Text

Analysis of Core Damage Frequency from Internal Events:Zion Unit 1
	ML20207G067
Person / Time
Site:	Zion File:ZionSolutions icon.png
Issue date:	10/31/1986
From:	Tyrus Wheeler; SANDIA NATIONAL LABORATORIES
To:	; NRC OFFICE OF NUCLEAR REGULATORY RESEARCH (RES)
References
	CON-FIN-A-1228 NUREG-CR-4550, NUREG-CR-4550-V07, NUREG-CR-4550-V7, SAND86-2084, NUDOCS 8701060314
	Download: ML20207G067 (105)
	v • d • e

~-

l NUREO/CR-4550/Velumo 7 SAND 86 --2084 AN Printed October 1986 Analysis of Core Damage Frequency From Internal Events: Zion Unit 1 Timothy A. Wheeler area Na onal Laboratones or ae Depar en of ne gy under Contract DE-AC04-76DP00789 870106014ag1[3hDR P

q,,,

Prepared for U. S. NUCLEAR REGULATORY COMMISSION m . ro-n

% . g l

NOTICE This report was prepared as an account of work sponsored by an agency of the United States Government. Neither the United States Government nor any agency thereof, or any of their em ploy-ees, makes any warranty, espressed or implied, or assumes any legal liability or responsibihty for any third party's use, or the results of such use, of any information, apparatus product or process disclowd in this report, or represents that its use by such third party would not infringe privately owned rights.

Available from Superintendent of Documents U.S. Government Pnnting Office Post Of fice Ikix 37082 Washington, D.C. 20013-7982 and National Technical Information Service Spnngfield, VA 22161

NUREG/CR-4550/ Volume 7 SAND 86-2084 AN l.

ANALYSIS OF CORE DAMAGE FREQUENCY FROM INTERNAL EVENTS: ZION UNIT 1 I

Timothy A. Wheeler Printed: October 1986 Prepared by Sandia National Laboratories Albuquerque, NM 87185 Operated by Sandia Corporation for the US Department of Energy Prepared for Division of Reactor System Safety Office of Nuclear Regulatory Research US Nuclear Regulatory Commission Washington, DC 20555 Under Memorandum of Understanding 40-550-75 NRC FIN No. A1228

Abstract The Review and Evaluation of the Zion Probabilistic Safety Study (NUREG/CR-3300) represents an analysis of the risk profile at Zion based on the plant status as of 1982. This report reevaluates the dominant accident sequences of NUREG/CR-3300 within the context of changes in plant configurations, operational procedures, and general safety issues. This analysis is restricted to the set of accident sequences in NUREG/CR-3300, and does not investigate potentially new dominant sequences.

iii/iv

Table of Contents Section Pace I. EXECUTIVE

SUMMARY

.................................. 1-1 1.1 Motivations and Objectives.................. I-l I.2 Approach.................................... 1-1 1.3 Results..................................... I-2 1.3.1 Characterization of Core Damage Frequency at Zion.................. I-3 1.3.2 Characterization of Plant Damage State Frequencies.................. 1-3 1.3.3 Characterization of Dominant Sequence Frequencies............... 1-7 l

1.4 Conclusions and Recommendations............. 1-14 1.4.1 Specific Plant Damage State Conclusions........................ 1-15 1.4.2 Specific Sequence Conclusions...... 1-15 1.4.3 Sensitivity Conclusions............ 1-16 II. PROGRAM SCOPE AND LIMITATIONS...................... 11-1 III. PROGRAM REVIEW..................................... 111-1 l 111.1 NUREG/CR-4550 Program Review................ 111-1

\

IV. TASK DESCRIPTIONS.................................. IV-1 IV.1 Rebaseline Tasks............................ IV-1 IV.2 Review of Zion Risk Studies for Background on Rebaseline Issues........................ IV-1 IV.3 Definition of Rebaseline Issues............. IV-1 IV.3.1 CCWS and SWS Pump Success Criteria. IV-2 IV.3.2 Common-Cause Failures.............. IV-2 IV.3.3 Restoration of AC Power............ IV-3 IV.3.4 Feed and Bleed..................... IV-3 IV.3.5 Refueling Water Storage Tank (RWST) Refi11...................... IV-4 IV.3.6 Reactor Coolant Pump Seal LOCA..... IV-4 IV.3.7 Manual Switchover to Recirculation Cooling............................ IV-4 IV.3.8 Recovery CCWS Pipe Ruptures........ IV-5 IV.3.9 RHR System Check Valve Testing..... IV-5 IV.3.10 Diesel Driven Containment Spray Pump............................... IV-5 IV.3.11 Common Cause Failure of the AFWS Due to Steam Binding............... IV-ll v

Table of Contents (Continued)

Section Page IV.4 Systems Analysis............................ IV-6 IV.4.1 Service Water and Component Cooling Water System Unavailabilities................... IV-7 IV.5 Incorporation of Certain NUREG-ll50 Methods into 7. ion Review Methods............ IV-11 IV.5.1 AC Power Recovery Model............ IV-13 IV.S.2 Common Cause Failures - CCWS, SWS, Unit 2 Diesel Generators...... IV-14 IV.5.3 Reactor Coolant Pump Seal LOCA..... IV-16 IV.6 Accident Sequence Quantification............ IV-17 IV.6.1 Sequence 1......................... IV-18 IV.6.2 Sequence 2......................... IV-21 IV.6.3 Sequence 3......................... IV-21 IV.6.4 Sequence 4......................... IV-22 IV.6.5 Sequence 5......................... IV-22 IV.6.6 Sequence 6......................... IV-25 IV.6.7 Sequence 7......................... IV-26 IV.6.8 Sequence 8......................... IV-26 IV.6.9 Sequence 9......................... IV-28 IV.6.10 Sequence 10........................ IV-28 IV.6.ll Sequence 11........................ IV-29 IV.6.12 Sequence 12........................ IV-30 IV.6.13 Sequence 13........................ IV-30 IV.6.14 Sequence 14........................ IV-32 IV.6.15 Sequence 15........................ IV-32 IV.6.16 Sequence 16........................ IV-33 IV.6.17 Sequence 17........................ IV-34 IV.7 Sensitivity Analysis........................ IV-35 IV.7.1 Sensitivity Issues for the Limited Rebaseline CCWS Pipe Rupture....... IV-35 IV.7.2 Sensitivity Quantification......... IV-39 IV.7.2.1 CCWS Pipe Rupture........ IV-40 IV.7.2.2 Manual Switchover to Recirculation Cooling.... IV-40 IV.7.2.3 Reactor Coolant Pump Seal LOCA Model.......... IV-41 IV.7.2.4 Common Mode Event Probabilities............ IV-44 vi

Table of Contents (Continued)

Section Pace IV.7.2.5 RWST Refill.............. IV-44 IV.7.2.6 Containment Fan - Core-Melt Interactions........ IV-46 IV.7.2.7 Containment Spray

- Diesel Pump - AC Independence............. IV-46 IV.7.2.8 Containment Spray Injection Room Cooling... IV-49 IV.8 Review of Licensee Event Reports (LERs)..... IV-49 V. RESULTS............................................ V-1 V.1 Characterization of Core Damage Frequency at 7. ion..................................... V-1 V.2 Characterization of Plant Damage State Frequencies........................... V-6 V.2.1 Early Core Melt with Containment Cooling............................ V-6 V.2.2 Early Core Melt without Containment Cooling................ V-6 V.2.3 Late Core Melt with Containment Cooling................ V-8 V.2.4 Late Core Melt without Containment Cooling................ V-8 V.2.5 Interfacing Systems LOCA........... V-9 V.3 Characterization of Dominant Accident Sequences................................... V-9 V.3.1 Sequence 1......................... V-9 V.3.2 Sequence 2......................... V-9 V.3.3 Sequence 3......................... V-10 V.3.4 Sequence 4......................... V-11 V.3.5 Sequence 5......................... V-11 V.3.6 Sequence 6......................... V-12 V.3.7 Sequence 7......................... V-12 V.3.8 Sequence 8......................... V-13 V.3.9 Sequence 9......................... V-13 V.3.10 Sequence 10........................ V-13 V.3.11 Sequence 11........................ V-14 V.3.12 Sequence 12........................ V-14 V.3.13 Sequence 13........................ V-15 V.3.14 Sequence 14........................ V-15 V.3.15 Sequence 15........................ V-15 V.3.16 Sequence 16........................ V-15 V.3.17 Sequence 17........................ V-16 vii

Table of Contents (Continued)

Section Pace V.4 Comparison of Results with' Zion Review...... V-16 VI REFERENCES......................................... VI_1 !

i i

1 6

I i

l i

s i

h I

+

l viii s

. . . ~ . .._ - , - - . _ _ . , _ _ _ _ _ _ . . . . - - - _ _ _ , . - _ . , . - _ , _ _ , , - _ _ _ - - - - . _ _ _ . . _ - . . , _ _ _ _ , . . . _ . . . . , .--.c.-_, . . . - - -

I. EXECUTIVE

SUMMARY

I.1 MOTIVATIONS AND OBJECTIVES This document presents the results of one of several studies that will provide information to the NRC Office of Research about Light Water Reactor (LWR) risk. The Office of Research will use the results of this work along with other input to l prepare NUREG-ll50. NUREG-1150 will examine our current perception of risk from a selected group of nuclear power plants, incorporating the results of wide-ranging research efforts that have taken place over the past several years. The NUREG-ll50 results will provide the bases for updating our perception of risk from selected plants, developing methods for extrapolation to other plants, comparing NRC research to industry results, and resolving numerous severe accident issues.

Zion Unit I has been chosen as one of the reference plants that will be analyzed to accomplish these goals. The Zion Nuclear Power Plant contains two units of 1100 megawatts (electrical) capacity and is located near Zion, Illinois. The reactors are both housed in large dry containments. The Zion plant was previously analyzed in the Review and Evaluation of the Zion Probabilistic Safety Study (NUREG/CR-3300) and the Zion Probabilistic Safety Study (ZPSS), which was performed by Commonwealth Edison, owner of the Zion station. Other plants that have been chosen as reference plants are Surry, Peach Bottom, Grand Gulf, Sequoyah, and LaSalle.

Our objective was to perform an analysis that updated the previous Zion analyses. For most of the project, we worked under severe time and resource constraints, and it was necessary to take shortcuts in many areas.

This document presents the initial part of the risk equation --

the frequency of scenarios involving system failures which lead to severe core damage.* (External and special events were not analyzed in this study.) Containment and consequence analysts have taken our results and have integrated them into the risk equation. The corresponding Zion containment and consequence analyses can be found under separate cover.

1.2 APPROACH Due to the fact that recent analyses of Zion exist and because of the severe resource constraints associated with NUREG/CR-4550, it was decided to perform an update of the previous

Core damage is defined as significant core exposure occurring with no imminent reflooding of the core foreseen. The pro-longed exposure of the core leads to damaged fuel and an expected release of fission products.from the fuel.

1-1

.. l

analysis, rather than perform a complete reanalysis. Thus, this analysis of Zion represents a limited rebaseline of the dominant accident sequences of the Review and Evaluation of the Zion Probabilistic Safety Study (NUREG/CR-3300), commonly referred to as the Zion Review. The scope and nature of the NUREG/CR-4550 Zion analysis, as a rebaseline of the Zion Review, is therefore quite different than the other teference plant analyses. Thic report should be considered a companion document to the Zion Review; it is assumed that the reader has access to that document.

l l

The limited rebaseline of the Zion Review was restricted to the '

set of dominant accident sequences defined in that study. The rebaseline analysis incorporated specific issues into the systems and accident sequence models of the Zion review. These issues reflect both changes in the Zion plant and general PRA assumptions which have arisen since the Zion Review was performed. No significant model changes were made. The existing set of system and sequence models were reevaluated within the context of the new plant and PRA issues. Event trees were not developed or reanalyzed to study new potentially dominant accident sequences. These tasks were beyond the scope and resources of the Zion analysis. The original set of plant-specific data used in the ZPSS and Zion Review was used in this study. It is important that the results of this ,

analysis are viewed with these limitations and restrictions in mind. This analysis represents a limited rebaseline of the Zion risk profile as portrayed in the Zion Review. It is not a reanalysis of the Zion plant, and no new potential dominant core damage sequences were found by this analysis.

The methods employed in the ZPSS, and used in the Zion Review and this analysis, are based on an accident sequence event tree

- small system fault tree approach to modeling. The method is quite different than the method used in the other reference plants. The ZPSS method does not yield Boolean expressions for accident sequence models, but rather algebraic expressions involving system level unavailabilities. All fcontline, support, and containment systems are explicitly modeled in the accident sequence equations. The accident sequence models of the Zion analyses do not facilitate ranking of dominant contributors based on importance calculations, not can statistical uncertainty of accident sequences be readily estimated.

1.3 RESULTS A summary of the quantitative results of the analysis is presented in this section. The results are presented at three levels; the plant level, the plant damage state level, and the sequence level.

1-2 1

a s

I.3.1 Characterization of Core Damage Frequency at Zion The Zion rebaseline analysis identified seventeen core damage sequences from the original list of fifteen dominant sequences in the Zion Review. The original fifteen sequences are shown on Table 3.1-1 of the Zion Review. The Zion Review method was such that each event tree sequence was unique to a specific plant damage state. Thus, changes to certain sequences in the rebaseline analysis which effect the plant damage state of a sequence result in some sequences being split up into two different sequences. Other sequences were combined if rebaseline changes moved one sequence into the same plant damage stato as another sequence, and all event tree' events for the two sequences were the same. (The importantedamage states are summarized in Section I.3.2, and the important sequences are summarized in Section I.3.3.) The sum of the frequencies of the analyzed sequences is 1.5E-4 per reac. tor year. The Zion Review value is 3.5E-4. These values are sums of point estimates: the Zion Review analysis did not propagate statistical uncertainty of the dominant sequence frequencies and provide a distribution from which a mean or median would be obtained. ,

Since results of the ZPSS and the Zion Review were not constructed with probabilistic sequence equations based on merged fault tree models of basic events with statistical distributions, uncertainty analyses were not feasible with the current set of computer and statistical tecimiques available to the NUREG/CR-4550. Therefore, sensitivit/ analyses were performed on the sequence models to estimats the potential impact of certain issues on the Zion risk profile. Some of the issues considered were the behavior of the Reactor Coolant Pump (RCP) reals during degraded electrical power situations, generic common- mode failura values, and AC power independence of the diesel-driven containment spray pump. A completed description of the sensitivity studies is presented in Section IV.7.

I.3.2 Characterization of Plant Damage State Frequencies The plant damage states defined and used in the ZPSS and Zion Review are shown in Table 1.3.1 for both the base case calculation and the sensitivity issues. The plant damage states are described below.

DESCRIPTION OF DOMINANT PLANT DAMAGE STATES The plant damage states were defined on the basis of four parameters and are identified with a letter code. As seen on Table 1.3.1, the various damage states are grouped into five general plant damage categories. Wi' thin each category, all damage states have similar characteristics, ' yet they may be sufficiently different so that the consequence analyst desires ,

1-3

/

Table I-3-1. Plant Damage State Sensitivity Results Base Case Sensitivity Range

Plant Damage Category Damage State Frequency Best case Worst Case Comments Early Core Damage with AEC O.0 0.0 1.4E-6 Containment fan failure at Containment Cooling TEC 0.0 0.0 2.6E-6 core damage causes TEFC.

SEFC 1.2E-4 0.0 1.3E-4 SEFC. AEFC to change to TEC TEFC 2.78E-6 0.0 2.7E-6 AEC. and SEC AEFC 1.4E-6 0.0 1.4E-6 SEC 1.0E-7 1.0E-7 1.2E-4 1.2E-4 Early Core Damage SE 7.0E-7 2.8E-B 7.0E-7 A fully AC and SWS inde-without Containment Pendent diesel-driven Cooling containment spray pump would reduce damage state frequency SE by moving several sequences to SEC.

64 i Late Core Damage with ALFC 1.OE-5 0.0 3.4E-5 Pessimistic human reliabil-Cooling SLFC 1.6E-5 0.0 2.9E-5 ity yields worst case for ALF O.0 0.0 1.OE-5 ALFC. SLFC. Credit for SLF 0.0 0.0 1.6E-5 refilling the RWST switches ALC O.0 0.0 1.0E-5 ALFC. SLFC to ALF. SLF.

j SLC O.0 0.0 1.6E-5 Containment fan failure at 2.6E-5 core damage switchea ALFC.

SLFC. to ALC. SLC.

Late Core Damage AL 0.0 0.0 0.0 No dominant sequences were

, without Containment SL O.0 0.0 0.0 relevant to these plant Cooling damage states.

, Interfacing Systems V 1.0E-7 1.OE-7 1.OE-7 No sensitivities were I

LOCA relevant to this plant damage state.

Base Case Total 1.2E-4

Certain sensitivity issues which yield a best case estimate for one plant damage state will yield a worst case estimate for others. Thus, the cest case estimates and the worst case estimates cannot be summed across plant damage states to calculate a sensitivity range for each plant damage category.

_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . z_

I ,

d ? ., ,_ ,

.. L-

, ,3 ,

.,the fin,e r division .of individual damage states. The labeling 7, c od e, islas

, .;* follows:,) ,

, P' ? ,, ,c Fir,st Lett!,er : A' Large or medium LOCA, core damage at low pressure S: Small LOCA, core damage at high pressure

', T: / Transient initiator, RCS remains intact until core damage l >,

} 8 f iV:s# Inter' facing systems LOCA

,,o '

/ t : .

Second Letter: Core Dainage Timing if ,

?.

r

< E: - Injp;ction Phase.

./ 'e '

L: Recirculation Phase ThiEband .,

Fourth ~

Lyt t.4 r s .. Status of Containment Cooling 1 g /j -

F( Containment Fans Succeed

- C: Containment Sprays SUOceed (

> t* , ,

}, l i f.

Absence of either of'the last two' letters, ~

indicates' loss of the appropridte system.

SEFC -- This damage state is characterized ' by s a' loss of the Component'l Cool,ing Water System (CCWS), e,i t he r directly or through failute of, support systems such as ~ en,ergency AC1 powec.

CCWS failure r e stilts in an RCP seal LOCA *and loss 'o f all Reactor Core qdoling Systems (RCCS) . injection systems.

Containment coofing .. remains functional. The failure that contributes most to " this state is pipe rupture in the OCWS.

Other failures aro, closs of offsite power, emergency diesel generator failures, a nJ, CCWS hardware, maintenance, and common-mode failures. Sequences lis;ed o,n Table I.3.2 included in this damage state ar@

, j', , ,

, ;i _t Sequences l' , 8, l l'. and 17.

j TECF -- This plant damage state is chdacterized by loss of offsite power, followed by failure of the Auxiliary Feedwater System (AFWS), and inability to conduct feed and bleed procedures. The containment cooling systems function. The sequences in this state are dominated by hardware faults in the AFWS and emergency diesel generators, and human error in the feed and bleed procedures. Sequences from Table I.3.2 in this damage state are:

1-5

Sequences 5, 7, and 15.

SE -- Core damage in this state is characterized by similar events as state SEFC. All containment systems have failed due either to loss of the SWS (which fails cont.ainment cooling directly) or failure to restore AC power within eight hours (the ZPSS an2 Zion Review assumed successful restorstion of AC power within eight hours after sequence initiation was sufficient to ensure success of containment cooling). Dominant contributors include loss of offsite power, emergency diesel '

generator failures, SWS and CCWS hardware, maintenance, and common-mode failures. The sequences in Table I.3.2 in this !

state are:

Sequences 9, 10, 12, and 16.

AEFC -- This damage state is characterized by a large LOCA followed by loss of the Low Pressure Injection System (LPIS).

The loss of LPIS is caused by improper return of the LPIS to service after testing (MOVs are misaligned). The containment cooling systems function. The only sequence f rom Table I.3.2 in this state is:

Sequence 6.

SEC -- Core damage in this damage state is characterized by similar events as state SEFC, except that the containment fans have failed, although containment sprays still work. The dominant contributors are loss of offsite power, emergency '

diesel generator failures, and CCWS hardware, maintenance, and common-mode failures. The cause of containment fan failure is loss of power on two of the three Unit 1 AC buses. The sequence from Table I.3.2 in this state is:

Sequence 13.

ALFC -- This damage state is characterized by a large or medium LOCA, followed by failure of the recirculation cooling system at low pressure. Containment Cooling systems function. The dominant contributor is human error in switching the ECCS over to recirculation from injection. The sequences in Table 1.3.2 in this state are:

Sequences 3 and 4.

SLFC -- This damage state is characterized by a small LOCA, followed by failure of the recirculation cooling system at high pressure. Containment Cooling systems function. The dominant contributor is human error in switching the ECCS over to recirculation from injection. The sequence in Table I.3.2 in this state is:

1-6

Sequence 2.

ALF, ALC, SLC, and SLF -- These damage states are essentially variations of ALFC and SLFC. Certain sensitivity issues question the ability to operate containment sprays given loss of recirculation cooling and the operability of containment fans given core damage. These damage states represent the various possible changes to damage states ALFC and SLFC for these sensitivities. No base case sequences fall into these damage states.

AL and SL -- These damage states are characterized by a LOCA' initiator, followed by failure o'f recirculation cooling as iri damage states ALFC and SLFC, and loss of all containment cooling. As can be seen in Tables I.3.1 and 1.3.2, none of the dominant sequences fall into this damage state. This damage state is included here because it was included in the Zion Review. Certain nondominant sequences contribute to it.

V - This damage state is characterized by a failure of the barrier between high and low pressure systems and represents a containment bypass path. The dominant contributor is combined rupture of two motor-operated valves (MOVs) in the Residual Heat Removal (RHR) suction path. This damage state is synonymous with sequence V.

I.3.3 Characterization of Dominant Sequence Frequencies The dominant accident sequences are presented in Table I.3.2.

The results of the sequence sensitivity analysis are shown on Table 1.3.3. The ZPSS and Zion Review method defined accident sequences so that each entire accident sequence model resulted in one, and only one, plant damage state. Furthermore, the Zion method of accident sequence definition does not name a sequence based on the series of event tree events relevant to that sequence (e.g., TMLB). The Zion method simply ranks the dominant sequences, and a sequence's rank becomes its unique identifier. Therefore, in Table I.3.2 and in the following discussions of the dominant sequences, the Zion sequences are identified by their rank. A brief description of each sequence is included in lieu of an event tree label scheme. These descriptions are consistent with the descriptions used in the ZPSS and the Zion Review dominant sequence discussions. To further enhance understanding between the rebaseline results and the Zion Review, the sequence results from the Zion Review (rank, frequency. and damage state) are included in Table I.3.2.

Sequence 1 - CCW failure, causing failure of all charging and SI pumps, seal LOCA The initiator for this sequence is loss of the CCWS. Loss of the CCWS results in loss of cooling to the RCP seal thermal barriers, resulting in a seal LOCA. Both charging pumps fail I7

Table I.3.2. Zion Dominant Accident Sequences i

Rank Cequence Frequency (yr-1) Damage State New Zion Review New Review New Review 1 1 CCW Failure, causing failure of all 1.2E-4 2.0E-4 SEFC SEFC charging and SI pumps, seal LOCA 2 5 Small LOCA; failure of recirculation 1.6E-5 1.6E-5 SLFC SLF

! 3 9 Large LOCA, failure of recirculation 4.9E-6 4.9E-6 ALFC ALP 1

cooling i

j 4 10 Medium LOCA, failure of recirculation 4.9E-6 4.9E-6 ALc'C ALF cooling

$ g 5 14 Loss of offsite power; failure of AFWS 2.lE-6 1.0E-6 TEFC TEFC 8

failure of feed and bleed; failure to restore AC power in 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months (recovery i prior to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months ) i 6 12 Large LOCA: failure of low pressure 1.4E-6 1.4E-6 AEFC AEFC injection 7 13 Loss of offsite power; failure of AFWS 5.7E-7 1.lE-6 TEFC TEFC failure of feed and bleed; failure to restore AC power in 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months (recovered by a hours)

, 8 3 Loss of offsite power; CCW/SWS loss. 3.2E-7 4.OE-5 SEFC SEFC l failure to recover AC power in 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months (recovery _ prior to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months ) 9 -

Same as sequence 8, only this repre- 3.0E-7 -

SE -

sents the SWS common mode portion of i the rebaselined Zion Review sequence No. 3 s

Table I.3.2. Zion Dominant Accident Sequences (Continued)

Rank Sequence Frequency (yr-1) Damage State New Zion Review New Review New Review 10 11 Loss of offsite power: CCW/SWS loss: 2.lE-7 4.7E-6 SE SE failure to restore AC power in 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months failure of containment sprays and fan coolers 11 2 Loss of offsite power: CCW/SWS loss; 1.5E-7 4.6E-5 SEFC SEFC failure to restore AC power in 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months (recovery prior to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months ) 12 - Loss of offsite power, failure of SWS: 1.5E-7 -

SE -

failure to restore AC power in 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months .

This sequence represents the SWS 7 portions of the rebaselined Zion

Review Sequence No. 4 and No. 6 13 4 Same as sequence 12 above, only this 1.0E-7 1.8E-5 SEC 'SEC is the CCW portion of the rebaselined Zion Review sequence No. 4 14 -

Interfacing Systems LOCA 1.0E-7 1.0E-7 V V 15 7 Failure of DC bus 112, causing loss 5.0E-8 7.0E-6 TEFC TEFC of one PORV and loss of AC bus 148, failure of Auxiliary Feedwater 16 -

Same as sequence ll, only this repre- 4.8E-8 -

SE -

sents the SWS common mode portion of the rebaselined Zion Review sequence No. 2 17 6 Loss of offsite power: CCW failure 3.7E-8 8.0E-6 SEFC SEFC failure to recover AC power in 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months

Table I.3.3. Sensitivity Results Base Case Sensitivity Range

Sequence Frequency Damage Stato Best Case Worst Case 1 1.2E-4 SEFC 5.5E-6 1.2E-4 2 1.6E-5 SLFC 8.1E-6 2.9E-5 3 4.9E-6 ALFC 5.lE-7 1.7E-5 4 4.9E-6 ALFC 5.lE-7 1.7E-5 5 2.lE-6 TEFC 2.lE-6 2.lE-6 6 1.4E-6 AEFC 1.4E-6 1.4E-6 7 5.7E-7 TEFC 4.6E-7 5.7E-7 8 3.2E-7 SEFC 1.6E-7 8.4E-7 9 3.0E-7 SE 4.0E-ll 3.0E-7 10 2.lE-7 SE 2.8E-8 2.1E-7 11 1.5E-7 SEFC 1.2E-7 1.5E-6 12 1.5E-7 SE 1.2E-7 1.5E-6 13 1.0E-7 SEC 1.0E-7 1.0E-7 14 1.0E-7 V 1.0E-7 1.0E-7 15 5.OE-8 TEFC 5.OE-8 5.0E-8 16 4.8E-8 SE 3.8E-ll 4.8E-8 17 3.7E-8 SEFC . 7.9E-9 3.7E-8 1.5E-4

The best case and worst case values should not be summed across all sequences to yield a sensitivity range of the total core damage frequency. The sensitivity issues were analyzed individually for each sequence. An overall best or worst case scenario, combining several issues across all the sequence models, was not hypothesized.

I-10

due to loss of CCWS, as do the two safety injection pumps when they are actuated in response to low reactor pressure.

Containment cooling systems remain functional, but core damage results due to inability to replace primary coolant. This sequence is placed in plant damage state SEFC.

.The dominant contributor to loss of CCWS is pipe rupture in the CCWS.

Sequence 2 - Small LOCA, failure of recirculation cooling This sequence represents a small LOCA (<2 inches) followed by failure of the recirculation system to provide high pressure coolant injection into the primary system. The dominant contributor to loss of recirculation is human error in switching the low pressure pump suction lines over from injection alignment to recirculation alignment. The HPIS (composed of both the charging pumps and safety injection pumps) takes suction from the low pressure pumps. Containment systems remain functional. This sequence is placed in the

-plant damage state SLFC.

Sequence 3 - Large LOCA, failure of recirculation cooling This sequence represents a large LOCA (>6 inches), followed by failure of the low pressure system to provide coolant injection into the primary system. The dominant contributor to loss of recirculation cooling is human error in realigning the low pressure injection system (LPIS) suction valves from injection to recirculation alignment. Containment systems remain functional. This sequence is placed in damage state ALFC.

Sequence 4 - Medium LOCA, failure of recirculation cooling The sequence model for this sequence is exactly the same as that for sequence 3, except that the initiator is a medium LOCA (2 to 6 inches).

Sequence 5 - Loss of offsite power; failure of AFWS; failure of feed and bleed; failure to restore AC power in one hour (recovery prior to four hours)

In this sequence, the initiating event, loss of offsite power, is followed by loss of auxiliary feedwater and loss of feed and bleed capability, with failure to restore power in one hour.

The loss of auxiliary feedwater eliminates the capability for secondary cooling, since without offsite power, the main feedwater pumps have tripped and cannot be restored. The loss of feed and bleed capability removes the remaining option for core cooling. Therefore, core cooling will not occur. The dominant contributors to this sequence are failure of the AFWS turbine-driven pump and diesel generators.

1-11

Containment systems success is ensured by successful !

restoration of AC within four hours. This sequence is placed I in damage state TEFC.

Sequence 6 - Large LOCA, failure of low pressure injection l cooling This sequence represents a large LOCA followed by failure of the LPIS to provide injection coolant. The primary contributor is human error in leaving certain MOVs closed after testing the LPIS. Containment systems remain functional. This sequence is placed in plant damage state AELC.

Sequence 7 - Loss of offsite power; failure of AFWS; failure of feed and bleed; failure to restore AC power in four hours (recovered by eight hours)

This sequence represents a set of events similar to sequence 5, except that successful restoration of AC power occurs at a later time, between four and eight hours after the initiation of the sequence. This sequence is placed in damage state TEFC.

Senance 8 - Loss of offsite power; CCW/SWS loss, failure to re,over AC power in one hour (recovery prior to four hours)

This sequence represents a loss of offsite power, followed by failure of the CCWS, either directly due to random failures, or indirectly due to a combination of loss of AC power and SWS*

pumps. Failure of the CCWS results in failure of the RCP thermal barrier cooling and a seal LOCA, and loss of all HPIS capabilities, as with sequence 1. Dominant contributors are hardware and maintenance failures in the CCWS, SWS, and emergency diesel generators. The containment systems and SWS are restored to service when AC power is restored. Although the CCWS may be restored as well, core damage has already occurred. This sequence is placed in damage state SEFC.

Sequence 9 - Same as sequence 8 only this represents the SWS common-mode portion of the Zion Review sequence No. 3 In ?

, rebaseline .inalysis, the contribution of SWS to core damage became significant relevant to the contribution of CCWS. In the Zion Review and ZPSS, this was not the case, and outcomes due to nonrecoverable failures of the SWS were not important. This sequence represents a similar set of events as in sequence 8, except that the onset of the seal LOCA and HPIS failure is caused by loss of CCWS due to nonrecoverable faults in the SWS (predominantly SWS pump common mode). The permanent loss of SWS also fails the containment systems, resulting in a plant damage state of SE. This sequence was essentially " split apart" from sequence 8 when it was reevaluated, explicitly modeling the SWS failures separately from the CCWS failures.

! I-12

Sequence 10 - Loss of offsite power CCW/SWS loss; failure to restore AC power in eight hours; failure of containment sprays and fan coolers This sequence represents a set of events similar to sequence 8 except that AC power is not restored within eight hours after the sequence is initiated. The Zion Review and ZPSS gave no credit for containment systems if they could not be restored within eight hours. This sequence is placed in damage state SE.

Sequence 11 - Loss of offsite power CCW/SWS loss; failure to restore AC power in four hours (recovery prior to eight hours)

This sequence represents a set of events similar to sequence 3, l except that AC power is restored within a later time frame, l four to eight hours after sequence initiation. This sequence is in plant damage state SEFC.

Sequence 12 - Loss of offsite power, failure of SWS: failure to restore AC power in eight hours. This sequence represents the SWS portions of the rebaselined Zion Review sequences No. 4 and No. 6 This sequence represents a set of events similar to sequence 10, except that loss of RCP seal thermal barrier cooling, and hence the cause of the seal LOCA, is failure of the CCWS due to loss of the SWS. This sequence represents portions of sequences 13 and 17 which were " split apart" when these sequences were reevaluated using new unavailabilities for the CCWS and SWS. In the Zion Review, SWS failure was not significant relative to CCWS failure. In the rebaseline, it is, so contribution to core damage due to nonrecoverable SWS failure must be segregated from core damago due to CCWS, since these two contributors yield different plant damage states.

This sequence is placed in damage state SE.

Sequence 13 - Same as sequence 12 above, only this is the CCW portion of the Zion Review sequence No. 4, and containment fans fail. As discussed above, this sequence represents a set of similar events similar to sequence 12, except that containment fan failure is explicitly included here. In sequence 12, the fans fail due to loss of SWS cooling to the air chillers. The dominant cause of fan failure here is loss of two out of three AC buses at Unit 1 due to random failures in the diesel generators. This sequence is placed in plant damage state SEC.

Sequence 14 - Interfacing Systems LOCA This sequence represents a combined rupture of two MOVs in the RHR which isolate low pressure piping from high pressure piping. A containment bypass path results. This sequence is placed in plant damage state V.

i 1-13

Sequence 15 - Failure of DC bus 112, loss of two PORVs and loss of AC bus 148, failure of Auxiliary Feedwater The sequence of interest in this case is failure of DC bus 112, loss of main feedwater, reactor trip, loss of auxiliary feedwater, and failure of feed and bleed capability due to loss of the PORVs. The containment systems are functional. This sequence is placed in plant damage state TEFC.

Sequence 16 - Same as sequenco 11, only this represents the SWS common-mode portion of the Zion Review sequence No. 2 This sequence represents that portion of sequence 11 " split l apart" from the sequence model when it was reevaluated using j new unavailabilities for the CCWS and SWS. SWS failure becomes important relative to CCWS failure. Nontecoverable SWS failures must be segregated from nonrecoverable SWS failures and CCWS faults, since nonrecovered failure of the SWS results in damage state SE.

Sequence 17 - Loss of offsite power: CCW failure; failure to recover AC power in eight hours: success of containment systems This sequence represents a set of events leading to core damage due to an RCP seal LOCA and loss of HPIS similar to sequence

8. A significant difference to sequence 8 is that here, AC power is not restored within eight hours after initiation of the sequence. Furthermore, only the CCWS fails, not the SWS.

Containment systems are available because the degradation of AC power in this sequence is not sufficient to significantly weaken those systems. This sequence is placed in plant damage state SEFC.

I.4 CONCLUSIONS AND RECOMMENDATIONS Understanding of reactor operation and safety has improved, even in the relatively short time between the Zion Review and the present analysis. Furthermore, Commonwealth Edison, operator of the Zion station, has responded to several reactor safety issues brought out in the Zion Review. However, while some of the individual sequence frequencies have changed significantly, the total core damage frequencies calculated by the two analyses differ by less than a factor of two.

Significant differences and similarities between this study and the Zion Review are summarized below:

e Seal LOCA sequences are the most dominant contributor to core damage in both studies.

e Loss of CCWS is the most important initiator in both studies.

l I-14

e Loss of offsite power sequences, which include failure of the CCWS in degraded power conditions, are less important in the rebaseline than in the Zion Review due to a less stringent success criterion in the CCWS.

LOCAs followed by loss of recirculation cooling accident sequences do not change in frequency. These sequences become relatively more important to total core damage frequency in the rebas eli ne analysis than

in. the Zion Review, due to the lower rebaseline frequencies of loss of offsite power sequences.

Certain sequences involving loss of all secondary heat removal were reduced in frequency significantly due to changes in the success criterion for PORVs used in feed and bleed cooling mode. The Zion Review assumed 2 of 2 PORVs were needed. The rebaseline assumes 1 of 2 is necessary. This tended to drive down the frequencies of these sequences. However, these sequence models also include success of the CCHS. As the CCWS reliability is improved. in the present analysis, one sequence of this type actually increased in frequency.

1.4.1 Specific Plant Damage State Conclusions Of the eight plant damage states relevant to the dominant accident sequences, two states involve core damage with no containment cooling protection or radioactivity removal. These states and their frequencies are: 1) SE -- 7.OE-7, and 2) V

-- 1.0E-7. These . damage states may be high in potential consequences due to the lack of containment protection. The other six damage states involve success of at least one containment cooling system. These damage states and their frequencies are:

Damage State Frequency (Yr-1)

SEFC 1.2E-4 TEFC 2.6E-6 AEFC 1.4E-6 SEC 1.0E-7 ALFC 1.0E-5 SLFC 1.6E-5 1.4.2 Specific Sequence conclusions The seventeen sequences analyzed in the rebaseline analysi', can be grouped as follows:

1-15

1) Nine sequences involved complete loss of the CCWS with subsequent seal LOCA. One of these sequences, sequence 1, involves loss of CCWS as the initiator, and it accounts for 80% of- the total core damage frequency. The other l sequences are negligible compared to this sequence.. Those sequences differ from sequence 1 primarily in that .their initiator is loss of offsite power, and failure of the CCWS is_ enhanced by partial or complete loss of AC power to the CCWS.

2) Three sequences are either small, medium, or large LOCAs with failure of core cooling in the recirculation mode.

These sequences contribute 17% to total core damage frequency.

4

3) Three sequences involve total loss of secondary heat

removal and failure of feed and bleed cooling mode. These 4

sequences contribute 2% to total core damage frequency.

4) One sequence involves a large LOCA, followed by failure of low pressure injection cooling. This sequence contributes 1% to total core damage frequency.

l

5) The interfacing systems LOCA sequence contributes less than

0.1% to total core damage frequency.

Approximately 80% of the core damage frequency is related to assumptions and issues involving the seal LOCA failure model and the CCWS failure model. Resolution of issues which change failure mode probabilities in these models

could change the total core damage frequency significantly.

1.4.3 S_ensitivity Conclusions As discussed in Section 1.3.1, uncertainty analyses were not i performed on the Zion accident sequence models, as these models

are not of a nature that facilitates statistical uncertainty j analysis. The sensitivity effects on the total core damage frequency were small, with one exception. Only the sensitivity on CCWS pipe rupture frequency significantly affected total core damage frequency, driving the total core damage estimate i from 1.2E-4 to 3.6E-5. This sensitivity affects a sequence which accounts for 80% of the base case frequency. Some of th'e i

plant damage state frequencies are aftected tremendously by certain sensitivities. There are two reasons for this: 1) some plant damage states are dominated by a single sequence, and 2) certain sensitivities investigate possible reclassification of sequences into different plant damage states other than their base case classification.

Sensitivity issues were analyzed individually to ascertain the significance of each issue to the core damage frequency estimate of each sequence and the plant total. Overall, best I-16 i

I

J I

e

)

! or worst case scenarios, involving a set of several sensitivity 1 conditions all assumed to exit 'cogether, were not analyzed.

J l'

t h

4 4

4 i

t-(

i f

i t

i d

)

I

' I-17 I

II. PROGRAM SCOPE AND LIMITATIONS The objective of this study is to perform an analysis that updated the previous Zion analyses, particularly the Zion Review (NUREG/CR-3300), so that the current estimate of the risk profile for Zion would incorporate the most important PRA issues and plant changes that have arisen since the Zion Review. Whereas a typical level 1 PRA requires 16 months, this analysis represents an enlightened reevaluation of the Zion risk profile in three months, with considerable restrictions on manpower and access to plant personnel and information. To give the reader an idea of the scope of this work, a typical list of PRA tasks is present below. A brief description of the effort of this analysis for each task is given.

1) Initial Information Collection --

No plant visit was included in this study. Contact with personnel at Zion was restricted to limited telephone conversations. This analysis primarily reevaluated the Zion risk profile set forth in the Zion Review, using the models of the Zion Review. Our information collection was limited to identifying issues and plant changes which might affect the Zion Review estimates. There were four primar sources of information: 1) The Zion Review itself,{

which identified many issues wherein the analysts disagreed with the ZPSS: 2) the NRR Staff Report on Zion of August 1, 1986.2 which identified several areas of concern which the NRR staff felt were either excluded from the Zion Review or were no longer relevant to Zion:

3) the other NUREG-1150 reference plant analyses; and

4) a letter from Dave Kunsman of Sandia National Laboratories to Scott Newberry, then of the Risk and Reliability Branch, NRR, dated July 9, 1984.3 Reference 3 was a reevaluation of the Zion Review's dominant accident sequences based on a more realistic CCWS pump success criterion than was used in the Zion Review. These four sources, in conjunction with limited telephone conversations with Zion personnel, were used to enhance our knowledge of the current status of Zion station.

2) Initiating Event Identification -- No effort was made to expand upon the initiating events identified in the Zion Review dominant sequences.

3) Event Tree Development -- No new event tree analysis was performed, nor were the existing event trees of the ZPSS (which were used in the Zion Review) reevaluated to investigate potentially new dominant accident sequences.

4) System Modeling -- With the exception of Reference 3 the system models of the Zion Review were used here. Only minor changcs or requantification, where appropriate, were done.

II-l

5) Analysis of Dependent Failures -- It was not possible to apply Beta factors for common-cause events to sequence cut sets, as was done in the other NUREG-ll50 reference plant analyses due to the nature of the ZPSS sequence models.

However, the nature of the CCWS and SWS models developed in Reference.3 were such that the NUREG-ll50 Beta factors for CCWS and SWS pumps, and diesel generators were applied to these models.

6) Human Reliability Analysis (HRA) -- No HRA was performed as part of the rebaseline. Human error values in the Zion Review models were not changed.

7) . 3ta Base Development -- The Zion Review and ZPSS used extensive plant-specific data. For this reason, the NUREG-1150 generic data base was not used in the Zion models. Furthermore, no attempt to update the Zion plant-specific data was made.

8) Accident Sequence Quantification --

The same sequence quantification methods used in the Zion Review were used here.

9) Physical Process of Reactor Meltdown Accidents --

No changes were made from the Zion Review.

10) Radionuclide Release and Transport -- This was handled by the NUREG-ll50 consequence analysis and is beyond the scope of this study.

11) Environmental Transport and Consequence Analysis -- This was handled by the NUREG-ll50 conscquence analysis and is beyond the scope of this study.

12) Seismic Risk Analysis -- This is outside the present scope.

13) Fire Risk Analysis -- This is outside the present scope.

14) Flood Risk Analysis -- This is outside the present scope.

15) Other External Hazards (e.g., Tornadoes) --

This is outside the present scope.

16) Treatment of Uncertainties --

Statistical uncertainties were not treated here, as they were not in the Zion Review, because of the nature of the Zion accident sequence models.

In addition to the comparison of our analysis to a state-of-the-art PRA, we felt that it would be helpful to identify some things that PRAs don't normally treat. The following list of items not normally treated in PRAs is reprinted from NUREG-lll5.

II-2

Partial Failures Design Adequacy Adequacy of Test and Maintenance Practices Effect of Aging on Component Reliability (also burn-in phenomena)

Adequacy of Equipment Qualification Equipment Operability in Sequence Environment Diagnostic Human Errors Environmentally-Related Common Cause Similar Parts-Related Common Cause Sabotage Long-Term Accident Response (beyond approximately 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months )

Innovative Operator Accident Response Actions Effects of Training and Operator Experience / Conditioning on Operator Response II-3

III. PROGRAM REVIEW III.1 NUREG/CR-4550 PROGRAM REVIEW To ensure the quality of the NUREG/CR-4550 work, the other reference plant analyses were subjected to several review groups. Because the scope and nature of the Zion analysis was so different compared to the other plant analyses, it was felt that review of the Zion rebaseline would best be served by having people extremely familiar to the methods of the Zion Review and ZPSS review the work. For that reason, two people who were very fundamental to the Zion Review Analysis. David Kunsman and Gregory Kolb (a member of both the NUREG/CR-4550 Senior Consultant Group and the Quality Control Group) reviewed this analysis. Other organizations involved in reviewing this analysis include the NRC (Divisions of Nuclear Regulatory Research and Nuclear Reactor Regulation), Brookhaven National Laboratories (Robert Youngblood), and Commonwealth Edison.

Comments and concerns of the above parties were either resolved or incorporated into the final documentation.

I III-l

IV. TASK DESCRIPTIONS IV.1 REBASELINE TASKS The following list delineates the basic tasks undertaken in this analysis.

1. Review of Zion risk studies for background on Rebaseline Issues e Zion Probabilistic Safety Study (ZPSS) e Review and Evaluation of the ZPSS (NUREG-3300)

The USNRC/NRR Staff Report on Zion, August 1985

2. Definition of Rebaseline Issues

3. Requantification of SWS and CCWS Failure Probability

4. Incorporation of Certain NUREG/CR-4550 Methods into Zion Review Methods e Recovery of AC power e Limited application of common mode events e Reactor Coolant Pump Seal LOCA Model

5. Accident Sequence Frequency Rebaseline

6. Sensitivity Analysis IV.2 REVIEW OF ZION RISK STUDIES FOR BACKGROUND ON REBASELINE ISSUES The ZPSS, Zion Review, and the USNRC/NRR Staff Report on Zion 5 were reviewed to gather information on plant changes and PRA issues which might affect the tisk profile for Zion.

Reference 5 was especially useful, as this document illustrated many of the NRC's concerns and opinions about issues or plant changes at Zion which might affect our understanding of Zion's risk profile. The Zion Review also had several issues which were addressed as sensitivity issues. As knowledge of Zion has changed since the publishing of the Zion Review or as changes at Zion occurred in response to the Zion Review, some of its sensitivities are now relevant to Zion's base case risk profile. Reference 3 was also used in preparing the set of issues incorporated into the rebaseline.

IV.3 DEFINITION OF REBASELINE ISSUES A list of eleven issues

relevant to the Zion risk profile was considered for incorporation into the rebaseline of the Zion Review base case estimate. These issues are defined and discussed below.

IV-1

IV.3.1 CCWS and SWS Pump Success Criteria In the Zion Review, it was assumed that two of five CCWS pumps must succeed for the systems to function properly, and that two of six SWS pumps were needed. The NRR Staff state in the Staff Report on Zion that an adequate CCW criterion is one of five pumps, while SWS success remains two of six pumps. This is put forth in a memorandum from R. Mattson (NRC) to T. Speis, NRC, August 16, 1983.6 In Reference 3, the sequence frequencies were reestimated with this new success criterion. In the Zion Review. SWS failure was not included in the dominant sequence models because they were quantitatively insignificant with respect to CCW failure. With the new success criterion, SWS becomes important relative to CCW. Although certain sequence estimates decrease due to improved CCW reliability, the relative importance of SWS can affect the plant damage status for some sequences.

spray injection, SWS failure will fail containment fans and whereas CCW failure will not. For this analysis, the sequence equations in Kunsman's letter were requantified, factoring the SWS terms from the CCW terms to determine the impact on plant damage states.

IV.3.2 Common-Cause Failures CCW, SWS, and Unit 2 diesel generator common mode failures were not incorporated into the models in the Zion Review, ZPSS, or Reference 3. These events were included here for two reasons;

1) to bring as much consistency as poss -le between the Zion work and the other NUREG/CR-4550 plant analyses, and 2) the coherent and detailed nature of the equations in Reference 3 permitted easy application of the common mode analysis to the Zion models. No other Zion systems were modified to match our common cause analysis. The method of system failure quantification in the ZPSS and Zion Review is highly complex.

Common cause failures in the Zion models cannot be requantified by simply changing the value of a common cause event in a system model. The Zion common cause quantification is highly intertwined with the method of modeling systems for various electric power configurations at the plant. System failures j

are calculated as conditional probabilities given each electric power state. The ZPSS and Zion Review common cause values are incorporated into the calculation of the probabilities for the various electric power states. To unravel these models and incorporate the Beta factors used in the other NUREG/CR-4550 analyses would be extremely difficult.

The NUREG/CR-4550 common-cause Beta factors that were included in the Zion rebaseline (CCW, SWS, Unit 2 diesel generatora) come from EPRI NP-3967,4 otherwise known as the Fleming Report. In the other NUREG/CR-4550 analyses, it was assumed that the Fleming Beta factors represent .95 quantiles of log-normally distributed random variables. For their base case analyses, slightly lower values for the Beta factors -

IV-2

representing means of the random variables -

were- used.

Because the Zion analysis.was completed before the other plant analyses had developed a consensus on Beta factors, the Fleming Beta factors.were applied directly to Zion's base case study. .

No distribution was assumed for the Beta factors, but a i

sensitivity analysis was done on .the Beta factors to evaluate I

the maximum and minimum potential impact of the NUREG/CR-4550 Beta factors on the risk profile.

1 l

A.special point needs to be discussed here regarding the diesel generator ' common mode event. This failure was not modeled across Units 1 and 2. It was modeled only for the two diesel generators dedicated to Unit 2, and only as a failure mode in the CCW and SWS models. These generators power certain SWS and CCWS pumps (these two systems are shared by Units 1 . a nd 2).

Recall that the ZPSS sequence analysis method analyzed each sequence within the coatext of eight electrical power states for Zion Unit 1. As stated above, Unit 1 diesel generator common mode failures are embedded in the electric . power state models, and to unravel the ZPSS analysis and include our common mode events in the electric power state models would be extremely complicated. Furthermore, there is an argument for decoupling Units 1 and 2 diesel generator common mode fa'ilures. Major maintenance for the dedicated diesel generators is performed when the respective units are down for refueling. Thus, the major maintenance activities are significantly staggered for the dedicated diesel generators.

IV.3.3 Restoration of AC Power Failure to restore offsite power was adjusted in the sequence models to reflect changes in the generic power recovery models since the time of the Zion Review. In addition, failure to restore a diesel generator was also added to sequence models.

This recovery event was not included in the Zion Review or the

-ZPSS sequence models. Values for failure to restore offsite power and diesel generators are from the NUREG/CR-4550 generic data base.

IV.3.4 Feed and Bleed Conversations with Commonwealth Edison personnel confirm that procedures for feed and bleed are in place. Furthermore, the lift settings for the safety relief valves (2435 psig) may be sufficiently below the maximum discharge head of the two 550-gpm charging pumps (2670 psig) to allow sufficient feed and bleed capability without any PORVs. The Zion Review assumed both PORVs were necessary. As a conservatism, it was assumed here that at least one PORV is needed to sufficiently depressurize the vessel and permit significant injection from the charging or safety injection pumps. Even with this conservative assumption in regard to PORVs, improved feed and bleed capability at Zion significantly reduces the sequence frequencies involving loss of feed and bleed.

f IV-3

IV.3.5 Refueling Water Storage Tank (RWST) Refill Procedures are now in place at Zion to refill the RWST should the operator perceive a need to do so. The Zion Review took no credit for this because no such procedures were in place at the time. This affects the plant damage state classifications for certain sequences, but not the core damage frequencies (containment spray injection could be continued as a replacement of failed containment spray recirculation cooling throughout an accident sequence if RWST is replenished). This issue is also included in the sensitivity analysis to illustrate the potential range of plant damage state frequencies depending on whether the RWST can or cannot be replenished.

IV.3.6 Reactor Coolant Pump Seal LOCA The question of how quickly and how large a seal LOCA will develop upon loss of CCW cooling to the seals remains ar issue of debate. The NRR Staff Report identifies this issue as a potential conservatism in the Zion Review. In the Zion Review and the ZPSS, it was assumed that a 300 gpm leak per pump would develop within one hour if CCWS flow to the RCP seals is lost.

The NUREG/CR-4550 RCP seal LOCA model is a time-dependent model with a 5% confidence limit at I hour and 95% confidence limit at 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months . Although the distribution is for a single RCP seal, it is assumed in the sequence models that all RCP seals fail simultaneously. Each RCP seal LOCA is assumed to result in a 450 gpm leak, for a total seal LOCA of 1800 gpm at Zion.

Although this leak rate is larger than that assumed in the Review, this is still within the range of a small LOCA, so there is no impact on plant damage state classification due to the new RCP seal LOCA model. Once a seal LOCA occurs, it is assumed that the core will not become uncovered for 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months without injection to the primary system. This allows for an extra hour for recovery of AC power in sequences involving Loss of Offsite Power transients where high pressure injection is l lost due to degraded of AC power. In certain cases where there j is no possibility of restoring cooling to the RCP seals, this sensitivity issue is not relevant. An example of such a case is Sequence 1. Failure of the CCWS due to pipe rupture is considered to be nonrecoverable before the core becomes uncovered even for the best case RCP seal LOCA model. Thus, it is not important wMcher the seals fail within one hour or ten hours after loss of cooling - if the CCW cooling to the seals can not be restored, the seals fail with probability 1.0.

I IV.3.7 Manual Switchover to Recirculation Cooling Discussions with Commonwealth Edison staff did not disclose any information to suggest improved reliability in the human actions necessary to switch ECCS over to recirculation mode.

No changes in the recirculation cooling models were made.

IV-4 i

i l _ _

However, as a sensitivity, worst and best case estimates for human actions in switchover to recirculation were investigated.

IV.3.8 Recovery of CCWS Pipe Ruptures Although there are procedures at Zion to isolate pipe leaks in the CCWS, discussions with Commonwealth Edison staff indicate that the capability of' isolating such leaks in a timely fashion could be highly dependent on the nature of an individual pipe leak. There 'are no data available to generate a statistical distribution on this recovery action. The Zion Review did allow credit for recovery of CCW pipe leaks based on the fact that Zion has such procedures in place. Due to the limitations of this rebaselining, the Zion Review assumptions were retained here. The frequency of CCW pipe rupture is also treated as a sensitivity issue.

IV.3.9 RHR System Check Valve Testino It is required by the NRC that the RHR check valve disks at Zion be tested for integrity every refueling shutdown and cold shutdown. It is estimated by the NRR staff in Reference 5 that absence of such testing would result in an interfacing systems LOCA frequency of IE-6, an order of magnitude larger than was estimated in the ZPSS and Zion review. Those two studies assumed such testing was in place at Zion, while in fact it was not. Zion station has confirmed that it is testing the RHR check valves in . compliance with the Confirmatory Order. The interfacing systems LOCA analysis of the Zion Review is, therefore, an appropriate study of Zion.

IV.3.10 Diesel Driven Containment Spray Pump Zion's one diesel driven containment spray pump still has an indirect AC power dependency due to its need for SWS cooling water. The NRR Staff Report suggests that modifying one or more of the containment sprays pumps to be completely AC independent could significantly reduce the risk after core melt. Since such modifications are not currently planned by the Utility, this issue is not applied to our Zion point estimate rebaselining. However, the impact of this issue on plant damage state frequencies is included as a sensitivity for insights.

IV.3.11 Common Cause Failure of the AFWS Due to Steam Binding The potential common mode failure of the AFWS due to steam binding of the pumps was investigated for the PWR reference plant analyses. If steam leaks through check valves from the main steam lines into the AFWS pumps, pump failure could occur upon actuation of the pumps. A potential common failure mode exists if the AFWS pump discharge lines are crosstied. While f the configuration of the Zion AFWS in the ZPSS shows crossties IV-5 l

between the AFWS trains, it is not clear how many check valves in the AFWS discharge lines are designed as steam seals. This is an important variable in the probability model of steam binding. Both the Surry and Sequoyah steam binding analyses encountered other important plant-specific features besides l AFWS configuration. For example, Surry has procedures to check the AFWS each shift for possible steam leakage back into the AFWS pumps. Sequoyah has closed MOVs in the AFWS discharge lines, whereas Surry has check valves in the AFWS discharge lines in line with open MOVs. These check valves are not designed specifically as isolation valves. Surry used a mean failure probability of 1.0E-4; Sequoyah used a value of 1.0E-5. So plant-specific considerations are important to this issue. The limitations imposed on the Zion rebaseline did not permit us to procure and carefully review up-to-date AFWS drawings and procedures, so it is not possible to judge whether or not steam binding is relevant at Zion. It is possible to roughly estimate the potential impact of steam binding on the Zion AFWS failure model. The unavailability for the AFWS was

, calculated in the ZPSS to be 3.4E-5 if there is power on all AC j buses. The probability of failure increases for degraded power states, up to 3.9E-2 for no AC power at Unit 1. If the generic value for steam binding is used, 1.0E-5, it is seen that addition of this failure mode to the AFWS model would increase

! system unavailability by approximately 30% for the power state l wheLe there is AC power on all three emergency buses. Its contribution would be insignificant for the degraded power i states. Because the potential contribution of steam binding i appears to be very low, and because the nature of the event necessitates a level of plant-specific analysis not available to us, it was not included in the rebaseline analysis.

i IV.4 SYSTEMS ANALYSIS l

As stated earlier, system models were not developed for the rebaseline analysis. Almost all system models used here are the same models used in the Zion Review and the ZPSS.

Descriptions of front line safety systems and support systems can be found in Section 2.0 of the Zion Review and Volume III of the ZPSS. The exceptions to the use of Zion Review system models are the CCWS and SWS. The models for these systems were reconstructed during 1984 when Sandia National Laboratories was asked to reevaluate the Zion Review dominant sequences based on a more reliable CCWS pump success criterion than was used in the Zion Review. The models developed for this reevaluation of CCWS success criterion explicitly modeled SWS failure as a contributor to CCWS failure. The Zion Review did not include SWS because it was insignificant compared to CCWS faults.

However, the new CCWS model did not distinguish as to whether CCWS was directly due to CCWS failure or indirectly due to SWS fallure. The distinction is important because loss of CCWS will not fail containment cooling systems, but loss of SWS will. So the resulting plant damage state of a sequence with IV-6

failure of the CCWS can be different than one with failure of the SWS. Furthermore, common cause failures of the CCWS and SWS pumps, and Unit 2 diesel generators (certain CCWS and SWS pumps are powered off Unit 2 emergency power) were not included in the Zion Review or the new CCWS model. So the model developed to reevaluate the new CCWS success criterion was altered so that sequence models would explicitly show either loss of CCWS or loss of SWS and to include common mode failure of the pumps and Unit 2 diesel generators.

IV.4.1 Service Water and Component Cooling Water System Unavailabilities The rebaseline analysis incorporates different CCWS pump success criterion than did the Zion Review. The rebaseline analysis assumes that 1 of 5 CCWS pumps and 2 of 6 SWS pumps are needed for successful operation of the respective systems.

The Zion Review used 2 of 5 and 2 of 6 for success criteria of these systems. The NUREG-ll50 rebaseline system models are essentially the same models used in Reference 3. The SWS and CCWS models differ only slightly from the models in Reference

3. The rebaseline models include pump and diesel generator common mode events consistent with the NUREG-ll50 common mode ana'ysis.

s The models in Reference 3 have no such events.

Anothe* distinction is that, in Reference 3, quantification of system t'ailure did not distinguish between loss of SWS and loss of CCWS, while the rebaseline model does. The following discussion on system unavailability quantification is based directly on the content of Reference 3.

System Unavailabilities The scenario for which these unavailabilities are calculated is loss of offsite power followed by failure of either the CCW system (one pump criterion) or the SW system (two pump criterion). The systems can fail indigenously or by not having electric power. At this point, it is helpful to recall the configuration of the emergency power system at Zion Units 1 and 2 with respect to the CCWS and SWS.

DGlB DGlA DGO DG2A DG2B l l 1 I I BUS 149 BUS 148 BUS 147 BUS 247 BUS 248 BUS 249

_, i '

CCWP SWP CCWP SWP CCWP S'WP SWP CCWP SWP CCWP SWP DGO is a " swing" diesel generator. As calculated in Section 2.4.1.1 of the Review, 90% of the time that BUS 147 is unavailable, DGO will be powering BUS 247. The other l ot, of the time that BUS 147 is unavailable, DGO itself has failed so BUS 247 is unavailable as well. Furthermore, it is important to note that five of the six buses can power both a CCW and a SW pump. BUS 247, however, has no CCW pump.

IV-7

The data used in calculating the unavailabilitics are taken from the ZPSS. The data, and the event nomenclature for the following equations are:

Diesel Generator Fails to Start and Run for One Hour DGF = 0.018 Diesel Generator in Maintenance DGM = 0.034 Service Water Pump Fails to Start SWF = 7.2 E-4

Service Water Pump in Maintenance SWM = 2.3E-3 l Component Cooling Water Pump Fails to Start CCWF = 7.2 E-4 Component Cooling Water Pump in Maintenance CCWM = 0.032 Two Component Cooling Water Pumps in Maintenance CCW2M = 7.7E-3 Unit 2 Diesel Generator Common Mode DGCM = 9.0 E-4 Service Water Pump Common Mode SWCM = 2.5 E-5 Component Cooling Water Pump Common Mode CCCM = 2.5 E-5 There are four cases, or electrical power configurations, for which SWS and CCWS unavailabilities must be calculated: 1) no power available at Unit 1: 2) one bus available at Unit 1: 3) two buses available at Unit 1; and 4) three buses available at Unit 1. The first three cases need to be subdivided according to the availability and the alignment of DGO.

The first term in each of the following equations represents the conditional unavailability of SWS given each power I

configuration - loss of SWS will always fail the CCWS. The second term of the equation represents the conditional unavailability of the CCWS. The unavailability of the SWS is then summed with that of the CCWS. So, for each power con-figuration below, there are three values; SWS unavailability, CCWS unavailability, and a total unavailability. The total unavailability represents, in effect, the total CCWS value inclusive of support failures (electrical power and SWS).

There are situations in the Zion accident sequence models where it is important to distinguish between whether CCWS or SWS has failed. For example, if an RCP seal LOCA results due to direct failure of the CCWS, the containment systems would still be functional. However, if the seal LOCA results from loss of CCWS due to SWS failure, the containment systems would not be operable. In other situations, such as loss of offsite power, loss of emergency AC power followed by successful restoration of AC power, it is not important as to which system, CCWS or SWS, fails if the systems are restored by the recovery of AC power. Note that in the models below, virtually all the failure terms involved at least partial system failure due to degraded AC power. Therefore, the system unavailabilities are used three different ways in the Zion sequence models, SWS failure only, CCW failure only, or the total failure unavailability.

IV-8

Case 1: No buses available at Unit 1 Case la: 10% of the time there are, at mcst, 2 buses available at Unit 2 because DGO itself has failed.

Eq. la: =

0.1[2(DGF+DGM) + 2(SWF+SWM) + SWCM+DGCM] +

2 0.1[CCWF +2xCCWFxCCWM+CCW2M+CCCM]

= 1.2E-2 + 7.7E-4

= 1.3E-2 Thus, for case la, 1.2E-2 is due to events which fail both the SWS and CCWS, while 7.7E-4 is due to events which fail only the CCWS.

Case lb: 90% of the time DGO has succeeded, but is powering bus 247; thus we can at most have three buses available at Unit 2, but we definitely have at least one.

Eq. lb: 2

= .9(DGF +(2xDGFxDGM)+DGCM+2(DGF+DGM)x(2xSWF+

2 2xSWS)+(3xSWF +6xSWFxSWM)+SWCM]

+.9[2x(DGF+DGM)x(CCWF+CCWM)+2xCCWFxCCWM

+CCW2M+CCCM]

= 2.8E-3 + 1.0E-2

= 1.3E-2 Case 2: 1 bus is available at Unit 1 Case 2a: The bus available at Unit 1 is 147; thus we can at most have two buses available at Unit 2.

Eq. 2a: =

[DGF 2+2xDGFxDGM+DGCM+2x(DGF+DGM)x2x(SWF+SWM)

+3x(SWF 2+2xSWFxSWM)4SWCM]

+[(2x(DGF+DGM)x(2xCCWFxCCNM+CCWM2M))+

(CCWF3+3CCWF 2xCCWM+3xCCWFxCCW2M)

+CCCM]

= 3.0E-3 + 8.5E-4

= 3.9E-3 Case 2b: The bus available at Unit 1 is not 147, and DGO has failed. Thus, we can at most have two buses available at Unit 2.

IV-9

l~

f Eq. 2b: = 0.1 x Eq. 2a

- 3.0E-3 + 8.5E-5

- 3.8E-4 Case 2c: The bus available at Unit 1 is not 147, and DGO has succeeded. Thus, we can at most have three buses available at Unit 2, but bus 247 is definitely available.

Eq. 2c: 2

= 0.9x[(DGF +2xDGFxDGM+DGCM)x(2x[SWF+SWM])+

2x(DGF+DGM)x3x([SWF 2+2xSWFxSWM])+

2 4x(SWF 3+3xSWF xSWM)+SWCM]

2 2

+0.9x[(DGF+2DGFxDGM+DGCMgx(CCWF+2CCWFxCCWM

+CCW2M)+2x(DGF+DGM)x(CCWF +3xCCWF 2xCCWM

+3xCCWFxCCW2M+CCW2M +CCWF4 +

4xCCWFxCCWM+6xCCWF}XCCW2M 3

+CCWM]

= 3.4E-5 + 8.0E-4

= 8.3E-4

, Case 3: 2 buses are available at Unit 1.

Case 3a: One of the buses available is 147. Thus, we can at most have two buses available at Unit 2.

'\

Eq. 3a: = [(DGF 2x2xDGFxDGM+DGCM)x(2x[SWF+SWM])

+2x(DGF+DGM)x(3x[SWF 2+2xSWFxSWM])

+4x(SWF 3 3xgwp2xSWM)+SWCM]

2 2

+[(DGF +2xDGFxDGM+DGCM)x(CCWF +2xCCWFxCCWM+CCW2M) 2

+2x(DGF+DGM)x(CCWF 3+3xCCWF xCCWM+

4

+3xCCW2MxCCWF)+CCWF +4xCCWF 3xCCWM+

6xCCWF2xCCW2M+CCCM]

= 3.8E-5 + 4.0E-5

= 7.8E-5 Case 3b: The two buses available at Unit 1 are 143 and 149, and DGO has failed. Thus, we can at most have two buses available at Unit 2.

Eq. 3b: = 0.1 x Equation 3a

= 3.8E-6 + 4.0E-6

= 7.8E-6 IV-10

Case 3c: The two buses available at Unit 1 are 148 and 149, and DGO has succeeded. Thus, we can potentially have three bases available at Unit 2, but we definitely have one (247).

2 2 Eq. 3c: = 0.9[(DGF +2xDGFxDGM+DGCM)x(3x[SWF +2xSWFxSWM])

3 2

+2x(DGF+DGM)x(4x[SWF +3xSWF xsygj)

+5xSWF4+12xSWF xSWM+SWCM]

3 2 2

+0.9[(DGF x2xDGFxDGM+DGCM)x(CCWF +2XCCWFX CCWM+CCW2M)+2x(DGF+DGM)x 2

(CCWF3+3xCCWF xCCWM+3xCCWFxCCW2M)

+CCWF +4xCCWF 3xCCWM+6xCCWF 2xCCW2M 4

+CCCM]

u 2.0E-5 + 3.7E-5

= 5.7E-5 Case 4: Three buses are available at Unit 1; thus we can have at most two buses available at Unit 2.

Eg. 4: = [(DGF 2+2xDGFxDGM+DGCM)x(3x[SWF2+2xSWFxSWM])

3 2

+2x(DGF+DGM)xj4x[SWF+3xSWFxSWM])

4

+5SWF +12xSWF XSWM+SWCM]

2 3 2

+[(DGF +2xDGFxDGM+DGCM)x(CCWF x3xCCWF xCCWM+

3xCCWFxCCW2M)+2x(DGF+DGMgx 4 3 (CCWF +4xCCWF xCCMW+CCWF XCCW2M)

+(CCWF5+5xCCWF 4xCCWM+6xCCWF 3xCCW2M)

+CCCM]

= 2.2E-5 + 2.2E-5 ,

= 4.4E-5 These subcases now need to be related to the electric power states of Unit 1 as defined in the ZPSS. Table IV.4.1 lists the system unavailabilities for both SWS and CCWS for each power state. The relevant subcases are shown for each power state. The subcase unavailabilities illustrated above included common mode failures. However, the system unavailabilities are calculated and shown on Table IV.4.1 for two different common mode assumptions; common mode event probabilities based on Fleming Beta factors, and no common mode events. The latter set is used in the sensitivity analysis.

IV.5 INCORPORATION OF CERTAIN NUREG-1150 METHODS INTO ZION REVIEW METHODS As part of the approach to rebaselining Zion, whenever possible, techniques and methods used throughout the other NUREG-1150 reference plant analyses were incorporated into the IV-11

Table IV.4.1. Zion Rebaseline System Unavailability for SWS, CCWS 1

i l

Zion Power States Power Available Without Betas With Fleming Betas at Unit 1 Buses Subcases SWS CCWS Total SWS CCWS Total All 4 3.3E-8 1.lE-8 4.4E-8 2.2E-5 2.2E-5 4.4E-5 1 147,148 3a 1.0E-5 1.2E-5 2.2E-5 3.8E-5 4.OE-5 7.8E-5 s 147,149 3a 1.0E-5 1.2E-5 2.2E-5 3.8E-5 4.0E-5 7.8E-5

? 3b and 3c 1.0E-6 1.2E-5 1.3E-5 2.4E-5 4.1E-5 6.5E-5 148,149

[

147 2a 2.lE-3 8.3E-4 2.9E-3 3.OE-3 8.5E-4 3.8E-3 148 2b and 2c 2.2E-4 8.8E-4 1.1E-3 3.3E-4 9.0E-4 1.2E-3 149 2b and 2c 2.2E-4 8.8E-4 1.lE-3 3.3E-3 9.OE-4 1.2E-3 None la and lb 1.4E-2 1.OE-2 2.4E-2 1.5E-2 1.OE-2 2.5E-2

- - - - 4 h

methods of the Zion Review and ZPSS. Although the two methods of PRA are profoundly different, three areas were found where a limited union of the methods was possible.

IV.S.1 AC Power Recoverv Model The generic recovery data used in the other analyses is used in the Zion model for AC power recovery. Several Zion sequences involve successful restoration of AC power by a certain time, given that AC power was not restored before a specific earlier time. For example, failure to restore AC power by four hours, followed by successful restoration of AC power between four and eight hours is actually the intersection of several events:

failure to restore AC power by 0.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months ; and failure to restore AC power by one hour given no recovery at 0.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months , and failure to restore AC power by four hours given no recovery at one hour and 0.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months ; and successful recovery of AC power by eight hours given no recovery at four, one, and 0.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months .

To illustrate, define the event, EPX as:

EPX E Failure to restore AC power by X hours.

Then, the probability of failing to restore AC power by four hours, followed by successful restoration between four and eight hours is:

Eq. 1: P(Restoring AC between 4 and 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months )

= P(EP.5) x p p x P(EP4)

[P(EP1)/P(EP.5)]xP(EP.5) 1- P(EP8)

P(EP4) P(EP1)

[P(EP1)/(EP.5)]xP(EP.5)

P(EP.5)x P(EP.5)

This simplifies to:

Eq. 2: P(Restoring AC between 4 and 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months )

= P(EP4) x l P(EP8)

P(EP4)

IV-13

The basic probabilities of failure to restore AC power [e.g.,

P(EP4)] are developed using values from the generic ' data base.

For a specific time x, the probability is the product of failure to restore offsite power and failure to restore a diesel generator. For the Zion rebaseline,.the basic probabilities for failure 0.5, 1, to restore AC power by time x were calculated for x =

2, 4, on Table IV.5.1.

5, and 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . The calculations are illustrated The following probabilities were used in the Zion sequence models for loss of offsite power sequences:

P(Restoring AC between 1 and 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months ) E P(EPl-4)

P(Restoring AC between 2 and 5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months ) E P(EP2-5)

P(Restoring AC between 4 and 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months ) E P(EP4-8)

P(Restoring AC between 5 and 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months ) E P(EPS-8)

P(Restoring AC by 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months ) E P(EP8)

These probabilities are calculated as illustrated in Equations 1 and 2:

P(EPl-4) = P(EPl) x1 p p1

= 0.3 x 1 - = 0.23 P(EPS)

P(EP2-5) = P(EP2) x 1 P(EP2)

= 0.26 P(EP8)

P(EP4-8) = P(EP4) x 1 P(EP4)

= 0.05 P(EPS-8) = P(EP5) x1 p p = 0.02 P(EP8) = 0.02 IV.5.2 Common Cause Failures - CWS. SWS. Unit 2 Diesel Generators The NUREG/CR-4550 common mode analysis is based on EPRI NP-3967.4 Common mode events are quantified using generic beta factors listed on Table S-1, page S-3, of that report.

For the NUREG/CR-4550 analyses, these Beta factors were assumed to be .95 quantiles of lognormally distributed random variables.

IV-14

Table IV.5.1. Generic Nonrecovery Probabilities for Offsite Power and Diesel Generators Failure to Restore a Failure to Restore Diesel Generator Given Time (Hours) Offsite Power Failure to Start 0.5 0.4 1.0 1 0.3 0.9 2 0.3 0.9 4 0.1 0.7 5 0.06 0.7 8 0.04 0.5 P(EP.5) = 0.4 x 1.0 = 0.4 P(EP1) = 0.3 x 0.9 = 0.3 P(EP2) = 0.3 x 0.9 = 0.3 P(EP4) = 0.1 x 0.7 = 0.07 P(EPS) = 0.06 x 0.7 = 0.04 P(EP8) = 0.04 x 0.5 = 0.02 IV-15

For the Zion rebaseline, common mode events were incorporated into the system models for CCWS and SWS in Section IV.4.1. The common mode events incorporated were Component Cooling Water System pump common mode failure, Service Water System pump common mode, and Unit 2 diesel generators (failure of Unit 2 diesel generators contribute to loss of SWS and CCWS, which are shared systems at Zion Units 1 and 2). These three events were incorporated because it was clear that pump common mode and Unit 2 diesel generator common mode events had not been previously incorporated into the CCWS and SWS models.

Consistent with the NUREG/CR-4550 common mode analysis, the Beta factors are assumed to apply to all relevant components.

Thus, all operable CCWS pumps are failed by the CCWS common mode event.

The quantification of the common mode events is shown below.

Common Mode Beta Factors Diesel Generators 0.05 SWS Pumps 0.03 CCW Pumps 0.03 Base Case Common Mode Event Probabilities Diesel Generators (Unit 2) = .05 x failure to start *

= .05 x .018 = 9.OE-4 Service Water System Pumps = .03 x failure to start

= .03 x 7.2E-4 = 2.2E-5 Component Cooling Water Pumps = 2.2E-5 IV.S.3 Reactor Coolant Pump Seal LOCA

. The NUEEG/CR-4550 RCP seal LOCA model was used in the Zion

( accident sequence models. The Zion Review assumed that a seal

LOCA would occur with probability 1.0 given that thermal l barrier cooling via the CCWS is lost. The NUREG/CR-4550 model assumes that the probability of a seal LOCA given loss of the CCWS is a function of time after the loss of the CCWS. The model is discussed below.

l The question of how quickly and how large a seal LOCA will develop upon loss of CCW cooling to the seals remains an issue of debate. The NRR Staff Report identifies this issue as a potential conservatism in the Zion Review. In the Zion Review, it was assumed that a 300 gpm leak per pump would develop within one hour if CCWS flow to the RCP seals is lost. The

Component Unavai*. abilities are the same as used in ZPSS.

IV-16

NUREG/CR-4550 RCP seal LOCA model is a time-dependent Weibull distributed random variable with a 5% confidence limit at 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months and 95% confidence limit at 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months . Thus, there is a

.05 probability that RCP seals will have failed within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after cooling is lost, and there is a .95 probability that the seals will have failed within 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months after cooling is lost.

Although the distribution is for a single RCP seal, it is assumed in the sequence models that all RCP seals fail simultaneously. Each RCP seal LOCA is assumed to result in a 450 gpm leak, for a total seal LOCA of 1800 gpm at Zion.

Al?. hough this leak rate is larger than that assumed in the Review, this is still within the range of a small LOCA, so there is no impact on plant damage state classification due to l the new RCP seal LOCA model. Once a seal LOCA occurs, it is assumed that the core will become uncovered for one hour if injection to the primary system is not restored. This allows for an extra hour for recovery of AC power in sequences involving Loss of Offsite Power transients where high pressure injection is lost due to degraded AC power.

IV.6 ACCIDENT SEQUENCE QUANTIFICATION The method of accident sequence quantification employed in the Zion Review and ZPSS is quite different than the method used in the other reference plant analyses. The Zion analysis is based on a large event tree - small fault tree method in which all system models, front line and support systems, were placed on event trees. Thus, support failures are directly included in the event trees and not as support events in system fault trees. Accident sequence equations are not expressed in Boolean format, but rather as algebraic expressions involving system failure probabilities for front line systems and support systems. Another significant difference in the two methods of accident sequence quantification is the treatment of loss of offsite power sequences. The Zion method defines eight electric power states given loss of effsite power. These states are the various combinations of electric power success

on the three emergency AC power buses. All plant systems are analyzed for failure probabilities given each electric power state. Each electric power state has a conditional probability of occurring given a loss of offsite power event. A loss of offsite power sequence is quantified by calculating a sequence frequency for each state. These electric power state sequence frequencies are then summed across all eight electric power states to arrive at a total sequence frequency.

l i Another difference of note between the Zion method and that of

! the other reference plant analyses is that, in the Zion method, l each accident sequence must be defined by one, and only one, plant damage state. In the other plant analyses, an accident sequence model involve any number of plant damage states.

IV-17 1

1 Thus, as Zion sequences were rebaselined, any changes which altered the plant damage state outcome for any portion of a sequence model resulted in & splitting up of the original sequence into at least two sequences.

The list of Zion Review dominant accident sequences analyzed for the rebaseline is shown on Table IV.6.1. These sequences correspond to the list of dominant sequences on Table 3.1-1 of the Zion Review. The Zion Review rank, frequency, and plant damage state for each sequence is shown along with the rebaseline result to illustrate the relationship between the rebaseline sequences and the Zion Review sequences.

The dominant accident sequence models and the rebaseline analysis of these models are discussed below. All sequences are referred to by their rebaseline rank as in Table IV.6.1.

IV.6.1 Sequence 1 - CCW Failure. Causino Failure of all Charoina and SI Pumps. Seal LOCA The initiator for this sequence is loss of the CCWS. Loss of the CCWS results in loss of cooling to the RCP seal thermal barriers, resulting in a seal LOCA. Both charging pumps fail due to loss of CCWS, as do the two safety injection pumps when they are actuated in response to low reactor pressure.

Containment cooling systems remain functional, but core damage results due to inability to replace primary coolant. This sequence is placed in plant damage state SEFC.

This sequence is dominated by two CCWS failure modes. From page 3-8 of the Zion Review:

Frequency of CCWS failure due to pipe rupture = 1.2E-4 Frequency of other CCWS = 7.lE-4 failures The Zion Review analysis was not able to ascertain the nature of these "other" failures resulting in loss of CCWS as an initiator in the ZPSS. Due to the status of the ZPSS documentation, it was common that the Zion Review analysts were unable to fully extract information on certain accident and system models from the ZPSS. Because the nature of these "other" system failures cannot be determined from the previous Zion studies, it is not possible to determine if the ZPSS incorporated a system common-cause failure or not.

Furthermore, it would be difficult to incorporate a common-cause event based on NUREG/CR-4550 Beta factors, since the model of these "other" CCWS failures is not available to work with.

IV-18

Table IV.6.1. Zion Dominant Accident Sequences Rank Sequence Frequency (yr-1) Damage State New Zion Review New Review New Review 1 1 CCW Failure, causing failure of all 1.2E-4 2.OE-4 SEFC SEFC charging and SI pumps, seal LOCA 2 5 Small LOCA; failure of recirculation 1.6E-5 1.6E-5 SLFC SLP 3 9 Large LOCA, failure of recirculation 4.9E-6 4.9E-6 ALFC ALP cooling 4 10 Medium LOCA, failure of recirculation 4.9E-6 4.9E-6 ALFC ALF cooling 5 14 Loss of offsite power; failure of AFWS 2.lE-6 1.OE-6 TEFC TEFC failure of feed and bleed; failure to H restore AC power in 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months (recovery 7 ,

prior to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months )

H

1.4E-6 1.4E-6 AEFC AEFC 6 12 Large LOCA; failure of low pressure injection 7 13 Loss of offsite power; failure of AFWS 4.6E-7 1.1E-6 TEFC TEFC failure of feed and bleed; failure to restore AC power in 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months (recovered by 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months ) 8 3 Loss of offsite power; CCW/SWS loss, 3.2E-7 4.OE-5 SEFC SEFC failure to recover AC power in 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months (recovery prior to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months ) 9 - Same as sequence 8 only this repre- 3.OE-7 - SE -

sents the SWS common mode portion of the rebaselined Zion Review sequence No. 3

Table IV.6.1. Zion Dominant Accident Sequences (Continued)

Rank Sequence Frequency (yr-1) Damage State New Zion Review New Review RJew Review 10 11 Loss of offsite power: CCW/SWS loss: 2.lE-7 4.7E-6 SE SE failure to restore AC power in 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months failure of containment sprays and fan coolers 11 2 Loss of offsite power CCW/SWS loss; 1.5E-7 4.6E-5 SEFC SEFC ,

I failure to restore AC power in 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months (recovery prior to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months ) 12 - Loss of offsite power. failure of SWS; 1.SE-7 -

SE -

failure to restore AC power in 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months .

This sequence represents the SWS portions of the rebaselined Zion Review Sequence No. 4 and No. 6 13 4 Same as sequence 12 above, only this 1.0E-7 1.8E-S SEC SEC

$ is the CCW portion of the rebaselined Zion Review sequence No. 4 14 - Interfacing Systems LOCA 1.0E-7 1.0E-7 V V 15 7 Failure of DC bus 112, causing loss 5.0E-8 7.0E-6 TEFC TEFC of one PORV and loss of AC bus 148, failure of Auxiliary Feedwater 16 - Same as sequence ll, only this repre- 4.8E-8 -

SE -

sents the SWS common mode portion of the rebaselined Zion Review sequence No. 2 17 6 Loss of offsite power: CCW failure 3.7E-8 8.0E-6 SEFC SEFC failure to recover AC power in 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months

The "other" CCWS failures can be circumvented by successfully starting 1 of 2 standby pumps. The Zion Review, required both standby pumps to operate due to its more stringent CCWS success criterion. For the rebaseline, the recovery term is reevaluated using the following:

PPS E standby pump fails to start = 7.2E-4 PMAT E standby pump out for maintenance = .032 Success criterion E 1 of 2 Failure to restore CCWS = 2x(PFS+PMAT)

+PFS2+2xPFSxPMAT+PMAT2

= 5.2E-7+5.0E-5+7.7E-3

= 7.7E-3 The rebaseline sequence frequency is:

Sequence 1 = 1.2E-4 + 7.1E-4 x 7.7E-3

= 1.2E-4 + 5.5E-6

= 1.2E-4 IV.6.2 Sequence 2 - Small LOCA. Failure of Recirculation Coolino This sequence represents a small LOCA followed by failure of the recirculation system to provide high pressure coolant injection into the primary systr.m The dominant contributor to loss of recirculatien is hur error in switching the low pressure pump suction lines over from injection alignment to recirculation alignment. The HPIS (composed of both the charging pumps and safety injection pumps) take suction from the low pressure pumps. Containment system remain functional.

This sequence is placed in the plant damage state SLFC.

The plant damage state for this sequence was reclassified from SLF to SLFC, allowing credit for long-term operation of the containment spray system by refilling the RWST.

The rebaseline sequence frequency is the same as in the Zion Review:

Sequence 2 = Frequency of small LOCA x probability of recirculation failure at high pressure

= 3.5E-2 x 4.55E-4

= 1.6E-5 IV.6,3 Sequence 3 - Large LOCA. Failure of Recirculation Coolinq This sequence represents a large LOCA, followed by failure of the low pressure system to provide coolant injection into the primary system to provide coolant injection into the primary system. The dominant contributor to loss of recirculation IV-21

cooling is human error in realigning the low pressure injection system (LPIS) suction valves from injection to recirculation alignment. Containment systems remain functional. This

! sequence is placed in damage state ALFC.

The plant damage state for this sequence was reclassified from ALF to ALFC, allowing credit for long-term operation of the containment spray system by refilling the RWST.

The rebaseline sequence frequency is the same as in the Zion Review:

Sequence 3 = Frequency of large LOCA x probability of recirculation failure at low pressure

= 9.4E-4 x 5.2E-3

= 4.9E-6 IV.6.4 Sequence 4 - Medium LOCA. Failure of Recirculation Coolino The sequence model for this sequence is exactly the same as that for sequence 3, except that the initiator is a medium LOCA.

The plant damage state for this sequence was reclassified from ALF to ALFC, allowing credit for long-term operation of the containment spray system by refilling the RWST.

The rebaseline sequence frequency is the same as in the Zion Review: '

Sequence 4 = Frequency of medium LOCA x probability of recirculation failure at low pressure

= 9.4E-4 x 5.2E-3

= 4.9E-6 IV.6.5 Sequence 5 - Loss of Offsite Power: Failure of AFWS Milure of Feed and Bleed: Failure to Restore AC Power in One Hour (Recovery Prior to Four Hours)

In this sequence, the initiating event, loss of offsite power, is followed by loss of auxiliary feedwater and loss of feed and bleed capability, with failure to restore power in one hour.

The loss of auxiliary feedwater eliminates the capability for secondary cooling, since without offsite power, the main feedwater pumps have tripped and cannot be restored. The loss of feed and bleed capability removes the remaining option for core cooling. Therefore, core cooling will not occur. The dominant contributors' to this sequence are in Station Blackout Unit 1 and random failure of the AFWS. Containment systems success is ensured by successful restoration of AC within four hours. This sequence is placed in damage state TEPC.

IV-22

The Zion Review assumed that 2 of 2 PORVs are necessary for successful Feed and Bleed. In view of the maximum discharge head of the two 550 gpm charging pumps (2670 psig) compared to the safety relief valve settings (2435 psig), it appears that Zion's injection capacity may permit successful feed and bleed even with the loss of both PORVs. However, the rebaseline for 1150 assumes that at least one PORV is needed to enhance the primary system-charging pump discharge pressure differential.

There are three failure paths for Feed and Bleed:

1) All charging and safety injection pumps fail,

2) 1 PORV and both charging pumps fail,

3) both PORVs fail Addressing the first failure mode, page 2.31 of the Review describes the unavailability of the charging and safety pumps for each power state. Listed below are the charging and safety injection pump configurations for each power state and their unavailabilities:

Number of Number of Pcwer On Charging Pumps on Safety Pumps on Unavail-Buses Available Buses Available Buses ability All 2 2 147,148 2.lE-8 1 2 147,149 6.8E-7 2 1 1.4E-7 148,149 1 1 1.2E-5 147 1 1 1.2E-5 148 0 1 2.lE-5 149 1 0 5.6E-3 None O O 1.0 The second failure mode, 1 PORV and both charging pumps, is also quantified from the Review, pages 2-31 and 2-32. The probability of a PORV failing is given as:

PORV f4ils to open upon demand = 1.44E-3 The probabiliti that 1 of 2 PORVs fail = 1.44E-3 + 1.44E-3

= 2.9E-3 The charging pump unavailabilities vary from power state to power state, as shown on page 2-31 of the Review:

IV-23 i

L Power On Buses 1 PORV Fails 2 of 2 Charging Pumps Fail All 2.9E-3 6.5E-5 147,148 2.9E-3 5.6E-3 147,149 2.9E-3 6.5E-5 148,149 2.9E-3 5.6E-3 147 2.9E-3 5.6E-3 148 2.9E-3 1.0 149 2.9E-3 5.6E-3 None 2.9E-3 1.0 The last Feed and Bleed failure mode, 2 of 2 PORVs is unaffected by the power states. The two failure events for this mode are:

Operator error to initiate procedures = 1.3E-4 PORV fails to open upon demand = 1.44 E-3 The probability of losing both PORVs is:

P(2/2 PORVs) = 1.3E-4+(1.44E-3)2

= 1.3E-4 Summing all three failure mode probabilities within each power state yields the probability of unsuccessful Feed and L.eed:

Power Loss of On all cps, Buses SI Pumps or 1 PORV x 2 cps or 2 PORVs = P(F&B)

All 2.lE-8 1.9E-7 1.3E-4 1.3E-4 147,148 6.8E-7 1.6E-S 1.3E-4 1.5E-4 147,149 1.4E-7 1.9E-7 1.3E-4 1.3E-4 148,149 1.2E-5 1.6E-5 1.3E-4 1.5E-4 l 147 1.2E-5 1.6E-5 1.3E-4 1.6E-4 148 2.lE-3 2.9E-3 1.3E-4 5.lE-3 149 5.6E-3 1.6E-5 1.3E-4 5.7E-3 None 1.0 2.9E-3 1.3E-4 1.0 From page 3-44 of the Review, it is seen that the sequence quantification model includes successful operation of the SWS and CCWS. The success probability of SWS and CCWS is calculated by subtraccing the sum of the SWS and CCWS unavail-abilities on Table IV.4.1 from 1.0 for each power state, using the high common mode values. The sequence quantification is as follows:

IV-24 i

Failure to Success-Restore AC ful Power by 1 Hr. Operation Power On (Restoration of Loss AFW State Buses by 4 Hrs.) SWS,CCWS of FSB Failure Prob. Total 4

All 0.20 1.0 1.3E-4 3.4E-5 0.38 3.4E-10 147,148 0.23 1.0 1.5E-4 2.3E-4 3.6E-2 1.9E-10 147,149 0.23 1.0 1.3E-4 2.3E-4 3.6E-2 1.9E-lO 148,149 0.23 1.0 1.5E-4 3.4E-5 0.45 3.5E-10 147 0.23 1.0 1.6E-4 0.039 3.2E-3 3.2E-9 148 0.23 1.0 5.lE-3 2.3E-4 4.5E-2 8.7E-8 149 0.23 1.0 5.7E-3 2.3E-4 4.5E-2 8.7E-8 I

None 0.23 0.98 1.0 0.039 3.9E-3 3.4E-5 3.4E-5 Frequency of Sequence 5 = LOSP x 3.4E-5

= 0.061/yr. x 3.4E-5

= 2.lE-6/yr.

Note that the probability that AC power is recovered between one and four hours is slightly less for power state "All" than for the other states. No credit is given in power state "All" for recovery of a diesel generator. All of the Unit 1 generators function in this case, and the recovery of Unit 2 generators which affect the SWS and CCWS is not important, since those two sytems succeed in this sequence.

IV.6.6 Sequence 6 - Large LOCA. Failure of Low Pressure Iniection Coolinq

. This sequence represents a large LOCA followed by failure of the LPIS to provide injection coolant. The primary contributor is human error in leaving certain MOVs closed after testing the LPIS. Containment systems remain functional. This sequence is placed in plant damage state AEFC.

No changes were made on the Zion Review sequence model. This sequence was sequence 12 in the Review.

The sequence frequency is:

Sequence 6 = Frequency of large LOCA x probability of injection failure at low pressure

= 9.4E-4 x 1.39E-3 3

= 1.4E-6 4

1 IV-25 o

--c-.,eg -,--.----v- w----w+-w-ge wn -

w. - -- - - - - - - a w a - - - - - . - . . - - - , , , , , - - . - _ - , - - . , - . ,, _ . - . _ - - - , _ _ _ _ _ _ , , _ - - . -

--my ,

IV.6.7 Sequence 7 - Loss of Offsite Power: Failure of AFWS:

Failure of Feed and Bleed: Failure to Restore AC Power in Fo'ir Hours (Recovered by Eight Hours)

This sequence represents a set of events similar to sequence 5, except that successful restoration of AC power occurs at a later time, between four and eight hours after the initiation of the sequence. This sequence is placed in damage state TEFC.

This sequence is exactly the same as sequence 5, except that the AC power recovery probabilities are different to reflect the longer time frame of this sequence.

Failure to Success-Restore AC ful Power by 1 Hr. Operation Loss Power On (Restored of SWS, of AFW State Buses by 8 Hrs.) CCWS F&B Failure Prob. Total All 0.05 1.0 1.3E-4 3.4E-5 0.38 6.5E-ll 147,148 0.05 1.0 1.5E-4 2.3E-4 3.6E-2 147,149 4.lE-ll 0.05 1.0 1.3E-4 2.3E-4 3.6E-2 4.lE-11 148,149 0.05 1.0 1.5E-4 3.4E-5 0.45 7.72-11 117 0.05 1.0 1.6E-3 0.039 3.2E-3 6.9E-10 148 0.05 1.0 5.lE-3 2.3E-4 4.5E-2 1.9E-9 149 0.05 1.0 5.7E-3 2.3E-4 4.5E-2 1.9E-6 None 0.05 0.98 1.0 .039 3.9E-3 7.5E-6 9.4E-6 Frequency of Sequence 7 = LOSP x 9.4E-6

= .061/yr.x9.4E-6

= S.7E-7/yr.

IV.6.8 Sequence 8 - Loss of Offsite Power: CCW/SWS Loss.

Failure to Recover AC Power in One Hour (Recovery Prior to Four Hours)

This sequence represents a loss of offsite power, followed by failure of the CCWS, either directly due to random failures, or indirectly due to a combination of loss of AC power and SWS pumps. Failure of the CCWS results in failure of the RCP thermal barrier cooling and a seal LOCA, and loss of all HPIS capabilities, as with sequence 1. Dominant contributors are hardware and maintenance failures in the CCWS, SWS, and emergency diesel generators. The containment systems and SWS are restored to service when AC power is restored. Although the CCWS may be restored as well, core damage has already occurred. This sequence is placed in damage state SEFC.

Since the plant damage state of this sequence is defined as SEFC, unrecoverable SWS failures have been separated out in the rebaseline analysis. If SWS is not restored, containment cooling systems will fail, and a damage state of SE results.

IV-26

l Most of the failure terms in the SWS model, as quantified in Section IV.4, are recoverable upon successful restoration of AC power. The nonrecoverable SWS failures are defined as a new sequence, sequence 9. The rebaseline sequence 9 was not included in the Zion Review since SWS failure was not included in the Review's sequence models.

The sequence quantification is shown below. SWS common mode contributors are not included here for this set of events, but in sequence 9, since SWS common mode failures are nonrecoverable and would result in plant damage state SE.

Failure to Restore AC Prob. of Power by 1 Hr. Loss of Power RCP Seal On (Restored CCWS or State LOCA Buses by 4 Hrs.) SWS Prob. at 1 Hr. Total All O.23 2.2E-5 0.38 1.0 1.9E-6 147,148 0.26 7.8E-5 3.6E-2 0.05 3.7E-8 i 147,149 0.26 7.8E-5 3.6E-2 0.05 3.7E-8 l 148,149 0.26 6.5E-5 0.45 0.05 3.8E-7

147 0.26 3.8E-3 3.2E-3 0.05 1.6E-7 t

148 0.26 1.2E-3 4.5E-2 0.05 7.0E-7 149 0.26 1.2E-3 4.5E-2 0.05 7.0E-7 None 0.26 2.5E-2 3.9E-3 0.05 1.3E-6 5.2E-6

., Frequency of Sequence 8 = LOSP x 5.2E-6

= .061/yr. x 5.2E-6

= 3.2E-7/yr.

Note that the probability of restoring AC power differs for power state "All" from the others. The probability of loss of 3 CCWS in power state "All" is due victually 100% to common mode, which is nonrecoverable. Further, it is assumed that an RCP seal LOCA will occur with probability of 1.0 regardless of whether it is assumed that the seal LOCA occurs immediately, one hour, or ten hours after loss of RCP seal cooling. Without any chance of restoring the CCWS to cool the seals, a seal LOCA j will definitely occur. Since all the charging and safety pumps i receive electricity in this case, they will all start up at some point during the transient as the RCP seal LOCA lowers the primary system level. As the injection pumps start up in response to the LOCA, they will fail due to loss of cooling from the CCWS. So the sequence, as defined by the successful i

restoration of AC power . between one and four hours after the transient, is not affected by the RCP seal LOCA model in this case. However, for the other power states, the sequence has I

changed slightly from the Zion Review and ZPSS situations because of the NUREG/CR-4550 RCP seal LOCA model.

I IV-27

._ = _

In the NUREG/CR-4550 RCP seal LOCA model, the seal LOCA will occur at one hour after the transient with probability 0.05.

>However, if AC power is restored within the next hour after the seal LOCA occurs, the LOCA will be mitigated by the recovered injection pumps. The assumption here is that even though the seal LOCA occurs at one hour after the transient, the seals will not be totally destroyed for one more hour. Therefore, the timing of the event - successful restoration of AC power -

must shifted from one hour to two hours after the transa. .. The result is a slightly increased probability of restoring AC power.

IV.6.9 Sequence 9 - Same as sequence 8. only this represents the SWS Common-Mode Portion of the Zion Review Sequence No. 3 In the rebaseline analysis, damage became significant the contribution of SWS to core relevant to the contribution of CCWS. In the Zion Review and ZPSS, this was not the case, and cutcomes important.

due to nonrecoverable failures of the SWS were not This sequence represents a similar set of events as in sequence 8, except that the onset of the seal LOCA and HPIS failure is caused by loss of CCWS due to nonrecoverable faults i in the SWS (predominantly SWS pump common mode). The permanent loss of SWS also fails the containment systems, resulting in a plant damage state of SE. This sequence was essentially " split apart" from sequence 8 when it was reevaluated, explicitly modeling the SWS failures separately from the CCWS failures.

Because SWS failure here is not recoverable, the CCWS and injection pumps will not be operable, and an RCP seal LOCA will occur with probability 1.0. Thus, the electric power recovery events are not affected here by the RCP seal LOCA model as they j are in other sequences.

t Failure to I Restore AC l Power by 1 Hr. Power RCP On (Restored Loss of State Seal Buses by 4 Hrs.) SWS Prob. LOCA Total All O.23 2.2E-5 0.38 1.0 1.9E-6 147,148 0.23 2.2E-5 3.6E-2 1.0 1.8E-7 l 147,149 0.23 2.2E-5 3.5E-2 1.0 1.8E-7 148,149 0.23 2.2E-5 0.45 1.0 2.2E-6 147 0.23 2.2E-5 3.2E-3 1.0 1.6E-8 148 0.23 2.2E-5 4.5E-2 1.0 2.2E-7 149 0.23 2.2E-5 4.5E-2 1.0 2.2E-7 None 0.23 2.2E-5 3.9E-3 1.0 1.9E-8 4.9E-6 Frequency of Sequence 9 = LOSP x 4.9E-6

- 0.061/yr. x 4.9E-6

- 3.0E-7/yr.

IV-28

IV.6.10 Sequence 10 - Loss of Offsite Power: CCW/SWS Loss:

Failure to Restore AC Power in Eight Hours: Failure of Containment Sprays and Fan Coolers This sequence represents a set of events similar to sequence 8, except that AC power is not restored within eight hours after the sequence is initiated. The Zion Review and ZPSS gave no credit for containment systems if they could not be restored within eight hours. This sequence is placed in damage state SE. The Zion Review only quantifies this sequence for the highly degraded power states 147, 148, 149, and None, assuming the unavailabilities for the containment systems are too low for the less degraded states to warrant their inclusion here.

The sequence quantification follows below.

CCWS contribution to sequence frequency:

Power Failure to Contain- Contain- Power On Restore AC Loss of ment ment State Buses by 8 Hrs. CCWS Sprays Pans Prob. Total 147 0.02 8.5E-4 6.8E-3 1.0 3.2E-3 3.7E-10 148 0.02 9.0E-4 6.8E-3 1.0 4.5E-2 5.5E-9 149 0.02 9.0E-4 6.8E-2 1.0 4.5E-2 5.5E-8 None 0.02 1.0E-2 1.0 1.0 3.9E-3 7.8E-7 8.4E-7 SWS contributiori to sequence frequency is extended to all the power states, since loss of SWS fails both containment systems with probability 1.0, given loss of offsite power, due to station blackout upon loss of diesel generator cooling.

Power Failure to Loss Contain- Contain- Power On Restore AC of ment ment State Buses by 8 Hrs. SWS Sprays Fans Prob. Total All 0.02 2.2E-5 1.0 1.0 0.38 1.7E-7 147,148 0.02 3.8E-5 1.0 1.0 3.6E-2 2.78-8 147,148 0.02 3.8E-5 1.0 1.0 3.6E-2 2.7E-8 148,149 0.02 2.4E-5 1.0 1.0 0.45 2.2E-7 147 0.02 3.0E-3 1.0 1.0 3.2E-3 1.9E-7 148 0.02 3.3E-4 1.0 1.0 4.5E-2 3.0E-7 149 0.02 3.3E-4 1.0 1.0 4.5E-2 3.0E-7 None 0.02 1.5E-2 1.0 1.0 3.9E-3 1.2E-6 2.6E-6 i Frequency of Sequence 10 = LOSPx(8.4E-7 + 2.6E-6) l = .061/yr. x (3.5E-6)

= 2.lE-7/yr.

l 1

i IV-29 L____________________ _ _ _ _ _ _ _ _ __ _ _ _ _ _ _ _ _

IV.6.11 Sequence 11 - Loss of Offsite Power: CCW/SWS Loss:

Failure to restore AC Power in Four Hours (Recovery _

c J

Prior to Elaht Hours)

This sequence represents a set of events similar to sequence 8, except ' that AC power is restored within a later time frame, i

i four to eight hours after sequence initiation. This sequence is in p'lant damage state SEFC.

Sequence 11 involves an RCP seal LOCA occurring at four hours, and successful restoration of AC power within four to eight hours to electric power state "All," and five to eight hours i for the degraded pcwer states -

this incorporates the additional late to one hourcore prevent after melt a sealbyLOCA occurs before it is too restoring AC power. The discussion in Section IV.6.8 regarding the RCP seal LOCA model and recovery of offsite power is fully applicable here. For the sequence quantification, just as for sequence 8, unrecoverable SWS failures are separated from other SWS and the CCWS '.,f ailures due to plant damage state definitions. Sequence 16 is due to the unrecoverable SWS portion of sequence 11.

Failure to Restore AC RCP by 4 Hrs. Loss of Power SEAL Power (Restored CCWS or State LOCA On Bus by 8 Hrs.) SWS Prob. Prob. Total All 0.05 2.2E-5 0.38 1.0 4.8E-7

147,148 0.02 7.8E-5 3.6E-2 0.47 2.6E-8 147,149 0.02 7.8E-5 3.5E-2 0.47 2.6E-8 148,149 0.02 6.5E-5 0.45 0.47 2.7E-7 147 0.02 3.8E-3 3.2E-3 0.47 1.lE-7 148 0.02 1.2E-3 4.SE-2 0.47 5.lE-7 149 0.02 1.2E-3 4.5E-2 0.47 5.lE-7 None 0.n3 2.5E-2 3.9E-3 0.47 9.2E-7 2.5E-6 Frequency of Sequence 11 = LOSP x 2.5E-6

- 0.061/yr. x 2.5E-6

= 1.5E-7/yr.

IV.6.12 Sequence 12 - Loss of Offsite Power. Failure of SWS Failure to Restore AC Power in Eiaht Hours. This Sequence Represents the SWS Portions of the Rebaselined Zion Review Seouences No. 4 and No. 6 This sequence represents a set of events similar to sequence 10, except that loss of RCP seal thermal barrier, cooling and hence the cause of the seal LOCA, is failure of the CCWS due'to loss of the SWS. This sequence represents portions of the sequences 13 and 17 which were " split apart" when these sequences were reevaluated using new unavailabilities for the IV-30 i

CCWS and SWS. In the Zion Review, SWS failure was not significant relative to CCWS failure. In the rebaseline, it is, so contribution to core damage due to nonrecoverable SWS 1 failure must be segregated from core damage due to CCWS, since "

these two contributors yield different plant damage states.

This sequence is placed in damage state SE.

This sequence is a "new" sequence, created by the inclusion of SWS failure into the sequence analyses. This sequence represents those portions of sequences 13 and 17 in which SWS failure contributes to core melt. These two original sequences had to be redefined into three sequences, since the resulting plant damage states depend on whether CCWS or SWS contributed t to the sequences. AC power is not restored within eight hours for these sequences, so all SWS failures are unrecoverable, resulting in complete loss of the containment systems. Even though sequences 13 and 17 are defined differently (sequence 13 has failure of the containment fans due to degraded power -

sequence 17 has success of the fans) the SWS portions of these original sequences are indistinguishable since containment fans fail upon loss of SWS. They are therefore combined here.

The sequence quantification is shown below. Sequence 13 was quantified only for power states 147, 148, 149, and None. This is because the sequence was defined as having loss of con-tainment fans due to power failures. The fans fail with probability of 1.0 in these power states. Sequence 17 was quantified only for the power states All, 147-148, 147-149, and 148-149. This is because sequence 16 was defined as having success of the fans. So only these power states are relevant to sequence 17. Therefore, the SWS portions of sequences 13 and 17 can be combined to form sequence 12 without double counting of power state contributions to core melt frequency.

Note that the value for failure to restore power in power state is included even for power state "All" for which there is power on all three Unit 1 AC buses. The failure to restore power is still relevant for the two Unit 2 buses which power certain CCW and SWS pumps. See Section IV.4.1, Eq. 4.

Failure to , Power Power On Restore AC Loss of State Buses by 8 Hrs. SNS Prob. Total All O.02 2.2E-5 0.38 1.7E-7 147,148 0.02 3.8E-5 3.6E-2 2.7E-8 147,149 0.02 3.8E-5 3.6E-2 2.7E-8 148,149 0.02 2.4E-5 0.45 2. 2E -7 147 0.02 3.OE-3 3.2E-3 1.9E-7 148 0.02 3.3E-4 4.5E-2 3.7E-7 149 0.02 3.3E-4 4.5E-2 3.0E-7 None 0.02 1.5E-2 3.9E-3 1.2E-6 2.4E-6 IV-31

Frequency of Sequence 12 = LOSP x 2.4E-6

- 0.61/yr. x 2.4E-6

= 1.5E-7/yr.

IV.6.13 Sequence 13 - Same as Sequence 12 Above. Only This is the CCW Portion of the Zion Review Sequence No. 4. and Containment Fans Fail As discussed in sequence 12 above, this sequence represents a set of similar events, except that containment fan failure is explicitly included here. In sequence 12, the fans fail due to loss of SWS cooling to the air chillers. The dominant cause of fan failure here is loss of two out of three AC buses at Unit 1 due to random failures in the diesel generators. This sequence results in plant damage state SEC, with loss of the containment fans due to degraded power. The success criterion for the fan coolers is 3 of S. The fan coolers will fail electrically only in electric power states 147, 148, 149, and none. However, failure of all AC power at Unit I will also result in loss of the containment sprays, which would violate the damage state.

The sequence is quantified below, using the .95 quantile for CCWS common mode, for the three power states 147, 148, and 149. Since AC power is not restored, the probability of an RCP seal LOCA is 1.0.

Failure to Power Power On Restore AC Loss of State Buses by 8 Hrs. CCWS Prob. Total 147 0.02 8.5E-4 3.2E-3 5.4E-8 148 0.02 9.0E-4 4.5E-2 8.0E-7 149 0.02 9.0E-4 4.5E-2 8.0E-7 1.7E-6 Frequency of Sequencs 13 = LOSP x 1.7E-6

= .061/yr. x 1.7E-6

= 1.0E-7/yr.

IV.6.14 Sequence 14 - Interfacino Systems LOCA This sequence represents failure' of two MOVs in the RHR to isolate low pressure piping from high pressure piping. This sequence is placed in plant damage state V.

This sequence model was not changed from the model in the Zion Review. The frequency from the Zion Review is:

Frequency of Sequence 14 = 1.lE-7 IV-32

IV.6.15 Sequence 15 - Failure of DC Bus 112. Causina Loss of One_PORV and Loss of AC Bus 148. Failure of Auxiliary Feedwater The sequence of interest in this case is failure of DC bus 112, loss of main feedwater, reactor trip, loss of auxiliary feedwater, and failure of feed and bleed capability due to loss l of the PORVs. The containment systems are functional. This sequence is placed in plant damage state TEFC. As discussed in l Section IV.6.4, Feed and Bleed appears feasible without any l

PORVs. However, the rebaseline analysis requires at least one PORV as a conservatism. From the Review, page 2-32:

Operator error to open PORV = 1.3E-4

Failure of PORV to open on demand = 1.4E-3 The sequence equation becomes

Frequency of Sequence 15 = Initiator x recovery of initiator x AFW failure in power state (147, 149) x (failure of F&B) from pages 3-10 of the review and the above discussion on Feed and Bleed.

Frequency of Sequence 15 = 0.28/yr. x 0.1 x 2.3E-4 x(1.4E-3+1.3E-4)

= 5.0E-8/yr.

IV.6.16 Sequence 16 - Same as Sequence 11. Only This Represents the SWS Common-Mode Portion of the Zion Review Secuence No. 2 1

This sequence represents that portion of sequence 11 " split apart" from the sequence model when it was reevaluated using new unavailabilities for the CCWS and SWS. SWS failure becomes important relative to CCWS failure, so nonrecoverable SWS failures must be segregated from nonrecoverable SWS failures and CCWS faults, since nonrecovered failure of the SWS results in damage state SE.

The SWS failures are dominated by common mode. Since the SWS can not be restored, the CCWS and injection pumps will not be operable. Thus, the probability of an RCP seal LOCA is 1.0.

The electric power recovery terms are not affected here as they were in sequence 11 due to the RCP seal LOCA model.

IV-33

Failure to Restore AC Power by 4 Hrs. Loss Power On (Restared of State RCP Seal Buses by 8 Hrs.) SWS Prob. LOCA Total All .06 2.2E-5 0.38 1.0 147,148 5.0E-7

.06 2.2E-5 3.6E-2 1.0 4.8E-8 147,149 .06 2.2E-5 3.6E-2 1.0 4.8E-8 148,149 .06 2.2E-5 0.45 1.0 6.0E-8 147 .06 2.2E-5 3.2E-3 1.0 148 4.2E-9

.06 2.2E-5 4.5E-2 1.0 6.OE-8 149 .06 2.2E-5 4.5E-2 1.0 6.0E-8 None .06 2.2E-5 3.9E-3 1.0 5.lE-9 7.8E-7 '

Frequency of Sequence 16 = LOSP x 7.8E-7

= 0.061/yr.x7.8E-7 '

= 4.8E-8/yr.

IV.6.17 Sequence 17 - Loss of Offsite Power; CCW Failure:

Failure to Recover Offsite Power or Emeroency Diesel Generators in Eloht Hours; Success of Containment Systems This sequence represents a set of events leading to core damage due to an RCP seal LOCA and loss of HPIS similar to sequence ,

, 8. A significant difference to sequence 8 is that here, none of the emergency diesel generators AC power failures - either offsite power or any of the which may- have failed -

are restored within eight hours after initiation of the sequence.

SWS and containment cooling systems succeed in this sequence.

Therefore, this sequence is placed in plant damage state SEFC.

Because the plant damage state for the set of events in this sequence is defined as SEFC in the Zion Review (successful operation of containment fans and sprays), only power states resulting in SEFC for this set of events are analyzed in this sequence - All, 147-148, 147-149, and 148-149. This same set of events is quantified for electric power states 147, 148, and 147 in sequence 13, where the containment fans fail due to the degraded power states and plant damage state SEC is the outcome. Sequence 17 is quantified below. The probability of an RCP seal LOCA is 1.0, since the loss of CCWS water to the seals cannot be restored.

IV-34

Failure to Power Power On Restore AC Loss of State Buses by 8 Hrs. CCWS Prob. Total All 0.02 2.2E-5 0.38 1.7E-7 i 147,148 0.02 4.0E-5 3.6E-2 2.9E-8 147,149 0.02 4.0E-5 3.6E-2 2.9E-8 148,149 0.02 4.lE-5 .45 3.7E-7 6.0E-7 Frequency of Sequence 17 = LOSP x 6.0E-7

= .061/yr. x 6.7E-7

= 3.7E-8/yr.

IV.7 SENSITIVITY ANALYSIS The issues incorporated into the sensitivity analysis are gathered from three different areas; the list of sensitivity issues in the Zion Review, the preliminary sensitivity list from the Surry analysis, and a general set of issues which were generated during the Zion rebaseline analysis. These three sets of issues were reviewed to determine which issues were relevant and applicable to the Zion rebaselinine results.

These issues are summarized on Table IV.7.1. As can be seen from the table, certain issues either are specific to Surry, or were incorporated into the Zion base case analysis. The resulting set of issues investigated in the sensitivity analysis are discussed below, and illustrated in Table IV.7.2.

IV.7.1 Sensitivity Issues for the Limited Rebaseline CCWS CCWS Pipe Rupture The mest dominant sequence for Zion involves loss of CCWS as the initiating event. The loss of CCWS results in failure of the safety and high pressure injection pumps, and failure of the RCP seals. The result is an RCP seal LOCA with no source of high pressure inventory makeup. The sequence is dominated by pipe rupture in the CCWS. This failure mode is highly controversial. The frequency for CCWS pipe rupture is based on the WASH-1400 pipe rupture analysis. However, the WASH-1400 analysis, directed at primary system pipes, was based on information about very large pipes exposed to high temperatures and pressures. The CCWS presents a very different environment for pipe fatigue. The CCWS is not pressurized to the level of the primary system, and temperatures are significantly lower.

Although low pressure pipes do fail, it is easy to imagine how the low energy pipe rupture frequency could be much less than that of pipes exposed to . high energy environments. Just how much lower is not known. There are no available data on catastrophic ruptures in low pressure pipes in nuclear power plants. Whether the rupture frequency might be one, two.

IV-35

Table IV.7.1. Potential Sensitivity lasues l Source Issue Status Zion Review Containment Fans - Core Melt Interactions Analyzed Feed and Bleed Capability Incorporated in Rebaseline Reactor Coolant Pump Seal LOCA Analyzed Using 1150 RCP Seal LOCA Model Testing of Room Cooling System Incorporated in Rebaseline ATWS Beyond Scope of Analysis CCWS-3WS Pump Success Criteria Incorporated in Rebaseline j $ Surry 1150 Sensitivity List Credit for Non-Safety Grade Gas Turbine Plant Specific to Surry La Biofouling of SMS Intake Channel

Plant Specific to Surry Common Mode Probabilities Analyzed Fan Coolers - Credit for Operation After Sprays Plant Specific to Surry 480V Bus Initiator Plant Specific to Surry Elimination of Hot Leg Recirculation Plant Specific to Surry j Zion Rebaseline Issue Manual Switchover to Recirculation Analyzed 1 CCWS Pipe Rupture Analyzed

} RWST Refill Analyzed j Containment Spray Injection Roon Cooling Analyzed

Diesel-Driven Containment Spray Pump Analyzed

)

i i

l 1

i i

Table IV.7.2. Rebaseline Sensitivity Issues Issue Description l

CCWS Pipe Rupture Probability of CCWS pipe rupture is varied from WASH-1400 basis to values well below other CCWS failure modes.

Base Case - WASH-1400 Basis Best Case - Pipe rupture contributes less than other CCWS faults.

Manual Switchover to 1150 HRA error factor applied to Zion Recirculation human error contributors.

Base Case - Mean value of ZPSS used.

Best Case - 0.05 low value used Worst Case - 0.95 high value used RCP Seal LOCA Probability of seal LOCA modeled with Weibull distribution.

Base Case - .05 at 1 hr., .95 at 10 hrs.

Best Case .05 at 2 hrs., .95 at 15 hrs.

! Worst Case - .05 at 1/2 hr., .95 at 4 hrs.

Zion Review and ZPSS - Probability = 1.0 at I hr.

Common Mode Fleming Betas used for Unit 2 diesel generators, CCWS pumps. SWS pumps.

Base Case - Quantified using Fleming's betas Best Case - Common mode terms are removed RWST Refill Refilling RWST for long-term use of containment spray injection during core-melt sequences involving loss of recirculation.

Base Case - Probability of Refill = 1.0 Worst Case - Probability of Refill = 0.0 Containment Spray RWST water temperature may be low enough to maintain Injection Room operational conditions in pump rooms.

Cooling Base Case - Room coolers necessary Best Case - Room coolers not necessary Containment Fans - Containment Fans may fail in core melt environment.

Core Melt Base Case - Fans will operate Interactions Worst Case - No credit for fans in any sequences Diesel-Driven Diesel-driven pump depends on SWS cooling Containment Spray Base Case - Diesel Pump depends on SWS Pump Best Case - Diesel pumps is self-cooled IV-37

A three, or more orders of magnitude below high energy ruptures is not_known. To provide a perspective of the maximum potential impact of this issue on the Zion risk profile, the pipe rupture frequency for the CCWS is analyzed as a sensitivity issue by removing the pipe rupture failure mode from the sequence 1 model.

Manual Switchover to Recirculation Cooling Three of the top four sequences for Zion involve a LOCA initiator followed by failure of recirculation cooling.

Failure to switchover to recirculation cooling has a significant human error contribution. For the small LOCA sequence (2), human error contributes approximately 50%. For the large and medium LOCA sequences (3 and 4), human error contributes 93%. No specific issues have arisen concerning these sequences. Discussions with Commonwealth Edison personnel did not disclose any information to suggest improved

, reliability in the procedures for manual switchover. However, since other 1150 plant analyses are putting significant uncertainty bounds on human errors (error factors of 10), the human error portions of these three Zion sequences are adjusted to illustrate a potential impact due to the uncertain nature of the human reliability analysis. The human error contributions to each sequence were assumed to be log-normally distributed random variables with error factors of 10. 95% and 5%

quantiles were calculated for the sensitivity analysis.

RCP Seal LOCA Model The 1150 RCP seal LOCA model for the base case calculations uses a cumulative probability distribution with 5% and 95%

values at 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months and 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months , respectively. The best case model assumes 5% and 95% values at 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months and 15 hours1.736111e-4 days 0.00417 hours 2.480159e-5 weeks 5.7075e-6 months . The worst case model assumes 5% and 95% values at 1/2 hour and 4

hours. For each relevant Zion sequence, the appropriate value for probability of an RCP seal LOCA given loss of the CCWS was I

taken from these three cases. I Common-Mode Analysis Common-mode analysis for the rebaseline of Zion using Fleming Beta factors was limited to the CCWS, SWS, and Unit 2 dedicated l diesel generators. Any common-cause analysis which was

! incorporated into other system models in the ZPSS was retained in this analysis. The common-mode pumps and diesel generator

, events were quantified using Beta factors from Fleming's report, EPRI NP-3967.4 Thic is assumed to represent a worst case for the common-mode analysis. As a common-mode best case, the three common-mode events were dropped from the rebaseline.

1 I

IV-38 I

l

)

i RWST Refill Certain late core-melt plant damage states are affected by the ability to use containment spray injection pumps as a backup to the containment spray recirculation system. In the event of recirculation failure, containment spray injection can be extended over long periods of time by refilling the RWST. The Zion Review did not take credit for refilling the RWST since procedures did not exist at the time of the Review. Procedures now exist to replace the depleted water supply in the RWST if the operators deem it necessary. The base case rebaseline takes credit for refilling the RWST in late core damage sequences where recirculation has failed. The probability of success is assumed to be 1.0. No HRA was performed to discount the success probability. For the sensitivity analysis, no credit is given for refilling the RWST.

Containment Spray Iniection Room Cooling The rebaseline base case assumes that containment spray I injection pumps will fail if room cooling, supplied by the SWS, fails. Since containment spray pumps draw suction from water 3

at approximately ambient temperature, the resulting increase in 1 pump room temperature may be low enough so as not to damage the

pump motors. As a sensitivity, the motor-driven containment spray pumps are assumed to be independent of the SWS.

Containment Fans - Core Melt Interaction

! One of the Review's sensitivity issues dealt with the question of whether or not containment fans would fail due to plugging of filters or coolers with aerosols, or cable failure due to radiation. As a sensitivity, no credit for containment fans is given in any of the sequences.

i Diesel-D_ riven Containment Spray Pump One of the containment spray pumps at Zion is driven by a diesel engine. This pump still has AC dependency due to its need for SWS cooling of the diesel engine jacket and due to its need of AC power for control. The NRC has recommended that this pump be made self-cooling to enhance containment cooling during station blackout core-melt sequences. The effect of this en sequence and damage state frequencies is analyzed as a sensitivity.

IV.7.2 Sensitivity Ouantification The sensitivity issues were analyzed by reevaluating the accident sequence equations in Section IV.6. Each issue is applied to the sequence models appropriate for that issue. The sensitivity calculations are illustrated below.

IV-39

IV.7.2.1 CCWS Pipe Rupture The Zion Review discusses the quantification of CCWS pipe rupture on page 3-7. The model is based on the WASH-1400 model for high pressure pipe rupture. Since CCWS pipes experience a significantly different environment, the frequency of CCWS pipe rupture as an initiating event failure of CCWS is dropped well below %he frequency due to other failure modes for the sensitivity analysis. One sequence is relevant to this issue, sequence 1.

Sequence 1 Sequence 1 is initiated by loss of CCWS, followed by failure of the seal cooling and cooling to the high pressure injection pumps, both cooled by the CCWS, and finally an RCP seal LOCA.

As shown in Section IV.6.1, the sequence frequency is due to nonrecoverable CCWS pipe ruptures and other failure modes of the CCWS:

Frequency of Sequence 1 = Pipe ruptures + other failure modes

= 1.2E-4 + 5.5E-6.

The above equation shows that the best case estimate for sequence 1 is (assuming CCWS pipe rupture frequency to be very low):

Frequency of Sequence 1 - 5.5E-6 IV.7.2.2 Manual Switchover to Recirculation Cooling Three sequences (sequences 2, 3, and 4) are relevant to this issue. These sequences involve LOCA initiators followed by failure of recirculation cooling. The human error portions of these sequences are assumed to be lognormally distributed random variables with error factors of 10. New sequence frequencies are calculated to illustrate a potential range of frequencies due to uncertainty of the human error terms.

Sequence 2 The frequency of sequence 2 is 1.6E-5, the product of small LOCA frequency, .036/yr. and failure of high pressure recirculation. From the Zion Review, page 2-34, failure of high pressure recirculation is 3.9E-4, of which 1.6E-4 is due to human error and 2.3E-4 is due to hardware faults. To incorporate an error factor of 10 on the human error term (assuming a log-normal distribution), the median value must first be calculated, since the human error term is defined in the ZPSS as a mean value of a log-normally distributed random variable:

IV-40

[ ~\2 Median Human Error = 1.6E-4 x exp-

= 6.0E-5 1.645 x n(EP)

-)

f k

The upper and lower sequence frequency estimates are:

l High Sequence Frequency = 0.035/yr. x [2.3E-4 + (6.0E-5x10)]

= 2.9E-5/yr.

Low Sequence Frequency = 0.035/yr. x [2.3E-4 + (6.0E-5x0.1)]

= 8.lE-6/yr.

Sequences 3 and 4 Sequences 3 and 4 have the same failure models and initiator frequencies. They are different only in the definition of their initiators; sequence 3 involves a large LOCA, sequence 4 involves a medium LOCA. The initiators are followed by failure of low pressure recirculation cooling. From the Zion Review, page 2-34, the probability of loss of low pressure recirculation is 5.16E-3, of which 4.8E-3 is due to human error, and 3.6E-4 is due to hardware faults. Calculating a median human error term for sequences 3 and 4, assuming an error factor of 10, yields:

Median Human Error = 1.8E-3 The upper and lower sequence frequency estimates are:

High Sequence Frequency = 9.4E-4/yr.x[3.6E-4+(1.8E-3x10)]

= 1.7E-5/yr.

Low Sequence Frequency = 9.4E-4/yr.x[3.6E-4+(1.8E-3xO.1)]

= 5.lE-7/yr.

IV.7.2.3 Reactor Coolant Pump Seal LOCA Model The 1150 RCP seal LOCA analysis models the probability of an RCP seal LOCA given loss of seal thermal barrier cooling as a Weibull distributed random variable as a function of time. The Weibull cumulative probability function is:

(y B F(T) -

= l-exp 'b I where T is time in hours, and y and B are the parameters of the Weibull distribution.

The base case seal LOCA model assumes that the .05 and .95 quantiles of the distribution occur at T = one hour and ten hours, respectively. The best case model assumes that the .05 IV-41

and .95 quantiles occur at T- 2 and 15 hours1.736111e-4 days 0.00417 hours 2.480159e-5 weeks 5.7075e-6 months . The worst case model assumes .05 and .95 quantiles at 0.5 and four hours.

These assumptions yield the following values for the distribution parameters:

Base Case Best Case Worst Case B 1.77 2.02 1.96 9 5.38 8.70 2.29 The probabilities of an RCP seal LOCA for the various times modeled for Zion loss of offsite power sequences are:

Time at which Probability of Seal LOCA

, Seal LOCA Occurs Base Case Best Case Worst Case 1 Hour 0.05 0.013 0.18 4 Hours 0.45 0.2 1.0 8 Hours 1.0 1.0 1.0 Although the probability model for the worst case would yield a value of .95 for a seal LOCA at four hours, a value of 1.0 was used as a slight conservatism. The probability of an RCP seal LOCA at eight hours is assumed to be 1.0 for the purpose of sequence modeling. All sequences for which AC power is not restored within eight hours involve no successful restoration of AC at any time. Therefore, an RCP seal LOCA will eventually Ocur due to loss of CCWS and high pressure injection.

The results of the best and worst case seal LOCA models are discussed below for the relevant sequences.

Sequence 8 Sequence 8 involves loss of offsite power, failure of either the CCWS or SWS, and failure to restore AC power before one hour, but successful restoration of AC power by four hours.

The probability of a seal LOCA for this sequence is quantified at T = 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . The probabilities for RCP seal LOCA for T = 1 i hour shown above - 0.05 for the base case, 0.013 for the best 1 case, and 0.18 for the worst case - are incorporated into the l sequence model in Section IV.6.8 under the column " Probability of RCP Seal LOCA at 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months ." The sequence model in Section IV.6.8, which illustrates the calculation of the base case l sequence frequency, is shown below with the seal LOCA l probability for the best case calculations:

IV-42

Failure to Restore AC Prob. of I

Power by 1 Hr. Loss of Power RCP Seal -

On (Restored CCWS or State LOCA Buses by 4 Hrs.) SWS Prob. at 1 Hr. Total All O.23 2.2E-5 0.38 1.0 1.9E-6 147,148 0.26 7.8E-5 3.6E-2 0.013 9.6E-9 147,149 0.26 7.8E-5 3.6E-2 0.013 9.6E-9 148,149 0.26 6.5E-5 0.45 0.013 9.9E-8 147 0.26 3.8E-3 3.2E-3 0.013 4.2E-8 148 0.26 1.2E-3 4.5E-2 0.013 1.8E-7 149 0.26 1.2E-3 4.5E-2 0.013 1.8E-7 None 0.26 2.5E-2 3.9E-3 0.013 3.4E-7 2.8E-6 Frequency of Sequence 8 - LOSP x 2.8E-6

= .061/yr. x 2.8E-6

= 1.7E-7/yr.

The worst case calculations are done in a similar manner. The resulting sensitivity values for Sequence 8 are:

Base Best Worst Sequence 8 Frequency 3.2E-7 1.7E-7 8.4E-7 Sequence 11 Sequence 11 is the same as Sequence 8, except that four hours is the time at which the seal LOCA is modeled. Therefore, the conditional probability of a seal LOCA at four hours given no seal LOCA at one hour must be calculated from the seal LOCA probabilities:

i I Base Case = 1[ 05

Best Case = .2 = .2 1 .013 Worst Case = 1.0 The conditional probabilities for RCP seal LOCA calculated above are incorporated into the sequence model in Section IV.6.11 under the column " Probability of RCP seal LOCA at 1 Hr." The sequence model in Section IV.6.11, which illustrates the calculations of the base case sequence frequency, is shown below with the seal LOCA conditional probability for the best case calculations:

IV-43

l l

l 1

Failure to l Restore AC RCP by 1 Hr. Loss of Power Seal Power (Restored CCWS or State LOCA On Bus by 4 Hrs.) SWS Prob. Prob. Total All 0.05 2.2E-5 0.38 1.0 8.4E-7 147,148 0.02 7.8E-5 3.6E-2 0.2 1.1E-8 147,149 0.02 7.8E-5 3.6E-2 0.2 1.lE-8 148,149 0.02 6.5E-5 0.45 0.2 1.lE-7 147 0.02 3.8E-3 3.2E-3 0.2 4.7E-8 148 0.02 1.2E-3 4.5E-2 0.2 2.2E-7 149 0.02 1.2E-3 4.5E-2 0.2 2.2E-7 None 0.02 2.5E-2 3.9E-3 0.2 4.3E-7 1.9E-6 Frequency of Sequence 11 = LOSP x 1.9E-6

= 0.061/yr. x 1.9E-6

= 1.2E-7/yr.

The resulting sensitivity values for Sequence 11 frequency are:

Base Best Worst Sequence Frequency 1.5E-7 1.2E-7 1.5E-6 IV.7.2.4 Common Mode Event Probabilities Table IV.7.3 shows the SWS and CCWS unavailabilities for each power state quantified for two different cases, 1) point estimate common mode values were calculated with Fleming's Beta factors, and 2) no common mode events included in the models.

For a sensitivity study, the SWS, CCWS, and Unit 2 diesel generator common mode events were removed from the system models. Except for the electric power state "All", this sensitivity has only moderate impact on the system unavailabilities, as is seen on Table IV.7.3. For the sensitivity analysis, the SWS and CCWS unavailabilities without common mode events replace the appropriate system unavailabilities in the sequence models illustrated in Section IV.4.6. This issue is relevant for Sequences 7, 8, 9, 11, 12, 13, 16, and 17, but the effect of removing these common-mode events from the sequence models has a significant impact only for sequences 9, 16, and 17.

IV.7.2.5 RWST Refill All sequences involving failure of recirculation cooling (sequences 2, 3, and 4) were modeled with successful long-term operation of the containment sprays due to procedures for refilling the RWST. A success probability of 1.0 was assigned to RWST refill. To evaluate a sensitivity range for this issue, no credit is given for RWST refill. The plant damage states for sequences 2, 3, and 4 change as follows.

IV-44

f 1

a j

4 i

j Table IV.7.3. Zion Rebaseline System Unavailability for SMS, CCWS l

Eton Power States i Power Available Without Betas With Fleming Betas at Unit 1 Buses Subcases SWS CCWS Total SWS CCWS Total All 4 3.3E-8 1.1E-8 4.4E-8 2.2E-5 2.2E-5 4.4E-5 147,148 3a 1.0E-5 1.2E-5 2.2E-5 3.8E-5 4.0E-5 7.8E-5 l

.i j 147,149 3a 1.0E-5 1.2E-5 2.2E-5 3.8E-5 4.0E-5 7.8E-5 t M

! <* 148,149 3b and 3c 1.OE-6 1.2E-5 1.3E-5 2.4E-5 4.1E-5 6.5E-5 I I I

$ 147 2a 2.1E-3 8.3E-4 2.9E-3 3.0E-3 8.5E-4 3.8E-3 i

! 148 2b and 2c 2.2E-4 8.8E-4 1.1E-3 3.3E-4 9.0E-4 1.2E-3 1

149 2b and 2c 2.2E-4 8.8E-4 1.1E-3 3.3E-3 9.0E-4 1.2E-3 l None la and Ib 1.4E-2 1.0E-2 2.4E-2 1.5E-2 1.0E-2 2.5E-2 j i

4 I

i i

1 1

4

Damage State Sequence Best Worst 2 SLFC SLF 3 ALFC ALF 4 ALFC ALF There is no effect on tha sequence frequencies, as this issue affects containment cooling systems, not the ECCS.

IV.7.2.6 Containment Fan - Core Damage Interactions For this sensitivity issue, all plant damage states which have j success of the containment fans are no longer legitimate states j and the relevant sequences are shifted to other states. The j sequences affected are sequences 1, 2, 3, 4, 5, 6, 7 8, 11, 1 15, and 17.

Frequency Damage State Best Worst SEFC 1.0E-4 0.0 TEFC 2.6E-6 0.0 AEFC 1.4E-6 0.0 ALFC 1.0E-5 0.0 SLFC 1.6E-5 0.0 SEC 1.0E-7 1.0E-4 TEC 0.0 2.6E-6 ALC O.0 1.0E-5 SLC 0.0 1.6E-5 AEC 0.0 1.4E-6 IV.7.2.7 Containment Spray Diesel Driven Pump - AC Independence If the containment spray diesel driven pump is redesigned to be fully AC power independent. four sequences are affected. The plant damage states for Sequences 9, 12, and 16 will change.

These sequences involve unrecoverable failures of the SWS, resulting in loss of all containment cooling, and plant damage state SE. The damage state for these sequences will change to SEC (successful operation of containment sprays) if the diesel driven pump is independent of all AC power and SWS dependencies. The sequence frequencies will not change.

Because these sequences do not include any direct failures of the containment Spray Injection System, failure of the diesel driven CS pump was not added to the sequence models. The effect of this would be to maintain sequences 9, 12, and 16 in damage state SE, but with lower frequencies.

Sequence 10 is affected significantly in frequency by this issue. Sequence 10 involves loss of offsite power, loss of ,

either the CCWS or SWS - due to mechanical pump failures and diesel generator failures - failure to restore any of the failed AC power within eight hours, and failure of the IV-46 i

Containment Sprays and Fan Coolers. Although the improved reliability of the CS would reduce the frequency of this sequence, it should be noted that even if the containment systems succeed, the resulting set of events will still result in core damage. The set of events similar to this sequence, with the exception that containment systems succeed, are treated in sequences 12 and 13.

With AC independence, the sprays would be more reliable for i

degraded power states. The diesel spray pump is currently l dependent on electric power bus 149 for controls. On page 2-35 I

of the Zion Review, the unavailability of the sprays is calculated for each power state. A new system unavailability for each power state is calculated below assuming AC and SWS independence of the diesel-driven pump, based on component unavailabilities in the Zion Review. The unavailability is calculated for two cases; 1) SWS succeeds, and 2) SWS fails.

Containment Failure Model Given SWS Success:

All AC Power Available - This is the basic calculation for CS described on page 2-35 of the Review. The CS unavailability is unaffected by AC independence for the diesel spray pump, 6.3E-5.

Power on Buses 147 and 148 - If the diesel driven pump is AC independent, this case is the same as power on all AC buses.

The value is 6.3E-5.

Power on Buses 147 and 149 - One motor driven pump is powered by bus 147, and the diesel pump train is unaffected by the power state. The system failure is dominated by failure of these two trains. The value is unchanged from the base case value of 4.6E-4.

P(Motor Train FTS) x P(Diesel Train FTS) = 6.8E-3x6.8E-2

= 4.6E-4 Power on Buses 148 and 149 - This case is the same as for power states 147, 149; 4.6E-4.

Power on Bus 147 - One motor driven train is powered by bus 147, and the diesel-driven pump is also available. This case is the same as power states 147, 149 and 148, 149; 4.6E-4.

Power on Bus 148 - This case is the same as power state 147; 4.6E-4.

Power on Bus 149 - Only the diesel driven pump is available at the onset of the sequence. The value is failure of the diesel pump train to start; 6.8E-2.

Failure of All AC Buses - This case is the same as power state 149; 6.8E-2.

IV-47

A comparison of containment spray unavailability for the base

, case and best case (diesel pump is AC independent) is shown i below:

1 Loss of Containment Sprays (SMS Succeeds)

Power State Base Case Best Case All 6.3E-5 6.3E-5 147,148 1.2E-4 6.3E-5 147,149 4.6E-4 4.6E-4 l 148,149 4.6E-4 4.6E-4 147 6.8E-3 4.6E-4 148 6.8E-3 4.6E-4 149 6.8E-2 6.8E-2 None 1.0 6.8E-2 The above system unavailabilities are applicable only assuming SMS succeeds. Containment spray pumps rely on SWS for room cooling (this is treated as another sensitivity in Section IV.7.2.8). Furthermore, given loss of offsite power and failure to restore AC power, loss of SWS will fail all diesel generators, result in a blackout situation, which would fail all the motor-driven pumps. In the base case, all for loss of SMS, containment sprays f ailed with probability 1.0, since even i the diesel pump would fail in a blackout. For the best case i' sensitivity, the spray unavailability is simply the value for failure of the diesel driven train for all power states:

containment Spray Failure

! (Given Loss of SMS)

Power State Base Case Best Case i

All 1.0 6.8E-2 i 147,148 1.0 6.8E-2 147,149 1.0 6.8E-2 148,149 1.0 6.8E-2 147 1.0 6.8E-2 148 1.0 6.8E-2 149 1.0 6.8E 2

]

None 1.0 6.8E-2 f

} The best case containment spray values were substituted into

'l the Sequence 10 equations of Section IV.6 to evaluate the impact of an AC independent containment spray pump. The resulting frequency is Best Case Frequency of Sequence 10 = 2.8E-8/yr.

Base Case Frequency = 2.lE-7/yr.

l IV-48

IV.7.2.8 Containment Spray Injection Room Cooling System diagrams in the ZPSS of the SWS show that containment spray injection pumps depend on the SWS for room cooling. If room cooling is not necessary for containment spray operation, then only the diesel-driven pump is directly dependent on SWS.

This issue is relevant to all sequences in which containment spray is modeled as failed by SWS loss - sequences 9, 12, and

16. But only sequence 9 would be affected by this sensitivity. In sequences 12 and 16, loss of SWS leads to a station blackout since loss of AC power is never restored. The containment sprays will fail electrically. In sequence 9. AC power is restored, so that the containment spray pumps will also be restored to service. The frequency of sequence 9 is not affected, but its plant damage state classification changes from SE to SEC.

IV.8 REVIEW OF LICENSEE EVENT REPORTS (LERs)

Although a detailed plant-specific data analysis was beyond the scope of this analysis, all LERs, which occurred at Zion Units 1 and 2 between January of 1983 and January 1985, were reviewed.

The LERs were qualitatively assessed for relevancy to the Zion accident sequence models. A total of twenty-five LERs was identified which involved potential failures of systems modeled in the dominant sequences. Some of the LERs identified failures, and some identified problems which did not fail any systems or components, but which might lead to failures if left unattended. Most of these LERs include corrective actions taken by plant personnel to avoid future reoccurrence of these events. The LERs are listed on Table IV.7.4.

The systems affected by these LERs are listed below along with the number of relevant LERs found:

System Number of LERs Containment Fans or Sprays 6 Diesel Generators 16 Emergency Injection 1 Emergency AC Bus 1 SWS 1 The containment systems and SWS reliabilities are relevant to all the dominant sequences. The reliability of the other systems and components above are relevant to twelve of the seventeen dominant sequences, but not the four most significant sequences. Without performing a thorough engineering and statistical investigation of these systems and components, it is not possible to estimate the impact of these events on the risk profile for Zion. The data may represent improvement or worsoning of past historical performances of plant systems.

Furthermore, a more detailed study of the LERs may turn up more, or fewer, reports worthy of note.

IV-49

- - = - - -

Table IV.7.4. Licensee Event Reports Relevant to Zion Dominant Sequences - January 1983 to January 1985 LER Number Systems or Components Involved 295-83-019 Diesel Generator - 1A

. 295-83-023 Diesel Generator - 0 295-83-024 Containment Spray Pump 1B 295-83-026 Diesel Generator - O i 295-83-039 Diesel Generator - 0 i 295-85-002 Diesel Generator - lA 295-85-003 Diesel Generator - 0 299-85-010 Diesel Generator - 0 295-85-022 Gafety Injection System 295-85-029 Diesel Generators - 1A and IB 295-85-039 Service Water System 304-83-002 Emergency AC Bus 247 304-83-007 Diesel Generator - 0 304-83-029 Containment Fans 304-83-035 Diesel Generator - 2A 304-83-040 Containment Fans 304-83-043 Containment Sprays and Fans 304-83-044 Containment Sprays '

304-84-013 Containment Fans 304-85-001 Diesel Generator - 28 304-85-002 Diesel Generator - 0 304-85-003 Diesel Generator - 2B i 304-85-007 Diesel Generator - IB 304-85-014 Diesel Generator - 2B '

304-85-015 Diesel Generators - 2A and 2B I

j i

i I

l i

4 IV-50

v V. RESULTS This section presents the final results of the Zion rebaseline. These results include the dominant core damage sequences, their frequencies and contributors, plant damage state frequencies, and results of sensitivity studies on the key issues on the study. In addition, a comparison of these results with those of the Zion Review are presented.

Section V.1 presents the results from the perspective of overall core damage frequency and sensitivity studies on key issues of modeling, success criteria, and data development.

Section V.2 presents the results from the perspective of plant damage states. Section V.3 describes the core damage sequences on an individual basis and identifies their dominant contributors. Section V.4 compares the results of this study with the results of the Zion Review. Differences in results due to plant modifications, failure data, and study methodology are discussed.

V.1 CHARACTERIZATION OF CORE DAMAGE FREQUENCY AT ZION The Zion rebaseline redefined and requantified the fifteen dominant accident sequences identified in the Zion Review into seventeen sequences, using the same methods employed in the Zion Review. These sequences, their frequencies, plant damage states, and a brief description of each sequence are shown on Table V.1.1. The corresponding infcrmation at each sequence from the Zion Review is also included on Table V.l.1 for comparison. The frequencies in Table V. l.1 are point estimate values. They should not be construed to represent any values from statistical distributions, such as means or medians. The Zion system models were quantified using estimates of statistical means of basic event probabilities, but the distributions of the accident sequence frequencies were not calculated or determined. So the values on Table V.1.1 cannot be assumed to represent points from statistical distzibutions.

The total core damage frequency estimate for Zion is 1.5E-4.

As with the individual accident sequence frequencies, this value is a point estimate, and does not represent a value taken from a statistical distribution of the core damage frequency estimate.

The sensitivity studies and their impact on core damage frequency are summarized in Table V.1.2, along with the i sensitivity results for the plant damage states. The sensitivity issues and quantification are discussed in Section IV.7. The bottom row on Table V.1.2 shows that the total core melt frequency is affected very little by any sensitivities except CCWS pipe rupture frequency. CCWS pipe rupture is the major contributor to sequence 1 on Table V.1.1. This sequence is by far the most significant to core damage frequency. The V-1

Table V.l.l. Zion Dominant Accident Sequences Rank Sequence Frequency (yr-1) Damage State New Zion Review New Review New Review 1 1 CCW Failure, causing failure of all 1.2E-4 2.OE-4 SEFC SEFC charging and SI pumps, seal LOCA 2 5 Small LOCA: failure of recirculation 1.6E-5 1.6E-5 SLFC SLF 3 9 Large LOCA. failure of recirculation 4.9E-6 4.9E-6 ALFC ALF cooling 4 10 Medium LOCA, failure of recirculation 4.9E-6 4.9E-6 ALFC ALF cooling 5 14 Loss of offsite power: failure of AFWS 2.lE-6 1.LE-6 TEFC TEFC failure of feed and bleed; failure to restore AC power in I hour (recovery y prior to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months ) u 6 12 Large LOCA: failure of low pressure 1.4E-6 1.4E-6 AEFC AEFC injection 7 13 Loss of offsite power; failure of AFWS 5.7E-7 1.lE-6 TEFC TEFC

! failure of feed and bleed; failure to restore AC power in 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months (recovered by 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months ) 8 3 Loss of offsite power: CCW/SWS loss, 3.2E-7 4.OE-5 SEFC SEFC failure to recover AC power in I hour (recovery prior to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months ) 9 - Same as sequence 8. only this repre- 3.OE-7 -

SE -

seats the SMS common mode portion of the rebaselined Zion Review sequence No. 3 e

4 . . , . . . - - - - -

Table V l.l. Zion Dominant Accident Sequences (Continued)

Rank Sequence Frequency (yr-1) Damage State New Review New Review New Zion Review Loss of offsite power; CCW/SWS loss: 2.lE-7 4.7E-6 SE SE 10 11 failure to restore AC power in 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months failure of containment sprays and fan coolers Loss of offsite power; CCW/SWS loss; 1.5E-7 4.6E-5 SEFC SEFC 11 2 failure to restore AC power in 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months (recovery prior to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months )

Loss of offsite power, failure of SWS; 1.5E-7 - SE -

12 -

failure to restore AC power in 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months ; i failure of containment fans. This

" sequence represents the SWS portions of the rebaselined Zion Review Sequence No. 4 and No. 6 1.OE-7 1.8E-5 SEC SEC 13 4 Same as sequence 12 above, only this is the CCW portion of the rebaselined Zion Review sequence No. 4 1.OE-7 1.OE-7 V V 14 - Interfacing Systems LOCA Failure of DC bus 112, causing loss 5.OE-8 7.OE-6 TEFC TEFC 15 7 of one PORV and loss of AC bus 148, failure of Auxiliary Feedwater Same as sequence 11, only this repre- 4.8E-8 - SE -

16 -

sents the SWS common mode portion of the rebaselined Zion Review sequence No. 2 3.7E-8 8.OE-6 SEFC SEFC 17 6 Loss of offsite power; CCW failure failure to recover AC power in 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months

Table V.1.2. Plant Damage State Sensitivity Results CCWS Pipe Manual Switchover Damage State RCP Seal 14CA Common RWST CS Room CF-Core' Diesel Rupture for Recirc.

mode Defill cooling Damage CS Pump Best Sest Worst Plant Damage Category same case Best Worst Early Core Damage with aEC 0.0 1.4E-6 Contaanment Coo 11aq TEC 0.0 2.6E-6 1.3E-4 0.0 6.0E-6 SEFC 1.2E-4 1.2E-4 TEFC 2.7E-6 0.0 AFFC 1.4E-6 0.0 4.0E-7 1.2E-4 6.7E-7 SEC 1.0E-7 1.2E-4 1.2E-4 1.3E-4 I.2E-4 1.2E-4 T.7E7 1.2E-4 1.2E-4 N N N Total l

l 7.oE-7 7.eE-7 3.9E-7 2.8E-O -

Early Core Damage with- SE DET N N T TE 7 out containment Caoling Total 7.~5E 7 N N D E7 N 3.9E-7 7.oE-7 0.0 0.0 1.0E-6 3.4E-5 Late Core Damage with ALFC 1.0E-5 8.1E-6 2.9E-5 yp containment cooling si. C ALF 1.6E-5 O.0 0.0 1.0E-5 0.0 0.0 SLF 0.0 1.6E-5 0.0 ALC 0.0 0.0 1.0E-5 0.0 0.0 1.6E-5 SLC 2.6E-5 2.6E-5 6.38-5 Total DM 2.6E-5 2.6E-5 2.6E-5 2.6F-5 2.6E-5 2.6E-5 9.IE-6 Late Core Damage with- AL 0.0 out Containment Cooling SL 0.0 0.0 0.0 G 0.0 0.0 U U U U U U Total 1rterfacsag Systems v 1.0E-7 N N N DM

!aCA Total TTE 7 N N N 1.0E-7 N 1.0E-7 W -4 1.5E-4 1.5E-4 1.5E-4 1.5E-4 1.5E-4 3.6E-5 1.4E-4 1.5E-4 Debaseline Total 1.5E-4 1.5E-4 Notes: For each sensitivity, frequencies are listed only for relevant plant damage states. However, the total frequency for each plant damage category is listed for each sensitivity regardless of relevancy.

1 I

1

Table v.1.3. Sensitivity Results CS Room CF-Core Diesel CCWS Pipe Repeal Switchover PCP Seal LOCA Common Mode RWST Reft!! Cooling Damage CS Pump Rupture for Rectrc.

Sequence sase Case Best worst Review Best worst mest worst Best seat Best worst 1 1.2E-4 SEFC SEC 5.55-6 2 1.6E-5 SLFC SLF SLC S.1E-6 2.95-5 3 4. 9 E'6 ALFC ALF ALC 5.1E-7 1.7E-5 4 4.9E-6 ALFC ALF ALC 5.1E-7 1.7E-5 5 2.!E-6 TEFC TEC 6 1.4E-6 AEFC A EC 5.7E-7 TEFC 5.7E-7 TZC 8 3.2E-7 SZFC 1.7E-7 8.4E-7 6.7E-6 1.6E-7 SEC

9 3.0E-7 SE 4.0E-11 SEC SEC

[, 10 2.1E-7 SE 1.5E-7 2.8E-0 11 1.5E-7 SEFC 1.2E-7 1.5E-6 1.5E-6 1.2E-7 SEC 12 1.5E-7 SE 1.2E-7 SEC 13 1.0E-7 SEC 1.0E-7 le 1.0E-7 y 15 5.0E-S TEFC TEC 16 4.4E-S SE 3.SE-11 SEC 17 3.7E-S SEFC 7.9E-9 SEC Total 1.5E-4 1.4E-4 1.6E-4 1.6E-4 1.5E-4 1.5E-4 1.5E-4 1.5E-4 1.5E-4 J.6E-5 1.4E-4 1.5E-4 uctes: Impacts are noted in sensitivity columns only where relevait so specific sequences. Where plant damage states appear in sensitivity columwe, this indicates that the sequence's damage state classification is af fected, not its core-melt frequency.

l

results of the sensitivity studies for each sequence are shown on Table V.l.3. As can be seen, CCWS pipe rupture is the only sensitivity which affects the core damage frequency for sequence 1, so the impact of all the other sensitivities are overshadowed by by CCWS pipe rupture.

V.2 CHARACTERIZATION OF PLANT DAMAGE STATE FREQUENCIES The development of plant damage states has been previously discussed in Section I.3. Table V.2.1 displays the dominant plant damage state frequencies for the rebaselining.

Table V.2.1 displays the dominant plant damage state frequencies for the rebaselining. Recall that the ZPSS and

Zion Review plant damage states are defined by a four letter l system. The first letter denotes the behavior of the accident sequences in the damage states (S E Small LOCA. A E Large or Medium LOCA. T E Transient). The second letter denotes the timing of core melt, early - during injection cooling (E),

or late - during recirculation cooling (L). The last two i

letters denote the status of the containment fans and containment spray systems. C denotes that the containment j sprays are available; F denotes that the fan coolers are i available. The interfacing systems LOCA sequence has its own labeling scheme, simply the letter V. The damage states have been grouped into five major categories on the left side of Table V. 2.1. For each major category, the plant damage states have similar core damage timing and containment status. Tne various plant damage categories and their dominant damage states are discussed below.

V.2.1 Early Core Melt with Containment Coolina This category remains the most dominant category. The resulting frequency, 1.0E-4, is dominated completed by damage state SEFC and the rebaselined sequence 1 - Loss of CCWS, failure of HPIS and RCP seal integrity. This damage category is affected significantly only by the CCWS pipe rupture frequency sensitivity, as shown in Table V.l.2. The damage l category frequency is reduced in this sensitivity by an order of magnitude to 1.0E-5. The sequences in this category are:

Plant Damace State Seauence SEFC 1,8,11,17 TEFC 5,7,15 AEFC 6 SEC 13 V.2.2 Early Core Melt without Containment Coolino This category is dominated by sequences 9 and 10. The frequency of sequence 10 was reduced by an order of magnitude V-6

Table V.2.1. Damage State Frequencies Plant Damage State Containment Damage Categories Success Mode State Frequency (Yr-1)

Early Core Melt with Fans and Sprays SEFC 1.2E-4 Containment Cooling TEFC 2.7E-6 AEFC 1.4E-6 Sprays Only SEC 1.OE-7 1.2E-4 Early Core Melt with- None SE 7.0E-7 out Containment Cooling Late Core Melt with Fans and Sprays ALFC 1.0E-S

< Containment Cooling SLFC 1.6E-S

O Fans Only ALF 0 SLF 0 2.6E-5 Late Core Melt with- None AL -

out Containment Cooling SL -

Interfacing Systems LOCA '.' l.0E-7

by the rebaselining, due primarily to the less stringent success criterion for the CCNS. However, the decrease was partially offset by sequences 9, 12, and 16 which have failure of containment fans and sprays, primarily due to common-mode failure of the SWS.

Only one plant damage state is relevant here, SE. Table V.l.2 shows that this plant damage state is affected very significantly by the sensitivity issue on AC independence of the diesel-driven containment spray pump. This issue is discussed in Section IV.7.2.7. The diesel engine currently depends on AC power indirectly through the SMS, which cools the diesel. The effect of this issue can be seen on Table V.l.3.

Under the column - " Diesel CS Pump Best" - the frequency of sequence 10 is 2.8E-8 reduced from 2.lE-7 in the base case, while the plant damage states of sequences 9, 12, and 16 change to SEC, since the containment sprays would not fail with loss of the SWS.

Plant Danace State Sequence SE 9,10,12,16 V.2.3 Late Core Melt with Containment Coolina The overall frequency for this category is unchanged from the -

Zion Review even though the actual plant damage states of the category change from ALF and SLF to ALFC and SLFC, respectively. The plant damage states have changed to allow for long-term use of the containment sprays, giving credit for procedures to refill the RWST.

Table V. l.2 shows that the plant damage state assignments for i ALFC and SLFC flip back over to ALF and SLF if it is assumed I that the RWST cannot be refilled. Refilling the RWST would i

f permit continued operation of the containment sprays in replacement of the failed containment recirculation system (all recirculation systems at Zion share the same low pressure pumps

- so loss of recirculation core cooling affects the recircula-tion containment cooling as well). It should be noted that the accident sequences in this damage category do not involve any degraded power status at emergency or non-emergency buses. So alternate sources of RWST water should be available during these sequences. Comparing the results for ALF and SLF in the Zion Review with the rebaseline results for ALFC and SLFC provides a full range sensitivity perspective on the issue of refilling the RWST.

V.2.4 Late Core Melt without Containment Coolina This category does not figure in the dominant sequences, but is included here for completeness.

V-8

Plant Damace State Sequence AL None SL V.2.5 Interfacina Systems LOCA This category, the V sequence, was included in the Zion Review despite its low frequency because of the potential for high consequences. No sensitivities were relevant to this damage state.

Plant Damace State Sequence V V V.3 CHARACTERIZATION OF DOMINANT ACCIDENT SEQUENCES The dominant core damage sequences and their associated plant damage states were identified in Sections V.1 and V.2. Table V.l.1 shows the dominant accident sequence damage states and core damage frequencies. Table V. l . 3 shows the results of the sensitivity analysis for each sequence. The results of the rebaseline calculations and sensitivity analysis are discussed below for each sequence.

V.3.1 Sequence 1 - CCW Failure. Causing Failure of all Charginq and SI Pumps. Seal LOCA The initiator for this sequence is loss of the CCWS. Loss of the CCWS results in loss of cooling to the RCP seal thermal barriers, resulting in a seal LOCA. Both charging pumps fail due to loss of CCWS, as do the two safety injection pumps when they are actuated in response to low reactor pressure.

Containment cooling systems remain functional, but core damage results due to inability to replace primary coolant. This sequence is placed in plant damage state SEFC. The dominant contributor to loss of CCWS is pipe rupture in the CCWS.

Just as in the Zion Review, this sequence is the most significant by far. The rebaseline frequency is a factor of two lower than in the Zion Review due to the less stringent CCW success criterion. The resulting sequence frequency is dominated by the pipe rupture event in the CCW. This frequency is driven by 1) the frequency of pipe rupture in the CCW, and

2) the small amount of time (approximately 1/2 hour) available to restore CCW before a seal LOCA occurs. These issues may be quantified in a conserva.tive manner. However, in lieu of a detailed human reliability analysis on the CCW recovery procedures and simulator studies of CCW pipe rupture accidents, the models used in the Zion Review are prudent in their conservatism. The probabilistic RCP seal LOCA model does not affect this sequence model since all charging and safety V-9

l i

injection pumps fail due to loss of CCW cooling, and an RCP seal LOCA will eventually occur.

This sequence is affected only by the sensitivity where the CCWS pipe rupture is removed from the sequence model. This

~

sensitivity is discussed in Section IV.7.1. The sequence frequency would be reduced to by a factor of 22 if CCWb pipe rupture is eliminated from the model.

1 V.3.2 Sequence 2 - Small LOCA. Failure of Recirculation Coolina This sequence represents a small LOCA followed by failure of

, the recirculation system to provide high pressure coolant

injection into the primary system. The dominant contributor to

. loss of recirculation is human error in switching the low

! pressure pump suction lines over from injection alignment to recirculation alignment. The HPIS (composed of both the charging pumps and safety injection pumps) takes suction from i the low pressure pumps. Containment systems remain i functional. This sequence is placed in the plant damage state SLFC.

i No changes were made in the frequency estimate for this I

sequence. However, the capability to refill the RWST would allow long-term use of the Containment Spray Injection System

, (CSIS). This would change the ZPSS plant damage state 4

classification for this sequence from SLF in the Zion Review to SLFC. This assumes a 100% successful refilling of the RWST.

Although this is a nonconservative assumption, there are factors which favor this assumption. The failure during recirculation implies that substantial time would be available for the operators to determine the need to refill the RWST and to order such actions. Furthermore, this sequence does not involve any degraded power situations which could substantially increase the probability of failing to refill the RWST. Our rebaselined plant damage state results, when compared to the j

Zion Review values, represent a full sensitivity range for the 1

issue of refilling the RWST.

l Table V l.3 shows that two sensitivities affect the plant

! damage state assignment for this sequence, and one issue affects the core damage frequency. If no credit is allowed for l

RWST refill, the plant damage state becomes SLF, with only fans available for containment cooling. If containment fans are assumed to fail in a core damage environment, the damage state becomes SLC. If both of these issues were applied together, the sequence would be assigned to damage state SL.

Table V.l.3 shows that a noticeable but not too significant range in sequence frequency --

from 8.1E-6 to 2.9E-5 -- could i

result from using low and high point estimates for human error in switching over to recirculation cooling.

{ V-10 I

i l

V.3.3 Sequence 3 - Larce LOCA. Failure of Recirculation Coolina This sequence represents a large LOCA, followed by failure of the low pressure system to provide coolant injection into the primary system. The dominant contributor to loss of recirculation cooling is human error in realigning the low pressure injection system (LPIS) suction valves from injection to recirculation alignment. Containment systems remain functional. This sequence is placed in damage state ALPC.

Just as for sequence 2, above, no changes were made in the point estimate frequency of this sequenca. However, the plant damage state classification was changed from ALP to ALFC, allowing credit for procedures to refill the RNST.

The same set of sensitivities which affect sequence 2 have a similar impact on sequence 3, except that the potential ange of sequence frequency due to low and high human error es' v.aates is significant, more than an order of magnitude, from 5.lE-7 to 1.7E-5. This is because human error is much more important for large and medium LOCAs at Zion than for small LOCAs.

V.3.4 Sequence 4 - Medium LOCA. Failure of Recirculation Coolino The sequence model for this sequence is exactly the same as that for sequence 3, except that the initiator is a medium LOCA.

Just as with sequences 2 and 3, only the plant damage state classification is changed from ALF to ALFC, allowing for refilling of the RWST.

The range of sequence frequency due to potential uncertainty of operator error in switchover to recirculation cooling is the same as for sequence 3 - from 5.lE-7 to 1.7E-5. These two sequences have very similar models.

V.3.5 Sequence 5 - Loss of Offsite Power: Failure of APWS Failure of Feed and Bleed; Failure to Restore AC Power in One Hour (Recovery Prior to Four Hours)

In this sequence, the initiating event, loss of offsite power, is followed by loss of auxiliary feedwater and loss of feed and bleed capability, with failure to restore power in one hour.

The loss of auxiliary feedwater eliminates the capability for secondary cooling, since without offsite power, the main feedwater pumps have tripped and cannot be restored. The loss of feed and bleed capability removes the remaining option for core cooling. The dominant contributors to this sequence are human error in following the feed and bleed procedures and random failure of the AFWS. Containment systems success is ensured by successful restoration of AC within four hours.

This sequence is placed in damage state TEFC.

V-11

- --. . _ . _ _ _ - - . -- - . ~ -. -

The frequency of this sequence increases for the rebaseline analysis because the sequence model includes success of the CCWS and SWS. This success probability has increased with the less stringent success criterion used in the rebaseline for CCWS pumps. Failure of feed and bleed is dominated by loss of AC power to the charging and SI pumps, so there is no benefit from the less stringent feed and bleed success criterion of only 1 of 2 PORVs, as opposed to 2 of 2 in the Zion Review.

Sequence 5 is only affected by the sensitivity studying potential failure of the containment fans in a core damage environment, discussed in Section IV.7.2.6. If the fans failed in this environment, the plant damage state would be assigned to the state TEC.

1 V.3.6 Sequence 6 - Larce LOCA. Failure of Low Pressure Iniection Coolinc j

This sequence represents a large LOCA followed by failure of the LPIS to provide injection coolant. The primary contributor j

is human error in leaving certain MOVs closed after testing the i LPIS. Containment systems remain functional. This sequence is 4

placed in plant damage state AEFC. The sequence is affected l only the by the sensitivity of Section IV.7.2.6 which studies i

the impact of containment fan failure during core damage i environments. The plant damage state assignment would be AEC.

V.3.7 Secuence 7 - Loss of Offsite Power: Failure of AFWS;

! j Failure of Feed and Bleed: Failure to Restore AC Power '

in Four Hours (Recovered by Eloht Hours)

This sequence represents a set of events similar to sequence 5 except that successful restoration of AC power occurs at a 3 later time, between four and eight hours after the initiation

, of the sequence. This sequence is placed in damage state TEFC. This sequence model includes success of the CCW, which

! is an increasing factor for this sequence's frequency.

i However, the rebaseline value for failing to restore AC power within four hours offsets the increase and yields a net reduction in sequence frequency. Two sensitivities are relevant to this sequence, although only one has a noticeable impact. Removing the CCWS common-mode from the sequence

( equation in Section IV.6.7 has essentially no impact on core s damage frequency, the frequency remains 5.7E-7. Failure of the

! containment fans in core damage environments would change the i

plant damage state to TEC.

i l

1 i

i f

l V-12 i

V.3.8 Sequence 8 - Loss of Offsite Power: CCW/SWS Loss.

Failure to Recover AC Power in One Hour (Recovery Prior to Four Hours)

This sequence represents a loss of offsite power, followed by failure of the CCWS, either directly due to random failures, or indirectly due to a combination of loss of AC power and SWS pumps. Failure of the CCWS results in failure of the RCP thermal barrier cooling and a seal LOCA, and loss of all HPIS capabilities, as with sequence 1.

hardware and Dominant contributors are maintenance failures in the CCWS, SWS, and omergency diesel generators. The containment systems and SWS are restored to service when AC power is restored. Although the CCWS may be restored as well, core damage has already occurred. This sequence is placed in damage state SEFC.

The reduction in frequency for this sequence is split equally between the impact of the less stringent CCW success criterion and the new RCP seal LOCA model.

Table V.1.3 shows that no sensitivity study has a significant impact on sequence 8.

V.3.9 Sequence 9 - Same as Sequence 8. Oniv This Represents the SWS Common-Mode Portion of the Zion Review Secuence No. 3 In the rebaseline analysis, damage became significant the contribution of SWS to core relevant to the contribution of CCWS. In the Zion Review and ZPSS, this was not the case, and outcomes due to nonrecoverable failures of the SWS were not important. This sequence represents a similar set of events as in sequence 8, except that the onset of the seal LOCA and HPIS failure ic caused by loss of CCWS due to nonrecoverable faults in the SWS (predominantly SWS pump common mode). The permanent loss of SWS also fails the containment systems, resulting in a plant damage state of SE. This sequence was essentially " split apart" from sequence 8 when it was reevaluated, explicitly modeling the SWS failures separately from the CCWS failures.

Removal of SWS common-mode failure will virtually eliminate this sequence, reducing its frequency to 4.0E-ll. The potentially significant consequences due to plant damage state SE could be mitigated if the containment spray system was fully independent of the SWS. This would change the plant damage state to SEC.

V.3.10 Sequence 10 - Loss of Offsite Power: CCW/SWS Loss:

Failure to Restore AC Power in Eicht Hours: Failure of Containment Sprays and Fan Coolers This sequence represents a set of events similar to sequence 8, except that AC power is not restored within eight hours after V-13

the sequence is initiated. The Zion Review and ZPSS gave not credit for containment systems if they could not be restored within eight hours. This sequence is placed in damage state SE.

Table V.l.3 shows that this sequence is not significantly affected by removal of the SWS common-mode event from its model. Because this sequence involves failure to restore AC power within eight hours of the sequence initiation, no credit is given for restoring the containment systems to service. SWS hardware and maintenance, and diesel generators dominate causes of SWS failure. Pump common-mode failure is insignificant.

Since this sequence model includes failure of the containment sprays, removal of the SWS dependency of the sprays would significantly reduce the sequence frequency from 2.lE-7 to 2.8E-8.

V.3.ll Sequence 11 - Loss of Offsite Power: CCW/SWS Loss:

Failure to Restore AC Power in Four Hours (Recoverv Prior to Eicht Hours)

This sequence represents a set of events similar to sequence 8, except that AC power is restored within a later time frame, four to eight hours after sequence initiation. This sequence is in plant damage state SEFC.

The reduction in frequency for this sequence is primarily due to the less stringent success criterion of the CCW. The RCP seal LOCA model contributes a factor of 3 to the frequency reduction.

The potential impact of the RCP seal LOCA worst case estimate is significant for this sequence. This is because by four hours after cooling to the RCP seals, the worst case seal LOCA event has a probability of 1.0.

V.3.12 Sequence 12 - Loss of Offsite Power. Failure of SWS:

Failure to Restore AC Power in Eicht Hours. This Sequence Represents the SWS Portions of the Rebaselined Zion Review Sequences No. 4 and No. 6 This sequence represents a set of events similar to sequence I

10, except that loss of RCP seal thermal barrier cooling and hence the seal LOCA is due to failure of the CCWS due to loss of the SWS. This sequence represents portions of the sequences 13 and 17 which were " split apart" when these sequences were reevaluated using new unavailabilities for the CCWS and SWS.

In the Zion Review, SWS failure was not significant relative to CCWS failure. In the rebaseline, it is, so contribution to core damage due to non-recoverable SWS failure must be segregated from core damage due to CCWS, since these two contributors yield different plant damage states. This sequence is placed in damage state SE.

V-14

No sensitivities have a significant impact on the sequence frequency. However, if the diesel-driven containment spray pump is redesigned to be independent of the SWS, the plant damage state would become SEC.

V.3.13 Sequence 13 - Same as Sequence 12 Above, Only This is the CCW Portion of the Zion Review Sequence No. 4, and Containment Fans Fail Directly As discussed in sequence 12 above, this sequence represents a set of similar events, except that containment fans failure is explicitly included here. In sequence 12, the fans fail due to loss of SWS cooling to the air chillers. The dominant cause of fan failure here is loss of two out of three AC buses at Unit I due to random failures in the diesel generators. This sequence is placed in plant damage state SEC. No sensitivities were relevant to this sequence.

V.3.14 Secuence 14 - Interfacing Systems LOCA This sequence represents failure of two MOVs in the RHR to isolate low pressure piping from high pressure piping. This sequence is placed in plant damage state V.

The models developed in the ZPSS for the V sequence are quite different than the models employed in the Surry and Sequoyah reference plant analyses. The sensitivities applied to the Surry and Sequoyah models are not readily applicable to the Zion V sequence model.

V.3.15 Sequence 15 - Failure of DC Bus 112. Causing Loss of One PORV and Loss of AC Bus 148, Failure of Auxiliary Feedwater The sequence of interest in this case is failure of DC bus 112, loss of main feedwater, reactor trip, loss of auxiliary feedwater, and failure of feed and bleed capability due to loss of the PORVs. The containment systems are functional. This sequence is placed in plant damage state TEFC.

The frequency of this sequence was reduced by over two orders of magnitude compared to its value in the Zion Review. This is due to the improved success criterion of the PORVs for feed and bleed cooling, 1 of 2 versus 2 of 2. No sensitivities had a significant impact on this sequence.

V.3.16 Sequence 16 - Same as Sequence 11. Only This Represents the SWS Common-Mode Portion of the Zion Review Sequence No. 2 This sequence represents that portion of sequence 11 " split apart" from the original sequence model when it was reevaluated using new unavailabilities for the CCWS and SWS. SWS failure V-15

_ -' ^'-

becomes important relative to CCWS failure, so nonrecoverable SWS failures must be segregated from recoverable SWS failures and any CCWS faults, since nonrecovered failure of the SWS results in damage state SE.

Removal of SWS pumps common-mode failure from the sequence model would virtually eliminate the sequence, reducing its frequency to 3.8E-ll.

V.3.17 Sequence 17 - Loss of Offsite Power: CCW Failure:

Failure to Recover AC Power in Eicht Hours: Success of Containment Systems This sequence represents a set of events leading to core damage due to an RCP seal LOCA and loss of HPIS similar to sequence.

8. A significant difference to sequence 8 is that here. AC ~

power to the blacked out emergency buses is not restored within eight hours after initiation of the sequence. Only degraded power states in which the containment systems could still function are modeled. Furthermore, only the CCWS fails in this sequence, not the SWS, so the containment systems are available. This sequence is placed in plant damage state SEFC.

Removing the CCWS common-mode event from the sequence model has moderate impact on the sequence frequency, reducing it from 3.7E-8 to 7.9E-9.

V.4 COMPARISON OF RESULTS WITH ZION REVIEW Many of the differences between the rebaseline results and the Zion Review results have already been brought out in the sequence quantification and results sections. Because this analysis was limited to a rebaselining of the original set of Zion Review dominant sequences, it was quite natural and straightforward to describe the rebaselined sequences in contrast to the Zion Review sequences. The results of the two analyses are summarized here to point out significant contrasts.

The accident sequence and systems analysis methods employed in the Zion Review were not altered for the rebaseline analysis.

However, some changes were made to the Zion review models to address changes at the plant and changes in PRA methods since the Zion Review was performed. The principal model di.fferences are summarized below. A more detailed discussion of khese and other issues is found in Section IV.3.

The pump success criterion for the CCWS is improved over the criterion used in the Zion Review, from 2 of 5 to 1 of 5.

V-16

e Common-cause failures for CCWS and SWS pumps, and Unit 2 diesel generators were incorporated into the CCWS and SWS rebaseline models. Such events were not incorporated into the Zion Review accident sequences.

Feed and bleed success criterion for the PORVs was changed from 2 of 2 to 1 of 2.

Credit was given for procedures to refill the RWST so that the containment spray system could be used for long-term cooling of the containment if the recirculation system fails.

e The simplistic reactor coolant pump seal LOCA model l used in the Zion Review has been replaced with a time-dependent random variable model using the Weibull distribution.

The plant damage state results are compared on Table V.4.1.

The accident sequence results are summarized on Table V.4.2.

The total core damage frequency for the rebaseline analysis is l.5E-4. The value from the Zion Review is 3.5E-4. This is not a drastic difference for the total core damage estimate. Both analyses are dominated significantly by the same sequence. The rebaseline value for sequence 1 on Table V.4.2 is one-half the value for sequence 1 from the-Zion Review. This reduction is due to the less restrictive CCWS pump success criterion (1 of

5) used in the rebaseline, opposed to the Zion Review's criterion (2 of 5). However, the rebaselined sequence 1 still clearly dominates core damage frequency, and its 50% reduction in frequency does not significantly change the total core damage results.

Among the plant damage state results shown on Table V.4.1 seven damage states display significant differences between the two studies:

e Damage state SEC's rebaseline frequency is significantly reduced compared to the Zion Review.

This is due primarily to improved CCWS reliability in the model of sequence 14.

Damage state SE's rebaseline frequency is reduced from 4.7E-6 to 7.0E-7 primarily due to improved reliability of the CCWS in sequence 10.

J e TEFC damage state frequency is reduced almost an order of magnitude due to a less stringent success criterion for PORVs for feed and bleed cooling (1 of 2 versus 2 of 2 in the Zion Review).

Giving credit for refilling the Refueling Water Storage Tank (RWST) changes the sequences in plant damage categories ALF and SLF to ALFC and SLFC. respectively.

V-17

Among the sequence level results, both analyses are dominated by the same sequence on Table V.4.1. As stated earlier in this section, there is little difference between the rebaseline and Zion Review results for sequence 1. However, among the less dominant sequences, there are some significant changes. As can be seen by observing the rank column of Table V.4.2, the previously second, third, and fourth top sequences bave been reduced by approximately two orders of magnitude. This reduction the rebaseline analysis.

is primarily due to the improved CCWS reliability in

\

}

V-18

4 Table V.4.1 Damage State Frequencies Plant Damage Containment Damage Frequency (Yr-1)

Category Success Status State New Review Early Core Melt with Fans and Sprays SEFC 1.0E-4 3.0E-4 Containment Cooling TEFC 2.7E-6 1.0E-5 AEFC 1.4E-6 1.9E-6 Sprays Only SEC 1.0E-7 1.9E-5

' ' * < 1.0E-4 3.3E-4 Early Core Melt with- SE 7.0E-7 4.7E-6

'<: out Containment Cooling 5

Late Core Melt with Fans and Sprays ALFC 1.0E-5 O Containment Cooling SLFC 1.6E-5 0 Fans Only ALF 0 1.0E-5 SLF 0 1.6E-5 2.6E-5 2.6E-5 f

Late Core Melt with- None AL N/A 1.OE-7 '

out Containment Cooling SL N/A -

l.0E-7 Interfacing Systems LOCA Containment Bypassed V 1.0E-7 1.0E-7

Table V.4.2. Zion Dominant Accident Sequences Rank Sequence Frequency (yr-1) Damage State I New Zion Review New Review New Review 1 1 CCW Failure, causing failure of all 1.2E-4 2.0E-4 SEFC SEFC charging and SI pumps, seal LOCA 2 5 Small LOCA; failure of recirculation 1.6E-5 1.6E-5 SLFC SLP 3 9 Large LOCA, failure of recirculation 4.9E-6 4.9E-6 ALFC ALP cooling 4 10 Medium LOCA, failure of recirculation 4.9E-6 4.9E-6 ALFC ALF cooling 14 Loss of offsite power; failure of AFWS 2.lE-6 1.OE-6 TEFC TEFC T 5 y failure of feed and bleed; failure to restore AC power in 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months (recovery prior to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months ) 6 12 Large LOCA; failure of low pressure 1.4E-6 1.4E-6 AEFC AEFC injection 7 13 Loss of offsite power; failure of AFWS 5.7E-7 1.lE-6 TEFC TEFC failure of feed and bleed; failure to restore AC power in 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months (recovered by 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months ) 8 3 Loss of offsite power; CCW/SWS loss, 3.2E-7 4.0E-5 SEFC SEFC failure to recover AC power in 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months (recovery prior to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months ) 9 - Same as sequence 8, only this repre- 3.OE-7 - SE -

sents the SWS common mode portion of the rebaselined Zion Review sequence No. 3

Table V.4.2. Zion Dominant Accident Sequences (Continued)

Frequency (yr-1) Damage State Rank Sequence Review I

New Review New I New Zion Review 4.7E-6 SE SE 10 11 Loss of offsite power; CCW/SWS loss: 2.lE-7 failure to restore AC power in 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months ,

i failure of containment sprays and fan coolers 1.5E-7 4.6E-5 SEFC SEFC 11 2 Loss of offsite power; CCW/SWS loss; l failure to restore AC power in 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months .

.' (recovery prior to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months ) a 1.5E-7 - SE -

12 - Loss of offsite power, failure of SWS;

]

failurc to restore AC power in 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months , i

j This sequence represents the SWS

?

portions of the rebaselined Zion Review l

j M Sequence No. 4 and No. 6 1.OE-7 1.8E-5 SEC SEC 1

13 4 Same as sequence 12 above, only this

[

i is the CCW portion of the rebaselined Zion Review sequence No. 4 1.OE-7 1.OE-7 V V

14 - Interfacing Systems LOCA 5.OE-8 7.OE-6 TEFC TEFC 15 7 Failure of DC bus 112, causing loss of one PORV and loss of AC bus 148, i

failure of Auxiliary Feedwater SE i

16 - Same as sequence 11, only this repre- 4.8E-B -

cents the SWS common mode portion of i'

the rebaselined Zion Review sequence No. 2 17 6 Loss of offsite power; CCW failure 3.7E-8 8.OE-6 SEFC SEFC failure to recover AC power in 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months 4

s

4 h- ..

VI. References

1. Berry, et al, Review and Evaluation of the Zion Probabilistic Safety Study, NUREG/CR-3300, SAND 83-ll18, Volume 1, Sandia National Laboratories, Albuquerque, New Mexico, May 1984.

2. Commonwealth Edison Company of Chicago, Zion Probabilistic Safety Study, 1981.

3. D. M. Kunsaan, Letter to S. Newberry, NRC, July 9, 1984. )

i

4. Pickard, Lowe, and Garrick, Classification and Analysis of Reactor Operatina Experience Involving Dependent Events, EPRI NP-3967, June 1985.

5. Speis, T. P., to Denton, H. R. Recommendations Resulting from Zion Risk Inquiry, (Washington, DC: USNRC, August 1, 1985), Memorandum.

6. Mattson, R., to Speis, T. P. (Washington, DC: USNRC, August 16, 1983), Memorandum.

4 i

l VI-1

DISTRIBUTION:

U. S. Government Printing Office Receiving Branch (Attn: NRC Stock) 8610 Cherry Lane Laurel, MD 20707

100 copies for AN Author Selected Distribution (162) 3141 S. A. Landenberger (5) 3151 W. L. Garner j 6400 A. W. Snyder i 6410 J. W. Hickman l 6411 A. S. Benjamin 6412 A. L. Camp 6412 M. P. Bohn 6412 F. T. Harper (32) 6412 D. M. Kunsman 6412 J. A. Lambright 6412 A. C. Payne, Jr.

6412 T. A. Wheeler 6415 F. E. Haskin 6422 D. A. Powers 8024 P. W. Dean f

i DIST-1

eISC POmas 33 U $ huCL M E 81&LaTomv h.asion i

t, Om a hwweid edmW a', reoc eso ye, we , ,e ea,s (2 84 I,"oE 'E BIBLIOGRAPHIC DATA SHEET NUREG/CR-4550, Volume 7 SAND 86-2084 us i=svaveys o= t e movins TLt 3 Llavi Ska%E 3 TiTLl aNO S Analysi of Core Damage Frequency from Internal Events: ion Unit 1 ,f,,,,,,,,,co,,,,,,,

.o .t.a j

J e 1986 s auv-Qassi y . o.vi . .o i ,ssao vtaa Timothy A. Whe er foo~1- l f0ctober ECT 146n nQan ug,i gvvate 1986 wasLihG ADDat&& ##ar*uerte Com. 89 1 et f omwi=G OmGami2af EON haut Reactor Systems Sa ty Analysis /

Division 6412 [*"''**""

Sandia National Labor ories A1228 Albuquerque, NM 87185 at$5 uareves to Cores t ia Y vPt 05 a t*Q8'T 10 SPON$Ome%G ORGANi2 AteON Nave a%Q wai.shG a Division of Reactor System afety

Technical Office of Nuclear Regulator Research US Nuclear Regulatory Commiss n Washington, DC 20555 November 1985 - June 1986

~

12 SWPPLlwi%Y AR v NOTis

>> u i s a.ci ax.

The Review and Evaluation of the Zio1 Pr bilistic Safety Study (NUREG/CR-3300) represents an analysis of the risk profi at Zion based on the plant status as of 1982. This report reevaluates the dominAn accident sequences of NUREG/CR-3300 withinthecontextofchangesinplant,[onfi ration, operational procedures, and general safety issues. This analysis s rest cted to the set of accident sequences inNUREG/CR-3300,anddoesnotinvesti[gatepotetiallynewdominant sequences.

. , y . =,. .

.. . t..... ..... .........t,<. .... , .

. Unlimited

/./ E. .. c.. . . c ... . .c., .cs

. ion ~v.. eas,oei= e=oso teaus J[. Unclassified J.f.

p

< r.e .m Unclassified o .....o... cts is om.ct w

iff U S GOVERNMENT PritNTING OFFICE 1986 - 773 44 641021

120555078877 1 1AN US NRC ADM-DIV 0F PUB SVCS POLICY & PUB MGT BR-POR NUREG W-501 20555 WASHINGTON OC

\

l

. , _ . _ _ _ _ _ _ - _ _ _ _ _ .__

ML20207G067

Text

SUMMARY

SUMMARY

Navigation menu

Search