ML20210G467
| ML20210G467 | |
| Person / Time | |
|---|---|
| Site: | San Onofre  |
| Issue date: | 07/30/1999 |
| From: | King T NRC OFFICE OF NUCLEAR REGULATORY RESEARCH (RES) |
| To: | Holahan G, Matthews D, Strosnider J NRC (Affiliation Not Assigned) |
| Shared Package | |
| ML20210G460 | List: |
| References | |
| NUDOCS 9908030106 | |
| Download: ML20210G467 (157) | |
Text
{{#Wiki_filter:. 8
- C MIO e }t UNITED STATES
[ j 2 NUCLEAR REGULATORY COMMISSION WASHINGTON, o.C. 20555-0001
%...../ ,
July 30, 1999 MEMORANDUM TO: David B. Matthews, Director, DRIP:NRR Gary M. Holahan, Director, DSSA:NRR Jack R. Strosnider, Jr., Director, DE:NRR Charles E. Rossi, DSARE.RES / John W. Craig, Director, DET:RES Wayne D. Lanning, Director, DRS:RGN-l A. Randolph Blough, Directcr, DRP:RGN-l Bruce S. Mallett, Director, DRS:RGN-ll Loren R. Plisco, Director, DRP:RGN-Il John A. Grobe, Director, DRS:RGN-ill Geoffrey E. Grant, Director, DRP:RGN-ill Arthur T. Howell, Director, DRS:RGN-IV Kenneth E. Brockman, DirectorrDRP:RGN-IV h) FROM: Thomas L. King, Director j. y,. It Division of Risk Analysis and
,',\
lications Office of Nuclear Regulatory Research
SUBJECT:
REQUEST FOR REVIEW OF REPORT- SYSTEM RELIABILITY STUDY- HIGH PRESSURE INJECTION SYSTEM,1987-1997 Attached for your information and review is the draft report on the high pressure injection (HPI) system reliability at U.S. commercial pressurized water reactors. This study is part of our ongoing evaluation of the reliability of risk-significant safety systems and their associated components. Using data obtained from licensee event reports and the common cause failure (CCF) database, the study provides an estimate of the HPl system unreliability based on unplanned system demands between 1987 and 1997. In addition, the report identifies dominant contributors to system unreliability, compares HPl unreliability calculated using operating experience with unreliability calculated using data puhlished in probabilistic risk assessments (PRAs) and individual plant examinations (IPEs), evaluates significant trends, and provides insights on failure detection methods. Major findings obtained from this study are summarized below:
. Based on 1987-1997 operating experience data, there were no failures of the entire HPI system in 224 unplanned system demands. The arithmetic average of HPl system unreliability for 72 pressurized water reactors is 4.5E-4. The industry-wide arithmetic average of HPl system unreliability calculated using data extracted from PRA/IPEs is 5.7E-4. This is consistent with the HPl sustem unreliability based on operating experience from 1987-1997.
CONTACT: Sunil D. Weerakkody (SDW1), OERAB:DRAA:RES (301) 415-6374 9908030106 DR 990729 ADOCK 05000361 PDR
e' j
$ ') -
L Multiple Addressees 2 i Individual plant HPI system unreliabilities among the 72 plants vary by a factor of 50, i from 6E-5 to 3.5E-3. The variability reflects the diversity found in HPl system designs l rather than a difference in performance among plants. Plants with both high head and 1 intermediate head HPl trains have lower system unreliabilities and plants with only high head or only intermediate HPl trains have relatively higher system unreliabilities.
- For plants with both high head and intermediate head HPl trains, the unreliabilities )
calculated using IPE data are significantly lower than the unreliabilities calculated using i 1987-1997 operating experience. Some of these IPEs may have optimistically evaluated ' ]'
- HPl unrelisbety. This difference is attributed to the dominating contribution (greater than 90%) of the RWST suction path failure probability to the overall system unreliability for
. the operating expertence based analysis for plants in this class. The failure probability of the RWST suction segment may not have been property incorporated in some pes of plants in this class.
- Common cause failures of pump trains (pumps failing to start or run) and injection ,
headers (motor operated valves), and independent failures in the shared suction path i from the refueling water storage tank (only for plants with both high head and intermediate head pump trains) are the leading contributors to system unreliability. i
- The frequency of unplanned HPl demands and the number of HPl failure events show a i statistically significant downward trend as a function of calendar time and as a function of j
- plant age. That is, the number of HPl demands and the number of reportedHPl failure ]
events per year per plant have gone down with calendar time, in addition, older plants, tend to have less HPi demands and less reported failure events per unit time compared to new plants. We are specifically interested in your comments regarding:
- The technical adequacy of the data analysis,
- The appropriateness of the findings, s nd ,
- How the information contained in the report can be presented in order to better help you in your risk-informed regulatory activities.
l
p I
' l Multiple Addressees 3 It is our understanding that NRR will coordinate the review by and receipt of comments from the '
regions. We intend to have a review meeting on Friday, September 3,1999 at 9.00 A.M. in room T483 to ; discuss any comments or recommendations you might have before we issue the final report. I i
Attachment:
As stated cc w/att.: A. Thadani, RES M. Federline, RES j S. Collins, NRR R. Zimmerman, NRR B. Sheron, NRR W. Kane, NRR Distribution w/att.: OERAB RF ARubin, RES MReinhart, NRR PBernard, Ril DRAA RF MCunningham, RES MParker, Rlli WJones, RIV File Center NSiu, RES RBarrett, NRR SBurgess, Rlli Public MDrouin, RES PWilson, NRR JShackelford, RIV JRosenthal JVora, RES DCoe, NRR JFiack LLancaster, RES WDean, NRR TFoley GParry, NRR MJohnson, NRk MKnapp, DEDE SMalik, NRR AMadison, NRR JMitchell, OEDO FTalbot, NRR JTrapp, RI JLarkins, ACRS LMarsh, NRR TShediosky, RI MMarkley, ACRS MRubin, NRR WRogers, Ril DOCUMENT NAME: S:\DRAA.OERAB\SDW1\HPINRCDISMEMO.WPD To receive a copr of thie document indicate in the box "C" = Copy wolencI"E" = Copy w/enci "N" = No copy OFFICE OERAB k OERAB C, OERAB (/ RES $. NAME SWeerakkody SMays hM PBaranowsky TKirhh DATE 7 /2 7 /99 ' 7 /yg/99 ]/78/99 7 Os /99 L
1 NUREGICR-xxxx, Vol. x INEEUEXT-99-00373 July 1999 High-Pressure Safety injection System Reliability, 1987-1997 , (DRAFT) J. P. Poloski J. K. Knudsen C.L.Atwood W. J. Galyean l I
NUREG/CR-xxxx, Vol. x INEEUEXT-99-00373 High-Pressure Safety injection System Reliability, 1987-1997 (DRAFT) l J. P. Poloski - J.K.Knudsen C. L. Atwood W. J. Galyean Manuscript Completed July 1999 l Idaho National Engineering and Environmental Laboratory Nuclear Operations Analysis Department Lockheed Martin Idaho Technologies Company Idaho Falls, Idaho 83415 Prepared for the Division of Risk Analysis and Applications Office of Nuclear Regulatory Research U.S. Nuclear Regulatory Commission Washington, D.C. 20555 Job Code E8246 (
CONTENTS EXECUTIVE
SUMMARY
.. .... ... . . . . . . . . . . . . ix FOREWORD ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. . . . . . .. . . xvi ACKNL ./LEDGMENTS...... .. . .. . . . . . . . . . . . . . . . . .. . . . . . . .. xix ACRONYM S . ...... . .. .. ...... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxi l TERMINOLOGY... . . . . . . . . . . . . . . . . . . . . . . . . . . . .. . . . . , .. . . . . xxiii
- 1. INTRODUCTION . ... . . .. . . . .. .... . . . . . . . . . . . . . . . . . . . . . . . . . . 1
- 2. SCOPE OF STUDY.. . . . ... ..... .. . ... .. .. .. ... . .. . . . . . . . . . . . . . . . . 3 2.1 System Operation and Description.. . . .. . .. . .. . . . . . . . . . 3 2.1.1 System Purpose ... .. .. . .. . ... . . . . . . .. .. 3 2.1.2 System Description . . .. . . .. .. .. .. .... ... . . . . . . . . .. 3 2.1.3 System Boundaries.. . . . . . . . . . . . . . . . . . . . . . . . . . . 12 2.2 Collection of Plant Operating Data .. . . . . . . . . . . . . . . . . . . . .. 13 2.2.1 Characterization ofInoperability Data.. . . . . . . . . . . . . . . . .. . . . . . . . 13 2.2.2 Failure Classification.. .
1 2.2.3 Characterization of Demand Data. . . . . . . . . . .
. . . . . . . . . . . ...... . . 14
. . . . . . . . . . . . 15 2.3 Operational Data Analysis..... .. . . ... . . . . . . . . . . . . . . . . . . . . 17
- 3. RISK-BASED ANALYSIS OF THE 1987-1997 EXPERIENCE.. .. . . . . . . 18 3.1 HPI Unreliability Data and System Modeling... ... . . . . . . . .. .. . 20 3.1.1 Recovery of HPI Failures. . . . . . . . . . 21 1 3.1.2 Failure and Demand Counts used in the Unreliability Estimation. 21 3.1.3 Modeling of Common Cause Failures.. . .. . 23 3.1.4 HPI System Fault Tree Models .. .. .. . . 24 1 3.2 HPI Unreliability. .. .. . . . . . . . . . . 24 3.2.1 HPl System Modeling Assumptions .
1 3.2.2 Estimates of HPI Unreliability and Insights.. 24 34 m 3.2.3 HPI Unreliability Across Design Classes.. 34 3.2.4 Within Design Class Differences . . . . . 36 ( 3.3 Comparison with PRA/IPEs. . . . .. . . . . 39 3.3.1 HPI System Model Assumptions for Comparison with PRA/IPE Results.. 40 [ 3.3.2 3.3.3 Comparison with PRA/IPE Results.. . 41 Maintenance-Out-of-Service---Pump Train Segment . . . 43 , iii NUREG/CR-xxxx, Vol. x
3.3.4 Failure to Start-Pump Train Segment. . . . . .. . 44 3.3.5 Failure to Run-Pump Train Segment. .. . . . 44 3.4 Human Error of Commission. . . . .. . .. . 44 3.5 Sensitivity of Support System Failures (Outside IIPI System Boundary) on HPI Unreliability. .. . . .. .. ... . . . 45
- 4. ENGINEERING ANALYSIS OF TIIE 1987-1997 Experience.. .. . 47 4.1 Industry Trends.. . . . . . . . . . . .. .. . . 49 4.1.1 Trends by Year.. ... ... . . . . . .. . . 49 4.2 Factors Affecting HPI Reliability (Failures Identified During SI Actuations).. .. 55 4.2.1 System Reliability. . . .. . .. . 56 4.2.2 Train Reliability.. . . . . . . . . . .. 60 4.2.3 Intermediate-head Pump Reliability... . .. . . . 60 4.2.4 Injection Header / Cold Leg Injection Path.. . . . . . . . 60 4.3 Comparisons of Failures During Unplanned Demands With Failures Detected by Other Means . . .. . . . . ... . . . . . . ... 61 4.4 Insights from the ASP Events to the HPI Reliability Study.. 65 I
4.5 Regulatory Issues . ... . . . . . . . . . . . . . . . . . . 65
- 5. IEFERENCES . . .. . . . . . ... 70 Appendix A -HPI Data Collection and Analysis Methods Appendix B-HPI Operational Data, 1987-1997 Appendix C-HPI Unreliability Events, 1987-1997 Appendix D-Supporting Information ofIIPI System Unreliability Analysis NUREG/CR-xxxx, Vol. x iv
F LIST OF FIGURES ES-1. Plant-specific estimates ofIIPI system unreliability (injection phase only) grouped by design class. The mean and uncertainty values associated with this plot are listed in Table D-3 in Appendix D.. . . . . . . . . . . . . . . . . . . . . . . . . xi ES-2. Plant-specific estimates ofIIPI system unreliability (injection phase only) grouped by design class. The mean and uncertainty values associated with this plot are listed in Table D-3 and D-4 in Appendix D .. . . .. . . . . . . . .. ... . . . . . ..... xiii ES-3. Frequency (events per reactor-calendar year) of all Si actuations, as a function of calendar year, calculated assuming that the frequency does not depend on. . . . . . ... . xiv ES-4. Frequency (events per reactor-calendar year) of all Si actuations, as a function of calendar year, for hypothetical plants of several low-power license dates... .. . . . . xiv ES-5. Frequency (events per reactor-calendar year) of all IIPI failure events, as a function of calendar year, for hypothetin t plants of several low-power license dates.. . . . . xv ES-6. Illustration of the IIPI failures by cause . . . . . . . . . . . . . .. . . . . . . . . . . xvi ES-7. Distribution of the detection method by failures of the three major IIPI segments.. . xvi
- 1. Simplified block diagrams ofIIPI systems for each of the 6 design classes. . . . . . 8
- 2. Illustration of the relationship between the inoperability and failure data sets.... . 17 i
- 3. The recovery tree depicting the outcomes of recovering an HPI failure. The tree is
{ based on the recovery actions observed in the unplanned demand data. Path B had l no events of this type. Path E was assumed to have no likelihood based on i Path B results . .. . . ..... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 21 1
- 4. System fault trees of the six HPI (injection phase) design classes used m calculating unreliability. . . . . . . . . . . .. . . . . . .. 26
- 5. Plant-specific estimates ofIIPI system unreliability (injection phase only) grouped by design class. The mean and uncertamty values associated with this plot are listed in Table D-3 in Appendix D.. . .. 37
- 6. Plot of the PRA/IPE estimates ofIIPI unreliability (injection phase only). The mean and uncertainty values associated with this plot are listed in Tables D-3 and D-4 in Appendix D.. . . . . . . . . 42 7, Frequency (events per reactor-calendar year) of all Si actuations, as a function of calendar year, with confidence limits on the individual frequencies. The decreasing trend is highly statistically significant (p-value is 0.0001). However, the analysis I assumes that the frequency does not depend on plant low-power license date . 50 l
l l v NUREG/CR-xxxx, Vol. x
- 8. Frequency (events per reactor-calendar year) of all SI actuations, as a function oflow-power license date. The trend is not quite significant (p-value = 0.06), and some lack of fit is seen. Each point corresponds to a single plant and ignores the effect of calendar year for the plant . . . .. . .... . . . .. .. 50
- 9. Frequency (events per reactor-calendar year) of all SI actuations, as a function of calendar year, for hypothetical plants of several low-power license dates... . . . . . . 51
- 10. Frequency (events per reactor-critical year) of all automatic and manual SI actuations, as a ftmetion of calendar year, for hypothetical plants of several low-power license dates. To avoid clutter, confidence bands are not shown . .. . .. 52
- 11. Frequency (events per reactor-calendar year) ofinadvertent and spurious SI actuations, as a function of calendar year. The effect oflow-power license date was not statistically significant, uid so is not modeled . . . . . . ... . .. . . .. . .. 54
- 12. Frequency (events per reactor <alendar year) of all HPI failure events, as a function of calendar year, for hypothetical plants of several low-power license dates.. . . . . . .. 54
- 13. Cumulative numbers of segment failure events, for three classes of segments, plotted by calendar year.. . . . . . . . . . . . . . .. . . .. . .. .. . . .. 55
- 14. Distribution of the detection method by failures of the three major HPI segments., . . . . . . 64 I
l l 4 I l l NUREG/CR-xxxx, Vol. x vi l
LIST OF TABLES
- 1. Listing of the IIPI design classes, Units associated with each design class, the number and type ofIIPI trains, the number of cold-legs, and the success criterion
( for a small LOCA (as stated in the IPEs).. . . . . .. . .. .. 4
- 2. A summary of the llPI system / segment demands and associated independent failures identified in the unplanned demands .
{ . . . . . . . . . . . . . . . .. 23
- 3. Estimates of alpha factors based on the 1987-1997 experience used for calculating the llPI unreliability..... . . . . . . . . . . . . . . . . . . . . . . . .. .. . . . . . 25
- 4. IIPI system failure mede data and Bayesian probability information for estimating unreliability. The common cause alpha factors are presented in Table 3. .. 35
- 5. IIPI system cut set contribution (for the reference plant in each design class) to unreliability (injection phase only).. . .. ........ . . .. . . 36
- 6. Average design class unreliability (injection phase only) calculated from the 1987-1997 experience.. . .. ... . . .. .. . 36
- 7. Average design class unreliability (injection phase only) calculated from the 1987-1997 experience compared to the values calculated from the PRA/IPEs . . 43
- 8. Comparison of the independent failure and common cause failure contribution (for the reference plant in each design class) to the risk-based unreliability (injection pha: e only) based on IPE data and 1987-1997 experience.. .. . . . 43
- 9. Pump train segment maintenance-out-of-service probabilities (per demand) calculated from IPE data and 1987-1997 experience.. . . . . 44
- 10. Pump train segment failure to start probabilities (per demand) calculated for comparisons with PRA/IPE results and 1987-1997 experience.. . . . 45
( l 1. Pump train segment failure to run probabilities calculated from IPE data and 1987-1997 experience. . 45
- 12. Number ofIIPI events by category for each year' of the study. 49
- 13. Failures partitioned by segment type and by cause category.. . . 62
- 14. Segment failures partitioned by cause category and by calendar year.. 62
- 15. Pump segment failures partitioned by cause category and failure mode. 62
- 16. Failures partitioned by detection method and by cause category . 63
- 17. Failures partitioned by detection method and by segment category. 64
- 18. List of the ASP events that identified an IIPI unplanned demand and no IIPI failure. 65 r
vii NUREG/CR-xxxx, Vol. x
I
- 19. The listing of ASP events that identify a HPI failure . . . . .. . 66
- 20. NRC Inspection Notices related to the HPI system during this study period. . . .. .. 68 i
I I, i Ii I' I l I NUREG/CR-xxxx, Vol. x viii
1 EXECUTIVE
SUMMARY
I This report presents a performance analysis of High-Pressure Safety injection (HPI) systems at 72 United States commercial pressurized water reactors (PWRs). The evaluation is based on the operati7g experience from 1987 through 1997, as reported in Licensee Event Reports (LERs). The objectives of the study are: (1) to estimate the system unreliability based on operating experience and to compare these estimates with the assumptions, models, and data used in probabilistic risk assessments and individual plant evaluations (PRA/IPEs); and (2) to review the operating data from an engineering perspective to determine trends and patterns seen in the data and provide insights I into the failures and failure mechanisms associated with the operation of the HPI system. Ris study used as its source data the operating experience from 1987 through I 1997 as reported in LERs. He Sequence Coding and Search System (SCSS) database was used to identify LERs for review and classification for this study. De reportability requirements of 10 CFR 50.73 (LER rule) were not used to define or I classify any events used in this study. The full text of each LER was reviewed by an U.S. commercial nuclear power plant experienced engineer from a risk and reliability perspective. The HPI system unreliabilities (injection phase only) were estimated using a fault tree model to associate event occurrences with broadly defined failure I modes such as failure to start or failure to run. The probabilities for the failure modes were calculated by reviewing the failure information, categorizing each event by failure mode, and estimating the corresponding number of demands. I Forty-seven plant risk reports (i.e., PRAs, IPEs, and NUREGs) were used for comparison to the HPI reliability results obtained in this study. These reports document HPI system infonnation for 72 PWR plants. The HPl system configuratio..s (and operation) for the 72 plants used in this study differ considerably. HPI systems consist of different levels of pump train redundancy and diversity. To facilitate the assessment of the HPI systems, six HPI design classes were identified, and the plants were categorized accordingly. Major FMdings Based on the 1987-1997 experience data, there were no failures of the l entire HPI system identified in 224 unplanned system demands. An industry-wide Bayes estimate of the HPI system unreliability (injection phase only) using this data is 2.2E-03 (probability of failure per demand) with an I associated 90% uncertainty interval of[8.9E-06,8.6E-03]. System level fault tree models that use more detailed segment-level data and individual failure modes produces an unreliability of the HPI system of 4.5E-04 (calculated by I arithmetically averaging the results of 72 plant-specific models). There is a significant difference (approximately a factor of five) between the arithmetic average of the 72 plant-specific values (4.5E-04) and the Bayes estimate (2.2E-03). The arithmetic average is more representative of the actual system unreliability since it is based on a larger number of demands and failures ix NUREG/CR-xxxx, Vol. x
I compared to the data used to derive the Bayes estimate. The significant uncertainty of the Bayes estimate is demonstrated by the relatively wide 90% uncertainty band (approximately three orders of magnitude, ranging from 8.9E-06 to 8.6E-03). Individual plant results vary by about a factor of fifty, from 6.0E-05 to 3.5E-03. The variability largely reflects the diversity found in HPI system designs. However, there is some variation in results among plants with similar HPI designs (factors of ten between the highest and lowest HPI unreliabilites within a single design class). This is attributed to differences in the levels of redundancy in the injection headers. The estimates of HPI unreliability using operating experience from LERs and fault tree analyses are plotted in Figure ES-1. Contributions to unreliability varied depending on the design and operation of the HPI system. Details for each class are provided in Section 3.2 of the report. Based on the average of the six reference plants, common cause failure (CCF) is the leading contributor to the unreliability. Generally, the imponance of CCF is typical of redundant train systems that are highly reliable. Although there g were no actual CCFs events identified in the unplanned Si actuations, there were 3 CCF events identified in the 1987-1997 experience. Typically, these CCF events involved failures of the injection header segments and failures of redundant pump trains (failure to start and failure to run). For plants having HPI systems E 3 consisting of both high- and intermediate-head injection systems, no CCF failures were identified that affected both the high-and intermediate-head systems in the. Based en HPI unreliability calculated form the 1987-1997 experience, HPI systems consisting solely ofintermediate-head or high-head trains are more likely to fail as a result of CCF, while HPI systems consisting of two high-head an d two intermediate-head trains are more likely to fail as a result of random failures of the common HPI suction pipe segment. See Section 3.2.2 for additionalinformation. The review of the 1987-1997 experience found no support system failures ll that disabled the entire HPI system. However, two instances of a HPI train ! failing to operate automatically because of support system problems were identified. In the first event, an inadvertent Si actuation occurred while testing gl g i an emergency-diesel generator for operability. The operability test being performed simulates a loss of ESF Bus voltage concurrent with an Si actuation test signal. The ESF bus was de-energized and a manual Si signal to the diesel generator was initiated. However, concurrent with the manual SI, an inadvertent SI was generated on both HPI trains when the bus was de-energized. The diesel-generator output breaker failed to close resulting in an HPI train unable to respond to an SI signal. The second event occurred during a loss of offsite power 4 while one of the emergency-diesel generators was inoperable. Due to the diesel-generator inoperability, only one of the redundant HPl trains responded to the Si actuation. The effect ofincluding these non-dedicated support system failures on HPI system reliability estimates are negligible since the redundant HP1 train successfully operated. Section 3.5 provides the results of the sensitivity of support system failures on HPI unreliability. i l i NUREG/CR-xxxx, Vol. x x
{ e w 1987-1997 exponence h h One1 % Arkansas Nucieer One 2 Cnivert CHs 15 2
%Q&.f~9'""""'Y"]f"L, cpLp fUpp%.e&, t
,,~
n
;i &{'~#;->--Q
. ; _ ;gy-~~w-577]gywfgg 2 444sg4 A ;gg 4My Dess-Besse ; , ', , !? Q :p --o-t % % g : g R
+
Kommunee Millstone 2 ' Oj,(jg w ;p_, . ql., ym rpJ- -*-H d, ypjgg p,g,,,g,, w:
'p- o c 4jWg. y: mg ~p s
w.
- f, ,, Rant Oass 1 h;m;.:p h I$ b" ' ' i '
x Palo Verde 1,2. & 3 Point Beach 1 & 2 - Nu., / ' T. A%MMkdhNyh 1l M -H V %, Ang Prano laiend 1 & 2 VM.lGW ? ' A k x$F. ,A. > o&M,d%ffi 7:mQMMs ' San Onofre 2 & 3 M M W Ly 4 at Lucie 1 & 2 - WV " % r 'y p r.'liEM %'id/I' # NMd bMh Iltk" I [ , h g j S j.& M *i$ 7 Nqu$[ ]y
- Q 7:Agr merford 3 -NA@4:
%;$ l .
Crystal River 3 Fort Calhoun - Genne ~ Oconee 1. 2, & 3 Rant Cass 2 Three Mile leiend 1 ' ~ Beever Wiley 1 w@wemww W p. A J mermwvmm:mw.mm~r.::, r
,ij k RAhg4 ' 4 4 " h,'
Beever Wiley 2 Farley 1 & 2
@MM iMy% E
,n .
+
t?4 .__~_aj% q H B Rotunnon ;iMd W,#[$' r 1 f " V$' TdW d
- W s M/ - '
-iwMadhp '
M N H MBPM W Meine Yankee Q$$4 d
/, ' N
%' A.rI, Pfant Cass 3
, s 2 ,+
;, 'm, . y $ Y t $- $
North Anna 1 & 2 : M
.. Ap . , :.
P o- f geg - - -2: .q ap;m Sheeral Horns 1 o.
,. , .ygg Summer 1 Q w;s , ,ua 33,,J
- m ,, M , , , M fn g.; w q qpgy ; ,
c Suny 1 & 2 iis MW si'b'1*<,
- < - . _ . . . ...~ , i D M r.r. M-MK<My- - . - -
Turkey Point 3 & 4 - Pfant Osss 4 ing,,n po,ra 2 W~1S*;P,"R3p!w?Ty;TYM:
#A " "m - ' ' .<
y- >--i ~ ^ 71 y Irdan Point 3 N(~ . i .. t @vWW~ IM p,ygN If D ggNRant
+, 5 D Qass
%U 5 -u South Texas 1 & 2 4M$ TD C.w. . v .-.w-a
. . - . U. .-. >A.ummw ~ e a MR s ':*--dEVN*T44h,sa,,
- 6. 4 Breedwood 1& 2 Byron 1 & 2 Callausy Catautia 1 & 2
- Comanche Peak 1 & 2 -
Cook 1 & 2 *- Diablo Canyon 1 & 2 Haddam Neck { McGuire 1 & 2 k Millstone 3 !
" - ~ - - -
Rant Oass 6 Satern 1 & 2 - - - Seabrook
.Sequoyah 1 & 2 -
Wgtie 1 & 2 l ~ Wolf Creek !' Zion 1 & 2 '- d' 1.0E-09 1.0E-08 1.0E 07 1.0E 061.0E 05 1.0E-04 1.0E -03 1.0E-02 1.0E-01 H Pl unrelia bihty GC99 one 2 Figure ES-1. Plant-specific estimates of HPl system unreliability(injection [ phase only) grouped by design class. The mean and uncertainty values associated I with this plot are listed in Table D-3 in Appendix D. The industry-wide arithmetic average of HPI system unreliability calculated l using data (component failure probabilities, maintenance unavailability, etc.) extracted from PRA/IPEs is 5.7E-04. The corresponding estimate based on the 1987-1997 experience is 4.5E-04. The average of the run times identified in the p 1987-1997 experience was approximately one-half hour. For a proper " comparison, this run time was used to calculate unreliabilities using both PRA/IPE data as well as 1987-1997 experience data. Neither of these estimates accounts for non-safety trains and equipment available at some plants (for example, the use of non-safety grade injection pumps as backups to HPI or an f L xi NUREG/CR-xxxx, Vol. x
installed spare HPI pump). A plot of these estimates is shown in Figure ES-2. For HPI Design Class 6, the unreliabilities calculated using IPE data could be one or more orders of magnitude lower than the unreliability calculated using 1987-1997 operating experience. Some of the Design Class 6 IPEs may have optimistically evaluated HPI unreliability. This difference is attributed to the dominating contribution (greater than 90%) of the RWST suction path failure probability to the overall system unreliability for the operating experience based g analysis of HPI Design Class 6 plants. The failure probability of the RWST g suction segment may not have been properly incorporated in some Design Class 6 IPEs. Section 3.3.2 provides the results and insights for comparison with i PRA/IPE results. Trends were identified in the frequency of the HPI unplanned demands, g which includes both actual Si and inadvertent Si actuations. When plotted g against calendar year, the unplanned demand frequency exhibited a statistically significant decreasing trend (Figure ES-3). When unplanned demand frequency of events from all plants for each year is modeled as function of both calendar year and low-power license dates, both factors had statistically significant effects. An equation that correlates the failures per reactor-calendar year with the plant age (measured from low-power license date) and the calendar year was derived using :he 1987-1997 operating experience. Figure ES-4 shows the variation of the frequency of all SI actuations for three plants whose age was 0, 10, and 20 years at 1987, over the period 1987-1997, derived using the equation. A The frequency of failure events observed during unplanned demands and other detection methods such as testing were analyzed to determine trends. l These did not necessarily occur during unplanned demands that could be counted E easily, so the frequency of failure events is expressed here as events per reacte calendar year. When modeled as a function of both calendar year and plant age, both factors were statistically significant (p-values of 0.02 and 0.03, respectively). 'Ihe fitted frequency is plotted against calendar year in Figure ES-5. This is an industry average, not reflecting individual plant g differences. Figure ES-5 shows the variation of the frequency of all HPI failure E events for three plants whose age was 0,10, and 20 years at 1987, over the period 1987-1997, derived using the same form of the equation mentioned earlier. Section 4.1 provides details of these and other trends discovered using the analysis of the 1987-1997 operating experience. The HP1 segment failures were reviewed to determine the factors affecting system reliability. The HPI unreliabilities are based on three segment failures (a pump failing to start, a motor operated valve in the injection header failing to open, and a train actuation signal failing) observed during unplanned demands and CCF alpha factors which we calculated from HPI related CCF events in the g CCF database. Based on the review it was discovered that many Jominant (high 5 } contribution to unreliability) and risk significant (high CCDP based on ASP analyses) events have resulted from problems associated with the minimum flow g or other pump recirculation lines and gas binding. Many of these events 3 prompted the NRC to issue information notices. I NUREG/CR-xxxx, Vol. x xii l
f + IPE data for companson to operational exponence j n 19871997 expenenm Arkanses Nucteer One i Arkansas Nuclear One 2 M@dWT W TT;f" V " C 'M F'7"' " " Z *f72miW T M T
' ' " i* 3 A
- j* :
Calvert Chfts is 2 y,@f$ 4 7 4
, j1 r tq,. . .uesto g - @N M @Q
. 3.--p fVM M id Davis-Besse qq, ;pp t . gt W 3 o -
O Kewounee
@.+ii4- n pyn ,
~,,
rnyM is , ,* %, ..
%@eg%
'> 4 uw% gq)y Muistone 2 '
't*
pen o , Palo Verde 1,2, & 3 P y,. d ; p .j, -
$g#27N"? ' "
,3'%,p^' 4s-tf "
D;*g AQ YPM:W Mig Mant Gass 1 Point Beach 1 & 2 ' . N9; '
^
-.4 M ' NNSijMp U $g[g,Msb*W.. f s(. 5: _ 1JC! "' d%WQ-,ih1hh Prene island 1 & 2 San Onofre 2 & 3 2
%g/
St. Luos 1 & 2 d@M%fl%
)9 '
- '*"'(.O V: Af "yQ' . , . -Q4.-f%G - nW h
-Q.'b;4 Warj $ng? na.dMfph JQ Waterford 3 } iikkD.. D_m_- A_. _C.^ O,M T. [ NS t ==ammt?gSW:;V.
. h :. .
0.[. Crystal River 3 - - - -
- Fort Calhoun a-Ginne -
~ Aant Cass 2 Oconee 1. 2, & 3 -*-i Three Mile is.and 1 -
97pyywy.7~xmv. y'~vympwyn Beaver Valley 1 Beaver Valley 2 wW v ..n . . - -y ,,.a,.
+ - -
6,
,ew s S we L ,.,4w- .'g n,
.s . .-s egi,^4
; wery
- C g s
Farley 1 & 2 H B. Robinson k gf gyp c%;* Z;peQ q , u :
M' , . A. . . , . - U:$i M,fa-u$ g
$' # Ath +---4==8r'$24% ?h((A
, ' fi; 3 Maine Yankee C % i- ' /
^
- NW# % ilhN D Rent Gass J North Anna 1 & 2 Shearon Harns 1
~mw pVMyy,ay,
,.>, , .... M 9.M C Summer 1 ,.,4 RA Wi 'MNI2hMgM' nh~ -A W ~
MN> ; N[:: W ?v M,q,5 c @;g .-g'1 d -jghdD u Surry 1 & 2 ~ Turkey Por.t 3 & 4 ---:- Rant Cass 4 yyppyw - - ;p-Indian Point 2 - 5 hr-e iMA A4 =
',2 ~
i - mJAm< +m Ay> 'g-WWW
~ -
g m& 4. m /, + Indian Point 3 .,. N
., !+ 7 $. ; qM$3W) . 4 Rant Cass 5 SouthTexas 1 & 2 5 mPM.,um% a - -- ', R a_ ~.. w'.am.nw Ma mn%9C WM6 Braidwood 1& 2 *
- Byron 1 & 2 ,
+--
Callaway j Catawba 1 & 2 . *
- Comanche Peak 1 & 2 3 * .
Cook 1 & 2 * - * - + - -~ Diablo Canyon 1 & 2 -*~ Haddom Neck
- McGuire 1 & 2 * *'
Mihstone 3 ! - " - * - - - - Rant Cass 6
;~
Salem 1 & 2 l Seabrook i *~ ~ Sequoyah 1 & 2 i ~* Vogtw 1 & 2 l
- Wolf Creek ' " - - * - - ' r -- ----*
Zion 1 & 2 ' 1,0E 09 1.0E-08 1.0E-07 1.0E 061.0E-05 1.0E-04 1.0E 03 1.0E-02 1.0E-01 61Pl unreliabil;ty ocos ossa 1 Figu6 e ES-2. Plant-specific estimates of HPI system unreliability (injection phase only) grouped by design class. The mean and uncertainty values associated with this plot are listed in Table D-3 and D-4 in Appendix D. xiii NUREG/CR-xxxx, Vol. x
0.9 4 MLE and 90% conf. interval g 0.8 , Fitted rate D -
--- 90% conf. band on the rate C
0'7 . S 0.6
- g _ .o
,\
j 0.5 . .
- 0.4 ,' ,
}.g0.3 ' .gN , h .. ,
7 1 . , g .. , is 0.2 - N.. N . h 0 .1 0.0 , , , , , , , , , , , 87 88 89 90 91 92 93 94 95 96 97 Year ocn oiss i g Figure ES-3. Frequency (events per reactor-calendar year) of all SI actuations, as a E function of calendar year, calculated assuming that the frequency does not depend on plant age (low-power license date), with confidence limits on the individual g frequencies. The decreasing trend is highly statistically significant (p-value is 3 0.0001).
- Age 0 in 1987
- - Age 10 in 1987 m
Age 20 in 1987 8 0.8 - 15 ~
?
S
~
s Q 0.6 s m . s 2 s 8 N g _ s s .. g 0.4 -
's '
8m s s Ro
's ~
h 0.2
~
0.0 87 88 89 90 91 92 93 94 95 96 97 Year ocu otss 4 Figure ES 4. Frequency (events per reactor-calendar year) of all SI actuations, as a function of calendar year, for hypothetical plants of several low-power license dates. NUREG/CR-xxxx, Vol x xiv
0.5 Age 20 in 1987
- - Age 10 in 1987 k 0.4 - ^9' IB E
_e s..
~
Q 0.3 -
~.
O I m e _
}o 0.2 -
'~~_ '
I o ~_' _
~ _ _
y 0.1 - I I 0.0 ' ' ' ' ' ' 87 88 89 90 91 92 93 94 95 96 97 Year C* C3" ' Figure ES 5. Frequency (events per reactor-calendar year) of all HPI failure events, as a function of calendar year, for hypothetical plants of several low-power license dates. The engineering insights that can be derived from failures observed during unplanned demands were limited since only three failures occurred. Therefore, I IIPI failures discovered by other means were reviewed to investigate the contributing causes. as well as the detection methods of the dominant failures. The unplanned demand data and the additional data resulted in 125 failure events containing 184 failures being analyzed. Figure ES-6 illustrates liPI failures by cause. Figure ES-7 shows the I failures by detection method. Section 4.3 provides details on the insights derived from all the IIPI failures. I Based on the failure categorization used for this study, testing is the leading method for detecting failures. Overall, testing revealed approximately 34% of the failures identified in the 1987-1997 experience compared to the next leading detection method, design / review,21%. Plant tours, abnormal indication of system parameters, and actual alarms discovered about 25% of the failures l (10%,10%, and 6%, respectively). Approximately 12% of the failures were l detected during an actual demand for liPI (4% of the failures during an actual SI demand and 8% during a demand for IIPI other than by automatic SI actuation). About 8% of the failures were discovered during troubleshooting activities. In addition to the above findings, the contribution of support system N failures to IIPI faihire was relatively small. Only 5 failure events (8 failures) out l of the 125 failure events (184 failures) were attributed to support system failures. Of the five failure events, three events involved six high-head pump failures xv NUREG/CR-xxxx, Vol. x
c i I 60 50 l i[N b 20 _ io ._g _
/ ed +* j/ s <#
Cause Figure ES-6. Illustration of the HPI failures by cause. 30 I 25 - 3 g High-head j 15 - O lniennediate-head S 10 - } Dinjection segments o hn sh n U i$
/jf;Wf I 9 Detection Method Figure ES-7. Distribution of the detection method by failures of the three major HPI segments.
while the remaining two failure events resulted in two train failures. The six high-head pump failures were the result ofloss of component cooling water. The two train failures occurred during an unplanned demand. The train failures were g related to an emergency diesel generator not providing power to the 4 Kv 3 emergency bus. I I NUREG/CR-xxxx, Vol. x xvi
FOREWORD This report provides information relevant to high-pressure safety injection (IIPI) system performance in response to normal operational transients and summarizes the event data used in the analysis. The results, findings, conclusions, and information contained in this and similar system reliability studies conducted by the Office for Nuclear Regulatory Research are intended to support several risk-informed regulatory activities. This includes providing information about relevant operating experience that can be used to enhance plant inspections of risk-important systems and information used to support staff technical reviews of proposed license amendments, including risk-informed applications. In the future, this work will be used in the development of risk-based performance indicators that will be based to a large extent on plant-specific system and equipment performance. f Findings and conclusions from the performance analysis of the IIPI systems at 72 United States commercial pressurized water reactors based on 1987-1997 operating experience are presented in the Executive Summary. The results of the risk-based analysis and engineering analysis are summarized at the beginning of Sections 3 and 4. This report provides an mdustry-wide perspective ( on the reliability ofIIPI systems, and how both industry (generic) and plant-specific performance compares with reliability estimates from PRAs and individual plant examinations (IPEs). This report also provides an indication of [ how performance varies between plants and the measurable magnitude of that variation. The dominant contnbutors are identified along with information on important failure modes and causes. All relevant operating experience on common cause failures that have been identified has been compiled and generic common cause failure parameters have been estimated. A tabulation of failures, demands, and estimated failure rates for key equipment and system segments are also included. The report provides a mechanism for identifying individual licensee event reports (LERs) that are the source of the tabulated failure, demand, and failure-rate estimates. For convenience, the risk-important information that r would be useful in support ofrisk-informed regulatory activities insvlving the [ IIPI system is summarized in Table P-1. Users of this information are cautioned to be aware of the uncertainty in quantitative results when drawing inferences about industry performance trends and plant-specific variations in performance. The application ofresults to plant-specific applications may require a more detailed review of the relevant LERs to determine specific aspects of the events ( associated with the dominant contributors that are applicable to a specific plant design and operational characteristics. Factors such as type of equipment, configuration variations, operating environment and conditions, and test and maintenance practices would need to be considered in light of specific { information provided in the LERs cited in this report. This review is needed to determine if generic experiences described in the report are applicable to the design and operational features of the system at a specific plant. This is [i especially important for dominant failure modes associated with suction source reliabihty, starting reliability of pumps, and the running reliability of pumps in f general. In addition, it may be appropriate to obtain and review more recent { LERs to bring plant-specific insights on performance and the potentially important dominant contnbutors to a more cunent state. A search of the LER xvii NUREG/CR-xxxx, Vol. x
I database can be conducted through the NRC's Sequence Coding and Search System (SCSS) to identify the system failures and demands that occurred after the period covered by this report. SCSS contains the full text LERs and is g accessible by NRC staff from the SCSS home page (http://scss.ornl. gov /). 3 Nuclear industry organizations and the general public can obtain information from the SCSS on a cost recovery basis by contacting the Oak Ridge National g Laboratory, g The Office of Nuclear Regulatory Research plans to periodically update the information in this report as additional data becomes available. Thomas L. King, Director Division of Risk Analysis and Applications Office of Nuclear Regulatory Research Table P-1. Summary of risk-important inforination specific to HPI system unreliability. Failure information from the 1987-1997 operating experience used to estimate Table C-l* system unreliability (event summaries, failure modes, and LER references) Dominant contributors to HPI system unreliability Sections 3.2.2-3.2.5 Comparison of dominant contributors to HPI unreliability based on IPE failure Table D-2 g probabilities and 1987-1997 operating experience for the six reference plants. E Causal factors affecting dominant contributors to HPI system reliability Sections 4.2,4.3 (affected segments and components, failure modes, cause of failures, methods of discovery, and LER references for all dominant events) Plant-specific failure data with LER references Tables 2, B-2' g Plant specific demand data with LER references Tables 2, B-3' s Plant-specific estimates of HPI unreliability Table D-3 System failure mode data and probability information Table 4 Common cause failure parameters used for calculating system unreliability Table 3
- a. Other docurnents such as logs, reports, and inspection reports that con ain information about plant-specific expenence (e.g.,
maintenance, operation, or surveillance testmg) should be reviewed during plant inspections to supplement the informatmn contained in this report. These sources will provide updated information on plant operating expenence includmg failure events and demands captured in plant logs that are not reportable in LERs. such as single tram failures dunng tests. ___ I l l I I NUREG/CR-xxxx, Vol. x xviii __----------------____-----_----------------------J
[ [ { [ [ ACKNOWLEDGMENTS This report benefited from the questions and comments of { P. W. Baranowsky, S. E. Mays, and S. Wearakkody of the Nuclear Regulatory Commission. [' Technical reviews by T. J. Leahy of the INEEL, A. M. Kolaczkowski of SAIC, J. Minarick of SAIC, and A. Mosleh of the University of Maryland contributed substantially to the final report. [ Technical contributors to this report are J. B. Hudson and T. E. Wierman of the INEEL. f ( {; f { t { p r s xix NUREG/CR-xxxx, Vol. x
i I I I I I I I I I I I I I I I I I I NUREG/CR-xxxx, Vol. x xx
1 f ACRONYMS AMF alternate minimum flow ASEP Accident Sequence Evaluation Prograrn f ASP accident sequence precursor BIT Borated-water Injection Tank BWST Borated Water Storage Tank BAW Babcock and Wilcox CCDP conditional core damage probability CCF common cause failure CCP centrifugal charging pump CFR Code of Federal Regulations CL cold water leg CVCS Chemical and Volume Control System DRAA Division of Risk Analysis and Applications (NRC) ECCS Emergency Core Cooling Systems EOC error of commission { ESF engineered safety feature ESFAS Engineered Safety Feature Actuation System FTR failure to run FTS failure to start FTO failure to operate IIVAC heating. ventilating, and air conditioning IIPI liigh-Pressure Safety injection IllSI Intermediate liigh-head Safety injection INEEL Idaho National Environmental and Engineenng Laboratory INJ injection segment xxi NUREG/C.R-xxxx, Vol. x
s IPE individual plant examination Ky kilo-volts LDST Let Down Storage Tank LER Licensee Event Report LOCA loss-of-coolant accident MCC motor control center MOOS maintenance-out-of-sen> ice MOV motor-operated valve I MUT make-up tank NPRDS Nuclear Plant Reliability Data System NRC U.S. Nuclear Regulatory Commission NSSS nuclear steam supply system ORNL Oak Ridge National Laboratory PRA probabilistic risk assessment PWR pressurized water reactor PZR pressurizer RCS Reactor Coolant System RES Office of Nuclear Regulatory Research RHR residual heat removal RWST Refueling Water Storage Tank SAS SAS Institute, Inc.'s commercial software package SG steam generator SGTR steam generator tube rupture SI safety injection SCSS Sequence Coding and Search System (database maintained at ORNL) SUCT suction segment VCT Volume Control Tank NUREG/CR-xxxx, Vol. x xxii
TERMINOLOGY Alphafactor-the fraction of the total frequency of failure events that occur in the system and involve the failure of k components (m) due to common cause. Common causefailure-A dependent failure in which two or more components' fault states exist simultaneously, or within a short time interval, and are a direct result of a shared cause. Common causefailure model-the basis for quantifying the frequency of common cause failures. Examples include beta factor, alpha factor, and basic parameter models. The binomial failure rate model is another model for quantifying common cause failures. Common cause component group-a group of(usually similar) components that are considered to have a high potential for failure due the same cause or causes. Common injection segment-The portion of the IIPI system that applies to plants where the motor-driven pumps discharge to a shared header with flow to the cold water legs being regulated in the common header. This segment includes the piping and valves from (not including) the pump discharge isolation up to but not including the check valve just prior to entering the cold water leg. Included with the segment are the associated valves and valve operators, the injection / isolation valve and the control iogic, and the test recirculation line if applicable. Demand-An event requiring either the system or segment of the system to perform its safety function as a result of an actual valid initiation signal. Spurious signals or those inadvertent initiation signals that occurred during the performance of a surveillance test were classified as demands. An unplanned demand is either a manual or automatic start initiation of the system or segment that was not part of a pre-planned evolution. Unplanned demands typically were the result of safety injection demands. Dependentfailure-Two events are statistically dependent if the Prob (AnB) = Prob (A) Prob (BlA) = Prob (B) Prob (AlB)
- Prob (A) Prob (B).
Afotor driven pump segment-The portion of the IIPI system that includes the electric motor and associated breaker at the power board (excluding the power board itself). Also included with this segment is the pump and associated piping from and including the suction isolation valve up to and including the discharge isolation valve, and associated valve operators. The minimum flow and test recirculation line is inciuded if the associated tap offis prior to the discharge isolation valve. Error ofcommission (EOC)-A failure of the IIPI system as a result of being purposely or inappropriately rendered inoperable by operator action when the system was needed to inject to the RCS. I Eventfrequency-The number of events ofinterest (failures, demands, etc.) divided by operating time. - Failure-An inoperability in which the capability of the IIPI system or train to supply water to the RCS l was lost when a demand for IIPI existed. For estimating IIPI unreliability, a subset of the failures was I used (that is, only those that occurred on unplanned Si actuations). Failure to run (FTR)-Any failure to complete the mission after a successful start cf the pump train segment. This includes obvious cases of failure to continue running, and also cases when the train started I and supplied water to the RCS, tripped off for a valid reason, and then could not be restarted. l i 1 xxiii NUREG/CR-xxxx, Vol. x ,
l Failure to operate (FTO)--Failure to operate occurs if the HPl train segment, other than pump train segment, prevents the HPI system from delivering water to the affected cold water leg. FTO-LOOP-INJ pertains to the cold leg injection path check valve segment immediately upstream of the cold leg. l~rO-INJ-HDR generally refers to the piping / valve segment that contains the MOVs that receive a Si signal. Failure to start (FTS}-Failure of the HPI pump train segment to start on a valid demand signal. Fussell-Veselylmportance--An indication of the fraction of the minimal cut set upper bound that involves the cut sets containing the basic event of concern. Independentfailure-Two or more events are statistically independent if Prob (AnB) = Prob (A) Prob (B). I hoperability-An event affecting the HPI system such that it did not meet the operability requirements of plant technical specifications and therefore was required to be reported in an LER. Afaintenance out ofservice (MOOS)-A failure occurring during an unplanned demand that is attributed to a maintenance activity. Afaintenance unavailability--Probability that a system is out of service for maintenance at any instam m time. Mission time-The elapsed clock time from the first demand for the system until plant conditions are such that the system is no longer required. PRAs typically assume that HPI to be available throughout the entire mission time. i Operating conditions-Plant conditions stated in technical specifications that require HPI operability, typically with the reactor vessel pressurized. Operating data--A term used to represent the industry operating experience as reported in LERs. It is also referred to as operating experience or industry experience. PRA/IPE-A term used to represent the data sources (PRAs, IPEs, and NUREGs) that describe plant-specific system modeling and risk assessment, rather than a simple focus on operating data. P-value-The probability that the data would be as extreme as they are assuming that the model or hypothesis is correct. It is the significance level at which the assumed model or hypothesis is statistically rejected. In this study, a model was rejected if the p-value is less than 0.05. Recovery-An act that enables the HPI system to resume operation during the event without maintenance intervention. Generally, recovery of the HPI system was only considered in the unplanned demand events. Each failure reported during an unplanned demand was evaluated to determine whether recovery of the system by operator actions had occurred. Typically, a failure was recovered if the operator was able to reposition a switch, open a valve, or reset the govemor to restore the HPl train segment failure. Events that required replacing components were not considered as recoveries. Also, for redundant trains, it may not be necessary to recover the failed train / piping segment immediately if the other redundant part succeeded. The LERs were further analyzed to determine those failures that may have been recovered if attempted. Coldleg injection segment-The portion of the system that includes the check valve (s) and associated piping upstream of the common injection header segments. The last set of check valves in the injection path piping was included in this segment. I NUREG/CR-xxxx, Vol. x xxiv l
T l Suction segment-The portion of the IIPl system that includes all piping, valves (including valve operators) and storage tanks associated with the suction source (typically the RWST) to the common I pump suction isolation valves, including those isolation valves that supply water to the individual pump trains. I Totalfailure rate-The failure frequency of both independent and dependent failures. Unreliability-Probability that the IIPI system will not fulfill its required mission. This includes the l unavailability contribution of the system being out of service for maintenance, as well as failures to start i or run. l
}
I I I !I lI l l lI I !I I I I E xxv NUREG/CR-xxxx, Vol. x
I I I I Il I I:! II I I I I I-Ill I I I I NUREG/CR-xxxx, Vol. x xxvi
I High-Pressure Safety injection System Reliability, 1987-1997 (DRAFT)
- 1. INTRODUCTION The U.S. Nuclear Regulatory Commission (NRC), Office of Nuclear Regulatory Research (RES) has, in cooperation with other NRC offices, undertaken an effort to ensure that the stated NRC policy to expand the use of probabilistic risk assessment (PRA) within the agency is implemented in a consistent and predictable manner. As pan of this effort, the RES Division of Risk Analysis and Applications (DRAA) has undertaken to monitor and report upon the functional reliability of risk-important systems in commercial nuclear power plants. The approach is to compare the estimates and associated assumptions as found in PRAs to actual operating experience. The first phase of the review involves the identification of risk-important systems from a PRA perspective and the performance of reliability and trending analysis on these identified systems. As part of this review, a risk-related performance evaluation of the liigh-Pressure Safety Injection systems in the U.S. commercial pressurized water reactors (PWRs) was performed. Because of the different terminology used throughout the industry for simplicity the liigh-Pressure Safety Injection systems will be refened to in this repon as the liigh-Pressure Injection (11PI) system.
The evaluation measures llPI system unreliability using operating experience. To perform this evaluation and make risk-based comparisons to the relevant information provided in the PRAs, unreliability estimates are calculated using the data collected from the operating experience and data extracted from probabilistic risk assessments and individual plant examinations (PRA/IPEs). The operating experience based estimates ofIIPI system unreliability are derived from data from unplanned demands. These unplanned demands include actual SI actuations as well as spurious and inadvertent SI actuations. The data from this source are considered the closest representation of the plant conditions found during accident conditions. Data from component malfunctions that did not result in a loss of safety function of at least one train of the system were not utilized. Generally, data based on surveillance tests were not used in the estimation ofIIPI unreliability because failures of an individual train ofIIPI during a surveillance test are not reportable in accordance with 10 CFR 50.73, the Licensee Event Repon (LER) reporting rule; and therefore an accurate count of these failures could not be obtained. Ilowever, for the suction segment (e.g., the RWST), failure data were extracted from quarterly surveillance test results contained in LERs since this represents a single failure of the liPI system. He objectives of the study were to:
- Estimate unreliability based on operational data, and compare the results with the assumptions, aodels, and data used in PRA/IPEs e Provide an engineering analysis of the factors affecting system unreliability and determine if trends and patterns are present in the IIPI system operational data.
This repon is arranged as follows. Section 1 provides the introduction. Section 2 describes the scope of the study, describes the I!PI system and system boundaries, provides the description of the six IIPI design categories developed for this repon, and briefly describes the data collection and analysis methods. Section 3 provides a discussion of the rationale of classifying failures as recoverable, a breakdown of the failure and demand counts used in estimating IIPI unreliability, modeling of common cause failures, and the fault tree models associated with the six lIPI design classes. Also contained in Section 3 are estimates of unreliability of the IIPI system and pump train and injection header segments, design class differences, and comparisons to PRA/IPEs. Section 4 provides results on the trends of i 1 1 NUREG/CR-xxxx, Vol. x
Introduction failures and unplanned demands by calendar year and low-power license date (i.e., newer plants versus older plants). Also included in Section 4 are engineering insights into the factors affecting the system, pump segment, and injection header segment reliability as well as an evaluation of the failures that contributed to the design class reliabilities. Section 5 contains the references. Appendix A provides a detailed explanation of the methods used for data collection, characteriza-tion, and analysis. Appendix B gives summary lists of the LER data. The failure data used in the unreliability estimations are provided in Appendix C. Appendix D provides additional system unreliability information. I I I NUREG/CR-xxxx, Vol. x 2
- 2. SCOPE OF STUDY This study documents an analysis of the High-Pressure Injection (HPI) system operational experience for the PWRs listed in Table 1. For the purposes of this study, only the pumps and associated components that have an automatic start signal were considered as part of the system. Spare standby pumps that require operator actions (and in some cases several hours to install) were not modeled since they are incapable of mitigating situations that require immediate injection. The system boundaries, data collection, failure categorization, and limitations of the study are brietly described in this section.
Table I shows, for each plant, the number and type of trains (high-head and intermediate-head), the number of cold water legs, the reference report (e.g., IPE, PRA, etc.) used to obtain the estimates of plant-specific system unreliability, and other risk-related information. 2.1 System Operation and Description 2.1.1 System Purpose The HPI utem is part of the Emergency Core Cooling System (ECCS) that performs emergency coolant injection and recirculation functions to maintain reactor core coolant inventory and adequate decay heat removal following a loss-of-coolant accident (LOCA). The coolant injection function is performed during a relatively short-term period afler LOCA initiation, followed by realignment to a recirculation mode of operation to maintain long-term, post-LOCA core cooling. In addition to the above, i reactors which are equipped with pressurizer (PZR) power operated relief valves (PORVs) use the PORVs and HPI to remove decay heat from the reactor in the event of the loss of the Main Feedwater (MFW) and Auxiliary Feedwater (AFW) systems. The HPI system actuates automatically on low PZR pressure, high containment pressure, or when < steam line pressure or flow anomalies are detected. Therefore, in addition to a LOCA, other events will lead to HPI actuation. Some examples of such events are Steam Generator Tube Ruptures (SGTRs), RCS overcooling events resulting from team line breaks (e.g: Stuck open main steam safety valves), or RCS depressurization events (e.g: stuck open PZR spray valves). 2.1.2 System Description The HPI systems analyzed have been grouped into six different design classes as shown in Table 1. The criteria used to determine this grouping are the number of steam generators, and the number of intermediate- and high-head safety injection trains available for automatic actuation. The steam generator criterion was used for a matter ofconvenience instead of the number of cold legs. The number of cold-legs is correlated to the number of steam generators. The steam generator criterion reduced the number of possible groupings of HPI design. Other groupings are possible, but this grouping utilizes two dominant design characteristics, which have the potential to dominate system reliabilities (i.e., number of pump trains and the number of cold-legs). Figure 1 is a block diagram of each of the design classes. These block diagrams show how the major system segments (e.g., RWST, pump trains, injection headers and cold legs) are connected to accomplish the HPI function. Each system typically consists of at least two independent divisions. The divisions consist of a number of different combinations of motor-driven pump trains. Because of the diversity in system design, operation, and response to plant transients, a detailed discussion of the each plant-specific system is not practical. A general description is provided for the two major designs utilizing high head or intermediate head functional schemes. Differences between the other types of system design classes are also discussed. , 3 NUREG/CR-xxxx, Vol. x
y4$pf5M M t r a wt d e d e e da h lo 'n l s I ht st t o T g P l ;y s lai d pl oa u e sr c S e l sll s ht o d ;h e e pA l r ht a h a st a lofn sh r d a;o n oB
- o a u ta p d u er es t
o d pn o la, h l fs )e s a p n t t te 3 d u h glt ao l mTs o c s a eh c nmW o n o i o w oe s g lemo p lu2 fag
/
ef h ls iod nl a e u f d oS lte r fW g e M c p t f i t eS i c l f l nn t t lot o unR l o un s cb e d tc e j e z d c uiy c ia c af e c fa io o do io jon dno anzclo o r j in f t jI d nt t l e At c ints a in 3 lp iAn n e c c 4 f p iS m u uh b Ce 4 aG / s pX/ 2 r t ous C 6Su htes si tc 2 4 2 / at 3 m Oj n /hD 2
/
2 o mR I s 3 I/O / 3Css ew
/
1 u n Li ( s; mpE ; s t s u pd e s tut ol a t oPI I t L oB sora t t ok a s t o l l a puto p p r sI IsS 3A s t o s e m pd m m I t I nas IP3 I eCh I yt I ht S m uge n u p u p P a P at Hc o i I m o H2 s p
/ IP mI e Ph t Oa Pl dL p t
I la a u P I I it n I I I I u s 3 pniwl ig 3 2 2 s 2 r t
/ sa / Iou 3Ro 2 s 2 eBg 2i e 2 n f a/
/
i
/
1 s a 1
/
1 1 1 Ol o / s a/ eI fSl e 1/ itnh / 1 1 _ ar s r t o I mt a a P e er 2 2 2 2 2 2 2 2 2 2 H t S ne f G o s ep h y ga t t eP L d n a d o lotc i n 4 4 4 4 2 4 4 4 2 2 M r Cej e n b i m P r C o t u ea r n Ct ot uiS a t e d dl ht nae a 2 2 2 2 2 2 2 2 2 2 aSmu S Eman
, I s
s l a l i t f rim o c s n h n ig gr ei a r s ii uT s e l s r 3 3 3 2 2 3 2 2 2 2 a e l d r h c t oP too a T M e d ) ) ht ). an p e pr at r s e o metsh ) o ao e umtar ish ta i wE P l it l c te e s) ut f pr a oinn pe ge es a c p mmp t per dI ia nm1 j p1 5 n pnin p p o oot e u p uo ps 2 e e dI - su o 2 2 2 2 2 t u1( iwr k iah emt t yP 1 s e s st win ca re e gr e c n rf e oi e a I( nn v e el a b iu m(3 q n, ni r u wq s t nS 3 u er ' s er sd i a e t s a pe sf ) it s t ne r oic l a g pI Ua n s g ns) m;mt a gu enia es n fuipP u nppoon
,( ir gmCr pi ngos wte - - - - - -
s a uC eA tnhP( eC I( n u inr st e e ei n sC s C 3 r wve lnh s ut m a aO n lcL nl l ga t r n oe e c M is m pr I 2 7 8 l 2 4 5 9 6 e s e fe I 1 1 . d a R e I R P or I I f 1 e 2 e M-e no O n O n 3 h i t r 2 2 2 f et r a r a & &, & oi r t n le e I 2, & 1 gc c lc s I la u u f e 1 d n ins f h P N N i s s e 2 e c la t s s s lC e e e s dr a is e a u B n n e e e Is L cc s n n t r - u o d a V B ie _ a a e is a ts s t r u v v w l o n _ ia 1 eh t s e k A r k A r l C a D a K e li M h P a la P io P P r M_ l I s s b d P an I la 1 I I I I I I i I I Ta I C _ ygC)$;$My-[r cc X #
pooo %W5x n o ht s 4 f i I it 3 3 r f t P c e a / 33
/
o d e o i H j s p 33,
/
3 e
/
3 ot f n nl e ei d de n ht n n si gI gbia mua lor r o i g a o o o ts s o s s e c c p t sP t i
,lal it h o pC pi sP t it l g
le i fs )e it r c c pC p a a; n t s s s n c e d n e v ae a o e mCm mCm loib a s v ah wp le g g e lo d it c j n j i n u2 p u u2 p u t c aot i o pr t iS nT l c e i p/I e p/ 1 r t o on d d j S 4
/ e 3 e
/ p pn mjo 2W
/
S as ar s r t I s io n o us I c s 2 g gs C l u a I lo o R 1 o S a ap pm c ta to lycars i p ki At c c 4 le le R h ! l Ce 4 4 i n / 4 g ! le s
! l le s l
I g . s t m
/ 1 u l
/ d e d e sl pab e P nd e inr o Oj n Li (
2
/
I 2 o 4/ /2 / 2 I or goc n Igoc
/
n m ms ht I I iol a f o o o t I o ht nmid nmi r a o gb r s t t t s o o i s ig;srdeu I r a t p a gge g;s e agge Ip :o. I l t l a s s s P t t s r s r s e ; e is o s Is r r s I S or e
,h U
I I I I I I m P P P P e P h e le wh eewIP;bf yt I P nd d Pl a S I I M uec Hsh IP P 12r H r p I I I I I I I Cldd o Cl p 3l ldd p o l I nd o I I I e s una e I 2 E n 2 t r s 3
/
I 2
/ /
1 2ta 1 p 3
/
I 3
/ 3/ 3/ o /
I 1 I n 3 I 3l l
/ oon 1
ccu / I oon ccu / 2 ot n I h s o
/ P e I I h
/a 1 wfo -
r o mt a ar tee 2 2 2 2 2 2 2 2 3 3 3 3 3 S ne G ga eP ht s L n d io 4 4 4 4 4 2 4 4 3 3 3 3 3 lot Cejc I n Po C r e ar t - Ct ot uiSat , d dl nAea 2 2 2 3 3 3 3 3 2 2 2 2 2 IaSmu S Eman _ rim l o l I f
- s h n igreiar u
i l sT 3 2 3 3 3 3 3 s r 3 3 3 3 2 3 - l t a e r o oP to . T M - l d a d r a e e n s u e k) f ioc l t e r n a sll d a et s) at eu e e pI s) iuq m')n e r o nirne b e;p a - t iajnml S e og ped r t i 2 3 3 - - - di ul( n r - - mkc - otos e yP er la . mte I n oe ota r ( ar u pr a rf ( r t e a 3 e 3 ep 1 (i s I nS p o o 3
,y) lag p) p p) p p s nb er a e s )r ud gns) mg m )g mg m) s r n a fui pP un u n upi n upaer m )e eorneo pap t
nrgmC rhP( a uC - -- I ( pi n n u
-- pi I( ru n
n I( n urn I( s p u pa r I( s p rI;u r a v eP qee p i t
- mts upmp pmu s
eC (s I r C 3 r 3 3 3 3 I o i up 3 ( p1 3 I e t c r n 8 oe pr 5 6 9 3 4 0 3 1, 0 1 2 6 4 e fe 1 1 1 1 1 7 2 2 2 2 2 Re 1 R 1
)
d 3 3 d e n 2 u t n & 2 3
&, l a
1 y y n e n a 2 & r e n Is le le 2 o s e i t l P e 3 v u 2, n k.r n f r 1 dr o le la la & i a o o e o Ri h l I i V V b o Y c n ic f a e M r r I ( O u r la C ane n e e e y R e L e t s e v v le n in c o t
. n t a y r r a a r B.
i a a r o h e e a S. W 1 t S C F G O T B B F I M e I l s I s b P la I I I 2 2 2 2 2 3 3 3 3 3 a ll C T
" 7cg9Q *- <g x
$S ]mcgC n -
t ; f n R en g o n n n o 3 O c e n s o o o I I n p I/ l P i nm s n i t a S o f ;m s t c i t i c it c it c e s o C f s g p p l e r e fi i ta gu j e e e j t R I. r Is ig le p j j n s o)e pb l
;e r n n n i
!ta p p 4 d le f
s s I l I I a on lyac s g s p go ld its s 4 i i 4 i 4 4
/ n m
/
! ted e s a I a l
e s onu s s g / / / 2 o up o lult eh c p 2 u lata le l c g g e 2 2 2 o it t au d u r le le d o o l c / n 3 o c I s f a nf un 1 a mh) d l loe s o / e t t t t s e S p u nu o s m opr s r t o 1 h lo d d loc sp s s p j m uc in 2 s i a c anp oto p p lo u 3 3 nmo
/
At c s m 3/ lt mt s r c c 3 / u m m m p Ce led u 4 I f e uh / 3 u u nfo 4/ / 4 u u ofo d e np 2 p p p p / 2 D I Oj n o e o e 8 o 1omp iat I o S V N S 3 2 M mn I I Li ( ;p (
- r n t I
ts isS tr i d o o t I IS I S N to As po r t o o l s ai s l e t t s r r r s t l a s m pe I i Stol i 1 5 rc s s I o o o r p s o s s Is s i up l I P sl S f 1 I I S o mP o P g PI S m l I a ba P 1 f d t I g P P P C C C I u Cl Ce I I IP l ite3 i i 1 I I I t d I el 1 f 1 ni I I I Cs hCs Csh Ns ph Ct Clh c I 3i r 2 i va 2 3 a d 2
/ imo 4k a /3/ /3/ a3/ a4 4 t / a / a4 4 4 2t 4l / 2
/ t t t
/ av / /
/ / 1 ni / o I ht 1 h a I 1 l 2 2t 1 I I 1 p 1 p I p 1 p 1 1 c 1(2 / -
s r o mt a a r 3 3 3 3 3 4 4 4 4 4 4 4 4 4 te e 4 4 S ne G s ht ga s y s y s y s s s s y y y y eP s s s s s s s L n r r r r r r r e e e e e e e ld o 3 3 3 3 3 4 8 3 p p p p p p p 5 i ot c 4 4 4 4 4 4 4 Cej 8 8; 8; 8; 8; 8; 8; i n P r C ot o t r e a Ct uiS at d nAdl ea 2 2 2 2 2 3 3 3 4 4 4 4 4 4 4 4 IaS S Ema mun l l I f rim o M s ) h n it igreiar n u u i l sT s 3 3 3 3 r 3 3 3 4 4 4 4 4 4 4 4 r e l t a e r o p oP to 2 T M ( 4 d an I co ) it
~
I it c s) n te e pI u iaj S r dI n mlul( - - - - e p 3 3 3 2 2 2 2 2 2 2 2 e yP I mt rf e 2 ( t e a 4 I nS s p p d in ") l a g pe)e pu m p um s )t s kc p gns) mnr mp) o uI e m pi u r o pl o i m )g fui pP un i t r gmC r auC uI ta p; ge r p;a r p;k g p uI e d m-ga e u n ek p - t o - - -- 2 2 2 l pi n 2 2 n 2 2 C nhP( eC 3 inp I( n n I( ins o 3 nn I(inb a 3 n r c r I( lu l ( 2 u r u r u r u r 3 "p e tr c oe n pr 5 3 7 8 9 9 0 8 0 1 4 5 6 7 8 3 e fe 2 2 2 2 2 3 4 4 3 3 3 3 3 3 3 3 R e R 2 2
)
4 2 d 2 I e 1
& &2 I u t & s
& 2 k
a n i t n l P n a i a n ir r a 2 3 t n i 2 t 3 t n n a d 1 s I 2 & P e 2 o y n k c e M n n i l i
& o io io x e o & y I e
& a N o A n r e
P P P T o I a a h c C m c o I y w n w b n I lo e ( ht r m y e n n h w a
. r o h a
e m u r r u k r u ia ia u dia d d t o r o r y
!a a
ta a m o o o k b i a d d a 1 N S S S T n n S B B C C C C D l I e I I l s I s b P a 3 3 3 3 4 5 '5 5 6 6 6 6 6 6 6 6 a I I lC T s h] soc ; xU [r
- o
o to a L" 8 x n 3 gs I o ld 4 4 r e P i t o 2
/ /
fol d c c 2 H g e S S o o sl go r e j J t t P n C o l i S ) ) lec I S fss)e ld 4 R r S S d/ 4 _ s a o / d~ o C C 3 s i eh c 2 e g V- V loch g g r e o cp c 2 t o l t u n C C l
)
un # ig 4 u d er fa s r r / s io p r a o o 3 or lo At c tso n c u) Ce P m u h c I S I S hh gt ~ 4 neru Oj n C m 3
/
3 l a ( s n ( s us oI rS
/
3 ns yes g n o h r Li ( C Mr o fu i a ia h /r t 2 s is t l l a 2 o t s i r t s r sI u igp g I tgs P
/ r t
C Ro SP hPiu m I m 1 C P n s P e P e I ( _ S D Csh H ep c Hl Hl I sC r O.h N s m d d 6 I Cd 4 a
/ t / 4 g 4
/ u 4l 4l p / o 2 / r 4 Ce A p1 le c / o o m
/
1 1 1 1 c 1 hf 1 I ( s r o m a i. _ e a t i 4 4' 4 4 4 4 4 4 S ic _ C s . h _ ga t s y s s s s s s s y y y y y y y eP s s s s s s s s L n r r r r r r - r r e e e e e d io p p p p p e p e e p p lotc 4 4 4 4 4 4 4 4 Cej 8 8; 8; 8 8; 8; 8 8;
.i n
Pr C o t r - Ct ot uiS ea t a d nA aS J. aul 4 4 4 4 4 4 4 4 S Er I .. na Ho! I f M
- s h n gr ei a r iu HsT 4 a es or l 5 4 4 4 4 4 4 t r t oPo T M d
n n 1 eo 1 it e c s) taje pI inmS di 2 2 2 2 2 2 2 2 e yPuH ( I mt rf e ' ea I t nS s d pe)e l a g p) p p gns) ui mg mnr o m )g m )g f nrgmC pP un pi uI t p ,a un un n ge r 2 2 2 pin 2 pi n t nhP( auC 1( urn I n n 3 inp I eC ( I( ru ( ur C 2 n n o 2 2
.r u
e t c r n oe pr 1 2 3 2 4 5 6 7 e fe 4 4 4 3 4 4 4 4 Re R . ) d e 2 u t n 2 n la & 2
& 2 so P I e
3 e n
& k I
h a
& k e
e & 2 c r o I o y I r ( i u t o r o le C I G s m b u t f n
. c l
l e a q g l o i l a e e o o i 1 e M M S S S V WZ l s I s b P a 6 6 6 6 a IC I l 6 6 6 6 T 4 mob 90 e& x
1 Scope of Study ]l j layertaos heedet A In sow arg l A _ (HDRA LOOPA thJAt , Cod irg l4 impeciene header ll le geW leg B A _ a = (MWA-lhjAl f SI PUMPA, 1sgetuonheader A eseWleg iB
~~ j surtma tHDRA LOOPA-INJBs I I'8NH -
c,y gggg 1RWST-5UCT) ggggpg gg;g, huestos tweder B esow leg 1B _ (HDRB LOOPA INJBP
-- had selett apesesa
- pusnP eem C (51 MIMPO
+ esemesses. huernme header A e cow leg 2A
- ~
lHDRA-LOOPS INJA3 CeW leg 2 A (LOOPB4NJA ingettssa header B e sow leg 2 A (HDRB LOOPS IrelAn lapsssos heads A en sew irg 25
- pump tes - _
ggi ppupg. (HDRA.LOOPB.fNJB) CoM leg 2B (LOOPB INJBt lascous heads B e sew leg 29 _
<HDnB-tOOPB-InsB, Waterford 3 (Design Class I)
I' l I Egh4 sad selevy
- shjecess pwg Bam A -
(,oki leg l A (CC PUMPA1 (LOOPA-INJA)
"im suaem ===sima injectson hesdre A as cow leg A (HDRA N)
_ cow leg i A F High head infrey (LOOP A-INJB) Segmrm IRWST-SUCTI f
,cy .ppupg,
~
t
- Cold leg IB ump (LW)PB !NJA3 "Y **I'D Inisetion headet B
. mleriam PWT _ ,, ,,y, g,, g _
, g (HDRBINh Cuid leg IB
~~
(LG)PB INE Oconee 1,2, & 3 (Design Class 2) Figure 1. Simplified block diagrams ofIIPI systems for each of the 6 design classes. NUREG/CR-xxxx, Vol. x 8 l
6aaa of Study i inernusdese. bend _ sofrq turerase pump Coldl'8 A ween A (LOOPA lND (St PUMPA) imod Cold les B g,,,,,, asien agermokPunW (LOOPS-INS gm
' (RW5T-sVCT) gg, ,,)
seiny impereen pump C*ld 188 C
.- C iLwPcINo (siwwci South Texas (Design Class 5) c.u w, A head - aLOOPA-INJ)
=
" N - - tapetenen benew -
(HDR3 A-IND (58 PUMP A - s I*U ES d sagsuret ~- '#'8'IE RW5T-sUCTs 0 head M8ser suechsepump , luetess headst see B (HDR35-inh CoM kg C 451-PUMPsi - (LOOPC-INje Una Unit 3 i Pea.P e m svanseer g (UNITE XTIEs Unit 4 T new ceW les A (LOOPA-lhh sainy sywusa pam, se a A - - In#wuse M~ IMDR4A-Phih dst P MPA cow w
.-P.e..n,,
,y"; .I" "" a"- -_ er
"'"'"8""*P _ io e m til P MP3 CeW
- , Loo,les.C,,
- c. .
'h";l; r, ,,'*;;"*, Turkey Pomt 3 & 4 (Design Class 4)
Figure 1. (continued). 9 NUREG/CR-xxxx, Vol. x
. . _ . . .. . . _ _ . . _ _ . _ _ _ _ _ . .. ._. _ _ _ _ _ _ _ _ . . . _ _ . . ]
i Scope of Study .- l _ ie.sg.,u,m-- e e! OOP A.51 fN h latermedssea 4ead safety a peer - neernmedes e he elas t*5m
$woon 15UM
$cgmene for imamedime4eell e $6 AN latermedaait head spuon m=
memed.e..
- e., ;,g ,.m, _
m;m,L g 451 Pt.'MPB t intermedseie4eed m>rstase
~
#10 P I IN h
$asetma Hegb tead m ime en High4eed (LOOP A CC.!Nb
~
High mo m gym (CC.PUM P4 6 iCC HDR A lNh _ mans for 'u=*==a'=****-= mas #LOOPp.CC.fNh 1 Ses.sh-head k pumps u ,,3 4,,d ,,,,, . Safety IN GC peep _ gr ,,,,,,, d C
. 4e m,re.m. m
,t o'oPnc'CSh n
=
Braidwood I and 2 (Design Class 6) Figure 1. (continued). The HPI system is typically not in service during normal plant operations. It is considered part of the Emergency Core Cooling System (ECCS) and is used to restore primary coolant volume during LOCAs, depressurization events, and overcooling events. However, the IIPI systems have wioe variation from vendor to vendor and from plant to plant. In some plants, B&W in particular and in seme Westinghouse designs, the normal make-up pumps are also the HPI pumps, and therefore a portion of the HPI system is in service during normal modes of plant operation. The Combustion Engineering and other Westinghouse designs commonly use a charging system for normal make-up that is separate from the safety injection pumps, which are used only during emergency or abnormal situations. However, even in these designs the make-up and safety injection systems are inter-related because they share common valves, water sources, piping mns, and other equipment. Consequently, the safety injection systems can be either intermediate-head capacity (approximately 1400 psi), or high-head capacity (approximately 2200 psi) depending on whether they are used for normal charging (high-head) or not (intermediate-head). These differences in system pressure determine how it is used during emergencies. The HPI system is typically started automatically by the engineered safety features actuation system (ESFAS) or equivalent, depending on plant design and terminology. Generally, the ESFAS automatic start signal setpoints include a low reactor coolant system pressure or a high reactor building (i.e., containment) pressure signal. There are additional start signals, but these two are typical. As mentioned before, in some PWRs, the normally running charging pumps ne used to perform the HPl function. In these plants, during normal operations, the charging-pump /make-up pump takes suction from the volume control tank (VCT)/make-up tank (MUT). The level in this tank is maintained from letdown received from the purification loop of the reactor coolant system (RCS), reactor coolant pump (RCP) seal return, charging /make-up pump recirculation, and other minor sources. Borated water is added to the VCT/MUT occasionally depending on losses in the system, such as RCS leakage or operational requirements to borate or deborate. During emergency operation, the suction of the charging /make-up pumps is changed. Several valves reposition automatically upon receipt of a safety NUREG/CR-xxxx, Vol. x 10
Scope of Study injection signal. This allows a large reserve tank to supply borated water to the suction of the charging' safety injection pumps. This large tank is commonly called the refueling water storage tank (RWST) or borated water storage tank (BWST). The water in this tank has a high boron concentration, generally 2400 ppm boron. The tank volume varies from about 245,000 to as high as 4,500,000 gallons but is often in the 338,000 to 425,000 gallon range. Once the valves have repositioned, the head from the RWST/BWST seats the VCT/MUT outlet check valve, and thereby the highly borated water is supplied to the SI pumps. Du ing emergency situations, when the water in the RWST/BWST is depleted, water is available to the HPI pumps from the reactor building or containment building sump. This water may be directly available to the SI pumps via piping and valves or it may require a low-pressure stage pump to provide sufficient net positive suction head (NPSH) to the SI and charging /make-up pumps. This source of water becomes extremely important during emergencies that require a prolonged time for injection before being terminated and possibly exhausting the RWST/BWST water capacity. In this case, the HPI system is I used in the " recirculation mode." The above discussion mainly applies to designs where the charging /make-up pumps used in normal operation are also the HPI pumps during emergencies. These pumps require the low-pressure pumps to I provide NPSH from the reactor building or containment building sump, for example Oconee 1,2, and 3 utilize this design. The following applies to those designs that incorporate separate SI pumps and charging /make-un pumps. For these designs, the charging /make-up pumps operate the same as mentioned abovt . wever, the dedicated SI pumps can only take water from the RWST/BWST and not the VCT/MUT like the charging /make-up pumps. These SI pumps are intermediate head. The intermediate-head SI pumps will require the charging /make-up pumps to be in operation until the RCS press decreases to the pressure where the intermediate-head pumps can inject water. At this point the I charging /make-up pumps can be tumed off or left on to help inject a greater volume of water. Braidwood I and 2 is an example of this design. The final plant design contains only intermediate-head SI pumps that are used for HPI. These pumps take suction from the RWST/BWST for injection and are aligned to take suction directly from the reactor building or containment build sump during " recirculation mode." Waterford is an example of this design. I In the plants equipped with charging /make-up pumps and dedicated SI pumps, typically, during normal operation, the charging /make-up pumps supply make-up or cooling water to plant equipment. One is the RCP seal supply. This normally requires 8 to 10 gpm per reactor coolant pump. Another function is pressurizer level control. This system senses pressurizer level and opens or closes the I pressurizer level control valve allowing more or less make-up to maintain the selected pressurizer level serpoint. Most of the flow from the charging /make-up pumps is returned to the VCT/MUT via recirculation piping and valves durmg normal system operation. Once an ECCS signal is received or the I operator manually repositions valves to their emergency position, the discharge of the charging /make-up pumps is redirected. There tre generally three or four injection nozzles to the RCS for HPI. These nozzles, located in the cold legs of the RCS have instmmented piping connected to them from the charging /make-up pumps and SI pumps depending on the design. Some of the devices and instrumentation on the discharge piping includes but is not limited to injection / isolation valves, Dow-balancing orifices, Dow crossover piping, and nozzle and total Dow indicators. Flow from the SI pumps I and the charging /make-up pumps is going to the injection nozzles is reduced to the RCP seals. The charging /make-up pump recirculation back to the VCT/MUT is also automatically terminated in order to maximize Si Dow into the RCS. I - 11 NUREG/CR-xxxx, Vol. x
r Scope of Study 2.1.3 System Boundaries For the purposes of this analysis, the HPI system is partitioned into several difTerent segments. These segments are (1) suction, (2) pump train, (3) pump injection header, (4) shared injection header, (5) cold leg injection, and (6) Instru nentation and Control subsystem. These segments are described in more detail below:
- 1. The suction segment includes all piping and valves (including valve operators) from the RWST/BWST to the pump suction header. Also included in this segment are the components and equipment used for VCT isolation and the tiansfer of pump suction to the RWST.
- 2. The pump train segment includes the motor and associated breaker, but excludes the electrical power bus itself. Also included with this segment are the pump and associated piping from (and including) the pump-suction header up to and including the discharge header valves, and associated valve operators. The minimum flow and test recirculation line is included if the associated tap off connects prior to the discharge isolation valve.
- 3. The pump injection header segment includes the piping and valves from the pump discharge isolation valve up to the cold-leg or cold-leg injection segment depending on whether multiple injection segments feed a common cold-leg injection header. This segment begins downstream from the pump discharge isolation valve (or discharge header) and terminates at the point connecting to attemate injection paths (or cold-leg for plants that do not have a shared injection header since these plants have dedicated injection paths from the pumps to the cold legs). lhcluded with the segment are the associated valves and valve operators, the injection valve and control logic, and the test recirculation line where applicable.
- 4. The common injection control segment applies to plants where the pump discharges to a shared header with flow to the cold-leg being regulated in this common line. This segment includes the piping and valves from (but not including) the pump discharge isolation up to the cold-leg for plants with only one injection header per cold-leg. For plants with more than one injection header per cold-leg or where the injection path connects with another injection systems, the injection control segment includes piping up to the connection point for the altemate injection path. Included with this segment are the associated valves and valve operators, the injection / isolation valve and the control logic, and the test recirculation line where applicable.
- 5. The cold-leg (loop) injection segment includes the check valve (s) and associated piping downstream of the common injection header segments. This segment generally includes the last check valves in the injection system piping immediately upstream of the RCS cold leg.
- 6. The Instrumentation and Control subsystem includes the circuits for initiation of the HP1 system. It includes sensors, transmitters, instrument channels, and analog or solid state components used for HPI train actuation.
Additional components that were considered to be part of the HPI system are the circuit breakers at the motor control centers (MCCs) (but not the MCCs themselves) that are specifically dedicated to the HPI system. Heating, ventilating, and air conditioning systems and room cooling dedicated with the HPI system were also included. Losses of a specific HPI room cooler are included if the losses cause failure of the HPI system or train to perform its intended function. However, failures within the service water system are not included in the quantification. NUREG/CR-xxxx, Vol. x 12
------------- J
1 Scope of Study HPI system failures caused by support system failures are included in this study. Support system failures were defined as failures of systems (or components) that affect the operation of the HPI system. These support systems included, but were not limited to,4160 and 480 Vac vital power,125 Vdc power, service water, engineered safety feature actuation system (ESFAS), and solid state protection system (SSPS). However, because the support system failure contribution to the overall HPI system failure probabilities would be modeled separately in the PRAs, support system failures were not included in the unreliability estimates used to compare with the plant specific PRA/IPE results in Section 3. 2.2 Collection of Plant Operating Data The HPI system operational data used in this report are based on LERs cataloged in the Sequence Coding and Search System (SCSS) database. The SCSS database was searched for all records that explicitly identified an engineered safety feature (ESF) actuation or failure associated with the HPI system for the years 1987 through 1997. It is assumed for this study that every plant was reporting HPI ESF actuations and failures consistently as required by the LER rule,10 CFR 50.73, and the guidance provided in NUREG-1022, Event Reporting Systems 10 CFR 50.72 and 50.73. (HPI ESF actuations were found to be reponed for all plants during the study time period.) HPI events that were reponed in accordance with the requirements of 10 CFR 50.72 (Immediate Notification Reports) are not explicitly used in this study, because the LERs (i.e.,10 CFR 50.73 reports) provide a more complete description, thus making it easier to determine whether the HPI had operated successfully or not. 2.2.1 Characterization ofinoperability Data The information encoded in the SCSS database, and included in this study, encompasses eve'nts that occmred during all plant operating conditions. In this report, the term inoperability is used to describe any HPI component malfunction either actual or potential, for which an LER was submitted in accordance with the requirements identified in 10 CFR 50.73. It is distinguished from the termfailure, which is the subset ofinoperabilities for which a segment of the system was not able to perform its safety function. Specifically, for an event to be classified as a failure the component / pipe-segment would have to be found (orjudged) to have not successfully fulfilled the actual or postulated safety mission for which the system was designed. The inoperabilities that were not classified as failures are primarily potential failures or administrative deficiencies (e.g., late performance of surveillance tests, missing seismic restraints, etc.). f The HPI system is a safety system. Any occurrences in which the system was not able to perform its safety function, as defined by plant technical specifications, are required by 10 CFR 50.73 to be reported. However, because the HPI system consists of redundant trains, and only a single train is required (typically) to perform the safety function, train-level inoperabilities do not require an LER. Specifically, plants are not required to report single train inoperabilities unless the event resulted in an outage in excess of technical specification ellowable outage times, or resulted in a unit shutdown required by technical specifications. Otherwise, occurrences where a train was not fully operable would not be reported. For example, no LER would be required if, during the performance of a surveillance test, a motor-driven pump failed to start, provided the redundant train (s) were operable and the cause of the failure to stan was conected and operability restored prior to expiration of the technical specification limiting condition for operation. This reportability requirement effectively means surveillance test data cannot be used for the unreliability calculations since most of these failures are likely.not reported. However, for ESF actuations, all component failures that occurred as part of or in conjunction with the ESF actuation are assumed to be described in the narrative of the LER as required by 10 CFR 50.73(b)(2)(ii). Because all ESF actuations are reportable under 10 CFR 50.73(a)(2)(iv), the failures listed in an LER describing an ESF actuation are assumed to be complete. Additional information L I ! 13 NUREG/CR-xxxx, Vol. x
l Scope of Study 1 concerning the identification and classification of the LER data are provided in Section A-2.2 of Il Appendix A. l 2.2.2 Failure Classification I The information encoded in the SCSS database was only used to identify and select LERs for the a' review and classification. Analysts experienced in PRA and in U.S. commercial NPP operations g reviewed the full text of the selected LERs. Care was taken to properly classify each event and to maintain consistency of the classification process. The focus of this report is on risk and reliability. Therefore it was necessary to review the full text of each LER and classify or exclude events based on whether the HPI component / segment / train / system could fulfill its intended safety function ifit was actually needed to mitigate an accident. Specifically, the information necessary for determining reliability, such as classification of HPI failures, failure mode, failure mechanism, and cause, was based on redundant and independent reviews of the selected LERs. Again, the SCSS data search was used only to identify those LERs relevant to this study; no data characterization, evaluation, or reliability analysis was performed using the information encoded in the SCSS database. Failure classification of the inoperability events was based on the ability of the segment to function as designed for the assumed mission. The operational mission requirements vary based on the type of g transient experienced by the plant. Typically the operational missions require system operation for only a g few minutes. Inoperability events were classified for the operational mission based on the operational requiremerits of the actual unplanned event (i.e., how was the system actually needed). The events identified in this study as segment failures represent actual malfunctions that prevented the successful operation of a particular pipe segment. Segment failures identified in this study are not necessarily failures of the HPI system to complete its mission. Specifically, a motor. driven pump segment might have failed to start; however, the re:lundant motor-driven pump segment would have responded as designed. Therefore, the system did not fail. For the purposes of this study, the following segment failure modes were considered during the review of the operational data:
. Maintenance out of service (MOOS) event is one in which, because of maintenance activities, the affected segment was prevented from starting automatically during an unplanned demand.
- Failure to start (FTS) occurred if the pump segment was nominally in service (i.e., not classified as MOOS) but failed to automatically or manually start, and generate sufficient pressure and flow. This failure mode only applies to the pump segments.
. Failure to run (FTR) event is one in which the pump segment was delivering sufficient 1
pressure and flow (i.e. successful start), but the segment failed to maintain sufficient pressure and flow during the time it was needed (or would have been needed). This failure mode only applies to the pump segments.
- Failure to operate (FTO) occurred if a segment (other than a pump segment) could not perform its required design function when needed. For example, a segment with a motor-operated valve failed to open on demand, or a normally open valve fails to remain open.
- Common cause failure (CCF) is a failure of two or more segments resulting from the same I root failure mechanism that prevented the components from performing their required safety a function.
I NUREG/CR-xxxx, Vol. x 14
Scope of Study Error of commission (EOC) occurs if the HPI system was rendered inoperable by operator action when the system was needed. Recovering from a failure is also considered in the reliability calculations. To recover from a segment failure, the operators have to recognize that the segment is in a failed state, and then restore the function of the segment without actually repairing or replacing hardware. (This is because the time and resources available for recovery depends on the specifics of an accident scenario and can vary greatly.) An example of such a recovery would be an operator (a) noticing that the pump failed to start and (b) manually starting the pump. Each failure during an unplanned demand was evaluated to determine I whether recovery by the operator occurred or was possible. There were some failure events during which the operators elected not to recover a failure because I a redundant segment of the HPI system was successfully operating. For example,if the pump tripped during start and the other pump was operating properly, the operators may have elected to not recover the failed pump. To minimize any potential bias in the estimates of the recovery probabilities, failures that I the operators did not attempt to recover were funher analyzed to determine if they could have been recovered. If the failure mechanism was such that recovery was possible, the failure wasjudged to be recoverable. The analysis section of most LERs provided information useful for determining if the segment would have t een able to perform as required even though it was not operable as defined by plant technical specifications. For example, a section of pump discharge piping was found to have less than the required I number of seismic restraints, and therefore was declared inoperable in accordance with the plant technical specifications. However, since the operation of the system during a small LOCA coincident with a seismic event is not a mission considered in this study, and the pump would have worked during a small LOCA in spite of the missing seismic restraint, this event was not classified as a failure. In addition, administrative problems associated with HPI were not classified as failures. As an I example, an LER may have been submitted specifically for the late performance of a technical specification required surveillance test. This event would not be classified as a failure in this study. This classification is based on the judgement that, given a demand for the segment, the segment would be I capable of perfomaing its safety function. Moreover, in cases like this LERs typically state that the segment was available to respond a 6emand, and that the subsequent surveillance test was performed satisfactorily. If the LER stated that the segment failed the subsequent surveillance test, that event would be classified as a failure. As a result of the review of the LER data, the number of events classified and used in this study to estimate HPI unreliability will differ fram the nuraber of events and classification that would result from a I simple SCSS database search. Differences between the data used in this study and a tally of events from an SCSS search stem primarily from the completeness of the data (i.e., reportability requirements for both demands and failures) and the exclusion of events where the failure mechanism is either outside the HPI system boundary or inconsistent with the definition of failure used here. Because of these differences, the reader and/or analyst is cautioned from making comparisons of the data used in this study with a simple tally of events from SCSS without first making a detailed evaluation of the data provided from a I reliability and risk perspective. Appendix C provides a listing and summary of the events used in estimating the unreliability of the HPI system. 2.2.3 Characterization of Demand Data To estimate reliability, information on the frequency and nature of the HPl demands is also needed. For the purposes of this study, a demand is defined as an event requiring either the system or segment of 15 NUREG/CR-xxxx, Vol. x
l Scope of Study i the system to perform its safety function as a result of a safety injection (SI) signal. Spurious signals or those inadvertent SI signals that occurred during surveillance testing of systems other than HPI were also classified as demands if the IIPI system was normally expected to be operational, since these demands are g required to be reported. An unplanned demand is defined as either a manual or automatic Si initiation of 3 the system or segment that was not part of a pre-planned evolution. Unplanned demands are typically the result of actual safety injection demands or inadvertent SI signals. Other plant conditions may have also g resulted in an unplanned demand ofIIPI based on the plant-specific design of the liPI initiation circuit, gj These initiations ofIIPI were also included in the study if they resulted from an automatic SI signal. l The LERs identified from the SCSS database search were reviewed to determine the nature and number ofIIPI unplanned demands. Each LER was reviewed to determine what portion (s) of the system were demanded. For cases where the LER did not provide clear indication of what portion (s) of the system were demanded, the IPE or Final Safety Analysis Report (FSAR) for each plant was reviewed to determine the initiation setpoints and operating characteristics of the system for the specific plant. In ; addition to the setpoints and operating characteristics, the plant-specific system schematics were also ) reviewed. The purpose of this review was to determine which segment (s) of the system were demanded, l given the initiation setpoints and operating characteristics of the system, when reviewing the full text of each LER. { The identification of the system initiation setpoints, operating characteristics and schematics for the system were necessary to capture the unplanned demand frequency because many LERs simply stated ! that all systems functioned as designed. Since the full text of the LER describes the plant conditions E before and during the reported event, the information provided in the IPE and FSAR were used to determire whether an unplanned demand ofIIPI occurred. For example, au LER might state that a l pressuraer low pressure condition existed during the event. Using the information provided in the IPE or FSAR for that particular plant, a determination was made whether the condition resulted in an automatic safety injection signal. Even though no explicit identification of the IIPI pump start was found in the LER. Therefore, based on the narrative of each LER and plant-specific knowledge conceming IIPI initiation and pperation, it was possible to determine a relatively accurate number ofIIPI unplanned demands throughout the industry. For more details on the counting of unplanned demands, see Section A-2.2 in Appendix A. Data from the surveillance tests that are performed approximately every operating cycle were also considered for use in estimating system reliability. Plant technical specifications require that the 18-month surveillance tests simulate automatic actuation of the system throughout its safety-related g operating sequence and that each automatic valve actuate to the correct position. In addition to the g 18-month surveillance tests, quarterly surveillance tests of the pumps that are required to be performed per ASME (1989) Section XI, in-service testing programs, could also be used to estimate reliability. g flowever, because surveillance test failures of a single train would not be required to be reported, as g discussed previously, ti;e number of failures found in the LERs could be significantly less than the number that actually occurred. Consequently, this effectively removed any surveillance test data from being considered for the reliability estimate. As a result of the review of the LER data, the number of events classified and used in this study to determine the number ofIIPI unplanned demands will differ from the number of ESF actuations ) identified in a simple SCSS database search. This difference is the result of the coding methodology j employed in coding an event for SCSS and analysis of the LER in this study. Specifically, SCSS will only capture explicitly identified IIPI ESF actuations, while in this study, the intent was to capture all E, actual IIPI unplanned demands. Because of this difference, the reader and/or analyst is cautioned from E j making comparisons of the data used in this study with a simple tally of events from SCSS without first ! making a detailed evaluation of the data provided in the LERs and a review of the system operating i NUREG/CR-xxxx, Vol. x 16 .
- o
Scope of Study characteristics and initiation parameters. The results of the LER review and evaluation are provided in Appendix B, Section B-1. 2.3 Operational Data Analysis The risk-based and engineering analysis of the operational data are based on two different data sets. The Venn diagram in Figure 2 illustrates the relationship between these data sets. Data Set A represents the all the inoperabilities found using SCSS. Data Set B represents the subset ofinoperabilities that are classified as failures. Data Set C represents a subset of the failures for which the corresponding demands I (both failures and successes) could be counted (i.e., countable failures with countable demands). Data Set C, which consists of the countable failures, provides the basis for estimating the unreliability of the IIPI system. Data Set C contains all relevant failures that occurred during an urt.>lanned demand. The only criteria are the occurrence of an actual failure and the ability to count or estimate all corresponding demands (i.e., both failures and successes). Data Set C represents the minimum requirements for the data used in the risk-based analysis of the operational experience, and is I the source data for Section 3 of the repon. To eliminate any bias in the analysis of the failure and demand data in Data Set C and to ensure a I homogeneous population of data, three additional selection criteria on the data were imposed. These criteria were the following: (1) the data from the plants must be reported in accordance with the same reporting requirements, (2) the data from each plant must be statistically from the same population, and I (3) the data must be consistent (i.e., from the same population) from an engineering perspective. Each of these three criteria must be met or the results of the analysis would 1 e incorrectly influenced. As a result of these three criteria, the failure and demand data that comprise Data Set C were not analyzed strictly on I the ability to count the number of failures and associated demands for a risk-based mission, but also to ensure that each of the above three criteria were met. The purpose of the engineering analysis is to provide qualitative insights into HPI system performance and not calculate quantitative estimates of unreliability. Therefore, the engineering analysis uses the failures appearing in the operational data. That is, the engineering analysis focused on Data Set i B, which includes Data Set C, with an engineering analysis of the factors affecting IIPI system unreliability. Represents all the inoperabilities identified from A the SCSS database search. Represents the inoperabilities that are I B B classifed as failures. I C g Represents the subset of failures for which the demand counts could be determined or estimated, countable failures. Figure 2. Illustration of the relationship between the inoperability and failure data sets. 17 NUREG/CR-xxxx, Vol. x
r I
- 3. RISK-BASED ANALYSIS OF THE 1987-1997 EXPERIENCE This section documents the results of the reliability analyses in two ways. First, estimates of HPI unreliability for the actual missions experienced were calculated using the HPI 1987-1997 experience.
These unreliability estimates are based on the HPI missions that result from routine transients that include a SI actuation and a demand for high-pressure safety injection. These demands for HPI operation can g range from a few minutes to a few hours. The estimates of HPI system unreliability (injection phase 5 only) for this operational-based mission were analyzed to uncover pattems in system performance on a plant-specific and industry-wide basis. Second, HPI system unreliability (injection phase only) was estimated using the fault trees developed for this study, but using the HPI component failure data reported in PRA/IPEs (see References 1 through 48). Adjustments we-e made to the mission time assumed in the PRA/IPEs (typically several hours to 24 hours) to allow a fair comparison between unreliabilities calculated using the PRA/IPE data and the 1987-1997 experience. For the purposes of this study, the risk reports are referred to collectively as PRA/IPEs. These reports document data and results of probabilistic risk analyses for 72 operating PWR plants. PWRs that were permanently shut down at the time of this study were not included. (These PWRs that were shutdown are Trojan, San Onofre Unit 1, Rancho Seco, and Yankee Rowe.) Further, PWRs thatjust began operation at the end of the study's time period were not included (Watts Bar operation date 5/96). HPI unreliabilities were estimated using fault tree logic models that combine the probabilities of g broadly defined failure modes such as failure to start and failure to run into an overall system result. The 3 probabilities of the individual failure modes were calculated by reviewing the available data (see Appendix C), and categorizing each failure event and successful demand, by failure mode and system g segment. Generally, the HPI fault tree logic models were not available in the PRA/IPEs, since the models g were not required to be submitted to the NRC. However, the component failure probabilities used in calculating HPI unavailability were documented. HPI unreliabilities were calculated using the HPI component failure data contained in the PRA/IPEs and using the fault trees developed for this study. The component failure probabilities were extracted and linked to the corresponding system failure modes identified in the fault tree developed for the analysis of the 1987-1997 experience. The component failure probabilities extracted from the PRA/IPEs were generally those identified as the major contributors to HPI unavailability. Therefore, the PRA/IPE estimates approximated for this study are likely to be different from those used in PRA/IPE quantification. Besides the plant-specific estimates, six HPI system design classes were identified to distinguish the differences in redundancy, diversity, and operation among the various HPI system designs. Plant-specific estimates of HPI unreliability are grouped according to design class to provide additional insights into HPI system reliability. The following is a summary of the major findings:
- Based on the data found in the 1987-1997 experience, there were no failures of the entire HP1 system identified in 224 unplanned system demands. A simple Bayes estimate of the HPl system unreliability using this data is 2.2E-03 with associated 90% uncertainty interval (8.9E-06,8.6E-03). Using a system level fault tree model that combines individual failure modes, the unreliability (injection phase only) of the HPl system calculated by arithmetic averaging the results of 72 plant-specific models is 4.5E-04. There is a significant difference (approximately a factor of five) between the arithmetic average of the 72 plant-specific values (4.5E-04) and the Bayes estimate (2.2E-03). The arithmetic average is more representative of the actual system unreliability since it is based on a larger number of I8 NUREG/CR-xxxx, Vol. x
Risk-Based Analysis demands and failures compared to the data used to derive the Bayes estimate. The significant variability of the Bayes estimate is demonstrated by the relatively high magnitude of the 90% uncertainty band (approximately three orders of magnitude; ranging from 8.9E-06 to 8.6E-03). Individual plant results vary by about a factor of fifty, from 6.0E-05 to 3.5E-03. The variability reflects the diversity in HPI system designs. However, there is variability in results among plants with similar HP1 designs (factors of ten between highest and lowest HPI unreliabilities). This is attnbuted to the differences in the levels ofredundancy in the injection headers. Section 3.2.4 discusses the within design class differences. Based on the average of the six reference plants, CCF is the leading contributor to the unreliability (injection phase only). Generally, the importance of CCF is typical of redundant train systems that are highly reliable. Although there were no CCF events I identified in the unplanned Si actuations, there were CCF events identified in the remaining set of 1987-1997 experience. The CCFs consisted of the high-head pump trains failing to start and run, intermediate-head pump trains failing to start and run, and the injection headers failing to operate. For plants having HPI systems consisting of both high- and I intermediate-head injection systems, no CCF failures were identified that affected both the high-and intermediate-head systems in the 1987-1997 experience. Based on IIPI unreliability, HPI systems consisting solely ofintermediate-head or high-head trains are more likely to fail as a result of CCF. HPI systems consisting of two high-head and two intermediate-head trains are more likely to fail as a result of random failures of the common HPI suction piping (i.e., RWST and associated piping to the HPI pump trains) since no CCFs were identified I in the 1987-1997 experience that affected these systems simultaneously. See Section 3.2.2 for additional information. e The review of the 1987-1997 experience found no suppon system failures that disabled the I entire HPI system. However, two instances of a HPI train failing to operate automatically because of support system problems were identified. In the first event, an inadvertent SI actuation occurred while testing an emergency-diesel generator for operability. The I operability test being performed simulates a loss of ESF Bus voltage concurrent with an SI actuation test signal. The ESF bus was de-energized and a manual SI to the diesel generator was initiated. However, concurrent with the manual SI, an inadvertent SI was generated on I both HPI trains when the bus was de-energized. The diesel generator output breaker failed to close resulting in an HPI train unable to respond to an SI signal. The second evem occurred during a loss of offsite power while one of the emergency-diesel generators was inoperable. Due to the diesel-generator inoperability, only one of the redundant HP1 trains responded to the Si actuation. The effect ofincluding these non-dedicated support system 5 failures on HPl system rehability estimates are negligible since the redundant HPI train successfully operated. Section 3.5 provides the results of the sensitivity of support system failures on HPI unreliability. One inappropriate operator intervention in the operation of the entire system was identified in the 1987-1997 experience. The human error consisted of bypassing the Si signal during a reactor coolant system depressurization. However, the bypass was removed when low-pressure bistables tripped. Section 3.4 discusses the operator action. L - 19 NUREG/CR-xxxx, Vol. x
Risk-Based Analysis
- The leading contributors to IIPI unreliability (injection phase only) vary depending on the l HPI design class. These are briefly described below and in detail in Section 3.2.4. l
- For HPI designs consisting of three or fewer pump trains, common cause failure (CCF) accounts for 72% to 95% of HPI unreliability. The major CCF contributors to I these configurations are CCF of the injection headers failing to operate and CCF of HPI pumps failing to start and failing to run (not in the order ofimportance).
- For HPI designs composed of two high-head and two intermediate-head pump trains, random failures of the common RWST and associated suction piping are the leading l contributors to unreliability, approximately 93%. l e The industry-wide arithmetic average of HPI system unreliability (injection phase only) i calculated using data extracted from PRA/IPEs is 5.7E-04. The corresponding estimate based on the 1987-1997 experience is 4.5E-04. Both of these estimates use a half-hour mission and do not account for non-safety trains and equipment available at some plants (for example, the use of non-safety grade injection pumps as backups to HPI or an installed spare HPI pump). Section 3.3.2 provides the results and insights for comparison with PRA/IPE results.
3.1 HPI Unreliability Data and System Modeling Estimates of HPI unreliability (injection phase only) were calculated using the unplanned demands (i.e., SI actuations) reported in the LERs and surveillance test data associated with the RWST. Testing data associated with redundant equipment were not used as part of the 1987-1997 experience because of g concerns about the reportability of test failures involving redundant train systems. A failure involving g total system failure is reportable, but failure of a single train is not. Due to the reportability issue, the counting of demands and failures from tests cannot be done with any degree of confidence for the redundant trains. However, test data were used when calculating the failure probability associated with the RWST suction source since failure of the RWST represents total system failure. Therefore, RWST failures are reportable. The failure data used to develop failure probabilities for the observed failure modes are described in more detail in Section 2.2. The contributions to the unreliability of the HPI system from support systems outside the HPI boundary defined in Section 2.1.3 are excluded from the failure counts. The failures identified for the HPI system fall into the following failure categories: suction path faults, pump / valve train maintenance-out-of-service, pump / valve train segment failure to start and failure to run, injection header failing to operate, and the cold leg injection path failing to operate. The maintenance-out-of-service, failure to start, and failure to run modes were further broken down into high-head and intermediate-head pump failure modes to provide additional insights into the reliability of the liPI system. Additionally, the data associated with the maintenance-out-of-service failure mode were segregated according to plant operating mode. The maintenance events were categonzed as to whether the reactor was critical or shut down at the time of the unplanned demand. For the unreliability estimates calculated, only the contribution of maintenance-out-of-service while the plant is operating (i.e., the reactor was critical)is included. In calculating failure probabilities for the individual failure modes, the data were analyzed and tested (statistically) to determine if significant variability was present or if the data could be pooled. Each data set was modeled by simple Bayes method due to the sparseness of the data. In the simple Bayes NUREG/CR-xxxx, Vol. x 20
Risk-Based Analysis method, the uncertainty in the calculated failure rate is dominated by random or statistical uncertainty (also referred to as sampling uncertainty). The simple Bayes method essentially pools the data and treats it as a homogeneous population. [For more information on this aspect of the data analysis, see Appendix A (Section A-2.1)). 3.1.1 Recovery of HPl Failures Given that a failure has occurred in the IIPI system, there exists an opportunity for the failure to be recovered. Specifically, the potential for failure recovery credited in this analysis is only for those events identified in the 1987-1997 experience where actual diagnosis and repair of HPI system are not required to make the system operational. Generally, the events listed in these categories require a simple activity such as restarting of the system if the automatic initiation circuitry did not start the system. Since these failures were not catastrophic (i.e., no corrective maintenance necessary), the estimates ofIIPI unreliability include the effects of recovery. However, due to t F ' ,dancy of the IIPI system, if a train failed and the redundant train was successful, there might be r .nmediately attempt to recover the failed train. This type of failure was further analyzed to determine if the failed component could have been recovered. This potential for recovery was identified to prevent any bias in the recovery resum. Figure 3 shows the outcomes of recovery based on the process used to review the 1987-1997 experience. The review of the 1987-1997 experience identified no instances where the human failed the recovery attempt where simple recovery was possible. Since, there were no events identified in the 1987-1997 { experience for Path B (recovery was attempted but not successful), Path E (recovery wasjudged to be possible but would not have been successful) was assumed to have an outcome probability of zero. 3.1.2 Failure and Demand Counts used in the Unreliability Estimation The failure and demand counts used for estimating probabilities for the HPI system failure modes p are identified in Table 2. The demand counts identified in Table 2 represent opportunities for IIPI system L success. Due to the various designs and operational differences of the IIPI system, a demand for HPI may require only a specific pipe segment of the system. No direct correlation of the segment demands to HPI system actuations is possible based solely on the information contained in the LERs. Therefore, piping ( diagrams and the design operation of the HPI systems (as documented in Final Safety Analysis Reports [ m "s = I '.*. " " A success R e co s e r, successful ,, , ,, , , , , ,,
" ~ ~ .............., a r.oure f.'.'. !T.'t. i ,,,...,..........,n,
..a... c ,,n,,,
( .".T.' %f.:fd!"O...a.i D S u c"" r,; [-lg- : =:::==. 5
..o...
[ ..,.,;,,,.. . . o u ,. [ Figure 3. The recovery tree depicting the outcomes of recovering an HPI failure. The tree is based on the recovery actions observed in the unplanned demand data. Path B had no events of this type. Path E ( was assumed to have no likelihood based on Path B results. c w , 21 NUREG/CR-xxxx, Vol. x
Risk-Based Analysis and Plant Inforraation Books) were used, in conjunction with LERs, to determine the appropriate number of segment demands. The counts in Table 2 are summarized below:
- There were 227 unplanned SI actuations identified in the 1987-1997 experience. Of these, three occurred before the low-power license date and therefore are not counted. The net result is that 224 Si actuations formed the basis for the demand counts provided in Table 2.
Due to the redundancy of the HPI system and plant conditions,410 HPI train actuations resulted with one train failure reported. Due to the sparseness of the failure data, additional failure information was reviewed in order to reduce the uncertainty in the ability to recover from the failures. (The additional failures belong to the set B of the Venn diagram depicted in Figure 2 of Section 2.3.) Based on this additional information, the failure to recover probability was based on two failures with one not being recoverable.
- For the high-head pump train, there were 96 demands that resulted in no trains being out of service for maintenance at the time of the demand. Similarly, for the intermediate-head pump train, no out-of-service failures occurred in 160 demands.
- The suction segment provides the source of water, typically from the Refueling Water Storage Tank, to the HPI pump trains during the injection phase. There were 168 unplanned demands for the suction segment to supply water to a pump train. No failures were identified for the suction segment. Due to sparseness of unplanned demand data associated with the RWST, test data was used in addition to the unplanned demand data. Based on quarterly surveillance testing of the high-pressure safety injection, low-pressure safety injection, and containment spray systems, no failure of the RWST was identified in the 1987-1997 experience. There were 9,261 quarterly test demands estimated for this study's time period.
- There were 145 opportunities for a high-head motor train to start due to unplanned demands.
No failures were identified.
- There were 230 opportunities for an intermediate-head motor train to start due to unplanned demands. These demands resulted in one failure to start of an intermediate-head motor train.
Based on the review of additional information contained in the HPI inoperable events, a total of thirteen failures of the intermediate-head motor train were noted with ten not being recoverable.
- For the run phase of the HPI system operation, there were no failures of the high-head motor train in the 145 unplanned demands. For the intermediate-head motor train, no failures to run were observed in the 229 demands.
- The injection headers downstream of the pump / valve trains received an estimated 430 opportunities to direct / control flow to a co!d leg injection path. Of the injection header demands one failure to operate was identified within this pipe / valve segment. Based on the review of additional infonnation contained in the HPI inoperable events, six failures of this HPI piping segment were noted. The six failures were not recoverable.
- The cold leg injection path segment consists of the piping segment downstream of the injection headers and immediately upstream of the cold leg. There were 498 demands experienced by this segment from the unplanned demands. No failures occurred.
NUREG/CR-xxxx, Vol. x 22
Risk-Based Analysis Table 2. A summary of the IIPI system / segment demands and associated independent failures identified in the unplanned demands. Unnlanned Demands Ouarterly Tests Failure Mode f* d' f d Failure to operate, train actuation faults (FTO-TRAIN) 1 410 - - Failure to recover, train actuation faults (FTO-TPAIN) 0(1)6 1(1)6 - - Maintenance-out-of-service while not shut down-high. 0 96 - - head motor train (MOOS-CC)* Failure to recover, high-head motor train maMtenance 0 0 - - MOOS-CC Maintenance +ut-of-service while not shut down--- 0 160 - - intermediate-head motor train (MOOS-SI)* Failure to recover, intermediate-head motor train 0 0 - - I maintenance MOOS-SI Failure to operate, suction path faults RWST-SUCT 0 168 0 9,261 Failure to recover, suction path faults RWST-SUCT 0 0 0 0 1 Faihte to start, high-head pump / valve train path (FTS- 0 145 - - CC) Failure to recover from high-head motor FTS-CC 0 0 - - Failure to start, intermediate-head pump / valve train path 1 230 - - (FTS-SI) Failure to recover from intermediate-head motor FTS-SI 1(9)6 1(12)6 - - Failure to run, high-head pump / valve train path (FTR- 0 145 - - CC) I Failure to recover, high-head pump / valve train path FTR- 0 0 - - CC Failure to run, intermediate-head pump / valve train path 0 229 1 (FTR-SI) Failure to recover, intermediate-head pump / valve train 0 0 - - path FTR-SI I Failure to operate, injection' isolation header (FTO-INJ) 1 430 - - Failure to recover injection / isolation header FTO-INJ 1(5)6 1(5)6 - - Failure to operate, cold leg injection path (FTO-LOOP- 0 498 - - INJ) a fdenotes failures, d denotes derrands b The parenthetical salues denote the additional failures identi6cd for estimatinF the failure to recover probabilities The additional failures were ident 6ed from data $ct it (refer to the Venn diagram depicted m Figure 2)
- c. In this report, the MOOS contnbution to llPI system unreliabihty was determmed usmg those unplanned demand failures that resulted from the llPI system bemy unavailable for mamtenance (test, preventive, or corrective) at the time of the demand 3.1.3 Modeling of Common Cause Failures Due to the redundant characteristics of the 11P1 pump trains, injection headers and cold leg injection paths, common cause failures (CCFs) were considered. CCF was explicitly included in the llPI u
- 23 NUREG/CR-xxxx, Vol. x
Risk-Based Analysis unreliability model because CCF events were found in HPI failure data between 1987-1997. (The CCFs were identified in data set B in the Venn diagram of Figure 2.) The following paragraphs summarize the basis for the type of CCF events evaluated, the method of estimating C.CF basic event probabilities used in the system model, and a comparison of the selected method and raw data estimates. Section D-1 of Appendix D provides further details of the CCF analysis. CCF data collection and analysis of the HP1 system was conducted in several stages and accomplished in conjunction with the CCF Database" program. First, the LERs (unplanned demand, surveillance test, and inoperable events for the 1987-1997 time frame) were screened for identification of CCF modes and basic events to be included in the fault tree analyses. The CCF analysis of the HPI system included events identified in the 1987-1997 time period that contributed to failure of redundant segments. Based on the 1987-1997 unplanned Si actuation demand data, no CCF events were identified. To further evaluate the susceptibility of HPI to CCF, the data contained in the remaining LERs were screened to identify any potential CCF mechanisms. CCF events were identified in the set of data for the high-head pump trains failing to start and run, intermediate-head pump trains failing to start and run, and the injection headers failing to operate. No CCF failures were identified across the high-and intermediate-head pump systems in the 1087-1997 experience. The alpha factor method, which is supported by the CCF Data Collection and Analysis System (see g Reference 50), was selected to estimate the CCF contribution of the failure modes identified dunng the 5 CCF screening step. This method was selected because it: (1) fits the HPI system study needs, and (2) supports an uncertainty analysis by estimating CCF uncertainties. The alpha factors calculated from the CCF Data Collection and Analysis System are presented in Table 3. In addition to the CCF failure modes identified in the 1987-1997 experience, the alpha factors for the aggregated high- and intermediate-head failing to start as well as failing to run are included in Table 3. (These events in Table 3 are labeled as ALPHA-FTS-HPI and ALPHA-FTR-HPI, respectively.) Although there were no CCF failures identified across the high-and intermediate-head pump systems in the 1987-1997 experience, the estimates are intended to provide the reader and user of this document with a consistent set of CCF parameters for the HPI systems for the time period of this study. 3.1.4 HPl System Fault Tree Models The fault tree models for the six design classes shown in Figure 4 illustrate the logic used for generating the 72 plant-specific HPI unreliability models (injection phase only). Plant-specific models were generated since there are some HPI design and operation differences within a design class. These g differences are described in Section D-2 of Appendix D. E 3.2 HPl Unreliability This section documents the results of the reliability analyses performed using the 1987-1997 HPI experience. Estimates ofilPI unreliability for the actual missions experienced were calculated. These E unreliability estimates are based on the operational events that result from a SI actuation signal (manual or g automatic) and a demand for high-pressure safety injection. These events for HPI operation can range from a few minutes to a few hours. 3.2.1 HPl System Modeling Assumptions I The fault tree models for the six design classes shown in Figure 4 provided the logic used for generating the 72 plant-specific HPI unreliability models. The six HPI design class models were developed to categorize the levels of cold leg and pump train redundancy and diversity (high-head and l NUREG/CR-xxxx, Vol. x 24 4
)
)
Risk-Based Analysis ! Table 3. Estimates of alpha factors based on the 1987-1997 experience used for calculating the HPI unreliability. Alpha Factor Mean and Event Name Distribution 90% Interval Description ALPIIA-FTS-CC Beta (2.49,3.70E+01) (1.5 E-03, 6.3E-02,1.4E-01) 2 of 2 high-head pumps fail to start ALPHA-FTS-CC Beta (1.66,5.68E+01) (4.0E-03,2.8E-02, 7.1 E-02) 3 of 3 high-head pumps fail to start ALPHA-FTS-SI Beta (1.89,5.04E+01) (6.1E-03,3.6E-02, 8.6E-02) 2 of 2 intermediate-head pumps fail to start ALPIIA-FTS-SI Beta (1.41,7.68E+01) (1.9E-03,1.8E-02,4.8E-02) 3 of 3 intermediate-head pumps fail to I start ALPHA-ITS-SI Beta (1.48,1.07E+02) (1.6E-03,1.4E-02,3.6E-02) 4 of4 intermediate-head pumps fail to p start ALPHA-ITS-HPI' Beta (3.90,7.79E+01) (1.6E-02,4.7E-02,9. lE-02) 2 of 2 safety-injection pumps fail to start I ALPHA-FTS-HPI' Beta (2.66,1.18E+02) (5.4E-03,2.2E-02,4.7E-02) 3 of 3 safety-injection pumps fail to start i ALPHA-FTS-HPI' Beta (2.61,1.61E+02) (3.8E-03,1.6E-02,3.4E-02) 4 of 4 safety-injection pumps fail to start ALPHA-FTR-CC Beta (1.15,7 25EMI) (1.lE-03,1.6E-02,4.4E-02) 2 of 2 high-head pumps fail to run ALPHA-FTR-CC Beta (0.57,1.10E+02) (3.8E-05, 5.1 E-03,1.9E-02) 3 of 3 high-head pumps fail to run ALPHA-FTR-SI Beta (3.71,4.56E401) (2.5E-02,7.5E-02,1.4E-01) 2 of 2 intermediate-head pumps fail to mn I ALPHA-FTR SI Beta (2.89,6.97E+01) (1.1E-02,4.0E-02, 8.3E-02) 3 of 3 intermediate-head pumps fail to run l g ALPHA FTR SI Beta (2.74,9.67E+01) (7.0E-03,2.8E-02,3.9E-02) 4 of 4 intermediate-head pumps fail to mn ALPHA-FTR-HPI' Beta (4.39,1.10E+02) (1.4E-02, 3.8E-02, 7.2 E-02) 2 of 2 safety-injection pumps fail to run I ALPHA-FTR HPI' Beta (3.04,1.65E+02) (5.0E-03,1.8E-02,3.7E-02) 3 of 3 safety-injection pumps fail to run ALPHA-FTR IIPI' Beta (2.84,2.23E+02) i (3.2E-03,1.2E-02,2.6E-02) 4 of 4 safety-injection pumps fail to run ALPHA-INJ HDR Beta (2.85,4.72E+01) (1.5E-02, 5.6E-02,1.1 E-01) 2 of 2 injection header valves fail to operate ALPHA-INJ-HDR Beta (2.47,7.20E+01) (7.6E-03, 3.3 E-02, 7.2E-02) 3 of 3 injection header valves fail to operate ALPHA-INJ-IIDR Beta (2.49,1.00E+02) (5.6E-03, 2.4 E-02, 5.3E-02) 4 of 4 injection header valves fail to operate ALPHA-INJ-HDR Beta (2.65,1.63E+02) (3.9E-03,1.6E-02, 3.d E-02) 6 of 6 injection header valves fail to operate ALPHA-INJ-HDR Beta (2.92,2.47E+02) (3.1 E-03,1.2E-02, 2.5 E-02) 8 of 8 injection header valves fail to operate a The estirnate is based on the aggregated experience for the high. and -intermediate-head pumps (e g , FTS CC and FTS.SD I - 25 NUREG/CR-xxxx, Vol. x
4 jt F28 ' 1 "' 4 1 1
/
l 5 0
/
9
=A.
. 9 9
1 l d - l M 9.. I=. 1 I. . _ '- I
= o- r e o.
l l o-
. l m l T*^
** . l
- I O_. - l l ,
y
=o _ -
l I _
... - t
- m-l i
o- "2 l ' l
- i l9_lm..
I b I - M ia l l N- j e m s o-l Q_ . r n u I I l e4M .N g n m . I - ~
. I i t
E O_ - - 9 1 _ a - r-o l l i M = - u
=-o
. l l
c mo._ l a c n l - 1
. m l l L- - i
**A- o_.
. i _
d e- o- =9__ _ l G 5 s e l I l
"= .. u e .. l l . l
=
_ l l s I m O_ = 1 e o I m= o.=%l MO I f S
- M,_A l e
s s a c I
=
l l E n eO-
. l g
e . r Q_. l _ . is loY l I
?
e
. l -.
s d
=
l . .
)
M. &_ = _
- _ e
" Q_
1 s
> . l
= o- ( s a l
l
- ]
- m. o .
l
- _ l la C
s h p
- . n n
^._ o I _
g T* eo l9__ =. .e .- is
. l i e t c
I l l D e e . l .
'. e
- j n
m O.__ e l lm o - lP _lT*Q: T t e r i ( I P i m= o- l M _ l F lu a I I
- A. x l l . la
. n i s
- l
_ . o e lo_= P R_1 1 ita r e p ht
=
- f -
1 O o e r o.__
. l l
P s H e l l l
. L= o. .
d w t e r d l _ t _ e
- f. l l
ia u a l9_. " W l l
.. f
- a. . Ml l
=: R m
e CQ e. Io_. E t L- s
. y 3
l S S G . W 4 e r u g i F g $aF?' 5 Nx ( or* I'l , l1lllli i; !ll ll! l 1 1 lt
Risk-Based Analysis i
/ .'
II
!I d[lj!(E il bl i Oh- g l- i I -
1 -
- h. 3l 8 3
i.l Ol 1 ;e .[ 0i ! -
..: ij Ol
.d!j;ei !!l G! 3 Di I
Of. 1 l lil Ol-- i .;;
;I
-1 I '
Byg Og j! ;lI I EE
, 1' 61'i h O!' !
Q(
,' i j Y i g ar ,
!j,6;1 !! elf !!!0: '
!! gl, 8 ,
Of . e ~ j ;
$$l~l~' .
1
;,j, si j
4 5 . jji 3l 3l Og
.. Er f lj 6l ;
}c 5-
- 01 1
8 il,! = s.i> G! . !
!!lOf' ;! x id l i
5 l . E i
!E 3 4
iE 27 NUREG/CR-xxxx, Vol. x
Risk-Based Analysis I l i! b
. 5 L- 1
!! Ol' s"j i! 01 b!!O h .
liji b lil4 i i y Qs -t
.i Og l!I (g ll"!
! q ijl G! ,i
!!Gi"!Gl,.o!- '
iP
!!!6l l 8 I
!jl.l [i;;g ; I
!)5li i 6li 3 iii d' . ii ! $
lllO! lt i' ii Gl-j !j Of g
- 1 G, i.
!I 2l !. i E GlI l) O yi il 4
- e g 3 i
l !! I i ! 'i
.ll l
Gl; - II G[e - -! Eg
!! G~ !
l O.! l g! l!.3f. g? ! l . ! ! :8: I j
; Ol' g ,' i 3.' ilOl(G~- ,
,;. 2 I!!$lt I' i }
4 Q- itO 4 j l b' ! _ l iE NUREG/CR-xxxx, Vol. x 28 I
l1!i , l!llllll ;l)'lIIlll 'l\l N;;i 7oIt D $ N ,T 0' 1 1
/
l
. 5 0
/
n a-o 9 9 9 1 I 4+o p I . w-o l I
. l -
s- - l l x o. l m o..- mo. l l . I l9-l =
=- o. x o = = h 5
lM-l I l I l l . . Eo xo p e 0. . f le l E I l k c
= . ] l 3 c
= o.
l . s- . M
._ L m o.
= to n
l P-:
- o. .
l
. ie l l . j I %
l
. . 6
= . .
= M.--
~= M- 7 .
. =
a._
. me o
, . p 9 . e l ] 9- l l g r
e, - u l l tcs O_. l- ., _ e d m .
.. e o. re l
=
r o l T eg i r t 4 la s s l l l
. r C
- .. - ts, n
.. - m g
s- s .
=
0-l m - o- A D s e l l e
, o l
r= . I T e r 8 . . 0 j r i
'- o.- l
= M.- .
~
ltu F a l
- l la
. n
=o o l
l
. ta r
- e r
M.-
= p l
- O lo=-
5 l l t P H
= o.
l
. I
. t e- --
- m
_ o
- P
= o,._
l l l
. m - o.-. k y
e r u l
= o-,
l .. T )
. . d
= o, _._.
. - e l
R u E n 4 it l _ 3 n S P o T ( c r 4 e r u ig F a ON:oAN .
<.o_' x
_, llll
l i Risk-Based Analysis j i l I a e j!!' 01 - 5 p i niiq ; si il l
!!!Oi ,!
<i;e't{Og is >>
i g ll1OI! a
],!!6,! is eh .
I 3 5 O - ji i! r d,iO! e, t 146!! l i ig 21 11 O,! a! el-!I; a
, ,t i
t a:, I li Ol i.j, I i . i i i i! I! nl vni n, ! l i 4 5 i !! a! ! i! it el- !!! I I i! Oj i m
! g l
i ki O[ il g li Oj g i : g
;E 3 4 ij 6! g is z
.i wo I
ro l 3 g 4 5
$ l, NUREG/CR-xxxx, Vol. x 30
)i1\lll\
- D g r:tE c>BqC$ n 1
1
/
5 0 3
, 9 9
= ~ O,_. 1
= 9.
I
**.. = -
f y , c; O_ .
. _ =-
= 9,I . R- :
i t. _ . i s
=.A.,
s, - s.. yT e-r
=.
_. O _ O_ i- '
=
0__
=..9,.,,.
- . r- _,
h L m. 0_ b._,
. . E 9 .-
e-
=p G. . T, . r-3 =
1~
' 0__
- r. O,,_ . e-
=_
. l' ,
l
# r-
=. _
Oy 'J" T. 0_
=. o_
, =. . .
t' , t 6, Q a n g i, e
=J.O.
D m u s u a-r O __. , T lt e e r u
=.o.
a
. r F s
m u
= O .
la n o ita m - r O __. i
- e p
T. O I
, P s
a H m . d o u o w
?
l de a n . B r
)
- v. O,y. & d e
=
- _ . W
- R u
. l E n
" L- i t
t n S R o B ( c - 4 e r u g - i F
.- g a'nWAN*.<o_*M .
2
Risk-Based Analysis I
. 5 1 o!-i Ilti
! I
!! E, i! 012 2 E I N Of jl il Ol t
l llI G-i!! or inn I r i "i G8- ls
,ii
!!I Gg i i l
OE- 3 l.I i i 1-l
,i e
d gg
' s i lj GI 5"
!!! O!-, i,, ii. t 1 e
. ,, a a!
1i 01s ,, s
!!l G i i
-1 si
!! 5 i a s
l
,!!!01 h!!o!I ,i s! _ I a a I(
Ul I h h t h 2 'E l I E $ l 4 h en E NUREG/CR-xxxx, Vol. x 32 1
p Risk-Based Analysis intermediate-head) across the industry. The steam generator criterion was used for a matter of convenience instead of the number of cold legs. The nut-ber of cold legs is correlated to the number of steam generators. The steam generator criterion reduced the number of possible groupings ofIIPI design. Plant-specific models were developed from the six models to identify injection header / cold leg path redundancy and operational differences within a design class. These differences are described later in Section 3.2.4. The unreliability of the IIPI system was calculated using the plant-specific fault tree models. The models were constructed to reflect the failure modes identified in the unplanned demand data and the levels of redundancy and diversity of the IIPI piping segments. In most cases, the fault tree models used the small LOCA success criteria stated in the PRA/IPEs (refer to Table 1 for the success criteria). Ilowever, the success criterion for several plants was modified to eliminate the non-safety class pump trains modeled in some PRA/IPEs. Failures are not reportable for these types of pump trains. Therefore, estimates for these types of non-safety components were not calculated. Further, the success logic was modified to account for the in-line spare pump that required operator actions to place the spare HPI pump in service (e.g. reconnecting the spare pump to an electrical bus). The failure of the RWST suction path was modeled and it was the dominant failure for IIPI Design Class 6 plants although there were no failures in the unplanned demand data extracted from the 1987-1997 experience. The failure mode associated with this segment was included as the dominant failure in the quantification because of the following reasons:
- Although no complete failure of this segment was observed in the unplanned demand data for this segment, partial failures of the RWST suction path identified in the 1987-1997 experience tends to support this failure mode as being credible. Even though this failure dominates Design Class 6, the failure probability estimated for this segment is low, about SE-05.
- Design Class 6 uses redundancy (four or five pump trains and eight injection paths) and diversity (high-head and intermediate-head pumps) in the IIPI systems. Because of these features, it is reasonable for the RWST suction segment (this is the shared between high and intermediate subsystems) to have a major effect on IIPI unreliability.
Estimates of HPI unreliability were calculated using the 1987-1997 experience using only the unplanned demand data. These data were statistically analyzed to develop failure probabilities (see Appendix A for the details on the statistical applications and methods). The following failure modes are based on the 1987-1997 experience (based on the unplanned demand data): I Maintenance-out-of-service-Pump, driver, valves, and associated piping (MOOS)
- Failure to Operate: Train Actuation-liigh-Pressure Safety injection (SI) actuation channels (FTO-ACT)
- Failure to Start-Pump, driver, valves and associated piping (FTS)
- 11ilure to Run-Pump, driver, valves and associated piping (FTR)
{
- Failure to Operate-Injection header valves (llPI isolation, etc.) and associated piping faults (FTO-INJ)
- Failure to Operate---Loop (cold leg) injection paths and associated piping faults (1 TO-LOOP-INJ).
- Failure to Operate-RWST suction path and associated piping faults (FTO-RWST-SUCT).
l 1 33 NUREG/CR-xxxx, Vol. x j I
1 Risk-Based Analysis l 1 Table 4 contains the failure mode probabilities and associated uncertainty intervals calculated from the 1987-1997 experience for the independent failures. Table 3 provides the estimates for the alpha factors (%) used in the CCF quantification. The following conditions were assumed for the purposes of quantifying the operational mission fault tree:
. A demand (Si actuation), whether actual or inadvertent, to provide high-pressure safety injection to a cold leg is received by the HPI system.
. The only mode of HPI modeled is the injection phase. Alternate swtion sources were not modeled. Further, the long-term recirculation mode of HPI is not modeled.
3.2.2 Estimates of HPI Unreliability and Insights Between-plant differences in HPI unreliability exist due to the design variations and due to operational variations of the HPI systems within certain design classes. Therefore, plant-specific estimates were calculated. A plot of the plant-specific estimates of HPI unreliability is provided in g Figure 5. The plant-specific estimates are grouped according to HPI design class. The average of the E 72 plant-specific estimates of HPI unreliability is approximately 4.5E-04. The range of the 72 plant-specific estimates,is 6.0E-05,3.5E-03. The aritlunetic average, which is based on the plant-specific g , estimates derived from fault tree methodology, was compared to a simple system (complete) performance g, ' estimate calculated directly by using a Jeffreys noninformative prior. The overall system reliability estimate is 2.2E-03 (based on no total system failures in 224 SI demands). The 90% uncertainty interval on the Jeffreys estimate is (8.9E-06,8.6E-03). The plant-specific mean estimates fall within the 90% uncenainty interval calculated for the overall system reliability estimate. The contributions of failures to the overall HPl unreliability are presented in Table 5. The contributions are calculated according to the cut set contribution to the unreliability for the reference plant selected for each design class. (Table D-6 provides the listing of the cut sets for the six reference plants.) Based on the ayerage of the six reference plants, CCF is the leading contributor to the unreliability. Generally, the importance of CCF is typical of redundant train systems that are highly reliable.) Based on HPI unreliability, IIPI systems consisting solely ofintermediate-head or high-head trains are more likely to t' ail as a result of CCF While llPI systems consisting of two high-head and two intermediate-head g trains are more likely to fail as a result of random failures of the common RWST suction segment. E 3.2.3 HPI Unreliability Across Design Classes Table 6 contains the arithmetic average of HPI unreliability with regard to design class. These results indicate that variability across the HPl system designs exists. The design class average unreliability ranges from 5.6E-05 (Design Class 6) to 9.1E-04 (Design Class 3). IIPI designs consisting of only two pump trains are the least reliable, while designs incorporating four diverse pump trains are the most reliable. The 1987--1997 HPI operational experience includes zero total sys' ~n failures and a total of three IIPI segment failures. Due to the sparseness of the data, between-plant vacation of failure probabilities ; could not be calculated at the HPI segment level. For example, for all plants, an identical value was used ) for the failure to start probability of a pump train. In spite of using identical failure probabilities, there are I significant differences in the plant-specific HPI unreliabilities calculated using the operating experience. This is attributed to major differences in design (number of pump trains, etc.) and operation (number of g normally operating pumps) among the HPI systems. 3 4 NUREG/CR-xxxx, Vol. x 34
)
5,@DChc>(Mh .
) ) ) )) ) ) ) ) ) d )
* ) ) ) ) ) ) )) )
e la 2 2 3 33 0001) 4 2 22 0 32 1 2 3 3 33 0 3 r v 0- 0- 0- - - - 0- 0- 00- -0+ 000- - - 0- 0- 0- 00 - - 0+ 0-a r E E E EEE E E EEE EEE E E E te 0 2 5 65 0 0 EEE E e s r n 3 47.0 90.l. 3 3 5 51 0 E. s o I 2, 1
, 7, 5, 9, 9, 2, 1 1 1 I 7,1, 9, 1 8, 9, 8, 9,11, 3, e
ht s% t e 3 3 3 331 5 3 331, 331 3 3 g c y0 0- 0- 0- 000 0- 0 000 000 0- 0 3 0-33 000 3 0-a a9 E E E
- - - - - - - - - - - - m EEE f E E EEE EEE E E EEE B d 2 9 86 0 E E d u
a n 1 3 4 95 5 005 4 2 5 25 3 0 lcn h p a 5, 3, 1 1
, 3, 5, 5, 3, 4, 6, 7, 3, 4, 7, 3, 2, 2, 3, 3, 9, 1 i n 5 a 0 5 6 54 2 7 5 44 1 44 1 5 6 6 44 1 6 i
d c e - 0- 0- 000- - - 0- 0- 000
- - - 000- - - 0- 0- 0- 000- - - 0- n a
e M E E E EEE E E EEE EEE E E E EEE E a s s 0 2 7 e u 2 7 6.37 749
- l. 4 673 275 4 6 9 71 4 9 ta ta 1 2 372 d r
- ( ( ( (( ( ( 1( (( (
345 ( ( ( 1( 8 ( 9( 347 ( ( ( 3 ( e e c s r r u n a l p ia o ) s s f d m n ) ) ) h r
) h a ly r
n o ) ) ) 45 ) 5 ) 0. ) )) ) ) 2 95 ) ) t o u o it 5 u 5 5 5 09) 9 5 05 4 9) 25 ) 44 5 5 5 0 2, 1 5 ht a h c 0 6 2 5 5 9 59) 8 e e b 6 n 9, 6 5 2, 5, 04 5I 4 41 2, 2 5 7 7 3, 4 2 5 4, 4, 2 0, 5 9 s e a r h t 1 2 , 9, , 7 2, 0, 4,3,5 1 2, 0 7 4, d d s 5 5, 955, 1 55 T i D 0 0 5 0 01 1 5 0 5 0 l(1 I 4 5.0 5 0 5 0 (
. 455 1 6(
5 0 m n. r o t e n ( ( ( (( ( ( ( 1 (( 1 1( .n (l( ei e ta (a (a a a ( ( ( y a aa a a a aa a a a aa a a r t a s e t t t t t t t t et t t t t u lui m t e e e ee e e e ee e t e t e o t t ee e t t e r i l i B B B DBB B D BeBBe BDB D B G BBD B fa ofr s p b; tnin te a e l i l e uan
, it m
s r o e n i u d n gn g n g n ggg g g ggg ggg g g g ggg g ,yt i n e io i i i inn i ni in in inn i ni inni l i l n n n n lnmi n n sd wd u r le a i i i t l i i i g o a l lp lp p lpplp lp lp lppp l l lppp lp lp lp ppp l lp o n di r s i oa m a m a m a mmm aa a m a m a mmm aa a mmm aa a m a n e m a mmm m d r a t e t MV S S S SSS a a a a e e r r a S S SSS SSS S S S SSS S da d lu m hs a er ia f _ i t s 6 0 6 02 9 5 0i 53 5 9 8 06 8 n e h e d 9 6 5 2 4 3 7 1 4 2 2 3 9 u h e 1 2 41 4, 1 2 3 1 2 0 2 4 4 et T r 9 h o n fo Tt
. d o tyde i
.au t
n h iv o i o ima b r t tc it 0 ia p a f 0 0 0 1 I 0 0 I 1 1 1 0 0 O 1 6 0 lee hd ye _ m r r r na t nrm us o ia al f I w tr p n ) P or l e n cu _ I i y C P f d f oed n u n t C - l i
- na a
g - i l i S O n I
) R T
oh ti s
%n 5
9 r i b ia S - a c n u _ a O t r d I) f i e u hte dn b M n - d S- fih o ( a a ) t nT d o a. r e S ) n C I . p n h- S- s u a, G. i T p qt s n a r e C F R n a t t a d ( m u e e lu s a e m e T _ i d i
) )
- ) F p tr er mp s a db nm C C e e i L ) ( I t
s s m y h- N C ht I C- S J
) luai n eu _
a h u o A S a p P I R - d N f d yp a f h n ea Ro _ T h I B ig n C l l n S
- T ta a I
P
- ht le es d h i ( C- I
( ia T F p C ) s h r T r ( O inim u n - - - T C - t F in C J N O t, o a
- i n n C U e )
(
- a d L-d ee tih
_ a e r A L ht v s
- ht r e IJ dl d imnu
_ t d o o w w o w o S a la p a t e n ON O u v l r d a M d d d ON T-p v mh t p v b i TI F( O- T lc ro mo y t d e t t t u TA Fl S n
/
p u a pp n l a m F s y oe Mta e u u W ia m i a v o T ( e a Si n (i t r h m d u s h s hs C- r u I r / p C -F - i r i o R t p d ra t on m c
.ue 'n
( > li t t t e e m r r n n m a o o o nT t s v d nt I v u ht ee l ta o F n n n la a dd LtioL p a ei s la p l e u eI a eP p a a r r le le le A f a / v hS Cl vI v d e e n lu tadW' cn u a - p - - a I- / a n hh o i i CvS p af a i i i h h h NuO ht m e3 e ia nn it f e timh e m li lAtcT t a w w u a u a1 d /T p m h- r ioo c h ad n et d e aF p diF e u e t i e u e s f e, e c e l Cmm n p e in mI um p t a e v t c e tc e j n t qse ar ab m. e3 ine ine ic v r e T a o r r it o d a e m r ro m bmIpo r d a e d i e la v jj n im i p o t yt s o ee hi ns r
, ab eea ef t
s e s s s C t, f c u h t oP f h- m
/
p J N e; r, o dh d Si nr
- r yl f- f- f- Aer t e s, h I
e v Cl l, e h r I t e l yidnt e t sb a o o. o- - a v ig - r, o ( v ig e m - a s : e
, l en I
t u t u t u Oe Tpe o r c e t h, St T ac 5t ro h, t n u p Oer o Tpe c t a n n ;e a e r s r e PT o- o- o- I or a r e tr F st r e 7 tac 1 s re n i, n F or r e muru pes inpr I I n e c e) c ec d oo p a detoo d oo u r u r m n d oo p o dh et a el i i et t o t s t et t et t f s s aS - an n I
,d n a r reer e o o r
e ree r r c reer t o t o o t r ee e r r t o d ns ee uu 4 e n nS n e v u u t t s uu s uu e e e v ue e hai s tela la en e t e eOtn ol i! e r er olii c aa l oliiaa c l r r r o! l cii a a r s teo v v e a ne ee nOi a creFF iaa t n t u u lu u lu e le l b s i a i n l eFF r n eFF r n a l ia ia r FF ia hmdhh T r fTT a er aM M U n i
*ia a F F F ts Tp M M( F F U U U F aeb cd yy[gyAyxk2y .
U
Risk-Based Analysis Table 5. HPI system ciet set contribution (for the reference plant in each design class) to unreliability (injection phase only). Contribution (%)To Unreliability Reference Plant Multiple Unreliability Independent Common IIPI Design Class (Mean) Failures Cause Failure 1--(2 IIHSI or 2 IHSI; 2 SGs) 3.4E-04 27 73 2-(3 IlliSI or 3 IHSI; 2 SGs) 2.9E-04 28 72 3-(2 HIISI or 2 IIISI; 3 SGs) 4.8E-04 18 82 4-(4 IllSI; 3 SGs) 2.8E-04 5 95 5-(3 IllSI; 4 SGs) 2.6E-04 20 80 6-(2 HHSI,2 IllSI; 4 SGs) 6.1 E-05 99 1 Table 6. Average design class unreliability (injection phase only) calculated from the 1987-1997 experience. Average' Design Class HPI Design Class Number of Plants Unreliability 1 -(2 HHSI or 2 IHSI; 2 SGs) 20 8.1 E-04 2-(3 HHSI or 3 IllSI; 2 SGs) 7 2.7E-04 3 -(2 HHSI or 2 IllSI; 3 SGs) 12 9.lE-04 4-(4 IHSl; 3 SGs) 2 2.8E-04 5-(3 IllSI; 4 SGs) 4 2.4E-04 6-(2 IIIISI,2 IHSI; 4 SGs) 27 5.6E-05
- a. The values are anthmetic averages.
Even though all random failure probabilities were based on three failures, the HPI unreliabilit. - were dominated by CCFs. Therefore, alpha factors, and all the CCF failure events that contributed to me generation of the alpha factors, significantly influenced the unreliability estimates calculated using the 1987-1997 HPI operational experience. 3.2.4 Within Design-Class Differences The differences within design class shown in Figure 5 are attributed to the variations of HPI systems within a design class and to some degree the success criteria postulated by some plants. Differences within a design class due to system configuration are possible sir e ,I I design classes were categorized first by number of steam generators (SGs)(which correlater m coM iegs) and then by number ofIIPI pump trains. These differences are discussed below. Design Class 1 (2 HHS1 or 2 IHSI, 2 SGs). The system configuration modeled in Design Class 1 is essentially two pump trains that require one train for success. Generally, the injection header configurations provide redundant injection header paths and redundant injection paths per cold leg. However, two configurations (Kewaunee and Prairie Island 1&2) have the pump trains discharge into a common injection header and only one injection path per cold leg. The HPI unreliability for this configuration is higher by about a factor of ten than for the remaining plants within this HPl design class. I NUREG/CR-xxxx, Vol x 36 o
Risk-Based Analysis r
- 1967-1997 exponenm Arkanese Nucteer One 1 9 :as-My[4 - '
Arkeness Nucasar One 2 Calvert cme 14 2 gg?ivgH h! $ [(KWPCM%7FNW{hgy(q.,, Uf: s gy #gt% 3 We-M gg;# l' Dawn. sense MMgagw$MMRyqqq%y %w Kommunes Milowne 2 Pekaades n WMQMMh ygshg 'R%.M:V
;Ge;5 WA MW t
< 7gg gm GMjp 'e N4M
*4<
,pgaD Mt%m6kng^ 4 4 q gge q"aef-Q M(w %g i b '-e$ "ye /r gy W 6
l
.i rsF*T Mant Class 1 Pelo Verde 1. 2. & 3 i Pomt Beach 1 & 2 Prene le6mnd 1 & 2 $dW 9%@ q
%mC
~4
.@[M D ['Cs7$2i M c% T* y==PMDp
%-w=4 G
m : y W hen n$O\ W$'O.fli-7DM San Onohe 2 & 3 St. L.uos 1 & 2 b" W!MWENM"PMNTN5NDD d ~~ M* % - Waterford 3 @$h [k!hOU #NCj[r8 l % ' G Sd Ni? ONM.$Ey 4 6Dm@mUD$a % bI h M k Crystal River 3 Fort Ca%un ~ g,nne -- Oconee 1. 2. & 3 Mant Class 2 Three Mie tenend 1
****WrM Beaver Valley 1 Reever Veiley 2 wQa/hh p, 4 ,Mg M?yp , ' MW;Qy.%gf p M 7c W TJ".W7m g .
N eg. I g pu w ytq: E, %;;t,-q: eg: qn gn - Fortey 1 & 2 ? p PMkf,.4 R w: h 1 3;$ > ; WWMNW 'yy@n n V Ggf 2 ' j- i H s. Rotuneen M" Maine Yankee North Anne 1 & 2 P@FWEfk cWd4f/M fj & @jS;MMM @Y[d.4Mh7 Nt Mantdpi' Class 3 %%etWm:pigw Sheeron Herra 1 WNP D ' Summer 1 %f9 t ' ' M h 1! " ~ 3%di T _ de . .d9$
- 9b O'MSQ, Surry 1 & 2 T_" M- D_;
*M. OL.
. D 7'/.. C - SW* ,s wO-_' b M , W.-.WWY@h% 4 Turkey Point 3 & 4 Mant Class 4 lndeen Point 2 T?vPV8qf?""! n 'i"QI' T **" M M Y g ??*? W indian Pomt 3 South Tenas 1 & 2 j'6R
$ hgjWJ @ G [3 W M l D tO W%gy M Q3W
'%d
~
l* f M; 9 +"""**"4 %@ . .NR [,^h Qh*:ddn 2,sQ-L' YW y Mant R Class W 5"M P Braidwood 14 2 Byron 1 & 2
- Cellowey *-
Catewtie 1 & 2
- Comenche Peak 1 & 2 ~
Cook 1 & 2
- DeatWo Canyon 1 & 2 ~
Haddom Neck ~ McGuire 1 & 2 " Miletone 3 Mont CAess 6 Salem 1 & 2 - Seatwook
- Sequoyah 1 & 2 l Vogtle 1 & 2 "--
MolfCreek I ~ ( Zson 1 & 2 I l ,i
, : 13
~~""
1 :ir a 1p ii y 1.0 E-09 1.0 E-0 8 1.0 E -0 7 1.0E-061.0E 05 1.0E-04 1.0E-03 1.0E 02 1.0E-01 H Pl unre habihty ocos osse s Figure 5. Plant-specific estimates ofIIPl system unreliability (injection phase only) grouped by design class. The mean and uncertainty values associated with this plot are listed in Table D-3 in Appendix D. f The lower HPl unreliability of Arkansas Nuclear One 1 is primarily due to the operational running high-head pump as compared to the standby intermediate-head pumps of the remaining liPI configurations of Design Class 1. The running high head pump eliminates the CCF mechanism of failing [ to start. Further, the alpha factor for the high-head pumps failing to run is smaller by a factor of four than the corresponding alpha factor for the intermediate-head pumps. [~ Design Cisss 2 (3 HHSI or 3 INSI, 2 SGs). The variation in HPI unreliabilities seen within this design class is mainly attributed to the redundancy levels associated with the injection paths to the cold legs, the use of high-head versus intermediate-head pumps, and the success criteria for the injection { phase. Crystal River 3 and Three Mile Island i 11PI configurations were below the design class average. The lower HPl unreliabilities calculated for these two plants are primarily due to the operational running l t 37 NUREG/CR-xxxx, Vol. x r
i Risk-Based Analysis l 1 high-head pump as compared to the standby intermediate-head pumps of the HPI configurations of Design Class 2. The running high-head pump eliminates the CCF mechanism of failing to start. Further, l the alphe factor for the high-head pumps failing to run is smaller by a factor of four than the correponding alpha factor for the intermediate-head pumps. This resulted in the 3PI configurations at g 3 )! Ginna and Ft. Calhoun to have higher than average HPI unreliabilities within this design class. 1 Althou3h Oconee has high-head pumps with one pump running, similar to Crystal River 3 and Three Mile Island 1, there is a lesser number of redundant injectior, headers at Oconee, thereby resulting in a higher CCF likelihood. Design Class 3 (2 HHS1 or 2 /HSI, 3 SGs). he system configuration modeled in Design Class 3 is I two pump trains that require one train for success. (Note that this class of HPI systems has a third pump that requires operator action to be put on line. Spare HPI pumps that require operator action to place in service are not credited in this analysis.) Generally, the injection header cc,afigurations provide redundant injection header paths and redundant injection paths per cold leg. The plants (Beaver Valley 1&2) resulted in the highest unreliability within this design class. This is attribuad to the success criterion that g requires three-of-three cold legs for the injection phase. The HPI unreliability for this configuration is R higher by about a factor of seven than the remaining plants within this HPI design class. The HPI design at Maine Yankee resulted in a lower unreliability (by about a factor of five) than the majority of plants in g this design class. The lower unreliability is primarily due to additional levels of redundancy in the g injection headers and the injection paths per cold leg at Maine Yankee. Des /gn Class 4 (3 /HSI, 3 SGs). There is only one unit, Turkey Point 3&4, with this configuration. Des /gn Class 5 (3 IHSI, 4 SGs). There are only four plants with this configuration and all of the HPI unreliabilities are in good agreement. The South Texas plants have a slightly higher unreliability that is attributed to one less cold leg available for injection (three versus four) than the other configurations within this design class. Des /gn Class 6 (2 HHSI, 2 /HSI, 4 SGs). There is a slight difference between two system configurations in Design Class 6. The difference is attributed to the operational aspect of the high-head pumps. One configuration has a high-head motor pump train is running, while the remaining high-head g pump train is in standby. The other configuration has both high-head pump trains in standby mode. (For 3 the one running and one standby configuration, only the CCF of the pumps failing to run is modeled. For the configuration where both high-head pumps are in standby, CCF of failure to start and CCF of failing to run are modeled.) These operational differences only resulted in negligible differences in HP1 system un eliability.
. m.;.swn in Figure 5, two plants accounted for the variability in this design class. These two plants (in decreasing HPI unreliability) are Haddam Neck and Millstone 3. The cold leg injection path of the high-head system at Haddam Nek is atypical of the high-head systems belonging to Design Class 6.
Haddam Neck has one cold leg inject. n path (Cold Leg # 2) compared to the four cold leg injection paths for the other Design Class 6 plants. An additional factor affecting the HPI unreliability at Haddam Neck is the conservative success criterion for the intermediate-head system (for example, one-of-two pumps to three-of-three unfaulted loops) when compared to remaining Design Cla:ss 6 plants (typically one-of four E trains to two-of-four cold legs). E Although Millstone 3 is not atypical in redundancy levels for either the high-head or intermediate- g head injection paths, the criterion for HPl success is more conservative than other plants in Design E Class 6 (one-of-four pumps to three-of-three unfaulted loops compared to one-of-four pumps to two-of. four loops). NUREG/CR-xxxx, Vol. x 38
Risk-Based Analysis 3.3 Comparison with PRAllPEs The fault tree models for the six design classes shown in Figure 4 provided the logic template for generating 72 plant-specific HPI unreliability models. The plant-specific models were quantified based on success criteria stated in the PRA/IPEs. The spare pump requiring manual operator action was not included in the quantification. In order to allow a fair comparison, the mission time of one half hour was ust;d. The logic model also provided the template for mapping relevant PRA/IPE component failure probabilities into an HPI system model. The mapping provides a relational structure for comparing PRA/IPE results to the estimates derived from the 1987-1997 experience. 4 To provide consistency in comparisons of PRA/IPE results to corresponding results of analysis of the 1987-1997 experience, the contributions to the HPI unreliability from support systems outside the HPI boundary defined in Section 2.1.3 were excluded from this study. (Section 3.5 provides a discussion cf the support system failures that lie outside the HPI system boundary on HPI unreliability.) Recovery events were included in the unreliability analysis where such actions were found in the 1987-1997 experience. The recovery failure modes identified in the 1987-1997 experience are those events for which actual diagnosis and repair of the HPI system are not required to make the system operational. PRA/IPEs may model this type of event at the system level. Due to the summary nature of the information provided in many of the PRA/IPEs (e.g.: the lack ofinformation related to model/quantification assumptions) and the small contribution of this type of recovery on the final estimate (i.e., failure to recover from an automatic actuation failure), these actions are not explicitly accounted for in the PRA/IPE data-based results calculated for this study. Other types ofrecovery modeled in PRA/IPEs involve actual diagnosis and repair of the components that experience a catastrophic failure. These types of recovery are generally modeled at the accident scenario level (i.e., accident sequence cut set) since actual diagnosis and repair of the failed equipment is required. For comparison with PRA/IPEs, the failure probability estimates associated with the ITR mode of HPI operation were calculated on an hourly basis. An hourly failure rate was used to quantify the probability of failure to run. For these calculations, the run times stated in the LERs (or estimated from the LER information) for the unplarmed demands (SI actuations) were used to estimate the hourly failure rate. The run times were generally short and no failures to run were observed. Because the FTR probability would be unrealistically (inconsistent with the failure data) high, the comparison of HPI unreliability based on the 1987-1997 experience and PRA/IPE failure rates uses a half-hour mission. Long run times that are typically postulated in PRA/IPEs were infrequently observed in the 1987-1997 experience. The majority of the run times associated with the unplanned demands tended to be of much shorter duration. There was one instance of run times to approximately 6 hours. However, there were no failures associated with this event. The majority of the run times were about 15 minutes. Further, many of the run times were unspecified in the LERs. Due to the limited run time data, no time-dependent analysis of the failure rates could be performed. Therefore, the failure probability based on an FTR rate derived from short run times does not accurately reflect the longer mistion time (24 hours) performance. Due to these concerns, the reader is cautioned in using the hourly rate without regard to the limited data used in the estimnion. The cumulative run time (actual plus extrapolated) based on the 188 unplanned demands where the pump train operated is approximately 202 hours. Table D-1 in Section D-3 of Appendix D provides a summary of the run time estimation. t 39 NUREG/CR-xxxx, Vol. x e
Risk-Based Analysis . 3.3.1 HPl System Model Assumptions for Comparison with PRA/IPE Results For the purposes of comparing the 1987-1997 experience and PRA/IPE data on a similar basis, the following conditions were assumed:
- A demand (SI actuation) for HPI flow is received by the HPI system.
- For comparison to the 1987-1997 experience, the FTR contribution to the unreliability assumes a half-hour mission time.
)
- Most IPEs do not provide data and adequate information to model the HPI actuation failure probability with a high degree of confidence. Therefore, the IPE-based calculations assume the actuation failure is implicitly included in the other failure modes (e.g., FTS). This assumption has no impact on the Design Class 1 through 5 results and only a minimal impact on the Design Class 6 results since the contribution of this failure mode, based on the 1987-1997 operating experience, is relatively low.
- The HPI system success criterion are based on those reported in the PRA /IPEs except where the success criterion uses a non-safety pump train or a spare pump that does not automatically start on a SI actuation. In these cases, the success criterion was modified to g eliminate the non-safety pump train or spare pump. The success criterion depicted in the g logic models is presented in Table 1.
- Only the injection phase of HPI operation is modeled. The long-term phase involving recirculation mode of HPI is not modeled.
Besides the overall HPI system unreliability comparisons, the component failure probabilities from the PRA/IPEs were grouped into the same system failure modes and pipe segments defined for analysis of the 1987-1997 experience. The component failure modes identified in the PRA/IPEs were grouped according to the following breakdown: Suction oath secment (SUCT) FTO-Failure of the suction path valves and associated piping from the reactor water storage tank g to deliver the flow to the pump trains necessary for HPI success. Also included in this segment are E failures of the VCT that lead to HPI failure. HPI train actuation (ACT-CHANL) FTO--Failurt; to operate of the Si actuation channel for the HPI system. Pumn train secment (HHSI or IHST) MOOS-Unavailability of the HPI pump train due to maintenance. FTS-HPI pump train failure to start and valve failures in the pump train suction and discharge pipihg. FTR-HPI pump train failure to run and continue to run and valve failures in the pump train l suction and discharge piping after successful start. j Iniection header secment UNJ-HDR) FTO-Failure of the HPI injection header / flow control valves and associated valves and piping to deliver the flow necessary for HPI success. 1 NUREG/CR-xxxx, Vol. x 40 L
Risk-Based Analysis l Cold len iniection oath segment (LOOP IND FTO-Failure of the cold leg injection path / check valves and associated valves and piping to deliver the flow necessary for HPI success. I While there are additional component failure modes in a given PRA/IPE for the HPI system, they ere generally for passive components and are insignificant with respect to the failure probability of the active components identified above. The effect of not including these additional components in the system failure probability estimate is small. The failure mode probability estimates based on 1987-1997 experience that were used in the i PRA/IPE comparison calculations are listed in Table 4. No between-plant variability was identified due to the sparseness of the data. 3.3.2 Comparison with PRA/IPE Results Figure 6 shows the model results using the PRA/IPE data along with the model results using the 1987-1997 experience. Both the PRA/IPE and 1987-1997 experience estimates were calculated i assuming a half-hour mission time. Generally, the specified time of HPI operation reported in the PRA/IPE includes both the injection (short-term) and recircu'ation (long-term) phases. Therefore, the PRA/IPE estimates of HPI unreliability based on the mission times stated in the PRA/IPEs will result in a i higher unreliability for the injection phase of HPI operation. The mission times stated in the PRA/IPEs ranged from a half-hour to 24 hours. About half the mission times postulated in the PRA/IPEs is 24 hours. (Table 1 provides the mission times postulated for HPI operation following a small LOCA that i were provided in the PRA/IPEs.) For HPI Design Class 6, the unreliabilities calculated using IPE data could be one or more orders ofmagnitude lower than the unreliability calculated using 1987-1997 operating experience. Som of the Design Class 6 IPEs may have optimistically evaluated HPI unreliability. This difference is attributed to the dominating contribution (greater than 90%) of the RWST suction path failure probability to the overall system unreliability for the operating experience based analysis of HPI Design Class 6 plants. The failure probability of the RWST suction segment may not have been properly incorporated in some Design Class 6 IPEs. The HPI system unreliabilities (i.e., means) estimated using the PRA/IPE failure probabilities range from 5.5E-09 to 5.0E-03. The estimates of HPI unreliability based on the 1987-1997 experience range from 6.0E-05 to 3.5E-03. Table 7 lists the arithmetic average and range of values based on the I 1987-1997 experience and the corresponding PRA/IPE values. Table 8 provides a comparison of the independent failures and common cause failures contribution 1 to the HPI unreliabilities based on the 1987-1997 experience and on the PRA/IPE data. Since the 1987-1997 experience has so few failures based on the unplanned Si actuation demands, caution is advised when making comparisons. Table D-2 of Appendix D provides a summary comparison of the J cutset contribution to HPI unreliability based on the PRA/IPE failure probabilities and the failure probabilities estimated from the 1987-1997 experience for the six reference plants. The corresponding cutset listings are provided in Tables D-5 and D-6. NUREG/CR-xxxx, Vol. x 41
Risk-Based Analysis
- IPE data for companson to operational experience n 1987-1997 expenence Arkansas Nuclear One 1 ' "7"N"7'M 'i " " ^ " ~~* ! ' "~~Q E~CPF,'?'
T Arkansas Nuclear One 2 .1 ,y, , , A;' i :. p n ,MM ',' r Calvert Cliffs 1& 2 1
.$cgc ,, ,
9 . .g , Davis-Besse ,
., r haq -
Kewaunee Millstone 2 i 3--
'W#
4
' , e.e.- 4 Q^ "
Palisades , , ' , , . g- Aant Cass 1 Palo Verde 1,2, & 3 RW"Q,: ,
- > ;WM_
r cu4 y '/ .. :.. p u
,.h
~~
Me * ~ Point Beach 1 & 2 - - 3~. Prano Island 1 & 2 - , M.! ? ,;') E ' q' r , 'L {/' ' N A ,-4% h
- Y f: qq)76, M ? <
San Onofre 2 & 3 t
- 14. 0 W
- W ' k[/?u 4 St. Lucie 1 & 2 i W@ M v .-M J ,r +
. .~ M .'
Waterford 3
.~m_- ". " sS/fWC.q.-...
a.. u. -- 5 A-.- - - : M
%s..w-
.. ,. 6 Crystal River 3 Fort Calhoun - mem Genna *---+.--.t- Aant Gass 2 Oconee 1,2, & 3 '~
Three Mile island 1 aew gypww .- ~n. ,, ~e , r.e,y , 7-.e . gemy,. Beaver Valley 1 >-: d - Beaver Valley 2 Farley 1 & 2 1 Yr"~.' r Ce Wk - ' - H.B Robinson '- 't i "
"/ i '
- e--tm.a -1 r *'
Maine Yankee ' A. > Aant Cass 3 North Anna 1 & 2 ,_ Shearon Harns 1 , s 3 Sumrner 1 ,
. 7,' '
gp pA-+--4 n ;g; *. . . Surry 1 & 2 r <-I A r 1 ... :
. < . ~
wh4
.u- 1
% 2 a.u. w . % % m - - A-Turkey Point 3 & 4 - :- Aant Cass 4 p -- m. - m. m.w pp pym e indian Point 2 , r o -a m W : X"i N
- s. P --
Indian Point ! ;.pg., , - W_o , ,
'pa=== v
~
A-y,.% > d.j f- Aant Cass 5 South Texas 1 & 2 w .ww twa.:.a :. ..
.1 a - ww.u.w w
W'-% td."ns.L,:msa4
.u..muu -
Draidwood 1& 2 Dyron 1 & 2 Callaway : = Catawba 1 & 2 Cornanr:he Peak i & 2 * - -- Cook i & 2 - Diablo Canyon 1 & 2 * - * - " Haddam Neck r* ~ McGuire 1 & 2 Aant Cass 6 Millstone 3 * " - Sawm 1 & 2 - * - Seabrook '" 1 Sequoyah 1 & 2 l +- * . Vogtle 1 & 2 j !
~ ^
Walf Creek Zon 1 & 2
- 1.0 E-O'9 1.0 E-0 8 1.0 E -0 7 1. 0 E -061.0 E -0 5 1.0 E -04 1.0 E-0 3 1.0 E-02 1 DE-01 E H Pl unreliability ocos ons 1 Figure 6. Plot of the PRA/IPE estimates of HPI unreliability (injection phase only). The mean and uncertainty values a: .Niated with this plot are listed in Tables D-3 and D-4 in Appendix D.
I I I I NUREG/CR-xxxx, Vol. x 42 l
Risk-Based Analysis [ 4' Table 'T Average design class unreliability (injection phase only) calculated from the 1987-1997 ( experience compared to the values calculated from the PRA/IPEs. Number 1987-1997 HPI Design Class ofPlants IPE Comparison Experience 1 -(2 HHSI or 2 IHSI; 2 SGs) 20 4.8E-04 8.1 E-04 2-(3 HHSI or 3 HISI; 2 SGs) 7 2.7E-04 2.7E-04 3-(2 IIHSI or 2 HISI; 3 SGs) ( 12 2.1 E-03 9.1E-04 4-(4 IHSl; 3 SGs) 2 9.9E-04 2.8E-04 5-(3 IIISl; 4 SGs) 4 6.7E-04 2.4E-04 6-(2 HHSI,2 DISI; 4 SGs) 27 1.6E-06 6.6E-05 Overall average' 5.7E-04 4.5E-04 Range of estimates for all 72 plants 5.5E-09-5.0E-03 6.0E-05-3.5 E-03
- a. The values are arithrnetic averages.
Table 8. Comparison of the independent failure and common cause failure contribution (for the reference plant in each design class) to the risk-based unreliability (injection phase only) based on IPE data and 1987-1997 experience. Contribution (%) To Unreliability Reference Plant Multiple Independent Common Cause PRA-based Unreliability Failures Failure HPI Design Class 1987-1997 IPE 1987-1997 IPE 1987-1997 IPE l--(2 HHSI or 2 IHSI; 2 SGs) 3.4E-04 9.5E-04 27 9 73 90 2---(3 IIHSI or 3 IHSI; 2 SGs) 2.9E-04 3.2E-04 28 15 72 85 3--(2 IIHSI or 2 IHSI; 3 SGs) 4.8E-04 5.5E-04 18 59 82 41 4-(4 HISI; 3 SGs) 2.8E-04 9.9E-04 5 7 95 71 5--(3 IriSI; 4 SGs) 2.6E-04 3.4E-05 20 <1 80 >99 6--(2 IIHSI,2 HISI; 4 SGs) 6.1E-05 3.5E-08 99 73 * *
- e. No CCFs were identified across the high-head and intermediate-hea/ systems. Only CCFs modeled are within a system.
3.3.3 Maintenance-Out-of Service-Pump Train Segment Table 9 is a summary of the maintenance-out-of-senice estimates found in the PR A/IPEs and the estimates calculated from the 1987-1997 experience. In this study, maintenance unavailability is estimated using the failures and demands when the HPI system was required to supply water into the cold leg (i.e., a reliability parameter). Risk analysis generally accounts for the maintenance-out-of-service { probability as an unavailability estimate (i.e., fraction of HPI down time compared to total plant operating time). In theory (i.e., infinitely large sample), these two estimates should be equivalent. Due to these different calculation methods used for computing maintenance unavailability, the reader is cautioned l when making absolute comparisons of the PRA/IPE and the 1987-1997 experience probability estimates ofmaintenance-out-of-senice. 43 NUREG/CR-xxxx, Vol. x
Risk-Based Analysis Table 9. Pump train segment maintenance-out-of-service probabilities (per demand) calculated from IPE data and 1987-1997 experience. IPE Data 1987-1997 Experience Maintenance-Out-of-Service Average Range Mean 90% Uncertainty Interval High head 2.5E-02 1.3 E 3.3 E-01 5.2E-03 2.0E 2.0E-2 Intermediate head 6.3E-03 3.9E 5.0E-02 3.1E-03 1.2E 1.2E-02 Combined 1.5 E-02 3.9E 3.3E-01 1.9E-03 7.7E 7.5 E-03
- a. The " Combined" value for the IPE Data is an anthmetic average of the high-head and intermediate-head values stated in the g PRA/IPE. g For high-head MOOS, the average of the PRA/IPE estimates is about a factor of five greater than the mean estimate of the 1987-1997 experience. Both the PRA/IPE estimates and 1987-1997 experience estimates for intermediate-head MOOS compare well, about a factor of two. The average of the PRA/IPE intermediate- and high-head MOOS estimates (" Combined") is about a factor of ten greater than the mean probability calculated from the 1987-1997 experience.
3.3.4 Failure to Start-Pump Train Segment Table 10 provides a summary of the pump train segments failure to start probabilities of the HPI pumps found in the PRA/IPEs and the estimates calculated from the 1987-1997 experience. For high- g head I~fS, the average of the PRA/IFE estimates is in good agreement with the mean estimate of the 5 1987-1997 experience. The average of the PRA/IPE estimates of the intermediate- and high-head FTS (" Combined") is about the same as the mean probability calculated from the 1987-1997 experience. 3.3.5 Failure to Run--Pump Train Segment Table 11 is a summary of the failure to nm estimates found in the PRA/IPEs and those calculated from the 1987-1997 experience using the unplanned demands. Since the run times associated with the successful missions were relatively shon and there were no observed failures, the estimate based on the 1987-1997 experience only applies to missions that are relatively short (e.g., one-half hour). Use of this rate on a typical mission stated in the PRA/IPEs would produce unreasonable probabilities ( i.e., the value is too large and therefore is not consistent with no failures being observed). 3.4 Human Error of Commission There was one event identified where the entire HPI system was made unavailable by actions of the control room operators when an SI sienal was present. This event occurred when an operator bypassed the llPI system from actuation durmg a reactor coolant system (RCS) depressurization transient. The bypassing of HPI was inappropriate since he did not receive permission to bypass HPI and the g acknowledgement of the bypass by the Senior Reactor Operator (SRO) was not provided. However, the 3 operator had announced his intention to bypass HPI and operator interviews indicated that the SRO on duty was aware of the bypass. Furthermore, prior to bypassing HPI. the operators used trouble-shooting g strategies during he steady slow decrease of RCS pressure (the pressure decreasing over 19 minutes) g looking for symptoms of a LOCA and pressurizer heater failures. The Operations Superintendent noticed the bypass and was discussing with the SRO the action to remove the bypass when the ES low RCS NUREG/CR-xxxx, Vol. x 44
Risk-Based Analysis Table 10. Pump train segment failure to start probabilities (per demand) calculated for comparisons with PRA/IPE results and 1987-1997 experience. IPE Data 1987-1997 Experience Failure to Start Average Range Mean 90% Uncertainty Intenal liigh head 2.1E-03 2.1 E-04-5.0E-03 3.4E-03 1.4E-05-1.3E-02 Intermediate head 2.4E-03 2.8E-04-9.7E-03 6.5E-03 7.7E-04-1.7E-02 Combined 2.3 E-03' 2. l E-04-9.7E-03' 3.0E-03 3.2E-04-7.9E-03
- a. The " Combined" value for the IPE Data is an arithmetic average of the high-head and intermediate-head values stated in the PRASPE.
Table 11. Pump train segment failure to run probabilities calculated from IPE data and 1987-1997 experience. I IPE Data 1987-1997 Experience Failure to Run Average Range Mean 90% Uncertainty Interval High head 7.7E-05/hr 7.6E-06-5.4E-04 - - Intermediate head 5.8E-04/hr 5.3 E-06-9.3E-03 - - Combined 3.6E-04/hr' 5.3E-06-9.3 E-04' 2.5E-03/hr 9.9E-06-9.5E-03
- a. The " Combined" value for the IPE Data is an anthmetic average of the high-head and intermediate-head values stated in the PRAMPE.
I pressure bistables tripped. At this time the SRO ordered the bypass to be removed, at which time the IIPI I successfully responded. After HPI provided full flow for one minute, the system was once again placed in bypass per the procedure, so that equipment could be manually controlled. Although this event is significant from a procedure compliance perspective (i.e., operator securing a safety system while a valid I HPI actuation signal existed), it was excluded from the unreliability analysis. l This particular EOC was omitted from the HPI unreliability calculations since (a) the error could l not have occurred during a small LOCA or a steam generator tube rupture (SGTR) and the system unreliability is calculated for mitigating these events, and (b) the system was placed in bypass after a minute ofinjection and as a result, the operator error is more likely classified as a " procedure non-I compliance" rather than a system failure. 3.5 Sensitivity of Support System Failures l (Outside HPI System Boundary) on HPl Unreliability Based on the 1987-1997 unplanned demand data, two LER events involving two failures were 1 attributed to support system failures that are outside the HPI system boundary defined for this report. None of these support system failures disabled the entire HPI system. The failures were all related to a single failure of the HPl train failing to operate. In the first event, an inadvertent Si actuation occurred while testing an emergency-diesel generator for operability. The operability test is performed by simulating a loss of ESF Bus voltage concurrent with an SI actuation test signal. The ESF bus was de-energized and a manual SI to the diesel generator was initiated. However, concurrent with the manual SI, an inadvertent SI was generated on both HPI trains when the bus was de-energized. The diesel-generator , 45 NUREG/CR-xxxx, Vol. x
~
Risk-Based Analysis output breaker failed to close resulting in an IIPI train unable to respond to a SI signal. The failure occurred while the plant was shutdown and undergoing refueling, The second event occurred during a loss of offsite power while one of the emergency-diesel generators was inoperable. The plant was at full power at the time of the event. During this event, only one of the redundant IIPI trains responded to the SI actuation. The effects ofincluding these support system failures on the train level failure mode (FTO-ACT-CIIANL) estimates are negligible due to the redundancy of the SI actuation channels. , I I I I I' 1 I I Il I NUREG/CR-xxxx, Vol. x 46 A
i
- 4. ENGINEERING ANALYSIS OF THE 1987-1997 EXPERIENCE This section documents the results of an engineering evaluation of the 1987-1997 operational experience of the llPI system obtained from LER data. The M ttive here is to analyze the data and provide insights into the performance of the HPI system thrognout the industry, and at a design class and plant-specific level. Because of the sparseness of the failures in the unplanned demand data, segment failures that occurred during unplanned demands, surveillance tests and other routine plant operations were used to develop trends and failure frequencies. The failures found during surveillance tests and other routine plant operations are also discussed in qualitative terms. The following paragraphs summarize the major findings in this section of the report.
- Trends were identified in the frequency of the HPl unplanned demands, which includes both actual SI and inadvertent SI actuations. When modeled as a function of both calendar year and low-power license dates (plant age), the unplanned demand frequency exhibited a I statistically significant decreasing trend. Excluding the inadvenent and spurious SI actuations from all SI actuations (i.e., actual SI actuations) resulted in an unplanned demand frequency that exhibited a statistically significant decreasing trend when modeled as a function of both calendar year and low-power license dates. The frequency of failure events observed during unplanned demands and other detection methods such as testing were analyzed to determine trends. When modeled as a function of both calendar year and low-I power license dates, both factors were statistically significant. Statistically significant decreasing trends were also identified in the frequency ofinadvertent and spurious SI actuations when modeled against calendar year but not against low-power license dates. No other trend analysis indicated a statistically significant trend.
- Only three actual HPI segment failures were encountered during unplanned demands.
I Therefore, the HPI segment failures reported in all LERs were reviewed to determine the factors affecting overall system reliability. The LER review identified 125 failure events consisting of I84 HPI segment failures observed from 1987 through 1997. None of these failures resulted in complete system failure, at least one train was fully operable and I providing adequate flow to the cold water leg (s). Included in these 184 failures, were several instances where multiple independent trains did not function as designed. These cases were attributed to either common cause failures or an error of commission. Actual I recovery from segment failures or failuresjudged to be recoverable, were observed in approximately 20% of the observed failures. Segment failures attributed to personnel error were recovered about 40% of the time. Segment failures attributed to hardware, design, and other categories were recovered in approximately 10% of the observed events. Common cause failure was a leading contributor to HPl unreliability as indicated previously in Section 3. Twenty-one CCF events (approximately 17% of the 125 failure events) were I identified in the 1987-1997 operating experience that either resulted in multiple failures or exhibited the potential to fail multiple segments. In the unplanned demand data, there was only one event categorized as a potential CCF event where Emergency Safeguards (ES) I actuation was bypassed by an operator (human error of commission). However, since the trains were restored upon receipt of the SI actuation signal and the ES bypass was put in place one minute after HP1 actuation, this event was not considered in the HPI unreliability I model. The CCF events that were detected other than during an unplanned demand resulted in 48 HPl segment failures. I NUREG/CR xxxx, Vol. x 47
r Engineering Analysis
- The leading IIPI segments involving CCF events were the intermediate-head pump (7 CCF events involving 14 failures) and the high-head pump (7 CCF events involving 12 failures). The injection header segment had 4 CCF events involving 18 failures, g while the RWST suction segment had 3 CCF events with 4 failures. 3
- liardware and personnel problems accounted for approximately one-half of the CCF events. Testing identified 30% of the CCF events associated with hardware and personnel. Overall, testing resulted in the about one-third of the CCF events identified in the 1987-1997 operating experience. Design / review and tour of the plant resulted in approximately one-third of the CCF events being identified.
- The distribution of the 184 segment failures showed that the high-head pump segment (53),
intermediate-head pump (49), injection header (30), and cold leg injection path (31) comprised about 90% of the failures. Of these 184 segment failures, hardware was the leading cause (approximately 41%) followed by personnel-related problems (29%).
- The injection header segment failures were primarily caused by hardware malfunctions,66%. Personnel error in the operation of the system contributed to about 31% of the failures. Of the cold leg injection path failures, personnel, procedme and hardware problems accounted for about 30% each of the failures.
- Of the high-head pump segment failures,73% were classified as failures to run and 27% as failures to start. For the failures classified as failures to run, hardware was the g leading cause (30%). The remaining causes of failure to run were not dominated by any particular cause. In particular, there were no failures attributed to environmental 5
problems.
- Of the intermediate-head pump segment failures, approximately 61% were classified as failures to run and 29% as failures to start. Approximately 47% of the intermediate-head pump failures were hardware related, while personnel-error-related g failures accounted for 27%. No other cause category contributed to a significant E percentage of failures.
. While failures attributed to design-related problems were a relatively small contributor to the total number of failures (13 of 184),in one particular event all safety injection trains were blocked due to design. (The safety injection is blocked when the reactor trip breakers are open and a second SI signal is received.)
- Based on the failure categorization used for this study, testing is the leading method for detecting failures. Overall, testing identified approximately 35% of the failures identified in E the 1987-1997 experience compared to the next leading detection method, design / review, E 21%. Approximately 12% of the failures were detected during an actual demand for llPI (4% of the failures during an actual SI demand (the percentage includes the EOC, a design- g related failure and two support system failures) and 8% during a demand for liPI other than g the result of a SI actuation].
. in addition to the above findings, the contnbution of support system failures was relatively small. Only 5 failure events (8 failures) out of the 125 failure events (184 failures) were attributed to support system failures. Of the five failure events, three events involved six high head pump failures while the remaining two resulted in 2 train failures. The six high-head pump failures were the result ofloss of component cooling water. The two train failures occurred during an unplanned demand. The train failures were related to an emergency diesel generator not prr ' ding power to the 4 Kv emergency bus. One event a NUREG/CR-xxxx, Vol. x 48
o Engineering Analysis diesel generator was down for maintenance while the other event the diesel generator output breaker did not close. Sections 4.1 through 4.3 provide a detailed summary of the industry data supporting the above results. Additional insights were derived from (1) an assessment of the operational data for trends and pattems in system performance across the industry and an evaluation of the relationship with low-power i license date, and (2) identification of the factors affecting segment reliability in the industry. 4.1 Industry Trends This section provides the results ofindustry trend analyses. The analyses include HPl unplanned demands (Si actuations) and segment failures plotted against calendar year and low-power license date. The frequencies of unplanned demands or failures provided in the figures are the number of events
-{ unplanned demands or failures) that occurred in the specific year divided by the total number of plant operational years for the specific year. Plant operational years were estimated as described in Section A-2.2.4 of Appendix A. The estimated frequencies and 90% confidence intervals are plotted in each figure in this section. A fitted trend line, and 90% confidence band on the fitted line, is also shown in the figures.
4.1.1 Trends by Calendar Year and by Age Tabic 12 provides the HPI segment failures and unplanned demands that occurred in the industry for each year of the study period. Table 12 is a complete list of failures in the database. (There were no failures classified as maintenance-out-of-service events and only several support system failures were identified. The inclusion of the support system failures does not affect the inferences made.) 4.'I.1.1 Trend in Unplanned Demands (St Actuations) by Year. Figute 7 is an illustration of the HPl system unplanned demand frequency (all Si actuations) as a function of calendar year. The dots and vertical lines are point estimates and 90% confidence intervals for the frequency, each calculated using data for only one year. The estimated frequency is the number of events (ESF actuations resulting in HPl demands) that occurred in the specific year divided by the total number of plant operational years for the rpecific year. The fitted frequency, assuming an exponential trend, and a 90% confidence band for the frequency are also shown. This analysis ignores the possible effect of plant age, and so is incomplete. Additional analysis was performed to look at the effect of plant age, as described in Sec. 4.1.1.3 I As shown in Figure 7, the frequency of unplanned HPl demands per plant operating year decreased from approximately 0.6 in 1987 to approximately 0.2 in 1997. The trend is statistically significant. The p-value of the fitted trend line is 0.0001. The fit is good but the calculations do not include the possible effect of age of the plant, as discussed in the next subsections. Table 12. Number of HPI events by category for each year' of the study. Category 1987 1988 1989 1990 1991 1992 1993 1994 1995 1996 1997 Total ESF Actuations 38 36 39 26 23 18 10 10 10 5 9 224 Automatic / Manual 15 16 20 3 11 6 4 2 2 2 4 85 Inadvertent / Spurious 23 20 19 23 12 12 6 8 8 3 5 139 Failure Events 13 17 13 15 13 17 2 14 4 11 6 125 Number of Failures 22 22 17 30 18 26 3 21 4 14 7 184 6 Plant operating years 64.3 67.2 69.5 70.9 71.0 71.2 71.9 72.0 72.0 72.2 70.0 772.3 6 Plant critical years 45.5 50.7 50.5 52.5 56.1 57.1 56.1 59.2 59.2 58.1 52.0 596.9
- c. Each entry consists of the number of events that occurred m that calendar year.
b Plant operstmg years and entical years are computed from low-pomer hcense date 1 I 49 NUREG/CR-xxxx, Vol. x
1 Engineering Analysis 0.9
; 4 MLE and 90% conf. interval I g 0.8 _
Fitted rate f
------ 90% conf. band on the rate k0.7 'n
'E
- 0.6
--. ~
g - p 0.5 -
,\ ' ,
's.
0.4 " .'. f 0 .3 N, o .. , 30.2 -D.N,f ..f...,, g,
~ .. .. % ,........ f 25 0.1 1 l' "i 1
~
I i ! I t i i i i t i 90 92 93 94 95 96 97 5 87 88 89 91 oco8 om 5 Year Figure 7. Frequency (events per reactor-calendar year) of all Si actuations, as a function of calendar year, with confidence limits on the individual frequencies. The decreasing trend is highly statistically gl 5 significant (p-value is 0.0001). liowever, the analysis assumes that the frequency does not depend on { plant low-power licc nse date. { 4.1.1.2 Trends in Unplanned Demands (SI Actuations) by Low-Power License Date. To give some indication of the effect of plant aging (i.e., older plants versus newer plants) on llPI demands, a trend of plant-specific unplanned demand frequency was plotted against the low-power license date. Figure 8 shows the frequency of all Si actuations as a function the low-power license date. The trend was not quite significant (p-value = 0.06) and some lack of fit was seen, apparently caused by variation between plants. Ilowever, this model did not consider the effect of calendar year. an coM. h al 1'5 _ Fitted rate g - - ---- 90% conf. band on the rate U - f E -
.E 1.0 ,
?
~
.I .( r 2 ;
8 f, , e p'rH
- ! < ; o ir
~ '
4 e
- 8 05 k4
. i
._ , !! y' eh..4 -
j .{.f" ...r**- 4 .IIJ. 1,yyyCE*7 ~; t*' 4
*t -
ts ;1 ___ T r-+td::q~~*91 j'
* ~
f~== *'
?f M ,?-
1 A**M}*}t%~Jg*[h
^ ' ^M ;
- i j
! 4 l
0.0 -* ?=* *1
^ ^
^
- l 67 69 71 73 75 77 79 81 83 85 87 89 91 93 Low-power license date ocoo em ' E' E
Figure 8. Frequency (events per reactor-calendar year) of all Si actuations, as a function oflow-power license date. The trend is not quite significant (p-value = 0.06), and some lack of fit is seen. Each point corresponds to a single plant and ignores the effect of calendar year for the plant. NUREG/CR-xxxx, Vol. x 50
Engineering Analysis 4.1.1.3 Trends in Calendar Year and Age, Considered Together. In Figute 7, the Si actuation frequency was shown to be decreasing with calendar year, when the plant data were pooled within each year. Figure 8 suggests that the same Ote may depend on plant age, when the data from 1987 to 1997 were pooled within each plant. Both trends were plausible: the calendar year reflects industry-wide culture and regulations, which have resulted in a decreasing rate of scrams, and the low-power license date reflects the experience and learning at the particular plant. To identify the tmly significant efTects, the two variables were analyzed in a single model, presented here. The two variables can be event date and low-power heense date, or they can be expressed as event date and age of the plant when the event occurred. The information is equivalent, because age is event date minus low-power license date, in practice, estimates using the two models are almost equivalent, because the dates and ages must be grouped into bins, such as one-year bins. The resulting round-off can cause small differences between age (to the nearest year) and event year minus low-power license year. To obtain accurate as'sessment of goodness of fit, it was necessary to pool plants with the same 1:w-power license year. The fit was acceptable (p-value for lack of fit is 0.2). When the Si frequency was modeled as a function of both calendar year and low-power license year, both factors were statistically significant (p-values of 0.0001 and 0.014, respectively). The fitted equation is A = exp(15.5090 - 0.2086y + 0.02841) where A is the frequency,y is the two-digit calendar year, and Iis the low-power license. If a is defined asy- 1, the approximate plant age when the event occurred, this equation translates to A = exp(15.5090 - 0.1802y - 0.0284a) . Figure 9 plots the frequency as a function of calendar year, for hypothetical plants of several ages. This plot provides better insights on the frequency of Si actuations than Figures 7 and 8, because it takes both year and age into account. 1.0 Age 0 in 1987
- - Age 10 in 1987 g
Age 20 in 1987 g 0.8 7
,m -
)y o
0.6 -
's N s
N e -
's j0.4 N.- 's
's 8 '
; 73 0.2
~~_
0.0 87 88 89 90 91 92 93 94 95 96 97 Y6af GC99 0166 4 Figure 9. Frequency (events per reactor-calendar year) of all Si actuations, as a function of calendar year, for hypothetical plants of several low-power license dates. 51 NUREG/CR-xxxx, Vol. x
Engineering Analysis Technical details of the analysis method are given in Section A-4 of Appendix A. Two subsets of SI actuations are also ofinterest:
- Automatic and manual actuations (actual unplanned demands). Nearly all of these occur during reactor criticality, so the frequency is calculated as events per reactor-critical year. The trend in automr. tic and manual actuations is ofinterest since these events are indicative of situations where the RCS deviated from the normal conditions.
. Inadvertent and sp9rious actuations. These occur during both criticality and shutdown, so the frequency is calcuhted as events per reactor-calendar year. The trend in inadvertent and spurious actuations is ofinterest since these events are indicative of human errors or malfunctions that would initiate St.
4.1.1.4 Trend /n Actual Unplanned Demands. The frequency of automatic and manual actuations was modeled as a function of both calendar year and low-power license date. Both factors were statistically significant. This data set was relatively small (only 85 events). Therefore, tojudge the goodness of fit accurately it was necessary to pool data from plants with the same low-power license year, and to group the low-power license dates and the calendar dates into two-year bins. When this was done, the fit was very good (p-value for lack of fit = 0.41). Both calendar year and low-power license year were statistically significant (p-valuet of 0.0001 and 0.002, respectively). Figure 10 plots the frequency against calendar year, for three hypothetical plants of different assumed low-power license years. The frequency is the mean number of events (automatic or manual ESF actuations resulting in HPI demands) in the specific year divided by the total number of plant critical years for the specific year. 4.1.1.5 Trend in inadvertent Unplanned Demands. The frequency ofinadvertent and spurious actuations was also modeled as a function of both calendar year and plant age. In this case, calendar year was statistically significant (p-value = 0.0001) but plant age was not statistically significant (p-value = 0.5). Therefore, the frequency was modeled as a function of calendar year only. 0.8 Age 0 in 1987
-- Age 10 in 1987 Age 20 in 1987 0.6 ~
E E. g h 0.4 - E s N 5 's
!! 's E
$ 0.2
~, '
g N s
~~.___ x' ~ __
l 87 88 89 90 91 92 93 94 95 96 97 Year ocescass Figure 10. Frequency (events per reactor-critical year) of all automatic and manual SI actuations, as a function of calendar year, for hypothetical plants of several low-power license dates. To avoid clutter, confidence bands are not shown. NUREG/CR-xxxx, Vol. x 52
Enginecting Analysis Figure 11 is an illustration of the HPI system inadvertent unplanned demand frequency for each year of the study. The figure includes fitted trend lines and 90% confidence bands for the fitted trend. The frequency is the number of events (inadvertent or spurious ESF actuations resulting in HPI demands) that occurred in the specific year divided by the total number of plant operational years for the specific year. It is interesting to compare the mod :s for automatic / manual actuations and for inadvertent / spurious actuations. Plant age is a factor for the first type of actuation but not for the second. That is, plants seem to have a relatively high initial frequency of automatic and manual actuations, which they I leam to control. In contrast, there is no such learning period for inadvertent and spurious actuations. Overriding all this is the clear tendency of the industry to have fewer actuations now than ten years ago. Trend in Failure Events. HPI failure events reported in LERS were also trended. These did not I necessarily occur during unplanned demands that could be counted easily, so the frequency of failure events is expressed here as events per reactor-calendar year. When modeled as a function of both calendar year and plant age, both factors were statistically significant. To accurately assess the goodness I of fit, it was necessary to group calendar years and low-power license years into two year bins. When this was done, the fit was poor (p-value for lack of fit = 0.0006). Between-plant variation appeared to be an important contributor to the lack of fit. Therefore, plant-specific effects were added to the model. To use the plant information, the low. power years were not collapsed. The calendar years were combined into two-year bins, however, to allow I for accurate assessment of the goodness of fit. When this was done, the fit was good (p-value for lack of fit = 0.4). Both calendar year and low-power license date were statistically significant (p-values of 0.02 and 0.03, respectively). The litted frequency is plotted against calendar year in Figure 12. This is an industry average, not reflecting individual plant differences. The fitted frequency uses an equation that correlates the failure event frequency to the plant age measured from low-power license date and the calendar year. Three hypothetical plants are selected by setting the plant age to zero, ten, and twenty dunng 1987 and generating a family of three fitted curves for three hypothetical plants. The results differ slightly from the above plots of the same form, in that the younger plants have I lower failure frequencies than the older plants. In Figures 9 and 10, the younger plants had higher frequencies of actuations. When relating these two facts, one must remain aware that most of the failures did not occur on automatic or manual unplanned actuations. Various numbers of components failed during the failure events. In all, the 125 events had 184 failed components, with some events having multiple failed components (e.g., one event having 10 failed components). This "10 failure" event resulted from 10 MOV torque switches being relaxed, and was I found during a troubleshooting activity. A graph, not presented here, showed that the multiple failures seem to be scattered randomly over the study period. Therefore, they are not analyzed further here. I 4.1.1.6 Segment Failure Events. To determine if any one segment type had an affect on the failure trend identified in Figure 12, the HPI segment failure events were partitioned by the three major segment types: high-head pump, intermediate-head pump, and injection header / cold leg injection path. This partitioning was chosen because the failure events in the partition represent approximately 85% of all the I reported HPI failure events. The failure events are considered, not the individual segment failures, because some events involve multiple segments, but the timing of the multiple failures appears to be random. Figure 13 shows the cumulative failure event counts for the major segment types. The slope of I the cumulative line represents the approximate frequency of failure events per calendar year. - 53 NUREG/CR-xxxx, Vol. x
Engineering Analysis { 0.9 4 MLE and 90% conf. interval 0.8 [ Fitted rate 0.7
- --- 90% conf. band on the rate 4 0.6 -
5
' E y 0.5 -
- E ,
s j 4
- .N '-
' , g
'5 0.3 -
%' 5 g -
+'N.. ,
, ~. ... ,_
I ' ( g 02 -- " N' ~~- vy . z w -
' '7 0.1 0.0 1
DWM-- ... 3 9 ; i 87 88 89 90 91 92 93 04 05 96 97 Year GC8558 Figure 11. Frequency (events per reactor-calendar year) ofinadvertent and spurious SI actuations, as a g function of calendar year. The effect of low-power license date was not statistically significant, and so is 5 not modeled. 0.5 Age 20 in 1987
- - Age 10 in 1987 5 Age 0 in 1987 g 0.4 -
a
?
_e
@ 0.3 O -
t -
). 0.2
'-_- ~-%
.. ~'~--~
g - 76 0.1 -
- u. ,
0.0 3 87 88 89 90 91 92 93 94 95 96 97 ceu n2 gj Year Figure 12. Frequency (events per reactor-calendar year) of all HPI failure events, as a function of calendar year, for hypothetical plants of several low-power license dates. - I 1 NUREG/CR-xxxx, Vol. x 54 ; l
Engineering Analysis 45 { 40 -
---- High-head pump Intermediate-head pump ' ,-
Injection header / cold leg path ,- 35 - [ 3 '
,.-- /
E 30 7 - t 1. { as / y 25 - [ .i 20 - L 3s
/
$15 -
d ,' l [ 10 -
/
5 - ' 0 ' ' ' ' ' ' 87 88 69 90 91 92 93 94 95 96 97 Year oca nn s fL Figure 13. Cumulative numbers of segment failure events, for three classes of segments, plotted by calendar year. For all three classes of events, the slope is roughly constant, indicating a roughly constant [ frequency. The high-head pump segment events show a slight curvature in the cumulative line, the injection header / cold leg path shows a smaller curvature, and the intermediate-head pump segment events show no curvature at all. The curvatures, with steeper slopes on the left than on the right, correspond to [ slightly decreasing frequencies. An analysis, not presented, shows that the decreasmg trend for the high-head pump failure event frequency (events per reactor calendar year)is statistically significant (p-value =
. 0.02). This is not at all surprising, in view of the decreasing trend for failure events as a whole. A full ~
analysis would examine each of the three types of failure events, normalizing by reactor calendar years and accounting for the possible effect oflow-power license date. This is not done here. It was done for the failure events as a whole, and repeating it for each segment type would have little or no additional value. { 4.2 Factors Affecting HPl Reliability [ (Failures identified During SI Actuations) The HPI segment failures were reviewed to determine the factors affecting overall system e reliability. This review primarily focuses on the causes and mechanisms of the segment failures that have a dominant impact on system unreliability. Section 4.2 discusses only those failures observed during the unplanned demand (SI actuation). Segment failures found as a result of a surveillance test or from other methods are not presented in this section. Since CCFs are a dominant contributor to unreliability, those { events are also discussed in Section 4.2. Section 4.3 provides a qualitative discussion of the failares found during surveillance testing or other detection methods. r , 55 NUREG/CR-xxxx, Vol. x
l Enginsering Analysis 4.2.1 System Reliability The IIPI system consists of multiple independent trains that increase the reliability of the system because a single component or train failure will not disable the system's safety function. There were no system failures during unplanned demands. liowever, failures of two or more llPI trains were obsen ed in the other llPI failure events. Since CCFs are the dominant contributor to IIPI unreliability, these events are described in this section. Twenty-one CCF events (approximately 17% of the 125 failure events identified Table 12) were identified in the 19T ' -1997 operating experience that either resulted in multiple failures or exhibited the potential to fail mun.ple segments. The CCF events that were detected other than during an unplanned demand resulted in 48 HPI segment failures. The leading IIPI segments involving CCF events were the intermediate-head pump (7 events involving 14 failures) and the high-head pump (7 CCF events involving 12 failures). The injection header segment had 4 CCF events involving 18 failures, while the RWST suction segment kd 3 CCF events with 4 failures. liardware and personnel problems accounted for approximately one-half of the CCF events. Testing identified 30% of the CCF events associated with hardware and personnel. Overall, testing discovered about one-third of the CCF events identified in the 1987-1997 operating experience. 3 Design / review and tour of the plant resulted in approximately one-third of the CCF events being 3 identified. 4.2.1.1 CCFs of the Intermediate-head pumps. The seven common cause failure events associated with the intermediate-head pump segments were attributed to two hardware problems, two environmental problems, two procedure problems, and a personnel error. Six of these events were related to failure to run and one as a failure to start. The hardware problems were failures related to the intermediate-head pump mini-flow recirculation lines. In one event, the mini-flow recirculation lines were frozen due to the failure of a heat trace temperature switch. In the second hardware related event, a leak on a socket weld on the common pump recirculation line caused all Ntermediate-head pumps to be inoperable. The environmental problems were the result of mini-flow recirculation line obstruction. In one event, both safety injection pumps failed to satisfy the minimum recirculation flow required for the periodic test. The apparent cause of the low recirculation flow in the pumps was a restriction in the pump recirculation line. The restriction was dislodged or elimmated from the recirculation line during the g investigation. In the second environmental event, the restriction or obstruction was a result of a frozen g section of the pump recirculation line piping. A portion of the piping line,just before the Refueling Water Storage Tank passes through the Purge Room inside the duct of the Inlet Plenum for the Purge Supply. With below freezing conditions in the outside environment, this area could see freezing temperatures. Corrective actions include rerouting the piping and installing a temporary heat trace with administrative controls to eliminate the conditions for a pipe freeze. A future modification was planned to reroute the pump mini-flow recirculation line. The personnel-error-related CCF event was detected during testing. Following performance of an unscheduled sun'eillance test to demonstrate Safety Injection system operability, Safety Injection pump "B" was declared inoperable due to inadequate recirculation flow. Safety injection pump "A" was also declared inoperable due to an observed declining trend in the pump's recircuhtion flow. Although the recirculation flow acceptance criteria was satisfied, after consultation with the licensee's Operations Manager, the pump was conservatively declared inoperable based on a greater than ten percent decline in flow rate frora the last three tests. The cause of the Safety injection pump "B" reduced recirculation flow is attributed to foreign material blockage within the associated mini-flow recirculation flow onfice. NUREG/CR-xxxx, Vol. x 56
Engineering Analysis Plastic sheeting was found in the pump discharge recirculation line. The blockage of the flow limiting orifice in the Safety Injection pump recirculation piping prevented the mini-flow recirculation flows needed to assure reliability of the pump during periods when the pump is not flowing water to the Reactor Coolant System. During periods of operation under minimum recirculation flow conditions, this recirculation flow provides the only source of cooling to the pump. This event was identified by the ASP Program" and was assigned a CCDP of 3.5E-05. The procedure-related problems were due to the control power fuses being removed while the plant was in mode 4 and a potential CCF due to the improper gasket installation and assembly of two motor coolers for the intermediate-head pump, 4.2.1.2 CCFs of High-headpumps. The seven common cause failure events associated with the high-head pump segment were caused by tv.o design-related events, two gas binding events, and one event each for procedure, maintenance, and hardware. Six of these events were classified as failure to mn and one as failure to start. The design related problems were related to the alternate mini-flow (AMF) lines and inadequate ventilation of the cubicle containing the high-head pumps. These alternate mini-flow (AMF) lines are designed to protect the high-head pumps, which provide high head safety injection as well a normal charging, from deadhead operation during accidents where the Reactor Coolant System (RCS) repressurizes after safety injection is actuated. Damage to relief valves and drain connections on these AMF lines were such that a significant portion of the safety injection flow would have been diverted from the RCS. The system was repaired and procedures were revised to preclude recurrence. The AMF lines were modified to eliminate the use ofrelief valves. The modified system uses orifices and revised motor-operated valve logic to protect the high-head pumps from deadhead operation. This event was identified by the ASP Program and was assigned a CCDP of 6.3E-03. The inadequate ventilation of the high-head pumps was determined during a design review. The actual measured ventilation flow from each high-head pump cubicle was found to be less than the flow-rate required by the calculations to maintain motor temperatures within required Emironmental Qualification limits. An investigation determined that a manual isolation damper, common to all three high-head pumps, was failed in a partially closed position. The damper was repaired and placed in the proper position to meet flow requirements. A gas binding problem associated with the high-head pumps occurred when an attempt was made to placing a charging pump in service and securing the operating pump. When the running pump was stopped, the operator observed fluctuations in pump flow and motor current on the operating pump. The pump was secured after retuming the standby pump to service. After venting the pump casing and discharge piping, the pump was restarted. Similar fluctuations in pump flow and current were observed, and the pump was again stopped. The pump casing and discharge piping were again vented. The pump suction piping was also vented without complete success. The venting operations continued and a length of piping from the residual heat removal (RilR) heat exchanger discharge to the high-head pump suction header was vented. The pump was started and normal operating parameters were observed. The pump was subsequently tested. Vibration diagnostics, pump flow, and discharge pressure indicated acceptable pump performance. Ilowever, non-intrusive ultrasonic testing indicated that a small pocket of gas was present in the horizontal section of suction piping from the RiiR discharge to the high-head pumps. An evaluation of the event concluded that hydrogen gas was coming out uf solution and accumulating in certain pipe locations. It was subsequently determined that hydrogen gas had been coming out of solution on both units and accumulating in the suction piping as a probable result of gas stripping by the mini-flow orifices. In sddition, entrainment of hydrogen bubbles from the volume control tank to the suction piping may be a contributor as well. In the original plant design, the mini-flow.retumed to the VCT rather than to the pump suction line. liowever, as a result of a Westinghouse generic letter conceming the potential for overfilling the VCT after swap-over from the 57 NUREG/CR-xxxx, Vol. x
Engineering Analysis
)
1 VCT to the RWST, the mini-flow was rerouted to the high-head suction line downstream of the VCT outlet valves. This event was identified by the ASP Program and was assigned a CCDP of 6.0E-04. The other gas-binding-related failure of the high-head pump, as the result of shaft cracking, was l' attributed to impact loading due to gas. In this event, an operational surveillance test showed that a charging pump could not meet the required performance criteria. The pump was declared inoperable and a spare pump was installed in its place. The pump shaft was cracked. The crack was believed to result from abnonnal impact loading on the pump. The abnormal loading is attributed in part to gas voids in the suction during pump stans. Nuclear Regulatory Commission (NRC) Information Notice 88-23, " Potential for Gas Binding of liigh-Pressure Safety Injection Pumps During A Loss of Coolant Accident,"" dated May 12,1988, alerted licensees to potential problems resulting from hydrogen transport from the volume control tank and accumulation in emergency core cooling system piping. The high-head CCF identified as maintenance related was detected when smoke was discovered g coming from the speed increaser unit for a centrifugal charging pump (CCP). Upon disassembly of the E CCP speed increaser, the internals were found damaged. Further investigation found the two gland seal (GS) retaining bolts inside the speed increaser lube oil pump (SILOP) backed out allowing the GS to g loosen. The GS being loosened caused reduced oil flow to the speed increaser internals and ultimate g damage. The SILOPs for the two other CCPs were inspected, and the same GS bolts as on the first pump j were found loosened. The cause of the bolts backing out was determined to be lack of a periodic adjustment of the GS bolts. It was discovered during the investigation that the original SILOPs for three of the four high-head pumps had been replaced with incorrect SILOPs. Only one high-head pump did not have the original SILOP replaced with an incorrect SILOP. The replacement SILOPs had been ordered using an incorrect pan number. The replacement SILOPs were rated for 900 rpm and incorporated a compression packing seal which requires periodic adjustment as the packing wears. The original SILOPs ' were rated for 1,800 rpm and incorporated a mechanical seal which does not require adjustment. The major cause of this event was that the replacement SILOPs were the wrong SILOPs that incorporated the packing seal, and no program was in place to periodically tighten the gland bolts. The SILOPs were replaced with 1800-rpm pumps. To prevent recurrence, a new procurement program that provides I additional independent review / verification was instituted. This event was identified by the ASP Program l and was assigned a CCDP of 3.8E-04. 1 The procedure related event occurred following an overhaul ofIfigh-Pressure Injection (IIPI)/Make Up and Purification Pump P36A. System Engineering requested simultaneous operation of P36A and its auxiliary oil pump P64A for post-maintenance testing of repairs to the lube oil system control valve. During the test run, System Engineering observed that approximately one cup of oil per minute was flowing from the outboard pump bearing area. Funher investigation revealed that a similar condition existed on pump P36C, although the oil loss was not as significant. An attached shaft-driven pump provides lubrication to the llPI pump bearings and gear drive. An electric-driven auxiliaty lube oil pump provides lubrication during pump startup and shutdown. The auxiliary lube oil pump is operated I for approximately one minute prior to starting the HPI pump. It is also started prior to stopping the IIPI i pump and allowed to continue running for at least one minute after the llPI pump is stopped. The I d auxiliary pump does not normally run while the llPI pump is running except during an Engineered Safeguards Actuation System (ESAS) actuation, during which the pump starts au:omatically and runs until manually secured. During an ESAS actuation, the low oil pressure trips of the IIPI pumps are bypassed. The bypass allows the HPI pumps to start even if oil pressure has not built up and prevents the HPI pumps from tripping on low lube oil pressure during an ESAS actuation. Proper distribution oflube i oil between the pump bearings and the high-speed gear drive is accomplished by adjustment of a hand control valve. Additionally, a pressure control valve that relieves back to the sump is installed to . NUREG/CR-xxxx, Vol. x 58
1 Engineering Analysis compensate for system overpressure conditions. It was concluded that this condition represented a common mode failure mechanism act that simultaneous operation of the IIPI pump and the associated auxiliary lube oil pump for extended periods could resuh in excessive oil loss from the system and subsequent failure of the pumps. The root cause of the oil leakage from HPI pump bearings during simultaneous operation of the HPI pumps and their associated auxiliary oil pumps was lack of procedures for adjustment and verification of setpoints for either of the lube oil control valves. Not having had these procedures in place could have resulted in the control valves being improperly adjusted at any time since initial plant operation. The high-head CCF event identified as hardware related resulted in both HPI pumps being damaged due to operation with an inadequate suction source. Both Letdown Storage Tank (LDST) level instruments erroneously indicated level was 55.9 inches for about one hour and forty-five minutes prior to the damage to the HPI pumps. However, at the time of the failure, the tank was essentially empty. Subsequent investigation determined the reference leg of the LDST level to be partially drained. The root cause is a combination of a design weakness of a common reference leg for the LDST level instruments I and a leaking instmment fitting due to an inadequate work practice. This event was identified in the ASP Program and was assigned a CCDP of 6.0E-04. 4.2.1.3 CCFs ofinfection headers. The four common cause failure events associated with the I injection header segment were attributed to two hardware problems and two personnel error related problems. One of the personnel-related CCF events was the result of an operator closing two SI pump discharge header isolation valves. The second personnel CCF was due to flow rates being low in three I legs of one HPSI loop and two legs of the other loop. The vendor for HPSI isolation valves made an error in fabrication draveings by incorrectly referencing an improper drawing for the valve disc plug. The first hardware related CCF event was attributed to the relaxation of spring packs due to spring pack fatigue in 10 MOVs of the high-head and intermediate-head injection headers. The MOVs are equipped with a motor operator that is controlled by a torque switch that senses movement of a spring I pack. The spring pack is used in conjunction with the torque switch to control the valve stem thrust. A drive worm screw provides compression to the spring pack, which in tum regulates the desired torque from the operator. Excessive relaxation of the spring pack could allow the torque switch to actuate at less than the desired value of stem thrust and result in premature cutout of the actuator motor. The second hardware event was identified earlier in the section describing the thermal aging of the relays in the injection header MOVs. The hardware related CCF event was detected as part of a re-I assessment of NRC Information Notice (IN) 92-27"," Thermally Induced Accelerated Aging and Failure ofITE/Gould AC Relays Used in Safety-Related Applications." It was identified that the failure mechanism described in the IN potentially exists for ITE/Gould J12 relays. The re-assessment was part I of an evaluation to address six J12 relay failures that occmTed (two in 1995 and four in 1996). The six J12 relays functioned as designed in response to an Engineered Safety Feature (SI) signal during testing. Inspection of J12 relays removed during a refueling outage identified that these relays had the potential to bind. Subsequent bench testing of a suspect J12 relay revealed that this relay will overheat, if mechanically bound, and potentially cause a short circuit. Such a short circuit could result in failure of the control power fuse for the component, rendering the component inoperable. Of the six bad relays, three were associated with the charging pump suction from the RWST, isolation of the VCT and the I Boron Injection Tank isolation. 4.2.1.4 RWSTsuction. The three common cause failure events associated with the RWST suction I segment were attributed to a hardware problem, a design problem, and a personnel error. The design-related event occurred when level indication for the RWST was determined to be inoperable. The sensing
. lines'had frozen due to subfreezing outdoor temperatures. Although the piping to the RWST level 59 NUREG/CR-xxxx, Vol. x
__.__.___a
Engineering Analysis l l instrument lines was insulated and heat traced, the instrument root stop valve was not insulated and the electric heat trace wire on it was not wrapped around the valve. Additional heating was applied to thaw the affected lines and retum them to service. l l The second hardware event was identified in the previous section describing the thermal aging of i the relays in the injection header MOVs. These relays were also found in the RWST suction segment as j well. j i The personnel error event was detected during a review. The event describes that the breakers for l the liigh-Pressure Injection suction valves from the Borated Water Storage Tank were inadvertently left I tagged open after the Reactor Coolant System had been heated up to greater than 350 degrees Fahrenheit. j l 4.2.2 Actuation Channel Reliability In the unplanned demand operational data there was one event in which a SI actuation train ofIIPI l failed to operate. In this event, the reactor was in the cold / refueling condition and an inadvertent safety injection occurred. Only the A train SI logic actuated and no containment ventilation isolation signal was received. All "A" train' equipment not in pull stop operated as designed. Other SI equipment did not operate as it was either in pull stop for testing or was "B" train actuated. The underlying cause of the inadvertent SI was determined to be procedural inadequacy. The failure of the B train Si logic to actuate was due to mechanical interference between the plunger of a relay installed during the 1989 outage and a wire moved subsequent to the relay installation. This wire was moved for Engineering Work Request. The underlying cause of the failure of the "B" train Si logic to actuate due to the mechanical interference was because the installation and inspection requiremee of the system modification overlooked the possibility of mechanical interference. The failure of the B train SI logic and the containment ventilation isolation to actuate was due to modifications performed during the outage. The scheduled post modification testing would have identified the above problems assuming the test is perfect. Labels were later installed on appropriate latching type relays to wam not to obstruct the operation of the relay plunger. 4.2.3 Intermediate-head Pump Reliability While the plant was in a shutdown condition, an inadvertent Si actuation signal started all in-service equipment except one of the safety injection pumps which did not start as expected. This failure to start appears to be due to an intermittent failure mechanism that could not be duplicated during trouble shooting. A blocking and timing relay controlling the start of the SI pump were replaced. Subsequent testing during the integrated safeguards testing process resulted in repeated successful starts of the SI pump. The actuation occurred when a safety injection block relay failed to maintain the block signal after power application to the relay racks. The actuation cause was an intermittent seal-in contact failure of a block relay. 4.2.4 Injection Header / Cold Leg Injection Path An inadvertent safety injection from the Safety injection Tanks as a result orlow pressurizer pressure signals not being properly bypassed. During the event a high-pressure safety injection valve did not fully open. The liPI loop injection valve did not open due to a blown fuse. The IIPI loop injection valve was verified to operate properly after replacing the malfunctioning fuse. Troubleshooting revealed that there was no indication of a ground on the circuit and after installation of a new fuse, the liPI valve operated properly. The cause of the fuse opening could not be determined. Further testing was conducted and it was determined that the fuse failure was random and that the existing fuse specification is adequate. I NUREG/CR-xxxx, Vol. x 60
Engineer:ng Analysis 4.3 Comparisons of Failures During Unplanned Demands With Failures Detected by Other Means This review primarily focuses on the causes and detection methods of the segment failures by segment type observed during the unplanned demand (SI actuation), surveillance testing, and from other methods. 4.3.1.1 Failure Cause. The cause category that was assigned for each failure was based on the independent review of the data provided in the LER and does not conespond to the cause codes provided by SCSS. The cause categories were based on the data provided in the LERs and engineering judgment. The cause classifiestion of each failure was based on the immediate cause of the failure and not a cause that may be determined through a root cause analysis of the failure that was provided by the plant. Specifically, the mechanism that actually resulted in the segment failing to function as designed was captured as the cause. This methodology precluded categorization of many of the failures as a
" Management Deficiency" or simply a " Personnel Error," which many of the LERs identified as the I cause. For a detailed explanation of the definitions of each of the cause categories and examples of the types of failures assigned to each category, see Section A-2.1.1 of Appendix A.
I Table 13 is a listing of the failurer partitioned by segment type and the cause of the failure. Table 14 is a listing of the failures partitioned by the cause category and by calendar year. The review of the causes of the segment failures over the study period indicated that hardware-related failures contributed to I approximately 40% of the failures. These failures were equally distributed throughout the study period with the exception of 1990, where the number of failures is about twice those of any other year. The failures attributed to personnel error, inadequate procedures, and design errors accounted for about 49% I of the failures. The distribution of failures associated with these three cause categories over the study period did vary considerably. Specifically, the failures attributed to personnel-related problems had higher values (factors of at least two or three and comprising 65% of the failures) in years 1987,1990, I and 1992 than the remaining years. The distribution ofprocedural-related problems was relatively constant over the study period. The reader is cautioned from making comparisons of the numbers provided in Tables 13 and 14 with the number of failures used in the unreliability analysis provided in the Section 3. The tables include the contribution of all failures identified in the LERs as well as support system failures (which were not used in the unreliability analysis). In addition, the common cause failures and the errors of commission I are included with the tables as an independent count of failed segments. Specifically, if a common cause failure resulted in two high-head pumps failing to start, the tables show two failures to start of high-head pumps, not one. m Table 15 is a listing of the intermediate- and high-head pump segment failures that were identified in the 1987-1997 experience partitioned by the cause category and failure mode. Only the high- and intermediate-head pump segments were partitioned by failure mode--the other segments failures were all classified as failure to operate. Therefore, as a result of the failure mode classifications, only the high-and intermediate-head pump segments required an additional data partitioning. There were 53 failures of the high-head pump segment: 12 were classified as failures to start and 41 as failures to run. Hardware-related problems were the primary cause of high-head pump failures (32%), followed by personnel error (23%), procedure (13%), and support system (11 %). b d M 61 NUREG/CR-xxxx, Vol. x
Engineering Analysis Table 13. Failures partitioned by segment type and by cause category.' Cause Categorv Segment Design Envrnmnt' Gas Bmdme liardware Mainten* Persnnl* Proedre* Supprt" Sys Total System 1 - - - - 1 1 - 3 Train - - - 5 - - - 2 7 RWST 2 - - 2 - 2 1 - 7 Pump suction - - - - - 4 - - 4 liigh-head pump 5 - 4 17 2 12 7 6 53 m intermediate-head pump 2 6 - 22 - 14 5 - 49 Injection header 1 - - 19 - 10 - - 30 Cold leg injection path 2 - - 9 - 10 10 - 31 Total 13 6 4 74 2 53 24 8 184
- a. The reader is cautioned from rmking compansons of the numbers provided in this table with the number of failures used in the unreliabihty analysis provided m Section 3. This table includes the contnbution of all failures resultmg from unplanned demands, surveillance tests, and other means of detection. In addition, common cause failures and errors of commission are included as individual failure counts.
b Envmmnt = Envimnment: Mainten = Mamtenance; Persnnt = Personnel; Pmedre = Procedure; Supprt Sys = Suptxm System. Table 14. Segment failures partitioned by cause category and by calendar year. Cause 87 88 89 90 91 92 93 94 95 96 97 Total Design 1 1 2 0 7 0 0 1 0 0 1 13 Ensironment 0 0 0 0 2 2 0 0 0 2 0 6 Gas Binding 0 0 0 2 0 0 0 1 0 0 1 4 g Hardware 6 8 9 18 3 6 1 8 3 7 5 74 E Maintenance 0 2 0 0 0 0 0 0 0 0 0 2 Personnel 13 4 5 7 2 14 0 6 1 1 0 53 Procedure 0 3 0 3 4 4 2 5 0 1 2 24 Support System 2 4 1 0 0 0 0 0 0 1 0 8 Total 22 22 17 30 18 26 3 21 4 12 9 184 Table 15. Pump segment failures partitioned by cause category and failure mode.' Cause Category b Gas Suppn 6 6 6 Segment 6 Design Envmmnt Binding Hardware Mainten Persnn1 Proedr Sys Total g liigh-head pump B Failure to start - - 2 5 - 5 - -- 12 Failure to run 5 - 2 12 2 7 7 6 41 Intermediate-head Pump Failure to start 2 - - 8 - 8 2 - 20 Failure to run - 6 - 14 - 6 3 - 29 Total' 2,5 0,6 2,2 13,26 0,2 13,13 2,10 0,( 32,70
- a. The reader is cautioned from makmg comparisons of the numbers provided in this table with the number of failures used in the unrehability analysis provided in Section 3. This table includes the contribution all failures resulting from unplanned demands, surveillance tests, and other means of detection. In addition, . common cause failures and errors of commission are included as individual failure counts.
- b. Envrnmnt - Environment; Mainten = Mamtenance; Persnnt - Personrel; Proedre = Procedure; Supprt Sys = Support System.
- c. The first value is the number of failures to start; the second value is the number of failures to run.
I NUREG/CR-xxxx, Vol. x 62
Engineering Analysis There were 49 failures of the high-head pump segment: 20 were classified as failures to start and 29 were classified as failures to run. The hardware and personnel category accounted for a majority of the failures,45% and 29%, respectively. There were 61 failures ofinjection header / cold leg injection path segments: 30 associated with the injection header segment and 31 failures of the cold leg injection path segment. Failures attnbuted to hardware problems accounted for about 46% of the failures, while personnel errors, procedure, and design errors accounted for approximately 33% 16%, and 5% of the failures, respectively. 4.3.1.2 Detection Method. This section of the report is comprised of summary information relating to the detection method and the failures identified in the 1987-1997 experience. The method of detection is the activity that revealed the existence of the failure. For example, the test category includes items such as leak rate tests, surveillance tests, post-maintenance tests, etc. The design / review category generally includes such items as review oflogs, design or engineering evaluations, and subsequent inve-tigations. The abnormal system parameter is typically assigned to abnormal indication of the operating system parameters other than by alarm methods. For a detailed explanation of the definitions cf each of the detection method categories and examples of the types of failures assigned 1o each category, see Section A-2.1.1 of Appendix A. Table 16 tabulates the failures identified in the 1987-1997 experience by method of detection and by cause category. The four major cause categories are identified explicitly while the other cruse categories are grouped as " Remaining causes." Based on the failure categorization used for this study, testing is the leading method for detecting failures. Overall, testing identified approximately 34% of the failures identified in the 1987-1997 experience compared to the next loding detection method, design / review,21%. Approximately 12% of the failures were detected during an actual demand for HPI (4% of the failures during an actual SI demand and 8% during a demand for GPI other than the result of an SI actuation). Table 16. Failures partitioned by~ detection method and by cause category.' Cause Category Gas Supprt' Detection Method Design Emrnmnt 6 Binding Hardware Mainten* Persnn16 Proedre 6 Sys Total Abnormal Sys. Param. - 2 - 4 - 3 2 7 18 Alarm 2 - - 7 - 2 - - 11 Design / Review 2 - 1 9 - 21 6 - 39 non-SI Demand 1 - 2 9 - 3 - - 15 SI Demand 1 - - 4 - 1 - 1 7 Test 7 4 1 22 - 16 12 - 62 Tour - - - 6 2 7 3 - 18 Troubleshooting - - - 13 - - 1 - 14 Total 13 6 4 74 2 53 24 8 184
- a. 'D.e reader is cautioned from making compansons of the numbers provided m this table with the number of failures used in the unreliabihty analysis provided m Section 3. This table includes the contnbution of all failures resulting from unplanned demands. surveillance tests. and other neans of detection. In addition, common cause failures and errors of commission are included as individual failure counts.
b Envrnmnt = fnvironment; Mainten - Mamtenance; Persnni = Personnel. Proedre = Pmcedure; Supprt Sys - Support System 63 NUREG/CR-xxxx, Vol. x
Engineering Analysis l Based on the leading cause category (hardware) identified for this study,30% of the hardware-related failures were detected by test followed by 18% for troubleshooting. As noted earlier, the aggregated segment failures of the high-head, intermediate-head, injection header, and cold leg injection path comprised roughly 90% of the failures. Table 17 tabulates the failures by method of detection and by segment category. Figure 14 displays the information in Table 17 for the high-head, intermediate-head, and injection (injection header and cold leg injection path) segment failares by method of detection. Table 17. Failures partitioned by detection method and by segment category.' Segment Category Pump High- head Intermediate- Injection
- Detection Method System Train RWST suction head Total l
Abnormal Sys. Param. I 1 - - 12 2 2 18 Alarm - 3 1 - 2 3 2 11 Design / Review - - 3 3 12 6 15 39 non-SI Demand - - 1 - 8 5 1 15 Si Demand 2 2 - - 1 I I 7 Test - - 2 I 11 24 24 62 Tour - - - - 6 8 4 18 Troubleshooting - 1 - - 1 - 12 14 Total 3 7 7 4 53 49 61 184
- a. 'Ihe reader is cautioned from making compansons of the numbers provided in this table with the number of failures used in the unreliability analysis provided in Section 3. This table includes the contnbution of all failures resulting from unplanned ,
demands, surveillance tests, and other means of detection. In addition, common cause failures and errors of commission are ' included as individual failure counts.
- b. The injection segment is the combined total of the SI-INJ-HDR, CC INJ-HDR, and LOOP-INJ segment failures.
30 25 20 - m High-head g 15 - O lntermediate-head l S 10 -E E O lnjection segments 0 "O -
/
- l Detection Method Figure 14. Distribution of the detection method by failures of the three major HPI segments.
I NUREG/CR-xxxx, Vol. x 64
Engineering Analysis 1 ( 4.4 Insights from the ASP Events to the HPl Reliability Study l
)
The events identified by the ASP Program (NUREG/CR-4674) were reviewed. The purpose of this l review was to relate the operational data to the types of events that resulted in a conditional core damage probability (CCDP) of greater than 1.0E-06. The search for ASP events was limited to the 1987-1997 {' study period and included all ASP events in which the IIPI system was identified in the ASP database. The search resulted in the identification of 16 events related to the HPI system with a CCDP greater than 1.0E-06. Of these 16 events, only two involved an automatic Si actuation of the HPI system. One of the HPI actuations was in response to a steam generator tube rupture. The second HPI actuation was in response to RCS cooldown following a malfunction of the steam bypass control system. In each of these events, HPI injected water into the primary and there were no failures of the HPI system. An event (unplanned demand) was identified involving a steam generator tube rupture that resulted in the manual starting of a additional high-head pump and the intentional blocking (allowed by procedure) of the intermediate-head pumps from starting. There were no HPI failures identified in this ASP event. i The ASP events that identified an HPI demand (SI actuation or unplanned demand) are listed in Table 18. Table 19 lists the remaining 13 ASP cvents that involve a failure of a HPI component. Some of the failures contributed to the HPI unreliability (see LERs 32888005 and 32890102) by impacting the alpha f:ctors used to calculate the CCF probabilities. 4.5 Regulatory issues The failures identified in the 1987-1997 experience that have the potential to occur at other plants have been addressed by previous NRC Inspection Notices (IN). The Inspection Notices relating to HPI cover areas related to valve problems, boron solidification, pump suction clogging due to debris, design deficiencies (for example, gas binding of HPI pumps, common mode, etc.), and pump motor cooling problems. Table 20 lists the various inspection notices relating to HPI along with a brief summary. As shown in Tables 19 and 20 several information notices (e.g., IN 92-61, IN 94-76, IN 95-18, IN 97-38, IN 97-46) are related to ASP events. The most noticeable impact of a regulatory issue involves the boron solidification problems that occurred prior to this study's time period. No failures have been attributed to this failure mechanism of l the HPl system during the 1987-1997 study period. ; Table 18. List of the ASP events that identified an HPI unplanned demand and no HPI failure. Plant Name LER Number Event Date CCDP Description i McGuire 1 369890N 3/7/89 7.7E-04 A Steam Generator Tube Rupture Occurred On March 7, 1989; manually started second high-head pump and opened 2 BIT valves. Blocked SI, allowed by procedure. )' No HPI (intermediate-head) pumps were started. Palo Verde 3 53089001 3/3/89 4.9E-05 Four Steam Bypass Control Valves cycled from fully open to fully closed during load rejection. Received reactor trip followed by Si on low pressurizer pressure due to RCS cooldown Palo Verde 2 52993001 2/14/93 4.7E-05 Steam generator tube ruptured in Steam Generator 2. Reactor was manually tripped due to low pressurizer level and pressure; received SI. RCS leak rate was i approximately 240 gpm, which is in excess of charging pump. Combined makeup from the HPSI and charging pumps slowly increased pressurizer level 65 NUREG/CR-xxxx, Vol. x
f.nd j$ f E y@T(#$ 1* P D 5 6 6 6 4 5 6 6 5 6 C 0- 0- 0- 0- 0- 0- 0- 0- 0- 0-C E 7 3 E 0 2 E 8 6 E 9 6 E 6 8 E 2 2 E 4 E 9 E 5 E 3 M 5 9 3 1 e G y s u Ad D 4 nI o M-s l n a uS E t e er p io N d e edt
. t n
c e 1 o P fd e l i a e uo nr t a s t f ht eeps a b . k wpa sk r e ht u i l d n p e o omwo c
. e l t t
esit pe e a gt a c v l o l imm a l a v etntoR c l u l m i h el n i. I v l t a u s . r a mge g,p u gbei ly n wba vk o ed v e p s e p S i g n i S g n f ea iel l at e se ws s e a ru e pe s t c al er e z z a a d ro s t ps e n yl pvo it a s pehr r sbd f at r c a ie fo g r pr me up M_ n ri l e rl v r t po mp o fotr b n r mn pt bl s en i o a k e n u oa ui d i way s c z ) at v ou g np h uw mer t a I S inre i t p r l f ol e r d d i l o e e d f o r l l i S rd ni y t n ii t n no t po nt d um pn mCs a .d e h e n e nh t M c l d e n rk uc s ( aiodDirat d c oe yi aont oo s l s o e mn ee c eit l at r n faie o s i l d e e fu ola e p sl n eu . ep c e pnj p n leh S o t t D i eh o s o ejo o e r ly l t oi jt c ri t t r a e r yb uio r n le re nn Cd n ue t b ae d v eO e r e pl r ot u a t c o s ad yt et e e u v s iel r e i t n .a pl ta e e s l a u ia sd M t a w f c e ngc o nof e rs . kd se u s v mrd ue up ms c dm r al o t r k r . eg s a e e insl a c h e ae -rp e e i s ice rimps t sl sb pm c pi n e t s ne d e r re a em u e c n npeh p e i r h xo e r l op l jo ce "A o iog l h pt t a p p . c eN v nf r n le ig o s mn u mid r e t t i t w l a l e i y epla nin t "g n t t h bha h igw a C ges a gS s n t I B . peg e e t t s n M gr ma l - s i e T
. t pr er a e yi l
C t nru S fal eei i o io s e o m h w nh ai dki p. uk s a efiob e shvnpr nt p oo i rusc as clo mu pc h Tbeca l D 2 t l oi Pf a W R i Aws rS s eUseTo Ddy wb p uu t it ns wf l i I l Sb o Wm Si n M e s e u l e r e r e r l e l e e r a n u a a n n a n n n C n o s d e c ig s is g ig s dr w dr w n o s n o s dr w M r e o r e e e a a r e r e a P P D D D i l l I P P l l e r u e r e ud M li l o f a iaM F R O O O O O R S R R I P T T T F T T T T T T T I F I F F F F F F F I d a o s w s y ht y e y f e S i v S i e t n M l a R l a d e t c m./ r n m. r i t t e t om na ig s m r t om na m r t t r a e s r e a s r a s s u ht D Te b a l e b a l e e o AP D A T AP A T T T t s n t 0 8 0 e ne t 5 9 9
/ 5 8
/
1 9 7 9 7 2 9/ 2 9/ v e a / 2 9 1 / 0 EvD
/
e 2 1 / l 0 1 9
/ 8 9
/ 2 1 /
9 / 2 3 / P / 2 / 2 1
/ / /
1
/
9
/ 2 S 9 1 3 1 4 4 5 9 7 1 A M f 1 7 0 0 1 1 3 3 3 2 o R 1 0
1 0 1 0 2 0 1 0 0 0 0 0 0 0 1 0 4 0 g E 5 0 5 8 1 7 7 2 2 0 i n L 9 9 9 8 9 9 9 9 9 9 t 5 4 3 7 3 0 7 1 1 1 s 4 4 2 7 8 0 6 M- . 1 1 1 i l 3 2 2 2 4 2 2 3 2 3 e h T k c 2 2
. t e e t n 3 h 9 nm N io c
1 e lPN a a 1 a m a P n e n to 2 e e 3 e c B a e n o s n 2 M_ l k n d a s n n t n m o i b d i i o o b e a o in a d n l i c c i o o l a T C G I I I M O O P R S M
& hc@ ; A5y<.*X ..
l lIljlIIlllll{ 1 s={9e >Eiw P D 6 6 4 4 C 0- 0- 0- 0-3 0-C E E E E E 3 8 8 0 3 1 4 3 6 6 t - d . u i n he m I l d P ue d o e i I osa le d g t nl m et o r ia eo n I g wh fk dnvr eaP dn eof sf n y p a;eC a pawc r h nd 4 ni ot e i g ln o n mb h wpvC e
) t h
r a Oi t c ustit l omsudt h e 4 7-) otr ov er ct. e. je plo w f fi z n l p pett S4 pi d i b p e C57 oe s a t oi fr t o o ea l m mh n a eg l nn t
- a e nl o s n buseup e. ut Vn pd i &Sc e n i a s e nreumie .p .
5Cfi i b o ri nI l dl c i i ps 5I n e i t p t ot o iP l I r e ano na s cet cr 7f - g v i wd gI sl a gbene nel si iosb f Soiash r c t e s i nf o e rd ut n t d rosa r i o Cmad e s a npg s s t 1 at l o ne c n r a i ua g ( ea u D e l b c l e s s a i nae t e;n strh o ae s r r h op d d s ele ae m cBm u - mi et c e s t v ph w ie d t c n el r u pa t co s l f Bal Sb r i l a ucuwo p w e o d2 ot s v (s a s t e i t s pn si v e ni v n g. e pr r e fe n e sl f c e v dl a mid pep r s ns ngw r et o in i let iore n o el pa l u u e r ec wic e c pmpg b e or aiocsl t vi r iv pt ne l ece g us n n pd ri r o u pD en r ef t o nns e oinnS eje . k on l i Tr S ce t i r gn ge u cd a t a cm.l r r u s ope w i gcl a nFt eR i y C LB aT eI Wf Ra f h mlppe a CWrtey Omhil et poemo t t f miMf e a ar DdAst ah e g e c s e n a in u r n d n a a n e i n C dr w g t n B g is i a s is a e a e i l D M G D e r e ud l i o FaM O O R R R T F T F T T T F F F d o ht e M t c e r m r t e u a i u t s t s o o e e D T l A T T T t 9 ne et a 0 9 8
/
8 8 0 9 1
/ 6 /
vD S
/
7 1 2 2 E 1
/
/
2 1
/
2
/
3
/
1 1 2 8 4 5 3 5 2 8
)
R 0 3 0 1 0 0 0 0 0 0 d E 0 9 3 0 1 e L 9 8 8 9 9 u 7 8 8 0 in t 1 3 2 3 2 3 2 3 0 4 n o c s i ( r r
. t e I 2 2 a 9
1 nm a a h a h a h a i l 2 y y n l
- a. lPN m o u
o u y o u o r b e q q a q e a l S a S e e e h T S S S 34 n L ien?M8. <Si l !
Engineering Analysis Table 20. NRC Inspection Notices related to the HPI system during this study period. Inspection Notice Summary IN 97-52 Vogtle: Lack of cooling water flow to SI pump motor coolers. Incorrect heat exchanger plenum and gasket installation caused the problem. (Issue for medium break LOCA) IN 97-46 Oconee 2: Leaking cracked weld in unisolable section ofIIPI line. Thermal cycling during heat up and cooldown and alternate heating and cooling of the weld due to intermittent mixing hot RCS liquid and cool makeup water. (IN 82-09 and GL 85-20 address similar issues) IN 97-76 Poteatial degradation of throttle valves in the high and intermediate-head SI pump flow paths due to high differential pressure causes cavitation and valve g erosion. Thereby pumps may reach "run out" causing pumps to be stopped g earlier than necessary. IN 97-40 Nitrogen accumulation from back-leakage from Safety Injection Tanks result in E water hammer (llappened in LPSI: reduced pressures in LPSI allow nitrogen to E come out of solution and form gas voids. Potential problem for interfa 'ng SI systems.) IN 97-38 Oconee 3: Common mode failure of HPI pumps. Both HPI pumps became hydrogen bound due to taking suction from empty tank (both level transmitters failed in common mode; due to drained reference leg oflet down storage tank. The isolation valve for this tank remains open on SI signal). IN 95-18 Haddam Neck: Susceptible pressure locking ofinjection MOVs. Problem also addressed in IN 95-14 and GL 89-10. IN 94-90 Salem 1: Reactor trip and multiple safety system actuation. Train B of SI logic did not actuate due to wrong logic. Solid state protection system mismatch due to response sensitivity to the steam flow input relays. IN 94-76 Sequoyah 1&2, Callaway, Shearon Harris, DC Cook 1&2, Braidwood 1, Failures of charging /SI pump shafts. Operating under abnormal conditions (gas entrainment, void formation, or other abnormal conditions) may be contributing to the failures. (Issue also addressed in IN 80-07) IN 94-29 PaloVerde 2, Parallel operation of multiple pumps (3 charging and I boric acid L and when switching from VCr to RWST) causes low suction pressure and trip a , charging pump dunng SGTR event. g' IN 92-61 Shearon 11arris: HHSI degraded due rdief valve and drain line failure in the = alternate minimum flow (AMF) system as a result of water hammer. The degraded AMF would divert SI flow away from RCS. Air left in piping after test
& maintenance causes the water hammer.
IN 92-85 H.B. Robinson, foreign material blocking flow (20% Si flow reduction). IN 90-64 Haddam Neck: Common mode failure of both high-point vent isolation valves in the suction vent line that connects charging pumps to VCT. Failure of these valves to isolate during a LOCA could drain down the VCT and allow Ilydrogen gas (and any other gas collected in the vent line) to be transported to the suction 3 of the charging pumps by way of the high-point vent charging pump suction line. g IN 88-01 Farley 2: Safety injection pipe failure. Issues similar to IN 97-46 I 68 NUREG/CR-xxxx, Vol. x
Engineering Analysis _ Table 20. (continued). Inspection Notice Summary IN 88-23 Farley 1: Gas binding of HPSI pumps. Hydrogen entrained in suction line due to suction header lines are 32 ft. above VCT. Iflocal pipe pressure in the lines between VCT and IIPSI pump suction nozzles is less than VCT pressure, dissolve hydrogen will come out of solution and be swept :hrough the pumps. Four IN Supplements have been issued since this IN covering 1988 through 1992. IN 86-63 Potential loss of SI due common mode failure. Crystallization of boric acid blocking pump suction. Indian Point 2 had two leaky valves in the discharge line of the BIT that allowed highly concentrated boric acid to flow and precipitate in the SI pump suction which were not heat traced (2 of 3 pumps rendered inoperable). Other Westinghouse plants with boric acid upstream of SI pumps are San Onofre 1, lladdam Neck, Yankee Rowe, Point Beach 1&2, Prairie Island I&2, Kewaunee, and Ginna. GL 85-16 addresses the need for BIT or for reduced boric acid concentration. The following plants now operate with reduced concentrations: Indian Point 2, Turkey Point 3&4, liarris, Surry 1&2, Beaver Valley 1, South Texas, Mcguire 1 (unit 2 licensed without BIT), Catawba 1&2, Callaway, Farley, and Trojan. IN 86-80 McGuire: Startup with degraded IIPSI; VCT isolation valves in failed condition. IN 82-19 McGuire 1: Loss of HilSI, Emergency Boration, and make-up. Hydrogen enters ' common suction of the centrifugal charging pump suction piping system from the positive displacement pump suction damper. IN 82-35 Davis Bessie 1: Failure of three check valves on IIPI lines to pass flow. Combination of overtorquing by operators and a steep valve seat angle may have contributed. Each IIPI line has a stop check and swing check in series. The stop checks failed to pass flow. 69 NUREG/CR-xxxx, Vol. x
- 5. REFERENCES
- 1. Entergy Operations, Inc., Arkansas Nuclear One Unit 1 Probabilistic Risk Assessment Summary Report, April 29,1993.
- 2. Entergy Operations, Inc., Arkansas Nuclear One Unit 2 Probabilistic Risk Assessment Summary g Report, August 28,1992. 3
- 3. Florida Power and Light Corporation, Crystal River 3, Individual Plant Examination, March 1993.
- 4. Omaha Public Power District, Fort Calhoun Station Individual Plant Examination Submittal, Volume 1, December 1993.
- 5. Arizona Public Service Company, Palo Verde Nuclear Generating Station Individual Plant Examination, April 28,1992.
I
- 6. No thern States Power Company, Prairie Island Nuclear Generating Plant Individual Plant Examination Report, March 1,1994.
- 7. Baltimore Gas and Electric, Calvert Cliffs Nuclear Power Plant Individual Plant Examination Summary Report, December 30,1993.
- 8. Toledo Edison Company, Individual Plant Examination for the Davis-Besse Nuclear Power Station, February 1993.
- 9. Wisconsin Electric Power Company, Point Beach Nuclear Power Plant Individual Plant Examination Summary Report, June 30,1993.
- 10. Rochester Gas and Electric Corporation, R. E. Ginna Probabilistic Risk Assessment Project Report to United States Nuclear Regulatory Commission in Response to Generic Letter 88-20, Volume 1&2, March 15,1994.
I 1. Wisconsin Public Service Corporation, Kewaunee Nuclear Power Plant Individual Plant Examination Summary Report, December 1,1992.
- 12. Northeast Utilities, Millstone Nuclear Power Station, Unit No. 2 Individual Plant Examination for Severe Accident Vulnerabilities Summary Report, December 1993.
- 13. Duke Power Company, Oconee Nuclear Station Units I,2, &3 IPE Submittal Report, December 1990.
- 14. Consumers Power Company, Palisades Plant Individual Plant Examination for Severe Accident Vulnerabilities (IPE), January 23,1993.
- 15. Southern California Edison Company, Individual Plant Examination Report for San Onofre Generating Station Units 2 and 3 in Response to Generic Letter 88-20, Submittal Document, April 1993.
- 16. Florida Power & Light Company, St. Lucie 1 and 2 Individual Plant Examination (IPE) for Severe Accident Vulnerabilities Generic Letter 88-20 (IPE) Submittal, December 9,1993.
I. 70 NUREG/CR-xxxx, Vol. x i I
References
- 17. General Public Utilities, TMI Unit 1 Individual Plant Examination Submittal Report, March 1993.
- 18. General Public Utilities, TMI Unit 1 Probabilistic Risk Assessment (Level 2), January 1993.
- 19. Entergy Operations,Inc., Waterford 3 Probabilistic Risk Assessment, August 28.1992.
- 20. Duquesne Light Company, Beaver Valley Unit 1 Probabilistic Risk Assessment Individual Plant Examination, Summary Report, October 1992.
- 21. Duquesne Light Company, Beaver Valley Unit 2 Probabilistic Risk Assessment Individual Plant Examination, Summary Repon, March 1992.
- 22. Southern Nuclear Operating Company, Joseph M. Farley Nuclear Plant Units 1 and 2 Individual Plant Examination Report in to Response to Generic Letter 88-20, June 1993.
23. I Carolina Power & Light Company, Shearon Harris Nuclear Power Plant Individual Plant Examination Submittal, Final Report, Augue 31,1993.
- 24. Yankee Atomic Electric Company, Maine Yankee Probabilistic Risk Assessment, YAEC-1824, August 25,1992.
-1
- 25. Virginia Electrical Power Company, Probabilistic Risk Assessment for the Individual Plant Examination Final Report North Anna Power Stations Units 1 and 2, Volume 1, December 1992.
- 26. Carolina Power & Light Company, H. B. Robinson Steam Electric Plant Unit No. 2 Individual Plant Examination Submittal, Final Repon, Volume 2, August 1992.
- 27. South Carolina Electric & Gas Company, V. C. Summer Nuclear Station Individual Plant Examination Report in Response to Generic Letter 88-20, June 1993.
- 28. Virginia Electric and Power, Suny Units 1 and 2 Probabilistic Risk Assessment for the Individual Plant Examination, Final Report, August 1991.
- 29. Florida Power & Light Company, Individual Plant Examination (IPE) for Severe Accident Vulnerabilities Turkey Point Units 3 and 4, October 15,1992.
- 30. Commonwealth Edison Company, Braidwood Nuclear Power Station Units 1 and 2 Individual Plant Examination Submittal, June 30,1994.
- 31. Commonwealth Edison Company, Byron Nuclear Power Station Units 1 and 2 Individual Plant Examination Submittal, April 28,1994.
- 32. New Hampshire Yankee, Individual Plant Examination Report for Seabrook Station, March 1991.
- 33. Connecticut Yankee Atomic Power Company, Haddam Neck Plant Individual Plant Examination I for Severe Accident Vulnerabilities, June 1993.
L 34. Union Electric Company, Callaway Plant Individual Plant Examination, September 29,1992.
- 35. Duke Power Company, Catawba Nuclear Station, IPE Submittai Report, September 1992.
[ 71 NUREG/CR-xxxx, Vol. x
References l
- 36. Texas Utilities Electric Company, Individual Plant Examination Comanche Peak Steam Electric Station, Volume I: Front-End Analysis, August 1992.
- 37. Indiana Michigan Power Company, Donald C. Cook Nuclear Power Plant Units 1 and 2 Individual Plant Examination Summary Report, Revision 1, October 1997.
- 38. Pacific Gas and Electric Company, Individual Plant Examination Report for the Diablo Canyon Power Plant Units I and 2 in Response to Generic Letter 88-20, April 1992.
- 39. Consolidated Edison Company of New York, Inc., Individual Plant Examination for Indian Point Unit No. 2 Nuclear Generating Station, August 1992.
- 40. New York Power Authority, Indian Point 3 Nuclear Power Plant Individual Plant Examination, August 1991.
- 41. Duke Power Company, McGuire Nuclear Station IPE Submitted Report, November 1991.
- 42. Northeast Utilities, Millstone Nuclear Power Station, U' nit No. 3 Individual Plant Examination for Severe Accident Vulnerabilities Summary Report, NUSCO 171, August 1990.
- 43. Public Service Electric and Gas Company, Salem Generating Station Individual Plant Examination, July 1993.
- 44. Tennessee Valley Authority, Sequoyah Nuclear Plant Units 1 and 2 Probabilistic Risk Assessment Individual Plant Examination, September 1,1992.
- 45. Georgia Power Company and Southern Nuclear Operating Company, Vogtle Electric Generating Plant Units 1 and 2 Individual Plant Examination Report in Response to Generic Letter 88-20, December 1992.
- 46. Wolf Creek Nuclear Operating Corporation, Wolf Creek Generating Station Individual Plant Examination Summary Report, September 1992.
- 47. Commonwealth Edison Company, Zion Generating Station Units 1 & 2, Individual Plant Examination Submittal Report, Revision 1, September 1997.
- 48. Houston Lighting and Power Company, South Texas Project Electric Generating Station Level 2 Probabilistic Safety Assessment and Individual Plant Examination, August 1992.
- 49. Event Reporting Guidelines 10 CFR 50.72 and 50.73, NUREG-1022, Rev.1, January 1984.
- 50. 11. M. Stromberg, F. M. Marshall, et al., Common Cause Failure Data Collection and Analysis System, Volumes 1 through 6, INEL-94/0064, December 1997.
- 51. Accident Sequence Precursor ( ASP) Program (NUREG/CR-4674).
- 52. Nuclear Regulatory Commission (NRC) Information Notice 88-23, " Potential for Gas Binding of liigh-Pressure Safety injection Pumps During A Loss of Coolant Accident," May 12,1988.
- 53. Nuclear Regulatory Commission (NRC) Information Notice (IN) 92-27, " Thermally Induced ll Accelerated Aging and Failure ofITE/Gould AC Relays Used in Safety-Related Applications,"
April 3,1992. NUREG/CR-xxxx, Vol. x 72
[ [ [ [ { [ Appendix A [ HPI Data Collection and Analysis Methods [ { [ [ [ [ i (
Appendix A I HPI Data Collection and Analysis Methods l To characterize high pressure safety injection (IIPI) system performance, operational data pertain-ing to the IIPI system from 72 U.S. commercial nuclear pressurized water reactor plants having IIPI systems were collected and reviewed. This appendix provides descriptions for the operational data collection and the subsequent data characterization for the estimation ofIIPI system unreliability. The descriptions below give details of the methodology, summaries of the quality assurance measures used, and discussions of the reasoning behind the choice of methods. A-1. SYSTEM CHARACTERIZATION I The IIPI systems for the plants used in this , :dy differ considerably among the plants. The plants have difTerent numbers of trains and operating features. In an effort to collect and properly classify the operational data from the plants, it was necessary to group the plants that had similar system I configurations. This grouping resulted in partitioning the plants into 6 different IIPI design classes. To estimate unreliability for each IIPI design class, it was necessary to collect information on the I frequency and nature of demands. For the reliability estimation process, demand counts must be associated with failure counts. To estimate IIPI demands and associate the failures with the demands consistently within each group and where possible for the industry, the liPI system was partitioned into I segments to facilitate the subsequent analysis. These system segments are (1) RWST suction,(2) pump train and discharge piping, (3) pump injection header, (4) shared injection header (5) cold leg injection, g and (6) Instrumentation and Control (i.e., actuation circuits) subsystem. The composition of the various l components for each segment may differ among plants within an HPI design class. However, the overall function of the segment for each is approximately the same. The following are descriptions of the types of segments found among the various llPI design classes and the components found in each segment. In I each description, the segment name is followed in parentheses with the general label used in the simplified block diagrams.
- 1. The RWST suction segment (RWST-SUCT) includes all piping and valves (including valve operators) from the RWST/BWST to the pump suction header. Also included in this segment are the components and equipment used for VCT isolation and the transfer of pump suction to the RWST.
- 2. The pump train and discharge piping segment (ff-PUMPx) includes the motor and associated l breaker, but excludes the electrical power bus itself. Also included with this segment are the I pump and associated piping from (and including) the pump suction header up to and including the discharge header valves, and associated valve operators. The minimum flow and test recirculation line is included if the associated tap off connects prior to the discharge isolation valve. The IIPI systems consist of either high-head pumps (CC-PUMPx),
intermediate-head pumps (SI-PUMPx), or a combination of both. Note, some plants have a common suction header arrangement instead of a dedicated suction path within the pump train. For plants having this configuration, an independent segment labeled PUMP-SUCT was used to model these systems. A-1 NUREG/CR-xxxx, Vol. x J
Appendix A 1
- 3. The pump injection header segment (xx-INJ-HDR) includes the pipmg and valves from the pump discharge isolation valve up the cold-leg or cold-leg injection ngment depending on ,
whether multiple injection segments feed a common cold-leg injection header. This segment begins downstream from the pump discharge isolation valve (or discharge header) and terminates at the point connecting to altemate injection paths (or cold-leg for plants that do f not have a shared injection header since these plants have dedicated injection paths from the 1 pumps to the cold legs). Included with the segment are the associated valves and valve operators, the injection valve and control logic, and the test recirculation line where applicable.
- 4. The shared injection control segment (xx-INJ-HDR) applies to plants where the pump discharges to a shared header with flow to the cold-leg being regulated in this common line.
(The xx prefix refers to high head, CC, or intermediate head, SI.) This segment includes the piping and valves from (but not including) the pump discharge isolation up to the cold-leg for plants with only one injection header per cold-leg. For plants with more than one injection header per cold-leg or where the injection path connects with another injection g systems, the injection control segment includes piping up to the connection point for the 3 alternate injection path. Included with this segment are the associated valves and valve operators, the injection / isolation valve and the control logic, and the test recirculation line where applicable.
- 5. The cold-leg (loop) injection segment (LOOP x-INJ y) includes the check valve (s) and g associated piping downstream of the common injection header segments. This segment g generally includes the last check valves in the injection system piping immediately upstream of the RCS cold leg.
- 6. The Instmmentation and Control subsystem (ACT-CHANL x) includes the circuits for I
initiation of the HPI system. It includes sensors, transmitters, instrument channels, and analog or solid state components used for HP1 train actuation Each plant's HPI system has several but not all of these segment types. Appendix D provides block diagrams of typical configurations of these segments for each of the six HPI design classes. Also, p' nt and design-class specific fault trees were developed to describe how the HPl system fails in terms of these segment types. A-2. DATA COLLECTION AND CHARACTERIZATION The HPI system operational data used in this report are based on LERs selected using the SCSS database. The SCSS database was searched for all records that exphcitly identified an engineered safety feature (ESF) actuation or failure associated with the HPI system for the years 1987 through 1997. To ensure as complete a data set as possible, the SCSS database was also searched for all safety injection E actuations for plants that have an HPI system. These records potentially provide an additional source of 5 HPI actuations because (1) the HPI system is typically demanded as a result of a safety injection demand and (2) HPI may be required to start following a reactor trip as a result oflow pressurizer level (for E example, as the result of overcooling the reactor coolant system). 3 These potential differences in what a plant may or may not report are not evaluated in this study. It was assumed for this study that every plant was reporting HPI ESF actuations and failures consistently as required by the LER Rule,10 CFR 50.73, and the guidance provided in NUREG-1022, Event Reporting Systems 10 CFR 50. 72 and 50.73.^~' (HPI ESF actuations were found and reported as ESF actuations for i NUREG/CR-xxxx, Vol. x A-7.
Appendix A all plants in the study.) HPI events that were reported in accordance with the requirements of 10 CFR 50.72 (Immediate Notification Repons) were not explicitly used in this stucy because the LERs (i.e.,10 TR 50.73 reports) provided the more complete event descriptions needed to determine successful peration or failure of HPL Sections A-2.1 and A-2.2 below describe methods for acquiring the basic operational data used in this study. A-2.1 Inoperability identification and Classification The information encoded in the SCSS database, and included in this study, encompasses both actual and potential IIPI failures during various plant operating conditions and testing. In this report, the term inoperability is used to describe any HPI component malfunction either actual or potential, except an ESF actuation, in which an LER was submitted in accordance with the requirements identified in 10 CFR 50.73. It is distinguished from the termfailure, which is a subset of the inoperabilities for which a segment of the system was not able to perform its safety function. Specifically for an event to be classified as a failure, when considering all the data provided in the full text of the L ER. the segment would not have functioned successfully upon demand. The HPI system is a safety system, and any occurrences in which the system was not fully operable, as defined by plant technical specifications, are required by 10 CFR 50.73 to be reported in LERs. However, because the HPI system consists of redundant trains, not all train level inoperabilities are captured in the LER data. Specifically, a plant is not required to report a single train inoperability unless the malfunction resulted in a train outage time in excess of technical specification allowable outage times, or resulted in a unit shutdown required by technical specifications. Otherwise, any occurrences where a train was not fully operable would not be reported. For example, no LER would be required to be submitted if, during the performance of a surveillance test, a intermediate-head pump failed to start but the redundant train (s) were operable and the cause of the failure to start was corrected with operability restored prior to expiration of the technical specification limiting condition for operation. This reportability requirement effectively removes any surveillance test data from being considered for the unreliability estimate except for those HPI system segments that do not have redundancies (e.g., RWST suction path). However, for ESF actuations, all component failures that occurred as part of the ESF actuation were assumed to be described in the narrative of the LER as required by 10 CFR 50.73(b)(2)(ii). Because all ESF actuations are reportable as required by 10 CFR 50.73(a)(2)(iv), the failures that occurred during an ESF actuation are assumed to be complete. A-2.1.1 Failure Classification Each of the LERs identified in the SCSS database search was reviewed by a team of U.S. commercial nuclear power plant experienced personnel, to properly classify each event and to ensure consistency of the classification for each event. Because the focus of this report is on risk and reliability, it was necessary to review the full text of each LER and classify or exclude events based on the available information reported in the LER. Specifically, the information in this report necessary for determination of reliability, such as classification of HPI failures, failure modes, failure mechanisms, causes, etc. were based on the independent review of the information provided in the LERs. Two engineers independently evaluated the full text of each LER from a risk and reliability perspective. At the conclusion of the independent review, the data from each independent LER review were combined, and classification of each event was agreed upon by the engineers. The events identified as failures that could contribute to system unreliability were peer reviewed by the NRC technical monitor A-3 NUREG/CR-xxxx, Vol. x
Appendix A
- and technical consultants that have extensive experience in reliability and risk analysis. The peer review was conducted to ensure consistent and conect classification of the failure event for the reliability estimation process.
The events identified in this study as segment failures represent actual malfunctions that prevented the successful operation of the particular segment. Segment failures identified in this study are not necessarily failures of the HPI system to complete its mission. Specifically, a pump segment may have failed to start; however, the redundant pump segment may have responded as designed for the mission. IIence, the system was not failed. Examples of the types ofinoperabilities that are classified as segment failures include:
- Malfunctions of the initiation circuit prevent a pump from starting in automatic.
e The test recirculation valve was not fully closed after a surveillance test, and as a result, I diverted sufficient flow during an Si condition requiring inventory makeup to the reactor coolant system.
- A pump is shut down by operator action for any reason with a SI signal at or below the initiation setpoint.
- Gas binding, sludge or foreign material in the pump casing results in a reduction in pump capacity.
- A damaged pump impeller or shaft as a result of stress corrosion cracking or fatigue due to gas binding experiences.
Based on the review and classification of the LERs, the following segment failure modes were observedin the operational data:
- Maintenance-out-of-service (MOOS) occurred if, because of maintenance activities, the segment is prevented from starting automatically during an unplanned demand. This failure a mode only applied to the pump segments. Examples of the types of events classified as l MOOS include an pump motor's circuit breaker being racked out for repairs.
- Failure to start (FTS) occurred if the pump segment was in service but failed to automatically start or manually start, and obtain sufficient pressure and flow. This failure mode applied only to the pump segments. There was no minimum operational time associated with this failure mode. Specifically, if the pump successfully started as evidenced by achieving the required flow and pressure, it was considered a successful start, even j though the pump may have failed to maintain required flow and pressure a short time later.
Examples of the types of failures classified as FTS include stopping the pump as a result of gas accumulation in the suction line, causing erratic operation of the pump that required the ! motor to be shut down before the required flows and pressures are observed, a damaged pump impeller, and a pump motor's circuit breaker failing to close on an initiation signal. In addition, events in which the pump successfully started and later failed as a result of a failure mechanism that was present at the time of the demand were classified as a failure to . I start. Also, a failure may have been classified as a failure to start if the pump circuit breaker tripped on over-current a few minutes after a successful start as a result of the over-current NUREG/CR-xxxx, Vol. x A-4 I l
Appendix A protection relay setpoint being set at the normal running amperage versus a higher amperage setpoint as required.
- Failure to mn (FTR) occurred if, at any time after the pump segment was delivering sufficient pressure and flow, the segment failed to maintain sufficient pressure a. 41ow while it was needed due to a time-dependent mechanism not present at the time of the demand. This failure mode applied only to the pump segments. This failure mode was not associated with any minimum required operational time prior to the failure (i.e., no minimum running time restrictions applied for the failure to be classified as a failure to run).
However, the failure mechanism had to be time dependent. Specifically, the mechanism of the failure had to be related to operation of the pump, and the failure had to occur after the pump was delivering required flow and pressure. Examples of the types of failures classified as FTR include the pump discharge relief valve lifting and diverting flow, erratic pump operation that required the pump to be shut down at anytime after the required flows and pressures are observed, the pump ventilation damper failed to open on pump start, and racking out the spare pump motor's circuit breaker that results in tripping the running pump due to interlock design. I
- Failure to operate (FTO) occurred if the segment could not perform its required safety function when needed. This failure mode applied to the segments other than the pump segments. Examples of the types of failures classified as FTO include Train B failed to actuate due to a wire interfering with a relay plunger, low safety injection flows due to I mispositioned valves / stem locks, relief valve (common cold leg injection line to the Reactor Coolant System (RCS) lifted and failed to rescat (both trains of the HPI system were declared inoperable), and the HPI loop injection valve did not open due to a blown fuse I during an inadvertent SI actuation during cold shutdown.
- Failure to operate (FFO) of the RWST suction path and associated piping faults segment I occurred if this segment could not perform its required safety function when needed. Also included under this heading is any isolation failure of the VCT that lead to the failure of the HPI suction source.
I In addition to the basic failure mode, each failr.: event was distinguished according to whether the following two attributes apply: I
- Common cause failure (CCF) occmred if two or more segments could not perform their required safety function as a result of a common failure mechanism. Examples of the types I of failures that were classified as a common cause failure include the following: RWST level detector lines frozen, a charging pump speed increaser lube oil pump failed due to wrong pump installed and gland seal bolts backed out during previous maintenance (two pumps affected) and the potential to gas bind all 3 HPI pumps from the suction piping accumulating I gas. (The volume of gas trapped in the piping exceeded the manufacturer's limit of gas volume that the pump would safely pass without causing damage to the pump.)
- Error of commission (EOC) occurred if the HPI system was rendered inoperable by operator action when the system was demanded by an Si signal. An example is an operator inappropriately bypassed actuation of the engineered safeguards (ES) prior to the setpoint.
However the shift supervisor directed ES ou' of bypass and ES actuation was initiated. A-5 NUREG/CR-xxxx, Vol. x
Appendix A For the events associated with the injection header / cold leg injection path segments, some LERs identified a degraded flow condition to one or more cold legs. In these events typically no actual flow rates were provided, or was a qualitative discussion of the relationship between the flow rates and technical specification or safety analysis report requirements identified. In these events where degraded flow was indicated, the corrective actions associated with the degraded flow condition were reviewed. In some cases the corrective actions for the degraded flow identified lengthy and extensive testing and inspections, along with component replacements. Because of the extensive corrective actions associated with the identified degraded flow it was assumed that the degraded flow was at the very least not sufficient to meet technical specification operability requirements. As a result, the events that identified degraded flow in an injection header / cold leg injection path segment were classified as failures of the . associated injection header / cold leg injection path segment based on the corrective actions taken by the plant. For the LERs that identified an injection header / cold leg injection path segment flow problem where a flow rate was provided, the segment was classified as failed if the LER stated that the flow rate was less than technical specification minimum flow rate. Overall, there was no assigned minimum flow value for determining a failed injection header / cold leg injection path segment for this report (e.g. less than 90% of the technical specification minimum). If the plant identified a flow rate less than technical specification minimums or a degraded condition which required significant corrective actions the injection header / cold leg injection path segment was classified as failed. This classification was based on the need for the injection header / cold leg injection path segment to function successfully for a period of time until the plant is cooled down to the point where the residual heat removal system is able to be placed in service. Recovery from initial failures is also imponant in estimating reliability. To recover from a failure of any segment, operators have to recognize that the segment is in a failed state, and restore the function of the segment without performing maintenance (for example, without replacing components). An example of such a recovery would be an operator (a) noticing that the pump tripped but did not start automatically and (b) manually starting the pump from the control room. Each failure during an unplanned demand was evaluated to determine whether recovery by the operator occurred. In addition to the failures that were actually recovered by plant operators, there wuc some failures that operators elected not to recover from because a redundant segment of the system was performing the intended function. As an example, if a pump failed to start and the redundant pump started and was operating properly, operators would not normally pursue recovery of the failed pump segment if the reactor / plant parameters were being retumed to normal. Similarly, failures that occur during testing are not typically recovered. As a result, each failure that was not actually recovered was reviewed to determine, using engineering judgment, if the failure could have been recovered if given the need to recover the failed segment. Specifically, using the above example of the pump failing to stan, engineers assessed whether, given the information, specifically the failure mechanism, in the LER, the likelihood was high that the operators would have been able to restart the pump without any performing any corrective maintenance on the pump. For example, if the failure to start was attributed to the automatic start circuitry, this failure was typicallyjudged to be recoverable because manual starting is possible. Ilowever, if the pump failing to start was a mechanical failure of the pump shaft, the failure wasjudged to be nonrecoverable even though the pump was not needed at that time in addition to the failure mode data, other information concerning the event was collected from the detailed review of the full text of the LER:
- For esents classified as failures to run, the run time prior to failure, if provided in the LER NUREG/CR-xxxx, Vol. x A-6
Appendix A e The segment and component involved e The method ofdiscovery of the event (e.g., unplanned demand, surveillance test, engineering design review, or other routine plant operations) The cause of the event (design, hardware, maintenance, personnel, procedure, support system, gas binding, or environment). The assessment of the cause of the failures was based on the independent review of the data provided in the LERs and does not correspond to the "Cause Codes" provided by SCSS. The eight cause categories selected for this study were based on the data provided in the LERs and engineeringjudgment. The cause classification of each inoperability was based on the immediate cause of the event and not on a root cause analysis that may be provided by the plant. Specifically, the mechanism that actually resulted in the segment failing to function as designed was captured as the cause. This methodology precluded categorization of many of the failures as a management deficiency or simply a personnel error which many LERs identify as a cause. Definitions and explanations for the assirned cause codes follow: Design-Inoperabilities that were the result ofincorrect design specifications of the system were classified as " Design." These failures were not related to inaccuracies associated with operating / maintenance procedures or operator / technician error. Specifically, if a technician was following the approved procedure foi setting torque switches and it was later determined that the settings of the torque switches were too low based on an evaluation of the assumptions and associated calculations used to determine the switch setpoints, the cause was classified as " Design." This category included both actual and potential failures. Examples of the types ofinoperabilities that were assigned to the " Design" category include torque switches for motor-operated valves set too low /high, RWST level detector lines frozen, and design logic (the safety injection trains were blocked when the reactor trip breakers were open and safety injection actuation had occurred) errorr,.
. Hardware-Inoperabilities that were the result of an actual component failure that resulted in HPI system to satisfactorily perform its intended function were classified as "Ilardware."
These failures were not related to technician error associated with improperly performed maintenance activities resulting in a failed component. Examples of the types of inoperabilities that were assigned to the "IIardware" category include cracked pump rotor bars, blown fuses that were the proper size, worn packing that prevents proper operation of valves or pumps, wom pump impeller wearing rings, pump failures as of worn or loose parts, and short circuits associated with instrumentation and control circuits.
. Maintenance--Inoperabilities that were the result of a technician failing to perform a maintenance activity in accordance with established procedures that results in failure of the system to operate properly when demanded, were classified as " Maintenance." These failures were not related to errors associated with maintenance procedures resulting in a failed component. An example ofinoperabilities that were assigned to the " Maintenance" category include installing the wrong pump during a previous maintenance resulting in several pump failures.
- Personnel-Inoperabilities that were the result of an operator failing to operate the system as required by procedure were classified as " Personnel." These failures tvere not related to errcrs associated with maintenance activities resulting in a failed component. This category primarily included actual failures. Examples of the types ofinoperabilities that were A-7 NUREG/CR-xxxx, Vol. x i
Appendix A assigned to the " Personnel" category include operating a valve to the open position when it was intended to be closed, shutting both the pump discharge and minimum flow isolation valves during pump operation, failing to place the system in standby operation when g required by plant technical specifications, and blocking any system automatic start function g when required to be operational by plant technical specifications.
. Procedure-Inoperabilities in which personnel properly fo'! owed either an operations or maintenance procedure and rendered a segment inoperable, because of an error in the procedure, were classified as " Procedure." Examples of the types ofinoperabilities assigned to the " Procedure" category include the opening switches that disable ESF actuation being because the procedure was incorrect, motor cooling for a pump had been significantly degraded due to improper gasket installation and incorrect assembly of the two motor coolers, or performing the system check valve testing in accordance with a surveillance procedure that rendered both HPI trains inoperable.
- Environment-Inoperabilities that were the result of a piping blockage / restrictions due to foreign material were classified as " Environment." Examples ofinoperabilities falling under this cause category are frozen recirculation lines and obstructions in the pump recirculation line.
. Support system-HPI segment inoperabilities that were the result of a failure mechanism associated with a system outside of HP1 but necessary for the operation of HPI were classified as " Support system." Generally, these failures were outside the system boundaries for this study and, as a result, were not used in the unreliability estimates provided in this report. However, failure of support system did result in occurrences for which HP1 could not E respond to a SI actuation signal. The types of failures caused by support system failures .g include HPI inoperabilities from losses of 4,160-Vac bus with the diesel generator failing to provide power to the affected bus, air binding of component cooling water thereby making the HPI pumps inoperable, etc.
. Gas Binding-Inoperabilities that were the result of gas (air, hydrogen, etc.) in the pump train suction piping were classified as " Gas binding." This category was defined because this has been a reoccurring problem that has been analyzed and documented in past NRC Inspection Notices. This cause category was created to track these specific events.
A 2.1.2 Additional Classification Guidelines The information in the analysis section of some LERs lead to the determination that an HP1 l segment would have been able to perform as required even though it was not operable as defined by plant 5 technical specifications. For example, consider an event where the pump discharge piping was found not to have the required number of seismic restraints, and therefore was not operable as defined by plant technical specifications. This event would not be classified as a failure since the system would function during an HPI demand unless the HPl demand coincided with an earthquake. Other inoperabilities not classified as failures include configuration en' ors associated with the floor drain system, failures that occurred after the event was terminated when the system was being restored to standby, and valves failed in the position required for emergency response. In addition, administrative problems associated with HPI were not classified as failures. As an l example, the LER may have been submitted specifically for the late performance of a technical j specification required surveillance test. This event would not be classified as a failure in this study if a I{; i NUREG/CR-xxxx, Vol. x A-8
)
i
Appendix A I test conducted after the discovery of the missed surveillance shows that the segment would still be capable of functioning as designed given a demand for the segment. If the segment failed the subsequent surveillance test, the event would have been classified as a failure. l Other events found in the SCSS database search were explicitly removed from consideration from the unreliability estimate even though the events were esprured in the SCSS database as failures of the I IIPI system during an unplanned demand. These events were instances in which the failure mechanism was outside t'le system boundary for this study or were support system failures. Ilowever, if the failure prevented successful operation of the IIPI system durmg an unplanned demand, the event was captured I for informational purposes only. Examples of the types of events explicitly excluded from the unreliability estimate include a de-energized emergency bus that prevented the start of an motor-driven pump, malfuncti >n of protective / actuation circuitry that is not specifically dedicated to the IIPI system, and malfunctio:, of the emergency diesel generator sequencer circuitry. Additional differences between the events captured as failures in this study and the events captured I as failures in the SCSS database would be observed because of the definition of failure used in this study and that used in the SCSS database. Specifically, a system that is out of service for maintenance at the time of an unplanned demand would not be classified as a failure in the SCSS database; however, it I would be classified as a failure for this study in an effort to estimate a maintenance-out-of-service probability. Also, the SCSS database would identify a system as failed if the system is out of service for pre-planned maintenance and another system subsequently fails. As an example, the train "A"IIPI pump is out of service for maintenance when the "B" emergency diesel generator fails a surveillance test. The I SCSS database would identify both systems as failed; however, pre-planned maintenance of the IIPI system without a corresponding demand is not considered a failure in this study. As a result of the review of the LER data, the number of events classified and used in this study to estimate IIPI unreliability will differ from the number of events and classification that would be identified in a simple SCSS database search. Differences between the data used in this study and a tally of events from an SCSS search would stem primarily from the reportability requirements identified for the LER and the exclusion of events whose fniture mechanism is outside the system boundary. Because of these differences, the reader and/or analyst is cautioned from making comparisons of the data used in this study I with a simple tally of events from SCSS without first making a detailed evaluation of the data provided in the LERs from a reliability and risk perspective. The results of the LER review and classification are provided in Appendix B, Section B 2. A-2.2 Characterization of Demand and Exposure Time Data To estimate unreliability, information on the frequency and nature ofliPI demands was needed. For the reliability estimation process, demand counts must be associated with failure counts. The selection of sets of events with particular system demands determines the set of failures to be considered in the reliability estimation (namely, the failures occurring during those demands). Two criteria are I important in selecting event sets for reliability analysis. First, useful event sets must, of course, be countah/c. Reasonable assurance must exist that the number of events can be estimated, that all failures associated with these events will be reported, and that sufficient detail will be present in the failure reports I to match the failures to the applicable event set. The second criterion is that the demands must reasonably approximate the conditions being I considered in the unreliability analysis. The unplanned demands or tests must be rigorous enough that successes as well as failures provide meaningful system performance information. The determination of A-9 NUREG!CR-xxxx, Vol. x
-.A
Appendix A whether each demand reasonably approximates conditions for required accident / transient response depends in turn on the responses measured in each failure probability estimate. i As explained in further detail below, the unplanned demands meet the countable and rigorous requirements, but except for the RWST suction segment, use of surveillance test data is precluded I because the failures are not generally reportable and thus are not countable. A 2.2.1 Unpir.w d Demands I 1 ( For the purposes of this study, an unplanned demand was defined as an event requiring either the , system or segment of the system to perform its safety function as a result of a valid initiation signal that l was not part of a pre-planned evolution. Other plant conditions may have also resulted in an unplanned demand ofIIPI based on the plant-specific design of the 11PI initiation circuit. These initiations ofIIPI were also included in the study if they resulted from a valid signal. Spurious signals or those inadvertent S1 initiation signals that occurred during the performance of a 3 surveillance test were classified as demands. For example, shorting test leads or blown fuses that resulted B in a demand signal were counted as a valid demand ofIIPI's safety-related function. The LERs identified from the SCSS database search were reviewed to determine the nature and frequency ofIIPI unplanned demands. Specifically, each LER was reviewed to determine what segment (s) of the system were demanded. To determine which segment (s) of the system were demanded, the IPE and/or Final Safety Analysis Report (FS AR) for each plant was reviewed to determine the initiation setpoints and cperating characteristics of the system for the specific plant. In addition to the setpoints and operating characteristics, the plant-specific system schematic for IIPI was also reviewed. This review provided the plant-specific background information needed to evaluate from the full text of each LER which segment (s) of the system were demanded. The identification of the system initiation setpoints, operating characteristics, and schematic for the system was necessary to capture the unplanned demand frequency because many LERs simply stated that all systems functioned as designed. Ilowever, the full text of the LER would describe plant conditions that should have resulted in an unplanned demand ofIIPL For example, an LER might state that an Si occurred and the reactor coolant system pressure during the event. Com aring the RCS pressure stated in the LER to the IIPI information provided in the FSAR for the particular plant, it was determined whether the RCS pressure was greater than the shutoff-head of the running IIPI pumps. If not, then the IIPI pumps would run in a recirculation mode and na llPI flow would be provided to the cold legs until RCS pressure dropped to below the pump's shutoff head. For this event, the segment containing the check valves (typically, the cold leg injection path) that isolate RCS from the IIPl piping would not receive any IIPI 11ow. For thW segment, no demand for the segment was recorded in the actuation database. Otherwise, a demand would be recorded for the cold leg injection path segment. The review of the unplanned demands also e ;.luded capturing in the database the average pump run times (total run time for all running pumps during the event) specified in the LER for each type of pump that received a demand to start and run during the events. The results of the LER review and evaluation are provided in Appendix B, Section B-2. I I NUREG/CR-xxxx, Vol. x A-10
A-2.2.2 Surveillance Tests Reasonable assurance must exist that all failures associated with surveillance tests will be reported. Because surveillance test failures of a single train would not be required to be reported, as discussed previously, the number of failures found in the LERs may be less than the number that actually occurred. This would result in a reliability estimate that would be based only on a subset of the actual failures. Consequently, no surveillance test data were considered for the reliability estimate except for the RWST suction segment. A-2.2.3 Pump Run Times An average nm time was computed from the unplanned demand LERs for which run times were specified. Estimated run times were then projected for the pump demands with unknown run times. Such a mn time would be zero if the demand was followed by an unrecovered maintenance-out-of-service or failure to start. Using projected run times based on averages of known times for unknown run times introduces additional uncertainty in the failure rate estimates. The uncertainty introduced by using projected run times has not been quantified. A-2.2.4 System Operation Time In addition to the unreliability analysis, the reported system unplanned demands were characterized and studied from the perspective of overall trends and the existence of patterns in the performance of particular plant units. These assessments were based on frequencies of occurrence per year. Since valid I demands for the HPI system only occur when a plant is operational, the operational times associated with the NRC's Performance Indicator Program were used to normalize the unplanned demand counts. For each plant and year, the plant's operational time was computed as a fraction of a year. Periods prior to the I low-power license date or after a plant's decommission date were excluded. To evaluate trends with respect to plant age, it was assumed that the age of the HPI system is the same as the total calendar time of the plant from the low-power license date. Each plant's HPI unplanned demand count was normalized by the plant's operational time during the study period, and the resulting frequencies were trended against the plant's low-power license date (i.e., age). A-3. ESTIMATION OF UNRELIABILITY Four groups of estimates were evaluated for the HPI system study: independent failure probabilities and rates, total failure probabilities and rates, recovery probabilities, and common cause failure (CCF) probabilities. The independent failure probabilities and associated recovery probabilities (as applicable) were used directly in the fault trees developed to quantify the unreliability of the llPI system. The total failure probabilities (i.e., the independent failure probabilities since no CCF events _ were identified in the unplanned demands) were developed for use with common cause alpha factors, discussed Section 3.1.3 of this report, to quantify the common cause ponion of the fault trees. ( In all four groups of estimates, the primary data are failures and demands, leading to estimates of failure probabilities. In the statistical analysis process, rate-based analysis was performed for failure to run for the high-head and intermediate-head pumps. The rate-based estimates were developed for use in [ comparing the operating experience to the PRA/IPE results. For FTR, most of the operational demands were relatively short compared with the longer mission times (several hours to 24 hours) typically A-11 NUREG/CR-xxxx, Vol. x p - . _ - -
Appendix A l assumed in PRAs. Rate-based models specifically account for the fact that unreliability tends to increase as the mission time gets longer. The selection of particular failure modes in the four groups was dictated by the requirements of ) fault trees developed for each plant's HP system. Failure probabilities were quantified for each of the j types of segments described in Section A-1. For the pump trains, separate estimates were developed for each failure mode for each train type. All these estimates were based on only independent failures. Recovery modes were modeled for failure modes having at least one failure and for which recovery was possible. In the PRA/IPE comparisons, the recovery failure modes are included even though PRAs typically model recovery separately. The recovery event defined for this study encompasses only those failures for which no actual diagnosis and physical repair of a failed component occurred. Examples of these events include the recovery of a failure related to automatic stan that was recovered by the operator manually starting the system. This kind of recovery is different from PRA-defined recoveries that require diagnosis and actual repair of failed equipment that will restore the system to operational status. Generally, PRAs take credit for the recovery failure modes defined for this study if procedures or training direct the operator to perform these actions. Based on the types of events observed in the LER data, CCF was quantified for FTS for high-head and intermediate-head trains, for FTR for high-head and intermediate-head trains, for l'f0 for the injection header segments. For these five CCF classifications, LER-based estimates were developed. The total failure probabilities (or rates for the risk-based model for FTR) are based on relevant segment failures and the associated counts or times for each segment demand. The common cause factors or alpha factors were derived using data from both LERs and the Nuclear Plant Reliability Data System (NPRDS) maintained by the Institute for Nuclear Power Operations (INPO). The derivation, as described in Reference A-2, used data for the HPI system during the 1987-1997 study period and included partial as well as total losses of function. For failure of the motor-driven pumps to start and failure to run, both the pump and the associated motor were considered. The alpha factors were developed for the high-head pumps and intermediste-head pumps. Data for motor-operated valves were considered for the injection header segments. The applicable individual failure probabilities, failure rates, and mission time were combined to estimate the total unreiiebility. Estimating the unreliability and the associated uncenainty involves two major steps: (1) estimating probabilities or rates and uncertainties for the different failure modes and (2) combining these estimates. These two steps are described below in Sections A-3.1 and A-3.2. A-3.1 Estimates for Each Failure Mode Estimating the probability for a failure mode requires a determination of the failure and demand counts or exposure time in each data set, a decision about what data may be pooled, and a method for estimating the failure probability and assessing the uncenainty of the estimate. A-3.1.1 Demand and Failure Counts I l J For the independent failure probabilities, the unplanned demands were counted by failure mode as follows. The tota! number of demands was obtained as described in Section A-2.2 for each of the other segments defined in Section A-1. These counts were used directly for the injection header segments and cold leg injection segments. For the pump trains, the number of demands applies to the MOOS failure mode. The number of demands for l'I S was taken to be the number of train demands minus the number NUREG/CR-xxxx, Vol. x A-12 i I
l Appendix A I E E of unrecove+:d MOOS events. With one exception, the number of demands to run was the number of demands fx ITS minus the number of unrecovered FTS events. The t aplanned demands were associated with all the failures on unplanned demads for the total failure probability estimates. For the independent failure probability estimates, all identified demands I were counted, but failures associated with CCF events were excluded. (For the HPI study, there were no CCF events in the operating experience based on the unplanned demand data.) A run time was known or estimated for each of the events counted for FTR demands. as described in Section A-2.2.3. For each recovery mode, the number of demands is the number of corresponding failures, and the number of failures is the subset of the failures that werejudged to be not recoverable. Since the failure data was sparse, the failures identified in the test and non-SI events were evaluated with regard to recovery. Including these events into the recovery analysis reduced the uncertainty of the nonrecoverable failure probabilities. A-3.1.2 Data-Based Choice of Data Sets The data were reviewed to see if pump train events could be combined across high-head and intermediatt-head pump types. For this assessment, failure probabilities and FTR rates and their I associated 90% confidence intervals were computed separately for each group of data. The confidence intervals for probabilities assume binomial distributions for the number of failures observed in a fixed number of demands, with independent trials and a constant probability of failure in each data set. Similarly, the confidence intervals for FTR in the risk-based model assume Poisson distributions for the number of failures observed in a fixed time period, with independent failures and a constant failure occurrence rate in each data set. A comparison of the confidence intervals gave an indication of whether the data sets could be pooled. I The hypothesis that the underlying maintenance-out-of-service probability for the high-head and intermediate-head pump trains is the same was tested. A chi-square test was performed to assess whether the data provide evidence for separate probabilities. A similar test was performed to assess whether pooling might be reasonable for the ITS rates. Decisions concerning the pooling of the data were made based on the engineering feasibility of pooling together with the results of the statistical tests. A-3.1.3 Estimation of Failure Probability Distributions using Demands The probability of failure on demand was modeled using Bayesian tools, with the unknown probability of failure for each failure mode represented by a probability distribution. An updated probability distribution, or posterior distribution, is formed by using the observed data to update an I assumed prior distribution. One important reason for using Bayesian tools is that the resulting distributions for individual failure modes can be propagated easily, yielding an uncertainty distribution for the overall unreliability. Bayes Theorem provides the mechanics for this process. The prior distribution describing failure probabilities is taken to be a beta distribution. The beta family of distributions provides a variety of distributions for quantities lying between 0 and 1, ranging from bell-shape distributions to J and U. i shaped distributions. Given a probability (p) sampled from this distribution, the number of failures in a fixed number of demands is taken to be binomial. Use of the beta family of distributions for the prior on p is convenient because, with binomial data, the resulting posterior distribution is also beta. More i A-13 NUREG/CR-xxxx, Vol. x
Appendix A specifically, if a and b are the parameters of a prior beta distribution, a plus the number of failures and b plus the number of successes are the parameters of the resulting posterior beta distribution. The posterior distribution thus combines the prior distribution and the observed data, both of which are viewed as relevant for the observed performance. The data were too sparse to show significant differences between groups (such as plants). Therefore, the data were pooled and then n odeled as arising from a binomial distribution with a failure probabilityp^. The assumed prior distribution was taken to be the Jeffreys noninformative prior distribution. 4 More specifically, in accordance with the processing of binomially distributed data, the prior distribution was a beta distribution with parameters, a = 0.5 and b = 0.5. This distribution is diffuse and U-shaped, and has a mean of 0.5. Results from the use of noninformative priors are very similar to traditional confidence bounds. See Atwood^d for further discussion. The data were pooled, not because there were no differences between groups (such as plants), but because the sampling variability within each group was so much larger than the variability between groups that the between-group variability could not be estimated. The dominant variability was the sampling variability, and this was quantified by the posterior distribution from the pooled data. Therefore, the simple Bayes method used a single posterior distribution for the failure probability. A-3.1.4 Assessments and Estimation of Failure Probability Distributions Using Rates The FTR probabilities for each train type were derived from rates of occurrence rather than from 3 failures and demands. Bayesian methods similar to those described above were used. The analyses for g rates are based on event counts from Poisson distributions, with the Jeffreys noninformative prior distribution. The simple Bayes procedure for rates results in a gamma distribution with shape parameter equal to 0.5+f, wherefis the number of failures, and scale parameter 1/T, where Tis the total pooled running time. Engelhardt^4 gives details. A-3.2 The Combination of Failure Modes l The failure mode probabilities were combined to obtain the unreliability. Two steps were used to g obtain the reliability for the HPI system. First, simple algebra was used to combine failure and g nonrecovery probabilities, thereby simplifying the system fault trees. In the second step, Monte Carlo simulation using the IRRAS software suite ^* allowed the quantification of the system unreliability and its uncertainty. These steps are discussed in more detail below. 1 A-3.2.1 Nonrecovery Probabilities and Rates l The algebra used to compute nonrecovery probabilities or rates and their uncertainty bounds for I applicable failure modes was based on the simple fact that Prob (A and B) = Prob (A)* Prob (B). In the application here, A is the event " failure with a cenain failure mode" and B is the event "nonrecovery from the failure." Since this expression is linear in each of the two failure probabilities, the estimated mean and variance of the probability of failing and not recovering can be obtained by propagating the means and variances of the two failure probabilities. The process, described in more generality by Martz and Waller,^# is as follows: NUREG/CR-xxxx, Vol. x A-14
Appendix A
- Select appropriate beta distributions for each applicable basic failure mode and probability ofnonrecovery.
- Compute the mean and variance of each beta distribution.
(
- Compute the mean of the nonrecovery probability for each case using the simple fact that the mean of a product is the product of the means, for independent random variables.
Compute the variance of the nonrecovery probability for each case using the fact that the variance of a random variable is the expected value ofits square minus the square ofits mean.
- Compute parameters for the beta distribution with the same mean and variance.
- Report the mean and the 5th and 95th percentiles of the fitted beta distribution.
For failure to run, based on a rate, a rate of nonrecovery was not computed. There were no observed failures to run in the SI actuation events. The means and variances of the nonrecovery probabilities or rates calculated from the above r process are exact. The 5th and 95th percentiles are only approximate, however, because they assume that [ the final distribution is a beta distribution for the probability of unrecovered failures or a gamma distribution for the nonrecovery rate. Monte Carlo simulation for the percentiles would be more accurate than this method if enough simulations were performed, because the output uncertainty distribution is empirical and not required to be among the shapes described by beta or gamma distnbutions. Nevertheless, the approximation seems to be close in cases where comparisons were made, and it greatly reduces then number of failure combinations for consideration in the HPI system unreliability quantification. Because the data were sparse, the Jeffreys noninformative distribution was always used as the pnor. A-3.2.2 HPl System Unreliability Four senes of HPI system unreliability calculations were performed. Because of the complexity of the HPl system models, IRRAS was used to perform these analyses, rather than an extension of the moment-matching method of Section A-3.2.1. The series are as follows:
- Plant-specific operational models, using unrecovered maintenance-out-of-service, independent failures to start, and independent failure to run for each applicable train type.
[ Recovery from high-head and intermediate-head maintenance and failure to run were not considered since no failures occurred for these modes. For each plant, as applicable depending on plant configurations, the fault models included contributions from umecovered ( independent failures in injection header segments. Independent failures of the segments containing check valves were also considered, although recovery was not modeled since no failures were observed. Finally, the models included CCF contributions from failures to start ( of high-head pumps, failures to start ofintermediate-head pumps, failures to run of high-head pumps, failures to run ofintennediate-head pumps, and failures of the injection header segments. Recovery was included for the CCF contributors for the independent failure modes that identified failures. (The total failure probability used in the CCF estimation used [ the independent failure probability for the failure mode ofinterest.) NUREG/CR-xxxx, Vol. x A-15
Appendix A Alpha factors were used with the total failure probability estimates, as applicable, for the CCF contributors. For the operational models, the failure modes were characterized with beta distributions, except for the FTR that used a gamma distribution, using raw data consisting of failure and demand counts. A plant-specific model was evaluated for each of the 72 plant units in the study.
- Plant-specific risk-based models, for each of the 72 plants. These were like the operational data models.
In the HPI system unreliability calculations,3,000 simulations were evaluated in most IRRAS runs. The simulation outputs provided estimates of the mean value of the unreliability, together with uncertainty bounds and a standard deviation. A-4. ESTIMATION OF ADDITIONAL DISTRIBUTIONS FOR TREND ANALYSIS l A-4.1 Frequency of Events l There were very few failures on unplanned demands, far too few to justify analysis for trends. However, there were enough of certain events to justify a trend analysis. These events are SI actuations (subdivided as automatic / manual and inadvertent / spurious), and reported failure events under all circumstances, unplanned demand or not. (Afailure event is defined as an event in which one or more E segments failed.) The frequency was defined as the expected number of events per " year." The quantity 3 " year" was reactor-calendar-year if the events could occur at any time, or it was reactor-critical-year if the events occurred almost entirely when the reactor was critical. Three analyses were performed. First, each frequency was examined to determine whether significant differences exist among the years. The hypotheses of a simple Poisson distribution for the occurrences, with no differences between years, was tested using the Pearson chi-square test. The computed p-values are approximate since the expected cell counts were often small; however, they are useful for screening. Second, cumulative plots were constructed, to see if any trends were gradual or sudden. The i concem was that plants would have a sharply demarcated leaming period at the beginning oflife, after which they would quickly become dramatically better. Because the number of plants in the data period varies by age-there were few very young plants and few very old plants--the cumulative plot had to be , modified as follows. As an example, consider a plot against age. Plant-specific plots were not useful, I because no one plant had very many events. Instead, the plot was for the industry as a whole. Each event was plotted, with the plant age at the time of the event plotted on the horizontal axis. The cumulative plot jumped at each event occurrence. The height of the jump was 1/(exposure time for that age). For example, if the event occurred at a plant of age 2. the denominator was the number of reactor-years for reactors of age 2 during 1987-1997. The slope of the cumulative plot was an estimate of the frequency of events, and a change in the slope indicated a change in the event frequency. In the analysis described below the frequency was assumed to change exponentially, but this plot was used as a diagnostic, to help reveal whether the assumed gently changing rate was believable. Finally, a loglinear model was used to quantify the trends, as described below. . I NUREG/CR-xxxx, Vol. x A-16 I i
Appendix A y For calculating a trend involving one explanatory variable, such as calendar year or plant low-power license year, the count in year i was assumed to be Poisson distributed with mean A,ts, where is is the total exposure time during year i, either total reactor, calendar-years or total reactor-critical-years. The frequency Aswas assumed to depend on the year according to in A, = a + bl . The SAS procedure GENMOD" was used to estimate the parameters a and b by the method of maximum likelihood. The parameter b can be considered a slope parameter in the logarithmic scale. Goodness of fit was evaluated by examining both the Pearson residuals and the deviance residuals (see Ref. A-9). The sum of the squared residuals should have a chi-squared distribution if the assumed I model is correct. A too large observed sum of squares indicates underfit. A too small observed sum of squares indicates overfit. Disagreement between the Pearson and deviance sums of squares indicates that the data set is too small to allow an accurate assessment of the goodness of fit. If the fit was adequate, the statistical significance of the trend was calculated usin me-sample approximation, under which the maximum likelihood estimator of the slope parameter is appioximately nonnally distributed. For plotting purposes, a confidence band was constructed, as desenbed in Ref. A-9. I This is a band yielding 90% confidence that the band contains the tme frequency at all times. Because it accounts for all times simultaneously, the confidence band is wider, by about 30%, than a 90% confidence interval for the frequency at any one particular time. For modeling a frequency as a function of two explanatory variables, such as calendar year and low-power license date, the data were prepared as follows. The unplanned demands and the critical hours I were counted for each time period, typically each calendar year. The count within each time period was assumed to be Poisson distributed. Each record of the data file therefore contained five fields: the plant identifier, the calendar year, the low-power license year, the corresponding count of events, and the exposure time (either critical or calendar years for the plant). GENMOD was invoked with this data file. It fitted the model in A, = a + b,i + b,j (A-1) for calendar year i and low-power license yearj. The year i and agej are integers, and the parameters b, and bi quantify the effects of calendar year and low-power license year, respectively. If the two goodness-of-fit measures, the Pearson sum of squares and the deviance sum of squares, ~ did not agree on whether the fit was adequate, the data were pooled more. This was done by grouping the times into two-year bins instead of one-year bins. Calendar years were grouped as 1987,1988-89,1990-91, . .,1996-97, and low-power license years were grouped as 1966-67,1968-69. .,1996-97. This created fewer cells, and brought the two goodness-of-fit measures into agreement. { If the two goodness-of-fit measures agreed that the fit was inadequate, between-plant variation was added to the model. That is, the model was { in Ay = a + b,i + b,j + u ( H A-17 NUREG/CR-xxxx, Vol. x W
i Appendix A l where o is a normally distributed random term, with each plant corresponding to a different value of u. i This model was evaluated using the SAS procedure GLIMMIX^" . The estimates were reported as l A(i) = exp(a + b,i + b,j) graphed as a function of calendar year, i, for several selected values oflow-power license year.j. The ) graph was described in the text as refernng to the industry average, ignoring plant-specific variation, because the o term was not shown in the graph. l The above discussion has considered both plant age at the time of an event and plant low-power license date. These two presentations are equivalent, for any event occurnng on a known date. That is, let i andj be the event date and the low-power license date, and let k be the age of the plant at the time of the event, k = i-j. Then the model (A-1) can be rewritten as in Ay = a + b,i + b,j
= a + b,i + b,(i- k)
= a + (b, + b,)/ - b,k .
This expresses InA as a function of event date and plant age instead of event date and low-power license date. The only difference in the two expressions occurs when dates and ages are rounded off, say to the nearest year. The rounding can cause slight differences in the numerical values. In this report, the model in terms of low-power license date was used, for two reasons. First, plant age at the time of the event is strongly correlated with event date, but low-power license date is not. This makes the significance of indnidual factors easier to interpret when low-power license date is used. Second, the computer programming happens to be simpler in terms of low-power license date. A-4.2 Number of Failed Components per Failure Event l l Some failure events involve multiple failed components. The failed components cannot be analyzed in the same way as failure events in the previcus section. The reason is that the events were treated as independent in the previous section. The failed components are not independent; instead, they tend to come in bunches, because a single event can involve several failed components. Therefore, the failed components were analyzed graphically as follows. The failure events were ordered by event date, and each event was then assigned a sequence number: 1,2,3, etc. A cumulative plot was constmeted whichjumps at the ith event by the number of components that failed. Thus, the horizontal axis counted the cumulative number of events, and the vertical axis counted the cumulative number of failed components. The slope showed the average number of failed components per event. , This plot fell nearly on a straight line. Therefore, we concluded that the number of failed components per j event did not seem to be affected by time, and that no further analysis was necessary. l A-5. REFERENCES g, A-1. Event Reporting Systems 10 CFR 50.72 and 50.73, NUREG-1022. I)i NUREG/CR-xxxx, Vol. x A-18 . I i
)
[ A-2. A. Mosleh and D. M. Rasmuson, Common Cause Failure Data Collection and Analysis System ( Volume 5-Guidelines on Afodeling Common Cause Failure in Probabilistic Risk Assessments (Draft), INEL-94/0064, December 1997. A 3. George E. P. Box and George C. Tiao, Bayesian Inference in Statistical Analysis, Reading, MA: { Addison Wesley,1973, Sections 1.3.4-1.3.5. A-4. Corwin L. Atwood, Hits per Trial: Basic Analysis ofBinomial Data, EGG-RAAM-11041, { September 1994. ( A-5. M. E. Engelhardt, Events in Time: Basic Analysis ofPoisson Data, EGG-RAAM-11088, l September 1994. ( A-6. K. D. Russell et al., Systems Analysis Programsfor Hands-on Integrated Reliability Evaluations L (SAPHIRE) Version 5.0, Integrated Reliability and Risk Analysis System (IRRAS) Reference Afanual, Vol. 2, NUREG/CR-6116, July 1994. A-7. II. F. Martz and R. A. Waller, " Bayesian Reliability Analysis of Complex Series / Parallel Systems of Binomial Subsystems and Components," Technometrics,32,1990, pp. 407-416. ( A-8. SAS/STATSoftware: The GENAf0D Procedure, Release 6.09, SAS Technical Report P-243, 1993. A-9. Corwin L. Atwood, Afodeling Patterns in Count Data Using Loglinear and Related Afodels, ( INEL-95/0121, December 1997, pp. 33-36. A-10. Wolfinger, R., GLIMMIX, http://www.sas.com/techsup/ download / stat /gimm612.sas, version '[ dated March 12,1997. ( [ [ [ ( A-19 NUREG/CR-xxxx, Vol. x
,( r Appendix B HPI Operational Data,1987-1997 l l
Appendix B HPl Operational Data,1987-1997 In the subsections below, listings of the data used for the high-pressure safety injection (HPI) system reliability study are provided. First, the results of the data classification for failures are listed, then the results of the classification of the unplanned demands. The HPI system operational data used in this report are based on LERs residing in the SCSS database. The SCSS database was searched for all records that explicitly identified an engineered safety feature (ESF) actuation or failure associated with the HPI system [high-head safety injection, intermediate-head safety injection, reactor / borated water storage tank (RWST/BWST)]for the years 1987 through 1997. To ensure as complete a data set as possible, the SCSS database was also searched for all safety injection actuations for plants that have an HPl system. These records would provide an additional source of HPI actuations because (1) the HPI system is demanded as a result of safety injection demand and (2) HPI may be required to start following a reactor trip as a result of a reactor coolant system overcooling experienced as part of the trip. B-1. HPIINOPERABILITIES The information encoded in the SCSS database, and included in this study, encompasses both actual and potential HPI failures during all plant operating conditions and testing. In this report, the term inoperability is used to describe any HPI component malfunction either actual or potential, except an ESF actuation, in which an LER was submitted in accordance with the requirements identified in 10 CFR 50.73. It is distinguished from the termfailure, which is a subset of the inoperabilities for which a segment of th'e system was not able to perform its safety function. Details of the classification of the inoperability events is provided in Section A-2.1 of Appendix A. Table B-1 provides the column headings Snd associated definitions of the information tabulated in Table B-2. Table B-2 is a listing of all the failure events that were included in the study. The events that were classified as failures include the applicable failure mode. A listing and description of the events used in the unreliability analysis are provided in Appendix C. B-2. HPI UNPLANNED DEMANDS To estimate reliability, information on the frequency and nature of HPI demands was needed. For the purposes of this study, an unplanned demand was defined as an event requiring either the system or segment of the system to perform its safety function as a result of a valid initiation signal that was not part of a pre-planned evolution. Unplanned demands usually were the result of a safety injection. Other plant conditions may have also resulted in an unplanned demand of HPI based on the plant-specific design of the HPI initiation circuit. These initiations of HPI were also included in the study if they resulted from a valid signal.- Spunous signals or those inadvertent initiation signals that occurred during the performance of surveillance test were also cicssified as unplanned demands. For example, the shorting of test leads or blon fuses that resulted in a demand signal were counted as a valid demand. The spurious or inadvertent demands were counted due to the sparseness of the failure and demand data. Further, these B-1 NUREG/CR-xxxx, Vol. x
1 Appendix B l types of actuations were considered as random tests on the response of the HPI system to a valid SI signal. The LERs identified from the SCSS database scarch were resiewed to determine the nature and frequency of HPI unplanned demands. Specifically, each LER was reviewed to determine what segment (s) of the system were demanded. To determine which segment (s) of the system were demanded, the IPE and/or Final Safety Analysis Report (FSAR) for each plant were reviewed to determine the operating characteristics of the system for the specific plant. In addition to the operating characteristics, the plant-specitic system schematic for HPI was also reviewed. The purpose of this review was to determine which segment (s) of the system were demanded when reviewing the full text of each LER. The identification of the system operating characteristics and schematic for the system was necessary to capture the unplanned demand frequency for all the HPI segments because many LERs simply stated all systems functioned as designed. However, the full text of the LER would describe plant conditions that should have resulted in an unplanned demand of HPI based on the information provided in the IPE or F3AR. For example, the plant would state in the LER that reactor coolant pressure was less than 1500 psig. Based on the information provided in the IPE/FSAR for the particular plant, the condition would result in the pump pressure being greater than the reactor coolant system pressure. Hence, tiow through the cold leg injection paths into the reactor coolant system. However, no explicit idcr.tification of the HPI cold leg injection was found in the LER. Therefore, based on the narrative of each LER and plant-specific knowledge conceming HPI initiation and operation, it was possible to determine a relatively accurate number of HPI unplanned demands throughout the industry, even though a not every demand was explicitly identified in the LER. As a result of using this method for counting HPI g segment demands, the reader / analyst should not compare the results used in this study to a simple SCSS database search for an HPI demand count. For more details on the counting of unplanned demands, see Section A-2.2.1 in Appendix A. Table B-3, which follows the :able of HPI failures, provides the results of the search and categorization of HPI unplanned demands. I I I NUREG/CR-xxxx, Vol. x B-2 Ilt J
Appendix B Table B-1. Column heading definitions and abbreviations used in Table B-2. Column Headmg Definition LER number Self-explanatory. However,in some cases, the LER number listed is for the unplanned demand in which a failure was observed. It is not unusual for a plant to report the unplanned demand in one LER and mention that the system did not respond as designed. LER number XXX89001 and a followup LER (i.e., LER number XXX89003) provide the details of the failure and subsequent corrective actions. Also, the LER number may not match the docket number for a dual unit site. The LER may be under a Umt I number because the event afTected both units; however, a failure may also be identified at Unit 2. Event date The event date is typically the date identified in Block 5 of the LER. In some cases, the Block 5 date may be different than the failure date because the system may have run for a period of time prior to the failure. In all cases, the event date is the date of the actual failure. Segment affected The segment of the system that the malfunction was assigned to: LOOP-INJ, cold leg injection path I segment; INSTRMNT, instrumentation and control; CC-PUMP, high-head pump segment; SI-PUMP, intermediate-head pump segment; INJ-HDR, injectmn header segment; PUMP-SUCT, pump suction header segment (if apphcable), RWST-SUCT, reactor water storage tank suction. Cause he cause of the inoperabihty: Design, system design; Maintenance, error associated with the performance of a maintenance activity; Hardware, a malfunction of a cornponent that was installed properly; Gas binding, gas accumulation in the pump suction or in the purnp casing; Support sys., the rnalfunction associate with a support system that ultimately prevented operation of a segment of HPI (an example would be a loss of a 4,160 Vac powerboard); Personnel, operators incorrectly operated the segment (an example would be that operators did not follow an established procedure to restore reactor coolant system pressure); Environment, the rnalfunction was the result of an environmental problem (an example would be an frozen recirculation ime due to extreme cold weather). Method of discovery The method of discovery identifies how the inoperabihty was found. SI Demand, unplanned demand [ (ESF actuation); non-SI Demand, unplanned demand (actuation other than by ESF systeme.); Abnormal System Parameter, discovered through the normal course of routine plant operations (this category includes operators observing non-alarming parameters associated with operation of the system, etc.); Tour (this category includes operator walkdowns); Alarm (control room annunicators, alarms, etc. identifymg a system anomaly); DesigrvReview, engmeenng design review; Test, penodic surveillance test. Failure mode he failure mode is nsk-related information that is only provided for the events that are classified as failures. FTS, failure to start; FTR, failure to run; FTO, failure to operate; MOOS, maintenance-out. of-service. For the events classified as faults, the failure mode is N/A. Recovered! True-If the segment failed as part of an unplanned demand and operators restored segment operation recoverable without replacmg components. For a recoverable failure, the failure wasjudged to have been recoverable had operators anempted to restore the segment to operation. False-For all other methods of discovery or if recovery by plant operators was performed by replacmg components. Common dependency True--if more than one segment failed as result of a single failure mechamsm. As an example, two failure flow control vah es fail to open on demand as a rtsult of a blown fuse m a ecmmon control circuit. Fahe--independent failure. Common cause failure True--if more than one segment of the system exists m a failed state at the same time, or withm a small time interval as result of a set of dependent failures resulting from a common mechamsm. As , an example, two flow control valves fail to open on demand as a result ofimproperly set torque switches for both vahet False-Independent failure. B-3 NUREG/CR-xxxx, Vol, x
>u3{p W m n
~ se er mulu nai s s s s s s m
oCaF o e e o e e e o o o o o o o o o o o o o o o o o o o e C N Y Y N Y Y Y NN N N N N N N N N N N N N N N N N N Y n cn uer y e m nd u
- r. l om pFia C s D o o o o o o o N N N N N N N o o o o o o o o o o o o o o o o o o o o N N N NN N N N N N N N N N N N N N N N m
/ e dlb e a r
e re v o c o e c v e s o o o o o o o o o o o o o e e se s es so o o m P h No No No Ye No No No N N N N N N N N N N N N N Y Y Y Y N N N e r e ud o OR OR RS O OOR ROOOS R OS RRS OOOORO liaM T TTF FT FTF TF FT FTF TF FT FTF TF FT FTF TF FT FT T T T T F F FTT F FTF T F FT T F y r e v o ma r a m c g P g g s d. n www l a .w d n d d n n ww wiwi n n i s D . ito eie i ie - y ie a a a ie ie ie o e t t o mm i r u o v e eve v S ve v e ev dn v eo hv eoh d 3 ht o D I S-o h s e Rvt R /n/R n D I n s l a R m/ o gn mSr - r D I m e d. u I e e D D I R R a R s R s g gne m/e
/ /
n n v - l l e m g g g S- s S -S - ig b u ig bu e n t t s se o r e e elbu is is is s s n u s t t r t n is a n D n n s is is D es ro es or t M No Te Te Te nT o oT eA bD e lA n S no no Te DeDeS D T D T o 1 I T T DD D M m m e t e t e g s s n s u e r e r l e i e r d er er l e e l le S y le er re S y e er e le le e er er er er l l l a u n u n a a a n n n tr n a a t n a n n n n a a u a M C n g ed o ne d g Bn i w w w n d d o o n o np o o ns dw dwp oor ns dw nos sons on s o n wd dwd c d ew s rd is e co r r e D P P P DG s c o r ise a a i l l l
~
a a PeP eP SeP u e a a u e a e r i l r s s s r r r p r i l r 1 1 r p r r S P i f r e e e a a oP a r P P P P r r l I r i l r r i l r rd ee bt c M 2 2 4 2 8 2 me uT f 1 1 5 1 2 I I i 1 1 1 i i 1 1 I 1 1 i I 1 1 1 t s NA n e v e t r M_ . dr cu t d d r - e r n et e r p d p p p l r d d p r mp n jn o m p p mmp n p p j j j p l d mmmiS - - j n n mi1 j n p -u mu u mc e I n ml u - i u u u jT i l l
- - u mI I
I mu u mI mI - - I u j - n
- 1 j
l i gf - j p P -n P P P- n j j - P n u P P u p - e p p P I n a SA ef o - - - I S n- -n PC- uP p o ia o P - C ia P
- C- C- P - o os o t
y oo o C C
- - I f
n Lo C C I I C C C C WI I I S C C C C R S IS C S L T L IS C T IS C C S L S L L C C S I o r o - r I I i o _ t c 9 j e t n e 1 1 7 9 6 6 7 9 0 9 9 9 1 8 9 8 5 9 4 1 9 0 i n y e a EvD t 9 0 S2 19 3 8 8
/ 0 /
2 / 1 9 3 / 2 9 / / 9/ / 9 / 1 1
/
9 9 8 /8 89/ 8 8 /! / /6 8 8 9 8 9
/ 6//
9 2 22 5/ 2 8 I 1 8 26 1 2 / 39
/ /0 3 2 3 15 8 /9 //
6 / / 1/ / 1 1 / / 1 9
/ 2 /
8 8 6 9 2 8 / 2 9 /2 1 E
/ 01 / / 2 2 0 / 1 / / / / / 1 1 ////2 / / / /
t e 1 9 9 1 1 1 7 1 3 3 9 2 5 1 1 2 5 7 9 9 3 1 6 7 2 3 f a s r 7 3 9 7 6 2 1 8 9 1 9 7 6 2 9 5 9 5 3 1 1 1 1 E 1 4 1 15 0 0 e e 0 ) 0 0 0 2 0 2 0 0 0 00 0 00 0 N 1 1 1 0 1 0 2 3 3 0 1 r Rb 0 0 0 0 0 0 10 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 u s E m 9 1 2 1 7 6 6 7 9 8 (0 9 1 1 9 6 9 8 5 9 4 9 8 9 8 8 9 8 9 1 9 9 8 6 0 8 8 9 9 s L u 8 9 9 9 9 9 9 9 9 8 8 9 8 9 4 4 5 5 2 2 6 6 5 5 N 3 3 8 4 4 4 6 7 7 7 5 5 3 7 3 41 e r 1 1 6 3 3 3 21 5 5 5 5 5 5 8 1 1 1 1 I 1 0 0 4 4 7 7 p 3 3 3 3 3 3 4 4 4 4 4 4 4 4 3 4 4 4 4 3 3 3 3 3 3 2 2 h ig i 1 2 E i r r r 1 I l e ae a e ea I I I 2 I 3 3 n n
. m a c lc lc y y y y l
s r r 1 1 o y yo 2- N u u u le le le le 1 2 2 2 f f e e v v sss s an ae e n N N N la la la la d d d d I i 2 2 2 B t o o o o y l R i iR beb e C C n as as as V V V V lC a a a a e a o o o o 2 2 s b b b b a la s- - w w w w n n s o o l l s n s s r r r r wt r I I P a n a n a e v e v e v e e a w a w w w k k l l l t v d d d d a h t a a o o y ys ssr i a ba ivbi a a i b o or la a a a a a o o r l ia ia ia r r ia t a kr k rk a r a ae ae e e r r r y y t t t T A A A B B B B B B B B B B C C C C C C C C C C D D D D E QOpy5 { D CL
ll j I,! Ii) !! il N ugg t D u ve ns er o ul u nai s uCaF o o o o e o o o o o o o o o o o o o o o o o o o o o o C N N N N Y N N N N N N N N M N N N N N N N N N N N N N y n c nu ner e u idnl n ea i o pF Ce o o o o o o o o o o o o o o o o o o o o o o o o D o o o N N N N N N N N N N N N N N N N N N N N N N N N N N N le d' e r a b e e r
,v v c o e ce s s R R No No No Ye No NoN oN oY eN oN oN o o o o o o o o o es se o o o o o N N N N N N N N Y Y N N N N N e
r e ud o liaM F S TOOORS T T T T TOR T TOOS T T T O I R R S OOOORS OR O T T T T T T T T T T T T OR T T T O F F F F F F F F F F F F F F F F F F F F F F F F F F F y t r n e a v r o a c s P g D i w s . wd>we n w w f ie v y ie S ve wi v it o ie v i e o R e d n l a R me h o e v e d o / a m/ D R s R R ht n m r n I
/
n le /n
/
n e t t ig s s s a s se m r t t D e t o n is g S g
- r mmmb r r r u g g i r M
s e o ne is t s u s t a a a o st s t is t es e s t s e s t e u Te Te De lA T eT S Te A I b D n D e o e T T T l l A lA A T T T D T T r e e e T D T o e g s n p u a l e e r er e e r e r r e er l e di e l e er e e er e re l e e l e e e er l a u neu r r r r n a a a a n a a a a rn n a ar r r C n o dwd w s d d w w ng wa wa uin n uo B s os i n n a a a ww w gn w w w w o n n ww s so d d wd e r r r r r is dr d r sr s e a e r d d d r r r is d r d d d e a a ar r a Per Pr e ar ar r dr c a or ime P e a Ha a a eDl a a iPP G P 1 1 i i l l i l l l l a a a Dl i i l l i l f i l l f i l l I l I P P rd ee bt e me uT f 1 i i I 3 1 I i 1 2 1 2 4 i 1 i I I I I I I i 1 I i I 2 i NA m r t t d c r n et e p j l d r p p p t c u p d i p u p cu t d l d r mc mI n- j - ml n j p mp S p mS p- mjI u p n in u u n u e pmms j j p l mm I n n n - p u mu P u mT mu a i - - e
- p- p u mI gf - u j I I -
ef P I S n n n u P p u n j n SA P- o mP I P P o - a - - iar -P sy um C C o o P - CPt - - - I I I r I I I S L S T S S T S S P C C L S C S R T T T S C P S C L L S S I I WiiiP a r a ra r C u I I C oo oo P - - I I I s a 7 0 7 7 8 m t n e 7 8 4 8 9 4 9 8 /9 8 9 1 2 5 6 8 8 4 9 5 6 2 0 u eta 2 8 /8/ /9 4 / 3 / 8/ 92 / 0 0 / / / 29 94 39 02 789282 06 7 S9 9 0 EvD 2S9/ 25 7 / 9 2 8 3 1 9 62
/
9 8 3
/
1 1 1 5 I
/ / / /
8 3 8
/ /
/ / / 29 / / 6 /7/ / 5 / / / /
- / 2 6 1 1 1
9 8 1
/ /
5 6 1 12 8 8 1 5
/ 1 10 12 0 9 / /
1 1
/ / / / /
1 2
/
/ 1 1
/
1 1 1 1 1 2 5 4 8 8 8 9 2 1 5 r 0 0 2 9 8 3 8 7 e I 3 12 8 3 0 4 0 1 3 3 6 0 5 0 9 2 6 7 Rb 1 1 0 1 0 0 0 0 1 1 1 1 2 2 2 1 0 1 0 2 2 2 0 1 2 1 7
)
E 0 m 29 S7 0880940940 870 S90 940 90 90 90 87 0 0 0 0 4 0 0 0 0 0 0 0 5 7 8 1 2 2 5 0 0 0 0 0 6 8 8 0 0 6 0 0 2 0 d L u 9 9 9 8 9 9 9 9 9 8 8 9 9 9 9 r e N 75 46 58 44 444 44 44 44 4 3 3 3 3 3 7 7 6 6 5 5 9 9 9 0 6 3 3 u 1 1 1 1 1 4 4 S 8 0 0 0 6 6 7 3 2 2 i n 2 3 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 3 3 3 3 3 3 3 4 4 t n o mr ( c e 1 1 i i 1 1 1
. m n e 2- a o y
i k k k c c c kc kc 2 2 3 3 e N n n e e e e e n n n n t t t t 1 1 k , B t n a o u N N N N N io io io io ee ce an 1 1 2 2 3 3 e e e e la C o y2 lha a a a a a a a a mmm e r er e n n n mmP a n nP a aP P nuaw aunwigYen GiuG iu ui r 1 1 I 1 1 1 -r l P a a n n o o o b lb le C n n n n n n t t t d da da a d d da add idan ndi ndin d eK KeMMMM accc s ia ls ls a ia a r . i i n n mimmd n d ll i li l i T t D F F G G G G G G l l l I l I l I l l I I I I MMM i r Z C c, h b N A N x- o_ X t l
j@@c.r g a S m_ u n oe ns r nai ul u e _ uCaF o o o o o , o o o o e e o o o es os o o o o e o se o o o o o s s C N N N N N N N N N N Y Y N N N Y N N N N N Y N Y N N N N N a m y nu,cn e u e r ed u nil o n a m m C #F o o o o o o o o o o o o o o o o o o o o o o o o o o o o o C N N N N N N N N N N N N N N N N N N N N N N N N N N N N N a_ -
/e dlb e a r
e r m v ev oo c e c s s s s s s u ReR No No No Ye Ye No No Ye Ye No No Ye No No No No No No No No No No No Ye No No No No No m e r e u s ludo iaM ORR T R O TORT TOST TORDS T TF TF T T S' - S S I T DOOS S R S DRORS O T T T I T T T T T T 1 T T T T T F F ~ I F F F l' F F l l F F F F F F F F F F F F F F F F F s y r m m m
. am e a a a v r r r o a a a c P P P g _
s d . wd d. d. d. i D ie w s. y n a ie w s y i e u o
. - -- - sy i
t n o a m f o v S e l a m e v e S v l a e w w w d i wlS h o u d R D R R D D C - D am s ht o / n g n u nv mra s s n s I S-
/
n g mo m/S r g I I S S r r w I S o r le b u ru ru ur ou D s e es ese so n b en s e r - t M Tse eD b A lA is t eT e t o t e e a b n e mno no u is o t t t t t o o o o m T n T D is lA A D I n n T T S T T T T n A T T T T T r e e s u l e l e er er er l e r le e e e er l e e l l l e l e e e e a C n n ra ne ur u a u e n e a n ar a r a ru n ae ar n rn en eae n n r a ea lea ar r r r n w n d d wd n n w o wwwd n w w n n n w n n w w w w g o d o s ce ce d cr s e o ig d wd dr dr ce sor dr d r ro s r sos or d r o s sor dr d dr d r e en a er o a or re es ra o ra a r r is r or a or e a a e e e a e r e a a a a D P l f P P P l I P P D i l P i i l l l I P P l I i l P P P i l P P l I l f i l l I s u rd ee a bt c me I 2 I I 2 2 I 2 I l 2 2 1 i 1 2 l 1 1 1 i 2 1 2 i i I i 1 uff s NA a m t r t c nd et e d r p p p p p u r o dl r p p p p d r p r d p p l d me e l i p mu u mmjjmjmjmS n nI pIn p p np u T mmmmI -n- jjn nu mmmmimimmI jl - f i l u u u j u jn- uP -uP-j - l m jn u P P p p P - p P- pPu S-u u u
- I I - -
gT u u u p
- n ef SA I I
- - P - - o o - o - o C C o o C o C o C- W P- -P - P- P o I I I I o I
I I I
- P P P P In I
l I I I P- I I C C C i m S S C t C L L C L C L C R S S S S L S S S E S S S IS S C C C s - t n e eta 1 9 /
/ 9 90 6 0 3 S7 2 8 7 9 /
/ / 9 0 / /
0 8 9 / 94 7 8
/ 8 9 9 9 7 7 6 8 9 8 /
8 2 8 9 2 7 2 4 9 / / / 2 8 2 68 8 0 9 8 9 7 0 9 7 0 u-a - EvD 4 3// 1 0 2 3 3 1 1 M01/ / / 12 7I / 829 28 / / / I 1 8 8 4 / 29 / 9
'9 / 2 2
/ / /
1 5 7 - 01 /
/
4 6 I 0 1 I I
/ 0 // 2/
2 3 1 3 4 1 / 1 1 2 3
/ / / / / / / / / 0 / 6 8 7 6 7 7 4 5 4 2 7 6 2 3 2 1 2 1
/ 1 9
1
/ / 2/ 9/ / / 2 /
1 / 1 2 5 I 1 r 1 0 6 I 9 8 2 0 4 1 3 6 4 0 0 4 5 5 5 3 9 8 4 5 3 2 3 6 5 . - e 1 2 0 1 0 0 0 1 1 0 0 0 G 1 1 G 0 0 0 0 0 1 1 1 1 2 3 0 0 - Rb 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Em
) 1 0 6 0 3 0 7 2 8 7 7 7 7 6 9 8 2 8 4 2 7 2 2 7 2 0 9 79 08 9 9 8 9 8 8 9 d L u 3 9 9 9 9 9 8 9 8 9 9 8 9 9 8 8 9 8 9 19 2 2 2 e N 3 3 8 8 8 9 9 9 9 0 7 7 5 5 5 8 8 9 9 1 2 1 1 1 1 u 2 2 3 3 3 3 3 3 6 7 8 8 5 5 5 2 2 2 2 0 8 6 6 6 6 7 7 7 1 -
n 4 4 3 3 3 3 3 3 2 2 2 2 2 2 2 5 5 5 5 3 2 2 2 2 2 2 2 2 3 - i t n o ( c - e -
. m 1 s
2-N a 1 1 1 a a a a a a 2 2 2 1 1 2 2 2 h n d m B t n 3 3 e e n n n n n n n n n n n n 2 3 3 I I s s s 1 der d e ed ed ca la 2 2 2 2 s n n n n u n on A A A A A A ec ce ee eca da da Vd V V Ve er eB ie ons so o sno ns 1 r r e l a o e e e e e I 1 1 1 2 - l b P t s ls t s o o o o n t r bo oinoioi le i b b b mmmr e n Nh Nh Nh Nh Nh Oh OO n nO nP nP sP sP iPlaP la laPlaR ioR a le a la le t t t t a l l l t r t i i o o o o o o c c c oc oa oa olah h r r r r r iar a m T MMN P P R R S S S S u s hgO8?h? oy a m u
!ll ll
. jl) ! I ll jl]l ) l cug- DC n e me
. s r vulu ai i,s C Fa o o o o o o o o e s o o e s o e s o o o o o o o o o o o o o o o C N N N N N N N N Y N N Y N Y N N N N N N N N N N N N N N N y
i c i
- r. e iv e r
- i. ul i
d u o s a i i yF C s o o o o o o o o o o o o o o o o o o o o o o o o o o o o es D N N N N N N N N N N N NN N N N N N N N N N N N N N N N Y
/e dlb ea r r e e v
o v c o c ee o o o e s s s e e o e s o o e s o o o o o es o o o o es o es o es o es se
= RR N N N YY Y N Y N N Y N N N N N Y N N N N Y N Y N Y N Y Y e
r e ud i o lam S RRT R T T TST OR T T S RRRT RT 3 R S OOR RT RT RR R S R OS TST ST T l' F F F T F T TT F TF T F F F F TF T F FT FTF TF T I I F F ' l F F F F F F I F F F y . t . . . r e v m ar n a r ammt nm ar a a o a a r r r c a a a a P P P P P P D is sy s y d w wd i
- s. s . s. . Ad n w s
ie ie - y y y y - a e f d o l S a I S
- D
- R v
e R v e D n s d i S S S S l
- a a a a l l l o mi s e e v dn d i.
ht o m r n i I S
/
n
/
n I n mmmmr C DR /gne s r r r I I u e i e r o g g S s is n Du n o bno bo n bo noS no S ne is D se D uro se u r r e M s u n sss r - - - t t t t r ou es on es ou e ise e t t t - t t Te o b e e e b o b t I 1 T A T T T A T T n T T D T D n S A A A A n n DS T S T T mm e e m e e g g e t s t s t s s n n c y y y e er er re re n i e na a er e re er er e u r e l e d id l e er S S l e S l e e l l a r r C a a u a a a n n in n r a a n d n a n a u a n wn w w ng op po ons t t e g n e g r t v n w n wd w n n wdr nors iB t e os d e g i w wd dr d rc d d r r is a a Po a a De a P l r wl wl n 1 e G s s a G B sor ian dr is a P e Ml a De a a DS i d d r i i r is p p r e uS uP Se Pu y e a Pe a Por a Preis r i r o s d r r c dr os e l I I l 1 l l l i l l f D rd ee bt c me 2 2 i 2 i i i 1 1 I i 2 1 3 i I i 2 2 i 2 i I 2 i 1 I 2 i uIT NA t t t t d c c c u e p p u p p p p p p p p p u p p p p p p p p u mt c mp mp p S mmmmmmmmmS mmmmmmmmS p p p n r, T e u mu m m T- u u u u u u u u u P- uP- P- uP uP SV P P P P - P- D P P P- -S e P P mu T-P P u u u u Su uu u uu T mmm -
- - P P P- P ef SA - -
C- C- C C C- C- C C C- Wtsy C C C- C C C C- C W P- P- -P C I C I I '. t I I C S C S S R C C C C C C C C C R S C C C C C C C C R S S S t 0 I 7 ne 8 9 4 7 2 0 5 8 7 S8 88 9 / 8 9 9 8 8 4 9 9 1 4 8 3 1 8 7 2 2 8 8 4 4 et a 8 / 09 8/ /9/ 9 9 8 9 4 9 8 9 9 /7 24 8/28 / 1 EvD / 2 40 7/ 7/2 // / / 9 / /
/
8 2 2 4 0 /8 / 8 8 / / 2 9
/ 3/ 2/ 8/ / 9/ 6 2 3 3 1
/
/ 2 / / / 2 2 1 3
/ ' 9 2/ 8/ /2 / / / / /2 23 /2 /2 // 2 1 1 2 / 1 1 3 2 2 2 5 / / I I
/ / / / / /
6 1 9 6 8 1
. 3 8 I 9 2 4 4 9 2 1 6 9 3 1 3 1 2 3 8 5 1 I r 2 2 0 3 4 3 0 Rb e 1 4 1 1 1 1
0 0 1 2 2O 070 05 0 50 08 8 8 10 20 3 66 32 0 3 1 1 1 0 0 0 2 4 8 1 2 4 5 0 0 0 0 4 W4 8 3 t 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Em 8 0 4 7 2 9 _ 5 7 1 S 1 1 8 8 1 7 7 2 2 5 8 4 4 4 d L u 8 9 9 8 9 8 9 8 9 9 9 S 9 9 9 5 9 8 8 9 8 8 9 9 S 8 9 9 9 e N 1 1 1 2 7 7 7 8 8 8 5 8 0 0 0 0 9 0 0 0 0 1 1 1 1 0 0 0 0 u 1 1 1 6 2 2 2 2 2 2 2 2 0 0 0 0 9 8 8 8 8 8 8 8 8 5 5 5 5 3 3 3 3 3 3 3 3 3 3 3 3 4 4 4 4 4 2 2 2 2 2 2 2 2 2 2 2 2 i n t n o ( c e 1 1 1 1
. m s s s s 3 3 3 3 2- a 3 ir i ir i 2r r N e ! I l 2 2 2 2 2 a a a iai iai r r r r s t t n n n n t t B t n
r f h h h h h h h h l l l l x e io io io io P P P P a a 2 2 2 o a n yay ay ya yay a y ya a n n or n or n o rT h o o uo uo uo uou ou ou u a a ao l P 1 I i I 2 2 2 2 y y y y l b mmmO e e e r a t y r
. y y y y y y e e e e r r r r r r k rk k rk c n q q q q q q q q e e e e u r r r r r r r r
~u u u u u u u u T
la la la S S S S S S S S S S S S S S S S kSu a e e e e e e e e h h h h S S S S S S S T T T T u u u D ty ;c1T ton'MANM* O X .
, l\
3@Qa; g M-n o mse r e M ul u mai oCa e o e o es o o o o o es o o s F C Y N N N Y N N N N N Y N N y nc
- u. ene r
. d. lu o gF i
iia C s o o o o o o o o o o o o o _ D N N N N N N N N N N N N N _ f e dl b er a e r v e o c o c v M e e R R NN o o o es o o o o o es o o o N Y N NNNN Y N N N e e r ud i o M lam R OR TT R R R OOROR R TR T F F F TF TF TF TT F F TF TF TF T F F F y r e m-a v r o a c s P i w s D i e y v S f d o R e ! m M o / n i mmg m i ht rmr i e ru a a is ra s s s r r t t t u s s s t t t M Tol l e l e e e b o e e e A A D A T T T A T T T T M t t t e n e n e e n s u a e r e r e re er aer u l er e mle mmre l C deu wa nn du wa wd n n n n n a n o nro o w r c d s oc ed d c s ei os i i odr v r v v r or ar er o r ar ar or re n l i e n n a l P H P P f l P P E P E E f rd ee bt c me uff i 1 i 2 2 I 4 1 2 1 2 2 I NA M n de t t p p p c et mc e p j m n mmp u u mu n S mjuI - pj p mI mmm n p p gf pI. P P u P p p u p u - - ef SA I u P o-o C C- P -C oo mP I u u u o - P oP -P-I I I I M S L C C S C L P S L S S S 0 6 t n e 62 1 9 9 4 4 2 2 9 E t e a 9/ 9/ 789 / 3 // /8 9 96 9 vD 1 1
/
4 1
/ 5 2 2 /
2
/ / / 2 / 1/ / / 0 9 9 61 1 2 8 /
9
/
4 7/ /9 1
/ /
9
/
5 I 0
/8 2/
M_ . 1 5 7 6 9 2 3 3 1 1 7 1 Rb r e 0 4 1 0 0 4 0 2 0 0 0 5 8 5 9
)
1 1 0 0 98 9409 409 6 0 4 7 ) Xt 8 1 1 0 0 0 0 4 9 0 0 0 M ) Em 6 2 7 9 9 8 1 9 X 9' 9 2 1 2 6 9 9 9 d L u e u N 24 24 24 25 82 82 95 95 95 95 04 04 04 n 4 4 4 4 4 4 2 2 2 2 3 3 3 i t n o ( c e
. m 2- a 1 1 N
B t n a 1 1 1 2 k k e e e r er M l e l P e e e e C C I 1 i 1 2 2 2 l lt ltg lf f b t g g ltg n n n n n n no a o o o o o lo io oi oi oi io i o T V V V V WWZ Z Z Z Z Z iZ 1O8?xy* I T <o( . Y= _ w
i1j !ll)l jl l
>cyh*W j
n 4 p 2 2 2 o 1 3 9 4 4 4 4 4 o L r d l i j I n 2 2 2 2 6 6 I 6 6 C-C r d l i j 2 2 4 6 8 I n I S d 1 e 4 p u m D u P- I I I 2 2 2 2 I 2 t. C
~ C y
e S p m u I 2 3 2 P-I S T- no Si t We RS u I I I 1 I 1 3 1 1 1 1 1 I 1 s d t c n A a m i n 2 2 2 2 2 2 2 2 i 1 2 2 2 I 2 2 e a r d T d e - n n l a p t 9 0 9 3 6 4 0 9 8 8 8 9 8 9 9 9 4 3 9 7 7 7 n n e 5 8 M u n o et EvD 6 a 7 39 9 9 97/ 0823 208 / 8
/ /
1
/ / / / / /
I 1 1 2 / / / / / /
/1 88 88 2 1 1 3 8/ 8/26 //7 //
1 9 /2 / 0 1 4 2/88 8 1 8 83
/ 9 7
0 / / / 2 / 1
/
1
/
1 9
/
/ 9 9 8 2 8 8 8 8 2
1 5 /0 / 5 1
/ 0/ 2 / 9 / // 9 0 / 9 8 3 2
/ / / / /
1 2 3 1
/ /
/
2 i 3 5 4 1 I 4 3 8 8 9 1 6 1 1 5 6 2 1 4 1 3 1 3 5 6 7 2 9 t c e M j i n y r 8 5 2 7 2 7 3 5 6 0 2 6 7 7 3 5 0 3 4 2 5 6 2 t Rb e 0 0 0 1 0 0 0 1 1 4 0 2 1 81 1 0 0 0 1 1 1 0 0 0 0 0 I 1 M X 2 4 f e Em 0 0 0 0 0 0 0 0 0 0 0 0 0 0 7 6 4 0 9 8 8 8 8 2 8 9 9 0 9 8 5 9 0 0 0 0 0 1 0 3 4 0 0 0 0 0 3 9 2 7 7 F0 7 0 a s L u 9 9 9 9 8 8 8 8 8 9 8 8 8 9 0 3 13 3 8 8 9 8 9 9 9 9 8 9 8 8 8 8 N W e r u s 9 3 3 1 1 1 3 8 8 8 8 8 8 8 8 4 4 4 4 4 4 4 2 2 1 6 6 6 6 6 6 6 6 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 1 4 1 4 4 4 2 1 2 1 2 41 2 2 4 4 4 1 2 1 s e r p 1 I I 2 2 2 2 2 2 2 2 W 1
- t t t t t t t t t t t t h miiiiiiiiiii n n n n n n n n n n n ig 1 i i I 1 1 2 2 2 2 2 2 2 2 i e Ur r U Ur U UU Ur rU Ur Ur Ur Ur i it it it it it t t miiiiiiiii t t t t t t t t l n r r r n n n n n n n n n n n n n n r
a eae ae e a a a ea e ae ea e ae a a U y Uy yUy yU y Uy yUy yUy U U U U U U Uy- Uy 3-N a l c lc lc lc lec lce l c lc lc lc l c lc u u u e u u u u u u u u le le le le le le le le le e le le le le le y y W B e l P t n a Ns sN s Ns N s N N Ns N N N N N la la la la la la la a la la a la a la la a as a sass as sa sas as ss a as as as s ss sV rVr V Vr V rV rV V r l V V V V V V V r r r r l l r r l r r r l b n n n n n a a a a a a a a a a a a v vn n n n n n n e e e e e e s e s e ev v v ve ve vev ev e e s s s N a kr k kr k rk k r k kr k kr k rk r r r r r a a a a a a a a a a a a a a a e e e e e e e e e e e e e e e . E T A A A A A A A A A A A A B B B B B B B B B B B B B B B E E F .. 7dhQhAxykO x ' 1
>g@SX m M
j I n p 2 4 4 4 4 8 8 8 8 4 8 4 o 1 o L M r d H-j 1 n 2 I I I I I I 1 I 1 1 I I I C C d r M H - j 2 I 1 I 1 1 1 I 1 8 4 I n d I S M e d-p D
- m u 2 2 2 2 P- 2 1 2 I I I 1 I t.
C
~
C s e S y M n u 2 2 2 I 1 2 1 2 2 P-I S T-Si no 1 t 2 f 1 i I I 1 1 1 I 1 1 I 1 1 Wc RS u t c A in 2 2 I 2 1 2 1 2 I 2 2 I 2 2 i I 2 2 6 2 2 4 2 2 ar T 7 2 9 1 8 t 8 9 0 9 9 8 8 3 0 7 9 7 7 7 9 0 9 5 8 9 5 9 n e / 8 / /93 // 0 8 / // 8 9 09 9/ 8 / 8 7 28 /8/ 8 /98 /09/ 39 8 / 8 /9 63/ 8 8 8 90/ 90 9 8 M t e a 1 8 5/ 6 / 28/ /
/
/ 97/ 0/
EvD 2 1 1 9 2 6 3 5 4 / 1 1 1 1 /
/ / 2 / / / / 8/2 2 2
/ 2/ /2 / 0 / 0 / 2 / / / 02 / / 2 / /8 // /3 / / 3 5
/ 1 1 ! 5 1 1 1 1 1 1
/ 2
/ !
1 1 9 1 4 1 1 4 4 3 2 1 8 4 1 8 2 1 9 9 5 8 1 5 3 3 8 5 3 e 2 6 8 4 2 2 3 2 4) 4 9 9 0 6 1 1 6 8 5 5 4 2 3 3 3 5 4 0 0 0 4 0 0 0 0 0 ) R J4 E n 6 0 1 0 0 0 1 3 2 10 0 0 1 7 9 0 2 9 9 8 3 0 0 7 0 0 0 0 X ( 0 0 G 0 0 0 1 1 0 2 0 0 0 0 1 0 0 0 0 0 0 0 0 0 7 7 7 7 9 0 0 3 9 5 8 8 9 0 0 7 9 X ( 2 0 0 0 0 0 Lu 8 8 9 9 8 8 8 9 9 9 8 9 8 8 8 8 8 9 9 9 8 9 8 8 8 9 9 9 8 7 7 7 7 7 N 65 65 65 65 65 65 65 75 75 75 45 45 45 45 55 55 55 55 55 55 38 38 38 1 71 1 1 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 13 13 3 3 3 3 ) d e u - i n t n 1 1 i i 1 i o e it it it it it it ( c 1 1 1 1 1 1 i 2 2 2 n n n n n n m 1 a it it it it it it it it it it i 1 U U U U U U N Un U n n n n n n n n n t
. it i it s s s s s s 3- t U UU U U U U U I i 1 I 2 2 2 2 2 2 n n n T T f
T fT f f T f f n t t t it U U U f o n n n n n n n n n n y y y C lC Ch iC Ch Ch h h it it it it it B a do do dod od od od od o d d it i i i c lP o o o o o o o o o o U U U U U U U U U U a a a l b e d w w w w w w w w w w d d d d d d d d d o o o nnnnnnnnnnwww o o o o o o o h t a la la e e e e e e r v t r h t t v t r v t r v t r ia l ia ia i i ia ia ia a ia a ia r r r r r r r v t t la la la a la a la la la a r r r r r r r r r r y y y y y y y y 3 i T B B B B B B B B B B B B B B B B B B B B C C C C C C C C C Z Q A Nx*4S,X g5
l !Ilj l)I )l lilI l y$o{E w j I n p 4 4 4 4 4 4 4 4 8 o 4 4 4 i 1 8 8 o L r d H - j I n I 1 1 I I 1 I 1 I 1 1 2 1 I 1 C-C r d H - j I 1 I n I I I I 1 I S d e d n a m v e . D N 2 2 1 I 2 2 I 2 I I 1 2 2 2 3 I 2 2 t., C-m C s e S p m u 2 2 I 2 2 2 2 2 2 2 P- I I S n T- o Si t 1 1 1 I 1 1 Wu RS c I 1 1 1 1 1 1 1 1 I 1 1 t c A n 1 2 2 1 2 2 2 2 1 2 2 i 2 I 1 2 2 2 iar T M 7 6 7 8 0 m t ne t a EsD t 1 9
/
2 1
/
9 1
/ 2/ 5/ 22 /
8 9 9 8 / 6 8 8 / 8 7 / 3 3 / / 0 9 /1 / 1 6 1
/ 8
/1 6 2 2
/ /
9 9 9 2 / 9 8 1 9
/ 3/ 7 1
/ / / ///
6 3 0 9
/
1 9 9
//9 6
2 1 0 0 0 2 7 9 39 /9 / 8/ 9
/
2 1 / 5 0 /6 3 2 8 8 2 6 4 I 3 2 2 / /
/ / / 0 2 1
/ /90 // 4 3 8 7 8 7 0 1
/
8 /// 8/ 49
/
I
/ /
I 1 0 90 1
/
8 1
/ / 2 1
7 2 1 9
/
/
3 3 3 1 2 2 2 1 2 9 1 2 3 9 I 7 7 6 1 1 9 I I 1 7 5 5 1 M r 1 2 8 7 1 1 4 3 7 3 1 1 3 4 2 7 1 0 6 I 8 9 0 2 1 1 0 9 7 e 0 0 0 0 1 0 0 0 0 0 0 0 0 2 3 2 2 0 3 2 2 0 1 Rb I 1 1 1 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Em Lu 1 9 91 9 8 7 6 9 9 6 8 8 8 9 9 8 8 9 8 9 1 6 9 3 9 0 1 0 0 0 2 7 9 9 9 9 9 9 8 9 9 8 8 8 8 9 1 3 7 7 8 7 0 1 9 0 9 N 8 8 m ) 1 3 1 3 1 3 4 4 41 4 3 1 3 1 4 4 4 1 4 41 1 4 4 4 5 5 5 5 5 5 5 5 6 1 1 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 3 3 3 3 3 3 3 3 2 2 1 2 2 2 0 0 0 2 2 2 6 5 5 0 0 0 4 7 7 d e u n m it n o 2 2 i t in n 1 it ( c e m a t iit U U n n 1 1 1 2 2 2 2 2 2 i 1 t i it 1 it i i it i t 1 it 1 t i i I t 3t 3n n3n3n 3n 3 i nUn Un t miiiii U U U U U U t t t t it 3-N s s it it t it t t t it it n n n n n n n n r r r r r r U o o m i i i i T T f B t n a f i l i Un Un U nU nU Un UnU nU en en e Ue Ue eU eUe U U U U 2 it ev vie vi eiv iveivse a ea es yn yn lP C lC a a a a a a a a a h h h h h h h h n Ri R R R R R e C C e t r t r b b b b b b b b b n n cn cn cnc nc cn cn cU l l a a a l la la la s o lo b - l b r r w w w w w m w w w a a a mmmmmmmmko a a a a ya ya y y t t s sys sy t t t s t s l m a h h a a a a a a a a t t a a a a a a a a a a t t t t t t ta o o o o o o o o o nb a ia ia b u n T C C C C C C C C C C C C C C C C C C C C C C C C C C D D D r r r r r r u Y cC tj 7
. O3?5xX,[ x 1
l
1
>g@&h _
j I n p-m 8 8 8 8 8 8 3 4 4 o o L r d H-j I C n 1 I 1 1 1 I I 2 m C d r m H - 2 2 j I 1 I 1 I I 1 1 n d I I S m e d n a p m m e u D P- 2 2 2 2 2 2 2 I 1 t o C m C y e S p M m u 2 2 2 2 2 2 3 3 P-t S Tn o Si We t u 1 1 1 I 1 1 1 1 l I 1 1 1 1 M RS t c A 2 2 2 2 n 2 2 2 2 2 2 2 4 2 2 I 1 1 i 2 2 2 1 l ia r T 9 0 8 7 7 3 7 7 7 3 7 9 t 9 9 7 7 8 1 2 5 8 8 9 9 8 4 / n e t 9 0 2 9 0/ 89 8 8/ /9/ /8/ et a EvD S8 3 2 6 2 4 / 8/
/
/ 8 7 8 8 9 9 9 12 / 3 4 1/7 / 6 8/ 6/ / 2 /1
/ 8 6 2 8 3 96 9/ / 9 / / 9 2 2 / /1 2 22 /2/ 5/ /
/ /
6 1
/ /
1 3
/
1 1 9 9 / G3/ / 6 /2/ 3 / 0 3 8 4 72 32 2 / 1
/ / / / 0 1
M
/ /0 1/0 /1 / /
1 1 1
/
3 3 4 7 7 0'1 /7 /4 1 1 6 5 4 2 I 21 2 4 7 1 3 5 4 4 5 3 1 3 5 8 5 2 9 6 5 N3 0 1 r 5 9 5 3 4 6 8 7 3 4 6 4 3 3 5 1 8 1 1 e 0 2 0 1 1 1 0 0 0 0 00 0 0 0 0 0 2 0 0 0 1 0 0 0 0 0 1 0 20 50 90 80 60 2 0 9 0 0 1 0 0 0 0 0 0 0 Rb Em 0 0 0 0 0 9 7 7 7 7 8 1 3 0 0 08 04 00 02 3 0 7 7 7 3 7 7 L u 9 583 93 38 383 83 88 898 98 89 484 84 49 9 1 8 9 9 8 5 595 5 9 5 95 59 5 95 58 5 84 8 9 8 9 N 5 7 7 2 2 2 2 2 2 4 4 4 4 4 6 6 2 2 3 3 3 3 3 3 3 3 3 3 3 3 36 36 38 28 2 8 2 8 8 2 82 82 82 82 82 82 42 2
)
d e u n it i 1 2 2 2 2 2 2 n t t o e it n n it i n n n n n n it it it i it i 1 i 1 i i 1 1 i 1 i c t t m U U U U U U U U t t t t t it it ( a it n n n n it mimmmim n n 3-N n o n n n n n n n y y oy yo y o y yoy o o o I 1 1 i 1 2 2 2 2 U U U U U U U U U U U i t n n na na nan an a n na a i n nit n n itn itn mmint t t i t t t nu nu nu nu nu nun un un un un u i t B l a a i o o e ho h o h o h o h oh o h ho Uo n h h l e P C o o CC lo C lo lo C Co C lo C o Uy yUy U y y UyUy U y yU U U la la th e le le C C aC C C C C la la la la la la la la a C.C .C .n n le r ler ler er le l l b lba ia a a b b b b b b lb a l r le r lr r r C. a i i i ia ia i ia a a a a a a a a a t t t t t t t t t t t i T DD D D D D D D F F F F F F F F F F F F F F F F F F F F G Q A. Q0 M
. cG tj
j jlj i lllll l i D
>$oDaE C j
I n p 4 4 4 4 3 3 8 4 8 4 4 i m r d l i i o 0 I n t 1 1 1 I 1 I C C r d l i i n 2 6 6 6 1 1 I 1 1 0 I I i I S d e d n a m e c. io D P- 2 2 i 2 2 2 1 2 2 t i u C n C u S p m u 1 3 3 2 3 3 3 3 3 3 3 2 2 2 2 P- I I 1 I S Tn Si t o 1 1 1 1 Wuc RS 1 1 1 I 1 1 1 1 1 1 I 1 I 1 1 1 1 t c A y in 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 I I 2 2 2 r a T t 8 1 3 n e 9 5 8 2 5 7 7 8 3 0 2 9 8 7 7 3 9 M et EvD a 8 8
/ 09 59 88 9 0 /3 8 7 9 7 9 9 8 8 7 8 / 9 /9 // 8
/ / / 7 9/ 9/ /7 9/ /7 / 89 9' 1 8 /
7 / 8 8 2 7 9 9 9 9 / 2 4 /5 / 3 / / I 3 6 / 8 1 I
/ 8 / /
/ 7 2 2 7
5 7 2 6 6 2
/ 2 / / / 4' / /2 / / 2 3 2 / / / 20 // 2/ / / / / 9/ 2 7 2 2 /
1 1 1 ! 1 1 I 1 1
/ / / / / / i / !
5 5 4 6 7 6 7 1
$ 1 5 2 4 2 4 9 3 1 4 2 1 3 8 7 2 3 5 3 1 M r 3 6 3 5 6 5 1 1 0 2 9 1 9 2 4 0 2 1 2 2 5 5 7 2 1 4 1 3 8 e 0 0 0 0 1 0 1 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Rb 1 1 1 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Em Lu 9 0 5 8 5 0 3 8 7 2 7 9 5 7 7 7 8 8 0 2 8 9 9 8 9 9 9 8 9 9 9 8 9 8 8 8 8 8 9 9 1
9 8 7 7 1 8 8 8 9 8 9 9 9 9 7 3 3 m ) N 4 4 4 4 4 4 4 4 3 3 1 3 71 7 7 7 6 6 6 6 6 5 9 9 9 9 9 9 9 9 9 0 0 0 1 4 4 4 4 8 8 8 8 8 0 0 0 0 6 6 6 6 6 6 7 7 7 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 3 3 3 3 3 3 3 3 3 3 3 3 3 d e u n m i t n o e i it 1 it I it 2 2 2 2 3 3 3 3 3 i t I t 1 t ( c m n n n it t t t t t t t t i miin n a U U U n n i miimiiin n n n n it U U U 1 i i I I 1 2 2 2 3-N k k k U U U UU U U U U n e e eee e it it it it t it it it it m i i c c c t n 1 I 1 e e e t t t n n n n t t t t t n n n t U k k k n n n n n n n n n B a it it n n n n it it N N N ino io io io io ino io io io e n n n U U U U U U U U U e a a a l e lP Ua Ua Ua Ua mmmP a a aP naP n P nP nP nP nP nP nn nY Yu Ye e e iuer iu er e re er e r e e er i iu u iu u iu ir r i u iu r a a n n n b a n m nnn nd dd dad ad ndi dni andnadn dn ndn dn d d eKwiiiG miiiar i i ia a i a i ai ia a a a cG c GGc c G G G cG cG c c c m T G G G GI l l l l I i I I I I I I I I MMMMMMMMMMMM I pC yC Og?NxM. <h x t I
>g@&, g j
I n p 4 4 4 3 3 3 3 2 2 4 2 2 2 2 o o L m r d l i j I C n I 1 I 1 I 1 1 2 1 I 1 m C r d H-j 1 1 I I n I S de d.
- p u
s m C u 2 2 2 2 2 2 I 1 I i t P- 1 1 I I 1 1 1 1 u C m o, C y s S p m u 1 I 2 P-t S M Tn Si o 1 1 2 1 1 I I W. t 1 1 I I I I 1 1 1 Ri t c A n 2 I 1 1 I 2 i i I 2 2 2 2 2 2 1 i a r T M 9 1 7 7 3 t 9 0 4 4 9 8 9 5 7 7 9 9 8 8 7 8 3 0 4 9 ne 1 1 1
/
e ta EvD 8 9 9 9 0 3 / 8 9 8 8 /8 / 88 9
/ 9/1 /31 5/ 2 /9 97/ 1 0
3 1 1
/
5 6 / 5 5 3 4 2
/ / / /
T1 /45/ / /2/ / 3 I 2 1
/
7
/ 8 /
1 9
/
2 2 9
/ /
/ / 0 / 1 8
2 0 6 2 // 2 9 2 / 69 /9 /9 /9 9 9 4 6 / 0 / 6 I 3 / 1 6 / 1
/ 8 3
6 8 2 2 6
/
/
9
/ 2 4
0 M
/ / / / / / 2 I 21 8 9 7 8 5
/
5
/ / /
2 4 3 9 5 7 2 1 1 1 7 3 7 1 1 I 1 1 r 5 5 0 3 2 5 4 3 7 6 7 6 5 31 7 9 0 7 2 2 2 7 M 0 0 2 41 07 3 6 1 1 e 0 1 1 2 0 0 3 3 0 0 1 1 0 2 1 1 0 1 0 0 0 0 0 0 Rb 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 300 09 09 4 4 Em Lu 9 0 4 4 0 9 9 9 5 8 7 7 9 8 9 9 9 9 8 8 8 9 8 8 8 8 9 9 1 1 91 91 8 7 2 7 8 3 9 8 1 9 9 9 8 8 9 9 9 3 N 6 6 6 6 3 3 3 3 3 3 3 8 8 8 8 8 9 9 9 9 9 9 9 9 9 9 9 0 0 3 3 3 3 2 2 2 2 2 2 2 3 3 3 3 3 3 3 3 3 3 6 6 6 6 6 6 7 7 3 3 3 3 4 4 4 4 4 4 4 3 3 3 3 3 3 3 3 3 3 2 2 2 2 2 2 2 2
)
d e u i n t n o e i 1 I 1 2 2 2 2 2 ( c 1 t t it m 2 2 2 2 3 3 3 3 3 3 3 i it it it it i it it it a t t n n n n n n n n n n 2 2 3-N it n n n it it in it it n n n n it it i er it n n it U U U U U U U U U U i t 1 it I it i i t 1 it 1 it it it t n U U U U U U U U U U U a an a r. a na nan an an na na ni n n n n n n n n M B l a e e e e e e e e e e e n n n n n n n n n n U U U U U U U U e P n o on on on on n ton n o on on ono A A A A A A A A A A e e e ee ec ee eee ee e e t l b t t s t s t s st t s s t s t t s h h h h h h h h t h h nt n n n n n n n ls l l ll ll ls ll l l l ls l l t r t r t r t r t r t r t r r t r r o o o o o o o o a li l i li i i i i i l l i li i o o o o o o o o o o c c c c c c c c T MMMMMMMMMMMN N N N N N N N N N O OOO O OO O M Q AhQ0 , M p% l l
lj lI ll I ! ll i!lI
>5oEE W i
I n p 4 2 2 2 2 2 2 2 2 2 2 8 o 4 4 4 4 4 4 4 o L r df 4 j n 2 1 1 I 1 I I 1 I I I IC-C r d H - j n 2 5 8 8 8 8 8 8 4 8 I I S d e J, p u m D u t P- 3 1 1 I 1 I I I I I 1 n C e m C g e S p m u 2 P- 1 2 2 2 2 2 2 1 2 I S n T- o Si t 1 1 1 I c I Wu
'RS I I 1 1 1 1 1 1 1 1 1 1 1 1 1 1 t
c ~ A n 2 2 1 2 2 2 2 2 2 2 2 2 2 2 iar T M 2 9 0 9 2 S7 282/93IS8 1 I t ne 8 7 7 5 9 8 3 8 7 5 9 9 7 9 3! S M 1 et a 9 9 9 8 8 8/8 /4 1 3 9 0 / 5 8 9 2/2 9 / 8 9 / 67 / 1/ 332 / 1 8 4 / 8 / 7 2 1 8
/ 8/ /6 /8 4 8 9 EvD 8 62 9 /
/ 0 S90 2 1 I / 1 / 1 1
/
0 5/ 3/ 2/
/
3 / 6 7/ // 2
/ / / /2 /2 /6 02 // / / 2 I I I /
/ / 4/ 2 /
1 1 1 1 2 2 3
/ / /
4 8 7
/ I 1 1 0 1 1 1 1 3 3 1 3 9 7 4 5 3 1 2 9 1 3 6 7 1 2 1 M r 4 3 2 2 1 2 4 5 7 3 2 2 5 1 2 5 7 4 0 3 5 6 0 9 8 5 0 e 0 0 0 0 0 0 0 0 0 0 0 0 2 0 3 0 3 0 0 1
0 0 0 0 1 Rb 0 0 0 0 0 0 0 0 1 1 0 0 0 1 Em 2 9 9 7 7 5 9 9 10 0 0 0 0 0 0 05 0 0 0 9 0 9 7 5 2 2 0 1 0 0 0 0 0 0 1 9 7 2 3 7 9 0 0 0 0 1 8 1 Lu 9 8 8 8 8 9 8 8 9 9 8 9 8 9 8 9 9 9 9 9 8 9 9 9 8 8 9 8 9 N 7 0 0 0 0 0 0 7 7 7 7 7 7 5 5 5 5 5 8 8 8 9 9 9 9 9 9 9 9 8 m ) 2 2 7 7 2 7 2 7 2 7 8 8 8 8 8 8 5 5 5 5 5 2 2 2 2 2 2 2 2 2 2 2 2 2 5 2 5 2 5 2 5 2 5 2 5 2 5 2 5 2 5 2 2 2 5 5 5 d 1 e u i n t n o n ( c N e m a 2 2 2 2 2 2 3 3 3 3 3 3 i i t t 1 t 1 t 1 t 1 it 1 t n in n 1 it it 2 2 2 2 2 2 2 2 3 it it it it it n n n n n n n n n i t it it 3- t it it i t it it i t it it it it it t imiiiU n n nU n U U U U U U U U U U n n n n n n n n n n n n n i U U U U U ed ed ded e e de d ed de d e e e e B l a U U U U U U U U U U U U s s s s s r d dr d r r e P e e e e e e e e e er er e e e e er er er er er er n l b e e c e n n n n en e e o e c e e e c n n n n n n e e e e e e d a d a s d a d a d a is si s V V V V o o V V V V V V V V o loaloa o ola lo is a o c co c co o sc oc o c o c co co c oa li la a la lia la la lo l a a l a alo a lo a lo la T OO OOOOOOOOOO P P P P P P P P P P P P P P P P P 1 f p C, WIO g ? Nxx.< b x 1 T 1
ko@9h j i n 8 8 4 0 M. - p 4 4 2 3 8 _ o o _ L _ r d l I j 1 I 2 1 I n C-C r d H-j 8 8 4 4 8 I 3 3 1 I 2 1 0 I n _ I S _ d _ e _ d n a p m m e D u 1 2 1 2 2 2 t P- _
- i. C m C y
e S p m u 2 2 2 2 4 1 3 3 1 2 1 2 2 2 1 P-I S T- o Si t n 1 1 2 2 2 1 1 1 1 1 2 1 1 Wu RS c t c A n 2 2 2 2 I 2 2 1 2 2 2 2 1 2 1 1 2 4 2 2 iar T 7 9 5 8 3 t 8 9 9 7 9 8 9 8 8 2 0 8 1 3 9 9 1 ne 9 3 9 1 8
/ 9 1
6 8 / 8 / 4 8 8 8 8 / 8 9 9 8 0 9 2 9 / 88 4 / 9 9 e ta 8
/ 9/ 9
/
12 2 95
/ 9 8 / / 72/ 86 2 9 0/ 8/ /9 /7 4 / / 3/ /2 92/ 2 9 // 6 / 5 2 2 / 8 / 9 / 5 EvD 1
/
2 / / / 7/ 9
/
2 2 2 2 4 1 1 0 0 / / / 3 2 2 / / 21 / 1
/ / 7 / /0 / 1/
/ 1 1 3 4 1 1
1 1 / / / / / / / /
/ / /
3 2 6 1 6 4 4 1 1 3 3 3 2 1 2 8 9 6 5 8 1 4 1 3 4 6 8 r 7 0 8 4 7 4 7 2 1 6 4 5 7 4 7 0 03 5 08 0 10 0 260 5 71 3 1 Rb e 1 0 1 0 0 1 4 01 040 4 8 0 0 0 0 0 0 1 1 1 0 0 0 0 0 0 0 0 0 0 0 2 3 3 9 4 90 0 0 0 1 0 0 1 0 0 2 2 0 0 0 0 0 0 01 0 Em 6 8 9 9 5 4 7 9 8 9 8 8 2 0 8 0 1 1 9 3 7 9 8 9 8 9 Lu 8 9 91 8 9 9 8 8 8 9 9 82 28 8 8 2 82 8 9 9 8 9 9 9 9 1 1 1 1 1 1 1 1 1 2 2 2 N 0 0 0 6 6 6 1 1 1 1 1 1 6 6 6 6 1 1 1 1 1 1 7 7 7 3 3 3 6 6 6 0 0 0 0 8 8 1 1 1 1 1 5 5 5 2 2 2 3 3 3 3 2 2 3 3 2 2 2 2 3 3 3 3 3 3 3 3 2 2 2 ) d e u i n t n o 1 1 1 1 e 1 i 1 2 2 2 2 it c 3 3 3 t t t it it it ( m a it t it it it it i i n n n n n n n i U U U U it n n n n 2 2 2 2
. n in N U U U n U U U U U U U t
it i t it 3- t h h h h h h h n n d cd UoU oU iUn n n n 2 2 2 2 2 2 2 2 c t t t it t it a de d ed ae a ca ac a ca ac c c c a a e es S S n n n n n it it i B ls l n n in i n n in n n l P r r r e e e e e e e o o s s s s o o o o U U U U U U U U - e I e e e B B B B B B B I e
! t l l
b a o o o n n n n n n n ir ie V V V t t t la la la oi io io io io oi oi ia t t t t r ia r r a hn nhab oi boinboi mbommmmmmmmmmm c c n n elaela lea lae lea ale lae lea ale lae la e T P P P P P P P P P P P P R R R R R R S S S S S S S S S S S M hhQ A Q0,.'M .
. c tN
jl j)I jI 1i !I I I l l yEnEE IU j I n p 4 4 4 4 4 8 o 8 3 3 3 3 3 I o L r d H-i I n I I 1 1 I 1 4 4 4 C-C r d H - j 8 8 8 8 I n I 1 I S d e d n a p m e n r D u P- I 1 2 2 2 2 2 2 t. u C
,. C q
S p m u 2 2 2 2 2 2 2 P- 2 3 I 3 3 3 I S n To Si t 1 1 e 1 1 Wu RS I 1 1 1 I 1 1 1 1 1 I 1 1 1 t c
- A i
n 2 2 2 2 1 I 1 2 2 2 2 I 2 2 1 1 2 3 3 3 3 3 3 a r m T O 8 t S 8 7 7 n 8 7878 4 8 2 2 4 2 7 7 5 5 8 7 8 5 4 9 8 9 9 9 9 8 9 95 595 8 8 8 S 391 8888 1 e te a 2 9 / 8 9 8 8 8 8 EvD /9 2 0/ 6 / 8 6 / 2 19 1
/ / / / / / /
7 3 6 2 1
/ / /
1 01 2 2 2 3 0 5 4 9 1 1 2
/ / / / / / / /
1 6 1 41 / / 7 2 9 1 / / 22 / / / 1
/ / / / /
0 6 6 6 8 0 2 / 2 2 3 4 I I
/ 2 / 6/ 9/ 8/4 /3 / / / / /3 /4 /8 /
1 I 0 / 1 10 8 /2 3/ / 1 1 I 8 7 5 I 1 9 1 1 8 3 I _ r e 9 4 0 1 0 0 2 1 12 15 I2 9 0 0 1 6 1 7 3 0 I 5 4 1 9 9 2 18 9 1 2 9 9 2 6 Rb 0 01 0 0 0 0 1 0 0 0 0 0 1 1 0 1 0 0 1 4 1 0 0 0 0 0 0 0 0 0 0 1 0 2 6 0 1 0 5 4 2 2 Em 2 0 9 8 7 0 0 0 0 0 Lu 9 9 8 8 8 9 1 7 7 7 4 8 2 2 4 2 7 7 5 5 8 7 8 5 4 1 8 8 8 8 38 3 8 8 9 8 9 9 9 9 8 9 9 9 8 8 8 9 9 9 8 8 8 8 _ N 27 6 62 62 62 43 4 3 3 7 7 7 8 8 0 0 0 0 0 0 8 8 8 8 8 8 8 8 1 2 3 3 3 3 4 4 44 44 44 23 23 23 23 23 04 04040 40 40 49 49 49 49 49 49 49 49 4
)
d e u i n t n 1 1 1 1 1 i o e t i i i i t t t it i t ( c 2 3 3 3 n n n n n n 1 I 1 1 I 1 1 i m t it it t 1 i I 2 2 U U U sU s U U it it it it t t t t a i n n n n i 1 i 1 1 I t s s n n n n mimi n n N t it it it t is is it it n n n nit nitn n n n n mU U U U U U U U i i 3- U U U U i r r r r ir ir ir r r r a as sa s a as a s as sa s a t n e e e er kU kUk Uk kU h Uh U U U U U a la a la a B l a r fr f f f r h h h l l l l l l i l l l x x x x x x x x e e e e e e e e e P ! o n n o n on o o o o o o o o o o o a y y a y yay a a n n n n n n T T T T T T T T o o o o o o l b mOOOO r r r r r o o o o o r r t r r r h h h h h h h h a la e n n n n a a babab ab qb qu qu qu qu eu ea e a a e ae ae au t t t u u u t tu t u u t t u T a a a a e e e e e e e e e e h h h h h h o o o o o o o o S S S S S S S S S S S S S S S S S S S S S S S S S S S S S r pG gC O3?5xx. g @ &,xgt
~
j I n p 3 3 3 3 3 3 3 3 3
~
o o L
~
r d i l j 7 4 I 1 1 I I 1 I 1 I 1 I n C-C d l r
~
I j n 2 8
~
I I S d e d n a p m m e u D
~
P- 2 2 I 1 I 2 1 I 1 t n e C m C g e S p m u
~-
6 3 2 P-I S n T- o 2 Si t 2 1 1 1 1 1 1 1 I 1 1 I 1 Wc RS u t c A n 6 3 3 2 2 2 i 2 2 2 1 1 2 l 1 2 I 1 2 1 ia T r 4 4 8 7 1 t 9 9 9 7 9 7 0 2 8 8 8 0 7 9 9 7 8 8 nt e 1
/
0 8 9 3 / 8 8 / 6 8 9 9 3 8 / 3 8 9 /9 71 R / 1 8 8 8 8 0 e a 4 9 / / 9 4 / 8 2 9 / / / 9 9 / /
/ 51 3 / / 0 18 8 / 1 9 / 8/2 /7 /6 9 /
EvD 2 / 0 8 / 2 4 / 2 / / 2 9 6 / 2 1 ! /
/ / 0 /1 / / / / / 2 7
/ /8 2 ! 2
/ 2 1// 8 1 1 1
/1 11/ 2 /
l
/
2 8 / / 1 1
/
8
/
/1 1
/ /
5 1 3
/
1
/
1
/ 2 1 1 4 9 1 1 4 2 1 7 2 5 2 5 8 1 2 9 9 8 8 3 3 5 1 r
e 0 1 1 6 1 0 0 1 9 8 3 4 3 3 6 3 1 9 8 60 32 24 0 80 7 M 1 0 0 4 0 1 0 0 0 0 M00 0 30 000 0 0 0 0 0 2 1 1 0 1 0 0 1 1 1 1 ( Rb 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 9 7 8 8 0 0 0 Em Lu 1 9 0 9 1 3 4 7 8 4 6 7 0 2 3 8 8 3 8 0 9 7 7 7 9 8 9 9 9 8 8 9 9 8 9 9 9 8 8 9 8 9 8 8 8 9 9 1 8 8 8 8 9 9 N 9 9 9 5 35 35 35 353 53 53 53 98 9 9 5 5 0 0 0 0 0 0 0 1 1 1 1 9 9 0 8 8 9 9 8 8 8 8 8 8 8 8 8 8 18 8 8 4 4 4 3 3 3 3 3 3 3 3 3 3 3 3 3 2 2 2 2 2 2 2 2 2 2 2 2 2 ) d e u 1 n i t n o c e 2 2 2 it U d n ~ ( m t t t n a iim1 n n 1 i 1 I 1 1 1 2 2 2 1 i a N U U U t t t t t t t t t t t ls miiiiiiiiiit 3- it 2 2 2 2 2 I t n s s s n n n n n n n n n n in n I 1 1 i 1 1 I le B a a x x x a a U U U U Ue eU U Ue eU U Ue Ur Ur itn nit m miiiimmmi e e e e e t t t n n n n t t t i t t t t n l e lP T T T h h h u ic u uicuie c cie u uc u i icu ie u cuicu ic mmy c e e U U U U U U U U U U Us U ie yicy y y y y y y y y e M b r r e tu L L . L L. L .L L L L L L t r r r r r r r r r' a t u u o o o . t t t t t
. . . . . . .u mmr t t t t t t r r u u u u u u u u u u u u u h r r r r r r r r r r r T S S S S S S S S S S S S S S S S S S S S S S S S S S S S T Qb ANxQ0., M .
cN t
~
y5eE. x W M M ~ j I n p 4 4 4 4 4 4 4 o o L _ M . r _ d { l M j I C-n 2 2 1 1 1 1 I C M d r l . f _ j 1 I 8 8 8 I I n . M d I S e d.
. p w m _
D u P- 1 I 2 2 2 2 2 2 I t. i w C _ o C _ g . e S M p n r u 3 3 4 3 3 3 3 4 2 2 I 2 2 2 2 2 P-I M S
- n To Si t 2 2 2 2 2 2 2 2 2 Wc RS u
1 I 1 1 I I 1 1 1 1 1 1 M t c A n 2 I 2 2 2 2 2 2 1 I 2 2 2 2 I I 1 2 2 2 2 2 2 iar T M 9 8 9 1 0 t n 8 2 6 7 7 8 9 0 2 9 9 3 8 2 1 9 8 1 9 2 2 9 M e te EvD / a 0
/ 2 M3 3 O2 4982 2
/
8 9 8 7 8 8 8 4 9 9 8 8 4 9
/ 9/ 7 / 8 // / 3/ 5 7 / 5 69 / / / / 592 1 1 I 1 5 1 2 1 1 2 18
/
/
1 0
/
6 /93 39/ / 8889/
/ 2 / / / / 2 / 4 / I2 1 1
/ 9 /
2 5 3 / 7 / 9 1
/
/
2
/
9 7 / 6 28/ 2 0 // 80 3
/
0 / / / / / / / / / / / / / / / / I 1 7 2 7 3 5 7 9 1 6 5 4 3 9 4 2 4 1 4 8 3 2 8 I 7 1 1 1 r 1 6 8 2 7 6 1 3 2 1 2 8 4 1 2 1 6 8 8 9 6 3 4 9 2 8 2 2 3 e 0 0 0 2 0 1 2 2 0 1 0 0 0 1 0 0 0 2 4 0 0 0 2 1 2 0 0 2 Rb 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 10 0 0 Em 9 8 0 2 8 6 7 7 7 8 9 4 0 2 9 9 4 3 8 2 9 9 8 9 8 8 8 8 8 9 9 9 8 8 9 9 8 9 9 1 9 9 9 8 8 8 1 9 1 2 2 7 0 9 9 9 8 9 L u 4 4 4 5 5 5 2 2 2 2 2 2 2 2 N 9 9 4 4 0 0 0 0 0 0 0 0 1 1 1 8 8 4 4 5 5 5 5 5 5 5 5 5 5 5 2 2 2 2 2 2 8 8 8 8 8 8 8 8 M ) 2 2 3 3 2 2 2 2 2 2 2 2 2 2 2 4 4 4 4 4 4 3 3 3 3 3 3 4 4 d e u n i 1 M i t n o it n n i t 3 3 3 3 3 3 3 3 4 4 e U U
'4 i 1 c d d it it t t it it it it it i t
it 3 3 3 3 3 3 ( m a n n n n in i n n n n n n n n t t it it n a U U U U U U U U U U U t t t t 3-N t I las l I s 1 i t t t t t n n n n n n n n n n n t t t t t t 1 t I t 1 t 2 2 2 t t t mimiminU n U U U U U U n n U k k n it it mimn min md d dr dr dr dr e r e r B a le le n n io io io io io io io io io io io e er MMi nUnU eyPyePye yPe yePy eyPey P y yPy P P P P Ue. U U U U Ule i lP o o o o o o r e e e e e le le e e fre efr e fer fe rf fr Cr C f l b e e e ej j a a 't g gt tg lt g glttg lf a r r o or kr k rk k rk kr k k k rk kr u u u u u u u u ur ur u o o o o o o r r r ta ta ta ta ta te a lo o T T T T T T T T T T T T T T T T V V V V V V WWWWWWWW h h r eG t j ?NxX. g3&h j I n M p 8 4 8 8 I 8 o
- c. _
1 M__ r d l _ l j I n I I 1 1 I C C d 1 r M_ 1 j I 1 1 I I I n d I S M e d,
- p m
L I P-u 2 I 2 2 I 2 t. r e C m C g e S p M m u 2 2 2 I 2 P-I S M n T- o Si Wc t u 1 I 1 1 1 1 M RS t c M A n 1 2 I 2 2 1 2 2 iar T 2 5 3 8 t ne 7 1 1 9 9 7 9 1 6 2 7 7 8 e v ;9 9 3 8 9 9
/ 8 / /5 / 0 03
/ 21/ 8/0/ 9 10 / 7/ 0/ 98/ 92/ 99 8 /
/ /
1 1 M 3 / 1/ 2 1 2 1 2/ /27 F t / / 4 I
/ / / /
1 1 2 1 / / 0 5 2 6 5 1 1 4 1 1 1 1 1 r e 9 4 2 8 4 2 9 0 6 1 9 9 6 2 0 0 0 0 2 2 0 1 1 0 1 0 0 1 Rb 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Em Lu 3 7 9 8 1 9 1 2 5 7 3 9 9 9 8 9 1 6 2 7 7 8 9 9 9 9 5 8 N 2 9 9 5 5 5 5 5 5 5 5 4 4 4 8 2 2 9 9 9 9 9 9 9 9 0 0 G 4 0 0 2 2 2 2 2 2 2 2 3 3 3 ) d e u i n t n 1 I o e it it ( c I n n m it a n U U N U e e n ke owow 3-B l P t a 1 1 e R R in in miiimmiii r t t 1 t i i i t n n n t t 1 t i t 2 2 2 t n n n t t M l e C ee ee U U U U U U U U U U U _ b f k k lo n n n no on on n n o n n n n on o T a a a io i WY Y Z Z Z Z Z Z Z Z Z Z Z i i io i io io io i i - M__ ZqhO A
- zC. X
. p$
t
[ { l { l' [- { Appendix C [ HPI Unreliability Events,1987-1997 ( [ [ { { { { 4 i
Appendix C HPi Unreliability Events,1987-1997 The events classified as segment failures that occurred as part of an unplanned demand of any segment of the high pressure safety injection (HPI) system were used for the statistical estimation of unreliability. Table C-1 provides a summary description of the events used to determine system unreliability. The table lists the events alphabetically by plant name. Within each plant, the events are sorted by failure mode (i.e., failure to nm or failure to start). There were no events classified as common cause failures (CCF). Two engineers independently evaluated the full text of each licensee event report (LER) from a risk and reliability perspective. At the conclusion of the independent review, the data from each independent LER review were combined, and classification of each event was agreed upon by the engineers. The events identified as failures that could contribute to system unreliability were peer reviewed by the program technical monitor and technical consultants that have extensive experience in reliability and risk analysis. The peer review was conducted to ensure consistent and correct classification of the failure event for the reliability estimation process. The events identified in this study as segment failures represent actual malfunctions that prevented the successful operation of the particular segment. Segment failures identified in this study are not necessarily failures of the HPI system to complete its mission. As an exampk, a motor-driven pump segment may have failed to start; however, the redundant motor-driven pump segment may have responded as designed for the mission. Hence, the system was not failed For the events associated with the injection header and cold leg injection path segments, some LERs identified a degraded flow condition to one or more steam generators. In these events typically no actual flow rates were provided, in some cases a qualitative discussion of the relationship between the flow rates and technical specification or safety analysis report requirements was provided. In these events where degraded flow was indicated, the corrective actions associated with the degraded flow condition were reviewed. In some cases the corrective actions for the degraded flow identified lengthy and extensive testing and inspections, along with component replacements. Because of the extensive corrective actions associated with the identified degraded flow it was assumed that the degraded flow was not sufficient to meet technical specification operability requirements. As a result, the events that identified degraded flow in a feed control segment were classified as failures of the associated feed control segment based on the corrective actions taken by the plant. For the LERs that identified an injection segment flow problem where a flow rate was provided, the segment was classified as failed if the LER stated that the flow rate was less than the technical specification minimum flow rate. Overall, there was no assigned minimum flow value for determining a failed injection segment for this report (e.g. less than 90% of the technical specification minimum). If the plant identified a flow rate less than technical specification minimums or a degraded condition required significant corrective actions, the injection segment was clase.ified as failed. If the LERs identified injection valves that failed in the normal position for injecting water into the RCS cold leg, these valve inoperabilities were not classified as failures of the injection segment to operate for the mission. However, these malfunctions are considered as system inoperabilities. This classification was based on the need for the injection segment to function successfully for a period of time whether it be an operational or a risk-based mission. Even for an operational mission, as stated in most safety analysis reports, the system must be able to function over an extended period of time until the plant is cooled down to the point where the residual heat removal system is able to be placed in service. C-1 NUREG/CR-xxxx, Vol. x l
Appendix C Table C 1. Events used to estimate IIPI unreliability. LER Plant Name Number segment Failure Mode Desenption Dunng an inadvertent Lsi- actuation, the llP51 loop tajection Palo Verde 2 52988005 injection header FTO valve did not fully open due to a blown fuse. Installed new fuse and valve tested satisfactonly. Cause of the fuse opemng could not be determmed. fuse failure was concluded to be a ' random event. R.E. Ginna 24489003 Train actuation FTO Inadvertent safety actuation.only Tram A actuated Train B Si logic failed to actuate due to a wire mtertenng with a relay plunger. The mechanical mterference was due to mstallation and inspection requirements for a system modification overlooked the possibihty of mechanical mterference. Turkey Pomt 3 25494002 Intermediate-head FTS As a result of an madvertent ESF actuation signal, all pump train equipment responded as designed except 4A si pump failed to start. Failure attnbuted to mtermittent failure mechanism (failure could not be duphcated dunng troubleshootmg). Replaced blocking and timmg relay associated with pump start Tested satisfactorily C-1.1 Special Interest Events In addition to the events classified as failures that would prevent the IIPI system from successful I operation during a small LOCA or steam generator tube rupture, several events not considered for the unreliability calculation are described below. The first event was classified as a human error of commission and the second event is a design-related event. C-1.1.1 Error of Commission In the operational data consisting of unplanned demands, there was one event in which automatic actuation of all trains of HPI were intentionally bypassed by operator action when the system was required to be in operation by plant technical specifications. Although this event was not classified as a failure for the purposes of quantifying IIPI unreliability, it did occur during an unplanned demand and is discussed here because of the human error associated with the event. The event occurred when the plant was being retumed to power operation following a short shutdown for maintenance. The plant was at 11% and power was being slowly raised in steps. During g each of the power increases, Reactor Coolant System (RCS) pressure increased to the 2205 psig setpoint 5 for opening of the Pressurizer Spray Valve. The " closed" indicating lamp did not extinguish in either instance. The spray valve failed to close, resulting in a steady decrease in RCS pressure over the next E 19 minutes. Troubleshooting strategies in the control room during this time period included taking manual E control of the spray valve and selecting it to the " closed" position. This was done despite the fact that the spray valve indication never changed from indicating full closure of the valve which had led the operators to believe it had not opened. The operators concluded that a LOCA was not in progress, however they still suspected that the pressurizer heaters were not functioning normally. They also evaluated the possibility that the continuing RCS depressurization might be the result of a secondary plant induced overcooling of the RCS. This was based on secondary plant anomalies that existedjust prior to the onset of the transient. RCS pressure decreased to the Reactor Protection System (RPS) low RCS pressure setpoint of 1800 psig, resulting in a reactor trip. Following the reactor trip, RCS pressure did not recover as expected. RCS pressure decreased below 1700 psig and the permissive to manually bypass automatic liigh Pressure Injection NUREG/CR-xxxx, Vol. x C-2 - ll
Appendix C (HPI) actuation had been met. Prior to reaching 1500 psig, one of the control room operators announced and bypassed both trains of HPI but did not receive permission nor was his announcement acknowledged although operator interviews indicated that the Senior Reactor Operator (SRO) on duty was aware of the bypass. This action was inappropriate since the reason for the ongoing RCS depressurization had not yet been diagnosed and management concurrence with the ES bypass had not been obtained. The acting Operations Superintendent, after completing phone notification of the Plant Manager, recognized that the operator had bypassed ES and recommended, to the SRO on duty, removal of the bypass. While this action was being discussed, two of three ES low RCS pressure (1500 psig) bistables tripped and the SRO on duty immediately ordered the bypass removed, at which time full HP1 actuation occurred I automatically. Full HPI flow to de RCS occurred for approximately one minute, after which the system was once again placed in ES bypass, per the procedure, so that equipment could be manually controlled. HPI flow continued for approximately another minute and was then terminated due to the rapid recovery in RCS pressure. The ES bistables were then reset to arm the HPI System. RCS pressure again began to decrease due to the spray valve being failed open. One of the three ES bistables tripped. As RCS pressure decreased to a minimum value of 1503 psig, the control room crew bypassed ES, since a full I actuation was not necessary based on observed indications. Makeup flow to the RCS was increased by opening the HPI make-up valve. Over the next 10 minutes, RCS pressure gradually recovered as the increased makeup flow filled the pressurizer and compressed the pressurizer steam bubble. After RCS pressure had increased to approximately 1700 psig, makeup flow was terminated. However, pressurizer temperature continued to slowly decrease. The Pressurizer Spray Block Valve was closed and stable RCS conditions were achieved, terminating the event. The cause of this event was the failure of the spray valve. The failure was compounded by the concunent failure of the position indication for the valve. The spray valve failed to close in both the I manual and automatic modes of operation. This particular EOC was omitted from the HPI unreliability calculations since (a) the error could I not have occurred during a small LOCA or a steam generator tube rupture (SGTR) and the system unreliability is calculated for mitigating these events, and (b) the system was placed in bypass after a minute ofinjection and as a result, the operator error is more likely classified as a " procedure non-compliance" rather than a system failure. C-1.1.2 Design While at 30% power, both pressurizer spray valves were modulating to control pressure, the feedback arm linkage on pressure control valve (Loop A spray valve) became disengaged from the valve stem connecting plate. This caused the available tratrument Air to be ported to the valve actuator forcing I the spray valve to the open position. Spray flow increased causing the Reactor Coolant System (RCS) pressure to decrease. As pressure decreased, the operator noticed that the " red" open indication light was still present on both spray valves. The operator placed the two spray valve controllers in manual and I verified that there was no demand on the controllers. Power was reduced in order to secure the two reactor coolant pumps feeding pressurizer spray without generating an automatic reactor trip. This was done to stop the depressurization transient. An automatic reactor trip due to low pressurizer pressure I occurred at 16% power. A safety injection, accompanied by contamment isolation, also occurred at this time. RCPs 2A and 2D were stopped manually. The operators implemented the Emergency Operating Procedures and stabilized the plant. The safety injection and Phase A isolation signals were reset and instrument air was resupplied to the Reactor Containment Building. Due to the mode of failure of the spray valve, the valve again failed open on resupply ofinstrument air. Pressurizer pressure dropped below the nominal safety injection setpoint but an automatic safety injection signal was not received due to the block / reset feature of the safety injection actuation circuitry. By design, the safety injection trains C-3 NUREG/CR-xxxx, Vol. x I b L Mo* e ~ P
Appendix C l were blocked when the reactor trip breakers were open and safety injection actuation had occurred. The Ilj' operators did not manually inject safety injection because the operators were incorrectly assuming that the Emergency Operating Procedure criteria for safety injection were still applicable even though the g Emergency Operating Procedure was exited earlier. The transient was terminated and the plant was 3 retumed to normal operating pressure and temperature. Later, the reactor trip breakers were closed which I automatically reset the safety injection actuation capability. The actuation of HPI did not inject coolant ) into the RCS because the minimum pressure reached was 1725 psig and the shutoff head of the High Head Safety Injection (HHSI) pumps is 1680 psig (plus 20 psig suction pressure). The time between the event initiation (2235 psig and decreasing) and the automatic reactor trip was 281 seconds. Even though power was being reduced rapidly, review determined that the operators should have initiated a manual reactor trip before the automatic system was challenged. From the time that the Emergency Operating Procedures were exited to the time when the reactor trip breakers were closed, the plant was in violation of Technical Specifications. The plant was in this Technical Specification for approximately 2 hours. The Technical Specifications require two of three safety injection automatic circuits to be operable in Modes 1 through 4. All safety injection trains were blocked due to the safety I injection block design feature when the reactor trip breakers are open. This particular system actuation a failure was omitted from the HPI unreliability calculations since (a) the initial demand for HPI was successful, and (b) manuel actions can be taken during subsequent demands to start HPI.
)
l 1 I< I I I I I' NUREG/CR-xxxx, Vol. x C-4
{ ( { '[ [ [
~
Appendix D Supporting Information of HPl System Unreliability Analysis [
=
[ '[ [ [ h.. . . . . .
1 1 l l Appendix D ! Supporting Information of HPI System Unreliability Analysis l D-1. RUN TIME CALCULATIONS Table D-1 provides a summary of the run time estimation. An average run time was calculated for each pump type. An average run time was calculated for the high-head systemhrain. An average run time was computed for the intermediate-head system / train. These averages were then used to estimate run times for pump demands with unknown run times. Further, the uncertainty arising from using the projected run times were not modeled in failure rate estimates, since it is not significant compared to - modeled statistical uncertainty. Section A-2.2.3 of Appendix A provides the additional information about the run time evaluation. i The cumulative run time (actual plus projected) based on the 124 unplanned demands for the high-head pump trains is approximately 50.3 hours. For the intermediate-head pump train, the cumulative run I time (actual plus projected) was 151.7 hours based on 115 unplanned demands. For the combined pump ! trains, the unplanned demands resulted in 202 cumulative hours of run time (actual plus projected). l Table D-1. HPI pump run times (hours) estimated from the HPI unplanned demands. Pump Type l Run Time Events High-head Intermediate-head Combined Number known' 105 114 21 l Known run time (hr) 27.5 70.9 98. l Average known run time (hr) 0.26 0.62 0.4 - Number unknown 87 130 21 Projected unknown run time 22.8 80.8 103. (hr) Total projected run time (hr) 50.3 151.7 20
- c. The value represents the number of successful HPI system' train events involving the given pump type and the HPI systern/ train run tirne was specified in the LER.
D-1 NUREG/CR-xxxx, Vol. x
Appendix D D-2.
SUMMARY
OF CUT SET CONTRIBUTION TO HPI UNRELIABILITY BASED ON IPE FAILURE DATA AND 1987-1997 EXPERIENCE FOR THE SIX REFERENCE PLANTS To determine the reasons for the differences between the IPEs and those based on the 1987-1997 experience, the cut sets for the six references plants (both IPE and 1987-1997 experience) generated for this study were compared with each other. The results are based on the model assumptions presented in the Section 3.2.1 of the main report. Table D-2 provides a summary tabulation of the cut set review. The contributions are based on the cutset contribution to the mincut upper bound of HPI unreliability. I I I I I I I I I I I NUREG/CR-xxxx, Vol. x D-2
i;{fj ll j d}c.F o 5 n t r n n n n n
- 7 dd o t a
s o u r o i t o c s i e v r i e v r i e v r - r u p m r-p m u 8 en s u r d- d- d- op op a a t t 9 s s s e f f 1 B 4e p p T d r o r o po r o mtpo t on t on a mt mev mev he e yr e m m S e t o t t
- t mn h
t it l uc gn u p u p W R h n m o u u mpo f n e o u u mpo foen c e fi od r fi od r i ba Fie i n n o f o oe c s - r s - e oi f vn e r r i r e e o t s v n r o o frde ieip l ne i v i v e c e s e er i na s eri na ut o ut o d s r r l l
- rl x r r j rd e rd e t
eu nee d d- u i n l u) ul r n t l u r n t iam f iam f a si Udo7 r-o r o l i a p i6 f0a i fatoia iat oi t d n na t d me o f o a n e n i t s m PM9 I 9 t o t o f t n m u t n E t nm m t nm m e d n d n a ei t I I e1 e - f m f m e d)5 f p d9 e0 e d dt o) e d dt o) nuer) 6 nu er) _ s n eo or7 T89 o o a0 o n( n na eu0 enan u0 6 e6 po0 p 6 pr a e t i t i s r F F c - F et p *r dE pt rdE d et - d eto0 - l i s s o itu 1 C C pE C c3 et d s dt e ae7 e dt ae7 n pE n pE m8 m8 ua i i t I I b a m b F C) C) 5d n5 C) - 5 i n o nsb5 l nsb5 l u3 u3 b r ie - 04 0- i(
- 0 t I
oa( e i oa( e p( p(
- ou l r
htma e s li t t tnth -
%E -
pac nr nr hm P imi ' .cv
%E8 hE hu u 7htm*r r c p ph o o 7. 4. 4 r
- 6. 8 viv %vt ea s %vts ea l
ih e rl f-ua C 2 1 3( 2( l. 9 6 o 1 s 1 i( 3' 7 2 P 1 u"s un e P" e 7 1 pus r 1 1 dt i r o 1 1 dtr i o a
- fA d(
n . n o t a r ne i e c n e e c vr i as e t s v v v r - n dd en i r e i r e r o u s e s s s a o d- spf s d- spfs t r i a a t o) o il l i t c B 4e yr p s t omo r ut t omo r ut m0 5 t s p bagn u m o p u o p u h E m n o o o3 mu t t bi i l g u p m ne os a f e e b i r e ba Fta i f e 2 p pd n e ov cn ov cn f o (t n eI i l nD v si ra ed n e s r a i r e rP ei rl e i r r u r- t ed n e r u r-e rt a v uI ner u d- t us i r l I iax Udoi l r l i on l iat on l io d fa oa t i fi o f oai fat r E e s PMFa I t o t mm t mm t nn o g o - n n I t P h I eE m ed o ed o el i I t orPe f d nt d nt di a m nr t TI o nae nae nf f oof s r t F et u prd et pr d u e ps o d ol u C a a ep F e4 det e det sl e - s e ar b ug bu a t F C)4 I sl n ob) a5 n i ob) nu a5 i d mC) p C6 ie r 0-t l 0-t 0- - 0-bpaE hv l ni ioF tnth o hE
- 3. 2 hma4 si paEv si ma4 v n
e %E 2 t ui n C 9 8 6 un2 6 un2 5. r i 0(87 b n 8( 2 pu( 2 pu( 2d i r t w no ohs 7 9 E c 9 . P t e ee s 1 p x+/ A I r t t ut 7E 8 R cl 9 P 4 f u 1 0 of a nI oP sI iI r t a e n ph t a mg) lP o ns . e - ci yuo r s n i c n e 3 d adt r r fo a e mnl au f e r m el c R e Su nc a t a c W
.iye 2- rt ei pl Dxb eea i
n s gs l 7l i ia s ba99 nre el DC l T1 u 9 g3: chx. <o. x . ll
d]e.
- U M n d M o n e
n e n C C n a v v u p p dd e r A en s a g i r i r o m m u r T d- d- uf l e a B 4e h a S r o rA o t s p Apo Ap nne n n M yr e c s W R t o t oi a n m innt a ve oe u i a v h a it uc i u l bi gn ier d n f o f m ff mt r p t fd ri r c n t fd ri r f c a Fi e o) oo n o r- o -r o) ieine v e e a l p i r r u e5 r0 e re r )6 v e rt on e e rt o e6 r0 - rl x d-l u - uu0 i u ot uo u nee i) fa5 l E l l
- r l min li m iE l
Udo7 r o 0- a0 i f aff6ia E dro i i a ft d a a ft d) f a2 3 PM99 I t o t nE t l t nd9 t na nm n6 t n( I e1 m) e d 3 n n5 d e (s e n( o e o) na0 - el e nE d a M no ntan n d m I or7 e - f4 e( o f d nt noe 6 d no nn eg t T8 o0 - pe ei t ri o eiu0 ei0 F E ec pc ee e se at t - t i s r t 9 pt c pcdE pc4 ps ou l 1 C8 d r e Fs ee ee( e n u d s d o C d s e1 d s n d n o t b F ua C1 I os neI g nt e C 6
)
l neb 6 neu In gri M i r he -( - n - ra I - Cg r - rl I ga( a iac - a o e r I t
- a u t
nt o
%n %o %h %mc %E %h
- 7. c t o
i 4. tc i c ph a 4 c a t vivr %hcl s %tca s s s C 5 e 9 1us 3d 38. i 5 ui 3 6 2. 2d us i ne 15.dfisi a 2. B 6 s pd 2 ( 1 M e n n Ci v c o i a r dd pr e t e s a a n n ms uf d n r o M B 4e i o Apo a At o ) 6 yr t c u nnt u e A nm o 0-it ug s iavri o n5) iadt r E M l r e i bi Ft i a T t a0 r - t f a u n e3 a a S fd c 1 inD o - r an t E ond( l ei rl e W R eon rt f o 6 e ri o ee l c uot e 1 t ner e ucb Ud u i i n l e a r v a mia r( ia sl l s us oi l p M fO n l"eus iV l a f i e PMFa I f d I m u t na nm t af I eE p e o t nM eano orPe f)4 d nt en e d vut t s TI o0 eiu noe dni o nkCo u t pepec r t olu F - C E ee pcd et pc eh mc M t ua b F C 27 dIneb) ( se ga5 d l e u s dn c uan I npn i r he - s rl 0 np o e t
- aia - I int nt o %V
- 9. O 2. %h c vE %p 4. cenj ivi a6 - u m%t e n M
C 8M8d 4 i n2 s u( 5B 0idm r a 7 9 E 9 1 p+/ I P M
- x A 7E 8 R 9 P 9 1 0 t
n a l P M
)
e c d e n u e r 1 n f e e it e n e n o c R o ( c
. O 2-D n gs s l
e ia s b el a DC 2 T M 5 oPWgy. <2 x - o
j )
>3n U n n n -
n o n e - eE v0 e vne dd ) e u r ivE i i en eT gI g d-r0 d( r1 di r v s a a r r T o 1 - - r B 4e h( aB h a S t s r o( rT oI rd-o yr e ck c W p t oI T t oB t oo r s n l it uc gn i d at is d R m u mB mfo mto f f o f ba Fi er p i i n n n o ot n ou t fo m eo e n ieine l rl x nee p vi i t r c d- ej i d8 vW r r l i) e u i e v r ! si e r s t n e s e rt u o s ne s e o r e lur f Udo7 fa5 d l r oi n iamg iuW i rl o 0- r fa mg al i oWtnE f f a PM99 mr I t ono t e o t t n es t n s e t f nd 8 I I e1 or7 e - f o f mB d 3 o n5 m e d e e d e de n3 t s T8 r lt1 9 ob F ot Ft o f o e( pef o ec ng er pa ng er pa n a (d en a put ou Cn Cu d r F eh d cs eh d cs er s t b F ua Ci sI t Cos nI ous CC 5) t I ni d ni dnt oo I t
- n - I d ie r n
- A t h
%mg e e %n o s p
s p pp C nt o 7 8 e I' 7 8 e mg 5.cui %E 1 t 3 2 %m) 0 2 u5 %m) 2 u5 8%mm uu 3 sI 3 s I s 4 ( 2 p0 2 p0 0 pp
)
n n6 n n o m n e entu e0 e v e dd o v vo v - i v en r i i iE r r i r s f r r e a a T s d- d- cn d0 r9 d r d) - r6 B 4e S p p) V r r a o( oT yr W m) m5 O t o o ne t t oT oB t I t o0 oE t u R oot i bi Ft l ig a f u5 u0 M p0 -pE mmn mB mf I m0 o o foto u i f f 9 o) fd a e 4 nE e n5e n a a o onm t o( iei nD l r0 v5 v7i( i ea s n se os s s r nt o eV t u E - i c ei rl e r7 r r r ne r l d( drT us u io e ut s ut luO Udoiu ia8 - rT rBo p - I iat l l n l n iM l f 2 oI f cd u ia e i ae a PMFa I t n (e t o B o poo t f m u t s e le) fngmf t ng t m f t T de v mt mt n nS I I eE u deebga - 0 5 e e e es e orPe d s dW l na f n f) ev oih o ho o05 - n aiE m f d t s TI p rl ne e ne eg g nR e r tl ek Ft a Ft a F E p ehc a8 v pr pr pn ou dnc e Cp Cp C e s al e ha e a eo t br u a I ch Ce Ce C 5 7 di n( d nd ue cn sI i c d hc n s ) di nc t
- - rg - rg ( I 6 I u
ie t r nt h %n o %a %a % T S
- pprABiv - dp I dpi E 0 - - sp 2% mms %m%m0 %m o 9. i 6. h t
c c e C 0 u c 3i s 6. sh 6.W 3i 3 R 3 ppouuf 6 u 6 u 9 6 u 5 s 1 d 1 d 1 1 p 1 p ( 1 p 7 - 9 9 1
- p+/
x E P I 7E A 8 R 8 9 P - 1 0 t n - ) l P a e 1 i s r d c r e n i a u e r l i n e n t n f e o r o R a e ( c h
. S 2-D n e igss l s a b el a DC 3 T
g i zCWmOPN $ d- OX w llL
dje U* M n o o n o e - dd t s t s v A en p p i r l sa a d- e B 4e s m u m u r) nn M yr e p p p to5 a it uc m n n o0 - h c) l gn u e e mE f 6 _ i b ie p) v v f0 a Fi r i r i r o0 - n4 o1 eipne e0 d r d- sE i l r e(s e2r r rl x nee i vE o r8 t t o l ut n l u3 Ud o7 d- 1 o o i ae i( al PM9 I 9 r o (s m m fngmf t ng ta n M-l l I t ot n l l e e me fa I e1 a s ei or7e - f d ne nn d s t s T89 f mo) o eg eo r r t oge F5 F) pa5 pi o lu1 Fs C0 CC- 0 d h c dntu t e e a t ua Ce CE
- E n i s b F Cg I I c i
r e tnth - ha r
%(42 %3 5 d p B a
C o %s 6i c 5 t r 9. 5 a 2 u 8 u 2. dn t (n %m% 6d 1 s 1 r 3 p 1 a M 3 3 4 4 n n - t - t - it r
- t r
r o e r o i n r o i n r o n o i n o o dd ena v t o U t o U t o U t o U t o4t t o4 s a s i d-r m f o) m f o) m f o) m f o) m iU0 n)6 3mi) t n6 M B 4e p r) 4 F6 4 F6 3 F6 3 F6 3 U0 to50 - C0 ntoC0 ntoC0 yr m i t i t C 0- i t t i t fE t if E i t u g u o E CE n t CE CE in o CE n Uo4 n U o4 t p l i ba Ft a i a m6 Ued 8 Ued 8 Ued f u 8 Ued 8 F7 f F7 iei nD l n) f e4 f u o(2 od a( n9od a( odn9 a( od a( v0 ert s ee en ee en ee en ee en i - f u n9 f u n9 oeCu f C (neCn oC(u rl e rl rl rl rl rd r rd r drE un ub cu ub cu u u no ne ru Udol - r 1 l i e i l a ir l v l i a vub c av i r l i l u ub c auv i r l i ai r i r o a l i no at i l at i o4 famfai r o air l o air o l a PMFa I t ( o s ne naf t g t aet vs s f ta vet s sf aet t vsf sa et t vsf nA s ft nB u t u I p naf p naf p naf p nr p nr p I eE mtn e s d ut enomdenomdenomd nom e om e om e orPe t s TI f e d ng omer e n eAop eBop u u eAop n uteBop uu ut neApu eAp u n utu u dt n u dtn u r tl ou F g pa p Cse eh epe e nv depe p e n epep en pepe ne pepne epn p M t ua Ce ni d cs d mc ni mc ni v d mc ni v d mc n v d mv d mv e b F - gr I d I nupnda r I n u pnd a r I nuapnd r I nupnd ar nui i I pd r I nui r pd ie r tnth
%ac - s p - nt er - - nt er - - nt er - - nt er - - n r- -n r-C o 8.
0i s h 5%u m7.% vienovit%eno vit t ri a o 7. ri a o 7. ri ao
%eno7.%eno vit %eo vt ri ao 3. ri o 3. ri o
%eo vt M
7d 4 p 1 d mm1 d mm1 d mm1 d mm1 d m1 d m 7 9 E 9 1 p+I x P
/
M 7E A 8 R 5 9 P 1 0 M t n a l P ) d e u e c n e 3 i t n o M-n r P i t fe y n e e _ o c R k r ( u T M 2-D n gs s l e ia s l b a eC D 4 T M oPNAh. <9 M 5 o
.!I 1 ]llll !(i1ii l
>sa&.xD t
n a r
- dd o
en t s o n u r s a t T a s S o B 4e p p t yr e m m W s p R
- x. l i
i t uc gn e u p u p f o m u biFi a r n) n s p i ne e4 e e n l eip i v0 - v i r u e rl x r r v
- nee dE d -
l ia5 ) i r Ud o7 r1 o1 o r f t 0- dr-PM99 I t o (s t o nE o mtn m de3 t He1e - o or 7 f e f n5 m
- t s T8 rtl 19 om o Fg F e(
pe f ec o ou Ce sC d r ua Inu F ) t b F Ce - g -C) 5 os C i r e r - 0 - n C 50
- tnth %a %-h %o - E
- 5. 4E %0 i
o 1 cs 1 t c C 0i 0 5 4d 2( 2 s0 u 9 5 1 (
- 'n o t
a r n e t s n v dd u i en s a o r d-r a t s o
- r t
B 4 e p s o yr m p t o i t u g u m m l p u ba ia i p f Ft a n o nD e n i l v e s ei i v e rl e r r ner Udolu d-r i d r l i8 u) i a o r f0a PMF I t o t o t n E
- o I
e orPeE I m e 6 f m' d3 t TI o f n( s rt F o et pr ol u C F et a t ua C)5 C)
- b F ir e - C7 d nso I t
0 0-tnth
%-E E
- s p
C o 8. 1 6 2( 3 078 5 %mu 1 9( p
- 7 9' E 9 . P 1
- p+I x /
A 7E 8 R 9 P 3 1 8 1 t n jc t a e l P o r
)
e Ps d c e n e x a u e Te n r i t f n e h o R u t (c o
. S 2-D n e igss
- l s a DeC l b a 5 T es ,mOFYss $rM 5
1 d]e:* n d n t o o dd en A a d n a s p m s a l t ng e u a T e B 4e S n er a pI S yr e n mh nI t uc W h a gc eI i l gn R c es si i vI I ba Fi er i i f f d rf o o) gIe d- o) in l e s e6 rS r e8 eip e r0 aI or0 rl x r u - hl l t u - nee u) l 5 iE l cI ol Ei Udo7 i0a fa2 i sf mfa4 PM99 I f - E 3 d o Gtn( 6 I I or7 e1 e - t d( n3 e5 d t n( el a n Ge)rI n g Ci a 0 f n I l u7 Cd e l l et n m_ . t s T89 n e e ei fE opg em r t pcr pse f ot 7 Fee ou l 1 deu d n o F en5 Cn d s t b F ua nso Ini t C d (t Cie g
- a Cenne - dna r I
ie r n u tnth - o C o %i%t a 3 uc 7 t c
%d
- e pm%ms g 1 ah c
ines 0 nd i 9 s 5B 1 ege e n ner n n n r ol u e r r o k i ou g n o o au m l c t l r i i hi ii dd e ci a a o t c t c c a t a en uf) hI I u u sf cf s a a sG sG i h s cS) t S) i t ut c t 8 cI d nt r isI 9 uI 9 s nt l I r B 4e G n Gen 0 I dI I 0 - sII 0 I l I I SC Gedti as Ged ta yr I d o I dE
- SC I I ns Cen0 Gfo1 E IGfE I I l I t
u Cac ni t l f I f I t I i libia iFta g a f t u ons e eI f p1 oe( CF2 CF2f CfF ed e f C (t I I I o1 (t I o I oC) 9 oC I I fF o Ceo f e s od p pt Cpteo fode ps m nD mS e ri nm l ei rl e r u gl i r nv ui l a oCa oCa eCr 0 eC) r t r r e rinm udnp u udnp u - Ud u ne r l i el id l an v ed r u n s t ed r s ud n E ud l n0 9 l l a o u na o fa t 1a5 fa aE faan l i asI i i - i a ol i f ef f ak c l l f an e PMFa n vo t t I t t i i t t e t nt n e f atns p fatn s t n( t n 5 t nv t n nv ep n et n e1 n e ei r e ei r l I eE e a e e ehc e e e I orPe dn v u ekli) r d nm egn egu t nm e mtnmgu ng md mne d m (t d md dn gmd r-t TI pc a8 peio d ep d ep eemeengn n e g ee r-o ee o . s e ef 4 est c ens n e ns n ps g ps evge mee o pst pst r t ou l dn htcnE dnv e u pee pee eeo u a s e vv e vv ee d v e se dnl d nlvm) d vm)nl t b F I ede0 g I l aI d a r d a r l i l i nl I ag e I a s I aI 0 I aI 0
- kv on - kl i
t r he - r n1
%a pe e( %kI
- vS I nvd nvd I
- k r
- I kr o vr a
kc hc %ci %ci vS l 1
- vS kl l
1 E
- c o el 0 E %ci nt o 5. hc e 5 cI eI e t ct e %e t e c 6.h el 0 M C 8i 2di sd nv a28hf co %h 6 cm6 o %h cm4o cd 3.h i s 3.
4 cs 2 c o h u f 9 ( 6.h 2 c o f 9 ( 7 9 E 9 1 7E 8
- x p+/
P I A R 1 2 9 1 P 6 1 M t n a l P
)
e c I d n d e e u r o n e o i t n f e w M o c R da i r ( _
. B 2-D n s gs l
e is a b el a DC 6 _ T . [gcFfhQS x i L e6e M rllf1 ,f
Appendix D D-3. ADDITIONAL INFORMATION SUPPORTING THE UNRELIABILITY ANALYSIS Information and results to support the high pressure injection (IIPI) system unreliability information provided in the main body of this report are presented. Figure D-1 provides the simple P&lD I schematics used to define the piping segments for the six reference plants. The labeling of the segments correlate to the naming convention used in Figure 4 of the main body of the report. The plant-specific estimates ofIIPI operational unreliability and associated 90% uncertainty I intervals calculated from the 1987-1997 experience are shown in Table D-3. Due to the sparseness of the failure to run data, both failures and run time, the PRA-based mission uses the same operational mission assumptions. Therefore, Table D-3 also represents the PRA-based values for comparison to the IPE I results. Similar types of estimates, except they are based on PRA/IPE information, are shown in Table D-4. The results presented in Table D-4 are calculated from the PRA/IPE failure rates and based on a half-hour mission time. The listing of cut sets contributing 0.1% or greater to IIPI unreliability based on a half-hour mission time and the 1987-1997 experience are tabulated in Table D-5. Table D-6 lists the IPE generated cut sets contributing 0.1% or greater to liPI unreliability using the half-hour mission time and the IPE failure probabilities. The fault tree model appears in Figure 4 of the main body of the report. I I I I I I I I I - D-9 R REG /CR-xxxx, Vol. x
. >mto pe M A B A R I B 2 2 G G G G - E E E E L L L L D D D D L L L L O O O O C C C C O T O T O T O T M_ _ 7 .._ - ;- . B A B%N - B AqN _ J , J _ B NMN. - J
$N_
d
^
J N I N I~ A~ I J N A N I-B- I~ B~ J N I B M A - P~ - f - P P~ - P P- , P . U - O O~ O O- - o O- - O
- O - O O- - o t
O L L- AJ L A B, L:
.M MN - O'N -- O'N.- -
- L: J B
D t- LN-B N B' R -N N - , ~- R N. I A P
.l. R -I D A H P B
P el. ,
, B D
H M O.' O'.l H.-O...l O_*l
.. . ,. , .,..-j O-O~ ._,
O - O -- _ m ,-
' ' - L~ 4- ,,
L_f:- A A
' 7,R~~OuT Ntu A-m ,-
- t.-
A )u T R-m - m R-D-. H,ll-D HF.*. tr'
. - R-D H,..
L ,O"T..- l-l DC n,.l m
.m r ,_
(
~
e.-
- - _u -
- - )
- - - 1 .
s s t
- - s n
-.'l..
ae l r l a p
- _p J- k- - Cp s a
e
- - .'l.- - nd c
- - ge n e
- i ll
_ _ - sa r
- - ets e M-n f
- Di
( s e r
- o i
- x
- sN 3C dp i
s rm ou ht e
- - - fP
- - - r'
_ - - r
- e fo t
a s M _ W m e _ - - t
- - _ s
- - - y
- c_
r-
- B-P_
- I P
s M-
- _ I g
p- u- - u_ _ I u-d
- - o e y_
p_ / i rd_ is- ^V-
- r. -
s
- P- ht p_
y f O s M i c _ _ t a
- X- -
m e M
. UA rl.,l
,rL_ 3 J_
h c s D _
.l..*ll'- - .
- p - l M.
T_ C - _ P U-S T S
- d e
T _ W _l,.. '.. '. .. _.'l..l..... - f i _
- i
~
S - R l p W-R - i m M_ S
,. ...'.l',..... l'..l..l.......le. .
1 D M e r u g i F b Q o pxxXX.go. x . a, o
l1
>~u9ap a
)
2 s s l a g n Cita nr
;_ ge
_g
- 2. -
p _ =_
- = _- _
i s o ely A_ __ _ B A- _ _ D J_ ._ _J _N J- _- _J Dl ( a
._ N m r
I
- _I I- _ 3o n F- _-
N__g ___e N-Q _ M __ I A_ _ _A B- _B P_ __ _P P- _- _P &p O_ _O _- _O m O_ L_ _O _L Om_ O-L- _- _L _O 2p u Le n _ __ _ - _- . - . eO _. n' c o
.r :%. ,,., .
_ O c _ y k - _ _ 3 - J J N _ . , J I N _ A R _ ., I B D ._ R - I I D - _ _ H -
~
e.:. _ r L -
, , ' , _ 1 A ,.:...
__ i
. _C A _ _ _
_ P P _ _ B - _M M_ P - _ U
- _ _ _P U _ . _ M -
_C P _ -
- _ _ _U - _C C _ P-m C _
.C
_C - x__ W__.... .:..: r- . : . ;._..:...::.'-
~
_ q. A ~
~
~
~
_ - ) ri P k
- d
- _ ' 1J
- e
_s r _
- u g 1 I
[ FU in t n T 7 s s- o - ._ w 'T ( c r _ n s _ E
- 1
~a -
.,..:,,. !....:.,...':..ll..,,....:;.'
D e m r u g i F i r
- ZCy s()N.x*** <o-T I
il
> ,t 9 c_.* O I 2 P
OG O L L E O P" O L fo t J S D CL ROC O S C" R U T c h N I T_ J _ J r A3, ,,_I,i P N Ell - Ul e B_ C P_ E O O__+N__O_ '- Q , L __ , re .. _ O_ L.*;- Q, 1 E
,l' ,l. i.
A_ R_
- A_ ._ A- R- _
ii . E R_ _ D-
._ ,l._ -
I_ D_ I_ J_ D_ H _ $ __ H g __ J_ _ J
+N ' $ J_
N_ J _N-J N. N- . I_ _ I. I_ N_- _ - B_ . IN_$__IB B-
- g. __
X I-C _ x._ B . _ _ R A_ P_ X P_ P- R_ ._ R ._ O_ - O_ O_ _ O-D. - _ D_ I _ D-I O- _ _ - . O_ - A H. P._ X _P_IB _ X P- _ L_ - L __ _ L- g_ _ R l R t _ I-C g__ _ _ C- _ _ i i O_ O_ ._ O- . _ _ R " R O _ O _ O- . _f" . M M L__ _ L _ L-O O _ . - ._ R F R F _e l-.
~
O_ _ n ia S toI s n ) o "?g e i 3 - J D"s
- i J
s s N _ I
,8' !l'
- N a I
- O , O l
A _ , - B e ,ea. .*' J N , 'e*' l J C R _ R- I - D ,l!,.'. _ - IN D- " - A _ - - n l l l - l
- R . '__" - B g
' - D _ ~ - R i
- - I
- c. ~ - ID s -
e! ,,l. e- I _ - e D I e T I _ .- E - ta i, J B _ !,e8 ~' e- (
*'J i
,I s
ea ..' ,,
,'l,* , .i a r i
r r a - _ -4iel H H _ _l'., - M _ _ 8' m _ e,p A . C_ _ B __ P . P_ _ P_ M . M_ _ _ ni ad U _ u_ _ M_ U e n P P_ _ P_ n _ _ is C _ C_ pm M_ C C_ _ , C __ ,Cp C_ _
,,m
,u
_ _ or
. - )
eelt _ ,' ! d
, l,.'l ,g,,.'s ,s ! e u
- a g _
n R
]
qL - i t n
!, , ,9e.l*,' i .
o
. 'T s_ _
c C_ U _ ( s _ T- __ M_ _ 1 S ji_s D w_ W R __ [ n e _,. . r u g i F O'(')M.yNM. < o~ x U.C k <
1i:,' j ,l
.r
>@oDos C D A _ A B C g g g _ g g g e e e _ e e e L L l _ L L L d d d _ d d d l
lo lo lo _ lo o lo C C C _ C C C
- T _ _
4Y._N&.__Q._ _h.__M.___
]
N-J~ N~ t S _ N, L N __L _ U _ I I~ _ d 3 _ _ g _ _ _ C3 B~- <3 _ a<_ _ 3_ dl_ B < J- _ P ><__ _ P~ > _ f > __ 0, [>y<_f>__ _ f CX__ OC_ Q 9t_ 9 O.- Q 0 __o9C_ _ _ 9 9 _ I- _ L _ L _ I- ' _ 1_ 1 _
)
4 _ _ _ _ _ _ s
$,.'_____ _ s
-[_MN__e r ' _
"l_ _ _ r _
l a C T , ,- ; l_ _ ,,9'- -
, , . ' _J _ n
- - _J _ J- - - g J- _N _ N- _N i
-- s
- I IN- - _ I- _
A- _I - e A
- - =
4 <3BR _ _ 4 R 2 7 m m_ R B 4 D( 3- - r- >_ D _ D u r- m R-D-
- _I I _
H-r_DI 4 _ _ - I l ir- rT , ! _ r.'I r_ . ' !
- gI T E _
bit 3
- - I T
- t n
- X- _ i S _ o IT
_ P u u N _ u u y U _ e
,i el.*e**el k
_ r _ u _!.,l ..i,e' _ .e' l ,l,l
*j_ T
.i,e8
,W'_ __
1 e
$i s el,ee.eee[
1 e
$i n
_-l
.l,.s.l_W_ _
n L e _ mL ot et s _ s _ _ r e _ _ B- _ _ (F r e T _ F T fg A_ A_ _ P- _ P_ P_ _ _ P_ _ M _ ._ _ M ,* M ___ U_ P' U- _ _ U_ B_ m _ U__ _ M _ +[__ P- _ P_ I_ _ _ _ tP_ -_ _ _ tS- _ IS_ _ S __
' v_ _
S_ r Q_ m _ X_ _ >t _ _ g> __ _.!. r,4'_ t P
, t i '_ _.
_l,!.._ 1n_ l,j..._ ; m _ X_ 3 _ 4 T _ T _ C _ C m _ _S U T S U S T S d
)
W _ W _ e _ _ _ u u _R _ R u _ n m _
,ll,
_.l i t c n o _1 3 _ T 4 _ ( _ s t _ _ S i _ i n _ n _ w - _ W i _ 1 U . _ u m _ R 3 T I 4 T R _ D e N I _ly I
,,, !..lie' N ,...l, j ,,. r U _ U u g
m i F T U* 4, t
- yOp;.xUx* c <o..
a r I!I ' I l
>eeOcp O g g g S eI S e2 S e3 CL R d o P CL p R d o CL p R d o oloLo M-oloLo oloLo TC TC TC
? > >
. a'._ ,
.al {i' a.'
!l N_
N-J .
. N __
_ J _
- J
. _ N - - N-N_
I I I C-
. B . - _
P P . - P- _ A ._ ._ O.. - O- _ O_ . ' - O-O_ ' O... L
- L-L_ _
..i'!ea.. . _ - - .
,el* e' e.' l.
.' ll
- 3. i l,e., , _ ,i_ _.'! _ )
_ , _ _ _ _ 5 s s a M,,,,
. _ . _ l
_ _ . _ . C _ _ . . n i g s M _ , . _ . . e
. D
( A_ _ , B __ _ C_ _ . 1
, _ P . s P_ , P _ _ .
_ , M_ _ M_ % _ a M_ U. . _ . x U_ , P- . _ UP ._ . e P_ -
, . I - . T t
S.. , S .. I
. S . ._ ht
. u
._ o
_ S PJ , ,
] ._
]. _
M
. ae.e l
.ili'il. _
.,.'l ._ ,.'. ,*
'l*
e.._ i'. A.
- A..
_ - _ _ ) _ - _ _ d
,,.il.i., e,.. *' r..'..... ' ,,... . e T ., l - u C. - n U..
i
- t
; n S_
T_ o c M ( S. - - c - - . W. - 1 R. -
..l.,i* ne.- D e
r u - g i . F O~op.5yx. c Oe x O.. M
i i' I 1' lilj,ljll i ,1,li l l
>oonnE.x C A B C D g g g g s
iL e e e l L d ! f i k k k lo o o o af.
- _,'f e. , lC. -
.D,
- r _
- . . r . - : ,
J N
. N
. ~ .. JN._
JN', N I . _ I- , I. - I_- N'_J.4_N_T_ ' _ C-C- . T _ _ _ C- ,
- _-_ _ C-A P
._ B P
C_ P _ D-P-
, )
O [_ _ _ O_ _ O- 6 O L . O. [._L._O_ [ _ L-O-[,, O L s s a
. . . . - l C
, n el M.__._M.X.M,,,
il i g s e D ( J N ,,,. e,!- m I
- ._ J e
A _
. _. " -- N
~ -I t
s R y D I _ 'RB - S I C-rD - I I I n
. ! . e. C . . _
- C-i_
_ o _ .,,'e,. ., L s , e- C . i t
. c j
e I n d a e H-
. . B . h A.
P. P .
. i g
M M. U.
. U P-
. H P. . .
. C
_ 2 C_ C d C_ M _ G. ._ _ n a
. O_ _
I _ . d M o o
. D . . w
. . . d
. . i
.,.,,il,* ,
i*l. _ . a r B M j ,.
, t!9_
. a , .
s M k r ' rC . T _ U ) _,ees. !, _ S d
- .i _ ,- e T _ . . G u C _ . . n U _. ,~ , '. . i M S-T .
t n o S W
.. ' - m' _-
_ ( c R . .
.,8 al! .- ., .
,,el,**. *'l.
1 M D e r u ig F M I y tg b$Oso3/.xxxx~ <P. x \ ll
>uoOoy A n c s o M g s s e e e e t L t t M o uo uo uo c _ r ._ _!._ __ c=_._-, t :.__
,l M
= _
_ J- - _ s_A_,i_A._I_A_I-N N_ i_ - s_ N I_- A_ _
)
i S__ _ I I 6 s_ a __ _ _ S__ _ S- - _ s _ D-a _ p_ _ P s o_ _ C_P_ O _ _ a O O-r __ 0_ o_ O O_ _ _ L__ _ OL-_ O _ O O __ l C M t __ t__ _ n g i _c_ _ _
- <_ s e _ :e_ _
e t __ _ C_ t_ _ D M _l-. _ .-_ {. :_ _ ( m
., t e
._ ! ,. _ s J y N
t_ R _ S M 1 _ n t t s _ i o
;.: l i; _ . ,..,Il=
t s._ .,'_ _ c
.{,.
j e n M I _ - . d _ - a _ ,,l
. e M
e Hi
. t a
W. d h__ e A_ P_ M_ C_ P_ M_ _ m r M U __ _ U_ t e P_ P_ . I
-_ _ t S
. I n
s_ _ rd__
. rJ.
2 d M _ . . n
,:, - ,.'. _ a
_ - I
. o _
d o M _ o w d
!,D,:__
.,l , ' . ,,.';l.._ i l: _
_ _ a r B T C . _ t' ) _!,l - :,.. _ S-
-- d T . _ t e
- _ S u C ._ _
n t' S T- _ _ 3 y- - it n S W _ C, - _ ( O c E R . -- _
. - -T , ..'. i ,..,'_
1
, l. l D
e r u g i F O'np h y*.<o x s.s t' e _ t !
Appendix D Table D-3. Plant-specific estimates ofIIPI unreliability (operational mission: half hour) and 90% uncertainty based on the 1987-1997 operational experience. (This set corresponds to the "1987-1997 Experience" plotted.) 5th Percentile of 95th Percentile of HPl Design IIPI Operational IIPI Operational IIPI Operational Class Plant Unreliability Unreliability Mean Unreliability , 1 Arkansas Nuclear One 1 3.22E-05 1.26E-04 2.97E-04 1 Arkansas Nuclear One 2 1.27E-04 3.42E-04 7.16E-04 i Calvert Cliffs 1 1.27E-04 3.42E-04 7.16E-04 1 Calvert Cliffs 2 1.27E-04 3.42E-04 7.16E-04 1 Davis-Besse 1.44E-04 3.80E-04 7.80E-04 1 1 Kewaunee 6.38E-04 3.51E-03 8.74E-03 1 Millstone 2 1.26E-04 3.39E-04 6.84E-04 1 Palisades 1.28E-04 3.41E-04 7.12E-04 1 Palo Verde 1 1.26E-04 3.39E-04 6.84E-04 1 Palo Verde 2 1.26E-04 3.39E-04 6.84E-04 1 Palo Verde 3 1.26E-04 3.39E-04 6.84E-04 i Point Beach 1 1.46E-04 3.81E-04 7.76E-04 1 Point Beach 2 1.46E-04 3.81 E-04 7.76E-04 m 1 Prairie Island 1 6.38E-04 3.51E-03 8.74E-03 1 Prairie Island 2 6.38E-04 3.51E-03 8.74E-03 1 San Onofre 2 1.26E-04 3.39E-04 6.84E-04 1 San Onofre 3 1.26E-04 3.39E-04 6.84 E-04 1 St. Lucie 1 1.28E-04 3.41 E-04 7.12E-04 l 1 St. Lucie 2 1.28E-04 3.41 E-04 7.12E-04 1 Waterford 3 1.26E-04 3.39E-04 6.84E-04 2 Crystal River 3 , 2.40E-05 1.43E-04 3.71 E-04 2 Fort Calhoun 1.29E-04 3.98E-04 8.62E-04 2 Ginna 1.13E-04 3.60E-04 7.91 E-04 2 Oconee 1 5.96E-05 2.85E-04 7.09E-04 1 2 Oconee 2 5.96E-05 2.85E-04 7.09E-04 2 Oconee 3 5.96E-05 2.85E-04 7.09E-04
]
J 2 Three Mile Island 1 2.45E-05 1.43E-04 3.72E-04 3 Beaver Valley 1 2.87E-04 3.47E-03 1.20E-02 3 Beaver Valley 2 2.87E-04 3.47E-03 1.20E-02 i 3 Farley 1 1.13 E-04 4.88E-04 1.23E-03 l^ 3 Farley 2 1.13 E-04 4.88E-04 1.23E-03 3 II.B. Robinson 1.85E-04 4.99E-04 1.02E-03 [ 3 Maine Yankee 3.60E-05 1.39E-04 3.32E-04 3 North Anna 1 1.07E-04 4.79E-04 1.21 E-03 3 North Anna 2 1.07E-04 4.79E-04 1.21 E-03 [ 3 Shearon liarris 1 1.09E-04 4.82E-04 1. I 7E-03 , D-17 NUREG/CR-xxxx, Vol. x
1 Appendix D Table D-3. (continued). HPI Design HPI Operational HPI Operational HPI Operational Class Plant Unreliability Unreliability Mean Unreliability 3 Summer 1 7.82E-05 3.21 E-04 7.87E-04 l 3 Surry 1 6.61E-05 2.83E-04 6.93E-04 3 Suny 2 6.61E-05 2.83E-04 6.93 E-04 4 Turkey Point 3 7.61E-05 2.83E-04 6.82E-04 4 Turkey Point 4 7.61E-05 2.83E-04 6.82E-04 5 Indian Point 2 7.88E-05 2.40E-04 5.18E-04 ! 5 Indian Point 3 6.87E-05 2.03E-04 4.38E-04 5 South Texas 1 8.24E-05 2.64E-04 5.91E-04 8.24E-05 2.64E-04 5.91 E-04 I 5 South Texas 2 6 Braidwood 1 2.15E-06 6.06E-05 2.14E-04 6 Braidwood 2 2.15E-06 6.06E-05 2.14E-04 6 Byron 1 2.14E-06 6.06E-05 2.13E-04 j 6 Byron 2 2.14E-06 6.06E-05 2.13E-04 { 6 Callaway 2.53E-06 6.14E-05 213E-04 6 Catawba 1 2.14E-06 6.06E-05 2.13E-04 - 6 Catawba 2 2.14E-06 6.06E-05 2.13E-04 6 Comanche Peak 1 2.59E-06 6.14E-05 2.13E-04 6 Comanche Peak 2 2.59E-06 6.14E-05 2.13E-04 g 6 Cooki 1.58E-06 6.02E-05 2.16E-04 5 6 Cook 2 1.58E-06 6.02E-05 2.16E-04 6 Diablo Canyon 1 3.11E-06 6.22E-05 2.18E-04 6 Diablo Canyon 2 3.11E-06 6.22E-05 2.18E-04 6 Haddam Neck 1.05E-05 1.33E-04 4.02E-04 g' 6 McGuire 1 2.14E-06 6.06E-05 2.13E-04 m ' 6 McGuire 2 2.14E-06 6.06E-05 2.13E-04 6 Millstore 3 6.01E-06 1.23E-04 4.19E-04 6 Salem 1 3.10E-06 6.22E-05 2.17E-04 6 Salem 2 3.1OE-06 6.22E-05 2.17E-04 6 Seabrook 2.14E-06 6.07E-05 2.16E-04 6 Sequoyah1 3.24E-06 6.22E-05 2.15E-04 6.22E-05 2.15E-04 6 Sequoyah 2 3.24 E-06 5 5 6 Vogtle 1 2.12E-06 6.07E-05 2.14E-04 6 Vogtle 2 2.13E-06 6.07E-05 2.14E-04 6 Wolf Creek 2.79E-06 6.15E-05 2.14 E-04 6 Zion 1 1.94E-06 6.07E-05 2.13E-04 6 Zion 2 1.94E-06 6.07E-05 2.13 E-04 I NUREG/CR-xxxx, Vol. x D-18
Appendix D Table D 4. Plant-specific estimates of HPI unreliability (PRA-based) and 90% uncertainty based on the IPE failure rates for comparison to the HPI operational experience. (This set corresponds to the "IPE data for comparison to operating experience" plotted.) HP1 5th Percentile of 95th Percentile of Design HPIIPE HP1IPE Unreliability llPIIPE Class Plant Unreliability Mean Unreliability 1 ' Arkansas Nuclear One 1 9.37E-04 1.11E-03 1.29E-03
- 1. Arkansas Nuclear One 2 8.79E-06 6.19E-05 2.10E-04 1 Calvert Cliffs 1 1.04E-04 1.67E-04 2.52E-04 1 Calvert Cliffs 2 1.04E-04 1.67E-04 2.52E-04 1 Davis-Besse 3.65E-04 5.46E-04 8.20E-04 1 Kewaunee 4.09E-05 8.48E-04 3.01E-03 1 Millstone 2 1.82E-04 1 Palisades 1.92E-04 1 Palo Verde 1 1.18E-05 1.96E-04 6.39E-04 1 Palo Verde 2 1.18E-05 1.96E-04 6.39E-04 1 Palo Verde 3 1.18E-05 1.96E-04 6.39E-04 1 Point Beach 1 3.65E-04 1 Point Beach 2 3.65E-04 1 Prairie Island 1 5.69E-04 1 Prairie Island 2 5.69E-04 1 San Onofre 2 4.18E-04 1.11E-03 2.36E-03 1 San Onofre 3 4.18E-04 1.11E-03 2.36E-03 1 St. Lucie 1 1.49E-04 3.61E-04 7.33E-04 1 St. Lucie 2 1.49E-04 3.61E-04 7.33E-04 1 Waterford 3 1.54E-04 9.53E-04 2.86E-03
? Crystal River 3 3.56E-04 4.10E-04 4.70E-04 Fort Calhoun 3.06E-05 2.43E-04 7.62 E-04 2 Ginna 1.93E-05 9.17E-05 2.52E-04 2- Oconee 1 - 3.18E-04 2 Oconee2 3.18E-04 2- Oconee3 3.18E-04 2- Three Mile Island 1 1.89E-04 2.25E-04 2.66E-04 3 Beaver Valley 1 3.36E-04 9.73E-04 2.62E-03 3 Beaver Valley 2 8.90E-04 2.51E-03 5.82E-03 3 Farley 1 2.68E-04 4.24E-04 6.77E-04 3 Farley 2 2.68E-04 4.24E-04 6.77E-04
'3 H.B. kobinson 4.64E-04 8.90E-04 1.53E-03 3 Maine Yankee 2.55E-04 7.10E-04 1.52E-03 3 North Anna 1 1.00E-10 5.02E-03 2.23E-02 3 North Anna 2 1.00E-10 5.02E-03 2.23E-02 3- Shearon Harris 1 1.78E-04 5.53 E-04 1.26E-03 D 19 NUREG/CR-xxxx, Vol. x
Appendix D Table D 4. (continued). IIPI Sth Percentile of 95th Percentile of Design IIPIIPE IIPI IPE Unreliability llPI IPE Class Plant Unreliability Mean Unreliability 3 Summer 1 1.16E-04 1.1lE-03 4.14E-03 6.78E-03 3 Surry 1 6.78E,03 5 3 Surry 2 1.llE-03 4.14 E-03 5 4 Turkey Point 3 1.88E-04 9.94 E-04 1.66E-03 4 Turkey Point 4 1.88E-04 9.94 E-04 1.66E-03 5 Indian Point 2 1.13E-03 2.27E-03 3.97E-03 5 Indian Point 3 8.84E-05 3.55E-04 9.38E-04 5 South Texas 1 8.76E 4)6 3.42E-05 7.87E-03 5 Sout5 , f uas 2 8.76E-06 3.42E-05 7.87E-05 6 Braidwood 1 3.52E-08 6 Braidwood 2 3.52E-08 6 Byron 1 5.50E-09 6 Byron 2 5.50E-09 6 Callaway 1.23E-07 9.10E-07 2.92E-06 6 Catawba 1 2.42E-07 6 Catawba 2 2.42E-07 6 Comanche Peak 1 4.94 E-07 Comanche Peak 2 4.94 E-07 6 E 5 6 Cook 1 3.09E-08 1.25E-07 3.23E-07 6 Cook 2 3.09E-08 1.25E-07 3.23E-07 6 Diablo Canyon 1 9.01 E-08 3.16E-07 /.69E-07 6 Diablo Canyon 2 9.01E-08 3.16E-07 7.69E-07 Iladdam Neck 2.33E-05 6 E 6 McGuire 1 3.21E-07 E , 6 McGuire 2 3.21E-07 6 Millstone 3 7.25E-07 1.46E-05 5.34E-05 6 Salem 1 2.64 E-09 1.86E-07 4.64 E-07 l 6 Salem 2 2.64 E-09 1.86E-07 4.64 E-07 6 Seabrook 2.34E-08 7.09E-07 2.12E-06 6 Sequoyah1 1.71 E-07 6.66E-07 1.86E-06 6 Sequoyah 2 1.71 E-07 6.66E-07 1.86E-06 g 6.40E-09 7.91 E-08 2.78 E-07 5 6 Vogtle 1 6 Vogtle 2 6.40 E-09 7.91 E-08 2.78E-07 i 6 WolfCreek 1.13E-08 5.25E-08 1.38E-07 6 Zion 1 8.64E-09 6 Zion 2 8.64 E-09 i I NUREG/CR-xxxx, Vol. x D-20
Appendix D p Table D-5. A listing of the cut sets (by reference plant in the six IIPI design classes) contributing 0.1% 9 or greater to IIPI operational unreliabiUty based on the 1987-1997 experience and a half-hour mission time. p HPIDesign Class 1 System: Waterford Mincut UpperBound: 3.30SE-04 Cut No. CutSet % Probability Basic Event Probability 1 32.7 1.10E-04 WGS3-ALPilA SI-FTS 3.60E-02 WGS3-SI-PUMP FTS 3.00E-03 2 28.4 9.40E-05 WGS3-ALPilA-SI-FTR 7.50E-02 WGS3-SI-PUMP-FTR 1.20E-03 a 16 5.30E-05 WGS3 RWST-SUCT 5.30E-05 4 11.6 3.80E-05 WGS3-ALPIIA-SI-INJ 1.20E-02 WGS3-SI-IIDR-INJ 3.20E-03 I 5 2.7 9.00E-06 WGS3-SI-FTS-PUMPA 3.00E-03 WGS3-SI-FTS-PUMPB 3.00E-03 6 1.7 5.70E-06 WGS3-SI-FTS-PUMPA 3.00E-03 I WGS3-SI-MOOS-PUMPB 1.90E-03 7 1.7 5.70E-06 WGS3-SI-FTS-PUMPB 3.00E-03 I 8 1.1 3.80E-06 WGS3 SI-MOOS-PUMPA WGS3-SI-FTR-PUMPA 1.90E-03 1.20E-03 WGS3-SI-FTS-PUMPB 3.00E-03 9 1.1 3.80E-06 WGS3-SI-FTR-PUMPB 1.20E-03 WGS3-SI-FTS-PUMPA 3.00E-03 10 1 3.20E-06 WGS3-FTO-ACT-CHANLA 1.80E-03 I 11 0.7 2.40E-06 WGS3-FTO-ACT-CIIANLB WGS3-SI-FTR-PUMPA 1.80E-03 1.20E-03 WGS3-SI-MOOS-PUMPB 1.90E-03 I 12 0.7 2.40E-06 WGS3-SI-FTR-PUMPB 1.20E-03 WGS3-SI-MOOS-PUMPA 1.90E-03 13 0.5 1.60E-06 WGS3-SI-FTR-PUMPA 1.20E-03 1 WGS3-SI-FTR-PUMPB 1.20E-03 14 0.0 1.00E-09 WGS3-CKV-LOOPA-INJA 1.00E-03 WGS3-CKV-LOOPA-INJB 1.00E-03 WGS3-CKV-LOOPB-INJA 1.00E-03 15 0.0 1.00E-09 WGS3 CKV-LOOPA-INJA 1.00E-03 WGS3-CKV-LOOPA-INJB 1.00E-03 WGS3-CKV-LOOPB-INJB 1.00E-03 16 0.0 1.00E-09 WGS3-CKV-LOOPA-INJA 1.00E-03 1 WGS3-CKV-LOOPB INJA 1.00E-03 WGS3-CKV-LOOPB-INJB 1.00E-03 17 0.0 1.00E-09 WGS3-CKV-LOOPA-INJB 1.00E-03 l WGS3-CKV-LOOPB-INJA 1.00E-03 WGS3-CKV-LOOPB-INJB ._, 1.00E-03 3 _2 , _ _ .m
Appendix D Table D-5. (continued). HP1 Design Class 2 System: Oconee Mincut UpperBound: 2.72E-04 Cut No. CutSet % Probability Bas.: Event Probability 1 65.7 1.80E-04 NEEl-ALPHA-CC-INJ 5.60E-02 NEEl-CC-HDR-INJ 3.20E-03 2 19.4 5.30E-05 NEEl-RWST-SUCT 5.30E-05 3 3.8 1.00E-05 NEEl-MOV-HDRA-INJ 3.20E-03 NEEl-MOV-HDRB-INJ 3.20E-03 4 3.5 9.60E-06 NEEl-CC-FTS-PUMPC 3.00E-03 NEEl-MOV-HDRA-INJ 3.20E-03 5 2.3 6.40E-06 NEEl-ALPHA-CC-FTR 5.10E-03 NEEl-CC-PUMP-FTR 1.20E-03 6 2.2 6.10E-06 NEEl-CC-MOOS-PUMPC 1.90E-03 NEEl-MOV-HDRA-INJ 3.20E-03 7 1.5 4.00E-06 NEEl-CC-FTR-PUMPC 1.20E-03 NEEl-MOV-HDRA-INJ 3.20E-03 8 1.2 3.20E-06 NEEl-FTO-ACT-CHANLA 1.80E-03 NEEl-FTO-ACT-CHANLB 1.80E-03 9 0.2 6.10E-07 NEEl-SLPHA-CC-FTS 6.30E-02 NEEl-CC-PUMP-FTS 3.00E-03 NEEl-MOV-HDRA-INJ 3.20E-03 10 0.1 2.40E-07 NEEl-ALPHA-CC-FTS 6.30E-02 E NEEl-CC-FTR PUMPA 1.20E-03 5 NEEl-CC-PUMP-FTS 3.00E-03 11 0.0 1.20E-08 NEEl-CC-FTR-PUMPA 1.20E-03 NEEl-CC-FTS-PUMPB 3.00E-03 NEEl-MOV-HDRB-INJ 3.20E-03 12 0.0 1.10E-08 NEEl-CC-FTR PUMPA 1.20E-03 NEEl-CC-FTS-FUMPB 3.00E-03 NEEl-CC-FTS-PUMPC 3.00F-03 13 0.0 7.60E-09 NEE 1-CC-FTR-PUMPA 1.20E-03 NEEl-CC-MOOS-PUMPB 1.90E-0.1 NEEl-MOV-HDRB-INJ 3.20E-03 14 0.0 7.10E-09 NEEl-CC-FTR-PUMPA 1.20E-03 NEEl-CC-FTS-PUMPB 3.00E-03 NEEl-CC-MOOS-PUMPC 1.90E-03 15 0.0 7.10E-09 NEEl-CC-FTR-PUMPA 1.20E-03 NEEl-CC-FTS-PUMPC 3.00E-03 NEEl-CC-MOOS-PUMPB 1.90E-03 I NUREG/CR-xxxx, Vol. x D-22
1 Appendix D 1 Table D 5. (continued). Cut No. CutSet % Probability Basic Event Probability 16 0.0 5.00E-09 NEEl-CC-FTR-PUMPA 1.20E-03 NEEl-CC-FTR-PUMPB 1.20E-03 NEEl-MOV-HDRB-INJ 3.20E-03 17 0.0 4.70E-09 NEEICC-FTR-PUMPA 1.20E-03 NEEl-CC-FTR-PUMPB 1.20E-03 NEEl-CC-FTS-PUMPC 3.00E-03 i 18 0.0 4.70E-09 NEEl-CC-FTR PUMPA 1.20E-03 NEEl-CC-FTR-PUMPC 1.20E-03 NEEl-CC-FTS-PUMPB 3.00E-03 19 0.0 3.20E-09 NEEl-CKV-LOOPA-INJA 1.00E-03 NEEl-CKV-LOOPA-INJB 1.00E-03 NEEl-MOV-HDRB-INJ 3.20E-03 20 0.0 3.20E-09 NEEl-CKV LOOPB-INJA 1.00E-03 NEEl-CKV-LOOPB-INJB 1.00E-03 i NEEl-MOV-HDRA-INJ 3.20E-03 21 0.0 3.00E-09 NEEl-CC-FTS-PUMPC 3.00E-03 NEEl-CKV-LOOPA-INJA 1.00E-03 NEEl-CKV-LOOPA-INJB 1.00E-03 22 0.0 3.00E-09 NEEl-CC-FTR-PUMPA 1.20E-03 1 NEEl-CC-FTR-PUMPB 1.20E-03 NEEl-CC-MOOS-PUMPC 1.90E-03 23 0.0 3.00E-09 NEEl-CC-FTR-PUMPA 1.20E-03 NEEl-CC-FTR-PUMPC .l .20E-03 NEEl-CC-MOOS-PUMPB 1.90E-03 i 24 0.0 2.00E-09 NEEl-CC-FTR-PUMPA 1.20E-03 NEEl-CC-FTR-PUMPB 1.20E-03 NEEl-CC-FTR-PUMPC 1.20E-03 I 25 0.0 1.90E-09 NEEl-CC-MOOS-PUMPC 1.90E-03 NEEl-CKV-LOOPA-INJA 1.00E-03 NEEl-CKV LOOPA-INJB 1.00E-03 26 0.0 1.30E-09 NEEl-CC-FTR-PUMPC 1.20E-03 NEEl-CKV-LOOPA-INJA 1.00E-03 I NEEl-CKV-LOOPA-INJB 1.00E-03 I l l l D-23 NUREG/CR-xxxx, Vol. x
~ _
Appendix D Table D 5. (continued). HPIDesign Clan s System: Shearon Harris Mincut UpperBound: 4.627E-04 Cut No. CutSet % Probability Basic Ev:nt Probability 1 38.7 1.80E-04 SHSI-ALPHA-CC-iNJI 5.60E-02 SHSI-CC-HDR-INJI 3.20E-03 2 38.7 1.80E-04 SHSI-ALPHA-CC-INJO 5.60E-02 SHSI-CC-HDR-INJO 3.20E-03 3 11.5 5.30E-05 SHS1-RWST-SUCT 5.30E-05 4 4.3 2.00E-05 SHSI-ALPHA-CC-FTR 1.60E-02 SilSI-CC-PUMP-FTR 1.20E-03 E 5 2.2 1.00E-05 SHSI-MOV-CC HDR-INJAI 3.20E-03 3 SHSI-MOV-CC-HDR-INJBI 3.20E-03 6 2.2 1.00E-05 SHSI-MOV-CC-HDR-INJAO 3.20E-03 g SHSI-MOV-CC-HDR-INJBO 3.20E-03 5 7 0.8 3.80E-06 SilSI-CC-FTR-PUMPA 1.20E-03 SHS1-CC-FTS-PUMPB 3.00E-03 8 0.7 3.20E-06 SHSI-FTO-ACT-CHANLA 1.80E-03 SilSI-FTO-ACT-CHANLB 1.80E-03 9 0.5 2.40E-06 SHSI-CC-FTR-PUMPA 1.20E-03 SHSI-CC-MOOS-PUMPB 1.90E-03 10 0.3 1.60E-06 SHSI-CC-FTR-PUMPA 1.20E-03 SHSI-CC-FTR-PUMPB 1.20E-03 11 0.0 1.00E-09 SHS1-CKV-LOOPA-INJ 1.00E-03 SHS1-CKV-LOOPB-INJ 1.00E-03 ) SHSI-CKV-LOOPC-INJ 1.00E-03 12 0.0 1.00E-09 SHSI-CKV-LOOPA-INJ 1.00E-003 SIISI-CKV-LOOPB-INJ 1.00E-03 E SHSI-CKV-LPC-HDRB-INJ 1.00E-03 g 13 0.0 1.00E-09 SHSI-CKV-LOOPA-INJ 1.00E-03 SHSI-CKV-LOOPC-INJ 1.00E-03 g SHSI-CKV-LPB-HDRB-INJ 1.00E-03 3 14 0.0 1.00E-09 SHSI-CKV-LOOPA-INJ 1.00E-03 SHSI-CKV-LPB-HDRB-INJ 1.00E-03 E SHSI-CKV-LPC-HDRB-INJ 1.00E-03 5 15 0.0 1.00E-09 SHSI-CKV-LOOPB-INJ 1.00E-03 SHS1-CKV-LOOPC-INJ 1.00E-03 SHSI-CKV-LPA-HDRB-INJ 1.00E-03 16 0.0 1.00E-09 SHSI-CKV-LOOPB-INJ 1.00E-03 SHSI-CKV-LPA-HDRB-INJ 1.00E-03 SilSI-CKV-LPC-HDRB-INJ 1.00E-03 17 0.0 1.00E-09 SHSI-CKV-LOOPC-INJ 1.00E-03 SHSI-CKV-LPA-HDRB-INJ 1.00E-03 SHSI-CKV-LPB-HDRB-INJ 1.00E-03 l IIi uunnoica-xxxx, voi. x D-24 l
Appendix D Table D 5. (continued). HPIDesign Class 4 System: TurkeyPoint Mincut UpperBound: 2.717E-04 Cut No. CutSet % Probability Basic Event Probability 1 66 1.80E-04 TPS3 ALPHA-SI-INJ 5.60E-02 TPS3 SI HDR.INJ 3.20E-03 2 15.5 4.20E-05 TPS3-ALPilA-SI-FTS 1.40E-02 TPS3 SI-PUMP-FTS 3.00E-03 3 12.9 3.50E-05 TPS3-ALPHA-SI-FTR 2.80E-02 TPS3-SI-PUMP-FTR 1.20E-03 4 3.8 1.00E-05 TPS3-MOV-CC-HDR-INJA 3.20E-03 I 5 1.2 3.20E-06 TPS3-MOV-CC-HDR-INJB TPS3 FTO-ACT-CHANLA 3.20E-03 1.80E-03 TPS3 FTO-ACT-CHANLB 1.80E-03 6 0.1 1.60E-07 TPS3-RWST-SUCT3 5.30E-05 TPS3-SI-FTS-PUMP 4A 3.00E-03 I 7 0.1 1.60E-07 TPS3 RWST-SUCT3 TPS3-SI-FTS-PUMP 48 5.30E-05 3.00E-03 8 0.1 1.60E-07 TPS3-RWST-SUCT4 5.30E-05 TPS3 SI-FTS-PUMP 3A 3.00E-03 9 0.1 1.60E-07 TPS3-RWST-SUCT4 5.30E-05 TPS3 SI-FTS-PUMP 3B 3.00E-03 10 0.0 1.00E-07 TPS3-RWST-SUCT3 5.30E-05 TPS3 SI-MOOS-PUMP 4A 1.90E-03 I 11 0.0 1.00E-07 TPS3-RWST-SUCT3 5.30E-05 TPS3-SI-MOOS-PUMP 4B 1.90E-03 12 0.0 1.00E-07 TPS3 RWST-SUCT4 5.30E-05 TPS3-SI-MOOS-PUMP 3A 1.90E-03 13 0.0 1.00E-07 TPS3-RWST-SUCT4 5.30E-05 TPS3-SI-MOOS-PUMP 3B 1.90E-03 [ E D-25 NUREG/CR-xxxx, Vol. x
l Appendix D l Table D-5. (continued). HP1 Design Class 5 System: South Texas Project Mincut UpperBound: 2.633E-04 Cut No. CutSet % Probability Basic Event Probability 1 40.1 1.10E-04 STN1-ALPHA-SI-INJ 3.30E-02 STN1-SI-HDR-INJ 3.20E-03 2 20.5 5.40E-05 STN1-ALPHA-SI-FTS 1.80E-02 STN1-SI-PUMP-FTS 3.00E-03 3 20.1 5.30E-05 STN1-RWST-SUCT 5.30E-05 4 19 5.00E-05 STN1-ALPHA-SI FTR 4.00E-02 STN1-SI-PUMP-FTR 1.20E-03 5 0.0 3.30E-08 STN1-MOV-LOOPA-INJ 3.20E-03 STN1-MOV-LOOPB-INJ 3.20E-03 STN1-MOV-LOOPC-INJ 3.20E-03 g 6 0.0 3.10E-08 STN1-MOV-LOOPA INJ 3.20E-03 3 STN1-MOV-LOOPB-INJ 3.20E-03 STN1-SI-FTS-PUMPC 3.00E-03 g 7 0.0 3.10E-08 STN1-MOV-LOOPA-INJ 3.20E-03 E STN1-MOV-LOOPC-INJ 3.20E-03 STN1-SI-FTS-PUMPB 3.00E-03 g 8 0.0 3.10E-08 STN1-MOV-LOOPB-INJ 3.20E-03 5 STN1-MOV-LOOPC-INJ 3.20E-03 STN1-SI-FTS-PUMPA 3.00E-03 9 0.0 2.90E-08 STN1-MOV-LOOPA INJ 3.20E-03 STN1-SI-FTS-PUMPB 3.00E-03 STN1-SI-FTS-PUMPC 3.00E-03 10 0.0 2.90E-08 STN1-MOV-LOOPB-INJ 3.20E-03 STN1-SI-FTS-PUMPA 3.00E-03 STN1-SI-FTS-PUMPC 3.00E-03 ' 11 0.0 2.90E-08 STN1-MOV-LOOPC-INJ 3.20E-03 STN1-SI-FTS-PUMPA 3.00E-03 STN1-SI-FTS-PUMPB 3.00E-03 J 12 0.0 2.70E-08 STN1-SI-FTS-PUMPA 3.00E-03 t STN1-S!-FTS-PUMPB 3.00E-03 STN1-SI-FTS-PUMPC 3.00E-03 J 13 0.0 2.00E-08 STN1-MOV-LOOPA-INJ 3.20E-03 STN1-MOV-LOOPB INJ 3.20E-03 STN1-SI-MOOS-PUMPC 1.90E-03 14 0.0 2.00E-08 STN1-MOV-LOOPA-INJ 3.20E-03 STN1-MOV-LOOPC-INJ 3.20E-03 g STN1-SI-MOOS-PUMPB 1.90E-03 g 15 0.0 2.00E-08 STN1-MOV-LOOPB-INJ 3.20E-03 SSTN1-MOV-LOOPC-INJ 3.20E-03 STN1-SI-MOOS-PUMPA 1.90E-03 ) STN1-MDP-FS-PUMPB 3.30E-03 l NUREG/CR-xxxx, Vol. x D-26
Appendix D Table D 5. (continued). HP1 design class 6 System: Braidwood Mincut UpperBound: 3699E-05 Cut No. CutSet % Probability Basic Event Probability 1 93 5.30E-05 BRSI-RWST-SUCT 5.30E-05 2 5.7 3.20E-06 BRSI-FTO-ACT-CHANLA 1.80E-03 BRSI-FTO-ACT-CHANLB i 3 1 5.70E-07 BRSI-ALPHA-CC-INJ 1.80E-03 5.60E-02 BRSI-CC-HDR-INJ 3.20E-03 BRSI-MOV-SI-HDR-INJ 3.20E-03 4 0.1 6.40E-08 BRSI-ALPIIA-CC-FTR 1.60E-02 BRSI-CC-PUMMP-FTR 1.20E-03 I BRSI-MOV-SI-IIDR-INJ 3.20E-03 5 0.1 3.30E-08 BRSI-MOV-CC-HDR-INJA 3.20E-03 BRSI-MOV-CC-HDR-INJB 3.20E-03 BRSI-MOV-SI-HDR-INJ 3.20E-03 6 0.0 1.90E-08 BRSI-ALPHA-CC-INJ 5.60E-02 BRSI-ALPHA-SI-FTS 3.60E-02 BRSI-CC-HDR-INJ 3.20E-03 BRSl-SI-PUMP-FTS 3.00E-03 7 0.0 1.70E-08 BRSI-ALPHA-CC-INJ 5.60E-02 BRSI-ALPHA-SI-FTR 7.50E-02 BRSI-CC-HDR-INJ 3.20E-03 i 8 0.0 1.20E-08 BRSI-SI-PUMP-FTR BRSI-CC-FTR-PUMPA 1.20E-03 1.20E-03 BRSI-CC-FTS-PUMPB 3.00E-03 BRSI-MOV-SI-HDR-INJ 3.20E-03 9 0.0 7.60E-09 BRSI-CC-FTR-PUMPA 1.20E-03 i BRSI-CC-MOOS-PUMPB BRSI-MOV-SI-HDR-INJ 1.90E-03 3.20E-03 10 0.0 5.00E-09 BRSI-CC-FTR-PUMPA 1.20E-03 BRSI-CC-FTR-PUMPB 1.20E-03 BRSI-MOV-SI-HDA-INJ 3.20E-03 11 0.0 2.20E-09 BRS1-ALPHA-CC-FTR 1.60E-02 BRSI-ALPHA-SI-FTS 3.60E-02 BRSI-CC-PUMP-FTR 1.20E-03 i BRS1-SI-PUMP-ITS 3.00E-03 1 _ D-27 NUREG/CR-xxxx, Vol. x
Appendix D l Table D 5. (continued). Cut No. Cutset % Probability Basic Event Probability 12 0.0 1.90E-09 BRSl-ALPHA-CC-FTR 1.60E-02 BRSI-ALPHA-SI-FTR 7.50E-02 BRSI-CC-PUMP-FTR 1.20E-03 BRSI-SI-PUMP-FTR 1.20E-03 13 0.0 1.60E-09 BRSI-ALPHA-CC-INJ 5.60E-02 BRSI-CC-HDR-INJ 3.20E-03 BRSI-SI-FTS-PUMPA 3.00E-03 BRSI-SI-FTS-PUMPB 3.00E-03 g, 14 0.0 1.10E-09 BRSI-ALPHA-SI-FTS 3.60E-02 5 BRSI-MOV-CC-HDR-INJA 3.20E-03 BRSI-MOV-CC-HDR-INJB 3.20E-03 BRSI-SI-PUMP-FTS 3.00E-03 15 0.0 1.00E-09 BRSI-ALPHA-CC-INJ 5.60E-02 i BRSI CC-HDR-INJ 3.20E-03 BRSI-SI-FTS-PUMPA 3.00E-03 BRSI-SI-MOOS-PUMPB 1.90E-03 16 0.0 1.00E-09 BRSI-ALPHA-CC-INJ 5.60E-02 BRS1-CC-HDR-INJ 3.20E-03 BRS)-SI-FTS-PUMPB 3.00E-03 BRSI-SI-MOOS-PUMPA 1.90E-03 I I I I I NUREG/CR-xxxx, Vol. x D-28
Appendix D Table D-6. A listing of the cut sets (by reference plant in the six IIPI design classes contributing 0.1% or greater to IIPI unreliability) based on the IPE failure probabilities and a half-hour mmission time. HP1 Design Class 1 System: Waterford Mincut UpperBound: 9.143E-04 Cut No. CutSet % Probability Basic Event Probability I 1 89.3 8.20E-04 WGS3-MDP-CCF-FS 8.20E-04 2 2.6 2.40E-05 WGS3-MDP-FS PUMPA 4.80E-03 WGS3-MDP-MOOS-PUMPB 5.00E-03 3 2.6 2.40E-05 WGS3-MDP-FS-PUMPB 4.80E-03 WGS3-MDP-MOOS-PUMPA 5.00E-03 I 4 2.5 2.30E-05 WGS3-MDP-FS-PUMPA 4.80E-03 WGS3-MDP-FS-PUMPB 4.80E-03 5 0.8 7.20E-06 WGS3-MDP-CCF-FR 7.20E-06 1 6 0.2 2.00E-06 WGS3-MDP-MOOS-PUMPA 5.00E-03 WGS3-MOV-CCF-DISB 4.10E-04 7 0.2 2.00E-06 WGS3-MDP-MOOS-PUMPB 5.00E-03 WGS3-MOV-CCF-DISA 4.10E-04 8 0.2 2.00E-06 WGS3-MDP-FS-PUMPA 4.80E-03 WGS3-MOV-CCF-DISB 4.10E-04 9 0.2 2.00E-06 WGS3-MDP-FS-PUMPB 4.80E-03 WGS3-MOV-CCF-DISA 4.10E-04 i 10 0.1 7.50E-07 WGS3-CKV-DISA 1.50E-04 WGS3-MDP-MOOS-PUMPB 5.00E-03 11 0.1 7.50E-07 WGS3-CKV-PUMPA 1.50E-04 WGS3-MDP-MOOS PUMPB 5.00E-03 12 0.1 7.50E-07 WGS3-CKV-PUMPB-DIS 1.50E-04 WGS3-MDP-MOOS-PUMPA 5.00E-03
'13 0.1 7.50E-07 WGS3-CKV-PUMPB-SUCT 1.50E-04 WGS3-MDP-MOOS-PUMPA 5.00E-03 I 14 0.1 7.50E-07 WGS3-CKV-SUCI A 1.50E-04 WGS3-MDP-MOOS-PUMPB 5.00E-03 15 0.1 7.50E-07 WGS3-CKV-SUC2A 1.50E-04 1 WGS3-MDP-MOOS-PUMPB 5.00E-03 16 0.1 7.50E-07 WGS3-CKV-SUCB 1.50E-04 WGS3-MDP-MOOS-PUMPA 5.00E-03 17 0.1 7.20E-07 WGS3-CKV-DISA 1.50E-04 WGS3-MDP-FS-PUMPB 4.80E-03 I 18 0.1 7.20E-07 WGS3-CKV-PUMPA 1.50E-04 WGS3-MDP-FS-PUMPB 4.80E-03 19 0.1 7.20E-07 WGS3-CKV-PUMPB-DIS 1.50E-04 1 WGS3-MDP-FS-PUMPA 4.80E-03 1
D-29 hUREG/CR-xxxx, Vol. x
Appendix D l Table D-6. (continued). Cut No. CutSet % Pobability Basic Event Probability 20 0.1 7.20E-07 WGS3-CKV-PUMPB-SUCT 1.50E-04 WGS3-MDP-FS-PUMPA 4.80E-03 21 0.1 7.20E-07 WGS3-CKV-SUCI A 1.50E-04 WGS3-MDP-FS-PUMPB 4.80E-03 22 0.1 7.20E-07 WGS3-CKV-SUC2A 1.50E-04 WGS3-MDP-FS-PUMPB 4.80E-03 23 0.1 7.20E-07 WGS3-CKV SUCB 1.50E-04 WGS3-MDP-FS-PUMPA 4.80E-03 I I I I I'
)
NUREG/CR-xxxx, Vol. x D-30 l I
Appendix D
- h. I Tabe D 4. (continued).
HPldesign class 2 ( System: Oconee Mincut UpperBound: 3.182E-04 Cut No. Probability ( ~ CutSet % Basic Event Probability 1 84.9 2.70E-04 NEEl-MOV-CCF-SUCT 2.70E-04 2 8.2 2.60E-05 NEEl-MDP-MOOS-PUMPC 6.50E-03 NEEl-MOV-CC-DISA 4.00E-03 3 5 1.60E-05 NEEl-MOV-CC-SUCA 4.00E-03 [- NEEl-MOV-CC-SUCB 4.00E-03 4 0.4 1.30E-06 NEEl-CKV-HDRA-INJ 2.00E-04
. NEEl-MDP-MOOS-PUMPC 6.50E-03
{ 5 0.3 - 8.40E-07 NEEl-MDP-FS-PUMPC 2.10E-04 NEEl-MOV CC-DISA 4.00E-03 [ 6 0.3 8.00E-07 NEEl-CKV-DISA 2.00E-04 NEEl-MOV-CC-SUCB 4.00E 7 0.3 8.00E-07 NEEl-CKV-HDRB INJ 2.00E-04 NEEl MOV-CC-DISA 4.00E-03 8 0.3 8.00E-07 NEEl-CKV-PUMPC 2.00E-04 NEEl-MOV-CC-DISA 4.00E-03 9 0.3 8.00E-07 NEEl-CKV-SUCB 2.00E-04 NEEl-MOV-CC-SUCA 4.00E-03
^10 0.2 5.20E-07 NEEl-MDP-FR-PUMPC 1.30E-04 NEEl-MOV-CC-DISA 4.00E-03
{ 11 0.0 1.20E-07 NEEl-MDP-CCF-FS 2.90E-05 NEEl-MOV-CC-DISA 4.00E-03 ( [ [ I L , D-31 NUREG/CR-xxxx, Vol. x
. . . . . -r . . .
Appendix D l Table D-6. (cor.tinued). HP1 design class 3 System: Shearon Harris Mincut UpperBound: 5.506E-04 Cut No. CutSet % Probability Basic Event Probabihty 1 50.9 2.80E-04 SilSI-CKV-RWST-SUCT 2.80E-04 2 13.6 7.50E-05 SHSI-MOV-CCF-BITI 7.50E-05 3 13.6 7.50E-05 SIISI-MOV-CCF-BITO 7.50E-05 4 13.6 7.50E-05 SilSI-MOV-CCF-SUCT 7.50E-05 5 3.2 1.80E-05 SHSI-CKV-DIS-PUMPA 2.80E-04 SHSI-MDP-MOOS-PUMPB 6.30E-02 6 1.6 9.00E-06 SilS1-MOV-CC-SUCTA 3.00E-03 SHSI-MOV-CC-SUCTB 3.00E-03 g 7 1.6 9.00E-06 SHSI-MOV-DIS-BITIA 3.00E-03 3 SHSI-MOV-DIS-BITIB 3.00E-03 8 1.6 9.00E-06 SHSI-MOV-DIS-BITOA 3.00E-03 SHSI-MOV-DIS-BITOB 3.00E-03 9 0.1 3.90E-07 SHSI-CKV-DIS-PUMPA 2.80E-04 g SHSI-MDP-FS-PUMPB 1.40E-03 5 10 0.1 3.50E-07 SHSI-MDP-FR-PUMPA 5.50E-06 SHSI-MDP-MOOS-PUMPB 6.30E-02 11 0.1 2.60E-07 SHS1-MDP-CCF-FR 2.60E-07 12 0.0 7.80E-08 SHSI-CKV-DIS-PUMPA 2.80E-04 SHSI-CKV-DIS-PUMPB 2.80E-04 I I I! NUREG/CR-xxxx, Vol. x D-32
Appendix D Table D-6, (continued). HPIdesign class 4 System: Turkey Point Mincut UpperBound: 5.764E-04 Cut No. CutSet % Probability Basic Event Probability 1 70.8 4.10E-04 TPS3-MOV-CCF-DIS 4.10E-04 1 2 4.5 2.60E-05 TPS3-MOV-CC-INJ3A 5.10E-03 TPS3-MOV-CC-INJ3B 5.10E-03 3 1.7 9.80E-06 TPS3-MDP-CCF-FR3 7.90E-04 TPS3-MDP-MOOS-PUMP 4A 1.20E-02 4 1.7 9.80E-06 TPS3-MDP-CCF-FR3 7.90E-04 TPS3-MDP-MOOS-PUMP 4B 1.20E-02 g 5 1.7 9.80E-06 TPS3-MDP-CCF-FR4 7.90E-04 m . TPS3-MDP-MOOS-PUMP 3A 1.20E-02 6 1.7 9.80E-06 TPS3-MDP-CCF-FR4 7.90E-04 TPS3-MDP-MOOS-PUMP 3B 1.20E-02 7 1.3 7.40E-06 TPS3-MDP-CCF-FR3 7.90E-04 TPS3-MDP-FR-PUMP 4A 9.30E-03 8 1.3 7.40E-06 TPS3-MDP-CCF-FR3 7.90E-04 TPS3-MDP-FR-PUMP 4B 9.30E-03 9 1.3 7.40E-06 TPS3-MDP-CCF-FR4 7.30E-04 TPS3-MDP-FR-PUMP 3A 9.30E-03 10 1.3 7.40E-06 TPS3-MDP-CCF-FR4 7.90E-04 TPS3 MDP-FR-PUMP 3B 9.30E-03 11 0.8 4.90E-06 TPS3-MDP-CCF-FS3 3.90E-04 1 TPS3-MDP-MOOS-PUMP 4A 1.20E-02 12 0.8 4.90E-06 TPS3-MDP-CCF-FS3 3.90E-04 TPS3-MDP-MOOS-PUMP 4B 1.20E-02 13 0.8 4.90E-06 TPS3-MDP-CCF-FS4 3.90E-04 TPS3-MDP-MOOS-PUMP 3A 1.20E-02 I. 14 0.8 4.90E-06 TPS3-MDP-CCF-FS4 3.90E-04 TPS3-MDP-MOOS-PUMP 3B 1.20E-02 15 0.6 3.60E-06 TPS3-MDP-CCF-FS3 3.90E-04 TPS3-MDP-FR-PUMP 4A 9.30E-03 16 0.6 3.60E-06 TPS3-MDP-CCF FS3 3.90E-04 TPS3-MDP-FR-PUMP 4B 9.30E-03 [ 17 0.6 3.60E-06 TPS3-MDP-CCF-FS4 3.90E-04 TPS3-MDP-FR-PUMP 3A 9.30E-03 { L D-33 NUREG/CR-xxxx, Vol. x
r-Appendix D l Table D-6. (continued). J Cut No. CutSet % Probability Basic Event Probability 18 0.6 3.60E-06 TPS3-MDP-CCF-FS4 3.90E-04 TPS3-MDP-FR-PUMP 3B 9.30E-03 l 19 0.3 1.80E-06 TPS3-MDP-CCF-FR3 7.90E-04 TPS3-MDP-FS-PUMP 4A 2.30E-03 20 0.3 1.80E-06 TPS3-MDP-CCF-FR3 7.90E-04 l TPS3-MDP-FS-PUMP 4B 2.30E-03 21 0.3 1.80E-06 TPS3-MDP-CCF-FR4 7.90E-04 TPS3-MDP-FS-PUMP 3A 2.30E-03 l 22 0.3 1.80E-06 TPS3-MDP-CCF-FR4 7.90E-04 l TPS3 MDP-FS-PUMP 3B 2.30E-03 23 0.2 1.10E-06 TPS3-MDP-FR-PUMP 3A 9.30E-03 ; TPS3-MDP-FR-PUMP 3B 9.30E-03 ) TPS3-MDP-MOOS-PUMP 4A 1.20E-02 24 0.2 1.10E-06 TPS3-MDP-FR-PUMP 3A 9.30E-03 TPS3-MDP-FR-PUMP 3B 9.30E-03 TPS3-MDP-MOOS-PUMP 4B 1.20E-02 g 25 0.2 1.10E-06 TPS3 MDP-FR-PUMP 3A 9.30E-03 E TPS3-MDP-FR-PUMP 4A 9.30E-03 TPS3-MDP-MOOS-PUMP 3B 1.20E-02 26 0.2 1.10E-06 TPS3-MDP-FR-PUMP 3A 9.30E-03 TPS3-MDP-FR-PUMP 4A 9.30E-03 TPS3-MDP-MOOS-PUMP 4B 1.20E-02 l 27 0.2 1.10E-06 TPS3-MDP-FR-PUMP 3A 9.30E-03 ) TPS3-MDP-FR-PUMP 4B 9.30E-03 TPS3-MDP-MOOS-PUMP 3B 1.20E-02 28 0.2 1.10E-06 TPS3-MDP-FR-PUMP 3A TPS3-MDP-FR-PUMP 4B 9.30E-03 9.30E-03 EI E TPS3-MDP-MOOS-PUMP 4A 1.20E-02 i 29 0.2 1.10E-06 TPS3-MDP-FR-PUMP 3B 9.30E-03 TPS3-MDP-FR-PUMP 4A 9.30E-03 TPS3-MDP-MOOS-PUMP 3A 1.20E-02 30 0.2 1.10E-06 TPS3-MDP-FR-PUMP 3B 9.30E-03 TPS3-MDP-FR-PUMP 4A 9.30E-03 TPS3-MDP-MOOS-PUMP 4B 1.20E-02 31 0.2 1.10E-06 TPS3-MDP-FR-PUMP 3B 9.30E-03 TPS3-MDP-FR-PUMP 4B 9.30E-03 TPS3-MDP-MOOS-PUMP 3A 1.20E-02 I NUREG/CR-xxxx, Vol. x D-34
Appendix D Table D-6. (continued). Cut No. CutSet % Probability Basic Event Probability 32 0.2 1.10E-06 TPS3-MDP-FR-PUMP 3B 9.30E-03 TPS3-MDP-FR-PUMP 4B 9.30E-03 TPS3-MDP-MOOS-PUMP 4A 1.20E-02 33 0.2 1.10E-06 TPS3-MDP-FR-PUMP 4A 9.30E-03 TPS3-MDP-FR-PUMP 4B 9.30E-03 TPS3-MDP-MOOS-PUMP 3A 1.20E-02 34 0.2 1.10E-06 TPS3-MDP-FR-PUMP 4A 9.30E-03 TPS3-MDP-FR-PUMP 4B 9.30E-03 TPS3-MDP-MOOS-PUMP 3B 1.20E-02 35 0.2 9.00E-07 TPS3-MDP-CCF-FS3 3.90E-04 TPS3-MDP-FS-PUMP 4A 2.30E-03 36 0.2 9.00E-07 TPS3-MDP-CCF-FS3 3.90E-04 I 37 0.2 9.00E-07 TPS3-MDP-FS-PUMP 4B TPS3-MDP-CCF-FS4 2.30E-03 3.90E-04 TPS3-MDP-FS-PUMP 3A 2.30E-03 38 0.2 9.00E-07 TPS3-MDP-CCF-FS4 3.90E-04 TPS3-MDP-FS-PUMP 3B 2.30E-03 I 39 0.1 8.00E-07 TPS3-MDP-FR-PUMP 3A TPS3-MDP-FR-PUMP 3B 9.30E-03 9.30E-03 TPS3-MDP-FR-PUMP 4A 9.30E-03 40 0.1 8.00E-07 TPS3-MDP-FR-PUMP 3A 9.30E-03 TPS3-MDP-FR-PUMP 3B 9.30E-03 TPS3 MDP-FR-PUMP 4B 9.30E-03 41 0.1 8.00E-07 TPS3-MDP-FR-PUMP 3A 9.30E-03 I TPS3 MDP-FR-PUMP 4A TPS3-MDP-FR-PUMP 4B 9.30E-03 9.30E-03 42 0.1 8.00E-07 TPS3-MDP-FR-PUMP 3B 9.30E-03 TPS3-MDP-FR-PUMP 4A 9.30E-03 TPS3 MDP-FR-PUMP 4B 9.30E-03 I I I I _ D-35 NUREG/CR-xxxx, Vol. x
7 Appendix D l Table D-6. (continued). _ HP1 design class S System: South Texas Project Mincut UpperBound: 3.17]E-05 Cut No. CutSet % Probability Basic Event Probability i STN1-MDP-CCF FS
~
1 96.8 3.10E-05 3.10E-05 2 2.7 8.50E-07 STN1-MDP-CCF-FR 8.50E-07 3 0.1 3.60E-08 STN1-MDP-FS-PUMPA 3.30E-03 STN1-MDP-FS-PUMPB 3.30E-03 STN1-MDP-FS-PUMPC 3.30E-03
)
1 4 0.0 1.30E-08 STN1-MDP-FS-PUMPA 3.30E-03 f STN1-MDP-FS-PUMPB 3.30E-03 l STN1-MDP-MOOS-PUMPC 1.20E-03 5 0.0 1.30E-08 STN1-MDP-FS-PUMPA 3.30E-03 ) STN1-MDP-FS-PUMPC 3.30E-03 STN1-MDP-MOOS-PUMPB 1.20E-03 6 0.0 1.30E-08 STN1-MDP-FS-PUMPB 3.30E-03 STN1-MDP-FS-PUMPC 3.30E-03 7 0.0 2.90E-09 STN1-MDP-MOOS-PUMPA STN1-CKV-DIS-PUMPA 1.20E-03 2.70E-04 f STN1-MDP-FS-PUMPB 3.30E-03 STN1-MDP-FS-PUMPC 3.30E-03 8 0.0 2.90E-09 STN1-CKV-DIS-PUMPB 2.70E-04 STN1-MDP-FS-PUMPA 3.30E-03 STN1-MDP-FS-PUMPC 3.30E-03 9 0.0 2.90E-09 STN1-CKV-DIS PUMPC 2.70E-04 STN1-MDP-FS-PUMPA 3.30E-03 STNI-MDP-FS-PUMPB 3.30E-03 10 0.0 2.90E-09 STN1-CKV-LPA-INJ1 A 2.70E-04 STN1-MDP-FS-PUMPB 3.30E-03 STN1-MDP-FS-PUMPC 3.30E-03 11 0.0 2.90E-09 STN1-CKV-LPA-INJ2A 2.70E-04 STN1-MDP-FS-PUMPB 3.30E-03 STN1-MDP-FS-PUMPC 3.30E-03 12 0.0 2.90E-09 STN1-CKV-LPB-INJ1B 2.70E-04 STN1-MDP-FS-PUMPA 3.30E-03 STN1-MDP-FS-PUMPC 3.30E-03 13 0.0 2.90E-09 STN1-CKV-LPB-INJ2B 2.70E-04 STN1-MDP-FS-PUMPA 3.30E-03 h, STN1-MDP-FS-PUMPC 3.30E-03 NUREG/CR-xxxx, Vol. x D-36
Appendix D Table D-6. (continued). Cut No. CutSet % Probability Basic Event Probability 14 0.0 2.90E-09 STN1-CKV-LPC-INJ1C 2.70E-04 STN1-MDP-FS-PUMPA 3.30E-03 STN1-MDP-FS-PUMPB 3.30E-03 15 0.0 2.90E-09 STN1-CKV-LPC-INJ2C 2.70E-04 STN1-MDP-FS-PUMPA 3.30E-03 STN1-MDP-FS-PUMPB 3.30E-03 16 0.0 2.90E-09 STN1-CKV-SUC-PUMPA 2.70E-04 STN1-MDP-FS-PUMPB 3.30E-03 STN1-MDP-FS-PUMPC 3.30E-03 17 0.0 2.90E-09 STN1-CKV-SUC-PUMPB 2.70E-04 STN1-MDP-FS-PUMPA 3.30E-03 STN1-MDP-FS-PUMPC 3.30E-03 18 0.0 2.90E-09 STN1-CKV-SUC-PUMPC 2.70E-04 1 - STN1-MDP-FS-PUMPA 3.30E-03 STN1-MDP-FS-PUMPB 3.30E-03 I l i I I I [ [ _ D-37 NUREG/CR-xxxx, Vol. x
Appendix D ) Table D-6. (continued). HP1 design class 6 System: Braidwood 1 Mincut UpperBound: 3.515E-08 l Cut No. CutSet % Probability Basic Event Probability 1 28.5 1.00E-08 BRSI-CKV-CH-DIS 1.00E-04 BRS1-CKV-SI-SUCT 1.00E-04 2 28.5 1.00E-08 BRSI-CKV-CH-SUCT 1.00E-04 BRSI-CKV-SI-SUCT 1.00E-04 3 6 2.10E-09 BRSI-CKV-CH-DIS 1.00E-04 BRSI-MDP-CCF-SI-START 2.10E-05 4 6 2.10E-09 BRSI-CKV-CH-SUCT 1.00E-04 1 BRSI-MDP-CCF-SI-START 2.10E-05 5 4.3 1.50E-09 BRSI-CKV-SI-SUCT 1.00E-04 BRS1-MOV-CCF-CH-DIS 1.50E-05 6 4.3 1.50E-09 BRSI-CKV-SI-SUCT 1.00E-04 BRSI-MOV-CCF-CH-SUCT 1.50E-05 7 2.6 9.00E-10 BRS1-CKV-CH-DIS 1.00E-04 BRSI-MDP-FS-SI-PUMPA 3.00E-03 BRSl-MDP-FS-SI-PUMPB 3.00E-03 8 2.6 9.00E-10 BRSI-CKV-CH-SUCT 1.00E-04 BRSl-MDP-FS-SI-PUMPA 3.00E-03 BRSI-MDP-FS-SI-PUMPB 3.00E-03 9 1.6 5.70E-10 BRSI-CKV-CH-DIS 1.00E-04 ; BRSI-MDP-FS-SI PUMPA 3.00E-03 BRSI-MDP-MOOS-SI-PUMPB 1.90E-03 10 1.6 5.70E-10 BRSI-CKV-CH DIS 1.00E-04 BRSI-MDP-FS-SI-PUMPB 3.00E-03 4 BRSI-MDP-MOOS-SI-PUMPA 1.90E-03 1.6 5.70E-10 BRS1-CKV-CH-SUCT 1.00E-04 I 11 BRSI-MDP-FS-SI-PUMPA 3.00E-03 . BRSI-MDP-MOOS-SI-PUMPP, 1.90E-03 12 1.6 5.70E-10 BRSI-CKV-CH-SUCT 1.00E-04 BRSl-MDP-FS-SI-PUMPB 3.00E-03
)
BRSl-MDP-MOOS-SI-PUMPA 1.90E-03 13 1.1 3.90E-10 BRSI-CKV-CH-DIS 1.00E-04 ! BRSl-MDP-CCF-SI-RUN 3.9CE-06 14 1.1 3.90E-10 BRSl-CKV-CH-SUCT 1.00E-04 BRSI-MDP-CCF-SI-RUN 3.903-06 NUREG/CR-xxxx, Vol. x D-38
1 Appendix D l l Table D-6. (continued). Cut No. CutSet % Probability Basic Event Probability 15 0.9 3.20E-10 BRSl-MDP-CCF-SI-START 2.10E-05 BRSI-MOV-CCF-CH-DIS 1.50E-05 16 0.9 3.20E-10 BRSI-MDP-CCF-SI START 2.10E-05 BRSI-MOV-CCF-CH-SUCT 1.50E-05 17 0.5 1.70E-10 BRSI-CKV-CH-DIS 1.00E-04 BRSI-MDP-FR-SI-PUMPA 5.50E-04 i BRSI-MDP-FS-SI-PUMPB 3.00E-03 18 0.5 1.70E-10 BRSI-CKV-CH-DIS 1.00E-04 BRSI-MDP-FR-SI-PUMPB 5.50E-04 BRSI-MDP-FS-SI-PUMPA 3.00E-03 19 0.5 1.70E-10 BRSI-CKV-CH SUCT 1.00E-04 BRSI-MDP-FR-SI-PUMPA 5.50E-04 BRSI-MDP-FS-SI-PUMPB 3.00E-03 i 20 0.5 1.70E-10 BRSI-CKV-CII-SUCT 1.00E-04 BRSl-MDP-FR-SI-PUMPB 5.50E-04 BRSI-MDP-FS-SI-PUMPA 3.00E-03 21 0.4 1.40E-10 BRSI-MDP-FS-SI-PUMPA 3.00E-03 BRSI-MDP-FS-SI-PUMPB 3.00E-03 I BRSl-MOV-CCF-CH-DIS 1.50E-05 22 0.4 1.40E-10 BRSl-MDP-FS-SI-PUMPA 3.00E-03 BRSI-MDP-FS SI-PUMPB 3.00E-03 BRS1-MOV-CCF-CH-SUCT 1.50E-05 23 0.3 1.00E-10 BRSI-CKV-CH-DIS 1.00E-04 1 BRSI-MDP-FR-SI-PUMPA 5.50E-04 BRSI-MDP-MOOS-SI-PUMPB 1.90E-03 24 0.3 1.00E-10 BRSI-CKV-CH-DlS 1.00E-04 BRSI-MDP-FR-SI-PUMPB 5.50E-04 BRSI-MDP-MOOS-SI-PUMPA 1.90E-03 i 25 0.3 1.00E-10 BRSl-CKV-CH-SUCT 1.00E-04 BRSI-MDP FR-SI-PUMPA 5.50E-04 BRSI-MDP-MOOS-SI-PUMPB 1.90E-03 26 0.3 1.00E-10 BRSI-CKV-CH-SUCT 1.00E-04 BRSI-MDP-FR-SI-PUMPB 5.50E-04 BRSI-MDP-MOOS-SI-PUMPA 1.90E-03 [ 27 0.2 8.60E-11 BRS1-MDP-FS-SI-PUMPA 3.00E-03 BRSI-MDP-MOOS-SI-PUMPB 1.90E-03 ( BRSI-MOV-CCF-CH-DIS 1.50E-05 D 39 NUREG/CR-xxxx, Vol. x
Appendix D Table D-6. (continued). Cut No. CutSet % Probability Basic Event Probability 28 0.2 8.60E-11 BRS1-MDP-FS-SI-PUMPA 3.00E-03 BRSI-MDP-MOOS-SI-PUMPB 1.90E-03 BRSI MOV-CCF-Cll-SUCT 1.50E-05 29 0.2 8.60E-11 BRS1-MDP-FS-SI-PUMPB 3.00E-03 ! BRSI-MDP-MOOS-SI-PUMPA 1.90E-03 BRSI-MOV-CCF-Cll-DIS 1.50E-05 30 0.2 8.60E-I l BRSI-MDP-FS-SI-PUMPB 3.00E-03 BRS1-MDP-MOOS-SI-PUMPA 1.90E-03 BRSI-MOV-CCF-Cll-SUCT 1.50E-05 31 0.2 5.80E-11 BRS1-MDP-CCF-SI-RUN 3.90E-06 BRSI-MOV-CCF-CH-DIS 1.50E-05 32 0.2 5.80E-11 BRSI-MDP-CCF-SI-RUN 3.90E-06 BRSI-MOV-CCF-CH-SUCT 1.50E-05 33 0.1 3.00E-11 BRS1-CKV-CH-DIS 1.00E-04 BRSI-MDP-FR-SI-PUMPA 5.50E-04 BRSI-MDP-FR-SI-PUMPB 5.50E-04 34 0.1 3.00E-I l BRSI-CKV-CH-SUCT 1.00E-04 BRSl-MDP-FR-SI-PUMPA 5.50E-04 BRSI-MDP FR-SI-PUMPB 5.50E-04 35 0.1 3.00E-I l BRSI-CKV-CH-DIS 1.00E-04 BRSI-CKV-SI-PUMPA 1.00E-04 BRSI-MDP-FS-SI-PUMPB 3.00E-03 36 0.1 3.00E-I l BRSI-CKV-CH-DIS 1.00E-04 BRSI-CKV-SI-PUMPB 1.00E-04 BRSI-MDP-FS-SI-PUMPA 3.00E-03 37 0.1 3.00E-11 BRS1-CKV-Cll-SUCT 1.00E-04 BRSI-CKV-SI PUMPA 1.00E-04 BRSI-MDP-FS-SI-PUMPB 3.00E-03 38 0.1 3.00E-11 BRS1-CKV-CH-SUCT 1.00E-04 BRS1-CKV-SI-PUMPB 1.00E-04 BRSI-MDP-FS-SI-PUMPA 3.00E-03 39 0.1 2.50E-I l BRSl-MDP-FR-SI-PUMPA 5.50E-04 BRS1-MDP-FS-SI-PUMPB 3.00E-03 BRSI-MOV-CCF-Cll-DIS 1.50E-05 40 0.1 2.50E-I l BRSI-MDP-FR-SI-PUMPA 5.50E-04 BRSI-MDP-FS-SI-PUMPB 3.00E-03 BRSI-MOV-CCF-CH-5UCT 1.50E-05 NUREG/CR-xxxx, Vol. x D-40
Appendix D Table D4. (continued). Cut No. CutSet % Probability Basic Event Probability { 41 0.1 2.50E-l l BRSI-MDP-FR-SI-PUMPB 5.50E-04 BRS1-MDP-FS-SI PUMPA 3.00E-03 BRSI MOV-CCF-CH-DIS 1.50E-05 42 0.1 2.50E-11 BRS1-MDP-FR-SI-PUMPB 5.50E-04 ( BRSI-MDP-FS-SI-PUMPA 3.00E-03 BRSI-MOV-CCF-CH-SUCT 1.50E-05 43 0.1 2.40E-Il BRSI-CKV-CH-PUMPA 1.00E-04 BRS1-CKV-SI-SUCT 1.00E-04 BRSI-MDP-MOOS-CH-PUMPB 2.40E-03 44 0.1 1.90E-Il BRSI-CKV-CH-DIS 1.00E-04 BRSI-CKV-SI-PUMPA 1.00E-04 BRS1-MPD-MOOS-SI-PUMPB 1.90E-03 45 0.1 1.90E-Il BRSI-CKV-CH-DIS 1.00E-04 BRSl-CKV-SI-PUMPB 1.00E-04 BRSI-MDP-MOOS-SI-PUMPA 1.90E-03 46 0.1 1.90E-11 BRS1-CKV-CH-SUCT 1.00E-04 BRSI-CKV-SI-PUMPA 1.00E-04 BRSI-MDP-MOOS-SI-PUMPB 1.90E-03 47 0.1 1.90E-11 BRSI-CKV-CH-SUCT 1.00E-04 BRSI-CKV-SI-PUMPB 1.00E-04 BRSI-MDP-MOOS-SI-PUMPA 1.90E-03 48 ( 0.1 1.70E-11 BRSI-CKV-CH-PUMPA 1.00E-04 BRSI-CKV-SI-SUCT 1.00E-04 BRSI-MDP-FS-CH-PUMPB 1.70E-03 [ [ [ [ r L D-41 NUREG/CR-xxxx, Vol. x}}