVIDUAL PLANT EXAMINATION IMPROVEMENTS-Table 6-1 dasic Events or Independent Sub-trees With Highest Fussel-Vesely Importance Measures for the Core D.amage Cutsets , Basic Event Fussel- Probability Basic Event or or IST Vesely or Independent Sub-tree Desianator Value Frecuencv* Descriotion YL1 5.01E-1 4.21E-1 FAILURE TO RECOVER OFF-SITE POWER IN 0.5 HOURS YLOOPXXTRX 5.00E-1 8.4E-2/yr LOSS OF OFF-SITE POWER INITIATOR HISTINJECT 4.15E-1 5.00E-2 INDEPENDENT SUB-TREE CONSISTING OF HPCS FAILURE BASIC EVENTS BISTHPINJR 4.15E-1 7.18E-1 BASIC EVENT REPRESENTING RECOVERY OF HPCS FAIUURES IN HISTINJECT IISTINJECT 2.88E-1 5.46E-2 INDEPENDENT SUB-TREE CONSISTING OF RCIC FAILURE BASIC EVENTS BISTRIINJR 2.88E-1 7.56E-1 BASIC EVENT REPRESENTING RECOVERY OF RCIC FAILURES IN IISTINJECT GADSMANSYW 2.41E-1 5.00E-4 OPERATOR FAILS TO MANUALLY INITIATE ADS YTRANSYTRX 1.85E-1 4.70E+0/yr TRANSIENT WITHOUT ISOLATION INITIATOR YTRANISTRX 1.60E-1 1.70E+0/yr TRANSIENT WITH ISOLATION INITIATOR EISTFIREPR 1.30E-1 5.06E-1 INDEPENDENT SUB-TREE CONSISTING OF FIRE PROTECTION SYSTEM (AS A CORE . COOLING SYSTEM) FAILURES YDG2R04DGH 1.29E-1 8.00E-1 FAILURE TO RECOVER THE DIVISION 2 DIESEL WITHIN FIRST 4 HOURS OF: STATION BLACKOUT GISTADSHDW 1.05E-1 3.63E-4 INDEPENDENT SUB-TREE CONSISTING OF ADS HARDWARE FAILURES BSXMANSTRT 1.01E-1 5.00E-1 BASIC EVENT REPRESENTING RECOVERY FROM SHUTDOWN SERVICE WATER (SX) AUTOMATIC INITIATION FAILURES BY MANUAL INITIATION OF SX
- All initiating events have units of 1/yr, all other events are unitless.
6-27
l CPS INDIVIDUAL PLANT EXAMINATION IMPROVEMENTS Table 6-2 , Basic Events or Independent Sub-trees With Highest Fussel-Vesely Importance Measures for the Class 1B (Station Blackout) Co*e Damace Cutsets Basic Event Fussel- Probability Basic Event or or IST Vesely or Independent Sub-tree Desicnator Value Frecuencv* Description YL1 1.00E+0 4.21E-1 FAILURE TO RECOVER OFF-SITE POWER - IN 0.5 HOURS YLOOPXXTRX 9.99E-1 8.4E-2/yr LOSS OF OFF-SITE POWER INITIATOR IISTINJECT 4.05E-1 5.46E-2 INDEPENDENT SUB-TREE CONSISTING OF RCIC FAILURE BASIC EVENTS BISTRIINJR 4.05E-1 7.56E-1 BASIC EVENT REPRESENTING RECOVERY OF RCIC FAILURES IN IISTINJECT YDG2R04DGH 3.46E-1 8.00E-1 FAILURE TO RECOVER THE DIVISION 2 DIESEL WITHIN FIRST 4 HOURS OF STATION BLACKOUT / YDG1R04DGH 2.58E-1 8.00E-1 FAILURE TO RECOVER THE DIVISION 1 DIESEL WITHIN FIRST 4 HOURS OF STATION BLACKOUT YOSOTO4SWH 2.58E-1 4.50E-2 FAILURE TO RECOVER OFF-SITE POWER WITHIN FIRST 4 HOURS OF STATION BLACKOUT (CONDITIONAL TO FAILURE TO RECOVER WITHIN O.5 HOURS) HISTINJECT 2.17E-1 5.00E-2 INDEPENDENT SUB-TREE CONSISTING OF HPCS FAILURE BASIC EVENTS BISTHPINJR 2.17E-1 7.18E-1 BASIC EVENT REPRESENTING RECOVERY OF HPCS FAILURES IN HISTINJECT YDCLOADSWH 2.10E-1 2.98E-2 FAILURE TO SHED DC LOADS TO PROLONG DIVISIONAL BATTERY LIFE YDG1R01DGH 2.09E-1 9.90E-1 FAILURE TO RECOVER THE DIVISION 1 DIESEL WITHIN FIRST HOUR OF STATION BLACKOUT
\
- All initiating events have units of 1/yr, all other events are unitless.
6-28 l L .
CPS INDIVIDUAL-PLANT EXAMINATION IMPROVEMENTS Table 6-2 Continued Basic Event Fussel- Probability Basic Event or or IST Vesely or Independent Sub-tree Desianator Value Frecuency Descriotion YOSOTO1SWH 2.09E-1 5.94E-1 FAILURE TO RECOVER OFF-SITE POWER WITHIN FIRST HOUR OF SBO (CONDITIONAL TO FAILURE TO RECOVER WITHIN 0.5 HOURS) AISTDGASTR 1.43E-1 2.31E-2 INDEPENDENT SUB-TREE CONSISTING OF. DIVISION 1 DIESEL GENERATOR FAILURES AISTDGBSTR 1.41E-1 2.31E-2 INDEPENDENT SUB-TREE CONSISTING OF DIVISION 2 DIESEL GENERATOR FAILURES A2DG1KADGM 1.39E-1 2.63E-2 DIVISION 1 DIESEL GENERATOR OUT FOR CORTICTIVE MAINTENANCE AISTDGCSTR 1.25E-1 2.31E-2 INDEPENDENT SUB-TREE CONSISTING OF DIVISION 3 DIESEL GENERATOR FAILURES YDG2R01DGH 1.21E-1 9.90E-1 FAILURE TO RECOVER THE DIVISION 2 DIESEL WITHIN FIRST HOUR OF SBO A2DG1KCDGM 1.18E-1 2.63E-2 DIVISION 3 DIESEL GENERATOR OUT FOR CORRECTIVE-MAINTENANCE BSXMANSTRT 1.18E-1 5.00E-1 BASIC EVENT REPRESENTING FAILURE TO RECOVER FROM SHUTDOWN SERVICE WATER (SX) AUTOMATIC INITIATION FAILURE, BY MANUAL INITIATION OF SX
- All initiating events have units of 1/yr, all other events are unitless.
6-29 i i
CPS INDIVIDUAL PLANT EXAMINATION IMPROVEMENTS Table 6-3 Basic Events or Independent Sub-trees With Highest Fussel-Vesely Importance Measures for the Class 1A (Hiah Pressur.gl C2re Damace Cutsets Basic Event Fussel- Probability Basic Event or or IST Vesely or Independent Sub-tree Desianator Value Precuencv* Description GADSMANSYW 6.47E-1 5.00E-4 OPERATOR FAILS TO MANUALLY INITIATE ADS HISTINJECT 6.08E-1 5.00E-2 INDEPENDENT SUB-TREE CONSISTING OF HPCS FAILURE BASIC EVENTS BISTHPINJR 6.08E-1 7.18E-1 BASIC EVENT REPRESENTING RECOVERY OF HPCS FAILURES IN HISTINJECT YTRANSYTRX 3.76E-1 4.70E+0/yr TRANSIENT WITHOUT ISOLATION INITIATOR YTRANISTRX 3.75E-1 1.70E+0/yr TRANSIENT WITH ISOLATION INITIATOR IISTINJECT 3.67E-1 5.46E-2 INDEPENDENT SUB-TREE CONSISTING OF RCIC FAILURE BASIC EVENTS BISTRIINJR 3.67E-1 7.56E-1 BASIC EVENT REPRESENTING RECOVERY OF RCIC FAILURES IN IISTINJECT GISTADSHDW 2.85E-1 3.63E-4 INDEPENDENT SUB-TREE CONSISTING OF ADS HARDWARE FAILURES FISTRESTRB 2.39E-1 1.23E-1 FAILURE TO REC 07ER FEEDWATER TRIP GIVEN FAILURE OF MANUAL ADS . FFWCCORTRM 2.36E-1 6.00E-2 MOTOR DRIVEN REACTOR FEEDWATER PUMP OUT FOR CORRECTIVE MAINTENANCE YRIPRORFRC 1.8SE-1 1.00E-1 BASIC-FVENT REPRESENTING FRACTION OF TRANSIENTS WITH ISOLATION THAT RESULT IN LOSS OF RCIC RSPCOOLSWW 1.29E-1 5.04E-2 FAILURE TO INITIATE RHR SUPP POOL COOLING YL1 1.16E-1 4.21E-1 FAILURT ') RECOVER OFF-SITE PCWER IN 0.f 'S YLOOPXXTRX 1.16E-1 8.40E-2 LOSS 01 JFF-SITE POWER INITIATOR
- All initiating events have units of 1/yr, all other events are unitiess.
6-30
CPS IllDIVIDUAL PLANT EX.4MINATION IMPROVEMENTS Table 6-4 Basic Events or Independent Sub-trees With Highest Pussel-Vesely Importance Measures for the Containment Failure (Radioactive Release)Erdttg Basic Event Fussel- Probability Basic Event or or IST Vosely or Independent sub-tree Desianator Value Precuencv* Description Y LC"PXXTRX 9.00-1 8.4E-2/yr LOSS OF OFF-SITE POWER IhITIATOR YL1 8 96E-1 4.21E-1 FAILURE TO RECOVER OFF-SITE POWER IN 0.5 llOURS Y DG2R04 DGil 7.44E-1 8.00E-1 FAILURE TO RECOVER THE DIVISION 2 DIESEL WITilIN FIRST 4 ilOURS OF STATION BLACKOUT Y DG1R04 DGli 7.28E-1 8.00E-1 FAILURE TO RECOVER THE DIVISION 1 DIESEL WITHIN FIRST 4 !!OURS OF STATIOli BLACKOUT YOSOTO4SWH 7.28E-1 4.50E-2 FAILURE TO RECOVER OFF-SITE POWER WITHIN FIRST 4 HOURS OF STATION BLACKOUT (CONDITIONAL TO FAILURE TO RECOVER WITilIN 3.5 HOURS) BNCSBOISOL 5.66E-1 4.00E-1 FAILURE OF CollT;INME: ISOLATION Ilt STATION BLACKCn 7 SEQUEhCES (MANUA5 iSOIATIOli BY OCATO'1S; BOS OTO4 SWii 5.47E-1 7.60E-1 FAILURE TO RECOVEL OFF-SITE POWE. IN TIME TO PREVENT RPV FAILURE (CONDITIONAL TO FAILURE TC REFOVER WITHIN 4 HOURS) . BLATERhCVY 3.30E-1 4.69E-1 CONDITIONAL FAILURE TO RECOVER OFF-SITE POWER IN 4 !!OURS GIVEN FAILURE TO RECOVER IN 2 BSBOISOLOK 3.30E-1 6.00E-1 COMPLEMENT EVENT FOR FAILURE OF STATION BLACKOUT CONTAINMENT ISOLATION FAILURE HISTINJECT 2.06E-1 5. _'GE O INDEFENDINT SUB-TREE CONSISTING OF HPCS FAILURE BASIC EVENTS
- All initiating events he.ve units of 1/yr, all other events are uniticss.
6-31
CPS INDIVIDUAL PIANT EXAMINATION IMPROVEMENTS Tablo 6-4 Continued Basic Event Fussel- Probability Dasic Event or , or IST Vesely or Independent Sub-tree DSR19AfttOI Value Frqqqqngy* D3scrintion BISTliPINJR 2.06E-1 7.10E-1 BASIC EVENT REPRL,ENTING RECOVERY OF llPCS FAILURES IN llISTINJECT , , BDGRCTDDR4 1.30E-1 8.70E-1 FAILURE TO RECOVER DIESEL GENERATOR ISTS IN TIME TO AVOID RPV FAILURE , BDGRUNDDR4 1.30E-1 1.91E-1 FAILURE OF TIME-PIIASED DIESEL RUN RECOVERY IN FOUR llOURS AISTDGARUN 1.14E-1 5.41E-2 INDEPENDENT SUB-TREE CONSISTING OF DIVISION 1 DIESEL GENERATOR RUNNING FAILURE BASIC EVENTS AGABCCCDGS 1.13E-1 2.00E-4 EMERGENCY DIESEL GENERATOR DIVISIONS 1, 2 AND 3 FAIL TO START COMMON CAUSE IISTINJECT 1.13E-1 5.46E-2 INDEPENDENT SUB-TREE CONSISTING OF RCIC FAILURE BASIC EVENTS BISTRIINJR 1.13E-1 7.56E-1 BASIC EVENT REPRESENTING RECOVERY OF RCIC FAILURES IN .TISTINJECT AISTDGBRUN 1.08E-1 5.41E-2 INDEPENDENT SUD-TREE CONSISTING OF DIVISION 2 DIESEL GENERATOR RUNNING FAILURE BASIS EVENTS AISTDGASTR 1.06E-1 2.31E-2 INDEPENDENT SUB-TREE CONSISTING OF DIVISION 1 DIESEL GENERATOR FAILURES AISTDGCSTR 1.06E-1 2.31E-2 INDEPENDENT SUB-TREE CONSISTING OF DIVISION 3 DIESEL GENERATOR FAILURES A2 DG1KAI.XIM 1.04E-1 2.63E-2 DIVISION 1 DIESEL GENERATOR OUT FOR CORRECTIVE MAINTENANCE YXSCRAMTRX 1.04E-1 1.00E-5 SCRAM SYSTEM IIARDWARE FAILURES
- All initiating events have units of 1/yr, all other events are unitless.
6-32 k
CPS INDIVIDUAL PLANT EXAMINATION
SUMMARY
- 7.
SUMMARY
AND CONCLUSIONS The CPS internal events PRA consisting of a level 1 systems analysis and a level 2 containment performance analysis has been completed using current acceptable methods. It was intended to determine whether plant-unique vulnerabilities exist and to develop an appreciation for the behavior of CPS during severe accident conditions. The major conclusions of this study are that CPS design and operation provide good protection against core damaging accidents with a calculated core damage frequency of 2.6E-5 events / reactor year. This value is below the NRC safety goal of 1.0E-4 events / reactor year for core damaging events and is well within the range of recent published PRAs. There are no particular combinations of failures that stand out as dominant contributors to core damage. CPS has a robust ccccainment design with a resultant low, calculated containment failure rate amounting to approximately 1 core damage event in 20 leading to containment failure. This result shows that the expected CPS containment failure rate is lower than that of many other nuclear plants. There are no plant vulnerabilities identified in the course of this study. The CPS IPE was performed by a team of CPS employees, along with extensive CPS management involvement throughout the development process. This team was supplemented with contract personnel with PRA experience to assure that the CPS IPE followed standard PRA practices. The CPS IPE Team members have the technical and operational background and experience to examine and understand the plant design, operations, maintenance, emergency procedures, and surveillances, which allowed them to identify initiating events applicabla to CPS; model the plant based upon practical experience concerning equipment and operator behnvlor; develop system and support system dependencies with assurance of completeness; and develop insight into the complexity, strengths and weaknesses of the plant response to a variety of severe accident conditions. 7-1
CPS I!1DIVIDUAL PLAllT EXAMI!1ATIOtt
SUMMARY
The formal in-house reviewn performed during the course of the IPE resulted in assurance of the accuracy of the IPE documentation as well as a validation of the IPE proceso and l
~
results. Thoue reviews also helped disseminate knowledge about the IPE and plant accident benavlor. The CPS IPE project accomplished the following objectivest Y
- 1. Developed an appreciation of severe accident behavior at S"9.
- 2. B(,aloped understanding of the most likely nevere accident acquenceu that could occur at CPS.
- 3. Gained a more quantitative understanding of the overall probabilitien of core damage nequences and flasion product releanes from CPS.
- 4. Identified potential hardware and procedure modifications that could be implemented to further reduce the likelihood of core damage or containment failure.
- 5. Enhanced internal rick nosessment skills and knowledge, established a baseline database, developed a set of risk models and instructions no that CPS will be able to use and maintain the CPS IPE for applications such as evaluating ,
potential modifications, procedure changes, or material conditions. The CPS IPE used an integrated systematic approach to examine the Clinton Power Station (CPS) for ponsible significant risk , contributions. Development of the CP3 IPE began by identification of the comprehensive initiating event list upon which all subsequent work was built. Then the potential progression of events that lead to either a safe shutdcwn condition or a core damage situation was ascertained. The modeling and evaluation of plant systems cr major operator actions that could mitigate the effects of the different initiating events were then performed using event treen as tools. The logic structure of the event troca in generally consistent with the operating approach taken in the Emergency operating Proceduren (EOPs). Their consistency in structure with the EOPs 7-2
CPS I!1DIVIDUAL PLANT EXAMIllATIOli SUl4 MAP.Y makes these tools useful in evaluating operations-related safety issues. The event trees were reviewed for agreement with the appropriate system procedures and the Emergency operating Procedures by experienced IPE analysts and in-houce review team members to ensure that they included the approprinto operational perspec ;ives and adequately addressed tie important operator actions. NUREG/CR 4550, " Analysis of Core Damage Frequency: Grand Gulf, Unit 1 Internal Events", was used as a pattern for the event trees. After the structure of the event trees was determined, system fault trees were developed. The fault trees provide detail on each of the systems modeled in the CPS IPE to show important components and how failure could affect the system. Failuros modeled include human errors, hardware failures, and common cause failuren. Thie resulted in a detailed study of the failure mechanisms of each system. The CPS IPE level 2 containment performance analysis used the same integrated systematic approach as the level 1 analysis described above. The containment performance analysis began with the level 1 sequence end states, grouped (binned) according to their expected offect on containment response. Next, containment event trees were developed for each b! , of core damage sequence end states. These event trees were then solved to determine the containment failure probability and the release source term, if applica.ble. The development of the CPS IPE and its results received extensive internal and external reviews by technical and management level individuals. The final results represent an accurate model of Clinton Power Station with which PRA applications have been performed. While the final numerical values for core damage and containment failure probabilities may be subject to change as models are refined through application and maintenance, the relative order and importance of the sequences are considered reasonable and not subject to significant change due to minor assumption revisions. No single initiator dominates the core
CPS lilDIVIDUAL PLAllT EXAMI!iATIOli
SUMMARY
damage frequency, and no severe accident vulnerabilities requiring immediate corrective action were identified. The CPS IPE results indicato a core damage frequency of 2.6E-5 per year based upon the present, as-operated, CPS reactor, plant, and containment capabilities. The significant core damage contributors are Station Blackout (long and short term) and Transients. The c contributors account for 37.2% and 52.0% of the total corsa damage frequency. The results from the containmer.t pe rformance analysis indicate a containment failure rate of 5%. Containment failures were determined to occur in ATWS, and some SB0 and low pressure core damage sequences. The low core damage and containment failure probabilities are attributable to the fact that CPS is one of the newest design BWR-6 plants with a Mark III containment. Features built into the plant that contribute to these lower probabilities include the following:
- 1. Three separato emergency electrical buses, each with their own Diesel Generator.
- 2. Pressure suppression containment design.
- 3. A strong and large volume containment relative to similar pressure suppression designs.
- 4. Compartmentalized ECCS systems for physical and flood separation.
- 5. Three ECCS divisions.
- 6. Two separato divisions of Hydrogen Ignitors.
- 7. A motor driven feodwater pump in addition to the two turbine driven foodwater pumps.
The CPS IPE program has to date produced several interim reports. These reports, based upon CPS IPE results; have been provided for use to the Operations Training department and the Emergency Planning Organization for generating realistic scenarios for operator training and Emergency Plan drills. These documents, 7-4
CPS IllDYVIDUAL PLA!1T EXAM 111ATIoli
SUMMARY
along with a number of other supporting documents, provide the reference basis for the IPE and are available at CPS. Insights were also generated during the CPS IPE development. These insights represent an accumulation of observations and calculations that may provido the means to reduce the coro damage frequency. Soveral potential changes were evaluated in accordance with NUMARC 91-04, "Severo Accident Issue Closure Guidelines". However, any commitment for specific action will be reserved until severe accident management program development - after completion of the IPE for External Events (IPEEE). The only open Unresolved Sr.fety Issue (USI) or Generic Safety Issue (GSI) for CPS was l'SI A-4 5, " Loss of Decay Heat Removal". The result of this ovaluation was that the design of CPS shows no vulnerabilities in this area and this issue should be considered closed by this submittal. The completion of this CPS IPE report does not represent the end of the CPS IPE. CPS intends to maintain and apply the PRA as a management tool. Specific policies on updates ated future uses of the CPS IPE are yet to be determined; however, implementation of the maintenance rule, review of plant modifications, studies to support licensing actions, and reactor SCRAM reduction are expected to be among the uses of the CPS PRA. 7-5 i
)
TilIS PAGE INTENTIO!! ALLY LEFT DIA!1K
- E i.- . . .}}