ML20128L838

Chapter 1 of Westinghouse RSAR, Internal Initiating Events

ML20128L838
Person / Time
Site:	05000601
Issue date:	06/28/1985
From:	WESTINGHOUSE ELECTRIC COMPANY, DIV OF CBS CORP.
To:
Shared Package
ML19304B194	List: ML20128L802 ML20128L809 ML20128L838 ML20128L847 ML20128L858 ML20128L887 NRC-85-0343, Forwards Proprietary & Nonproprietary Westinghouse Advanced PWR RESAR-SP/90,PDA Module 16, Probabilistic Safety Study, Vols 1 & 2
References
NUDOCS 8507110471
Download: ML20128L838 (46)

Text

1.0 INTERNAL INITIATING EVENT ANALYSIS The initial task of a plant risk assessment is to determine the accident initiators to be used to quantify accident sequences. This section identifies the initiators for the APWR probabilistic safety study which have the potential to trigger a sequence of events which could lead to core damage during plant power operation. The initiating event categories are defined to form a complete set in the sense that any internal initiator that could hypothetically result in core damage must cause one of the event categories to occur. The resultant categories are comprised of specific initiating events that were derived and identified from various reference sources. The frequencies with which these. initiating event categories occur, due only to internal plant considerations and the plant's electric grid, are subsequently determined.

Initiating events occurring during controlled shutdowns, cold shutdown and refueling are not included in this study as initiating events. They are not addressed because of the low potential for core damage due to the redundancy O of systems and long operator response times given that a failure has occurred when compared with the events initiated at power.

Accidents due to external causes such as earthquakes, fires and floods are also excluded. Additionally, sabotage events, internally or externally initiated, are excluded. . External initiating events are not included for the following reasons:

o Detailed knowledge of the site is unavailable and would be necessary to Q determine the frequency and severity of related external events.

o Detailed knowledge of the plant layout is unavailable.

o For the most part, these events relate to the design and layout of the safety buildings and not necessarily to the safety systems.

O W APWR-PSS 1-1 June,1985 59660:lD 8507110471 850628 PDR K ADOCK 05000601 PDR

However, it is estimated that the APWR systems would have an advantage with respect to external events because of their greater redundancy and diversity.

In addition, the plant layout provides a greater degree of separation between safety trains A and B and between safety equipment and control equipment.

1.1 INTERNAL INITIATING EVENT CATEGORIZATION All internal initiating events which could lead to core damage are systematically categorized. Core damage will occur if an insuf ficient core O cooling event or an excess core power event occurs.

Loss of core cooling can occur either due to a primary coolant boundary failure or due to insufficient heat removal and subsequent failures of essential safeguards systems. Primary coolant boundary failure results from loss of coolant accident (LOCA) discharges inside or outside of containment.

Insufficient heat removal cari occur because of inadequate core or Reactor Coolant System (RCS) heat removal or because of loss of secondary system heat removel capability.

Excess core power is directly initiated by a core power excursion event. The

! internal initiating event categories are defined logically. These categories are broken down into the ten initiating event categories shown on Table 1.1 -1. The event categories are logically categorized in such a manner that any internal initiator is 1.ncluded in at least one of the categories.

This section describes the basis for selection of the initiating events

! included in each category. The selection of initiating events for the i categories identified on Table 1.1-1 is an iterative process between the first categorization of initiators, the detemination of nomal plant response sequences and the construction of event trees.

Event tree and fault tree methodology is employed to determine the contribution to core damate frequency of each category. Each category is analyzed as a separate initiator and bounds, from the point of view of core damage state probability, the entire range of the initiating events categorized.

W APWR-PSS 1-2 June, 1985 5966Q:10

-._..,__.__.___t._

i-i I

The loss of DC power is not considered as an initiating event for the following reasons:

i) If AC power is available when Vital DC is lost, the running pumps will continue to run and other pumps can be started locally if needed.

Since loss of Vital DC 'is a rare event, it has no appreciable impact on plant risk.

l 11) If station blackout occurs following loss of a DC power circuit, the l turbine driven ' emergency feedwater pumps and back-up seal injection

~

! system will still be operable. Thus, such an event will progress like l ,

a station blackout. However, the frequency of loss of DC power is orders of magnitude lower than a station blackout event and is f considered to be accounted for in the station blackout accident sequence. Loss of Vital DC power is included in the failure of the

! Integrated Protection System which generates the safety (IPS)

~ injection and other signals following an initiating event. It is estimated that the loss of DC power would make up more than 90% of the

, IPS failures. Thus, loss of DC power concurrent with an initiating event is accounted for in the present model.

In conclusion, the loss of Vital DC power event is not deemed to result in a

[ dominant accident sequence. Failure of the IPS, which includes loss of vital DC power, is accounted for:in the station blackout event sequence.

i f 1.1.1 TRANSIENTS Transient events can be simply defined as non-LOCA initiating events.

However, it is not a simple task to identify all possible transient initiators and analyze their consequences. Transient events, as defined in 10 CFR 50, ,

Appendix A, are of two different types: anticipated transients and unanticipated transients or postulated accidents. EPRI NP-2230 (Ref. 3) was

! used as a basis for the identification of anticipated transients and WASH-1400 (Ref.1) was used for the unanticipated transients. Additional sources were used in reviewing the completeness of the lists of transient initiators (Refs.

2,4,5). -

W APWR-PSS 1-3 June, 1985 i

59660

10

--i='yrwe=urwd-p------,,yy p wp .r m.--iWe-mmgw yvwwwe.--wramur.-------pm-+y t-g--ymw_ mww w.e- =wm -m- __wwww

-www-

h i

i The listings of transient initiators included in this analysis are presented j ,

in Tables 1.1-2 and 1.1-3. Each transient initiator listed in these tables should be recognized as representing a group of similar transient initiators.

To illustrate this point, there are a variety of equipment malfunctions such as low suction pressure, overspeed, low feedwater pump bearing oil pressure, etc., that can cause a feedwater' pump trip and all are represented by the loss of feedwater flow initiator. .

! Except for the transients marked as included in another initiating event category, the transient initiators presented in Tables 1.1-2 and 1.1-3 have been traditionally' classified based on plant response, signal actuation, systems required for mitigation and subsequent plant related ef fects. For

! continuity and completeness, the traditional transient initiating event classifications are presented in Table 1.1-4. Whenever applicable, unanticipated transients are grouped together with anticipated transients.

! Because the plant response behavior is essentially the same for all of the transient initiating event classifications, all transients have been analyzed

) with one event tree in this study. Any minor differences that may exist

! between the classifications do not affect the accident sequence as modeled in the transient category event tree.

Breaks of small steam and feedwater branch lines, small leaks in secondary piping and spurious failure of steam generator relief or safety valves to the open position comprise small secondary side breaks. None of these postulated events results in a need for safety injection. These events are therefore j treated differently than large ruptures of secondary system piping. Recovery j from small secondary side breaks is similar to recovery from a transient.

l System operability and parameters will be identical following isolation of either the leak or the affected steam generator. The most likely event in

this category is the spurious opening of an atmospheric dump valve. However,

, these valves are provided with automatically-actuated motor-driven block I valves. These valves close on low steamline pressure, thus isolating the open i

j valve following reactor trip and the associated reduction in secondary side j steam flow. For these reasons, small secondary side breaks are analyzed in the transient event tree.

O W APWR-PSS 1 -4 June, 1985 l 59660:10

The introduction of the automatic steam generator overfill protection system may increase the number of transients due to inadvertent opening of one of the overfill protection valves. However, this potential increase is judged to be small compared to the number of transients assumed for this study.

1.1.2 LOSS OF 0FFSITE POWER This category was developed due to the unique ef feet that this transient has on the plant. A loss of offsite power event can be caused by either a complete loss of the offsite grid power accompanied by a turbine trip or loss of the onsite AC distribution system.

1.1.3 STEAM GENERATOR TUBE RUPTURE (SGTR)

Although this category could be included with small LOCAs, it is separated due to its unique effect on the plant. If steam generator safety or relief valves fail, a steam generator tube rupture may result in direct bypass of the containment boundary and, therefore, must be analyzed separately. Also, iricluded in this category are all abnormal leakages from the RCS into one steam generator which are in excess of the charging pump make up capacity and l would result in actuation of the ECCS. Multiple tube ruptures in a single SG l have a low frequency of occurrence, and due to the inclusion of the steam generator overfill system, plant recovery would not proceed differently from the single tube rupture event.

Based on historical plant operational data, the event of coincident tube rupture in multiple steam generators has an extremely low frequency, not only O as a random occurrence but also if considered as a consequence of other initiating events. The frequency of tube rupture in multiple steam generators is about two percent of the frequency of multiple tube ruptures in one steam generator. For this teason it is not included in this category.

O l

i l

1 M APWR-PSS 1-5 June,1985 59660:10

1.1.4 LARGE SECONDARY SIDE BREAK Many of the transient initiators f rom Tables 1.1-2 and 1.1-3 were grouped to form this initiating event category. It includes secondary line breaks both inside and outside of containment and multiple stuck open steam valves. The transient initiators included in the Large Secondary Side Break. category are shown on Table 1.1-5 and described in the following subsections.

1.1.4.1 SECONDARY SIDE BREAKS UPSTREAM OF MSIVS OR DOWNSTREAM OF MFWIVS Initiators included ^1n this category are transients that begin with a secondary side break upstream of the MSIVs. Also considered among these initiators are breaks located downstream of the MFWIVs. This category was developed due to the effect of having an unisolatable secondary side break that could lead to a severe cooldown of the reactor coolant system. Included.

in this category are unanticipated random pipe ruptures and failures of two or more unisolated steam generator relief or safety valves.

, 1.1.4.2 SECONDARY SIDE BREAKS DOWNSTREAM OF MSIVS OR UPSTREAM OF MFWIVS l This category considers all transients that begin with a secondary side break downstream of the MSIVs. Also included are breaks located upstream of the f MFW1Vs. As opposed to secondary side breaks upstream of the MSIVs, these breaks can be quickly; isolated without significant steam generator depressurization. Included under this category are random pipe ruptures and failures of two or more steam dump valves.

1.1. 5 SMALL LOSS OF COOLANT ACCIDENTS (< 6")

Loss of coolant accidents can be defined as any accident involving the rupture or failure of the reactor coolant boundary including piping, valves, pressure vessel and interconnecting systems. Reactor coolant pump seal failures are O also categorized under LOCA initiators.

initiators consider loss of The loss of coolant accident primary inventory inside and outside the containment structure.

O W APWR-PSS 1-6 June, 1985 59660:10

This category considers random ruptures of the RCS piping in the range f rom 3/8 ir:ch to 6 inches in diameter. Also considered in this category are reactor coolant pump seal LOCAs, f ailure of one or multiple power-operated relief valves or safety valves and small LOCAs from ruptured control rod drive housing and instrument line failures. Although initiators resulting in breaks of less than 3/8 inches in diameter are within the capability of the normal makeup system, if normal technical specification limits are exceeded, a reactor trip may be manually initiated. For this reason these small leakages f rom the RCS are categorized in reactor trip category.

1.1.6 LARGE LOCA (v 6")

This category considers any random ruptures of the reactor coolant system ranging f rom a 6-inch diameter break up to the double-ended rupture of the largest pipe in the system. The large LOCA category includes failures of the reactor pressure vessel that do not exceed the capability of the emergency core cooling system.

1.1. 7 ANTICIPATED TRANSIENT WITHOUT SCRAM (ATWS)

Anticipated Transient Without Scram (ATWS) is not an internal initiating event, but is a consequential failure resulting from other events. Therefore, ATWS is included as an initioting event category and has a detailed event tree analysis performed to determine core damage frequency.

1.1.8 INTERFACING SYSTENS LOCA This category considers RCS supporting systems that have direct piping connections to the RCS. Piping and/or valve ruptures associated with these systems have the potential to cause a LOCA with severe consequences which could disable the Emergency Core Cooling System (ECCS) functions and bypass

, the containment. The limiting factors in this type of event are possible loss

( of primary coolant outside the containment boundary and a direct release path to the environment.

O W APWR-PSS 1-7 . lune, 1985 5966Q:10

Initiating events included in this category are vessel injection line failure, hot leg injection line failure, RHR letdown line failure and pipe ruptures outside of conteinment in other interfacing systems.

1.1.9 VESSEL FAILURE This initiator category considers all catastrophic reactor vessel failures.

The leakage due to these failures is assumed to exceed the Emergency Core Cooling System cap.bility to maintain core cooling. Thus, since severe core damage is assumed ,due to the progression of this type of accident, it is categorizedseparatelh.

1.1.10 TOTAL LOSS OF AUXILIARY COOLING During the process of categorizing the transient initiators, it was apparent that certain transient initiators need special attention based on the effects that could arise. These transients can occur as a result of loss of either O the Component Cooling Water System (CCW) or the Essential Service Water (ESW)

System.

i j Component Cooling Water (CCW) is used to cool a number of plant systems, many l

of which are safety-related mitigation systems such as safety injection and the containment heat removal systems.

The main systems cooled by the CCW are as follows:

Reactor Coolant Pumps Containment Spray Pumps High Head ISS (HHSI) pumps, Residual Heat Removal (RHR) pumps, RHR heat exchangers Containment Fan Coolers Centrifugal Charging Pumps W APWR-PSS 1-8 June,1985 59660:10

The CCW System consists of two independent 100 percent capacity trains, each of which has a win and a back-up pump. Under normal conditions, only one pump in each train is operating. If, for any reason, the running train j becomes unavailable, the back-up CCW pump is started. The switchover is automatically initiated by low CCW pressure. At the same time, the ESW is

automatically realigned so that the CCWS is properly cooled. If the

, switchover to the second train fails, a total loss of CCW specific transient I

is generated.

O Because of the design connections between the CCW/ESW and various primary systems including the reactor coolant pumps / motors and the charging pumps, the loss of this cooling will result in reactor trip due to failure of one of these components.

l O

. O

!O l

r I,

O W APWR-PSS 1-9 June, 1985 59660:10

l' 4!

! TABLE 1.1-1 APWR INITIATING EVENT CATEGORIES

.i Event Tree No. Symbol Initiatina Event Cateaory 1

j 1 TRA Transients 2 LSP Loss of Offsite Power 3 SGR Steam Generator Tube Rupture 4 .- SSB Large Secondary Side Break

! 5 SLO Small LOCA < 6' i . 6 LLO Large LOCA > 6" l 7 ATW ATWS 8 ISL Interfacing Systems LOCA j 9 VEF Vessel Failure

10 LC1 Total Loss of Auxiliary Cooling lO l

i I

l O ,

l M APWR-PSS 1-10 June, 1985 5966Q:10

TABLE 1.1-2 ANTICIPATED TRANSIENT INITIATOR LIST FROM EPRI NP-2230 O EPRI NP-2230 Number Title Loss of RCS flow (1 loop)

O 1

2 Uncontrolled rod withdrawal 3 CROM problems and/or rod drop 4 Leakage from control rods 5 Leakage in primary system 6 Low pressurizer pressure 7 Pressurizer leakage 8 High pressurizer pressure 9 Inadvertent safety injection signal 11 CVCS malfunction - Boron dilution 12 Pressure / Temperature / Power imbalance-rod position error 13 Startup of inactive coolant pump 14 Total loss of RCS flow (all loops) 15 Loss of reduction in feedwater flow (1 loop) 16 Total loss of feedwater flow (all loops) 17 Full or partial closure of MSIV (1 loop) 18 Closure of' all MSIVs 19 Increase in feedwater flow (1 loop) 20 Increase of feedwater flow (all loops)

Feedwater flow instability - Operator error O

21 22 Feedwater flow instability - Misc. mechanical causes 23 Loss of condensate pump (1 loop) 24 Loss of all condensate pumps (all loops) 25 Loss of condenser vacuum 27 Condenser leakage W APWR-PSS 1-11 June, 1985 59660:10

-. . - _.- .- - ~ - . - - . . - - . _ . _

t i

TABLE 1.1-2 (Continued) r ANTICIPATED TRANSIENT INITIATOR LIST FROM EPRI NP-2230 I

EPRI NP-2230 -

Number Title

28 Misc. leakage in secondary system 29* Sudden opening of steam relief valves (Dump valves) 30 Loss of circulating water

31** Loss of component cooling 32** Loss of service water systems i 33 Turbine trip, throttle valve closure. EHC problems 34 Generator trip or generator-caused faults ,

35+ Total loss of offsite power 36 Pressurizer spray failure

! 37 Loss of power to necessary plant systems 38 Spurious trips cause unknown 39 Auto trip - no transient condition (Hardware error) 40 Manual trip - no transient condition (Operator error) i I

O

• One Valve Failed Open Included in Transient Category; Two Valves Failed Open Included in Secondary Side Break Category

• • Included in Total Loss of Auxiliary Cooling Category O + Included in Loss of Offsite Power Category I i

O M APWR-PSS 1-12 June, 1985 59660:10 ,

. TABLE 1.1-3 UNANTICIPATED TRANSIENT LIST 1 Control rod ejection Reactor coolant pump locked rotor 2

3 Reactor coolant pump shaft failure i 4* Feedwater line break downstream of MFW1V 5* Feedwater line break upstream of MFWIV 6* Steam line break downstream of MSIVs 7* Steam line break upstream of MSIVs 8** One or two steam generator relief valves fail open and unisolated 9** One or two steam generator safety valves fail open 10* Multiple steam dump valves fail open Multiple steam generator relief valves fail open and unisolated 11*

12* Multiple steam generator safety valves fail open j

t O

i

• Included in Secondary Side Break Category

• • One Valve Failed Open Included in Transient Category; Two Valves Failed Open Included in Secondary Side Break Category j W APWR-PSS 1-13 June,1985 5966Q:10

TABLE 1.1-4 TRANSIENT INITIATING EVENT CLASSIFICATIONS

1. Loss of Reactor Coolant Flow Loss of RCS flow (1 loop)

Total Loss of RCS flow Reactor Coolant Pump Locked Rotor Reactor Coolant Pump Shaft Failure

2. Loss of Main Feedwater Flow Total Loss of Feedwater Flow Feedwater Flow Instability - Operator Error Feedwater Flow Instability - Miscellaneous Mechanical Causes Loss of Condensate Pump (1 loop)

Loss of All Condensate Pumps O Condenser Leakage

3. Primary to Secondary Power Mismatch Full or Partial Closure of One or More MSIVs Increase in Feedwater Flow in One or More Loops Loss or Reduction in Feedwater Flow (1 loop)

4. Turbine Trip Closure of all MSIVs Miscellaneous Leakage in Secondary System Loss of Condenser Vacuum Loss of Circulating Water O Turbine Trip, Throttle Valve Closure. - EHC Problems Generator Trip or Generator-Caused Faults W APWR-PSS 1-14 . lune, 1985 5966Q:10

TABLE 1.1-4 (Continued)

, TRANSIENT INITIATING EVENT CLASSIFICATIONS

5. Reactor Trip Control Rod Drive Mechanism Problems and/or Rod Drop High or Low Pressurizer Pressure Pressurizer Spray Failure l

Spurious Trips - Cause Unknown i Manual Trip' Operator Error Auto Trip . Hardware Error i Pressure, Temperature or Power Imbalance - Rod Position Error l

Loss of Power to Necessary Plant Systems Leakage from Control Rods Leakage in Primary System Pressurizer Leakage 6 Core Power Excursion - Uncontrolled Rod Withdrawal and Boron Dilution i

Uncontrolled Rod Withdrawal Control Rod Ejection Startup of an Inactive Coolant Pump CVCS Malfunction . Boron Dilution 1 7. Spurious "S" Signal i

i Inadvertent Safety Injection Signal ,

8. Small Secondary Side Breaks One Steam Generator Relief Valve Fails Open and Unisolated j One Steam Generator Safety Valve Fails Open 1 One Steam Dump Valve Fails Open and Unisolated by MSIVs i

O M APWR-PSS 1-15 June, 1985 j 5966Q:10 i

I

i I

i l TABLE 1.1-5 SECONDARY SIDE BREAK INITIATING EVENT CLASSIFICATIONS

1. Seconda', Side Breaks' Upstream of MSIVs or Downstream of MFWIVs Steam Line Break Upstream of MSIVs Feedwater Line Break Ocwnstream of MFWIV Multiple Steam Generator Safety Valves Fail Open Multiple Steam Generator Relief Valves Fail Open and Unisolated

2. Secondary Side Breaks Downstream of MSIVs or Upstream of MFWIV Steam Line Break Downstream of MSIVs ,

Feedwater Line Break Upstream of MFWIV Multiple Steam Dump Valves Fail Open t

O l

O i

i O M APWR-PSS 1-16 June,1985 59660:10 l

. r a

1.2 INTERNAL INITIATING EVENT FREQUENCY QUANTIFICATION This section discusses the methods employed in deriving the frequency of f uccurrence of initiating events as categorized in Section 1.1 and listed in

Table 1.1-1. The resultant initiating event frequencies are sunnarized in v Table 1.2-1.

Because the plant is at the design stage, no plant-specific operating i experience is available for incorporation into the data analysis. Due to the 1

i lack of plant-specific data for the initiating events, estimates of the initiating event frequency distribution are based on USA PWR experience. An l exception is the steam generator tube rupture data which was derived from an l

extensive review of Westinghouse-manufactured plants, both in the USA and 1 abroad.

1 l Sources utilized in the analysis include an Electric Power Research Institute compilation of transient data, EPRI NP-2230, (Ref. 3), a Brookhaven Laboratory memorandum which connents on the Zion Probabilistic Safety Study (Ref. 7) and

. WASH-1400 (Ref. 1). Other sources have been also examined, such as

NUREG/CR-2815 (Ref.12) and NUREG/CR-2497 (Ref. 13). In EPRI NP-2230, data i from 36 operating pressurized water reactors (PWRs), representing 201 4 .

operating years, is assimilated into 41 transient categories.

l i

Reference PW9 event data are presented in Table 1.2-2 by plant versus initiating event. Table 1.2-3 lists the plants and operational years included

in the data base. With the exception of the small loss of coolant accidents, the data presented in Tables 1.2-2 and 1.2-3 is taken from EPRI NP-2230. The

) small LOCA event is noted in a Brookhaven Laboratory memorandum (Ref. 7) which j refers to a random reactor coolant pump seal failure at the H. B. Robinson

{ Plant. This event has been confirmed by a review of the plant operating history (Ref. 8). Large LOCAs and all the unanticipated transients have not been observed in the reference PWR experience and treatment of these rare events is discussed in Sections 1.2.4 and 1.2.6. For the loss of offsite power initiator a f requency derived from operating experience has been used.

1 l W APWR-PSS 1-17 June, 1985 59660:10 t

i

---

.-,-n.- - , - . - - . ,_ . - - - _ - ~ , - - - . . - _ _ - _ . ._

The initiating event data for Indian Point Unit 1, although included in EPRI NP-2230, is excluded f rom the calculations in Tables 1.2-3 and 1.2-4. It was excluded because the plant experience is not representative of current operational practices and of initiating event causes expected to occur in a Indian O newer generation of decomissioned.

plants.

Its initiating ' event data also shows marked differences from Point Unit 1 has already been other plants in the data : base. Additionally, Indian Point Unit 1 is a non-Westinghouse plant.

The quantification of each initiating event frequency is discussed in the following paragraph'. s 1.2.1 FREQUENCY OF TRANSIENT EVENTS From Table 1.2-3, the average transient event frequency per plant is calculated as:

2 = 10.3/ year f) = 3 in EPRI NP-2230, the transient occurrence rate for Westinghouse plants is estimated as:

fj = 9.71/ year For this analysis, the following estimate is used for the mean value of

, transient events:

i f) = 10/ year The variance is calculated by assuming a lognormal distribution and an error factor of 3 (EF = Xg5/X05) as:

V) = 56/ year .

i W APWR-PSS 1-18 June,1985 59660:10 I

c:t y>h This should be very conservative for the WAPWR because of its ambitious availability goals (<3% forced outages between refuelings) will result in i reduced trip frequency.

1.2.2 FREQUENCY OF LOSS OF 0FFSITE POWER EVENT The loss of offsite power event frequency is taken from EPRI NP-2301 (Reference 15). It is based on 45 loss of offsite power occurrences which occurred over the 370 years of plant operation for all of the plants included O' in the report. This frequency is:

f2 = 0.12/ year with a variance of:

-3 2 V2 = 8.1 x 10 / year which is calculated by assuming a lognormal distribution and an error factor of 3.

, 1.2.3 FREQUENCY OF STEAM GENERATOR TUBE RUPTURE EVENT Due to its unique effects on the plant the steam generator tube rupture initiating event frequency was calculated based on a detailed review of historical tube rupture data from domestic and foreign Westinghouse-manufactured plants and from Westinghouse licensee plants. This data, sunenarized on Table 1.2-4, totals over four million tube years since O consnercial operation. Because the data assumes continuous operation since the beginning of commercial operation, it is discounted 10 percent to 3.6 x 10 6 tube years to account for outages for steam generator replacement, plugged tubes and any other prolonged period of non-operation such as licensing action for seismic analysis.

O W APWR-PSS 1-19 June, 1985 59660:10

l

[

TU6E FAILURE RATE Table 1.2-5 presents a list of the five tube rupture events that have occurred in Westinghouse steam generators. Assuming there will be four advanced steam generators with 5626 tubes each,,the point estiniate for the frequency of steam generator tube rupture is calculated as:

f x = . x year 6

3 " 3.6 x 10 This estimate is conservative for the present design due to the modifications for design and operation improvements in steam generators, as described below.

The variance is:

2 V 3 = 5.4 x 10-4/ year O which is calculated by assuming a lognormal distribution and an error factor of 3.

MODIFICATIONS FOR DESIGN AND OPERATION IMPROVEMENTS Because of improvements in the design, operation, and inspection of steam generators, it is believe'd that experience in the Model F plants will be significantly better than that observed to date. Cogent reasons can be given as to why certain of the five tube ruptures experienced should not occur in the Model F's since the operating conditions are not applicable, or why the occurrence rate should be substantially less because of such design and inspection improvements. These are described below.

At Point Beach 1 in February 1975, phosphate wastage had thinned tubes in a zone just above the tubesheet where sludge had collected. In addition to thinning, some stress corrosion cracking was also present. The events at Surry 2 in September 1976 and Doel 2 in June 1979 show some similarities. In both cases, the tubes had suffered stress corrosion cracking starting from the O W APWR-PSS 1-20 June, 1985 59660:10

i 1

primary . side. At Surry, this was due to denting accompanied by " hour glassing" of the flow slots. At Doel, the affected tube had excessive ovality which led to high stresses at the be.id. The two remaining events, at Prairie Island 1 in October 1979 and Ginna in January 1982, were 'noth due to foreign objects fretting against the tube and wearing it thin along one side. Due to improvements in the design of Model F steam generators and in current maintenance procedures, some of these incidents can be expected to be reduced in frequency. The problem of phosphate wastage, for example, has been eliminated since phosphates will not be used.

Denting of tubes, if'it occurs at all, will develop much more slowly and with more limited extent than at previous stations due to:

o use of an improved tube support plate material (stainless steel type 405) which is less susceptible to corrosion and promotes less oxide growth than carbon steel; o new hole profiles which allow less concentration of salts; O

o elimination of copper and decrease in chloride concentrations compared to other plants.

Stress corrosion cracking (SCC) for the APWR is very unlikely due to the following improvements:

o .new thermal treatment of tubing which makes it less sensitive to caustic SCC and intergranular attack (IGA);

o absence of copper which reduces the rate of SCC by minimizing the corrosive environment; o improved design which minimizes crevices between the tube and tubesheet, O including hydraulic expansion of tubes, to reduce the concentration of alkaline salts in overlying sludge.

O W APWR-PSS 1-21 June,1985 5966Q:10

l

} In addition, tube degradation will most likely be identified before rupture occurs due to extensive In-Service Inspection (ISI) which includes: eddy current testing, ultrasonic techniques, profilometer probes, full inspection i of all tubes before the plant is put into operation, and continuous monitoring  !

of water quality, radioactivity, leakage rates, etc.

One type of tube failure, wear due to foreign objects, was responsible for the two largest tube rupture events which have occurred and is not affected by design improvements. However, due to rigorous quality assurance procedures as O well as monitoring for loose parts, this type of tube failure is judged to be much less likely than historical frequency indicates.

l 1.2.4 FREQUENCY OF LARGE SECONDARY SIDE BREAK EVENT Because safety injection is not required for success, small secondary side break events are considered as transients. The remaining large secondary side breaks are rare events. The frequency of such events is estimated as the same as large LOCA events (Section 1.2.6). The frequency of large LOCA is multiplied by 2 to account for both steam and feedwater line breaks.

f 4 = 8 x 10-4/ year V 4 = 4 x 10Nyea/

1.2.5 FREQUENCY OF SMALL LOCA EVENT The small LOCA initiating event frequency is estiinated from Table 1.2-2 as:

O f' =

201 s

= 0.005 for 0 to 2 inch breaks.

The 2-6 inch breaks (traditionally classified as medium LOCAs) are included in the small LOCA category since the plant success criteria is identical to that for small LOCAs. The f requency of the " medium" LOCA is estimated similar to O M APWR-PSS 1-22 June, 1985 5966Q:10

- . . -._.~.. - --_.=- . . - . - _ _ - - - _. - . _ . ._-.. - _ - .....- - .--- - .

\

l l

l l

large LOCA estimation of Section 1.2.6. The resulting fregency is calculated I to be:

f' = 6.0 x 10 / year 4

V" = 1.3 x 10-6/ year 2 The total frequency of small LOCA events (0-6 inches) is O ,, = 5.0 x 10-2 . . 0 x l e = ,.. x , o ,,ea,.

The variance is calculated to be V5 = 1.8 x 10 /yead i

by assuming a nonnal distribution and an error factor of 3. -

This estimate reflects only those events that are randomly initiated as small LOCAs. The consequential LOCAs that will follow transients are modeled as nodes in the event trees. The consequential LOCAs are estimated to be about 20% of the 0-2 inch LOCAs. Thus, in the event trees, a consequential LOCA probability of 1 x 10 is used. When multiplied with 10 transients a year, this results in 0.001 consequential small LOCAs per year.

1.2.6 FREQUENCY OF LARGE LOCA EVENT For the large LOCA, 2-6 inch LOCA and Large Secondary Side Break events which have not occurred, a Bayesian estimate of event f requency has been generated.

5 For these events, prior distributions have been developed from WASH-1400 th and the 95 th percentiles of the WASH-1400 distributions. The 5 th th percentiles lognormal distributions have been taken as the 20 and 80 of the prior distributions in order to express greater uncertainty in the pipe l failure rates. The prior distribution was then updated based on the l observation of zero occurrences in the total number of operating years in the l

M APWR-PSS 1-23 June,1985 i

5966Q:10

data base (201 reactor years). The posterior mean and variance are calculated as:

f6 = 4.0 x 10 / year V6 = 1.0 x 10 / yea /

1.2.7 FREQUENCY OF ATWS EVENT The ATWS initiating event frequency is calculated as a fraction of all transients which challenge the reactor protection system. Based on Reference 15, the unavailability of the reactor trip, including signal generation and insertion of the control rods is assumed to be 3.0 x 10- per demand. The expected number of challenges per year can be estimated by the number of transients. Thus, the initiating event frequency is estimated as:

-5

- 3 x 10 / year.

f7 - 10 x 3 x 10 The variance is calculated as

-8 2 V7 = 5.1 x 10 / year assuming a lognormal distribution and an error factor of 3.

1.2.8 FREQUENCY OF INTERFACING SYSTEMS LOCA EVENT The interfacing systems LOCA (ISL), Event Y as described in WASH-1400, is postulated for those large piping systems that connect to the Reactor Coolant System and also pass through containment. Such connections have the potential to cause a LOCA in which the containment and containment safeguards radionuclide protective barriers are bypassed. In addition, there is the potential for those piping failures to render the ISS ineffective or inoperable since most of these piping connections involve the ISS.

l l

W APWR-PSS 1-24 June,1985 5966Q:10

Three possible ISL-initiation scenarios have been identified for detailed analysis and are discussed and quantified in the foll'owing paragraphs. These scenarios are:

o Disk rupture of the two series motor-operated valves in the letdown Os piping of the Residual Heat Removal System.

o Disk rupture of check valves and disc rupture or transfer open of motor-operated valves in the reactor vessel injection lines.

o Disk rupture of char.k valves and disc rupture or transfer open of motor-operated isolation valves in the hot leg injection lines.

These scenarios have been identified through a review of containment piping penetrations that was conducted in order to insure that all interfacing systems have been considered.

Several CVCS and other system penetrations for which an interfacing systems LOCA might be postulated are not considered in detail in this analysis..

Hupture of the piping in the CVCS charging and RCP seal injection linas l

upstream of the RCS pressure boundary is judged to be extremely unlikely f or several reasons. First, the piping in these lines is qualified to pressures higher than normal RCS pressures and thus this piping should not rupture if exposed to existing RCS pressure. Second, the piping runs range f rom two to j four inches in diameter, so that the consequences of an interfacing systems LOCA via any of these paths would be less severe than the other scenarios under analysis. Third, these paths are similar in valve configuration to tha low and high pressure injection paths which are analyzed, and shown to be O minor contributors to the ISL-initiation frequency in the following paragraphs.

l Other paths not considered in detail are the back-up seal injection and CVCS letdown lhes.

~

The back-up seal injection line is similar to the normal seal injection line. The CVCS letdown line is excluded from detailed analysis because orifices before the containment penetration reduce the flow outside containment if postulated rupture of piping is assumed. In this case, the i

)(APWR-PSS 1-25 June,1985 59660:10

,c) maximum flow rate is [ ] gpm; centrifugal charging pumps are of suf ficient capacity to make up this flow rate. Thus, the consequences of an interfacing systems LOCA via this path would be less severe than the other scenarios under analysis. The less frequent and less severe paths associated with these

(

charging systems are, therefore, judged to be insignificant contributors to O plant risk and are not considered further in this analysis.

{

ISL - RHR SUCTION PATH There are four RHR suction lines, each of which contains two series motor-operated valves. These RHR lines are used during plant shutdown conditions when the RHR system is in operation.

Failure combinations involving disc rupture of two series motor-operated valves (MOV) are included in this analysis. Other valve failure modes have been judged inapplicable based on system characteristics.

Disk failure to close is defined as a failure of a valve disc to return to the closed position upon demand. If both valves in any line had disks which failed to close, this condition would become apparent within a short period of time during the subsequent RCS startup, and corrective action would be taken.

Thus, the event initiators involving disk failure to close in two series MOVs are excluded from further consideration, because of the very low probability of failure to detect and correct this situation.

Combinations involving an inadvertently open disk in the first MOV and subsequent rupture of the second MOV downstream of the first valve are also eliminated fran consideration because the positions of these valves are Os indicated in the control room. Therefore, failure to close the initial valve in any line would be detected during a normal shift. In addition, it is assumed that the operator would detect the initial valve misposition and take corrective action, to depressurize the RCS and close the valve, within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after startup, during which time the second valve would not be exposed to pressures that could reasonably be postulated to induce disc rupture.

O W APWR-PSS 1-26 -

June, 1985 59660:10

i Furtbr, because this is such a short period, the conditional probability of the second valve rupture is very small.

The valve transfer open (spurious opening) failure mode is also excluded from quantification, in part because of the ability of the operators to detect changes in valve position from the control room. More importantly, these valves would have to transfer open against existing RCS pressure. There is an extremely low probability, given the valve motor capabilities, that such

. valves could change position under such a large pressure dif ferential. In s addition, these valves are interlocked against opening unless RCS pressure is less than RHR operating pressure, and are electrically racked out at the motor control center.

Based on the information and assumptions above, the following expression has been developed for the frequency of an interfacing systems LOCA initiating via the RHR suction path:

F(ISLg ) =

4 [F(V1) x P(V2/V1)]

where:

F(ISLR ) = requency of RHR suedon ISL F(VI) = frequency of initial valve failure P(V2/V1) = conditional probability of 2nd valve failure V1, V2 refers to the two normally closed MOVs 4 = number of RHR suction paths The failure rate distribution associated with MOV and check valve disc rupture / catastrophic leakage is taken from the NREP Procedures Guide (NUREG/CR-2815) and is lognormal with the following characteristics:

Mean = 1.0 x 10-7/ hour Variance = 1.0 x 10 "/ hour 2 O W APWR-PSS 1-27 . lune, 1985 59660:10

Component failure probability is the product of the component failure rate and the exposure interval. Thus, the probability of the first valve failure is given by 41" l .

where ,

q) = failure probability for the first MOV

1) = failure rate per unit time for the first MOV t = exposure interval (time to failure) such that 0<t<T T = maximum exposure interval considered; for this analysis T = 1 year to obtain an annual frequency, since the valves are not tested on a more frequent basis.

The probability of the second valve failure is then

, q2"12 (T-t) because the second valve cannot fail until after the first valve fails but must fail within the time interval under consideration. The combined probability of the two valves failing is then F(ISLR ) " 4 4 1 4 2 " 4

• ki t x 1 2(T-t) and, because the valves are identical, 2

F(ISLg ) = 4 A t(T-t)

The mean value of F(ISL ) is then determined by averaging over t R

2 1 i (tT - t )dt 22 7

F(ISLR )

• 4

• T 3" -

J dt o

O M APWR-PSS 1-28 June,1985 5966Q:10

,,,-,,--,.-_-,--e- -

,,,p- - - . , _ _ ,m.g_. - - , _ _ . , _ . . . . _ , , - - _ , , _ , . - - - _ _ _ , - , . - - , -

With the previously stated value of T (1 year, = 8760 hr.) and 1 (mean = 1.0x10 ~7 variance =

, 1.0x10'I 4) , the resulting ISL-initiation probability distribution is described by f8 = 1.0 x' 10 year 2 V8 = 1.0 x 10- / year Note that this reflects the fact that the mean value of the square of a probability is given by the square of the mean, plus the variance.

ISL - VESSEL INJECTION PATHS The vessel injection lines consist of four trains, each of which contains several paths incorporating low-pressure piping. Each of these paths contains at least three check valves or two check valves and two normally-closed motor-operated valves. Several of these paths lead only to release inside containment (i.e., LOCA) and are not evaluated further for this analysis.

The frequency of an ISL initiation via the vessel injection paths is dominated by the following sequence:

F(ISL,) = 4 [F(V1)P'(V2/V1)P(V3/V1,V2)]

where F(V1) = frequency of first check valve rupture P(V2/V1),:P(V3/V1,V2) = conditional probability of 2nd and 3rd check valve ruptures It has been determined, based on consideration of possible failure modes in the context of this analysis, that valve failure to close, excessive valve back leakage and valve transfers open are not credible failure modes for the check valves in the vessel injection lines. These check valves are tested for leakage during RCS repressurization, after system use (RHR mode) and prior to reactor startup. The tests confirm the proper seating of each valve disc and O W APWR-PSS 1-29 June,1985 5966Q:lD

l 4

verify that each valve can independently sustain differential pressure across its valve disc.

~

Disk rupture, therefore, is the sole failure mode applicable to the check j valves in the vessel injection lines. Because disc rupture is more reasonably

postulated for valves exposed to relatively high (e.g., RCS) pressures, the accident progression as modeled here involves failure of the last series check valve (i.e., the one farthest downstream) and the sequential failure of the

. three valves upstream of the initial valve failure. Scenarios involving disc j rupture of valves not exposed to RCS pressure are judged to have extremely 5 remote associated frequencies and are eliminated from further consideration on those grounds.

Quantification of this vessel injection path results in a negligibly small contribution to the frequency of an interfacing systems LOCA (mean ~

-9 2 x 10 /yr).

ISL - HOT LEG INJECTION PATHS O

The hot leg injection lines consist of four trains, each of which contains three check valves and one normally closed motor-operated valve. An interfacing systems LOCA via this path would involve sequential disc rupture

c. .. of the check valves and disc rapture or transfer open of the MOV.

1 Quantification of scenarios involving four valve failures shows a negligible contribution to the overall frequency of an interfacing systems LOCA.

t

SUMMARY

I In sununary, the two injection path scenarios are of low frequency. The suction path is dominant in terms of frequency and cannot be isolated. The total mean frequency'for initiation of an ISL' is 1.0 x 10 -6 per year with a 2

variance of 1.0 x 10 -II per year ,

W APWR-PSS 1-30 June,1985 5966Q:10

1.2.9 FREQUENCY OF VESSEL FAILURE EVENT (LARGE LOCA BEYOND ECCS CAPABILITY)

The mean frequency of a reactor vessel failure is estimated as 1 x 10- / year.

A vessel integrity failure is defined as a disruptive failure. This is l characterized as a breaching of the vessel by failure of the shell, head,  ;

nozzles or bolting accompanied by a rapid release of a large volume of reactor i

coolant. "Large" is defined as beyond the capacity of the ECCS System to keep i

the core covered or reflood the core after initial uncovery. This event includes all challenges to vessel integrity during emergency and fault conditions.

Two classes of large LOCAs that may be beyond ECCS capability have been identified; simultaneous rupture of two or more large pipes and a very large reactor vessel rupture.

Independent, simultaneous large ruptures are so unlikely that they cannot be contributors to core melt or risk. No internal dependencies (e.g., pipe whip 4

damage following a large LOCA) have been identified that would contribute substantially to risk.

Catastrophic reactor vessel ruptures that are beyond the capability of ECCS were analyzed in WASH-1400. The WASH-1400 estimate of such failure is:

5th percentile:

-8 1.0 x 10 / year Median: 1.0 x 10-7/ year

-6 95th percentile: 1.0 x 10 / year Significant additional work has been performed since WASH-1400 and is sunenarized below. Due to the expected low frequency of vessel failure (there has not been a nuclear vessel failure to date), two basic approaches have been taken to characterize this frequency:

l l

l W APWR-PSS 1-31 June,1985 5966Q:10

(1) Consideration was given to the operating experience of non-nuclear pressure vessels. Such experience must be critically examined to decide whether the reported failures are relevant to nuclear pressure vessels. In addition, an appraisal must be made of the considerable differences between non-nuclear ' and nuclear vessel O practice regarding design, fabrication, materials, operation and in-service inspection. Into this data base is included the operating experience of commercial and military nuclear reactor pressure vessels. However, the contribution of nuclear experience C/ is small since a statistically significant data base will not exist for at least 20 more years for commercial nuclear pressure vessels.

(ii) Calculation of a theoretical probability of ' failure by particular identified mechanisms.

Several studies have been completed using these methods in the US and UK (References 16, 17 and 18) with the results in agreement. These studies surveyed the pressure vessel data and extrapolated the results to nuclear applications. These are sununarized below:

FREQUENCY PER YEAR OF DISRUPTIVE FAILURE WASH-1318 MARSHALL COMMITTEE (Reference 16) (Reference 17)

P ASME Section I Boilers 6.3 x 10-6 1.0 x 10-5 ASME Section III Boilers 6.3 x 10- 1.0 x 10 -6 There are several major cautions in utilizing these results:

(1) These results are on a yearly basis and do not provide a knowledge of what type of " challenges" to vessel integrity occurred. Thus, a failure per challenge must be cautiously inferred.

M APWR-PSS 1-32 - June,1985 5966Q:1D

= .

1 i

i i

) (ii) No disruptive vessel failures have occurred in Section III type

vessels, thus, the probability has been assessed in a highly conservative manner.

! (iii) In both. reports these values represent at least a 99 percent confidence level, whereas this study utilizes "best estimate" values. Thus, these values are highly conservative within the context of defining risk. These values were therefore assumed to be l . 95 percent confidence levels.

l It is judged that items (ii) and (iii) far outweigh the concerns of (1).

-I Thus, a value of ~ 1.0 x 10 failure per year is judged a reasonable mean estimate of vessel rupture frequency.

I Another nethod to verify the above result is to calculate the theoretical probability of failure by identified mechanisms (stress intensity, crack detection, crack location, etc.). Calculations performed in Reference 18

assessed a disruptive failure rate of 1.0 x 10 per demand with an expected

-6 -8 per vessel year given that vessel failure of 1.0 x 10 to 1.0 x 10 vessel integrity challenges occur at a frequency of 1.0 x 10 to l .0 x 10 per year. Several issues must be considered:

) (1) The failure rate per year is consistent with the conservative data

assessment made above.

I (ii) This assessment of probability is highly conservative for the following reasons:

a. All cracks are assumed to be pre-existing lines rather than i semi-elliptical cracks. Semi-elliptical cracks are less limiting by a factor of 10 to 100 (Reference 2), however, semi-elliptical cracks are the most probable (due to the difficulty of UT ecd on) .

NOT i

M APWR-PSS 1-33 . lune, 1985 59660:10

i l

b. Thermal transients are induced at the most limiting set of

! conditions (zero power, no decay heat for steam breaks). This  !

t condition exists for less than one percent of core life.

l 1

c. Cooldown conditions are the most adverse with respect to RCS and SI flow. By assuming low RCS flow Reactor Coolant Pump (RCP)

trip, the vessel inner wall is subjected to very low temperature j SI water as a' result of low mixing with the reactor coolant.

!O This maximizes stresses).

tripped.

vessel wall temperature gradients However, in most cases the RCPs will not be Thus, SI flow will be completely mixed with the (thermal i

reactor coolant which would reduce vessel wall / reactor coolant j_ ATs. This would reduce the thermal stress and reduce the probability of initiation.

4 These types of assumptions are appropriate in assuring a high j confidence that a bounding (99 percent assurance) calculation I has been produced.

!O (iii) The cooldown transient frequencies in this study are not equivalent to the transients considered in Reference 17. For example, 90 to 95

,I percent of steam breaks are a single steam generator PORY or steam l

dump valve. These do r.ot represent a vessel challenge as verified by the Westinghouse Owner's Group 12/81 submittal (Reference 19).

However, the initiator frequencies used do not make this distinction.

Based on several of the arguments in items (ii) and (iii), failure probability

-I is assessed at 3.0 x 10 per indicated vessel integrity challenge. The derivation of this value for transient events is as follows: 1.0E-04 based on Reference 19, a reduction of 100 based on item (ii) and an additional reduction of 10 based on item (iii). This range of values is aTso consistent with the NRC assessment of Pressurized Thermal Shock (Reference 20).

4 In SECY-82-465 (Reference 20) issued in 1982, the staff proposed RT NDT

screening criteria of 270*F for longitudinal welds and 300*F for i

W APWR-PSS 1-34 June, 1985 59660:10

_ _.__ - _.. _, ____._ ___ _ _ _. . _ ,.=_ _ _ _ . - _ _ . _ _ . _ _ _ . , _ _ . _ _ _ _ .

circumf arential welds. These values were established based upon the staf f evaluation, as discussed below.

The NRC approach for the selection of these RT screening crMa dudng NDT

. 1982 used a deterministic fracture mechanics algorithm to calculate the value

, of RT NDT for which assumed pre-existing flaws in the reactor vessel would be predicted to initiate (grow deeper into the vessel wall) assuming occurrence of one of the severe overcooling events that have been experienced in domestic

'4dR 's . These values of RT NDT were related to the expected frequency of the O* experienced severe overcooling events based upon the available data base, consisting of eight events in 350 reactor-years of operation. However, this approach did not reflect low frequency events that have not occurred and could pose a greater potential risk to the integrity of the vessel.

To address this concern, the NRC considered a wide spectrum of postulated overcooling events that could occur. These events were grouped into categories, estimates were made of their expected frequency, and stylized characterizations of the temperature and pressure time histories were developed for each category. The estimates were based on a generic study of Westinghouse - designed PWR systems. These estimates. were used by the NRC to better understand the residual risks inherent in the use of the screening criteria approach for further evaluations and resolution of the PTS issue.

~

i The proposed NRC rule .for PTS: (1) established the RT screening NDT criteria; (2) requires licensees to submit present and projected values of RTNDT; (3) requires early analysis and implementation of such irradiation flux reduction programs as are reasonably practicable to avoid reaching the screening criteria; and (4) requires plant-specific PTS safety analyses before l O a plant is within 3 calendar years of reaching the screening criteria,

! including analyses of alternatives to minimize the PTS concern.

In addition, the WAPWR has several improvements that should reduce the probability of vessel failure such as improved vessel material, reduced vessel ,

fluence, and increased SI temperatures (EWST).

O W APWR-PSS 1-35 June,1985 5966Q:10

Thus, the following frequency estimate is used for catastrophic vessel failure beyond ECCS capacity:

f g = 1.0 x 10~7/ year The variance is calculated by assuming a legnormal distribution and an error factor of 10:

2 V 9 - 6.1 x 10""/ year ,

1.2.10 TOTAL LOSS OF AUXILIARY COOLING The total loss of essential service water or component cooling water cooling capabilities is treated as an initiating event. The initi.ating event frequency for this category is estimated to be 2.0 x 10-0/ year.

To estimate the failure probability of ESW or CCW systems with 2 running and 2 standby pumps, a period of twelve months is considered. The failure is modeled as the failure of both running pumps to operate and the failure of both standby pumps to start:

q = (q +B R 9R ) I4S+B3q) 3 where qR = failure to run = Ag x 8760 (8760 hr mission time) q3 = failure to start on demand = 13 (8760)

B = common cause beta factor Alternation of various pumps in and out of service is not addressed, since the minimum number of pumps (1 ESW and 1 CCW) will be running at all times during the yearly period of interest. For ESW and CCW pumps, the data is taken from Section 3.0 of this report, as follows:

M APWR-PSS 1-36 June,1985 5966Q:1D

SW or CCW Pump fail to run/hr 2.47 x 10' / hour Pump fail to start / demand -3 1.34 x 10 / demand Beta factor for run .10 Beta factor for start .10 For ESW or CCW: 9 q = {[(2.47 x 10-5)(8760)]2 + 0.1 (2.47 x 10-5)(8760)}

{(1.34 x 10-3)2 + 0.1 (1.34 x 10-3))

= (6.85 x 10-2) (1.36 x 10 )

= 9.3 x 10 -0 0 To take into account other failures, such as strainers, valves and unavailability due to maintenance, the initiating event frequency will be

-5 estimated by f = 1 x 10 / year for each system. Thus, the frequency of loss of either system will be:

fl0 - 2 x 10 / year V10 = 2.2 x 10

1. year/ 2 The variance is calculated by assuming a lognormal distribution and an error factor of 3.

O W APWR-PSS 1-37 June,1985 59660:10

4 l [ 1.2.11 REFERENCES

1. U.S. Nuclear Regulatory Connission, " Reactor Safety Study: An Assessment of Accident Risks in U.S. Nuclear Power Plants," WASH-1400 (NUREG/75/014),

October 1975.

1

2. Connonwealth Edison Company, " Zion Probabilistic Safety Study," 1981.

3. Electric Power Research Institute, "ATWS: A Reappraisal, Part III.

Frequency of Anticipated Transients," EPRI NP-2230, January 1982.

4. Westinghouse Electric Corporation, "Sizewell B Probabilistic Safety Study " WCAP-9991, December 1981.

5. Power Authority of the State of New York and Consolidated Edison Company of New York, Inc., " Indian Point Probabilistic Safety Study " 1982.

, 6. EPRI-NP-1804-SR, " German Risk Study Main Report," April 1981.

O 7. Memorandum f rom A. J. Busiik to R. A. Bari, "BNL Peer Review of the Zion Probabilistic Safety Study," Brookhaven National Laboratory, January 18, 1982.

8. Nuclear Power Experience, Volume PWR-1-2,1982.

j 9. Shulties, J. K., et al . , " Bayesian Analysis of Component Failure Data,"

NUREG/CR-1110, November 1979.

10. NRC " Evaluation of Steam Generator Tube Rupture Events," NUREG-0651, March 1980.

11. Westinghouse Electric Corporation, " Report on Small Break Accidents for Westinghouse NSS System," WCAP-9601, June 1979.

W APWR-PSS 1-38 -

June,1985 5966Q:10

12. Nuclear Regulatory Comission, " National Reliability Evaluation Program (NREP) Procedures Guide," NUREG/CR-2815, January 1983.

13. Nuclear Regulatory Comission, " Precursors to Potential Severe Core Damage O

a Accidents: 1969-1979, A Status Report," NUREG/CR-2497, June 1982.

14. Electric Power Research Institute, " Loss of Off-Site Power at Nuclear Power Plants: Data and Analysis," EPRI NP-2301, March 1982.

O 15. Nuclear Regulatory Comission, " Anticipated Transients Without Scram for Light-Water Reactors," NUREG-0460, April 1978.

16. United States Nuclear Regulatory Comission, " Technical Report: Analysis of Pressure Vessel Statistics from Fossil-Fueled Power Plant Service and Assessment of Reactor Vessel Reliability in Nuclear Power Plant Service,'

WASH-1318 May 1974.

17. United Kingdom Atomic Energy Authority, "An Assessment of the Integrity of PWR Pressure Vessels," October 1976.

18. " Report on the Integrity of Reactor Vessels for Light-Water Power Reactors by Advisory Comittee on Reactor Safeguards," WASH-1285, January 1974.

19. Westinghouse Owner's Group, " Vessel Integrity Issues," December 1981.

20. .Meyer, T. A., "Sumary Report on Reactor Vessel Integrity for Westinghouse Operating Plants," WCAP-10019, December 1981.

O O

O W APWR-PSS 1-39 June, 1985 5966Q:10

i, I

?

TABLE 1.2-1

PROBABILITY DISTRIBUTIONS FOR INITIATING EVENT OCCURRENCE FREQUENCIES Initiatina Event Mean (events /vear) Variance i

f 3

1. Transients 10 56

2. Loss of Offsite Power .12 8.1 x 10 -3 I -i

3. -2 Steam Generator Tube Rupture 3.1 x 10 5.4 x 10

4. Large Secondary Side Break 8.0 x 10 4.0 x 10 -6 i

5. Small LOCA (< 6") 5.6 x 10 -3 -

1.8 x 10 -5 1.0 x 10 -6

6. Large LOCA (> 6") 4.0 x 10

7. ATWS 3.0 x 10-4 5.1 x 10-8

8. Interfacing Systems LOCA 1.0 x 10 -6 1.0 x 10 -II

-I 4

9. Vessel Failure ,

1.0 x 10 6.1 x 10

10. Total Loss of Auxiliary Cooling 2.0 x 10 -5 2.2 x 10 -10 O

O 4

O M APWR-PSS 1-40 June, 1985 5966Q:10

-.-w-, - . . . . _ - . . . _ , _ , . _ , , - - ,-.,-,_,.,,,,._wm , , , , . - - , _-7m,r.,,-. .ye-.y 1,.- ,

1, a

l TAet[ 1.2 2 ,

! lE 2=

, o PWR POPULA110N EVENT DATA i r 7

3 (n Plant Name Loss of RCS Flow Loss of Main Primary to Secondary Core Power Spurious *5' Small LOCA Feedwater Flow Power Mismatch Turbine Trio Reactor Trio [xcursion Signal

1) YANKEE R0WE D 10 1 5 14 44 0 0 l 2) SAN ONOFRE O 1 1 2 15 19 0 1 j 3) HA00AM NECK 0 5 3 13 If il 26 0 0 I

4) R.E. GINNA 0 1 0 16 9- 1 0 0 '

1 5) POINT BEACH 1 0 0 0 11 12 17 0 0

6) H.8. ROOINSON 1 4 3 61 32 59 1 4 l 7) PALISADES 0 1 2 10 8 20 0 0 l 8) POINT BEACH 2 0 2 0 4 14 16 0 0

9) SURRY 1 0 2 6 34 20 23 1 2 y 10) MAINE YANKEE O 1 1 5 3 7 1 0 l 3 11) SURRY 2 0 0 0 29 14 7 0 0

12) OCONEE 1 0 2 7 11 25 15 1 0

13) IN0lAN POINT 2 0 8 10 92 21 37 1 2 1

14) PRAIRIE ISLAND 1 0 1 3 24 8 10 0 1 l

15) ZION 1 0 4 12 23 13 22 3 0 l 16) KEWAUNEE O 1 1 23 17 30 0 0 l 17) FORT CALHOUN 0 3 1 3 5 7 0 0 l 18) 1HREE MILE ISLAND 1 0 0 0 0 3 2 0 0 l 19) DCONEE 2 0 1 6 6 11 10 0 0

20) ZlDN 2 0 5 10 43 8 24 1 0 c' 21) OCONEE 3 0 2 2 4 15 8 1 0

22) ARKANSAS 1 0 0 4 0 0 l _5 1 11 15 j 23) PRAIRIE ISLANO 2 0 1 2 17 9 11 0 0 l $ 24) RANCHO SECO O 0 3 10 6 6 2 0

25) CALVERT CLIFFS 1 0 4 5 12 16 11 1 0 l

\

l l

... n.in,na. .e

. . _ . .__m__. _ . . . . _ _ _ . . _ - - - - - . - _ . . . . . - . . . _ . - - . - - . . . - - -_ . - . . . _ - . . . . . . . . . . . , _ _ _ _ _ -

I 148tl 1.2-2 (Continued) l.

l In- PWR POPULATION L'*ENT DATA l 4 -

l $ Loss of Main Primary to Secondary Core Power Sportous "S' 4

us Plant Name _Small LOCA Loss of RCS Flow Feedwater Flow Power Misaatch Turbine Trio Reactor Trio Excurston Sienal h

) 26) COOK 1 0 2 0 14 6 18 0 0 l 21) MILLS 10NE 2 0 3 1 14 22 17 0 0

20) TROJMe 0 3 1 17 7 16 0

~

2

29) IN0lAN POINT 3 0 0 0 7 0 2 0 0

30) CALVERI Cliffs 2 0 1 1 9 11 5 0 0

, 31) SALEM 1 0 1 2 12 16 12 0 i 0 1 32) DAVIS-BESSE 1 0 5 4 7 10 12 0 0 l 33) FARLEY I 0 6 6 25 15 3 0 0

34) NORIN ANNA 0 2 0 6 1 4 0 0

35) COOK 2 0 0 1 13 10 5 0 0 a

T\)

Total no. of events 1 82 96 586 424 548 13 12 i

i l

! s l

c.

1 5 i .

1 m i e

co us i

$9MQ

10/052285  !

I l i

3 TABLE 1.2-3 PLANTS AND OPERATIONAL YEARS INCLUDED IN PWR DATA BASE l

Number of Number of Number of i Plant Name Transients

• Years Transients / Year *

1) Yankee Rowe 74 17.66 4.2

2) San Onofre 39 12.32 3.2

3) Haddam Neck 64 12.42 5.2

4) R. E. Ginna 33 9.10 3.6

5) Point Beach 1~, 40 9.28 4.3

6) H. 8. Robinson 165 9.27 17.8

7) Palisades 41 3.82 10.7

8) Point Beach 2 36 7.50 4.8

9) Surry 1 88 6.00 14.7

10) Main Yankee 18 3.12 5.8

11) Surry 2 50 5.61 8.9

12) Oconee 1 61 7.47 8.2 O 13) Indian Point 2 171 6.55 26.1

14) Prairie Island 1 49 5.92 8.3

15) Zion 1 77 4.28 18.0

16) Kewaunee 72 6.58 10.9

17) Fort Calhoun 19 5.49 3.5

18) Three Mile Island 1 5 1.73 2.9

19) Oconee 2 34 6.31 5.4 20), Zion 2 91 3.57 25.5

21) Oconee 3 32 6.04 5.3

22) Arkansas 1 31 5.39 5.8

23) Prairie Island 2 40 4.92 8.1

24) Rancho Seco 27 5.71 4.7

25) Calvert Cliffs 1 49 4.92 10.0

26) Cook 1 38 5.35 7.1 0 27) 28)

Millstone 2 Trojan 57 46 4.43 4.20 12.9 11.0 i

O M APWR-PSS 1-43 June,1985 59660:1D

TABLE 1.2-3 (Cont.)

PLANTS AND OPERATIONAL YEARS INCLUDED IN PWR DATA BASE O Plant Name Number of Transients

• Number of

_ Years Number of Transients / Year *

29) Indian Point 3 ,

9 0.34 26.5

30) Calvert Cliffs 2 27 3.00 9.0

31) Salem 1 43 3.51 12.3

32) Davis-Besse 1_ '

38 3.11 12.2

33) Farley 1 55 2.28 24.1

34) North Anna 1 13 1.72 7.6

35) Cook 2 29 2.50 11.6 Total 1761 201.42 360.2**

i O

f

• From Table 1.2-2

• • Average O

O l

O M APWR-PSS 1-44 June, 1985 5966Q:10 l

- _ _ . - . - . . . - . . - . ~ . _ _ _ , _ - - , . . . _ . . . _ _ - _ . . - _ _ _ . . - . _ _ _ . . _ _ . - _ - - . . - . -

TABLE 1.2-4

SUMMARY

OF STEAM GENERATOR TUBE EXPERIENCE No. of Plants Plant-Years Tube-Years Westinghouse (Inconel Tube)

US plants 31 233.4 2,456,000 Foreign plants 10 69.8 491.000 Subtotal 41 303.2 2,947,000 Westinchouse Licensee plants MHI 7 41.8 328,000 FRA 20 54.9 555,000 Miscellaneous W Licensee Plants 3 23.5 181.000 Subtotal 30 120.2 1,064,000 TOTAL 71 423.4 4,011,000 P

O O

O M APWR-PSS 1-45 June, 1985 59660:10

TABLE 1.2-5 TUBE RUPTURE EXPERIENCES

SUMMARY

Estimated Event Occurrence Plant Leak O No. Date (startuo date) Attributed Cause Rate 1 Feb. 26, 1975 Point Beach 1 Phosphate Wastage + SCC 125 gpm (1)

(Oct. 70)

O 2 Sept.15, 1976 Surry 2 (Jan. 73) Denting + SCC 80 gpm (1) 3 June 25,1979 Doel 2 (June 75) Ovality + SCC 135 gpm (1) 4 Oct. 2, 1979 Prairie Island Loose Part (spring) 390 gpm (1)

(Aug. 73) 5 Jan. 25,1982 Ginna (Sept. 69) Loose Part (plate) 634 gpm (2)

O Ref.

1. NUREG-0651 Evaluation of Steam Generator Tube Rupture Events, USNRC, Appendices Card H, March 1980.

2. Response to Long-Term Comitmer.ts, Ginna Restart SER, Steam Generator Tube Rupture Incident, November 22, 1982, Attachment B, Analysis of Plant Response During January 25, 1982, Steam Generator Tube Failure at the R. E. Ginna Nuclear Power Plant.

O M APWR-PSS 1-46 June,1985 59660:10