ML20112F488
| ML20112F488 | |
| Person / Time | |
|---|---|
| Site: | Davis Besse  |
| Issue date: | 05/12/2020 |
| From: | Christopher Hunter NRC/RES/DRA/PRB |
| To: | |
| Hunter C (301) 415-1394 | |
| References | |
| LER-02-002, LER-02-005, LER-03-002 | |
| Download: ML20112F488 (47) | |
Text
1 Final Precursor Analysis Accident Sequence Precursor Program --- Office of Nuclear Regulatory Research Davis-Besse Cracking of Control Rod Drive Mechanism Nozzles and Reactor Pressure Vessel Head Degradation, Potential Clogging of the Emergency Sump, and Potential Degradation of High Pressure Injection Pumps Event Date:
February 2002 LERs: 346/02-002, 346/02-005, and
346/03-002 CDP = 6x10-3 January 31, 2005 Condition Summary During an inspection of the control rod drive mechanism (CRDM) nozzles in February 2002, the licensee discovered three nozzles were leaking through axial cracks, and that one of the leaking nozzles had begun to develop a circumferential crack. During repair of another one of the leaking nozzles, it became loose in the reactor pressure vessel (RPV) head. Subsequent investigation revealed that a cavity had formed around that nozzle in the low-alloy steel portion of the RPV head, leaving only the stainless steel-clad material as the reactor coolant pressure boundary over an area of approximately 16.5 square-inches. In its root cause analysis report, the licensee concluded that the axial crack in the affected nozzle had most probably been leaking for a period of 6 to 8 years before detection. A similar but much smaller cavity was subsequently identified at the location of the leaking crack in another of the degraded nozzles (References 1, 4 & 12).
On September 4, 2002, with the reactor defueled, the licensee determined that the existing amount of unqualified containment coatings and other debris (e.g., insulation) inside containment could have potentially blocked the emergency sump intake screen, rendering the sump inoperable following a loss of coolant accident. The unqualified coatings and deficiencies for other debris had existed since original construction. The licensee declared the emergency sump inoperable and entered the deficiency into their corrective action program. With the emergency sump inoperable, both independent emergency core cooling systems (ECCS) and containment spray (CS) systems are inoperable, due to both requiring suction from the emergency sump during the recirculation phase of operation. This could have prevented both trains of ECCS from removing residual heat from the reactor and could have prevented CS from removing heat and fission product iodine from the containment atmosphere (References 2 & 5).
On October 22, 2002, with the reactor defueled, a potential deficiency was identified that would affect the High Pressure Injection (HPI) pumps during the recirculation phase of postulated loss of coolant accidents (LOCA) and when the HPI pumps are used for post-LOCA boron precipitation control. The HPI pumps may be damaged due to potential debris generated by certain postulated LOCAs and entrained in the pumped fluid. The HPI pumps are subject to this debris after the pump suctions are switched over from the borated water storage tank to the discharge of the Low Pressure Injection Pumps, which take suction on the containment emergency sump. The HPI pumps use a process-fluid lubricated hydrostatic radial bearing on
the outboard end of the pump shaft. The hydrostatic bearing, inter-stage bearing sleeve, shaft bushings, and wear rings may be damaged by debris and particles in the pumped fluid. An evaluation determined that pump would be inoperable during any postulated accidents in which the pump would be required to pump water that contained fibrous debris (References 3, 6 & 13).
Cause. The condition of the head was caused by a series of cracks and leaks to CRDM nozzles that lead to corrosion of the carbon steel vessel head. The condition of the sump was caused by the licensees failure to ensure that qualified coatings were used in containment, and failure to remove debris. The condition of the HPI pumps was an original plant design deficiency.
Condition duration. All three conditions existed at Davis-Besse for at least a year, and were concurrent. The condition of the HPI pump and unqualified coatings existed since original plant start-up. The condition of the head, containment coatings and containment debris worsened with time.
Recovery opportunities. The dominant cutsets involve LOCAs followed by sump failure. The sump failure event is quantified using the NUREG/CR-6771 loss of NPSH margin as a surrogate for failure. Therefore, successful operation with less than the prescribed NPSH margin is modeled as a recovery. Other recovery actions are considered, but not credited.
Davis-Besse reports that they had no procedures for operating with a degraded or plugged sump. They do have a procedure for Reactor Water Storage Tank (RWST) refill following a Steam Generator Tube Rupture (SGTR). Section 8.19.8 of DB-OP-0200 provides operators guidance to align the Clean Waste Receiver Tanks to the RWST in accordance with DB-OP-06101, Clean Radwaste System. The Clean Waste Storage Tank Transfer Pumps have a rated capacity of 140 g.p.m. each. In the event of a plugged sump, operators may resort to this procedure, but no probabilistic credit was given since no training or analysis supports this action. See Attachment A for more details.
No recovery of the high pressure recirculation (HPR) function is credited in the analysis.
However, the model includes the ability to depressurize the plant and mitigate the accident at low pressure if the HPI system fails.
LER 346/06-002 1 Since this condition did not involve an actual initiating event, the parameter of interest is the measure of the incremental increase between the conditional probability for the period in which the condition existed and the nominal probability for the same period but with the condition nonexistent and plant equipment available. This incremental increase or importance is determined by subtracting the CDP from the CCDP. This measure is used to assess the risk significance of hardware unavailabilities especially for those cases where the nominal CDP is high with respect to the incremental increase of the conditional probability caused by the hardware unavailability.
2 A significant precursor is an event or condition that has a 1 in 1000 (10-3) or greater probability of leading to a reactor accident.
3 Analysis Results Importance1 This condition was modeled as a 1-year period in which the initiating event probability was increased for small LOCA (SLOCA), medium LOCA (MLOCA) and large LOCA (LLOCA).
During this period, the probability of sump failure was increased and the high pressure recirculation function was not available for LOCAs, including stuck open SRVs.
Additionally, the probability that transient increases in pressure could cause a LOCA was included. The CDP for this condition is 6 x 10-3, and this event is classified as a significant precursor by the Accident Sequence Precursor Program2. Since the approaches for calculating the LOCA probabilities and the sump failure probabilities do not include uncertainty analyses, an uncertainty distribution for the CDP was not evaluated.
Instead, detailed sensitivity analyses were done to show the potential range of results given various input conditions.
Dominant sequence The dominant core damage sequence for this condition is a large LOCA sequence (Sequence 2). The events and important component failures in this sequence (shown in Figure 1) include:
a large LOCA, successful reactor trip (not shown on event tree),
successful operation of the Core Flood System, successful operation of the Low Pressure Injection System, and failure of Low Pressure Recirculation.
The next dominant core damage sequence for this condition is a medium LOCA sequence (Sequence 4). The events and important component failures in this sequence(shown in Figure 2) include:
a medium LOCA, successful reactor trip, successful operation of the High Pressure Injection System, S
successful operation of the Auxiliary Feedwater System, S
failure to cool down the RCS, and
failure of High Pressure Recirculation.
Results tables The conditional probabilities of the dominant sequences are shown in Table 1.
The event tree sequence logic for the dominant sequences are provided in Table 2.
The conditional cut sets for the dominant sequences are provided in Table 3.
Modeling Assumptions Assessment summary The multiple conditions were modeled for a 1-year period using the Standardized Plant Analysis Risk (SPAR) Revision 3.02 model (Reference 10). The degraded head was modeled by the modified initiating event probabilities for SLOCA, MLOCA and LLOCA.
The possibility of sump failure was modeled by increasing the sump failure probability for the various accident sequences. The design deficiency in the high pressure recirculation function was modeled by setting a basic event to Boolean TRUE for this function for LOCAs, including accident scenarios where there are stuck open SRVs. Additionally, the probability that transient increases in pressure could cause a LOCA was included in the model.
Modeling Assumptions Key modeling assumptions. The key modeling assumptions are listed below and discussed in detail in the following sections. These assumptions are important contributors to the overall results.
S Head LOCA probabilities and sizes are based on a postulation of conditions that existed over the year prior (February 2001 to February 2002) to discovery of the degraded head (see Reference 11). CRDM ejection probabilities are calculated from models described in Reference 14. These probabilities are based on alternative damage scenarios that could have progressed undetected during the year prior to discovery.
S Sump failure probabilities are based on work done as part of GSI-191. Adjustments to sump failure probabilities for unqualified coatings and debris in containment are based on considerations researched as part of GSI-191. (See Attachment A).
S The assumptions that HPI pumps would fail during the recirculation phase of emergency core cooling are based on licensee testing performed under NRC oversight. (See Reference 13.)
Other assumptions. Assumptions that have impacts on the results include the following:
S Operators cannot recover from a plugged sump. Operator actions to unplug the sump are assumed to be impossible because no flow path for back flushing exists.
Theoretically, if the sump plugs during the recirculation phase of an event, operators could shift the ECCS systems back to the injection mode. However, since procedures had not been developed in 2002, and the success criteria have not been analyzed, these actions are not credited. See Attachment A for details.
S Transient-induced LOCAs will be small enough that they can be mitigated by the HPI pump. In other words, they will not behave like LLOCAs. The probability of a LLOCA is much lower than the sum of the probability of SLOCA and MLOCA at operating pressure, and, although not explicitly calculated, the relationship would also be true at transient induced pressures. (Reference 9)
S The pressure increase associated with an ATWS will cause a failure of the degraded pressure vessel head.
Modifications to fault tree models S
Containment sump. The SPAR model was modified to allow different containment sump probabilities to be used for different event sequences. Additionally, the original SPAR containment sump failure event was left in the model for sensitivity analysis purposes. The fault tree shown in Figure 3 was inserted in the place of the original sump failure event (HPR-SMP-FC-SUMP) for the base case risk analysis.
S Induced LOCAs. The SPAR model was modified to allow the probability of induced LOCAs following various transients. These modifications were treated much like a stuck open PORV since the plant response would be the similar. Details of this modification are described in Attachment B.
S HPR system. The SPAR model was modified to add failure events that can be set to model HPR failure in certain scenarios. Operation of the HPI pumps in the injection mode is not affected by these added events. The fault tree shown in Figure 4 was inserted into the OR gate in the HPR model.
Basic event probability changes The following describes the structure and approach to the Davis-Besse ASP analysis, and gives the results. The analysis includes the vessel head degradation, sump deficiencies and HPI system design deficiency. Table 4 provides the basic events that were modified to reflect the event condition being analyzed. The bases for these changes are as follows:
S HPI pumps fail following a MLOCA (HPR-PMP-FL-MLOCA). Licensee testing showed that HPI pumps will fail during recirculation any time small amounts of fibrous debris are present in the sump. This event is set to TRUE because it is assumed sump fluid is not perfectly clean following a MLOCA per Reference 13.
S HPI pumps fail following a SLOCA (HPR-PMP-FL-SLOCA). Licensee testing showed that HPI pumps will fail during recirculation when small amounts of fibrous debris are present in the sump. This event is set to TRUE because it is assumed sump fluid is not perfectly clean following a SLOCA per Reference 13.
S MLOCA caused by cladding failure following an ATWS (INDUCED-MLOCA -
ATWS). Set to TRUE per Attachment B.
S MLOCA caused by cladding failure following a LOOP (INDUCED-MLOCA -LOOP).
Set to 0.008 per Attachment B.
S MLOCA caused by cladding failure during an SBO (INDUCED-MLOCA -SBO). Set to 0.019 per Attachment B.
S MLOCA caused by cladding failure following an transient (INDUCED-MLOCA -
TRANS). Set to 0.002 per Attachment B.
S Reactor Vessel Discharge Check Valve 30 fails (DHR-CKV-CC-30). In the published SPAR model, this event is set to TRUE to model a LOCA from a reactor coolant loop that causes significant flow diversion from the DHR system. Since the most likely LOCA in this ASP analysis is from the vessel head, the base model was changed to run with this event unavailability at a nominal value (no effect). For sensitivity cases considering all LOCAs, this event is set to TRUE in GEM to reflect normal SPAR modeling techniques.
S CCF of DHR RCS Discharge Check Valves (DHR-CKV-CF-DIS). In the base SPAR model, this event is set to FALSE because DHR-CKV-CC-30 is set to TRUE for modeling purposes described above. A random CCF of discharge check valves would not be logical since DHR-CKV-CC-30 is set to TRUE to structure the model, not to indicate the occurrence of a failure. The base SPAR model was changed to run with this event unavailability at its nominal value (no effect) for cases analyzing LOCAs from the vessel head. For sensitivity cases considering all LOCAs, this event is set to FALSE in GEM to reflect normal SPAR modeling techniques.
S Recirculation containment sump fails (HPR-SMP-FC-SUMP). In the base SPAR model, this event is at its historic value of 5E-5. The event is left in the model for sensitivity analyses, but set to FALSE for the ASP analysis.
S Sump fails in a LLOCA (HPR-SMP-LL-SUMP). Set to 0.2, which is the geometric mean of the range of reasonable estimates described in Attachment A.
S Sump fails in a MLOCA (HPR-SMP-ML-SUMP). Set to 0.03, which is the geometric mean of the range of reasonable estimates described in Attachment A.
S Sump fails in a SLOCA (HPR-SMP-SL-SUMP). Set to 0.003, which is the geometric mean of the range of reasonable estimates described in Attachment A.
S Sump fails in a transient (HPR-SMP-TL-SUMP). Set to 0.001, which is the best estimate for sump performance for bleed and feed, as described in Attachment A.
S Operator fails to recover sump in a LLOCA (HPR-XHE-LL-SUMP). Set to 0.8, as described in Reference 8 and Attachment A.
S Operator fails to recover sump in a MLOCA (HPR-XHE-ML-SUMP). Set to 0.5, as described in Reference 8 and Attachment A.
S Operator fails to recover sump in a SLOCA (HPR-XHE-SL-SUMP). Set to 0.4, as described in Reference 8 and Attachment A.
S Operator fails to recover sump in a transient (HPR-XHE-TL-SUMP). Set to 0.4, as described in Reference 8 and Attachment A.
LOCA Frequency Changes The LOCA initiating event frequencies are the probability of LOCA (large, medium or small) occurring during the year before the discovery of the condition at Davis-Besse. In developing these frequencies, the condition of the vessel head at the time of discovery (February 2002) is treated as uncertain. Probability distributions of effective cavity radius one year before the time of discovery and of the elapsed time since flaw initiation are created using an expert elicitation process. Probability distributions for the rates of crack and cavity growth are used to produce distributions of possible crack and cavity conditions at the time of discovery. The crack and cavity distributions at the time of discovery are compared to metallurgical properties to determined whether or not the cavity failed in each hypothetical condition, and, if a hypothetical failure occurred, whether it resulted in a large, medium or small LOCA. Section 3.3 of Reference 11 describes this process in more detail, and shows the input, intermediate and output variables.
This approach produces a reasonable estimate of the probability of a LOCA and the sensitivity analyses provide a reasonable representation of the uncertainty range. The results are limited by the quality of the expert elicitation of the basic conditions and rates.
Additional work on boric acid corrosion may tell us more about how the cavity could have grown, and about the likelihood of it growing to a larger size. However, the range of sensitivity analyses and the Monte Carlo approach to the analyses indicate that it is unlikely that new information will significantly change th conclusions.
Large LOCA initiating event (IE-LLOCA). The baseline SPAR initiating event frequency is 5E-6/yr. (5.7E-10/hr.) and the best estimate for the degraded condition (which is the conditional frequency of failing during a year) is 0.03/yr. (3.0E-6/hr) per Reference 11.
S Medium LOCA initiating event (IE-MLOCA). The baseline SPAR initiating event frequency is 4E-5/yr. (4.6E-9/hr.) The conditional MLOCA frequency is the sum of CRDM ejection frequency and cavity rupture frequency. The SDP (Reference 4) calculated the CRDM ejection frequency to be 2E-2/yr (2.3E-6/hr), but further analysis shows that the frequency is about 1E-2/yr (1.1E-6) (Reference 14). The best estimate for the degraded condition of the cavity is 5.0E-3/yr (5.7E-7/hr), for a total MLOCA frequency of 0.015/yr (1.7E-6/hr) per Reference 11.
S Small LOCA initiating event (IE-SLOCA). The baseline SPAR initiating event frequency is 5E-4/yr.(5.7E-8/hr.) and the best estimate for the conditional frequency is 0.17/yr. (1.9E-5/hr) per Reference 11.
Sensitivity Analyses Since the analytic approaches to calculating initiating event and sump failure probabilities do not produce parameter uncertainty distributions that can readily be used for standard PRA uncertainty analysis, an extensive set of sensitivity analyses was performed. The sensitivity analysis shows that the area that contributes the largest amount of uncertainty to the analysis is the modeling of the sump, which contains both modeling and parametric uncertainties. The second largest effect is from the parametric uncertainties associated with LOCA probabilities.
Finally, the third largest uncertainties come from the modeling uncertainties associated with the performance of the HPR function. Based on the range of reasonable risk estimates from these sensitivity analyses, each of these areas contribute a larger quantitative range than would be expected from a standard, parametric PRA uncertainty analysis. Table 5 summarizes the results of the sensitivity analysis and Attachment C describes the sensitivity cases and results in more detail. Figure 5 shows the results of the sensitivity analysis.
S LOCA Frequency The metallurgical analysis (Ref. 11) did a detailed sensitivity analysis by varying assumptions and data about the materials and phenomena associated with vessel head failure. The cases that produced the highest and lowest risk estimates are shown in the sensitivity analysis.
S Containment Sump Failures and Non-Recoveries Attachment A describes the analysis to determine the baseline and ASP analysis sump failure parameters. The baseline for this ASP analysis was determined using the documentation developed for GSI-191(Ref. 7 & 8). The SPAR model uses an unrecoverable sump failure probability of 5E-5 for all sequences, which is based on historic PRA values. The table below summarizes the sump failure probabilities used in sensitivity analyses.
Containment Sump Parameters for the ASP Analysis.
Sump Failure Probabilities for Various Scenarios LOCA Scenarios Baseline With unqualified coatings and debris All LOCAs HPR-SMP-TL-SUMP=0.001 HPR-SMP-SL-SUMP=0.01 HPR-SMP-ML-SUMP=0.1 HPR-SMP-LL-SUMP=0.6 HPR-SMP-TL-SUMP=0.001 HPR-SMP-SL-SUMP=0.01 to 0.1 HPR-SMP-ML-SUMP=0.1 HPR-SMP-LL-SUMP=0.9 Reactor Vessel Head LOCAs only HPR-SMP-TL-SUMP=0.001 HPR-SMP-SL-SUMP=0.001 HPR-SMP-ML-SUMP=0.01 HPR-SMP-LL-SUMP=0.01 to 0.1 HPR-SMP-TL-SUMP=0.001 HPR-SMP-SL-SUMP=0.001 to 0.01 HPR-SMP-ML-SUMP=0.01 to 0.1 HPR-SMP-LL-SUMP=0.1 to 0.4 TL - Transients SL = Small LOCA ML=Medium LOCA LL = Large LOCA Table 5 shows a large number of sensitivity analyses done for the sump failure parameters. A complete set was done for the degraded head LOCA frequencies and for the nominal LOCA frequencies. Note that CDP is very sensitive to sump failure probability when the degraded head LOCA frequencies are used. CDP varies from the mid-10-3 range for the historic sump failure probability to the high 10-2 range for a sump that fails in a MLOCA and a LLOCA.
S HPI Pump Performance Engineering analyses of the HPI pumps concluded that if they were called upon to pump water carrying even a small amount of fiber or debris that the pumps would probably fail.
Licensee testing at Wylie Labs performed to validate the previously existing and redesigned pump internals confirmed that failure would occur fairly quickly (Ref. 13).
Sensitivity cases were performed for a range of nominal performance of the pump to certain failure for all recirculation, including water from the PORV relief tank. Since the condition of the sump and vessel head dominate the analysis, all HPI pump sensitivity cases gave results high in the 10-3 range.
S Comparison to SDP Several sensitivity cases were run for the purposes of comparing the results to those of the SDP.
S The sensitivity analyses done for Head Only show that the CDP for the head failure, run with nominal HPR and sump performance, is greater than 1 x 10-4, agreeing with the RED finding.
S The sensitivity analyses done for the sump with nominal LOCA frequencies vary from low in the 10-6 range to the middle of the 10-5 range. Best estimate analyses are in the
LER 346/06-002 10 10-6 range, but the uncertainty and sensitivity to assumptions support the YELLOW finding found in Reference 5.
S The sensitivity analyses done for the HPR pump performance with nominal LOCA frequencies vary in the 10-6 range, supporting the WHITE finding found in Reference 6.
The run with HPR failed is shown, but not considered representative because it would require significant fibrous debris to be entrained into the water being used for feed and bleed.
References 1.
LER 50-346/02-002-00, Reactor Coolant System Pressure Boundary Leakage Due to Primary Water Stress Corrosion Cracking of Control Rod Drive Mechanism Nozzles and Reactor Pressure Vessel Head Degradation, April 29, 2002 (ADAMS Accession No. ML021220082) 2.
LER 50-346/02-005-02, Potential Clogging of the Emergency Sump Due to Debris in Containment, May 21, 2003 (ADAMS Accession No. ML031470074 )
3.
LER 50-346/03-002-01, Potential Degradation of High Pressure Injection Pumps Due to Debris in Emergency Sump Fluid Post Accident, January 29, 2004 (ADAMS Accession No. ML040330561).
4.
EA-03-025, Final Significance Determination for a Red Finding and Notice of Violation at Davis-Besse, NRC Inspection Report No., May 29, 2003 (ADAMS Accession No. ML0031490778).
5.
EA-03-131, Final Significance Determination for a Yellow Finding and Notice of Violation at Davis-Besse, (ADAMS Accession No. ML032801706).
6.
EA-03-172, Preliminary Significance Determination for a Greater than Green Finding (NRC Inspection Report 50-346/2003-21) - Davis-Besse High Pressure Injection Pump Design Issue, October 8, 2003 (Adams Accession No. ML032810667) 7.
NUREG/CR-6771, GSI-191: The Impact of Debris Induced Loss of ECCS Recirculation on PWR Core Damage Frequency, U.S. Nuclear Regulatory Commission, Washington, DC, August 2002.
8.
LA-UR-02-7562, The Impact of Recovery From Debris-Induced Loss of ECCS Recirculation on PWR Core Damage Frequency, Los Alamos National Laboratory, February 2003 (ADAMS Accession No. ML030690174).
9.
Jenson, W. memorandum to Holahan, G., Sensitivity Study of PWR Reactor Vessel Breaks, May 10, 2002, (ADAMS Accession No. ML021340306).
LER 346/06-002 11 10.
J. P. Poloski, et al., Simplified Plant Analysis Risk Model for Davis-Besse, Revision 3.11,
Idaho National Engineering and Environmental Laboratory, Idaho Falls, ID, December 2004.
11.
Williams, P. T., Yin, S., and Bass, B. R., Probabilistic Structural Mechanics Analysis of the Degraded Davis-Besse RPV Head, ORNL/NRC/LTR-04/15, Oak Ridge National Laboratory, June 2004. (ADAMS Accession No. ML042600455) 12.
Marsh, L. B. memorandum to Grobe, J. A., Response to Request for Technical Assistance
- Risk Assessment of Davis-Besse Reactor Head Degradation (TIA 2002-01), December 6, 2002. (Adams Accession No. ML023020366).
13.
Hannon, J. N. and Imbro, E. V. memorandum to William H. Ruland, Evaluation of Davis-Besse Modifications to the High Pressure Injection Pump and Associated Mock-up Testing (TIA No. 2003-04, TAC NO. MC0584), U.S. Nuclear Regulatory Commission, January 14, 2004. (ADAMS Accession No. ML040200191).
14.
Caruso, M. memorandum to Cheok, M. C., Reevaluation of Increase in Medium LOCA Frequency Attributable to Circumferential Cracking Potential in Leaking CRDM Nozzles at the Davis-Besse Nuclear Power Plant, September 7, 2004. (Adams Accession No. ML0425104015).
LER 346/06-002 12 Table 1. Conditional probabilities associated with the highest probability sequences Event tree name Sequence no.
Conditional core damage probability (CCDP)
Core damage probability (CDP)
Importance (CCDP - CDP)2 LLOCA 2
4.4E-3 2.4E-6 4.7E-3 MLOCA 4
9.1E-4 1.3E-7 1.7E-3 MLOCA 2
2.7E-4 2.1E-6 5.1E-4 SLOCA 5
1.8E-4 2.9E-8 1.6E-4 SLOCA 3
1.7E-4 6.4E-7 1.5E-4 Total (all sequences)1 6.2E-3 6.3E-5 6.1E-3 Notes:
- 2. Importance is calculated using the total CDP and total CDP from all sequences. Sequence level importance measures are not additive.
Table 2a. Event tree sequence logic for dominant sequence Event tree name Sequence no.
Logic
(/ denotes success; see Table 2b for top event names)
LLOCA 2
/CFS, /LPI, LPR MLOCA 4
/RPS, /HPI, /AFW, COOLDOWN, HPR MLOCA 2
/RPS, /HPI, /AFW, /COOLDOWN, LPR SLOCA 5
/RPS, /AFW, /HPI, COOLDOWN, HPR SLOCA 3
/RPS, /AFW, /HPI, /COOLDOWN, DHR, LPR Table 2b. Definitions of fault trees listed in Table 2a AFW AUXILIARY FEEDWATER SYSTEM CFS CORE FLOOD TANK COOLDOWN RCS COOLDOWN TO DHR PRESSURE USING TBVs, etc.
DHR DECAY HEAT REMOVAL SYSTEM HPI HIGH PRESSURE INJECTION FAILS HPR NO OR INSUFFICIENT FLOW FROM HIGH PRESSURE RECIRCULATION COOLING LPI NO OR INSUFFICIENT FLOW DURING LOW PRESSURE INJECTION LPR NO OR INSUFFICIENT FLOW FROM LOW PRESSURE RECIRCULATION COOLING RPS REACTOR FAILS TO TRIP
LER 346/06-002 13 Table 3a. Conditional cut sets for LLOCA Sequence 2 CCDP Percent contribution Minimal cut sets1 Event Tree: LLOCA, Sequence 2 94.6 HPR-SMP-LL-SUMP HPR-XHE-LL-SUMP 5.9 LPR-XHE-XM1 4.4E-3 Total2 Notes:
- 1. See Table 4 for definitions and probabilities for the basic events.
- 2. Total CCDP includes all cut sets (including those not shown in this table).
Table 3a. Conditional cut sets for MLOCA Sequence 4 CCDP Percent contribution Minimal cut sets1 Event Tree: MLOCA, Sequence 4 98.2 PCS-XHE-XM-COOLDOWN2 HPR-PMP-FL-MLOCA 9.1E-4 Total2 Notes:
- 1. See Table 4 for definitions and probabilities for the basic events.
- 2. Total CCDP includes all cut sets (including those not shown in this table).
Table 3c. Conditional cut sets for MLOCA Sequence 2 CCDP Percent contribution Minimal cut sets1 Event Tree: MLOCA, Sequence 2 81.8 HPR-XHE-ML-SUMP HPR-SMP-ML-SUMP 2.7E-4 Total2 Notes:
- 1. See Table 4 for definitions and probabilities for the basic events.
- 2. Total CCDP includes all cut sets (including those not shown in this table).
Table 3d. Conditional cut sets for SLOCA Sequence 5 CCDP Percent contribution Minimal cut sets1 Event Tree: SLOCA, Sequence 5 94.7 PCS-XHE-XM-CDOWN HPR-PMP-FL-SLOCA 4.9 PCS-XHE-XM-CDOWN HPR-XHE-XM1 1.8E-4 Total2 Notes:
- 1. See Table 4 for definitions and probabilities for the basic events.
- 2. Total CCDP includes all cut sets (including those not shown in this table).
LER 346/06-002 14 Table 3e. Conditional cut sets for SLOCA Sequence 3 CCDP Percent contribution Minimal cut sets1 Event Tree: SLOCA, Sequence 3 22.3 DHR-FAN-CF-RMCFR 7.7 DHR-MDP-CF-STRT 4.7 CCW-MDP-TM-12 DHR-FAN-FR-RMCA 4.7 DHR-FAN-CF-RMCFS 1.2E-4 Total2 Notes:
- 1. See Table 4 for definitions and probabilities for the basic events.
- 2. Total CCDP includes all cut sets (including those not shown in this table).
Table 4. Definitions and probabilities for modified and dominant basic events Event name Description Probability/
Frequency Modified CCW-MDP-FS-12 COMPONENT COOLING WATER MDP 1-2 FAILS TO START 1.5E-003 No CCW-MDP-TM-12 CCW MDP 1-2 UNAVAILABLE DUE TO TEST AND MAINTENANCE 8.0E-003 No DHR-AOV-CC-14B DHR MDP 1-1 DISCH AOV FAILS TO OPEN 9.0E-004 No DHR-CKV-CC-30 REACTOR VESSEL DISCHARGE CHECK VALVE 30 FAILS 1.0E-004 Yes1 DHR-CKV-CF-DIS CCF OF DHR RCS DISCHARGE CHECK VALVES 1.0E-005 Yes1 DHR-FAN-CF-RMCFR CCF OF DHR FANS FOR ROOM COOLING TO RUN 1.6E-004 No DHR-FAN-CF-RMCFS CCF OF DHR FANS FOR ROOM COOLING TO START 3.3E-005 No DRH-FAN-FR-RMCA DHR MDP 1-1 ROOM COOLING FAN UNAVAIL.
2.0E-003 No DHR-MDP-CF-RUN DHR PUMP COMMON CAUSE FAILURES TO RUN 1.3E-005 No DHR-MDP-CF-START DHR PUMP COMMON CAUSE FAILURES TO START 5.4E-005 No HPR-PMP-FL-MLOCA HPI pumps fail during a MLOCA TRUE Yes2 HPR-PMP-FL-SLOCA HPI pumps fail during a SLOCA TRUE Yes2 HPR-SMP-FC-SUMP RECIRCULATION CONTAINMENT SUMP FAILS FALSE Yes2 HPR-SMP-LL-SUMP Sump Fails in a LLOCA 2.0E-001 Yes2 HPR-SMP-ML-SUMP Sump Fails in a MLOCA 3.0E-002 Yes2 HPR-SMP-SL-SUMP Sump Fails in a SLOCA 3.0E-003 Yes2
LER 346/06-002 Event name Description Probability/
Frequency Modified 15 HPR-SMP-TL-SUMP Sump Fails in a Transient-induced LOCA (PORV or RCP Seal) 1.0E-003 Yes2 HPR-XHE-LL-SUMP Operator Fails to Recover Sump in a LLOCA 8.0E-001 No3 HPR-XHE-ML-SUMP Operator Fails to Recover Sump in a MLOCA 5.0E-001 No3 HPR-XHE-SL-SUMP Operator Fails to Recover Sump in a SLOCA 4.0E-001 No3 HPR-XHE-TL-SUMP Operator Fails to Recover Sump in a Transient 4.0E-001 No3 IE-LLOCA INITIATING EVENT-LARGE LOSS OF COOLANT ACCIDENT 3.0E-006 Yes2 IE-MLOCA INITIATING EVENT-MEDIUM LOSS OF COOLANT ACCIDENT 1.7E-006 Yes2 IE-SLOCA INITIATING EVENT - SMALL LOSS OF COOLANT ACCIDENT 1.9E-005 Yes2 INDUCED-MLOCA-AT WS MLOCA from cladding Induced by ATWS Scenario 1.0E-000 Yes2 INDUCED-MLOCA-LOOP MLOCA induced by cladding failure during a transient 8.0E-003 Yes2 INDUCED-MLOCA-SBO MLOCA induced by cladding failure during a transient 1.9E-002 Yes2 INDUCED-MLOCA-TRANS MLOCA induced by cladding failure during a transient 2.0E-003 Yes2 LPR-XHE-XM OPERATOR FAILS TO INITIATE THE LPR SYSTEM 2.0E-003 No LPR-XHE-XM1 OPERATOR FAILS TO INITIATE THE LPR SYSTEM DURING LLOCA 1.0E-002 No PCS-XHE-XM-CDOWN OPERATOR FAILS TO INITIATE COOLDOWN 1.0E-003 No PCS-XHE-XM-COOLDOWN2 OPERATOR FAILS TO INITIATE RAPID COOLDOWN DURING MLOCA 6.0E-002 No Notes:
1.
Modified to reflect that the most likely LOCA location is the head, not a loop.
2.
Basic event was changed to reflect condition being analyzed. TRUE has a failure probability of 1.0.
3.
Added to the base model and the cases to reflect latest understanding of sump operation.
LER 346/06-002 1 - ASP-## refers to sensitivity cases studied in Reference 11.
16 Table 5. Davis-Besse ASP - Sensitivity Analysis Summary Sensitivity Analysis Case Parameters CDP Comments Analysis with postulated LOCA frequencies Best Estimate (ASP 01)
Sump - Postulated parameters HPR - Failed for MLOCA, SLOCA and SRV stuck open LOCA - Best Estimate 6E-3 Dominant cutsets are LLOCA or MLOCA followed by sump failure.
LOCA Sensitivity Sump - w/debris, geometric mean estimates HPR - postulated parameters L1 S H ASP 031 2E-2 LLOCA-related assumptions can drive analysis to >1E-2. Results relatively insensitive to changes in MLOCA and SLOCA analyses.
L2 S H ASP 05 7E-3 L3 S H ASP 09 3E-2 L4 S H ASP 04 3E-3 Sump Sensitivity LOCA - best estimate HPR - postulated parameters L S0 H Sump at historic value 2E-3 L S1a H Sump without debris (baseline for head LOCAs)(Low estimate) 2E-3 GSI-191-type analysis of sump performance gives a range of results L S1b H Sump without debris (baseline for head LOCAs)(high estimate) 4E-3 L S2 H Sump with debris - low estimates 4E-3 Analysis is very sensitive to sump performance in a LLOCA. Big difference between using high, central and low estimates.
L S3 H Sump with debris - SLOCA high, MLOCA & LLOCA low 4E-3 L S4 H Sump with debris - MLOCA high, SLOCA & LLOCA low 5E-3 L S5 H Sump with debris - LLOCA high, SLOCA & MLOCA low 1E-2 L S6 H Sump with debris - Geometric means of estimates - Best Estimate 6E-3 Uses center of range of estimates for sump performance.
L S7 H Sump with debris - high estimates for all 1E-2 Highly unreliable sump can increase risk to above 1E-2 L S8 H Sump failed for all LOCAs, unreliable for feed & bleed.
Recovery credited 3E-2 Upper bound, sump fails but operates with inadequate NPSH margin.
L S9 H Sump failed for all LOCAs, unreliable for feed & bleed 4E-2 Assuming sump failure is not realistic and these cases are provided for information only.
HPR Sensitivity LOCA - best estimate sump - w/debris, geometric mean estimates L S H1 HPR nominal 5E-3 HPI pump performance affects analysis between mid-and upper-1E-3 range. Important for SLOCA sequences.
L S H2 HPR failed for MLOCA only 6E-3
LER 346/06-002 Sensitivity Analysis Case Parameters CDP Comments 17 L S H3 HPR failed for MLOCA &
SLOCA only (nominal for SRV) 6E-3 L S H4 HPR failed 9E-3 Head Only Sump - historic HPR - nominal SDPL1 SH HN ASP 04 4E-4 Matches vessel head SDP (RED)
SDPL2 SH HN ASP 05 5E-4 SDPL3 SH HN ASP 01 6E-4 SDPL4 SH HN ASP 09 2E-3 CRDM Only - One Year Sump - historic HPR - nominal CRDM1y SH HN 5% of distribution with K parameter = -1 (IE_MLOCA=0.0021) 2E-5 One year operation considering CRDM ejection only. Comparable to the SDP CRDM2y SH HN Best estimate - Mean of distribution with K parameter =0 (IE_MLOCA=0.01) 5E-5 CRDM3y SH HN 95% of distribution with K parameter = 1 (IE_MLOCA=0.016) 7E-5 CRDM Only -
6 Weeks Sump - historic HPR - nominal CRDM1w SH HN 5% of distribution with K parameter = -1 (IE_MLOCA=0.0021) 2E-6 6 weeks operation considering CRDM ejection only. Comparable to the decision to operate CRDM2w SH HN Best estimate - Mean of distribution with K parameter =0 (IE_MLOCA=0.01) 6E-6 CRDM3w SH HN 95% of distribution with K parameter = 1 (IE_MLOCA=0.016) 8E-6 Analysis with nominal LOCA frequencies Sump Sensitivity LOCA - nominal HPR - nominal LN S0 HN Sump at historic value
(-5E-6)
For information - not used as a baseline. PRA risk is 5E-6 less than baseline if historic sump parameter is used.
LN S1 HN Sump at GSI-191 values 0
Baseline PRA - 6.3E-5/yr LN S2 HN Sump with debris - low estimates 1E-6 LN S3 HN Sump with debris - SLOCA high, MLOCA & LLOCA low 2E-6 LN S4 HN Sump with debris - MLOCA high, SLOCA & LLOCA low 3E-6 MLOCA sump failure set to 0.2.
LN S5 HN Sump with debris - LLOCA high, MLOCA & SLOCA low 1E-6
LER 346/06-002 Sensitivity Analysis Case Parameters CDP Comments 18 LN S6 HN Sump with debris - Best estimates or geometric means of estimates 1E-6 LN S7 HN Sump with debris - high estimates for all 4E-6 MLOCA sump failure set to 0.2.
LN S8 HN Sump failed for all LOCAs, unreliable for feed & bleed.
Recovery credited 3E-5 Upper bound, sump fails but operates with inadequate NPSH margin.
LN S9 HN Sump failed for all LOCAs, unreliable for feed & bleed. No recovery credited.
7E-5 Assuming sump failure is not realistic and these cases are provided for information only.
HPR Sensitivity LOCA - nominal sump - historic LN SN H1 HPR nominal 0
Baseline PRA - 6.3E-5/yr.
LN SN H2 HPR failed for MLOCA only 2E-6 LN SN H3 HPR failed for MLOCA &
SLOCA only (nominal for SRV stuck open) 3E-6 LN SN H4 HPR failed for MLOCA, SLOCA
& SRV stuck open) 3E-6 LN SN H5 HPR - Failed 2E-4 Assume failed Bleed and Feed.
Not considered realistic - fibrous debris would have to be in sump.
Shows the importance of the Bleed
& Feed function.
LER 346/06-002 19 LPR LOW PRESSURE RECIRCULATION LPI LOW PRESSURE INJECTION CFS CORE FLOOD SYSTEM IE-LLOCA LARGE LOCA ENDSTATE FREQUENCY 1
OK 2
CD 3
CD 4
CD LLOCA - DAVIS-BESSE PWR D LARGE LOCA EVENT TREE 2002/11/12 Page 2 Figure 1. Large LOCA Event Tree
LER 346/06-002 20 HPR HIGH PRESSURE RECIRCULATION LPR LOW PRESSURE RECIRCULATION LPI LOW PRESSURE INJECTION COOLDOWN RCS COOLDOWN (POST-LOCA)
OP-LPI OPERATOR DEPRESS.
AFW AUXILIARY FEEDWATER SYSTEM CFS CORE FLOOD SYSTEM HPI HIGH PRESSURE INJECTION RPS REACTOR TRIP IE-MLOCA MEDIUM LOCA END-STATE FREQUENCY 1
OK 2
CD 3
OK 4
CD 5
OK 6
CD 7
OK 8
CD 9
CD 10 CD 11 CD 12 CD 13 CD MLOCA - DAVIS-BESSE PWR D MEDIUM LOCA EVENT TREE 2003/12/24 Page 9 Figure 2. Medium LOCA Event Tree
LER 346/06-002 21 SUMP 5.0E-5 HPR-SMP-FC-SUMP SMP-LLOCA FALSE HPR-SMP-LL-SUMP 8.0E-1 HPR-XHE-LL-SUMP FALSE LLOCA SMP-MLOCA FALSE HPR-SMP-ML-SUMP 5.0E-1 HPR-XHE-ML-SUMP FALSE MLOCA SMP-SLOCA FALSE HPR-SMP-SL-SUMP 4.0E-1 HPR-XHE-SL-SUMP SLOCA_OCCURS 1.6E-2 PPR-SRV-OO-13A 1.6E-2 PPR-SRV-OO-13B FALSE SLOCA SMP-TRANSI ENT FALSE HPR-SMP-TL-SUMP 4.0E-1 HPR-XHE-TL-SUMP TRUE
/ LLOCA TRUE
/ MLOCA TRUE
/ SLOCA SLOCA occurrs SUMP FAILURES Sump Failures Following a Large LOCA Sump Failures Following a Medium LOCA Sump Failures Following a Small LOCA Sump Failures Following a Transient (PORV or Seal LOCA)
Sump Fails in a LLOCA Operator Fails to Recover Sump in a LLOCA Sump Fails in a MLOCA Operator Fails to Recover Sump in a MLOCA Sump Fails in a SLOCA SMALL LOCA INITIATING EVENT HAS OCCURRED MEDIUM LOCA INITIATING EVENT HAS OCCURRED Operator Fails to Recover Sump in a SLOCA PSV RC13B FAILS TO RECLOSE PSV RC13A FAILS TO RECLOSE RECIRCULATION CONTAINMENT SUMP FAILS Large LOCA has occurred Sump Fails in a Transient-induced LOCA (PORV or RCP Seal)
Operator Fails to Recover Sump in a Transient SUMP - Sum p Failu res 20 04/ 0 9/ 15 Page 11 1 Figure 3. Sump Fault Tree
LER 346/06-002 22 HPR-PUMPS HPI -MLOCA 1.0E+0 HPR-PMP-FL-MLOCA FALSE MLOCA HPI-SLOCA 1.0E+ 0 HPR-PMP-FL-SLOCA SLOCA_OCCURS1 FALSE SLOCA PORV-SRV-F1 FALSE PPR-MOV-FC-BLK 4.0E-2 PPR-SRV-CO-TRAN FALSE TRANS PORV-SRV-FAIL1 3.0E-3 PPR-SRV-CC-13A 3.0E-3 PPR-SRV-CC-13B SRVs FAIL TO CLOSE GIVEN THEY OPEN Failure of SRVs to close SLOCA occurs HPI pumps fail during a small LOCA HPI pumps fail during a MLOCA HPI pumps fail during recirculation
- design deficiency HPI pumps fail during a SLOCA due to design deficiency HPI pumps fail during a MLOCA due to design deficiency SMALL LOCA INITIATING EVENT HAS OCCURRED TRANSIENT INITIATIN G EVENT HAS OCCU RRED MED IUM LOCA INITIATING EVENT HAS OCC URRED PORV BLOCK VALVE CLOSED DURING POWER PORV RC 2A OPENS DURING TRANSIENT PSV RC13B FAILS TO OPEN PSV RC13A FAILS TO OPEN HPR-PUMPS - HPI pum ps fail during recirculat ion - design deficien cy 20 04/ 0 9/ 15 Page 75 Figure 4. HPR Fault Tree
LER 346/06-002 23 FIGURE 5:
SUMMARY
OF ASP ANALYSIS RESULTS 1E-6 1E-5 1E-4 1E-3 1E-2 1E-1 1E+0 BEST ESTIMATE LOCA Sump HPR CRDM & Head CRDM CRDM (6 wks)
Sump HPR Sensitivity Analyses Change in Core Damage Probability INTEGRATED ASP RESULTS:
Analyses with postulated probabilities for LOCAs, sump failure and HPR system failure.
VESSEL HEAD ONLY:
Analyses with postulated probabilities for LOCAs, and nominal sump and HPR failure probabilities SUMP AND HPR:
Analyses with nominal LOCA probabilities.
LER 346/06-002 A-1 ATTACHMENT A PARAMETERS FOR ASP ANALYSIS OF DAVIS-BESSE SUMP
- 1. Introduction Section 2 of this attachment discusses the existing risk assessment of sump failure probabilities up to and including the work done under GSI-191. Section 3 discusses the modifications to these probabilities based on the as found condition at Davis-Besse. Section 4 summarizes the parameters that are used in the ASP analysis.
2.
Background on Sump Failure Probability 2.1 A Brief History of Sump Failure Parameters All PWR SPAR models contain the event named PBC-SMP-FC-SUMP, described as Recirculation Containment Sump Fails, which is assigned a probability of occurrence of 5E-5.
This value was obtained from the NUREG-1150 Sequoyah PRA, NUREG/CR-4550, Vol.4, Rev.1, which was published in 1989. A check of WASH-1400 (published in 1975) shows a probability of a sump plugging with debris of 1E-6, with no significant explanation provided.
WASH-1400 performed a sensitivity study that showed no effect of varying this number by two orders of magnitude (page IV-38). A sensitivity study using the Davis-Besse SPAR model showed the same thing.
The Davis-Besse IPE used 2.2E-5/hr, but does not specify a mission time. Assuming a 24 hr.
mission time, the sump failure probability would be 5.2E-4. The event did not show up in dominant sequences in the IPE, and would not show up in dominant cutsets if 5.2E-4 was used in the SPAR model.
The Davis-Besse sump failure event is ranked 70th by Risk Increase Ratio. It appears in 35 cutsets listed in the SPAR document. Event importances are: Fussel/Vesley - 2E-4; Risk Reduction Ratio - 1.0; and Risk Increase Ratio - 5. The same sump failure probability is used in all other PWR SPAR models, and the event importances are similar.
2.2 Sump Failure Probability per GSI-191 NUREG/CR-6771, GSI-191: The Impact of Debris Induced Loss of ECCS Recirculation on PWR Core Damage Frequency was used as the primary reference for this ASP analysis. The document collects and tabulates sump failure probabilities for accident sequences, and then enters these failure probabilities into event trees to calculate changes in core damage frequencies. This ASP analysis assumes that the range of sump failure probabilities found in NUREG/CR-6771 can be used as a basis for Davis-Besse sump probabilities. However, the ASP analysis uses the Davis-Besse specific event trees found in the SPAR model and calculates the event-specific LOCA probabilities.
LER 346/06-002 A-The failure probabilities calculated in NUREG/CR-6771 can be questioned as more is learned about PWR sump performance. However, two important conclusions relative to sump performance are driving the risk modeling in this ASP analysis:
1.
The sump failure probability is significantly different for the different accident scenarios (Transient, SLOCA, MLOCA and LLOCA) postulated for nuclear power plants.
2.
The sump failure probabilities used in PRAs, which are usually below 1E-4, and often in the range of 1E-6 may be nonconservative.
The abstract to NUREG/CR-6771 states that Results suggest the conditional probability of recirculation sump failure (given a demand for recirculation cooling) is sufficiently high at many U.S. plants to cause an increase in the total CDF of an order of magnitude or more. The report goes on to state that the average increase in CDF from debris-induced failure of the recirculation sump is about a factor of 100. It is noted in NUREG/CR-6771 that the sump failure probabilities do not credit the chance that ECCS pumps continue to function with a loss of NPSH margin, nor the operator recovery actions to restore core cooling when normal recirculation flow terminates.
The results in NUREG/CR-6771 are aggregated from what can be described as generic analyses (titled parametric evaluations in the study) that were performed for each of the 69 PWRs. However, there is a mixture of generic and plant specific analysis parameters for each of the 69 parametric cases, and therefore, a direct translation from the parametric cases to the plant specific reliability parameters cannot be done. In addition, the uncertainties associated with each specific plant are so large that the characteristics should not be used for plant-specific quantitative analysis. The study assumes that aggregation of the plant specific results to generic conclusions bounds the uncertainties and gaps in knowledge associated with individual plant performances. For the purposes of this ASP analysis, it will be appropriate to compare Davis-Besse plant characteristics to those found throughout the NUREG/CR-6771 study.
- 3. Analytic Approach to Estimating Sump Parameters at Davis-Besse This section lays out the step by step approach to estimating the sump failure probabilities for the ASP analysis. The first step, discussed in Section 3.1, is to identify the range of parameters that are appropriate for PWR sumps. In Section 3.2, the engineering characteristics of the Davis-Besse plant, as it existed in 2002, are identified and described. Section 3.2 also compares the Davis-Besse characteristics to those at other PWRs. Section 3.3 estimates the baseline sump failure probabilities from the range of parameters in Section 3.1 and the characteristics in Section 3.2. These parameters are entered into the baseline risk model to replace the historic SPAR value (5E-5). Potential recovery actions and the probabilities of non-recovery estimated for Davis-Besse are described in Section 3.4. They are separately entered into the baseline risk model. The baseline risk model is then requantified with the new sump failure and non-recovery probabilities. Section 3.5 describes the estimate of the increased sump failure probabilities as a result of the reported unqualified coatings and debris in Davis-Besses containment.
LER 346/06-002 A-3 3.1 Range of PWR Sump Failure Probabilities Chapter 4 of NUREG/CR-6771 described the expert elicitation process used to establish sump failure probabilities. The allowed range of probabilities is from 1E-3 (defined to mean almost impossible in NUREG/CR-6771) to 0.999 (meaning almost certain). These probabilities were assigned to regions of a curve relating minimum particulate mass to volume of fiber in the bed.
Attachment C to NUREG/CR-6771 lists the conditional failure probabilities for the sumps throughout the country, and shows that sump failure probabilities fall:
Between 0.001 and 0.999 for LLOCA - most fall between 0.4 and 0.9 Between 0.001 and 0.99 for MLOCAs - most fall between 0.1 and 0.6 Between 0.001 and 0.999 for SLOCAs - most fall between 0.01 and 0.4, and Between 0.001 and 0.01 for Transients 3.2 Summary of Davis-Besse Characteristics that Effect Sump Failure Probability The following summarizes the significant sump design characteristics at Davis-Besse and their effect on sump failure probability. Design characteristics for other PWR sumps are provided for comparison.
Sump Screen Area - (125 ft2) Plants vary from 11 ft2 to 414 ft2. Davis-Besse is fairly close to the mean and median of this range. The effective sump area, or the area wetted at the time of switching from injection to recirculation is 50 ft2. (Effect on sump failure probability -
neutral.)
NPSH Margin - (2.4 ft) Plants vary from 0.5 ft to 15 ft. There may be some inconsistences in the way this is calculated and reported. Davis-Besse is in the typical range, but probably below the mean and median.(Effect on sump failure probability - slight increase.)
Full ECCS flow - (11000 g.p.m.). Plants varied from 7600 g.p.m. to 19740 g.p.m. Davis-Besse is in the typical range. (Effect on sump failure probability - neutral.)
Containment Spray Actuation Setpoint - (23 psig) Plants vary from 2.3 psig to 25.3 psig.
Only one plant has a higher setpoint than Davis-Besse. (Effect on sump failure probability -
decrease.)
Switchover Pool Height (1.8 ft.), Maximum Pool Height (6.7 ft.) and Sump Screen Height (2 ft.) are all in the typical range. (Effect on sump failure probability - neutral.)
Insulation - Davis-Besse has a very high percentage (98%) of reflective metal insulation (RMI). It has 2% fibrous insulation, which would be considered very low. The plant has no calcium-silicate insulating material. (Effect on sump failure probability - decrease.)
LER 346/06-002 A-4 3.3 Baseline Sump Failure Probabilities for Davis-Besse NUREG/CR-6771 estimates sump failure probabilities for different sequences of each LOCA size. The sequences do not match up identically with the sequences used in the SPAR model because the SPAR model does not consider Containment Spray (CS). Therefore, the range analysis being done for ASP will not be done for every sequence, but instead for each initiating event.
A review of GSI-191 research leads to the conclusion that operation of CS significantly increases the likelihood of washing containment debris into the sump, and increases the water flow in the sump, thus increasing the rate of debris transport. Davis-Besse containment spray has several unique characteristics that indicate that sump failure would be less likely at Davis-Besse than many other plants:
Containment spray comes on later than at most plants, and may not come on at all for some medium LOCAs.
The Davis-Besse IPE states that containment spray is not required for large LOCA success, and therefore implies that it is not required for other LOCAs. Therefore, the operator will not hesitate to turn off containment spray if the water inventory is needed for decay heat removal. Procedures allow turning off containment spray if containment pressure is less than 19.5 psig.
GSI-191 research considers the integration of all possible LOCA locations. In this specific ASP analysis, the reactor vessel head LOCA probability is dominant. Debris generation is difficult to predict, but debris from a head LOCA would be likely to fall into the reactor cavity. Debris generation would also be lower than many locations because of the hardened structures and shields around the head. While this is considered in estimating the generic sump failure probabilities, plant specific analysis is beyond the scope GSI-191 research.
The generic debris generation amounts used in the GSI-191 study were between 100 and 500 lbm for miscellaneous debris in containment for all LOCA types, and the insulation debris generation varied by LOCA type. Plant specific compositions of insulation were used to characterize the nature of the insulation debris. The fraction of the material transported to the sump varied from a low estimate of 0.05 for SLOCAs to a high estimate 0.25 for LLOCAs. The major parameters are summarized in Table 1.
LER 346/06-002 A-5 Table 1. Summary of Major Generic Parameters Used in GSI-191 Analyses LOCA Type Pipe Insulation Debris Generation Davis-Besse Plant-Specific Fiber Fraction Miscellaneous Debris Generation Fraction transported to sump screen SLOCA 25 ft3 0.02 100 to 500 lbm 0.05 to 0.1 MLOCA 40 ft3 0.02 100 to 500 lbm 0.1 to 0.25 LLOCA 1700 ft3 0.02 100 to 500 lbm 0.1 to 0.25 The debris generated and transported to the sump was compared to the Failure-Threshold Debris Loading (FTDL) metric. The FTDL is a metric that represents the minimum sump screen debris loading necessary to induce head loss across the sump in excess of the failure criterion.
The general structure of the FTDL is shown in Figure 4.3 of NUREG/CR-6771, and plant-specific FTDLs are shown in Appendix B of NUREG/CR-6762. The FTDLs come from detailed head-loss calculations that were performed for each parametric case. These calculations show the combinations of particulate and fiber that can fail the sump (i.e., drop below the minimum design NPSH). From the location of the expected range of debris relative to the FTDL curve, the information in Table 2 is used to assign sump failure probabilities.
Table 2. Reproduction of Table 4.2 of NUREG/CR-6771 Numeric Equivalents of Qualitative Conditional Probability Assignments Qualitative Assignment Conditional Probability Very Likely 0.9 if debris transport box < 10 to right of FTDL curve 0.99 if debris transport box < 100 to right of FTDL curve 0.999 if debris transport box > 100 to right of FTDL curve Likely 0.6 if debris transport box mostly to right of FTDL Possible 0.4 if debris transport box mostly to left of FTDL Unlikely 0.1 if debris transport box < 10 to left of FTDL curve 0.01 if debris transport box < 100 to left of FTDL curve 0.001 if debris transport box > 100 to left of FTDL curve Notes: Comparisons of debris transport with the FTDL refer to the left-hand edge of the box for the category of Very Likely and to the right hand edge for the category of Unlikely.
Using the qualitative information and Table 4.2 of NUREG/CR-6771, the baseline sump failure probabilities are estimated as follows.
Transients - Transient sequences receive water from the PORV tank, which have much less chance of picking up debris, so the sump failure is even lower. Sump failure would be
LER 346/06-002 A-6 considered to be unlikely. Most plants are assigned 0.001 in NUREG/CR-6771, as is Davis-Besse.
SLOCA - For the small LOCA, much less wash down would be expected since containment spray would not be activated. Therefore, we estimate the conditional failure probability to be 0.01..
MLOCA - Performance would be considerably better in a medium LOCA than in a large LOCA, even though the CS system is assumed to be operating (per the IPE). The small sump area has less effect in a MLOCA than in a LLOCA because the flow rates are lower.
However, since containment spray is running, there could be a significant wash down, so we estimate the conditional failure probability to be 0.1. This corresponds to an Unlikely sump failure, which is the same for 26 of the 69 plants.
LLOCA - Davis-Besse has less fibrous material than most plants because it uses mostly RFI, but since the sump was relatively small, we assign a conditional failure probability of 0.6 for a Large LOCA. If the sump were larger, a 0.4 parameter would be appropriate. This corresponds to the NUREG/CR-6771 Likely sump failure (53 of the 69 plants were in the Very Likely category).
3.4. Sump Failure Probability as a Result of Conditions at Davis-Besse LER 2002-005-02 identified two issues with the Davis-Besse sump: 1) existing amounts of unqualified coatings and other debris inside containment could have potentially blocked the emergency sump intake screen, and 2) a gap in the sump screen larger than allowed by design basis (greater than 1/4 inch openings). Additionally, the location of the LOCA has a major effect on sump performance. The baseline LOCA initiating event frequencies are based on the sum of all possible LOCA locations, and most of the LOCA probability comes from failures in reactor coolant loop piping. In this ASP analyses, the probability of a LOCA from other than the head is negligible compared to the probability of a head LOCA. Sump performance during a head LOCA is somewhat different than during a LOCA from the reactor coolant loop. Therefore, sump failure probabilities are determined for 3 cases other than the baseline:
For all LOCAs, with unqualified coatings and debris, For head LOCAs, with baseline conditions, and For head LOCAs, with unqualified coatings and debris Sump Failure Probability for All LOCAs, with unqualified coatings and debris The LER describes unqualified coatings and other unspecified debris (including but not limited to fibrous/Nukon insulation) that could be generated by a LOCA and plug the sump. The analyses that support NUREG/CR-6771 (which include NUREG/CR-6762, 6882, and 5561) analyze the debris expected in containments around the country. Therefore, the sump failure probabilities in NUREG/CR-6771 are not based on debris-free containments. As shown above, the generic debris generation amounts used in the GSI-191 study were between 100 and 500
LER 346/06-002 A-7 lbm for miscellaneous debris in containment for all LOCA types. The increased debris loading cannot be quantified from the information provided by the licensee, but, based on discussions with NRC staff and from GSI-191 documentation, it can be concluded that the Davis-Besse containment debris would be mostly particulate and is on the same order of magnitude as the baseline particulate amounts. Additionally, the possibility that the debris contains a small amount of fiber will be considered.
As part of GSI-191 research, paint chips (non-qualified coatings) have been observed to produce a concrete-like substance when combined with fibrous debris on a sump screen. The amount of unqualified coatings that would reach the sump cannot be easily quantified, but is assumed to be much larger than the amount in the base case. It is assumed that any coatings impacted by the LOCA flow would be removed, since coatings are not qualified for the mechanical forces associated with direct impingement from LOCA flows. The decreased sump reliability would come from the unqualified coatings being loosened from the painted surfaces by the high heat and humidity, and washed toward the sump by containment spray and other condensing water.
SLOCA - The increase in particulate mass from unqualified coatings moves the expected mass of debris up in parallel to the FTDL curve described in NUREG/CR-6771. Since the mass change relative to the FTDL curve is in parallel to the curve, the conditional probability of sump failure would not change. A change in fiber volume could change the probability of sump failure, according to th FTDL curve. Fiber volume would have to increase by a factor of about 5 to change the conditional probability. Based on reports by the licensee and discussions with NRC staff, the fiber volume in containment reported in the LER would increase the total fiber in containment by less than a factor of 5. Therefore the sump failure probability is assumed to remain at 0.01.
MLOCA - The increase in particulate mass moves the expected debris up in parallel to the FTDL curve. However, since it is moving in parallel to the curve, this does not change the conditional probability. As with the SLOCA described above, fiber volume would have to increase by a factor of about 5 to change the conditional probability, which is considered to be unlikely. Therefore the sump failure probability is assumed to remain at 0.1.
LLOCA - In the base case, the expected range of debris spans the FTDL curve. Increased particulate (a factor of 3) could fairly quickly move the expected range of debris to entirely above the curve. Increased fiber would have little effect, since the base case has more than enough fiber to plug the sump. Therefore, the sump failure would stay about the same as the base case or only increase slightly, so the failure probability is assumed to be in the range from 0.6 to 0.9.
LER 346/06-002 A-8 Sump Failure Probability for Head LOCAs, with Baseline Conditions The licensee and NRC staff report that there is essentially no fibrous insulation in the area above and around the vessel head. All fibrous insulation is around the piping in the RCS loops.
Although the very long range effects of energetic vessel head LOCAs could dislodge some fiber elsewhere in the containment. The potential for generating fibrous debris is much lower than baseline LOCA scenarios (i.e., scenarios including RCS loop LOCAs). Transport factors for fibrous debris during a head LOCA would be about the same as for the baseline LOCA scenarios. Particulate generation in the area of the head would be about the same as for anywhere else in containment, however the transport would be a little less efficient because much of the debris would fall into the reactor cavity area and sink to a level lower than the inlet of the sump.
SLOCA - The decrease in fibrous volume moves the expected debris to the left, directly away from the FTDL curve. The decrease in sump failure probability would be roughly proportional to the decrease in fiber generation. Therefore the sump failure probability is assumed to decrease from the baseline value of 0.01 to 0.001.
MLOCA - The decrease in fibrous volume moves the expected debris to the left, directly away from the FTDL curve. The decrease in sump failure probability would be roughly proportional to the decrease in fiber generation. Therefore the sump failure probability is assumed to decrease from the baseline value of 0.1 to 0.01.
LLOCA - In the base case, the expected range of debris spans the FTDL curve. As above, the decrease in sump failure probability would be roughly proportional to the decrease in fiber generation. Decreasing the amount of fiber could move just to the left of the FTDL, giving a failure probability of 0.1 or possibly far enough to the left of the FTDL to make the failure probability as low as 0.01. Therefore, sump failure probabilities of 0.1 and 0.01 will be considered.
Sump Failure Probability for Head LOCAs, with Unqualified Coatings and Debris The sump condition for head LOCAs with unqualified coatings and debris are generally in the very low fiber area of the FTDL curve. Since they are generally in the far left portion of the FTDL charts, generation of a few cubic feet of fiber can have a large effect on sump failure probabilities. The failure probabilities are generally less sensitive to the particulate (unqualified coatings) which have low transport fractions because there is not enough fiber present on the sump screen to lead to a high probability of sump failure.
SLOCA - The increased amounts of debris moves the expected debris upwards, generally parallel to the FTDL curve. However, some increase in sump failure probability may be noted because the increase in debris may move the expected range of debris from below the inflection point in the FTDL curve to above the deflection point. Therefore the sump failure probability would stay the same or possibly increase from the baseline head LOCA value. Sump failure probabilities of 0.001 and 0.01 will be considered.
LER 346/06-002 A-9 MLOCA -The increased amounts of debris moves the expected range of debris upwards, parallel to the FTDL curve. The results are very sensitive to small amounts of fiber, so a slight increase in fiber content could move the expected range of debris toward the FTDL, thus increasing the estimated sump failure probability. Therefore the sump failure probability would stay the same or possibly increase from the baseline head LOCA value.
Sump failure probabilities of 0.01 and 0.1 will be considered.
LLOCA - The increased amounts of debris moves the expected range of debris upwards, parallel to the FTDL curve. The results are sensitive to small amounts of fiber, so a slight increase in fiber content could move the expected range of debris toward the FTDL, thus increasing the estimated sump failure probability. The expected range of debris would remain all or mostly to the left of the vertical portion of the FTDL curve. Therefore, sump failure probabilities of 0.1 and 0.4 will be considered.
Table 3. Parameters for the ASP Analysis.
Sump Failure Probabilities for Various Scenarios LOCA Scenarios Baseline With unqualified coatings and debris All LOCAs PTrans=0.001 PSLOCA=0.01 PMLOCA=0.1 PLLOCA=0.6 PTrans=0.001 PSLOCA=0.01 to 0.1 PMLOCA=0.1 PLLOCA=0.9 Reactor Vessel Head LOCAs only PTrans=0.001 PSLOCA=0.001 PMLOCA=0.01 PLLOCA=0.01 to 0.1 PTrans=0.001 PSLOCA=0.001 to 0.01 PMLOCA=0.01 to 0.1 PLLOCA=0.1 to 0.4 Note that unqualified coatings do not affect sump performance during a transient because there is no mechanism (containment spray or LOCA) to transport the coatings to the sump. Since the reported debris was not generally in the sump, and, even if there was debris in the sump, during a transient sump flow velocities are too low to efficiently transport debris to the sump screen, there is no significant change in sump failure probabilities for transient event sequences.
LER 346/06-002 A-10 3.5 Equipment Failure Due to Debris in Containment (for reasons other than the HPI pump design deficiency and sump plugging)
A small opening (3/4" x 6" ) was reported in Davis-Besses sump screen (Reference 2). This section discusses the potential for equipment failure due to debris entering the ECCS system through this opening.
In order for debris to get into the ECCS, it would first have to be broken from its location in containment by the force of the LOCA or the CS flow. Then the debris would have to be transported through containment to the sump during recirculation. Finally, the debris would have to pass through the sump screen to get to the ECCS equipment.
Previous discussions on sump failure probability have focused on fibrous and particulate debris.
Well designed pumps and ECCS equipment should continue to function in the presence of any fibrous or particulate debris that makes it through the sump screen. (Reference 13.) According to GSI-191 research, the amount of small debris entering the system is proportional to the flow area. The 3/4" x 6" opening is only slight increase above the flow area designed into the sump screen. Additionally, according to GSI-191 research, most of the debris that is transported is fibrous or small, light particulate and would not affect system operation. Properly designed ECCS components will operate If reflective metal insulation (RMI) or other solid debris should enter the ECCS system, HPI pumps and/or HPI pump discharge throttle valves could fail. The debris would have to arrive at the exact point of the opening with the correct orientation to pass through the 3/4" x 6" opening in the sump screen. The debris could go to the ECCS or the CS system. It would then have to pass through the system piping without getting caught in the numerous areas that it would do no harm whatsoever. In the low pressure areas of the ECCS system, the pipes are quite large and velocities are low. The debris could easily get caught in a low area or on valve internals with no measurable effect on flow.
In the unlikely event that debris reached the low pressure, centrifugal DHR pumps, the centrifugal pumps would most likely pass the debris without a failure. Any friable debris would be broken into small pieces by the low pressure pumps. The debris would have to pass through the low pressure area of the system to the high pressure pumps. The piping and valving are large enough in the low pressure system that debris from the 3/4" x 6" opening in the sump screen would not cause a blockage.
If ingested into the HPI pumps, damage is possible, especially from RMI. However, reduced performance of the HPI pumps (from scoring or damaged seals) would be more likely than catastrophic failure. The only place the flow path is tortuous enough to hypothesize clogging is in the HPI discharge valves. A piece of debris could position itself in a manner that affects the flow through these throttle valves. Therefore, it is assumed that the likelihood of failure of the recirculation function due to debris passage is much lower than the likelihood of failure of recirculation due to a plugged sump or due to the design deficiency in the HPI pumps.
LER 346/06-002 A - 11 Another possible effect of the debris would be to plug CS nozzles. This failure will not have an effect on the Level 1 SPAR model. The potential affect of plugged CS nozzles during recirculation is beyond the scope of the ASP program.
Therefore, the increased system failure probability due to debris passing through the opening in the sump is considered to be negligible compared to increased system failure probabilities from sump and HPI pump filter clogging. The likelihood of debris entering the 3/4" x 6" gap in the sump screen with not be treated probabilistically in this ASP analysis.
3.6 Sump Recovery per LA-UR-02-7562 The NRC directed a follow-on study to NUREG/CR-6771 to probabilistically address the possible recovery actions and conservatism in the sump failure analysis (Reference 8).
Recovery options were described in NUREG/CR-6771 but not further analyzed. The recovery options from debris-induced loss of net positive suction head (NPSH) are (1) continued cooling with ECCS recirculation and (2) alignment of an alternative source of borated cooling water.
Continued ECCS recirculation could be achieved by the pumps if they provide sufficient flow despite loss of NPSH margin or by operator actions to restore NPSH. Cooling with alternative sources of borated water involves realigning the pumps to injection mode and refilling the refueling water storage tank (RWST).
The recovery analysis uses the ASEP methodology for human error probabilities. This methodology differs from the SPAR approach in some respects, but is widely accepted in the PRA community. The ASEP is acceptable for this ASP analysis because it is generally considered to be more conservative than the SPAR methodology. Table 4 shows the non-recovery probabilities calculated in LA-UR-02-7562 for a generic plant.
Table 4. Sump Non-Recovery Probabilities Non-Recovery Event Large LOCA Medium LOCA Small LOCA &
transient Failure of ECCS Recirculation with Loss of NPSH Margin 0.46 0.16 0.025 Failure to Establish ECCS Injection 0.87 0.37 0.045 Net Non-Recovery Probability 0.4 0.06 0.001 From Attachment A, Section 5.0 of LA-UR-02-7562 The recovery actions in LA-UR-02-7562 have been reviewed with the staff at Davis-Besse, and are considered to be overly optimistic. The following recovery activities were considered, but are not credited in the ASP analysis:
LER 346/06-002 A - 12 Davis-Besse has a procedure to refill the RWST following a SGTR. Section 8.19.8 of DB-OP-0200 provides operators guidance to align the Clean Waste Receiver Tanks to the RWST in accordance with DB-OP-06101, Clean Radwaste System. The Clean Waste Storage Tank Transfer Pumps have a rated capacity of 140 gpm each. In event of a plugged sump, operators may resort to this procedure, but no probabilistic credit was given since no training or analysis supports this action.
Davis-Besse has no procedures or practices for establishing ECCS flow if they have indication of a failed or cavitating ECCS pumps. Any action to restore pump operation would be skill of the craft.
Back-flushing the sump screen (credited in LA-UR-02-7562) is impossible. No flow path is available EOPs do not contain guidance to shift back to injection following a failed sump. The only reasonably possible action would be to refill the RWST with water from the spent fuel pool. Operators would not start this action immediately, and would be very hesitant to start his action upon degradation of the recirculation. Davis-Besse does not credit this action in their PRA or safety analyses.
Therefore, the only recovery credit given is from Table 7 of Appendix A of LA-UR-02-7562. This takes into account the failure of ECCS pumps to operate with loss of ECCS margin each type of initiating event.
LA-UR-02-7562 (Appendix A, Table 7) provides non-recovery probabilities for loss of NPSH margin. These values are entered as PRA basic events.
LLOCA
÷ 0.8 MLOCA
÷ 0.5 SLOCA
÷ 0.4 Non-recovery probability for transient are not given in LA-UR-02-7562. They are assumed to be equal to the non-recovery probabilities for SLOCA. The SPAR model used in the ASP analysis includes an AND gate with sump failure rates and non-recovery probabilities as inputs.
LER 346/06-002 B-1 Attachment B Transient-Induced LOCA Probabilities This ASP analysis focuses on the LOCA initiating events occurring at normal operating pressure. However some transient events increase the reactor pressure enough to potentially result in transient-induced LOCAs. The power operated relief valves (PORVs) and safety valves (SVs) located on the pressurizer actuate at high pressure to limit RCS pressure increases. The SVs at Davis-Besse limit RCS pressure to 2525 psig for design-basis accidents.
The licensee has provided a table of the number of times the Davis-Besse RCS has reached various pressure levels above its normal operating value. None of these pressure transients has reached the SV setpoint at Davis-Besse. However, other plants have experienced pressure transients that actuated their pressurizer SVs. Davis-Besse provided an estimate of the frequency of reaching the SV setpoint, using the number of years of operation and a Bayesian statistical process. That estimate appears to be reasonable and slightly conservative in comparison with the statistics available for the operational transients at other plants.
For the RCS pressure to increase beyond the SV setpoint, an operational event that is more severe than the plant is designed to handle would need to occur. Anticipated transient without scram (ATWS) events fall into this category. A review of plant PRAs shows that the frequency for this type of event is less than 1x10-5/reactor-year.
On the basis of these considerations, the frequencies used in this significance determination for reaching various pressure levels in the Davis-Besse RCS are listed in Table B-1. The Oak Ridge National Laboratory (ORNL) has estimated the failure pressure for the as-found cavity to be between 2700 and 3300 psig in Reference 11. For convenience, a normal distribution was used, with a mean of 3000 psig and a standard deviation of 182 psig. The probability of a LOCA for each pressure range was calculated by multiplying the frequency of exceeding each range times the probability of LOCA from the normal distribution times the length of the study period
year). The total probability of a LOCA is the sum of the probability of a LOCA from each pressure range. That gives a total probability of an induced LOCA of about 2E-4 as shown in the table below. Note that this is much lower than the LOCA initiating event frequencies calculated in Reference 11.
Table B-1. Frequency of Operation within Specific RCS Pressure Ranges at Davis-Besse RCS Pressure Frequency of Occurrence Frequency of Probability of Exceeding Range Base LOCA 2185 psig 1.0 [operation 1.0 [operation]
3.95E-6 2250-2300 psig 0.254/rx-yr 0.98/rx-yr 1.93E-5 2300-2350 psig 0.508/rx-yr 0.73/rx-yr 4.54E-5 2350-2400 psig 0.127 /rx-y 0.22/rx-yr 4.07E-5 2400-2450 psig 0.0635/rx-yr 0.095/rx-yr 4.78E-5 2450-2525 psig 0.0317/rx-yr 0.0317/rx-yr 4.07E-5 *
> 2525 psig
< 0.00001/rx-yr
< 0.00001/rx-yr 1.00E-5 Total probability of a LOCA 2.08E-4
LER 346/06-002 B-2 The choice of a normal distribution is neither supported or refuted by the calculations shown in Reference 11, so the probability of a transient-induced LOCA is assumed to be an order of magnitude (2E-3) higher for the purposes of the ASP analysis, and is used for the event INDUCED-MLOCA-TRANSIENT. This accounts for uncertainty induced by the selection of this distribution.
According to the SPAR model (Ref. 10), PORVs open for 4% of transients, 16% of LOOPs and 37% of SBO sequences. For the purpose of ASP analysis, it is assumed that the ratio of PORV lifts for the various sequences can be used to scale the LOCA probabilities. Therefore, the LOCA probability for LOOP sequences is (16%÷4%)*2E-3 = 8E-3, which is used for event INDUCED-MLOCA-LOOP. The LOCA probability for SBO sequences is (37%÷4%)*2E-3 =
1.85E-2, which is used for event INDUCED-MLOCA-SBO. An ATWS scenario would result in the PORV opening and possibly a pressure increase well beyond the PORV setpoint. Since the hypothetical pressure increases may be significant, the ASP analysis will assume that an ATWS initiates a LOCA from the head.
The induced LOCA could be a SLOCA, MLOCA or LLOCA. However, since the SLOCA is the most likely LOCA, and the success criteria are similar for a MLOCA, these events are inserted into the same location in the SPAR model and stuck open PORVs. The risk of the scenarios is dominated by HPR failure in the various sensitivity analyses. Because the probabilities are conservative, it is concluded that these events are probabilistically less important than LOCAs initiated by alternate metallurgical scenarios modeled in the initiating event probability calculations.
LER 346/06-002 C-1 Attachment C Sensitivity Analyses The Davis-Besse ASP analysis does not contain a parametric uncertainty analysis, because the parameters that dominate the risk increase do not have well established parametric uncertainty distributions. Instead, a structured sensitivity analysis that shows the variation attributable to various engineering assumptions one parameter at a time.
LOCA Frequency The metallurgical analysis (Ref. 11) performed a detailed sensitivity analysis by varying assumptions and data about the materials and phenomena associated with vessel head failure. The cases that produced the highest and lowest risk estimates are shown in the sensitivity analysis. Table C-1 shows spreadsheet calculations of the risk for each of the cases. Cases ASP-01 (best estimate), ASP-04, ASP-05 and ASP-09 also have GEM runs and are tabulated in Table 5 of the ASP analysis. Note that cases with higher LLOCA or MLOCA estimates lead to higher risk estimates. The total probability of a LOCA does not vary from case-to-case, but as the probabilities of the various LOCA sizes change, the risk changes between mid-10-3 to mid-10-2.
The best estimates of key sump and HPI pump parameters (with the performance deficiencies) were used for all LOCA sensitivity calculations as follows:
HPR-SMP-LL-SUMP = 0.2 HPR-PMP-FL-MLOCA = 1.0 HPR-SMP-ML-SUMP = 0.03 HPR-PMP-FL-SLOCA = 1.0 HPR-SMP-SL-SUMP = 0.003 Table C-1. Sensitivity to LOCA Analysis Assumptions Case LOCA Probabilities Numbers No LOCA SBLOCA MBLOCA LBLOCA in Report
~ CDP 79.935%
16.923%
0.497%
2.645%
ASP-001 0.006 82.177%
16.947%
0.244%
0.632%
ASP-004 0.002 86.073%
6.191%
7.733%
0.003%
ASP-005 0.007 75.248%
2.005%
14.182%
8.565%
ASP-009 0.028 82.881%
7.452%
9.615%
0.052%
ASP-002 0.009 79.955%
2.926%
14.230%
2.889%
ASP-003 0.018 75.245%
15.869%
0.753%
8.133%
ASP-007 0.016 82.235%
3.838%
13.202%
0.725%
ASP-006 0.013 77.253%
7.955%
13.549%
1.243%
ASP-008 0.014 The best estimate analysis gives a CDP of about 6E-3, while many of the more conservative analyses give risk estimates about twice that high. While this change is significant, it is well within the uncertainty bounds of normal PRA studies. It shows that the risk is around, and not significantly higher than 1E-2. The technical details of the
LER 346/06-002 C-2 sensitivity cases are shown in Reference 11. The sensitivity analyses include many issues, but do not include the following considerations that have been discussed in the context of Davis-Besse:
The limitations of the expert elicitation, including the possibility of different experts or different questions producing different results; The possibility of discovering the head degradations on a different date because either the NRC (hypothetically) did not order increased head inspections or the NRC did not become aware of CRDM cracking at Oconee, or The potential for a higher plant capacity factor to have created the as-found level of degradation at an earlier date.
Sump Performance Ten sensitivity cases were analyzed to show the effects of sump performance under various conditions and assumptions. These sensitivity cases show the effects of increased sump failure probabilities for individual sequences, and show the risk estimates for essentially certain sump failure.
The best estimates of key LOCA probabilities and HPI pump parameters (with the performance deficiencies) were used for all sump sensitivity calculations as follows:
IE-SLOCA = 15%
HPR-PMP-FL-MLOCA = 1.0 IE-MLOCA = 3%
HPR-PMP-FL-SLOCA = 1.0 IE-LLOCA = 3%
Case L S0 H - Sump at historic value (CDP = 2E-3)
Key parameter - HPR-SMP-FC-SUMP = 5E-5 The sump failure probability was set to 5E-5 for all sequences, consistent with the historic estimate. The CDP was 2E-3, or about a third of the best estimate CDP estimate of 6E-3. Even with a highly reliable sump, the condition at Davis-Besse is a significant precursor.
Case L S1a H - Sump without debris (baseline for head LOCAs)(Low estimate)
Case L S1b H - Sump without debris (baseline for head LOCAs)(High estimate)
(CDP =4E-3)
Key parameters -
HPR-SMP-LL-SUMP = 0.01 to 0.1 HPR-SMP-ML-SUMP = 0.01 HPR-SMP-SL-SUMP = 0.001 The sump failure probability was set to a baseline value that was quantified using the methods developed during GSI-191. This represents the Davis-Besse sump
LER 346/06-002 C-3 without considering the unqualified coatings and debris reported in the LER. The CDP of the situation at Davis-Besse without any deficiencies related to sump performance would be between 3E-3 and 5E-3.
Case L S2 H - Sump with debris - low estimates (CDP = 4E-3)
Case L S3 H - Sump with debris - SLOCA high, MLOCA & LLOCA low (CDP = 4E-3)
Case L S4 H - Sump with debris - MLOCA high, SLOCA & LLOCA low (CDP = 5E-3)
Case L S5 H - Sump with debris - LLOCA high, MLOCA & SLOCA low (CDP = 1E-2)
Key parameters -
HPR-SMP-LL-SUMP = 0.1 to 0.4 HPR-SMP-ML-SUMP = 0.01 to 0.1 HPR-SMP-SL-SUMP = 0.001 to 0.01 This group of sensitivity analyses shows the effect of using the lower estimates for sump failure parameters and then raising the value to the upper estimate for each type of LOCA scenario, one scenario at a time. It shows that the CDP is not particularly sensitive to estimations of parameters in SLOCA and MLOCA sequences, but very sensitive to estimates in LLOCA sequences. Conservative quantification of sump performance in a LLOCA can drive total CDP calculations to approximately 1E-2.
Case L S6 H - Sump with debris - Geometric means of estimates - Best estimates (CDP = 6E-3)
Key parameters -
HPR-SMP-LL-SUMP = 0.2 HPR-SMP-ML-SUMP = 0.03 HPR-SMP-SL-SUMP = 0.003 The parameter estimation approach for sump failure probabilities often leads to ranges of estimates. When two credible estimates that vary by a large amount are possible with slight changes to debris characteristics, using a central estimate is prudent. The geometric mean (i.e., the square root of the product of the estimates) was chosen for the best estimate case.
Case L S7 H - Sump with debris - high estimates for all parameters (CDP = 1E-2)
Key parameters -
HPR-SMP-LL-SUMP = 0.4 HPR-SMP-ML-SUMP = 0.1 HPR-SMP-SL-SUMP = 0.01 Using the highest estimate for all sump failure parameters shows that the CDP is approximately 1E-2.
Case L S8 H - Sump with debris - Sump failed for all LOCAs, unreliable for feed & bleed.
Recovery credited. (CDP = 3E-2)
Case L S9 H - Sump with debris - Sump with debris - Sump failed for all LOCAs, unreliable for feed & bleed. Recovery not credited. (CDP = 4E-2)
LER 346/06-002 C-4 Key parameters -
HPR-SMP-LL-SUMP = 1 HPR-SMP-ML-SUMP = 1 HPR-SMP-SL-SUMP = 1 HPR-SMP-TR-SUMP = 0.01 HPR-XHE-LL-SUMP = 0.8 HPR-XHE-ML-SUMP = 0.5 HPR-XHE-SL-SUMP = 0.4 HPR-XHE-TR-SUMP = 0.4 These sensitivity cases are for extremely pessimistic assumptions about sump performance, and shows the effect of recovery (operation with loss of NPSH margin).
These high estimates of sump reliability can increase CDP calculations by nearly an order of magnitude.
HPI Pump Performance Engineering analyses concluded that the HPI pumps will fail if these pumps were called upon to pump water carrying even a small amount of fiber or debris. Licensee testing at Wyle Labs performed to validate the previously existing and redesigned pump internals confirmed that failures would occur fairly quickly. The best estimate case therefore assumed failure of the HPI pumps. Sensitivity cases went from nominal performance of the pump to certain failure for all recirculation, including water from the PORV relief tank.
Since the condition of the sump and vessel head dominate the analysis, all HPI pump sensitivity cases did not provide CDP that differed substantially from the base case.
The best estimates of key LOCA probabilities and sump failure parameters (with the performance deficiencies) were used for all HPI pump sensitivity calculations as follows:
IE-SLOCA = 15%
HPR-SMP-SL-SUMP = 0.003 IE-MLOCA = 3%
HPR-SMP-ML-SUMP = 0.03 IE-LLOCA = 3%
HPR-SMP-LL-SUMP = 0.2 Case L S H1 - HPR nominal (CDP = 5E-3)
Key parameters -
HPR-PMP-FL-MLOCA = FALSE HPR-PMP-FL-SLOCA = FALSE HPR pump failure to start and run events are at nominal PRA values (Ref. 10)
With the HPR functioning normally, the risk of the conditions is middle of the 10-3 range and about 2/3 of the best estimate risk.
Case L S H2 - HPR failed for MLOCA only (CDP = 6E-3)
Key parameters -
HPR-PMP-FL-MLOCA = 1.0 HPR-PMP-FL-SLOCA = FALSE HPR pump failure to start and run events are at nominal PRA values (Ref. 10) for SLOCAs
LER 346/06-002 C-5 This case models the assumption that only MLOCAs produces enough debris to fail the pumps in HPR mode. The CDP is only slightly smaller than the best estimate.
Case L S H3 - HPR failed for MLOCA and SLOCA only (CDP = 6E-3)
Key parameters -
HPR-PMP-FL-MLOCA = 1.0 HPR-PMP-FL-SLOCA = 1.0 PPR-SRV-CO-TRAN = FALSE PPR-SRV-CO-TRAN is set to FALSE, to remove the possibility of the SRVs sticking open in a transient. The best estimate case assumed that a stuck open SRV creates enough debris to fail the HPR pumps. This assumption does not result in a change to the risk estimates.
Case L S H4 - HPR failed for all scenarios (CDP = 9E-3)
Key parameters -
HPR-PMP-FL-MLOCA = 1.0 HPR-PMP-FL-SLOCA = 1.0 HPR-XHE-XM = 1.0 This case models the failure of the HPR in all scenarios, adding the certain failure of the HPR transient sequences in which bleed and feed is used. The assumptions would imply large amounts of fibrous debris are in the containment sump area. Since use of bleed and feed generates essentially no debris, this scenario is not considered realistic, but is included for completeness.
Vessel Head Only The sensitivity analyses done for a degraded reactor vessel head only to look at the CDP without effects from the sump or HPR pumps.
Key parameters -
HPR-PMP-FL-MLOCA = FALSE HPR-PMP-FL-SLOCA = FALSE HPR-SMP-FC-SUMP=5E-5 HPR pump failure to start and run events are at nominal PRA values (Ref. 10)
LOCA probabilities from Table C-1 Case SDPL1 SH HN - ASP-04 (CDP = 4E-4)
Case SDPL2 SH HN - ASP-05 (CDP = 5E-4)
Case SDPL3 SH HN - ASP-01 (CDP = 6E-4)
Case SDPL4 SH HN - ASP-09 (CDP = 2E-3)
The results of the cases listed above show that the CDP for the head failure, run with nominal HPR and sump performance is clearly greater than 1 x 10-4, matching the RED finding of Reference 4.
LER 346/06-002 C-6
&5'0RQO\\
The CRDM nozzle ejection frequency calculation (Ref. 14) performed a sensitivity analysis by varying the stress parameter and taking the 5th and 95th percentiles of the Monte Carlo-generated results. The best estimate is the mean of this distribution when the stress parameter is set to use the sample window derived from the Weibull scale parameter theta estimate:
0.010 (Mean of distribution with K parameter = 0.)
The upper sensitivity value for IE-MLOCA is the 95th percentile value of the IE-MLOCA distribution for which the stress is set to the maximum value for all Monte Carlo samples (K=1). This value is:
0.016 (95% of distribution with K parameter = 1.)
The lower sensitivity value for IE-MLOCA is the 5th percentile value of the IE-MLOCA distribution for which K samples are drawn from the full range of the K parameter.
This value is:
0.0021 (5% of distribution with K parameter = -1.)
All of the CRDM sensitivity cases use historic sump failure probability and nominal performance of the HPI system, which reflects the expected condition at Davis-Besse.
1 year cases: Cases CRDM1y SH HN, CRDM2y SH HN, and CRDM3y SH HN were done for a duration of one year.
Case CRDM1y SH HN - IE-MLOCA = 0.0021 CDP=2E-5 Case CRDM1y SH HN - IE-MLOCA = 0.01 CDP=5E-5 Case CRDM1y SH HN - IE-MLOCA = 0.016 CDP=7E-5 These sensitivity analyses show the variation possible for the ASP analysis from the CRDM ejection frequency only. Note that the range of CDPs from CRDM only is more than an order of magnitude lower than the range of CDPs from the vessel head only.
Therefore, the largest risk and greatest uncertainty comes from the head cavity, not CRDM ejection.
6 week cases: Cases CRDM1w SH HN, CRDM2w SH HN, and CRDM3w SH HN were done for a duration of one year.
Case CRDM1y SH HN - IE-MLOCA = 0.0021 CDP=2E-6 Case CRDM1y SH HN - IE-MLOCA = 0.01 CDP=6E-6 Case CRDM1y SH HN - IE-MLOCA = 0.016 CDP=8E-6 These sensitivity analyses are directly proportional to the 1 year cases. They show the risk increase for 6 weeks of operation. This is the risk increase due to CRDM ejection only that Davis-Besse incurred by shutting down 6 weeks after the NRC-proposed date of January 1, 2002. It also approximately represents the risk that would have been
LER 346/06-002 C-7 incurred if Davis-Besse was allowed to operate until their scheduled refueling date in early spring of 2002.
Sump Performance with nominal LOCA frequencies Ten sensitivity cases were analyzed to show the effects of sump performance under various conditions and assumptions. The sensitivity cases are identical to the cases described in Section 1, except the LOCA frequencies are set to their nominal values.
These cases show the potential impact of sump parameters for Davis-Besse without considering degradation of the vessel head. The SPAR model LOCA probabilities and HPI pump parameters (without the performance deficiencies) were used for all sensitivity calculations in this section Case LN S0 HN - Sump at historic value (CDP = - 5E-6)
Key parameter - HPR-SMP-FC-SUMP = 5E-5 The sump failure probability was set to 5E-5 for all sequences, consistent with historically accepted values. The CDP is listed as negative, because this case is not the baseline case for analysis and the risk is below the baseline. The baseline is Case LN S1 HN. This case tells you that at Davis-Besse, with no performance deficiencies, GSI-191 parameters raise the CDP (which is a CDF in this case) by 5E-6, or about 10%.
Case LN S1 HN - Sump without debris (baseline for head LOCAs)(Low estimate)
(CDP = 0)
Key parameters -
HPR-SMP-LL-SUMP = 0.6 HPR-SMP-ML-SUMP = 0.1 HPR-SMP-SL-SUMP = 0.01 The sump failure probability was set to a baseline value that was quantified using the methods developed during GSI-191. This represents the Davis-Besse sump without considering the unqualified coatings and debris reported in the LER. The total CDF of the situation at Davis-Besse without any deficiencies, but using GSI-191 parameters for the sump instead of the basic SPAR parameter is 6.3E-5\\yr..
Case LN S2 HN - Sump with debris - low estimates (CDP = 1E-6)
Case LN S3 HN-Sump with debris - SLOCA high, MLOCA & LLOCA low (CDP = 2E-6)
Case LN S4 HN - Sump with debris - MLOCA high, SLOCA & LLOCA low (CDP = 3E-6)
Case LN S5 HN - Sump with debris - LLOCA high, MLOCA & SLOCA low (CDP = 1E-6)
Key parameters -
HPR-SMP-LL-SUMP = 0.9 HPR-SMP-ML-SUMP = 0.1 HPR-SMP-SL-SUMP = 0.01 to 0.1
LER 346/06-002 C-8 This group of sensitivity analyses shows the effect of using the lower estimates for sump failure parameters and then raising the value to the upper estimate for each type of LOCA scenario, one scenario at a time. It shows that the CDP is not particularly sensitive to estimations of parameters in LLOCA sequences, and is a little more sensitive to estimates in SLOCA and MLOCA sequences.
Case LN S6 HN - Sump with debris - Geometric means of estimates - Best estimates (CDP = 1E-6)
Key parameters -
HPR-SMP-LL-SUMP = 0.9 HPR-SMP-ML-SUMP = 0.1 HPR-SMP-SL-SUMP = 0.03 The parameter estimation approach for sump failure probabilities often leads to ranges of estimates. When two credible estimates that vary by a large amount are possible with slight changes to debris characteristics, using a central estimate is prudent. The geometric mean (i.e., the square root of the product of the estimates) was chosen for the best estimate case.
Case LN S7 HN - Sump with debris - high estimates for all parameters (CDP = 4E-6)
Key parameters -
HPR-SMP-LL-SUMP = 0.9 HPR-SMP-ML-SUMP = 0.2 HPR-SMP-SL-SUMP = 0.01 to 0.1 Using the highest estimate for all sump failure parameters shows that the CDP can go well into the 10-6 range. For the MLOCA, the sump failure probability was set to 0.2 to establish a small penalty for the debris. The CDP is much more sensitive to changes in the sump failure probability for MLOCAs than for LLOCAs or SLOCAs because LLOCAs have a very low frequency and SLOCAs have alternative success paths.
Case LN S8 HN - Sump with debris - Sump failed for all LOCAs, unreliable for feed &
bleed. Recovery credited. (CDP = 3E-5)
Case LN S9 HN - Sump with debris - Sump with debris - Sump failed for all LOCAs, unreliable for feed & bleed. Recovery not credited. (CDP = 7E-5)
Key parameters -
HPR-SMP-LL-SUMP = 1 HPR-SMP-ML-SUMP = 1 HPR-SMP-SL-SUMP = 1 HPR-SMP-TR-SUMP = 0.01 HPR-XHE-LL-SUMP = 0.8 HPR-XHE-ML-SUMP = 0.5 HPR-XHE-SL-SUMP = 0.4 HPR-XHE-TR-SUMP = 0.4
LER 346/06-002 C-9 These sensitivity cases are for pessimistic assumptions about sump performance, and shows the effect of recovery (operation with loss of NPSH margin). These high estimates of sump reliability can increase CDP calculations by nearly an order of magnitude.
The sensitivity analyses done for the sump with nominal LOCA frequencies vary from low in the 10-6 range to the middle of the 10-5 range, supporting the YELLOW finding.
HPI Pump Performance with nominal LOCA frequencies Engineering analyses follow from Item 3 above. The SPAR model LOCA probabilities and sump failure parameters (without the performance deficiencies) were used for all HPI pump sensitivity calculations.
Case LN SN H1 - HPR nominal (CDP = 0)
Key parameters -
HPR-PMP-FL-MLOCA = FALSE HPR-PMP-FL-SLOCA = FALSE HPR pump failure to start and run events are at nominal PRA values (Ref. 10)
This run simply yields the SPAR model basic sequence frequencies, with a total CDF of 6.3E-5/yr..
Case LN SN H2 - HPR failed for MLOCA only (CDP = 2E-6)
Key parameters -
HPR-PMP-FL-MLOCA = 1.0 HPR-PMP-FL-SLOCA = FALSE HPR pump failure to start and run events are at nominal PRA values (Ref. 10) for SLOCAs This case models the assumption that only MLOCAs produces enough debris to fail the pumps in HPR mode. The CDP is only slightly smaller than the best estimate.
Case LN SN H3 - HPR failed for MLOCA and SLOCA only (CDP = 3E-6)
Case LN SN H4 - HPR failed for all scenarios (CDP = 3E-6)
Key parameters -
HPR-PMP-FL-MLOCA = 1.0 HPR-PMP-FL-SLOCA = 1.0 PPR-SRV-CO-TRAN = FALSE PPR-SRV-CO-TRAN is set to FALSE, to remove the possibility of the SRVs sticking open in a transient in LN SN H3, and returned to nominal in LN SN H4. LN SN H4 best estimate case assumed that a stuck open SRV creates enough debris to fail the HPR pumps. This assumption does not matter in the risk estimates.
Case LN SN H5 - HPR failed for all scenarios (CDP = 2E-4)
Key parameters -
HPR-PMP-FL-MLOCA = 1.0
LER 346/06-002 C-10 HPR-PMP-FL-SLOCA = 1.0 HPR-XHE-XM = 1.0 This case models the failure of the HPR in all scenarios, adding the certain failure of the HPR transient sequences in which bleed and feed is used. The assumptions would imply large amounts of fibrous debris are in the containment sump area. Since use of bleed and feed generates essentially no debris, this scenario is not considered realistic, but is included for completeness.