ML20210H111

Consequence Evaluation of Vynp Class 1 Piping in Support of ASME Code Case N-560

ML20210H111
Person / Time
Site:	Vermont Yankee File:NorthStar Vermont Yankee icon.png
Issue date:	07/07/1997
From:	VERMONT YANKEE NUCLEAR POWER CORP.
To:
Shared Package
ML20210H108	List: ML20210H103 ML20210H111
References
NUDOCS 9708110250
Download: ML20210H111 (57)

Text

--___

Page1 VYN560_1 i

Consequence Evaluation of Vermont Yankee Class 1 Piping in Support of ASME Code Case N-560 l

9708110250 970006 '"

PDR ADOCK 05000271 P PDR ,

Page 2 VYN560._1 Table of Contents 1.0 OBJECTIVE AND SCOPE 3 2.0 METHODOLOGY 5 2.1 Failure blodes & Effects Analysis (Fh1EA) 5 2.2 Impact Group Assessment 7

3.0 INPUTS AND ASSUMPTIONS 16 3.1 PRA Review 16 3.2 Safety Functions 17 3.3 Plant Level Assumptions 20 l 4.0 ANALYSIS 26 4.1 System Configurations 26 4.2 Failure blodes & Effects Analysis (Fh1EA) 26 4.3 Impact Group Assessment 33 5.0 RESULTS 52

6.0 CONCLUSION

S 55

7.0 REFERENCES

56 7n/97

Page 3 VYN560_1 1.0 Objective and Scope This analysis is conducted to support the application of ASME Code Case N 560 (Reference 1) at the Vermont Yankee (VY) power plant. This calculation contains the consequence analysis portion of the evaluation required by Section 2.4 of Appendix I of the code case. The objectives of the evaluation process are to identify risk important piping segments, define the elements that i are to be inspected within this risk important piping, and identify appropriate inspection methods.

As part of determining the risk significance of piping, the consequence evaluation focuses on the impact of a pipe failure.

l The primary objective of the analysis presented here is to rank the consequence (s) of pipe failure for VY class 1 piping within the ASME in service inspection (ISI) program. The systems and piping line numbers covered by this analysis and the ISI program are summarized in Table 1-1 along with the isometric drawings (Reference 4). Each system in the class 1 ISI program is listed below:

. - Reactor recirculation (RR) e - Reactor water cleanup (CUW) suction Residual heat removal (RilR) including shutdown cooling (SDC) suction & LPCI injection e Core spray (CS)

Feedwater (FDW) e Main steam (MS) including steam supplies to RCIC and HPCI e

Main steam drains (MSD)

. Standby liquid control (SLC)

In addition, smaller lines not in the ISI volumertic examination program, such as instrument, sample, CRD inlet & outlet, and other small reactor coolant pressure boundary piping are evaluated for completeness; they are also listed in Table 1-1. The line numbers in Table 1-1 first identify the nominal pipe diameter in inches, then the system and a numerical identifier, 7 5/97

Page 4 VYN560 1 Yable 1-1 Piping in the Analysis Scope Line Number System ISI Drawing (1) Description 28 PLW RR 1S1 5920-6622 Reactor Recirculation loop A 4 PLR RR 1S1 5920-6622 Reactor Recirculation Loop A h10V53A bypass 28-PLR RR 1S1 5920-6622 Reactor Recirculation loop B 4 PLR RR ISI 5920-6622 Reactor Recirculation loop D A10V53B bypass 4 CUW-l8 CUW 1S1-5920-6622 CUW from 20-RilR 32 to hiOV18 2-CUW-19 CUW 1S1 5920-6622 CUW from 4 CUW 18 to 2-CUW-400 2-CUW-400 CUW ISI-5920-6622 CUW from 2-CUW 19 to reactor vessel (drain line) 24 RilR 28 RilR ISI RilR-Partl1 LPCI injection A from hiOV27A to check valve 46A 24 RilR 30 RilR 1S1-5920-6622 LPCI injection A fmm check valve 46A to recirc loop A 24 RilR 29 - RilR 151 5920-9287 LPCI injection B from h10V27B to check valve 46B 24 RilR 31 RilR 151 5920-6622 LPCI injection B from check valve 46B to recire loop B 20-Ri!R 33 RilR 1S1-5920-9283 SDC suction from drywell penetration to h10Vl7 20-RilR 32 RilR 1S1 5920-6622 SDC suction from recirc loop A to drywell penetration 1S1 5920-9283 6 RitR-tlead RilR ISI RPV-103 RilR head spray blind flange and connection to nozzle N6A LCS-4A CS 151 5920-9211 CS from h10V12A to reactor vessel 8-CS-4 B CS 1S1-5920-9206 CS from h10V!2B to reactor vessel 16-FDW 16 FDW ISI FDW Part5 FDW A from check valve 27A to manual valve 29A 16-FDW 19 FDW ISI FDW-Part5 FDW A from manual valve 29A to 10-FDW 19 and 21

l. 10-FDW 19 FDW ISI-FDW-Part5 FDW A from 16-FDW 19 to reactor vessel nozzle 4A 10-FDW 21 FDW ISI FDW-Part5 FDW A from 16-FDW 19 to reactor vessel nozzle 4B 16-FDW-17 FDW ISI FDW PartSA FDW B from check valve 96A to manual valve 2VB 16-FDW 18 FDW ISI FDW-PartSA FDW D from manual valve 29B to 10-FDW-18 and 20 10-FDW 18 FDW ISI FDW Part5A FDW B from 16-FDW 19 to reactor vessel nozzle 4C 10-FDW-20 FDW ISI FDW-PartSA FDW B from 16-FDW 19 to reactor vessel nozzle 4D 18-h1S 7A h1S ISI-RPV 105 hts from reactor vessel to outside h1SIV 86A 18 hts-7B h1S ISI RPV 105 hts from reactor vessel to outside htSIV 86B 18-hts-7C his ISI RPV 105 hts from reactor vessel to outside h1SIV 86C d 18-hts-7D hts ISI RPV-105 hts from reactor vessel to outside h1SIV 86D 3-hts-5A hts ISI RPV 105 RCIC steam fmm hts line C to h10Vl6 10-blS-4 A hts ISI-RPV-105 llPCI 6 team frem hts line B to h10V16 ISI-llPCI Part2 3-h1SD-2 h1SD ISI-RPV-105 h1S drain header to outside h10V77 2-h1SD htSD na hts drains from each of 4 hts lines to htSD header 2-htSVent - na Vessel vent line from h1S C to VIS and FCV17 1 %-SLC-1i SLC ISI SLC-Part4 SLC from check valve 16 to reactor vessel sl Inst / Sample -

na Sample line from recire and instrumentation lines sl-CRD -

na 89 CRD inlet (1 inch) and outlet (3/4 inch) lines (1) Reference 4 identifies system flow diagrams and piping isometrics.

7D/97 3

P:ge$

VYN560_1 2,0 Methodology The consequence evaluation is conducted assuming pipe failure (loss of possure boundary integrity). A pipe failure can occur any time. Occurrence during operation, v.andby, periodic testing, or an accident demand is evaluated. These failures can cause an initiating event and/or disable the corresponding system or train, in addition, the same failure can aise 1.npact the availability of other mitigating systems. These consequence scenarios are analyze.i par Appendix I to Reference 1.

There are two aspects of the consequence evaluation summarized below and described in the next two subsections:

1. Failure Modes and Effects Analysis (FMEA): >

(a) Break Size (b) Isolability of the Break (c) Spatial Effects (d) Initiating Events (c) System Impact / Recovery (f) System Redundancy .

I

2. Impact Group Assessment:

(a) Initiating Event Impact Group Assessment f (b) System Impact Group Assessment (c) Combination Impact Group Assessment The consequence evaluation is an assessment of core damage potential with the plant at-power for internal initiating events, llowever, containment performance, other modes of operation, and external events are considered in the final " Impact Group Assessment."

2.1 Failure Modes & Effects Analysis (FMEA)

The FMEA documents the evaluation of pipe break hnpacts. Each arpect of the FMEA, described in Reference 1, is summarized in this section. The FMEA provides the input for the impact group assessment (consequence determination) described in Section 2.2.

Break Si7e i

This analysis is performed assuming a large break; the size is based on pipe diameter unless a smaller break is limiting. No credit is given to leak-before-break in the analysis.

Isolability of the Break Valves are identified that can isohte the break. lsolation is credited in the analysis when there is automatic isolation (e.g., check valve or automatically operated valve that closes on a signal as a 7D/97

_ _ _ - _ _ _ _ _ _ ~

Page 6 VYN560_1 result of the pipe break) or a normally closed valve. Also, when there is adequate detection, guidance, and time for the operators to manually isolate the break before certain impacts occur, manual isolation is evaluated. Whenever isolation is credited, impacts are assessed for both isolation succesa and failure. This is described further in Section 2.2.

Sshilikts The effects of flood, spray, and pipe whip on mitigating systems due to a pipe break are evaluated.

Mti#ine Even.t3 Some pipe breaks cause an initiating event. In the analysis of Class I piping (e.g., reactor coolant pressure boundaiy), loss of cor,lant accident (LOCA) initiating events are prevalent. Beyond the first normally closed or automatic isolation valve in the reactor coolant pressure boundary, potential LOCAs and isolable LOCAs that include a valve failure are evaluated.

Systemimnact/}kqcvejy The impact on systeme including the potential for recovery,is described. The total impact includes the above (e.g., spatial and initiating event) as well as other direct and indirect impacts:

Direct - the failure n salts in a diversion of flow and a loss of the corresponding train / system or an initiating event. Pipe failure is always assumed large enough to either disable the system l or lead to isolation.

Indittet - the failore residts in depletion of a source (e.g., suppressica pool, steam supply) and loss of system (s) supplied by the source, and/or spatially impacts other train / system (s) due to spray, flooding, etc. Since it takes time for Gooding and draining impacts to Meur, detection and isolat:en capabilitie.s are an important consideration in assessing these impacts. The spatial location and impacts of propagation are assessed for each assumed pipe failure.

Also, the impact of isolation success and failure is considered, when applicable (see example in Section 2.2). Recovery of the system containing the pipe failure is not credited in the evaluation.

Snt. em Redundancy Given the total impact described above, the remaining avai.lable trains (i.e., redundancy) are identified for each critical safety function. This is a key input in the determination of the consequence ranking in Section 2.2. As described in Section 2.2, consequences are ranked based on the logic structure of the plant PRA. The logic structures speci0cally examined in this process include event trees and system models in response to initiating events, critical failure combinations, and success paths. The critical failure combinations and the success paths are analyzed for each safety function.

As described above, the impact of successful and unsuccessful isolation of a pipe failure sometimes has to be evaluated. This is described with an example in the Section 2.2.

}

7D/97 s . , m a

Page 7 VYN560_1 2.2 Impact Group Assessment The VY PRA (lPE, Reference 2), supplemented with design basis information,is used to define the quantitative basis for applying the ASME procedure to the consequence evaluation at VY.

Section 3.2, including Figure 3-1, summarizes VY success criteria for different safety functions.

Table 2-4 provides the valuer. for conditional core damage probability (CCDP) utilized by Reference 1 (Table 1-4) und this analysis to assign consequence categories. As described below, this table also provides the basis for Tab!cs 2-1,2-2, and 2-3 which are in the impact group assessment.

The consequence ranking is performed based upon the impacts, including the isolability or failure to isolate the break, and the number of available mitigating (unaffected backup) trains. Section 2.1 describes the FMEA used to determine impacts and backup trains. CCDP calculations in this consequence evaluation are based on the VY PRA as describcd in this section and the remainder of the analysis. The evaluation is performed such that pipe segments can be qualitatively binned Osing the above bins (e.g., Iligh) and/or by their quantitative CCDP value estimated in this evaluation. This allows additional ranking to be perfonned within a category (e.g., High).

\_ As summarized in Section 2.0, the " Impact Group Assessment" includes three types ofimpacts where the analysis depends on whether or not the pipe failure causes an initiating event. The following examples explain analysis differences and the general methodology for the three impact group assessments. Also, Reference 15 provides additional information and insights on selecting system configurations (see Scetion 4.1) and modeling interfaces between the consequence analysis and the pipe degradation analysis.

Initiatine Event impact Groun Assessr_dVA!

This assessment method is used when the pipe failure only results in an initiating event (e.g.,

medium LOCA) without failing any other system or train. The initiating event is a direct impact and there are no other direct or indirect impacts. Table 2-1 (Reference 1 Table I-3) is used to determine the consequence category. For example, a MLOCA in Table 2-1 leads to a " Medium"

consequence. Also, the consequence ranking is equivalent to using Table 2-4.

Table 2 I has been revised from Reference 1 (Table 1-3) to be VY specific, based on conditional core damage probability for each initiating event type. This table provides the minimum consequence category when pipe failure causes one of the plant specific initiating events. If additional impacts occur to mitigating systems due to the pipe failure, the " Combination Impact Group Assessment" applies as described below; Table 2-3 must also be used (same as Reference 1 Table 1-6).

The methodology also includes potential LOCAs both inside and outside containment for piping beyond the firtt ncrmally clnsed reactor coolant isolation valve. CCDP is calculated based on the probability of the isolation valve disc rupture and the assumed pipe segment failure. The following summarizes the simplified model, assuming that a check vahe normally isolates the reactor 5 coolant system:

7D/97

~ ~ . - - - _ _ - -. . . - _. - -_

l Page 8 VYN5601 CCDPgoc4 = CV

• CCDPT.s.2.iwc4 Where: CCDPg wc4 s ithe value used to assign a consequence category based on Table 2-4.

CV is the probability of a check valve disc rupture.

CCDPr.u.a.: wc4 is the CCDP from Table 2-1 based on LOCA type and size.

These pipe segments, normally isolated from the reactor coolant system, need to also be evaluated assuming an independent initiating demand as summarized in the " System Impact Group Assessment" below.

Similarly, the methodology also includes isolable LOCAs both inside and outside containment for piping beyond the first normally open automatic reactor coolant isolation valve. CCDP is

, calculated for both isolation success and failure cases, and their respective impacts. The following example applies to a reactor water cleanup pipe break downstream ofinboard MOVl5 and ortside containment:

Isolation System impact / Recovery System Redundancy Consequence i Success T transient (reactor water _ Dased on Table 2 1 CCDP <lE-6 for T initiator. LOW cleanup pipe break turns into a The probability of isolation success is 0,996 (see transient when cleanup MOV isolation failure probability below).

closes on low RPV level)

Failure LOCA.OC (failure of cleanup Dased on Table 21, CCDP = 1E 2 for a LOCA MEDIUM MOV to close results in LOCA outside containment initiator, llowever, the

outside containment) probability ofisolation failure (4E-3) must be included. The final CCDP is 1E 2*4E-3=4E-5 '

As shown, an isolable LOCA which isolates successfully (low RPV level signal) results in a plant trip (LOCA quickly isolated) with only a transient impact. This is a " Low" consequence sequence

, in the above table based on the VY PRA (Table 2-1) The isolation failure case includes both the isolation failure probability (4E-3 based on automatic isolation) and the consequences ofisolation failure (IE-2 based on Table 2-1) in determining the consequence (CCDP),

3 System Impact Groun Assessment (No Initiatine Event)

This assessment method is used when the pipe failure does not cause an irtitiating event, but the pipe failure affects plant mitigating functions In this case, Table 2 2 (Reference 1 Table I 5) or Table 2-4 with an estimate of CCDP (Reference 1 Table I-4) based on the PRA (Reference 2) is g used to determine the consequence category,

~

Consistent with Reference 1, assigning consequence categories when the mitigating ability of the plant is affected depends on the following attributes:

1. Frequency of cha!!enge, which determines how often the mitigating function of the system / train is called upon. This corresponds to the frequency of plant initiating events that require the system / train operation; not the pipe failure frequency, 7n/97

Page 9 VYN5601

2. Number of unaffected backup systems / trains, which determines how many unaffected systems or trains are available to perform the same mitigating function. The availability of multiple trains makes the effect of the loss of systems / trains less significant. Mitigating systems are evaluated for each plant safety function (e.g., reactivity control, RPV inventory, decay heat removal) When considering the consequences, given an isolation failure, the number of available backup trains includes isolation.

3. Exposure time is the time to detection, repair, and/or plant shutdown for the case where pipe failure rnost likely occurs during the standby or operating conditions. A combination of

" frequency of challenge" and " exposure time"in Tab'e 2-2 provides the probability of challenging the system piping assumed to have failed. When the piping is considered more likely to fait during the accident challenge (the demand configuration), the exposure time is the time between tests, assuming the test provides a comparable challenge (e.g., pressure, flow).

In analysis of class 1 piping, it is always assumed that the exposure time is "all year" since the piping of interest is not periodically tested during operation.

Table 2-2 has also been revised from Reference 1 (Table I-5) to be VY specific, The Table 2-2 evaluation requires the number of backup trains to be determined, as well as the frequency of challenging the system, and the exposure time. The total impact and remaining backup trains are provided in the FMEA and/or can be determined from Section 3.2. The frequency of challenging the system and inducing pipe break can be determined from the PRA. For example, design basis l category IV is the correct frequency of challenging LPCI and CS piping in standby. Also, assuming the piping is not periodically tested, the correct exposure time is "all year" in Table 2-2.

As a further example, with 2 unaffected backup trains and a category IV challenge, the consequence category is " Low" in Table 2-2. This is also referred to as the qualitative or semi-quantitative method. The alternative or equivalent quantitative method of estimating CCDP for this example is as follows:

The expected frequency for design basis category IV events is IE-2/yr or less

• Exposure time is all year e

A backup train s 0.01 unavailability,2 backup trains a 1E-4 unavailability, etc.

The product of" frequency of challenge" and " exposure time" and "2 backup trains"in Table 2-2 is a CCDP of 1E-6. Thus, CCDP can be estimated and the consequence category assigned based on Table 2-2.

Also, CCDP can be estimated using the plant PRA (Reference 2). This requires requantification of the PRA with the system impacts from the assumed pipe break set to failure. Then, assuming an "all year" exposure time, a delta CCDP can be calculated based on the new impacts.

CCDP is calculated for both isolation success and failure cases, and their respective impacts.

Isolation is not typically automatic for the case where mitigating systems are challenged and the pipe break occurs during the accident demand. Isolation reliability depends on detection, guidance available to operators, the ticu available, and physical capability (e.g., remotely controlled valve 7 0/97 l

1

Page 10 VYN560_1 versus local operation). The following example applies to a LPCI injection line break in the reactor building, given an independer.t demand:

Isolation System impact / Recovery - System Redundancy Consequence Success Loss of LPCI train due to The other LPCI train and 2 CS trains are available. LOW isolation Based on Table 2-2, CCDP <lE-6 for Cat IV frequency of challenge and at least 2 backup trains.

Probability ofisolation success is assumed to be 0.99.

Failure Loss of LPCI train due to Dow Failure to isolate is assumed to be an equivalent MEDIUM diversion and eventually all backup train. Based on Table 2-2, CCDP = IE-4 for ECCS due to Gooding or Cat IV frequency of challenge (0.01) and I backup pumping suppression pool train (isolation failure is assumed = 0.01). No credit inventory into the reactor is given for the ability to injection with external building sources (e.g., service watert Combination impact Groun Assessment L This assessment method is used when the pipe failure causes both an initiating event and impacts mitigating systems; Table 2-3 (Reference 1 Table I-6) applies. As an example, assume there are two unaffected backup trains available to mitigate the event. Based on Table 2-3 the consequence category is " Medium" unless the consequence category for the initiating event in Table 2-1 is higher. Ifit is further assumed the initiating event is a large LOCA, then using Table 2-1, the final consequence category becomes "lligh."

Note that Table 2-3 (same as Table I-6 in Reference 1) is used in combination with Table 2-1 in that the higher consequence category is always selected. The number of unaffected backup systems / trains available to perform the mitigating functions is determined. Systems are evaluated for each plant safety function (e.g., reactivity control, RPV inventory, decay heat removal). When considering the consequences, given an isolation failure, the number of backup trains also includes isolation as described in the examples above.

As described before, CCDP can be quantitatively determined as an alternative to using Table 2-3 and 2-1. In this case, the initiating event and mitigating impacts are considered in estimating CCDP and Table 2-4 is used to assign the consequence category. CCDP is estimated using the plant PRA (Reference 2). This requires requantification of the PRA with the initiating event set to 1.0 and including the system impacts from the assumed pipe break.

-- 7n/97

\

Pcge i1 VYN560 1 Cewidtupent Performance l The above evaluations, with the use of Tables 21,2 2, and 2 3, or their equivait,t CCDP l calculetion (Table 2 4), determine pipe failure irpportance relative to core damage. Pipe failure is i also asse. sed for impacts on containment perfonnance. This is accomplished using two methods; both are based on an approximate conditional value of 50.1 between the CCDP and the likelihood l oflargo early release from the containment if there is no margin (e.g., >0.l), the consequence category is increased. The two methods used in this analysis are:

1. CCDP values for initiating events and safety functions are evaluated in Section 3.2 to determine whether the potential for large early containment failure requires th; consequence catego.y to be .inereased.

2. Impact on containment isolation is evaluated, if there is a containment barrier available, the consequence category determined for core damage in the " Group Assessments" above is retained if there is no containment barrier or failure of the only available barrier is used in determining the consequence category for core damage, some margin in the consequence category must be present to retain the consequence determined for core damage.

As an example for containment isolation, consider the following:

• CCDP Nr core damage is about IE 5 (Medium consequence for core damage), but there is i no et unent barrier. Since there is 0.1 margin to the "lligh" consequence at 1E 4, the Medh onsequence is retained, e

CCDP ... abott SE 5 (Medium consequence for core damage) , but there is no containment barrier. Since the margin to the "lligh" consequence at IE-4 is about 0.5 (>0.l), the consequence is increased to liigh.

Other Modes of Operation & External Events The consequence evaluation is m assessment with the plant at power for internalinitiating events.

Ilowever, the potential importance of pipe break during a plant shutdown and external initiating events is evaluated to ensure the full scope of potential risks is addressed. This additional evaluation includes a review and comparison of potential CCDPs during other modes of operation or external initiating events versus the at power results, if the at power case for internal initiators is not judged to envelope, the coriegence bin is adjusted higher.

7D/97

Page 13 VYN560 )

Table 21 Consequence Category Assignment For VY Pipe Failures When Impact is Only an Initiating Event Initiating livent (note 1) lliF 3 CDF CCDP Consequence (eventdyr) (eventdyr) gCDF/IEIS f transient (htSIVs & feedwater available) 1.5 4.9 E 7 3.3 E 7 Low t his h1SIV closure (feedwater available) 0.3 7.0E 7 2.3E-6 hied TFWhtS h1SlV closure & loss of feedwater 0.1 6.3E 7 63E 6 hied FLP loss of of fsite power 0.1 8.8E 7 I 8.8E 6 hied l LLOCA large LOCA l'.0E 4 6.21?[8 G.2B 4 liigh

~

h1LOCA rnedium LOCA 3.0E-4 2.5E 8 8.4 E 5 hied SLOCA smallLOCA 1.0E 2 1.3E 8 1.3B 6 hied LORY inadvertent stuck open relief valve 5.6E 3 1.5 E 7 2.7E 5 hied ISLOCA interfacing system LOCA (note 2) 1.lE 9 1.1E 9 1.0 liigh LOCA OC LOCA outside containment (note 3) note 3 note 3 note 3

, FWTl feedwater 1.6E 8 3.0E 9 0.19 liigh htSTI - main steam 2.5 E 7 3.4E 10 1.4E 3 liigh RCTl RCIC steam supply 3.2 E 7 7.4E 10 2.3 E 3 liigh IIPTl - IIPCI steam supply 1.lE 8 1.5E 11 1.4 E 3 liigh RWRll) reactor water cleanup suction 7.dE 8 9.6E 10 1.3 8 2 liigh SLC discharge (not evaluated in PR A) note 4 note 4 IE 2 liigh TDI loss of 125V DC bus i 1.5 E 3 4.4 B 7 2.9 E 4 liigh fD2 loss of 125V DC bus 2 1.5E 3 4.5E 7 3.0E-4 liigh FA3 loss of 4160V AC bus 3 1.5E 3 2.2E 7 1.5 11-4 liigh FA4 loss of 4160V AC bus 4 1.5E 3 2.0E 7 1.3E-4 liigh

, TSW loss of service water 7.0E-4 2.lE 8 3.0E 5 hied initiating event faquency (IEF)is from VY PRA Tables 3.1.1.1,3.1.1.4 and 3.1.1.5. Core damage frequency (CDF) is derived from VY PRA (Reference 2).

note 1: Transients (T. TA1S, TFWhtS and TLP) include the contribution from reactivity control failure (ATWS) which is quantined in the VY PRA with separate initiating eventc (A, AhtS, AFWhtS, ALP).

note 2: There are numerous ISLOCA initiators in the VY PRA. The results shown are for the class I lines in this analysis (LPCI, CS, and SDC piping between the drywell and the outer isolation valve). The initiators include LAllEL, LilllEL, CANVL, C!lSVL, and S11EL in Reference 2 Table 3.1.1.4.

The initiating event frequency includes the probability of inner isolation valve failure (Reference 2, Sections 3.2.26 and 3.1.1).

note 3: There are numerous LOCA outside containment initiators in the VY PRA, he results shown are for class I lines in this analysis (pipe between the drywell and the oute isolation valve). The initiating event frequency includes the probability of the inner isolation valve failure (Reference 2, Sections 3.2.26 and 3.1.1).

note 4: The impact of St C LOCA is bounded by RWRilI based on a comparison of loca.tions and pipe sites (see Section 43).

7/7/97

Page 13 VYN560_1 Table 2 2 Guidelines for Assigning Consequence Categories to Pipe Failures Resulting in less of System (s)/frain(s) Without un Initiating Event Affecte(I Systems Numl>cr of Unaltected Ilackup Trains Frequency of Exposure Time Challenge to Challenge l 0 1 2 23 1

~

All year .

L Anticipated lietween tests (13 month) L (Dil Cat II) uing AOT(> 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />) q H

h-L Short AOT(s 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />)  !

L L

)] Nf .

All year '

l l

inIrcytient lietween tests (13 month) L (Dl) Cat 111) bing AOT(> 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />) L L MQ, Short AOT(s 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />) k l l All year j.  ;

L L p

ggy Unexpected lietween tests (13 month) L L g

(DI3 Cat IV) Long AOT(> 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />) 3 L L M{

Short AOT($ 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />) L L L 11 m liigh Consequence Category M = Medium Consequence Category L = Low Consequence Category inn 1 J

l Page 14 l

l VYN560_1 Table 2 3 Ouldelines for Assigning Consequence Categories to Combinations of Consequence impacts (Initiati:e Eves.! mic Mitigating Train (s)/ System (s) Impact)

Comnination of Inillating Event & Consequence Category Mitigating Ability Affects Less than 2 unaffected backup trains availabic for mitigation

.s .-

At least 2, but less than 3 unaffected backup trains f available for mitigation 'iy.

LOW At least 3 unaffected backup trains available for (or IE category from Table 21, mitigation ifhigher)

No mitigating ability affected IE category from Table 21 Note: Mitigating systems always correspond to the analyzed initiating event.

7 0/97

Page 15 VYN560_1 Table 2-4 Conditional Core Damage Probability (CCDP) Used to Assign Consequence Category Consequence Category CCDP 1,ow CCDP<IE6 Medium lE 6 s CCDP < IE-4 liigh CCDP h IE 4 1

7D/97-

Page 16 VYN560_1 l

3.0 Inputs and Assumptions in addition to Reference 1, numerous plant specific documents are reviewed (see Section 7 references); the following are key inputs to this analysis:

• The VY PRA (References 2 and 3)is used to assess plant initiating event challenges and their frequencies, conditional core damage probability, and the imponance and unavailability of systems, trains, and accident sequence types. The PRA also contains information on systems operation, dependencies, safety functions, and spatial consequences.

• VY flow diagrams and isometries (Reference 4) are utilized to identify piping locations, isolation valves, and detection capability.

Additional reviews, inputs, and assumptions are summarized in the following subsections.

l 3.1 PRA Review The VY PR A (Reference 2) is used to evaluate the imponance of initiating events, systems, safety functions, and spatial k) cations affected by potential pipe leaks and/or failures.

Core damage frequency depicted in the VY PRA is approximately 4.3E-6/yr (Reference 2, page 1.4-1). Table 2-1 shows the contribution of accident initiator types as well as conditional core damage probability (CCDP) which provides an indication of overall mitigation capability for each initiator. Table 3 1 shows how CCDP contributes by safety function for certain initiating events in this analysis. A simplified representation of the safety functions can be found in Figure 3-1.

The following summarizes the major contributors to core damage in the PRA based on a review of the first 10 sequences (Reference 2, Table 3.4.1). Also, the contribution from safety functions and systems is discussed below and in the next section.

Sequences 1 & 2 loss of the power conversion system (initiating events TFWMS and TLP) and subsequent failure of RCIC, llPCI, and emergency depressurization are the top two sequences. The frequency of these scenarios (each is approximately 4E-7/yr) and the initiating frequency (0.1/yr) confirms the " Medium" consequence importance ofloss of feedwater initiators in Table 2-1.

Sequences 3 & 4 - the next two sequences are ATWS eventst the pmbability of reactor protection system failure (e.g., failure of control rods to insert) is about IE 5. Sequence 3 involves failure of SLC. Thus, SLC pipe failure on demand (transient and failure of rods to insert) will be a " Medium" consequence with a CCDP of approximately lE-5. Sequence 4 involves feedwater pump trip failure which is not expected to be impacted by class 1 pipe failures analyted in this analysis.

2nm

Page 17 VYN560_1 e

Sequence 5 involves a turbine trip initiating event and subsequent failure of feedwater, RCIC, llPCI, and emergency depressurization. The frequency of this scenarios (approximately lE 7/yr) and the initiating frequency (1.5/yr) confirms the " Low" consequence importance of transient initiatars (feedwater and main condenser initially available) in Table 2 1.

-* Sequence 6 - another ATWS event involving failure of ADS inhibit which is not expected to be impacted by class 1 pipe failures analyzed in this analysis.

• Sequences 7 through 10 - involve support system (AC and DC) initiating events which are not expected to be impacted by class 1 pipe failures analyzed in this analysis.

The binning of core damage sequences (Reference 2, Table 3.4.2) was also reviewed for insights.

For example, the "IllB" bin is totally based on medium LOCAs where feedwater, llPCI, and emergency depressurization have failed. The frequency of this bin divided by the medium LOCA initiating frequency indicates that CCDP for the high pressure injection and/or depressurization function is a " Medium" for medium LOCAs. Table 3-1 summarizes CCDP contributions by critical safety functions for key initiating events in the analysis. These safety functions are described further in the next section.

3.2 Safety Functions Each critical safety function is ccnsidered when determhiing the number of available mitigating trains and/or estimating CCDP in the consequence evaluation. Note that applying CCDPs from Tab!c 2-1 will account for these critical safety functions, as they are included in the VY PRA.

Table 3 1 also summarizes how safety function failures contribute to the CCDPs in Table 2-1.

Figure 3 1 summarizes the VY PRA success criteria (Reference 2, Section 3.1.2) for loss of coolant accidents (LOCAs)in simplined diagrams Based on a review of VY PRA results, including Tables 2-1 and 3 1, the following summarizes how these functions and others are treated in the consequence evaluation:

e Reactivity Control - this function is required immediately upon demand to protect the core.

Ilowever, a pipe failure is judged more likely to cause a reactor trip than to prevent a reactor protection system (RPS) success (this function is fail safe, de-energize to actuate). This is -

particularly true for Class 1 piping located inside the drywell. Also,it isjudged unlikely that a pipe failure could immediately impact recirculation pump trip (RPT) and altemate rod insertion ( ARI) functions simultaneous with RPS. Independent failure to SCRAM unavailability on the order of IE 5 (top event CR in Table 3-2) is judged to envelope other potential spatial causes. These judgments are based upon the fact that the RPS is safety related and must function during design basis accidents (e.g., LOCAs inside the drywell). This IE-5 probability results in a medium consequence without considering any other mitigating capability or the frequency of challenging RPS. The following explains how this function is in:ated in the analysis:

+ If the pipe failure causes a LLOCA or MLOCA, a " Medium" CCDP is used based on Table 3 1. The lE 5 value for SCRAM failure is binned to core damage with a high 70/97

{

Page 18 VYN560_1 likelihood of containment failure. Because this probability provides margin (0.1), the ,

"htedium" consequence is retained.

+ If pipe failure causes a Th1S (htSIV closure) or TFWhtS (loss of feedwater and main condenser), a "hiedium" CCDP is assumed based on Tables 2 1 and 3 1. There is sufDeient margin to retain this "hiedium" when considering containment performance.

+ If the SLC pipe falls on demand, a "hiedium" CCDP is used has:d on the IE-5 value and the fact that SLC is unavailable to mitigate tbc scram failure As with h1LOCA and LLOCA, a 0.1 margin for containment performance allows the "hiedium" consequence to be retained.

• For pipe failures that cause a transient with feedwater and the main condenser initially available (T in Tables 2 1 and 3-1), a " Low" consequence is used because mitigating capabilities exist to reduce CCDP to <lE-6 with margin on containment performance.

• For pipe failures that occur during an independent demand, a " Low" consequence is used because the frequency of challenge (e.g., core spray)in combination with RPS failure and mitigation failure is <!E 6 with margin on containment performance.

Vapor Suppression - this function is required c@ after a LOCA initiating event to protect containment from caily over pressure failure. The probability of vapor suppression failure in the VY PRA is 1.lE-4 (top event VS in Table 3 2).The following explains how this function is treated in the analysis:

I

+ If pipe failure causes a LLOCA, a "lligh" CCDP is assigned since there is little time for additional mitigation. The VY PRA does not credit additional mitigation (Reference 2, Section 3.1.2.1). Although IE 4 in Table 31 is close to the medium CCDP, the potential

, for early containment failure is considered imponant enough to retain the high j consequence.

t

+ If pipe failure causes a h1LOCA, a "hiedium" CCDP is assigned based on the VY PRA

)

(Table 3 1) which credits emergency depressurization as mitigating vapor suppression failure (Reference 2, Section 3.1.2.2). CCDP is about IE 5 which provides margin to retain the medium consequence when the potential for early containment failure is considered.

+ If pipe failure causes a SLOCA, a "hiedium" CCDP is assigned because there is insufficient margin when containment performance is considered. As shown in Table 3-1, CCDP is less than iE-6 because both emergency depressurization and containment sprays are credited as mitigating vapor suppression failure (Refennce 2, Section 3.1.2.3).

+ For all other cases, a " Low" CCDI is assigned based on the VY PRA (Reference 2, Section 3.1,2.4).

e liigh Pressure Stakeup and/or Depressurliation - by deDnition, this function is not required for large LOCAs. For medium LOCAs, it is only required until the RPV depressurizes enough for low pressure injection, llowever,in the case of small LOCAs and transients, feedwater, RCIC, and llPCI are considered redundant to the low pressure makeup function. RPV depressurization is needed for low pressure makeup,if these high pressure makeup systems are unavailable. Based on the VY PRA (Tables 2-1 and 3-1), a CCDP in the 7n/97

I Page 19 VYN560_1

" Medium" range occurs for medium LOCA (MLOCA), loss of feedwater (TFWMS), and loss of suppo t system initiators. There is sufficient margin to retain this consequence when containment performance is considered. Only small LOCAs (SLOCA) and transients whh feedwater initially available (T and TMS) can reach the ' Low" CCDP. Ilowever, the

" Medium" consequence is assigned to SLOCA and TMS because there is not sufficient margin for containment performance.

Also, CCDP was estimated for certain transients with RCIC or llPCI unavailable to support the analysis (see Table 3 1). As shown, these are a " Medium" consequence. With regard to containment performance, the margin is not sufficient to retain a " Medium" consequence for TFWMS in Table 3 1. Ilowever, based on a combination of margin in Table 3 1 (0.41) times the conditional probability of"Early" release (0.26 = [2.258-7 + 1.65E 7]/1.5E 6 based on Reference 2, Table 4.6.2), the margin is close to 0.1 and the consequence is not increased.  ;

e Low Pressure Makeup there are several makeup trains, however, common cause limits the unavailability of LPCI and CS. For example, failure of the low pressure permissive in the VY PRA is >lE-4 (top event Pi in Table 3 2), guaranteeing a "lligh" CCDP for large LOCA since there is limited time for operator response; no time is credited for large LOCA. In the case of medium LOCA, recovery of condensate is credited which results in a " Medium" CCDP with margin for containment performance. This function provides a " Low" CCDP for small LOCA and general transients, in those cases where the margin is borderline, the initiator is already in a higher consequence category due to another safety function.

• IIcat Removal - The RilR system in the torus cooling mode of operation and the hardened containment vent provide it:lable containment heat removal capabilities. The containment vent is not dependent on support systems, except for controlling depressurization and attemate injection when necessary Local recovery of this equipment is possible and there is significant time available to perform these actions. With the exception oflarge and medium LOCAs, these capabilities provide CCDP values <lE-6. Given the time available to recover this function and the obvious domination of other functions, containment heat removal is not considered important in this analysis. Also, because loss of this function does cause core damage to occur late, containment performance is not considered.

• Containment Performance - To maintain the consequence category der: mined from the above functions, at least one containment barrier must be availab!c or there must be margin in the number of available mitigating trains as described in Section 2. Otherwise, the consequence category is adjusted accordingly.

Table 3 2 summarizes unavailability for key functions, systems, and trains required to support the critical safety functions and success diagram shown in Figures 3 1. The table also explains the backups trains that can be assumed in the analysis when using Table 2 2 and 2 3. As explained in Section 2, I train m 0.01 unavailability,2 trains a lE-4 unavailability, and etc. Also, a 0.5 train =

0.1 unavailability, The unavailability's in Table 3 2 generally assume all support systems are available. Support system trains are generally more reliable, they are included in the analysis, and their impact on system unavailability is considered, e 7n/97

Page 30 VYN560 I 3.3 Plant Level Assumptions Engineering judgments are included and discussed throughout the analysis; the following are considered to be key plant level assumptions and judgments:

1. The pipe failure can occur at anytime; three configurations are defined in Section 4. These are l normal (operating or standby), test, and accident demand. Section 4 also summarizes

' Judgments and assumptions regarding which configurations are most important. If the pipe failure does not cause a direct initiating event, it is assumed that the pipe failure occurs during the accident denmnd configuration, if applicable. This assumes pipe failure occurs during the ,

most conservative exposure time and accounts for the higher stress placed on the operators with resultant delay in operator response.

2. Leak before break is not credited in the analysis. This is acknowledged as an option in the Code Case (Reference 1) which references NUREG 1061, Volume 3.

3. Large LOCA initiators in the VY PRA assume thm cr.c LPCI injecticn path is unavailable due to the initiating LOCA being assumed to occur in the recirculation discharge piping (Reference 2 Section 3.1.2). No credit was taken for the piping upstream of the discharge block valves potentially being isolated on low reactor pressure. Although this is potentially l conservative, the same low pressure permissive that closes the block valves is also required to j

open the LPCI injection valves. Since failure of the low pressure permissive or vapor i

suppression function are greater than IE-4, all large LOCA initiating events will have a "lligh" CCDP whether block valve closure is credited or not. Still, it should be noted that these common cause failure modes could be over estimated and conservative.

4. Interfacing system LOCA (ISLOCA) initiators between the LPCIinjection hiOVs (h10V27A/Il and h10V25A/B) are potentially isolable with the h10V25 valve. Consistent with the VY l'RA, this was not credited in the analysis due to proximity of break, environment, interlock, and blowdown loads (Reference 2, Section 3.1.3 and 3.2.36).

5. Assigning large LOCAs to the "lligh" consequence is potentially conservative. Conditional core damage probability is dominated by the probability of common cause failure of the low pressure ECCS permissive and vapor suppression failure (Tables 31 and 3 2). Both of these probabilities could be conseivatively estimated.

6. Low pressure ECCS is credited for steam line breaks in the steam tunnel (Reference, Section 3.1.3.2). This results in a "hiedluni" consequence. There appears to be no analysis for steam line breaks with failure to isolate, however, thisjudgment appears reasonable based on a review of the spatial configuration and considering that ECCS equipment is safety related. in {

l the case of feedwater line breaks in the steam tunnel,little credit is given for makeup, resulting i in a "lligh" consequence. This may be conservative.

7. The pipe size assumed in the analysis (Section 4.2) for the case where the reactor depressurizes, allowing low pressure ECCS makeup without the aid of IIPCI, feedwater, or ADS is judged to be conservative. Additional analysis may indicate that some piping leads to a medium LOCA instead of a large LOCA; this would reduce the importance of such piping.

7D/97

. Pcge 21 VYN560_1

8. The following items can be considered potential open items with regard to analysis assumptions:

e A plant walkdown has not been conducted, however, spatial assumptions were discussed with and are being reviewed by the engineers responsible for internal hazards analysis,

• The seismic analysis in support of A-46 and IPEEE is not completed, however, this is not

! expected to impact this analysis of class 1 piping as described in Section 4.

l e Similarly, Dre and flood analyses in support of IPEEE are not completed, however, this is not expected to impact this analysis of class 1 piping as described in Section 4.

l 7D/97 i

Page 22 VYN560 !

Table 31 CCDP Contribution by Safety Function initiating CCDP by Safety Functions Event Reactivity Vapor liigh Press Low Press Containment  ;

Control Suppression Makeup Makeup lleat Removal LLOCA 1.0E-5 1.lE 4 -

4.5 E-4 5.0E 5  !

MLOCA 1.0E 5 1.lE 5 4.5E 6 1.lE 5 4.7E 5 l SLOCA <lE 6(1) 5.5E 7 3.6E 7 4.0E 7 1.3E 8 TMS 2.lE 6 -

1.6E-7 1.0E 7 1.3E 8 TISVh1S 1.3E 6 -

4.8E 6 1.9E-7 1.3E 8 T 8.2 E 8 -

1.4E-7 9.5E 8 1.3E 8 i l

TMS with 2.lE 6 -

1.58 6 1.8E-7 2.lE 8 RCIC unavail.

TMS with 2.lE-6 -

1.3 E-6 1.8E 7 3.5E 8 IIPCI unavail.

TITVMS with 1.3E 6 -

4.5E 5 9.0E 7 2.lE 8 RCIC unavail.

TFWMS with 1.3E 6 -

3.8E 5 8.7E-7 3.5E-8 IIPCI unavail.

Table is derived from VY IPE (Reference 2) utilizing core damage binning frequencies.

(1)IPE recognizes that SLOCA can be mitigated in the ATWS model, but these scenarios were not quantified; the results would be enveloped by transients analyzed (Reference 2, Section 3.1.2.3).

7n/97

I Page 23 VYN560 !

i Table 3 2 Auumed System & Train Itackup System / function Top livent (1) Trains (3) Unav.dl (2) 1 unction Top livent Split Praction (2)

CR control rod insertion 2.5 _l.tlli 5 reactivity control . CRilASE ~

VS vapor suppreulon 2 i . l E-4 carly containment control . VSil AS!!

l.P . LPCI (all support availabic) 1.5 2.5E-4 LP makeup . LPil ASE 1.P . LPCI (1 1.PCI loop) I 9.2113 1.P makeup LP2P CS . CS (all support available) 1.5 3.9 E 4 LP makeup . CSil ASE CS CS (I CS loop) '

1 1.l E 2 LP makeup CSlP _

Pl . ECCS !.P interlock I.5 4.21!4 LP makeup PlHASil TC . torus cooling (2 train RilR) 1.5 5.21!-4 heat removal . TCil ASE and others TC torm cooling (1 train MilR) I 1.0!! 2 heat removal TCLPS2 and others VT. containment vent 1.5 1.9E 3 heat removal VTilASE Al alternate injection (2 trains) 2 9.9 E 5 heat removal. AillASE Al alternate inlection (1 train) I 1.0E 2 heat removal AINPSil and others DS drywell spray  % 0.10 carly containment control- DSil ASE OD - depreuuritation (MLOCA)  % 0.911 2 carly containment control . ODMLBS OD depreuuriration (St.OCA) 1 4.7E 3 carly containment control . ODSLilS IIP IIPCI(all support available)  % 8.8H 2 IIP makeup HPilASE RC RCIC(all support available) ,

% 0.11 IIP makeup . RCll ASE IIP & RC IIPCI and RCIC 1 1.3112 IIP makeup 11PRCilS ISV feedwater i 1.5H 2 IIP makeup ISVilASE AD- ADS (MLOCA) 1.5 1.1E 3 IIP /LP makeup. ADMilS AD. ADS (SLOCAffransient) 1.5 3.6 E 4 IIP /1.P makeup ADSilS CN condensate i 1.3E 2 LP makeup . CNil ASE RM recover main condenser '1 1.1 E 4 heat removal . RMH ASE Til turbine bypaw(transients) 1 5.3H 3 heat removal TilllASE (1) Top events (e.g , CR) are frorn the VY PRA event trees (Reference 2. Section 3.1.2)

(2) Top event split fractions and their values are from VY PRA (Referenec 2. Table 3.3.5.1)

(3) As described in Section 2,0.5 train a 0.1 unavailability, I train m 0.01,2 trains a IE-4, etc.

0 7D/97

I Page 24 VYN 60 !

Figure 31 (1 of 2) Siinplified Success Criteria (Reference 2 Section 3.1.2) flti2dy CIfilfluia!.R Lt2.SiH118122 LtW1! Alt frat egg tilat.remeral LPel'A' RHk ' A' -.

LPel'B' P HR 'B' -

LLOCA-> cenisol kods > '[,* ,ig

' > l',*

p, h,',';','," > -> -> $ u C C tll c.,e seter A-  ;

l',*,' M,, -

core 5 prey 'B' The VY IH A nuumes !.l.OCA l> on the discharge side of the recirculation line, since this disables ! LPCI train (iteference 2 Sntion 3.1.2.1).

High press makeup and/or Depressuriztion LOW pins makeup Heat removal

> Hl'el LPCI'A' RHR*A' ---

> lerde sier LPel*b' RHR 'b' -

M LOC A(1)- -> -> -> S ucc eis u i c..d

> 2of4$kV c6,# $rray 'A' - Recoiery g)) & -

_gier..ie i i

as A core serer 's' -

3}',,,, , _

condmaiem -

(1) Reactivity control, vapor suppression, and the low pressure pennissive success blocks are required as for LLOCA. For h!LOCA, depressurization is also inodeled as initigating vapor suppression failure.

(2) Condensate as a low pressure snakeup capability is dependent on feedwater.

(3) The VY PRA does not credit the recovery of the inain condenser for htLOCA (Reference 2, Section 3.1.2.2).

7/7/97

Itge 25 VYN560_1 1:igure 31 (2 of 2) Simplified Success Criteria (Reference 2, Section 3.1.2) an r p es ur rat on Low press makeup Host removal k CIC kilt ' A' r Htti - RHR*6' ~

$l0C All) - > ->$ucccss

~~Mm Cend

& F desist --

Rece,,ry &

Alierme ini _

LFCI'A'

'> l of 41RV > ->

• I g,,,',, -

ae, ','

Core Spray 'A' Core 5ptsy 'B' I

0 ipdeessie(1)

Other (fire &

Strti(t alltr) =

0)

(1) Reactivity control, vapor suppression, and the low pressure permissive success blocks are required as for LLOCA. Mitigation of both reactivity control and vapor suppression failure is inodeled for SLOCA. For SLOCA, both containment spray and depressurization are modeled as mitigating vapor suppression failure. Transient success is similar to SLOCA except the main condenser is considered to be initially available unless the transient is caused by loss of the condenser or its support systems.

Also, vapor suppression is not required for transients.

(2) Condensate as a low pressure makeup capability is dependent on feedwater.

(3) Other (fire & service water) external injection 'a ater sources are not credited for SLOCA response. Use of the diesel fire pump is included in the transient model for station blackout response.

l 7 0/97

l Page 26 l VYN560 !

4.0 Analysis-4.1 System Conngurations An important input to the consequence evaluation is the system connguration under which the piping is assumed to fall. The following system configurations are identified as potentially applicable.

1. Normal (operating or standby)

2. Test (periodic testing applies)

3. - Demand (real demand due to plant trip or accident)

The configuration can influence piping loads, piping degradation mechanisms, the probability of failure (demand versus time dependent exposure), and the probability of detecting and isolating the failure prior to significant propagation and/or impacts. Reference 15 provides additional infonnation and insights on selecting system configurations and modeling interfaces between the consequence analysis and the pipe degradation analysis, if the pipe break causes an initiating event, the bicak is assumed to occur during the normal conHguration; there is no need to evaluate the test and demand configurations, if pipe failure does not cause an initiating event and is isolated from the reactor coolant system (RCS), the demand configuration is analyzed. Also, a potential initiating event due to an additional failure (e.g.,

passive valve failure causing a LOCA) is analyzed. The testing configuration is assumed not to apply to Class I piping; testing on the reactor coolant system and connected piping is not normally performed during power operation.

The first two columns in Table 4 1 identify the piping segments by line number and the configuration (s) analyzed for each segment. The line number in Table 1 1 (Class I piping scope) is separated into "Line Number / Segment" based on the potential for isolation of the break and -

whether the piping is inside the drywell or outside the diywell. The system flow diagrams and

-isometrics (P,crerence 4) determine the location of Classi piping within the plant and associated piping connections (e.g., reactor recirculation, RPV, and etc.). Figure 4-1 is simplified diagram of the major class I piping and can be used with Table 4-1 to help identify where the pipe segment is located.

4.2 Failure blodes & Effects Analysis (FhlEA)

The effects of pipe failure are evaluated and documented !n this section and Table 4 1. Table 4 2 provides information on spatial propagation and imrwts outside the drywell Each column of Table 4 1 is described below, refening to the FMCA elements in Section 2.

Line Number / Segment this first column identifies the " break size" which is a requirement of

- FMEA item (a), The first number in the segment description contains the pipe diameter in inches inn 1

Pcge 27 VYNS60_1 which is assumed to be the break size. This impacts the initiating event LOCA size which impacts conditional core damage probability (CCDP).

Conng this column identines the system connguration being evaluated, llow decisions are made on applicable conngurations to evaluate is described in Section 4.1.

- IE identines " initiating events" which is a requirement of FMEA item (d). Most pipe failures in the reactor coolaut pressure boundary and its connections result in a LOCA initiating event. The size of the pipe innuences whether it is a large LOCA (LLOCA), medium LOCA (MLOCA), or small LOCA (SLOCA). Some piping isolates autornatically (e.g., main steam, reactor water cleanup, and feedwater) and is identitled as "lLOCA" because it is likely to be isolated immediately. When ILOCA is the initiator, the Dnal initiator and its impact is identined in the

" Impact" column for both isolation success and falltne.

A "pLOCA" (potential LOCA) is identified in this column and evaluated when piping is nonnally isolated from the RCS; passive failure of a normally closed valve is required to challenge and fall the pipe. When PLOCA is the initiator, the Dnal initiator and its impact is identified in the

" Impact" column. Also, for normally isolated piping (e.g., can not directly cause an initiating event), the demand connguration is evaluated for the applicable mitigating challenge. For example, a design basis category IV challenge identined as "LOCA"is used for LPCI and core spray piping. Comments at the end of Table 4 1 further describe the initiators.

Detection and Isolation - These two columns address "isolability of break" which is a requirement of FMEA item (b). "Yes"in the detection column signines that break detection capabilities are identified; they are explained in footnotes, "No" means that no detection capability is identified, in some cases, "na" is used when detection is not considered mlevant, The isolation column indicates whether isolation is actually credited in the evaluation. The system valve credited in the analysis is usually shown or "No" signines that r.o credit for isolation is included. When active isolation is credited in the evaluation, both success and failure to isolate are evaluated and shown in the isolation column. First the success case shows the system valve and/or equipment.

Then, " failure" signifies the evaluation of isolation failure impacts. The valves identified in the

" Isolation" column can be seen in Figure 4 1 and comments provided at the end of Table 4 1 describe this analysis. Detection and isolation is described further below and in Section 4.3.

Impacts summarizes additional " system impact / recovery"(e.g., besides the initiating event impact discussed above) due to pipe failure which is a requirement of FMEA item (c). Recovery of system pipe failures is not cmdited in this analysis. This column also contains information on

" spatial effects" which is a requirement of FMEA item (c), if a pipe break is in the LPCI or CS system, a LPCI or CS train is unavailable due to either flow diversion or isolation. This is a system impact. For a break in the reactor building, failure to isolate may lead to pumping the suppression pool into the reactor building and/or flooding all ECCS equipment. This is considered a spatial efrect. For an isolable LOCA (ILOCA) in column "!E", this column also includes the initiator type as an impact; this changes dependent on whether isolation is successful or falls.

Similarly, for a potential LOCA (PLOCA) in column "lE", the " Impacts" column also includes the LOCA type. Interfacing systems LOCA (ISLOCA) and LOCAs outside containment (LOCA OC) events in this column also contain spatial effects on systems. This section (below). Table 4 2, and comments at the end of Table 4 1 further describe the impacts.

TMNT

Page 38 VYN560.1 Qualitative liasis identifies how " system redundancy" or the number of backup trains are evaluated which is a requirement of FMEA item (f), As described in Sections 2 and 4.3, the basle principles of defense in depth and sing!c failure for safety functions, including containment perfonnance, are included in the evaluation. Table 21 or 2 2 or 2 3 is referenced which signifies

. the applicable impact group assessment. The evaluation differs for the isolation success and failure

) case, when applicable. This column also explains how the CCDP is estimated in the next column.

An "*" indicates that two probabilities are being multlplied to calculate the CCDP. Comments at the end of Table 4 1 further describe the evaluation.

CCDP shows the calculation of CCDP. The results provide the basis for assigning consequence categories and quantitatively ranking segments, as described in Section 4.3. Comments at the end of Table 4 1 further describe the CCDP calcuhitions.

The remainder of this section provides additional supporting FMEA documentation.

Success Criteria for LOCA Sizes As described in Section 3 the success criteria and CCDP for critical safety functions depend on the LOCA size. Also, as described above, the pipe break size is assumed to be the piping inside diameter unless smaller breaks are more limiting, in this analysis, breaks smaller than the pipe i inside diameter are not more limiting; this can be seen in Table 211 and 3 1 where CCDP is lower for smaller size LOCAs. There are two pipe size boundaries with respect to this analysis:

1. The pipe size, which if broken, still allows normal makeup capabilities from 1 CRD pump and RCIC to maintain reactor water level. This is defined as the small LOCA upper limit in this analysis. Based on Reference 5, the following are used in this analysis:

51.45 inches internal diameter for water breaks (1.5 inch nominal pipe diameter) s 2.37 inches internal dhuneter for steam breaks (2.5 inch nominal pipe diameter)

2. The pipe size where the reactor depressurizes, allowing low pressure ECCS makeup, without the aid of lipCI, feedwater, or ADS. This is defined as the large LOCA lower limit in this analysis.

2 6 inches nominal pipe diameter for water breaks. This is based on discussions with 2

YAEC LOCA Group which indicated that 0,4 ft will depressurize fast enough.

This would be equivalent to an 8.4 inch internal diameter (8 inch nominal pipe diameter).

2 4.0 inches nominal pipe diameter for steam breaks. This is based on 2 SRVs required for depressurization success in the VY PRA. One SRV is about 0.1 ft'. Two SRVs are equivalent to about a 6 inch diameter opening and 1 SRV is equivalent to about

. a 4 inch opening. One was chosen as conservative for this analysis.

The medium LOCA pipe size is the range between the two boundaries defined above for small and large LOCA, 7nm

Pcge 39 VYN560 l i Detection of Pipp_Ilrenks Class 1 pipe breaks inside the drywc!! (LOCAs) will cause a high drywell pressure and low RPV level, as well as other detectable conditions (e.g., rising temperatures in the drywell). Reactor SCRAM and ECCS actuation will occur if drywell pressure continues to increase and/or reactor water level continues to drop. Other detection capabilities depend on the specific system pipe that falls (e.g., a large steam line break results in low steam line pressure automatic MSIV closure) and the site of the leak. For example, small leaks will likely be detected per VY technical specification 3.6.C (Reference 6).

Technical specification 3.6.C " Coolant Leakage" . requires that unidentified and total leakage into the primary containment not exceed 5 and 25 gpm, respectively, While in the run mode, leakage into the primary containment from unidentified sources can not exceed a 2 spm change. Both the sump and air sampling systems shall be operable during power operation to assure detection.

- Reactor coolant leakage shall be checked and logged once a shift, not to exceed 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />, Pipe breaks outside the drywell can also be detected. The VY class I piping outside the drywellis limited to the reactor building and steam tunnel, as summarized in Table 4 2. This piping is also limited in that the outer containment isolation valve that provides the class break is relatively close

, to the outer drywell wall. Detection is described for two different conditions; (1) high energy LOCAs outside containment which cause initiating events and (2) Independent demand challenges of mitigating system piping which leads to water being pumped into the reactor building by the mitigating system pipe failure.

For the Orst condition, high energy line breaks in the reactor building can be detected by high temperatures, high radiation, and/or high water levels. All three of these detectable elements are entry conditions into emergency operating procedure EO 3105 " Secondary Containment Control" (Reference 7). This procedure directs the operators to isolate systems discharging into the area except those required to shutdown the reactor and assure adequate core cooling. If the primary system is the source and adverse conditions persist (e.g., water level reaches 12 inches in a corner room), the operators are directed to shutdown the reactor and go to OT 3100 (scram procedure),  ;

If adverse conditions persist in more than one area (e.g., water level is 12 inches in more than one corner room), the operators me also directed to OE 3102, Section RPV ED, to depressurize the reactor (Reference 7). This procedure ensures use of the main condenser and turbine bypass valves if available. Large high energy line breaks will likely result in a reactor scram due to low RPV level, liigh energy line breaks in the steam tunnel will be detected by high area temperature and J automatic MSIV closure will also occur on high area temperature (Reference 2, Section 3.2,11).

If high area temperature persists, both IIPCI and RCIC isolation will also occur (Reference 2, Sections 3.2.1 and 3.2.4).

For the second condition, pipe breaks are also postulated during an independent demand of a mitigating system for those systems that are normally isolated from reactor operating conditions.

These systems include LPCI injection, core spray injection, and standby liquid control. All of this piping is k cated in the reactor building. This piping will pump the contents of the suppression 7nm

Page 30 VYN560_1 pool or SLC tank into the reactor building if not isolated. Flooding in the reactor building will be detected first by Hoor drain alarms and entry into OE 3105 is likely (see above). Also, loss of torus level is an entry into OE 3104 (Reference 7) Similar to OE 3105, the operators are dhected to shut down the reactor (OT 3100) and depressurize the reactor (OE 3102 RPV ED). In addition, if level continues to drop below 6.5 feet, the operators are further directed to line up injection sources that take suction external to primary containment.

belal!n!1 The ability to isolate a break is evaluated and credited,if feasible. As described previously, piping line numbers are separated into segments based on isolation potential to allow distinguishing piping which can be isolated. Check valves and isolation valves with automatic signals are credited as providing reliable automatic isolation. The following lines and isolation valves are j credited with automatic isolation; the valves are shown in Figure 4-1.

l l e \

hiain steam lines down stretun ofinside h1SIV 80A,800,80C, and 80D which isolate on j

several different signals including low steam line pressure, low low RPV level, and high area 1 temperature in steam tunnel.

• Feedwater lines upstream of check valves 28A and 288.

Reactor water cleanup suction piping downstream of h10V15 which isolates on several j different signals including low RPV level, e

llPCI steam downstream of h10V15 which isolates on several different signals including high j steam line now and high area temperature in the steam tunnel.

RCIC steam downstream of h10V15 which isolates on several different signals including high steam line flow and high area temperature in steam the tunnel, e

RilR shutdown cooling suction downstream of h10V18 which isolates on low RPV level.

The above cases apply to piping that is normally connected and open to the reactor during normal power operation except for RllR shutdown cooling which is open to the reactor during shutdown. In all cases, the pipe failure causes an initiating event (isolable LOCA, ILOCA in Table 41, column "lE"). They become a transient when isolation is successful and a LOCA when isolation fails.

When piping is normally isolated from the reactor (standby configuration), there are two types of events that are evaluatedt the valves are shown in Figure 41.

Potential LOCAs (plOCA) which require a valve disc failure, providing reactor pressure as the piping challenge. No credit is allowed for isolation of these events.

For mitigating systems, an independent accident demand challenge is assumed. This applies to the 1.PCI, core spray, and SLC injection paths. With regard to SLC, isolation is not credited since it would likely make SLC unavailable anyway, and the SLC tank volume is not sufficient to impact other mitigating systems. The event of interest is a break outside the drywell in the LPCI and core spray injection paths because the suppression pool could be pumped into the reactor building. Since environmental conditions are much less severe than LOCAs outside 7n/97

Page 31 VYN560_1 containment and there is adequate detection, credit is allowed for remotely tripping the pumps and/or closing h10Vs (see Table 41).

Spathil Arram'ement & Impacts Outside the Drywell Spatial effects are included in the " impact" column of Table 4 1. hiost class 1 piping is inside the drywell. For this piping, there is containment of pipe failures and no propagation other than blow down and dralnage to the torus. All automatic isolation valves credited in the analysis and identified in Table 4 1 are located inside the drywell and are containment isolation valves qualified for design basis LOCA conditions. Valves inside the drywell and credited for isolation include l

h1SIVs, RCIC steam line h10V15, llPCI steam line h10V15, SDC h10V18, and reactor water cleanup hiOV15. The LPCI and core spray injection paths are spatially separated in the drywell such that sprays and pipe whip due to a failure in one recirculation loop or injection path is unlikely to effect the other loop or paths. The probability of spray impacts preventing isolation is judged unlikely based on the design qualification of these valves. The limited piping outside the i drywell is described below and in Table 4 2 with an explanation of the potential for propagation i and its impact.

Based on a review of plant arrangements (Reference 8), the VY internal flooding study note books (Reference 9), and PRA (Reference 2), propagation is described below and in Table 4-2:

e LOCAs in the reactor building, during power operation, through the LPCI injection, core I

spray injection, and shutdown cooling suction paths (ISLOCAs in the VY PRA, Reference 2, f

Section 3.1.1) are assumed to eventually fail ECCS by pumping down the suppression pool.

These are relatively large LOCAs and environmental conditions could also impact the hiCCs that provide the ability to align an external water source through LPCI A. Based on the VY PRA, core damage is assumed for these ISLOCA initiators (see Table 2-1).

Based on the VY PRA, during a reactor water cleanup LOCA in the reactor building, credit can be taken for the use of condensate as an external water source in the long term (Reference 2, Section 3.1.3). This piping is smaller than LPCI and CS, therefore the LOCA causes a slower loss of reactor inventory 110 wever, it is still assumed in the VY PRA that eventually ECCS will fail due to flooding or loss of suppression pool outside the containment. The SLC LOCA is even smaller and was not evaluated in the VY PRA. Ilowever, based on location and pipe size the reactor water cleanup LOCA can be assumed to envelope the SLC event.

LOCAs in the steam tunnel will propagate into the turbine building via blowout panels and also into the reactor building through a door on El 252. Water will flow toward the reactor building El 252. In the VY PRA, the environmental impacts on equipment in the reactor building are assumed to be minor (Reference 2, Section 3.1.3). The spatial arrangement of critical electrical components in the reactor building is not in the direct path of steam and water release (References 8 and 9). The room on El 252 is large and vents directly to higher elevations through an equipment hatch and stairs. Still, all LOCAs in the steam tunnel are assumed to disable feedwater, main condenser, llPCI, and RCIC. Feedwater breaks are conservatively assumed to drain the suppression pool and eventually fail all ECCS. This is based on the assumption that operators will control reactor water level high enough to intinue pumping suppression pool through the feedwater sparger,into the steam tunnel

Page 33 VYN560_1 (Reference 2, Section 3.1.3). Steam line breaks are not likely to drain the suppression pool, thus, low pressure ECCS is credited.

The following further explains propagation and arrangement in the reactor building starting from the high elevations (all elevations have floor drains to drain tanks in the torus room at El 213) based on Reference 9:

El 318 the standby liquid control piping is located here. Flood propagation is through a large equipment hatch and under doors down to El 280. Equipment on this location is protected and/or on berms such that there are no flooding impacts at this elevation.

EL 280 core spray and reactor water cleanup piping is located here. Propagation is through a large equipment hatch and open stainvay to El 252. Scram and ECCS actuation cabinets are l in the area, but impact is more likely to be actuation success due to the de-energize to actuate design, hiCCs 80 and 90 are located on this floor, but it takes about a foot of water to impact an MCC. Flooding to I foot is very unlikely given the propagation paths.

El 252 LPCI and SDC piping is located here. Flood propagation is initially through the torus access hatch (Southeast corner of torus room), CRD access (Southwest corner which ine; m..s llPCI), and under the Northwest stairway door (1 inch gap) which includes the RCIC room.

MCC89A & D are located on this floor but it takes about a foot of water to affect the MCCs.

The torus room and IIPCI corner room connect and provide a very large area for floods to collect. This is where the torus and Cli D access opening and floor drains propagate. The NW l

t door leads to the RCIC room, but only 300 to 400 ppm is expected (assuming 4 inches of water) to pass under this door. Water levels on EL 252 must reach 4 inches to overflow the berm at the RilR ceiling chases and 6 inches to overflow the stairways to the RilR corner '

rooms, it has been estimated that over 2,500 ppm is required to sustain 4 inches on the North end of El 252. This is due to a restricted area between the hatch enclosure area and the East end of the floor which restricts flow to the South end of the building where the torus and CRD access openings provide easy piopagation to El 213. Thus, a >2500 gpm break on the North end of El 252 propagates into the NE RilR corner room (train A of RilR and CS). This would impact train A of RilR and core spray quicker than for the case where propagation is into the South end of the building. All propagation from higher elevations (e.g., El 280 which contain core spray) is into the South end of El 252. Thus, there is easy propagation through the access opening to the torus and llPCI rooms on El 213. It has been estimated that >8,000 gpm is required to sustain 4 inches on the South end of El 252 where propagation would occur into both RilR corner rooms. This is not considered a likely scenario in this analysis, lnitiatinn Events There are two types of initiating events or demands considered in this analysis:

1. The pipe failure causes a direct initiating event. In this case, conditional core damage probability (CCDP) is determined in Section 4.3 considering the initiator and any other impacts on mitigating systems. Table 2-1 provides the CCDP for each plant initiator, la place of Table 2 3 (e.g., determining backup trains), an equivalent CCDP is estimated with the VY 7nm l

l I

Page 33

, VYN560_1 PRA. Table 3 1 provides the CCDP values for transient initiators with RCIC or llPCI '

unavailable, which were needed for the Table 2 3 evaluation of CCDP. The basic principles of defense in depth and single fallule for safety functions, hicluding containment perfonnance, are included in the evaluation.

2. When the pipe failure does not cause a direct initiating event, an independent demand for the system under evaluation is assessed. For this condition, the failure is assumed to occur during the " demand" configuration as described in Section 4.1. The frequency of challenge demand i

depends on the system and is provided in Table 4 1 (see columns "lE" and " Qualitative Basis" and "CCDP" and the notas). Conditional core damage probability is determined in Section 4.3 considering the fmquency of challenge, exposure time for the challenge, and the number of backup mitigating trains. In place of Table 2 2 (e.g., determining backup trains), an equivalent CCDP is also estimated. The basic principles of defense-in depth and single failure for safety l

functions, including containment performance, are included in the evaluation.

The independent accident demand initiator assumed in the analysis for LPCI and com spray piping is a LOCA (unexpected frequency of challenge in Table 2 2) based on system design basis and I

expected frequency of challenge in the IPE (See Table 2 1). For standby liquid control, an anticipated frequency of challenge (transient) in Table 2 2 is assumed based on system design basis and expected frequency of challenge in the IPB (see Table 21),

4.3 Impact Group Assessment The FMEA (Table 4 1, column " Qualitative Basis") identifies which impact group assessment is utilized in the evaluation by referring to Table 2 1 or 2 2 or 2 3.

As indicated in Section 2, Table 2 1 is utilized when the pipe break causes an initiating event with no other mitigating system impacts. Note that loss of a LPCI or core spray injection path is

- always assumed in the VY PRA for large LOCAs (LLOCA); therefore, this does not require the use of Table 2-3 (Reference 2, Section 3.1.2.1) CCDP is the same whether Table 2-1 or 2 3 is utilized.

For normally isolated piping, a potential LOCA is evaluated. The assessment of a potential LOCA (PLOCA in Table 4 1, column IE) utilizes the CCDP in Table 2 1 for the applicable LOCA size

and type (e.g.,6 inch pipe in the drywell utilizes the LLOCA CCDP) and the probability of a -

passive valve failure. This calculation is summarized in the comments section of Table 4-1.-

Also, for normally isolated piping, the demand configuration is evaluated (Table 2-2), The system impact group assessment with Table 2 2 is based on the following:

The frequency of challenge in Table 2 2 for LPCI and core spray injection piping is " Design Basis Category IV" whleh is identified as a "LOCA" initiating event in Table 4 1. As shown in Table 21, the total frequency for all LOCA initiators is about lE 2/yr.

70/97

Page 34 VYN560.1 e

llecause Class I piping is not tested, the exposure time is assumed to be "all year" for the demand configuration. Leaks during standby or operating configurations are assumed to cause un initiating event (e.g., Table 2 2 does r.ot apply).

The number of backup trains are identified and Tr.ble 3 2 utilized to estimate the unavailability value for the backup trains.

As described in Section 2, containment performance is considered in detennining the Gnal consequence category. A containment barrier is required or the consequence evaluation must I show margin. The shaded cells in the "hnpact" column of Table 4-1 identifies pipe segments and configurations where containment bypass has occurred as part of the CCDP estimate if there is not enough margin in the CCDP, the " consequence" column is shaded to denote that the I l consequence has been increased. The following summarizes the analysis results:

l e All class 1 pipe breaks inside the drywell have at least one barrier, including an isolation valve, outside the drywell. Therefore, the consequence ranking for this piping is not affected.

e

' Class 1 pipe breaks outside the drywell postulated for the accident demand conDguratian l (LPCI, CS, and SLC inlection) have an isolation valve inside the drywell. This valve is not included in the evaluation of core damage, bect.use it's closure is not relevant. Therefore, the i consequence ranking for this piping and emDguration is not affected.

I'

• ISLOCA (interfacing system LOCf.) and LOCA OC (LOCA outside containment) events postulated for class I piping oi.aside the drywell, where the inside drywell isolation valve is postulated to fall, are potenCally affected. These core damage scenarios include failure of the inside isolation valve and pipe failure outside the drywell between the drywell and outer isolation valve (containment bypass). The ppe segments and configurations which have core damage CCDP estimates with containmein bypass in Table 4 1 are denoted in the " Impact" column by a shaded cell, in some cases, either the segmert was already a "lligh" consequence or there was margin to preclude the need for increasing the consequence. The llPCI steam line and main steam drain header were increased from " Low" to " Medium." The reactor water cleanup suction and SLC discharge lines were increased from " Medium" to "liigh." It should be noted that for several of these LOCAs outside the drywell, ECCS is not guaranteed to fall immediately either due to the environment or pumping the suppression pool into the reactor building. The probability that core damage with containment bypass occurs early (e.g., more risk significant) rather than late is less than ' O.

Instrument I in_es Instrument line breaks are evaluated in the VY PRA (Refemnce 2, Section 3.1.1). A variable line break causes level transmitters to read false low which will cause scram and MSIV closure. ECCS is not disable, but is actuated before it is required due to the false low level, llowever, the false low level will disable the automatic high RPV level trip for liPCI, RCIC, and feedwater (high level trip requires high level on both instrument loops). Operators would have to fall to control level in order for an overfill event to Dood steam lines. Although this could impact IIPCI and RCIC, the overfill event provides time for operator recovery actions.

7n/97

Page 35 VYN560_1 A leference line break appears to provide the limiting impactst it causes level transmitters to read false high and pressure transmitters to read false low. Since a high level is required in both loops to trip feedwater, RCIC, and lipCI, these systems are not tripped off line. The limiting impact appears to be the false high level disabling half of the low RpV level ECCS actaation signal.

Ilowever, ECCS is not disabled and plant response is to a small LOCA since this piping is 1 inch and less. A false low pressure signal will satisfy half of the ECCS signal and low pressure permissive, thus, providing a success for ECCS, Also, false signals will disable half of the low level and high pressure scram signals, as well as MSIV closure, llowever, there are redundant and diverse signals. Italf of the Rirr/ARI logic is disabled, but the other redundant half is available.

In summmy, the reference leg break is most limiting, but no automatic function is completely disabled. The reliability of these actuation systems is high even with one train disabled and these are small lines that result in a relatively small LOCA. Therefore, the conditional probability of core damage, given an instrument line break, is on the order of IE 6, the same as small LOCA in Table 21.

l Sampk[dpes and Other Small Connections 1

Because small LOCAs have a CCDP on the order of IE 6 and these lines are 1 inch and less, they fall into the " Low" consequence category. They do not impact any mitigating systems.

CRD Inlet & Outlet There are 89 pairs of CRD scram inlet and outlet lines. A break of one of these lines could affect operation of a single control rod, but this is considered an insignificant risk. Also, these lines are 1 inch and less, thus, the small LOCA CCDP of IE-6 is used as with other small lines described above. One potential consequential event is an outlet line break in the reactor building. Initially this line would be spilling reactor coolant into the building at EL 252 rather than the CRD discharge volume. As the reactor is shut down and cooled down, the leakage would turn to hot water and the environmental consequences would turn less severe. This piping is % inch and the

- environmental consequences are enveloped by other high energy line breaks which provide the basis for environmental qualification.

Q1her Modes of Oncration The consequence evaluation is an assessment assuming the plant is at power. Generally, the at.

power plant configuration is assumed to present the greatest risk for piping since the plant requires immediate response to control reactivity, heat removal, and inventory control; the plant is critical, and at higher pressure and temperature in comparison to shutdown operation. The potential importance of piping during plant shutdown is evaluated here to establish confidence that power operation envelopes and/or determine where a higher consequence should be assigned.

Pipe segments that are already a "lligh" consequence from the evaluation at power need not be evaluated for shutdown. Those that are already " Medium" require some confidence that liigh would not occur due to shutdown configurations. Ilowever, a " Low" consequence for power operation requires more confidence that a liigh would not occur and some confidence that a Medium consequence would not occur. Taking this into account, a review & comparison of system consequence results for power operation versus potential consequence during shutdown 70/97 -

/

s "

page 36 VYN560_1 operation was conducted. Table 4 3 documents this review. It was concluded that RilR operation in the shutdown cooling (SDC) mode needs further analysis :ccognizing that the piping is aheady

" Medium" or "lligh" for power operation. A further review of RilR is provided below to determine whether " Medium" could b: "lligh" because of shutdown risk.

Other assumptions and observations about shutdown operation considered in this review include the following:

e During shutdown, some equipment may not be automatic and require manual actuation, ilowever, outage risk management philosophy, guidelines, and procedures provide assurance that loss of SDC will be detected and mitigated.

• Unavailability of mitigating trains is higher due to planned maintenance during outages.

llowever, guidelines and procedures assure sufnelent redundancy and account for higher risk configurations.

• For the majority of class 1 piping, the exposure time associated with operation in a shutdown con 0guration is on the order of 0.1/yr. Also, the operating conditions are much less severe than during power operation. The frequency of twing in a more risk sign 10 cant configuration could be even lower depending on the system and function being evaluated. 0;wration of RilR in the shutdown cooling (SDC) mode of operation is an important exception.

e The rea, tor is shutdown, depressurized, and decay heat is lower than for at power operation.

The reactivity control function is not a conceribecmne the rods are inserted. Re-criticality during shutdown is unlikely and not judged to effect the present ranking. The inventory makeup function is considered the most important function during shutdown, given a class I pipe break occurs during shutdown causing loss of SDC.

• During shutdowr, the reactor coolant system and connected piping are not pressurized nor at high temperatures, as during power operation. Piping failures are not as likely (e.g., initiating events) and the at power analysis for these systems envelope shutdown conditions. Since the RilR system is aligned to the reactor coolant system in the SDC mode of operation during most of the outage versus being isolated from the reactor in standby during power operation, this system is evaluated further below.

• Decay heat is lower during shutdown such that the time for recovery of shutdown cooling or inventory makeup is usually longer. Thus, even though equipment may require manual actuation and may also be in maintenance, there is time for recovery. LOCAs (considered less likely due to reduced pressure and temperature) would exhibit much less severe environmental conditions (e.g., hot or warm water versus steam) until decay heat starts to heat up the core after loss of SDC, That portion of RilR that is in standby during power operation and operates in the SDC mode during an outage presents an important configuration change requiring further evaluation. Loss of SDC is an important in.i.lating event during shutdown and the potential for an unisolated LOCA in the RilR system must also be considered.

The following summarizes the review of RilR pipe segments relative to power operation:

7n/97

Page 37 VYN560 I

• SDC suction piping upstream of h10V18 is already "lligh" in Table 41 due to a LLOCA during power operation. The SDC discharge paths back to the recirculation loops are also "lligh" in Table 4 1 for the same reasons.

• SDC suction piping downstream of h10Vl8 inside the drywell is a " Low" consequence during 1 power operation because passive failure of the normally closed MOVl8 is necessary to l challenge piping. During SDC, h10Vl8 is open, but it closes automatically on a low RPV level signal. Although this disables SDC, there is time for automatic and manual recovery of reactor makeup. Failure to do so after isolation success is unlikely (e.g., on the order of IE-4 or less). The probability of MOVl8 failure times the probability of not recovering reactor makeup with the reactor drained down to theJet pumps is also unlikely (e.g., on the order of IE-4 or less). Pipe breaks on the suction side envelope breaks on the discharge where there is a check valve to isolate the reactor. These breaks could still pump down the reactor inventory until the low level isolation signal is reached. Failure of this piping is increased to a " Medium" consequence in Table 4 1 based on consideration of pipe faihire during SDC operation.

• SDC suction piping downstream of MOV18 outside the drywell is already a "lligh" consequence during power operation because passive failure of the normally closed MOVl8 is assumed to cause an ISLOCA in the reactor building. Failure of this piping during SDC is still considered a " Medium" consequence in Table 4 1 for similar reasons described above. The LOCA conditions (failure of MOVl8 to close automatically)in the reactor building during shutdown are much less severe with regard to the potential impact on mitigating systems. The fact that water is being lost outside contalmacnt is a concern in the longer term. Pipe breaks on the suction side envelope breaks on the discharge where there is a check valve to isolate the reactor. These breaks would still pump down the reactor inventory until the low level isolation signal is reached.

in summary, most RilR class I piping was already in the "liigh" or " Medium" category based on power operation. The SDC piping segment between MOVl8 and the drywell was increased from a " Low" consequence to a " Medium" consequence based on potential consequences during shutdown.

8hternalEvents The consequence evaluation is an assessment utilizing design basis information and the plant PRA for intemal initiating events. Pipe breaks in this analysis that cause an initiating event are no different than those in the PRA, but their frequency is 1.0/yr (assumed to occur). External causes of pipe break are obviously less than 1.0/yr. When the pipe break does not cause an initiating event, the piping is analyzed for the demand or system challenge case. The frequency of challenges from fire and seismic on mitigating system: is less than assumed in the analysis. (e.g.,

core spray challenges due to LOCAs or loss of high pressure makeup systems is on the order of IE-2/yr), Seismic and fire challenges are not greater than IE 2. Even if these events beyond the design basis are low in frequency, their potential common cause effects could affect the importance of piping. Therefore, the potential importance of piping during external events beyond the design basis is assessed here to establish confidence that the existing consequences envelope 7D/97

Page 38 VYN560_1 and/or to determine if a higher consequence should be assigned, it was concluded from the evaluation below that no consequence assignments need to be changed Pipe segments that are already a "lligh" consequence from the evaluation need not be evaluated for external events. Those that are already " Medium" require some con 0dence that liigh would not occur due to external events. Ilowever, a " Low" consequence requires more confidence that a liigh would not occur and some confidence that a Medium consequence would not occur. Taking this into account, a review & comparison of system consequence results versus potential consequence during external events was conducted.

The following observations can be made, in general, for all external initiators:

e For piping which is assumed to cause an initiating event in the present analysis (reactor coolant system, connections to reactor coolant system, and operating systems), external initiating events should not have an impact on pipe importance. The frequency of the initiator l

1s already 1.0 in the present analysis. The frequency of the external event causing a pipe falluie is low and the probability of an external event simultaneously with the pipe break is also low.

I e Based on the above, it is expected that piping in mitigating systems that respond on " Demand" to external initiating event challenges are more likely to be effected. The frequency of challenge and impacts on redundant mitigating functions due to the external initiator are considered.

The VY IPEEE (Reference 3) has not been completed and submitted to NRC, but major portions of the evaluation have been finished. This information, along with insights from other external event PRAs is used to assess whether external initiating events with their common cause impacts on mitigating systems could impact the analysis ranking. The following summarizes the review for each of the major hazards (seismic, fire, flood, and other):

Seismic Challenges - It can be concluded that a plant flCLPF (high confidence low probability of iallure) close to a 0.3g screening value will be provided for the plant when all outliers are resolved per Reference 10. The potential effects of scismic initiating events on consequence assignment is assessed by considering the frequency of challenging plant mitigating systems and the potential impact on the existing consequence category. The following summarizes this assessment:

Piping in the analysis scope will have a capacity much greater than the 0.3g screening value and is not considered likely to fait during a seismic event.

Most class I piping is already assumed to cause an initiating event in this analysis, The .

frequency of an earthquake induced pipe failure in these systems is less than assumed in the i present analysis. Also, the likelihood of a coincidental seismic event during or after a pipe break is low.

Reactivity control is unlikely to be effected by seismic events because it de-energizes to '

actuate. In fact, the carthquake is more likely to cause a scram. A very large carthquake could cause mechanical failure of the core and/or prevent rods from entering the cote. Ilowever,

, 2nm

Page 39 VYN560_1 such a low probability event would likely impact most functions due to equipment failures, causing core damage. The importance of piping becomes less important at this point and it is a low probability event. Similarly, vapor suppression is relatively passive and a LOCA is required. Also, containment venting can be accomplished without suppon systems. Thus, RPV inventory control (high pressure and low pressure injection) is judged to be most impcrtant.

With regard to mitigation, a likely scenario would be loss of offsite power due to the seismic event. The seismic capacity of offsite power has been found to be limiting with respect seismic capacity and its impact on the plant is important because it causes the unavailability of feedwater, main condenser, and all equipment dependent on normal AC power, u also challenges the emergency diesels (usually less reliable than the numerous trains of raitigating systems they support). Based on a typical fragility for LOSP (Reference 11), a llCLPF of about 0.lg can be a;sumed. This fragility when combined with the seismic hazards developed for the VY site (References 12 and 13) indicate the unconditional frequency of a seismically induced LOSP is less than IE-4/yr. Since the analysis includes initiating event challenges on the order of 1 E-2 for LPCI and core spray, the seismic challenge is enveloped by the present analysis. Note that 1E-4 aloac provides the basis for a " Medium" CCDP.

It is concluded that scismic challenges could be closer to a " Low" consequence than the "lligh" l

and ' Medium" consequences already determined in the analysis. Therefore, funher detailed evaluation is not necessary.

l Fire Challenges - Important fire scenarios usually involve impact on multiple mitigating systems

' and/or support systems because of their common cause effect. Similar to seismic events, fires are not likely to impact reactivity control nor cause LOCAs unless it is a stuck open relief valve.

A Fain, the inventory control function isjudged most imponant.

For reactor coolant and connected pipig , whose failure causes an initiating event in the present analysis, the frequency of a concurrent fire ev.mt is small and does not influence the importance of this piping. With regard to standby piping, which is evaluated for the demand configuration, the frequency of mitigating system challenges from fires is less than assumed in the present analysis.

For example, the frequency of challenging LPCI and core spray injection piping depends on a fire causing a LOCA condition (e.g., stuck open SRV) and/or loss of all high pressure makeup sources. This frequency is less than used in the current analysis. A fire scenario that leads to loss of high pressure makeup or a stuck open SRV and fails one or more trains oflow pressure injection is also judged to be enveloped by the present analysis. '

Because LPCI and core spray piping is already " Medium" and "High" consequence, it was concluded that the present analysis envelopes the impact from fires.

An dallenges - important flood scenarios at VY occur outside the drywell. The analysis of class I pipmg inside the drywell considers and envelopes flooding impacts. Similar to fires, a flood induced initiating event that challenges low pressure injection piping or other class I piping is less likely than the demand already included in the evaluation. Both low and high pressure injection pumps are located in the basement of the reactor building. HPCI, RCIC, and each train of RHR &

7D/97

Page 40 VYN560 I core . spray are located in separate corner rooms. Based on physical arrangement, it is difficult to flood these pumps; an unlikely scenario (see previous discussion of 4patial arrangement). In any  !

case, an extreme Hood of all pumps would make consideration of piping almost irrelevant.

Other Challenges - other hazards also have a low frequency of challenging analysis scope piping and are less likely to impact mitiga:Ing systems. The discussion of seismic and fire can be assumed to envelope, i

l l

5 76/97

Page 41 VYN560_1 Figure 4-1 Simplified Diagram of Class 1 Piping Systems m Drvwell Wall RCIC HFCI MOV16 MOV15 MOVI5 MOVl6 e MS C MS B e us a MS m

CS B >h< N M k

?, CS A MOVl2B V13B V13A MOV 12 A V29B RPV g, FW B W V96A N

V28B X

Z y2gg 4

V27A g, 4 Recite Recire LPCI B N j Z

V46A MOV25A MOV27A LPCI A MOV27B MOV25B V46B y

\

+ W V17 V

VI6 sLC gV49 Note that manual valves, MSD, and small piping act shown V50' MOVIS @ @ MOVI5 M.- t I

1. M..

RHR SDC CUW Suetion Section 7U/97

Page 42 VYN560__I Table 4-1 FMEA and Impact Grot p Assessment Summary 2

Line Number / Segment Config IE' Detection Isolation

• Impacts' Ocalitative Basis' CCDP' Congxnce 28-PLR-A Operating LLOCA Yes (a) No (a) LPCI A, Table 2-1 (d) 6E-4 High SDC (a) 28-PLR-D Operating LLOCA Yes (a) No (a) LPCI B Table 2-1 (d) 6E-4 High i 4-PLR-A Operating MLOCA Yes (a) No (a) none Table 2-1 SE-5 Medium l 4-PLR-B Operating MLOCA Yes (a) No (a) none Table 2-1 8E-5 Medium 4-CUW-18 Operating MLOCA Yes (a) No SDC (a) Table 2-1 SE-5 Medium (R11R to MOVl5) 4-CUW-18 Operating ILOCA Yes (a)(b) MOV15 T-transient. Table 2-1 (c) 3E-7 I; w (MOV15 to drywell) SDC(a) failure MLOCA MOV

• Table 2-1 i 4 E-3 *8E-5=3 E-7 Low 4-CUW-18 Operating ILOCA Yes (b) MOV15 T-transient, Table 2-1 (c) 3E-7 lev (drywell to MOVl8) SDC (a) failure LM1100l MOV

• Table i 2-1 4 E-3

• l E-2=4E-5 i3Highdi 2-CUW-19 & 400 Operating MLOCA Ye:,(a) No SDC (a) Table 2-1 SE-5 Medium y 24-RIIR-28 Standby PLOCA Yes (c) CV 46A & CV

• Table 2-1 i 2E-3

• 1.0=2E-3 liigh (MOV27A to MOV25A) MOV25A Demand LOCA Yes (d) trip pumps or LPCIA IV* Table 2-2 (a) 1E-2* IE-3=1E-7 Low close MOV27A (2.5 backup: 2 CS trains & LPCI B) failure All ECCS IV*Isol (Table 2-2) 1 E-2* l E-2= l E-4 Medium 24-R1IR-28 Standby PLOCA Yes (c) CV 46A @i CV

• Table 2-1 i 2E-3

• 1.0=2E-3 Ifigh (MOV25A to daywell)

Demand LOCA Yes (d) trip pumps or ITCIA IV* Table 2-2 (a) 1E-2* 1E-5=1 E-7 Low 1 close MOVs (2.5 backup: 2 CS trains & LPCI B) failure AllI CCS IV*Isol (Table 2-2) I E-2* I E-2=l E-4 Medium 24-RIIR-28 Standby PLOCA Yes (n) CV 46A LLOCA, CV i* Table 2-1 (d) 2E-3*6E-4=1E-6 Low (drywell to CV 46A) LPCI A Demand LOCA No No LPCI A IV* Table 2-2 (a) 1E-2* 1E-5=1E-7 Low (2.5 backup: 2 CS trains & LPCI B) 24-RIIR-30 Standby I1OCA Yes (a) No IECI A Table 2-1 (d) 6E-4 Ifigh (CV 46A to recire loop A) 7/7/97

Page 43 VYN560 I Table 4-1 FMEA and Impact Group Assessment Summary Line Number / Segment Config IE'- Detection 2 Isolation

• Impacts' Qualitative Basis' CCDP* Consequence 24-RilR-29 Standby PLOCA Yes (c) CV 46B & A CV.* Table 2-1 2E-3

• 1.0=2E-3 High

@;fSLOC'@Md (MOV27B to MOV25B) MOV25B Demand LOCA Yes (d) trip pumps or LPCI B IV* Table 2-2 (a) 1 E-2* 1 E-5=1 E-7 Low close MOV27B (2.5 backup- 2 CS trains & LPCI A) failure All ECCS IV*lsol (Table 2-2) I E-2

• I E-2=l E-4 Medium 24-RHR-29 Standby PLOCA Yes (c) CV 46B &ISLOCA CV i* Table 2-1 2E-3

• I .0=2E-3 Ifigh (MOV25B to drywell) DINY Demand LOCA Yes (d) trip pumps or LPCI B IV* Tat,le 2-2 (a) I E-2* I E-5=1 E-7 Imv close MOVs (2.5 bacLup: 2 CS trains & LPCI A) failt:re All ECCS IV*Isol (Table 2-2) I E-2* l E-2=l E-4 Medium 24-RIIR-29 Star Jby PLOCA Yes (a) CV 46B LLOCA , CV

• Table 2-1 (d) i 2E-3 *6E-4=1 E-6 I.tw (drywell to CV 46B) LPCI B Demand LOCA No No LPCI B IV* Tabic 2-2 (a) iE-2* I E-5=1E-7 Imv (2.5 backup: 2 CS trains & LPCI A) 24-RHR-3i Standby LLOCA Yes (a) No LPCI B Table 2-1 (d) 6E-4 High (CV 46B to recire loop B) 20-RIIR-32 Standby 110CA Yes (a) No SDC(a) Table 2-1 (d) 6E-4 liigh (recire loop A to MOV18) 20-RilR-32 Siandby PLOCA Yes (a) MOV18 LLOCA . MOV* Table 2-1 (d) I E-3 *6E-4=6E-7 Imv (MOVI8 to drywell) SDC(a)

Operating ILOCA Yes (e) MOVIS SDC CCDPsn <! E-4 (note 7) Medium in SDC failure I1OCA MOV i* CCDPsn <1 E-4 (note 7) Medium 20-RIIR-33 Standby PLOCA Yes (c) MOVl8 MOV* Table 2-1 IE-3* I .0=I D3 High (drywell to MOVl7) Operating ILOCA Yes (e) MOVl8 SDC CCDPsn <1E-4 (note 7) - Medium

. in SDC fai!ure MOV i* CCDPsn l inch entry level of OE 3105 " Secondary Containment Control". The j loss of torus pool level will put the operators in OE 3104 " Torus Temperature & Level Control" Also, depending on the LOCA size, there  !

could be a mismatch between flows and pressures in low pressure systems versus the reactor.

(e) During shutdown cooling operation, MOVl8 automatically closes on low RPV level.

(f) Loss of feedwater is automatically isolated by inside drywell check valve 28A and B. 1 (g) MSIV 80A, B, C, and D automatically close on high steam line flow or low-low RPV level. f (h) MSIV 80A, B, C, and D automatically close on high steam line flow or high steam tunnel temperature or low-low RPV level. 1 (i) RCIC MOV 15 (MCC 88, Vol 29, El 280) automatically closes on high steam line flow.

(j) RCIC MOV 15 automatically closes on high steam line flow or high steam tunnel temperature.

(k) IIPCI MOV 15 (MCC 9D, Vol 34. El 252) automatically closes on high steam lic: flon (1) IIPCI MOV 15 automatically closes on high steam line flow or high steam tunnel tempeiature.

(m) SLC LOCA outside containment - see (c) above.

(n) MSD LOCA outside containment - high steam tunnel temperature which will cause MSIV closure.

' Isolation - The system motor operated valve (MOV), check valve (CV), etc. is shown, when applicable. Wien isolation success and failure are evaluated, the first line will identify the relevant valve and/or action for isolation success case. Then, the next line with the word " failure" denotes evaluation of the isolation failure case. His may apply to isolabfe LOCA (ILOCA in column IE) initiators or the demand LOCA. For the case where a passive valve failure is necessary to cause an initiator,110CA is shown in the initiating event (IE) column (by definition the valve fails).

(a) He reactor recirculation loop discharge stop valves and 1:ypass valves close at 350 psig (Reference 2, pages 3.1.2-2 and 3.2.2-1).

Reactor recirculation piping ami connected piping between these isolation valves and the suction isolation valve in each loop could be isolated. This was not credited in the analysis.

7/7/97 i . _ ___ _.

Page 49 VYN560_1 4

Impact - this column identifies system / train impacts due to pipe failure, including spatial impacts. He initiating event and its associated impact is {

- identified in the "IE" column except for potential and isolable LOCAs (FLOCA and ILOCA in column "IE"). De applicable LOCA or initiator in j Table 2-1 for PLOCA and ILOCA is identified in this column and may depend on isolation success and failutt:-

(a) Shutdown ecoling (SDC) is not modeled in the VY PRA and isjudged to have low importance. Note that SDC is unlikely to provide successful heat removal for LOCAs particularly water LOCAs. Loss of SDC as an initiating event during plant shutdown is assessed as a separate configuration for the suction piping downstream of MOV18.

5 Qualitative Basis - the basis for quantifying total CCDP is provided, including Table 2-1,2. or 3 to denote applicable " Impact Group Assessment" MOV i= failure ofinboard MOV (RCIC or CUW) to close on demand = 3.6E-3 (Reference 2)

MOV 2= failure ofinboard MOV (HPCI) to close on demand = 1.1E-3 (Reference 2)

MSIV = failure of inboard MSIV to close on demand = 6.4E-3 (Reference 2)

CV,w = failure of feedwater inboard check valve to close on demand = 8.4E-4 (Reference 2)

CV i= passive check valve failure (quaverly test) = 6.8E-7/hr

• 2190 hrs (Reference 2) + 2.7E-4/ demand (NSAC-154) = 1.8E-3 CV 2= passive check valve failure (refuel test) = 6.8E-7/hr

• 8760 hrs (Reference 2) + 2.7E-4/ demand (NSAC-154) = 6.2E-3 MOV = passive failure of MOV (refuel test) = 9.27E-8/hr (Reference 2)

• 8760 hr/yr + 2.7E-4/ demand (NSAC-154) = I.IE-3/yr Isol = failure of operators to detect :md isolate = 1E-2 is used for LPCI and CS injection line breaks during a LOCA demand.

II or Cat II = anticipated frequency of challenge 2 I event /yr IV or Cat IV = unexpected frequency of cha!!enge 51 E-2 event /yr CCDPso = CCDP during shutdown given pipe break in SDC suction line (see note 7)

(a) He LOCA demand frequency (1E-2) and CCDP from Table 2-2 and Table 3-3 for 2.5 backup trains is about iE-5.

(b) He probability of challenging SLC is equivalent to 2.5 backup trains based upon a scram failure probability of about 1E-5 in Table 3-2 (top event CR).

(c) CCDP for T, TMS, and TFWMS is the totalin Table 2-1 for both ADVS and non ADVS.

(d) Large LOCA (LLOCA) in the VY PRA is assumed to fail a LPCI injection path due to the LOCA.De LLOCA CCDP in Table 2-1 is assumed to envelope all LLOCAs.

(e) CCDPs are calculated with VY PRA as shown in Table 3-1 (includes total for reactivity control and high pressure makeup functions).

• CCDP - shows the quantitative calculation of "CCDP Basis" column

' Loss of shutdown cooling as an initiating event is assessed in Section 4 of main report; a combination of lower pipe failure probability during shutdown conditions and mitigation failure isjudged to be on the order of IE-4 or less.

s Instrument line breaks are evaluated in the VY PRA and assessed to be low importance; this is discussed in Section 43.

' CRD inlet & outlet (89 sets) arejdged to be lower importance than reactor water cleanup; this is discussed in Section 43.

7n/97 i

1 Page 50 !

VYN560_1 l Table 4-2 Summary of Piping Outside Drywell and Impacts Assuming Unisolated LOCA

, System Location Outside Drywell Flood Propacation impacts LPCI RB El 252, drywell personnel Floor hatches & drains to Loss of RIIR train. LPCI injection MOVs due to environment, and access hatch enclosure (X-13) torus and IIPCI rooms at external injection (dependent on LPCI A). Eventual flooding of El 213. Under door to remaining ECCS and/or suppression pool depletion and extemal RCIC room at El 213. injection source assumed to fail.

CS RB El 280,(X-16) Floor hatch and open stair loss of one CS train, environmental impact on ECCS cabinets (signals) to El 252. See El 252 and MCC9B or SB (SW to RilR crosstie). Eventual flooding of ECCS above. and/or suppression pool depletion, but extemal injection source through SW to R11P, crosstie fails.

SDC RB El 252,drywell per*onnel Same as LPCI above. Ioss of LPCI injection MOVs due to environment and extemal injection access hatch enclosure (X-12) (dependent on LPCI A). Eventual flooding of remaining ECCS and/or suppression pool depletion. and extemal injection source assumed to fail.

CUW RB El 280 Same as CS above. Environmental impacts minor on MCC SB and more severe on MCC 9B due to closer proximity. CS train A injection MOV is assumed to fait due to close proximity. Extemal injection is not likely to be available due to MCC SB or 9B failure The condensate system is credited as an external makeup source.

SLC RB El 318 (X-42) Floor hatch, drains, and Ixss important than CUW due to pipe size and location.

under doors to El 280 &

252. See El 252 above.

IIPCI Steam Tunnel TB blowout panels and RB Iess of IIPCI and PCS. RCIC assumed lost due to break size. Steam EL 252 door. breaks are assumed recoverable via low pressure ECCS.

RCIC Steam Tunnel Same as liPCI Loss of RCIC and PCS. Steam breaks are assumed recoverable via low pressure ECCS.

MS Steam Tunnel Same as IIPCI Iess of PCS and depending on steam line, possibly RCIC or IIPCL St am breaks are assumed recoversble via low pressure ECCS.

FW Steam Tunnel Same as IIPCIexcept Imss of PCS and depending on feedwater line, either IIIU or RCIC.

water propagation in RD Water breaks are assumed recoverable by external injection. It is assumed that the suppression pool is depleted by low pressure ECCS pumping water through the feedwater sparger and out the break.

MSD Steam Tunnel Same as HPCI Same as MS except much smaller pipe.

7n/97

Page 51-VYN560_1 Table 4-3 Review & Comparison of Power & Shutdown Operations System Power Operation Shutdown Operation RR LOCAs result in "Iligh" or" Medium" Much less severe operating conditions nnd already "High" and " Medium" for major yiping.

consequence depending on pipe size.

CUW " Medium" consequence for LOCA piping. This system may also be operating durmg shutdown and could impact inventory. IIowever.

" Low" for isolaMe piping inside drywell, the operating conditions are much less severe, MOV isolation is still automatic, piping is and "Iligh" for isolable piping outside small, and the system is not required for mitigation. Power operation is assumed bounding.

drywell.

RIIR "High" and " Medium" consequence due This system is normally in standby during power operation, but it is operating most of the mostly to LOCA initiators, including outage and it's failure is an initiating event. His system requires further analysis ,

outside the drywell. recognizing that during power operation it is already " Medium" and "High."

CS "High"and " Medium" consequence due His system is in standby during shutdown and maintenance unavailability is typically mostly to LOCA initiators, including higher. Although low pressure inventony makeup redundancy may be reduced during outside the drywell. shutdown, CRD pumps provide success makeup due to reduced decay heat.and there is more time during LOCAs for alignment of extemal water sources. Frequency of challenge is comparable or lower and at least I backup train assures a " Medium" consequence.

FDW "High" and " Medium" consequence due to Main feedwater is not operating during shutdown and is not depended upon for mitigation.

LOCA or loss of feedwater and/or loss of Condensate pumps could be utilized, but the likelihood of FDW pipe failure during such a RCIC or HPCIinjection. demand during shutdown conditions is less likely.The frequency ofchallenge and backup trains assures a " Medium" consequence.

MS "High" and " Medium" consequence due to Main steam is not usually available nor depended upon for operation or mitigation during LOCA or MSIV closure and/orloss of ccid shutdown. As a result RCIC and HPCI are also not assumed to be available for ,

RCIC or HPCI steam. . mitigation. Power operation is assumed bounding.

MSD " Medium"and " Low" consequence May be used dunng shutdown, but small pipe and not depended upon for mitigation. Power ,

depending on LOCA size and location. operation is assumed bounding.

SLC " Medium" consequence due to scram Reactivity control is considered a success during shutdown with the rods inserted.'Ihe ,

failure pio'oability and "liigh" consequence likelihood of reactivity accidents requiring scram and/or SLC isjudged to be enveloped by for LOCA outside containment. power operation.

l

+

7D/97 5

F

Page $2 VYN560_1 5.0 Results This section summarizes the results of the consequence evaluations described in the previous  ;

- sections and Table 4-1. The following summarizes the ASME class I systems included in the '

evaluation along with their functions; providing the reactor coolant pressure boundary function is common to all piping (e.g., class 1):

e Reactor recirculation (RR)- circulates the required coolant through the reactor core to ensure mixing, heat removal, and po'ver control.

Reactor water cleanup (CUW) - maintains high reactor water quality and provides inventory control by removing water from the primary system during periods of increasing water volume. In addition, the system pressure boundaiy is required to satisfy the primary containment function.

Residual 11 eat Removal (RilR)- the R11R system has numerous functions including primary containment isolation. As part of the emergency core cooling system (ECCS) function, the I low pressure coolant injection (LPCI) function restores reactor water level after a loss of L coolant accident (LOCA) so that the core is sufficiently cooled to prevent fuel cladding damage, RilR limits drywell and torus water temperature and pressure, and removes heat from the torus after transients and accidents. The shutdown cooling mode of operation removes decay heat and sensible heat from the reactor coolant system while the reactor is shutdown and/or during refueling. RIIR can supplement the fuel pool cooling function when necessary to provide additional cooling capability. The steam condensing mode condenses reactor steam so that decay and residual heat may be removed if the main condenser is unavailable (hot standby). During emergency conditions, a RHR injection path can maintain reactor water level by providing a pathway for the transfer of service water or fire water from the intake to the reactor .

Core spray (CS) - prevents fuel damage following a design basis LOCA by spraying torus water onto the fuel to remove decay heat. The system also functions to prevent core damage following small LOCAs or non LOCA scenarios after automatic depressurization has reduced reactor pressure below the pressure required for core spray operation. In addition, portions of the core spray pressure boundary are required to satisfy the primary containment function.

Feedwater (FDW) - the function of the power conversion system (PCS - feedwater and main steam) is to produce electric power from the steam coming from the reactor, condense the steam into water, and return the heated feedwater to the reactor. The feedwater system provides a dependable supply of heated feedwater to the reactor. In addition, feedwater can

provide high pressure reactor water makeup during plant transients and the system pressure boundary is required to satisfy the primary containment function.

. Main Steam (MS)- the function of the power conversion system (PCS - feedwater and main steam) is to produce electric power from the steam coming from the reactor, condense the steam into water, and return the heated feedwater to the reactor. The main steam system carries steam from the reactor to the main turbine or condenser. In addition, main steam provides over pressure protection, can provide heat removal during plant transients, is 70/97

Page 53 VYN560_1 required to support ilPCI and RCIC pump operation, r.nd the system pressure boundary is required to satisfy the primary containment function.

HPCI ensures that the reactor is adequately cooled to limit fuel clad temperatures in the i event of a break in the reactor coolant system which does not result in rapid depressurization of the reactor vessel (provides sufficient reactor inventory to the reactor until reactor '

pressure is below pressure required for RilR system operation). In addition, the system pressure boundary is required to satisfy the primary containment function.

RCIC maintains suf ficient water in the reactor to cool the core when feedwater is unavailable and until the reactor is depressurized sufficiently to allow operation of shutdown cooling. In addition, the system pressure boundary is required to satisfy the primary containment function.

• Main steam drain (.',lSD)- ensures that water does not collect in the main steam lines.

Standby liquid control (SLC) - SLC shuts down the reactor from rated power operation to the cold condition in the postulated situation that the control rods cannot be inserted. In addition, the system pressure boundary is required to satisfy the primary containment function.

Other small piping connected to the above and not in the ISI volumetric examination scope was also evaluated. For example, the nuclear boiler instrumentation system provides input to automatic reactor scram, actuation of ECCS (RCIC, llPCI, ADS, core spray, and LPCI), and isolation, as well as indications for the operators in the main control room. Also, the CRD system has important functions such as providing hydraulic operating pressure and cooling for the CRD mechanisms which move the control rods used to control mactor power level. CRD provides the principal means of quickly and safely shutting down the reactor.

The following summarizes the ASME class 1 piping consequence analysis results in Table 4-1:

1. Most reactor coolant system piping and connected piping inside the drywell, which is not normally isolated nor protected with an automatic isolation valve, falls into the "High" or

" Medium" consequence category. This piping causes a LOCA initiating event with a conditional core damage probability (CCDP) in the high or medium range. The ranking of this piping depends on the size of the pipe (e.g., small LOCA has a lower CCDP than large &

medium LOCAs).

2. Some very small reactor coolant system piping (1 inch diameter and less) which results in a small LOCA with no significant impact on mitigating systems falls into the " Low" consequence category. CCDP for small LOCA is slightly greater than IE-6. Since there is margin in the size of these small lines, a " Low" consequence is assumed.

3. Piping between the first isolation valve inside drywell and the drywell wall are a " Low" consequence, except for standby liquid control piping. There are redundant low pressure injection sources to provide a " Low" consequence for LPCI and core spray. If the system does not provide a mitigating function (e.g., reactor water cleanup and main steam drains) the low consequence applies because it takes an automatic valve failure for a LOCA to occur.

7D/97

Page 54 VYN5601

4. Piping between the drywell wall and the outer containment isolation valve fall into the

" Medium" to "Iligh" consequence category. This a because these piping failures irsult in a LOCA outside containment. Steam piping (main steam,-IIPCI, RCIC, and steam drains) is in the medium category where as non stum piping (RtiR, CS, reactor water cleanup, SLC, feedwater) is in the high category, Steam piping h located in the steam tunnel (assumed to -

have minimal impact on the reactor building and associated equipment based on its spatial arrangement), steam line connections to the reactor provide depressurization, and it would take significant time for steam connections to pump the suppression pool outside containment (e.g., a steaming reactor versus maintaining water level with a liquid type break). The conditional probability of not providing makeup with the low pressure ECCS is judged to be low enough to provide margin for the medium CCDP. In the case of non steam piping, it is conservatively assumed that the suppression pool could be drained outside the containment if operators maintain RPV level per the EOPs. Also, for some piping in the reactor building, the environmental consequences are judged to be more severe.

l 7 0/97

Page 55 VYN560_1 l-

[_ 6,0 - Conclusions The consequence assessment results an: provided in Table 4-1 where each pipe segment has been assigned a "lligh" or " Medium" or " Low" consequence. In addition, conditional core damage probability (CCDP) has been estimated for the ASME Class 1 piping per the ASME Code Case N-560 (Reference 1). These quantitative estimates are in Table 4-1 ("CCDP" column) and they can be used as part of the pipe risk ranking and selection decision process. Conservatism and non

-conservatism that could potentially effect the ranking that were noted during the analysis are identified in Section 3.3.

Containment performance was considered in determining the final consequence category (e.g.,

High, Medium, and Low). Some consequence results were changed from " Low" to " Medium" or from " Medium" to liigh" based on containment performance considerations. Containment performance could be incorporated quantitatively by multiplying CCDP by a factor (e.g.,10) for containment bypass cases. Note that for some small pipe (e.g., SLC), a generic multiplier such as 10 could be conservative. Generally, the timing and size of potential releases have not been considered in the ranking.

Shutdown operation was also considered. As a result, shutdown cooling suction piping between

- the insiue drywell isolation valve (MOV18) and the drywell wall was increased from " Low" to the " Medium" category; it is " Low" during power operation.

Consideration of external events did not affect the ranking of pipe.

1 7D/97

Page 56 VYN560 I 7,0 References-1 ASME Code Case N 560," Alternate Examination Requirements for Class 1. Category B-J Piping WeldsSection XI, Division 1," August 12,1996,

2. ~ Vermont Yankee Individual Plant Examination (IPE), December,1993 (including RISKMAN Computer Model, see Reference 14).

3. Vermont Yankee Individual Plant Examination Externa! Events, TBP.

4. Drawings:

G 1181167, Rev 54, Flow Diagram - Nuclear Boiler G 1181168. Rev 31, Flow Diagram - Core Spray System G-191169, Rev 36, Flow Diagram - Iligh Pressure Coolant Injection (Sh 1 of 2)

G-191169, Rev 32, Flow Diagram - liigh Pressure Coolant Injection (Sh 2 of 2)

G-191171, Rev 18, Flow Diagram - Standby Liquid Control I

G-191172, Rev 45, Flow Diagram - Residual lleat Removal System

! G-191174, Rev 30, Flow Diagram - Reactor Core Isolation Cooling System (Sh 1 of 2) i

' G-191174, Rev 17, Flow Diagram - Reactor Core Isolation Cooling System (Sh 2 of 2)

ISl RPV-103, Rev 2, Piping ISO L Reactor Vessel  ;

ISI RilR PART 11, Rev 3, Piping ISO - Residual Heat Removal Diywell Access Enclosure (RHR) Part 11 (Sh 1 of 5)

ISI-5020 6622, Rev 2, Piping ISO - Reacte Recirc (RR), Residual Heat Removal (RHR) and Reactor Cleanup Water (RCUW) Systems - Drywell (Sh 1 of 3)

ISI 5020-9206, Rev 2, Piping ISO - Core Spray (CS) Part 2 ISI 5020-9211, Rev 2, Piping ISO - Core Spray (CS) Part 6 151-5020 9283, Rev 1, Piping ISO - Residual Heat Removal (RHR) Part 5 ISI-5020-9287, Rev 1, Piping ISO - Residual lleat Removal (RHR) Part 7 ISI-FDW-PART 5, Rev 2, Piping ISO - Feedwater Drywell - Main Steam Tunnel (FDW)

Part 5 ISI-FDW-PART SA, Rev 3, Piping ISO - Feedwater Main Steam Tunnel & Drywell (FDW)

Part 5A ISI HPCI-PART 2, Rev 2, Piping ISO - H. P. Coolant Injectiori Reactor Building (HPCI)

Part 2 ISI-RPV-105, Rev 2, Piping ISO - Main Steam (MS), Reactor Core Isolation Cooling

- (RCIC), Reactor Building (Drywell/Steani Tunnel) 7n/97

__-_____a

Page 57 VYN560_1 ISi SLC-PART 4. Rev 2, Piping ISO - Standby Liquid Control Reactor Building (SLC) Part 4

5. YAEC Calculation Number VYC-Il18,"Line Size Exemptions From ISI Section XI IWB-1220 Examination Requirements" 10/30/92.

6. Vermont Yankee Nuclear Power Corporation Technical Specifications, Amendment 150, Change 165.

7 VY EOPs:

OT-3100, Rev 3 " Scram Procedure" -

OE-3101, Rev 12 "RPV Control Procedure" OE 3102, Rev 1I (1 of 3), Rev 13 (2 & 3 of 3)" Alternate Level Control" 08-3103, Rev 13 "Drywell Pressure, Temperature, and Hydrogen Control Procedure" OE-3104, Rev 12 " Torus Temperature and Level Control Pressure" OE 3105, Rev i1 " Secondary Containment Control Procedure"

8. Arrangement Drawings:

G-191148, Rev 18, General Arrangement Reactor Building Plans Sheet 1 G 191149, Rev 20, General Arrangement Reactor Building Plans Sheet 2 G 191150, Rev 17, General Arrangement Reactor Building Sections

. 9. Vermont Yankee Internal Flooding Study Note Books

10. Vermont Yankee Nuclear Power Corporation letter BVY 96-86 to USNRC " Vermont Yankee Summary Report for Resolution of USI A-46" dated July 1,1996

11. North Atlantic Energy Services Corp. " Individual Plant Examination External Events" Report for Seabrook Station, Response to Generic Letter 88-20, Supplement 4, September -

1992,

12. EPRI NP-6395-D, April 1989, "Probabilistic Seismic Hazard Evaluations at Nuclear Plant Sites in the Central and Eastern United States: Resolution of the Charleston Earthquake issue" Prepared by Risk Engineering, Inc., Yankee Atomic Electric Company, and Woodward-Clyde Consultants.

13. NUREG-1488, " Revised Livermore Seismic Hazard Estimates for 69 Nuclear Power Plant s Sites East of the Rocky Mountains" Final Report, April 1994,

14. PLG, Inc., "RIS KM AN: PR A Workstation Software" Newport, Beach, CA,1990??

15. YAEC paper ICONES 2592 " Lessons Learned From the Evaluation of Pipe Break Consequences in BWRs (Risk Informed Decision Making on Inservice Inspection of Pipe Welds)" Proceeding of ICONE 5, May 26-30,1997, Nice, France.

70/97 9