ML20248J915

Rev 0 to Calculation NSD-024, ANO-1 N560 Consequence Evaluation

ML20248J915
Person / Time
Site:	Arkansas Nuclear
Issue date:	05/20/1998
From:	Moody J DUKE ENGINEERING & SERVICES
To:
Shared Package
ML20248J876	List: 1CAN069804, Submits Results of Pilot Plant Application Study Performed at Unit 1 for NRC Review.Submittal Provides Pilot Application Based on ASME Code Case N-560.Calculations NSD-024 & EPRI-116-310 & Rept SIR-98-055,encl ML20248J915 ML20248J951 ML20248J990
References
NSD-024, NSD-024-R00, NSD-24, NSD-24-R, NUDOCS 9806090357
Download: ML20248J915 (41)

Text

Arkansas Nuclear One - Unit 1 l

i X-560 Pilot Plant Application Study Risk-Informed Inservice Inspection Evaluation for the Class 1, Category B-J Piping Systems consisting of the following:

l CalculationNo.NSD-024: ANO-1N560 ConsequenceEvaluation Calculation No. EPRI-116-310: Degradation l

tvfechanisms Evaluationfor ANO-1 Report No. SIR-98-055: Risk Evaluation and Element Selection in Support ofASME Code Case N-560, Arkansas Nuclear One - Unit 1 June 1998 i

O e-=Entergy

• a' Pdu Pe886 G

PDR

Page1 ANO-l_N560 ORIGINAL: PAGE 1 of 41 PAGES Rev.1: PAGE 1 of PAGES Rev. 2: PAGE 1 of PAGES Rev.3: PAGE 1 of PAGES QA RECORD?

RECORD TYPE NO.

__YES Safety Class /P.O. NO. (if applicable)

_N/A

_K NO YANKEE NUCLEAR SERVICES DIVISION CALCULATION / ANALYSIS FOR TITLE ANO-1 N560 Consequence Evaluation PLANT Arkansas Nuclear One - Unit 1 (ANO-1)

CYCLE N_/_4 CALCULATION NUMBER NSD-024 (Nonsafety-Related)

PREPARED BY REVIEWED BY APPROVED BY ReviewLevel *

/DATE

/DATE

/DATE A

b

'/44ctp g 4

FM W lf 4 2

ORIGINAL b 98 G70 -9 B C-10 W U

I Level of review required:

1 = Reviewin detail 2 = General review for reasonableness 3 = Review not required 1

KEYWORDS: Inservich Inspection OSIL Probabilistic Risk Assessment (PRAL Risk Based.

Risk infonned. ASME Section XL Consequence Analysis. Pinine rina! - May 98 ANO) MAY. doc e3 51 J

Page 2 r.AO-l_N560 Table of Contents 1.0 OBJECTIVE AND SCOPE 3

l 2.0 METHODOLOGY 5

2.1 Failure Modes & Effects Analysis (FMEA) 5 2.2 Impact Group Assessment 7

3.0 INPUTS AND ASSUMPTIONS 15 3.1 PRA Review 15 3.2 SafetyFunctions 15 3.3 Plant Level Assumptions 17 4.0 ANALYSIS 22 4.1 System Configurations 22 4.2 Failure Modes & Effects Analysis (FMEA) 22 4.3 Impact Group Assessment 27 5.0 RESULTS 38

6.0 CONCLUSION

S 39

7.0 REFERENCES

40 Fmal - May 98 ANOi,MAY. doc

1 Page 3 ANO-1_N560 1.0 Objective and Scope This analysis is conducted to suppon the application of ASME Code Case N-560 (Reference 1) at the Arkansas Nuclear One - Unit 1 (ANO-1) power plant. This calculation contains the consequence analysis portion of the evaluation required by Section 2.4 of Appendix I of the code case. The objectives of the evaluation process are to identify risk important piping segments, define the elements that are to be inspected within this risk important piping, and identify appropriate inspection methods. As pan of determining the risk significance of piping, the consequence evaluation focuses on the impact of a pipe failure.

The primary objective of the analysis presented here is to rank the consequence (s) of pipe failure for ANO-1 class 1 piping within the ASME in-service inspection (ISI) program. The systems and piping line numbers covered by this analysis and the ISI program are summarized in Table 1-1.

Each system in the class 1 ISI program is listed below:

Reactor Coolant, e

Primary Makeup and Purification, e

High Pressure Injection, e

Decay Heat Removal, e

Low Pressure Injection and e

e Core Flood The line numbers in Table 1-1 identify the nominal pipe diameter in inches (last number).

Final. May98 ANol_MAY.dae

Page 4 ANO-l_N560 Table 1-1 Piping in the Analysis Scope (1)

Line Number Description (P&ID)

CCA-136 -

Reactor Coolant Loops - Hot legs (M-230-1)

CCA-1-28 Reactor Coolant Loops - Cold Legs (M-230-1)

CCA-2-10 Pressurimr Surge Line (M-230-1)

CCA-3-2.5 Reactor Coolant Letdown (M-230-1 and M-231 2)

CCA-4-2.5 & 4 Pressurimr Normal Spray Line (M-230-1)

CCA-5-2.5 High Pressure Injection to Reactor Coolant Loops (M-230-1)

CCA-6-14.12 & 8 Core Flood and Low Pressure Injection to Reactor Vessel (M-230-1)

CCA-7-2.5 & 3 Pressuriur Pressure Relief (M-230-1) (2)

CCA-8-12 Decay Heat Removal From Hot Leg A (M-230-1 and M-232-1)

CCA-9-1.5 Pressuriur Auxiliary Spray Line (M-230-1)

CCA 13-1.5 & 2 RCS Vents and Drains (M-230-1)

(1) Reference 4 identifies system piping and instrument diagrams (P&ID).

(2) The Pressurizer block valve (CV-1000) and relief valves (PSV-1000,1001, and 1002) are bolted directly to the pressurizer; there are no BJ class welds.

Final May98 ANO) MAY. doc

Pcge 5 ANO-1_N560 2.0 Methodology The consequence evaluation is conducted assuming pipe failure (loss of pressure boundary integrity). A pipe failure can occur any time. Occurrence during operation, standby, periodic

.. testing, or an accident demand is evaluated. These failures can cause an initiating event and/or disable the corresponding system or train. In addition, the same failure can also impact the availability of other mitigating systems. These consequence scenarios are analyzed per Appendix I to Reference l'.

There are two aspects of the consequence evaluation summarized below and described in the next two subsections:

1. Failure Modes and Effects Analysis (FMEA):

(a) Break Size (b) Isolability of the Break (c) Spatial Effects

- (d) Initiating Events (e) System Impact / Recovery (f) System Redundancy

2. Impact Group Assessment:

(a) Initiating Event Impact Group Assessment (b) System Impact Group Assessment (c) Combination Impact Group Assessment The consequence evaluation is an assessment of core damage potential with the plant at-power for internal initiating events. However, containment performance, other modes of operation, and external events are considered in the final" Impact Group Assessment."

i 2.1 Failure Modes & Effects Analysis (FMEA)

The FMEA documents the evaluation of pipe break impacts. The FMEA provides the input for the impact group assessment (consequence determination'n) described in Section 2.2.

j I

~ Break Size This analysis is performed assuming a spectrum of break sizes; the size typically is based on pipe

)

diameter unless a smaller break is more limiting. No credit is given to leak-before-break in the

. analysis.

1 Fmal - May 98 ANol_MAY. doc

Page 6 ANO-l_N560 Isolability of the Break Valves are identified that can isolate the break. Isolation is credited in the analysis when there is reliable isolation (e.g., check valve or reliable detection to support operator action) or a normally closed valve. When there is adequate detection, guidance, and time for the operators to manually isolate the break before certain impacts occur, manual isolation is evaluated. Whenever isolation is l

credited, impacts are assessed for both isolation success and failure. This is described further in l

Section 2.2.

Soatial Effects l

The effects of flood, spray, and pipe whip on' mitigating systems due to a pipe break are evaluated.

l Initiating Events Some pipe breaks cause an initiating event. In the analysis of Class 1 piping (e.g., reactor coolant

_ pressure boundary), loss of coolant accident (LOCA) initiating events are prevalent. Beyond the l

first normally closed isolation valve in the reactor coolant pressure boundary, potential LOCAs that include a passive valve failure are evaluated.

System Imoact/ Recovery The impact on systems, including the potential for recovery, is described. The total impact includes the above (e.g., spatial and initiating event) as well as other direct and indirect impacts:

Direct - the failure results in a diversion of flow and a loss of the corresponding train / system or an initiating event. Pipe failure is always assumed large enough to either disable the system flow path or lead to isolation.

Indirect - the failure results in depletion of a source (e.g., BWST) and/or spatially impacts other train / system (s) due to spray, flooding, etc. Since it takes time for flooding and draining impacts to occur, detection and isolation capabilities are an important consideration in j

assessing these impacts. The spatial location and impacts of propagation are assessed for each assumed pipe failure.

Also, the impact ofisolation success and failure is considered, when applicable (see example in Section 2.2). Recovery of the system containing the pipe failure is not credited in the evaluation.

3 System Redundancy Given the total impact described above, the remaining available trains (i.e., redundancy) are identified for each critical safety function. This is a key input in the determination of the consequence ranking in Section 2.2. As described in Section 2.2, consequences are ranked based i

on the logic structure of the plant PRA. The logic structures specifically examined in this process

- include event trees and system models in response to initiating events, including success paths.

The critical failure combinations and the success paths are analyzed for each safety functicn.

Final. May 98 -

ANOl_MAY. doc

____.__________________________J

Page 7 ANO-l_N560 As described above, the impact of successful and unsuccessful isolation of a pipe failure sometimes has to be evaluated.

2.2 Impact Group Assessment The ANO-1 PRA (IPE, Reference 2), supplemented with design basis information, is used to defme the quantitative basis for applying the AShE procedure to the consequence evaluation.

Section 3.2, summarizes the ANO-1 success criteria for different safety functions.

Table 2-4 provides the values for conditional core damage probability (CCDP) utilized by Reference 1 (Table I-4) and this analysis to assign consequence categories. As described below, this table also provides the basis for Tables 2-1,2-2, and 2-3 which are in the impact group assessment.

The consequence ranking is performed based upon the impacts, including the isolability or failure to isolate the break, and the number of available mitigating trains. Section 2.1 describes the FMEA used to determine impacts and backup trains. CCDP calculations in this consequence evaluation are based on the ANO-1 PRA as described in this section and the remainder of the analysis. The evaluation is performed such that pipe segments can be qualitatively binned using the bins in Table 2-4 (e.g., High) and/or by their quantitative CCDP value estimated in this evaluation. This allows additional ranking to be performed within a category (e.g., High).

As summarized in Section 2.0, the " Impact Group Assessment" includes three types ofimpacts.

The analysis depends on whether or not the pipe failure causes an initiating event. The following explain the general methodology for the three impact group assessments.

Initiatina Event Impact Group Assessment This assessment method is used when the pipe failure only results in an initiating event (e.g., large LOCA). In order to meet this group's criteria, the failure must not fail any other system or train.

Table 2-1 is used to determine the consequence category. For example, a large LOCA in Table 2-1 leads to a "High" consequence. Also, the consequence ranking is equivalent to using Table 2-4.

Per the requirements ofN560, Table 2-1 has been revised to be ANO-1 specific, based on

' conditional core damage probability for each initiating event. This table provides the minimum consequence category when pipe failure causes one of the plant specific initiating events. If additional impacts occur to mitigating systems due to the pipe failure, the " Combination Impact Group Assessment" applies as described below.-

The methodology also requires an evaluation of the potential for LOCAs for piping beyond the l

I first normally closed r,eactor coolant isolation valve. CCDP is calculated based on the probability of the isolation valve disc rupture together with the assumed pipe segment failure.

f l

Fmal - May98 ANo!_MAY. doc

Page 8 ANO-1,_N560 Similarly, the methodology also requires an evaluation of the potential for an isolable LOCA (ILOCA) for piping beyond the first normally open reactor coolant isolation valve. When justified, CCDP is calculated for both isolation success and failure cases, and their respective impacts.

System Impact Group Assessment fNo Initiating Event)

This assessment method is used when the pipe failure does not cause an initiating event, but the pipe failure affects plant mitigating functions. In this case, Table 2-2 (Reference 1 Table I-5) or Table 2-4 with an estimate of CCDP (Reference 1, Table I-4)is used to determine the consequence category.

' Consistent with Reference 1, assigning consequence categories when the mitigating ability of the plant is affected depends on the following attributes:

1. The frequency of challenge, which determines how often the mitigating function of the system / train is called upon. This corresponds to the frequency of plant initiating events that require the system / train operation.

2. The number of unaffected backup systems / trains, which determines how many unaffected systems or trains are available to perform the same mitigating function. The availability of multiple trains makes the effect of the loss of systems / trains less significant. Mitigating systems are evaluated for each plant safety function (e.g., reactivity control, reactor makeup, heat removal). When considering the consequences,' given an isolation failure, the number of available backup trains includes isolation.

3. Exposure time is the' time to detection, repair, and/or plant shutdown for the case where pipe failure most likely occurs during the standby conditions. A combination of" frequency of challenge" and " exposure time" in Table 2-2 provides the probability of challenging the system piping assumed to have failed. When the piping is considered more likely to fait during the accident challenge (the demand configuration), the exposure time is defined as the time between tests, assuming the. test provides a comparable challenge (e.g., pressure, flow). In the analysis of the ANO-1 B-J category piping, it is always assumed that the exposure time is "all year" since the piping ofinterest is not periodically tested during operation.

~

Table 2-2 has also been revised to be ANO-1 specific. A Table 2-2 evaluation requires the number l

l of backup trains to be determined, as well as the frequency of challenging the system, and the exposure time. The total impact and remaining backup trains are provided in the FMEA and/or can be determined from Section 3.2. The frequency of challenging the system and inducing pipe break can be determined from the PRA. For example, design basis category IV is the correct frequency of challenging HPI and LPI piping in standby. Also, assuming the piping is not periodically tested, the correct exposure time is "all year" in Table 2-2.

i l

2 l

i Fmal May98 ANol,MAY. doc 1

Page 9 ANO-l__N560 In addition, CCDP can be estimated using the plant PRA (Reference 2). This requires requantification of the PRA with the system impacts from the assumed pipe break set to failure.

Then, assuming an "all year" exposure time, a delta CCDP can be calculated based on the new impacts.

Combination Impact Group Assessment This assessment method is used when the pipe failure causes both an initiating event and impacts mitigating systems; Table 2-3 (Reference 1 Table I-6) applies.

Note that Table 2-3 (same as Table I-6 in Reference 1) is used in combination with Table 2-1 in that the higher consequence category is always selected. The number of unaffected backup systems / trains available to perform the mitigating functions is determined. Systems are evaluated for each plant safety function (e.g., reactivity control, reactor makeup, heat removal). When considering the consequences, given an isolation failure, the number of backup trains also includes isolation as described in the examples above.

As described before, CCDP can be quantitatively determined as an alternative to using Table 2-3 and 2-1. In this case, the initiating event and mitigating impacts are considered in estimating CCDP and Table 2-4 is used to assign the consequence category. CCDP is estimated using the plant PRA (Reference 2). This requires requantification of the PRA with the initiating event set to 1.0 and including the system impacts from the assumed pipe break.

Containment Performance The above evaluations, with the use of Tables 2-1,2-2, and 2-3, or their equivalent CCDP calculation (Table 2-4), determine pipe failure importance relative to core damage. Pipe failure is also assessed for impacts on containment performance. This is accomplished using two methods; both are based on an approximate conditional value of 50.1 between the CCDP and the likelihood oflarge early release from the containment. If there is no margin (e.g., >0.1), the consequence category is increased. The two methods used in this analysis are:

1. CCDP values for initiating events and safety functions are evaluated in Section 3.2 to determine whether the potential for large early containment failure requires the consequence category to be increased.

2. Impact on containment isolation is evaluated. If there is a containment barrier available, the consequence category determined for core damage in the " Group Assessments" above is retained. If there is no containment barrier or failure of the only available barrier is used in l

determining the consequence category for core damage, some margin in the consequence category must be present to retain the consequence determined for core damage.

e Final May98 ANol_MAY. doc i

l

Page 10 ANO-l_N560 Other Modes of Operation & External Events The initial consequence evaluation is an assessment with the plant at-power for internal initiating events. However, the potential importance of pipe break during a plant shutdown and external initiating events is evaluated to ensure that the full scope of potential risks is addressed. This.

additional evaluation includes a review and comparison of potential CCDPs during other modes of operation or external initiating events versus the at-power results. If the at-power case for internal initiators is not judged to envelope, the consequence bin is adjusted higher.

Fuul - May98 ANol_MAY. doc

Page11 ANO-l_N560 l

l Table 2-1 Consequence Category Assignment For ANO-1 Pipe Failures When impact is Oniv an Initiating Event l

initiating Event (1)

IEF CDF C. CDP Consequence (events /vr)

(events /vr)

(CDF/IEF)

T1 ' Reactor / Turbine Trip Transient 3.9 5.4E-6 1.4E-6 Medium (4)

T6 - Pressurizer Low Pressure Transient (2) 3.4E-4 9.2E-9 2.7E-5 Medium T7 - Pressurizer High Pressure Transient (3) 3.6E-3 8.lE-10 2.3 E-7 Low S - Small LOCA 5.0E-3 1.5E-5 3.0E-3 High A - Large LOCA 1.0E-4 7.5E-7 7.5E-3 High (1) Initiating event frequency (IEF) is from ANO-1 PRA Table 3.3-6. Core damage frequency (CDF) is from ANO-1 PRA Table 3.5.4-7A (Reference 2). Only initiating events relevant to class I piping breaks are analyzed. Initiating events T6 and T7 are not used in the final analysis.

(2) This initiator is shown because pipe failure in the normal pressurizer spray line could cause a low pressurizer pressure. The concem with this initiator in the PRA (Reference 2 Section 3.1) is that a low pressure transient would activate pressurizer heaters and close the spray valve causing an over pressure transient and a stuck open safety relief valve. Since pipe breaks in this line cause a LOCA and the initiator frequency includer operator actions, it is not considered likely nor used in the analysis.

(3) No pipe failure that causes a high pressurizer pressure transient was found in this analysis; this initiator was not used in this analysis.

(4) Although this CCDP is close to " Low," the " Medium" consequence is retained which addresses containment performance issues.

l l

Fmal - May 98 ANOl.,,M AY. doc

Page 12 l

ANO-1 N560 l

1 Table 2-2 Guidelines for Assigning Consequence Categories to Pipe Failures Resulting in Loss of I

System (s)/ Train (s) Without en Initiating Event

{

i l

Affected Systems Number of Unaffected Backup Trains i

Frequency of Exposure Time l

I Challenge to Challenge 0

1 2

2. 3

)

i All year g;%h L

?w

]O:MJ L

Anticipated Between tests (13 month) 3.:

0, (DB Cat II)

Long AOT (> 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />) idMig:

L W+ws:

L L

Short AOT (s 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />)

.M ;}

Allyear M

L Infrequent Between tests (1-3 month)

MM L

(DB Cat III)

Long AOT (> 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />) s fME L

L

we M{

L L

Short AOT(s 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />) l All year 6

lMh L

L l

c. w l;M.{<(

L L

Unexpected Between tests (1-3 month)

(DB Cat IV)

Long AOT(> 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />)

Mj {

L L

FN 4 3

^

l 3T.y14 L

L L

Short AOT(s 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />)

P 3

- g l

High Consequence Category H

m Medium Consequence Category M

t-L' Low Consequence Category e

Containment isolation is not explicitly addressed because there is always at least one containment barrier for class I pipe breaks at ANO-1.

)

Fmal May98 ANo!.MAY. doc

i Page 13 ANO-1_N560 Table 2-3 Guidelines for Assigning Consequence Categories to Combinations of Consequence Impacts (Initiating Event and Mitigating Train (s)iSystem(s) Impact)

Combination ofInitiating Event &

Consequence Category Mitigating Ability Affects Less than 2 unaffected backup trains available for mitigation

• h!

dE khh b

te%ghbi:n%m$1b xea At least 2, but less than 3 unaffected backup trains s

f nTa available for mitigation gM MQif M ill$$$$$

LOW At least 3 unaffected backup trains available for (or IE category from Table 2-1, mitigation ifhigher)

No mitigating ability affected IE category from Table 2-1 l

1 l

l Note: Mitigating systems always correspond to the analyzed initiating event.

Containment isolation is not explicitly addressed because there is always at least one containment barrier for class 1 pipe breaks at ANO-1.

l rinal - May98 ANOl_MAY. doc

Page 14 ANO-1 N560 i

i Table 2-4 Conditional Core Damage Probability (CCDP) Used to Assign Consequence Category Consequence Category CCDP Low CCDP < IE-6 Medium -

1E-6 s; CCDP < 1E-4 High CCDP 2 lE-4 l

j l

Final May98 ANOl_MAY. doc

1 Page 15 ANO-1._N560 1

3.0' Inputs and Assumptions In order to collect necessary information, numerous plant specific documents were reviewed (see

. Section 7 References); the following are key inputs to this analysis:

.. The ANO-1 PRA (Reference 2) is used to assess plant initiating events and their frequencies, conditional core damage probability for different events, and the unavailability imponance of systems, trains, and accident sequences. The PRA also contains information. 9n systems operation, dependencies, safety functions, and spatial consequences.

ANO-1 piping and instrument diagrams, and piping isometrics (Reference 4) are utilized to identify piping locations, isolation valves, and detection capability.

Additional reviews, inputs, and assumptions are summarized in the following subsections.

1 3.1 PRA Review i

The ANO-1 PRA (Reference 2) is used to evaluate the importance ofinitiating events, systems, and safety functions affected by potential pipe leaks and/or failures.

1 Core damage frequency depicted in the ANO PRA is 4.8E-5/yr (Reference 2, Table 3.5.4-6A).

1 Table 2-1 shows the contribution of accident initiator types relevant to this analysis and conditional core damage probability (CCDP) which provides an indication of overall mitigation capability for each initiator. Table 3-1 shows CCDP contribution by safety function for certain initiating events in this analysis.- A simplified representation of the safety functions is provided in Figure 3-1 and Table 3-2 summarizes functional unavailability's from the PRA. These safety functions are described further in the next section.

' 3.2 Safety Functions Each critical safety function is considered when determining the number of available mitigating trains and/or estimating CCDP in the consequence evaluation. Application of the CCDPs from Table 2-1 accounts for those critical safety functions explicitly modeled in the ANO-1 PRA.

Tables 3-1 and 3-2 also summarize how safety function failures contribute to the Table 2-1 l

CCDPs. Figure 3-1 summarizes the ANO-1 PRA success criteria (Reference 2, Section 3.1, Table 3.1-4) for loss of coolant accidents (LOCAs) in simplified diagrams.

ANO-1 PRA results presented in Tables 2-1,3 1 and 3-2, and Figure 3-1 provide the functional basis for the consequence analysis. The folic-

'urther documents the PRA functional review:

Final. May98 ANol_MAY. doc

Page 16 ANO-l_N560 Reactivity Control - this function is required immediately upon demand to protect the core.

However, a pipe failure is judged more likely to cause a reactor trip than to prevent a reactor protection system (RPS) success. This is particularly true for Class 1 piping located inside the containment. Also, it isjudged unlikely that a pipe failure could immediately impact ATWS mitigation equipment. An independent unavailability to SCRAM on the order of 2E-5 (Reference 2, Section 3.1) is judged to envelope other potential spatial causes. These judgments are based upon the fact that the RPS is safety related and must fanction during design basis accidents (e g., small LOCA inside containment). This 2E-5 probability results in a " Medium" consequence without considering any other mitigating capability or the frequency of challenging RPS. The following explains how this function is treated in the analysis:

• If the pipe failure causes a LOCA, the makeup and heat removal functions described below result in a "High" consequence (see Table 2-1). Therefore, reactivity control is not j'

considered further for LOCAs.

i e If pipe failure causes a transient (TI) because it is isolated, a " Low" CCDP is possible given the scoping core damage frequency of 9.9E-7/yr for ATWS (Reference 2, Table 3.5.4-7A) and a transient initiating frequency of 3.9/yr. Even if there was a relatively high conditional probability to early core damage and containment release (Reference 2, Section 4.9), only a " Medium" consequence would occur and this is assumed as shown in Tabie 2-1 (i.e., not evaluated in detail).

Reactor Makeup Injection - success criteria is summarized in Figure 3-1 for LOCAs; CCDP is "High" based on Table 3-1. The conditional probability of a large containment releases is not evaluated since this function is already a "High" consequence.

For Tl transients, this function has a CCDP in the " Low" consequence category based on Table 3-1. Although there may be sufficient margins relative to containment performance, this was not evaluated since a " Medium" consequence has already been assumed.

Reactor Makeup Recirculation - success criteria is summarized in Figure 3-1 for LOCAs; CCDP is "High" based on Table 3-1. Note that the recirculation function includes the heat removal function below. Based on a review of the success criteria, the makeup function is the' dominant contributor to unavailability versus the heat removal function. Large LOCA is binned to early core damage whereas small LOCA could be binned to late core damage depending on the failure mode (Reference 2, Section 3.1). The conditional probability of a large containment release is not evaluated since this function is already a "High" consequence.

For T1 transients, this function has a CCDP in the " Low" consequence category based on Table 3-1. This function is most likely a late core damage with sufficient margins relative to containment performance, however, this was not evaluated since a " Medium" consequence has already been assigned based on reactivity.

I

\\

Final May98 ANOl_MAY. doc 1

Page 17 ANO-l_N560 Heat Removal - given recirculation makeup success, failure of this function would likely lead to late core damage. Also, the makeup function isjudged to dominate failure based on success criteria. This function does not effect the conclusion above relative to LOCAs and T1.

Containment Performance - To maintain the consequence categog determined from the above functions, at least one containment barrier must be available or there must be margin in the number of available mitigating trains as described above. Otherwise, the consequence categog is adjusted accordingly. At ANO-1, all Class 1 piping is inside containment and there

)

is no impact on containment isolation.

i The potential impact on large early release frequency (LERF) due to early core damage and structural failure of the containment is also judged not to effect consequence ranking based on the above review. A conditional value of 50.1 between the CCDP and the likelihood oflarge l

I early release from the containment is used in the analysis. If there is no margin (e.g., >0.1), the consequence category is increased. As shown in Table 2-1, LOCA initiators are already a "High" consequence and transients are a " Medium" consequence with sufficient margin as described above. Also, the conditional LERF for large dry PWR containment's is generically acknowledged to be < 0.1.

Table 3-2 summarizes unavailability for key functions and systems required to support the critical safety functions and success diagram shown in Figures 3-1. The table also explains the backup trains that can be assumed in the analysis when using Table 2-2 and 2-3. As explained in Section 2, I train s 0.01 unavailability,2 trains s IE-4 unavailability, and etc. Also, a 0.5 train = 0.1 unavailability.

3.3 Plant Level Assumptions Engineering judgments are included and discussed throughout the analysis; the follov.ing are considered to be key plant level assumptions and judgments:

1. The pipe failure can occur at anytime; three configurations are defined in Section 4. These are normal (operating or standby), test, and accident demand. Section 4 also summarizes judgments and assumptions regarding which configurations are most imponant. If the pipe failure does not cause a direct initiating event, it is assumed that the pipe failure occurs during the accident demand configuration, if applicable. This assumes pipe failure occurs during the most conservative exposure time and accounts for the higher stress placed on the operators with resultant delay in operator response.

2. Leak-before-break is not credited in the analysis. This is acknowledged as an option in the Code Case (Reference 1) which references NUREG-1061, Volume 3.

3. LOCA initiators in the ANO-1 PRA assume that one of the four HPI cold leg injection paths is unavailable due to the initiating LOCA. This is not always the case, but CCDP calculations include this a.ssuniption; it is slightly conservative.

l Fmal - May 98 ANol_MAY. doc

Page 18 ANO-1_N560

4. LOCA initiators in the LPI/ Core flood piping are assumed to result in a large LOCA, failing 1 of 2 LPI/ Core flood paths to the core. There are flow restrictors in the reactor vessel nozzles to limit breaks to approximately nine inches (Reference 35). However, this size break is defined as a Large LOCA in the ANO-1 PRA.

l

5. Reference 3 changed the LOCA initiating event sizes by breaking up small LOCA into two sizes: small LOCA and medium LOCA. However, the success criteria appeared to be unchanged relative to core damage. Also, new initiating event frequencies were not provided nor was core damage frequency provided. As a result, this reference was not used in the analysis. The success criteria for small LOCA still appears to be conservative for certain sizes and the present analysis is conservative.

l

- 6. Credit has been taken in the evaluation for manualisolation of pipe breaks. Isolation of the l

decay heat removal drop line appears to be well founded based on procedures (Reference 19).

Manual closure of CV-1009 (normal pressurizer spray) to isolate piping between this valve and CV-1008 (closes automatically) is also credited per procedure (Reference 24, Step 23). It appears that this valve could be closed in time to affect success criteria (e.g., Transient versus l-a LOCA), however, this could also be evaluated in greater detail with operations or training l

- (e.g., simulator) to increase confidence. Different size LOCAs should be considered. No credit has been taken for isolation ofletdown piping downstream of CV-1213 and CV-1215. This could be conservative.

l l

l l

l l

Fmal - May98 ANol_MAY. doc 1

1

Page 19 ANO-l_N560 Table 3-1 CCDP Contribution by Safety Function Initiating CCDP by Safety Functions Event Reactivity Makeup Makeup (2)

Control (1)

Injection (U)

Recirculation (X)

LLOCA na 2.3E-3 5.2E-3 SLOCA 2.0E-5 5.6E-4 2.4E-3 T1

~1E-6

~1E-6 Table 3.1 is derived from the ANO-1 PRA (Reference 2, Table 3.5.4-6A)

(1) CCDP for SLOCA based upon Reference 2, section 3.1.

(2) Recirculation (X) includes the heat removal function as summarized in Figure 3-1.

Fmal. May98 ANol_MAY. doc

Page 20 ANO-l_N560 Table 3-2 Functional Unavailability and Equivalent Backup Trains Function -Top Event (1)

Trains (2)

Unavail(2)

Top Event & Basis (3)

K - reactivity control 2.5 2.0E-5 K (Reference 2. Section 3.1)

U - makeup injection (SLOCA) 1.5 5.6E-4 H001 (used Table 3-1)

U -makeup injection (LLOCA) 1.5 2.3E-3

@UA01 (used Table 3-1)

X - recirculation (SLOCA) 1.5 2.4E-3

@XS01 (used Table 3-1)

X -recirculation (LLOCA) 1 5.2E-3

@XA01 (used Table 3-1),

(1) Event tree top events (e.g., K) are from the ANO-1 PRA (Reference 2, Section 3.1)

(2) 0.5 train a 0.1 unavailability, I train = 0.01,2 trains a IE-4, etc.

(3) Lower level Top Event Logic is shown (e.g., both H001 and @UA01 are top events for specific initiating events that feed into top event U in the event trees),

f 1

Final. Maypg ANOI.MAY. doc

Page 21 ANO-1, N560 Figure 3-1 Simplified Success Criteria (Reference 2, Section 3.1)

Core Flood Low Pressure Low Pressure Heat Removal Success Tanks (U)

Irgiection (U)

Recire. (X)

LPI Cooler (X)

A 1 of 2 CFTs I of 2 BWST Suction I of2 Surnp Suction 1 of2 LPICooler with I of 2 LPI Pump with previous LPI previous pump train 1 of 2 LPI Dtscharge purrq Paths Heat Removal RBFCs(X) 2 of 4 RBFCs l Reactivity HighPressure l High Pressure LPI Cooler (X)

A - Sucmss Control (K)

Injection (U)]

l Recire.(X)

Heat Removal m

A I of 2 BWsT Suction 1 of 2 Suntp Suction 1 of 2 LPI Cooler with I of 3 HPI Pump 1 of 2 LPI Pump previous pump train 2 of 3 CL Inj Paths with previous HPI (4th path unavailable due to LOCA)

Heat Removal d FCs(X) 2 of 4 RBFCs For transients, mitigation of reactivity control failures (e.g., backup to K) is more likely and the steam generators (with feedwater makeup) provide backup to both makeup and heat removal functions unless the transient leads to LOCA conditions (e.g., reactor coolant pump seal LOCA or stuck open pressurizer safety valve).

Fmal. May98 ANOl_MAY. doc

l_

Page 22 ANO-l_N560

' 4.n Analysis

' 4.1 System Configurations l

An important input to the consequence evaluation is the system configuration under which the piping is' assumed to fail. The following system configurations were evaluated.'

1. Normal (operating or standby)

2. Test (periodic testing applies)

3. Demand (real demand due to plant trip or accident)

The configuration can influence piping loads, piping degradation mechanisms, the probab:lity of failure (demand versus time dependent), and the probability of detecting and isolating the failure prior to significant propagation and impacts.

If the pipe break causes an initiating event, the break is assumed to occur during the normal configuration; there is no need to evaluate the test and demand configurations. If pipe failure does not cause an initiating event, the demand configuration is analyzed and a potential initiating event due to an additional failure (e.g., passive valve failure causing a LOCA) is analyzed. The testing configuration does not apply to ANO-1 Class 1 piping because testing on the reactor coolant

. system and connected piping is not normally performed during power operation.

The first two columns in Table 4-1 identify the piping segments by line number and the configuration (s) analyzed for each segment. The line number in Table 1-1 (Class 1 pip *mg scope) is separated into "Line Number / Segment" in Table 4-1 based on the potential for isolation of the break. The system flow diagrams and piping isometrics (Reference 4) define the location of Classi piping within the plant and associated piping connections. Figure 4-1 is a simplified diagram of the major class 1 piping and can be used with Table 4-1 to help identify the location of pipe segments relative to the reactor coolant pressure boundary.

. 4.2 Failure Modes & Effects Analysis (FMEA)

The effects of pipe failure are evaluated and documented in this section and Table 4-1. Each 1

column of Table 4-1 is described below, referring to the FMEA elements in Section 2:

Line Number / Segment - this first column identifies the piping segment by line number and

" break size" which is a requirement of FMEA item (a). The last number in the ' description contains the pipe diameter in inches which is assumed to be the break size. This impacts the initiating event LOCA size which impacts the conditional core damage probability (CCDP). As described in Section 3,, the success criteria and CCDP for critical safety functions depend on the LOCA size. The pipe break size is assumed to be the piping inside diameter unless smaller breaks are more limiting. In this analysis, breaks smaller than the pipe inside diameter are not more Final.'May98 ANol_MAY. doc

Page 23 ANO-l_N560 limiting; this can be seen in Table 2-1 and 3-1 which shows that the CCDP is lower for smaller size LOCAs.

The pipe size, which if broken, is beyond the high pressure injection makeup capability (I HPI pump supplying 2 of 3 available cold legs) is defined as a large LOCA. This size also must ensure sufficient depressurization to allow low pressure injection and core flooding. The pipe. size provided in the PRA (Reference 2, Section 3.1) is an equivalent diameter of 4.3 inches. This analysis assigns piping >4 inch nominal pipe size to the large LOCA category. Piping 54 inch nominal pipe size is assigned to the small LOCA category.

Config - this column identifies the system configuration being evaluated.

IE - this column identifies " initiating events" which is a requirement of FhEA item (d). Most pipe failures in the reactor coolant pressure boundary result in a LOCA initiating event. The size of the pipe influences whether it is a large LOCA (LLOCA) or small LOCA (SLOCA). Some piping can be isolated (e.g., letdown) and is identified as "lLOCA" because it can be isolated. When ILOCA is the initiator, the final initiator and its impact is identified in the " Impact" column for both isolation success and failure.

A "PLOCA" (potential LOCA) is identified in this column and evaluated when the piping is normally isolated from the RCS. This is the situation when a passive failure of a normally closed valve is required to challenge and fail the pipe. When PLOCA is the initiator, the final initiator and its impact is identified in the " Impact" column. Also, for normally isolated piping (e.g., break would not directly cause an initiating event), the demand configuration is evaluated for the applicable mitigating challenge. For example, a design basis category IV challenge, identified as "LOCA," is used for LPI and HPI piping.

Detection and Isolation - These two columns address "isolability of break" which is a requirement of FhEA item (b). Footnote "a" in the detection column summarizes the detection mechanisms for most breaks inside the containment. "No" means that no detection capability is identified for the demand configuration. Actually the operators could detect a break in the HPI or LPI path during a LOCA demand, but it was considered unlikely in the short term.

The isolation column indicates whether isolation is actually credited in the evaluation. The system valve credited in the analysis is usually shown or "No" signifies that no credit for isolation is included. When active isolation is credited in the evaluation, both success and failure to isolate are evaluated and shown in the isolation column. First the success case shows the valve. Then,

" failure" signifies the evaluation ofisolation failure impacts. The valves identified in the

" Isolation" column can be seen in Figure 4-1 and comments provided at the end of Table 4-1 describe this analysis. Detection and isolation is described further below.

Impacts - summarizes " system impact / recovery" (e.g., in addition to the initiating event impact if applicable) due to pipe failure which is a requirement of FhEA item (e). Recovery of system pipe failures is not credited in this analysis. This column also contains information on " spatial effects" which is a requirement of FhEA item (c). However, all the Class 1 piping at ANO-1 is inside containment, therefore, there is no spatial propagation impact. Also, HPI, core flood, and LPI active electrical equipment are not located inside containment. Spatial interactions are not an important consideration for Class 1 piping breaks at ANO-1.

4 Fmal May 98 ANol.,MAY. doc

Page 24 ANO-1_N560 If a pipe break is in the HPI or LPI system, an injection path is unavailable due to either flow diversion or isolation. This is a system impact. For an isolable LOCA (ILOCA) in column "IE",

the " Impacts" column also includes the initiator type (e.g., SLOCA) as an impact; this changes dependent on whether isolation is successful or fails (e.g., transient ifisolation is successful and LOCA ifisolation is not successful). Similarly, for a potential LOCA (PLOCA) in column "IE",

the " Impacts" column also includes the LOCA type (e.g., SLOCA). Interfacing systems LOCA and LOCA outside containment events are not applicable since all piping is inside containment.

Qualitative Basis - identifies how " system redundancy" or the number of backup trains are evaluated which is a requirement of FMEA item (f). As described in Sections 2 and 4.3, the basic principles of defense-in-depth and single failure for safety functions, including containment performance, are included in the evaluation. Table 2-1 or 2-2 or 2-3 is referenced in this column which signifies the applicable impact group assessment. The evaluation differs for the isolation success and failure case, when applicable. This column also explains how the CCDP is quantitatively estimated in the next column. An "*" indicates that two probabilities are being multiplied to calculate the CCDP. Comments at the end of Table 4-1 further describe the evaluation.

CCDP - shows the calculation of CCDP. The results provide the basis for assigning consequence categories and quantitatively ranking segments, as described in Section 4.3.

Consequence - provides the final ranking based on the previous columns of the FMEA and the CCDP value.

The remainder of this section provides additional supporting FMEA documentation.

Detection of Pipe Breaks Class ! pipe breaks inside the containment will cause a high containment pressure, low pressurizer pressure, and low pressurizer level, as well as other detectable conditions (e.g., rising temperatures). A high reactor building (containment) pressure (4 psig) will initiate ESAS as will a low pressurizer pressure (1590 psig). A low pressurizer pressure alarm occurs at 2055 psig and reactor trip occurs at 1800 psig (References 5 and 9). Smaller leaks willlikely be detected per ANO-1 technical specification section 3.1.6 and operating procedures (References 21 and 22).

Technical specification 3.1.6 " Leakage" - requires that unidentified and total leakage into the primary containment not exceed 1 and 10 gpm, respectively. Otherwise, the reactor must be shutdown within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of detection. Three reactor coolant leak detection systems of different operating principles shall be operable during power operation. Leakage may be identified by one or more of the follow'mg methods:

Level indication in the reactor building sump would detect a 1 gpm leak into the reactor

]

building in less than I hour.

l Total RCS leakage rate is periodically determined by comparing indications of reactor power,

]

reactor coolaht temperature, pressurizer water level and reactor coolant makeup tank level over a time interval. A 1 gpm leak would be detectable within approximately 1.1 hours1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />.

(.

l l

Tmal - May98 ANol_MAY. doc 9

Page 25 ANO-l_N560 The reactor building gaseous monitor is sensitive to low 1:ak rates if expected values of failed l

e fuel exist. The rates of reactor coolant leakage to which the instrument is sensitive are discussed in FSAR Section 4.2.3.8.

l Isolation The ability to isolate a break is evaluated and credited, if feasible. As described previously, piping line numbers are separated into segments based on isolation potential to allow distinguishing ~

piping that either can be isolated or is normally isolated from the reactor. Check valves are credited as providing automatic isolation. In addition, the following lines and isolation valves were identified in the analysis; (these valves are shown in Figure 4-1).

Letdown piping downstream of MOV CV-1213 and CV-1215 can be isolated. Indication in the control room (panel C04) includes low flow (FI-1236) and low temperature in the letdown l

system (Reference 6), as well as a mismatch between makeup and letdown No credit is given to isolation of these breaks; a review of procedures indicates the chance for isolation is unlikely and may not occur before reactor building entry (References 22 through 30).

. Decay heat removal suction piping downstream of MOV CV-1050, during shutdown, can be isolated by the operators. There is a low flow alarm and motor current /vortexing indication in the control room to alert the operators (References 10,19, and 20). Isolation is likely and credited based upon alarms and procedures (References 19 and 20).

Normal pressurizer spray piping between CV-1008 and CV-1009 can be isolated. CV-1008 automatically closes on low reactor coolant system (RCS) pressure (References 5 and 27). If the leak is large enough (e.g., pressure <l700 psig), the Reactor Trip Procedure (Reference

24) has the operators close both CV-1008 and CV-1009 at step 23. Based on procedures, credit is given to isolation of this piping.

The above cases apply to piping normally connected and open to the reactor either during normal power operation or plant shutdown. In all cases, the pipe failure causes an initiating event (isolable LOCA, ILOCA in Table 4-1, column "IE"). They become a transient when isolation is successful and a LOCA when isolation fails.

When piping is normally isolated from the reactor (standby con 6guration), there are two types of events that are evaluated; the valves are shown in Figure 4-1.

Potential LOCAs (PLOCA) which require a valve disc failure, providing reactor pressure as the piping challenge. No credit is allowed for isolation of these events.

For mitigating systems, an independent accident demand challenge is assumed. This applies to e

the LPI and HPI paths. Although the path can be isolated outside containment by closing an MOV, no credit was taken for these actions; the path is unavailable anyway and allowing diversion out the break is conservative.

1 i

I Final. May98 ANol_MAY. doc

f Page 26 l

ANO-1 N560 l

l Spatial Arrangement & Impacts l

Spatial effects would be included in the " impact" column of Table 4-1. However, all in-scope l

piping is inside the containment; there is containment of pipe failures and no propagation impacts I

different from the design basis LOCA analysis. The only electrically operated valves inside containment that could be credited as isolation valves in this analysis are:

Letdown MOVs CV-1213 and CV-1215 (isolation not credited in analysis)

' Decay heat removal suction MOV CV-1050 Pressurizer spray piping between MOVs CV-1008 and CV-1009 e

The probability of spray or environmental impacts preventing valve operation arejudged unlikely.

The LPI and HPI paths are spatially separated in the containment and electrical equipment is located outside containment.

Initiatina Events There are two types ofinitiating events or demands considered in this analysis:

1. The pipe failure causes a direct initiating event. In this case, conditional core damage probability (CCDP) is determined in Section 4.3 considering the initiator and any other l

impacts on mitigating systems. Table 2-1 provides the CCDP for each plant initiator. In place of Table 2-3 (e.g., determining backup trains), an equivalent CCDP can also be estimated with l

the PRA. However, as shown in Table 4-1, Table 2-3 was not required in this analysis.

l

2. When the pipe failure does not cause a direct initiating event, an independent demand for the system under evaluation is assessed. For this condition, the failure is assumed to occur during the " demand" configuration as described in Section 4.1. The frequency of challenge due to the independent demand depends on the system and is provided in Table 4-1 (see columns "IE" and " Qualitative Basis" and."CCDP"). Conditional core damage probability is determined in Section 4.3 considering the frequency of challenge, exposure time for the chal.lenge, and the number of backup mitigating trains. In place of Table 2-2 (e.g., determining backup trains), an equivalent CCDP is also estimated.

I l

I The independent accident demand initiator assumed in the analysis for LPI and HPl piping is a l

LOCA (unexpected frequency of challenge in Table 2-2) based on system design basis and the l

expected frequency of challenge in the PRA (See Table 2-1).

I l

l l

Fmal May 98 ANOl_MAY. doc l

Page 27 ANO-1 N560 l

4.3 Impact Group Assessment The FMEA (Table 4-1, column " Qualitative Basis") identifies which impact group assessment is utilized in the evaluation by referring to Table 2-1 or 2-2 or 2-3.

i As indicated in Section 2, Table 2-1 is utilized when the pipe break causes an initiating event with no other mitigating system impacts. Note that loss of a HPI path is always assumed in t.he PRA for small LOCAs (SLOCA); therefore, this does not require the use of Table 2-3 (Reference 2, Section 3.1).~ Also, pipe failures in the LPI and/or core flood piping result in a limited large LOCA (approximately nine inches) because of flow restrictors in the reactor vessel nozzles (Reference

-- 35). Per Reference 2 (section 3.1.1.4), for breaks bewteen 4 and 10 inches, the success criteria is not as restrictive as larger LOCAs. That is, success is equal to "HPI & LPI or LPI & CFTs). In the event of a break in these lines, both LPI pumps will still be feeding the other flowpath. In addition, the presence of high flow alarms for each loop of LPI injection upstream of the postulated break provides for the isolating of the affcted loop (s) and the use of both LPI pumps in recirculation. Table 2-3 is used because Reference 2 credited both CFTs being available in the -

large LOCA analysis.

L For normally isolated piping, a potential LOCA is evaluated. The assessment of a potential LOCA (PLOCA in Table 4-1, column IE) utilizes the CCDP values in Table 2-1 for the applicable LOCA size and type (e.g.,12 inch pipe utilizes the LLOCA CCDP) and the probability of a passive valve failure. This calculation is summarized in the "CCDP" column and comments section of Table 4-1.

Also, for normally isolated piping, the demand configuration is evaluated (Table 2-2). The system impact group assessment with Table 2-2 is based on the following:

The frequency of challenge in Table 2-2 for LPI and HPI piping is " Design Basis Category

- IV". which is identified as a "LOCA" initiating event in Table 4-1. As shown in Table 2-1, the frequency of LOCA initiators is less than IE-2/yr. Steam generator tube rupture frequency in the PRA is about IE-2/yr (Reference 2, Table 3.3-6). The frequency of transient mduced e

LOCAs (reactor coolant seal LOCA or stuck open pressurizer safety valve) or failure of all steam generator cooling (requiring HPI in feed & bleed mode) is also judged to be on the order of IE-2/yr or less.

• - Because Class 1 piping is not tested, the exposure time is assumed to be "all year" for the demand configuration.

The number of backup trains are identified from Figure 3-1 and Table 3-2. Table 3-2 can also be used to estimate the unavailability value for the backup trains.

For the HPI path demand in Table 4-1, it is assumed that the LOCA demand impacts one of the other HPI paths (e.g., the LOCA demand is SLOCA with a frequency of SE-3). Thus, success criteria for HPI is failpre of either of the remaining 2 paths. This is assumed to reduce HPI success to 1 backup train versus the 1.5 trains shown in Table 3-2. A combination of small LOCA i

l

. challenge (SE-3) and I backup train (IE-2) results in a " Medium" consequence. Note that it is l.

assumed that failure of 2 HPI paths does not cause sufficient flow diversion to fail the HPI I

l Final'. May 98 '

ANol_MAY. doc l

1 l

l

Page 28 ANO-l_N560 function. For transient induced LOCAs the success criteria revens to 2 of 3 injection paths rather than 2 of 2; the consequence is still Medium.

For the LPI path demand in Table 4-1, the combination oflarge LOCA frequency of challenge (IE-4) and the backup LPI path (<0.1) ensures a " Medium" consequence. Note that it is assumed that failure of a LPI path does not cause sufficient flow diversion to fail the LPI function due to the presence of flow restricting orifices upstream of the break.

As described in Section 2, containment performance is considered in determining the final consequence category. A containment barrier is required or the consequence evaluation must show margin. All Class 1 pipe is inside containment and also inside the containment isolation boundary at ANO-1. Therefore, containment isolation and the consequence ranking for this piping is not affected.

Other Modes of Operation The initial consequence evaluation is an assessment assuming the plant is at-power. Generally, the at-power plant configuration is assumed to present the greatest risk for piping since the plant requires immediate response to control reactivity, heat removal, and inventory control;.the plant is critical, and at higher pressure and temperature in comparison to shutdown operation. The potential importance of piping during plant shutdown is evaluated here to establish confidence that power operation envelopes or determine where a higher consequence should be assigned.

Pipe segments that are already a "High" consequence from the evaluation at-power need not be evaluated for shutdown. Those that are already " Medium" require some confidence that High would not occur due to shutdown configurations. There are no " Low" consequence pipe segments in the at-power analysis. Taking this into account, a review & comparison of system consequence results for power operation versus potential consequence during shutdown operation j

is conducted. Table 4-2 documents this review. It was concluded that LPI operation in the decay J

heat removal (DHR) mode needs further analysis recognizing that the piping is already " Medium" or "High" for power operation. A further review of DHR is provided below to determine whether

" Medium" could be "High" because of shutdown risk.

Other assumptions and observations about shutdown operatioa considered in this review include the following:

1 During shutdown, HPI and LPI are not automatic and require manual actuation. However, i

Entergy's outage management philosophy, outage risk management guidelines, and i

procedures provide assurance that loss of DHR will be detected and mitigated (References 17 i

through 20).

Unavailability of mitigating trains is higher due to planned maintenance during outages.

i However, guidelines and procedures assure sufficient redundancy and account for higher risk I

configurations (e.g., mid-loop) which requires extra redundancy and/or contingencies (Reference 18).

. Final May 98 ANOl MAY. doc

Page 29 ANO-l__N560 For the majority of piping, the exposure time associated with operation in a shutdown l

e configuration is on the order of 0.1/yr. Also, the operating conditions are much less severe than during power operation. The frequency of being in a more risk significant configuration could be even lower depending on the system and function being evaluated. Operation of LPI in the decay heat removal (DHR) mode of operation is an important exception for limited piping.

The reactor is shutdown, depressurized, and decay heat is lower than for at-power operation.

The reactivity control function is not a concern because the rods are inserted. Re-criticality during shutdown is unlikely and not judged to effect the present ranking. The inventory makeup (safety injection) function is considered the most important function during shutdown, given a class 1 pipe break occurs during shutdown causing loss of DHR.

During shutdown, the reactor coolant system and connected piping are not pressurized nor at high temperatures, as during power operation. Piping failures are not as likely (e.g., initiating events) and the at-power analysis for these systems is assumed to envelope shutdown conditions. Since the LPI system is aligned to the reactor coolant system in the DHR mode of operation during most of the ' outage versus being isolated from the reactor in standby during power operation, this system is evaluated further below.

Decay heat is lower during shutdown such that the time for recovery of DHR or inventory makeup is usually longer. Thus, even though equipment may require manual actuation and may also be in maintenance, there is time for recovery. LOCAs (considered less likely due to reduced pressure and temperature) would exhibit much less severe environmental conditions (e.g., hot or warm water versus steam) until decay heat starts to heatup the reactor after loss ofDHR.

That ponion of LPI that is in standby during power operation and operates in the DHR mode during an outage isjudged to present the most important configuration change requiring further evaluation. Loss of DHR is an important initiating event during shutdown and the potential for an unisolated LOCA in the LPI system must also be considered.

The following summarizes the review of LPI pipe segments relative to power operation:

DHR suction piping upstream of CV-1050 is already "High" due to a LLOCA during power e

operation. This can be assumed to envelope shutdown risk for the reasons stated above.

l DHR suction piping downstream of CV-1050 is a " Medium" consequence during power e

j=

operation because passive failure of the normally closed CV-1050 is necessary to challenge l

piping. Failure of this piping during DHR is assessed below by considering two types of scenarios. The first one is associated with the initial alignment of DHR because this is when pipe failure would most likely occur due to the demand challenge. The second considers the case where the plant is in cold shutdown and depressurized. A pipe rupture is assumed less likely at this point,given the successful demand during the previous scenario.

1. ' The real demand occurs when the operators align DHR (RCS pressure <250 psig and temperature <280 F). During this imponant evolution, operators are alerted to ensure proper Final May98 ANol,MAY. doc

Page 30 ANO-l_N560 alignment and inventory per procedures (Referenas 17 and 18). Thus, during the initial alignment and for some time thereafter it can be assumed operators are prepared and alerted to this important configuration change. Also, steam generators are still available or recoverable since they are being used until the plant is aligned to DHR (assuming CV-1050 is isolated quickly enough). Although reactor conditions are still relatively severe in comparison to cold shutdown, the operators are alert during this evolutica and the steam generators are available (assuming isolation). Thus, for the case where the operators successfully isolate the break early, a CCDP of IE-4 or less for failure to recover a steam generator or inventory makeup is reasonable. For the case where CV-1050 fails to close (either due to equipment or human), the reactor could drain to the invert of the hot and cold leg nozzles. The loss of DHR procedure (Reference 19) identifies entry conditions or symptoms, including alarms, and immediate operator actions include "stop the running DH pump (s)" and "close at least one Decay Heat Suction valve" with CV-1050 being the first valve identified for isolation. It also provides steps for restoring level and/or heat semoval depending on the configuration.

Assuming the operators have a second chance with regard to providing inventory makeup after failing to isolate (i.e., before boil off and core damage), a CCDP on the order of IE-4 or less is reasonable;

2. If the pipe failure occurs later in the outage when the reactor is in cold shutdown (<200 F and i

depressurized), it is possible that the steam generators are not available or the RCS is vented or open (vessel head is off). Also, the operators may not be as alent if the configuration is deemed to be steady state (e.g., the alignment has been successful for some time, the reactor is cold, and decay heat is lower). Ifit is assumed that the steam generators are not available, and DHR is lost due to the break, inventory makeup is the primary concern (i.e., makeup must at least satisfy decay heat boil off). Still, isolation can provide the operators significant time especially if the fuel transfer canal is flooded. For the case where the operators are at mid-loop, they should again be alert due to the importance of this configuration, but isolation is almost irrelevant because level is already near the invert of the reactor nozzles. Thus, for the mid-loop configuration, there is some increased level of alertness by the operators whereas when the refuel cavity is full there is more time to detect and isolate. Shutdown procedures require redundant inventory makeup capability during mid-loop (Reference 18). A CCDP of 1E-4 or lower is reasonable for a number of reasons. The likelihood of pipe failure after the initial demand and during cold conditions is smaller. The exposure time for the more risk significant configurations is lower and there is planned alertness and backup equipment available during these higher risk configurations. The operators have to fail to provide makeup or the equipment must fail.

Pipe breaks on the suction side envelope breaks on the discharge where there is a check valve to isolate the reactor. Still discharge breaks could pump down reactor inventory until detected and isolated or pump cavitation occurs.

In summary, LPI piping is already in the "High" or " Medium" category based on power operation. The DHR pipe segments not challenged as part of the LPI function arejudged to have a " Medium" consequence. A more detailed risk assessment of shutdown configurations would be needed to support a " Low" consequence for the piping.

Fmal. May98 ANol_MAY. doc

Page 31 ANO-l_N560 External Events The consequence evaluation is an assessment utilizing design basis information and the plant.PRA for internal initiating events. Pipe breaks cause the same initiating events in the PRA and their frequency in the present evaluation is higher than the frequency of fire and seismic events.

However, these low frequency events beyond the design basis have potential common cause effects that could possibly effect the importance of piping. Because of this, the importance of piping during external events beyond the design basis is assessed here to establish confidence that no gross misjudgment is made in the consequence assigmnent.

Pipe segments that are already a "High" consequence from the evaluation need not be evaluated for external events. Those that are already " Medium" require confidence that High would not occur due to external events. There are no " Low" consequence pipe segments in the at power analysis. Taking this into account, a review & comparison of system consequence results versus potential consequence during external events is conducted.

The following observations can be made, in general, for all external initiators:

For piping which is assumed to cause r,n initiating event in the present analysis (RCS, connections to RCS, and operating systems), external initiating events can not have an impact on pipe imponance. The frequency of the external event causing a pipe failure is low and the probability of an external event simultaneous with the pipe break is also low.

Based on the above, piping in mitigating systems that respond on " Demand" to external initiating event challenges are more likely to be effected. The frequency of challenge and impacts on redundant mitigating functions due to the external initiator are considered.

The ANO-1 IPEEE (References 13 through 16) was reviewed; the results are summarized for each hazard below. The followirig summarizes the review for each of the major hazards (seismic, fire, and other):

Seismic Challenges - Based on a review of the IPEEE, a plant HCLPF (high confidence low probability of failure) of 0.3g can be assumed when open items are resolved. The emergency diesel fuel oil tanks were found to have the lowest HCLPF at about 0.2g.

The potential affects of seismic initiating events on consequence ranking is assessed by considering the frequency of challenging plant mitigating systems and the potential impact on the existing consequence category. The following summarizes this assessment:

Piping in the analysis scope has a capacity much greater than the 0.3g screening value and is o

not considered likely to fail during a seismic event.

Most class 1 piping is already assumed to cause an initiating event in this analysis. The o

frequency of an earthquake induced pipe failure in these systems is less than assumed in the present analysis. Also, the likelihood of a simultaneous seismic event during or after a pipe break is low.

Final - May 98 ANol,MAY. doc

l l

Page 32 ANO-1. N560 Reactivity control is unlikely to be affected by seismic events because a loss of offsite power e

(usually the seismic limiting component with any consequence) will de-energize and drop the i

control rods. The eanhquake is more likely to cause a scram rather than prevent it. A very I

large earthquake could cause mechanical failure of the core and/or prevent rods from entering l

the core. However, such a low probability event would likely impact most functions due to equipment failures, causing core damage. The importance of the piping becomes irrelevant at this point and it is a low probability event.

. With regard to mitigation, the most likely scenario would be a loss of offsite power due to the seismic event. The seismic capacity of offsite power has been found to be limiting, both with respect to seismic capacity and its impact on the plant; it causes the unavailability of feedwater, the main condenser, and all equipment dependent on normal AC power. It also challenges the emergency diesels (usually less reliable than the numerous trains of mitigating systems they support). Based on a typical fragility for LOSP (Reference 31), a HCLPF of about 0.lg is assumed. This fragility when combined with the seismic hazards developed for the ANO site (References 32 and 33) indicates the unconditional frequency of a seismically induced LOSP is less than IE-4/yr. This alone provides for at least a " Medium" consequence.

With regard to the impact on mitigation backup trains, failure of a HPI or LPI/ core flood path during a seismic event leaves at least a train of backup based on Tables 2-1 and 3-1. Even if the LOSP value of IE-4/yr is assumed to challenge HPI and LPI, combining frequency of challenge and a backup train would lead to a " Low" consequence.

i It can be concluded that seismic will not effect consequence rankings of" Medium" and "High" obtained for at power.

Fire Challenges - Typically, important fire scenarios are those that impact support systems (e.g.,

because of their common cause effect) and/or multiple mitigating systems. Based on the IPEEE, areas that did not screen have an annual frequency in the IE-6 to 6E-6 range. These fire zones are typical of areas where the potential exists to impact cable and several support systems.

Similar to seismic events, fires usually do not impact reactivity control nor cause LOCAs unless it is due to a stuck open safety valve, reactor coolant seal LOCAs, or the need for feed and bleed l

cooling.

Similar to the seismic analysis, the frequency of mitigating system challenges from a fire isjudged to be low, at least IE-2/yr or less. Note that fires are not assumed to cause a LOCA (pipe break) which is a possibility, although low probability, for seismic. Challenging LPI and HPI piping depends on a fire causing a LOCA condition (stuck open safety valve, seal LOCA, or failure of all EFW). Similar to seismic initiators, there are multiple injection paths; failure of one path on demand in combination with the frequency of challenge and available backup paths can be shown to easily provide a " Medium" consequence.

Final May98 ANol_MAY. doc

Page 33 ANO-l_N560 Other Challenges - these hazards are screened in the ANO IPEEE except for one isolat'ed potential concern with roof ponding; these events are assumed not to influence ranking. The frequency of challenging mitigating systems due to these other external challenges is comparable or less than considered in the seismic and fire analysis above. Also, the likelihood ofimpacting mitigating systems is less. The discussion of seismic and fire is assumed to envelope.

Based on a review of the ANO-2 external event information, the RI-ISI results for power operation internal events envelope.

i Final May98 ANOl_MAY. doc

40 B

3 6 5

-9 1

e5 2

D g N_

8 1 -

9 B

2 r

R a

C 7

Pl A

E n

q O

w f(

1 o

N d

31 A

e 2

t L

1 -

A V

],

92 8

R B

B E

B 8

A B 2

R D

T f(

I I T B

I I

I F

4 R

I C

V B

-E4

, MM 2

4 T

c o

4 B

B d.

1 4

2 Y

I I

I 3

A D

II

-P M_

D I

ONA O

4 ;

roi e t

6 c s 5

s 6

a e

4 I

U-U P

eRv I

M M

I y

g O ;

g s

0R m

1 l e

4 i t

1 D 4

s C+

V y

$>4 S

J 4

gn i

y L p

5J C

D iP 2

xR 2

3 3

3 C

P-1

-P s

p s

a l

C

[

f 2

1 o.

00

-V m

V-C 1

ar s

/

V g

A B

a E4 2 R

i D

s D

d D

e if i

R lp C

m 0

9 D

8 0

i 0

D S

B D

1 V

R B

R 8

M C

9 1

y 4

a e

M r

ug la i

n F

iF

}ll

50 e

36 cn e

e m

m m

m m

m m

m m

5 gN u

h h

h h

h h

u i

h u

iu h

u P1 e

ig ig ig ig g

iH e

e ig i

d ig iu iu h

iu h

i h

iu u

a q

g d

d d

d d

ig d

ig d

ig i

d i

s H H H H H

H e

e H

e e

H e

H e

H e

n M

M M

M M

M M

M M

O o

N C

A 5

5 5

5 5

5 E

E E

=

=

E E

E 3

3 5

3

)

8 3

5

'P

=

=

=

3 E5 1

=

=

=

5 3

3 3

3 3

3 4

3 3

3 2

0 -

3 3

3 3

3 3

D 8

E

<E

(< E E

E E

E E

E E

E E

E E

E E

E E

E E

C 8

• 8 l

8 8

8 3

3 3

I 3

3 3

l 8

8 3

3 3

3 2 <

C 4

2 2

3 E

E 2

2 2

E E

E E

E E

I I

I l

S 1

I I

)

5 s

)

c

)

)

)

i 1

a

(

1 a

b d

s

(

)

)

(

1

(

)

)

(

)

a a

2 a

1 2

a b

3 2

1 a

1 1

2

(

B

(

(

1

(

1 1

1 1

1 e

(

le 2

1 l

1 2

2 3

2 2

2 b

2 e

1 e

2 2

2 2

2 2

b l

e e

2 2

le e

e a

e b

2 i

l l

le e

le e

a 2

v e

2 e

l l

T T

l a

b l

l t

b le b b

b b

b e

b le le b

b b

b T

le a

c l

l a

a a

a a

b T

o a

a b a

a a

a a

l i

T a T T T

T T L

b T

b b

T T

T V

T V

a d.

t a

a O

a a

T O T V

T T

V V

M M

l C

T V

Y u

S A

Q C

V C

I I

I M_

IO T

T

)

b F F

h h

N

)

h h

h h

)

t t

A

)

t a

C C a

A )a A

a a

a a

A A

a At a

b

(

t t

s t

I c

(

p e

e C

e C

p Cp p

P(

AI C(

e C

p p

(

n n

n I

I L T C n

a e

I R

OR o

O o

o O

o T O

OI I

i I

I p

n P

P P

P F

P P

H H H C OP P

H LH n

L I

I n

n L

n L

L m

o H I

H H

S LL L

D LD S

n S

S I

I I

I i

2 S

I I

i I

&)

U H

H D,

3 M

D D

C, a

'n

(

9 0

1

)

80 e

e t

5 t

B, o

2 5 00 r

v 0

o 01 4

o o

h 4

o o

o h

i o

o o o

1 2

n

- lu o

la3 n

n a1 n

n 2

o A

t 1

1 a

n n

n n

n a1 n

n V1 V ia v

v V-v 8

1 lo C

f V

V C k

k C

k s

C c

c c

D I

(

e e

e B

oC n

h h

h R

c c

c 2 no i

)

)

)

)

)

)

)

)

)

t

)

)

o

)

)

)

)

)

)

o y

c a

a a

a a

a a

a a

a a

a a

a a

a a

n n

r e

(

(

(

(

(

(

(

(

(

(

(

(

(

(

(

(

(

t a

e m D m

u S

)

A A A A A

A A A

A A

A A

a A

A A

A A

A t

(

n C C C C C

C C C

C C)

C)

C)

A C

C C

C)

C C

e 'E O O O O O

O O O

O O (a Ob Ob C

O O

O O (a O O

m L

L L

L L

L L

L L

L(

L(

O L

L L

L L

L I

L s

L L

L S

S S

P L

P L

L P

S P

S P

I I

sessA g

g g

g g

g g

g g

g g

g g

n n

n n

n n

n n

y d

n y

d n

y n

y n

y b

n b

n b

i d

i d

b b

i i

i i

it i

i i

i d

a i

d a

it p

f t

t t

t t

t t

t t

t d

u n

a a

a a

a a

a a

a a

a a

r r

r r

r r

r r

n m

r n

m r

n r

n r

n o

o e

e e

e e

e e

e a

e a

e a

e a

e a

e e

r C p

p p

p p

p p

p t

p t

p t

p t

t p

S D

O S

D O

O O

G O O O O O

O O O

S S

S tca k

f k

c o

V c

m p

)

V e

e a

m O

f h

e f

e

)

f h

f m

C o

b e0 cD o

aB M

o l

9 o

f o

c f

r I

t t

a p0 m D, or m B, o

m m

f o

s f

e r m5 d

i f

i r

f l

o o

n ip1 a

o o

a m D, w n

c.

a1 o

t s

a s

a e

m a C, o a

i.,

m e2 i

e&

e C, m, eA pA m

e r

r1 n

l r

s -

b 8 s B, a C, r4 u4 r

t 2 a

A y

a5 t

e t

d nV (u

t a

t s

c e1 r B, e

s1 8

e s

1 1

e a 0 n

r n -

r B,

n -

t E

S 2

r s

2

/

s1 wC 4

o0 wA r

n t

l wH &, H w5 wH s

pA t

t oD p

u8

& D, 0

s t

M r

p -

o s1 o4 pA oD 2D p

o0 s

e uV d d &

8 3

C, i-d u4 d

u2 F

b n

V

(

9 d

u d1 e

5. D 5. B t 53 e 1, t m

6 8

0 5. C 5 a 5

5. C

5. h 51 y

5 v 4 v 4h 2

2 1

1 1

a B

2U V

u 3-2 1

2d 23 2

2 2 a l

la H 3R 3A, E

0 1

f l

1 1

1 1

a a

4

- n 1

- n I

I 2

3 a 3 2 4

4 e 5 v 5M 4v 6 v 8 0 8

- 5 C

-9 v 9D N

- s 8

1 1

e 1

r k

k k

AV Ac Ae Ar AD l

k e A A A A3 A

A Au Ac Ae Ac Ac A

1 lb n C C C C1 C V-C Ct Ce Cl Ce Ce C V-C O Ce Cl C h CB i

v v

an a

i 2

e h

a h

h h

a a

T L

C C C C1 CC C Cb Cc Cv Cc Cc CCCM Cc Cv Cv CR F

o C (n f

nr n

L(

Pl O

e o L

t Om s

df a

&h i

t O

h L u i 1 s

t n

h a

I e

a( l s -

a I

c v

P p ia i

o t

N a

Ac i 2 R

Hn w

r A.

s nC) c e H. " o t

t p

t E

al p

c z

m vOI pb D )t s m e

a "t

u h

a l

le L (t a m n

c v

Ce.

t r le n imT k

a f r is a

o op uo e

a e

e n

s e qc m

b a

A e

d i s r a

s s

b v e

e e a I

r z

a hl e t

r o

s s

o Oi it in sh e

o f

a o L

r t

o g s

s n c a

.a e g s

t L

o yi i si f

f oi s

c u s

e sA l

i ot t

Amc s

v u o

.A e

eC ia nt it ai Ce sh P c

it t

a s n e

r p

u a

)

d O

tn n

e s Du Os s d

v 2

i

,t r s t

id iei s r mL e gC o e

e

.4 r

io t

L (g h e

lpi dA r

r r

nC G s

)

pe o

l ph nC oi ndeAt P

o r

sd l

e n ci n

I d

p i

e n ni wat a

f pi c

.H c

u a

e s n O

eCa s

mv h

ei i t

t lyip0f Op e r d

d2 o

nL l

e lo is inh

. e u r s o e

e s 1 I p

Tn le eb i gd PL m

).

la a d

o a

w le yf g

c n yv l

1 o

c r nL e r

I c n e

s e o k ga ph P

t e a a/ g "e 3 ni u

pi "t

m sh lni lp

,i n ai r

/y s

- a r

r i ni s c4 r

j T

t i

e i

c c

r l

n a e f

a s

>d e

c u h

c e

s s

Hlab o2 Ti 2 nS

/

t

)

al e

s t

i t

po 5

c 3

h ei ua p

ed ef e c t

r i a c

e ohi c e c 2i E

t m "t s

, luA d it t lpS n s ET 2 mo t

s h

r e c e

nd ws e

m diC imheT onb a a2 f c 4

1 a e nine I

a n ny p e

c r

r p n

r e

c t

aO h

t a eib

,e a

a t

f r

r l

r e

)

e c

= a gp la ua nL e

u

/y 1

r r d e

. 1 n m y.

e lait r,

t s

r cR

)

f oP e T ).

po st et s

= 2 T ei 1

3i mik sd o l

t 3 r h pI b e

e o p".d R

v v a sE ei c ah n n n e2 TE s

/ ut ni e

3 s

r o u e eh ni sAa le el o d t r

u et f

3 r

sd n

r t

/ 1 u e n l

u ws

(

ot c

l oRr

,b o ei2 u

h p bb od e o

s p "n ial s

e a

is f n r 5 or a a

ot s

ciCt

. e d

r l

s cSfaOn Ah n

a i it r

it e

t ei e mmf eH oee Rd ;

h r o=

3 n

f r b3

(

e c

a eh i nl lo ah r et o ei a ni ud vD o

ed 0 w1 -

S

.d Li C n e

u r

6 o

,f or gt n t

t e

u l

f n n a 2

0 /y 7

e 2, 2 n aT Oi r

a a d m 6 s 8 I( l oa ea F

L o er mic s

n s

ia l

r b

ed e

t s of c 7

s c s eC Pi s

f ne a ns e i y

p nt a lypi e n eh e2 lo cd o

aT d r e 8

u

• k a

e n et n

e t

su s

cd o nt m1 d io c e gaI, y

r

)

• h n r i P b le r

u e

Ac ei r )

u - c e n 4 ei nt e s a a c mgnCs e e

- r u gtaf pss2 a a o r

) 0 l

i. L d

r f d r e 4 6

3. b e e el e

t e

sl o it id OnjgfuuRma le n sl 37 3 e c s

feR a -

h eS d a i

c e r z

s at pn usbih 8

r n m e vy a uL i

R (g c n eif o x s

us inl I io t

a ei e r

si pi aAaf 3*

pr luI ui u

c if o

l o )n b o s

e s nd n

. oT I

a c

tad o4 gi C ph b

e

(

le) a yf gi v a o n c1 e. a gOh a

.b4 Tra e n.

r t

r e

t s

ni nl s

n ipl f Rm noe o

,a n

t s p r

nil o ps a -

A is a

a ippv pd e"

mip p

on c

it uCoRr e

(

a B '"2 e T,33

,p(

e1 s

l nAt s ed e

r 2 s r lu e

ipr di n l

c o l

u t

a w

iad l

n a

3 e c u a

l a

t e e /y o s

e e pa o o

o.

r2 e cl t

c r

s a d P nus lc oiO s

a re t

s r lo "e i i

ei l

i n s d o el nb n s

t e

mC t

t poihi f

cb e a e e d

s mloe r e L n1 e "s e o n1 te e

r at

,ul a

n a l

d eP e - s t f ta D "t z

i r

r n

u osi a cf p

c rdd s 0 eT e

miy oi s

a nl u n p(

eOa f s e s c

t e e oe ih r

A" a

e iail ai ei a

iadl ps Ns s vf d le e e2 Rd B

Ap cA e

hf a n

t 2

oAdCyAa d h lac CmhC h abf r

W"f ri Pib t

p e e

(

eEe u

t ot mO e c c

s a a orc e

s a

d P adol pI

( n u

h n a

ss

.d v

it OI vO t

r uI v eOmhe e r i Pd r

r ci L "e k c

i n

oL u

s

. yC p a L

e e ol e

r e o2 st d L r

a e

d edbCs v gH a

i4 n s n s e it p

lb wv t

s e u r mofe h -

t s

e c e

/ E ei t

a r ci e

ic ee dt le n in 4 sa et a

s s ed i n a uh e l

h i ga a d a c ehP uh n s/RT. 61 gl 1

r f u e( h m t

e tn v

cb a s

n a aTDs ci s6( /y E = le u at oo adA o

e cnC a s m

lp t

n e is Q

r f s

nplomle E r2 e la" pn s

s a -

ph s 5

ipms ud n imi.Ci idi h 7 u -

f d i e

f e n

ai p ipnd lo t

a r

s 3 ahf e

pool ia

. e e i n c moidoigt T n a5 t

msC h d

e i i ows h r oE1 lof z

nw d miu eL t

n c o al d I

e z t

a h2 e

aF a p1 /

= s r o nl a n muf pCmI 61 i o n inf u n o

i h o/ah nh pa wtnH L )r a

eh n e na a d h r

s o

wt l is t

r et i u s ef i ol c v wl r

yi r

t ta of PI e E ah&c

/

P =

ou I

r y

t s av nd ia e l

e t

t i

Pd L t 6 at nl e nf hl

,t a

s is o s

d mi s

o s

igd nx w s a i

ai t

mid h

d vc e u si e

e we e nni e pt t

I

= e e uc i h a t

ut n v h z o ne let ei t

g a4 s

n /y ; aveua e ql a

a s

rL s

) n e

sl t

c pl sl a

pt a u sh c is y odR la a uf s

t d

a eih e a os o r

hi ; s ad q o o3 nk ud e c r

r s

h peHph nd r ich Ai a is e o t

ac us n of e r

i wC;ak ip a it si

,e e ot t

s r c

e si f

A e

nh rif i Dg at oI eE me n

c i s s t

a h

af s s S hlow ms ei d v s

t wAO of n( ni Iid P e s e u( e ACL C yi f e inr e c

t mack f

lo r t a d c c t

v e

. f i t el r

f r

r e ei v uP Ht is pl h r

t oct f u o l

gaTFl n pd a I

a u e a )r oVe ot ei o )s it col Oiq n

i b

a pt e

c ei l

v.

.ided xi mt od L

.r b s b e

/y e O e r aL e n c s n

n r

OLi pel wims x

Vr e s

r a

n T "T B t

/

a e adb 4 u s e

lum a

e sf r i eAe r

lupe u Ll tnl l

e s r

s) h e

s sMio si r

c n vi o n

e e a or

)

F A

q a eb oi a r

e at gf t

Arat ah nm nC pEi s

v a

u t

ct mOa eCF c

s u

a u ng mtol i

Ca ysi ai loluL e ge iI f s, f f e

t R

Cros P3 p(

o o u o=h er d r s pod t

ei ue Oe v

s s t

va s e n n ts t

is t

i u eVs r h v ei a

h n nd Aa1 2 AAv el a ais e a e Lt e c n el c oI i

ya4 eCCs p T. i r a

ci h o cd yt on s uI w uis g=

=

n e w siHu) mr n ci I

l B Ol OOa d

a a o sl s

a a t

c s s t

s i "E n

ai i AAA A=

ad o t

t e

b sE i

h a ei lnP HvNaLL p=

e pf Ch od -

n t

Ar ot n

n T al oMin nI o n -

l iaCCC C C ic) n t

v s

ADiOLDiATSL = Vo= = r -

oni f

"e C )

OOO O O=)

it oimi) a o

t t

t V OmVl t

P a

n c

)

i t

nLLL L

)

ia (a b cd CMreMI

(

l

) ) ) )

oV D t

a a h O (a b

e (a iLSPI L T (a b I

D si cd al ui s

( pt L

(

(

f

( ( (

I ol l

t n

u C

e o

oe miP E

s Q

C I

I 2

5

m m n

sh t

Pl s

s e

o e y ot u c

a si r y O

lr c m yd yoaf w N

oe s e r

d g

A o(

nisM od y tn e n r

i H "y t

n t

ei a ri a

v u

aa q h" r

.l r

e

.d in wi mt pt a e g n e t ri wip oe r ct H ek is vl a o s u e a w

pn"

= b c i n id s

n t

c ui g ims y t

gi a

- ob et n

d t a

t i e a nb ai ad l

r c ed e,i p ud t

l

" gn u nii on a n p c a h d a q oi s

ei s

d

,i g u t

ni ys a ah n er g ij c n r H

n o e s ae n is t

n v ip t

e c pi a e

nu oeh ws ip y w q "m r r t o s d

oe e lu e

a r

g d s r

t iu edf win t

e h ai ul t u ed of z h h d lah ge psi s

n n

c n e M g 't s

g gu a dn gl a "a ni o n

id c i m g d a r r d a nl s r h u n e u e i r

r n

i n u c e d a n iodfid t

ye gs u r

it I

ov d o n n o d P ob op it o b n r d nHop n me ai r

t s

o i

a ri c gt ot l

i n at s a n ed pn n gi n v ia oo e

io n gid n o b ei m

ct r le mg lym n

i t

a od e e b gr a

r h n e e la c u la t

oip no o cAirmt n l

ph j

s t s

a a o ei a r it r

e a ef oh r y pe o n )t n e

r r e e on yh a ow p v yi e s at m

o e ct ic r e

s n a m P

O e u mh.

e p md r

f t

s n s ei e e

n s u pu nd t

r t

n we qoq o

si e

s ei a "h o

yvt e

y t

. s e a iol r r e e

s t d h f e,

gu g

a t

c s

r u u e we is al g i oi wi ai S M T piomHoe"vHHf m t

t eh h

u p

l O

t n

w e e e e o

c cd c c d

d n n n n n n

t e e a e e a

e u

e e u u e u u e c h

c c qq c qq c n S

n n e e n e e n e e e s s e s s e u u u n n u n n u q q qoo qoo qe r

e e c c e c c e s e

s n" s"

s n so m "m o m "m w

n n

n o o

o o c P

c c iuu c i iu i

u c "h f

" " dd " dd o

h h e eh e e h g g

g n

ig iMMiMM igiH o

Hll" H"

l l "

si n "n 'n i i n n" n n n

r nii ni a

oiit s it s

i pi t

t s

ma lt lt lul t lul l

lt t

t r u u s ul s u u u u

o e s s e s e s s

s s r e r e C p e e e

e e r

r r r s r s r r O

sad sad sA

&r s

n n

AACaACa A C wewCCOmCOm C

oOOL eOL e O O e

i L

v eP LLPDLPD LI R

2 n

m 4

SI w

e I

I et CP P

P o l

s d

b yRH L

Ht e L

aS T

I

,I

Page 38 ANO-l_N560 5.0 Results This section summarizes the results of the consequence evaluations described in the previous sections and Table 4-1, The following summarizes the ASME class 1 systems included in the evaluation aleng with their functions; providing the reactor coolant pressure boundary function is common to all piping (i.e., class 1):

Reactor coolant system - a pressurized water system that circulates coolant through the reactor core, removing heat from the reactor fuel, and transporting the heat to the steam J

. generators for use in steam production. The coolant also serves as a neutron moderator, j

reflector, and solvent for soluble neutron poison.

Primary makeup and purification, including HPI - performs various functions to support the reactor coolant system:

j E Supply RCS fill'and makeup water a Provide reactor coolant pump seal injection and return E Provide purification ofRCS water E Control boric acid concentrations in RCS E ' Accommodate changes in RCS volume E. Facilitate RCS chemistry control B l Supply borated water to core flood tanks a Provide a source of pressurizer auxiliary spray 5 Inject borated water at high pressure upon ES actuation Decay heat removal, including LPI and core flood - removes decay heat from the core and sensible heat from the reactor coolant system during later stages of cooldown. It also-l provides a means of automatically injecting borated water into the reactor vessel for cooling j

the core in the event of a loss of coolant accident during reactor operation. The core flood i

system provides core protection after intermediate to large reactor coolant system leaks.

I i'

The following summarizes the ASME class 1 piping consequence analysis results in Table 4-1:

j L Most reactor coolant system piping and connected piping, which is not normally isolated, falls into the "High" consequence category. This piping causes a LOCA initiating event with a conditional core damage probability (CCDP) in the high range. The ranking of this piping depends on the size of the pipe (e.g., small LOCA has a lower CCDP than large LOCA).

l h

2. Piping beyond the first RCS isolation valve falls in the " Medium" consequence except for I

letdown piping which is "High" because isolation was determined unlikely. In all other cases, a LOCA requires'either passive failure of a valve or failure to isolate the valve. This reduces the consequence from "High" to " Medium."

Final iMay98 ANol MAY. doc

__..__.______.m__..__

__.._.____=_____m___

__s

Page 39 ANO-l_N560 6.0 Conclusions The consequence assessment results are provided in Table 4-1 where each pipe segment.has been assigned a "High" or " Medium" or " Low" consequence. In addition, conditional core damage probability (CCDP) has been estimated for ASME Class 1 piping per the ASME Code Case N-560 (Reference 1). These quantitative estimates are in Table 4-1 ("CCDP" column) and they can l.

be used as part of the pipe risk ranking and selection decision process. Conservatism and non l

conservatism that could potentially effect the ranking that were noted during the analyri., are identified in Section 3.3.

l Containment performance was considered in determining the final consequence category. Some consequence results were changed from " Low" to " Medium" based on containment performance; the potential for early core damage and containment failure. The T1 initiator was assigned to the l

Medium consequence as discussed in Section 3.2 and Table 2-1. Containment isolation was not a concern because Class 1 piping is both inside containment and inboard of the containment isolation valves; therfore no impact on containment isolation.

l Shutdown operation was also considered. As a result, decay heat removal piping is judged to have a " Medium" consequence. This was already in the " Medium" or "High" category.

Consideration of external events did not affect the ran' ing of pipe.

l l

I l

l l

Final May98 ANOl,,MAY. doc

Page 40 ANO-l_N560 7.0 References

1. ASME Code Case N-560, " Alternate Examination Requirements for Class 1, Category B-J Piping WeidsSection XI, Division 1," August 12,1996.

2. Engineering Report 94-R-1004-01, Rev 1, ANO-1 Probabilistic Risk Assessment (PRA),

I Individual Plant Examination (IPE) Submittal.

3.- l Calculation No. 89-E-0047-20, Rev 1, ANO-1 PRA Level I Initiating Events & Accident Sequence Analysis Work Package l

4. Drawings:

l M-230, Sheet 1, Revision 98, " Piping & Instrument Diagram Reactor Coolant System" l

M-231, Sheet 2, Revision 41, " Piping & Instrument Diagram Makeup & Purification System" M-232, Sheet 1, Revision 87, " Piping & Instrument Diagram Decay Heat Removal System" 16-RC-6, Sheet 1, Rev. 9, "Large Pipe Isometric Pressurizer Relief Downstream of Relief Valve PSV-1000" l-16-RC-8, Sheet 1, Rev.16, "Large Pipe Isometric Pressurizer Relief Piping From PSV-1002 to Quench Tank T-42" 16-RC-9, Sheet 1, Rev. 6, "Large Pipe Isometric Pressurizer T-1 Main Spray Line"

,5.

STM l-03, Rev 7," Reactor Coolant System"

6. STM l-04, Rev 4, " Primary Makeup and Purification"

7. STM l-05, Rev 6, " Decay Heat Removal System"

8. STM l-06, Rev 5,' Core Flood System"

9. ULD-1-SYS-02, Rev 1, " Makeup and Purification /High Pressure Injection System"

10. ULD-1-SYS-04, Rev 1, " Decay Heat Removal / Low Pressure Injection System"

11. ULD-1-SYS-07 Rev 0," Core Flood System"

'12. ANO-1 UFSAR, Amendment No.14, Sections 4,6,9.1 and 9.5

13. Calculation No. 93-SQ-1001-03, Rev 3, USl A-46/IPEEE Safe Shutdown Equipment List (SSEL) Report for ANO 14. Calculation No. 95-E0066-02, Rev 0, ANO-1 IPEEE Fire P2 Values

15. Calculation No. 89-E-0047-35, Rev 1, ANO-1 Internal Flooding Analysis

16. ANO-1 " Summary Report ofIPEEE for Severe Accident Vulnerabilities" May 1996

17. ANO-1 Normal Operating Procedure 1102.010 " Plant Shutdown and Cooldown" Rev 47

18. Arkansas Nuclear.One Unit One " Shutdown Operations Protection Plan" Rev 4

19. ANO-1 Abnormal Operating Procedure 1203.028 " Loss of Decay Heat Removal" Rev 14 Final - 'May 98 ANol_MAY. doc

Page 41 ANO-l_N560

20. ANO-1 1203.012H " Annunciator K09 Corrective Action" Pages 46 and 47 of 55, Rev 29 regarding Decay Heat Flow HI/LO Alarm K09-A8 l

21. ANO-1 Technical Specifications - Section 1, page 1 (Amendment 25); Section 3.1.6, page 27 l

(Amendment 189), page 28 (Order dtd. 4/20/81), page 29 (Amendment 115), page 29a (Order dtd. 4/20/81)

22. ANO-1 Normal Operating Procedure 1103.013 "RCS Leak Detection" Rev 17

23. ANO-1 Normal Operating Procedure 1104.002 " Makeup & Purification System Operation" l

Rev 49

24. ANO-1 EmergencyOperating Procedure 1202.001 " Reactor Trip" Rev 26

25. ANO-1 Emergency Operating Procedure 1202.002 " Loss of Subcooling Margin" Rev 3

26. ANO-1 Emergency Operating Procedure 1202.010 "ESAS" Rev 3

27. ANO-1 1203.012H " Annunciator K09 Corrective Action" Pages 4 & 5 of 55, Rev 29 regarding RCS Pressure HI/LO Alarm K09-Cl

28. ANO-1 1203.012I " Annunciator K10 Corrective Action" Page 37 of 52, Rev 36 regarding MU Flow HI Alarm K10-B6

29. ANO-1 Abnormal Operating Procedure 1203.039 " Excess RCS Leakage" Rev 4

30. ANO-1 Abnormal Operating Procedure 1203.041 "Small Break LOCA Cooldown" Rev 3

31. North Atlantic Energy Services Corp. " Individual Plant Examination External Events" Report for Seabrook Station, Response to Generic Letter 88-20, Supplement 4, September 1992.

32. EPRI NP-6395-D, April 1989, "Probabilistic Seismic Hazard Evaluations at Nuclear Plant

. Sites in the Central and Eastern United States: Resolution of the Charleston Earthquake Issue" Prepared by Risk Engineering, Inc., Yankee Atomic Electric Company, and Woodward-Clyde Consultants.

33. NUREG-1488, " Revised Livermore Seismic Hazard Estimates for 69 Nuclear Power Plant Sites East of the Rocky Mountains" Final Report, April 1994.

34. YAEC paper ICONES-2592 " Lessons Learned From the Evaluation of Pipe Break Consequences in BWRs (Risk Informed Decision Making on Inservice Inspection of Pipe 1

Welds)" Proceeding ofICONE 5, May 26-30,1997, Nice, France.

35. ANO-1 Drawing #MIB-247.

i Final. May 98 ANo!,MAY. doc

)

i

_-_____.__-______w