ML20140A207

Final ASP Analysis - St. Lucie 1 (LER 335-95-004)

ML20140A207
Person / Time
Site:	Saint Lucie
Issue date:	05/19/2020
From:	NRC/RES/DRA/PRB
To:
Littlejohn J (301) 415-0428
References
LER 1995-004-00, LER 1995-005-00, LER 1995-006-00
Download: ML20140A207 (20)

Text

Appendix B Appenix Nos.

BLER 335/95-004, -005, -006 B.5 LER Nos. 335/95-004, -005, -006 Event

Description:

-Failed power-operated relief valves, reactor coolant pump seal failure, relief valve failure, and subsequent shutdown cooling unavailability, plus other problems Date of Event: August 2, 1995 Plant: St. Lucie 1 B.5.1 Event Summary On August 1, 1995, St. Lucie 1 shut down to Mode 3 in preparation for Hurricane Erin. The next day, the lower seal stage on reactor coolant pump (RCP) 1A2 failed. When operators attempted to restage the seal, two additional stages failed resulting in a 7.6-1/mn (2-gpm) leak. The reactor coolant system (RCS) was cooled down and depressurized to replace the failed seal. The next day, while in Mode 4, both power-operated relief valves (PORV) were tested and subsequently determined to be failed, a result of incorrect reassembly during the fall 1994 refueling outage. The failed PORVs required the plant to be cooled down, depressurized, and placed in Mode 5. During this cooldown, a thermal relief valve on the low pressure safety injection (LPSI) common discharge piping [part of the shutdown cooling system (SDC) system] lifted and did not reseat. Discovery of the open valve was delayed for 2 h because normally open floor drain valves were closed. After the open relief valve was discovered, the SDC system was removed from service for about a day to replace the valve. During this time, only the steam generators were available for decay heat removal. The conditional core damage probability (CCDP) estimated for the PORV unavailability is 1.1 x 10' This is an increase of 9.3 x 10O- over the nominal core damage probability (CDP) for the same period. The CCDP associated with the potential RCP seal loss-of-cooling accident (LOCA) is 5.6 x 10'. The increase in CDP associated with the removal of the SDC system from service to replace the thermal relief valve is less than the Accident Sequence Precursor (ASP) program screening value of 1.0 x 10-6.

B.5.2 Event Description On August 1, 1995, the National Hurricane Center predicted hurricane force winds from the passage of Hurricane Eri near the St. Lucie site. Both units were shut down and cooled down to an average temperature of 177'C (350'0F) to allow for enhanced steam generator heat removal capability with a steam-driven auxiliary feedwater (AFW) pump, and a storm crew was stationed on-site to support potential recovery efforts.

Hurricane Eri made landfall approximately 32 kmn (20 miles) north of the site, and maximum wind speed on-site was less than 72 kin/h (45 mph). The Unusual Event that had been declared because of the hurricane was terminated at 0542 on August 2, 1995, and a decision was made to return both units to service.

NUREG/CR-4674, Vol. 23 B.5-1 B.5-1 NUREG/CR-4674, Vol. 23

LER Nos. 335/95-004. -005. -006 Appendix B At 0805, while Unit 1was in Mode 3 with an RCS pressure of 10.7 MPa (1550 psia), RCP 1A2 middle seal cavity pressure was observed to be approximately equal to RCS pressure-an indication that the lower seal had failed. A decision was made to "restage" the leaking seal, increasing the differential pressure across it by sequentially depressurizing the seal cavities from top to bottom.

During the restaging evolution, the RCP middle seal failed and the upper and vapor seal degraded. The licensee attributed these failures to the performance of the restaging procedure at RCS temperatures above 93 0C (200*F) and on a rotating pump. At 1810, on August 2, 1995, 20 min after control room indication of the failed middle seal, operators began to cool down and depressurize the RCS. At 1840, RCP I1A2 was secured.

By 2018 on August 2, 1995, reactor cavity leakage had increased to about 7.6 I/in (2 gpm). This leakage decreased the next day because of the ongoing RCS cooldown and depressurization. The RCP I1A2 seal was subsequently replaced, as was the RCP IlA 1 seal (because of degraded performance).

During the RCS depressurization and cooldown on August 3, 1995, the PORVs also were stroke tested.

No increase in acoustical flow indication was observed. Because of apparent inconsistencies with other indications, the problem was initially attributed to the acoustic monitors, and further PORV testing was planned following replacement of the RCP seals. On August 9, 1995, the PORVs again were tested with unsatisfactory results-first at 1.8 MPa (260 psia), then in Mode 4 at 2.2 MPa (320 psia) and with SDC secured, and finally at an RCS pressure of 3.28 MPa (475 psia).

The problem with both PORVs was caused by the improper installation of the main disc guides, following overhaul during the 1994 fall refueling outage, and by inadequate post-maintenance testing before returning the valves to service. (Only a seat leakage test was performed.)

With both PORVs inoperable, Limiting Condition for Operation (LCO) 3.4.13 required the unit to be depressurized and a vent path established within 24 h. A cooldown and depressurization was begun.

At 0018 on August 10, 1995, with the unit at 137 *C(278 OF) and 1.8 MPa (261 psia), the IA LPSI pump was started to place the SDC system in service to continue the cooldown. Shortly after starting the pump, pressurizer level and letdown flow were observed to be decreasing. Because no annunciations associated with RCS leak-age were received, no increases in reactor cavity sump flow or waste management system sump levels and tanks were detected; and because no leakage was observed in the LPSI pump rooms and other auxiliary building areas, the operators concluded that the unexpected mismatch between charging and letdown flow was the result of the RCS cooldown. At 0105, the 1B LPSI pump was started, and the remaining steps in the SDC normal operating procedure were completed.

At 0215 on August 10, 1995, water was discovered to be accumulating in the auxiliary building pipe tunnel. Both trains of SDC were secured (decay heat removal was provided by the steam generators).

Pressurizer level and charging/letdown flow were observed to be stable, indicating that the leakage had stopped. The floor drain isolation valves to the safeguards pump room sumip were found to be closed.

When these valves were subsequently opened, high~ sump level annunciated. The safeguards pump room NUREG/CR-4674, Vol. 23 B.5-2

Ani)endix B LER Nos. 335/95-004. -005. -006 sump isolation valves had been stroke-tested in preparation for Hurricane Erin, and some of the seven valves controlled by a single switch had failed to close. Following trouble-shooting efforts, the control switch had been left in the closed position.

At 0611 on August 10, 1995, thermal relief valve V3439 was determined to have been the cause of the leakage. The valve is located in LPSI pump discharge piping, which is common to both trains. During the event, the operating pressure of the SDC system immediately following LPSI pump start was within the relief valve's lift-pressure range, resulting in the valve opening. The SDC system operating pressure remained above the relief valve reseat pressure, which prevented the valve from closing. Approximately 15,000 1(4000 gal) of reactor coolant was discharged during the almost 2-h period the valve was open.

Three and one-half hours after the relief valve leakage was identified, both trains of the SDC system were removed from service for approximately 20 h to replace the valve. RCS temperature was increased to 152'C (305' 0F), where the PORV Technical Specification was not applicable. Decay heat was removed using the steam generators, the only source of decay heat removal at that point. Following relief valve replacement, both SDC trains were restored to operable status, and the RCS was cooled down and depressurized to repair the PORVs.

Three other reportable events occurred during the same time frame as the events described previously.

These events, which would not be selected as precursors, are summarized to provide a more complete picture of the situation at St. Lucie 1 during the August 1995 time period.

While RCS temperature was being decreased on August 2, 1995, in response to the failed RCP seal, the main steam isolation signal (MSIS) block permissive annunciators were alarmed and were acknowledged by an operator. That operator did not refer to the annunciator summary procedure but concluded that blocking M.SIS was not required because all valves that would have been affected by an MSIS actuation were already in their actuated positions. The shift technical advisor subsequently questioned whether MSIS should be blocked, but the annunciator procedure again was not consulted. Six minutes after the block permissive annunciated, the annunciator for MSIS actuation alarmed. Before operator action could be taken, MSIS actuated and was subsequently blocked and reset.

On August 11, 1995, the Train A containment spray header flow control valve, FCV-07-IA, failed its stroke test and was declared inoperable. Because repair of the valve was expected to take a significant length of time, the valve was placed in its safeguard position (open), and repair was deferred until the next refueling outage. On August 16, 1995, a Unit 1 heatup was begun, and the SDC system was secured. Unspecified maintenance on the LPSI system delayed performance of the emergency core cooling system venting procedure until 1756 on August 17, 1995, when the RCS was at 278'C (532TF) and 10.7 MPa (1550 psia). As part of the venting procedure, the IA LPSI pump was started and used to circulate refueling water tank (RWT) water through the SDC warm-up line. The SDC heat exchanger inlet and outlet valves were then opened to circulate water through the heat exchanger. Because FCV-07-I1A was open, a direct path from the RWT was provided to the A containment spray header.

Three minutes later, at 1806, the control room received high reactor cavity leakage annunciation, multiple containment fire alarms, and rapidly increasing containment sump flow indication, and entered the off-normnal operating procedure for excessive RCS leakage. The IA LPSI pump was stopped, the B.5-3 NUREG/CR-4674, Vol. 23

LER Nos. 335/95-004, -005, -006 Appendix B flow path through the spray header identified, the SDC heat exchanger isolation valves closed, and the venting procedure exited. Approximately 38,000 1(10,000 gal) of borated water was sprayed into the containment. The containment fire detection system malfunctioned during the event; 90% of the containment smoke detectors either alarmed or faulted. In addition, an electrical ground occurred on one safety injection tank sample valve [Ref, 4].

On August 28, 1995, with the unit in Mode 5 with an RCS temperature of approximately 49 0 C (120' 0 F) and an RCS pressure of 1.7 MPa (250 psia), high pressure safety injection (HPSI) header stop valve V-3656 was opened and HPSI pump IA was started to support an inservice leak test of header relief valve V-34 17. This valve is the HPSI equivalent of the LPSI relief valve that opened on August 10, 1995. HPSI pump operation is prohibited at RCS temperatures-below 113C (236'F). All four HPSI injection valves were shut and disabled at the time, so the RCS was not affected [Ref. 5].

B.5.3 Additional Evenft-Related Information The PORVs provide three functions at St. Lucie: (1) low temperature overpressure protection when the RCS temperature is below 152 0 C (305 0F) and not vented, (2) RCS pressure relief above normal operating pressure to m~inimize challenges to the pressurizer code safety valves, and (3) a bleed path for "once-through cooling" (feed-and-bleed) in the event that secondary-side decay heat removal is unavailable.

The LPSI system at St. Lucie provides injection for large- and medium-break loss-of-coolant accidents (LOCAs). The system is secured at the start of the recirculation phase, and the HPSI pumps are realigned and used to provide RCS makeup from the containment sump. The LPSI system also provides decay heat removal during normal plant shutdowns. Either LPSI pump can be used to circulate reactor coolant through a shutdown heat exchanger, returning it to the RCS via the low-pressure injection header.

B.5.4 Modeling Assumptions The combined event has been modeled as (1) an unavailability of both PORVs from the time St. Lucie 1 returned to power following its fall 1994 refueling outage, (2) a potential RCP seal LOCA resulting from the two failed seal stages, and (3) a 22 h unavailability of the SDC system for decay heat removal.

The failure of the operator to block the MSIS, inadvertent spray-down of the containment, and HPSI pump start at low temperature, while problematic, did not substantially impact core damage sequences and were not addressed.

PORV unavailability. St. Lucie 1 returned to power on December 1, 1994, and the failed PORVs were discovered on August 3, 1995. During this period (approximately 5880 h), the PORVs were unavailable for both pressure relief and for feed-and-bleed. To reflect the unavailability for feed-and-bleed, basic events for failure of the valves to open (PPR-SRV-CC- 1 and PPR-SRV-CC-2) were set to TRUE.

The Accident Sequence Precursor (ASP) models do not specifically address failure of relief valves to open for pressure relief, a sufficient number of valves are assumed to open to prevent overpressure.

NlJREGICR-4674, Vol. 23B54 B.54

ADDendix B LER Nos. 335/95-004.-005.-006 Because the two PORVs were failed, the pressurizer code safety valves (SVs) would have been demanded in the event of high RCS pressure. Because SVs cannot be isolated, failure of an open valve to close would result in an unisolatable small-break LOCA. The potential for the SVs to be challenged instead of the PORVs Was reflected in the model by setting the basic events for failure of the PORVs to close (PPR-SRV-OO-1 and PPR-SRV-OO-2) to FALSE and adding a basic event (PPR-SRV-OO-SRVS) to represent the potential that an open SV will fail to close.

The relief valve challenge rate used in the model was not revised to reflect the fact that the SVs would be challenged on high RCS pressure instead of the PORVs. The SV lift pressure is 0.7 MPa (100 psi) greater than the PORV lift pressure, and fewer transients are expected to reach this pressure, which should result in fewer SV challenges and, therefore, a lower challenge rate. Unfortunately, because PORVs are usually available, operational data on SV challenges do not exist. The significance of impacted sequences (primarily transient sequences 5, 7, and 8 in Fig. B.5. 1), is, therefore, potentially overestimated in the analysis. However, these sequences do not signifficantly contribute to the overall results even with the conservative SV challenge rate.

Potential RCP seal LOCA. The seal on RCP 1A2 could have degraded further and failed, resulting in a small-break LOCA. The probability of a small-break LOCA, given the degraded seal, was estimated from Byron-Jackson RCP seal data in Tables 4 and B-3 of NUREG- 1275, Vol. 7 [Ref. 6]. These tables list actual RCP seal degradations (e.g., the failure of a stage or increased controlled bleed-off flow) in which plant operation was allowed to continue for some period of time in accordance with operating procedures.

Most of the data in Tables 4 and B-3 of Ref. 6 were from the Nuclear Plant Reliability Data System and excluded the names of the plants at which the events occurred. However, data were listed for Arkansas Nuclear One (ANO), Units I and 2. These data were compared with the seal history data included for these two units in Appendix A of Ref. 6 to determine the fraction of events in Tables 4 and B-3 that were unrelated to the seal degradation observed during this event-primarily seal degradations caused component cooling water transients, weld cracks, and end-of-life failures. Approximately one-third of the ANO degradations were determined to be unrelated to this event. Assuming this fraction is applicable to all of the data in Tables 4 and B-3 of Ref. 6, 25 instances of seal degradation have occurred which appear to be relevant to the failure observed during this event and in which RCP operation continued. None of these 25 instances proceeded to a catastrophic seal failure.' Using a Chi-square approach' with zero observed seal failures in these 25 demands, a probability of 0.02 8 is estimated for a subsequent RCP seal failure and a small-break LOCA, given an observed seal degradation (stage failure).

IOne catastrophic seal failure was included inTable B-3 in Ref. 6 but was excluded from the set of seal degradations relevant to this event. That event occurred at ANO I and followed a loss of off-site power (LOOP) and a deliberate isolation of seal injection during a test.

2 The use of a Chi-square distribution, a standard approach to estimate failure probabilities for small numbers of events, is described in Chapter 5 of NUTREG/CR-2300, PRA Procedures Guide.

B.5-5 NUREG/CR4674, Vol. 23

LER Nos. 335/95-004.-005.-006 Appendix B The probability of a small-break LOCA resulting from further degradation of the RCP 1A2 seal was reflected in the ASP model by revising basic event IE-SLOCA to 0.028. Consistent with the analysis of the failed PORVs, PPR-SRV-CC-1 and PPR-SRV-CC-2 were set to TRUE to reflect the unavailability of the PORVs for feed-and-bleed cooling, and PPR-SRV-OO-1I and PPR-SRV-00-2 were set to FALSE to reflect the unavailability of the PORVs for pressure relief.'3 SDC unavailability for 22 b. During the 22 h that the SDC system was removed from service to repair failed thermal relief valve V3439, the only source of decay heat removal was via the steam generators.

Feed-and-bleed was unavailable because of the failed PORVs. The analysis for this case assumed that both motor-driven AFW pumps were available for use and that if both failed, RCS heatup would allow use of the turbine-driven AFW pump as well. The analysis also assumed that the AFW system had been returned to its pre-initiation state before the discovery of the stuck-open relief valve and that component failure probabilities applicable following a typical reactor trip from power were applicable in this situation as well.'

The LPSI system was removed from service nine days after St. Lucie was shut down for Hurricane Eri, when decay heat was approximately one-eighth of its nominal post-trip value. The lower decay heat level would substantially extend the time available to recover the AFW system if it failed and would eliminate the requirement to provide an alternate AFW suction source because the CST would not be expected to be emptied during the 22-h LPSI unavailability. (The decay heat load for this period is estimated to be less than 79% of the Technical Specification-required CST volume.) This was reflected in the model by reducing the probability of not recovering AFW, as described in the following paragraph; setting the basic event representing the failure of the operator to provide an alternate water source upon depletion of the condensate storage tank (CST), AFW-XHE-XA-CST2, to FALSE; and utilizing a 22-h mission time.'

The ASP models utilize a probability of 0.26 for failing to recover an initially failed AFW system within about 0.5 h following a reactor trip from power (basic event AFW-XHE-NOREC). Assuming the time available to recover AFW is proportional to the decay heat load, 4 h would be available if AFW had failed during the LPSI relief valve repair. AFW-XHE-NOREC was changed to 0.12 to reflect this greater recovery time. This value is the demand-related AFW nonrecovery probability developed in FaultedSystems Recovery Experience, NSAC- 161 [Ref. 7] (Fig. 3.1-2) at 2 h, the longest nonrecovery duration addressed in that document. The probability is conservative for 4 h but consistent with the data-3Since high RCS pressure would not exist following a postulated small-break LOCA, model changes were not actually required to reflect the unavailability of the PORVs for pressure relief.

4 This, most likely, is conservative since at least some of the AEW components had recently operated and non-demand, standby failures, therefore, would not substantially contribute to these component failure probabilities.

5 Certain basic events in the ASP models address both failure to start and failure to run. The probabilities for these basic events were not revised to reflect the 22-h mission time, which has less than a 2% percent impact on these basic event probabilities.

NLTREG/CR-4674, Vol. 23 B.5-6

ADDendix B LER Nos. 335/95-004. -005. -006 based approach summarized in NUREG/CR-4834, Vol. 2 [Ref. 8]; the data in Fig. 3.1-2 of Ref. 7 were not extrapolated.

The probability that AFW would have failed during the 22 h that the SDC system was removed from service is estimated to be 3.0 x 10-', using the St. Lucie ASP model modified as described previously.

If the AFW system had failed, the condensate system could have been used for steam generator (SG) makeup. In addition, if the AEW system had failed when initially demanded, following isolation of the SDC system (failure at this time is more likely than failure following a successful demand), the SDC system could have been returned to service with the leaking relief valve until the AFW sy stem had been restored to operation. The probability that both of these alternatives would fail is estimated to be well below 0.03, which reduces the overall conditional probability for the 22-h SDC unavailability to less than 1.0 x 10 ', the truncation limit for documentation in the ASP program. Because the conditional probability for the 22-h SDC unavailability is estimated to be less than 1.0 x 10' it was not analyzed further.

B.5.5 Analysis Results The CCDP estimated for the 5880-h PORV unavailability is 1.1 x 10'. This is an increase of 9.3 x 10-'

over the nominal CDP of 1.6 x 10-' for the same period. The dominant core damage sequence, highlighted as sequence number 21 on the event tree in Fig. B.5. 1,contributes about 55% to the increase in the CCDP and involves

" a postulated reactor trip during the 5880 h the PORVs were unavailable,

" nonrecoverable failures of main feedwater (MEW) and AFW, and

" loss of feed-and-bleed ability because of the unavailability of the PORVs.

The second highest core damage sequence, which contributes about 33% of the increase in CCDP, is similar to sequence number 21 on Fig. B.5.1 but involves a postulated LOOP instead of a transient and is highlighted on Fig. B.5.2. Sequence 16 involves

• a successful reactor trip given a LOOP with emergency power available,

" failure of the AFW system, and

" loss of feed-and-bleed ability because of the unavailability of the PORVs.'

Table B.5. 1provides the definitions and probabilities for selected basic events for the assessment of the unavailable PORVs. The conditional probabilities associated with the highest probability sequences sorted by the increase in conditional probability for the condition assessment are shown in Table B.5.2.

Table B.5.3 shows the sequence logic associated with the sequences in Table B.5.2. Table B.5.4 6

The LOOP event tree includes the successful recovery of offsite power within 6 b in the dominant sequence. This is an artifice of the top event ordering. Feed-and-bleed challenge would occur about 20 miin after the trip, and core damage would begin shortly thereafter.

Sequences 16 and 21 together represent the core damage sequence involving emergency power success and AFW and feed-and-bleed failure.

B.5-7 NUREG/CR-4674, Vol. 23

LER Nos. 335/95-004. -005. -006 Avvendix B describes the system names associated with the dominant sequences for the condition ass 'essment. Cut sets associated with the dominant sequences for the condition assessment are shown in Table B.5 .5.

The CCDP estimated for the potential RCP seal LOCA is 5.6 x 10' The dominant core damage sequence (the only sequence above the 1 x 10' ASP screening value) involves

" a postulated RCP seal LOCA,

• AFW success, and

" failure of HPI.

Definitions and probabilities for selected basic events for the potential RCP seal failure are shown in TableB.5.6. The conditional probabilities associated with the highest probability sequences sorted by the increase in CCDP are shown in Table B.5.7. Table B.5.8 shows the sequence logic associated with the sequences in Table B.5.7. Table B.5.9 describes the system names associated with the dominant sequences. Minimal cut sets associated with the dominant sequences are shown in Table B.5. 10.

B.5.6 References

1. LER 335/95-004, Rev. 0, "Hurricane Eri at St. Lucie," August 27, 1995.

2. LER 335/95-005, Rev. 0, "Pressurizer Power Operated Relief Valves (PORV) Inoperable due to Personnel Error," August 22, 1995.

3. LER 335/95-006, Rev. 0, "Loss of Reactor Coolant Inventory Through a Shutdown Cooling Relief Valve due to Lack of Design Margin," August 22, 1995.

4. LER 335/95-007, Rev. 0, "Inadvertent Containment Spray via IA Low Pressure Safety Injection Pump While Venting the Emergency Core Cooling System During Startup due to Inadequate Procedure," August 27, 1995.

5. LER 335/95-008, Rev. 0, "High Pressure Safety Injection Pump Operation During Plant Conditions Not Allowed by Technical Specifications due to Personnel Error," September 27, 1995.

6. OperatingExperience FeedbackReport - Experience with Pump Seals Installed in Reactor Coolant Pumps Manufactured by Byron Jackson, L. G. Bell and P. D. O'Reilly, NUREG-1275, Vol. 7, U.S. Nuclear Regulatory Commission, September 1992.

7. Faulted Systems Recovery Experience, H. R. Booth, F. J. Mollerus, and J. L. Wray, NSAC- 16 1, Nuclear Safety Analysis Center, May 1992.

8. Recovery Actions in PRA for the Risk Methods Integration and Evaluation Program (RA41EP),

Volume 2: Application of the Data-BasedMethod, D. W. Whitehead, NUREG/CR-4834, Vol. 2, Sandia National Laboratories, 1987.

Vol. 23 B.5-8 NUREG/CR-4674, Vol.

NUREG/CR-4674, 23 B.5-8

LER Nos. 335/95-004, -005, -006 Annendix BLENo.355-0,-5,06 Fig. B.5. 1. Dominant core damnage sequence given a transient for LER Nos. 335/95-004, -005, -006.

B.5-9 NUREG/CR-4674, Vol. 23

LER Nos. 335/95-004. -005. -006 Atmendix B a ýt 0;:VV; vtv g ; AAar;A aa oaamR; Q;;

7 I L~JU Ui U Eli ji I II III

+/-

ill

'Ii K

~ U

Ii' I uJ w.~ d V

II 2 Ii! T III *1 U

Fig. B3.5.2. Dominant core damage sequence given a LOOP for LER Nos. 335/95-004, -005, -006.

NUREG/CR-4674, Vol. 23 B.5-10

Annendix B B LER Nos. 335/95-004, -005, -006 nnendix Table B.5.1. Definitions and Probabilities for Selected Basic Events for LER Nos. 335195-004, -005, -006 (PORV Unavailability)

Modified Event Base Current for this name Description probability probability Type event AFW-MOV-CF-SGALL Common-Cause Failure of all 5.5E-005 5.5E-005 No Steam Generator Motor-

_______________Operated Valves ___

AFW-PMP-CF-ALL Common-Cause Failure of all 1.7E-004 1.7E-004 No AFW Pumps ________

AFW-XHE-NOREC Operator Fails to Recover AFW 2.6E-00 1 2.6E-00 1 No System AFW-XHE-NOREC-L Operator Fails to Recover AFW 2.6E-00OI 2.6E-001 No

________________During a LOOP ____ ____

AFW-XH-E-XA-CST2 Operator Fails to Initiate Backup 1 OE-003 L OE-003 No Water Source AFW-XCHE-XA-CST2L Operator Fails to Intiate Backup 1.OE-003 I.OE-003 No Water Source During a LOOP ____

EPS-DGN-CF-AB Common-Cause Failure of 1.6E-003 1.6E-003 No Diesel Generators EPS-DGN-FC-DGA Diesel Generator A Failures 4.2E-002 4.2E-002 No EPS-DGN-FC-DGB Diesel Generator B Failures 4.2E-002 4.2E-002 No EPS-XHE-NOREC' Operator Fails to Recover B.OE-0O1 S.OE-0O1 No Emergency Power HPI-MDP-CF-ALL Common-Cause Failure of HPI 1 OE-004 1 OE-004 No Motor-Driven Pumps HPI-MOV-CF-DISAL Common-Cause Failure of all 5.5E-005 5.5 E-005 No HPI Injection Valves HPI-TNK-FC-RWST Refueling Water Storage Tank 2.7E-006 2.7E-006 No and Water Supply Valve Failures MFW-SYS-TRIP Main Feedwater (MFW) System 2.OE-0O1 2.OE-0O1 No I_________ Trips_____________________

I___ ______

aThe potential recovery of ac power through recovery of oftsite power or use of the unit 1I/unit 2 cross-tie isaddressed in basic events OEP-XHE-NOREC-BD (operator fails to recover offsite power before batteries are depleted) and OEP-XHE-NOREC-SL [operator fails to recover offsite power (seal LOCA)1. Because these basic events are insequences that contribute to less than 1%of the total CCDP, they do not appear in Table 1which provides definitions and probabilities for basic events that appear in the dominant sequences, or Table 5 which lists the dominant sequences and their cut sets.

B.5-11 NLTREG/CR-4674, Vol. 23

A~ni B Annendix LER Nos. 335/95-004. -005. -006 Table B.5.1. Definitions and Probabilities for Selected Basic Events for LER Nos. 335/95-004, -005, -006 (PORV Unavailability)

Modified Event Base Current for this name Description probability probability Type -event MFW-XHiE-NOREC Operator Fails to Recover MEW 3.4E-OO1 3.4E-OO1I No PPR-SRV-CC-I PORV 1 Fails to Open on 2.0E-003 1.OE-*OOO TRUE Yes DemandI PPR-SRV-CC-2 PORV 2 Fails to Open on 2.OE-003 1.OE-*OOO TRUE Yes Demand PPR-SRV-CO-SBO PORVs Open During a Station 3.7E-001 M.E-0O1 No Blackout PPR-SRV-CO-TRAN PORVs Open During Transient 4.0E-002 4.OE-002 No PPR-SRV-00-1 PORV I Fails to Reclose After 2.OE-003 O.OE+OOO FALSE Yes

___________________ Opening________ _____ ___ _____ _______

PPR-SRV-00-2 PORV 2 Fails to Reclose After 2.OE-003 O.OE+OOO FALSE Yes

___________________ Opening________ _____ ___ _____ _______

PPR-SRV-00-SRVS At Least One Safety Valve Fails O.OE-s-OO 9.0E-002 Yes to Reclose, After Opening I____ I____ I_______

23 B.5-12 NIJIIEG/CR-4674, Vol.

NUREG/CR-4674, Vol. 23 B.5-12

Annendix B AnDendix B LER Nos.

LER Nos. 335/95-004.-005.-006 335/95-004. -005. -006 Table B.5.2. Sequence Conditional Probabilities for LER Nos. 335/95-004, -005, -006 (PORV Unavailability)

Conditional Core Event tree Sequence core damage Importance Percent name name damage probability (CCDP-CDP) contribution' probability (CDP)

_______ _______ (CCDP) _____ ____

TRANS 21 5. E-005 7.213-007 5.OE-005 54.9 LOOP 16 3.1E-005 4.5E-007 3.013-005 33.3 LOOP 40 8.5E-006 1.213-008 1 8.513-006 9.2 TRANS 08 1.3E-006 8.1E-010 1.3E-006 14

-Total (all .sequences) j 1.1E-004 I 1.6=E-005 9.3E-005 Percent contribution to the total importance.

Table B.5.3. Sequence Logic for Dominant Sequences for LER Nos. 335/95-004, -005, -006 (PORV Unavailability)

Event tree name Sequence name Logic TRANS 21 IRT, AFW, MFW, F&B LOOP 16 IRT-L, /EP, AFW-L, /OP-6H, F&B-L LOOP 40 IR.T-L, EP, /AFW-L, PORV-SBO, PRVL-RES TRANS 08 /RT, /AFW, PORV, PORV-RES, H-PI B.5-13 B.5-13NUREG/CR-4674, Vol. 23

Annendix B A~ni LER Nos. 335/95-004. -005. -006 Table B.5.4. System Names for LER Nos. 335/95-004, -005, -006 (PORV Unavailability)

System name Logic AFW No or insufficient AFW flow AFW-L No or insufficient AFW flow during LOOP EP Failure of both trains of emergency power F&B Failure to provide feed-and-bleed cooling F&B-L Failure of feed-and-bleed cooling during a LOOP HPI No or insufficient flow from HPI system MEW Failure of the main feedwater system OP-6H- Operator fails to recover off-site power within 6 h PORV PORVs open during transient PORV-RES PORM fail to reseat PORV-SBO PORVs open during station blackout event PRVL-RES PORVs and block valves fail to reclose, [electric power

______________(EP) succeeds]

RT Reactor fails to trip during transient RT-L Reactor fails to trip during LOOP B.5-14 NUREG/CR-4674, Vol. 23 NUREGICR-4674, Vol. 23 B.5-14

Appendix BLENo.355-0,-5,06 LER Nos. 335/95-004, -005, -006 Table B.5.5. Conditional Cut Sets for Higher Probability Sequences for LER Nos. 335/95-004, -005, -006 (PORV Unavailability)

Cut set Percent Conditional no. contribution probability" Cut setsb TRANS Sequence 21 5.I1E-005.......

1 80.2 4. 1IE-005 AFW-XHE-XA-CST2, AFW-XE-NOREC, MFW-SYS-TRIP,

__________MFW-XHE-NOREC, PPR-SRV-CC-1 (or PPR-SRV-CC-2) 2 14.2 7.OE-006 AFW-PMP-CF-ALL, AFW-XHE-NOREC, MFW-SYS-TRIP, MFW-XH-E-NOREC, PPR-SRV-CC-1 (or PPR-SRV-CC-2) 3 4.4 2.2E-006 AFW-MOV-CF-SGALL, AFW-XHE-NOREC, MFW-SYS-TRIP,

________MFW-XHE-NOREC, PPR-SRV-CC-1I (or PPR-SRV-CC-2)

LOOP Sequence 16 3.1E-005 .............................. . ...... . . . . .

1 79.0 2.4E-005 AFW-XHE-XA-CST2L, AFW-XHE-NOREC-L, PPR-SRV-CC-1

__________(or PPR-SRV-CC-2) 2 13.9 4.4E-006 AFW-PMP-CF-ALL, AFW-XE-NOREC, PPR-SRV-CC- I

___________(or

_________ PPR.SRV..CC-2) 3 4.3 1.3E-006 AFW-MOV-CF-SGALL, AFW-XE-NOREC-L. PPR-SRV-CC- 1

___________(or PPR-SRV-CC-2)

LOOP Sequence 40 8.5 E-006 .........

1 52.4 4.5E-006 EPS-DGN-FC-DGA, EPS-DGN-FC-DGB, EPS-XHE-NOREC, PPR-SRV-CO-SBO, PPR-SRV-00-SRVS 2 47.5 4.OE-006 EPS-DGN-CF-AB, EPS-XHE-NOREC, PPR-SRV-CO-SBO, PPR-SRV-00-SRVS TRA1~J..Sequence.0..1.........

1 62.6 8................ ....... O-RA}.........SRS.HP-M P- F-347.............RA .PP -RVO -S VS PIM V-FDIA 2..........

3 1.6 2.2E-008 I PPR-SRV-CO-TRAN. PPR-SRV-OO-SRVS, HPI-TNK-FC-RWST I Total (lseun s) 1.1E-004

'The conditional probability for each cut set is determined by multiplying the probability that the portion of the sequence that makes the precursor visible (e.g., the system with a failure is demanded) will occur during the duration of the event by the probabilities of the remaining basic events in the minimal cut set. This can be approximated by 1 - e4', where p is determined by multiplying the expected number of initiators that occur during the duration of the event by the probabilities of the basic events in that cut set. The expected number of initiators is given by It, where X is the frequency of the initiating event (given B.5-15 NUREG/CR-4674, Vol. 23

LER Nos. 335/95-004, -005, -006 Appendix B Apni on a per-hour basis), and t is the duration time of the event (in this case, 5880 h). This approximation is conservative for precursors made visible by the initiating event. The frequencies of interest for this event are:

X,,,= 4.0 x 10'/h and X,, = 1.6 x 10-'/h.

bBasic events PPR-SRV-CC-i and PPR-SRV-CC-2 are type TRUE events which are not normally included in the output of fault tree reduction programs. These events have been added to aid in understanding the sequences to potential core damage associated with the event.

B.5-16 NUREG/CR-4674, Vol. Vol. 23 23 B.5-16

LER Nos. 335/95-004, -005, -006 Annendix BLENo.359-0,-5,06 Table B.5.6.' Definitions and Probabilities, for Selected Basic Events for LER Nos. 335/95-004, -005, -006 (RCP Seal Leak)

Modified Event Base Current for this name Description probability probability Type event IE-LOOP Initiating Event - Loss-of-Offsite 1.613-005 O.OE+OOO Yes Power IE-SGTR Initiating Event - Steam 1.E-006 O.OE11-000 Yes Generator Tube Rupture_____

JE-SLOCA Initiating Event -Small Break 1.O13-006 2.8E-002 Yes Loss-of-Coolant Accident IE-TRANS Initiating Event - Transients 4.OE-004 O.OE4000 Yes AFW-MOV-CF-SGALL Common-Cause Failure of all 5.513-005 5.5E-005 No Steam Generator Motor-

_____________Operated Valves AFW-PMP-CF-ALL Common-Cause Failure of all 1.7E-004 1.7E3-004 No AFW Pumps_____ _____

AFW-XHE-NOREC Operator Fails to Recover AFW` 2.611-001 2.6E-001 No

________________System____ __ _________

AFW-XH-E-XA-CST2 Operator Fails to Initiate Backup 1.OE1-003 1.OE3-003 No Water Source HPI-MDP-CF-ALL Common-Cause Failure of HPI 1 OE-004 1.OE1-004 No Motor-Driven Pumps ______

HPI-MOV-CF-DISAL Common-Cause Failure of all 5.5E-005 5.5E-005 No HPI Injection Valves ______

HPI-TNK-FC-RWST Refueling Water Storage Tank 2.7E-006 2.7E-006 No and Water Supply Valve Failures MFW-SYS-TRIP MFW System Trips 2.OE-OO1I 2.OE-OO1 No MFW-XHE-NOREC Operator Fails to Recover MFW 3.4E-001 3.4E-0O1 No PPR-SRV-CC- 1 PORV 1 Fails to Open on 2.OE-003 1.OE-*OOO TRUE Yes Demand PPR-SRV`-CC-2 PORV 2 Fails to Open on 2.OE-003 1.OE+OOO TRUE Yes Demand PPR-SRV-O I- PORV 1 Fails to Reclose After 2.OE-003 O.OE-i-OO FALSE Yes

__________ Opening I____ ______ I___ ___

NIJREGICR-4674, Vol. 23 B.5-17 B.5-1.7 NUREG/CR-4674, Vol. 23

LER Nos. 335/95-004, -005, -006 Apni Appendix B Table B.5.6. Definitions and Probabilities for Selected Basic Events for LER Nos. 335/95-004, -005, -006 (RCP Seal Leak)

Modified Event Base Current for this name Description probability probability Type event PPR-SRV-00-2 PORV 2 Fails to Reclose After 2.OE-003 O.QE+OOO FALSE Yes Opening_______ ___

PPR-SRV-00-SRVS At Least One Safety Relief O.OE+OOO 9.OE-002 Yes Valve Fails to Reclose After Opening _____

RPS-NQNREC Nonrecoverable Reactor 2.OE-005 2.OE-OO5 No Protection System Trip Failures I____________

23 B.5-18 NIJREGICR-4674, Vol.

NUREG/CR-4674, Vol. 23 B.5-18

Avvendix B -006 LER Nos. 335/95-004, -005, -006 Appendix B LER Nos. 335/95-004, -005, Table B.5.7. Sequence Conditional Probabilities for LER Nos. 335/95-004, -005, -006 (RCP Seal Leak)

Conditional core Event tree Sequence damage Percent name name probability contribution

_________ (CCDP)

SLOCA 06 4.413-006 78.6 SLOCA 23 6.1E-007 10.9 SLOCA 1 24 5.613-007 10.0 or 33 LE /9Nos.....

-0 4 -005 -006.. ..

EeTatree name8 Sequence ae frDmnn Logic eune SLOCA 06 /RT, /AFW, HPI SLOCA 23 /RT, AFW, MFW, F&B SLOCA 24 RT Table B.5.9. System Names for LER Nos. 335/95-004, -005, -006 (RCP Seal Leak)

System name Logic AFW No or insufficient AFW flow F&B Failure to provide feed-and-bleed cooling HPI No or insufficient flow from HPI system MFW Failure of the MFW system RT Reactor fails to trip during transient B.5-19 B.5-19NUTREG/CR-4674, Vol. 23

LER Nos. 335/95-004, -005, -006 LER os. 35/5-00, -05, 006Appendix B Table B.5.10. Conditional Cut Sets for Higher Probability Sequences for LER Nos. 335/95-004, -005, -006 (RCP Seal Leak)

Cut set Percent Conditional no. I contribution probability' Cut setsb SLOCA Sequence 06 4.4E-006 I 62.6 2.8E-006 IHPI-MDP-CF-ALL 2 34.7____ 1.5E-006 HPJ-MOV-CF-DISAI 3 1.6 7.5E-008 I HPI-TNK-FC-RWST SLOCA Sequence 23 6. 1E-007 1 80.2 4.9E-007 AFW-XHiE-XA-CST2, AFW-XHiE-NOREC, MFW-SYS-TRIP, MFW-XHE-NOREC, PPR-SRV-CC-1 (or PPR-SRV-CC-2) 2 14.2 8.7E-008 AFW-PMP-CF-ALL, AFW-XHiE-NOREC, MFW-SYS-TRIP, MFW-XHiE-NOREC, PPR-SRV-CC-1 (or PPR-SRV-CC-2) 3 4.4 2.7E-008 AFW-MQV-CF-SGALL, AFW-XHiE-NOREC, MFW-SYS-TRIP, MFW-XHEF-NORF.C PPR-RqRV-CC'-I (or PPR-SqRV-CC-2')

SLOCA Sequence 24 5.6E-007 1 100.0 5.6E-007 I RPS-NOREC I Total (all sequences) 5.6E-006 aThe conditional probability for each cut set is determined by multiplying the probability of the initiating event by the probabilities of the basic events in that minimal cut set. The probability of the initiating events are given in Table 6 and begin with the designator "JE." The probabilities for the basic events are also given inTable 6.

b Basic events PPR-SRV-CC- 1 and PPR-SRV-CC-2 are type TRUE events which are not normally included in the output of fault tree reduction programs. These events have been added to aid in understanding the sequences to potential core damage associated with the event.

B.5-20 NUREG/CR-4674, Vol. Vol. 2323 B.5-20