ML20215G245

Forwards Interfacing Sys LOCA at PWRs Tasks 2B & 3B, Draft Ltr Rept

ML20215G245
Person / Time
Site:	Oconee
Issue date:	03/02/1987
From:	Bozoki G BROOKHAVEN NATIONAL LABORATORY
To:	Woods R Office of Nuclear Reactor Regulation
Shared Package
ML15244A242	List: ML20215G245
References
CON-FIN-A-3829 NUDOCS 8703120211
Download: ML20215G245 (1)

Text

.

BROOKHAVEN NATIONAL LABORATORi ASSOCIATED UNIVERSITIES INC Upton. Long Is'Onc. New Ye*,

• T2 (516) 282. 7771 FTS 666 '

March 2, 1987 Mr. Roy Woods U.S. Nuclear Regulatory Commission Reactor' Safety Issues Branch Division of Safety Review & Oversight Phillips Building 7920 Norfolk Ave. , MS-244 Bethesda, Maryland 20814

Dear Mr. Woods :

Re: FIN A-3829, Interfacing Systems LOCA at PWRs Enclosed is a draft letter report covering additional work in the ISL Root Cause Analysis (Task 2B) and- Core Damage Frequency Calculations (Task 3B).

Sincerely, J

[ 'h l -

fe. Borok(

Risk Evaluation Group GB/dm/1-rpt.

Enc.

cc: R. Fitzpatrick P. Kohut W. Kato W. Pratt 87e3/GoauXe -

i k

INTERFACING SYSTEMS IACA AT PWRs TASKS 25 AND 3B DRAFT LETTER REPORT G. Bozoki, P. Kohut March 1987 7"

Risk Evaluation Group Department of Nuclear Energy Brookhaven National Laboratory Upton, New York 11973 Prepared for U.S. Nuclear Regulatory Commission Washington, DC 20555 Contract #DE-ACO2-76CH00016 FIN A-J622 4

9 A

q vi  ;-

W__3l _ _ s v~

_ _ . _ _ _ . , - -_ _. . . . _ _ _ _ ~ _ _ . . . . . ._ .__

t p p 3.,

DLO1?I i

i 4 INITIATOR FREQUENCIES OF ISLs FOR VARIOUS PATHWAYS IN REPRESENTATIVE PWR PLANTS 4.1 General 1

i The determination of the initiator frequencies of ISL on various pathways identified in Section 2 (of our previous letter report) is one of the most important part of our ongoing study of Interfacing Systems LOCA at PWRs. This section describes a) the approach applied for modelling of the initiator frequencies, I

i j

b) the initiator models, the valve failure modes involved and the ways

~

how they are acted upon by testing, and I

j c) the new frequency estimates for some valve failure' modes (in Appendix l B) and the quantification of the models.

i j

l 4.0 Basic Approach 1

l Originally, in modelling of the ISL initiators two possibilities were 1

considered; to use Markovian or a simplified model. The Markovian model

! includes all the conceivable failure modes of the valves (e.g., design and installation errors, etc.), their change by the passage of time (e.g., aging)

{ and how they are acted upon by testing, surveillance, operating and

} asintenance procedures and practices.

l I

The simplified model considers the basic mechanism of accident -

i initiation and includes only the most important failure modes of the valves,

) without their time dependence and makes drastic simplifications about the effect of testing, surveillance, operating and maintenance procedures and l practices. While the natural wish of the analysts and their peers worked for l

the Markovian approach, it became clear that within the present time scale and sapporting conditions one cannot pursue that line. Thus, for the present

, study, the simplified approach is chosen.

, p f -~

-..s. m. .

L 4 . >

4-2 b.

jam =

, According to this approach, similar pathways of the representative plants were grouped together. A generic model is worked out for the group. Then, the generic model is adapted to describe plant specific features of the pathways. The method allows to compare the effects of these features among the plants studied or with other plants having similar interfacing pathways.

4.3 Determination of Initiator Frequencies 4.3.1 Modelling of Multiple Failures for Valves in Series This section discusses a generic failure model of valves (check valves or MOVs) in series. The model describes the basic mechanism of accident initiation of most of the pathways identified in Section 2 of our previous letter report. The formulae obtained can be adapted and evaluated easily under the test and surveillance conditions of a specific plant. Three valve configurations, a two , a three , and a four-unit system are analyzed.

a. Two-Valve in Series Consider two valves in series. The valves are denoted by 1 and 2. Valve 1 is assumed to be the first isolation valve of interfacing systems. The failure frequency of the events, when both valves fail, can be written as:

1,(1,2) = A(1)P(2 1) + A(2)P(1 2) I Xg + X2e

. (I) where A(1) and A(2) are the independent, random failure frequencies of valves 1 and 2, respectively.

P(2 1) and P(1 2) denote the conditional probabilities that valve 2 fails, given valve i failed and valve 1 fails, given valve 2 failed,_

respectively. I The conditional probabilities include both independent, random and I demand type failures.

Xg and X2 denote the frequencies of failure combinations of two valves starting with failure of valves 1 or 2, respectively.

, . . \

e l

I ea 1 p(', s .,q 1. \

4-3 4

It is easy to see that external conditions like presence or absence of' '

RCS pressure in the space between the valves may significantly influence the

" innate" failure rates and conditional probabilities of the valves. Its e5fect can be evaluated if, according to the notation-of conditional probabilities, expression (1) is written in the following form:

As(Ie2)"IP(X1 P) + P(Xg P)} + (P(X 2 P) + P(X2 P)] , (la) i I where p is the probability that the space between the valves is pressurized by

! the RCS, and p=1 p.

t Since, p=1 p, expression (la) also.can be written as:

l.

2 As (1,2)=(Xg p) + p[(Xg p) - (Xg p)] + (X2 p) + p[(X2 P) - (X2 P)]. (Ib) f The formula can be simplified by considering that the term, (X 2 P) is small compared to the other terms, since it describes failure rate and j conditional probabilities when the second valve is not exposed to the RCS pressure. Consequently, i

1,(1,2)=(Xg p) + p[(Xg p) - (Xg p)] + p(X2 P). (Ic)

If the second valve is exposed to the RCS pressure the failure rate and

.j conditional probabilities are very similar to those related to the first i

valve, when there is no pressure in'the space between the valves, i.e.,

i p(X2 P)"P(X g p).

i 4

l Therefore i

0 As (1,2)=(Xg p) + p(Xg p) . (1d) i i

1 The valve 1, in a state when its both sides are exposed to the'RCS pressure, is expected to have smaller failure rate than in a state, when only its outer side is under RCS pressure. Thus,(Xg p)f,(Xg p) and the formula l>

(Id) can be approximated ast f M F, [ % b'D o' . .

7

4-4 0 R

7 i 6 .I A,,(1,2) 1 (Xi p)(1+p). (le)

The probability that the space ber, ween the valves is pressurized can be taken to be quite high (-1.0) because small leaks through valve 1 very 4

quickly pressurize the space. Therefore, the failure frequency of two valves

! in series is:

As (1,2) 1 2(Xg p) I 2A(1)P(2 1) . (2)

It is interesting to notice that the result is the same as if in Eq. (1)

" symmetry" would be assumed, i.e., A(1)P(2 1) = A( 2) P(1 2). However, by i

referring simply to symmetry, the whole physical process would have been covered up.

The next step in the analysis is to evaluate the term A(1)P(2 1) by a

simple multiple sequential failure model. The model introduces a I

chronological time ordering between the valve failures; the failure of valve 2 cannot proceed the occurrence of the failure of valve 1. The " innovation" in the model is the simultaneous treatment of random and demand type failure modes.

! Let. At and A2 denote the random type failure frequencies of valves 1 and 2, respectively. Let Ad denote the demand type failure rate of valve 2.

l Then, the probability of " simultaneous" failure of two valves over a time interval t can be calculated by the following integral (exponentials are

! approximated by first order terms):

t t i Q 12

~

fAdt' l ( [ 1 dt" 2 + Ad) (3) o e Ag2A "2

=

2

• AA*

1d (Note, that replacing Ad by a beta factor, 8, one arrives at an expression similar to the classical common mode failure formula. In sequential systems, l

. _ . f.

• ' t s n-

____L_

. . .. __ _ _ .. ._ _ _ _ . _ _..- _ - - . . _ _ . . . . .~ __.__ _ . ._

1 4-5 II [

eiy[  ;

the demand failure mode is similar to a S factor. Indeed, the time interval ~  !

between a failure causing a demand and the'second failure'can be infinitely j small. In this sense, two subseques failures are. equivalent with'two really a i - - .

simultaneous. failures. That is the reason why the common mode failurd is not explicitly indicated in this simple-model.) '5 l

Expression (3) is used to derive the-failure (or hazard) rate for two -i valves:

A 2(*) " (1 II'912 I ' (4)

" 1.q 12 9 12

• 912'(912<<I ' ('*)

=AA*+AA. (4b) 12 1d 1

4 The average failure rate over a time period, T is given by

, e g T

j <A12> " YO ] A 2(t)dt (5)

AAT l2 ,

j = *AA (Sa) 2 1d i

j By equating the term, A(1)P(2 1) to the average failure rate, <A12), the l

! the average failure frequency of two valves in series (see Eq. (2)) over a.

time period, T, is given by: l l

i (Af(1,2)>12<A 2> " A l2 A T + 2 A Ald* (0)

. If Ag=12 , one arrives at the expression ,

<A (1,2)> = 1 T + 2A gd A* II) l l - This expression is used in some further applications. i e r::r. - l 4

4-6 O I' O IP

b. Three-Valve in Series 1h 'ti j s_;b(7(g!.=

4 Consider now a configuration of three valves (1,2,3) in series. Again, valve 1 is assumed to be the first isolation valve. The failure frequency of .

the events, when three valves fail is:

As (1,2,3) = A(1)P(2 1)P(3 12) + A(2)P(1 2)P(3 21) +

A(1)P(3 1)P(2 13) + A(2)P(3 2)P(1 23) + (8)

A(3)P(1 3)P(2 31) + A(3)P(2 3)P(1 32),

where A(1), A(2), A(3) are the independent random failure frequencies of valves 1, 2, and 3, respectively.

P(2 1) denotes the conditional probability that valve 2 failed given valve 1 failed. Similar terms denote similar events.

P(3 12) is the conditional probability that valve 3 failed given valves 1 and 2 failed. Similar terms denote similar events.

t

The conditional probabilities describe both independent, random and j demand type failures.

It is easy to see, RC pressure can be now not only in the space between valves 1 and 2, but also in the space between valves 2 and 3 if both valves, 1

' and 2, fail. The pressure will affect the " innate" failure frequencies and probabilities of the valves. The possible number of pressure states of the inter-valve spaces are:

• 2 combinations of "non pressurized spaces,"

. I combination, when the space between valves 1 and 2 is pressurized (the space between valves 2 and 3 cannot be pressurized before the preceding space is not pressurized), and l . I combination when both spaces are pressurized.

The total number of states are 4.

Each of the terms of Eq. (8) can be now expressed as " conditional" on the presence or absenceiof each of the four states. - The process yields 6x2x4 = 48 4 ,

Y

'4-7 F b E'

.c

> nu" L:  ?

.: ;.:: 1 w

terms. Most of the terms can be eliminated by physical considerations. After the elimination process, Eq. (8) can be written as

! A,(1,2,3) 16 A(1)P(2 1)P(3 12) . (8a)

The result could be obtained also by symmetry consideration from Eq. (8) by substituting the first term for all the others. Obviously, the result is conse rvative.

The next step is to evaluate the frequency A(1)P(2 1)P(3 12) by a sequential model involving random and demand type failure modes.

Let At , 1 2, and 13 denote the random type failure frequencies of valves 1, 2, and 3, respectively. Let Ad2 and Ad3 denote the demand type failure frequencies of valves 2 and 3, respectively. Then the probability of simultaneous failures of three valves over a time interval t can be calculated by the following integral (exponentials are approximated by first order te'rms):

t t t t Q123 " A dt' {[Adt" l 2 [ f_ A3 dt" + Ad3)

• Ad2 f A3 dt" + Ad3}"

o t t t.

2 AA g 2 3*3 1 2 d3*2+ 1 d2 3*

• + 59) 6 2 2 +Al d2 d3*

• The failure (hazard) rate is:

' d 1 A

123 I *)" E 123 0 " 2 1 b A 3*2

• A b Ad3*

• lAd2A3*

l A A

• A Al d2 d3 (10)

The average failure rate over a time period, T, is given by:

2 T 1A T Akd231T AA3 d2 1T3 (11) g 323 +

l

+

<A 123 T  ! 123(*)dt "

o 6 2 2 + Al kd2 d3

• fT i .

s- m - - - .*

h,I;p c

4~8 )::bd i) % i,'

' ' 6Lk t g,-

Again, by equating the term A(1)P(2 1)P(3 12) to the average failure rate

<A 23), the average failure frequency of three valves in series (see Eq. (8))

over a time period, T, is given by:

<Af(1,2,3)>f6<A123> " A1 Y3 +3A 1 Yd3T+3AA AT g d2 3 + 6A 1Ad2Ad3. (12)

If Ag=A2*A3 and Ad2"Ad3"Ad one arrives at the expression:

3

<Af(1,2,3)>f1T +6AAT+6A d g

. (12a)

This expression is used in further applications,

c. Four-Valve in Series It is easy to show that for four valves in series the failure' frequency when four valves fail, can be written as A,(1,2,3,4) f 24A(1)P(2 1)P(3 12)P(4 123) (13) where A(1) is the independent failure frequency of the valves 1, 2, 3, and 4, and P(2 1), P(3 12), and P(4 123) are conditional probabilities describing that a subsequent valve fail given that the preceding valves already failed.

The conditional probabilities describe both independent, r'andom, and demand type failures.

The integral which describes the probability of simultaneous failures of four valves over a time interval t is given by:

t t t t Q1234 "

o A dt' fAdt" i

t 2 fAt_ dt" 3 (f A t dt""

4 + Ad4) +

t t t

[A l o

d2 t

! 3 t N tf_ A 4 d t"" + Ad4}

+

p- .- --

t L. .. -

• 4-9 gg g g .

f3h'.f,?L i s'.'*

a t t t 4

[ A ydt' Ad2(],Adt"(f_1dt"+Ad4}

3 4 o t t t t o

f A gdt' Ad3 If,Ad'~+Ad4) t 4 " AAbA' l2 4

+

f(A A g 2A3 d4 E +A

• l 2 d3 4* 1 d2 3 4* ) +

E 2*

1 2 2( 1 2 d3 d4*2

• 1 d2AA 3 d4 1 d2A d3 4* )

• AA g d2 d3 d4*

• where A i, A2 A3 , and Ag denote the random type failure frequencies of valves 1, 2, 3, and 4, respectively. Ad2 Ad3 Adi, denote the demand type failure frequencies of valves 2, 3, and 4, respectively.

In the same way as it was shown for the two and three valve configurations, the average failure frequency of four valves in series over a time period, T, can be expressed as:

<Af(1,2,3,4)>1AAAAT 1234 + 4(A gA 2 3 d4

+ A 12 d3 4

+AA 1 d2AAT)+

34 12(A g 2A d3A d4 A T+A + A _(15) l d2 3 d4 1 d2 d3 4 ) + ' 1 2 d3 d4 The formula obtained will be used for valve configurations when 11 "A2"A3 , and Ad1"Ad2"Ad d3" A . For this case Eq. (15) has the following simplified form:

<Af(1,2,3,4)> 1 A A 4T + 4( Af Ad

• d4 T +AfAd4 T ) + 12(2A A4 T) +

3

( 24AgA .

(15a) i l

uru.

l

!'- 4-10

'y

. ':"L.5%h" e su 4.3.2 calculation of Initiator Frequencies for Accumulator, LPI, and HPI i' Pathways 1At the majority of PWRs the LPI injection lines have a common inlet header to the RCS with the accumulator outlet lines. At PWRs of Westinghouse and Combustion Engineering designs this-inlet header is even shared with the HPI system. At PWRs of Babcock and Wilcox design the HPIS injects to the

reactor vessel via separate lines.

In all previous analyses of ISLs through the LPI (or HPI) lines the effect of the common inlet header was not taken into consideration. The ISL

initiator frequencies were e'stimated assuming the LPI pathways to be independent from the accumulator system.

l l A thorough analysis of the check valve failure events occurring in the LPI, accumulator injection lines (see Appendix B for details) revealed the fact that the second (downstream) check valve in accumulator injection lines I, is rather prone to " failure to operate upon demand"(i.e., to non-complete s-seating) failure mode. The proneness to failuresaof this type is due to the

} combined effects of boric acid corrosion, boron. deposition, and the valve being in a "see-saw" position between two overpressurized-regions each of them

[ subject to many pressure changes. Since the valve frequently. falls in the

" failed state," it behaves as a " kind of safety valve" with respect to'the.

overpressurization of the common inlet header. Namely, whenever the first (upstream) isolation ~ check valve to the RCS leaks (or'in the worst case ruptures), in the majority of the cases, the second check valve will not prevent completely the propagation of the leakage (or pressure wave) to the accumulators.

Based upon the results of the check. valve failure analysis, it was concluded, that in any study of ISLs going through the common injection inlet pathways, the proneness of accumulators second check valve to " failure 7to.

operate upon demand," failure mode has to be taken into account. It.was inferred that depending upon the state, this check valve (whether it is seated -

or not) and the rate of the backflow through the first check valve the nature pe ip .

, t Id

4-11 fI y $ ?f3

.* * , $5 L; k%3 LL 3

w and frequency of ISLs through the LPI/HPI pathways will be significantly different.

a) If the valve is seated, there will be no " relief valve" effect. ISLs through the LPI/HPI pathways, even with moderate leak rate (1 1000 gpm) will contribute to core damage and public-health risk.

b) If the valve is open, the preferred direction of the ISLs will be through the accumulator and not through the LPI/HPI pathways. Should an ISL with small or moderate leak rate (1 1000 gpm) still occur through these pathways, it will lead only to harmless overpressuriza-tion of low pressure piping. Since the accumulators are constantly monitored small leaks through the first check valve will have high potential for discovery and preventive actions.

In the case of an ISL with high leak rate (check valve ruptures) the open accumulator check valve will cause'an additional internal LOCA.

Despite the increased confusion in the accident management, it will have the beneficial effect that it will turn large part of the RCS inven' tory available for recirculation. The advent of core damage will be delayed and public health risk will be decreased.

Thus, in the following calculations of ISL initiator frequencies both effects the " safety valve" effect of the accumulator check valve'and the effect of the leak rate have been considered.

For lines having not shared inlets to the RCS, the initiator frequencies are calculated by considering the leak flow rate dependency of the leakage failure frequency of check valves. The leak rate dependency of the leakage failure frequency is described in Appendix B.

4.3.2.1 ISL Initiator Frequencies for Accumulator Pathways In order to determine the ISL initiator frequencies for the accumulator

pathways the exceedance frequency per year of experienced accumulator inleakage events (see also Section B.1.3) is plotted as a function of leakage

- - ..-- . .- . .- - - - = ,. - - -

4-12

. .w .w.;<.vt.!.!.hLi n.c i

flow rate through the accumulator injection lines. The plot is shown in Figure 4.1. The curve is fitted graphically with a straight line (on a log-log scale). A statistical estimate based on experienced event frequencies and assuming lognormal frequency distribution provided an average range factor of RF=10 for the curve. By using this range factor an other exceedance frequency per hour curve is constructed which represents mean values. 'The l curve describing mean values can be taken now as a direct source to estimate ISL initiator frequencies.

) The application of straight line fit for the observed values is supported by the generic experience, that " percolation type" physical processes, like

leakage through two subsequent openings follows exceedance frequency l distribution of Pareto type (i.e., a kind of power low).

4 i

To estimate ISL initiator frequencies for specific plant by using the:

i curve, the most important parameter is to choose the appropriate leak flow

rate value at which the estimate is carried out.- For that purpose a reasonable choice is that leak flow rate, which fills up the " free volume" of the accumulators within a " critical time" deemed to be required for operator actions to treat safely an accumulator inleakage. Table 4.1 presents the free volumes of the accumulators for the selected PWRs. The' table also shows.some .

! other relevant design characteristics of the accumulators for convenience. '

Table 4.2 lists the filling time of the free volumes for various leak rates.

1

(The filling times presented in the table are conservative because it does not take into account the delay in the filling due to the compression of the N2 gas.) As critical time, 10 minutes is selected for all the plants. . This time is deemed to be.long enough, for the operator-to respond for_the specific l accumulator-alarmet (high pressure, high level) to take successful corrective actions. Table 4.3 gives the corresponding-leak rates and the mean values of

! the leak rate exceedance frequencies per accumulator line year. The leak rate 5 exceedance frequencies were obtained simply by " read-off" from the curve describing mean values in Figure 4.1.

I In order to determine the ISL initiator frequencies from the generic

{ curve, the listed exceedance frequencies should be only a little bit adjusted according to the plant specific parameters and plant specific test or L

. _ u.

. - . - ~, . . , , , . - - . , - , , ~ . .. . , - - - - - - -

r pr e-4-13 r- - /

! q. 9

'in

.' . .. t u b

a surveillance conditions. The size of the lines is not important parameter because the experienced curve is based on failure events representing a relatively homogeneous sanple of pipe size, 8"-14" diameter.

The value which is directly read off from the curve at an appropriately chosen leak flow rate is essentially Eq. (7) (see also Eq. (1) in Appendix 3):

<1f(1,2)> = 2 Ag ( +Ad2) = 2A 1C , (7a) where A t is the frequency of leakage failure mode of the first check valve (near the RCS),

12 denotes the same quantity for the accumulator outlet check valve, Ad is the frequency of check valve " fail to operate on demand" failure mode, enhanced by the special conditions just explained at the preceding section, and C=.93 denotes an " effective leakage probability" for the accumulator outlet check valve.

At Indian Point 3 the check valves are leak tested after flow test at each RCS depressurization (*3 times / year). These leak tests are assessed to be 100% efficient for the present calculations. (Sensitivity calculations will be carried out later after all the representative plants have been visited.) Therefore, at Indian Point 3 the exceedance frequency, is not corrected for valve failures to reclose after cold shutdowns.

In contrast with Indian Point, at Oconee 3, leak tests are carried out only in time of nine month intervals. During this time period there are two cold shutdowns. Each cold shutdown creates a potential for additional reclose failures due to check valve demands. The probability that the first check valve " fails to operate (reclose) after demand" is: A **" = 2.81(-4) (see Section B.2.5). Then, the corrections for the exceedance frequency are given by:

E = A C = 2.61(-4), due to the first cold shutdown, and d

0

4-14 -r p [2 7

[- *

. ko :

L-..a[h) U E - 2A C = 5.22(-4), due to the second one.

d The total correction per line averaged over the year is:

T ' "

EA = (EA* A " * (~  !*

The correction is only 10% of the uncorrected value. Its value is presented also in Table 4.3. .

The best conditions for failure detection of the first check valve are at-Calvert Cliffs 1. The seat leakage of the first valve is continuously monitored with pressure sensors placed in the valve section between the two check valves of the accumulator lines. Thus, there is no need for correction of the exceedance frequency.

Based on the other relevant data in Table 4.3 the total initiator frequencies were calculated for each plant. The values obtained are presented also in Table 4.3.

The total initiator frequencies were determined also at leak rates which just exceeds the relief valve capacities of the accumulators. These frequencies represent the initiator frequencies for overpressurization of the accumulators. The value obtained are shown in the last row of Table 4.3.

The initiator frequencies serve as inputs for the accumulator ISL event-tree. The event trees are described in Section 5.

J As one notices, the initiator frequencies are relatively high compared to the generic frequency of small LOCA' initiators (-10-2/ year). This is connected with the high frequency of accumulator inleakage events and with their good potential for discovery (see Item (b) in Section 4.3.2).

The initiator frequency valves, (I A) Presented in Table 4.1, serve as inputs for the accumulator ISL event trees . The event trees will be discussed in Section 5.

, e-

I r ~, r. s, r=-7 e

• G 4-15 f * ?.

[.v . LJ d !! c f -

4.3.2.2 ISL Initiator Frecuencies for LPI Pathways I l

The check valve arrangements on the interfacing LPI lines of the representative plants belong to the following basic configurations:

a. Two check valves and an open MOV.

Indian Point 3. (Valve descriptions > '

are given in Tables 2.3.1 and 2.3.4) Rc s Number of paths: 4 I 2 HOV

b. Two check valves and a closed MOV. A i

Oconee 3. (Valve description are I 1

i

^

given in Tables 2.4.1)

Number of paths: 2 RCS / / 4 I 2 MOV-

c. Three check valves and a closed MOV. A Calvert Cliffs 1. (Valve description are given in Tables 2.5.1 and 2.5.4) RC 5 Number of paths: 4

-/ /-/ %

2 3 l .Hoy The ISL initiator frequencies for these LPI pathways, tI pt, is calculated by applying a) the formalism developed in Section 4.3.2, b) the dependency of the leakage failure frequency on the leak flow rate, c) the condition that the accumulator check valve is frequently being in the failed state, and d) the assumptions that ISLs, with leak flow less than the total relief valve capacity of the injection side of the LPI-system do not lead to overpressurization of the low pressure piping, but contribute to the small LOCAs, and ISLs with leak flow below-the total capacity of the charging system are easily treatabl'e and therefore negligible events. -

t r r:

4-16 b, h,

. c LU Before entering into the description of the calculation we reiterate the remark made on the common cause failure behivior of the quantity Ad in-the formalism developed in Section 4.3.2. The formalism does not include terms explicitly identified as accounting for common cause failures of the components. In sequential systems where the system is modelled as combination

~

of operating and standby components, the Ad represents the demand failure of' the standby components. Thus, if there is a combination of an operating and standby component, any failures of- both components will occur at- the sama time -

because of the way the system is designed, independently from the type of failure of the' operating component, whether it is independent or common cause J

failure. Therefore, it is superfluous to introduce separate terms for common cause failures. It is only required that the numerical value of Ad should-be appropriately selected.

1 J

4.3.2.2.1 Calculation of It p1 at Indian Point 3 I The formula applicable to calculate the average failure rate of the check valve configurations in the LPI pathways is described by Eq. (6), which is repeated here for convenience.

<A (1,2)> = 2A ( 2 + Ad) .

3 All the. quantities in this equation have been defined earlier.

The formula can be also applied to calculate the average frequency of double check valve failure events which are not accompanied by check valve failure in-the accumulator line (1,2,A). This can be done simply by multiplying the failure frequency (A1 ) of the first check valve by-(1-C),

where C is "the effective leakage failure probability" of the accumulator outlet check valve. Thus, At (1-C) will denote the frequency of the first check valve failures, when the accumulator check valve is closed.

The average frequency of the events (1,2,A), therefore, can be written; l as:

l AT

< A (1,2,'A)> = 2 Ag ( 2 *A d2)(1-C) = <A (1,2)>(1-C) , (17) i

!, i l

l

4-17 7 ~ r~ t' nm

. - '!; 3 ..

and if A 2 "A l 's - 'E

- N

<Af(1,2, A)> = ( A T + 2 A Ag d2)(1-C) (17a)

At Indian Point there are four.similar lines and the reactor is at power about 72% of the total time. -Thus, the total average frequency of potential ISL initiators with (remember that C=.97, and A =A i c) i and without simultaneous accumulator inleakage will be:

I py(1,2,A) = .72x4x<1 (1,2)> (18) and Ig(1,2, A) = .72x4x< A (1,2, A) (18a)

= .72x4x< Af(1,2)>(1-C) ,

respectively.

Quantification of I tpt (Indian Point 3) 4 Expressions (18) and (18a) were evaluated numerically as a function of

, the leak flow rate through the shared LPI/HPI/ Accumulator inlet by using the leakage failure exceedance curve given in Figure B.2 of Appendix B.

By using the curve data as medians, kedian, and by assuming lognormal failure frequency distribution and range factors slowly varying from RF:10 to RF:14 in the leak flow rate interval of 100-2000 gpm, the mean leakage frequency, A$**", and the expectation of its square < Ag > = '( A **")2 + var. ,

have been calculated (e.g., at leak flow rate of 100 gpm:

edian 1 = 1.58(-3)/yr, RF=10, A **" = 4.20(-3)/yr, and <A > = 1.25(-4)/yr ).

The mean frequency of " valve fail to operate on demand" failure mode was taken to be Ad2 = 2.81(-4)/ demand (see Appendix B.1.2). '

.\

! At the Indian Point 3 plant the check valve disc being in the open position is precluded by the leak test performed after every cold shutdown.

(This is a considered assessment. It is understood, in such a way, that the l .

l l

• l l

l _ - _ _

7 i

'. b- [~'

., [2 ;.

b.' :. J.f L 3 E check valves are closed as tight as their leak flow is smaller than a limiting flow rate defined in the tech. specs. and test requirements. A survey of the test performances will be discussed later.)

The average time interval between cold shutdown at Indian Point 3 is T=1/3 year.

The results obtained by the quantification are shown in Figure 4.2 to be compared with the results of other plants.

Initiation frequency data at important leak flow rates are also given in Table 4.4. Those values which are selected as inputs for LPI event trees are indicated in the last column of the table.

The first value is the frequency of double check valve failure events without accumulator inleakage where the leak flow rate is larger than the maximum makeup flow (-98 gpm), but less than the total capacity of LPI relief valves at the injection side (740 gpm). These events are not considered to cause overpressurization of the LPI piping, but may result in .

small LOCA. (Double check valve failure events in this category, which are associated with accumulator inleakage are considered to be mild and negligible.)

The second value is the sum of the frequencies of the following events:

a) Double check valve failure events without accumulator inleakage, where the leak flow rate is larger than the total capacity'of LPI relief valves at the injection side. These are considered to cause overpressurization.

(

b) Double check valve failures with accumulator inleakage, where the leak flow rate at the shared inlet of the LPI/HPI/ Accumulator Systen exceeds the. capacity of the LPI relief valves (740 gpm) in spite of the flow diversion to the accumulator. .

-, - ~ . -. , , . , - ,

4-19;

-e.( 4 b <

t.

4

. u. .

These events represent the majority of overpressurization events. (The

" critical leak flow" was estimated by considering that only a fraction, F of

the incoming flow reaches the relief valves. The fraction is equal to the ratio of the cross sections of the LPI and accumulator pipes

2 3

F = (6"10"

"*0*

i 740 Thus, the critical flow rate is: .36 = 2100 gpm.)

~

4.3.2.2.2 Calculation of I p1t at Oconee 3 An ISL would occur through an LPI line at Oconee 3 if two check valves

and a normally closed MOV were in an "open" failure state. The frequency of' these events can be calculated by applying Eq. (12) to the case. At the

^

application, one has to use the appropriate failure modes of both types of valves, check valves, and MOVs and the specific testing policy of the valves.

The testing policy of the valves is discussed first.

At Oconee 3, there is a leak testing equipment.(a rig) to carry out the 1

ISL tests at nine month intervals. (The efficiency of the test process will be discussed later after having seen the equipment, procedures, and discussion j with plant personnel during an oncoming plant visit.) These tests which are intended to verify that the check valves of the ECCS system properly reseat after cold shutdown, are considered to be efficient. However, there are usually two cold shutdowns during the nine month leak testing period when'the LPI lines are flow tested and the MOVs are stroked. After cold shutdowns the check valves may be stuck open and also the MOVs may remain in failed state (do not operate on demand), These conditions should be taken into account in the calculation of the initiator frequencies. For calculational simplicity, it is assumed that cold shutdowns are performed in three month intervals. It means that during a nine month period there will be two cold shutdowns with i potential of undetected valve reclose failures. Since the initiator frequencies are given on a basis "per reactor year,", the failure model'will be evaluated for four time periods of three months long and the results will be summed to obtain the yearly ISL frequency. It is easy to see that

,p.. * **"

S-

. l

= :- :-

4-20

• f; 7 ,,8

. . . .. . L in the first time period, just after the ISL test (and cold shutdown),

there is no need to correct the terms in Eq. (12),

e in the second time period (after a cold shutdown), in addition to the terms in Eq. (12), corrections have to be made for the potentially non-reclosed valves, e in the third time period (after cold shutdown) the correction is doubled for check valves (the MOV stays the same), and

= the fourth time period is the same as the first because this period begins also after ISL test.

The expressions to be quantified are (based on Eq. (12)):

1st Time Period (0-3 months), t = 1/4 year, T = 3/4 year; 2

t<1 (1,2,3)> < t(1 A (19) 3 +3hdT + 3Agd3 A A T + 6A h g

for events with accumulator inleakage and

, t<A (1,2,3,A)> = t<A (1,2,3)>(1-C) (19a) 4 for events without accumulator inleakage.

The meaning and numerical values of the variables are given below in the description of quantification.

2nd Time Period (3-6 months), T = 1/4 year;

..The same frequency contribution as above plus the correction. The correction is calculated by counting all the possible failure combinations caused by " valve fails to operate on demand" failure mode;

<A (1,2,3)>" ## = (2A A A T + u d13 d3 3 2n d+ 2A d) (20) i

4-21 P e. ,r [=

5" I'  ! l.

L  : . -. -

for events with accumulator inleakage and

<As (1,2,3,A)

= <1s (1,2,3)>(1-C) (20a) for events without accumulator inleakage.

3rd Time Period (6-9 months).

The same contribution as in the second time period plus twice this correction term because the frequency of " valve fails to operate on demand" failure mode doubles (accumulates).

4th Time Period (9-12 months).

The contribution from this time period is exactly the .same as that of the first one.

Quantification of I p1 t (Oconee 3)

In the formulae above A g is the leakage failure frequency of the check valves.

Ad is the check valve " fails to operate on demand" failure frequency.

The same quantity is used also for "MOV fails to operate on demand" failure mode (see also Section B.2.5).

1 3 is the sum of the frequencies of MOV failures which lead to inadvertent open state of normally closed MOVs.

1. The formulae were evaluated as a function of the leakage flow rate.

l The leakage frequencies were taken from the frequency exceedance curve (Figure B.2). The same procedure was used for obtaining mean, etc., failure frequencies as that of applied for the Indian Point 3 i

calculations.

i i 2. The frequency of " valve fail to operate -on demand" is also the same as that was used for the Indian Point 3 calculations (see also Section B.I.2.3); ,

4-22 P I': O. F p' ,Pb, i'. .L2L A

d = 2.81(-4)/ demand. The expectation of its square is:

~

< A > = ( A"* *") + var. = 2.05x10 / demand .

The expectation of its third power is obtained by the generic formula valid for lognormal distributions:

-10 / demand3 ,

2 <Ad > = [ Mean g ] = 3.88x10 d

3. The sua of the niean frequencies of MOV failures leading to inadvertent open state of normally closed MOV is obtained from the following contributors:

a) MOV disc rupture (B.2.1) 1.20x10~3/ year b) MOV internal leakage (B.2.2) 4.85x10~3/ year c) MOV disc failing open while indicating closed (B.2.3) 1.07x10'"/ year:

d) MOV transfer open (B.2.4, Seabrook value) 8.1x10'"/ year e) Inadvertent SI signal 6.4x10-2/vear*

-7.10x10-2/ year

• This value is taken from the Indian Point 3 PRA as a generic value for estimating the frequency of inadvertent SI signal. The Oconee PRA assumes a more moderate value of 1x10-2/ year.

I 4. The quantity, 1-C is equal to 0.07.

Since there are two LPI lines and the plant is at power 86% of the time, the initiator frequencies were obtained by the expression:

4 kPI"*

• i=1 S""# '# I * " "E

"}i * (21)

The results obtained are shown in Figure 2' as a function of the leak rate for both cases, with and without accumulator inleakage. The coincidence of the Oconee 3 "with accumulator inleakage" curve with Indian Point 3 "without accumulator inleakage curve" is merely accidental.

,,_p.

6

-ee

.. .~ - . _ . . .- - . -- . -

4-23 p q pf ,gr 12

m. ,  ; C '.

. (.

-More precise values are presented in Table 4.4'at relevant leak-flow rates. The final initiator frequencies selected as inputs for event trees at appropriate. leak flow rates are given also in Table 4.4.

The selection consideration was similar to that described at the~ Indian: 1 Point 3 calculation.

4.3.2.2.3 Calculation of I tpr at. Calvert Cliffs 1

.At Calvert Cliffs an ISL occurs through the LPI lines if three check valves and a normally closed MOV were in an open failure state. The frequency of the events can be calculated by applying Eq. (15a)'to the case. At'the application, one has to use the appropriate failure modes of both types of

, valves , check valves, and MOVs.

The check valve testing policy of Calvert Cliffs l'is varied; continuous

, leak / pressure indication of the first check valve and-additionally leak-test.

on each inboard check valve at each refueling outages. Leak test'is performed

quarterly during plant operation and flow test during refueling outages on outboard check valves. The MOVs are stroke tested quarterly and cycled per i month.

Since the test interval for the components ranges from zero to-1.5 year in the quantification of Eq. (15a), the b'asic time period, T,.over which the

average multiple-valve failure frequency is calculated was chosen to be T=1/4 ~

I year. The value selected seems to be. conservative, considering -that the leak / pressure indication and an additional safety valve would detect the

! faf',rres of the first check valve.

i a

There are four lines and the reactor is at power of 88% of the time, the initiator frequencies were evaluated by using Eq. (15a).as a function of the leak rate:

4 I p7(1,2,3,4) = .88x4x<1 (1,2,3,4)> (21) i i

w-

• 4

" ?R f, V.*

4-24 .- - to

u. E.! e '

for events with accumulator-inleakage and I py(1,2,3,4, A) = .88x4x< A (1,2,3,4)>(1-C) (21a) 1 for events without accumulator inleakage.

The procedure of the calculation was the same as it was applied in the previous cases.

The sum of the mean frequencies of MOV failures leading to inadvertent open state of notaally cl.osed MOV is obtained by using the list given at the quantification of Oconee 3 initiators. The only difference is that the demand rate "at MOV failing open while indicating closed" failure mode is taken to be 12/ year, resulting in A3 = 7.22(-2)/ year.

The results of the calculation are shown on Figure 4.3 as a function of the leak rate. The ISL frequencies seem to be indeed small because of the high check valve redundancy. More accurate initiation frequencies at relevant leak flow rates are given in Table 4.4 Table 4.4 indicates also the selected values for small LOCA and overpressurization initiators. The selection criteria were similar to those applied at Indian Point.

4.3.2.3 ISL Initiator Frecuencies for HPI Pathways The basic valve arrangements of the' interfacing HPI lines do not differ

from those already described for the LPI. Thus, the calculation of~ average I

multiple valve failure frequencies for individual lines essentially repeats the approach applied at the IL pr calculations. Small complication arises only for systems where various valve arrangements occur together as in the HPI system of Indian Point 3.

4.3.2.3.1 Calculation of Igpr at Indian Point 3 The HPI system in this plant has:

A) Four lines whose valve arrangement is of the type: three check valves and an open MOV. These lines have shared inlets with the LPI/ Accumulator System to the cold legs of the RCS.

. . . . r -

s-as P;

• O .f#P

e

u. .. ti L B) Four lines whose valve arrangement is of the type: two check valves and an open MOV. These lines have no shared inlets with the accumulator.

C) Two lines whose valve arrangement is of the type: two check valves and a. closed MOV.

There is a relief valve for these lines with a set point of 1500 psia and estimated capacity of 580 gpm. Valve descriptions are given in Table 2.3.3.

1. Calculation of average multiple check 1 valve failure frequencies for group A lines.

The. leak and stroke test of the check valves on these lines are different. The first check valve (upstream) stroke and leak tested at each cold shutdown. The other check valves are stroke tested at each cold shutdown, but leak tested at every refueling. The average valve failure frequencies per line were calculated for both of the cases,-with and without accumulator-inleakage by using the expressions:

3 2 3(< A (1,2,3)> ] < 3( A T +6A3d +6AfAd + 61 3d A ' (

and 3 [< A (1,2,3, A)> ] < (< A (1,2,3,) > (1-C) ) . (22a)

The time interval selected for the quantification was T=1/3 year, the cversge cold shutdown period, applicable for the first check valve. However, to make correction for the asymmetric in the leak and stroke test interval (1.5 year) of the other check valves, the average failure frequencies were multiplied by three.

The definition of the quantities appearing in these expressions have been defined earlier. The frequency values were quantified as a function of the leak flow rate through the first check valve. ,

i i

I l

. - l i

I

p. m r r:r-6-26 IP 2 I-

, il - O. L

2. Evaluation of average multiple check valve failure frequencies for group B lines.

The check valves on these lines are stroke and leak tested only a each refueling period. Thus, the average multiple check valve failure frequencies were calculated with a time period of.T=1.5 years. The lines do not have shared inlet with the accumulator.

The average failure frequency of two check valves is calculated with the formula by the formerly explained way:

<A (1,2)> = (A T + 2A gd A) *

3. Evaluation of average multiple check valve failure frequencies for group C lines.

The check valves on these lines are stroke and leak tested also at each refueling period (T=1.5 years). The MOVs are locked closed during normal operation. Therefore, from the MOV failure modes (see the list at B.2) the "MOV disk rupture," "MOV internal leakage," "MOV left open while indicating closed" failure modes, and "MOV does not operate on demand" failure modes were selected.as appropriat.e ones. The sum of the failure frequenciesoof the first three failure mode is A3 = 6.16(-3)/ year.

The average multiple failure frequency was calculated by the expression:

<A (1,2,M)> = ( A A + +3 Ad + 6A1dA ) , (23) 3 d where all the quantities were defined previously.

Taking into account that the reactor is at. power about 72% of the total time, the initiator frequencies were evaluated for each group of lines, A, B, and C separately with the following expressions.

l g.

ge* e

(

r [:=mI 4-27  :, . * ,

. .. _s . -l For line group A, in the case when there'is accumulator inleakage i A T I = .72x4x3< A (1,2,3)>(1-C) , (24)

HPI s i and in the case when there is no accumulator inleakage I

HPI =.72x4x3<1[(1,2,3)>(1-C). (24a)

For line group B (no inlet shared with the accumulator)

I gpy = .72x4x<A (1,2)> , (25) and fo'r line group C (no inlet shared with the accumulator IHPI " * ** * (

l e The results were plotted as a function of the-leak flow rate at the line inlets in Figure 4.3. The figure shows the dominant contributors are the flow l

paths having no common inlets with the accumulator.

7 Numerical value of the "line group frequencies" at several important leak flow rates are presented in Table 4.5. The table shows, each line group contribute to both, the overpressurization and for small LOCAs. The selection ,.

of values is based on the same leak rate considerations which were explained at the description of LPI initiators. The data in the last column of Table 4.5 indicate the final values selected for further analysis.

4.3.2.3.2 Calculation of IHPI at Calvert Cliffs 1 i The valve arrangement of the HPI lines at Calvert Cliffs 1 is similar to that of the LPI lines: three check valves and a closed MOV. (The valve descriptions are given in Table 2.5.3.) The number of lines is 4.  ;

The testing policy of the isolation check valves is also similar

[ continuous leak pressure indication of the first check. valve (common with the accumulator and LPI lines), leak test quarterly.during plant operation of a .

i A + u . + - = - 5 4. A E C (--4.

r" ~

4-28 [ Ite

t. . . . . . . L outboard check valve,. flow test during refueling outages. Additionally, leak test on each inboard check valves at each refueling.

The position of the MOVs is under continuous surveillance. They are stroke tested quarterly and after cycling upon SI signal their closed position is monthly verified. There is also a relief valve at header of the branch lines with a setpoint of 1485 psia and an estimated capacity of about 580 gpm.

There was no reason to use other parameters to calculate the multiple valve failure frequencies than it was used in the case of the LPI. Thus, the a

Calvert Cliffs frequency vs. leak flow rate curves in Figure 4.3 relate not only to the LPI but also to the HPI system.

Since the relief valve setpoint and capacities are different, the leak-flow requirements will be also different for the two systems.

Correspondingly, the selected values for small LOCA and overpressurization initiators will be different. These values are presented in Table 4.5 where also the data on Indian Point 3 are also shown.

t 4.3.3 ISL Initiator Frequencies For RHR Suction Paths '

For all three plants the three single RHR suction lines (Tables 2.3.3, 2.4.2, 2.5.2) is separated by two specially built MOVs in series. The basic 1

4 model of two valves in series described in Section 4.3.1 is essentially applicable to calculate the average failure frequency of each of these valve arrangement if the MOV failure modes are appropriately selected.- For some of the valve arrangements preclude certain failure modes and test policies and j practices are also different at each plant. Therefore the initiator frequencies are calculated on a plant-specific basis.

i There is a generic problem in the calculation of the initiator frequencies for the RRR suction paths, namely how to take into account in the model the role of the suction side relief valve. The approach applied for the check valves, when the initiation frequencies are evaluated as a function of the leak rate cannot be applied. The reason for this is that leakage failure 0

9 e

er y---- . - - - . - ,, - - . ., --y,, ., ,,,,,,m .y -_..

,. -.-., . .~. - . , , , , -- __. ,,y_,.-__y. ..y,

r' o' "! r.: -

4-29 ,

! . in

u. .. . w t.

frequency data similar to those of the check valves are not available for MOVs. The use of check valve data, as surrogates, can be very misleading.

, In order to overcome this problem, the following approach has been adopted in the calculation of initiation frequencies:

Failure combinations involving "MOV internal leakage" failure mode are considered to be representing failure events when the inleakage into the RHR system is below the relief valve capacity. Failure combinations, however, involving "MOV disk rupture" with other MOV failure modes (not MOV internal leakage) are considered to contribute to the overpressurization frequency of the RHR suction line (i.e., inleakage into the suction line is assumed to be higher than the relief valve capacity).

4.3.3.1 Calculation of Is at Indian Point 3 In Appendix B.2 six different failure modes are listed for a typical MOV. From these three failure modes (1) MOV failing open while indicating 1

closed, (2) MOV transfer open, and (3) MOV gross external leakage are not considered.

At Indian Point 3 the MOVs are stroke and leak (disk integrity) tested at 1

each cold shutdown. The leak test rules out the possibility of leaving the valve open, while the control room has a signal indicating a closed position.

I (If both valves had failed open valve disks, this condition would be detected during plant startup.) "MOV transfer open" failure mode cannot happen either, because at this plant not only the power breakers are locked in the off position but even the fuse disconnect is normally kept open during normal plant operation. Gross external leakage would result in a LOCA inside the containment with the HP and LP recirculation paths remaining open. It would cause no overpressurization. The frequency of this failure mode (B.2.6) is very small, so its failure combinations are assumed to be negligible.

I Since Indian Point 3 is at power about 72% of the time the overpressurization frequency of the suction line is calculated by the i

expression (see also Eq. (7)): '

1

't l

4 _

ID L. . . . , ^l - f.

T,(Rupture) = .72x( T.+ 2ARd A , (27) where AR denotes the mean frequency of the "MOV disk rupture" failure mode (B.2.1) and Ad denotes "MOV fails to operate on demand" failure mode (B.2.5).

The time parameter, T.= (1/3) year, is the average time period between cold shutdowns.

The rer. ult of the quantification is:

I s(Rupture = 9.80(-7)/ year .

Similarly, the frequency of " leakage" events is calculated by the expression:

I,(Leakago) = .72x( T + AR (T + 2( Ad ) , (28) where At denotes the "MOV internal leakage" failure mode (B.2.2).

At and Ad denote the same failure modes as were defined above.

The frequencies of various failure modes used in the quantification are given in Appendix B.

The quantification yields:

I s(Leakage) = 1.80(-5)/ year .

The values, Iy(Rupture and Iy(Leakage) are presented also in Table 4.6 for comparison with other initiation frequencies obtained for other plants.

1 4.3.3.2 Calculation of Is at Oconee 3 The MOVs of the RHR suction line at Oconee 3 are located-inside the containment. Thus, the "MOV external leakage" failure mode is not considered in the analysis. As it was mentioned in the previous section, this failure mode would result only in an inside LOCA of low occurrence frequency. The, ,

L

i j, p '

6-31 U2

- .l. .

-u b.

f simultaneous occurrence of "MOV fail open, while indicating closed" failure event is' expected to be recognized during plant heatup and is not further considered. At Oconee 3 the two MOVs are:

e stroke tested at each cold shutdown-and

• • leak (disk integrity) tested at every nine months.

Since the~1eak tests are carried out less frequency than the stroke tests, the "MOV fails open, while indicating closed" (demand type) failure mode would increase after each cold shutdown during the nine month period between two leak tests.

The initiator frequencies are evaluated for four time periods of three months long and the results will be summed to obtain the yearly ISL

! frequencies. The terms to be quantified are:

1st Time Period (0-3 months) t = 1/4 year.

Terms of rupture type (since valve ruptures are detected by the stroke test: T = 1/4 year).

F =

t(1 T + 2ARd A) (29)

Terms of leakage type (since disk integrity is tested only in each nine month period: T = 3/4 year).

F =

t( aft + ALRA T + 2dAA ) (30)

In these expressions AR . AL , and Ad denote "MOV rupture," "MOV leakage," "MOV fails to operate on demand" failure frequencies, respectively.

l 2nd Time Period (3-6 months) t = 1/4 year.

I

The same frequency contributions, F R1 Es plus the. corresponding i corrections

i i

i 2 =

1 1 2 1 1 F F an R R+ ##*R FL =FL + Corr.L .

6-l I

l

l p n ' g p::,-

)

4-32 ' .f U L ; _ L .1 1:

In the first expressions, the correction terms of rupture type (T'= 1/4 year) ')

are:

l Corr. = t(2A Rg #

k * (

i In the second expression, the correction terms of leakage type (T = 1/4 year)'

are:

• AAg (32)

Corr.f=t(2(A g T + kAT) .

In the correction terms A and g AT denote the frequencies of "MOV fails open, but indicating closed," and "MOV transfer open" failure modes, respectively. "MOV transfer open" failure mode is considered only for the second (downstream) MOV, since the upstrean valve is always subjected to the full RCS pressure. "MOV transfer open" failure events may arise at Oconee 3, 2

because according to our knowledge, the fuse disconnect is not kept open normally.

3rd Time Period (6-9 months) t = 1/4.

The same frequency contributions as in the previous period and additional increase of demand type failure terms:

3 2 2 3 2 2 F an Fg =F g + Corr.g R =FR* ##*R .

In the first expression the additional correction term of rupture type (T =

1/4 year) is:

Corr. = 4(2 A) (33)

In the second expression the additional correction term of leakage type (T =

1/4 year) is:

t

{

, Corr.2 = t(2ARg A) (34) -I

. * =

8 q - - - - - - - - - , - -- , --- - - - ,r-- < -

t 6-33 .. --

p t=rp

'(9 e

.v 2 4th-Time Period (9-12 months).

E The same terms as'in the first time period. The frequencies of various failure modes used in the quantification are given in Appendix B.

l The quantification provides the following frequency contributions:

i r

Rupture Leakage 1 1 let time period: F R" *

!9"*I#*' L

~

• 9 *I#*

2 2 2nd time period: ~

!9"*7#** ~

9"*7#*

FR " 0* L"

• 3 3 3rd time period: F ~

R"

• 9"*7#*' L"

• 9"*7#*

4 1 4 1 4th time period: F R

=F R" * '(' 9"*I#*' L

=F L

= 1.38(- W qu.yr.

4 4 Total F ~ "

• I#*' " ~

R

• I#*

i=1 L " i=1 f-The initiation frequencies (by using 86% capacity factor for Oconee 3) are:

i Is(Rupture) = .86xFR = 1.44(-6)/ year and i I,(Leakage) = .86xFL = 5.18(-5)/ year. )

R i- These values are given also in Table 4.6.

4.3.3.3 Calculation of I, at Calvert Cliffs 1 The isolation valve arrangement on the RHR suction line at Calvert Cliffs 1 (Shutdown Cooling Line) is different from those of the other two plants.

1 One of the isolation MOVs is located outside the containment. This requires -

to consider the "MOV external-leakage" failure mode for that,, valve for such n

- ~- -- - e4 n,--- ---,,,,-,,,-m m . ,,,n ,-r - --

c- e, e,-q.-r, ge v -

e-- ,s. . .,v-r - , , , - - , - -r,--- , - -g 4 y, e ~ ww

t' t

7

,.rm 4-34 p,

,. lt-

., ,. . . . . L.. l.

failure event would lead an ISL bypassing the containme1t even though actual overpressuricacion would not occur.

An interesting feature of the Calvert Cliffs isolation valve system that-4 a relief valve is)1ocated between the two MOVs,'inside the containment. While it has the potential for continuous leakage monitoring, its set point (-2485 3

psia) .s is much higher than the normal operating pressure of the RCS (-2250 psia). Therefore, in the present study no credit ,is given to this possibtifcy. E .i y

.6'

{

The MOVs 'are stroke and leak tested at every refueling. There are about A

on the average four cold shutdowns per year. After cold shutdowns, however, S

ist' order' to avoid "MOV failing open while indicating closed" failure mode .

mangali e, hecks are carried out by using calibrated wrench, to check whether the valves are indee'd closed (have the prescribed torque). The maintenance crew (usuall'y consisting of two persons) knows that these valves are " sacred" at the plants and the potential consequence of a failure to close these valves is severe. The mean human error probability that the crew will. leave open the-valves (or initiate restoring valve position) is estimated to be 2x10'f/d. Thus, the combination of this human failure with the "MOV failing open but indicated closed" failure (Ag = 1.04(-4)/ year,'B.2.3) would be about 2x10-7/ year. Therefore, it is taken to b'e negligible.

"MOV transfer open" failure mode is considered only for the second (downstream) MOV because this valve is not under high pressure difference and the fuse disconnects of the MOVc at this plant normally not:kept open.

Calvert Cliffs 1 is at power about 88% of the time. Thus, the rupture and-leakage initiator frequencies are calculated by the following expressions:

I,(Rupture) = .88x( T + 2A ARd+AR ) (35)

! and

-1,(Leakage)=.88x((T+2(Ad+ +

RL * (

l.

g O

- _ _ - . . . . . , . -, - , , , , , , . . _ , . ..rm ,- .- . .-_-

m . - ,.

4-35 [: r..j L... a CU $

The time T is taken to be T = 1/4 year -because MOV diskiruptures would be detected at cold shutdown. In these expressions AR . A L Ad , and AT denote the "MOV rupture," "MOV internal leakage," "MOV fails to operate on demand," and "MOV transfer open" failure frequencies, respectively.

i t-Quantification yields for the initiation frequencies:

Is(Rupture) = 1.45(-6)/ year and l I s(Leakage) = 1.89(-5)/ year.

The frequency of ISL4 bypassing the containment by the "MOV external leakage failure mode" is estimated by the expressions:

s

~ IDirect(Rupture) = .88x(ARol T/2) for cases when the first MOV ruptures and the second leaks profusely, and IDirect(Leakage) = .88x( AL Act/2)

I

, for casts when the first MOV is leaking only. In these expressions Ao denotes the frequency of "MOV external leakage" failure mode (see B.2.6).

i Quantification if performed by assuming that T = 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />, a very conservative case that the external leakage cf the MOV would not be detected. .The values obtained are:

IDirect(Rupture) = 4.22(-10)/ year and IDirect(Leakage) = 1.84(-9)/ year.

t All of the above data are presented also in Table 4.6 for comparison.

. The coincidence of the I,(Rupture) values for Oconee 3 and Calvert Cliffs 1 is completely accidental.

i 4.3.4 Letd'own The letdown line is used to continuously remove reactor coolant for level control and/or RC chemistry treatment.

rg -ry T- vr ygve- e y gwg y-y.,y w gr -r ,

ww-- -.m.y. . -,... - u.+-9 . -.,y a e g-.ppp p w -. s.- %+ ge -4yy, r TY Y '+W

4-36 p:

4.3.4.1 Indian Point Unit 3 l

i Reactor coolant is withdrawn from the intermediate leg of the RC piping through a manual and two air-operated fail closed stop valves, LCV-459 and LCV-460. Three letdown orifices are provided the reduce the letdown flow pressure from RCS operating (2235 psig) to the CVCS operating pressure (225-275 psig). Normally one orifice is in operation allowing normal letdown i

flow at optimum level. .One of the other two orifices is for backup and th'e other is to increase letdown flow when required to the maximum capacity of the CVCS. A relief valve is provided on the inside containment section of the low pressure piping to protect it in the event that either the letdown control valves fail open, the flow orifice may rupture or any of the low pressure i block valves (201, 202) may fail in the closed position. These failure modes s

combined with the failure of the relief valve may result in a pipe rupture.

In case the relief valve opens the result is a small LOCA inside the I

containment. Failure rates for air-operated valves fail to remain open or

fail in the open position has been obtained from.the data'pase included in the Oconee PRA and has the value'of Ay,1y, = 2.01-03/ year. The orifice rupture l rate has been obtained fron the data base provided in the Calvert Cliffs PRA, j A0rifice = 2.63-04/ year. Similarly, the failure rate for a relief valve-to

, open on demand is IRV = 3.0-04/d. The total average failure rate at Indian

Point resulting in a pipe rupture is A

Letdown " ( Valve

• Orifice)

• kV = 6.82-07/ year a

The opening of the relief valve results in a small LOCA inside the containment and its average failure rate is Letdown " balve

• Orifice "

• 7'*#

• i l 4.3.4.2 Oconee Unit 3 The letdown flow from the RCS is routed through the normally used 3A LD l cooler. Two MO block valves are provided on this line, HP-1 and HP-3, inside the containment. There is a redundant cooler and associated block valves (3B, l -

e .. .;

e '

r t

L. . , _ . _ - _ . . ,_ _, -_. - _ _ ~ . -- - , . . - ~ . . . . . - .

- . . . .. .. =. . . . . . . . . . .

4 Y 0 I-k t,

' f, ;

.. - . . L L -

HP-2 and.HP-4). Outside the containment there are two air-operated 'HP stop -

valves (HP-5, HP-6) upstream of the pressure reducing orifice and the letdown-flow control valve (HP-7) parallel with the orifice. .The RP/LP boundary is located outside the containment including the relief valve on the LP piping.

. Failures, such as orifice rupture, domineralized inlet valves -fail closed or letdown flow control valve fail open leading to overpressurization of the LP piping results in a small LOCA outside the containment, even if the relief valves open. The failure modes to be considered are the same as previously -

discussed in Section 4.3.2.4.1.

AValve = 2.01-03/ year 10rifice = 2.63-04/ year .

The average failure rate for the letdown system including small LOCA events due to overpressurization and consequent opening of the relief valve is a

" * ~

j Valve

• Orifice

• I'"#

• Letdown i

4.3.4.3 Calvert Cliffs Unit 2 4 .

! Coolant letdown from the cold leg first passes through the regenerative heat exchanger and then through the letdown control' valves. The valves, controlled by the pressurizer level control system, control the letdown flow 1 to maintain proper pressurizer level. An excess flow check valve is installed before the control valves to limit the letdown: flow in abnormal circumstances. RC pressure is reduced to CVCS operating pressure in one of the air-operated letdown control valve. A relief valve on the low pressure side prevents the overpressurization of the LP piping.

I The average failure rate of the letdown system can be obtained using general valve and orifice failure data as in the previous section and estimated as:

<A

' Letdown > = 2.28-03/ year .

s 4

, , - , ----,_.-,--,w--- n,- - - , - - - --- +n- ,-,, - . , n , , ,, n - . - - ,-e-- -,--- r, , , ,.

r . ; p:: ,-

4-38 - '

. . . . L 4.3.5 References

1. " Indian Point Probabilistic Safety Study," Power Authority of the State of New York and Consolidated Edison Company of New York,1982.

.2. "Oconee PRA, A Probabilistic Risk Assessment of Oconee Unit 3," NSAC-60, June 1984.

- 3. " Interim Reliability Evaluation Program: Analysis of the Calvert Cliffs Unit 1 Nuclear Power Plant," NUREG/CR-3511, March 1984.

1 e

.r .,,a ..., *

t. -

f . ,* > .' ?. 34 i . r '* .

{L

• L . . . '.. . c , ' ]

e f 8 i f ' ' f 8 *8 8 84 s s a e e e sse t  : e i 'a' e ein # e- 'i e....

1.0x10-l  !

a t .. J a.1. . _..-

.. u

}.]

, s , ,

H . .., ~ 4

. i '< ,

i ,

, g. i ,(: : t

. ( a.

, x,

., g L.. - . "' ~ . . . .~

i em h-e .

s x , , ,

5,, .

o s N -

-1 erp  :::- t .-1 i"

$ 'M:?

d : \  ; ~

?

'l l ,

.. ]

-Y

) kW .l i ijD  : i

~f 'P as " ' ga Thctm

' Rah. '

i 10) :l

• l u l.0x10-2

'y

'T

' it:

4 c X_ , ,

' ,_1.._,

( ,

to

.,..T-m '

', x' ' _, :.2. .Y. _, l. t .

4 o i i . .! V, s .' - ,' ,

g ,

.!, . t ..< , y .,

A-#. # . . .  ; -tp3ic;.

y l 6- t _t.

l am8c =

\,i - - -

,-tj-'1"i,'

s . ,

'l

't. .

y ,

.#. .i i 4 ~# g .

3 ,

i ,

-t-c

, .l l- .-  ;

.r.l . .  %. . . . -

. l .. t j.. ,1

.a

= :t -

m. 4 -< : .. :.  ;

== :l: i. '.

=: ::: ::h; .l; g

g i,n,,o-3 .: .  :: . r .: ;. 1.. : 1 .

(:: ::: .:l: .. .; l-b w  ;

i u

i s

m ,,

y i , ,! .- .

1. . , . i s , , ,

t. ..:

1. s , , i ,

7 ._g

.._g.

l i l

' ~ - -

j L

-J-- -f 'v

]

..l. ...

l- j

p _

g.

3 _

III III ib ' A E ,III III # '"'

~ ~

l 1.ox10-4 : '

s ,

1 10 100 1000 10000

, Leakage Flow Rate Through Accumulator Injection Lines (GPM) i l

1 i

j Figure 4.1 Frequency of accumulator inleakage events.

t l

, , , , . _ y,. . - - . -

.,~x- - " *W"'

M i' ** - l{,*r

' i  !

. .. .. d L

't 1.0a10 g . !

1 P 3 a 6 III8I ~

P l 4 5 ll '88I - f 8 8 8 8 '888 8

! 8 8 ll 88?'- 8 8 *  ? 88

+ ._e . - . ..g ..- E

. x , , , , .' ...4.. ..._

s i X i r 4 4 1 i 8

.(: -

4 : t! -

'! l ~ 0 l l l I

.x, ,

x . .

.. .._. g . ,r... , }..

s -x . . ..

u ..

3

~  %

j -

e

_ . I . .a .

l g Cd 64

.: y-:- -

'l -l j

- 5. L. J ss ahga Fisctjn[ 10)

• I $ h; l au i.0 i0 2 l

4 4  ; . -

.. _ . ..m.

= -

. . .x

~

s , ,.

m

. q... _

4

~

'O

, x xi ' '

. i s.  : a. . . . ,

i x . .g i i- . 4 i . .i U i 4 en m --

X  : ;N 6 i t t +

ij t.

am-?N- N U  ;

r -'

M i... J'

, "i ' . -t.

I  % \ '

w '

in . #

l l :A. a i.  %

. 1. . .

l l

e l

E w

i -

l' .

l

. i!N,-: ! ' 4

~

-l --

l

]iiii d:: :Ehd..:5 5.,,,,,.3  :!=.: 5:lF1. -

~ . . ..

li :=  :: d n ^

1 i w

.1. . .=  !!ii != .5- : .l . l .

w ' - r -.. . _ -

2 4 -

6 ,

i e i s s $ 11 ,_ ,

I , a , i

) I 'g t i I 9 e

.i.-- t. -

i t s r '6 -l l i

-j ._ . ,

9.. .....{..

7 4 '

1 + ' '

' t- I s,.. , s . ....  !. [

( ,

n. i . l .. .T' I. ~

!!! d!- ;i! -

-l 'a

~..

!f i.~fi!!

l ..

!I i;

i i '

3,,,g,-4 f1: nt

. - _5..-

- - .m' y,b..i. . . t.fili . :'. .

~

• ..:i.!

! *,  : 4 i

.L 1 10 100 1000 10000 ,

4 i Leakage Flow Rate Through Accumulator Injection Lines (GPM) 4 1

!l 1

1' 1

1 1

1 Figure 4.1 Frequency of accumulator inleakage events.

4 4

9' d'

"'~.

r f.n e-

• ..pt,a t

L cu [.

-4 1.0x10 ' - -

2. Leakage Flow Rate Through Shared 1.PI/HPI/ Accumulator Inlet

--. (GPM)

With accumula-t - --

-- - , - - tor inleakage 4_.. . . . . . -

' ~~

Without accumu-

.. .. lator inleakage a_. . . . .

u ndian Point-3 1.0x10 -5 '9-0

.g n 1

r. _-.; . - - . . - . . . o g

m

. c N "

N . . t, c:

\ .. Oconce 3 1.0x10

-6 -. .

\ - - - -

te a . . . . . . . . _.-. I o u,

y s

~- \- Indian Point-3 ,

a T - - - -

u e

g .

y 3 . _ .

g . . .

g --

g N

• e ... -

\  :

Ci

\ Oconee 3 0 1.0x10

-7 \

w o

- - - - - - - - - - - - - - - - - - - "o f _ _. -- N - - - - - - ---

---:- m g

p -

g

" O 5

. - N e

=

e a -- . . \ . ... .. .o.

'd 'r - N A w v. - - .

..\. m 2------

N .

alvert Cliffs-1

\ ,

-8 E 1.0x10 -.. -

w

\

\

y - . ..

\

\ ,

g -

i

\ \Calvert Cliffs-1

-9

• 1.0x10 100 1000 10000 100000

' p. " ;~ T= =~i I l i'

s. . .. u u a

~

• Leak fiow rate at the inlets of HPI' lines'(gpm)

A Group B Lines

[~

A E

-5 40 1.0x10 g i

EA Ba 23 Group A Lines (With accumulator inleakage) " e_

de

\ < ,$

-6 '

1.0x10 xe

,s aA ou

\ .ht Group C .

8a N-Lines N .

4 Group A Lines -

(Without accumu- \ #

1.0x10 lator inleakage) \ "

\

4

\ -

N

~

1.0x10 100 10no 10000

4-42' '"

• C 3;  ; l' e(x67 c :.-

Table 4.1 L...d[

Some Design Characteristics of The Accumulators (Core Flooding Tanks) at The Selected PWRs Design Characteristics Indian Poin't-3 Oconee-3 Calvert Cliffs-1 Number of accumulators 4 2 4 Design pressure (psig) 700 700 250 Operating pressure (psig) 650 600 200 Tank total volume (gallon) 8230 10547 14960 Water volume (gallon) 5240 7780 8325

" Free" volume (gallon) -3000 -2800 -6650 Number of relief valves- 1 1 1 Relief valve size 1" la 1" Relief valve setpoint 700 -700 250 Relief valve capacity (est.) (gpm) 710 710 425 Drain line (accessible) and size (inch) 1 (1") 1 (1") 1" (1")

Drainage capacity (gps) -1250 -1250 -1250 l

i 5

a g.*l'

,. 8 , 1 i' I 1

- - - - - - - - - - ,- m-n--, ,-- - . , , - - , . , , , , - ,, - r - - ,,

4-43 [*5' ;

ts

. t. . a Table 4.2 Filling Time of Accumulator's " Free" Volumes For Various Leak Rates

• Indian Point-3 Oconee-3 Calvert Cliffs-1 Leak Rate Time Leak Rate Time Leak Rate Time (gpm) (min) (gpm) (min) (gpm)- (min) 100 30 100 28 100 66 200 15 200 14 200 33 300 10 280 10 300 22 500 6 467 6 500 13 740 4 700 4 665 10, 1000 3 1000 -3 1000 -7

• Leak rates underlined correspond to the " critical time" necessary to the operator to take successful corrective actions.

i I .

l l

l r-i 4

I _ - ._ _ _ , - . _

4 4-44

~ f= .- :

. ta a i Table 4.3 ISL Initiation Frequencies For Accumulator Pathways With Some Relevant Parameters Used in The Calculation Indian Point-3 Oconee-3 Calvert Cliffs-1 Reactor at power .72 -.86 .88 Number-of lines, -

4 2 4

' Size (inch) 10 14 12 Leak rate (gpm) at the

" critical time, 10 min.," 300 280 665 Leakage exceedance frequency 3.1(-3) 3.3(-3) 1.7(-3) at above leak rate (per

• line year)

ISL initiation frequency at 8.93(-3) 7.02(-3) 5.98(-3) above leak rate IA (Per year)

ISL frequency at accumulator 4.64(-3) 4.10(-3) **

i relief valve capacity (710 gpm) (710 gpm)

• Correction: EA = 7.84(-4).

I

• • Not calculated (relief valve capacity is smaller than 665 gpm. )

1 I

k

. l l

, _ _ . _ _ _ _ . . . _ , . , . -. . . , - ,, . ., ....z., ., .-,

4-45 m e ; ,- :

k I*

Table 4.4 ISL Initiation Frequencies for LPI Pathways LPI Inleakage Frequencies Leak Rate @ With W/O IL p1 Initiator Number The Shared Accumulator Accumulator Frequencies Selected of LPI/HPI/Accum. Inleakage Inleakage For Further Analysis Plant Lines Inlet (gpm) (Per Year) (Per Year) (Per Year)

Indian 4 98+ 1.27(-4) 8.86(-6) 8.86(-6)

Point 740++ 1.19(-5) 8.33(-7) 3 -2100+++ 4.50(-6) 3.20(-7) 5.33(-6)

Oconee 2 100+ 8.84(-6) 6.19(-7) 6.19(-7) 1 660++ 1.03(-6) 7.23(-8) 1370+++ 4.86(-7) 3.40(-8) 5.58(-7)

Calvert 4 130+ 5.60(-8) 3.92(-9) 3.92(-9)

Cliffs 330++ 1.50(-8) 1.05(-9) 1 -1400+++ 2.35(-9) 1.65(-10) 3.40(-9)

+ Leak rate equal to the maximum charging flow rate.

++ Capacity of relief valves at injection side.

+++ Leakage required to exceed the capacity of relief valves given accumulator inleakage.

i I

4

l j

l i

,, , _ . . - - , ~ ,- -. .-. -- -- -

i 4-46

.,,[

- - . !: b Table 4.5 ISL Initiation Frequencies for HPI Pathways HPI Inleakage Frequencies Leak Rate @ With W/0 IMPI Initiator Number The Inlets Accumulator Accumulator Frequencies Selected of of HPI Lines Inleakage Inleakage For Further Analysis Plant Lines (gpm) (Per Year) (Per Year) (Per Year)

Indian 4 -98+ ~2.60(-5) 1.81(-6)v Point Group A 580++ 2.05(-6) 1.44(-7)* Small LOCA 3 14600++ 4.30(-8)* 3.00(-9) Sum of 7 5.52(-4) 4 98+ No shared 5.47(-4)v overpressurization Group B 580++ inlet 1.38(-4)* Sum of * = 1.39(-4) 2 98+ No shared 2.76(-6)V Group C 580++ inlet 3.51(-7)*

Calvert 4 130+ 5.60(-8) 3.92(-9) --

3.92(-9)

! Cliffs 580++ 8.84(-9) 6.18(-10) 1 28420+++ <1.0(-10)* <<1.0(-10) 7.18(-10)

+ Leak rate equal to the maximum charging flow rate.

++ Capacity of relief valves at injection side.

+++ Leak rate required to exceed the capacity of relief valves given accumulator inleakage.

Calculated as: Leak rate at relief valve capacity / flow diversion ratio at the shared inlet.

Flow diversion ratio: Cross section of LPI line Cross section of acc. line Indian Point 3: Flow diversion ratio: .04 Calvert Cliffs 1: Flow diversion ratio: .02 3

l I

I 1

4 h

" ' ~ ~ ~

i 6-47 [Y i6 ,,

Table 4.6 ,

ISL Initiation Frequencies For RHR Suction Pathways Is (Per Year)

Plant T4akage+ Rupture ++

Indian Point-3 1.80(-5) 9.80(-7)*

, Oconee-3 5.18(-5) 1.44(-6)*

1.89(-5) 1.45(-6)*

Calvert Cliffs-1

Direct leakage from external MOV 1.84(-9) 4.22(-10)*

• Selected for further analysis.

] + Leakage defines leak rates smaller than the capacity of suction side relief i valve.

++ Rupture defines leak rates higher than the relief valve capacity.

l 2

1 J

1 i

i 4

O l

i 1

. . .. . --. . . . = - - . . .- . .. -- .

5-1 ..7 p my-r_ :

.wL' 4

6

5. ' CORE DAMAGE FREQUENCIES AND EVENT TREES l The event trees have been constructed in such a way that for any given initiator the end states correspond to an initiating event of the respective PRA studies of the particular plant.1-2-3 In this manner all events are

{

classed as small or large LOCAs, inside or outside the containment building l

with a respective conditional core damage frequency derived from the plant PRAs. The effect of ISL on Safety systems required to mitigate a LOCA has

]

also been considered in determining the conditional core damage frequency.

Table 5.1 lists all. conditional coreadamage frequencies as derived from the

!, plant specific PRA studies. The main results of this study, the core damage t frequencies due to ISLs are listed in a summary format in Tables 5.2 through

5.6 for the three plc.nts.

One of the major assumptions in this study is that small LOCAs bypassing the containmint would eventually . dad to core damage. In order to mitigate '

LOCAs bypassing the containment the operator has to rely on the water supply I

j available in the RWST. Once the RWST is depleted additional source of water l must be found.

4 3 The time available to establish nakeup to the RWST varies depending on f the size of the break and the available equipment and could range f rom 3-4 l minutes (-6" break no LP, no HP systems), to a few (-12) hours (-1" f break HP available)." The makeup to the RWST would be based on an "ad hoc" j arrangement, and consequently was not modelled. Core damage was assumed to occur when the RWST has been depleted. In Sections 5.1 through 5.5 the event l trees for all interfacing systems are discussed along with the additional I assumptions used to establish the core damage frequencies. Section 5.6 l briefly describes the method used to derive the conditional core damage frequencies from the plant specific PRAs. The core damage frequencies are

presented in Section 5.7. In Appendix C assumptions used to quantify operator ,

f performances are discussed and Appendix D presents a brief summary of the t

1 thermal-hydraulic aspect of ISL events.

i

i l

i i

t I -

- -, ..,.,.- - -. - - -- - - - --._ ----- m . _ _ , - _ - . _ - , _ . - . - , . . . . . ~ .m.. _ - - . . _ . . ~ . . . _ _ -

- u y -- . - p : ..

5-2 i '!:

L_ . . . . 6-5.1 LP Injection t

The event trees for the three plants are shown on Figures 5.1 and 5.2.

An overpressurization event of the LP injection lines at Calvert Cliffs &

Oconee cannot be isolated causing a LOCA bypassing the containment. Even though at Oconee one LP injection train might be unaffected, the loss of recirculation capability leads to core damage once the RWST water supply runs out. The Indian Point arrangement is different from the other plants, because a large portion of the system is routed inside the containment and in addition i there is isolation capability on each injection line. It is very likely that an overpressurization event of the LP injection line at Indian Point will result in a LOCA inside the containment. The injection line is designed such, that the operator has the capability to terminate the blowdown of the primary ,

coolant by closing at least one of the two high pressure rated MOVs. In addition to the major pipe break event, the top events are (a) pipe break location, inside/outside containnent building, and-(b) operator diagnoses the event and attempts to terminate it. In case of a small break the probability of a pipe break inside the containment was estimated at .9. This probability was based on engineering judgment af ter reviewing the piping design and actual layout of the LP injection piping. In case of a small break inside the j containment, the primary concern is that depending on the actual break

, location the HP recirculation capability might be disrupted increasing the

core damage frequency due to an unisolated small LOCA without recirculation.

i Thermal-hydraulic calculations" have indicated (see Appendix D for a v

i brief summary) that there is ample time available (2-3 hours) to the operator to diagnose a small LOCA event. It is assumed that at least one of the two j isolation MOVs would operate and would terminate the blowdown of the primary coolant.

The NREP cognitive error function (see Appendix C) has been used to determine the probability of an operator error, 9x10~", having -2 hours

! available to recognize and isolate a small LOCA through the LP injection lines.

e 4

1 4

,--.----.-~v,--n~.. , - - - . , ,, - , - - , , , - , . , . - , - - - - . , - . v.-_ . . ..-.,-nn. - , , - ------e , .- ,,,,.-,.,.,e -

..m. - - - , , , - - - ,,

- , - - - - .-. ~.. .- . . . - , . - . _ . . - . - . . . - _ _ . -

o .

, 5-3 f ?; [ .?

Lt .

L.

s'3 tj b The core damage frequency for terminated small LOCAs has been determined 4

using the unavailability of the HP injection ~ system.

'A small break outside the containment on the recirculatien line '

connecting the LP outlet to the suction side of the HP peeps uculd disable the normally closed isolation valves. The RWST would drain through the pipe break and the RP pumps would be unavailable leading to core-damage regardless of the

! isolation capability.

1 j A large LOCA inside the containment would disable one LP injection line i

making the LP pumps unavailable, leading to core damage. It is assumed that the isolation capability would be lost during a large LOCA, because the .

isolation MOVs are not designed for high flow and.high~ temperature conditions.

5.2 SI Discharge

• The event tree (Figure 5.3),.for the SI line overpressurization event is

] relatively simple at Calvert Cliffs. There is no isolation capability, i therefore, a pipe break (small LOCA) would eventually lead to core damage, when the-RWST water supply is depleted.

At Indian Point some low pressure portion of the SI piping is inside the

! containment making the event tree somewhat more complicated -(Figure 5.4). In j addition, an open MOV on each injection l'ine can isolate 's LOCA event. Given l an overpressurization accident the relief valve common to both train will open leading to a small LOCA inside the containment. If the leak does not exceed l

the relief valve capacity, than the core damage frequency is what associated i

i with small LOCA. The integrity of both injection train is intact and can be l used to mitigate the accident. If the leak is larger than the relief valve I

capacity the integrity of the piping boundary may be lost.. If the pressure 1

boundary is damaged at the train isolating check valves (858A or B), then the l other train may loose enough flow through the break making the HP system l

1 unavailable. This leads to CD even if the blowdown is terminated by the operator (no makeup capability).

l 4

. . _ . - ~ - _ . , - - - _ - - , , --,--...,-..._ -- -,, -.-._._ .-. .._ .._~ __,,,.._..--,..-,.-.__.,_mm,,~...,m.-, ,y ,-.- ,.,-.. ,, -

l 5-6  !

u l

l If the pipe break is located outside (with a probability of .1) and is not terminated, CD will result, because of the lost recirculation capability.

In addition, the RWST could most likely be drained through the damaged train

~

making the progress of this accident much faster (reduced RWST inventoty). In order to terminate the accident outside the containment on the HP pump discharge line, the operator has to (a) be able to diagnose the problem, (b) terminate the RC blowdown with the SI high pressure isolation MOV, and (c) be able to isolate the damaged HP train and stop the RWST drain. The available time is judged to be 30-60 minutes. Considering the complexity of the

! accident and the short available time the probability of an error in the -

, operator's action is taken as .1 (the HEP for post-diagnosis activities are taken as 1.0; see Appendix C).

j The CD frequency associated with the small outside LOCA, terminated by i 'the operator has been calculated using HP system unavailability with one train in a definite failed mode.

5.3 RHR Suction 1

i l The event trees for all three plants are very similar and are shown in Figures 5 5 and 5.6. The main difference at Calvert Cliffs is that the pressure isolation boundary is located outside the containment leading to LOCAs always bypassing the containment. At Indian Point and Oconee the initiator or overpressurization event may cause a pipe break either inside or outside the containment. The first top event is to decide if the event is a small (<6") or large break. The location of the pipe break is of utmost l importance and the second top event determines if this is a break inside the containment or bypassing it. The probability of a pipe break outside the

ontainment at Indian Point has been based on field observations and was estimated at .5. The length of the LP piping are approximately equal on both

sides of the containment wall, there are few pipe turns and bends and relatively few weld locations. These observations support an equal j conditional pipe break probability for the inside and outside LP pipe i

segments. At Oconee the line just beyond LP-2 is designed for 200 psi. It connects inside the containment to a low pressure pipe designed for 388 psi.

There is also a relief valve (388 psi setpoint), which could not relieve the 4

I t

. .. . ~ _ _ . - , - . - .-.- .. . .- --- - . _ _ _ _ _ _ _ _ _ - _ _ .

4 -

.5-5' rp

$. ,5) g"rr.AI:

g

( t

. L: u-full pressure. The relief valve and the 200 psi line are the most likely i failure points. The probability that pipe break occurs inside the containment was estimated, based on these considerations at .9. If the.overpressurization

is such that the' relief valve is lifted and the leak does not exceed the t - relief valve capacity the end result is a small LOCA inside the containmant.

Each plant has an additional low pressure rated, normally closed valve on the I suction line after the two closed MOV. The assumption has been made that a

- major pipe break outside the containment would disable this valve. However, i

for small breaks, this third isolation valve would maintain the pressure l boundary. In either case small or large LOCAs outside the containmenc '

eventually lead to core damage, because recirculation is unavailable and the

)

RWST water supply is limited. Naturally the time available to find additional.

water supply would mainly depend on the size of the break. This ranges, depending on on the available equipment, from a few minutes (large LOCA, no makeup capability) to a few hours (small LOCA, RP available).

l j 5.4 Letdown Lines a

Figures 5.7 and 5.8 shows the event trees for the letdown lines. The a

primary top event asks whether the operator can recognize the nature of the

, ,i j accident and what action might be taken. The time available, even when the HP i

l

] system is unavailable, is about 1-2 hours before core damage starts. The 1

] blowdown can be terminated by closing the high pressure rated letdown stop l valves. The probability of the operator not able to recognize and terminate 5 the accident, 1.2x10'3, was determined from the NREP cognitive error function 1

(Appendix C). In this accident substantial amount of primary coolant may be lost requiring makeup capability using the HP pumps. The core damage

j. frequency associated with terminated small LOCAs reflects the unavailability i of the HP system.

I At Indian Point, in addition to operator action, a top event representing l inside or outside break location is also included. The probability of a j letdown pipe to rupture outside the containment, .5, has been estiasted as previously described in 5.3.

i 1 , e j e i

.-_-_._-__.__._m.,,___,_ _ . . . _ _ , . , - _ _ . _ . , . . . _ _ _ , . . _ . . _ , = . - , , _ . _ . , _ , . . . . _ _ , , _ , , , . ,

. __ = .

5-6

-- ry - r:qs 5.5 Accumulators '

The event tree for the accumulator system is shown on Figure 5.9. The accumulators are well instrumented including high pressure and high-low level alarms. The operator can easily recognize and diagnose a small ISL event with ample time available to terminate it. Therefore, below a critical leak rate (see Section 4.3.2.1) ISL's are essentially non-events. If the leak rates are above the critical level the time available for operator action is in the order of a few minutes. It has been assumed that initially the operator would try to maintain the water level in the accumulator by draining the excess leakage. The operator error associated with the draining action is based on the lower bound HEP values of Figure C.1 (Appendix C). For Oconee no remote draining capability has been identified eliminating the possibility of this action. If the back leakage is in excess of the drain and relief capacity a major pipe rupture may occur. The operator may be able to terminate the ISL event by closing the high pressure rated MOV on the accumulator outlet lines,

, which is deenergized open in normal operation requiring local action at the

, valve MCC. The probability of an operator error, including the probability of an MOV failure to close on demand has been estimated at 3.0x10-3 using generic MOV data with the error recognition function. In case of a major pipe or tank rupture the event is equivalent to the large LOCA DBA of the FSAR with one accumulator not being available. All the plant specific PRAs discuss and quantify this event.

5.6 Conditional Core Damage Frequencies (CCDF)

The CCDF values have been derived from the plant specific PRAs. I-3 All ISL events result in a small or large LOCA, inside or outside the

< containment. In addition, the effect of the initiating event (ISL) on some of the safety systems required to mitigate the accident has to be also considered.

l

,. L

, . -. . . . - - - - . - -- - - - .- _ .- . - -. - . - ~ .

5-7 .. -. e p--

L- .... ' i 5.6.1 Indian Point (Reference 2)

I In the following events the operator is unable to isolate the primary coolant leak and a failure in one of the required safety systems leads to core damage.

1

1. Large LOCA Inside Containment - 8.4-03.

{ This sequence is basically dominated by sequences AEFC and ALFC, i which reflects the failure of the LP injection or recirculation functions (Table 1.3.6.1-4 of Reference 1).

I 1

2. Small LOCA Inside Containment - 5.7-03.

1 I

The Indian Point PRA has three LOCA classes (large, medium, and a

small). In this study the medium and small LOCA has been grouped I into one (small loca <6"). In this case the dominant sequences are

( again reisted to the injection and recirculation functions (see Table 1.3.6.2-4 and 1.3.6.3-4 of~ Reference 1).

1 l ISL events terminated by the operator result in core damage only if the

makeup capability to the RCS is lost.

3. Small LOCA Inside/Outside. Terminated - 1.7-04.

j In this case the operator is able to terminate the-loss of the j

primary coolant, but it is assumed that makeup is still required to prevent core damage using the HP injection system. This value

{ essentially represents the HP system unavailability and corresponds 5

to the SEFC and AEFC sequences in Table 1.3.6.2-4, Seq.13-HH-1 J

failure and Table 1.3.6.3-4, Seq. 35-HH-2 failure. >

i

4. Small LOCA Inside/Outside HP Train'Affected - 5.74-03. '

The ISL event may affect one HP injection train. The unavailability e

of the RF system may be recalculat'ed in terms of the unavailabilities i

e F

--r=---- --&es  :-n-+-ew ---v<-w----- 3 w p~ ~m-- ,>-eme-e m,---%, e,s--wr--.-4-e*+---w- re^ e- - - - . . - - .m *-

5-8 { P, f [.:{2 t;-

L.: J tlli(t1 ' ; ? u' of the dominant contributors with one train in a failed mode. The dominant contributors with the original quantifications are found in pages 1.6-461 through 1.6-467 of Reference 1.

5.6.2 Oconee (Reference 2, Volume 4) .

1. Large LOCA Inside Containment - 1.03-02.

Large break LOCA events are contained in Bin V and VI. Bin V sequences include all those initiating events where core melt results due to failure in the injection phase (AU sequence). Bin VI 1

correspond to failures in the recirculation phase (AX sequence). The dominant cutset listing for Bin V and Vi including the initiator value are in Chapter D.2.7 and D.2.8 of Reference 2, Volume 4, Appendix D.

l

2. Small LOCA Inside Containment - 2.1-03.

1 l The dominant sequences leading to core melt are primarily related to the unsuccessful operation of the HP injection and/or recirculation system. These sequences are contained in Bin I (SUs and SY,Xs )

and Bin II (SX,). Again, the dominant cutsets along with the initiator are listed in Chapter D.2.1.1, D.2.1.3 and D.2.3.3 of Volume 4, Appendix D of Reference 2. ,

3. Terminated Small LOCA Inside/Outside - 1.6-04.

The HP system unavailability has been derived using the SU, sequence of Bin I.

J 5.6.3 Calvert Cliffs (Reference 3) i

1. Large LOCA Inside - 2.8-02.

The quantification of all large LOCA sequences, indicated on Figure 5.4 of Reference 3, is listed in Appendix C, Table C.9 of the s.ame,.

. . .. _ - . ~ . - -- . .

- 5-9'  ;','

i reference. The CCDF due to large LOCA has been calculated based on f

the initiator value listed in Figure 4.1 of Chapter 4.

i l

2. Small LOCA Inside - 1.3-03.

[ Similarly to the previous case, the quantified sequences, which are

}

lifttd.i.g_ Figure _5.. h _ vere.renormalised using~the initiator value from Figure 4.1. The numerical values of the sequence probabilities i are also listed in Appendix C, . Table C.9 of Reference 3.

!- 3. Terminated. Small LOCA Inside/Outside - 7.5-05.

1 The HP system unavailability has been derived using the S D" 2 sequence with the corresponding initiator.-

5.7 Core Damage Frequency (CDF) j The plant and system specific CDFs are listed in Tables 5.2a through l 5.4b. In Tables 5.2a, 5.3a, and 5.4a only ISL events resulting in i overpressurization are shown. If the system is equipped with a relief valve than overpressurization occurs only if the leak is in excess of the capacity l

of this valve. The opening of the relief valve results in a small,LOCA inside

the containment and the associated CDF values are listed in Tables 5.2b, 5.3b,.

and 5.4b.

I i

) A summary of the total.CDF due.,to I.SL, both inside and outside the containment, is shown in Table 5.5 with the respective CDF values (due to LOCAs) from the plant specific PRAa.

i i

It can easily be seen that the total CDF due to overpressurization is 1 less sensitive to low values of the major pipe rupture probability parameter.

This is mainly reflecting the assumption that small LOCAs bypassing the containment would eventually result in core damage. Therefore, small LOCA

! events will be the dominant contributors to CDF when the major pipe rupture

) probability is small.

t i

4

- . . , , .--- ,,,--,-.,-,- --..-,,z_- ..-,- . , . . - . . . . _ - . . . . . , - - - - , - - - , - - - . .

~ "

5-10 ."

L:

~

~-- - . u ;; l The most important result of this study, CDF due to ISLs bypassing containment are listed in Table 5.6. This again reflects the dominance of small LOCA events at low P(Rupture).

The total contribution of these events to CDF due to LOCAs is rather small (*1%), but naturally they are one of the most significant type of

contributors to risk resulting from core damage. -

5.8 References

1. " Indian Point Probabilistic Safety Study," Power Authority of the State of New York and Consolidated Edison Company of New York,1982.

1 ,

j 2. "Oconee PRA, A Probabilistic Risk Assessment of Oconee Unit-3," NSAC-60, June 1984.

3. " Interim Reliability Evaluation Program: Analysis of the Calvert Cliffs

] Unit 1 Nuclear Power Plant," NUREG/CR-3511, March 1984.

l 1

j 4. " Dominant Accident Sequences in Oconee-1 Pressurized Water Reacter,"

l NUREG/CR-4140, April 1985.

4 a

i i

i 1

i i

4 i

5-11 7.= q p i

. AL bN E

i 1

Conditional Core

Overpressurization Damage Multiplier (Initiator) Major Pipe Rupture (CCDF)

Small LOCA/Out 1.0 1 10- 1,10- 3,3. 0x 10- 5 Large LOCA/Out 1.0 t i

i Figure 5.1 ISL Event Trees - LP injection, Oconee and Calvert Cliffs stations.

1 1

i ar

,s w-I t

-n,- -. --- , , , _ ,--- .,-.-- -.m - - . - , , , - . . , . - - . - . - - , . . , , . , , , , ,, . . . . - . . , - _ _ , .

, . - ~ .

, 5 '

i h

, g - - -- - : -

4 s

_ [ . .: I .

i Ovarpres- Maj or Break Operator Conditional Core surization Pipe Outside Diagnoses Damage Multiplier-(Initiator) Break Containment Terminates (CCDF)

Small LOCA/In 1.7-04

! 9x10~" Terminated Small'LOCA/In 1.0 10-1 IIP Recir.

Small LOCA/Out 1.0 10~,10-3,3x10-5 1.0

. j-l Mrge LOCA/In 1.0

J LP Recire.

T 1

e i , Figure 5.2 ISL Event Trees - LP injection, Indian Point Station. ,

('

)'

i r (

l V ri t' 4 by- 3

'p t

i ,. ,1

. L ,

.l 1;

t 1

I r

..5-13

, r r < "g.

k i . . . .

t I

p I

4

. Conditional Core Overpressurization Pipe Pressure Damage Multiplier (Initiator) Boundary Maintained (CCDF)

OK

.1,10- 2,3x10- 5 Small LOCA/Out 1.0 4

' Figure 5.3 ISL event tree - SI discharge, Calvert Cliffs station.

I

/

e f

A i

e 4'

'\:

I 4'

/

., l ,

• I l

i, ' i k i j

e

\

e w n my,a - , , , - _ _ , ' , , , , , _ _ _ .

4 5 r- - " r :--'-

I

.: . . . . . u Pipe Oy::rpres- Pressure Pipe Operator Conditional Core Break Diagnoses Damage Multiplier surization' Boundary Outside Terminates (CCDF)

(Initiator) Maintained OK

.1,10-3,3*10-5 Small LOCA/In 1.0 Terminated, HP

.1 Small LOCA/Out* 5.74-03 Terminated

.1 Sa'all LOCA/Out 1.0

1. CCDF calculated with one side in failed mode.

Figure 5.4 ISL event tree - SI discharge, Indian Point Station.

I 4

l l

i i

1 5-15 f I

i

. \

u ... . L i 1

Conditional Core "

Overpressurization Damage Multiplier (Initiator) Major Pipe Rupture (CCDF)

Small LOCA/out 1.0 10~ 1,10- 3,3. 0x10- 5 Large LOCA/Out 1.0 Figure 5.5 ISL event trees - RHR suction, Calvert Cliffs Station.

I

.L-f

, - .~. _- -

5-16

'N T r:t~4

%l. .

me

! Conditional Core Overpres- Major Break Damage Multiplier surization Pipe Outside (CCDF)

(Initiator) Break Containment Indian Pt. Oconee Small LOCA/In 5.7-03 2.1-03

.5 Small LOCA/Out 1.0 1.0

(.1) Oconee

.1,10- 3,3x10- 5 Large LOCA/In 8.4-03 1.03-02

.5 Large LOCA/Out 1.0 1.0

(.1) Oconee Figure 5.6 ISL event trees - RHR suction, Indian Point and Oconee Stations.

,4

\ -$ '

i .. , , - - - - - -

5-17 r: . . .

lC Pipe Conditional Core Ovstpres- Pressure Operator Damage Mul'tiplier surization Boundary Diagnose's (CCDF)

(Initiator) Maintained Terminates Oconee Calvert Cliffs Small LOCA/Out 2.1-03 1.3-03

.1,10-3,3*10-5 Small LOCA/Out 1.6-04 7.5-05 Terminated 1.2x10-3 Small LOCA/Out 1.0 1.0 Figure 5.7 ISL event trees - Letdown lines, Oconee and Calvert Cliffs Stations.

O

e

..e Overpres- Operator Less Than Major Conditional CCDF surization Able to Drain + Relief' Pipe Operator Indian Calvert Initiator Drain Capacity Rupture Terminates Point Oconee Cliffs Small LOCA Terminated 1.7-04 1.6-04 7.5-05

.56-0C Small LOCA 5.7-03 2.1-03 1.3-03

.48-CC -

Small LOCA Terminated 1.7-04 1.6-04 7.5-05

.3-IP .1,10- 2,3x 10- 5 1.0-OC Large LOCA 8.4-03 1.03-02 2.8-02

.3-CC Small LOCA Terminated 1.7-04 1.6-04 7.5-05

~

• I* '

.44-IP .1,10-2,3x 10- 5

.56-OC Large LOCA 8.4-03 1.03-02 2.8-02

.48-CC Small LOCA Terminated 1.7-04 1.6-04 7.5-05 Small LOCA 5.7-03 2.1-03 1.3-03 IP = Indian Point, Unit 3 .1,10-2,3x 10- 5 ,

OC = Oconee, Unit 3 Large LOCA 8.4-03 1.03-02 2.8-02 ,

CC = Calvert Cliffs, Unit 2 ,

8 3

{

Figure 5.9 ISL event trees - Accumulators.

• t),

g-- ,

n.a.

s; . :E. f 5  :

Table 5.1 Conditional Core Damage Frequencies for LOCAs Indian Point Oconee Calvert Cliffs {

No Operator Action Large LOCA Inside Containment 8.4-03 1.03-02 2.8-02 5.7-03 2.10-03 1.3-03 Small LOCA Inside Large LOCA Outside 1.0 1.0 1.0  !

1.0 1.0 1.0 Small'LOCA Outside i LOCA Terminated by Operator ,

1 Small LOCA Inside 1.7-04 1.6-04 7.5-05 Small LOCA outside 1.7-04 1.6-04 7.5-05 Special Case Small LOCA Inside 5.74-03 One Train of HP System Not Available l

i M =we e g am ,

p

,. , *t g

' r ' t.l.: s-s 1

m e -

7..

~

5-21 g t . L Table 5.2a Core Damage Frequency Indian Point Overpressurization Sum of System Initiator P(Rupture) Event *CCDF CDF/ Year LPI 5.33-06 1.00-01 1.91-01 1.02-06 1.00-03 1.02-01 5.44-07 3.00-05 1.01-01 5.38-07 SI* 1.39-04 1.00-01 9.12-02 1.27-05 1.00-03 9.12-04 1.27-07 3.00-05 2.74-05 3.81-09 RHR Suction 9.80-07 1.00-01 5.03-01 4.93-07 1.00-03 5.03 4.93-07 3.00-05 5.02-01 4.92-07 Letdown

• 2.28-03 1.00-01 7.73-05 1.76-07 (Includes relief 1.00-03 7.73-07 1.76-09 valve opening) 3.00-05 2.31-08 5.77-11 Accumulators 4.64-03 1.00-01 6.85-04 3.18-06 1.00-03 1.39-04 6.45-07 3.00-05 1.35-04 6.26-07 TOTAL 1.00-01 1.76-05 (CDF due to over- 1.00-03 1.81-06 pressurization) 3.00-05 1.66-06 Note: P(Rupture) = Probability of a major pipe rupture,

• For this system P(Rupture) = Probability of pipe pressure boundary NOT.

maintained.

-Table 5.2b Core Damage Frequency Without Overpressurization Indian Point CCDF-System Initiator * (Small LOCA) CDF/ Year LPI 3.53-06 5.7-03 2.01-08 SI 4.13-04 5.7-03 2.35-06 i l

RHR 1.70-05 5.7-03 9.69-08 i Total 2.47-06 (CDF w/o over-pressurization)

• No overpressurization relief valves-open. '

. :-- c :

n --. - - - - -- -., . ~ , - -

5-23 Table 5.3a b Core Damage Frequency Oconee Overpressurizcaion- Sum of System Initiator P(Rupture) Event *CCDF CDF/ Year LPI 5.58-07 1.00-01 1.00 5.58-07 1.00-03 1.00 5.58-07 3.00-05 1.00 5.58-07 RHR Suction 1.44-06 1.00-01 1.00-01 1.44-07 1.00-03 1.00-01 1.44-07 3.00-05 1.00-01 1.44-07 Letdown

• 2.28-03 1.00-01 1.36-04 3.10-07 (Includes relief 1.00-03 1.36-06 3.10-09 valve opening) 3.00-05 4.08-08 9.30-11 Accumulators 4.10-03 1.00-01 1.18-03 4.84-06 1.00-03 1.76-04 7.72-07 3.00-05 1.60-04 6.81-07 TOTAL 1.00-01 5.85-06 3

(CDF due to over- 1.00-03 1.43-06 pressurization) 3.00-05 1.38-06 Note: P(Rupture) = Probabili.ty of a major pipe rupture.

i *For this system P(Rupture) = Probability of pipe pressure boundary NOT

, maintained.

Table.5.3b Core Damage Frequency Without Overpressurization Oconee CCDF ..

System Initiator * (Small LOCA) CDF/ Year LPI 6.10-08 2.1-03 1.28-10 RHR 5.04-05 2.1-03 1.06-07 Total 1.07-07 (CDF w/o over-pressurization)

• No overpressurization relief valves open.

5-23

.... . . m L Table 5.4a Core Damage Frequency Calvert Cliffs Overpressurization Sum of System Initiator P(Rupture) Event *CCDF 'CDF/ Year LPI 3.40-09 1.00-01 1.00 3.40-09 1.00-03 1.00 3.40-09 3.00-05 1.00 3.40-09 SI* 7.18-10 1.00-01 1.00-01 7.18-11 1.00-03 1.~00-03 7.18-13 3.00-05 3.00-05 2.15-14 RHR Suction 1.45-06 1.00-01 1.00 1.45-06 1.00-03 1.00 1.45-06 3.00-05 1.00 1.45-06 Letdown *- 2.28-03 1.00-01 1.27-04 2.90-07 (Includes relief 1.00-03 1.27-06 2.90-09 valve opening) 3.00-05 3.81-08 8.69-11 Accumulators 5.98-03 1.00-01 1.85-03 1.11-05 1.00-03 9.65-05 5.77-07 3.00-05 7.92-05 4.74-07 TOTAL 1.00-01 1.28-05 (CDF due to over- 1.00-03 2.03-06 pressurization) 3.00-05 1.93-06 1

Note: P(Rupture) = Probability of a major pipe rupture.

• For this system P(Rupture) = Probability of pipe pressure boundary NOT maintained.

Table 5.4b Core Damage Frequency Without Overpressurization Calvert Cliffs CCDF System Initiator * (Small LOCA) 'CDF/ Year LPI 5.2-10 1.3-03 6.76-13 SI 3.2-09 1.3-03 4.16-12  ;

RHR 1.75-05 1.3-03 2.27-08 Total 2.27-08 (CDF w/o over-pressurization) '

l

• No overpressurization relief valves open.' l l

5-24

g. - ; p::

r i.,

Table 5.5 t

' ~ ~ ~

Core Damage Frequency Summary Total CDF Total CDF Due to Without Overpres- Overpres- Total CDF* in Plant P(Rupture) surization surization CDF/ Year PRA (/ Year)

Indian Point 1.00-01 1.76-05 2.47-06 2.01-05 1.18-04 1.00-03 1.81-06 4.28-06 3.00-05 1.6a-06 4.13-06 Oconee 1.00-01 5.85-06 1.07-07 5.96-06 1.59-05 1.00-03 1.45-06 1.54-06 3.00-05 1.38-06 1.49-06 Calvert 1.00-01 1.28-05 2.27-08 1.28-05 3.34-05 Cliffs 1.00-03 2.03-06 2.05-06 3.00-05 1.93-06 1.95-06

• Due to LOCA only.

Table 5.6 Core Damage Frequency Due to ISL Bypassing Containment Total CDF/ Year ISL CDF* in Plant P(Rupture) Outside Containment PRA (/ Year)

Indian Point 1.00-01 1.27-06 1.18-04 1.00-03 1.03-06 3.00-05 1.02-06 Oconee 1.00-01 1.49-06 1.59-05 1.00-03 7.05-07 . .

3.00-05 7.02-07 Calvert - 1.00-01 2.04-06 -- -

3.34-05 Cliffs 1.00-03 1.45-06 3.00-05 1.45-06

• Due to LOCA only.

t

==

I a

,-, - -.- r-. . ,

g4

' - e. .. .

B-1 '.

. L APPENDIX B: Analysis of Valve Failure Data This appendix provides the documentation of valve failure data used to calculate the initiator frequencies of Interf acing System LOCAs (ISLs) in various pathways. It describes the approach used in the derivation of new failure rates and gives the sources for those which were previously determined.

B.1 Check Valve Failure Rates ,

In the initiation of an ISL through ECCS injection lines, essentially 4

three check valve failure modes are considered:

1. Check valve gross reverse leakage,

2. Check valve failure to operate on demand, and

3. Check valve disc rupture.

The following subsection discusses the data sources for each of the failure modes.

4 B.1.1 Check Valve Gross Reverse Leakage B.1.1.1 General In spite of the fact that various nuclear industry data sources have failure rate values for this f ailure mode, a cursory survey of the data showed, that the available data are not suitable for ISL analysis. The f

available data are related to a conglomerate of check valves of different type, size and make, which are built into various reactor systems. -It was recognized at the start of the study, that the knowledge of the specific value of gross reverse leakage failure rate of check valves in the RCS/ECCS interface plays a crucial role in the ISL analysis. It was also recognized,

, that small or large leak flow rate result in markedly different accident developments. Therefore, it was clear that specific information was required about the frequency of exceeding certain leakage flows through the valves and that information needed to be able to be extracted from available data.

i .

~ . .

B-2 -

._..: k In order to satisfy above requirements, special data collection and analysis were performed and are described below.

B.1.1.2 Data Collection A computer search was conducted in the LER data base for check valve failures occurring in the RCS/ECCS interface. The events selected were reported in Tables 3.1 and 3.3. Since then, the " efficiency" of the event selection has been cross-checked by conducting a similar search in the Nuclear-Power Experience data source, which is an LER-based compilation of failure events. This new search and a comparison with the results-of an independent search conducted at Pickard, Lowe and Garrick, Inc. for the Seabrook Station Risk Management and Emergency Planning Study (PLG-0432),1 proved that our search process was highly efficient.

The cross-check covered the time period from 1972 to the end of 1985.

The failure events selected are shown in Table B.1. The format of Table B.1 is somewhat different from the format of Table 3.1 and 3.3. The present format was developed to serve our further analysis. It contains the NPE number for facilitating better event identification, the name of the specific ECCS system involved (Accumulator, LPI, HP1) and direct or indirect information about the leak rate. .The latter involves such evidences as: the rate of boron concentration changes and rate of pressure reduction in the accumulators. The table also contains the estimated leak rates. The approach used to estimate the leak rate was essentially similar to that of Ref.1: the utilization of the direct or indirect flow rate information. If there were no i

such information available, the similarity to other occurrences for which the leak rates were known was applied.

An inspection of Table B.1 shows, that the majority of failure events are failures of the check valves in the accumulator outlet lines. This apparent I

bias might be due to the continuous monitoring of the accumulators, or it might reflect a particularly severe environment acting on the valves. An additional difficulty related to the interpretation of the leakage flow rates derived from accumulator inleakages. Accumulator inleakages from the ECS-represent leakage through two check valves 'in series, where the less leaking

~

7

- - u- s B-3 ,'[

.. w valve dominates (the other valve may even be wide open). Thus, the leakage flow rate values derived from RC leakage into the accumulators are essentially lower limits for these quantities. In order to clarify the causes of the apparent bias and extract maximum information from the data,' the following event analysis was carried out.

I B.1.1.3 Event Analysis B.1.1.3.1 Event Categories The failure events of Table B.1 were grouped into four categories:

1. Events whose description contains evidence of RC leakage into the accumulators. These events are considered to be accumulator inleakages through two failed check valves in series; A(2). The total number of A(2) events is: NA (2) = 28. (It represents 56 check valve failures.)

2. Accumulator leakage events, whose description contains evidence only about one leaking check v'lve; a A(1). (The water source is assumed not to be the RCS.) The total number of A(1) events is: NA (1) = 8.

3. Leakage events of neck valves in the common injection header of accumulator, LPI and HPI lines. Accumulator inleakages are not associated with these events. The leakages are directed into the LPI/HPI systems. These events are denoted by: LP. The total number of check valves in LP events is:

Np=2.

L

4. Leakage events of check valves on other HPI lines-not associated with the accumulator injection header. These events are denoted by HP. There is only one such event in Table B.1; representing three check valve leakage failures: N'P H = 3.

4 Since our main concern is to find an explanation for t.he high frequency of failure events associated with the accumulators, the events in the first three groups are subject to further analyses.

e

] g

B-4~ r <.:-

.-l

, . . L B.1.1.3.2 Interpretation of Accumulator Leakage Events. A(2)

Succeeding steps in the data analysis require some further understanding j about the possible origins of events A(2). 'For that purpose the schematic of

~

the check valve arrangements at the RCS/ Accumulator, LPI, HPI interface is

presented in Figure B.1. The figure indicates the pressure conditions at the interface _under ideal normal reactor operations when the check valves are perfect. Pg, P2, and P3 denote the pressures in the RCS, in the accumulator-and in the LPI, HPI systems, respectively. '

?

We are interested in the pressure conditions in the piping section between the check valves CV1, CV2, and CV3. (An additional check valve CV4 is also there if the design is such that the HPI line joins the LPI header downstream from CV3.)

4 It is easy to see that, when the check valves are operating, the pressure j.

between the valves is that of the accumulator, P 2. Since Pi>P 2 >P3 , (where P2 '

} the pressure of N2 filling in the accumulator is much higher-than P3 , the hydrostatic pressure of the RWST) the pressure differences across the check valves CVI and CV3 (and CV4) keep these valves closed. However,' the accumulator outlet check valve, CV2 is essentially open. Consequently, the seat of this check valve is exposed to various damaging affects of the highly j borated water of the accumulator. Under unfavorable temperature conditions boron can be deposited onto the seat or hinges of the valve disc. The affects of boric acid are different at the other check valves. At CV1, whose temperature is about the same as that of the RCS, boric acid stays in 4

solution. At CV3 (and CV4), the effect of boric acid is much smaller than at CV2, because these check valves are closed.

I.

i, Consider now what happens when a back-leakage develops through CV1. (An original " disc failing open" failure mode of CV1 must be excluded from

consideration, because CV1 and other similar " front line" check valves are 1

leak tested after RCS depressurization to ensure disc seating.) The sudden, ruling pressure in the space between the valves will become Pg, and the valve

( CV2 will close. CV3 (and CV4) will close even tighter because of the increased pressure difference across their'dises. CV1 will have RCS pressure

.i

m. .,,, , n,_--m , , , , - , n , ,e-wee

B-5 ..

L...-.- .

on both sides of its disc. At the same time, the check valves CV2 and CV3

) .(and CV4) will be exposed to the RC temperature. This is the situation, when CV2, CV3, and CV4 are operating. Due to the damaging effects of boric acid or boron deposition it is highly probable, however, that CV2 will not reclose.

Check valves also have a failure mode of " failure to operate (reseat) on demand" (see more about in in Section 1.2). The effects of boric acid may significantly enhance this probability for CV2. The effect of boric acid on CV3 (and CV4) is expected to be much less, because CV3 (and CV4) are always I

kept closed (unless they fail).

If CV2 recloses, it may develop backward leakage randomly in time with -

the same failure rate as previously CV1 had, because its disc is exposed now to the same differential pressure as previously CV1 was.

The level, pressure, temperature, and' boric acid concentration of the accumulator is under constant surveillance. _CV2 has high probability that is will not reclose completely upon demand. Consequently, even small leaks through CV1, have high potential for discovery.

Thus, it can be concluded, that the combination of two effects, the constant surveillance of the accumulators and the high probability that CV2 j fails to operate on demand because of boric acid effects, provides a

! reasonable explanation for the high occurrence frequency of accumulator events, A(2).

}

The frequency of these events can be described by the expression given

+

below (for more details see Section 4.3 of the main text, discussing the'

, determination of ISL initiator frequencies for LPI pathways):

h AT 2

• A (1)

{ AA (2) = 2A ( 2 g d2) I 2A gC i

f where, Ag and A2 the gross backward leakage failure rates of check valves CV1

and CV2, respectively, Ad2 is the enhanced failure probabil'ity of CV2 to operate on demand, l

B-6 ~ (,

- s wa . . . .u T is normally the time interval between the leak tests of CV1, when there is no other means to discover valve failures. Since the

accumulators are constantly monitored, it is, T=0.

The quantity C, may be considered as "an effective leakage failure 1

probability" of CV2.

Id2 is expected to be much higher than the first term in the parenthesis. Thus, C is practically equal to the enhanced failure probability of CV2 to operate on demand.

B.I.1.3.3 Interpretation of Accumulator Leakage Events. A(1)

In order to interpret the origin of these events we refer again to the valve configuration shown in Figure B.1. Consider the case, when CVI is perfectly seated. Leakage into the accumulator through CV2 still can occur, j if:

l l

a) for some reasons, the N2 Pressure in the accumulator, P2 falls below

the hydrostatic pressure of the RWST, P 3 (i.e., P >P 3 ) 2and CV2 does not

! reclose upon this challenge, or i

b) for some reasons, e.g., due to inadvertent initiation of the HPI pumps the pressure in the space between the valves suddenly increases such

, that P )P2 3 and CV2 does not operate upon this demand. Since these failure

, events are not associated with RC inleakage into the' accumulators they are not analyzed further.

l B.1.1.3.4 Interpretation of Leakage Events. LP l

l For the interpretation of these events we refer again to Figure B.I. We recall the situation described in Section B.I.l.3.2, when CV1 leaks and CV2 is operating. i.e., CV2 recloses upon demand and does not develop leakage l randomly. If there is no safety valve connected to the space between the valves, the overpressurization of the space betweaa the valves is hard to detect. Leakage tests on CV1 leads to the discovery of the valve failure.

, , - - - - , - , . - , . . . - , . , -- , , , - . - - , , _ . . - - - - - - , , . - . . . . . ---.-.,,-,,,,,-.n , - . , . . - . , - - . - , - . , , . , . . ,

B-7 --

_ ..... c Consider now the case when both check valves, CV1 and CV2-are operating, but CV3 or CV4 leaks (P2>P 3 ). It is hard to detect the failure because successive check valves upstream in the injection lines will probably reclose. As in the former case, leakage test leads to the discovery of the failures.

The frequency of LP events, i.e., the frequency of check valve back leakage failures which are not accompanied by check valve failure in the accumulator line, can be described by the expression:

At p = At (1-C), (2) where At is the leakace failure rate of the individual check valves (considered to be the name for each check valve, CV1, CV3, or CV4) and C is the " effective leakage failure probability of CV2" defined in expression (1).

Additional failure combinations of CV1 and CV3, or CV1 and CV4 are discussed in Section 4.3, of the main text, where the ISL initiator

frequencies are calculated.

i B.1.1.4 Data Reduction B.1.1.4.1 General The following approach has been applied in the data reduction:

+

1) Expressions (1) and (2) are equated to the maximum occurrence frequencies of events A(2) and LP. The obtained system of equations is solved for the " effective leakage probability," C of the accumulator check valve, CV2.

2) Expressions (1)'and (2) are equated to the experienced frequences of events A(2) and LP in various leak rate groups. By solving the equations for the leakage failure rate, a leakage exceedance frequency versus leak rate curve is calculated.

i I

l

B-8 v.  !

l

. . , l l

B.1.1.4.2 Determination of the Effective Leakage Probability, C for the Accumulator Check Valve, CV2 E

The maximum occurrence frequencies (frequency / hour) of events A(2) and LP are determined by using expressions (1) and (2), respectively, as follows:.

ma 2N^

A (xA 2) = 2A"1**C T =

, (I) l A

and A"** = A"**(1-C) = T ' (II) where A"** denotes the maximum LP leakage failure frequency, NA (2) and NL p, are the total number of failure events of event categories (1) and (3) (see Section B.1.1.3.1),

T A and T t p the total number of check valve l hours for check valve populations in accumulator and LPI lines, respectively at all PWRs.

The solution of the system of equations (I) and (II) for C, is:

A(2)

(III)

C=!A(2)+NLpp' where k '= AT /T t p, N A (2) = 28, Nt p = 2 (from Section B.1.1.2.1).

The total number of check valve hours, T A (2) and T L p are given in Table B.2, as:

7 7 f TA(2) = 2.369x10 and Tt p = 2.266x10 .

i~

Additional details about the determination of total number of check valve hours are discussed in Section B.1.1.4.4 From the data above the " effective leakage probabiL'ty" of the accumulator check valve, CV2 is (k=1.045):

C = .93 (III')

t

- - - -. 3= r, B-9 '. . *1

'h

. uL L As it was explained in Section B.1.1.3.2, C is practically equal to the probability of " failure to operate on demand" of CV2. The value.is high because of the presence of the boric acid. 'The valve obtained is in agreement with the expectation.

The significance of the high value of C for the initiation of ISLs through LPI lines is important. It means that CV2 behaves as a kind of. safety valve and the preferred direction of the ISL will be through the accumulator and not through the LPI (or HPI) pathways.

B.1.1.4.3 Calculation of a Leakage Exceedance Frequency Versus Leak Flow Rate The leakage events, A(2) can LP, were grouped-into five leak flow ranges. For each group, a frequency per hour value is calculated by using the total check valve hours given above. By equating expressions (1) and (2) to the frequencies of the i-th leak flow range one obtains the following system of equations:

I (7,)

AA (2)

= 2Ag (i)C = Ah2)I)

A ntp(i) (II')

A{p(i) = Ag (i)(1-C) = T LP Here, Ag(i) denotes the leakage failure frequency of a check valve in the i-th leak flow range and nA(2)(i) and ntp(i) are the number of leakage events of event categories (1) and (3) in the i-th leak flow range.

Solving the system of equations (I') and (II') for A g(i), one obtains:

^

)

A (i) = T LP (ULP(L) +

g i l

l I

l r

. . . --. . . --.~ - .. -. --

1. f F~ "N i

B-10 i -

c. .

I' Considering, that k=1.0, .

(III')

13 (i) = TLP (SP(i) + nA (2)(I))

' Table B.3 shows the sum of leakage events and the leakage failure-4 frequencies calculated according to formula (III') for the five leak flow

~

t ranges. Table B.3 shows also the corresponding cumulative frequency values.

The cumulative frequency values are also plotted as a function of the leak flows in Figure B.2.

The cumulative frequency values are fitted graphically with a straight line (on a. log-log scale) to facilitate inter- or extrapolation. The i application of straight line fit is supported by the generic experience, that

" percolation type" physical process, like leakage through two openings, follow exceedance frequency distributions of Pareto type (i.e., a kind of power low).

It has to be recognized that the curve in Figure B.2 is only a first f approximation for a more precise leak exceedance frequency versus relative leak rate curve, which should be based on single valve leakage, data and more.

1 homogeneous check valve sizes.

1 For further applications of the exceedance leak frequency data, a stretched statistical range factor (ratio of the 95th to the 5th percentile of lognormal probability density function), RF=10 is assigned to them (stretched i from RF=4). This large value accounts for the uncertainty in the 5 classification and leak flow rate grouping of the data, estimation of the total exposure time and applicability of the approach used for event-interpretation and data reduction.

B.1.1.4.4 Total Exposure Times of Check Valves in Accumulator and LPI Lines l This section provides some additional information about the determination of total exposure times for check valves in the accumulator and LPI lines.

l 4

4

B-11 Table B.2 details the accumulator and LPI check valve hours for each PWR considered and presents the total exposure times, TA (2) and TL p. Usually the FSARs of various PWRs were used to obtain the number of check valves n the relevant lines. The total time from start of commercial operation of the individual plants was taken as " time of exposure per check valve." This was done because corrosion effects (e.g., corrosion due to boric acid) continuously degrade the internals of the valves.

3.1.2 Check Valve Failure to Operate on Demand 3.1.2.1 General i

The situation, concerning the usefulness of the available data sources on

" check valve failure to operate on demand" failure mode, was similar to that of the reverse leakage failure mode discussed in Section B.1.1.1. The data sources do not specify " failure to open" and " failure to close" modes separately and there is no data on the subsets of check valves in the interfacing lines.

B.I.2.2 Data Collection From a larger set of failure events collected with the search process

~

described in Section B.1.1.2 a subset was selected which is considered to be representative for check valve fails to reclose stuck open mode. The events are listed in Table B.4, whose format is similar to Table B.1. From all the events listed the LPI and HPI events are taken to estimate the probability of a the failure mode. The total number of failed check valves involved in these events are 9.

5 The corresponding success data (number of demand) are developed on the LPI check valve population and plac.t age. The HPI check valve population in the interfacing lines is assumed to be equal to that of the LPI. An average

, of 10 system wide demands per year is considered for the success estimate.

O h.

B-12 r- -

,a B.I.2.3 Data Reduction  ! Lo i.

The total number of check valve years for LPI check valves from Table B.2 is 2.587x10 3. This value based on the above considerations results in the following total numb'er of check valve demands in the LPI and HPI interfacing lines: Check valve demands (LPI and HPI) = 2x10x2.587x103 = 5.174x10".

l The corresponding probability of failure to reclose on demand is A

Median , 9

= 1.74x10-" per demand.

4 5.174x10 The range factor assigned to characterize the uncertainty is RF=5. Thus,

~

A = 2.81x10 per demand, and the expectation value of its square is:

D

~

<A > = (A **") + var. = 2.05x10 per demand .

The result obtained is in agreement with that of obtained in Ref. 1 applying different basic data:

Ad (Median) = 1.58x10~" per demand.

B.1.3 Check Valve Dise Rupture Till the end of 1985 the nuclear industry had not reported any check valve disc rupture events. The closest failure event to this category is what happened at Davis Besse-1 (NPE f VII.A.273, IE Info. Notice 80-41) when a disc and arm had separated from the body in an LPI isolation check valve. The PSA Procedures Guide2 lists an estimated value based on expert opinions for the disc rupture failure rate, as 1.0x10~7/ hour. The guide's value practically-

! coincides with the exceedance frequency of the maximum experienced leak flow (200 gpm) in Figure B.2. Since there is no experienced event for this failure made in the nuclear industry, the leakage failure rates applied in this study are considered as conservative upper bounds for the disc rupture frequency.

- ~ . - - ._ m _ . . - , - - -- . _ , _.

, - i l B-13

. we k l

B.2 Motor-Operated Valve Failure Rates I l

i The following failure modes of MOVs are considered in the calculation of l ISL initiator frequencies: '

1. MOV disc rupture.

2. MOV internal leakage.

3. MOV disc failing open while indicating closed.

4. MOV transfer open. ,

5. MOV failure to close on demand.

6. MOV gross (external) leakage.

The subsection below discusses the data sources for each of the failure l modes.

B.2.1 MOV Disc Rupture Available data sources had no data on this catastrophic MOV failure mode based on experienced data. A LER search for this failure mode at PWRs could not identify any such event.- However, a search conducted for the study of 3

ISLs at BWR found five events in which valve disc was separated from the stem. The MOV disc rupture failure rate estimated in that study is:

1.37x10-7 per hour. This value is applied also in the present calculations. i B.2.2 MOV Internal Leakage 1

This failure mode represents failures in which MOV leaks because of saat  !

wear or other reasons. The failure mode is assumed to result in limited f leakage through the valve. An LER search performed to identify such failures in motor-operated isolation valves. Three events were found in RHR suction ,

I d

valves. These are special valves with double discs (see Table 3.2). The total number of RHR suction valve-hours was calculated by using the number of reactor years of Table B.2 and RHR suction valve population of two or four per reactor for plants starting commercial operation before or after 1981. The 6

total number of RHR suction valve-hours is 8.743x10 . Therefore, the internal leakage failure rate for MOV events divided'by the number of valve hours is

B-14  ;:

3.43x10-7 per' hour. Estimated range factor, RF=5. The corresponding mean

' ~3 value, O

4.85x10 per year. The expectation value of its square, <Aggy>

~

= + var. = 6.12x10 per year .

L (1 "V 0 )

B.2.3 MOV Disc Failing Open While Indicating Closed This type of failure mode may arise at MOVs, which are not equipped with stem-mounted limit switches from gear drive disengagement. At valves which are equipped with limit switches it arises from failure of the stem or other internal connections or' failure of a limit switch (including improper maintenance such as reversing indication). The failure may occur after the valve being opened. As a result, the valve is leaking while the indication in the control room signals that the valve is closed. It is expected, that this failure mode is giving rise small leakage.

The failure rate applied in this study is taken from the Seabrook PSA."

where it was obtained from data reported in NPE. The mean frequency of

" failure of an MOV to close on demand'and indicate closed" is

1.07x10-"/ demand.

B.2.4 MOV Transfer Open "MOV transfer open" failure mode defines such MOV failure, when a closed MOV inadvertently opens due to failures of valve control circuits and power supplies or due to human errors during test or maintenance.

In the Seabrook PSA" the failure rate of this failure mode was estimated by using generic data to be 9.2x10-8 per hour. - Table 4.4 has two events which can be classified as "MOV transfer open" failures for RHR suction valves.

Taking the total RHR suction valve-hours, T=8.743x106 and these two events, one obtains a median failure rate of: 2.29x10-7 per hour. Estimated range factor: RF=5.

i

• 4

. - - . . . - - - <ww- .,

x - -s. m , y w w

B-15 , ,

B.2.5 MOV Failure to Operate on Demand MOV failure to operate on demand represents MOV failures in which a closed MOV suddenly opens upon demand, e.g., as various kind of shocks like pressure wave, sudden stress increases due to mechanical or thermal causes.

This failure mode of MOV is a failure mode of " dependent" type and different from the retainer rupture failure mode of MOVs, which is a failure mode of random type.

An LER search to identify such events was futile. Therefore, in the calculation of ISL initiator frequencies instead of a guessed estimate the corresponding " check valve failure to operate on demand" (see Section B.I.2) failure rate is used as bounding value.

B.2.6 MOV External Leakage / Rupture This failure mode of the MOVs is the most visible and detectable. The failure rate is given in various data sources. The data sources, however, do not provide information about the exceedance frequency of the failure as a function of the leak flow rate. A cursory review of some failure event reports showed that there is no appropriate information in the event descriptions about the leak rate. The LER search for failures of MOVs in the interfacing lines did not detect the occurrence of this failure mode. Thus, for the present report the generic value given in NUREG/CR.-13633 for PWRs is taken. The failure frequency of MOV external leakage / rupture mode is 1.0x10'7 per hour. As first approximation to the variation of this value with the leak flow rate, the exceedance frequency vs. leak flow rate curve for check valves (Section B.1.1.4.3) is used.

B.3 References

1. "Seabrook Station Risk Management and Emergency Planning Study," PLG-0432, December 1985.

2. R. A. Bari et al. , "Probabilistic Saf ety Analysis Procedures Guide,"

NUREG/CR-2815, August 1985. '

B-16 -

i

-u L

3. L. Chu, S. Stoyanov,_R. Fitzpatrick, " Interfacing Systems LOCA at BWRs,'"

Draft Letter Report.- July 1986.

I

4. "Seabrook Station Probabilistic Safety Assessment," PLG-0300, December 1983.

i

5. W. H.-Hubble, C. F. Miller, " Data Summaries of LERs of Values," June 1980.

q 4

4

-T 5

1 i

I 4

i l

O I

l

i.  !

J 4

(

. l

.~ !

O gt P

2

=

ACC.

4 CV.2 RCS CV.1 2

y! $ ,

CV.3 P 3

1/ LPIS 5 I

. I i

W.4 L _ _ - _ ._ _ _ _

- - - _._ . kurtS

^

/

/ ..

/

/

Figure B.1 Schematic of the valve arrangement at the RCS/~ ,

Accumulator, LPIs, HPIs interface. (An alternative' joint of the HPI line to the LPI header is indikdted by a broken line.)

/

s

1 __ . . -

i m

v W /

i iuu e '

'u oi  : a a8 ' ' 1 I d n o' ' 8 8Ll'

! -5 '

I e ,

i 1.0x10 ,

~

m ,, .. ir m

'3r x . . r n n -

~-~"

! I 0

[ I E6

.i ji d

,i

_ a .

t 3' i:'

t:

f  :

f' i

l

, , ... , . ... . . i.  ! p i -

_r ? _ . . .._

I ' '

,,, 3 g [ -

gi i i- l'  ! l' .t' F I .;- i!1! ,.

~

.;!, s; I -

l I 4 7 li i iib i!, ' r 4 i k $ b i E i I 'I 5I '

I i T','b IIII

. i M-

iE ,, ei i

lE ib :h ih '!!: i: '

.! I@ !d h!i i i 'ii i lii h [ ', - ' ~

f ~ ~~ ~ '

i k f E

' ' - ^

f I b

' ' ~

Y: {.

~~ '

' ~ ~

2: :t  ;

l l, i h f 'il 4 l-  ; *I i:

ll! ll se O ,' i i.

s j -

Il

'} jp 3*p -i3-:; i t .~

i.s : . ---4 44; ..;

.g 4 +  ; -

t -- -- --

-n- y *--

-*t:

h:T. . .il i' A N N di k  ! l.

![ ,i_f $5 'i  !:t i i ',' .!'  ! lI !. ! I! ' i 5  : I ! !

• I :i lit- b i  ; H::  ; '

l- [ l r[

'ji:

Itl i;. -

.A .:i. i t ji- ..  : p' : - - .. -

'! i il 4: l d:'{' *

1:

!F . .;_

i.f.iT .*F ?

-

; . . . .. 1

": %; :  : l l ilf W :'  ! Is -  ; j ist :1F  ;.;.l .l:. lR ,;

3...

. i .. 2  ; ..

.., g 3 j p

i. ** 4p- '

... g.. . .- ....[

I - 6

• j' i g 86 .

l-F.

.i A sg I eg =- -l * *

.... . ob t a - - - - e -

.'. s

. . e a .

le.

,. i

-6 ... . .. .

ig. .

l 6'W.

i l 4 6... . . .,

,' i -1li si - -

r'- : I t is .

t!,

.{

3.l 5,0x10 i . .

,c  ; A , . .

-- 4 m; . . . r o 1 ..

-~~ ~* '"~

{, T ~ ~ ~~~

-**** *** ~

r-i . m , _ i. , i e i_._ i int _ .. .e. , .  ?

~~ ~

. .. 7 '

, i Ii . '.i .f . l? i!h il

'8. '

I t:! ., i l .

• l e

, .o m :. 4 u . ... r ,  ; a 'i a .i; .  !

e ii . , a .

~

8 r:i n di , o -

.p. 4 i:  ! N i 1. t -

l t i:1 ..- , ,

i i !!  ! ip i:-  : l'  ;: 9 8- . n ni 4 W e

• a ,.

iii' i; .

F :it li l l iM. I! ill s' i. l J ii.  ! :.!i i: D I:

l!.

l l ill :li. :D l'E i 'i L 1.1 -

i: -

itn f y ".- ' l

@D +

8' '

Ii -i H tlf ;,h ; d b.  : -

4 HP $t -

@f

-t St i tti-

+ - -

h ;n t ,. i: i lit. ah , r- .

ii I I H .,t.h._.;.i.t. 2P 11:  : :t! 's 1 :i  ;. ,

i .s.,i_: ,

g ..

...~__

j !}M4

t n  ;

ii r ji 1ll ji it

1. ! ij .: jF ;ji.

qi

% jh }i.  ; ,, 7 -

l l ! l!  !!r ';( ij;; ,.. .3 s  :

{} p .3

!i; .;;  ;  !.

g :i:: :..

pr  :- :i t:e,.,-itp. pi .::..

c: 3 <

e.. .. .:;. .:

9 r : l. t.: :u -

a .::p..  ::::

m:::

. ] l l i l:i ih;  ::l;. . .

% ,l ,  :.  ;

n ..  ::

__. .:::- ..  : . . .  :- . - 1: h.t. :r. :  : : i: .

n...

.. - . - - . w .

. . ... i a, .:.. t t,,

r. .

i..

.i.l..

, . i. . , I . i ..

y,. .

a.

_y  ;. ,

+ ...

-lu .c tz- yl u . ~ w - . -, . - , .

'p':.

,,l.0x10

d "' ' , ". " j l

6. i

• i "r + -

.  ! +

l'

• s@ i i -

' t -1 n  ;  :

i' q r

!! n' N' u :I p..44!

2 - 41 ..le. 4d t t E --

g.

7 u_ i pn i - .

i  ! : , .

,. 224. ;. . . .. . .. 4 *. ,. i,. 1. r, m., ..

, ,, , , y ,,,. ..

. ,,2 _, ,_ _

-.n.

.. , , i 1

-e_.

,.- a .. _ _

J . , ,

5?t. # fi !:i. ~1 e *: >

l. *i i i l !e N i: .! ' e r. u <

th' '

n_

g- .

. . - 4.l.A .' i .

g.

!! : .it;

.i '. ai # '

ia  ! Dh IIl :,. ; .! : y _

, e

il' i. .N -

,- i i. -

p

!. it;: _. ;

t- .

.!- ijp .i' r! i' q ri !g 4 i- !!! .%.: g lp jf. .q ]l  !! i!!  ;;;. +

-. 4, .lji .li.

-h(, N IId .';; A C- b-- d,} LII- k i- '"

, ': , , 'h-f... 4 $

'. 3- I I,I- J-

'. g i E.

M

.p. f,;-

ii..

r. .

1 l l3 t- j 'i_ N . s.-  !. a p , ,

1

!L ii  : . ..  ! 3 ili "I n 8 if :i!: li'  :

' E '. I i.  ? fil!

. .: u,! ..! j' .

p') :qJ. :-

.T--  :- --- --~ --

T- .- - - - - - -

- -"~

~t - -

~ ~ '

n. -

i

.!. i i  :

m..: 7. , - i  :. r:l ;i:- -

1- -

i I .

- c..: t  ! j :. :: ...:t  : 8

g:: t.  : ' -

.; ;; u.;. .2. ;  :. _

.f:.;  :. _ .' l q '.gl ly

.;.

j.i.:  : ..

.t :  ;

q 3.j:: p

.: :.; .n. 2. . . ._

hl 4  ;.. .g j_ :. _

g;:' y3

'*- 8 '

I '-

s' '

I' - l-"

r ' ' -

' '; I' **"*

1. 0x l'0

-8 ' l I- '-I 'I *"H'

'i 'M +~

!l'l$:p' r

! h l*! -

':" *l'- '" " ' ' '

I

' i'

' I-if

i' h

5

l _ _... c. .

. +_ a .

I 10 100 1000 10000 7

.. r-  :

Check Valve Leak Rate (gpm)

Figure B.2 Frequency of RCS/ Accumulator, LPI pressure isolation check valve leakage events.

t

Tablo B.I Summary of Operating Events, Emergency Core Cooling Syste ,. Alation Check Velves, Leekage Fallure %de

.~-

Number of Check Estimated Reference ECCS Valves ' Leak Rate (NPE #1 Plant Date System Event Description Falled (gpe)

Vll.A.13 Palisades 5/72 ACC Leakage into si tank. The Internals of a check valve on the outlet of an Si tank I y5 was incorrectly assembled. ; j 4

VII.A.25 Main 12/72 ACC Leakage Into si tank. A small piece of weld slag had lodged under thq seal of the 1 y5 Yankee outlet check valve allowlng back leakage. DIlu'tlon: 1700 ppm (Ilmit is 1720 ppm).

Vll.A.32 Turkey 5/73 IPI One of the three check valves in the St IInes developed a leakage of 1/3 gpe. 3 g.33 Point Two other check valves showed only slight leakage. Fallure of soft seats.

V11.A.63 Glnna 9/74 ACC Leakage of a check valve caused boron dilution in ACC. "A" (from 2250 ppe to I y20 1617 ppm).

V i l l. A.85 Surry I 8/75 ACC Check valve did not seat. ACC ("lC") level increased. Leakage rate: 4 gpm. t' y10 Vll.A.126 Zico 2 10/75 ACC Wrong size . gasket Installed in the check valve for ACC. "A". Leak rates =.25 gpm. I Y.25 VII.A.105 Robinson 2 1/76 ACC Accumulator ("B") Inleakage through leaking outlet check valve. I y20 V.A.122 Zion 1 6/76 ACC Inleakage to ACC. "ID" from RCS. 2 y20 V11.A.Il4 Surry I 7/76 ACC Two check valves In series (1-St-128, 130) leaked causing boron dilution In 2 yIO ACC. "B".

V11.A.120 Sorry 2 8/76 ACC Boron dilution (from 1950 ppm to 1893) In 51 ACC. "C" caused by leaking check 2 pl0 valves (2-S1-145, 147).

VII.A.225 Millstone 2 4/77 ACC Inteakage of RC through outlet check valves to SI tank "4". Low boron 2x6 y20 concentration. Five occurrences in 1977 I

VIII.A.182 Calvert 9/78 ACC Outlet check valves for Si tanks 218 and 228 leaked. Boron concentration reduc- 4 yl0 '

Cilffs 2 tion from 1724 and 1731 ppm to 1652 and 1594 ppm in one month period. yl0 T

Tablo B.1 (Continued)

+.

Nisaber of Check Estleeted Reference ECCS Valves Leak Rate (NPE #1 Plant Date System Event Description Falled (gpm)

VII.A.262 Crystal 7/80 ACC Check valve CFV-79 to core flood tank f ailed. The Isolation valve to the N 2 1+1 100<y River 3 system was open for N2 mixing. a600 gallon liquid entered the N2 system and <200 ar20 gallons was released. The corresponding activity released estimated as 1.07 mCl.

Vll.A.273 Davis 10/80 ACC RHR system isolation check valve CF-30 leaked back excessively. Valve 2 50< p l00 IE Info. Dosse I disk and arm had separated from the valve body. Dotts and locking mechanism Notice were missing. Core flood tank overpressurized.

80-41 VII.A.291 Surry 2 t/81 ACC Accumulator ("C") boron diluted. Check valve (1-S1-144) leaked. Flushing system 1 yl0 Improperly set up, resulting in charging system pressure to exist on the downstream side of the check valve.

Vll.A.303 Palisades 3/81 ACC Leakage of RC Into the $1 tank (T-823). 2 y5 V11.A.306 McGuire 1 4/81 ACC Accumulator "A" outlet check valves IN-159 and IN-160 were leaking. RCS pressure: 2 y10 1800 psig. Acc. pressure: 425 psig. water level above alarm setpoint.

Yll.A.307 McGuire 1 4/81 ACC Similar events with Aces. "C" and "D". 2x2 yl0 y10 Yll.A.343 Point 10/81 LPI RCS/LPI Isolation check valve (I-853C) leaks in excess of acceptance criterla 1 y10 Beach I (>6 gpm).

VII.A.384 Calvert 7/82 ACC Acc. outlet check valve at Unit 1 leaked due to deterioration of the disk sealing 2 1200 Cliffs o-ring. The o-ring material has been changed on all check valves of Unit I and 2 I&2 1/2 SI-215, 225, 235, and 245 r- -

Vll.A.403 Surry 2 9/82 ACC Acc. outlet check valve (2-51-144) leaked RCS water into tank "C" during a pipe 1 y20 .

flush resulting In low boron concentration.

[

Vll.A.396 Palisades 9-12/ ACC Minor leakage into Si tank (compounded by level Indication failure) via check 2 y5 82 valve leakages.

l Tablo B.1 (Osttigued) l thsaber  !

of Dieck Estimated..

Reference ECCS Valves Leak Rate i .-- (NPE #) Plant Date System Event Description Falled (gpe) i V l l. A.407 -McGuire 1 5/83 ACC RCS water inleakage through outlet check valves IN-170 and IN-171, resulting 2 20<f50 ,

in low boron concentration In CLA "B".

Yll.A.437 Farley 2 9/83 LPl/ SI check valve to loop 3 cold leg was excessively leaking, incomplete contact . 1 50<p100 HP1 between the valve disk and seat.

LER 84-001 Oconee 1 3/84 ACC Accumulator ("A") Inteakage through looking valves. Administrative deficiency, 2 y5 no management control over a known problem (since 8/83).

V.F.0043 ' . Polisades 7/84 ACC Accumulator Inteakage through leaking check valves CK-3146 and CK-3tl6 2 y5 LER 84-012 V l l . A.4 52 St. Lucie 12/84 ACC Inleekage to Si tank. Seal plate cocked, valve seat compensating Joint ball 2 '20<y50 2 galled.

i Vll.A.456 Calvert 1/85 ACC Inleakage to safety injection tanks through check valve, o-ring meterial Cilffs degradation (Unit 1 = 1.6 gom, Unit 2 = 27.2 gpm).

2 75 20(y50

+

.IL2.

Vll. A.457 : McGuire 1 4/85 .ACC Low occumulator boron concentration. 2 y5 LER 85-007 Pallsades 6/85 ACC Inleekage from the RCS. Low level boron concentration. 2 y5

- Vll.A.474 Palisades 11/85 ACC Acciseulttor (SIT-820) Inf oakage from RCS Boron dilution (see Note 1). 2 y5 Note'l: The Palisades unit Pas a chronic accumulator inleakage problem.

[]

q .

e ,

+,

i e m e

• s' L*..... . . _ , ,

Table B.2 Accumulator and LPI Check Valve Exposure Data Total Number of Total Start of Number of Accumulator Number of Number of LPI Commercial Ne ber of Accumulator Check Valve-Hrs. LPI Check Check Valve-Hrs.

Plant Name Operation Years Check Valves (105 Hours) Valves (105 Hours.)

Arkanssas Nuclear One 1 December 1974 11.08 4 3.882 4 3.882 Crystal River 3 March 1977 8.83 4 3.094 4 3.094 Davls-Besse i November 1977 8.16 4 2.859 4 2.859 Oconee 1 July 1973 12.50 4 4.380 4 4.380 Octnee 2 March 1974 11.83 4 4.145 4 4.145 Oconee 3 December 1974 11.08 4 3.882 4 3.882 Rancho Seco April 1975 10.75 4 3.767 4 3.767 Three Mlle Island 1 September 1974 11.33 4 3.970 4 3.970 Three Mile isIand 2 December 1978 7.08 4 2.481 4 2.481 Arkansas Nuclear One 2 March 1980 5.83 8 4.086 8 4.086 Calvert Cliffs 1 May 1975 10.67 8 7.478 12 11.217 Calvert Cilffs 2 April 1977 8.75 8 6.132 12 9.198 Fart Calhoun September 1973 12.33 8 8.641 2 2.160 Mllistone 2 December 1975 10.08 8 7.064 16 10.596 Melne Yankee December 1972 13.08 6 6.875 9 10.312 Fallsades December 1971 14.08 8 9.867 2 2.467 St. Lucie 1 December 1976 7.08 8 6.363 8 6.363 Be:ver Valley 1 April 1977 8.75 6 4.599 6 4.599 D. C. Cook 1 August 1975 10.42 8 7.302 4 3.651 D. C. Cook 2 July 1978 7.50 8 5.256 4 3.651 Indian Point 2 July 1974 11.50 8 8.059 9 8.954 Indian Point 3 August 1976 9.42 8 6.602 9 7.427 J:seph M. Farley 1 December 1977 8.08 6 4.247 6 4.247 Kcwaunee June 1974 11.58 4 4.058 4 4.05S North Anna 1 June 1978 7.58 6 3.984 8 5,312 Prairie Island 1, December 1973 12.08 4 4.233 3 3.175 Prolrie Island 2 December 1974 11.08 4, 3.882 3 2.588 Point Beach 1 December 1970 15.08 4 5.284 3 3.523 Point Beach 2 October 1972 13.25 4 4.643 3 3.095 R. E. GInna 1 March 1970 15.83 4 5.547 - ---

H. B. Robinson 2 March 1971 14.83 6 7.795 2 2.598 Salem 1 June 1977 8.50 8 5.957 6 4.668 Surry 1 December 1972 13.08 6 6.875 -

6 6.875 Sorry 2 May 1973 12.67 6 6.659 6 6.659 Trojan May 1976 9.67 8 6.777 6 5.083 Turkey Point 3 December 1972 13.08 6 6.875 2 2.292 Turkey Point 4 September 1973 12.33 6 6.481 2 2.160 Yankee Rowe June 1971 14.50 2 2.540 - --

Zion 1 December 1973 12.08 8 8.466 14 14.816 Zion 2 September 1974 11.33 8 7.940 14 13.895 McGuire 1 December 1981 4.08 8 2.859 14 5.003 Sequoyah 1 July 1981 4.50 10 3.942 14 5.519 Sequoyah 2 June 1982 3.58 10 3.136 14 4.390 San (Mofre January 1968 18.0 - -

3 4.730 Haddam Neck January 1968 18.0 - ---

3 4.730 TOTAL 2.369(2) 2.266(2)

, f. '

l l

~

t.. e .

l j'"' .- )

Table B.3 L . . i. g.  ;:

Statistical Data on Leakage Events of Pressure Isolation

}

Check valves to Accumulators and LPI Systems 4

Number of Frequency of Frecuency of Leak Rate Leakage Events occurrence

.,' Exceecance (gem) (A(2) + LP)' (per hour) (per hour) 5 8- 3.53(-7) 1.32(-6' 10 8 3.53(-7) 9.71(-7) 20 7 3.03(-7) 6.18(-7) 50 3 1.32(-7)

! 3.09(-7) 100 2 8.83(-8) 1.77(-7) 200 2 8.83(-8) 8.83(-8)

[

1 s

i j

i 1

e

• +

t 9

, ~

Tablo B.4 Summary of Operating Events, Emergency Core Cooling System, Isolation Dieck Valves,- ,

"Fallure to Operate on Domand" Failure Mode Number of Check Reference ECCS Valves l (NPE #1 Plant Data System Event Description Falled Vll.A.lF5 San 5/78 LPI Tilting disk check valve f ailed to close with gravity, it was Installed in a Onofre I vertical rather than a horizontal pipeline, i Vll.A.270 Sequoyah 1 9/80 WI Si check valve 63-635 was found to be stuck open. It was caused by 1 Interference between the disk not lockwire tack weld and the valve body.

VII.A.285 Salem i 12/80 WI Si check valve failed to close during a test. It is an Interface between RCS I hot leg and SI ptsups. Yalve was f ound to be locked open due to boron solldifica-tion during the last ref ueling.

Vll.A.294 Oconee 1 2/81 LPI Reactor vessel LPI loop "B" Isolation valve (CCF-12) leaked excessively during i LOCA leak test. The valve disk had becons f roren at the pivot in a cocked position. Bulldup of deposit in the gap between the hinge and disc knob caused the freezing.

Vll.k.302 Oconee 3 3/81 LPI Similar to event at Unit I (valve involved is 3 CF-13). I V!I.A.310 McGuire 1 5/81 ACC Leak test damaged acc. check valves - seat type changed. 2 Vll.A.311 .tGuire 1 5/81 ACC Acc. check valves failed. 2 Vll.A.315 Point 7/81 LPI RCS/LPI Isolat!on check valves I-853 C and D were found to be stuck in the full 2 Beach I open position. High leakage rate.

Yll.A.392 ANO-2 10/82 WI St Isolation chock valves 2 SI-13C and 2 51-138 stuck in the open posiffon during 2 test requested by IE Notice 81-30. Disk stud protruded above nut, disk misaligned.

.?

< =g;

e' - .

r_

C-1

[.[

APPENDIX C: Operator Diagnosis and Post-Diagnosis Performance Human behavior in response to an event, especially an abnormal event in a nuclear power plant, can be considered in three phases of activity: (1) observation of the event, (2) recognizing and/or diagnosing it, and (3) 4 responding to it. Errors in each of these phases can be considered separately. However, there is much interaction between the various phases.

In particular, phases 1 and 3 are very much controlled by phase 2 - the diagnosing stage. Failures in this stage are the most significant and i basically constitute failures in cognitive behavior. The. term cogn'.tive behavior refers to the behavior that comprises structuring information, conceptualizing root causes and developing a response.

In regard to an abnormal event in a nuclear power plant cognitive behavior on the part of the operator consists of identifying the nature of the

event, identifying the necessary safety-related responses and deciding how those responses can be implemented in terms of system operation. The main i basis for estimating the reliability of operator action is primarily determined by the available time for that particular event before core' damage occurs.

I The numerical models for diagnosing an abnormal event by_the control room team and carrying out the appropriate activities has been based on work described in Reference 1 (Handbook of HRA). Figure C.1 shows the basic i diagnosis model, the probability of operations team diagnosis error in case of an abnormal event. The median joint h man error probability (HEP) shows the probability of a team not diagnosing an abnormal event by a given elapsed time. The other lines represent the lower and upper error factors. The probability vs time curve was developed on the basis of a clinical speculation presented in Reference 2 at an National Reliability Evaluation Program data workshop. A hypothetical response time probability curve has~been constructed using the general approach suggested in Reference 3 assuming lognormality for time to diagnosis rather than that the probability of failure is a logarithmic function of time.

.t 4

w ,- -- - -= , -

,- ,,-,.r . - - - - , -r ,.,y- ,w,. _ ,,-,,+ --

y,~, , ,.,-,-_w-g --+9--. ,,,em , e sa- s-

- - , a C-2 In case the event is generally not practiced by the operators except in the initial training, the handbookl recommends the use of the upper bound joint HEP curve.

In this study a combination of upper bound HEPUB and median HEPg has been.used (HEPg3 + HEPg/2) reflecting on the fact, that even though LOCA.

l events are well practiced, ISL avents are not specifically recognized in the i written procedures especially not on the system icrel.

4 For post-diagnosis performance the' handbook recommends using single HEP values,'which are applicable to activities to be carried out by the control

, room team following diagnosis of the problem. It is certain that actions will always be taken by the operators in response to an abnormal event, but only.

after the condition has been diagnosed will the operators refer to the appropriate written procedures (if any) to cope with the event.

In case of an ISL the initial signals are somewhat misleading indicating i

either a typical inside or outside LOCA event. The determination of the

] particular location of the break due to the ISL is extremely important, since i systems required to. mitigate the LOCA event might be affected.

In general, system specific ISL procedures are not available to the operator, but the loss-of-coolant phase is covered by the LOCA procedures.

4 Once the nature of the event has been correctly diagnosed an HEP of .2 4

has been used for carrying out post-diagnosis activities. The recommended HEP

+

value of .05 is based on availability of well written specific procedures.

However, for ISL events system specific procedures generally do not exist and l an increased HEP value is judg2d to be more appropriate.

{

References

[ 1. A. D. Swain, H. E. Guttmann, " Handbook of Human Reliability Analysis With e

Emphasis on Nuclear Power Plant Applications, Final Report,"

^

NUREG/CR-1278, August 1983.

2 O

.,av 4 - - . + y - -.,, . , 4-pra g.,r,, -.-r-ew-w we. + -pw-, es .,, ----,w, _ ,- .e,, -q.e ---r.r g . , e yoy, .~+,2 ,.,e---m%-- y

s .

• C-3

2. J. R. Fragola, A. J. Oswald et al., " Human-Error Probability.vs Time, Generic Data Base for Data and Models in NREP Guide," EGG-EA-5887, June 1982.

3. J. Wreathall, " Operator Action Trees, An Apprr.,ach to Quantifying Operator Error Probability During Accident Sequences," NUS Report J4159, July 1982.

I i

4 f

4 i

O r

4 1

4

4

. :, e, C-4 , l l

. v l l

1 i e i.isisil 6 e i isiang i i a i siing

_s 5 N ss

---T 1

\ 5

F m

3 .1 g-s's s N

\

g UPPER BOUND, g JOINT HEP g

>  : \ \ 5 N \ -

E -

g \ -

Z .01 p

3

=

=

\

g  %, MEDIAN

' *~

=

=

- \

th \ JOINT HEP -

G .001 E- g g O 5 \  :

z -

\ -

c -

5 .0001 E- LOWER BOUND,/\\s =

0 5 N JOINT HEP 5 m

.00001 s*%s -

)

E'

=

=

'%s s N ,

=

- s s-=

' ' 'I ' ' 'I

.000001 ' ' ' I

1 10 100 1000 TO TIME T IN MINUTES AFTER A COMPELLING SIGNAL OF AN ABNORMAL SITUATION Figure C.1 Time curve for operator action.

J 4

4 W

,e,. . - , . - , , . - , - - - - , - - - - - - . . - , , - - - - - . - - , . . --,--r .,--._,,,.rx-, . , , - - - . - . - - - . - -.,m.r , , _ . . - - , ---.r -

. ~. - --. . -. . - ._ . -- . . .-

.. (

i D-1  ;

I- t . . . . U APPENDIX D: Thermal-Hydraulic Aspects of Interfacing LOCAs f l 1

Interfacing LOCA bypassing the containment has been deterministically.

studied for typical cases to assess the effect on core damage.

l ,

The LOCA sequence assumes the failure of the pressure boundary at-isolating check va1ves and/or motor-operated gate valves. The low pressure system is overpressurized by the primary coolant and the system boundary fails outside the containment (pipe rupture or pump seal blowout, etc.). Depending on the mode of' failure and its particular location, a large or small break LOCA can occur. In the following a brief summary of the deterministic calculations is given for these type of accident sequences.

s D.1 Large and Medium LOCA (>2")

2 I The transient is initiated by a large low pressure pipe break resulting I in an extremely severe accident sequence.I Figures D.1 through D.3 describe l

the thermal-hydraulic history of this accident. Four parametric. cases have I been calculated. The base case .ndicates an accident sequence where no ECC ,

injection is available. If the failure is such that pumped ECC injection is i

prevented, core damage-is certain as indicated on Figure'2 even if

- - - - - ~ ~ . - - - - - . - _ _ . . _ . . . - _ _ _ _ _ _ ,,_ , , _ , , _

accumulators are available. Core damage would occur at -8 minutes after the I break. The other parametric cases indicate that stable core cooling can be established with a minimum of one HPI pump available until the RWST inventory _

is depleted, which is in the order of 1-12 hours (Figure D.3). Long term l cooling is a major concern since the water supply from the RWST is limited.

4 In addition, recirculation system may be unavailable due to the postulated a

failure in the low pressure RHR system.

i i

D.2 Small LOCA (<2")

+

i The primary system in accident sequences with initial break size less-

' than 2" in diameter will remain pressurized by one HPl pump (see Figute D.4). _

The reactor coolant system is refilled and subcooling is achieved. Core e average temperature is determined by system-wide energy balance (Figure D.5) and in all' esses the system would slowly c*ool until the RWST water supply is i

a I

_ - - - - _ _ - . . . _ . , - ~ . . _ , _ - , _ _ - _ ~ . . . _ _ - - _ . - . _ , _ _ _ . . _ _ - , _ - . _ _ . _ . - . _ _ , - - _ . . _ -

3 D-2 i L . .. ..

exhausted, which may be extended by throttling the HPI-flow. Conditions for low pressure recirculation cooling are not met before the.RWST supply runs out (8-15 hours). Long term cooling may also be of some concern, because the postulated failure could affect'the capability of the-HP and/or LP recirculation system.

t References i

1. J. F.

Dearing et al.,

" Dominant Accident Sequences in Oconee-1 PWR,"

NUREG/CR-4140, Los Alamos National Laboratory, April 1985.

b 4

1 i

s J

d'

)

e l

d W

.)

D-3 n

1 i

M . . . . . . . .

- BASE Cast 14 - ......... . HPI.1 + LPI8

• Stml MPtse Q

A

{ - ONE MPIS J

X 12 - .

v .

G b .

D 10- .

E o

6

& 8-. .

e LPI C { trutated

.&* 8-. l es H9t .-

g 1

I 4 -

More steem productiest h in 31 case ti.aa

• g / the base ceas 2-- More condenation

\

6 in Si cear g because er cold water entertag he ---

0-- the care _ . . . . , _ .

t

-2 0 $0 Ado 150 2bo 2$0 Obo $ M 4*A Tima (s)

Figure D.1 Primary system pressure during V sequence base and parametric cases.

I

. , . - ,, . _ . . , m _ _ . - . _ . - . v -

r a D-4 1AE a e a a e a a BASE CAaB

- .......... up 3 , ists gqgg. Bent MPlan -

- ens urts a

bd w -

. M- -

6.

3 on 2 soo-- -

8.

E

[ M-- HPI Aorumulator -

nasusted actana u

4 D E"- g LPI intilated ag 13 a(E -

/ n Ascumulatore empty O ~

RCPn ett i U I*...a % a w J M .S,_ -(,

• ~

End of blowdown, esses et e.no.n E . i 6 . i . .

so o no 100 ano 200 ano ano 400 450 Time (s)

Figure D.2 Maximum cladding temperature of average rod during V sequence base and parametric cases.

I l

I l

J

. y<

D-5 w

IE . . . . . . . .

. DirST een Bast CASE (L46 h) pty .

la 6230 a .

. . .. . .... . HM S + lit s *

~ BOTH MPlan .

es M. . ,,

• DW5T empty in 28000 e#, .~

X w .-

(38 h) ,-

LP! lattiated ..

• #'p g " ~~

o .d~~~~~~., .

E~ ' '

\ WST S empty in 4300 e "

c (IL7 h) o 0 -

i .

2 m 403X)- .

C Accumulator dump .

h I a

M- .

90

~

MPI imtested je n .. -

g" o.

-20000- . . . . . . ,

O SO 100 ISO 200 250 J00 350 400 430

. .. Tame- (s) - - -

i I

Figure D.3 Duration of effective core cooling during V sequence base and parametric cases.

i i

1 ,

I i i l

J e

l 1

D-6 J

18 , , , , . -2600

^ .- . _ _

,,, 9 16 - p PORY Setpoint prte ', .

-2200 f

14 -*

• .-2000 J

I. I T w

g ~

~ '800 5

m 12 - -

~

-1600 1

10 . .

'1400 4

8-~ .

1200

-10C0 6 , . . . . , ,

0 1000 2000 3000 4000 $000 C000 7000 8000 1000 10000 TIME (s) l 1

Figure D.4 Pressurizer pressure,11-m diam. (0.43") break case.

e' iI e

I

D-7 -

soo , , , , , , . . .

- 815 g 90- g .

-600 @

y v

$ W

.N a 560- -

--585 a-s 5@

c.

W 2 570- .

3 9 w a O ~

Com tempentum flotermined by - 555 g 5 Sao. ,

positive system-wide energy balance . g Q w W -

-540 N

8 s

$50- v q

- 525 540- , , , . . . . . .

0 1000 2000 4000 4000 6000 6000 7000 8000 9000 10000 WE (s)

Figure D.5 Core average liquid temperature, 11-te diam. (0.43") break case.

6-1 6.

EFFECTS OF SOME CORRECTIVE ACTIONS ON CORE DAMAGE FREQUENCY In order to reduce the core damage frequency due to ISLs, numerous options appear to be available. From these options, however, corrective actions with perspective of implementation are rather limited. In the present section, those corrective actions will be discussed which have been deemed to be implementable without excessive difficulties.

The corrective acticas considered are essentially plant specific ones.

The reason for this is that one or two plants already have certain safety features against ISLs, while others do not.

In the following calculations, the effects of the remedial actions on the initiator frequencies of LOCAs and overpressurization, as well as on the core damage frequencies are presented.

6.1 Corrective Actions at Indian Point 1 At Indian Point 3 leak tests are performed on the isolation valves (check valves as well as MOVs) after each cold shutdown. Thus, there is no reason to increase the frequency of leak tests. However, as the calculations below demonstrate, there is room for safety improvement by implementing the i following corrective actions.

1.

Application of pressure sensors (or equivalent continuous leak sensor devices) between the first (RCS side) and second isolation valves on each of the LPI/HPI/RHR pathways. (This is a feature, which can be found at the common LPI/HPI/ Accumulator inlet at Calvert Cliffs 1.)

2.

Improving the ability of operators for ISL recognition and accident management.

3. Application of a " pipe fuse" (or equivalent plant feature) in the RHR suction line after the two MOVs, as it is implemented at Oconee 3.

4. Establishing a procedure for RWST makeup in case of an ISL.

6-2 Table 6.1 presents the base case results to be compared with the results l of each corrective action separately and combined.

6.1.1 Application of Permanent Pressure Sensor Between The First Two

Isolation Valves on Each'LPI/MPI/RHR Line i

The advantage of the pressure sensor is that whenever,the first isolation

-valve leaks an overpressurization alarm would call the ~ attention of the

]

operator to make preventive action in-time. .Its effect causes the time i dependent terms to vanish in expressions describing initiator frequencies..

Table 6.2 shows the pathway by pathway results if.the permanent pressura sensors are implemented. (The results reflect the assumption that the pressure sensors will not fail.) The last column gives the core damage reduction values relative to the base case. The effect of the continuous leak testing is to reduce the total CDF associated with ISL bypassing the-l containment by a factor of -2.

, 6.1.2 Improving The Ability of Operators For ISL Management i

After the plant visit and having read the LOCA procedure of Indian Point 3, our impression was that it would be very useful to improve the ability of

operators to manage an ISL accident. This would be easily achieved by training on control room simulators. However, Table 6.3 shows the effect of >

! considering improved operator actions in the ISL event trees is negligible.

t 4

6.1.3 Application of a " Pipe Fuse" in The RHR Suction Pathway 1

The advantage of the implementation of this corrective feature is that it

~

allows to convert a containment bypassing LOCA to a LOCA inside the j containment. Its merit is related rather to risk reduction and not to overall

?

reduction of core damage. It results in the decrease of about a factor of two 4 of the core damage frequency value associated with the "ISL outside i

j containment" case in Table 6.4.

4 i

l

6-3 6.1.4 Establishing RWST Makeup Procedure One of the basic assumptions in this study is that small LOCA bypassing the containment (LOCA/outside) would eventually lead to core damage (CCDF=1).

The operator has to rely on the water supply available in the RWST. The makeup to the RWST is generally based on "ad hoc" arrangements depending on the type of accidents and the available water supply. If this procedure can be formalized with respect to the various ISL scenarios, the CDF associated with small LOCA/outside would greatly be reduced (effectively reflecting only HP unavailability and typically CCDF-10-3).

't Table 6.5 lists the corresponding CDF values and it can clearly be seen th t the total CDF/outside is reduced by more than a f actor of-10. Two important conclusions can be drawn: 1) small LOCAs dominate the total

. CDF/outside, and 2) the most effective corrective action is to insure long term water supply.

Table 6.6 provides the results if all of the above corrective actions I

s would be implemented. A comparison with the base case shows significant advantage by implementing all of the above corrective actions.

6.2 Corrective Actions at Oconee 3 At Oconee 3 the leak tests of the isolation check valves and HOVs are performed at halfway between refueling (nine month intervals). After cold shutdown (there are two during the leak test period) the isolation valves may

. remain in failed states (open). Therefore, for this plant the simplest remedial action is to increase the frequency of the leak test. In addition, there are other options. The list of recommendations are:

1. Leek test of the isolation valves (check and HOVs) after each cold shutdown.

2. Application of permanent pressure sensors between the first and the second isolation valves on each LPI/R!!R pathways.

x

i 6-4:

e

3. Improving the ability of operators for ISL recognition and' accident management.

, 4. Rerouting the drain lines of certain relief valves back to the containment.

! 5. Establishing RWST makeup procedure.

1 a

t Table 6.7 provides the results to be compared with the results of each corrective action separately _and combined.

6.2.1 Leak Test of The Isolation Valves After Each Cold Shutdown With the implementation of leak tests after each cold shutdown, the possibility of leaving isolation valves open can be eliminated. In addition, i

the MOV in the LPI lines should be open during RCS pressurization. After 3

i reaching system pressure and before rods are withdrawn the MOV'should be 1

closed.-

At the RHR suction MOVs, after leak tests the fuse disconnect should be j kept open to isolate the 480 ac power during plant operation. This is j implemented at Indian Point 3 aga*nst any spuriously generated shorts in the control cables of the MOV breaker.

j Table 6.8 lists the results of the calculation. The results are obtained

,. by omitting the " quarterly correction terns" introduced into the expressions 4

describing the LPI/RHR initiators at Oconee 3.

a j 6.2.2 Application of Permanent Pressure Sensors Between The First and Second Isolation Valves on Each LPI/RHR Pathways i

i i

f The application of pressure sensors (or other equivalent leak sensor '

] devices) have the same effect as it was explained at Indian Point 3. - Table

! 6.9 shows the results for each pathway.

4 e

1 a

6-5 6.2.3 Improving The Ability of Operators For ISL Recognition and Accident Management Table 6.10 presents the results of this corrective action.

6.2.4 Rerouting The Drain Lines of Certain Relief Valves Back to The C'ntainment o

The drain lines of the LPI and letdown relief valves relieve into tanks located outside containment. The consequences of this fact is that small LOCAs though these relief valves are essentially containment bypassing ISLs.

By rerouting the drain lines from these relief valves back to the containment (e.g., to the Pressurizer Relief Tank) containment bypassing LOCAs would be converted to LOCAs inside containment. Thus, health risk would be reduced.

Table 6.11 contains the results of this correction action.

6.2.5 RWST Makeup Procedure f

( Establishing RWST makeup procedures have significant effect in reducing total CDF/outside as it was explained at Indian Point 3. Table 6.12 lists the results of this corrective action.

The combined effect of corrective action 2, 3, 4, and 5 is shown in Table 6.13.

6.3 Corrective Actions at Calvert Cliffs 1 At Calvert Cliffs there is a permanent pressure sensor at the common LPI/HPI/ Accumulator inlet. There is also a relief valve between the HOVs on the RHR suction line. However, its set point is set to high.

Thus, for Calvert Cliffs the list of corrective action is as follows: t i

1. Application of permanent pressure sensors also between the last check i

valves and the closed MOV on the LPI/HPI lines and also between the l two MOVs in the RHR suction line.

l l

1

~ . , -. . . . . . -. . . , , - .n. . .- -

~

l 6-6 'i

2. Improving the ability-of operators for ISL recognition and accident I management.

, 3. Rerouting the drain lines of LPI/HPI/RHR/Let'down relief valves back 3

4 to the containment.

4. RWST makeup procedure.

I Table 6.14 summarises the results to be compared with the results of each

, corrective action separately and combined.

i, 6.3.1 Application of Additional Permanent Pressure Sensors t

e In the base case calculations for the LPI/HPI lines full credit was not

, given to the effect of the pressure sensor at the shared inlet, because the other check valves and the MOVs on these lines are not surveilled

} continuously. Also, no credit was given to the effect of the relief valve

{ between the two MOVs on the RHR suction line.

!(.

l Table 6.15 contains the relevant data if the additional permanent l pressure sensors would be implemented along with open fuse disconnects of 480 b ac power bus to the RHR suction MOVs.

j 6.3.2 Improvement of The Ability of Operators For ISL Recognition and

{ Accident Management 1

4 r

i Table 6.16 shows the results of this corrective action.

/

l 6.3.3 Rerouting The Drain Lines of LPI/HPI/RHR/ Letdown Relief Valves Back to-l The Containment i

The advantage of rerouting the drain lines of these' relief valves back to

j. the containment has mainly health risk reducing significance. Table 6.17 4

presents the relevant data.

i i

< , _ . . _ _ _ _ _ . _ _ . - - - . _ . - . _ _ , , . _ .. . . _ _ . _ _ - , , . . _ . - _ - , . - , . , __ _ _ , , . . _ ~ . . . . , . _ - _ . - _

6-7 6.3.4 RWST Makeup Procedure Table 6.18 presents the results of calculations including the effects of formalized RWST makeup procedure.

The combined effect of. corrective actions 1, 2, ., and 4 is shown in Table 6.19.

I'

\

6-8 Table 6.1 Core Damage Frequency - Indian Point Base Case System CDF/ Year Initiator P(Rupture) Base A - Overpressurization LPI 1.71-06 1.00-01 3.26-07

1.00-03 1.74-07 3.00-05 1.73-07 SI 6.98-05 1.00-01 6.36-06 1.00-03 6.36-08 3.00-05 L.91-09 RHR Suction 9.8'0-07 1.00-01 4.93-07 1.00-03 4.93-07 3.00-05 4.93-07 Letdown 6.82-07 1.00 1.50-10 i

Accumulators 4.64-03 1.00-01 3.18-06 1.00-03 8.89-07 3.00-05 8.66-07

B - Without overpressurization LPI 9.88-06 SI 5.63-08

' 5.52-04 3.15-06 RHR 1.70-05 9.69-08 j Letdown a

2.28-03 1.30-05 Total CDF A - Overpressurization 1.00-01 1.04-05 '

1.00-03 1.62-06 3.00-05 1.53-06 B - Without overpressurization A ar.d B 1.63-05 1.00-01 2.67-05 1.00-03 1.79-05 3.00-05 1.78-05 Total CDF With ISL Outside 1.00-01 7.17-07 1.00-03 6.63-07 3.00-05 6.61-07

6-9 Table 6.2 Core Damage Frequency - Indian Point Continuous Leak / Pressure Monitoring CDF/ Year CDF/ Year CDF Pert Systsm Initiator P(Rupture) Perturbed Base CDF Base A - Overpressurization LPI 9.90-07 1.00-01 1.89-07 3.26-07 .58 1.00-03 1.01-07 1.74-07 .58 3.00-05 1.00-07 1.73-07 .58 SI 2.04-06 1.00-01 1.86-07 6.36-06 .03 1.00-03 1.86-09 6.36-08 .03 3.00-05 5.57-11 1.91-09 .03 RHR Suction 4.85-07 1.00-01 2.44-07 4.93-07 .50 1.00-03 2.44-07 4.93-07 .50 3.00-05 2.44-07 4.93-07 .50 Lstdown No change 1.00 1.50-10 1.00 Accumulators No change 1.00-01 3.18-06 1.00 1.00-03 8.89-07 1.00 3.00-05 8.66-07' 1.00 4 - Without Overpressurization LPI 1.50-06 8.55-09 SI 5.63-08 .15 6.81-06 3.88-08 3.15-06 .01 RHR 1.49-06 8.49-09 9.69-08 .09 Letdown No change 1.30-05 1.00 Total CDF A - Overpressurization 1.00-01 3.80-06 1.04-05 .37 1.00-03 1.24-06 1.62-06 .76 3.00-05 1.21-06 1.53-06 .79 B - Uithout overpressurization 1.31-05 1.63-05 .80 A cnd B 1.00-01 1.69-05 2.67-05 .63 1.00-03 1.43-05 1.79-05 .80 3.00-05 1.43-05 1.78-05 .80 Total CDF With ISL Outside. 1.00-01 3.34-07 7.17-07 .47 1.00-03 3.41-07 6.63-07 .52 3.00-05 3.41-07 6.61-07 .52 l

l l

i

' ' ~ ^ ~ ~ ~

6-10 Table 6.3 Core Damage Frequency - Indian Point Operator Training CDF/ Year CDF/ Year CDF Pert Systsm Initiator P(Rupture) Perturbed Base CDF Base A - Overpressurization LPI No change 1.00-01 3.25-07 3.26-07 .99 1.00-03 1.73-07 1.74-07 .99 3.00-05 1.71-07 1.73-07 .99 SI No change 1.00-01 6.29-06 6.36-06 .99 1.00-03 6.29-08 6.36-08 .99 3.00-05 1.89-09 1.91-09 .99 RHR Suction No change 1.00-01 No change 4.93-07 1.00 1.00-03 No change 4.93-07 1.00 3.00-05 No change 4.93-07 1.00 L2tdown No change 1.00 1.19-10 1.50-10 .79 Accumulators No change 1.00-01 2.54-06 3.18-06 .79 1.00-03 8.14-07 8.89-07 .92 7 3.00-05 7.97 8.66-07 .92

'o - Without Overpressurization LPI No change SI No change 5.63-08 1.0 No change No change 3.15-06 RHR No change 1.0 No' change 9.69-08 1.0 Latdown No change No change 1.30-05 1.0 Totel CDF A - Overpressurization 1.00-01 9.65-06 1.04-05 .93  !

1.00-03 1.54-06 1.62-06 .95  !

3.00-05 1.46-06 1.53-06 .95 l B - Without Overpressurization 1.63-05 l

A cnd B 1.63-05 1.00 '

1.00-01 2.59-05 2.67-05 .97 1.00-03 1.78-05 1.79-05 .99 3.00-05 1.78-05 1.78-05 .99 Total CDF With ISL Outside 1.00-01 6.55-07 7.17-07 .91 I 1.00-03 6.61-07 6.63-07 .99 3.00-05 6.61-07 6.61-07 .99 l

1 1

6-11 Table 6.4 Core Damage Frequency - Indian Point RHR Suction, Inside Break Enhanced CDF/ Year CDF/ Year CDF Pert Systsm Initiator P(Rupture) Perturbed Base CDF Base A - Overpressurization LPI No change 1.00-01 3.26-07 1.00.

1.00-03 1.74-07 1.00 3.00-05 1.73-07 1.00 SI~ No change 1.00-01 6.36-06 1.00 1.00-03 6.36-08 1.00 3.00-05 1.91-09 1.00 RHR Suction No change 1.00-01 1.03-07 4.93-07 .21 1.00-03 1.03-07 4.93-07 .21 3.00-05 1.03-07 4.93-07 .21 Lotdown No change 1.00 1.50-10 1.0 Accumulators No change 1.00-01 3.18-06 1.00 1.00-03 8.89-07 1.00 3.00-05 8.66-07 1.00 s a - Without Overpressurization LPI No change 5.63-08 1.00 SI No change 3.15-06 1.00 RHR No change 9.69-08 1.00 Letdovn No change 1.30-05 1.00 Tote.1 CDF A - Overpressurization 1.00-01 9.97-06 1.04-05 .96

, 1.00-03 1.23-06 1.62-06 .76 3.00-05 1.14-06 1.53-06 .75  ;

B - Without Overpressurization 1.63-05 1.63-05 1.00 A cnd b 1.00-01 2.63-05 2.67-05 .99 1.00-03 1.75-05 1.79-05 .98 1

3.00-05 1.74-05 1.78-05 .98

-Tctel CDF With ISL Outside 1.00-01 3.25-07 7.17-07 .45 1.00-03 2.70-07 6.63-07 .41 3.00-05 2.69-07 6.61-07 .41 l

4 e

6-12 Table 6.5 Core Damage Frequency - Indian Point RWST Makeup Procedure CDF/ Year CDF/ Year CDF Pert Systim Initiator P(Rupture) Perturbed Base CDF Base A - Overpressurization LPI No change 1.00-01 1.73-07 3.26-07 .53 1.00-03 4.33-09 1.74-07 .02 3.00-05 2.67-09 1.73-07 .01 SI No change 1.00-01 6.29-06 6.36-06 .99 1.00-03 6.29-08 6.36-08 .99 3.00-05 1.89-09 1.91-09 .99

'RHR Suction No change 1.00-01 5.44-08 4.93-07 .11 1.00-03 6.07-09 4.93-07 .01 3.00-05 5.60-09 4.93-07 .01 Letdcwn No change 1.00 1.16-10 1.50-10 .77 Accurulators No change 1.00-01 3.18-06 1.0 1.00-03 8.89-07 1.0 e, 3.00-05 8.66-07 1.0

_ - Without Overpressurization

. LPI No change SI 5.63-08 1.0 No change 3.15-06 RHR 1.0 No change 9.69-08 Letdown 1.0 No change 1.30-05 1.0

, Tetal CDP A - Overpressurization 1.00-01 9.70-06 1.04-05 .94 1.00-03 9.62-07 1.62-06 .60 3.00-05 8.77-07 1.53-06 .57 B - Without Overpressurization 1.63-05 A cnd B 1.63-05 1.0 1.00-01 2.60-05 2.67-05 .98 1.00-03 1.73-05 1.79-05 .96 3.00-05 1.72-05 1.78-05 .96 l

Total CDF With ISL Outside 1.00-01 5.65-08 7.17-07 .08 1.00-03 4.29-09 6.63-07 .01 3.00-05 3.78-09 6.61-07 .01 4

D

- . - - - - - - ,,,m -

6-13 Table 6.6 Core Damage Frequency - Indian Point Combination of Corrective Actions System CDF/ Year CDF/ Year CDF Pert Initiator P(Rupture) Perturbed Base CDF Base.

A - Overpressurization i LPI 1.00-01 9.97-08 3.26-07 1.00-03 .31 1.79-09 1.74-07 .01 3.00-05 8.26-10 1.73-07 .005 SI' 1.00-01 1.84-07 6.36-06 1.00-03 .03 1.84-09 6.36-08 .03 3.00-05 5.51-11 1.91-09 .03 RHR Suction 1.00-01 7.70-09 4.93-07 1.00-03 .02 2.81-09 4.93-07 .01 3.00-05 2.77-09 4.93-07 .01 Lotdewn 1.00 1.16-10 1.50-10 .77 Accurulators 1.00-01 2.54-06 3.18-06 1.00-03 .79 8.14-07 8.89-07 .92 3.00-05 7.97-07 8.66-07 .92

. - Without overpressurization LPI SI 8.55-09 5.63-08 .15 RHR 3.88-08 3.15-06 .01 L2tdown 8.49-09 9.69-08 .01 1.30-05 1.30-05 1.0

_Totn1 CDF A - Overpressurization 1.00-01 2.83-06 1.04-05 .27 1.00-03 8.20-07 1.62-06 3.00-05 .51 8.01-07 1.53-06 .52 i

B - Without Overpressurization A cnd B 1.31-05 1.63-05 .80 1.00-01 1.59-05 2.67-05 .60 1.00-03 1.39-05 i 1.79-05 .77 3.00-05 1.39-05 1.78-05 .77 l Totcl CDF With ISL Outside 1.00-01 5.78-09 7.17-07 .01 I 1.00-03 8.90-10 6.63-07 3.00-05 .001 i 8.42-10 6.61-07 .001 i

r

?

6-14 Table 6.7 Core Damage Frequency - Oconee Base Case CDF/ Year System Initiator P(Rupture) Base A - Overpressurization LPI 7.68-08 1.00-01 7.68-08 1.00-03 7.68-08 3.00-05 7.68-08 RHR Suction 1.44-06 1.00-01 1.48-07 1.00-03 1.47-07 3.00-05 1.47-07 Letdown 2.28-03 1.0 5.93-07 Accumulators 4.10-03 1.00-01 4.83-06 1.00-03 7.21-07 3.00-05 6.81-07 l

l B - Without Overpressurization

, LPI 6.22-07 6.22-07 i

RHR 5.04-05 1.06-07 Total CDF A - Overpressurization 1.00-01 5.65-06 1.00-03 1.54-06 3.00-05 1.50-06

. B - Without Overpressurization 7.31-07 A and B 1.00-01 6.38-06 1.00-03 2.27-06 3.00-05 2.23-06 Total CDF With ISL Outside 1.00-01 1.44-06 1.00-03 1.44-06 3.00-05 1.44-06 4

a

______.________.___.___________.___________________.___________._______.______________._____________________________I

. i 6-15 i

Table 6.8 Core Damage Frequency - Oconee Leak Test Af ter Each Cold Shutdown Systcm CDF/ Year CDF/ Year CDF Pert

, Initiator P(Rupture) Perturbed Base CDF Base A - Overpressurization LPI 9.68-09 1.00-01 9.68-09 7.68-08 .12 1

1.00-03 9.68-09 7.68-08 .12 3.00-05 9.68-09 7.68-08 .12 j RHR Suction 1.02-06 1.00-01 1.05-07 1.48-07 .71 1.00-03 1.04-07 1.47-07 .71

3.00-05 1.04-07 1.47-07 .71 Latdown No change 1.0 5.93-07 1.00 Accu ulators 2.75-03 1.00-01 3.24-06 4.83-06 .67 1.00-03 4.84-07 7.21-07 .67 3.00-05 4.57-07 6.81-07 .67 B - Without Overpressurization 4

LPI 8.07-08 R

8.07-08 6.22-07 .13 1.85-05 3.88-08 1.06-07

.37 Tatal CDF A - Overpressurization 1.00-01 3.95-06 5.65-06 .70 1.00-03 1.19-06 1.54-06 .77 3.00-05 1.16-06 1.50-06 .78

B - Without Overpressurization 1.20-07 i A cnd B 7.31-07 .16 1.00-01 4.07-06 6.38-06 .64 1.00-03 1.31-06 2.27-06

.58 3.00-05 1.28-06 2.23-06 .58 Total CDF With ISL outside 1.00-01 7.85-07

! 1.44-06 .55 1.00-03 7.85-07 1.44-06 4 .55 3.00-05 7.85-07 1.44-06 .55 l

l i

i

d 6-16 l Table 6.9 Core Damage Frequency - Oconee Continuous Leak / Pressure Testing I' CDF/ Year CDF/ Year CDF Pert Systca Initiator P(Rupture) Perturbed Base CDF Base l A - Overpressurization LPI 6.57-10 1.00-01 6.57-10 7.68-08 .01 1.00-03 6.57-10 7.68-08 .01 3.00-05 6.57-10 7.68-08 .01 i RHR Suction 5.80-07 1.00-01 5.95-08 1.48-07 .40 1.00-03 5.91-08 1.47-07 .40

-3.00-05 5.91-08 1.47-07 40 Lotdswn No change 1.0 5.93-07 -1.00 Accunulators No change 1.00-01 4.83-06 1.00 1.00-03 7.21-07 1.00 3.00-05 6.81-07 1.00 B - Without Overpressurization

, . t.P I 2.90-09 2.90-09 6.22-07 .004

s .!R 1.77-06 3.72-09 1.06-07, .03 Tatel CDF A - Overpressurization 1.00-01 5.49-06 5.65-06 .97 1.00-03 1.37-06 1.54-06 .89 3.00-05 1.33-06 1.50-06 .89

~

B - Without Overpressurization -

6.62-09 7.31-07 .01 A cnd B 1.00-01 5.49-06 6.38-06 .86 1.00-03 1.38-06 2.27-06 .61 3.00-05 1.34-06 2.23-06 .60 i Total CDF With ISL Outside 1.00-01 6.54-07 1.44-06 .46 1.00-03 6.54-07 1.44-06 46 3.00-05 6.54-07 1.44-06 .46 4

T

6-17 Table 6.10 Core Damage Frequency - Oconee J,

Operator Training  ;

CDF/ Year CDF/ Year CDF Pert Systcm Initiator P(Rupture) Perturbed Base CDF Base

• 4 A - Overpressurization LPI No change 1.00-01 7.68-08 7.68-08 1.00 1.00-03 7.68-08 7.68-08 1.00 3.00-05 7.68-08 7.68-08 1.00 RHR Suction No change 1.00-01 1.48-07 1.48-07 1.00 '

1.00-03 1.47-07 1.47-07 1.00-3.00-05 1.47-07 1.47-07 1.00 1 Estd:wn No change 1.0 3.88-07 5.93-07 .65 i Accurulators No change 1.00-01 4.82-06 4.83-06 .99

1.00-03 7.00-07 7.21-07 .97

, 3.00-05 6.60-07 6.81-07 .97 B - Without Overpressurization i'

'PI No change 6.25-07 6.22-07 1.0

.tR No change 1.06-07 1.06-07 1.0

} Tetal CDF

) A - Overpressurization 1.00-01 5.43-06 5.65-06 .96 1.00-03 1.31-06 1.54-06 .85 3.00-05 1.27-06 1.50-06 .85 B - Without overpressurization I '

1 7.31-07 7.31-07 1.0 A cnd B 1.00-01 6.16-06 6.38-06 l

.97 1.00-03 2.04-06 2.27-06 .90

{

, 3.00-05 2.00-06 2.23-06 .89 Totel CDF With ISL Outside 1.00-01 1.23-06 1.44-06 1 .86 1.00-03 1.23-06 1.44-06 .86 3.00-05 1.23-06 1.44-06 .86

,1 7

1 b

e

l 6-18 l

Table 6.11 l Core Damage Frequency - Oconee Rerouting Relief Valve Drain Lines CDF/ Year CDF/ Year CDF Port l Systcc Initiator P(Rupture) Perturbed Base CDF Base i

A - Overpressurization LPI No change 1.00-01 7.68-08 1.00 1.00-03 7.68-08 1.00 3.00-05 7.68-08 1.00 RHR Suction No change 1.00-01 1.48-07 1.00 1.00-03 1.47-07 1.00 3.00-05 1.47-07 1.00 14tdown No change 1.0 3.65-07 5.93-07 .62 Accumulators No change 1.00-01 4.83-06 1.00 1.00-03 7.21-07 1.00 3.00-05 6.81-07 1.00 B - Without Overpressurization

'PI No change 1.31-09 6.22-07 .002 IR No change 1.06-07 1.06-07 1.00 l Tatel CDF i

A - Overpressurization 1.00-01 5.42-06 5.65-06 .96 1.00-03 1.31-06 1.54-06 .85 3.00-05 1.27-06 1.50-06 .85 B - Without Overpressurization '

1.07-07 7.31-07 .15 A cnd B 1.00-01 5.53-06 6.38-06 .87 1.00-03 1.42-06 2.27-06 .63 3.00-05 1.38-06 2.23-06 .62 Totc1 CDF With ISL Outside 1.00-01 5.87-07 1.44-06 .41 1.00-03 5.87-07 1.44-06 .41 3.00-05 5.87-07 1.44-06 41

6-19 Table 6.12 Core Damage Frequency - Oconee RWST Makeup Procedure CDF/ Year CDF/ Year CDF Part Systca Initiator P(Rupture) Perturbed Base CDF Base A - Ovntpressurization LPI No change 1.00-01 7.83-09 7.68-08 .10 1.00-03 2.38-10 7.68-08 .003 3.00-05 1.64-10 7.68-08 .002 l RHR Suction No change 1.00-01 1.85-08 1.48-07 .13 1.00-03 3.18-09 1.47-07 .02 3.00-05 3.03-09 1.47-07 .02 L tdcwn No change 1.0 3.65-07 5.93-07 .62 Accumulators No change 1.00-01 4.83-06. 1.00 1.00-03 7.21-07 1.00 3.00-05 6.81-07 1.00 B - Without Overpressurization No change 1.31-09 6.22-07 .002 (91 R No change 1.06-07 1.06-07 1.00 Total CDF A - Overpressurization 1.00-01 5.23-06 5.65-06 .93 1.00-03 1.09-06 1.54-06 .71 3.00-05 1.05-06 1.50-06 .70 3 - Without Overpressurization '

1.07-07 7.31-07 .15 A cnd B 1.00-01 5.33-06 6.38-06 .84 1.00-03 1.20-06 2.27-06 .53 3.00-05 1.16-06 2.23-06 .52 Total CDF With ISL Outside 1.00-01 3.89-07 1.44-06 .27 1.00-03 3.67-07 1.44-06 .26 3.00-05 3.67-07 1.44-06 .26 I

6-20 l

Table 6.13 Core Damage Frequency - Oconee Combination of Corrective Actions l

l CDF/ Year CDF/ Year CDF Pert Systco Initiator P(Rupture) Perturbed Base CDF Base l l A - Overpressurization LPI 1.00-01 6.69-11 7.68-08 .001 1.00-03 2.04-12 7.68-08 .00002 3.00-05 1.40-12 7.68-08 .00001 RHR Suction 1.00-01 7.43-09 1.48-07 .05 1.00-03 1.'28-09 1.47-07 .01 3.00-05 1.22-09 1.47-07 .01 L:tdown 1.0 3.65-07 5.93-07 .62 Accurulators 1.00-01 4.82-06 4.83-06 .99 1.00-03 7.00-07 7.21-07 .97 3.00-05 6.60-07 6.81-07 .97 B - Without Overpressurization

'PI 6.09-12 6.22-07 0.0

.lR 3.72-09 1.06-07 .04 Tetal CDF A - Overpressurization 1.00-01 5.19-06 5.65-06 .92 1.00-03 1.07-06 1.54- 16 .70 3.00-05 1.03-06 1.50-06 .68 5 - Without Overpressurization 3.72-09 7.31-07 .01 A cnd B 1.00-01 5.19-06 6.38-06 .81 1.00-03 1.07-06 2.27-06 .47 3.00-05 1.03-06 2.23-06 .46 Tctol CDF With ISL Outside 1.00-01 3.71-07 1.44-06 .26 1.00-03 3.65-07 1.44-06 .25 3.00-05 3.65-07 1.44-06 .25

4 6-31 Table 6.14 Core Damage Frequency - Calvert Cliffs Base Case CDF/ Year Sys teis Initiator P(Rupture) Base i

' A - Overpressurization >

LPI 1.07-09 1.00-01 1.07-09 1.00-03 1.07-09

, 3.00-05 1.07-09

!: SI 6.21-10 1.00-01 6.21-11 l 1.00-03 6.21-13 l 3.00-05 1.86-14 i

RHR Suction 1.48-06 1.00-01 1.48-06 1.00-03 1.48-06 l 3.00-05 1.48-06  :

Letdown 2.28-03 1.0 3.99-07 Accumulators 5.98-03 1.00-01 1.11-05 1.00-03 5.77-07

3.00-05 4.74-07 '

J B - Without overpressurization

, LPI 3.94-09 3.94-09 i

SI 3.93-09 3.93-09 RHR 1.75-05 1.75-05 Total CDF '

A - Overpressurization 1.00-01 1.30-05 1.00-03 2.46-06 3.00-05 2.35-06 '

?

B - Without Overpressurization 1.75-05 A and B 1.00-01 3.05-05 1.00-03 2.00-05 3.00-05 1.99-05 Total CDF With ISL Outside 1.00-01 1.92-05 i

1.00-03 1.92-05 l

3.00-05 1.92-05 l

't I, ,

I i

-. . . .- - - _. ~ - ~ . . .... - .-- - - - - _

6-22 Table 6.15 Core Damage Frequency - Calvert Cliffs Continuous Leak / Pressure Monitoring i

CDF/ Year CDF/ Year CDF Part 1 Systcm Initiator P(Rupture) Perturbed Base CDF Base

-l A - Overpressurization I 1

j LPI 2.68-11 1.00-01 ' 2.68-11 1.07-09 .03 j 1.00-03 2.68-11 1.07-09 .03 3.00-05 2.68-11 1.07-09 .03 SI 5.96-12 1.00-01 5.96-13 6.21-11 .01 I

1.00-03 5.96-15 6.21-13 .01 l 3.00-05 1.79-16 1.86-14 .01 j l RHR Suction 5.93-07 1.00-01 5.93-07 1.48-06 .40 1.00-03 5.93-07 1.48-06 .40 j 3.00-05 5.93-07 1.48-06 .40 Letdown No change 1.0 3.99-07 1.0 i i Accumulators No change 1.00-01 1.11-05 1.0 i 1.00-03 5.77-07 1.0

! 3.00-05 4.74-07 1.0 1-B - Without Overpressurization

! LPI 3.22-11 3.94-09 .01 l SI 1.75-11 3.93-09 .005

, RHR 1.81-06 1.75-05

.1 ,

j Tetel CDF ,

1 A - Overpressurization 1.00-01 1.21-05 1.30-05 .93 1.00-03 1.57-06 2.46-06 .64

} 3.00-05 1.47-06 2.35-06 .62 i

B - Without overpressurization 1.81-06 1.75-05 .1 A cnd B 1.00-01 1.39-06 3.05-05 .46 1.00-03 3.38-06 2.00-05 .17  ;

i 3.00-05 3.28-06 1.99-05 .17 i i

Total CDF With ISL Outside 1.00-01 2.63-06 1.92-05 .14 l j 1.00-03 2.63-06 1.92-05 .14 j 3.00-05 2.63-06 1.92-05 .14 .i i

i a

1 l

i-4 i

- . _- . - . ~ _ = - - - -. _. ,__

^

6-23 Table 6.16 4

Core Damage Frequency - Calvert Cliffs Operator Training r >

J CDF/ Year CDF/ Year CDF Pert System Initiator P(Rupture) Perturbed Base CDF Base A - Overpressurization 1

LPI No change 1.00-01 l

1.07-09 1.07 1.0 1.00-03 1.07-09 1.07-09 1.0 l 3.00-05 1.07-09 1.07-09 1.0 SI No change 1.00-01 6.21-11 1

6.21-11 1.0 1.00-03 6.21-13 6.21-13 1.0 3.00-05 1.86-14 1.86-14 1.0 i

l RHR Suction No change 1.00-01 1.48-06 l

1.48-06 1.0 1.00-03 1.48-06 1.48-06 1.0 i

l 3.00-05 1.48-06 1.48-06 1.0

,h Letdcwn No change 1.0 1.94-07 3.99-07 .48 Accumulators No change 1.00-01 8.73-06 i

1.11-05 .79 1.00-03 5.33-07 5.17-07 .93 j

3.00-05 4.53-07 4.74-07 .96 j - Without Overpressurization "

! LPI No change 2

SI 3.94-09 3.94-09 1.0 No change 3.93-09 3.93-09 RHR 1.0 i No change 1.75-05 1.75-05 1.0 i

Total CDF l A - Overpressurization

' 1.00-01 1.04-05 1.30-05 .80 1.00-03 2.21-06 2.46-06 .90 j , 3.00-05 2.13-06 2.35-06 .90 i

B - Without Overpressurization 1.75-05 A cnd B 1.75-05 1.0 1.00-01 2.79-05 3.05-05 .92 1.00-03 1.97-05 2.00-05 .99

3.00-05 1.96-05 1.99-05 .99 i Tocci CDF With ISL outside 1.00-01 1.90-05 1.92-05 .99 1.00-03 1.90-05 1.92-05 .99

- 3.00-05 1.90-05 1.92-05 .99

6-24 Table 6.17 Core Damage Frequency - Calvert Cliffs Rerouting Relief Valve Drain Lines 4

CDF/ Year CDF/ Year CDF Pert System Initiator P(Rupture) Perturbed Base CDF Base A - Oserpressurization LPI No change 1.00-01 1.07-09 1.00 1.00-03 1.07-09 1.00 3.00-05 1.07-09 1.00 SI No change 1.00-01 6.21-!! 1.00 1.00-03 6.21-13 1.00 3.00-05 1.86-14 1.00 RHR Suction No change 1.00-01 1.48-06 1.00 2

1.00-03 1.48-06 1.00 3.00-05 1.48-06 1.00 Latdown No change 1.0 1.71-07 3.99-07 .43 Accumulators No change 1.00-01 1.11-05 1.00 1.00-03 5.77-07 1.00 3.00-05 4.74-07 1.00 B - Without Overpressurization LPI No change 5.12-12 3.94-09 .001 SI No change 5.11-12 3.93-09 .001 RHR No change 2.27-08 1.75-05 .001 Total CDF A - Overpressurization 1.00-01 1.27-05 1.30-05 .98 1.00-03 2.23-06 2.46-06 .90 3.00-05 2.13-06 2.35-06 .90 B - Without overpressurization 2.28-08 1.75-05 .001 A cnd B 1.00-01 1.28-05 3.05-05 .42 1.00-03 2.25-06 2.00-05 .11 3.00-05 2.15-06 1.99-05 .I1 Total CDP With ISL Outside 1.00-01 1.50-06 1.92-05 .01 1.00-03 1.50-06 1.92-05 .01 3.00-05 1.50-06 1.92-05 .01

I l

l 6-25 l

Table 6.18 Core Damage Frequency - Calvert Cliffs RWST Makeup Procedure l

l CDF/ Year CDF/ Year CDF Pert l System P(Rupture)

Initiator Perturbed Base CDF Base A - Overpressurization '

LPI No change 1.00-01 l 1.08-10 1.07-09 .10 1.00-03 2.46-12 1.07-09 .002 '

3.00-05 1.42-12 1.07-09 .001 SI No change 1.00-01 8.07-14 6.21-11 .001 1.00-03 8.07-16 6.21-13 .001 3.00-05 2.42-17 1.86-14 .001 RHR Suction No change 1.00-01 1.50-07 1.48-06 .10 1.00-03 3.49-09 1.48-06 .002 3.00-05 1.97-09 1.48-06 .001 Latd:wn No change 1.0 1.71-07 3.99-07 43 Accumulators 'No change 1.00-01 1.11-05 1.00 1.00-03 5.77-07 1.00 3.00-05 4.74-07 1.00 n - Without Overpressurization LPI No change SI 5.12-12 3.94-09 .001 No change 5.11-12 3.93-09 RHR No change .001 2.27-08 1.75-05 .001 Tetal CDF A - Overpressurization 1.00-01 1.14-05 1.30-05 .88 1.00-03 7.51-07 2.46-06 .31 3.00-05 6.47-07 2.35-06 .28 B - Without overpressurization 2.28-08 A cnd B 1.75-05 .001 1.00-01 1.14-05 3.05-05 .38 1.00-03 7.74-07 2.00-05 .039 3.00-05 6.70-07 1.99-05 .034 T tal CDF With ISL Outside 1.00-01 1.73-07 1.92-05 .009 1.00-03 2.65-08 1.92-05 .001 3.00-05 2.50-08 1.92-05 .001 l

l

r l

6-26 Table 6.19 Core Damage Frequency - Calvert Cliffs Combination of Corrective Actions '

l CDF/ Year CDF/ Year CDF Port Systcm Initiator P(Rupture) Perturbed Base CDF Base A - Overpressurization LPI 1.00-01 2.71-12 1.07-09 .003 1.00-03 6.16-14 1.07-09 .00005 3.00-05 3.56-14 1.07-09 .00003 SI 1.00-01 7.75-16 6.21-11 1.2-05 1.00-03 7.75-18 6.21-13 1.2-05 3.00-05 2.32-19 1.86-14 1.2-05 I

l RHR Suction 1.00-01 6.00-08 1.48-06 .04 1.00-03 1.39-09 1.48-06 .001 3.00-05 7.89-10 1.48-06 .001 Letdcwn 1.0 1.71-10 3.99-07 43 i Accumulators 1.00-01 8.73-06 1.11-05 .79 1.00-03 5.33-07 5.77-07 .93 3.00-05 4.53-07 4.74-07 .96 B - Without Overpressurization LPI 4.19-14 3.94-09 1.0-05 SI 2.28-14 3.93-09 5.8-06 RHR 2.35-09 1.75-05 1.3-04 Total CDF '

A - Overpressurization 1.00-01 8.96-06 1.30-05 .69 1.00-03 7.06-07 2.46-06 .29 3.00-05 6.25-07 2.35-06 .27 8 - Without overpressurination 2.35-09 1.75-05 1.3-04 l A cnd B 1.00-01 8.96-06 3 05-05 .29 i

1.00-03 7.08-07 2.00-05 .04 3.00-05 6.27-07 1.99-05 .03 Tctal CDF With ISL Outside 1.00-01 6.24-08 1.92-05 .003 1.00-03 3.75-09 1.92-05 .0002 3.00-05 3.17-09 1.92-05 .0002 l

l 1

1

_ - - _ - _ _ - _ _ _