ML20203G503
| ML20203G503 | |
| Person / Time | |
|---|---|
| Site: | Prairie Island  |
| Issue date: | 04/30/1986 |
| From: | Kapit J NORTHERN STATES POWER CO. |
| To: | |
| Shared Package | |
| ML20203G501 | List: |
| References | |
| NSPNAD-8606P, NSPNAD-8606P-R01, NSPNAD-8606P-R1, NUDOCS 8604290138 | |
| Download: ML20203G503 (453) | |
Text
{{#Wiki_filter:-. I PRAIRIE ISLAND UNITS 1 AND 2 AUXILIARY FEEDWATER , SYSTEM RELIABILITY STUDY l ! l i NSPNAD-8606P ' Revision 0 , April 1986 Prepared by [M. At Date Y-/7-/#2 Reviewed by 4 4 Date I'~ / 7 - O d Approved by Inj r M ut.st. Date'tYf/7/$6
/
O
~
6 42 o g e6 2 Page 1 of 453
O PRAIRIE ISLAND UNITS 1 AND 2 AUXILIARY FEECWATER SYSTEM RELIABILITY STUDY Principal Contributors Northern States Power Jon Kapitz Julie Kulzick Ron Meyer Craig Nierode Richard Pearson Delian Corporation Brian Brogan Jim Chapman Andy McClymont Walt Sullivan l April 1986 l O i Page 2 of 453
b P . LEGAL NOTICE This report was prepared by, or on behalf, of Northern States Power Company (NSP). Neither NSP, nor any person acting on behalf of NSP:
- a. Makes any warranty or represntation, express or implied, with respect to the accuracy, completeness, usefulness, or use of any information, apparatus, method or process disclosed or contained in this report, or that the use of any such information, apparatus, method, or process may not infringe privately owned rights; or -
- b. Assumes any liabilities with respect to the use of or for damages resulting from the use of, any information, apparatus, method, or process disclosed in the report.
O Page 3 of 453
EXECUTIVE
SUMMARY
INTRODUCTION This report describes a study of the Prairie Island Nuclear Generating Station auxiliary feedwater ( AFW) system. Probabilistic Risk Assessment (PRA) methods were used to 1) investigate the reliability of the auxiliary feedwater system,
- 2) support the identification of possible modifications that could improve the reliability of the AFW system, and 3) assess the general effect of these modifications.
While the study was designed to take full advantage of the PRA perspective, it did not rely solely upon the quantitative output of the PRA models to arrive at its conclusions. The primary objective of the analysis was not merely to produce a bottom-line reliability estimate, but rather to provide Northern States Power Company (NSP) with sufficient qualitative and quantitative information related to the reliability of the AFW system to support a logical determination of what changes in design or operation, if any, would be appropriate. BACKGROUND Due primarily to the recent event at Toledo Edison's Davis Besse plant, the U.S. Nuclear Regulatory Commission (NRC) is re-examining the reliability of auxiliary feedwater systems at other plants. The NRC is focusing their attention on a set of plants that, in the NRC's opinion, have " low reliability" auxiliary feedwater systems. Prairie Island Units 1 and 2 are included in this set of plants in large part due to a five year old post-TMI NRC assessment of the Prairie Island auxiliary feedwater system which predicted a low system reliability. For Westinghouse plants, these post-TMI assessments are documented in NUREG-0611. Three sequences were investigated by the NUREG-0611 study:
- 1. Loss of Main Feedwater initiating event followed by failure of the auxiliary feedwater system;
- 2. Loss of Offsite Power initiating event, followed by successful operation of emergency AC power systems and failure of the auxiliary feedwater system;
- 3. Station Blackout sequence (Loss of Offsite Power initiating event, followed by loss of onsite emergency AC power) plus failure of the auxiliary feedwater system.
NSP elected to conduct its own internal investigation into the reliability of the auxiliary feedwater system under the above conditions. This report describes the reliability study conducted to support this internal investigation. Page 4 of 453
(9 (m/ OBJECTIVES : The fundamental objective of this study is to provide safety and reliability information to support NSP and NRC decision-making with respect to the design or
- operation of the auxiliary feedwater system at Prairie Island. The specific objectives of this study derived from this fundamental objective are the following:
- 1. Calculate system reliability and develop a figure-of-merit for this calculated reliability.
- 2. Identify candidate reliability improvement modifications.
- 3. Evaluate the impact of the candidate reliability improvement modifications on the auxiliary feedwater system reliability and the overall figure-of-merit.
The figure-of-merit selected is the frequency of steam generator dryout at either unit. SYSTEM DESCRIPTION Figure S-1 is a simplified diagram of the Prairie Island Auxiliary Feedwater (AFW) System. The AFW pumps discharge to the steam generators via a 3-inch discharge line. 'U/O -The AFW pumps for each unit (Unit 1 - #11 & #12; Unit 2 - #21 & #22) can supply either of the unit's two steam generators by operating motor-operated valves to
- direct flow to the desired steam generator. In addition, manual cross-connect valves'are provided betwe'en the two motor-driven pumps to allow a motor-driven pump to feed the steam generators in the opposite unit.
Three 150,000 gallon condensate storage tanks (CSTs) provide the primary source of AFW pumps suction supply. A common suction header, shared among the three CSTs and the four AFW pumps, pipes the CST water to the suctions of the four AFW pumps. The Cooling Water System provides a backup suction supply to the AFW pumps. The backup suction supply is used when the CSTs are unable to provide sufficient suction for operation of the AFW pumps. The Cooling Water System also cools the lubricating oil for each of the AFW pumps. Unit 1 Cooling Water supplies cooling water for AFW pumps #11 and #21. Unit 2 Cooling Water supplies cooling water for AFW pumps #12 and #22. Cooling water to each of the turbine-driven pumps also cools the turbine bearings and the governor on each turbine. With the-system design discussed above, each unit effectively has up to three trains of auxiliary feedwater available for response to most transient conditions. However, differing plant conditions, varying system effects that result from progression of the transients, and differing operator response to each transient could vary the availability of each train considerably. v Page 5 of 453
RESULTS : Table S-1 summarizes the important candidate modifications identified by the study that were amenable to quantification. The table also gives the resulting changes in the baseline A W System failure probability for both a loss of main feedwater (LCMW) and a loss of offsite power (LOOP) initiating event when each modification is considered quantitatively. Table S-2 lists candidate modifications that are not amenable to quantification. Table S-3 provides a set of other important considerations identified by the analysis. Table S-4 summarizes the overall quantitative results of the Prairie Island Auxiliary Feedwater System reliability analysis. O O Page 6 of 453
(p) m\
'mJ [D
' (n\.j) ar-se-e ar-is-e'% %
r2kDE(--M-V"- / / N- -M-) re sican unn van
/ / s-is-3 er-se-3
<airz) uisan
/ "'"
g -se.: ar-is- /
/
Mig (- --> ' d+f j c :;r .a ri sican etwaarm
/ /
av-s.eeeX-G e> X-0 <r .3>3,,.. ~~Y/.?> D-X X-O r,r.le** ,'i'M es _ n O O
s- em scri ram sser Fpt> sGi, re[> sG 2 % -- - ..-2,, "O&lX --y,3 .
t,v,-=> X ggs E'E' X KiR* "diAt X - g ' **c,Au 4 $ 's1=.a **MA 4 4 ?!M' 4 mail $-' ,, " eld Zt Z t &&" Z t K3 "-A>M Z t o - ED fri.?"* X-D fri,?"'
.,, k 4 i CV-3toS9 Cd CJ .ie .1,G G22 CV-71060 t'.Y>' $73> -'
t'.*i>' CYil 4 N-- N 4 w N
- Wg735
- wv y Mvg}36 MV 5 h -se';;;X-0 av-'w,D-X -'7AEO "v-s EO
'ci!!il w : ) )N ) ) N ,, = L' =g 12:13 5a; ,J"c4 cEl"pLR0 LJA N N ' 5k' E 3Doce 9 e 13 Far fhelseedity s%
en sa. Figure S-1 Simplified Flow Diagram of the Prarie Island Auxiliary Fe<xlwater System Page 7 of 453
@9
TABLE S-1 - CANDIDATE MODIFICATIONS AMENABLE TO QUANTIFICATION FAILURE CANDIDATE PROBABILITY MCDIFICATION LOMFW LOOP Baselir.e5 2.0E-5 8.7E-58 2.0E-48
- 1. Discharge AFW pump recirculation 2.0E-5 (0*.') 7.2E-5 (17%)
thru lube oil coolers / turbine 1.7E-4 (15%)
- 2. Proceduralize and train 2.0E-5 (0%) 7.2E-5 (17%)
operations personnel in action 1.7E-4 (15%) required to recognize need for backup CST cooling
- 3. Verify common AFW pump cooling 1.6E-5 (20%) 7.3E-5 (16%)
water valves are in correct 1.6E-4 (20%) position with cooling water return line sight glass during pump test and verify valve position with post-maintenance test
- 4. Ensure cross-connect pump has a 5.5E-6 (73%) 7.3E-5 (16%)
high availability; proceduralize 1.6E-4 (20%) use and train operators; ensure cross-connect valves can be opened; test cross-connect valves
- 5. Proceduralize and train 8.0E-6 (60%) 4.1E-5 (53%)
operat'ocs personnel in manual 1.2E-4 (40".) start / control TDAFW pump
- 6. Candidate modifications
- 2.9E-6 (86%) 8.7E-6 (90%)
1.8E-5 (90%)
- 1. Baseline values assume MS-22-2 issue is resolved. Excludes parametric common cause (6.6E-5) which was not included in NUREG-0611 scope.
- 2. 24 hour value including recovery of offsite power.
- 3. Demand value without crediting recovery of offsite power.
- 4. Overall impact of the five modifications amenable to quantification.
O Page 8 of 453
.r TABLE S-2 .
CANDIDATE MODIFICATIONS
~
NOT AMENABLE TO QUANTIFICATION CANDIDATE MODIFICATIONS EXPECTED IMPACT Eliminate auto-open signal to High emergency supply valve MV-32041 Block open and tag all valves in High flow paths from the AFW steam lines to the main condenser Include flow versus time requirements ? . . in procedures Provide procedures to bypass control / Medium actuation faults for motor-driven AFW pumps O O Page 9 of 453
TABLE S-3 ADDDITIONAL CONSIDERATIONS Ensure main feedwater line check valves are not deteriorating. Ensure integrity of AFW system check valves, manual valves and motor-operated valves. Confirm that inadvertent / excessive opening of trip throttle valve high pressure leakoff valve (MS-22-2) will not cause failure of AFW pumps. Otherwise, route piping to drain system or turbine exhaust. Ensure post-maintenance / design changes to AFW components are adequately tested (testing representative of expected performance requirements). Continue to de-couple maintenance of Unit 1 and Unit 2 AFW system components. Confirm that failure of one diesel cooling water pump (DCWP) during opera-tion following a loss of offsite power will not result in load changes sufficient to trip the second pump. Confirm that load changes 'resulting from equipment use (on/off) will not adversely impact operation of DCWPs following a loss of offsite power. Confirm that delayed AF4 flow initiation will not cause water-hammer problems. Consider need for valve C-41-1. Consider proceduralizing use of mechanical acceleration to open turbine- -driven pump A0V (CV-31998) in an emergency. O Page 10 of 453
TABLE S-4
SUMMARY
OF RESULTS - WITH CANDIDATE MODIFICATIONS LOMFW LOOP CASE AFW F.P. SG DRYOUT FREQ. AFW F.P. SG DRYOUT FREQ.
- 1. Best Estimate
~
l
- No parametric CCFs 2.9E-6 5.8E-8 8.7E-6 7.0E-7 1.8E-52 N/A
- 2. Best Estimate
- With parametric CCFs 3.1E-5 6.2E-7 3.7E-5 3.0E-6 4.6E-5 N/A
- 3. Upper Bound 3.8E-5 7.6E-7 1.9E-4 1.5E-5
- With parametric CCFs 3.5E-4 N/A ,
- 4. Lower Bound 1.9E-6 3.8E-8 5.0E-6 4.0E-7 8.8E-6 N/A F.P. = Failure Probability 1 24-hours including offsite power recovery 2 Demand value without crediting recovery of offsite power Page 11 of 453
TABLE OF CONTENTS : , MAIN REPORT Page EXECUTIVE
SUMMARY
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 TAB LE O F CONT ENTS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 TABLES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 FIGURES. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
1.0 INTRODUCTION
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 1.1 Background . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 1.2 Objectives and Considerations. . . . . . . . . . . . . . . . . . 18 2.0 TECHNICAL APPROACH AND SCOPE. . . . . . . . . . . . . . . . . . . . . 21 2.1 Be nchma rk Analy s i s . . . . . . . . . . . . . . . . . . . . . . . 21 e 2.2 Best Estimate ("As-Built") Analysis. . . . . . . . . . . . . . . 22 3.0 CANDIDATE MODIFICATION IDENTIFICATION AND EVALUATION. . . . . . . . . 26 3.1 Task 1: Identify Characteristics of the System . ........ 26 That Should Be Considered For Change 3.2 Task 2: Identify Candidate Modi fications. . . . . . . . . . . . . 27 3.3 Task 3: Collect Candidate Modifications From Other . . . . . . . 28 Sources 3.4 Task 4: Candidate Modification Evaluation Process. . . . . . . . 28 4.0 SYSTEM DESCRIPTION. . . . . . . . . . . . . . . . . . . . . . . . . . 32 4.1 Auxiliary Feedwater System . . . . . . . . . . . . . . . . . . . 32 4.2 Main Feedwater System. . . . .................. 45 4.3 Support Systems. . . . . . . . . . . . . . . . . . . . . . . . . 45 4.4 Post-TMI System Changes. . . . . . . . . . . . . . . . . . . . . 48 5.0 RESULTS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 5.1 Be n chma rk An a ly s i s . . . . . . . . . . . . . . . . . . . . . . . 51 5.1.1 Before Post-TMI Modifications . . . . . . . . . . . . . . 51 5.1.1.1 Loss of Main Feedwater . . . . . . ........ 51 5.1.1.2 Loss of Offsite Power - Diesel Generators Operate. 52 5.1.1.3 Station Blackout . ................ 52 5.1.2 Current Situation . . . . . . . . . ........... 52 i
\
ill> 1 Page 12 of 453 1
)
N TABLE OF CONTENTS (V 3 MAIN REPORT (continued) Page 5.1.2.1 Lo s s o f Ma i n Feedwa te r . . . . . . . . . . . . . . . 52 5.1.2.2 Loss of Offsite Power - Diesel Generators Operate . 53 5.1.2.3 Station Blackout. ................. 53 5.2 Plant Specific Data . ... . . . . . . . . . . . . . . . . . . . . 53 5.2.1 Data Analysis and Probability Estimation Methods . . . . . 54 5.2.2 S uma ry o f Re su l t s . . . . . . . . . . . . . . . . . . . . 56
'5.3 As-Built Analysis . . . . . . . . . . . . . . . . . . . . . . . . 64 5.3.1 Single Unit - Explicit Comon Cause Included . . . . . . . 64 5.3.1.1 Before Post-TMI Aodifications . . . . . . . . . . . 64 5.3.1.1.1 Loss of Main Feedwater . . . . . . . . . . . 65 5.3.1.1.2 Loss of Offsite Power. . . . . . . . . . . . 66 5.3.1.2 Current Situation . . . . . . . . . . . . . . . . . 66 5.3.1.2.1 Loss of Main Feedwater . . . . . . . . . . . 6f
( 5.3.1.2.2 Loss of Offsite Power. . . . . . . . . . . . 69 5.3.2 Single Unit Comon Cause Analysis. . . . . . . . . . . . . 74 5.3.3 Two-Unit Effects . . . . . . . . . . . . . . . . . . . . . 96 5.4 Uncertainty and Sensitivity Evaluations . . . . . . . . . . . . 101 5.5 Candidate Modifications . . . . . . . . . . . . . . . . . . . . 123 5.6 S uma ry o f Re s u l t s . . . . . . . . . . . . . . . . . . . . . . . 13 2 b v Page 13 of 453~
TECHNICAL APPENDICES Page APPENDIX A: Auxiliary Feedwater System Fault Tree Analysis. . . . . . 136 APPENDIX B: Support System Analysis . . . . . . . . . . . . . . . . .231 APPENDIX C: Steam Generator Performance . . . . . . . . . . . . . . . 248 APPENDIX 0: Data Analysis and Event Probability Calculation . . . . . 260 APPENDIX E: Dependency Analysi s . . . . . . . . . . . . . . . . . . . 290 APPENDIX F: Two-Unit Loss of Of f site Power Analysis . . . . . . . . . 364 APPENDIX G: NUREG-0611 Based Analysi s . . . . . . . . . . . . . . . . 414 0 Page 14 of 453
I ( ~T TABLES I x_ / TABLE PAGE L l 3-1 SYSTEM CHARACTERISTICS AND INFLUENCE AREAS . . . . . . . . . . . . 30
- 3-2 OIRECT USE OF RESULTS TO IDENTIFY SYSTEM CHARACTERISTICS THAT SHOULD BE CONSIDERED FOR CHANGE ................ 31 l 4-1 AFW PUMP CONTROL CIRCUIT ACTUATION INPUTS ............ 36 5.2-1 FAILURE RATES FRCH PLANT DATA
- AUXILIARY FEEDWATER SYSTEM COMPONENTS . . . . . . . . . . . . . . . . . . . . . . . . . . 57 5.2-2 FAILURE PROBABILITIES: AUXILIARY FEEDWATER SYSTEM COMPONENTS , . . 58 l 5.2-3 FAILURE RATES FROM PLANT DATA: DIESEL GENERATORS . . . . . . . . . 59 l' 5.2-4 FAILURE PROBABILITIES: DIESEL GENERATORS . . . . . . . . . . . . . 60 l
5.2-5 FAILURE RATES FROM PLANT DATA: DIESEL-0 RIVEN COOLING WATER PUMPS . 61 5.2-6 FAILURE PROBABILITIES: DIESEL-0 RIVEN COOLING WATER PUMPS . . . . . 62 5.2-7 COMPONENT MAINTENANCE / TESTING UNAVAILABILITIES . . . . . . . . . 63
. 5.3.1-1 KEY CUT-SETS FOR SINGLE-UNIT LOSS OF OFFSITE POWER . . . . . . . . 71 5.3.1-2 SIMPLIFIE0 EXPRESSION FOR SINGLE UNIT LOSS OF OFFSITE POWER ,.. 72 5.3.2.2-1
SUMMARY
OF OPERATING EXPERIENCE REVIEW . . . . . . . . . . . . . . 78 5.3.2.3-1 PARAMETER VALUE3 USED IN ANALYSIS ................ 85 5.3.2.3-2 COMMON CAUSE PARAMETER EQUATIONS . . . . . . . . . . . . . . . . . 86
, 5.3.2.3-3 PARAMETRIC COMMON CAUSE ANAcYSIS RESULTS . . . . . . . . . . . . . 87 5.3.2.4-1 PLANT-SPECIFIC DESIGN ANALYSIS . . . . . . . . . . . . . . . . . . 90 5.3.3-1 KEY CUT-SETS FOR TWO-UNIT LOSS OF OFFSITE POWER ......... 97 5.3.3-2 SIMPLIFIED EXPRESSIONS . . . . . . . . . . . . . . . . . . . . . . 99 5.4-1 CATEGORIES USED FOR IDENTIFICATION AND CHARACTERIZATION OF UNCERTAINTIES . . . . . . . . . . . . . . . . . . . . . . . . 102 i (s l 5.4-2 UNCERTAINTY REVIEW . . . . . . . . . . . . . . . . . . . . . . . 103 l 5.4-3
SUMMARY
OF SENSITIVITY EVALUATIONS . . . . . . . . . . . . . . . 111 I 5.4-4 SENSITIVITIES FOR SINGLE-UNIT LOSS OF MAIN FEE 0 WATER . . . . . . 114 5.4-5 SENSITIVITIES FOR TWO-UNIT LOSS OF OFFSITE POWER . . . . . . . 118 5.4-6 OESCRIPTION OF EACH. KEY CONTRIBUTION TO THE SINGLE-UNIT LOSS l OF MAIN FEEDWATER ANALYSIS . . . . . . . . . . . . . . . . . . 122 l 5.5-1 SYSTEM CHARACTERISTICS - INTERRELATIONS . . . . . . . . . . . . 124 i 5.5-2 SYSTEM CHARACTERISTICS - CONFIGURATION . . . . . . . . . . . . . 127 l 5.5-3 SYSTEM CHARACTERISTICS - COMPONENTS . . . . . . . . . . . . . . 128 , 5.5-4 CANDIDATE M00!FICATIONS AMENABLE TO QUANTIFICATION . . . . . . 129 l 5.5-5 CANDIDATE M00!FICATIONS NOT AMENABLE TO QUANTIFICATION . . . . . 130 5.5-6 ADDITIONAL CONSIDERATIONS . . . . . . . . . . . . . . . . . . . 131 l 5.6-1
SUMMARY
OF RESULTS - CURRENT CONFIGURATION . . . . . . . . . . . 133 5.6-2
SUMMARY
OF RESULTS - WITH CAN010 ATE MODIFICATIONS . . . . . . . 134 l l l l l L O Page 15 of 453 c .
FIGURES FIGURE PAGE I 4-1 SIMPLIFIED FLOW DIAGRAM OF THE PRAIRIE ISLAND AUXILIARY FEECWATER SYSTEM . . . . . . . . . . . . . . . . . . . . . . . 34 4-2 AFW PUMP COOLING WATER DEPENDENCE . . . . . . . . . . . . . . 35 4-3
SUMMARY
OF AFW PUMP CONTROL CIRCUIT INTERFACES . . . . . . . . . 37 4-4 SIMPLIFIED DIAGRAM OF THE PRAIRIE ISLAND ELECTRICAL DISTRIBUTION SYSTEM . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 4-5 SIMPLIFIED DIAGRAM 0F THE AFV PUMP COOLING WATER SUCTION VALVE CONTROL AND ACTUATION CIRCUITRY . . . . . . . . . . . . . . . 39 4-6 SIMPLIFIED DIAGRAM OF THE UNIT 2 DIVERSION . . . . . . . . . . . 40 4-7 SIMPLIFIED DIAGRAM 0F STEAM GENERATOR LOW WATER LEVEL ACTUATION LOGIC ............................41 4-8 SIMPLIFIED DIAGRAM 0F MAIN FEEDWATER PL'MP TRIP ACTUATION LOGIC . 42 4-9 SIMPLIFIED OIAGRAM OF AFW LOW PRESSURE TRIP ACTUATION LOGIC . . 43 4-10 MAIN FEE 0 WATER SYSTEM .....................44 4-11 COOLING WATER SYSTEM . . . . . . . . . .............46 5.3-1 AFW SYSTEM BLOCK DIAGRAM . . . . . . . . . . . . . . . . . . . . 70 5.3.2.3-1 SIMPLIFIED FLOW DIAGRAM OF THE PRAIRIE ISLAND AUXILIARY FEEDWATER SYSTEM . . . . . . . . . . . . . . . . . . . . . . . 81 5.3.2.3-2 AFW SYSTEM BLOCK DIAGRAM . ...................82 5.3.2.3-3 AFW PUMP COOLING WATER DEPENDENCE . . . . . . . . . . . . . . . 83 e i e Page 16 of 453
^ /) 1.0 INTROCUCTION '
J This report describes a study of the Prairie Island Nuclear Generating Station auxiliary feedwater (AFW) system. Probabilistic Risk Assessment (PRA) methods were used to 1) investigate the reliability of the auxiliary feedwater system,
- 2) support the identification of possible modifications that could improve the reliability of the AFW system, and 3) assess the general effect of these modificaticns.
While the study was designed to take full advantage of the PRA perspective, it did not rely solely upon the quantitative output of the PRA models to arrive at its conclusions. The primary objective of the analysis was not merely to produce a bottom-line reliability estimate, but rather to provide NSP with ' sufficient qualitative and quantitative information related to the reliability of the AFW system to support a logical determination of what changes in design or operation, if any, would be apprcpriate. The study utilized PRA models and techniques to produce both qualitative and quantitative insights into the design and operation of the. AFW system. Quantitative estimates of system reliability vere produced to focus the analysis team's investigation of potential modifications and to provide a numerical basis for comparison between many of the modifications. This PRA-based information was augmented by the knowledge and judgement of engineers familiar with the design and operation of the system. - The structured, integrated PRA models, as well as the process of producing these
/] models, also provided considerable valuable qualitative information concerning
(.) how the components interact with each other to perform the system's mission and how this mission can fail to be accomplished. , Design and operation information not easily amenable to quantification within a PRA structure was also used to gain insights into the system's reliability and how to improve it. Potential modifications were not limited to those areas calculated to be the most significant contributors to unreliability by the PRA. In many cases, the full benefits of a modification could not be reflected in the quantified PRA models; in such cases, engineering knowledge and judgement concerning a mooffication's realistic ability to improve component and system reliability were used. The study as performed can be effectively viewed as a "PRA-supported engineering ar,aly si s . " As such, it combines the best features of the PRA perspective with the strengths of the traditional engineering disciplines.
1.1 Background
Due primarily to the recent event at Toledo Edison's Davis Besse plant, the U.S. Nuclear Regulatory Commission (NRC) is re-examining the reliability of auxiliary feedwater systems at other plants. The NRC is focusing their attention on a set of plants that, in the NRC's opinion, have " low reliability" auxiliary feedwater systems. Prairie Island Units I and 2 are included in this set of plants in large part due to a post-TMI NRC assessment of the Prairie Island auxiliary (N, feedwater system which predicted a low system reliability. O Page 17 of 453
r . . For Westinghouse plants, these post-TMI assessments are documented in NUREG-0611 (Ref 1). Three sequences were investigated by the NUREG-0611 study:
- 1. Loss of Main Feedwater initiating event followed by failure of the auxiliary feedwater system;
- 2. Loss of Offsite Power initiating event, followed by successful operation of emergency ac power systems and failure of the auxiliary feedwater system;
- 3. Station Blackout sequence (Loss of Offsite Power initiating event, followed by loss of onsite emergency ac power) plus failure of the auxiliary feedwater system.
Northern States Power Company (NSP) elected to conduct its own internal investi-gation into the reliability of the auxiliary feedwater system under the above conditions. This report describes the reliability study conducted to support this internal investigation. 1.2 Objectives and Considerations The fundamental objective of this study is to provide safety and reliability information to support NSP and NRC decision-making with respect to the design or operation of the auxiliary feedwater system at Prairie Island. The specific objectives of this study derived from this fundamental objective are the following:
- 1. Calculate system reliability and develop a figure-of-merit for this calculated reliability.
- 2. Identify candidate reliability improvement modifications.
- 3. Evaluate the impact of the candidate reliability improvement modifications on the auxiliary feedwater system reliability and the overall figure-of-merit.
1.2.1 Objective 1 Objective 1: Calculate system reliability and develop a figure-of-merit for this calculated reliability. Use quantitative reliability techniques to determine the reliability of the AFW system for the two initiating events analyzed in NUREG-0611. Perform this determination for two cases: 1) for the system as it was designed and operated prior to TMI and 2) for the system as it is designed and operated currently. The figure-of-merit is the yearly frequency of an event that results in steam generator dryout. This is generally a conservative figure-of-merit because other means to provide decay heat removal are not credited. O Page 18 of 453
- ') One way to determine this reliability is to use the generic methods, scope, and u/ data reported in NUREG-0611. Another way is to use plant-specific, "as-built" design and operating information to support a more comprehensive investigation of realistic system design and operation. In this study both approaches are used.
Using the approach documented in NUREG-0611 permits benchmarking of results for Prairie Island in the pre-TMI situation. The approach also allows for a determination of the effect of changes made to Prairie Island design and operation as a result of that initial study in a manner consistent with the methods used to raise the present issue of APd system reliability. The NUREG-0611 analysis is limited in scope. Consequently, a more detailed, plant-specific analysis is desired by NSP. In this way, decision-makers at NSP and at the NRC will have current PRA-based information available for review of the issue of Prairie Island APd system reliability. The objective of this analysis is to determine a realistic estimate of the AFW system reliability (and thereby the system unreliability), the key contributors to this unreliability, and the significance of these results to the adequacy of current design and operation of the system. To accomplish this objective the scope of the NUREG-0611 analysis must be extended as follows:
- 1. A comprehensive spectrum of sequences must be investigated, instead of limiting the analysis to the three sequences noted earlier.
- 2. Plant-specific equipment performance and operating practices must be used instead of generic information.
(]J L Recovery of faulted components, use of backup systems, and recovery of 3. offsite power must be considered.
- 4. Intrasystem functional dependencies, intersystem functional dependen-cies, and " common cause" events must be considered.
The results obtained from this more comprehensive and realistic analysis can be compared to those determined using NUREG-0611 methods. 1.2.2 Objective 2 Objective 2: Identify candidate reliability improvement modifications. Use the results of the NSP reliability study, and information gained in performing this study, to identify characteristics of the Prairie Island AFW system that should be considered for change. Qualitative insights gained during the conduct of the study as well as quantitative results are used to identify characteristics of the system that should be considered for change. In addition, the following sources are also used: 1) review of other APd system designs analyzed in NUREG-0611 that are calculated to have "high reliability"; 2) AFW system changes being considered by other utilities; 3) opinions of NSP individuals involved in the NSP internal-(N review of auxiliary feedwater system performance. () Page 19 of 453
Candidate modifications have been identified by using the collective judgement : of the AFW reliability evaluation team and by reviewing these candidate modifications with a diverse group of NSP individuals. This comprehensive judgement and review process provides a realistic and meaningful set of candidate reliability improvements. 1.2.3 Objective 3 Objective 3: Evaluate impact on AFW system reliability of the candidate modifications. Determine the impact of the candidate modifications on AFW system reliability and the overall figure-of-merit. Qualitative insights gained in development of the reliability models, general system information, and results of the quantitative analysis performed to satisfy the first objective are all used where possible to meet this objective. Since quantitative results often cannot identify all impacts of a proposed modification on the system reliability, some qualitative insights are also used to determine modification impacts. It is possible for these qualitative insights to be subjective. Consequently, the results of both the quantitative and qualitative impact determinations have been " sanity checked" by a diverse group of experienced NSP personnel. O i O Page 20 of 453 t
( ) 2.0 TECHNICAL APPROACH AND SCOPE LJ The benchmark analysis approach and "As-Built" analysis approach are described below. 2.1 Benchmark Analysis The benchmark analysis consists of the following steps:
- 1. Based on a review of NUREG-0611, develop and quantify a fault tree to benchmark the NUREG-0611 ana. lysis.
- 2. Use the fault tree to determine the impact of key assumptions made in the subsequent NUREG-0611 analysis.
- 3. Use the fault tree to determine the impact of changes made subsequent to publication of the NUREG-0611 analysis.
2.1.1 Benchmark of NUREG-0611 Analysis The analysis documented in NUREG-0611 was reviewed to determine the methods, level of detail, assumptions, and data used in that evaluation. From this review a fault tree was developed that is believed to be similar to that used in the NUREG-0611 analysis. Failure rate information provided in Table III-2 of that report is used to quantify the fault tree model. When necessary, additional data needs were developed from information provided in NUREG/CR-2815 (Ref. 2). C Ihe results of this benchmark analysis were compared to those reported in ()l NUREG-0611. This comparison provided the Prairie Island AFW evaluation team with a better perspective of the underlying reasons for the current AFW reliability issue than was possible by only reviewing the NUREG-0611 results. 2.1.2 Evaluate Impact of Key Assumptions After benchmarking this analysis, the impact on system reliability of key assumptions about the operating configuration of the Prairie Island AFW system was determined. As an example, a key assumption that had a substantial impact on the calculated reliability of the AFW system for the Loss of Main Feedwater initiating event was to not credit operation of the opposite unit's motor-driven AFW pump in order to provide flow to the affected unit. 2.1.3 Evaluate Current Situation Many changes were made to the design and operating characteristics of the AFW system as a result of the original NUREG-0611 findings. Other post-TMI requirements and NSP's internal investigations also resulted in significant changes to the APW system. The impact of these changes was determined by using the benchmark model. n ( ) v Page 21 of 453
2.2 Best Estimate ("As-Built") Analysis The best estimate, "as-built" analysis is a detailed analysis of the AFW system that uses plant-specific design and operating information. This information includes plant-specific data for important AFW system components and support systems. Rather than being limited to the three sequences analyzed in NUREG-0611, a cocprehensive investigation of possible sequences resulting from either a loss of main feedwater or loss of offsite power initiating event is performed. As described earlier, the figure-of-merit is the yearly frequency of steam generator dryout. The results are developed and are presented in the form of sequences; in this way, the contributors to each sequence and the associated unreliability of the AFW system can be easily seen and compared to the NiREG-0611 analysis. The key characteristics of the best estimate analysis are described below. 2.2.1 Models This integrated assessment consists of the following major elements:
- 1. Initiating Event Identification
- 2. Event Sequence Analysis
- 3. Modeling Systems in the Event Sequences
- 4. Dependency Analysis 2.2.1.1 Identification of Initiating Events There are many possible causes for a loss of main feedwater or for a loss of offsite power. Some of these causes might also impact the reliability of the auxiliary feedwater system. For example, problems with the Cooling Water System or Condensate System have the potential to simultaneously impact the main feedwater and auxiliary feedwater systems. Identification of such dependencies is an important part of the analysis.
2.2.1.2 Event Sequence Developmer.t Event sequences are developed for both the loss of main feedwater and the loss of offsite power initiating events. The undesired event is a loss of feedwater for a period of time suf ficient to result in steam generator dryout. This varies from about 30 minutes for a loss of main feedwater followed by total failure of the AFW system to about 60 minutes for a comparable loss of offsite power initiating event. This dryout period increases if the failure of the AFW system occurs at some time subsequent to the initiating event. The dryout period extention results from lower decay heat levels and differences between no-load and full power steam generator inventories that will exist should the AFW system operate for some time and then fail. O Page 22 of 453
a 2.2.1.3 Modeling Systems in Event Sequences Auxiliary Feedwater System The auxiliary feedwater system is modeled by using fault tree techniques. Auxiliary feedwater system fault trees are developed in order to estimate the likelihood of system unavailability for each of the sequences developed above. In addition, the model results are used to gain insights into system vulnerabilities.and to identify candidates for system modifications that could significantly improve overall system reliability.
.These fault trees are developed to show all major component failure contributions to system unavailability as well as all important support system contributions. Important human interactions with the auxiliary feedwater system are also identified and analyzed.
Other Systems Auxiliary feedwater support systems are analyzed to identify important dependencies between the support systems and the auxiliary feedwater systems. These support systems include cooling water, electric power and instrumentation and control. A combination of plant-specific system-level operating experience information and models of key support system components is used to estimate the unreliability of these support systems. (. (j 2.2.1.4 Common Cause Failure Analysis
" Common Cause" failures resulting from intrasystem or intersystem functional
~
dependencies are explicitly included in the models. In addition, human actions that could result in the unavailability or failure of multiple components are explicitly evaluated and included in the models. In addition to these explicit modeling tasks, the following activities were performed to support the common cause failure analysis effort. Industry Ooerating Experience Review The industry operating experience review defined potential coupling mechanisms between auxiliary feedwater system trains. A qualitative examination of the potential for similar industry events occurring at Prairie Island was performed by 1) defining the coupling mechanism, 2) examining the susceptibility of Prairie Island components to this mechanism, 3) examining the opportunity for Prairie Island components being exposed to such mechanisms, and 4) examining the test and maintenance procedures which could detect and minimize the possibility of occurrence of the mechanism. Statistical Parametric Analysis Statistical analysis of the frequency of common cause events in industry auxiliary feedwater systems was performed and incorporated in the overall system reliability analysis. For this effort, existing data documented in available literature was used as applicable to Prairie Island. O Page 23 of 453
Plant Design and Operation Review : Ibe most important components subject to common cause failure were examined to determine the susceptibility of these components to such causes. Causes that have occurred at other plants in systems other than the AFW system were used in this review. 2.2.2 Quantification The quantification process consists of the following major elements:
- 1. Component and System-Level Data Development
- 2. Initiating Event Frequency Quantification
- 3. Auxiliary Feedwater System Fault Tree, including Common Cause Failure Quantification
- 4. Other System Quantification
- 5. Event Sequence Quantification
- 6. Uncertainty Assessment 2.2.2.1. Data Development Prairie Island information was combined with relevant " generic" information to develop the data base for this project. Failure rate information provided in NUREG/CR-2815 is the primary source of this generic information. Time-dependent equipment performance trends were also examined. These trends allow for consideration of changes in operating practices as well as consiceration of physical changes made to equipment. Typical types of effects considered are detection times and wearout on component failure rates.
Equipment performance data for AFW system components, the diesel generators, cooling water system components, and main feedwater system equipment was examined in order to develop specific Prairie Island failure rates, repair times, and test and maintenance unavailabilities for this equipment.
- 2. Initiating Event Frequencies Specific Prairie Island loss of main feedwater and loss of offsite power information was also used to develop the frequencies of these two initiating events. Generic information provided in NSAC/80 (Ref. 3) was used to determine the likelihood of recovering offsite power.
- 3. Auxiliary Feedwater System Unreliability The AFW system fault tree was quantified using the WAMCUT computer code (Ref. 4). Two fault trees were developed:
- 1. A detailed " Master Fault Tree" which is an extended version of the fault tree developed in support of the NUREG-0611 analysis.
O Page 24 of 453
(l V
- 2. A simplified fault tree for performing the parametric common cause analysis.
The " Master Fault Tree" includes each of the important AFW system components and support systems, as well as those common cause events that are amenable to explicit modeling. Because it is recognized that subtle dependencies that are not amenable to explicit modeling often dominate the unreliability of a system, a simplified fault tree was developed and quantified in order to assess the potential significance of such events at Prairie Island. A simplified fault tree was first developed that included the key elements of the master fault tree. The Multiple . Greek letter (MGL) approach (Ref. 5) was then used to convert this simplified fault tree into a common cause fault tree. The parameters of the MGL method were developed from available literature as it is applicable to Prairie Island.
- 4. Other Systems Failure rates for each of the important support systems were developed based on the techniques described earlier.
- 5. Event Sequence Quantification A mission time of six hours was assumed for the loss of main feedwater initiating event. After six hours, decay heat levels have been reduced sufficiently to allow a significant period of time to make repairs of faulted fD equipment or to initiate RHR cooling. Furthermore, findings show that operating
'd failure rates are not the key contributors to the overall unreliability of the APW system for this' initiating event. ,
The reliability of the support systems are more sensitive to the mission time. Therefore, to account for the increased likelihood of offsite power recovery with time, the loss of offsite power initiating event is analyzed differently. For this initiating event, the probability of failure as a function of time is traced so that a more realistic estimate of the frequency of steam generator dryout given this event could be developed.
- 6. Uncertainty Assessment A focused uncertainty analysis that consists of two basic steps was performed.
- 1. The sources of uncertainty were documented to include both the uncertainties in input data and the uncertainties in modeling assumptions.
- 2. The impact on the overall system unavailability due to changes in these uncertain parameters is determined.
O b Page 25 of 453
3.0 CANDIDATE MODIFICATION IDENTIFICATION AND EVALUATION A logical and structured approach to identifying and evaluating candidate modifications is used in this study. The process takes full advantage of the reliability aspects of this study, but is not constrained to the sole use of PRA-based techniques. The process consists of the following four basic tasks:
- 1. Identification of system characteristics that should be considered for change.
- 2. Identification of candidate modifications by examination of those characteristics that should be considered for change.
- 3. Collection of candidate modifications from other sources.
- 4. Evaluation of candidate modifications.
3.1 Task 1: Identify Characteristics of the System that Should Be Considered for Change Before candidate reliability improvement modifications were identified, the characteristics of the system that should be considered for improvement were identified. To ensure that the appropriate characteristics of a system that should be considered for change are identified, a logical framework for viewing a system is used. The logical framework used views a system as consisting of a configuration of comoonents operating with other systems (system interrelations) to perform a function. Each of these basic characteristics of a system can be further expanded into one or more of the following areas that influence performance:
- 1. Design, Procurement, Installation, and Initial Testing
- 2. Operation and Maintenance
- 3. Environment Table 3-1 provides a summary of the logical framework used to identify characteristics that should be considered for change, and examples for each of these areas. The reliability of the AFW system can be changed by changing one or more of these elements and associated influence areas.
The impact of some of these areas is more easily determined than others; however, by taking this view cf a system, a group of individuals, some of which are not familiar with PRA, are able to logically examine the AFW system for characteristics that should be considered for change. O Page 26 of 453
/D To take maximum advantage of the activities involved in the reliability study,
() and to account for limitations inherent in the modeling and quantification processes, the following sources of these characteristics are used:
- 1) direct use of the reliability study results,
- 2) consideration of the key uncertainties that have the potential to significantly impact the quantitative estimate of the auxiliary 4
feedwater system reliability and
- 3) insights gained during the analysis that are not amenable to modeling and quantification.
Direct Use of Results Table 3-2 provides the process used to identify characteristics of the system that should be considered for change. The quantitative information is used to help focus investigation of the qualitative results. Consideration of Key Uncertainties
'A list of key uncertainties that are inherent in the modeling process is devel-oped in order to further consider their impact on the overall results. These uncertainties have the potential to significantly affect the absolute system reliability, the modification identification process, and the overall effect of candidate modifications. Therefore, it is important that key uncertainties be p addressed.
Insights Not Amenable to Modeling or Quantification Insights gained during the conduct of the study that are not easily amenable to explicit modeling or rigorous,quantification but which influence our understanding of the system performance and might affect identification of candidate modifications are also considered. Areas where insights were obtained Senerally involve the impact of operation and maintenance practices on equipment reliability. 3.2 Task 2: Identify Candidate Modifications The process of analyzing a system will not in itself identify candidate modifications. The results of the analysis indicate characteristics of the , system's design or operation that should be considered for improvement, but the results do not specify the specific modification (s) that should be evaluated. To accomplish this task, the evaluation team developed its own list of candidate modifications based on its interpretation of the study results. The evaluation team then reviewed these candidates and associated characteristics of the system with a diverse group of NSP individuals who are familiar with tne AFW system and its support systems. The purpose of this review is to ensure that the evaluation team's candidates are both realistic and meaningful. n Page 27 of 453
,r,- , . _ , . - --y _- . . _ . _. . - . - . . - ~ - . . - - - - _ _ _ , . _ _
3.3 Task 3: Collect Candidate Modifications From Other Sources There are three basic sources of other candidate modifications:
- 1. Those identified during the review of NUREG-0611.
- 2. Those identified during the review of actions being censidered at other plants to improve AFW reliability.
- 3. Those identified by cognizant NSP personnel.
3.3.1 NUREG-0611 Two actions were required to accomplish this task:
- 1. NUREG-0611 was reviewed to identify key differences between those plants calculated to have "high reliability" AFW systems and those calculated to have " low reliability" systems.
- 2. The relationship of these differences to the design and operational characteristics of Prairie Island was determined so that candidete modifications appropriate to Prairie Island could be developed.
3.3.2 Review of Other Plant Actions This is a valuable source because it makes use of other's ideas. The same activities outlined above were performed to translate this information into specific Prairie Island candidate modifications. 3.3.3 NSp Personnel Cognizant NSP personnel were interviewed for their input into the modification identification process. They reviewed the analysis team's suggestions as discussed in Task 2 and also provided additional suggestions for modification based on their knowledge of the system. 3.4 Task 4: Candidate Modification Evaluation Process This process consists of both formal evaluation using the reliability medels and subjective evaluation. The reliability models are used to provide benchmarks of the anticipated improvement for those candidate modifications amenable to modeling and quantification. Those not amenable to this formal process are ranked subjectively around these quantified benchmarks. 3.4.1 Identification of Relevant Modifications for Evaluation The benefits of some candidate modifications are so obvious that a detailed quantitative evaluation process was not required. For other modifications, the relative value or benefit is not immediately clear. The first step in the evaluation process for candidate modifications is intended to focus the evalua-tion on those candidates that can and should be further analyzed. O Page 28 of 453 t
3.4.2 Evaluation of the Impact of Candidate Modifications for Two Initiating Events Both individual modifications and groups of modifications were considered. First, individual. modifications amenable to formal analysis were evaluated to develop a quantitative estimate of the impact of their implementation on the system reliability. Next, groups of modifications amenable to formal analysis were evaluated. Those modifications not amenable to formal analysis were evaluated using the evaluation team's judgement and using the results of the first two steps as benchmarks. 3.4.3 Evaluation of Other Impacts
-This task needs to be accomplished by NSP if an overall assessment of the impact of a given modification or group of modifications is desired.
3.4.4 Overall Imoact The overall impact of the candidate modifications on AFW system reliability and other areas noted above was not performed by the evaluation team. O 1 O Page 29 of 453
TABLE 3-1 : SYSTEM CHARACTERISTICS AND INFLUENCE AREAS SYSTEM INTERRELATIONS
- 1. Design, Procurement, Installation, and Initial Testing (e.g., use of Cooling Water System to cool AFW pump lube oil)
- 2. Operation and Maintenance (e.g., impact of operational and maintenance practices of other systems on the AFW system)
- 3. Environment (e.g., impact of other systems on both the normal environment of the AFW system and the possibility of creation of an abnormal environment)
O OVERALL SYSTEM CONFIGURATION
- 1. Design, Procurement, Installation, and Initial Testing (e.g., piping layout, normal valve positions, number and arrangement of components, interactions among components)
- 2. Operation and Maintenance (e.g., operational and maintenance practices per-formed for one AFW component may impact other AFW components)
. 3. Environment (e.g., various atypical operational modes of one AFW component may-impact other AFW components)
INDIVIDUAL COMPONENTS
- 1. Design, Procurement, Installation, and Initial Testing (o.g.,
types / piece parts, recovery / repair characteristics, " inherent" reliability)
- 2. Operation and Maintenance (e.g., impact of operational and maintenance practices on a component's availability / reliability)
- 3. Environment (e.g., the impact of various operational modes of one component on its overall reliability)
O Page 30 of 453
z K TABLE 3-2
-DIRECT USE OF RESULTS TO IDENTIFY SYSTEM CHARACTERISTICS THAT SHOULD BE CONSIDERED FOR CHANGE QUALITATIVE QUANTITATIVE.
- 1. Identify intersystem dependencies 1. Estimate significance of in_tersystem dependencies
- Support Systems
- Between AFW and Main Feedwater and Condensate System
- 2. Review cut sets in ascending 2. Examine cut sets contributing order of minimum number of the most to unreliability component failures
- 3. Review cut sets involving similar 3. Examine the quantitative components contributions to unavaila-bility/unreliability of components
- 4. Review human interactions 4. Included in Step 2
- Before Event p - Post Event
- 5. Identify failures that can be 5. Use quantitative information restored and thereby result to focus identification in success
- 6. Identify important Common Cause 6. Same as Step 5 events to establish key
-coupling mechanisms
- 7. Identify key causes of component 7. Same as Step 5 unreliability or unavailability V
Page 31 of 453
4.0 SYSTEM DESCRIPTION 4.1 Auxiliary Feedwater System Summary Description The Auxiliary Feedwater (AFW) System supplies feedwater to the steam generators following the interruption of the main feedwater supply. If the reactor trips and the main feedwater pumps cease to operate for any reason, feedwater must be provided for the removal of core residual heat by heat exchange in the steam generators. AFW System operation is required during both normal transient conditions (unit start up and shutdown) and abnormal transient conditions (e.g., loss of main feedwater, loss of offsite power and station blackout). The Auxiliary Feedwater System, shown in simplified form in Figure 4-1, consists of one steam turbine-driven and one ac motor-driven pump per unit. Each pump is a five-stage, horizontal, centrifugal pump with a capacity of 220 pm at 1300 psia. One pump per unit is driven by a 300 hp ac motor which is powered from the unit safeguards busses (Pump #12: Safeguards Bus 16, Pump #21: Safeguards Bus 26). One pump per unit is driven by a Terry steam turbine supplied from the unit's Main Steam Supply System through an air-operated steam inlet control valve. The turbine is equipped 'sith a Woodward governor and an overspeed trip / throttle valve. The over speed trip is mechanically actuated by the speed of the turbine shaft. Overspeed results in tripping mechanical linkage that shuts the trip / throttle valve and isolates steam flow to the turbine. Three 150,000 gallon condensate storage tanks (CSTs) provide the primary source of AFW pump suction supply. A common suction header, shared among the three CSTs and the four AFW pumps, pipes the CST water to the suctions of the four AFW pumps. The Cooling Water System provides a backup suction supply to the AFW pu=ps. The backup suction supply is used when the CSTs are unable to provide sufficient suction for operation of the AFW pumps. The Cooling Water System also cools the lubricating oil for each of the AFW pumps. Unit 1 Cooling Water supplies cooling water for AFW pumps #11 and #21. Urft 2 Cooling Water supplies cooling water for AFW pumps #12 and #22. Cooling water to each of the turbine-driven pumps also cools the turbine bearings and the governor on each turbine. This dependence of the APW system on cooling water supplied from the Cooling Water System is shown in simplified form in Figure 4-2. Should the normal cooling water supply to the AFW pumps become unavailable, there is a means of using the water in the CSTs as a backup source of cooling water for each AF4 pump. Referring to Figure 4-2, by opening a manual valve in the AFW pump CST suction line (not shown in the simplified diagram) and by opening valve CL-92-6, an operator could align CST f?ow to the
- 11 AP4 pump lubricating oil cooler.
The AF4 pumps discharge to the steam generators via a 3-inch discharge line. The APd pumps for each unit (Unit 1 - #11 & #12 ; Unit 2 - #21 & #22) can supply either of the unit's two steam generators by operating motor-operated valves to direct flow to the desired steam generator. In addition, manual cross-connect valves are provided between the two motor-driven pumps to allow a motor-driven pump to feed the steam generators in the opposite unit. The AFW System is automatically actuated by a Steam Generator Lo-Lo Level signal, a Safety Injection signal, or a trip of both main feedwater pumps. In addition, the turbine-driven AFW pump is actuated when an undervoltage is sensed on both of the power supply busses to the main feedwater pumps, page 32 of 453
r j
; ; The auxiliary feedwater pumps automatically trip on low suction pressure (4 -
V inches of Hg vacuum) or low discharge pressure (500 psi for the motor-driven pump, 200 psi for the turbine-driven pump). In addition, the motor-driven pump is tripped by a load rejection signal from the associated safeguards bus and is restarted by a related load restoration signal. Figure 4-3 summarizes the AFV pump control circuit interfaces. Table 4-1 summarizes the actuation inputs for the pump control circuits. The term
' independent' in Table 4-1 is used to indicate cases where there are seperate components to provide the given protection or control signal. This term is not intended to imply that a given component is ' statistically independent' from any other component. This type of independence is covered in the analysis discussed in Appendix E. Figures 4-4 through 4-9 provide simplified diagrams of the power supplies for the control circuits of key components in the AFW System, simplified control circuits for those components, and simplified diagrams of key actuation logic considered inthe system analysis. These diagrams are useful for summarizing important information used to perform the AFW System dependency analysis, which is discussed as a separate appendix to this report.
The AFW pumps are lubricated by two different lubricating oil pumps. One is attached directly to the shaft of the AFW pump, while the other is installed in the auxiliary feedwater pump lubricating oil system and is driven by an ac motor. The former is referred to as the shaft-driven oil pump, the latter is known as the auxiliary oil pump. [V ] During operation the shaft-driven pump provides lubrication for the auxiliary feedwater pump. When oil pressure falls below 8 psi, the shaft-driven pump output is augmented by the auxiliary oil pump. An alarm will sound in the control room if the auxiliary feedwater pump oil pressure falls below 8.5 psi. When the AFW pumps are idle, the auxiliary oil pumps start once every 24 hours and operate for approximately 15 minutes. This operating cycle will provide ample prelubrication of the AFW pump bearings and thereby allow for starting of the AFd pumps regardless of the condition of their related auxiliary oil pumps. This is important for situations where the turbine-driven APW pumps are required to operate when there is no ac power to supply the auxiliary oil pumps. Since the AFW System will start and feed the steam generators automatically upon receipt of an actuation signal, operater intervention with AFW system operation is unnecessary except for recovery actions. Typical recovery actions considered in the analysis are 1) manual opening of the Unit 2 cross-connect valve in order to use the #21 APd pump, 2) shifting of the AFV pump suction path from the CSTs to the Cooling Water System, and 3) using the CSTs as an alternate source of cooling water to the AFW pump lubricating oil system. With the system design discussed above, each unit effectively has up to three trains of auxiliary feedwater available for response to most transient conditions. However, differing plant conditions, varying system effects that result from progression of the transients, and differing operator response to each transient could vary the availability of each train considerably. n Page 33 of 453
a-se-e a-ss-e j j gggg(-M-vi---/ / N _ M -) ersurm ux = tan unee) unse) / / w -i,+,,3 gg,3 g -ir- w -is-a
/
ngjg(-{X}-t-4--- f - en sirm unuscui
.,e,, u,.,, , ti ;,- ,,i,';,.
ww-3,rgy X- 0 E ggre 2 *~YSY> D-X X-Orc. ire a 4h:3*" ei er r r (\ O O n n v v "v-Y$l*, fl.i?' Mi?'* nv-3ze.4j
- E',L O O-X 'O "vTe1X-0 m.1"' Mil"
"dM Zf "all,_i .i63* , _i K2' ts3' tK3' .t53' *EX X gy.
"det ~j't
(
/
e#d-u 1-4 t> ram scri e m sore rnon sois tsoi scie H-H Mv-3219 "g&lX nv-3gg s g3em7 X g,-g-s MYii' X gg* "gM X = ""v-p"*'. 's== "'SM 4 4 "!&' '"5
&s 4 4 rst"
,, "ust Zt '
Z t seii-" Z t de'* "3M Zt o EDf7i.3'"' X-0f7,7'"
.e.
.ii
\ l CV-31039 Cd CM .
.re{d- CV-31064 t'.ti' t'.T>* t'.*i>* t'.*f[
nv%y
- i N- N - N nv ev gs pygs "v-searjX-0 av % s & X "v-w:[-O "v wX-0 Sc*!h'
) )N ) ) N s, 2b itti;f inf ittis ,,
N c$'Ind) Y N I ,BIf f WATLR
. >== > - is e.r ,% s%
e, g. Figure 4-1 Siniplified Flow Diagram of the Prairie Islarxl Aux Feedwater System Page 34 of 453
*{ 5E p $
Os ,, - a ,a i g
?
6, 5 t t 6 m d E =
= s s s j >j >- l > 4 >- l
, #f >- l >, 4 >-
t ig i id i t g - i & d 4 4 a t t 2 3 3 l 5 .. O a0 5 .b. E 8
!+ g1+ !+ g1 + j E'
I? k$ Y $ 0 Y N E . k 4
?
1 .
?
1 b g u 1.
- 1. . , . , u1 -> 1. + . -
L g g
.6 =
a Xi: ,
- , Xi #a a- e c -> a
= % s =
5 h E
=a = = =
0 @ = G l
TABIE 4-1 AFW PtIMP (X)tfTROL CIRCUIT AC'111ATION INPUTS ACIVATION INPUTS PIMP 12 PIMP 11 PUHF 21 BCR BLC BCR BLC BCR Bif 1.0 AITIYNATIC TRIPS 1.1 IBAD REJECTION TRN B, BilS 16 N N N/A N N TRN A, BUS 26 N N TRN B, BUS 16 N N N/A N N TRN A, BUS 26 N N 1.2 RESTARTS PIMP INDEPENDENT N Y INDEPENDENT N Y INDEPENDENT H Y 1.3 LOW DISCilARCE PRESS. N Y INDEPENDEt(I N Y INDEPENDENT H Y 1.4 IDJ SUCTION PRESS. INDEPENDENT 2.0 MANUAL CONTROL INDEPENDENT INDEPENDENT 2.1 C.R. C0fffROL SWITCH INDEPENDENT INDEPENDENT INDEPENDENT 2.2 C.R. SELECTOR SWITCH INDEPENDENT 3.0 AtTTOMATIC STARTS 3.1 SAFETY INJECTION TRN B, UNIT I TRN A, UNIT 1 TRN A, UNIT 2 3.2 11 SC LL LEVEL TRN B, UNIT 1 TRN A. UNIT 1 TRN A, UNIT 2 3.3 12 SC LL LEVEL TRN B, UNIT 1 TRN A, UNIT 1 TRN A, UNIT 2 3.4 FEEDWATER PUMP OFF 11* 11* 21* 3.5 FEEDWATER Pimp OFF 12* 12* 22* 3.6 IDAD RESTORATIONS N/A YES N/A 4.0 AtTTO CONTROL Al'X ISBE 4.1 LUBE OIL PkESS Y (IND) Y (IND) Y (IND) 4.2 IEBE OIL PRESS Y (IND) Y (IND) Y (IND) 4.3 IACAL PUSH BITITONS Y (IND) Y (IND) Y (IND) TO STOP REQUIRES built D = INDEPENDENT Page 36 of 45
,"v.
bp (-) k_) CIRCUIT /3REAKER POWER / AIR AC POWER / AIR PUMP --- [, c $0LEN0!D < SUPPLY 12 16-1 12 16 12 145-331 21 26-0 21 26 21 245-331 11 SV-33299 Il F1 11 CV-31999 CONTROL CIRCUIT e CONDENSATE SYSTEN ; PANEL 12 (12PI) SG 3 LOWDOWN : 12 : CmTROL POWER 12 SV-33288 (50LEr10!D FOR CV-31682) CmDENSATE SYSTEM g PANEL 21 (21P5) SG 3 LOWDOWN : 21 : CONTROL POWER 21 SV-33494 (50LEN0!D FOR CV-31683) CONDENSATE SYSTEN 4 PAffL 11 (llP20) SG 3 LOWDOWN 4 11 : CONTRCL POWER 11 SV-33287 (50LENO D FOR CV-31681) ACTUATION CIRCulT I a DUTPUTS ALSO INCLUDE. : PANEL 16 FRON PANEL 12 EQUIPNENT HEAT RENOVAL 21 PANEL 25 FRON PANEL 21 3, p
" #' O 11 PANEL 15 FRON PANEL 11 2Ws607Av Figure 4-3 Sumary of AFW Pump Control Circuit Interfaces Page 37 of 453
< l l ;
/
l l 2RY pc PANEL 11/21 DG2 PANEL 12/22 I l )NC >C NC ( NC(
'I 2 PANEL 11 PANEL 21
) NO 'A N0( )NO b N0(
4160V 4160V 4160V 4160V BUS 15 BUS 26 BUS 16 BUS 25 101 ("Y' Y m 201 mm 102 (YY YM 202 (YY m 480V 480V 480V 480V BUS 110 - BUS 210 BUS 120 BUS 220 480V MCC 480V NCC 480V HCC 480V MCC 1A BUS 1 2A BUS 1 1A BUS 2 2A BUS 2 480V HCC 480V MCC 490V HCC 480V MCC 1AC BUS 1 2AC BUS 1 1AC BUS 2 2AC BUS 2 11 21 12 22 22 iz 22 52 1 1 ! 1 1 l I I i I I l U1 DC PANEL 11 U2 DC PAf1EL 21 U1 DC PANEL 12 U2 DC PANEL 22 (TRAIN A) (TRAIN A) (TRAIN B) (TRAIN B) (3-4 HRS) (4-6 HRS) (I HR) (1-l.5 HRS) 2R8602 Figure 4-4 Simplified Diagram of t rairie Island Electrical Distribution System Page 38 of 453
C) n/ Q (T) j 4 MV-32025 MV-32026 MV-32027 % DG1 AC 9 gl2-1
- CKT BRK -
rs is3 : R MCC1A 480V 101 I
- BUS 1 BUS 110 STATION AUK 4160V
" TRAN$r0RMER BUS 15 I CONTROL CIRCUIT < DGl n MCC2A 480V 201 BUS 1 SUS 210 STAT][21 AUK i TRANSFORNER FROM j PRV ACTUATION , POWER (NWD h ,
CIRCUIT t 4160V BUS 26 SPRING RETURN SWITCH LOCAL SWITCH MCC1A 480V 102 46433 (ANNUNCIATED IN CR BUS 2 BUS 120 STATlan AUK TRANSFORMER 7pg, (SEAL-Ir0 IF IN LOCAL POSITIuro IRY RESERVE 46767 . TRANSF. j 46434 . 43gy sus 36 Figiere 4-5 Simplified Diagram of AFW Pump Cooling Water i eReso7Au Suction Valve Control and Actuation Circuitry Page 39 of 453
MV-32383 NV-32384 gg W 212-2 212- 4
< CKT BRK <
g' 4 4---- {p RgSERVE 1 ANSI. MCC2A 480V 2 01 BUS 1 BUS 210 STATION AUX. 4160V
'/ TRANSFDRNCR BUS 26 CONTROL
< DG1 CIRCUIT n NCC2A 480V 2 01 BUS 1 BUS 210 STATION AUX.
TRANSFORMER % FROM2RY E ACTUATION POWER (NWE) . CIRCUIT 4160V
. BUS 26
/
SPRING RETURN SWITCH LOCAL SWITCH 46840 (ANNUNCIATED IN' CR (SEAL-IN) IT IN LOCAL POSITION) 46341 . Figure 4-6 Simplified Diagram of the Unit 2 Diversion 2R0607AU-A Page 40 of 453 O O O
Figure 4-7 Simplified Diagram of Steam Generator Low Water Level Actuation Logic SG LEVEL ACTUATION LOGIC SG SG 11 ( 12 I I I I WA EYR MYE EYlh EYE Mi2 B C D E F A I I I I I I s/s s/s s/s e/s 3/s s/s B C D E F l A TRAIN B,12 PUMP TRAIN A ,11 PUDF PANEL 16 FROM PANEL 12 PANEL 15 FROM PANEL 11 PANEL 16 TRCM PAfTL 12 . PANEL 15 FR(N PANEL 11 I I I I En AT BT DT ET An an DM Ca$ Cak An$rn$ kra $Da CT$ Crk Av$ ri$ krr $ DT
lEP 1 1* ibP "c1NP wP2xA /--- T Acide T - - -f w PixA c
we2xn
. T - - -f <i 4gtg0 Areixa <Eggja /--- T = . u
~
~ *
~
ALL CDNTACTS NA ALL CONTACTS NA ALL CONTACTS N.D. renew ALL CONTACTS NA Page 41 of 453
ACTUATION Dr ArW PUMP TRDM IIL12 NrWD PUHF CONTROL CIRCUIT 12 PUMP (SAMC FOR 10 SHOWN IN
- ACTUATED" MODE SIGNALS TO OP[N NAIN TEEDWATER BREAr[R$ 11&12
#4JTO TRIPS 11C JNC
~
Nr D ~ Mr D 12 11 BRK - 12 BRK 31 7 DC PANEL 12 J ,
- 1) 12 SG HL TRN A SANC AS 11
~~-p-- NO { Aru PUMP 12 2) 12 SG HL TRN 3 I : CONTROL 3) 12 SG HL TRN A
- 5. \ ;, CIRCULI 43 12 % R Tm 3 *
** # 5) SIA
[* *
- 6) SIB
...................e b
- 7) UV CM 4160V 305 $UPPLY l 9) LOW SUCTION PRESSURE AT 2D00
. ! 9) 2/3 CONDCNSATE PUMPS Orr AT FULL P0u[R CONDITIONS P 2 *
. 10) ON TUR81r1E-TRIP GIVEN r0
[I i START WHEN MRGI D OTHER Pure RurftING
- 11) LOW LUBC O!L SANC AS 11 t.............................................*
Figure 4-8 Simplified Diagram of Main Feedwater Pump Trip Actuation Logic
"" Page 42 of 453 e
e
~
9 O
O O O a% w AFW PUMP LOW PRESSURE TRIPS _ i i i
- +
4 i LOW SUCTION LOW DISCHARGE PRESSURE PRESSURE 1 - 1
)
PUM CD ROL ____ ENERGIZE TO TRIP 1 T i i 2R9607AY Figure 4-9 Simplified Diagram of AFW trv i Pressure Trip Actuation Logic Page 43 of 453 2 w- -- - . _ ___ _ _ _ _ ___ _ _ _ _ _____
4 SA m FEEDWATER BYPASS FEED- CONTROL VALVE WATER O IIEATERS SG A SC B
._ _ N hk
~ ~
~~~
_ __ _ \ / \ / v FEEDWATER CONTROL VALVES SB u f
=
MkN FEEDWATER BYPASS
=
k G "" G CONTROL VALVES r ( ( O
-p n
=
RECIRCULATION LINE 7 1s FROM CONDENSER Auxiliary g AND FEEDWATER Feedwater llEATING 2(- RECIRCULAT70N LINE Figure 4-10 Main Feedwater System Page 44 of 453
v , f f ' 4.2' Main Feedwater System A) 1 j The Main Feedwater System maintains the feec4ater inventory in the steam
"> generators during normal plant operation. The feedwater pumps receive . condensate from the condensate pumps and heater drain pumps and deliver flow through two parallel, high pressure, feedwater heaters to the steam generators.
The Main Feedwater System (Figure 4-10) consists'of two 50". capacity motor-driven c.entrifugal pumps, a single high pressure feedwater heater and feedwater flow control valving. Main Feedwater pumps 11 and 12, (21 and 22 in Unit 2) are powered from 4.16 kV busses 11 and 12, (21 and 22 in Unit 2) respectively. Suction for the main feedwater pumps is delivered through a common suction header by the condensate and heater drain pumps at approximately 310 psia. The main feedwater pumps boost the system pressure to 1156 psia. Feedwater then flows through two carallel high pressure feedwater heaters which P raise the system temperature to 432*F. Each unit has two feedwater controllers, one for each steam generator. The three control input variables are feedwater flow rate, steam flow and steam generator level. These three signals are used to control the feedwater flow rate by positioning the air operated feedwater control valves in the feedwater flow path (Unit 1: CV-31127 & CV-31128; Unit 2: CV-31135 & CV-31136 used during normal plant operation or Unit 1: CV-31369 & 31370; Unit 2: CV-31371 & CV-31372 bypass valves used during plant startup). 4.3 Support Systems ( 4.3.1 Cooling Water Summary Description '; ! The primary function of the Cooling Water System is to provide an adequate cooling water supgly for plant ' equipment heat loads, to provide a cooling water l supply to all the safeguards equipment during normal and emergency operating conditions, and to provide an emergency feedwater supply to the steam generators. The Cooling Water System is a safeguards system consisting of five pumps (two
- horizontal motor-driven pumps, one vertical motor-driven pump and two diesel-engine-driven pumps) feeding a ring Seader shared by the two units as shown in l
Figure 4-11. The header can be automatically or manually separated into two i redundant supply headers. The automatic separation allows the necessary cooling l water requirements for the safeguards equipment to be met by either supply l header without manual valve operation during normal operating conditions. The normal water supply for the Cooling Water System is from the Cooling Water pump bays in the plant screenhouse. Two motor-driven cooling water pumps take a suction on the Cooling Water pump bays and discharge to a common header. The common pump discharge header contains four motor-operated isolation valves which may be used to divide the header and pumps such that the two supply headers are separated. The supply headers can be cross-connected through two normally-closed, motor-operated valves to form the ring header. Header "A" supplies safeguards equipment including
#11 and #21 auxiliary feedwater pumps. Header "B" supplies safeguards equipment including #12 and #22 auxiliary feedwater pumps. The diesel generators are provided with a cooling water supply from each of the two headers.
(3 O ' Page 45 of 453 i
s .
~
I e lf U
'I l' U
[i 3, #1 :: I ,2, I ,, b ,, T E E if O E lf 1f If X X X ".A^ ~~e hw=3203F uv=33038 kv=32034 kw=32035 3
*k et 9
*o .f 9 $*$
a 1f 0 E F3 s2 3 e u=
, ww -3
. . ae :
- y t 23
- t $2 If T 9 *
* $ 55 85 $' !o =.
2 2 a .J Es @
>3 5 3* 4 3 3 g* 3 3 0 3 jL . k 8*
z d . IL l d O O O 9
.'.,J- a
. M_=
I ' L y_, ~*nif" TO '" AUX t_; e*w e*3 SL I ? 4T S uv 3203, *j "4 Mv=32033Q y*g C W , W ATEA sysTEMW 3 .j$ D e ect C egM 3% ,g g- I g* CV-33448 kv=32032 l AUL F.W. PuupS l d 5! h3 5 h3~ f { } T l STA. AA CCupS. l I! A A I!= Mv=32372 E W W
$ wW-32371 7 "go f*. ~
Z "3] C , e*e e
.. ] i
!Q* uv=321ts uv-321u t*50 5
i 9 E 3 L4 ?2 1
.T_unerar sLca.
__ ___ ___ __a , w____________- XC,.32334 T Mv-32332 N u V
,12 09 unns 1 ano 2 112 09 UNWs 1 Ano 2 l SAFtGuamos wSAT S AFEcusacs ut Af '
EXCMANGERS EXCMANGERS j T e m e _ T
~4v=32329 W 32322 8
i: ;-- Quus TO GRACE WV-32038
~
l I Figure 4-11 Cooling Water System 2-R86-00% Page 46 of 453
~
F c , The Cooling Water System is capable of meeting the following design requirements:
- 1. Each supply header'can supply the needs of the safeguards equipment in
.both units.
- 2. The system is capable of tolerating a single passive failure during the long-term operating condition following an accident.
.3. Any one of the pumps is capable of satisfying the post-accident cooling requirements for one unit and the hot-standby requirements of the other unit or the post accident cooling requirements for both units. ; ' These requiren'ents include provisions for suction and cooling supply j to one auxiliary feedwater pump in each unit and cooling for both diesel generators.
- 4. The system is capable of operating with a loss of all offsite ac power with the diesel cooling water pumps.
- 5. The Cooling Water System prussure to the component cooling water heat exchangers is high enough to ensure that, in case of tube leakage, the. flow is from the Cooling Water System into the Component Cooling Water System.
Pump Instrumentation and Control i The two horizontal motor-driven pumps provide the normal cooling water supply. ,
~
Control of the pumps is from the main control room. The vertical motor-driven L pump (VMDP) serves as a backup to the two horizontal Cooling Water pumps. . The
..(h VMOP is normally operated from the control room. With the control switches in their " normal" positions the VMDP pump starts automatically if the cooling water discharge header pressure falls below 75 psig. The vertical motor-driven pump is automatically tripped if both diesel-driven cooling water pumps are operating at'or above 400 rpm. -The diesel-driven Cooling Water pumps serve as backups to the three motor-driven Cooling Water pumps. The diesel-driven Cooling Water pumps are operated either remotely from the control room or locally from a screenhouse control panel. For normal automatic operation, the " Remote-Local" selector switch is placed in REMOTE, the " Auto-Manual" selector switch is placed in. AUTO and the control switch is placed in NORMAL. This switch lineup allows the diesul to start automatically on the following signals:
- 1. A safety injection signal (SI) from the associated train for either unit.
- 2. A Cooling Water discharge header pressure signal below 75 psig for greater than 15 seconds. (The 15-second time delay allows the motor-driven vertical pump to start and attempt to restore the header pressure, preventing unnecessary diesel starts.)
The diesel-driven pumps are automatically tripped by the following signals:
.1. A diesel overspeed condition. This condition also results in a "CL i
Pump (Diesel) General Trouble Alarm" annunciator and a "CL Pump (Diesel) Locked Out" alarm in the control room. ) 2. A diesel low lube oil pressure condition. This condition also results in a "CL Pump (Diesel) Locked Out" alarm. l Page 47 of 453
4.3.2 Diesel Generator Summary Descriotion : The emergency diesel generators are connected so that one is available to supply emergency power to each of the two redundant safeguards systems. The generators are sized to be capable of supplying the full engineered safeguards loads for one unit and the concurrent hot shutdown load for the second unit. The diesel generators consist of two Fairbanks Morse units each rated at 2750 Kw continuous (8750 hr. basis), 0.8 power factor, 900 rpm, 4160 volt, 3 phase, 60 Hertz. The 2,000 hour rating of each diesel generator is 3000 kilowatts. The limitations imposed by the generator and the heat removal equipment limits the overall 30-minute rating of each unit to 3250 kilowatts maximum. The 8760 hour (continuous) rating of each diesel generator is 2750 kilowatts. Sufficient fuel is stored in the day tank for each diesel generator for up to two hours of operation at full load. Fuel from interconnected storage tanks can be trans-fered to the day tanks by electric pumps for operation of either diesel for up to two weeks. Each diesel generator is automatically started by either of the following events:
- 1. Loss of voltage or degraded voltage on either of the associated 4160-volt buses (buses 15 and 26 for DG 1 and buses 16 and 25 for DG 2).
- 2. Initiation of a Safety Injection Signal (both diesel generators start immediately on this signal).
Automatic starting of either diesel generator is initiated by a modified 2-out-of-4 undervoltage relay scheme on each 4160-volt bus to which the diesel generator is to be connected. The undervoltage relays on each 4160-volt safety features bus are normally energized and thus function properly and are fail-safe for any condition involving loss of 4160-volt power on the bus involved. On loss of voltage, the automatic voltage restoration scheme, consisting of diesel generator starting, breaker actuation to align the associated diesel generator or alternate source of ac, and load shedding is initiated immediately. When degraded voltage is sensed, the voltage restoration scheme is initiated if acceptable voltage is not restored within a short period of time. This time delay prevents initiation of the voltage restoration scheme when large loads are started and bus voltage momentarily dips below the degraded voltage setpoint. The undervoltage trip signal to the diesel generator source breakers is blocked if the safety injection signal is present, thereby preventing load shedding of the emergency buses when they are being supplied by the diesels. After voltage is re-established on the subject 4160-volt bus, either from an offsite source or from a diesel generator, the diesel generator continues to run (lcaded or unloaded) until manually shut down. 4.4 Post TMI Changes and Modifications After the 1979 incident at the Three Mile Island (TMI) Nuclear Plant many changes were made related to the design and operation of the Prairie Island Auxiliary Feedwater System (AFWS). Changes were made in response to NUREG- 0737 Items II.E.1.1 and II.E.1.2 and operational experience. Page 48 of 453
4 The following is a list of major design and operation &l changes that have been -
/]
V. :made to the Prairie Island Auxiliary Feedwater System in the " Post-TMI era":
- 1. Technical. specifications have been adopted to limit the allowable outage time for an AFW pump to 72 hours while the reactor coolant system temperature in the associated unit _is above'350*F.
- 2. Manual' valves in the AFW discharge path have been locked open to administratively control their position. Technical specifications have been incorporated to require monthly inspection of the manual valves outside containment-to verify their position. The following administrative controls have -been incorporated to assu-e the position-of the manual valves inside containment:
'a. 'A double verification of each AFW valve inside containment is made prior to the unit's startup.
- b. The AFW pumps are used as the feedwater source to the steam generators at~ plant startup, thus assuring that the flow path to the steam generators is open.
- c. ' Maintenance that requires these valves to be closed is done with the reactor coolant system temoerature below 350'F (cold shutdown).
- 3. Emergency procedures have been prepared and/or modified and made available to the operators for transferring to the alternate Auxiliary
-Fe'edwater Source (Cooling Water).
- 4. Dual continuous condensate storage tank level indication is being added to the control board of each unit in conjunction with other human factor engineering improvements. In addition, Technical specifications have,been adopted to require the valves in the cross connect line between the condensate storage tanks of Units 1 and 2 to be tagged in the open position to ensure that the available inventory is maximized and the inherent redundant level indication is main-tained.
- 5. Condensate storage tank level indication cables for Units 1 and 2 have been rerouted to meet separation criteria for redundant safeguard instrumentation.
- 6. The turbine-driven pump steam inlet valve was changed from a motor-operated valve to an air-operated, fail-open control valve. This was done to totally eliminate the ac dependency of the system. This control valve was later relocated outside of the pump room for envi-ronmental qualification considerations. A three-way manual valve was added in the line supplying air to the steam inlet valve to allow operators to manually start the turbine-driven pump locally by bleeding the air from the steam inlet valve actuator.
O Page 49 of 453
- 7. Environmentally qualified pressure switches have been installed in the :
suction and discharge lines of each pump. The suction pressure switch protects tne pump in the event of valving errors causing loss of ? ump suction or loss of level in the condensate storage tanks. The dis-charge pressure switches protect the pump in the event of valving errors or line breaks resulting in pump runout.
- 8. Control room annuciation has been added to warn the operator of a tripped condition of the turbine-driven pump overspeed trip mechanism.
Early indication of this condition is valuable in reducing the time to detect accidental tripping of the mechanism and/or aid in timely recove y from an actual overspeed trip.
- 9. In response to NRC Generic Letter 81-14, " Seismic Qualification of AFW Systems", dated February 10, 1981, Northern States Power Company reviewed the seismic design of the auxiliary feedwater system in each unit. Additional seismic analysis was performed and additional piping restraints were added. Other relatively minor modifications were also performed to provide assurance that the system would be available rollowing an earthquake.
O l 9 Page 50 of 453
-LJ() 5.0 RESULTS-5.1 Benchmark Analysis Performing an analysis of AFW reliability using the approach of NUREG-0611 (Ref.
- 1) permits benchmarking the pre-TMI situation and allows a determination of the effect of.the changes made as a result of this NUREG, and NUREG-0737. Since this is meant to be a benchmark of the NRC's NUREG-0611 model, wherever possible basic event data is taken from Table III-2 of the NUREG. .The specific values used for the basic events are documented in Appendix G. The code used in this analysis was obtained from EPRI and has been designated WAME-02 WAMCUT (Ref. 4).
The NSP version of the code used is CUT 86003. The results of this analysis are described below. There is a section for each of three initiating events evaluated in NUREG-0611, before and after the changes made for NUREG-0737. 5.1.1 Pre-TMI Modifications The models developed for this section represent conditions at the plant prior to changes made for NUREG-0737 and have become known as the NUREG-0611 pre-TMI models. These are the same conditions that were evaluated by the NRC in NUREG-0611. 5.1.1.1 Loss of Main Feedwater A The reliability of the AFW' system determined by our analysis for this event is b 3.4E-03. This compares favorably with the value, determined by the NRC in NUREG-0611, of IE-03. From this it is concluded that we have developed a good understanding of the approach used NUREG-0611 and can use these same methods for licensing calculations. AswasstatedinthePrairiekslandspecificsectionofNUREG-0611,the dominant fai'ure mode of the AFW system for this transient is the blockage of flow to the two steam generators due to inadvertent closure of two manual valves (AF-12-1 and AF-12-2) in the pump discharge lines inside containment. The probability assigned to this event, 3E-03, is taken from Table III-2 in the NUREG and pertains to common cause events due to human error. Due to the high probability of this event and its location in the fault tree, it alone brings the AFW system outside the high range of reliability defined in the NUREG. The next eight largest contributors are listed below along with their probabilities. 1.00E-04 Valves AF-12-1 and AF-12-2 fault, or are inadvertently left in the closed position. This probability is for uncoupled events. The probability of a coupled failure of these valves was the dominant failure mode described above. 7.00E-05 Valves AF-12-2 and MV-32242 fault. 7.00E-05 Valves AF-12-1 and MV-32243 fault. r 4.90E-05 Valves MV-32242 and MV-32243 fault. Page 51 of 453 l
4.90E-05 #11 and #12 AFW pumps fault. : 2.10E-05 #12 AFW pump and valve MV-32264 fault. 1.47E-05 #12 AFW pump and Valve AF-13-3 fault. 1.47E-05 #11 AFW pump and valve AF-13-4 fault. 5.1.1.2 Loss of Offsite Power - Diesel Generators Operate This transient is the same as the above transient when analyzed using the NUREG-0611 approach. All components included in this model that require ac power receive it from the diesel generators. Since this event assumes the diesel generators operate properly, it doesn't matter whether the components are operated with offsite power or the diesel generators. 5.1.1.3 Station Blackout In this transient only de power is available which reduces the AFW system to one steam-driven pump train. The AFW system unavailability associated with this event is 2E-02. The four largest contributors to this unavailability (given that the motor-driven train has failed due to loss of ac) are failure of the #11 AFW pump, or failure of valve MV-32264 (turbine steam inlet valve), or failure of valve AF-13-3 or the failure of both valve MV-32025 and valve MV-32333. 5.1.2 Post-TMI Modifications (Current Situation) The models in this section represent conditions at the plant after changes were made to the AFW system for NUREG-0737 and have become known as the NUREG-0611 Post-TMI models. The changes are summarized in the NRC's safety Evaluation Report of the implementation of NUREG-0737 II.E.1.1 and II.E.1.2. These models also take credit for the cross connect which allows the #21 AFW Pump to provide flow to the Unit 1 Steam Generators. 5.1.2.1 Loss of Main Feedwater The Post THI changes were sufficient to bring the reliability of the AFW system up into the high range as defined in NUREG-0611. In this case, the unreliability of the system was determined to be 5.4E-05. The main reason for the increase in reliability between this model and the Pre TMI model is in the treatment of the valves inside containment. Due to the three reasons given below, the valves no longer have human error as the dominant contribution to failure.
- a. Double independent verification of correct valve position prior to startup.
- b. After Cold Shutdown and prior to 10% power a test is performed to verify the normal flow path from the CSTs to the Steam Generators.
- c. Maintenance that requires closure of these valves will be conducted at less than 350 dagrees (most likely at cold shutdown). Following maintenance the test described in b. above is required.
Page 52 of 453
Another reason for the higher reliability is that the Unit 2 motor-driven AFW [/Y L pump along with the cross connect is included in this model. This would have little effect on the dominant contributors of the pre-TMI model and therefore its value for reliability, but does have some effect on this model. The six largest contributors to the AFW system unreliability along with their probabilities are listed below. 4.9E-05 Valves-MV-32242 and MV-32243 fault. 7.0E-07 Valves AF-16-2 and MV-32242 fault. 7.0E-07 Valves AF-12-2 and MV-32242 fault. 7.0E-07 -Valves AF-16-1 and MV-32243 fault.
.7.0E-07 Valves AF-12-1 and MV-32243 fault.
'3.4E-07 #11, #12 and #21 AFW pump fault.
5.1.2.2 Loss of Offsite Power - Diesel Generators Operate Since this case is so similar to the Loss of Main Feedwater initiating even (for , i the reasons described in pre-TMI discussion of this event) no further analysis was performed. O] 5.1.2.3 Station Blackout
-\ ,
As was stated in the pre-TMI discussion of this event, only the turbine-driven train can be expected to. perform in this situation. There is very little improvement in reliability between this case and the pre-TMI since the changes to the system had little effect on the dominant contributors to system unreliability. The four highest probability cut sets for this case were the same as-those in the pre-TMI model. Replacing the motor operated turbine steam admission valve with an air operated valve did result in a small incrtrase in system reliability. -The AFW system reliability for this event is 1.8E-02. 5.2. Plant Data Analysis In order to maximize the plant-specific nature of the Prairie Island auxiliary feedwater system reliability study, the reliability and availability histories of components at the plant were used as much as possible to derive the event probabilities used in the study. Plant records were surveyed for failure, demand, operating time, and exposure time data, which were used to estimate failure rates for major components in the auxiliary feedwater system, diesel generators, and diesel-driven cooling water pumps. The failure rate estimates were used to calculate r component failure probabilities in the auxiliary feedwater system fault tree, as well as failure probabilities of diesel generators and diesel-driven cooling water pumps. Plant testing and maintenance records were surveyed to obtain data on the frequency
'and duration of test and maintenance outages of major components. These data were
'used to estimate test and maintenance unavailabilities used in analysis.
The purpose of this section is to describe the methods used in the plant data analysis and summarize the results. Further details may be found in Appendix 0. Page 53 of 453
5.2.1 Data Analysis and Probability Estimation Methods The main steps of the plant data analysis were (1) collecting the information from plant records, (2) interpreting the information to count failures and demands, operating hours, or exposure hours for each component and failure mode of interest and to count instances and durations of maintenance and testing outage for each component of interest, (3) estimating failure rates and main-tenance and testing frequencies and average durations from these data, and (4) calculating probabilities from these failure rates and maintenance and testing parameters. The probabilities were then used to calculate the system reliability and plant risk measures of interest in the study. Failure data were obtained from event descriptions in Abnormal Occurrence (AO) reports, Reportable Occurrence (RO) reports, Significant Operating Event (SOE) reports, Licensee Event Reports (LER), and Nuclear Power Reliability Data System (NPRDS) entries. These sources were surveyed for events occurring during the years 1975 to 1985 for Prairie Island Unit 1 components and 1976 to 1985 for Unit 2 components. If an event was considered a failure under the failure mode definitions for components included in the study, then the event was added to the failure count for the appropriate component and failure mode. Component demand and operating time data were obtained from surveillance test records (for demands and operating time occurring during testing) and from plant outage records (for demands and operating time occurring at plant shutdowns, startups, and during outages). If complete information about component demands and operating time during a particular outage could not be obtained, then the judgement of the plant operations staff was used to estimate the number of demands and operating hours that occurred. Failure rates for some component failure modes were derived from a component exposure time other than operating time. For the motor-operated valve fails to remain open failure mode, the exposure time was the number of plant non-shutdown hours. For the turbine-driven auxiliary feedwater pump trip / throttle valve fails to remain open failure mode and all failure modes related to diesel generator and diesel-driven cooling water pump initiation and control circuits, the exposure time was the number of calendar hours during 1975-1985. Failure, demand, operating time, and exposure time data were pooled for compen-ents of the same type. For example, data were pooled for both turbine-driven AFW pumps, all motor-operated valves in the AFW system, motor-operated valves in the cooling water system, etc. The pooled data were used to estimate failure rates to apply to all components of the data pool. For demand-related failure modes (pump or diesel generator fails to start, valve fails to open or close), the failure rate was estimated by dividing the number of failures counted for the data pool by the number of demands. For operating time-related failure modes (pump or diesel generator fails to run), the failure rate was estimated by dividing the number of failures by -he number of operating hours. For passive (valve fails to remain open) failure modes or standby-related failure modes (initiation and control circuit failures), the failure rate was estimated as the number of failures divided by the number of exposure hours. O Page 54 of 453
/'/') Some component data pools experienced no failures. In these cases, the failure rate was not estimated as stated above, because this would result in a failure m. rate estimate of zero. Instead, the number 0.5 was divided by the appropriate
" denominator" (demands or operating time or exposure time) to estimate the failure rate. This allowed a non-zero failure rate estimate for those data pools with no failures. Furthermore, this failure rate estimate is lower than the estimate that would have been calculated had one failure been experienced, so some credit is given to the components in the data pool for not failing at all.
Event probabilities were calculated from the failure rate estimates in different ways, depending on the components and failure modes represented by the events. The probability of demand failures was set equal to the demand failure rate estimated from data. The probability of operating-time failures was calculated as the product of the operating-time failure rate and the assumed " mission time" for the component (usually 6 hours in this study). The probability of normally-closed valves failing to remain ooen after opening on demand was also calculated by this formula. The probability of other passive and standby-related failures was calculated in different ways, depending on whether the failures were detectable in the control room immediately after occurring or detectable only at a, periodic test or other component demand. In the former case, the failure probability was calculated as the product of the component failure rate and the average tinie to restore the component to its desired state (this average restoration time was calculated from plant data, if possible). In the latter case, the failure p-obability was calculated as the product of the failure rate and one-half the average time QLJ between component demands (the " test interval"). Data on maintenance outages were obtained from plant Work Request Authorizations (WRA). The frequency of component maintenance was estimated by dividing the number of instances of component maintenance outage by the numbeq of plant non-shutdown hours (for AFW system components) or the number of cqlendar hours (for diesel generators and diesel-driven cooling water pumps). The1 average duration of maintenance outage for a particular component was derived from the outage durations reported in the WRAs. The mair.tenance unavailability for each component was calculated as toe product of the outage frequency and the average outage duration. A separate co.1tribution to the maintenance unavailability of diesel generators was added to account for preventive maintenance. The frequency and average duration of preventive main-tenance was calculated from information provided by plant personnel. Plant test records provided the data used to estimats the frequency of tes'.ing of each component of interest. Plant operations personnel provided estimates of the duration of component outages at each test. The component testing unavail-abilities were calculated as the product of the frequency of testing outages and the estimated duration of each test outage. m I \
<J Page 55 of 453
5.2.2 Summary of Results The following tables summarize the results of the plant data analysis. Table 5.2-1 gives the failure rate estimates derived from plant data for components of the AFW system and Table 5.2-2 gives the failure probabilities calculated using these failure rate estimates. Tables 5.2-3 and 5.2-4 give the same information for diesel generators; Tables 5.2-5 and 5.2-6 give the same information for diesel-driven cooling water pumps. Table 5.2-7 gives the maintenance and testing unavailabilities estimated from plant data for major components. O 1 1 O Page 56 of 453
~~ . . - _ . . ~ - . , ~ ~ - - . . - - , - - . . . . . , _ . _ , . - _ .- . . .~. .. , .
a
, t f
(
/
t p-~3 t ,,;:.
- j 1
\~ .kt/-
) " TABLE 5,2-1 FAILURE RATES FROM PLANT DATA: AUXILI ARY FEEDWATER SYSTEM COMPONENTS ' NUMBER OF NUMBER OF FAILURE RATE i COMPONENT TYPE FAILURE MODE . FAILURES DEMANDS /HOUP.5 ESilMATE l (d) (h) i Turbine-Driven AFW Pump Falls to Start 8 314 d 2.5E-02 2 Falls to Run p 155 h 3.2E-03 i Turbine-Driven AfW Pump
- Trip / Throttle Valve Fa l l s to Rema in Open 8 184104 h 4.3E-05 Motor-Driven AFW Pump Falls to Stars 2 1382 d 1.4E-03
) Falls to Hun 0 4559 h 1.1E-04 1 Motor-Operated Va lve ialls to Open (1) 0 50 d 1.0E-02 f Falls to Close 1 1693 d 5.9E-04 Falls to Remain Open (2)_ 0 1352115 h 3.7E-07 , Ai r-Operated Va lve Fails to Open (3) 0 167 d 3.0E-03
, Ct.eck va lve Fails to Open 0 2084 d 2.4E-04
- Notes to Table 5.2-1
f 1 Data For AFW pump suction valves From cooling water (MV-32025, -32026, -32027, and -32030) only. 1
- 2. Data For normally-open AFW system motor-operated valves during plant non-shutdown hours only.
4 i 3. Data For AFW pump turbine steam inlet control valves (CV-31998 and -31999) only. 1 l 7 1 1 4 i i ! . 9 51 .,45, t i 1 4 1 4 , j
IABLE 5.2-2 FAILURE PROBABILITifS: AUXILIARY TEEDWATER SYSTEM COMPONENTS FAILURE RATE MISSION TIME / FAILURE COMPONENT TYPE FAILURE M00E ESTIMATE TEST INTERVAL / PROBABILITY RESTORATION TlHE (hours) Turbine-Oriven AFW Pump fails to Start 2.5E-02 -- 2.5E-02 Falls to Run 3.2E-03 6.0 1.9E-02 Turbine-Driven AfW Pump Trip / Throttle Valve Falls to Remain Open 4.3E-05 0.2 (1) 1.0E-05 Motor-Driven AFW Pump Falls to Start 1.4E-03 -- 1.4E-03 Fails to Run 1.1E-04 6.0 6.6E-04 Mo to r-Ope ra ted Va l ve Falls to open 1.0E-02 -- 1.0E-02 Falls to Close 5.9E-04 -- 5.9E-04
- Falls to Remain Open 3.7E-07 674.4 (2) 1.2E-04 689.5 (3) 1.3E-04 713.6 (4) 1.3E-04 919.8 (5) 1.7E-04 1488.3 (6) 2.8E-04 3898.0 (7) 7.4L-04 6.0 (8) 2.2E-06 Ai r-Ope ra ted Va lve fails to Open 3.0E-03 --
3.0E-03 Check Valve Falls to open 2.4E-04 -- 2.4E-04 NOTES To TABLE 5.2-2:
- 1. Average restoration time for Trip / Throttle Valves after failure; ra i l u res a re annunc i a ted in control room.
- 2. Test i nte rva l for MV-32335, based on f requency of SP 1100.
- 3. Test i nte rva l for MV-32333, based on frequency of SP 1102.
- 4. Test i nte rva l for MV-32336, based on f requency or SP 2100.
- 5. Test i nte rva l for MV-32381, -32382, -32242, and -32243, based on f requency or hot shutdown, cold shutdown, and refuel ing outages.
- 6. Test i nte rva l for MV-32238 and -32239, based on f requency or emergency hot shutdown, cold shutdown, and refueling outage.
- 7. Test i nte rva l for MV-32016 and MV-32017, based on f requency or cold shutdown and refueling outage.
- 8. Mission time, relevant for no rma l ly-closed va lves MV-32026, -32027, and -32025.
Page 58 of 453 O O O
TAotE 5.2-3 FAILURE RATES FROM PLANT DATA: DIESEL CENERATORS NUMRf'M OF NUMBER OF FAILURE RATE-. COMPONENT TYPE FAILURE MODE FAILURES DEMANDS / HOURS ESTIMATE (d) (h) Diesel Gene ra tor Falls to Start 2 783 2.6E-03 Falls to Run 5 2305 2.2E-03 Diesel Generator immediately Control Ci rcui t Detectable Faults 4 192864 2.1E-05 . Faults Detectable at Diesel Demand 1 192864 5.2E-06 Page 59 of 453 1
- - - -- w W :_ _ _--
TABLE 5.2-4 FAILURE PROBABILITIES: DIESEL GENERATORS FAILURE RATE MISSION TlHE/ FAILURE COMPONENT TYPE FAILURE MODE EST1 HATE TEST INTERVAL / PROBABILITY RESTORATION TIME (hours) Diesel Gene ra to r Fails to Start 2.6E-03 -- 2.6E-03 Falls to Run 2.2E-03 6.0 1.3E-02 Diesel Gene ra t o r immediately Control Ci rcui t Detectable faults 2.1C-05 1.0 (1) 2.1E-05 Faults Detectable at Diesel Demand 5.2E-06 246.3 6.4E-04 Notes to lable 5.2-4: _
- 1. Assumed restoration time for diesel generator control circuit immediately detectable faults.
Page 60 of 453 O O O
_ . . _ . . _ .._._ _ ._ .. ..__.__..;_. .._ __. ._ ._..._.m.. . ..-._...~-.m.,.m.. -._. . . . _ . . - _ .. , - . _ . _ ~ m- .. . . . . . .. i 1 a
! TA8tE 5.2-5
'l- FAILURE RATES FROM PLANT DATA: DIESEL-DRIVEN COOLIIIG WATER PUMPS $ 30 UMBER OF NUMBER OF FAILURE RATE i COMPONENT TYPE FAILURE MODE FAILURES DEMAIIDS/ HOURS ESTIMATE ) (d) (h)- l Diesel-Driven CW Pump Falls to Start 3 4as e 6.8E-03 + i . Falls to Run 1 614 1.6E-03 s l Diesel-Driven CW Pump lamediately [ Control Circuit Detectable faults 4 192864 2.1E-05 l , l Faults Detectable - l at Pump Demand 1 192864 5.2E-06 l f I 1
't i
i i i l l I I ' C b t s i i 1 }. l i Page 61 of 453 [ s I f m - , -
, - - .r-,e , n.e - ,-- c. ,.e-., , . - . . r - - er . -,
.s-. > , , . w v, ., -n,
IADtE 5.2-6 FAILURE PROBABILITIES: DIESEL-DRIVEN COOLING WATER PUHPS FAILURE RATE MISSION IIHE/ FAILURE COMPONENT TYPE FAILURE HODE ESTIMATE TEST INlERVAL/ PROBABILl1Y RESTORATION TlHE (hours) Diesel-Driven CW Pump fails to Start 6.8E-03 -- 6.8E-03 falls to Run 1.6E-03 6.0 9.8E-03 Diesel-Driven CW Pump Immediately Cont rol Ci rcui t Detectable faults 2.1E-05 P3.4 (1) 4.80-04 faults Detectable at Diesel Demand 5.2E-06 438.3 1.1E-03 Notes to Table 5.2-6:
- 1. Average restoration time for diesel-driven CW pump control c i rcui t immediately detactable faults.
Page 62 of 453 O O O
.4
\
v 't IASt r 5.2-7 COMPONENT MAINTENANCE / TESTING UNAVAILA81LITIES UNAVAILABILITY fit [QUENCY AVERACE DURATION UNAVAILA81LITY COMPONENT TYPE (per hour) ( hours) Motor-Driven AFW Pump 12 Test 1.5E-03 0.25 3.7E-04 Motor-Driven AFW Pump 21 Test 1.4E-03 0.25 3.5E-04~ Turbine-Driven AFW Pump 11 Test 1.50-03 0.17 2.4E-04 Turbine-Driven AFW Pump Maintenance 3.5E-05 5.36 1.9E-04 Motor-Driven AFW Pump Maintenance 2.1E-05 14.45 3.0E-04 Cooling Water MOVs (1) Maintenance 3.5E-06 31.83 1.1E-04 Diesel Generator D1 Maintenance ( Prevent ive ) 1.1E-04 81.66 9.3E-03 Maintenance (Unscheduled) 9.4E-05 20.17 1.9E-03 Diesel Generator D2 Maintenance ( Preventive ) 1.1E-04 81.66 9.3E-03 Maintenance (Unscheduled) 1.6E-04 32.63 5.2E-03 Diesel-Driven CW Pump Maintenance 1.0E-04 17.2 1.7E-03 Notes to Table 5.2-7:
- 1. Valves MV-32025, -32026, -32027, -32030.
Page 63 or 453
5.3 As-Built Analysis The as-built auxiliary feedwater system analysis incorporates details of the specific Prairie Island auxiliary feedwater system design into the determination of the overall analytical results for each case examined. The cases generally consist of a determination of auxiliary feedwater system failure probability for two accident initiators or initiating events. The first initiating event considered is complete loss of the main feedwater system such that the auxiliary feedwater system must be used for steam generator makeup and subsequent decay heat removal. The second event considered is complete loss of offsite power where the emergency diesel generators will be relied upon for restoration and continued supply of unit emergency safeguards power ind the auxiliary feedwater system will be required to supply steam generator makeup. Since Prairie Island is a two-unit facility where the auxiliary feedwater system is shared by both units, single-unit and two-unit effects of the two initiating events are examined. Further, the single-unit effects are analyzed to determine the relative cnange in auxiliary feedwater system failure probability following the system design changes that resulted from requirements imposed following the incident at Three Mile Island (TMI). Potential common cause failures of multiple components often contribute significantly to the overall results of a system failure analysis. Such is the case for the auxiliary feedwater system. Consequently, the single-unit analysis is further divided into two different sets of general results. The first considers only the common cause effects that are explicitly contained in the model. The second considers additional common cause contributions that must be determined parametrically. Each set of results is discussed and presented in the following sections. 5.3.1 Single Unit - Explicit Common Cause Included A detailed fault tree was developed to analyze the effects of the initiating events on the auxiliary feedwater system. To simplify the fault tree, only Prairie Island Unit I effects were modeled. The fault tree analysis assumes that the auxiliary feedwater system for each unit is essentially symmetric; therefore, the results of the Unit 1 fault tree analysis can be generally applied to Unit 2. The detailed fault tree is provided as Attachment B to this document. Some potential common cause events are explicitly modeled in the fault tree. Therefore, this section discusses results that include this explicit common cause contribution to the auxiliary feedwater system failure probability. 5.3.1.1 Before Post-TMI Modifications Subsequent to TMI many recommendations were made regarding changes that could be made to improve the reliability of the auxiliary feedwater system. Prairie Island made these changes where it was appropriate. Thus, the auxiliary feedwater configuration following TMI is different to that existing before TMI. O Page 64 of 453
I
.O Two key Prairie Island auxiliary feedwater system vulnerabilities were d identified in the NUREG-0611 analysis. First, there were (and still are) two manually-operated valves inside the containment (AF-12-1 and AF-12-2) that could prevent auxiliary feedwater flow to both of the Unit 1 steam generators if both valves were inadvertently closed or left closed following test or maintenance.
These valves exist in the common auxiliary feedwater train discharge header to the respective steam generator. Second, the turbine-drinn auxiliary feedwater pump was dependent on AC power for proper operation.
. The results given in this section reflect the estimated failure probability of the Prairie Island auxiliary feedwater system before the TMI changes were implemented.
5.3.1.1.1. Loss of Main Feedwater The failure probability of the auxiliary feedwater system, given a complete loss of main feedwater, estimated in NUREG-0611 is: Approximately 1E-3 It is not necessary to perform a detailed analysis to arrive at this value. The value represents the probability of both of the manual valves inside containment being closed when it is necessary to provide flow to either of the Unit 1 steam generators. The probability is-found in NUREG-0611 (Table III-2) as the value to use to estimate the probability of a coupled error of this type when the
- given valves have no valve position indication in the control room. If one assumes that the two available trains of auxiliary feedwater are reasonably s reliable, then the total system failure probability, given this initiating event, is dominated by the common misposition of these two manual valves.
Prairie Island data imply that the value of this occurrence could be no worse than 1E-4. That is, there is no record of an occurrence of this failure in the entire operating history of either of the Prairie Island units. Thus, prior to implementation of Post-TMI modifications, the frequency of steam generator dryout at Prairie Island Unit 1, given a complete loss of main feedwater, is estimated to be: 0.02
- 1E-4 = 2E-6 In this equation, 0.02 represents the frequency of a complete loss of main feedwater. This frequency is derived from specific Prairie Island plant information (0 events in 23 years of operation).
.. Since the manual valves that dominate the system failure probability are located in the containment, no credit can be taken for recovery of the auxiliary feedwater system. That is, it is assumed that containment entry to open one or -
both of the affected valves could not be accomplished before steam generator dryout occurs. O Page 65 of 453
5.3.1.1.2 Loss of Offsite Power The failure probability of the auxiliary feedwater system, given a complete loss of offsite electrical power and successful operation of the emergency diesel generators, will be very similar to the failure probability for the complete loss of main feedwater. The dominant failure mode in this case continues to be the coupled failure of the manual valves inside containment. Thus, the resulting frequency of steam generator dryout, given these conditions is on the order of: 0.08
- 1E-4 = 8E-6 In this equation, 0.08 represents the frequency of occurrence of a complete loss of offsite power. This frequency is also derived from specific Prairie Island plant information (1 event in 12 years of station operation). One should note that the one occurrence of this initiating event did not actually happen until one hour after the plant had tripped. Further, power was restored within one hour of the initial power loss. As in the previous case, no credit for recovery of the auxiliary feedwater system can be taken.
If the diesel generators fail to properly energize the emergency safeguards busses, the motor-driven auxiliary feedwater pumps will be unavailable for operation. Thus, should both diesel generators fail, the turbine-driven auxiliary feedwater pump becomes the sole source of feedwater to the unit's steam generators. NUREG-0611 analyzed this case and found that the dominant contributor to tuxiliary feedwater system f ailure probability under these conditions would be failure of the operator to manually open the turbine-driven auxiliary feedwater pump steam admission valve. Prior to TM1 the turbine-driven auxiliary feedwater pump steam admission valve was an AC powered motor-operated valve. Since the power source for this valve is unavailable under these plant conditions, local, manual operation of the valve would be required. This analysis would not differ significantly with the findings of NUREG-0611 for the set of conditions described above (loss of offsite power and failure of both diesel generators). 5.3.1.2 Current Situation A detailed fault tree model was developed to analyze the Prairie Island auxiliary feedwater system as it is currently configured. This model it used to ~ develop the baseline system failure probability for the loss of main feedwater initiating event. The cut sets generated by this baseline case are used to develop the quantitative results for the remaining initiator effects on < auxiliary feedwater system failure probability. O Page 66 of 453
5.3.1.2.1 Loss of Main Feedwater The auxiliary feedwater system fault tree is designed to model inadequate auxiliary feedwater flow to either Unit 1 steam generator _following a complete loss of main feedwater. The model takes credit for the manual cross-connect valves that allow the Unit 2 motor-driven auxiliary feedwater pump (#21) to feed the Unit 1 steam generators. .However, since use of the #21 pump for backup supply to Unit-1 is not proceduralized, the pump is assumed to be available only during periods when Unit 2 is in operation. When Unit 2 is shut down, the #21 pump is assumed to be unavailable for supply to Unit 1. The model also takes credit for the cooling water alternate suction supply to the auxiliary feedwater pumps should the normal condensate storage supply to the pumps be unavailable. The baseline failure probability, given the loss of main feedwater initiating event and the system configuration discussed above, is calculated to be: 7.5E-5 Key contributors to this failure probability are:
- 1. 5.4E-5 Operator errors and random failures associated with the high pressure drain valve-(MS-22-2) on the #11 turbine-driven AFW pump trip throttle valve stem.
Failure of this valve is assumed to result in the eventual unavailability of all AFW pumps due to excessive steam in the AFW pump room.
- 2. 1.3E-5 Failure of the Unit 1 pumps (#11 and #1T) combined with the Unit 2 pump (#21) being unavailable due to maintenance. The dominant Unit 1 pump failure modes are the random failures of both pumps to start on demand.
- 3. 1.5E-6 Failure of the Unit 1 pumps (#11 and #12) combined with failure of the Unit 2 operators to prevent flow diversion from the #21 pump to the Unit 2 steam generators. The operator error probability is relatively high because the procedure for properly using the unit cross-connection valves to provide flow from the #21 pump is not formally proceduralized.
- 4. 1.5E-6 Failure of the #12 pump combined with failure of the cooling water flow to the #11 and #21 pumps. The #11 pump and the
#21 pump have a common cooling water supply and return line.
. The common supply line contains one normally-open manual valve. The return line contains two normally-open manual valves. These valves are biccked open and tagged with a Safeguards Hold tag. However, even with these precautions, the combined effect of random failures and operator errors associated with these valves has a significant impact on the combined failure of the #11 and #21 pumps. This particular failure probability represents the effect of the failure of the return valves on the overall AFW failure probability.
O. The effect of supply valve failure is also significant and will be discussed. Page 67 of 453
P-
- 5. 1.1E-6 Random railure of the #11 pump combined with a random -
failure of the cooling water supply valve to the #12 pump and the #21 pump being unavailable due to maintenance. Each of these contributors is discussed above. The supply valve failure is discussed in further detail below.
- 6. 1.1E-6 Random failure of the #12 pump combined with failure of the common cooling water supply valve for the #11 and #21 pumps.
Like the common cooling water return valves, the failure of the common supply valve for the #11 and #21 pumps is demi-nated by the effects of both random failures and operator errors. The auxiliary feedwater system failures discussed above contribute to approximately 96% of the total auxiliary feedwater system failure probability for this initiating event. The likelihood of the combined failure of the two manual valves inside containment (AF-12-1 and AF-12-2), which completely dominated the NUREG-0611 analysis of the effects of this initiator, is estimated to be 1E-6 for this analysis. As a result of changes made following TMI and changes recommended by NUREG-0611, this failure now has little effect on the overall auxiliary feedwater failure probability. Typical contributions from motor-operated valve faults and electrical power system faults that one might expect to find in the list are minimized due to the plant policy of operating with nearly all critical auxiliary feedwater valves in their required operating position. Thus, demand failures of these components will not exist. Further, typical test and maintenance failure contributions are not significant because of the plant policy of blocking and tagging critical components in their required operating positions and monitoring these components on a regular basi:,. Electrical dependencies, which often dominate failure probabilities, are minimized at this plant by a strict design which separates each critical component electrically such that a common electrical power supply either does not exist or, where design dictates a commonality, the effects are insignificant. When the frequency of the initiating event is combined with the failure probability of the auxiliary feedwater system; and the likelihood of nonrecovery of the auxiliary feedwater system under these conditions is also considered; the resulting yearly frequency of steam generator dryout can be determined by: 0.02
- 7.5E-5
- 0.25 = 3.8E-7 In this equation, 0.02 is the frequency of complete loss of main feedwater, 7.5E-5 is the failure probability of the auxiliary feedwater system, given this initiating event, and 0.25 is the likelihood of not recovering auxiliary feedwater capability before steam generator dryout.
O Page 68 of 453
f (~'% 5.3.1.2.2 Loss of Offsite Power G This section discusses the results of the single-unit loss of offsite power analysis. Although a complete loss of offsite power while a single Prairie Island unit is in operation is not improbable, it is more likely that a complete loss of offsite power will occur while both Prairie Island units are in operation. The results of the analysis of the effects of a complete loss of offsite power while both units are in operation are discussed in a separate section of this report. Cut sets generated by the baseline model were used to obtain insights into the auxiliary feedwater system failure probability given total loss of offsite power. By appropriately changing the failure probabilities of individual cut set elements and recalculating the resulting auxiliary feedwater system failurt probability, extensive manipulation of the baseline model was not necessary. Using this approach, the resulting insights could then be determined and i verified by performing hand calculations or by using personal computers rather l than using time on the mainframe computer. Figure 5.3-1 is a reliability block diagram of the as-built auxiliary feedwater i system used for the single-unit analysis. By examining this diagram and using l Tables 5.3.1-1 and 5.3.1-2 one can quickly determine the system failures that l will result in Unit 1 steam generator dryout. The entries in Table 5.3.1-1 are based on the most significant cut sets determined in the loss of main feedwater analysis described above. The applicability of these cut sets was confirmed by reviewing the power b]
/
requirements of each AFW system component. The contribution from MS-22-2 that dominated the loss of main feedwater model, above, is assumed to be eliminated by a change in system design (e.g., piped into the turbine exhaust as with other ! steam leakoffs in the vicinity of MS-22-2). Support system failures are assumed to be dominated by diesel generator failures, diesel-driven cooling water pump failures, and failure of the operators to align the cooling water supply for the given AFW pump to the Condensate Storage Tanks (CSTs). The CSTs can be used as an alternate supply of cooling water for the AFW pumps should the normal cooling water supply (the Cooling Water System) become unavailable. This latter source of cooling water for AFW pumps was not included in the loss of main feedwater model because its need is relatively unlikely for that event. This is not the case for some conditions that could exist during a loss of offsite power. 1 l O Page 69 of 453
Stf rICIENT FLOW TO EITHER 3 Git or 3G12 k k SG SG 11 12 Ar-12-1 g.12-2 M -322 2 MY~N2f3
/\ $
( k ) , MV-32239 MV-32238 MV-32382 MV-32381 Ar-15-2 Ar-15-1 W 4 Ar-15-3 h h h h i l I Ar-13-3 W 5 Ar-13-4 Ar-15-9 Ar-15-it Ar-15-10 h h h Pit P21 P12 h h h "p %',, M2 GOI) M12 0 02) mi-t[2 f h h h g 2 4 1 y, Ar-13-1 h h h g MV-32383 y4 MV-32384
@ h h CW-t-2 (S CW-t-2 l.E. 1 LS. ,
CL-48-9 CL-48-9 2 L-49-2 CL-4 8-10 CL-4 8-10 2 3
, \ /\ /\ /\ /\ 4~
L l 3ACKUP SUCTION FROM CCOLING WATER SYSTEM W 1 Ar-14-5 Ar-14-3 MV-32333 MV-323% MV-32335
/\ /\ /\
l CCNrtN3 ATE STOR AM T At*. KADER. VALVC2 2RS607Az Figure 5.3-1 AFW System Block Diagram Page 70 of 453 b
p .z TABLE 5.3.1 D)
.(
KEY CUT-SETS FOR SINGLE-UNIT LOSS OF 0FFSITE POWER.- INDEPENDENT ' COMMON FII
- FII
- P21X C00L1
- PTf E
- FII FfiX MI
- C00L1 MI
- FII
- Fil N/A MI
- M2
- Pil N/A OCWP12
- DCWP22
- CSTCOOL N/A OCWP12
- DCWP22
- FII N/A O
v C00L1 = Failure of pump cooling to Pil and P21 (Common Piping) CSTC00L = Failure to supply pump cooling using CSTs MI = Failure of OG1 El = Failure of DG2 DCWP12 = Failure of Diesel Cooling Water Pump 12 DTWTff = Failure of Diesel Cooling Water Pump 22 FII = Pump 21 train failure P21X = Failure of pump 21 train when used to s supply cooling to Unit 1 PTi = Pump 11 train failure Fil = Pump 12 train failure s O
',- < Page 71 of 453
TABLE 5.3.1-2 SIMPLIFIED EXPRESSIONS FOR SINGLE UNIT LOSS OF OFFSITE POWER INDEPENDENT COMMON TMM C 0 TM 2 C 2 0 TM 1 2 0T -- 2 C3 __ 2 CT -- T = Turbine-Oriven Pump M = Motor-Driven Pump 03= Diesel Generator No. 1 0 = Ofesel Generator No. 2 C = Diesel Cooling Water Pump S = CST Backup Cooling L = Common Lube Oil Cooling MC= Cross-Connect Motor-0 riven Pump 9 Page 72 of 453
r (") v By examining Table 5.3.1-1 and the simplified exp'ressions in Table 5.3.1-2 one can see that there are four different types of support system states that can result following a loss of offsite power...Each will be dio:ussed below. The key contributors to each support state along with the expscted demand failure probability of the key contributors and the' likelihood af the set of failures occurring during a 24-hour interval following successful demand are also given. One should note that the likelihood of nonrecovery is included in the respective failure probability calculations given below. Consequently, the values include the probability of failure AND nonrecovery for the given contributor. Supoort State Description 1 Both diesel generators operate satisfactorily 2 Diesel Generator No. 2 is not available 3 Diesel Generator No. 1 is not available 4 Both diesel generators are unavailable 5 Both diesel-driven cooling water pumps are unavailable Analyzed by NUREG-0611 Support State 1: I TMM c 5.5E-6 (D) 5.9E-6 (D plus 24h) p The key contributor to single-unit steam generator dryout following a loss of offsite pcwer, where both diesel generators work as expected, is the failure of all three AFW pumps. One of the important contributors to.the failure probability of/these multiple pump faults is failure of the common cooling water supply / return,for the #11 and #21 AFW pumps combined with the random failure of the #12 pump. / n t Support State 2: 0 TM 2 c 2.6E-5 (D) 3.2E-5 (D plus 24h) ! The key contributor to single-unit steam generator dryout following a loss of l offsite power, where Diesel Generator No. 2 fails to operate, is failure of the diesel, combined with failure of turbine-driven pump #11 and subsequent unavail-ability of the Unit 2 (#21) pump. One of the important contributors to the failure probability of the #11 and #21 pumps is failure of the common cooling water supply / return for the #11 and #21 AFW pumps. Support State 3: 0 TM 1 5.4E-7 (D) 6.6E-7 (D plus 24h) The key contributor to single-unit steam generator dryout following a loss of offsite power, where Diesel Generator No.1 fails to operate, is failure of the diesel, combined with failure of turbine-driven pump #11 and motor-driven pump #12. O Page 73 of 453
Support State 4: 2 0T 2.5E-6 (D) 4.3E-6 (D plus 24h) The key contributor to single-unit steam generator dryout follocing a loss of offsite power, where both diesels fail to operate, is failure of the diesels, combined with failure of turbine-driven pump #11. Support State 5: 2 CS 8.5E-6 (D) 1.5E-5 (D plus 24h) 2 CT 1.0E-6 (D) 2.0E-6 (D plus 24h) The key contributors to single-unit steam generator dryout following a loss of offsite power, where both diesel-driven cooling water pumps fail to operate, are
. failure of the diesel-driven cooling water pumps, combined with either the failure of the CST backup cooling water supply to AFW pump #11 or the random failure of pump #11.
Given the individual contributions from each support state discussed above, the overall likelihood of a single-unit steam generator dryout following a complete loss of offsite power is: 4.4E-5 (D) 6.0E-5 (D plus 24h) By using the values given above one can then estimate the yearly frequency of a single-unit steam generator dryout by: 0.08
- 6.0E-5 = SE-6 In this equation, 0.08 represents the yearly frequency of complete loss of offsite power while 6.0E-5 is the likelihood of not preventing steam generator dryout given a loss of offsite power. Keep in mind that consideration of recovery is included in both the demand and time-dependent failure probabilities included in the equation.
5.3.2 Single-Unit Common Cause Analysis 5.3.2.1 Review of PI AFW System Performance The performance of AFW system components can be characterized as follows:
- 1. Motor-driven pump performance has been excellent, with only 2 demand failures in about 1400 demands. There have been no running failures in about 4600 hours of operation.
- 2. The turbine-driven pumps have exhibited poorer performance, with 8 demand failures in about 300 demands and 8 standby failures involving inadvertent closure of the trip / throttle valves.
- 3. Motor-operated valves have performed better than average, with only 2 failures in about 1700 demands.
Page 74 of 453
Motor-Driven Pumps i Of the two demand failures of the motor-driven pumps, one event was caused by a maintenance error that could have occurred on both motor-driven pumps. This maintenance error resulted.in backwards installation of the pump's lube oil , filter. To prevent this from occurring again, design changes were made to ! eliminate this possibility.
^
Turbine-Driven Pumps Several-problems with the governor and trip / throttle valve have been experienced at Prairie Island. These problems are typical of those experienced at other facilities. One of these events resulted in the simultaneous unavailability of both turbine-driven pumps. This event involved the inadvertent closure of both trip / throttle valves, and was discovered during surveillance testing. Prairie Island has taken several actions to minimize the likelihood of inad-j vertent closure of these valves and to improve the detection of such events. 2 For example, administrative controls were enhanced and signs were posted to minimize the likelihood of personnel inadvertently dislodging these valves from their appropriate position. More importantly, control room annunciation of an ~ overspeed trip condition was installed. Events which have occurred since installation of this annunciation have been detected and corrected within about 15 minutes on average. So although the potential for inadvertent closure remains, the detection means has reduced the significance of this event. .The f data analysis indicates that the average pump unavailability from such events is 1.6E-05. Motor-Operated Valves No common cause events have been experienced. Performance has been excellent. , l Characteristics of PI design and operation that were considered when evaluating common cause potential are summarized below. 1 Design / Construction
- The majority of the major components included in this analysis have been operated for more than ten years; there has been significant opportunity to
" shake-out" the equipment. Thus, most inherent design or construction problems should have been corrected or actions taken to minimize their impact. The primary area to be considered with regard to future equipment performance is the impact of any future design changes. To minimize the potential for design /
construction related common cause failures in the future, it is important that , acceptance testing of any future modifications adequately represent expected equipment performance requirements. In this way, the potential for these types of common cause failures can be controlled. 3 l-Environment The majority of the AFW system components are located in a " clean", controlled environment. The more severe environments are internal to some of these components. O ; Page 75 of 453 f
,vm--..,,-,,,~s.. m.v-,.-m,+,,,_=:-n - -- -w,,ew.--.r m a,, ,.n---- , . n. .g- ---- - - .---n-----.---- ----c- - -,-.-a. . ,es n, a
Turbine-driven AFW pump components are subject to high temperature steam which has caused some generally highly reliable components (such as check valves) to fail at other plants. All cf the AFW pumps are subject to backleakage of high pressure, hot water from the steam generators through AFW discharge line check valves. AFW pump cooling sub-system is subject to the effects of the water supplied from the Mississippi River by the Cooling Water System. All components are subject to normal vibrations, the characteristics varying among individual components. Maintenance /Oceration Important characteristics of the AFW system that influence the potential for common cause failures are the following: Preventive maintenance is generally performed off-line. Unlike some plants that use a startup feedwater pump when returning the unit to service, PI uses a motor-driven AFW pump (#12 or #21). Thus, there is opportunity to identify and correct many of the potential problems that might have occurred during shutdown activities. Even though the pumps used by the turbine-driven and motor-driven AFW pumps are the same, their operating history is significantly different. Whereas the motor-driven pumps have operated for about 4600 hours, the turbine-driven pumps have only operated for about 150 hours. Thus, wearcut commen cause failures would not be expected to be a major concern among the different pump types. The pumps normally aligned to each unit are not generally maintained at the same time because both units are not usually off-line at the same time. This staggering of maintenance activities should minimize the potential for maintenance-related common cause events between two motor-driven pumps or two turbine-driven pumps.
, 5.3.2.2 Industry Operating Experience Review The sources of industry data used in this effort were:
- 1) The work of Atwood and others using licensee event reports (Ref. 6-10)
- 2) Nuclear Power Experience publications (Ref. 11)
- 3) EPRI NP-3967 (Ref. 12)
Only those events relating to AFV system were used in this effort. In addition, only those events relating to ccmponents that are in the AFW system at Prairie Island were used. The review and collection of the data included APW system f ailures in motor-operated valves, check valves, manual valves, turbine-driven pumps, motor-driven pumps, and steam generator level detectors and actuation. Page 76 of 453 l
Four categories which cover the spectrum of events were identified from the list []
'v' of common cause failure events from industry data. These four categories are:
- 1. Failure to restore the system to an operational standby status following testing, maintenance, or operation of the system.
- 2. Failure to verify proper design or construction of the system for all possible operating modes.
- 3. Failure to protect the system from abnormal operating environments.
- 4. Failure to properly maintain or operate the system.
Typical events in the first category include failure to open valves in the suction line to a pump following maintenance or failure to replace fuses to control circuits after testing. An example of the second category would be failure of components due to water hammer caused by failure to install steam traps in the line to a turbine-driven pump. Examples of the third category include aligning pumps to sources of water that are too hot for them to pump or steam binding pumps due to inadequate isolation from sources of hot water. The last category is for events relating to improper maintenance or operation of the system. This differs from failure to restore faults in that this event involves failure to keep the system operational. An example of this type of failure would be failure to lubricate a pump or valve operator as often as required to make sure it will operate. b For each common cause failure mechanism presented above, there are three things which must occur in order for a CCF event to happen at Prairie Island. First, there must be an opportunity for a common cause failure event. Second, there must be a failure to prevent the mechanism from affecting redundant components. Third, there must be a failure to detect that such an event has taAen place before the system is required to operate. - The evaluation team reviewed each of these events to determine the opportunity, prevention mechanisms, and detection means at Prairie Island. In some cases, primarily those involving restoration errors, this review is redundant to the explicit modeling of human errors conducted as part of the fault tree development and analysis process. This additional investigation provides added assurance that important potential causes of either individual component or multiple component failure have not been missed. Findings Table 5.3.2.2-1 summarizes the events and findings of this investigation. Careful investigation of the entries in Table 5.3.2.2-1 should help plant personnel identify potential common cause failures that could affect operation of the Prairie Island AFW system. Then, based upon their judgement, the detection and prevention mechanisms, or recommendations, given in the table could be verified, established or improved upon in order to further ensure improved reliability of the AFW system. O b Page 77 of 453
,n-.w- -
y
tan!E 5.3.2.2-1
SUMMARY
OF OPERATING EXPERIENCE REVIEW DATE PLA COMP DESCRIPTION COMMENTS 7410 RSL Pt;MPT OPERATOR LEET SUCTION ISOLATED SAFEGUARDS-Il0LD TAGGED. CllECKED Willi MON 111LY TEST. VERIFIED WITil PUMP FUNCTIONAL TEST FOLLOWING MAINTENANCE. 7306 TU4 PUMPI FUSES FOR AUTO START NUT REINSTALLED AFTER MAINI DOES NUT APPLY TO TURBINE-DRIVEN PtHP - STARTS IF POWER IDST FOR MOTOR-DRIVEN PLMP - WILL LOSE INDICATING LITES ON CONTROL PANEL IN CR - OlECKED ONCE PER SilIFT. MAY ALARM. 7906 AR1 PtHPT WATER IN S1H LINE (ISOL TRAPS) CAUSES OVERSPEED CANDIDATE MODIFICATION IS TO INSTALL SAFEGUARDS-Il0LD TAGS ON ALL VALVES IN PAlli F1t0M STEAM LINE TO CONDENSER. ALL VALVES WILL ALSO BE ADDED TO SYSTEM STARTUP OIECKOFF LIST. 7909 SL1 SGLVL INCORRECT LVL SPAN CAUSES 2% NONCONSERV ERROR REQUIRES DJO OR MORE COUPLED ERRORS PER STEAM CENERATOR. 8103 JF1 PLMPT WIRING ERROR IN CNTRL CKT CAUSES PUMP FAILURE FOUND BY POST-MAINTENANCE OR PRE-OP TEST. COUla BE PROBLEM IF AITIO-START CIRCUITRY MISWIRED. COULD BE DETECTED BY BY INTEGRATED ACCEPTANCE TEST. 8112 NA1 PtNPT OIK VALVE PARTS JAM 11tIP VALVE DUE TO INST ERRORS VALVE IS NORMALLY OPEN. TitEREFORE, MORE LIKELY TO JAM 8209 BV1 PtHPT WASitER BLOCKS TRIP VALVE ADMISSION VALVE SHUT. DETECTED BY MONTl!LY TESTING. PREVENTED BY PERIODIC INSPECTION OF UPSTREAM COMPONEKrS. 8004 AR2 PtNPT TUR AND MTR PUMP CAVITATE DUE TO OVERHEAD WATER DISQlARGE PRESSURE MONITORED. IIEAT SENSITIVE TAPE INSTALLED 7607 IINI PLMPT LACK OF DISCH PRES DUE TO VAPOR BINDING (QIK VLVS) ON DISCllARGE PIPING AND MONITORED AT LEAST EVERY SHIIT. 8106 R02 PtHPT STEAM BINDING DUE TO LEAKING CitK AND MTR VALVES PERIODICALLY INSPECT AND LAP OIECK VALVE SEATING SURFACES. 8107 DC2 PUMPT STEAM BINDING DUE TO LEAKING CilK VALVE 8307 R02 PUMPI STEAM BINDING DUE TO LEAKING DISQtARGE VALVE 8311 SU2 PUMPT STEAM BINDING DUE TO LEAKING DlbC CHK VALVE 8307 R02 PtHPT STEAM BINDING DUE TO LEAKING DISC QtK VALVE 8307 R02 PtNPT CAVITATION DUE TO LEAKING DISQlARGE VALVES 7712 R02 MOVLV BACKLEAKAGE FROM DOWNSTREAM O!K VLV CAUSED BINDING 7312 RG1 PLNPT AIR IN SUCTION llEADER CAUSES PUMPS TO IDOSE SUCT DISCUSSED WITil PLANT PERSONNEL. }ILT WAS NUT A PROBLEM. 7402 Z12 PtHPT AIR ASPIRATED INTO PtHP CAUSING OVERSPEED SUCTION PRESS RUNS AT 8-10 PSI. FUNCIl0NAL TEST FOLl4NING MAINTENANCE DETECTS ANY LATENT PROBLEMS. IHJ SUCTION /DISQt 8012 AR2 PUMPH WATER IN LUBE OIL DUE TO PACKING LEAKAGE CAUSED DISCUSSED WITIl PLANT PERSONNEL. UNRESOLVED. COULD tKIT BEARING FAILURE DETERMINE CAUSE. PERIODIC INSPECTION FOR WATER IN LUBE OIL. 8202 SE2 PUMPT SEAL PACKING ON PtNP BLEW OUT OlANCE OIL FREQUENTLY. SECOND EVENI (SE2) COUID BE A 8104 M12 PtMPT OLD PACKING RESULTS IN EXCESSIVE LEAKACE MEQlANISM AS COUlD TIIE 1111RD (M12). IF SO, COUID PREVENT 8104 CCI PUMPT CARBON SEAL RINGS FOR TURBINE SilAPT SEAL WORN - BY PERIODIC INSPECTION AND REPLACDIENT OF PACKING. CAUSES ll101 BEARING TEMPERATURE FOURTil EVENT (CC1) COULD BE MEQtANISM FOR DEGRADATION OF TURBINE LUBE OIL. AGAIN PREVENTED BY PERIODIC INSPECII0fl. j l O, . , , - , e Page 78 of 453 w a ,
v) TADI.E O 2.2.-1 (C' nt. )
SUMMARY
OF OPERATIE EXPERIENCE REVIEW DATE PLA COMP DESCRIPTION COhMEttrS 7901 DB1 MOVLV DIRI FROM CONSTRUCTION ACTIVITIES CAUSED VALVE MAY IIAVE S1 HILAR EFFECTS ON TURBINE STEAM INLET AIR-OPERATED STEM TO STICK VALVE. Il0 WEVER, VALVE IS IN ENCIDSURE DIAT Sil0ULD PREVENT 8411 IINL A0VLV INSUFFICIENT EXERCISING CAUSED 2 OF 4 A0Vs TO FAIL CONTAMINATION. NO OIIIER IMPORTANT VALVES ARE REQUIRED TO TO OPEN Altf0MATICALLY CIIANCE STATE. VALVE IS OPERATED AT LEAST MorrI1ILY. 7809 JF1 PUMPT TRIP TilROITLE VALVE TRIPPED PUMP TRIP IS ANNUNCIATED IN DIE CONTROL ROOM. WARNING 7701 SA1 PUNPT TURBINE MANUALLY TRIPPED SICNS IN AREA ALERI PERSONNEL TO POTENTIAL PROBLEM. FLOOR 8104 AR1 PUMPT WORN TRIP MECil IN AREA IS MARKED TO ALERT PERSONNEL. CRITICAL MECilANICAL 8104 OE2 PUMPT LOOSE TRIP PLATE AND SPRING /CIIANGE SURV PROCEDURES PARTS ARE PAINTED IN BRICllT COLORS TO ALERT PERSONNEL. MECilANICAL FAULTS DETECTED BY PERIODIC TESTING. 7405 TU3 PUMPT PACKING 700 TICIIT DUE TO DEFECTIVE PROCEDURES DETECTED BY PERIODIC TESTS AND IUNCTIONAL TESTS AFTER 8105 CR3 PUMP PACKING GLAND OVERllEAT MAINTENENCE. OPERATOR (S) ALWAYS IN VICINITY FOR PUMP TESTING. TEST AND MAINTENANCE IS STACCERED FOR PUMPS. 8102 CCI PUMPT BRNG WEAR FROM LOW LUBE OIL PLAfft IRSONNEL ARE AWARE OF POTENTIAL PROBLEMS. OIL LEVEL 8103 CCI PUMPT BRNC DUE TO LOW LUBE OIL IS OlECKED ONCE PER SilIFT. SYSTEM ENGINEERS IIAVE ENSURED 8102 CC1 PUMPT BRNG DAMACE DUE TO IMPROPER OIL LEVEL IIVEL INDICATION AND SICirrCLASS MARKINGS REFLECT DESIRED 8211 SO2 PUMPT LOW OIL LEVEL CAUSES OVERSPEED TRIP SUMP LEVEL. 8211 CCI PUMPT LOW OIL LEVEL DUE TO IMPROPERLY MARKED OIL LEVEL INDICATOR 8310 DC2 PUMPT FAILED TO TRIP / RUST ON TRIP VALVE - OlANCED COULD BE IMPORTANT TO RECOVERY FROM SOME OrtiER FAULT. PREVENTATIVE MAINTENANCE PROGRAM RESULTS IN NONRECOVERABLE DAMAGE TO TURBINE-DRIVEN PUMP. DETECTED BY PERIODIC TESTING OF OVERSPEED TRIP CAPABILITY. 8401 TU3 PUMPT COVERNOR SPEED KNOBS MISPOSITIONED DETECTED BY PERIOOIC TESTING AND FUNCTIONAL TEST FOLLOWING MAINTENANCE. REQUIRED COVERNOR SPEED CilANGER SEITING IS DETAILED AND CitECKED BY TIIE SYSTEM PRESTART CIIECKLIST. Page 79 of 453
5.3.2.3 Parametric Analysis : Figure 5.3.2.3-1 provides a simplified p&ID of the AFW system. Figure 5.3.2.3-2 provides the block diagram used to develop the CCF analysis model. In general this block diagram follows the schematic of Figure 5.3.2.3-1; however, some components (in series) have been rearranged so that modules that have similar or identical components could be shown side-by-side. The column (#Similar Components) indicates the number of components among modules (side-by-side) that are similar or identical. These components are the common cause groups of interest. There are six such groups, prefixes A, B, C, D, E, and F. Other groups of components are treated independently (11+I7). Note the following differences between this block diagram, the master fault tree and Figure 5.3.2.3-1. Schematic Differences
- 1. The pumps have been divided into the fluid portion (the actual pump) and its driver (motor or turbine) so that common cause effects among these different sub-components cotid be investigated separately.
- 2. The pump cooling components (modules I6 & I7) are shown separately.
This accounts for the common inlet and outlet valves between the 11 and 21 pumps; and the 12/22 pumps as shown in Figure 5.3.2.3-3.
- 3. The backup pump suction from the cooling water system (Module I4) is shown as being common to all 3 pumps rather than as shown in Figure 5.3.2.3-1.
This simplifying and conservative assumption was made to facilitate modeling. Because of the low likelihood of loss of suction from the CST, this module can be assumed to be dominated by human error at a probability sufficient to account for the components included in this module and their actual logical relationship. O Page 80 of 453
[] + g ['
/ /
W-st-t W-1.-Ef f [ $ ,AM( H/ / 22 STEA.O KMJtAftBR asw a,w q;;,? q;;,,s W-12-1 W-16-1 $ $ l l W- .i,t.>.
/ / .i. >
Yitz5 X -0 X-0 ,~,.a=e.2
" Y/#> O-X X C r,v.weo "",Udb
,s n oo es es %s %s
"-Y/#, r3".?"' ??.?"' av-we
<r *
,~ g ,u 7y,jx_g g,3en. r,vy,1er.7 "2M i1 "u,%\ ,.1 .t03* ,.i03' .t03' '"YEi1E Eg tCC'{t03' "OL1 }'t
('
'M r, ,
,,,o,,
scn 4_ r. scit H_H .~-=..
"3MX --=mt m==> X g3= t'e' X O.P "aM X ,
Q 'smAa 3e5 4 4 il3' ~25 4 4 *3;r ,, "un Zt ZtK3" Zt @!i" "uia! Zt o ;ED fri.Y'" :ED % f'" mi wi me we k l CV-3 TOSS d d d 2 CV-31068 T3.t' t'a? "Ja? T337
% N- N-- N iE!" ""idl *idsl *ffs3*8 h; w,X-0 "v wD-X ->?//>X-0 ~-".snX-0 Ti'!N
,; ) ) N ) ) N ,,
'.3 a. =;r SE'lif mg ,
'as at;'"yLA N N Q,i,9a' LJA
< ,cooi > - se e.r w rt 3 %
enese* Pigure 5.3.2.3-1 Simplified Flow Diagram of the Prarie Isla--I Auxiliary Feodwater System Page 81 of 453
. FLO 1 HER SGtt or* SGt2
/l\ IrLOW k k SG SG 8 11 12 SIMILAR CCMPO-fiftTS FLDutt ITLOW12 Ar-12-1 1 Ar-12-2 d
' (f) s MI~32242 MT~dI2k3
/Vr1A1 IfIA2 @
N IFCB1 f trO1? .t m ) tr a o i MV-32239 A MV-32238 N MV-32382 E MV-32381 A (4) Ar-t5-2 u -tS-t a-t5-4 a -t5-3 (*) 1
@ Ir0C1 @ @ ITDC2C3 @
l I trCC2 trOC3 I Ar-13-3 b Ar-13-5 Ar-13-4 $ (3) M-15-9 Ar-15-tt Ar-15-10 (3) h h h g @ l D3 (3) Pit P21 P12
+ + +
T11 n g
,5YM?s 98 ,1 7
, 23 ,13 (g3 RS-15-2,t
$IF111 $ $trgC3 I I ft/A , ),
WA (1)
+
+ +
M - 238 gg gg) tt/A MV-32304
$ IFil3 @ @
CW-t-2 d CL-48-9 CW-t-2 d CL-48-9 P1-l l I7 2.L-49-2 (1) l l CL-48-10 CL-4 8-10 2CL-49-3 l /\ /\ /\ /\ /\ /\ s I CCCLING WATER b CCMPONCNT3. PipF (3) SUCTION VALVC3, ETC. IFCT! IFDT2 IFCf3 Ar-14-1 b Ar-14-5 Ar-14-3 (g)) I MV-32333 MV-32336 MV-32335
/\ /\ /\
l CONDEtt3ATC d STCRAE TANK, gg3 HCALER, VALVE 3 2R8607AP Figure 5.3.2.3-2 AFH System Block Diagram Page 82 of 453
e o _ -e .-. t IV 3 d . c, t
- 6. A g d
- h .
E s 3 s j )4
>-- l >4>--l ,
>4
>- l >,4 - >--
1 i t id i t t td d d a t a t a 3 [
. 5'__ O __
. __ 3 __
E F -- g1+ bO g1 + ;
=
0 m :I . m :I m :I . m :I
- i ex.
- 1. . . ~ 1. . _ ex . ,
L L L L e e e e a A A W 2
- ~ t
=
a Xi:.e :. Xi g e~ I e s
---> a
=
g E k s s , , , E O 8 # G l
- 4. The suction from the CSTs is modeled as a single module. Because of -
the low likelihood of failing to have suction, this simplifying assumption can be made. Master Fault Tree Differences The only major difference is the grouping of components. The quantitative benchmark and review of cut sets demonstrate that this grouping did not affect the results. Parameter Values Development of parameter values is a subjective process. The limited amount of information available and the impact of plant-specific characteristics on the applicability of this information makes it impossible to develop parameter values with uncertainty levels similar to those of individual component failure rates. However, without some consideration of common cause potential using parametric means, the overall unreliability of the AFW system will be underestimated. Because of these issues, the following approach was taken:
- 1. Information and processes provided in EPRI NP-3967 (Ref. 12) were used to develop parameter values for the AFW system pumps.
- 2. References 6 - 10.were reviewed to develop parameter values initially developed to support the BFR model.
- 3. Other sources were reviewed to determine " typical" parameter values.
- 4. Specific Prairie Island data were used.
- 5. Judgement was used to determine parameter values based on the findings of these four tasks.
Table 5.3.2.3-1 summarizes the parameter values used. The corresponding values for each of the common cause terms are provided in Table 5.3.2.3-2. Results Table 5.3.2.3-3 provides the most significant cut sets and corresponding values. The total failure probability was calculated to be 8.5E-5. Of this total, 1.9E-5 corresponds to cut sets involving only independent failures. The total value of the cut sets involving common cause failures (complete coupling or combinations of common cause and independent failures) is 6.6E-5. I O1 l l Page 84 of 453 l l
,- : g Table 5.3.2.3-1 PARAMETER VALUES USED IN ANALYSIS COMPONENT FAILURE TYPE MODE S X 6 N.O. MV FTRO .05 .5 .5 CV FT0 .05 .5 .5 N.O. MOV FTRO .05 .5 .5 PUMP FTS .15 .14 --
FTR .05 .14 -- MOTOR FTS .05 -- -- FTR .06 -- -- TURBINE FTS .06 -- --
. FTR .06 -- --
O - Page 85 of 453
TABLE 5.3.2.3-2 - COMMON CAUSE PARAMETER EQUATIONS BASIC EVENT ALGEBRAIC EXPRESSION FAILURE RATE EXPRESSION VALUE 2
- 1. Al A2 A SA 2.8E-5 2
- 2. B1 B2 B 1/3(1-y)SA 4.0E-6 B1 B3 B1 B4 82 B3 B2 84 B3 B4 3
- 3. 8182 B3 B 1/3(1-6)ByA 2.0E-6 B1 B2 B4 B1 B3 B4 B2 B3 B4 4
- 4. B1 B2 B3 B4 B sy6A 6.0E-6 2
- 5. C1 C2 C 1/2(1-y)sA 4.3E-6 C1 C3 C2 C3 3
l 6. C1 C2 C3 C SyA 8.5E-6 2
- 7. D1 D2 D 1/2(1-y)SA 4.5E-5 D1 D3 D2 D3 3
- 8. D1 02 D3 D Syl 1.5E-5 2
- 9. El E2 E BA 5.6E-5 2
- 10. F1 F2 F 1/2(1-y)SA 4.8E-6 F1 F3 F2 F3 3
- 11. F1 F2 F3 F ByA 9.5E-6 l
9 Page 86 of 453
TABLE 5.3.2.3-3 []> ( PARAMETRIC COMMON CAUSE ANALYSIS RESULTS CUT SET VALUE DESCRIPTION AIA2 2.8E-5 Common cause failure; normally open manual or motor operated valves fail to remain open or check valves fail to open 01D203 1.5E-5 Common cause failure of all three pumps CIC2C3 8.5E-6 Common cause failure of all pump discharge valves B1828384 6.0E-6 Common cause failure of four injection line valves (MOVs fail to remain open; check valves fail to open) E2I
- Il
- 12 5.9E-6 Independent failures of P12 motor and P11 turbine; P21 out-for-maintenance 0103
- I2 5.4E-6 Common cause failure of Pil and P12 pumps and P21 out for maintenance 11
- I2
- 17 2.5E-6 Independent failure of turbine and P21 out-for-maintenance ad independent failure of the P12 cooling water valves to remain open-03I
- Il
- I2 2 lE-6 Independent failure of P12's pump a_nd independent failure of turbine and P21 out-for-maintenance E1E2
- Il 1.6E-6 Common cause failure of P12 and P21's motors and independent failure of turbine 02D3
- Il 1.3E-6 Common cause failure of motor-driven pumps and independent failure of turbine E2I
- I6 1.2E-6 Independent failure of P12's motor and independent failure of the common cooling water inlet / outlet valves to P11/P21
,Q b/
i Page 87 of 453
5.3.2.4 Plant-Specific Design Analysis : A plant-specific design and operation review can be performed at a variety of levels. These range from a brief walkdown of a system to a detailed independent design and operation review in which individual component characteristics and intracomponent and intersystem relationships are considered. Since it was not the purpose of this study to review the adequacy of the AFW system design, a limited scope approach was used to supplement the examination of operating history and the statistical analysis. This investigation focused on those common groups of components identified in developing the common cause statistical analysis model. The investigation is analogous to that used to examine operating history. It consists of defining the susceptibility of key components to particular CCF mechanisms, and then assessing the opportunity for this mechanism. Although the results are qualitative, and completeness cannot be assured, this process provides important understanding and insights into potentially important areas that otherwise might be overlooked. The following task descriptions describe this process. Task #1: Determine Components to be Examined The first step is to determine what comporents will be examined for common cause failure susceptibility. Components were grouped by type. . Task #2: S_eiect Common Cause Linkino Mechanisms and Failure Causes The next step in the process is to determine what linking mechanisms to examine as potential initiators of common cause events. It is important to understand the failure causes that might result in common cause events, and what linking mechanisms might be present to produce these multiple failures. Identification of these linking mechanisms is critical to determining the opportunity for the CCF to actually occur. Components that are susceptible to the same failure cause and have a common linking mechanism would be expected to have a higher likelihood for multiple failure. Tasks 3 through 5 describe a process for evaluating the susceptibility and opportunity for CCF for common cause failures of similar components. Task #3: Determine Susceptibility of Components to Failure Causes After the linking mechanisms and failure causes that will be considered have been specified (Task 2), and the list of components prepared (Task 1), the next step is to determine the susceptibility of those components to these failure causes. O Page 88 of 453
l l i j Evaluating the susceptibility of each component involves an assessment by an (]' analyst familiar with the component design and operation. This is accomplished in a variety of ways:
- Plant walkdown with personnel knowledgeable of the system operation.
- Review of available design information (e.g., design descriptions, drawings, vendor documentation, failure modes and effects analyses (FMEAs).
- Review of operating experience with that particular component.
Task #4: Assess Opportunity for Occurrence of Failure Causes The previous task determines which components are susceptible to particular failure causes. The next step is to determine if there is an opportunity for that failure cause to occur. This involves answering the following questions for the failure causes of concern:
- 1) How can the failure cause exist?
- 2) What is the likelihood that this failure cause will exist?
Task #5: Assess Significance of Findings c This is a subjective judgment by the evaluation team, i k- The most important outcome of such an analysis is generally the development of an information base that knowledgeable plant personnel can use when considering inservic,e inspe'ction and testing program practices and schedules. Results , Table 5.3.2.4-1 summarizes the results of this review. The components examined for the plant-specific design analysis were grouped for examination as follows: Group 1 - Manual valves AF-12-1 and AF-12-2 Group 2 - Check valves AF-16-1 and AF-16-2 Group 3 - Motor-operated valves MV-32242 and MV-32243 Group 4 - Motor-operated valves MV-32238, MV-32239, MV-32381 and MV-32382 Group 5 - Check valves AF-15-1, AF-15-2, AF-15-3, and AF-15-4 Group 6 - Manual valves AF-13-3, AF-13-4, and AF-13-5 Group 7 - Check valves AF-15-9, AF-15-10, and AF-15-11 These groups were formed because of the physical and functional similarities among the components in each group. U Page 89 of 453
TABLE 5.3.2.4-1 PLANT-SPECIFIC DESIGN ANALYSIS POTENTIALLY LIKELIHOOD COMP 0NEtiT LINKING IMPORTANT CAUSE WILL GROUP MECilANISM FAILURE CAUSE Il0W CAN CAUSE EXIST? EXIST SIGNIFICANCE OF FINDINGS 1 Location None - - Located in containment. Essen-Identified tially a passive component. Assume considerable separation. There-fore, no potentially important failure causes identified. Energy Flow Vibration Proximity of main High Could expect coupled failures due Path feedwater piping, to vibrations. More likely to result from main feedwater opera-Some discharge flow liigh tion than auxiliary feedwater from AFW pumps, operation (cause typically exists for longer periods). Pressure Subject to steam High Could expect coupled failures generator pressure (e.g., packing leakage) due to high pressure. Design Same as Same as for Energy liigh Valves are of the same design. Energy Flow Flow Path Therefore, the likelihood of the coupled failures mentioned above is increased. Likely failure would be separation of valve disk from valve stem. 2 Location None - - Same as for Group 1 Ident,1fied Page 90 of 453
n n (- .3 (-) I v
)
TABLE 5.3.2.4-1 PLANT-SPECIFIC DESIGN ANALYSIS (continued) POTENTIALLY LIKELIHOOD COMPONENT LItiKING IMPORTANT CAUSE WILL GROUP MECHANISM FAILURE CAUSE HOW CAN CAUSE EXIST? EXIST SIGNIFICANCE OF FINDINGS 2 Energy Flow Impact Water-hammer due to Low Valve disk is normally in flow (cont.) Path emptying of feedwater path. Thus, water-hammer could cause valve disk to exceed design limits in acceleration and cause impact with valve seat or disk-opening stop; which could result in valve damage (e.g., disk separation from hinge or valve back-leakage). Could expect coupled failures. Vibration Similar to Group 1 High Could expect coupled failures due to vibration. Likely failures are . separation of disk from hinge, or hinge pivot, or excessive leakage. Pressure Similar to Group 1 High Could expect coupled failures (e.g., body-bonnet leaks) due to high pressure. Design Same as Same as Energy Flow Same as Valves are of the same design. Energy Path (EFP) for EFP Therefore, the likelihood of the Flow Path coupled failures mentioned above is increased. 3 Location None - - Valves are located outside of the Identified containment. Specific location and resulting effects were not determined. Energy Flow Vibration Discharge Flow from High Probably not significant. Rela-Path AFW Pumps tively short duration. Page 91 of 453 ,,
TABLE 5.3.2.4-1 PLANT-SPECIFIC DESIGN ANALYSIS (continued) POTENTIALLY LIKELIl100D COMP 0NENT LINKING IMPORTANT CAUSE WILL GROUP MECHANISM FAILURE CAUSE It0W CAN CAUSE EXIST? EXIST SIGNIFICANCE OF FINDINGS 3 Pressure Discharge pressure of High Will not exist for significant (cont.) AFW pumps periods unless Group 2 valves leak. Probably not significant. Design Same as Same as for Energy High Assumed to be same design as Energy Flow Flow Path MV-32238 and MV-32239. Since Path valves are of same design, likelihood of any coupled failures is increased. 4 Location Temperature Fire in AFW room Low Could cause coupled failure of Steam in AFW room all four valves. Fire would be mitigated by fire door, which would close and separate MV-32238 and 239 from 381 and 382. However steam would potentially cause failure of valves regardless of fire door position. Potential sources of excessive steam admission to room have been identified and are being eliminated. Steam Steam in AFW room Low See discussion above. Can also result in increased likelihood of moisture-rslated failures of electrical components in valves. Water Break of Fire Low- Coup 1.d failure unlikely since Protection or val .es for each pump are Cooling Water pt.ysically separated. Common System Line flooding is unlikely due to relatively high elevation of components in AFW room. O O Page 92 of 453 O,
O O O TABLE 5.3.2.4-1 PLANT-SPECIFIC DESIGN ANALYSIS (continued) POTENTIALLY LIKELIHOOD COMP 0NENT LINKING IMPORTANT CAUSE WILL GROUP MECHANISM FAILURE CAUSE HOW CAN CAUSE EXIST? EXIST SIGNIFICANCE OF FINDINGS 4 Grit Construction Probably Fire door that could separate Low valves for this cause is usually (cont.) activities During Outage open. Plant is relatively clean. Susceptible parts of i valves appear to be adequately protected by housings. Probably not significant. I t Energy Flow Similar to Similar to Group 3 Similar Similar to Group 3. I Path Group 3 to Group 3 Design Similar to Similar .to Group 3 Similar MV-32238 and MV-32239 are of a Group 3 to different design than MV-32381 and Group 3 MV-32382. Therefore, the design linking mechanism for this group is significantly different among the components. Thus, the likeli-hood of coupled failures of these valves due to failure causes from . that .nechanism is decreased significantly. 5 Location None - - Essentially passive components. Identified Considerable separation combined with little or no susceptibility to typical failure causes result-ing from this linking mechanism. Energy Flow Impact. Similar to Group 2 Low Similar to Group 2. Unlikely that , Path affects will be severe at this distance from the steam generators. Probably not significant. Page 93 of 453
TABLE 5.3.2.4.-1 PLANT-SPECIFIC DESIGN ANALYSIS (continued) POTENTIALLY LIKELIHOOD COMPONENT LINKING IMPORTANT CAUSE WILL GROUP MECHANISM FAILURE CAUSE HOW CAN CAUSE EXIST? EXIST SIGNIFICANCE OF FINDINGS 5 Vibration Discharge Flow From High Probably not significant. Rela-(cont.) AFW Pumps tively short duration. Pressure Discharge Pressure High Will not exist for significant From AFW Pumps periods unless Group 2 valves leak. Probably not significant. Design Same as Same as Energy Flow Same as All valves are of the same design. Energy Flow Path EFP Therefore, the likelihood of any Path coupled failure is increased. 6 Location None - - Essentially passive components. Identified Considerable separation corabined with little or no susceptibility to typical failure causes result-ing from this linking mechanism. Energy Flow Vibration Discharge Flow From High Probably not significant. Rela-Path AFW Pumps tively short duration. Pressure Discharge Pressure High Will not exist for significant From AFW Pumps periods unless Group 2 and Group 5 valves leak. Probably not significant. Design Same as Same as Energy Flow High All valves are of the same design. Energy Flow Path Therefore, the likelihood of any Path coupled failure is increased. Similar to Group 5. 7 Location None - - Identified . O O . O Page 94 of 453
O O O TABLE 5.3.2.4-1 PLANT-SPECIFIC DESIGN ANALYSIS (continued) POTENTIALLY LIKELIHOOD COMPONENT LINKING IMPORTANT CAUSE WILL GROUP MECHANISM FAILURE CAUSE HOW CAN CAUSE EXIST? EXIST SIGNIFICANCE OF FINDINGS 7 Energy Flow Impact Similar to Group 5 Low. Similar to Group 5. (cont.) Path
; Vibration Similar to Group 5 High Similar to Group 5.
Pressure Similar to Group 5 High Will not exist for significant periods unless Group 2 and Group 5 valves leak. Probably not significant. Design Same as Same as Energy Flow Same as All valves are of the same design. Energy Flow Path EFP Therefore, the likelihood of any Path coupled failure is increased. i I i i I i 4 Page 95 of 453 :
5.3.3 Two-Unit Effects If both units are operating prior to a loss of offsite power event, both will require operation of the AFW system. The AFW system cut sets and the influence of support systems are different from those determined in the single-unit analysis described earlier. Table 5.3.3-1 provides the key cut sets for this event. The undesired event in this case is failure to supply sufficient feed-water to either unit. Table 5.3.3-2 provides a simplified set of algebraic expressions that represent these cut sets. As was the case for the single unit analysis, the contribution from MS-22-2 that dominated the loss of main feedwater model, above, is assumed to be eliminated by a change in system design (e.g., piped into the turoine exhaust as with other steam leakoffs in the vicinity of MS-22-2). Support system failures are assumed to be dominated by diesel generator failures, diesel-driven cooling water pump failures and failure of the operators to align the cooling water supply for the given AFW pump to the Condensate Storage Tanks (CSTs). The first set of values presented below include the probability of AFW/ Support System failure an_d nonrecovery of offsite power before steam generator dryout. No credit for recovery of a failed diesel generator or diesel cooling water pump is given. The sensitivity of the results to each of these is then described. Support State 1: Both Diesel Generators Operate 2TMMC + 2MT2 = 2.1 E-05 (D)
= 2.1 E-05 (0 plus 24h)
The key contributor is 2MT2, in which either motor-driven pump P12 or p21 fails and both turbine-driven pumps, P11 and P22, fail. This contributor constitutes about 80*.' of the 2.1 E-05 value. Failure on demand dominates this support state. O Page 96 of 453
x TABLE 5.3.3-1
.\ KEY CUT-SETS FOR TWO-UNIT LOSS OF 0FFSITE POWER INDEPENDENT COMON o m
- m
- PT2X EUUU
- m PIT
- PT2
- F2IY CUOLT
- PTE PIT
- PYZ
- m EUULT
- FZZ PTT
- PY2
- PT2 tU6E2
- PTf DT2
- PZY
- F2T N/A DT2
- PIT
- PYIY U57
- EUDU DT2
- FIT
- P72 N/A DUT
- PYZ
- PT2X UGT
- EUOU UUT
- PIT
- PT2 N/A UGT
- PTI
- P72 N/A .
UGT
- DT2
- P72 N/A DET
- DUI
- FIT N/A DCWP12
- DCWP22
- CSTC00L N/A
- DCWP12
- DCWP22
- P72 N/A DCWP12
- DCWP22
- PIT N/A Failure to Supply Pump Cooling using CST
! CSTCOOL =
. EUDU = Failure of Pump Cooling to P22 and P12 (Comon Piping) EUUU = Failure of Pump Cooling to P11 and P21 (Comon Piping) l O
\
l l 1 Page 97 of 453
. _ _ _ _ _ _ _ _ . . _ _ _ . . _ _ _ . _ _ _ _ . _ _ _ _ . . _ , . _ _ _ _ _ _ . _ . _ . _ . . .._ I
TABLE 5.3.3-1 - (Continued) F22 = Pump 22 Train Failure P2I = Pump 21 Train Failure P12X = Failure of Pump 12 Train When Used to Supply Flow to Unit 2 P11 = Pump 11 Train Failure P12 = Pump 12 Train Failure P21X = Failure of Pump 21 Train When Used to Supply Flow to Unit 1 DGI = Failure of DG1 U52 = Failure of DG2 DCWP12 = Failure of Diesel Cooling Water Pump 12 OCWP22 = Failure of Diesel Cooling Water Pump 22 O Page 98 of 453
1 1 hn TABLE 5.3.3-2 SIMPLIFIED EXPRESSIONS INDEPENDENT COMMON 2TMM 2W
, C 2
2T M 2LT 1 t -2DMT i i. 2DTM 2W l C 2 -- 2DT 2 4 20 T -- 2
- _ C3 __
2 i 2C T -- l t f i_ T = Turbine-Driven Pump !
- M = Motor-Driven Pump
.- D = Diesel Generator C = Diesel Cooling Water Pump
- S = CST Backup Cooling L = Common Lube Oil Cooling M = Cross-Connect Motor-Driven Pump l C 4
1 4 i. l 4 !O f Page 99 of 453 { 1
Support State 2: One Diesel Generator Fails 2DMT + 2DTMC + 2DT2 = 3.1 E-05 (D)
= 3.9 E-05 (D plus 24h)
Demand failures dominate the overall failure probability for this support state also. Each term contributes the following: 2DMT 3% 2DTM 67% C 2DT2 30% Support State 3: Both Diesel Generators Fail 202T = 5.0 E-06 (D)
= 8.5 E-06 (D plus 24h)
Demand failures contribute approximately 59% for this support state. Failures of either turbine-driven pump train, failure probability of 2.9 E-02 per train on demand, causes a complete loss of feedwater to one of the two units. The failure probability of 2 diesel generators on demand was estimated to be 2.6 E-04 (excluding parametric common cause influences); the probability of not recovering off-site power within 1 hour was calculated to be 0.34. Support State 4: Both Diesel Cooling Water Pumps Fail . C2S + 2C2T = 1.0 E-05 (D)
= 1.9 E-05 (D plus 24h)
Demand and operating failures contribute about equally, 53% and 47% respectively, for this support state. If both DCWPs fail, the DGs will fail and the normal cooling supply (Cooling Water System) for the AFW pumps will be unavailable. Because the manual action to align the condensate storage tanks (CSTs) to supply cooling to the AF4 pumps is neither proceduralized nor understood by all operations personnel, a high failure probability was assigned to the S term, 0.25. This failure dominates the failure probability of this support state, about 81%. Summary The total demand value for all support states is 6.5 E-05; the 24 hour value is 8.7 E-05. This does not include the frequency of a loss of offsite power initiating event, about 0.08. The yearly frequency of steam generator dryout as a result of a loss of offsite power is: 0.08
- 8.7 E-05 = 7E-6 The analyses documented in NUREG-0611 did not consider recovery of offsite power or operating failures. So that a valid comparison could be made, analyses not crediting recovery of offsite power and which exclude operating failures were performed. The results are summarized below.
= 6.0 E-05, 20%
2TMMC + 2 MT2 Page 100 of 453
g a
/
I
/~N u 9:1 E-05, 46%
( ) 2DMT + 2DTMC + 2DT2 202T = 1.5 E-05, 8%
.C2S + 2C2T = 3.1 E-05, 16%
. TOTAL = 2.0 E-04 If recovery of the turbine-driven AFW pump is considered, failure probability of 0.25, the total value decreases to 8.4E-5 There are many candidate modifications that would reduce these values substan- i tially. They are considered in Section 5.5. I
, 5.4 Uncertainty and Sensitivity Evaluations The key areas of uncertainty were identified and analyzed both qualitatively and quantitatively, where appropriate, to determine the impact of the givten uncertainty on the overall results.
In order to systematically identify key areas of uncertainty in the auxiliary feedwater analysis, a logical approach to the identification process was employed. Table 5.4-1 summarizes the steps.in the approach. Table 5.4-2 summarizes the key uncertainties identified by the approach used. Where appropriate, both quantitative and qualitative impacts of the uncertainty are discussed. One should note that the entries in this table are generally discussed and analyzed in terms of independent failures. Many of the intrasystem dependencies identified
% in the table were discussed and analyzed in Section 5.3.3.
Table 5.4-3 summarizes the results of the sensitivity evaluations performed to l assess the impact of each key uncertainty. The system impact has two entries for each case. The "1U" entry represents the AFW system failure probability for a loss of main feedwater event affecting one unit. The "20" entry represents the overall AFW system failure probability for a loss pf offsite power that affects both units. For the latter situation, failure toiprovide flow to either unit is defined as the undesired event. The values provided in the table consider recovery of offsite power and events ranging from short-term losses to 24-hour l losses, as well as diesel ge.erator and diesel cooling water. pump failures. ' Table 5.4-4 and 5.4-5 provide more detailed reviews of each of the sensitivity evaluations for each initiating event. Table 5.4-5 provides both the demand failure probability without crediting recovery of offsite power and the 24 hour results crediting recovery of offsite power. Only the demand failure probability value without crediting offsite power recovery was calculated in NUREG-0611. Page 101 of 453
. l
TABLE 5.4-1 CATEGORIES USED FOR IDENTIFICATION AND CHARACTERIZATION OF UNCERTAINTIES QUALITATIVE CATEGORIES QUANTITATIVE CATEGORIES
- 1. Identify intersystem 1. Estimate significance and uncertainty dependencies of intersystem dependencies
- a. Support systems a. Same as qualitative
- b. Between AFW and Main b. Same as qualitative Feedwater, Condensate, etc.
- 2. Identify intrasystem 2. Estimate significance and uncertainty dependencies of intrasystem dependencies
- 3. Review cut sets in ascending 3. Examine cut sets contributing the order of minimum number most to unreliability and estimate of component failures significance and uncertainty
- 4. Review cut sets involving 4. Examine the quantitative similar components contributions to unavailability /
unreliability of these components and estimate significance and uncertainty .
- 5. Reviev human interactions 5. Included in Category 3
- a. Before Event a. Same as qualitative
- b. Post Event b. Same as qualitative
- 6. Identify failures that if 6. Use quantitative information to made recoverable would result focus identification and estimate in success uncertainty
- 7. Identify important common cause 7. Use quantitative infurmation to events to establish key focus identification and estimate coupling mechanisms uncertainty
- 8. Identify key cause of component 8. Use quantitative information to unreliability/ unavailability focus identification and estimate uncertainty O
Page 102 of 453
A q b(~~N U- .) IABLE 5.4-2 UNCERTAINTY REVIEW CHARACTERISTIC QUALITATIVE IMPACT COMMENTS System models The detailed model providos a solid The detailed system model assumes symmetry foundation for both single-unit and between Unit 1 & Unit 2. Only the Unit I dual-unit events. AFW system is modeled. Two-unit errects were also considered. Other impacts discussed below arc ' subsets of impacts for this un-certa inty characteristic. Manual valves inside Potential common cause railures or- The quantitative impact value of 1.0E-6 is the containment those valves combined with coupled the coupled HEP for these valves. A speci-human error probabilities (HEPs) . ric evaluation or the impact or this HEP i (AF-12-1 & AF-12-2) associated with operation or these will be discussed in a separate section of this table, valvos make them very important potential contributors to AfW rallure probability. Check valves inside Potential common cause ra ilures of The quantitative impact is not significant the containment these valves make them important because there is no human interaction with potential contributors to AfW these valvos during power operation. (AF-16-1 & AF-16-2) fa i l u re p robab i l i ty, ~i AFW discharge header Potential common cause rallure of MOVs these valves make them important potential contributors to AFW rallure (MV-32242 & MV-32243) probability. The coupled human error impact is expected to be less than tha t for AF-12-1 & AF-12-2, discussed above, because the positions of these va l ve s a re mon i to red in the control room. The valves are also accessible for recovery four check valves in Potential common cause railure independent fa i l u re is probabilistically the discha rge lines that could result in loss of all insignificant. Coupled railure is f rom the AFW pumps AfW riow to the steam generators. cons ide red in the common cause analysis. (AF-15-1, 2, 3 & 4) a Page 103 or 453
JADLE 5.4-2 UNCERTAINTY REVIEW 1 continued CHARACTERISTIC QUALITATIVE IMPACT COMMENTS Pump suction and dis- Potential to overestimate the These failuees could be considered as part cha rge manua l valves, impact of pump failures on AFW of the aggregate pump failure rate, which is check va lves and HOVs system failure probability calculated and quantified separately. (e.g., AF-13-3, AF-15-9, AF-14-1 & HV-32333 for pump #11) Turbine-driven AFW Pump f a i l u re p robab i l i ty ha s The demand failure probability may be lower pump #11 some impact on AIW failure pro- due to recent changes in pump design and bability for loss of main feed- ope ra t i on. The time-dependent fa i l u re ra te water events. However, for loss i s mo re unce rta i n Pra to the sparse plant-of of f si te power events, where specific data. This sparse data is used as diesel generators fail to oper- an upper bound for the time-dependent fall-ate, the turbine-d riven pump fa ll- ure rate. The current value of the time-ure probability can significantly dependent failure rate is based on the affect results. simi la r va lue for the motor-driven pump. The recovery probability has increased sub stantially due to recent changes in procedures for recovery and changes in related operator training. Turbine-driven pump This is a relatively new valve Valve is a minor contributor to overall steam admission valve that has not failed since the turbine-pump tra in fa ilure ra te. (CV-31998) b rea k- i n pe r i od . Ove ra l l failure contribution could be lower than currently estimated. Page 104 of 453 O O O
g nd sie e m hnpt he - e o do or h rtoia p e ii pl dth n t lye,t r s g s nf chrotwt e at i yl g e a e isora irr o afdadl u a th rtr hifdwwde trhiodnta + nt no wl dontf et i anf e e aam b1 del oao lyr nrA etup-h t if co r ice y' .it#uf n a 2. ldd efcw itevp ul ee pqm. 3 s i fy ofml s(o reeo acee . eeul 5 ioete weeseo' p htefh daf a yk s p e 4 r . fn tncka f e a n d es ua cgeihomltah i surtrdsol o f de s r aiblttue wtel nneao iCim o i v ps p v yd he uaerfe o sl na o fo mnyssd iiaiietl pee etertki rmne nn i pe o o .ye d 5 0 ov e m rc . mrdnl pegol imrl 1 c er es roiere ni mhn dntoai e ru viseiuno gu e utediaaoia e te i emrqntdn rh p,mante n hrrlt g cr all t s r m a e o a ni p e t pe e ie a ah sa aeuanrcrahmm l pl xd P m pt tr s t pth e e sume c s s n gi p a s - imtteroou iip ousrbe rae il et tpursisenl ha pya get h l tc , n re o gi b t e , stsnbnrt v ea pt e ae trer racrr useaemcm teec. xW uFe saouoo hll c n if to ud p me qehwmi adsntne aAld - ti' , ht mteeeenair bl pyeen a et fa hte ow u eeiuml rhed tt o h ,ihdtSrec yl hh s o u t pt m e i c ft tfl - e R ebi ttncpn pd
.e 1
S T ta np am i ro. n h oetrdm.h dneno geoater)t . ode scea surr o heppl coill gbsmii afnou ec N ui ais urmtatf1 r r nh g uueuofddvn E M q e ete av ou rwx hl so ewtod wecitn i ol rp ireei - h- .nowd M et lcrl tii p e oil a e yd p teeWxgce s O ha nua l ahmnnl neehani l rhFuieioa C Tg Udv AftiOafUbhtmap A pt A a s r v n w W E I 2 V: .
- Ed e 4 Re et u e eha ,
5 Yn s rtr s E Ti Nt u u a sfe f wr oo r
- s d - ly L n ec,sor o lt e sn fl nd B IAo er uene u fa w ieefeaen A Te hi l bgrtl st r or pb oi t v a T Rt tes y a i p ri nl ree peeeu dii E hael ves aa ouenb wcdlr vrt- .
C N rt rt vewpf iste eor rpunn hs aro oe drtn eido t e a gl U fo,tlyun a rt arw l , a ooestietai siic. ir sul ai ' luanl vi y ae 'l bl c dmiw ol eawo sa csivs tioeti nsht sa ehiffs ldr ll ee l p rarl ribo myecd e c vTb it aeeel e :iftnf rtei aenl fsl vuv yw so u c wi rh ',u hr T lv.bsgu a ouis n pi o o momtc e r ie ksohtr pnortowetetb e pb r f t l u C srase ocia s e tno l g ua - saebyl A nppc r d npsoet ny s len d 'p i rslh ,trhal
. P om n iisbvs oei ssnet nr M muenal al eram pol oer re mhp uep eoo I mprocl rtr haa,up e yetmehvorb f E
o um a c1l myr tg t re bse no tt r aefpt uhTe o h
.tfotp V 2iote nisnne ietyit ihI - ro tim I
e#aciv r f el eiev mi lhet lt Wn.ent wu T l o rsv atli rd Fopw np p A T ad si nmabt ueatoc r l ent f pl oe fmitr ixm.A mooame I eao ac cbvare soobai uoe,ly a rc u ppd t rpae u t n L s dlbe ri p s caru oy peq frte eso rv A e1 nl of eyeevs rnnape e usll ti pW ei U h1 aerf h ah pn e hdoooiiemF pr Q T#rwpa Tmtoer CaicOr Tesl sossiAod s p e m v u l , p a s yg e 6 p rv &p 1) ml e m rr - 2 ui tn 9u aa W1 po ar p ihs F-CI wut 8 l ce - F ne 4r isr 6A eb T ge o xiu 1 - vu S nr Lf) udt 3 it I i C 1 a p , r R E ld on 02
,1 # der ru 3 ,
11 dy r T oa 2- nt - 1 ea C cy 8& aag W- ni A l 14 wn FF il
'f R A
H pp mp WL1 uu CC#
- 1 ndi iep aei 6-13
- A bi rx uu C Ps ( Mfp ( Ta
o I . IABLE 5.4-2 UNCERTAINTY REVIEW icontinued CHARACTERISTIC QUALITATIVE lHPACT COMMENTS use of the opposite- C red i t for this pump ossentially Since this action is not currently proced-unit AFW pump changes the singlo-unit AFW con- u ra l i zed, the human error contribution to r igu ra t ion f rom a two-t ra i n to a the unavailability of the opposite unit pump Availability of three-tra in system. is quite high. Lowe r va l ues a re expec ted opposite-unit pump onco procedures a re in place and operators The initiating event and the oper- are trained for this action. Human error x-conn ational status of the opposite ( Procedu ra l ) unit have a significant impact on The ove ra l l value or failure to properly use the availability of the opposite- the opposite-unit pump is driven by the Human error x-conn unit pump. assumption that the pump will be unavail-(Test & Maintenance) able when the opposito unit is shut down. I f the cross-connect va lves a re Changes in test / maintenance practices could Manual valves subject to periodic test and main- va ry thi s unava i labi l i ty signi ficantly. tenanco, new railuro modes will be MOVs introduced that are not currently When used as the cross-connect pump, the #21 cons ide red in the model. Iho pump actuation is diverso f rom that or the value of railuro probabilitios Unit 1 pumps. Unit 1 accident signals do not associated with thoso modes will activate the #21 pump, therefore for the va ry depending on the types of single-unit analysis its operation is valves that require test and main- totally dependent on operator action, tenance (e.g., MOVs or the current-ly installed manual valves). Emergency diesel important to ArW system unavail- Detailed analysis of the emergency diesel gene ra to rs ability for loss-of-orrsite power generators was not undertaken because this initiating event. study focused on the auxilia ry feedwater system. However, due to their recognized influence on the ove ra l l results of the AFW system analysis, a limited errort was made to include the important errects or emergency diesel generator fa ilures. Page 106 or 453 O O O .
</
A
, gs y r f . d et ine l ng g o g od o e yti ril oa ines r n in sk e l s
ti r g esi oh re eyr sor a a - nu n vrb cc uh vl uyooo n eq i ra d t po ed tll ts e i t ede l eob nd mgt i r ii v o bnr o r o eatr ,u ,lesl sn e cisvseeen
.i o arr vosuep ur re e ope, 3 .
c op i ecr r pi b u o g e rl tcoeemmia ec rf ter 5 n s pse nl w we or ui dn day 4 do ofhvoasceiao d t o msr te etecns bsup p es eisi r i uou l sor w yol d rp s ce t tl o t pll e e e t e n o s d pltn e ov clni a, rea l suh hiHi i ooat om rl eaeb 7 t iedTdT e .pu t pa t nr dewn nsgs i u pa prna 0 sd ehr e d sih rp y v xeob 1 epe a W tt dd evpo ho w gF e.tc.dsml ergenunuf ,u mccir ero iaW F ct nu emr sop e g tl nA hrnpol op t p pr u fA eh s c a e gi tuixici ml mrdf o gs i e e P fv nze ctetntoeueue o f r snr oe i yh fcs aiawtsnp n s si eo tuwu ooetr mtseo cos mt caol ld llt oa toeti yr gr i s . loes E acdl es onn se npotes fnaton evp onss (s r pewa da cao : aoiaali o. mbor ow m Erame nrs Tuhurme hhssnyest eee nnr a nl oca l .o) pt . i tbWF l m eot Ol pa e r e t t A s ud pa r n uat en de vfc Nis tet or o e dog kru ivafA let e s irtr Irmbny robn repcn apysswafy.l m hc eti s s aps ceh ti co t S y dnr N u oss oeetmuu bo afsc I i
- ae Al pdi eeldihhsus lod y tiea cle "t N
E M t as lerr Rrrciauurl a os er t de soe Oeeudmlltprt Ta etl rroetttyp y tl l nh l na uue l ar aca tgum td i nili nrp M t epw Pvtdnriinueaeeaeg i gt nrr asl O oa imo M e a r o o a a o o ph h h u vii ais atl unao C Nw Dip ISwicnrfccottTdeh r S" Msa Qirt W E I i/ . 2 V Ed 4 Re t% u , t 5 Yn s h , n Ti r g . c am E Nt so n s rl an cas L I n pt s el eo l iep B Ao ma ilfo pi i i ftm A Tc ur ool eowntror eisu T Rf pe o h iao e hn p E n csntrs rtet tgn C We si onseaba iiW N Fg no ,fopprow ms r U tr imoel o tA w Al ell v eetu p g rtl ee i auhli pl orn fuuh hs r stbd u ii ost tei linruld ge r a n nfl el oesaho ehei strw - T rd o Ficvsuto. ewl a ien cs loiw ay't C fy sol vercan T A c ileli .asdcmgeS ssMu P gn wr eu ihC sr o y M I ine g do frwptn eshesnlt oa e ao.r mt g. l r h eom ir emh aldn E oe t s w pu rbid r o t ra a e v" ni l V om opo peren r I ce b m pC duheofo inorn T u AW n tT pt t temou A ee r pe ru e g ngetr T dh o tlA ril e.dnnm a ra I i t nh oie tm rs L v sesayottlil t satep A od str li il tos beanm U rn oarrntenicoy uteeu Q Pa Lwoooabuwacs S sh gp g i n l o o c rs - C oe I n tv T e al S vs ra ip ev RI E rm n en du T - p gw C o A R ler se md aw g A et eo H a tl C iDw Sb i ! ii t; !i' .il;j4' ]!1!l1l1 }i' r 4 ji! !
O t i d - n
. e a , usp y n f r s td i o e p- nm ou a p mn eu nt t y o uu vp s n r p i gW s o ot e s ar c v. Wi f 3 we t eri es l n ao A f
, h eA 5 4
sa buh vi m te iw l t re v f sd oie pa ot ni o lyoe tav fa ur fs ee y it c 8 ar d h kp ns se 0 n ep ao oir ep 1 ay r mms m t vs e uut te l e r a spn yn ct ar g ei s a ca ua v a tl ai awlfp, nl ep sw hh e P wx yA c t ri g rl fg or tt o du ea inet ea i bn e l ehs mm el e fe ivti er co eh h biOr ar e fn uc o ro sw o nt bd .t o g sno ld ian o yc yn o ce t mi reta pnir ri ei, oa S dd il a or ttd tr e T ee ebih tu aae l n, N rrbc isd ntt E ild u uua rsc aet M al l tbs hn e e ngr M tc i oi o ltef g a O en anrh oi hf ist C Di fi pt Nt Ata Sis W E I 2 4 5 V Ed Re Yn u s r e wT m - O E Ti Nt fs o d e h loS C . e n L I n oeWt e e vs t f f s t - i-B Ao rF a r rs ie. snp eo- ep stnmna syoiie A rv Vnhm T Tc Ri E snl u Aelt r s.uu )i't o i f n i p p qi simn. el uoe ol gMitu fan ( p e msh l ps tEea C iaoeauien c p g vi tf l rwl d . N tf gfrrru xy pa t nel oWf beou dn U an,om1 n r ee t elWim pF ra nl evu a o pl slA otl s .meo ra e1 eri i n i a o pb h n pA td croael pwyr4tet it 0sda bese8tm mnrt- aud t iu snpe fn,vrel wl l dl e e o 2 yi c o o e s F e plf cpv t emn iorpota oevs3ssi rfil rnf h uo l mvui nceuto T mise ro u ai pb g ve hr t saVeoi C ser r ipekd o nns Mt cd tnc o d 't lvWewt A Ft us etdeu suwaeef oied n o P e nia anor rs st neommh caclfiem M rrinvgwoyo eu uty l mxuo I ee u ndirt dnnar iklf a ys l Eo s r b E ftt _ fal acwec r kietda lii co u b b em.csop natp et c ginhlf d o V _ ddsmhl i wu eofate oerd , e)e u vc.li ea pnen oe tu I nn ctuld ot1 gsns l T eeocl nree atue ta2rio liimovefht A laf err ,oiovg es rnecp oe s1 e in eposa T f dn1 m)so l tl o d I r d . marm fate lueh s ee3e1 ri eda - nyi L enl wgn rpa dtsr gd- 4et wl rl oocd A viuo.ede e in ie dnVe0vc tuel tinn U eaol epnpot aoohv uoCh2iu loopeutea Q Smcf(oaOts fctT o Jc(t3ds f cowaadc l
)
m l e n e 1 th o , w 4 st Wi 2 t 0 ya s fs - o 2 sp n As 5 h 3 ie 1 - C rn ahnmi D
- r V l
oo rted es M i ti d va T se S as fi ) nv & I vr eorm &5 el R de n da - da 1 E ev im e 15 nv 2 T ei l aet - 1 o 1 ens cp O C fd 3- 1 A mri e 1D u 3 R A io nw a tb p v esrml D T ik ne - V l i al t pu u a T& aa C C Mf Sutpv ( Mm (
% W% .
(P% (j u. TABLE 5.4-2 UNCERTAINTY REVIEW tcontinued CHARACTERISTIC QUALITATIVE IMPACT . COMMENTS Coupled closure of Results in nonrecoverable railure Significant changes in treatment of valves manual valves inside or rmed flow to both steam gener- since TMI and NUREC-0611. containment stors. Never tested / maintained during operation. (Ar-12-1 & Ar-12-2) Blocked open with Saraguards liold tags. (lluman Error) Position verified with monthly containment inspection, flow through both valves verirled after eacle sta rtup f rom cold shutdown. Above changes result in a coupled railure that is unquantirlably low. Spec t ric HEP analysis conducted to attempt quantification. AFW turbine trip Assumed to result in railure of No rma l ly th rott led turn open. throttle valve stem all AFW pumps due to degraded high pressure leakoff environment caused by excessive Dra ins di rectly to ArW room. va lve open too f a r steam exhaust from the valve. (MS-22-2) (lluman Error) Use or backup Provides alternato suction for Requires successful operation of the pump , a cooling water the AFW pumps should the normal suction / discharge pressure trips to be a suction riov path CST source be unava ilable. viable option. . ] (e.g. Opening MV-32025 Assumed railure to open one valve will
. for. pump #11, when result in railure to open any of the requi red ) suction valves.
(lluman Error) No written procedure for proper use of the valves during accident conditions currently exists. AFW pumps must be manually restarted rollow-ing opening of the backup suction valves. I Valves are dependent on ac power for opera-tion. Page 109 or 453 1
TABLE 5.4-2 UNCERTAINTY REVIEW Icontinued CilARACTERISTIC QUALITATIVE lHPACT COMMEth S use of the CSis as Providos backup cooling water Only considered for loss of of fsite power the source of cooling source ( flow f rom the CSis) should models. for the AFW pump lube station cooling water flow become oil coolers unavailable. No written procedure for proper use of back-up CST cooling currently exists. Very important cha racteristic for a loss of offsite power combined few operators are f amiliar with the location with failure of the diesel-driven of the valves required for proper system cool ing wa ter pumps, alignment. Page 110 of 453 O O O
r p .p i k V 'V TABLE 5.4-3
SUMMARY
OF SENSITIVITY EVALUATIONS SYSTEM IMPACT CASE BASELINE VALUE NEW VALUE REASON FOR NEW VALUE/ COMMENTS 10 2U Baseline AFW 2.0E-5 8.7E Assumes potential impact of excess i failure probability leakage of steam from MS-22-2 has been corrected or shown to be an insignificant problem. Turbine-driven 3E-2(D) 7.5E-3 (D) 8.0E-6 4.1E-5 Allow for 75% recovery factor for AFW pump fil restoration of pump following failure. Baseline value includes steam admission valve faults. 1.1E-4(H) 3.2E- 3 e. 3.0E-5 1.1E-4 Limited run-time data result in this value; no failures in 155 hours. Baseline based on motor-driven AFW pump hourly rates. Combined 1.0E-5 6.0E-5 AFW pump cooling 7.2E-4 1E-4 1.4E-5 6.5E-5 More realistic estimate, if assumed water supply & transfer closed numbers are high and return valves changes are made to improve human error rates. 3.2E-4 1.6E-5 7.3E-5 Considers improved human error rates due to improvements in test and maintenance procedures.
~
1E-3 2.2E-5 9.7E-5 Upper bound value based on the AFW pump failure rates. t I Page 111 of 453 ,
TABLE 5.4-3
SUMMARY
OF SENSITIVITY EVALUATIONS (continued) SYSTEM IMPACT CASE BASELINE VALUE NEW VALUE REASON FOR NEW VALUE/ COMMENTS lu 20 Availability of 0.1 I 0.01 5.5E-6 Assume availability and performance cross-connect failure probabilities will be 2 approximately equal to this new pump 0.04 7.3E-5 value when new procedures and training are implemented. Emergency diesel 1.6E-2(D) 8.0E-3(D) -- 6.7E-5 Accounts for recovery factor of 0.5. generators 2.6E-4(D) 4.8E-4(D) -- 1.0E-4 Accounts for potential common cause events (Equivalent Beta Factor of 0.07, i.e., D2 changes from 2.6E-4 to 4.8E-4. Note maintenance unavailability is significant). Diesel-driven 1.0E-2(D) 5.0E-3(D) -- 7.7E-5 Accounts for recovery factor of 0.5. cooling water pumps 1.0E-4 (D) 6.8E-4 (D) -- 1.6E-4 Accounts for potential common cause events (Equivalent Beta Factor of 0.07, i.e., C2 changes from 1.0E-4 to 6.8E-4). Backup cooling 0.013 0.0013 2.0E-5 8.7E-5 Assumed an error factor of 10. water suction 0.13 2.1E-5 8.8E-5 1 Single-unit loss of main feedwater initiating event. 2 Dual-unit loss of offsite power event. Page 112 of 4
. _ . -- . . _ . - - - . _ _ ~ - . _ . - . . - -.
O O O TABLE 5.4-3 .
SUMMARY
OF SENSITIVITY EVALUATIONS - ! (continued) SYSTEM IMPACT CASE BASELINE VALUE NEW VALUE REASON FOR NEW VALUE/COMENTS 10 20 CSTs used 0.25 0.01 2.0E-5 7.2E-5 Assume availability and performance f failure probabilities will be
- for AFW pump lube i oil cooling 1.0 2.0E-5 1.3E-4 approximately equal to this new value (0.01) when new procedures and "
l' training are implemented. i i i l 4 4 i l 4 i i i i i Page 113 of 453
TABLE 5.4-4 SENSITIVITIES FOR SINGLE-UNIT LOSS OF MAIN FEEDWATER NEW SYSTEM CHANGE FROM FAILURE BASELINE , DESCRIPTION PROBABILITY VALUE KEY CONTRIBUTORS AFW system baseline failure 2.0E-5 -- (PUMP 11) (PUMP 12) (XCONNC) probability (PUMP 11) (PUMP 12) (21DIVR) (PUMP 12) (UlCWRT) (PUMPil) ([Wlf) (XCONNC) (PUMP 12)(CWV12) Recovery of 75% of turbine- 8.0E-6 -1.2E-5 (PUMPll) (PUMP 12) (XCONNC) driven pump #11 failures (PUMP 12) (UlCWRT) (PUMP 12) (EWf2) Upper bound estimate for turbine- 3.0E-5 +1.0E-5 (PUMPil)(PUMP 12)(FCONNC) driven pump fil failure-to-run (PUMP 11)(PUMP 12)(21DIVR) (PUMF11) (t WIT) (XCONNC) (PUMP 12) (UlCWRT) (PUMP 12) (CWI7) , (PUMPll) (PUMP 12) (PUMP 21)
- Refer to Table 5.4-6 for interpretation of these cut set elements.
Page 114
O O O TABLE 5.4-4 SENSITIVITIES FOR SINGLE-UNIT LOSS OF MAIN FEEDWATER
- (continued)
NEW SYSTEM CHANGE FROM FAILURE BASELINE DESCRIPTION PROBABILITY VALUE KEY CONTRIBUTORS I AFW pump common cooling water supply . and return valves l
- 1. Assume: - Transfer closed 1.4E -6.0E-6 (PUMP 11) (MiRPT2) (ENiNC) numbers are high (PUMP 11)(PUMP 12)(21DIVR)
- Improved test and maintenance procedures
- 2. Assume: - Improved test and 1.6E-5 -4.0E-6 (PUMP 11) (PUMP 12) (XCONNC) maintenance l procedures (PUMPil)(TURPTE)(21DIVR)
(PUMP 12)(UlCWRT)
- 3. Assume: - Upper bound limited 2.2E-5 +2.0E-6 (PUMPil) (PUMP 12) (XCONNC) by AFW pump failure probabilities (PUMP 12)(01CWRT) 1 NOTE: The UICWRT tenn includes l both cooling water supply j and return failures.
I i I i 4 4 Page 115 of 453
TABLE 5.4-4 SENSITIVITIES FOR SINGLE-UNIT LOSS OF MAIN FEEDWATER (continued) NEW SYSTEM CilANGE FROM FAILURE BASELINE DESCRIPTION PROBABILITY VALUE KEY CONTRIBUTORS Availability of the #21 pump: 5.5E-6 -1.5E-5 (PUMP 12) (UlCWRT)
- Includes availability and (PUMP 11)(PUMP 12)(XCONNC) performance values for entire train (PUMP 12) (CWV12)
- Accounts for new procedures and proper training in use of cross-connect and #21 pump
- Modifications to cross-connect valves Use of station cooling water for backup suction for the AFW pumps
- Dominated by human error in baseline case. Assume error factor of 10 for HEP
- Using lower bound value 2.0E-5 -- Same as baseline.
- Using upper bound value 2.lE-5 ,
+1.0E-6 Same as baseline.
Turbine-driven AFW pump failure 1.0E-5 -1.0E-5 (PUMP 11) (PUMP 12) (XCONNC) probability using the upper bound time-dependent failure and assuming (PUMP 12)(UlCWRT) 75% of the pump failures will be recovered. (PUMP 12) (CWV12) (PUMPil) (PUMP 12) (21DIVR)
~ -
Page 116 of 45 w,
d / TABLE 5.4-4 SENSITIVITIES FOR SINGLE-UNIT LOSS OF MAIN FEEDWATER (continued) NEW SYSTEM CHANGE FROM FAILURE BASELINE DESCRIPTION PROBABILITY VALUE KEY CONTRIBUTORS Upper bound estimate of AFW system 3.3E-5 +1.3E-5 (PUMP 11) (PURPT2) (XCONHC) failure probability (PUMP 12)(UlGRT) (PUMP 11) (PMPT2) (21DIVR)
. (PURPIT)(PMPI2)(PUMP 21)
Lower bound estimate of AFW system 1.9E-6 ~
-1.8E-5 (DPIPE11)
I failure probability
> (DPIPE12)
(SG11V)(SG12V) Best-estimate of Unit 1 AFW system 1.9E-6 -1.8E-5 (DPIPE11) - failure probability, given a loss-of-main-feedwater initiating event (DPIPE12) (including key changes evaluated
~above) (SG11V) (3LT2V)
Upper bound on best-estimate of 1.0E-5 -1.0E-5 (PDFPIT) (PUMP 12) (XCONNC) 4 Unit 1 AFW system failure prob-ability, given a loss-of-main- (PUMP 12) (UlH RT) feedwater initiating event j (including key changes evaluated (PUMP 11)(PURPT2)(PUMP 21)
- above) l Page 117 of 453
TABLE 5.4-5 SENSITIVITIES FOR TWO-UNIT LOSS OF 0FFSITE POWER CONTRIBUTORS 2DMT NEW + 2 DESCRIPTION SYSTEM CHANGE 2TMM 2DTM C3 c c 2 FAILURE FROM ,2 20 T PROBABILITY BASELINE
+2 2MT 2DT
+E 2C T_
1 Baseline 8.7E-5 -- 2.1E-5 3.9E-5 8.5E-6 1.9E-5 2 3.1E-5 2.0E-4 -- 6.0E-5 9.1E-5 1.5E-5 Recovery of 75% of turbine-driven 4.1E-5 -4.6E-5 6.4E-6 1.5E-5 2.3E-6 1.7E-5 pump failures 1.2E-4 -8.0E-5 1.8E-5 3.5E-5 3.8E-6 2.7E-5 Upper bound estimate for turbine driven 1.1E-4 +2.4E-5 2.5E-5 5.3E-5 1.2E-5 2.1E-5 pump failure-to-run value 2.0E-4 Neg. 6.0E-5 9.1E-5 1.5E-5 3.1E-5 AFW pump common cooling water supply 6.5E-5 -2.2E-5 7.2E-6 3.0E-5 8.5E-6 1.9E-5 and return valves 1.4E-4 -6.0E-5 2.0E-5 7.1E-5 1.5E-5 3.1E-5 - Transfer closed numbers are high - Improved T/M procedures AFW pump corrinon cooling water supply 7.3E-5 -1.4E-5 1.2E-5 3.3E-5 8.5E-6 1.9E-5 and return valves 1.6E-4 -4.0E-5 3.5E-5 7.8E-5 1.5E-5 3.1E-5 - Improved T/M procedures Page 118 of 45
O O O TABLE 5.4-5 SENSITIVITIES FOR TWO-UNIT LOSS OF 0FFSITE POWER (continued) CONTRIBUTORS 20MT' NEW + DESCRIPTION SYSTEM CHANGE 2TP91 2DTM c 2 dS C FAILURE FROM 20 T PROBABILITY BASELINE
+2 2MT
+2 20T
+2 2C T Baseline 8.7E-5 --
2.1E-5 3.9E-5 8.5E-6 1.9E-5 2.0E-4 -- 6.0E-5 9.1E-5 1.5E-5 3.1E-5 AFW pump connon cooling water supply 9.7E-5 +1.0E-5 2.7E-5 4.2E-5 8.5E-6 1.9E-5 and return valves 2.3E-4 +3.0E-5 7.9E-5 1.0E-4 1.5E-5 3.1E-5
- Upper bound; limited by AFW pump failure probabilities
- New procedures and proper training 7.3f-5 -1.4E-5 1.9E-5 2.7E-5 8.5E-6 1.9E-5 in use of cross-connect pumps 1.6E-4 -4.0E-5 5.4E 5 6.2E-5 1.5E-5 3.1E-5
- Assurance that cross-connect valves can be opened without ac power Recovery of 50% of diesel generator 6.7E-5 -2.0E-5 2.1E-5 2.3E-5 3.5E-6 1.9E-5 demand failures 1.4E-4 -6.0E-5 6.0E-5 4.6E-5. 3.7E-6 3.1E-5 Common cause failure of diesel 1.0E-4 +1.3E-5 2.1E-5 5.0E-5 1.4E-5 1.9E-5 generators assumed to be 7%
(8-Factor = .07) 2.5E-4 +1.5E-4 6.0E-5 1.3E-4 2.8E-5 3.1E-5 Page 119 of 453 ,,
TABLE 5.4-5 SENSITIVITIES FOR TWO-UNIT LOSS OF 0FFSITE POWER (continued) CONTRIBUTORS I 2DMT NEW + t 2 DESCRIPTION SYSTEH CHANGE 2TMM 2DTM C3 c c 2 FAILURE FROM ,2 20 T PROBABILITY BASELINE
+2 2MT 2DT
+2 2C T Baseline 8.7E-5 --
2.1E-5 3.9E-5 8.5E-6 1.9E-5 2.0E-4 -- 6.0E-5 9.1E-5 1.EE-5 3.1E-5 Recovery of 50% of diesel cooling 7.7E-5 -1.0E-5 2.1E-5 3.9E-5 8.5E-6 8.3E-6 water pump demand failures 1.7E-4 -3,0E-5 6.0E-5 9.1E-5 1.5E-5 7.7E-6 Comon cause failures of diesel 1.6E-4 +7.3E-5 2.1E-5 3.9E-5 8.5E-6 8.8E-5 cooling water pumps assumed to be 7% (8-factor = .07) 3.8E-4 +1.8E-4 6.0E-5 9.1E-5 1.5E-5 2.1E-4 Changes in failure probability for use Neg. of station cooling water system for backup suction to AFW pumps New procedures and proper training in 7.2E-5 -1.5E-5 2.1E-5 3.9E-5 8.5E-6 4.2E-6 use of CSTs for backup cooling to AFW pumps 1.7E-4 -3.0E-5 6.0E-5 9.1E-5 1.5E-5 6.8E-6 O O Pape 17n of I.V Q
. - . - . . -. _ - . - - - -- - -__ ~ - . . - .- ..
(
; O. ( - U TABLE 5.4-5 SENSITIVITIES FOR TWO-UNIT LOSS OF 0FFSITE POWER (continued) i i ! CONTRIBUTORS ,
20MT NEW + i 2 DESCRIPTION SYSTEM CHANGE 2TMM 20TM CS { c c 2 FAILURE FROM 2D T j PROBABILITY BASELINE
+2 2MT
+2 20T
+2 2C T l\
l Baseline 8.7E-5 -- 2.1E-5 3.9E-5' 8.5E-6 1.9E-5 2.0E-4 -- 6.0E-5 9.1E-5 1.5E-5 3.1E-5 i ,i No credit for use of CSTs to provide 1.3E-4 +4.3E-5 2.1E-5 3.9E-5 8.5E-6 6.5E-5 l cooling to AFW pumps 4 2.8E-4 +8.0E-5 6.0E-5 9.1E-5 1.5E-5 1.1E-4 ! Turbine-driven pump failure probability 6.0E-5 -2.7E-5 1.0E-5 2.5E-5 6.3E-6 1.8E-5 using the upper bound time-dependent failure and assuming 75% of the pump 8.4E-5 -1.2E-4 1.8E-5 3.5E-5 3.8E-6 2.7E-5 , failures are recovered l 1 . ! Upper bound estimate for current design / 4.4E-4 +3.5E-4 3.3E-5 7.2E-5 1.9E-5 3.1E-4 i operation 9.7E-4 +7.7E-4 7.9E-5 1.4E-4 2.8E-5 7.2E-4 4 l Lower bound estimate for current design / 5.0E-6 -8.2E-5 1.1E-6 2.2E-6 9.7E-7 7.1E-7 l
- operation 8.8E-6 -1.9E-4 3.1E-6 4.1E-6 9.6E-7 6.3E-7 ,
i Page 121 of 453
TABLE 5.4-5
. SENSITIVITIES FOR TWO-UNIT LOSS OF 0FFSITE POWER (continued)
CONTRIBUTORS 20MT NEW + 2 DESCRIPTION SYSTEM CilANGE 2TMM 2DTM CS C C 2 FAILURE 2D T FROM BASELINE
+2 2MT
+2 2DT
+2 2C T PROBABILITY Baseline 8.7E-5 -- 2.lE-5 3.9E-5 8.5E-6 1.9E-5 2.0E-4 -- 6.0E-5 9.1E-5 1.5E-5 3.1E-5 Best-estimate two-unit failure 8.7E-6 -7.8E-5 1.1E-6 3.6E-6 2.3E-6 1.7E-6 probability, including key changes evaluated above 1.8E-5 -1.8E-4 3.1E-6 8.2E-6 3.8E-6 2.5E-6 Best-estimate two-unit upper bound 1.6E-4 +7.3E-5 3.1E-5 5.9E-5 1.9E-5 5.1E-5 failure probability, including key changes evaluated above 3.2E-4 +1.2E-4 7.4E-5 1.1E-4 2.8E-5 1.1E-4 FOOTNOTES:
1 24-hour value including recovery of offsite power. 2 Demand value, no credit for recovery of offsite power. Page 121a o 3
TABLE 5.4 4 V DESCRIPTION OF EACH KEY CONTRIBUTION TO THE
-SINGLE-UNIT ~ LOSS OF MAIN FEE 0 WATER ANALYSIS i
PUMP 11 = AFW Pump #11 Faults PUMP 12 = AFW Pump #12 Faults PUMP 21 = AFW Pump #21 Faults XCONNC = U1/U2 AFW Cross-Connection Valves Closed - a . 210IVR = AFW Train #21 Flow Diversion to Unit 2 - f , UICWRT = Unit 1 Cooling Water Supply / Return Faults CWV11 = Unit 2 Cooling Water Supply Valve CW-1-1 Faults 4 .O\- ,3 CWV12 = Unit 1 Cooling Water Supply Valve CW-1-2 Faults . OPIPE11 = Rupture of AFW Discharge Header to SG11 OPIPE12 = Rupture of AFW Discharge Header to SG12 . .{ SG11V = Faults in AFW Valves in Discharge Header to SG11 f' SG12V = Faults in AFW Valves in Discharge Header to SG12 l l t I 'O Page 122 of 453
5.5 Candidate Modifications Tables 5.5-1 through 5.5-3 summarize the results of the evaluation of characteristics of the AFW system and resulting candidate modifications that might reduce the contribution of these characteristics to the AF# failure probability for either a loss of main feedwater or loss of offsite power initiating event. Many of these candidate modifications are amenable to evaluation using the AFW system reliability models; others are not. Before evaluating these candidates, the expected impact was determined using the engineering knowledge and judgement of the evaluation team. The initial evaluation results are provided in each table. Table 5.5-4 provides the candidate modifications amenable to quantification and the calculated impact on AFW system failure probability of each. The last entry (#6) estimates the overall impact of the five candidate modifications evaluated. Parametric common cause failure probabilities are not included in these values because they were not included in the NUREG-0611 analysis. Including the common cause contributions has the following impact. CASE LOMF4 LOOP Baseline 8.6E-5 1.5E-4 2.6E-4 With Candidate 3.1E-5 3.7E-5 Modifications 4.6E-5 These values are more representative of the current and future AFW system failure probabilities should key modifications be incorporated. Table 5.5-5 provides the evaluation team's judgment of the expected impact of candidate modifications not amenable to quantification. Table 5.5-6 summarizes some additional considerations for NSP review. Except for the last two entries, each of these areas needs further evaluation by NSP to ensure the applicability of the results calculated in this study. A review of other designs did not uncover any candidate modifications relevant to Prairie Island that are not shown in Table 5.5-1. O Page 123 of 453
^
/'N U U loRLE 5.5-1' ,
SYSTEM CHARACTERISTICS - IllT ERRELAT IONS CANDIDATE EXPECTED SYSTEM CHARACTERISTICS MoolFICATIONS IMPACT COOLINC WATER 1. Normal cooling supply for AfW pumps 1.1 ' Break dependency by'providirq High intra-system cooling (e.g., d i scha rge pump rec i rcu la t ion flow thru lube oil coolers / turbine). 2 Si ng le pa ss ive ra i lu re of manua l 2.1 Eliminate single railure Low
- va lves ( CW-1-1, 2CL-49-2, 2CL-49-3, or potential by eliminating valves.
CW-1-2, CL-48-9 CL-48-10) would fait coolang to 2 pumps 2.2 Eliminate single railure Low potential by providing parallel path. 2.3 Reduce likelihood or incorrect High valve position by inspecting more f requency. 2.4 Reduce likelihood of incorrect High-valve position by confirming flow through cooling water return header sight glass during pump test. 2.5 verity valve position High following maintenance with post-maintenance test.
- 3. Backup gravity feed cooling f rom 3.1 Proceduralize and train opera- High CSTs to pumps is not proceduralized tions personnel in actions or recognized as an option by required to recognize need for many operators backup CST cooling and initiate this backup source.
3.2 Provide remote operability to Low valves required to operate.
~ Page 124 of 453
,e
O O w 00 w< 4 aA @ < XE - % w= = Z m A 4 . g L-g g6C 6 wDe 0 ese o
% >Go
= VVD N
- e e eO C ea C Cd 400 E O C 0 m
=@3 C D & a e- -Om a a e 460 h C3 Se- w M GC 0 Z as we L 0 CE se- c
- e C>= w wk 0C w-- e
>4 40 wN 3- O>
m) ) Q- e- 6 V @ *
-6 e 3XC CC C- 96 WUs -O M ZQ d3 . CC --
Z 40 eVa Wap om UK CGV
.UC OW C= =00 - Q3 k ECU C cow o O @ O O
( -6c C CCe ce C C C C J =ac O O-6 c O O O O w wwc 2 2-0 MV Z Z Z Z E M w e e e e e e e w Z e e e N e N m 2 Mer
-EDa e
s M @ & b 8D @ s
- M3 D- C e = wo -e WN a 8 M UC 3 & CO O -O -- O O 6-3w 0 .Ccd8 e- >N E O w kw Q 4 3dwc U bCW-> Om 3 6 J MC C We(O COOceb ZI a b m -O eco E O- > 0 V a- m e > L W
< EU c aw c -060 & SE cow OK ww CO C#w UWO COV-be w W -
> N kGn = w % 20G4G) D w U M- 3mh
- CC C ) ) -C e a 4 e-O -em &Com
- Csoc @ me ) E
% >ed -9 CGCQ 3 -U-CaC C D 3 % ZwC e63 -det 44-0E- ma o a 0 bow GeGb d SCO 3= -e Q U CL> 04 ~66 -
M= Eb haC # w b f U
>OC 6D a@09 -
O E w M - - e-O CC C w a6 C C69 Em Ga wMhM
-Cbu O G C-WC -
C e O
> U- >m> C)W hl O wE - de a3 e M k CM 30 m3 Webcgg gw a 6
> M hmo OV6 w6aC-
-O ha QC=C)w d Od M - == 730 kwe e um e em da ws E a#@ 30 mOwC b -ud @h V3a 38 4 w a C O-m cauc Le >=oLC- CNN -3 L
> 3C- -me w me. ou -h-e-a ON ba co O wow a o Cham de V-w)-a and a )V ec -OE c e) 3
-0.CO3C- 0 ab hop cas -db >Vo ace - .C -w ad u > >e> D2 e% e-- U eN3 e4 C
% Cc- --- Cua O @( Came O Caw C -o O e>D wow -cwSC Cw e owCw eN od 06 m- eeo -reco --C
=c--@ -Nm -w 60 COW- c-o tu>w W--d>e Wm3 9N d6 e
wb Ch cu3- o w c -dC 0- seb--
->N -w
$cac xOw 06ehe Om -O>wba O-wbw) wwc 60>MM 05 MusODe MZm WW OU e e e N e N m a C
O E
> w 4
- g <
w w 3 N
> Z c Z
< w w o M O w -J Z Z Z wZ *C w w g w w (m
> c < > Z> 3>
M Z WOW W >Z
> C *w> > 00 M U MGM M (O
s
% g -N:
%/ -
TABLE 5.5-1 SYSTEM CHARACTERISTICS - INTERRELATlDNS ' (continued) CANDIDATE EXPECTED SYSTEM CHARACTERISTICS M001FICATIONS IMPACT t ACTUATION / S. Actuation is redundant and diverse 5.1 None CONTROL
- 6. AfW/MFW pump control powe r a re f rom 6.1 None same buses
) ELECTRICAL 1. Four 4160V emergency buses 1.1 None NOTIVE i 2. Each DC supplies two emergency buses 2.1 None
- 3. DCs require cooling from diesel 3.1 None cooling water pumps during loss of
} offsite power l 4. Each motor-driven AFW pump supplied by 4.1 None I sepa rate DC STEAM LINE 1. Drain steam lines immediately upstream 1.1 Block and tag all valves in flow High DRAINS of AfW turbine steam admission path from the AFW steam line to , va lves (CV-31998 and CV-31999) the main condensar.
. 2. Drain steam headers to AFW turbine 2.1 Add all valves in the flow path Medium f rom the steam lines to the main condenser to the AfW Prestart Check List.
2.2 Same as 1.1 High i i i T 5 l 4 i i A Page 126 or 453 J
lABLE 5.5-2 SYSTEM CilARACTERISTICS - CONFICURATION EXP[CIED CHARACTERISTICS CANDIDATE HODIFICATIONS IMPACT
- 1. Vaive C-41-1 resul t s in a symme t ry in CST 1.1 Remove. Low header
- 2. Uni t-to-unit cross-connect pump use 2.1 Leave valves open. Negative (Design change) 2.2 Leave one valve open/other closed. Medium (Valve with cable operator may be left open. This will eliminate the likelihood of this valve failing to open when requi red to be opog. )
~
2.3 Supp ly mo t i ve powe r.
- dc, with manual backup fligh
- ac, with manual backup Low 2.4 Change manual operators lii gh cable to chain).
- 3. Unit-to-unit cross-connect pump use 3.1 Proceduralize use. liigh
( Procedure chango) 3.2 Test (quarterly). (loclude opening Hagh or cross-connect valves discussed in 2, above.)
- 4. ATW reedwater flow control i s pe rfo rmed 4.1 loclude flow versus time manually requi rements in p rocedures.
Page 127 of 433 9 O O
/~N- ,G A TABLE 5.5-3 SYSTEM CHARACTERISTICS - COMPONENTS EXPECT [D CalARACTERISTICS CAN0lDATE MOOlFICATIONS IMPACT
- 1. Availability of cross-connect pump depends 1.1 Minimize unavailability when one unit High on status or other unit is shutdown (set availability goal of about 90% when unit is shutdown).
- 2. Cro6s-connect valves are not tested. 2.1 Confirm ability of operators to open High Reliability is dirricult to assess valves during pump operation and include in test program. Qua rte rly testing seems reasonable.
l 3. Motor-drivcn pumps can be made unavailable 3.1 Provide procedures to bypass control / - Medium by faults in pump trip actuation. Operating actuation faults. experience indicates that bypassabic control / actuation raults are important contributors to pump failure recovery
- 4. Many turbine-driven pump raults are 4.1 Proceduralize manual sta rt/ cont ro l High manually bypassable fault bypass process.
- 5. Inadvertent /nxcessive opening of trip 5.1 De te rmine i r env i ronment c rea ted by N/A throttle valve stem leakorr valve (MS-22-2) rault would cause rallure or other is a potential cause of railure of multiple equipment.
pumps 5.2 Route piping to drain system or to High turbine exhaust.
- 6. Ai r-operatad valve performance varies 6.1 Locked security cabinets inhibit .
4 substantially throughout i ndus t ry. PI recovery using mechanical acceleration. performance has been good. Many railures Consider proceduralizing. have been recovered manually l Page 128 or 453 l
TABLE 5.5-4 CANDIDATE MODIFICATIONS AMENABLE TO QUANTIFICATION FAILURE CANDIDATE PROBABILITY MODIFICATION LOMFW LOOP l 2 Baseline 2.0E-5 8.7E-5 3 2.0E-4
- 1. Discharge AFW pump recirculation 2.0E-5(0%) 7.2E-5 17%
thru lube oil coolers / turbine 1.7E-4 15%
- 2. Proceduralize and train 2.0E-5(0%) 7.2E-5(17%)
operations personnel in action 1.7E-4 (15%) required to recognize need for backup CST cooling
- 3. Verify common AFW pump cooling 1.6E-5(20%) 7.3E-5(16%)
water valves are in correct 1.6E-4 (20%) position by using cooling water return line sight glass during pump test. Verify valve position with post-maintenance test
- 4. Ensure cross-connect pump has a 5.5E-6(73%) 7.3E-5 (16%)
high availability; procedurize 1.6E-4(20%) use and train operators; ensure cross-connect valves can be opened; test cross-connect valves
- 5. Procedurize and train operations 8.0E-6 (60%) 4.1E-5(53%)
personnel in manual start / control 1.2E-4 (40%)
, TDAFW pump 4
- 6. Candidate modifications 2.9E-6(86%) 8.7E-6(90%)
1.8E-5 (90%) 1 Baseline values assume MS-22-2 issue is resolved. Excludes parametric common cause (6.6E-5) which was not included in NUREG-0611 scope. 2 24-hour value including recovery of offsite power. 3 Demand value without crediting recovery of offsite power. l 4 Overall impact of the five modifications amenable to quantification. l l l Page 129 of 453
e TABLE 5.5-5 CANDIDATE MODIFICATIONS NOT AMENABLE TO QUANTIFICATION CANDIDATE MODIFICATION EXPECTED IMPACT ! Eliminate auto-open signal to High
- emergency supply valve MV-32041 Block and tag all drain valves in flow High I
paths from the AFW steam lines to the main condenser ; Include flow versus time requirements ? . in procedures Provide procedures to bypass control / Medium actuation faults for motor-driven AFW pumps O c - 4 9 Y I i !O Page 130 of 453 e w- y-~ r -,<-,-,m--.*-%.m-.y - - .- --- .---+--%- - . - - - . - - - - - - - - - . . . , , . ,-.3----.--,----,-,,.-.4_ . . , - . - - . . - , , - - -
TABLE 5.5-6 ADDITIONAL CONSIDERATIONS Ensure main feedwater line check valves are not deteriorating. Ensure integrity of AFW system check valves, manual valves and motor-operated valves. Confirm that inadvertent / excessive opening of trip throttle valve high pressure leakoff valve (MS-22-2) will not cause failure of AFW pumps. Otherwise, route piping to drain system or turbine exhaust. Ensure post-maintenance / design changes to AFW components are adequately tested (testing representative of expected performance requirements). Continue to de-couple maintenance of Unit I and Unit 2 AFW system components. Confirm that failure of one diesel cooling water pump (DCWP) during opera-tion following a loss of offsite power will not result in load changes sufficient to trip the second pump. Confirm that load changes resulting from equipment use (on/off) will not adversely impact operation of DCWPs following a loss of offsite power. Confirm that delayed AFW flow initiation will not cause water-hammer problems. Consider need for valve C-41-1. Consider proceduralizing use of mechanical acceleration to open turbine-driven pump A0V (CV-31998) in an emergency. l l 9 Page 131 of 453
(D 5.6 Summary of Results - V Table 5.6-1 summarizes the quantitative results for the current AFW system configuration. The AFV system failure probability for the loss of main feedwater initiating event is calculated to be in the range of 3E-6 to 1.1E-4. The best estimate is about 8.6E-5. For a loss of offsite power event, the AFW system failure. probability is calculated to be in the range of IE-3 to 1E-5. The best estimate value is about IE-4. There is more uncertainty in the loss of offsite power case because of the increased influence of the diesel generators and the diesel cooling water pumps on the results. Table 5.6-2 summarizes the quantitative results when the candidate modifications described in Section 5.5 are considered. The AFW system failure probability for a loss of main feedwater initiating event is calculated to be in the range of 3E-6 to 4E-5, with a best estimate of 3E-5. For the loss of offsite power initiating event, the range is SE-6 to 2E-4, with a best estimate of 4E-5. The high upper bound value of 2E-4 is much higher than for the loss of feedwater case again because of the uncertainty in diesel generator and diesel cooling water pump performance. Section 5.5 contains summaries of the qualitative results of this analysis, which are too voluminous to repeat here. One should refer to this section to gain a complete perspective of the overall analytical results.
^ / \
V Page 132 of 453
TABLE 5.6-1
SUMMARY
OF RESULTS - CURRENT CONFIGURATION LOMFW I LOOP I CASE AFW F.P. SG DRYOUT FREQ. AFW F.P. SG DRYOUT FREQ. 2
- 1. Current - Best Estimate 2.0E-5 4.0E-7 8.7E-5 7.0E-6 3
- No faulted 2.0E-4 N/A component recovery
- No parametric CCFs
- 2. Current - Best Estimate 8.0E-6 1.6E-7 4.1E-5 3.3E-6
- 75% of TDAFW pump 1.2E-4 N/A failures recovered ,
- No parametric CCFs
- 3. Current - Best Estimate 8.6E-5 1.7E-6 2.4E-4 1.9E-5
- No faulted 6.0E-4 N/A component recovery
- With parametric CCFs
- 4. Current - Upper Bound 1.1E-4 2.2E-6 5.1E-4 4.1E-5
- With parametric CCFs 1.0E-3 N/A
- 5. Current - Lower Bound 2.9E-6 5.8E-8 5.0E-6 4.0E-7 8.CE-6 N/A 1 Assumes MS-22-2 issue is resolved F.P. = Failure Probability 2 24 hours including offsite power recovery CCF = Common Cause Failures 3 Demand value; no offsite power recovery G S Page133of453
i O O O TABLE 5.6-2
SUMMARY
OF RESULTS - WITH CANDIDATE MODIFICATIONS 4 1 LOMFW LOOP i CASE AFW F.P. SG DRYOUT FREQ. AFW F.P. SG DRYOUT FREQ. I 7.0E-7
- 1. Best Estimate 2.9E-6 5.8E-8 8.7E - No parametric CCFs 1.8E-52 N/A 3
\
- 2. Best Estimate 3.1E-5 6.2E-7 3.7E-5 3.0E-6 4.6E-5 J
- With parametric CCFs N/A
- 3. Upper Bound 3.8E-5 7.6E-7 1.9E-4 1.5E-5
- With parametric CCFs 3.5E-4 N/A
- 4. Lower Bound 1.9E-6 3.8E-8 5.0E-6 4.0E-7 8.8E-6 N/A i
.i 1 24-hours including offsite power recovery 2 Demand value; no offsite power recovery I -l
)
Page 134 of 453 __ _ . , _ , . -% ,.m.. ~ .
k
6.0 REFERENCES
- 1. Generic Evaluation of Feedwater Transients and Small Break Loss-of-Coolant Accidents in Westinghouse-Designed Goerating Plants, NUREG-0611, January 1980.
- 2. R. A. Bari et al., Probabilistic Safety Analysis Procedures Guide, NUREG/CR-2815, BNL-NUREG-51559, August 1985.
- 3. H. Wyckoff, Losses of Off-Site Power at U.S. Nuclear Power Plants: All Years Through 1983, NSAC-80, Electric Power Research Institute, July 1984.
- 4. L. G. Rayes et al., WAM User's Manual, RP-2507-1, SAI-83/1203, Science Applications, Inc., May 1984.
- 5. K. N. Fleming et al., A Systematic Procedure for the Incorporation of Common Caure Events into Risk and Reliability Models, Presented at Nuclear Engineering and Design International Seminar, August 1985.
- 6. C. L. Atwood, Data Analysis Using the Binomial Failure Rate Common Cause Model, NUREG/CR-3437, EGG-2271, EG&G Idaho, Inc., September 1983.
- 7. C. L. Atwood, Common Cause Fault Rates for Pumps: Estimates Based on Licensee Event Reports at U.S. Commercial Nuclear Power Plants, January 1, 1972 Through September 30, 1980, NUREG/CR-2098, EGG-EA-5289, EG&G Idaho, Inc., February 1983.
- 8. J. A. Steverson and C.L. Atwood, Common Cause Fault Rates for Valves:
Estimates Based on Licensee Event Reports at U.S. Commercial Nuclear Power Plants, 1976-1980, NUREG/CR-2770, EGG-EA-5485, EG&G Idaho, Inc., February 1983.
- 9. J. A. Steverson and C. L. Atwood, Common Cause Fault Rates for Diesel Generators: Estimates Based on Licensee Event Reports at U.S. Commercial Nuclear Power Plants, 1976-1978, NUREG/CR-2099, EGG-EA-5359 Rev. 1, EG&G Idaho, Inc., June 1982.
- 10. C. L. Atwood, Common Cause Fault Rates for Instrumentation and Control Assemblies: Estimates Based on Licensee Event Reports at U.S. Commercial Nuclear Power Plants, 1976-1978, NUREG/CR-2771, EGG-EA-5623, EG&G Idaho, Inc., February 1983.
- 11. Nuclear Power Experience, The S.M. Stoller Corporation, Boulder, Colorado.
- 12. K. N. Fleming et al., Classification and Analysis of Reactor Operating Experience Involving Dependent Events, NP-3967, Electric Power Research Institute, June 1985.
J O Page 135 of 453
APPENDIX A ., AUXILIARY FEEDWATER SYSTEM FAULT TREE ANALYSIS - i ( a l O . i d f O Page 136 of 453
,c - - - - -
i-- , - - . - . , - , . , - , , . _ . . . , _ . , , , _ , , , , , . , _ _ . . , , , , . . , ,
r . j TABLE OF CONTENTS Page O.
1.0 INTRODUCTION
. . . . . . . . . . . . . . . . . . . . . . . . . . . . 139 2.0 GENERAL DESCRIPTION OF THE FAULT TREE METHODOLOGY EMPLOYED . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139 2.1 Logic Gates . . . . . . . . . . . . . . . . . . . . . . . . . . 139 2.1.1 OR Gates . . . . . . . . . . . . . . . . . . . . . . . . 139 2.1.2 AND Gates ....................... 139 2.2 Primary Events ........... ........... 141 2.2.1 Basic Events . . . . . . . . . ........... 141 2.2.2 Undeveloped Events . . . . . . ........... 141 2.3 Transfers . . . . . . . . . . . . . . . . . . . . . . . . . . . 142 2.3.1 Transfer In ...................... 142 2.3.2 Transfer Out . ..................... 142 3.0 BASIC EVENT CODING SCHEME ..................... 143 3.1 Basic Event Code ....................... 143 3.2 Interface Code ........................ 143 h
4.0 TREATMENT OF RECOVERY ....................... 150 4.1 Approach Used to Treat Recovery in this Analysis ....... 150 4.1.1 Fault Detection ... ................ 150 4.1.2 Recoverable Failure .................. 151 4.1.3 Viable Recovery Action . . . . . . . . . . . ...... 151 4.1.4 Other Backups ..................... 153 4.2 Summary of Method Used for This Analysis .......... 153 5.0 TREATMENT OF HUMAN ERROR . . . . . . . . . . . . . . . . . . . . . . 154 6.0 RESULTS .............................. 154 6.1 System Description ... .................. 154 6.2 Major Assumptions Used in Fault Tree Development ....... 167 6.2.1 General Assumptions .................. 167 6.2.2 Assumptions Regarding Operator Response ........ 167 6.2.3 Modeling Assumptions . . . . . . . . . . . . . . . . . . 168 6.2.4 System Design Assumptions ............... 169 6.2.5 Assumptions Regarding Additional Faults Excluded from the Model ................ 171 O Page 137 of 453
( w i ~I)i . . TABLE OF CONTENTS (continued) Pag,!! t 6.3 The Auxiliary Feedwater System Fault Tree . . . . . . . . . . . 173 ! 6.4 Human Reliability Analysis .................. 214 { , 6.4.1 HEPs Obtained from Existing Work . . . . . . . . . . . . 219 6.4.2 HEPs Obtained from Engineering Judgement . ....... 219
- i. 6.4.3 Detailed Human Reliability Analysis .......... 219 4
- 4. 6.5 Quantitative Results ..................... 219
7.0 REFERENCES
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 228 1
4 i r 4 4 l i i i i-i t i e i i l' i i i Page 138 of 453
1.0 INTRODUCTION
The auxilit.ry feedwater system fault tree was developed with standard fault tree methods. This appendix explains the specific application of those methods for this analysis and provides insights into the interpretation and use of the auxiliary feedwater system fault tree. 2.0 GENERAL DESCRIPTION OF THE FAULT TREE METHODOLOGY EMPLOYED The auxiliary feedwater system fault tree is a logical representation of the various ways the system can fail and in so doing create the conditions necessary to cause the " Top Event" in the fault tree to occur. This logical relationship of events is depicted in the fault tree by the use of logic gates, primary events and transfers. Figure A.1-1 provides an example of each of these symbolic devices. The use of each is discussed below. 2.1 Logic Gates Two types of logic gates are used to construct the logical relationship among elements of the auxiliary feedwater system -- OR gates and AND gates. 2.1.1 OR Gates OR gates are used to depict the logical "0R" failure condition that exists between related components or events. For example, if two components exist serially in a functional " path" for operatior of the auxiliary feedwater system, then failure of either component will result in failure of the functional path. That is, if one component OR the other fails, the function will fail. Thus, these components are logically combined with an OR gate. . 2.1.2 AND Gates AND gates are used to depict the logical "AND" failure condition that exists between related components or events. For example, if two related components must fail before an auxiliary feedwater system function they support fails, then their logical relationship is depicted with an AND gate. Components in parallel paths often are developed with AND failure logic. That is, one component AND the other component must both fail before the function they provide fails. O Page 139 of 453
LOGIC GATES: OR Gate H AND Gate 4 U < 1~ PRIMARY EVENTS Basic Event 4 Undeveloped Event l O '- TRANSFERS: Transfer In O f Transfer Out O ' Figure A-1 Fault Tree Symbols 3 Page 140 of 453
2.2 Primary Events A primary event is an event that represents the extent of the resolution boundary for the fault tree being developed. Typically, these are the events for which failure probabilities will have to be provided if the fault tree is to be used for computing the probability of the top event. The auxiliary feedwater fault tree contains two primary events -- basic events and undeveloped events. The former requires a failure probability while the latter, in this case, does not. Each is discussed below. 2.2.1 Basic Events The basic event describes a basic initiating fault event that requires no further development. Component failures and human errors typically comprise most basic events. Each basic event will have to be assigned a failure probability before an accurate estimate of the system unreliability can be aetermined. Examples of basic events are pump failures and operator response errors during accident conditions. Basic events in the auxiliary feedwater system model are always accompanied by a basic event name. This name, or basic event " code", is used for both identification and quantification purposes. The naming scheme for basic events is the subject of a subsequent section of this appendix. Consistent use of the basic event naming scheme allows for accurate assignment of basic event probabilities, quick identification of the events when they occur in cut sets and, most importantly, correct logical representation of intrasystem and intersystem dependencies. This latter use of the naming scheme provides information to the WAMCUT quantification code so that it can accurately calculate the effects of system dependencies and properly depict those dependencies in the system cut sets. If two auxiliary feedwater system subfunctions (e.g., cooling of the 11 pump and cooling of the 21 pump) rely on proper function of the same component, then the basic event naming scheme will identify this functional dependency on the single component because the component will appear in the failure logic for both subfunctions. WAMCUT can then properly combine the resulting failure logic and both calculate the correct probability of failure, given this functional dependency, and illustrate the dependency in the resulting cut set listing. The same method and resulting WAMCUT processing is used to properly account for intersystem (or support system) dependencies. 2.2.2 Undevelooed Events Undeveloped events are specific fault events that require no further development for any of several reason::. Undeveloped events are used when the event described is of insufficient consequence and will not impact the results of the analysis. They are also used when the information required to quantify the described event is insufficient for proper application to the model. Another use for undeveloped events is to depict general faults that could be developed fur +.her but whose resulting quantification would already be included in other component failure rates. In all cases the undeveloped event is used to complete the logical representation of all contributing faults regardless of their ability to be accurately quar.tified. Page 141 of 453 [
7] ~For this model only the latter use of undeveloped e > emp'oyed. That is,
'V -all of the undeveloped events in the auxiliary fe w used strictly to illustrate other potential areas of '
<st-d-
'ault tree are
. opment that would complete the fault tree to a consistent level of However, development was not undertaken because the analyst real u .nat resultant quantification of the undeveloped logic would result in duplication of values
..already obtained at a higher level of resolution in the tree. For example, auxiliary feedwater pump lubricating oil system faults were not developed because the pump " component" fault probabilities (i.e., the pump fails to start
. or fails to run) already include pump failures that result from faults in the pump's lubrication system. Since undeveloped events are not used in quantification of the auxiliary feedwater system fault tree, no names were assigned to the individual undeveloped events. 2.3 Transfers Transfers are the devices used to accurately and consistently " guide" the logic (and the analyst) from one page of the fault tree to another. Two types of transfer devices are used to provide this page-to page transition -- the transfer "in" and the transfer "out". The names of the two transfer devices can be somewhat misleading until one realizes that a fault tree is a deductive model and is therefore read and quantified from the bottom up. When this perspective is used the names of the transfers become more descriptive. Although transfers are used in the auxiliary feedwater system model strictly for p). ( page-to page continuity, transfers are also often used for on page connection of logic. When transfer.s are used in this manner their interpretation remains virtually the same as when they are used for page-to page transfer of logic. ' On page transfers are not employed in the auxiliary feedwater fault tree. 4 2.3.1 Transfer In The transfer in is used to indicate the logical connection of other logic to the point where the transfer in symbol is located. To accurately track the logic flow unique transfer numbers are used to indicate the location where the incoming logic should flow. As an aid in verification of proper transfer, the transfer block will normally contain a replicate statement of the transferred event. The page number of the associated transfer out symbol is also located in the immediate vicinity of the given transfer. 2.3.2 Transfer Out The transfer out is used to indicate the transfer of logic flow from the point where the transfer out symbol exists to the point where the corresponding transfer in symbol exists. _ This is accomplished by numbering each transfer and using the same number of the related transfer in symbol. The fault tree page number where the related transfer in symbol can be found is located in the vicinity of the r, roper transfer number. In cases where developed logic is transfarred to more than one transfer in symbol there will be multiple transfer out number: and related page numbers. For proper transfer varification the statement associated with the transfer out logic will be repeated at the point O in the fault tree where the correct transfer in symbol exists. i Page 142 of 453
Thus, by consistently numbering transfer symbols, providing associated page . numbers for each transfer, and duplicating related transfer descriptions, the process of tracing the logic flow through the multipage auxiliary feedwater system fault tree becomes a trivial task. 3.0 2aSIC EVENT CODING Sd;EdC Fault tree input for the IBM version of WAMCUT is limited to a maximum of eight (8) characters for any basic event name. Therefore, the following fault tree coding scheme is used to name and identify basic events in the Prairie Island auxiliary feedwater system fault tree. 3.1 Basic Event Code Basic events in the Prairie Island auxiliary feedwater system fault tree are consistently named or coded with the following coding scheme: ABBCCCCD Where: A = System Code (Table A-1). BB = Component Code (Tables A-2 & A-3). CCCC = Component Identifier (A User-Supplied Alphanumeric). D = Failure Mode (Table A-4). Example: Failure of the Prairie Island Unit 1 turbine-driven auxiliary feedwater pump (#11) to start on demand is coded as: APT 00115 All eight character positions are utilized. This preserves the spatial orientation of the various basic event codes and thus provides consistent representation and ease of interpretation of each of the basic events when they appear in the tree or in WAMCUT output as cut sets. 3.2 Interface Code System interfaces are also consistently named for reasons similar to those for the basic event coding scheme. The auxiliary feedwater system interfaces are named or coded with the following scheme: ABBBBBBB O Page 143 of 453
Where: . A = Always the letter "I" to identify the event as an auxiliary feedwater system interface. i 8888888 = Interface Identifier (A User-Supplied Alphanumeric). Examples: IBUS16 = 4160V Bus 16 IU1CWSUP = Unit 1 Cooling Water Supply Header The only restriction is that the first character be the letter "I". All other characters are used by the analyst to identify the interfaces as they appear in l the fault tree and to provide a mnemonic for later ease in interface identification. t 1 4 O i Page 144 of 453
<r~ ~np. .
a,qw - e- - - - - - - - , , , m~ eve,+.--+ *smw-,~- 4-,nwe.e , w r-nnne - - -+,y,---.- . ~- - - - .-m.- w-- - w -- -- - - - - -- - - -- ,- .
TABLE A-1 : SYSTEM CODE CODE SYSTEM NAME A Auxiliary Feedwater C Condensate F Independent Failure Module (Used for quantification) (Not used in the detailed fault tree) I System Interface (Used to code transfers to other systems) M Main Feedwater W Cooling Water O O Page 145 of 453
,e'~'N TABLE A-2 : -(_./ -
MECHANICAL COMPONENT CODE CODE MECHANICAL COMPONENT 1 - AC Accumulator AM Air Motor AT Air Tank CH Chiller CL Clutch CM Compressor CN Condenser DL Diesel FE Flow Element FL Filter FN Fan GV Governor HX Heat Exchanger NZ Nozzle OR - Drifice PD Pump (Diesel-Driven) PM , Pump (Motor-Driven) PP Pipe PT Pump (Turbine-Driven) RD Rupture Disk SL Seal ST Strainer i TB Turbine TK Tank VA Valve (Air-Operated). ' VB Vacuum Breaker VE Valve (Solenoid-Operated) VH Valve (Manual) VK Valve (Check) VM Valve (Motor-Operated) VO Valve (Hydraulic-Operated) VR Valve (Relief) f-- VS Valve (Safety) ( XX Train- or System-Level Identifier , Page 146 of 453
TABLE A-3 ELECTRICAL COMPONENT CODE CODE ELECTRICAL COMPONENT AM Amplifier AN Annunciator BA Battery BC Battery Charger BS Bus CA Cable CB Circuit Breaker CK Control Circuit CN Contacts CP Capacitor DC DC Power Supply DI Diode or Rectifier DP Distribution Panel FU Fuse GE. Generator HR Heater HT Heat Tracing IN Inductor IV Inverter LA Lightning Arrestor LT Light MC Motor Control Center (MCC) MR Motor ND Neutron Detector PI Process Indicator (e.g. , Pressure, Flow, etc.) PT Process Transmitter RC Recorder RE Relay RS Resistor l 1 Page 147 of 453 ! I I 1 l
TABLE A-3 . (v~'T ELECTRICAL COMPONENT CODE CODE ELECTRICAL COMPONENT SA Switch (Automatic Transfer)' SC Speed Controller SG Switch (Ground) SK Switch (Lock-out) SL Switch (Limit) SP Switch (Process) (e.g., Pressure, Flow,etc.) SS Solid State Device ST Switch (Torque) SW Switch (Manual) TA Transformer (Current) TB Terminal Board TC Transformer (Control) TE Temperature Element (General) TI Timer / Timing Device TR Temperature Element (RTD - Resis. Temp. Device) TT Temperature Element (Thermocouple)
. O- TV TW Transformer (Voltage)
Transformer (Power) . WR Wire , XX Train- or System-Level Identifier 4 ZI Position Indicator ZT Position Transmitter f v v O Page 148 of 453
TABLE A-4 FAILURE MODE CONTROL CODE FAILURE MODE Passive A Short to Power 8 Short to Ground C Open Circuit D No Output E Erroneous Output F Does Not Remain Open (Plugged) G Excessive Leakage / Rupture / Premature Open/ Does Not Remain Closed H Unavailcble Due to Common Cause Failure I Unavailtble Due to Testing J Unavailable Due to Maintenance Active K Does Not Close M Does Not Open R Does Not Continue to Run S Does Not Start T U Does Not Operate (R & S Combined) Does Not Energize h X Operator Testing or Maintenance Error Y Operator Operational Error Z Operator Detection / Correction Error l l O Page 149 of 453 l-
1 J 4
- f. 4.0 TREATMENT OF RECOVERY
( The term " recovery" as used in reliability analysis generally refers to
, post-accident acts that are necessary to return a faulted component to service so that.it may aid in mitigation of the accident. Typically, post-accident
, - recovery credit is taken for component actuation faults or preaccident mispositioning faults, but recovery credit is not taken for general repairs or for heroic actions. Realistic-treatment of component failures must consider these recovery acts. Otherwise, the results of the reliability analysis may be overly conservative. Any conclusions drawn from these results may be distorted by this conservatism. Therefore, to realistically consider faulted components
- and the general influence of recovery of these faults on the overall results of
- the analysis, an evaluation'of the potential for recovery of faulted components must be performed.
No prescribed approach to recovery evaluation is uniformly practiced by reliability analysts. Typically, the major contributors to .the undesired event - (i.e., the cut sets with the highest probability of occurrence) are analyzed . without considering recovery. Then each cut set that contributes significantly to the undesired event is examined in detail and an appropriate nonrecovery factor is combined with the other terms in the cut set to develop a new cut set probability. This new cut set probabflity can be simply thought of as the , probability of occurrence of the original cut set (i.e., the faults represented by the criginal elements of the cut set) given one or more of the original elements of the cut set can be recovered. The nonrecovery factor is then j defined as the probability that the necessary recovery act or acts will not be
- "s possible or will not occur. Since these nonrecovery factors can often have values in the range of 0.1 to 0.01, a significant change in individual cut set probatiilities can be realized. When the. appropriate changes for each cut set .
are taken in aggregate, the undesired event probability or frequency of occurrence can often be decreased significantly and the major contributors to i occurrence of the undesired event can be changed dramatically. Thus, treatment of recovery is a very important task in development of realistic analytical results. 4.1 Approach Uced to Treat Recovery in this Analysis i i- Figure A-2 depicts the general approach used in this analysis to logically determine whether or not recovery of an individual component fault will be i considered. lI 2 j 4.1.1 Fault Detection If there is no means of readily detecting failure of a specific faulted component, then it follows that recovery of the component, if recovery is possible, will be left strictly to chance. Hence, the first step in consideration of recovery for a given faulted component or undesired event is to determine whether or not the operator can detect the specific component failure.
- If the component failure can be readily detected, then the failed component
- . remains as a candidate for recovery. If the failure cannot be detected, no '
recovery action will be assumed and the component will remain " failed" for purposes of this analysis. O . Page 150 of 453 i _ - ~ _ _ - _ . , _ _ , _ . _ _ _ _ _ . . . _ . _ _ . , _ _ _ . , _ _ _ , _
n Alarms and indirect indications such as meters and lights on the control room panels often provide adequate means of detection for faulted components. If these alarms or indications are capable of correctly indicating the failure state of a component during postulated accident conditions, then adequate detection of the component failure will be assumed and the next recovery question will be asked. Otherwise, the component will be considered failed as is and the failure will be treated as nonrecoverable. 4.1.2 Recoverable Failure Another important recovery consideration is whether or not the componNt has failed in a recoverable state. A catastrophic failure of a component often requires component replacement or extensive component repair before recovery of the component function is possible. In these cases, it is unreasonable to consider recovery of the component in the analysis. Thus, recovery consideration at this juncture will require careful evaluation of the events that lead to the component failure and a determination of the impact of those events on the failure mode of the component. If catastrophic failure has not occurred, the component failure remains a candidate for recovery. If catastrophic failure occurs, the component will remain failed. However, since detection of the component failure is implicit by virtue of considering the nature of the component failure (i.e., the logic path leads to this point only if a component failure is detected), a backup component's function may be substituted for the function of the failed component. If this substitution is possible, it could lead to what is in effect a recovery of the failed component's function. Treatment of appropriate backups is discussed in a section that follows. Running a diesel without lubrication, cavitating a pump that is not designed to cavitate and operating a motor under over-current or under voltage conditions are all examples of conditions that could lead to catastrophic failures of the respective components. If the accident conditions or related support system failures lead to these conditions, one must consider the resulting effects on the component. Often these effects will lead to catastrophic failure and nonrecovery. 4.1.3 Viable Recovery Action Should the component failure be detected and the component failure mode be such that it is possible to recover the function of the component, there still remains the question of viability of the necessary recovery actions. The component must be located such that the necessary actions are possible. The specific cause of the failure must be known so that appropriate recovery actions can be taken. There must be time to perform the recovery actions before the lack of the component function results in degradation of the accident conditions to the point where success of the component function will no longer matter. Such factors as lighting, locked doors, high radiation areas, high temperatures, proper communications and necessary procedures all influence the viability of a specific recovery action. Each of these must be considered before final assignment of a nonrecovery probability to a given failure or set of failures will be appropriate. O Page 151 of 453
O 3 5 4 f o tY DR RY ER 2 5 0IDW DEV 1 0 SO _ gS O I e NC OE NC OE g CR a P C\R , S S E Y E Y / O P O Y R y r ULE fRN/' tWI 8 O T N mAB7 N V OV NO E C e v o c MC EA AM B E e AO\C R R R t o h c a o r S S p E p W O Y A l a
/ r e
B E A R U EL' R/ I O N I % PS U NS7 T I A EX O N V OV NO Y R E C C n e OAN C F B E R 2 A
' e r
u g i 4 F S W N/ Y TI O LT UC? AE
/ O N
V OV NO R E FTE D N R C E
'\
O MW T Y R NO ._. OC C ER
! ;l { ,lI j
l As an example, consider a turbine-driven pump that is unavailable due to a trip -
~
of the mechanical overspeed trip mechanism. Assume the failure can be detected by an alarm in the control room, that local resetting of the trip will render the pump operable once the conditions that caused initial overspeeding are corrected, the auxiliary operators have all been trained in the correct procedures for resetting the trip and that time exists for correction of the original conditions for overspeed. If the original need for the pump w s caused by a fire in the room where the pump is located, recovery of the pump will probably not be viable. Thus, careful consideration of all viable recovery actions is necessary before finally assigning a nonrecovery value to a faulted component. Should the failure be detectable, recoverable, and recovery viable, it will be considered appropriate to assign a nonrecovery factor to the cut set containing the failure. 4.1.4 Other Backups Even though a specific component failure cannot be recovered, it is possible that there are other means of supplying the appropriate component function. If a backup function exists and can be successfully implemented, then it is appropriate to consider the backup as a recovery factor for the given component failure. Failure of implementation of the backup function is treated similarly to that of failure of the given component's recovery. That is, it will be necessary to first consider the existence of an appropriate backup and then to consider the viability of that backup. Should the backup be available and viable, then an appropriate nonrecovery factor can be considered in conjunction with the failed component's original cut set elements. For example, the condensate storage tanks (CSTs) could be an appropriate backup to the normal cooling water supply to the auxiliary feedwater pumps should the normal supply fail. However,,before final acceptance of this backup as a substitute for the normal cooling function, one must carefully consider the viability of the CST source. Piping exists for such a configuration (i.e., the configuration where the auxiliary feedwater pumps are cooled with CST water as opposed to Cooling Water System water). However, the operator must take local actions to initiate such cooling, lack of cooling water pressure may result in flow diversion of the CST water, and procedures for aligning valves for this flow configuration do not exist. Factors such as these must be evaluated before the CSTs could be appropriately considered as a viable backup to the normal cooling water supply. Even if the backup is ultimately considered to be appropriate, these viability factors will have a significant influence on the magnitude of the resultant nonrecovery factor. 4.2 Summary of Method Used for This Analysis Treatment of recovery for this analysis will use classic techniques. Appropriate nonrecovery factors will be applied to the cut sets that are important contributors to the overall system unavailability in order to minimize the conservatism in the analysis that would result if recovery were not considered. A logical and systemmatic approach will be used to guide the decision as to the appropriate treatment of recovery on an individual failure basis. O Page 153 of 453
(~i 5.0 TREATMENT OF HUMAN ERRORS V An important aspect of the Auxiliary Feedwater System fault tree analysis is the treatment of human actions required for successful system operation. Given the high degree of reliability offered by most hardware design and the redundancy of design for many of the system functions, human interfaces with the system are often significant contributors to system unavailability. This contribution may manifest itself in errors in the restoration of equipment to operability following test and maintenance activities or in errors in manipulating equipment in response to accident situations. On the other' hand, operators may take actions to correct misalignments of equipment or to overcome failures in order to resore vital system functions. Thus, the consideration of the operator as another important component in the overall operation of the Auxiliary Feedwater System cannot be overlooked. This analysis used several different methods to analyze the importance of the operator interface. Fault tree development identified the components where operator influence could impact the availability of the system. Once these interfaces were identified, each was evaluated as to its overall contribution to the failure probability of the Auxiliary Feedwater System. Many of the operator error probabilities were assumed to be contained in the plant-specific failure data gathered and analyzed for the individual components. Others were evaluated and assigned error probabilities based on existing work that fit the particular type of human error in question. Some human errors were specifically modeled using classic human error analysis techniques, while others were assigned values based on engineering judgement. A discussion of each of these techniques and the resulting human error probabilities used for the analysis are contained in a (7 subsequent section of this appendix. d 6.0 RESULTS The Prairie Island Auxiliary Feedwater System was analyzed, using the fault tree methods describe above, to determine its failure probability given either a complete loss of feedwater or a complete loss of offsite power. The results of the analysis are discussed in the sections that follow. 6.1 System Oescription The Auxiliary Feedwater (AFW) System supplies feedwater to the steam generators following the interruption of the main feedwater supply. If the reactor trips and the main feedwater pumps cease to operate for any reason, feedwater must be provided for the removal of core residual heat by heat exchange in the steam generators. AFW System operation is required during both normal transient conditions (unit start up and shutdown) and abnormal transient conditions (e.g., loss of main feedwater, loss of offsite power and station blackout). The Auxiliary Feedwater System, shown in simplified form in Figure A-3, consists of one steam turbine-driven and one ac motor-driven pump per unit. Each pump is a five-stage, horizontal, centrifugal pump with a capacity of 220 gpm at 1300 psia. One pump per unit is driven ty a 300 hp ac motor which is powered from the unit safeguards busses (Pump #12: Safeguards Bus 16, Pump #21: Safeguards Bus 26). One pump per unit is driven by a Terry steam turbine supplied from the unit's Main Steam Supply System through an air-operated steam inlet control n valve. The turbine is equipped with a Woodward governor and an overspeed V trip / throttle valve. The overspeed trip is mechanically actuated by the speed of the turbine shaft. Oversp!ed results in tripping mechanical linkage that shuts the trip / throttle valve and isolates steam flow to the turbine. Page 154 of 453
er-te-e w-is-e j . j c)ylfgW+H/ /
/
N---{X}-) ** Sitaa Eda *TS
<ater> <aise) /
/
gj,s,,3 gg,3 u -se- w-i6-i en stem awasta a'kUIS(-D()M-f mei) <ai6i) y f g,-l,* ,* ,l,e,-. f 3 nv-see g X-0 ""YI.',10-X X-0rcler = ' =, " ,3'f*=
<e e X-0 nv:>)ee.2
<e ,,
n es O O n n v v nv-se,,3,e
, g-wwe gv, geni ,y_,,,,
nv-wgez Mv-wa! X-0 m,3'"* Wi>1'
NE "iK171 "uld .t .10 3 * .t 03' "uM{'t tnis?i' t13' .103' y k
i car-lu (2AJi> rame scen t o ssee rnan scu re scia H-H nv-scoi, "dMX "-TiO firi""' X T2'
" 'i' X E#*
"#M X "E <e . -
p*o 'sw.= "53,5 4 4 !!a' airs,s 4 4 gras-i "31,1 Zt Zt 53" Z t f.'2 " 2 45 Z t O '[-0 21" X-D %3"
.e. .ie Cd C2 .eeG k 1: CV-moS9 G2e CV-31060 TO.Y3' Tj.*s>' T#.*i>' TO.*i[
n N- N- -- 4 2 8 #Ei3 [33sf W i3 Y3335 h; --sgX-0 "v-'7.iD-X "v-'w)X-0 ~ - ' =X-G TE*!il s, : ) ) X ) ) N sr
= a. =;r 1E'lif g-; ,
- n. m !
Cla" > X N ' ,Jh'? P LJA a 4 pocot 3 = 33 for Pekadtty stue6 ens.c Figure A-3 Simplified Diagram of the Prairie Island Aux ry Pecdwater System Page 155 of 4
1 I (l Three 150,000 gallon condensate storage tanks (CSTs) provide the primary source - t x j' of AFW pump suction supply. A common suction header, shared among the three l' CSTs and the four AFW pumps, pipes the CST water to the suctions of the four AFW , pumps. The Cooling Water System provides a backup suction supply to the AFW ) i pumps. The backup suction supply is used when the CSTs are unable to provide ! sufficient suction for operation of the AFW pumps. ; The Cooling Water System also cools the lubricating oil for each of the AFW pumps. Unit 1 Cooling Water supplies cooling water for AFW pumps #11 and #21. Unit 2 Cooling Water supplies cooling water for AFW pumps #12 and #22. Cooling water.to each of the turbine-driven pumps also cools the turbine bearings and l the governor on each turbine. This dependence.of the AFW system on cooling water supplied from the Cooling Water System is shown in simplified form in Figure A-4. Should the normal cooling water supply to the AFW pumps bec.ome l unavailable, there is a means of using the water in the CSTs as a backup source of cooling water for each AFW pump. Referring to Figure A-4, by opening a f manual valve in the AFW pump CST suction line (not shown in the simplified diagram) and by opening valve CL-92-6, an operator could align CST flow to the
#11 AFW pump lubricating oil cooler.
The AFW pumps discharge to the steam generators via a 3-inch discharge line. The AFW pumps for each unit (Unit 1 - #11 & #12 ; Unit 2 - #21 & #22) can supply either of the unit's two steam generators by operating motor-operated valves to direct flow to the desired steam generator. In addition, manual cross-connect valves are provided between the two motor-driven pumps to allow a meter-driven l . pump to feed the steam generators in the opposite unit. (j) The AFW System is automatically actuated by a Steam Generator Lo-Lo Level signal, a Safety Injection signal, or a trip of both main feedwater pumps. In addition, the turbine-driven AFW pump is actuated when an undervoltage is sensed on both of the power supply busses to the main feedwater pumps. The auxiliary feedwater pumos automatically trip on low suction pressure (4 inches cf Hg vacuum) or low discharge pressure (500 psi for the motor-driven pump, 200 psi for the turbine-criven pump). In addition, the motor-driven pump is tripped by a load rejection signal from the associated safeguards bus and is restarted by a related load restoration signal. Figure A-5 summarizes the AFW pump control circuit interfaces. Table A-5 summarizes the actuation inputs for the pump control circuits. Figures A-6 through A-11 provide simplified diagrams of the power supplies for the control circuits of key components in the AFW System, simplified control circuits for those components, and simplified diagrams of key actuation logic considered in the system analysis. These diagrams are useful for summarizing important information used to perform the AFW System dependency analysis, which is discussed as a separate appendix to this report. The AFW pumps are it.bricated by two different lubricating oil pumps. One is attached directly to the shaft of the AFW pump, while the other is installed in the ' auxiliary feedwater pump lubricating oil system and is driven by an ac motor. The former is referred to as the shaft-driven oil pump, tne latter is known as the auxiliary oil pump. LJ Page 156 of 453
81 3 F M
, -a ,a g
. +
i
- 6 s: B i 3 a E s E s j kj >- l > 4 >-- l
>4
>- l kj >-
t t t td t t - t td d d 9 _E t a t a 3 [ 5 0 5.0
. 3 _b _
E
- e. 1 1 a k k 1 . 1 '
1 . 1
- 1. + ' . B1 + 1. + ' o B1 + '
0 d [e! d [gIe b d [$a d [!e ! i t i c l .* . l
=
e Xi: , , Xil - a- e c -> B l E s =
@ =
G le
7 During operation the shaft-driven pump provides lubrication for the auxiliary [d feedwater pump. When oil pressure falls below 8 psi, the shaft-driven pump catput is augmented by the auxiliary oil pump. An alarm will sound in the control room if the auxiliary feedwater pump oil pressure falls below 8.5 psi. When the AFW pumps are idle, the auxiliary oil pumps start once every 24 hours and operate for approximately 15 minutes. This operating cycle will provide ample prelubrication of the AFW pump bearings and thereby allow for starting of the AFW pumps regardless of the condition of their related auxiliary oil pumps.
; This is important for situations where the turbine-driven AFW pumps are required to operate when there is no ac power to supply the auxiliary oil pumps.
Since the AFW System will start and feed the steam generators automatically upon receipt of an actuation signal, operator intervention wi+,h AFW system operation is unnecessary except for recovery actions. Typical recovery actions considered in the analysis are 1) manual cpening of the Unit 2 cross-connect valve in order to use the #21 AFW pump, 2) shifting of the AFW pump suction path from the CSTs te the Cooling Water System, and 3) using the CSTs as an alternate source of
- cooling water to the AFW pump lubricating oil system. Each of these actions will be discussed in further detail in the section of this appendix that discusses treatment of human reliability for this analysis.
With the system design discussed above, each unit effectively has up to three trains of auxiliary feedwater available for response to most transient conditions. However, differing plant conditions, varying system effects that result from progression of the transients, and differing operator re:ponse to each transient could vary the availability of each train considerably. l O Pape 158 of 453
TABLE A-5 ATW PUMP CONTROL CIRCUIT ACTUATION INPUTS ACTUATION INPUTS PUMP 12 PUMP 11 PUMP 21 BCR BLC BCR BLC BCR BLC 1.0 AUTOMATIC TRIPS 1.1 IDAD REJECTION TRN 8, BUS 16 N N N/A N N TRN A, BUS 26 N N TRN B, BUS 16 N N N/A N N TRN A, BUS 26 N N 1.2 RESTARTS PUMP INDEPENDENT N Y INDEPENDENT H Y INDEPENDENT H Y 1.3 LOW DISCilARGE PRESS. INDEPENDENT N Y INDEPENDEVI N Y INDEPENDENT H Y 1.4 LOW SUCTION PRESS. 2.0 MANUAL C0tTTROL 2.1 C.R. CONTROL SWITCll INDEPENDENT INDEPENDENT INDEPENDENT 2.2 C.R. SELECTOR SWITCll INDEPENDENT INDEPENDENT INDEPENDElfr 3.0 Atrit)MATIC STARTS 3.1 SAFETY INJECTION TRN B, UNIT 1 TRN A, UNIT 1 TRN A, UNIT 2 3.2 11 SC LL LEVEL TRN B, UNIT 1 TRN A, UNIT 1 TRN A, UNIT 2 3.3 12 SC LL LEVEL TRN B, UNIT 1 TRN A , UNIT 1 TRN A, UNIT 2 3.4 FEEDWATER PUMP OFF 11* 11* 21* 3.5 FEEDWATER PUMP OFF 12* 12* 22* 3.6 IDAD RESTORATIONS N/A YES N/A 4.0 AUTO CONTROL AUX LUBE 4.1 LUBE OIL PRESS Y (IND) Y (IND) Y (IND) 4.2 LUBE OIL PRESS Y (IND) Y (IND) Y (IND) 4.3 LOCAL PUSil BUTTONS Y (IND) Y (IND) Y (IND) TO STOP
- REQUIRES B0111
= INDEPENDENT
- c. n, a A
(~- 5 v
/
\v/ (u .s
/
CIRCUIT / BREAKER POUCR/ AIR TDR , q AC POWER / AIR , g gy PUMP 12 16-1 12 16 21 26-0 21 26 12 145-331 11 f.v. 21 245-331 11 SV-33299 n 11 CV-31998 f.v. = FAILS VENTED CONTROL CIRCUlT m PANEL 12 (12P1) CONDENSATE SYSTEM : SG BLWDOWN < 12 < CONTROL POWER 12 SV-33288 (SOLENDID FOR CV-31682) PANEL 21 (21PS) CONDENSATE SYSTEM : SG BLOWDOWN < 21 < CONTROL POWER 21 SV-33494 (SDLEr'0ID FOR CV-31683) PNit 11 (11P20) CONIENSATE SYSTEN < SG BLOWDDtJN < 11 < CONTROL POWER 11 SV-33287 (SOLEN 0!D FOR CV-31681) , 8 ACTUATION CIRCUIT ACTUATION CIRCUIT
; PArCL 16 TROM PANEL 12 e OUTPUTS ALSO INCLUDC.
EI PANEL 25 FROM PANEL 21 EQUIPMENT HEAT REMOVAL g,,g ,xt Pog, CHEMICAL TEED 11 PNCL 15 FROM PANEL 11 eno6o74v Pigure A-5 Summary of AFW Pump Control Circuit Interfaces. Page 160 of 453
9 4 l l l l 1RY -- 2RY DG1 PANEL 11/21 DG2 PANEL 12/22
) NC >C NC( NC(
PANEL 12 PANEL 22 PANEL 11 PANEL 21
)m J l* m( )m J L> m(
4160V 4160V 4160V 4160V BUS 15 BUS 26 BUS 16 BUS 25 101 (YY m 201
/'YY m 102 (YY YY"N 202 (YY m 480V 480V 480V 480V BUS 110 BUS 210 BUS >20 BUS 220 480V MCC 480V MCC 480V MCC 480V MCC 1A BUS 1 2A BUS 1 1A BUS 2 , 2A BUT 2 480V MCC 480V MCC 480V MCC 480V MCC 1AC BUS 1 2AC BUS I 1AC BUS 2 2AC BUS 2 11 21 Y12 Y 22
" l l i et l l l 22 l l l ee l l F-U1 DC PANEL 11 U2 DC PANEL 21 U1 DC PANEL 12 U2 DC PANEL 22 (TRAIN A) (TRAIN A) (TRAIN B) (TRAIN B)
(3-4 HRS) (4-6 HRS) (1 HR) (1-1.5 HRS) Figure A-6 Simplified Diagram of the le Island Electrical Distrilxition System Page 161 of 4
v v HV-32025 4 NV-32026 i MV-32027 l e DG1 V 112 -1 < CKT BRK < ; O
~
122h R j HCCIA 480V 101 BUS 1 BUS 110 STAT 10N AUX. 4160V
" TRANSFORMER BUS 15 CONTROL CIRCUIT & DG1
^ NCC2A 480V 201 BUS 1 EUS 210 STATION AUX.
TRANSFORMER g FROM 2RY ACTUATION PauER (NONC) hh, i CIRCUIT 4160V BUS 26 LOCAL SWITCH HCCIA 480V 102 SPRING RETURN SWITCH 46433 (ANNUNCIATED IN CR BUS 2 BUS 120 STATION AUX. TRANSFORNER pg (SEAL-IN) If IN LOCAL POSITION) IRY RESERVE 46767 ' TRANSF. i ! 46434 e 4160V BUS 16 2Reso7AU Pigure A-7 Simplified Diagram of AFW R ap Cooling Water Suction Valve Control and Actuation Cirruitry. Page 162 of 453,,
HV-32383 MV-32384 .
% DG1 m ,
p 212- 2 < CKT SkK (- k f 212- 4 < , 4 " & EW RgSERVE T ANSF. HCC2A 480V 201 BUS 1 BUS 210 STATION AUX. 4160V V TRANSFORNER BUS 26
~
CONTROL CIRCUIT % DGt n HCC2A 480V 2 01 BUS 1 BUS 210 STATION AUX. TRArtSFORMER % FROM 2RY ACTUATION POWER (NONE) h sf. CIRCUIT 4160V BUS 26 SPRING RETURN StJITCH LDCAL Su!TCH 46840 (ANNUNCIATED IN CR (SEAL-Ir0 IF IN LOCAL POSITION) 46841 . 2R8607AU-A ram of the IAtit 2 Diversion G Figure A-8 Simplified Valve Contr and Actuation Circuitry p,,,,, g 3 ny f, s 3 . .
e'~~g
/
\~J
'mJ )
SG LEVEL ^CTUATION LOGIC SG SG i 11 12 I I I I dik MYE nY2 EYE MYlb EYE C D E F , A B I I I I I I ses s/s 3/s 3/s 34 s/s C D E F A B TRAIN B.12 PUMP TRAIN A ,11 PUMP PMEL 15 FROM PANEL 11 PANEL 15 FROM PANEL 11 PANEL 16 FROM PANEL 12 PANEL 16 FROM PANEL 12 , I I I I AT BT ST ET AM BM DM EM CN 4 CN N AM $ rn $ krM KnN CTK CTN u$ rT$ kri $3T 2 a a 1 _L 1 1"JEP "JEP "JEP - --f iArnu iAreau f--- T"JEP T - - -f i Arna iAreen
. gartJo <cggao,/--- T = . ... T u
~ *
~
ALL CONTACTS N.D. ALL CONTACTS N.D. rerupm ALL CONTACTS N.D. ALL CONTACTS N.D. Pigure A-9 Simplified Diagram of Steam Generator Low Water Level Actuation LxxJi c Page 164 of 453
ACTUATION Of Afu PUMP FRUM 11&l2 MfWD PUMP CONTROL CIRCU!I 12 PtE1P (SAMC FOR ID SHutJN In
- ACTUATED
- HDDE SIGNAL 5 TO OPEN NAIN FEEDtJATER BREAKERS 11512 AUTD TRIPS
"" .1 MrD NrD - 32 11 BWK -- tt DC PAT 1EL 12 1 12 ..........................
BRK I 1) 12 SG HL TPN A SAME AS 11
-~~~ T~ NU ! Art , PUNP 12 2) 12 SG tt. TRN B e l
I : CatTROL 3) 12 SG HL TRN A' . I. \ I Elk 21T 4) 12 SG HL TRN B *
** # ) 4 j 5) SIA *
- 6) SIB
! 7) UV On 4160V BUS SUPPLY *
- : 8) LOLI SUCTION PRESSURE AT 2000
$ i 9) 2/3 CONDENStTE PUMPS OFF AT ruLL POLJER COnDIT!Drts DC PANEL 12 :. *
- . 10) D1 TURBINE-TRIP GIVEN to
* - START tJHEN OTHER PUMP RUNNING I MRGIZED SAME AS 11 i 10 LutJ LUBE O!L s.............................................
Figure A-10 Simplified Diagram of Main Feedwater Pump Trip Actuation Logic. rReso7s age 165 Of 4
O 3 5 4 f o 6 6 1 e g a P E G R A H CE SR IU DS S WE OR _ S LP P wc P I R t oig I T Wl o R O P An o T T fi E ota E 2 1 mu
. R G at r c U R E
gA a S N i p S E Di r E dT O R P )' e i e f r i u lpss me W _ i r S P O L _ l l P A M e r U P 1T i F u g W L F O A NE R OR IU TS y D CS C UE SR g M WP U P O L
+ _
O ^ l l I i. ii
- 6. Major Assumptions Used in Fault Tree Development g~
The major assumptions used to develcp the Prairie Ishnd Auxiliary Feedwater System fault tree model are given below.- These assumptions are used in some instances to bound the model and, in others, to simplify the modeling process. No importance is assigned to the order of the assumptions. The importance of each should be considered on an individual basis regardless of its position in the list. 6.2.1 General Assumptions
- 1. The Unit 1 AFW system is essentially symmetrical with the Unit 2 AFW system. Thertfore, only the Unit 1 AFW system will be modeled.
t!xceptions are made (i.e., Unit 2 faults are included in the model) if major differences between the two systems are identified or if Unit 2 faults that could result in unavailability of Unit 1 components are found. In addition, the model of the Unit 1 system will account for the possibility of feeding the Unit 1 steam generators with the Unit 2 motor-driven pump (#21) via the motor-driven pump discharge cross-connection valves (AF-13-1 & 2AF-13-1). Any important insights gained from the Unit 1 me, del will be investigated for validity in Unit 2.
- 2. The asscmptions used for AFW train #11 components also apply to the components in AP4 trains #12 and #21, where applicable. Any
. exceptions will be noted below.
6.2.2 Assumptions Regarding Operator Response
- 1. The operator will have tioe to properly position mispositioned valves and start pumps that fail to start automatically, provided there are controls and indications for the affected equipment in the control room. Events to consider these actions are appropriately included in the mcdel. If manual control circuits are faulted, local manual control or positioning may also be pessible. Generally, local recovery actions are treated in the system recovery analysis and are not specifically modeled.
- 2. Selecting the condensate storage tanks (CSTs) as an alternate source of cooling water to the AFW pumps is considered to be a recovery action following loss cf the normal cooling water (CW) flow path or a general loss of CW. Consequently, no choices for the CSTs as an alternate cooling scurce appear in the model. This alternate source will be considered in the recovery analysis.
O Page 167 of 453
l') 3. Proper transfer of the suction source for the AFW pumps from the CSTs U to the Cooling Water suction path requires several successful actions. The suction or discharge pressure switches for the respective AFW pump must trip the pump if the CST source becomes unavailable. If this trip does not occur, it is assumed that unrecoverable damage will cause the affected pump to be unavailable for subsequent pumping of the cooling water suction supply to the steam gene.ators. The operator must take action to open the related cooling water suction MOV and to manually restart the tripped AFW pump. If either of these - actions is unsuccessful, it is assumed that no ccoling water will be pumped to the steam generators. Failure of the operator to carry out these actions for one pump is assumed to result in his failure to conduct the similar actions for any of the other pumps. That is, operator failure to recognize the proper actions for transfer of pump suction from the C3Ts to the Cooling Water System is assumed to be a general failure that will result in failure of all pumps should the action fail to.be carried out for any pump. 6.2.3 Modeling Assumotions ,
- 1. Any check valve test and maintenance unavailability will be governed by associated manual or motor-operated valve (MOV) unavailability.
That is, any specific check valve test or maintenance act that results in the functional unavailability of the valve will require isolation and consequent functional unavailability of the upstream and/or
. downstream manual valves and MOVs. Therefore, the contribution to fd system unavailability due to check valve test or maintenance will be included in the contribution from the related manual valves or MOVs.
No specific test or maintenance events will appear for check valves.
- 2. Generally, pump lubricating oil system failures are included in the model as part of the general random failure contribution to pump unavailability. That is, the lubricating oil system is considered to be part of the " PUMP" component and any failures associated with the lubricating oil system are therefore included in the failures for the pump and are not specifically modeled. Exceptions are any system designs that are considerad to be atypical (e.g., the auxiliary oil pump and its control circuits) and any points of interface with important supporting systems (e.g., the- lubricating oil cooler interfaces with the cooling water system and is therefore modeled).
- 3. The model is simplified by representing the contribution to system unavailability due to test or maintenance of the lubricating oil cooler inlet and outlet valves with a single event for the testing contribution and a single event for the maintenance contribution.
These events represent the collective test and maintenance unavailability contribution from each of the valves. Restoration errors associated with these valves are also modeled similarly. An exceiation is treatment of the cooling water return header valves. O Page 168 of 453
Since faults associated with these valves can result in unavailability of both AFW pump 11 and pump 21, separate test, maintenance and restoration events to represent these faults are included in the model. Test, maintenance and restoration faults associated with the cooling water control valve, CV-31681, are included in the collective events described'above. The valve is nor1 ally closed and it cannot be opened from the control room should it fail to open automatically. Thus, the collective events should adequately consider the related faults of the control valve.
- 4. Motor-operated valve control circuit faults are not included in the random failure events for these valves (e.g., Valve fails to open).
Therefr.re, separate events are used to model the effects of related faults in the control circuits for each valve. However, these faults are only modeled when the valve is required to change state to ensure successful system operation.
- 5. AFW Pump #21 discharge isolation valves to the Unit 2 steam generators (MV-32383 & MV-32384) are closed during testing or can be closed during testing. Since this is the requirec position for these valves (i.e., " closed") in the model, no unavailability contribution due to testing of these valves is contained in the model. However, the valve control circuits could be undergoing maintenance when the valves are opened. This maintenance could prevent remote closure of the valves, if required. Therefore, an unavailability contribution due to maintenance of these valves is contained in the model.
- 6. Faults in either of the AFW Pump #21 discharge check valves to the Unit 2 steam generators (AF-15-6 & AF-15-8) will not affect Unit 1 AFW system unavailability. Failure of the check valves to open would result in the required functional response for this model (i.e., no flow diversion to Unit 2 steam generators). Failure of the check valves to remain closed, which is highly likely to occur if the downstream motor-operated valves (MV-32383 & MV-32384) are not closed, would be governed by the response of the downstream motor-operated valves. The associated failure modes of these motor-operated valves are included in the model.
- 7. Once the unavailability contribution from faults in the CST suction MOV and the CST suction check valve for each AFW pump are considered, there are no differences in CST suction faults for AFW Pumps #11 &
#21. u 6.2.4 System Design Assumption:-
- 1. Inadvertent flow diversion through the individual pump test lines will have negligible contribution to overall system unavailability.
Diversion would require inadvertent opening of two lock-closed manual , valves (e.g., AF-17-1 and AF-25-1 for pump 11). One of these two valves, in addition to being locked closed, is controlled in the
" locked-closed" position with a Safeguards-Hold tag.
Page 169 of 453
C'; 2. Hydrazine, ammonia and phosphate supply line faults will have an O insignificant effect on system unavailability.
- 3. Failure of the pump recirculatf or valves (e.g., CV-31153 for pump 11) to operate (i.e., to open when required or to close when required) will not significantly affect system performance. Failure to open will not result in failure of the pump functional requirements postulated for this model. Pump operation during these postulated operating conditions will always require flow to the steam generators.
Thus, no flow to the stum generators during pump operation; which will then require opening the pump recirculation flow path in order to prevent pump overheating and subsequent failure; results in system functional failure regardless of the condition et the recirculation flow path. Failure to close has no effect because ths associated - recirculation valves for each pump are open during all periods of pump operation.
- 4. Significant flow diversion will not result if the CST cooling supply valve (e.g., CW-73-1 for pump 11) for the respective pump is inadvertently lef t open. Differential pressure between the CW system and the CSTs will normally prevent flow because the corresponding check valve will be seated. If differential pressure is such that flow is possible, no significant diversion should result because the CST supply is designed to provide alternate cooling flow during pump operation.
- 5.
- Since the AFW pump casing drain valve appears to drain the casing at a (Q j point near the pump suction chamber, inadvertent opening of this valve could cause air binding of the pump if suction chamber pressure is
?less than atmospheric pressure during pump operation. However, normal gland leakoff during operation indicates that this condition would not exist. (i.e., Gland leakoff during normal operation indicates that suction chamber pressure is greater than atmospheric pressure.)
Therefore, this failure mode is not included in the model. Similarly, flow diversion out of an open casing drain valve would have an insignificant effect on overall pump performance.
- 6. If the cooling water control valve (CV-31681 for pump 11) is open or fails open, no significant change in AFW pump unavailability will result. This is the desired position of the valve during AFW pump operation. Subsequent cooling of the oil in the heat exchanger of an idle pump or cooling of the bearings in an idle pump will not significantly change the pump's unavailability.
- 7. Solenoid valves SV-33299 & SV-33287 (turbine stop valve and cooling water supply, respectively) will normally fail to the " vent" position upon loss of power.
- 8. An open steam generator air-operated relief valve (e.g., CV-31084 or CV-31090) will not have a significant effect on AFW system performance.
O t i v Page 170 of 453
Since both the normal and emergency CST makeup valves to the main 9. condenser hotwells (Unit 1 -- CV-31121 & MV-32041, Unit 2 -- CV-31124
& MV-32042) receive a signal to close if either of the Unit's AFW pumps receive a " start" signal, opening of any of these valves during operation of any of the AFW pumps is assumed to disable the operating pump or pumps.
- 10. Backwash Water Makeup & Recirculation faults will not result in AFW malfunction.
- 11. Demineralizer Makeup and Recycle faults will not result in AFW malfunction.
- 12. Faults in piping to the #121 Heating System Make-up Pump will not result in AFW malfunction.
- 13. Failure or inadvertent opening of the CST drain valves (C-29-1, 2CD-29-1 and 2CD-54-2) will not have a significant effect on AFW operation. The piping downstream of the valves is capped.
- 14. CST overflow line faults will not result in AFW system malfunction.
- 15. Faults in the Condensate Recycle and Transfer system will not result in a significant increase in AFW system unavailability or unreliability over the mission time postulated for this model. During this time (24 hours) the 150,000 gallons of approximately 75 degree Fahrenheit condensate in each CST must cool to the freeze point before faults can develop. Since the tanks are insulated and flow through the AFW CST suction header will be continuous, it should take more than 24 hours for the condensate to freeze even during adverse winter conditions.
- 16. Failure of cooling water flow to the auxiliary feedwater lube oil coolers is assumed to result in failure of the associated auxiliary feedwater pump. This is a conservative assumption. In reality, the AFW pumps could be operated without lube oil cooling by using a start-run-stop mode of operation. However, this is not proceduralized and consequently no credit was taken for this.
6.2.5 Assumotions Regarding Additional Faults Excluded from the Model
- 1. System unavailability due to plugging of flow elements or flow blockage due to flow element failure is not considered in the model.
- 2. Failure of the pump suction relief valves (AF-29-1, AF-29-2 &
2AF-29-1) will not have a significant effect on system unavailability. Flow diversion through a prematurely open relief would not be significant. Air introduction into the system from an open valve is not possible because suction header pressure is greater than atmospheric pressure during pump operation. Failure of the valve to open would have to be combined with failure of a check valve to seat in order to cause piping failure. Consequently, these failure modes are not included in the model. Page 171 of 453
(' -
- 3. _ Failure of the auxiliary oil pump will not directly result in failure N of the associated AFW pump because the auxiliary oil pump fs run daily to lubricate the bearing surfaces in the AFW pump. As long as this daily lubrication is accomplished, the associated AFW pump can start and be lubricated by the attached lubricating oil pump regardless of. i the condition of the auxiliary oil pump. If the auxiliary oil pump starts and does not develop adequate pressure in a short time, an alarm sounds in the control room. This will result in quick detection of auxiliary oil pump failure and subsequent corrective maintenance to repair the problem. The uravailability due to corrective maintenance is included in the model. The mechanical failure of the auxiliary oil pump is not in the model since the failure detection interval for this pump is short and its failure does not affect AFW pump unavailability as long as the daily run cycle is accomplished.
- 4. Rupture of the lubricating oil cooler for an individual pump will result in loss of the pump. Either the oil will become contaminated with cooling water or the oil will be pumped into the cooling water system. Either condition will result in pump failure. However, these conditions are not specifically included in the model. Like most of the other lubricating system faults, their occurrence is accounted for in the general random failure event for the given pump (i.e., Pump "x" fails to continue to run).
- 5. No faults in the turbine exhaust line will result in unavailability of the turbine-driven AFW pump. Therefore, no events to represent these
-O%/
faults are contained in the model.
- 6. Any faults associated with the turbine throttle valve, CV-31059, or the turbine governor valve are assumed to be a part of the contribution to system unavailability due to random failures of the turbine-driven pump (i.e., Pump fails to start, Pump falls to run).
Therefore, specific events for these faults are not contained 'n the model.
- 7. Closure or plugging of the throttle valve (CV-31059) low pressure or high pressure stem-leakoff valves (MS-22-1 & MS-22-2, respectively) will not result in a significant contribution to system unavailability. Therefore, these events are not included in the model.
- 8. Unit I steam generator pressures will remain relatively equal throughout the required AFW system mission time. Therefore, steam flow diversion from one steam generator to the other, given a large differential pressure between steam generators and a coincident
. failure of the AFW steam supply check valve, is not contained in the model.
- 9. Unit 1/ Unit 2 cross-connection valves (AF-13-1 & 2AF-13-1) are not tested periodically. If they are tested, they will either be open or can immediately be opened, if required. Therefore, no event for system unavailability contribution due to testing of these valves is in the model.
Page 172 of 453
- 10. Motor faults associated with motor-driven AFW Pumps #12 & #21 (e.g.,
grounds, shorts, bearing problems) are incluu d in the event, " Pump g: Mechanical Faults." Therefore, no separate events for AFW pump motor faults are in the model. 6.3 The Auxiliary Feedwater System Fault Tree The detailed fault tree developed for this analysis is provided as Figure A-12. The structure of the fault tree represents the various component faults and human errors that could lead to failure of the Auxiliary Feedwater System and subsequent steam generator dryout, given complete loss of main feedwater as the initiating event and the assumptions discussed above. Specifically, the success criterion represented by the top event of the fault tree is 1 of 3 auxiliary feedwater pumps prcyide adequate flow to either unit 1 steam generator, given a complete loss of main feedwater. This tree was designed for single-unit analysis of the effects of a loss of all main feedwater on the AFW system. Where appropriate, Unit I component identifiers are used in the tree. However, the tree is structured such that the resulting AFW failure probability determined by quantifying the tree should represent an estimate of the failure probability of the AFW system in either unit, given the same initial conditions and progression of transient conditions. Single-unit effects of a loss of offsite power were analyzed using the two-unit loss of offsite power model discussed in Appendix F. The constant terms in that model were appropriately adjusted to reflect the expected support system states and cut sets that would result from a single-unit loss of offsite power. Details of the use of the model are discussed in a subsequent section of this appendix. The basic event names given in Figure A-12 are derived frum the basic event naming scheme discussed above. Table A-6 summarizes the basic events found in the detailed fault tree, gives a brief description of each and identifies the fault tree page number where they can be found. The failure data associated with each basic event can be found in Appendix 0. Each support system interface identified in the tree also has a coded name. The coding scheme is discussed above. Table A-7 summarizes the interfaces found in the tree, gives a brief description of each and identifies the fault tree page number where they can be found. The failure data associated with each support system interface can be found in Appendix D. O Page 173 of 453
i p s> TABLE A-6 AFW FAULT TREE BASIC EVENT LIST (BY FAULT TREE PAGE NUMBER) BASIC FT BASIC EVENT PG EVENT NAME NO DESCRIPTION AVH2122H 1 COMMON CAUSE FAILURES OF MAN. VALVES AF-12-1 & AF-12-2 AVHM222G 1 EXCESSIVE LEAKAGE THROUGH MS-22-2 AVHM222X 1 MS-22-2 LEFT OPEN FOLLOWING TEST OR MAINT & NO S/V CONF AVHM222Y 1 MS-22-2 OPEN TOO FAR DURING S/U CHECK 0FF & NO S/U CONF AVK6162H 1 COMMON CAUSE FAILURES OF CHECK VALVES AF-16-1 & AF-16-2 AVM4243H 1 COMMON CAUSE FAILURES OF MV-32242 & MV-32243 AXXTRANH 1 COMMON CAUSE FAILURES OF AFW TRAIN COMPONENTS APPSG11G 2 DISCHARGE HEADER TO SG 11 RUPTURE APPSG12G 2 OISCHARGE HEADER TO SG 12 RUPTURE AVHA121F 2 MANUAL VALVE AF-12-1 FAILS TO REMAIN OPEN AVHA121X 2 MAN. VALVE AF-12-1 LEFT CLOSED FOLLOWING TEST OR MAINT AVKA161M 2 CHECK VALVE AF-16-1 FAILS TO OPEN AVM0242F 2 MV-32242 FAILS TO REMAIN OPEN AVM0242I 2 MV-32242 CLOSED DUE TO TESTING AVM0242J 2 MV-32242 CLOSED DUE TO MAINTENANCE
/ AVM0242X 2 T/M PERSON LEAVES MV-32242 CLOSED
(_,}j AVM0242Z 2 OPERATOR FAILS TO DETECT ERROR AND OPEN MV-32242 MPP1613G 2 RUPTURE IN MAIN FEED LINE 16-FW-13 MPP1616G 2 RUPTURE IN MAIN FEED LINE 16-FW-16 AVKA151M 3 CHECK VALVE AF-15-1 FAILS TO OPEN AVKA153M 3 CHECK VALVE AF-15-3 FAILS TO OPEN AVM0238F 3 MV-32238 FAILS TO REMAIN OPEN AVM0238I 3 MV-32238 CLOSED DUE TO TESTING AVM0238J 3 MV-32238 CLOSED 00E TO MAINTENANCE AVM0238X 3 T/M PERSON LEAVES MV-32238 CLOSED AVM0238Z 3 OPERATOR FAILS TO DETECT ERROR AND OPEN MV-32238 AVM0381F 3 MV-32381 FAILS TO REMAIN OPEN AVM03811 3 MV-32381 CLOSED DUE TO TESTING AVM0381J 3 MV-32381 CLOSED DUE TO MAINTENANCE AVM0381X 3 T/M PERSON LEAVES MV-12381 CLOSED AVM0381Z 3 OPERATOR FAILS TO DETECT ERROR AND OPEN MV-32381 APPSG11G 4 OISCHARGE HEADER TO SG 11 RUPTURE APPSG12G 4 DISCHARGE HEADER TO SG 12 RUPTURE AVHA122F 4 MANUAL VALVE AF-12-2 FAILS TO REMAIN OPEN AVHA122X 4 MAN. VALVE AF-12-2 LEFT CLOSED FOLLOWING TEST OR MAINT AVKA162M 4 CHECK VALVE AF-16-2 FAILS TO OPEN O Page 174 of 453
}
TABLE A-6 AFW FAULT TREE BASIC EVENT LIST (BY FAULT TREE PAGE NUMBER) (continued) BASIC FT BASIC EVENT PG EVENT NAME NO DESCRIPTION
===
AVM0243F 4 MV-32243 FAILS TO REMAIN OPEN AVM0243I 4 MV-32243 CLOSED DUE TO TESTING AVM0243J 4 MV-32243 CLOSED DUE TO MAINTENANCE AVM0243X 4 T/M PERSON LEAVES MV-32243 CLOSED AVM0243Z 4 OPERATOR FAILS TO DETECT ERROR AND N MV-32243 MPP1613G 4 RUPTURE IN MAIN FEED LINE 16-FW-13 MPP1616G 4 RUPTURE IN MAIN FEED LINE 16-P4-16 AVKA152M 5 CHECK VALVE AF-15-2 FAILS TO OPEN AVKA154M 5 CHECK VALVE AF-15-4 FAILS TO OPEN AVM0239F 5 MV-32239 FAILS TO REMAIN OPEN AVM0239I 5 MV-32239 CLOSED DUE TO TESTING AVM0239J 5 MV 32239 CLOSED DUE TO MAINTENANCE AVM0239X 5 T/M PERSON LEAVES MV-32239 CLOSED AVM0239Z 5 OPERATOR FAILS TO DETECT ERROR AND OPEN MV-32239 AVM0382F 5 MV-32382 FAILS TO REMAIN OPEN AVM0382I 5 MV-32382 CLOSED OUE TO TESTING AVM0382J 5 MV-32382 CLOSED DUE TO MAINTENANCE AVM0382X 5 T/M PERSON LEAVES MV-32382 CLOSED AVM0382Z 5 OPERATOR FAILS TO DETECT ERROR AND OPEN Mk-32382 AVHA133F 6 MANUAL VALVE AF-13-3 FAILS TO REMAIN OPEN AVHA133I 6 MANUAL VALVE AF-13-3 CLOSED OUE TO TESTING AVHA133J 6 MANUAL VALVE AF-13-3 CLOSED DUE TO MAINTENANCE AVHA133X 6 T/M PERSON LEAVES MANUAL VALVE AF-13-3 CLOSED AVKA159M 6 CHECK VALVE AF-15-9 FAILS TO OPEN APT 0011I 7 AFW PUMP #11 UNAVAILABLE QUE TO TESTING APT 0011J 7 AFW PUMP #11 UNAVAILABLE DUE TO MAINTENANCE APT 0011R 7 APW PUMP #11 DOES NOT RUN APT 0011S 7 AFW PUMP #11 DOES NOT START AVA0998F 7 CONTROL VALVE CV-31998 FAILS TO REMAIN OPEN AVA0998I 7 CONTROL VALVE CV-31998 INOPERABLE DUE TO TEST AVA0998J 7 CONTROL VALVE CV-31998 INOPERABLE DUE TO MAINTENANCE AVA0998M 7 CONTROL VALVE CV-31998 FAILS TO OPEN O Page 175 of 453
(T TABLE A-6
'~
AFW FAULT TREE BASIC EVENT LIST (BY FAULT TREE PAGE NUMBER) (continued) BASIC FT BASIC EVENT PG EVENT NAME NO DESCRIPTION
===
AHX0011F 8 AFW PUMP #11 LUBE OIL HEAT EXCHANGER PLUGGED AHX1110I 8 #11 LO HX INLET OR OUTLET VLVS CLOSED DUE TO TEST AHX11IOJ 8 #11 LO HX INLET OR OUTLET VLVS CLOSED DUE TO MAINT. AHX1110X 8 T/M PERSON LEAVES #11 LO HX VALVES CLOSED / DISABLED WU1RTHDI 8 UNIT 1 CW RET HDR VALVES UNAVAILABLE DUE TO TESTING WUIRTHDJ 8 UNIT 1 CW RET HDR VALVES UNAVAIL. DUE TO MAINTENANCE WV1RTHDX 8 T/M PERSON LEAVES UNIT 1 CW RET HDR VALVES CLOSED h'VA0681F 8 #11 LO HX CONTROL VALVE CV-31681 FAILS TO REMAIN OPEN WVA0681M 8 #11 LO HX CONTROL VALVE CV-31681 FAILS TO OPEN WVH0489F 8 UNIT 1 CW RET HDR VALVE CL-48-9 FAILS TO REMAIN OPEN WVH0741F 8 #11 LO HX VALVE CW-74-1 FAILS TO REMAIN OPEN WVH0742F 8 #11 LO HX VALVE CS 74-2 FAILS TO REMAIN OPEN WVM0927F #11 LO HX VALVE CL-92-7 FAILS TO REMAIN OPEN WVH1910F 8 ~#11 8 LO HX VALVE CW-19-10 FAILS TO REMAIN OPEN WVH4810F 8 UNIT 1 CW RET HDR VALVE CL-48-1,0 FAILS TO REMAIN OPEN
) APP 0998F 9 CONTROL VALVE CV-31998 VENT LINE PLUGGED AVE 0299F 9 SOLEN 0ID VALVE SV-33299 FAILS TO REMAIN OPEN (VENTED)
AVE 0299M 9 SOLENOID VALVE SV-33299 FAILS TO OPEN (VENT) WPP0681F 9 CONTROL VALVE CV-31681 VENT LINE PLUGGED WST0011F 9 AFW #11 TURBINE CW STRAINER PLUGGED WVE0287F 9 SOLENOID VALVE SV-33287 FAILS TO REMAIN OPEN (VENTED) WVE0287M 9 SOLEN 0ID VALVE SV-33287 FAILS TO OPEN (VENT) WVH0209F 9 AFW #11 TURBINE CW VALVE CW-20-9 FAILS TO REMAIN OPEN WVH0641G 9 AFW #11 TURB STRNR FLUSH VLV CW-64-1 EXCESSIVE LEAKAGE WVH11TBI 9 AFW #11 TURB CW INLET & OUTLET VLVS CLOSED DUE TO TEST WVH11TBJ 9 AFW #11 TURB CW INLET & OUTLET VLVS CLOSED DUE TO MAINT WVH11TBX 9 T/M PERSON LEAVES AFW #11 TURB INLT & OUTLT VLVS CLOSED WVH5511F 9 AFW #11 TURBINE CW VALVE CL-55-11 FAILS TO REMAIN OPEN WVH5512F 9 AFW #11 TURBINE CW VALVE CL-55-12 FAILS TO REMAIN OPEN WVH5513F 9 AFW #11 TURBINE CW VALVE CL-55-13 FAILS TO REMAIN OPEN WVR0531G 9 AFW #11 TURB CW RELIEF VALVE CL-58-1 OPENS PREMATURELY APPSTMSG 10 AFW PMP #11 STEAM SUP LINE RUPTURE DOWNSTM OF CHECK VLV AVKR151M 10 CHECK VALVE RS-15-1 FAILS TO OPEN AVKR152M 10 CHECK VALVE RS-15-2 FAILS TO OPEN AVM0016F 10 MV-32016 FAILS TO REMAIN OPEN AVM0016I 10 MV-32016 CLOSED DUE TO TESTING AVM0016J 10 MV-32016 CLOSED DUE TO MAINTENANCE (V'h Page 176 of 453
7 TABLE A-6 - AFW FAULT TREE BASIC EVENT LIST (BY FAULT TREE PAGE NUMBER) (continued) BASIC FT BASIC EVENT PG EVENT NAME NO DESCRIPTION
===
AVM0016X 10 T/M PERSON LEAVES MV-32016 CLOSED AVM0016Z 10 OPERATOR FAILS TO DETECT ERROR AND OPEN MV-32016 AVM0017F 10 MV-32017 FAILS TO REMAIN OPEN AVM0017I 10 MV-32017 CLOSED DUE TO TESTING AVM0017J 10 MV-32017 CLOSED DUE TO MAINTENANCE AVM0017X 10 T/M PERSON LEAVES MV-32017 CLOSED xVM0017Z 10 OPERATOR FAILS TO DETECT ERROR AND OPEN MV-32017 WVM0025F 11 MV-32025 FAILS TO REMAIN OPEN WVM0025I 11 MV-32025 DISABLED DUE TO TESTING WVM0025J 11 MV-32025 DISABLED DUE TO MAINTENANCE WVM0025M 11 MV-32025 FAILS TO OPEN WVMCWSCY 11 OPERATOR 00ES NOT OPEN MV-32025 WHEN REQUIRED AVKA141M 12 CHECK VALVE AF-14-1 FAILS TO OPEN AVM0333F 12 MV-32333 FAILS TO REMAIN OPEN AVM0333I 12 MV-32333 CLOSED DUE TO TESTING AVM0333J 12 MV-32333 CLOSED DUE TO MAINTENANCE AVM0333X 12 T/M PERSON LEAVES MV-32333 CLOSED AVM0333Z 12 OPERATOR FAILS TO DETECT ERROR AND OPEN MV-32333 CPPAFWSG 13 RUPTURE OF THE CST HEADER CTKCT11G 13 CONDENSATE STORAGE TANK #11 RUPTURE CTKCT21G 13 CONDENSATE STORAGE TANK #21 RUPTURE CTKCT22G 13 CONDENSATE STORAGE TANK #22 RUPTURE CVHC271F 13 MANUAL VALVE C-27-1 FAILS TO REMAIN OPEN CVHC271I 13 MANUAL VALVE C-27-1 CLOSED DUE TO TESTING CVHC271J 13 MANUAL VALVE C-27-1 CLOSED DUE TO MAINTENANCE CVHC271X 13 T/M PERSON LEAVES MANUAL VALVE C-27-1 CLOSED CPPAFWSG 14 RUPTURE OF THE CST HEADER CVHC411F 14 MANUAL VALVE C-41-1 FAILS TO REMAIN OPEN CVHC411I 14 MANUAL VALVE C-41-1 CLOSED DUE TO TESTING CVHC411J 14 MANUAL VALVE C-41-1 CLOSED DUE TO MAINTENANCE CVHC411X 14 T/M PERSON LEAVES MANUAL VALVE C-41-1 CLOSED CVHC412F 14 MANUAL VALVE C-41-2 FAILS TO REMAIN OPEN CVHC412I 14 MANUAL VALVE C-41-2 CLOSED OUE TO TESTING CVHC412J 14 MANUAL VALVE C-41-2 CLOSED OUE TO MAINTENANCE CVHC412X 14 T/M PERSON LEAVES MANUAL VALVE C-41-2 CLOSED O Fage 177 of 453 L
/T TABLE A-6 (j
AFW FAULT TREE BASIC EVENT LIST (BY FAULT TREE PAGE NUMBER) (continued) BASIC FT BASIC EVENT PG EVENT NAME NO DESCRIPTION
===
CTKCT11G 15 CONDENSATE STORAGE TANK #11 RUPTURE CTKCT21G 15 CONDENSATE STORAGE TANK #21 RUPTURE CTKCT22G 15 CONDENSATE STORAGE TANK #22 RUPTURE CVH2C71F 15 MANUAL VALVE 2CD-27-1 FAILS TO REMAIN OPEN CVH2C71I 15 MANUAL VALVE 200-27-1 CLOSED OUE TO TESTING CVH2C71J 15 MANUAL *iALVE 2C0-27-1 CLOSED DUE TO MAINTENANCE CVH2C71X 15 T/M PERSON LEAVES MANUAL VALVE 200-27-1 CLOSED CTKCT11G 16 CONDENSATE STORAGE TANK #11 RUPTURE CTKCT21G 16 CONDENSATE STORAGE TANK #21 RUPTURE CTKCT22G 16 CONDENSATE STORAGE TANK #22 RUPTURE CVHC541F 16 MANUAL VALVE 2CD-54-1 FAILS TO REMAIN OPEN CVHC5411 16 MANUAL VALVE 200-54-1 CLOSED DUE TO TESTING CVHC541J 16 MANUAL VALVE 200-54-1 CLOSED DUE TO MAINTENANCE CVHC541X 16 T/M PERSON LEAVES MANUAL VALVE 200-54-1 CLOSED. (,-~) AVH2A31G 17 MANUAL VALVE 2AF-13-1 FAILS TO REMAIN CLOSED AVHA131G 17 MANUAL VALVE AF-13-1 FAILS TO REMAIN CLOSED AVHA134F 17 MANUAL VALVE AF-13-4 FAILS TO REMAIN OPEN AVRA134I 17 MANUAL VALVE AF-13-4 CLOSED DUE TO TESTING AVHA134J 17 MANUAL VALVE AF-13-4 CLOSED DUE TO MAINTENANCE AVHA134X 17 T/M PERSON LEAVES MANUAL VALVE AF-13-4 CLOSED AVHXCNOX 17 T/M PERSON LEAVES BOTH MANUAL X-CONN VALVES OPEN ' AVHXCN0Y 17 OPERATOR OPENS BOTH MANUAL X-CONN VALVES AVKA510M 17 CHECK VALVE AF-15-10 FAILS TO OPEN APPU2SGG 18 AFW PUMP #21 DISCHARGE HEADER RUPTURE AVH2A31J 18 MANUAL X-CONN VALVE AF-13-1 UNAVAILABLE DUE TO MAINT AVH2A31M 18 MANUAL X-CONN VALVE AF-13-1 FAILS TO OPEN AVHA131J 18 MANUAL X-CONN VALVE 2AF-13-1 UNAVAILABLE DUE TO MAINT AVHA131M 18 MANUAL X-CONN VALVE 2AF-13-1 FAILS TO OPEN AVHXCONY 18 OPERATOR FAILS TO OPEN UNIT 1/ UNIT 2 AFW X-CONN VALVES AVM0383G 18 MV-32383 FAILS TO REMAIN CLOSED AVM0383J 18 MV-32383 DISABLED DUE TO MAINTENANCE AVM0383K 18 MV-32383 FAILS TO CLOSE AVM0384G 18 MV-32384 FAILS TO REMAIN CLOSED AVM0384J 18 MV-32384 DISABLED DUE TO MAINTENANCE AVM0384K 18 MV-32384 FAILS TO CLOSE AVMU2SGY 18 OPERATOR FAILS TO SHUT UNIT 2 SG MOVs l- Page 178 of 453 l
. ~ . - _ _ _ _ .
TABLE A-6 h AFW FAULT TREE BASIC EVENT LIST (BY FAULT TREE PAGE NUMBER) (continued) EVENT PG EVENT NAME NO DESCRIPTION
==
AVHA135F 19 MANUAL VALVE AF-13-5 FAILS TO REMAIN OPEN AVHA135I 19 MANUAL VALVE AF-13-5 CLOSED DUE TO TESTING AVHA135J 19 MANUAL VALVE AF-13-5 CLOSED DUE TO MAINTENANCE AVHA135X 19 T/M PERSON LEAVES MANUAL VALVE AF-13-5 CLOSED AVKA511M 19 CHECK VALVE AF-15-11 FAILS TO OPEN APM0021I 20 AFW PUMP #21 UNAVAILABLE DUE TO TESTING APM0021J 20 AFW PUMP #21 UNAVAILABLE DUE TO MAINTENANCE APM0021R 20 AFW PUMP #21 DOES NOT RUN APM0021S 20 AFW PUMP #21 DOES NOT START AHX0021F 21 AFW PUMP #21 LUBE OIL HEAT EXCHANGER PLUGGED AHX21I0I 21 #21 LO HX INLET OR OUTLET VLVS CLOSED DUE TO TEST AHX21IOJ 21 #21 LO HX INLET OR OUTLET VLVS CLOSED DUE TO MAINT. AHX21IOX 21 T/M PERSON LEAVES #21 LO HX VALVES CLOSED / DISABLED WVA0683F 21 #11 LO HX CONTROL VALVE CV-31683 FAILS TO REMAIN OPEN WVA0683M 21 #11 LO HX CONTROL VALVE CV-31683 FAILS TO OPEN WVH1912F 21 #11 LO HX VALVE 2CW-19-12 FAILS TO REMAIN OPEN WVH2743F 21 #11 LO HX VALVE 2CW-74-3 FAILS 70 REMAIN OPEN WVH2744F 21 #11 LO HX VALVE 2CW-74-4 FAILS TO REMAIN 0?EN WVH2925F 21 #11 LO HX VALVE 2CL-92-5 FAILS TO REMAIN OTEN WPP0682F 22 CONTROL VALVE CV-31682 VENT LINE PLUGGED WPP0683F 22 CONTROL VALVE CV-31683 VENT LIN PLUGGED WVE0288F 22 SOLEN 0ID VALVE SV-33287 FAILS TO REMAIN OPEN (VENTED) WVE0288M 22 SOLENOID VALVE SV-33287 FAILS TO OPEN (VENT) WVE0494F 22 SOLEN 0ID VALVE SV-33494 FAILS TO REMAIN OPEN (VENTED) WVE0494M 22 SOLEN 0ID VALVE SV-33494 FAILS TO OPEN (VENT) WVM0026F 23 MV-32026 FAILS TO REMAIN OPEN WVM0026I 23 MV-32026 DISABLED DUE TO TESTING WVM0026J 23 MV-32026 DISABLED DUE TO MAINTENANCE WVM0026M 23 MV-32026 FAILS TO OPEN WVMCWSCY 23 OPERATOR DOES NOT OPEN MV-32026 WHEN REQUIRED AVKA145M 24 CHECK VALVE AF-14-5 FAILS TO OPEN AVM0336F 24 MV-32336 FAILS TO REMAIN OPEN AVM0336I 24 MV-32336 CLOSED OUE TO TESTING O Page 179 of 453
f] TABLE A-6 AFW FAULT TREE BASIC EVENT LIST (BY FAULT TREE PAGE NUMBER) (continued) EVENT PG EVENT NAME NO DESCRIPTION AVM0336J 24 MV-32336 CLOSED CUE TO MAINTENANCE AVM0336X 24 T/M PERSON LEAVES MV-32336 CLOSED AVM0336Z 24 OPERATOR FAILS TO DETECT ERROR AND OPEN MV-32336 APM0012I 25 AFW PUMP #12 UNAVAILABLE DUE TO TESTING APM0012J 25 AFW PUMP #12 UNAVAILABLE DUE TO MAINTENANCE APM0012R 25 AFW PUMP #12 DOES NOT RUN APM0012S 25 AFW PUMP #12 DOES NOT START . AHX0012F 26 AFW PUMP #12 LUBE OIL HEAT EXCHANGER PLUGGED AHX12I0I 26 #12 LO HX INLET OR OUTLET VLVS CLOSED DUE TO TEST
- AHX12IOJ 26 #12 LO HX INLET OR OUTLET VLVS CLOSED DUE TO MAINT.
AHX12IOX 26 T/M PERSON LEAVES #12 LO HX VALVES CLOSED / DISABLED WU2RTHDI 26 UNIT 2 CW RET HDR VALVES UNAVAILABLE DUE TO TESTING WU2RTHDJ 26 UNIT 2 CW RET HOR VALVES UNAVAIL. DUE TO MAINTENANCE WU2RTHDX 26 T/M PERSON LEAVES UNIT 2 CW RET HDR VALVES CLOSED ~ f WVA0682F 26 #12 LO HX CONTROL VALVE CV-31682 FAILS TO P.EMAIN OPEN ( ,j). WVA0682M 26 #1 LO HX CONTROL VALVE CV-31682 FAILS TO OPEN WVH0745F 26 #12 LO HX VALVE CW-74-5 FAILS TO REMAIN OPEN WVH0746F 26 #12 LO HX VALVE CW-74-6 FAILS TO REMAIN OPEN WVH0925F 26 #12 LO HX VALVE CL-92-5 FAILS TO REMAIN OPEN WVH1911F 26 #12 LO HX VALVE CW-19-11 FAILS TO REMAIN OPEN WVH2492F 26 UNIT 2 CW RET HDR VALVE 2CL-49-2 FAILS TO REMAIN OPEN WVH2493F 26 UNIT 2 CW RET HDR VALVE 2CL-49-3 FAILS TO REMAIN OPEN WVM0027F 27 MV-32027 FAILS TO REMAIN OPEN WVM0027I 27 MV-32027 DISABLED OUE TO TESTING WVM0027J 27 MV-32027 DISABLED DUE TO MAINTENANCE WVM0027M 27 MV-32027 FAILS TO OPEN WVMCWSCY 27 OPERATOR DOES NOT OPEN MV-32027 WHEN REQUIRED AVKA143M 28 CHECK VALVE AF-14-3 FAILS TO OPEN AVM0335F 28 MV-32335 FAILS TO REMAIN OPEN AVM0335I 28 MV-32335 CLOSED DUE TO TESTING AVM0335J 28 MV-32335 CLOSED DUE TO MAINTENANCE AVM0335X 28 T/M PERSON LEAVES MV-32335 CLOSED AVM0335Z 28 OPERATOR FAILS TO DETECT ERROR AND OPEN MV-32335 O Page 180 of 453
TABLE A-6 AFW FAULT TREE BASIC EVENT LIST (BY FAULT TREE PAGE NUMBER) (continued) BASIC FT BASIC EVENT PG EVENT NAME NO DESCRIPTION CPPAFWSG 29 RUPTURE OF THE CST HEADER CTKCT11G 29 CONDENSATE STORAGE TANK #11 RUPTURE CTKCT21G 29 CONDENSATE STORAGE TANK #21 RUPTURE CTKCT22G 29 CONDENSATE STORAGE TANK #22 RUPTURE WVHCW11F 30 MANUAL VALVE CW-1-1 FAILS TO REMAIN OPEN WVHCW111 30 MANUAL VALVE CW-1-1 CLOSED DUE TO TESTING WVHCW11J 30 MANUAL VALVE CW-1-1 CLOSED DUE TO MAINTENANCE WVHCW11X 30 T/M PERSON LEAVES MANUAL VALVE CW-1-1 CLOSED WVHCW12F 30 MANUAL VALVE CW-1-2 FAILS TO REMAIN OPEN WVHCW12I 30 MANUAL VALVE CW-1-2 CLOSED DUE TO TESTING WVHCW12J 30 MANUAL VALVE CW-1-2 CLOSED DUE TO MAINTENANCE WVHCW12X 30 T/M PERSON LEAVES MANUAL VALVE CW-1-2 CLOSED CVA0121K 31 U1 CONDENSER MAKEUP SPRAY VALVE CV-31121 FAILS TO CLOSE CVA0124K 31 CVM0041G 31 U2 COND M/V SPRAY VALVE CV-31124 OPENS AT -4" IN HTWELL U1 CCND EMERG SUPLY VLV MV-32041 FAILS TO REMAIN CLOSED g CVM0042K 31 U2 COND EMERG.SUPLY VLV MV-32042 OPENS AT 44" IN HTWELL 9 Page 181 of 453
TABLE A-7
~/ 1/18/86 AFW SYSTEM INTERFACES THAT REQUIRE ADDITIONAL EVALUATION (SORTED BY PAGE NUMBERS)
INTERFACE FAULT TREE CODE PAGE NO. DESCRIPTION IBLCN11 2 EXCESSIVE BLCWOOWN OF SG 11 IBLDN12 4 EXCESSIVE BLOWDOWN OF SG 12 ITURBOS 7 11 AFW TURBINE STEAM LINE DRAINS IllAUXOP 8 11 AFW PUMP AUX OIL PUMP CONTROL CIRCUIT IU1CWSUP 8 UNIT 1 COOLING WATER SUPPLY HEADIR ISV299 9 SV-33299 CONTROL CIRCUIT ISV2d7 9 SV-33287 CONTROL CIRCUIT IllPS 11 11 AFW PUMP SUCTION PRESSURE PROTECTION IU1CWSUP 11 UNIT 1 COOLING WATER SUPPLY HEADER IMV25C 11 MV-32025 CONTROL CIRCUIT IBUS15 11 4160V BUS 15 IBUS26 18 4160V BUS 26 IMV383C 18 MV-32383 CONTROL CIRCUIT IMV384C 18 MV-32384 CONTROL CIRCUIT ('~T IBUS26 20 4160V BUS 26 (__,) IAFW21C 20 AFW PUMP #21 CONTROL CIRCUIT I21 AUX 0P 21 21 AFV PUMP AUX OIL PUMP CONTROL CIRCUIT IUICWSUP 21 UNIT 1 COOLING WATER SUPPLY HEADER ISV494 22 SV-33494 CONTROL CIRCUIT ISV288 22 SV-33288 CONTROL CIRCUIT 121PS 23 21 AFW PUMP SUCTION PRESEURE PROTECTION IU1CWSUP 23 UNIT 1 COOLING WATER SUPPLY HEADER IMV26C 23 MV-32026 CONTROL CIRCUIT IBUS26 23 4160V BUS 26 IBUS16 25 4160V BUS 16 IAFW12C 25 AFW PUMP #12 CONTROL CIRCUIT 112 AUX 0F 26 12 AFW PUMP AUX OIL PUMP CCNTROL CIRCUIT IU2CWSUP 26 UNIT 2 COOLING WATER SUPPLY HEADER I12PS 27 12 AFW PUMP SUCTION PRESSURE PROTECTION IU2CWSUP 27 UNIT 2 COOLING WATER SUPPLY HEADER IMV27C 27 MV-32027 CONTROL CIRCUIT IBUS16 27 4160V BUS 16 ICV 121CS 31 CV-31121 CONTROL SIGNAL
/%
x-Page 182 of 453
O!i
~
i E O XII p? o! t
!1 h gj!!r ic E
s!!!! er E!!'in i$t o! :
);il
- 2 Ibt! #'
i! etl tiiE 5!$I
- I3, -
ai a
]
! - 45'l l'kl I li,el! g es=
48, bgg, er g atg c geg a g g gogg
-a gagg [{e ,
Bli! ga 'ex, 18 ee c t 1 i og Fg. ilel 5hf ae; f52 (- - -
'i3s &;
- m
- h )
li,a - s
,. . e c lI" og
- {31 er u
. , g=
g.. gg 8!!I l
.x!a . -
( [!!! Bj" O ,5
eli - ill > l - 1 3! n- alj l5'
'd h;
ite di
- ll li F a=
=
o Ig'i : lj. "e isj 0-l5!
; ! i e
11 h si;n g;
. Ill 5 ilI 3 I
i ili y 5 tij - ne aj c I
!!g '
8 di nii : !aila E l'
!!"I t
!! p- 3 -
Ia 3) lie l$ 3= sa o k U a 5 isI, 3 s s dE B 3
*a ifls- ; ,
a
;It 'i
!= g I!! '? 5 q!=,l! I g
B I WS I li!"; 'l O . 8 1
-l.:l! 'l R
a - s s u e aDm T a i m uss
~v I wWm u Gsem r A Sa et a
, nTs eTs a wt h n
.,m , eWu I
I a0m b 1 se f S'
,,, n wtu f.
,, un f wo ne n e
o m m0s % I a t wee t u t 3 e ts t u- R I n ee c n e
, 3eW aist II P s
a p a
, rEw W ucD ueus t te I
t auP mr E A e e ps:
- ss e
mes geS r e tosa s e r upe r i nee ma T s ms sw r r utneis awto u sme ra s T I emsuer w wrsa tnh a t l u eeA wutDs a utm s Ru Ee I P E t I e s as 3 a I gwu e psa us s s e wst % A t AA s y Ts t S r t e a w d s e wue 8 3 s e e S anes P wro s I rsw as o A W A I rtr or wa e o
& A y
r a O ei wt ows i l sm a mes a a m i x atte a n ues e u I n A u1s woo t o A l s a w a h s a was dn e sf e sm c. l i w,ere ta r g mMe a 1 r l A W I am ni is f t e as et e o A wtm s a D nw wesa m e e s ) sDe m s I aT E1 e 1 uew s t n weW L A o c w ( s n 2
, &eW eL e s a 2 1 . I rpw e 3 -
t ste ecc u2 e A aur t n rI s u A e r s et se ee e P u at s i mm e tosa nec u ua g uw s st s ncn uime ]- i F Awm a mme ras Ti w en. cs era w t u t wPsn ( tDA a aa an wW 2s i ur i s mu sw s e m gw3 r 3 I o FsO W u2e e awl Tu m c w A _ , s s _ ,,, . aess r ner I nI wa t0 e1 v e $ 1
r rs [,_J') (' b) %
, o.-
suv e i 1 1 macrouw ww rtow io
-- Q c. i H I I I
" I I auense = maarause I mense w l
assosaaec waarn aw>eamer waara
"''*y avoi vatw w-ie-: rats mov ww-3:so saw n uw e.-r.re was. nro tsar i -rw-ie rto= mw nw waas to u or raurs .is to so in murrusu to,so m naw is ", *8
,, ",,*'O va art.
U U U U
. . U.. :=
U
.ma.em.
N seriem ereieies
,,cxise I I aerscire I I peacrouw noe seacro4ag rtow watw (gf vaw news tw = s w inas. r=rm sw wam watw raas o n to use esamual watw ca to m is
[ * -i2-3 rus to armas. aown rate.c wsvuam r,.ance en . no. as ei re m is
% c,,,,,,
to atuam en* == _ Attae24F es s ca s a W A 23r I sunn r r ergpavest rags f/ts reestne traws ==w so orwei cmm crtys watw acers U U 44s#3438 anserest I I vaw mosus vaw novo pg Te sLg 10 usins eusawaaaar U V ausef43 a m e34sJ Pigure A-12 (cont) Detailed Auxiliary Pecdwater Systan Pault Tree
^
CJ Page 186 of 453
s 5 w ir u 4 vr e nu Gs.e
.a I n=mw m
U == f o ws e m a e we r 7 8
.n sem ws 1 en , euna I mur .
e I ne.w s s e e g w y, wru au s a s P wsa w ee. s I nww Ue n wws *r ma e w e r T e o t n ws
==
e e s ' us s i s aas rm n s l u s I
*sam s
rn a as wae P
=re s
me e
*nr ws o a n
r t e sme t s am==sm r a s S y I wtnc aur ne Ue r w a
- e. s see.
r e t e esa a w, 8 4 S t = c..a ra n w w,_ t utu d a a I r ,
- e. m I
wr. a b e e va a mw3 F o ev s s nw y I e==w s s r u rse Uo a m r a w i Awn s a l 1u i x u A d l e s w c a a o i e a n a I n=m Ue t e m
= == s ua s
a D m s a. = m
*se u s e
s wn. eu. )
*s ee n m..
t n I
*s I w
k' o ms.=w . a
'rs am a c
r n e n e e ( m e n 2
, u a = m.Ue 1 wr am I
wow A w e ee r os s s.s u nui g ms ao
] 'nnm aa. w i r rwm F a ve *m s a. w=o I'
a ne mrei ac e mw n e a. srr aa . == et n r e n I c Ue m=e a nr w e eo m
,n ema s
em w=o a
. ran unu n,
e u I
,r , I wrs.
_ ,p,
, mwA en .= e
- nu s a=su Urme i I nsn w nmaa s _ iu
,A k
d - eli i si!i o 11,. : 8 V E I! di - is i . a s E- ! '
. ,y O !! E- 'll
- i i
1 ilei- ,:ll >l t i- i !2 8
- 9 at. I ;
- s. -
^
o E pt lli gg, , d di o
eli _
,jj , ,
i!, -
't i
- 1. I 5 I b $
3L -
!,,It>l -
_ ll! si* " t!; l; di i I!l,!o JE[ i y.r i;i >l
- - i 3
['i s !!! *- l!!* ! l
~
ni s . lgs";l>l !.
! .; P- 3 l;E'!
ilI !, - ll - i,:i <re , ,3 351 5 lliI lig 0 - 4E j qi E les s , e
!!I -
lji >l [
!!! I i
i11>i O pl o
S
- y
-l ]81
()Oki ._
' I m i
! l
=!c iv.
G'! oil l g Z
~
U , ,1 5 gin at I. f
~ 3 kih4; ik'
;p 4
-(([] u >l a
s Yi a m
..}
hg> E i1 :u..r 1 3 :l h. ili e lil - ; o
'a' gi -
;.i ,a _ ut ,a _ 111,1 i all all '
118 1
,11, 2 8
d d ff - m a f) I g 'l 111 : p E8* jj d; a 2,1 11[ 3l
? -
ljg 6- >' O .i ,i lij 1
O. 8 3 f. 0 f so= r s.= r o n e ) 1 s e s.W
=.. ==Ut
=
t E r 3 4 I
=
e s e e=1N 8 9 1
= . r=W e UW n w: s-a W I ws( E W
W e o
=
a a. = ==rW e a e P me Op/sevra E I j s wa A S e IM "" , 4, , e n n. S 1 Utn g
= E=.
e=M & r e r
',,,?I F n a T 4h s
s Re == F m S=f w
' wa . W I I w
= eNm m3 ..
sair t
, = . s1= -
cg l
.e B
e 9 8 u r e mD a ec- P s E m
..eC
=, e T n s
e
.etu ssG s
a o+A a A l
. t ms.
f f,,, ai.e Mt n*t - t W s a= = s y Use o4 Ux e W I s v e W I ec4 - s Use rnQ a e N Ue e S www s u=m r - I r I t g= - t u e t w a = (E W r
= g w ==ats
- w e u
a =. ==
- y. t e.=
r am ma e= n TI g..,m. ga. u
" a w
do es. a. s eT ge = P w=1 T : e s io= s a ene - P e I ws= t w .sn U-y s s. a. s Ue s I rt a a r w a O t ae== nir e ap a i l i x u A n F de I s=en e U3e r 3 l ms= s i a a,r= R 4 a t a e D
)
s s er t
= r n
_ e.. W a e )D e g o
. nen s e 9 I rE 1 s Ust c
- a.. .. YI (
i
. UO smW i I
s ns. a e a r A m ae.m W w =g ( 2 c-o r a 1 A s e r s u T W
.Qyg I o74 =.
n9me I
.at c
n ma m v i g mo.=UeT t s n7m a3 i.- == F a F I sa75 m c:n
=. ==T u
,.7
..8 a9 s1e s
pv 5 m-. T
.wC
.ww wtm 9
W s 0 8 e a= 9
=
W I Uesr I r=4 8 U33 s r w
.==
ss. Uea s a w=(W
=
=
A
.a.
I u c,n . s O o
A U l'il* >[ 1 e it 'il- : = I! ul! I
~
I
@li 1,
!;r >f
!!i ,,g -
~
h$$ b' Ifl &- gl, set i , j I' i - l,it I
~
"I- 1.11 1 g llll E
i wii l l 3 > 8 ll,i'
>l i
11 1
'!- gjl
,u :
ll
~
I- <, I
,- Ip f-> e l'1,1,I 1-I'l
- I?
l..il= uli'- lll
!!,!'l O -
=1-l,11,1 llll
-a ,
O ob : t Ij e 4b h Gl E r a 2 8 t: d
.E
- r. 3 j illi 4 !]ri<l 9; 'e a i o
E $$ I b it'
!! !l=l c
G r
~
5 V 5 0 3 e 8 l[f [" g il
*i r eg N
II I ,ls i - 4 sil I .t 3 - e Y e b
.m O ,a 1;p, !.
[ k
. <L< i-g >1 t p r
T
/~
v - s E fe ! N -
,n w It' g,, $
' NE f$1 8 k
E e kpl g
~ "n &
u
' 2
'Igs 1't 'l
}
; e O $
^
gI*r g Y5 - lji'I
- 3 lis ut s .yEl 3 95 5- nl; Elg 3 y i
- go s is g
l,j! 'l c a h bl 'h 14 ,- o . lli !
et c
@li - , 1 b
t 8 9
~
~
5 Je a% l
- l m
b n m lY Ef ',I E!l si
'f f e
a I 4 p I 1" - 5 ,
- l r ,i e :,r i ri 2
e 5 =a s y b 5 l 4 gD 'l 9;1 g 4; - n, . Y 0 r I! dl l
=
d I!! i g l
)
g 3 5 4 f I U.. o
. 6 9
1
~.v e Osr P
g a _ ._ . . e
.m...
I . ._. 1 I I . U. e r
.. __ ._ _ T
. ._ t l
. u
.. , . a P
I _ T . s e t sy
. . S
. . U.
r e I
.._ a. I
... t
. . a w
d ~ . e e
._A,
,. F I _ y
) .
_ r a
. i w :
.. l i
x
. u A
a #.
. I
. . A.
. d l
e i w. t.n. f
. t a
e
.. D R
_-Y_
.f.-
s a s n
)
t
.m se ,. .
n o
. c A. ..
( I . . . . . 2
. I
. .. U-1
. . A e
- r I
. i u
q
._ P YI .._
1 U-I ___,_ T Y,L o I _._aI
. . U.
' ,;1Ii , l
} ;
ew S 4 f o 7 9 1 e g a P e e e r e T w l n= Umc t @ o. n sr . 1= e w l c u a F e s o t s y S r t e a w de e e 4 F 4 l
,=
. m sw e B t
y s U *c sa.s 7 r e= C iwe a C a rsn u3Wr a I swu Aa Ts i C i l i x u G A
- i W r t
m l S f 4 i f a A 9 nf< r r s r J e t a M ui= i 1 e oR= 3 o mz <= 7C I nO=s nm nu u3e f D wsT
=Ei a
n f' weis C
= an i
)
v.ie = e t w, m
=,, ]
( c l g,,,- {a s 2 1 r i 5 A oo 7 e s e nts uC2 t r as F i wao wto w a r n e nnr EI wswE a w C i F u g e i
,m Uczr l
,a c m c
G
O
=
t E ' E e lf
@fi _.
Q I I
- y t _ 35 ,
4 !! ) D j
' o sia E
=1 3 8!
il : lW, 5
,Ij [ lgl! l s
II s I - s
~
lb le I l'p [ i!!
- = 'l (
.c il>l O
et Y Igg o 185 $
@!i I, z t lti l.
ly..!. A rt ,
, s. -s o
~
!,!, >a_
;; ! >; e g
+ i ! in -
g 5, j![ I 3 1 1
,e i g, -
U 3'5 ih kh ;P g d l.
' 5 t- ,
33t C f l!!p!
}
!,l!45 i.j{!
.i a.e i,i 3 llf I I C 9 liefi b
.i' 1:t" . !! I !
Ia;! '
'I _
[! > j ia <,
.t o
1 I1i 9 l lit
;a <;
Lge - L
G v i 2 h J dl al i q; ? eli 11
- E
,1 1 r[ x1 g
,n' m #
f5~ I I[e! y tilbl i-i
;Il >
e i
- 12I's l i di !
di 4 , in _ l; if-a la t (O 5
!:1 125 ' !: j l'I I vi! l -
',N
',s y 8 11 I
- 5 s
I25 I
!t-I df 1 1 in, a
~
3 0 5$ 5 i! f 1
-h _
ij; _
!!! >i o
O iill' z l1 il,i2l i[; i
>g 4; -
9, 5 L e 8 V 5 _ li 4 # 8 2 li, 5 O!5
- a h 31~ b
@ts
'[!
= e t I"s .5 g I
5.l)- 1:1 2 O
,lI m w
IIe e 5 ll usk *
- 8
!?!
i;cg [ E!1 ,,r! 2 4 13e .
'I I;8i -
2 1 m g, 1I e Ii lI ' 4at h' ll,I
r-U r 1 E E e 8 a j EIU ,
@h -
lh >l i nI gu In i j u
-I fiM S
( el' gI I IP;>l o 4 is
's e
5 li- ci j l5! : - lli : s 9 I! f df la O g uit y III 4) < i Iji
~
$lF ,,
)! ol f
!i! I I i li >l 0 i W
- O h Il
3o
!,5ll"1 a,
O!j
~ i;h !
o i! 8: lEil1 >! I
<!,I Sif g a b
e gi
- fa.
- h3 I 1 e E
5
,,1-5 I )l 161<*'
e g,g 8i' r, 3l 4 , af I ma lIl E 3 t 8- l!)n s y
,2
,)
If - 4,ef
!.4 i -
se se 3 g
'E i ig! I
=
f.glC
,,- g 8 $
~
d!l r f. v _ jk_
,it si 11;
, ,1 ;
si lg'hII r5. 8*l
]8 e
G i ,f
;,!)
._n 1
h
' ..i -
@$i
, - . i k
I 1li 6 i ) as 1 y' >l r O i
!ed
- ;1D ,
.g _
_b h g
- 4 H!; c $!i <l i e
i I, 7 l"v 1 I - ' i,t,k o - il >l
4 2 a 2 8 a
~
' g[
s i k, g Aa- m n h G p">} g 8
.i {
d1 2 e f.g "i 1 I ^ i 1 V. Fi . - a4 9 E tm,d a\ hi s
' e it's '
8 41 - h p g
._L-
\ l L
4 0 Q 5 5 j'll8
- g. l
!h .
, *'e-111 3 1, II" ,
!=
h fgI I.v'
I i 'E ,
- ,l,: .5 O 4 II s =
~
I'n'nl 3 n" !3
= l,le=l.
@g.-
n!!t , 8
- f
,lfic=dgaf-
,1 i 1"I c
k
- l! ,l s;I -
~
f af N - O
O= 1 5 2 8 k 2
"I $
@h~ ! il! ii.
>al 3
e rl 3
!fg
;i" h! ,i i
ii; e 4 , a 9 g <11 1 i e i gi g I - f$ I 5 8 l
<1 [
5 A I 4r S
- 8 z5 I _ 3 ii s, g, j,5 I I n lli 'l
' e al o
- 1
\
l 1 m'
\
N p s k o N i a.' E
@ki
,eg i -
5 di h
~
' B f$a f, de -
{
;i o t
g S 1 m , ge- a 4 ; [ _
%$ 33
=
". 3 *k 'il- 5 j - a E i E " lig Tg ( 5 TiLls_ sk IE k') *~ 3d b 2
,i lij 'l g Ng dk' 1 i hgl {.g 'i e dk- gg l
;d ,1 k i e f
\2{ t isi E- E' o
u
-4
>>19., >}- ,._4 ;
- .e 4.
1 e;
=
t : a' a 8 V
~
I 4-5 lj <3l j l @$ l[! u ?
~
if k [. 1 - .
< ey ia G pI >,l s
s u , I I
- a n j
l 2 >l F : a
~
l 'I - h 'I f, I l
' - 3 c ? I O
e 5
's 5
E
!$E Ill 4$ j
!st E .
ek* - 111 3 i e
.ll' lh
~
p is) 11 3 u lic
!=l 3'! le
=
'el,: 2 O
- gEs I! 'zj O
y
*a a
gg
!3 I.ls >j l' til = 1R
- 8 al"' s
=
;ll ,! 1 l i u
.e gA'a
'I f I a5 c sj= !
fa >$ eg e O
t l l
,s.m mve maarauaw now FROM CST 99 e p, gg to w c fi I I I I I I
""*""W ""*""W cst si est te est now ,,urw w w I gM is I MW RJrW c31 W.Acut , , 'h r
A U A U U A U M cwems M cwenio cweme M ceruvse
,, 13 Pp to P6 3 C1 o ruie c
[ ep 29 H I I l l c " '"
" #" D surw or mu== ww maareans new M csf C-4 -t FROM e%;lG, noefs rut n esns e esm A "
cre res. A A
,, , ,, t . ....
Figure A-12 (cont) Detailed Auxiliary Peedwater Systosa Pault Tree Page 211 of 45
\
O 3 5 4 f X t o i Uu l T% C 2 1 5 ew r 2 t e g a P T O'C, - 73 ae e S, m J t e r PP Ao g I h e h W L Uste e w s T t l u a F m t e s k] 1 f
"@ l l
S y Q l ?. h UCs M 4 w p 4 t r e a w d e e F w y O r I N i l a i x u A d M 3 l e t
'% Uc u i l
e t a W
$ W
)
D e t n o ( c
.t t ' 3
'3 a J
.S o 3 2 PP**P M 1 A0'3 3 e
e I N W L UC 4 e e r 1 A e r u g i F N'
*y 3
f I
"I
? U4Ce 3
H
- h w
w w O I N
5 4 f o 3 1 2 e g a P e e r T t l u a T P 1 t m e s y S W t s e r e t o a h IfEo d P w c e oli l Ec W 4 e y a r
.f rf D S 3 i
l i A1
- 1
= x u
A I Ecv
%, d e
% l i
a t 2 e r D M" ) t n o ( c _ 2 f(a I _ 1 A e
. u r
u
? m g l
Th c 3 F I l Q c S v i F U E T I n s 5 c I E Oen 1 i
4 1 I One should realize that efficient quantification of this detailed fault tree-cannot be accomplished with many of the existing fault tree quantification computer codes. An extremely large number of potential cut sets result from the logical combination of all faults in the detailed fault tree. Therefore, reduction methods must be employed to quantify the AFd failure probability that results from the fault tree logic displayed in the detailed tree. These reduction methods may vary among analysts and will vary depending on the type of quantification code used. For this analysis the WAMCUT fault tree quantifica-tion code was used and reduction of the tree was accomplished to support that code. The actual reduction process and the resulting input elements and values used for the WAMCUT code are contained in the calculation files generated in the process of completing this analysis. 6.4 Human Reliability Analysis Human reliability analysis was conducted in order to complete the quantification of the detailed fault tree. Two general classes of human errors were considered; those that occur prior to the initiating event and those that occur once the accident is in progress. An example of the former is an error where a critical component such as a single valve in the discharge path to the steam generators is left closed following testing or maintenance. An example of the latter is operator failure to properly align the opposite unit AF4 pump to discharge to the affected unit. Each critical human error is individually identified in the detailed fault tree. p Table A-8 summarizes the important human errors considered in this analysis. The table groups the individual errors by the type of contribution to the AFd system failure probability that is expected from the group. The values given in the table represent the human error probability (HEP) assigned to each basic
' event (human error) in the group. There are three different values assigned for most of the human errors in the table. The different values are used to represent the probability of each human error, given three sets of system conditions. The human error probabilities for the system conditions that -
existed prior to the system changes required as a result of the incident at TMI, the current system conditions and the system conditions that are expected to exist should certain key changes in system operation and design be incorporated, are respectively listed in the table. In addition, pertinent comments and a summary of the source of the respective HEPs are also included. Three general sources of human error probabilities are given in the table. Each is discussed briefly below. 1 4 O Page 214 of 453
,r ---- - _ _ . - , , , --y
TABLE A-8 HRA VALUES FOR NSP AFW ANALYSIS VALUES BEs GROUP # IN GROUP PRE-TMI CURRENT FUTURE SOURCE / COMMENTS 1 AHX1110X c c c Assumed to be included in pump failure rates. AHX1210X c c c Therefore, an c value is assigned. AHX2110X c c c AVHA133X c c c AVHA134X c c c AVHA135X c c c WVH11TBX c c c 2 AVHAl21X 1E-3 IE-6 IE-6 Specific TilERP analysis performed for Current / Future values. AVHA122X (Coupled) (Coupled) (Coupled) Pre-THI value - Based on 0611 number. 3 WUIRTHDX 4.2E-4 2.lE-4 IE-5 Current value - AN01 Component Class Ic. WU2RTHDX Pre-THI value - 2* Current value (Eng. Judgment). WVHCW11X future - AN01 Component Class II. WVHCW12X Assumed - Not currently verified by post maintenance test. 4 CVH2C71X 3.6E-4 IE-5 1E-5 Current / Future value - AN01 Component Class III. CVHC271X Pre-THI value - 2* AN01 Ccmponent Class la (Eng. CVHC411X Judgment. CVHC412X Assumed - CST level (monitored continuously in CR) will act as component status indication. Page 215 of 45
f (l (D
%J %, \ )
- TABLE A-8 HRA VALUES FOR NSP AFW ANALYSIS ;
(continued) ALUES BEs GROUP # IN GROUP PRE-TMI CURRENT FUTURE SOURCE / COMMENTS i i 5 CVHC541X 3.6E-4 1.8E-4 1.8E-4 Current / Future value - AN01 Component Class Ia. Pre-TMI value - 2* Current value (Eng. Judgment). Valve position cannot be determined by any control room indications.
> 6 AVM0016Z IE-5 IE-5 IE-5 All values - AN01 Component Class III.
AVM0017Z All MOVs in this list are monitored in the CR at AVM0238Z 1 east once per shift. Some are monitored more AVM0239Z frequently if they have indication on the SI AVM0242Z ready panel. - AVM0243Z AVM0333Z AVM0335Z AVM0336Z AVM0381Z AVM0382Z 7 AVM0016X 1.0 1.0 1.0 The recovery failure value for these valves AVM0017X (Group 6) includes both the operator error HEP and the failure to recover HEP. Therefore, to
! AVM0238X AVM0239X keep the model results from being over-optimistic AVM0242X for the Group 6 and Group 7 HEPs, Group 7 values AVM0243X will be assigned a value of 1.0. (i.e., In the AVM0333X model, Group 7 is always ANDed with Group 6.)
AVM0335X AVM0336X AVM0381X AVM0382X ! Page 216 of 453
r TABLE A-8 HRA VALUES FOR NSP AFW ANALYSIS (continued) M UES BEs GROUP # IN GROUP PRE-TMI CURRENT FUTURE SOURCE / COMMENTS 8 AVHXCN0X c c IE-5 Current / Pre-THI values - X-conn valves are not tested or maintained during plant operation. Future value - AN01 Component Class III. Assume - valves will be replaced with MOVs that have indication in CR and will be periodically tested. 1.9E-4 If left as is and tested - AN01 Class Ib. 9 AVHXCN0Y c c <1E-5 Current / Pre-TMI values - Opening of both X-conn valves when not required during plant operation is assumed to be similar to an act of sabotage and is therefore assumed to be unquantifiably low. Future value - Inadvertent opening of both x-conn valves when not required for plant operation is also assumed to be unquantifiably low. Assumption for future value - Both valves (if MOVs) have separate control panel switches and operate independently. 10 AVHM222X IE-5 lE-5 0.0 Current / Pre-TMI values - AN01 Component Class II. AVHM222Y Future value - Assumed valve discharge will be piped to turbine exhaust. This eliminates possibility of this error. NOTE: Overall AFW system unavailability is highly sensitive to values used for these HEPs. Page 217 of 45
/ \ ! ,)
TABLE A-8 , ilRA VALUES FOR NSP AFW ANALYSIS (continued) VALUES BEs GROUP # IN GROUP PRE-TMI CURRENT FUTURE SOURCE / COMMENTS 11 AVHXCONY 1.3E-2 1.3E-2 2E-3 Pre-TMI/ Current - AN01 value for incorrect AVMU2SGY diagnosis of information during complex dynamic WVMCWSCY situations. Assume HEP will be dominated by this error. These actions are not currently proceduralized. Future value - Palisades PRA ilEP 5, Failure to Align a System. This itEP is based on proceduralized actions required during short time frames. Therefore, may be somewhat conservative. 12 FAILURE TO 0.25 0.25 2E-3 Pre-TMI/ Current - Eng. Judgment based on following ALIGN CST information: COOLING WATER - No procedure. TO Tile AFW PUMP - Few operators aware that valves exist. L.0. COOLER - No remote indication of valve position. Future - Same as for Group 11.
- Assume will be proceduralized and operators will be trained as to location and use of valves.
Page 218 of 453
6.4.1 HEPs Cbtained from Existing Work Many of the human errors were of the type where a key component is left misaligned or improperly positioned following testing or maintenance. The IREP evsluation of the Arkansas Nuclear One - Unit 1 ( AN01) nuclear power plant contained a detailed assessment of similar human errors (Ref.1). The values used in this AN01 assessment were applied to the AFW HEPs where appropriate. The future value of the HEP for failure to properly use the opposite-unit AFW pump (i.e., use the cross-connect pump) and for failure to properly align CST cooling water to the AFW pump lube oil cooler was obtained from a similar HEP used in the Palisades PRA (Ref. 2). 6.4.2 HEPs Obtained from Engineering Judgement Certain human errors could easily be bounded by engineering judgement. Either the resultant error would have to manifest itself in the plant-specific failure data for the given component, would have to be considered to have a probability of occurrence that is unquantifiably low or be considered as highly likely to occur and assigned an accordingly high error probability. Judgement was also used to assign step changes in a given HEP to cover cases where detailed modeling would have inefficiently used available resources. 6.4.3 Detailed Human Reliability Analysis One human error was considered to be .of suf ficient importance to merit an individual detailed human reliability analysis to determine its contribution to the AFW System failure probability. The coupled human error of leaving both of the manual valves inside containment (AF-12-1 & AF-12-2) closed following test or maintenance completely dominated the NUREG/CR-0611 analysis of the Prairie Island AFW System. For this reason, this error was analyzed using the THERP methods described in Swain and Guttmann (Ref. 3). The results of that analysis are summarized in Figure A-13. The supporting information for the analysis along with the final quantification value is given in Table A-9. All of the HEPs discussed above and given in the table were evaluated as to their importance to the overall AFW system failure probability. In those cases where the HEP appeared to significantly affect the model results, sensitivity analyses were conducted to determine the effects of large uncertainties in the given HEP. The results of these sensitivity analyses are discussed in detail in the main report and are summarized for the single unit analysis below. 6.5 Quantitative Results The quantitative results of the Auxiliary Feedwater System reliability analysis are discussed in this section. This discussion only considers the results of the single-unit analysis. The results of the two-unit analysis are discussed in Apoendix F. O Page 219 of 453
4 2 I
/ The. baseline probability of failure of the Auxiliary Feedwater System, given
- 4. b complete loss of main feedwater as the initiating event is estimated to be 2.0E-5. This value assumes that the potential impact of excess leakage of steam-
. from MS-22-2 has been corrected or shown to be an insignificant problem.
Contributions from common failures of components that are not already specifically modeled in the fault tree (i.e., common-cause failures) are not
- included in this value. The key contributors to this value are summarized in-
! the first entry in Table A-10. Table A-11 provides a description of each of the key contributors identified in Table A-10. I Sensitivity of.the baseline value to various changes in the v'alues used to derive the baseline estimate of AFW System failure probability are also given in Table A-10. n i I l 1 i t O l I j' - i 1 4 5 j { 4 i l' ! t i l Page 220 of 453 j r 4 r e m' - ,-- . , - , --, ..,-,e--,, ..w- w,, -,-,,,,m, - , , -,,-m-, , , , ,,-.y .g,,, , , , -yn--m-,,-..e.,, e,es, ,,n--m, .n--+mp---,wwm.,r v vm-gwg-.- y
FIGURE A-13 - THERP ANALYSIS OF KEY HUMAN ERRORS ASSOCIATED WITH OPERATION OF THE MANUAL VALVES INSIDE CONTAINMENT (AF-12-1 & AF-12-2) 4 A
= 8 C C e
D 8 0 d D F r 3 g 2 A - Operator does not use Prestart Checklist to align valves B - Operator uses Prestart Checklist improperly . C - Operator omits check of valves when using checklist D - SS does not review Prestart Checklist F = (0.99)(0.5)(0.003)(0.01)== 1.5E-5 Ff
=
(0.99)(0.5)(0.01)(0.01) = 5.0E-5 F = (0.01)(0.01) 1.0E-4 3 1.7E-4 E r F F 5 4 E - SS does not use Unit Startup Procedure for Unit Startup F - SS does not complete Unit Startup Procedure Step 73a. F 4 = (0.997 (0.003) = 3.0E- 3 F = (0.003 = 3.0E-3 5 6.0E- 3 O Page 221 of 453
n . l-I i' l d' j-
/ TABLE A-9 SUPPORTING INFORMATION AND QUANTIFICATION OF THE THERP ANALYSIS FOR VALVES INSIDE CONTAINMENT (I)
(AF-12-1 & AF-12-2) i r A = 0.01 Table 20-6, (3) a= 0.99 B= 0.5 Table 20-6, (8) b= 0.5 l- Clb = 0.003 Table 20-7, (2) -- i ClB = 0.01 Table 20-7, (4) -- 0 = 0.01 Table 20-22, (1) & (10)LB(2) .. E = 0.003 Table 20-6, (3) LB e= 0.997 F = 0.003 Table 20-7, (2) -- l _The valves are only maintained or operated during plant shutdown. l Assume complete coupling between valves. Step 73a of the Unit Startup Procedure requires entry of pump flow value. Therefore, can assume correct use of checklist (Note for Table 20-6) when using Unit Startup Procedure for unit startup and check of pump operation in Step 73a. Assume use of Prestartup Checklist to properly position valves is completely
-(~ \
independent of use of Unit Startup Procedure to verify flow (and thereby proper valve position) through valves. Therefore, likelihood of valves being left in wrong pos'ition during operation: f l- P (Valves not properly positioned by Prestart Checklist)
- P (Proper flow through valves not verified by Unit Startup Procedure) 0R
! (1.7E-4) (6.0E-3) = 1.0E-6 l l (1) Table values from Reference 3. l- -(2) LB = Lower Bound. I O Page 222 of 453
TABLE A-10 SENSITIVITIES FOR SINGLE-UNIT LOSS OF MAIN FEEDWATER NEW SYSTEM . CllANGE FROM FAILURE BENCl! MARK DESCRIPTION PROBABILITY VALUE KEY CONTRIBUTORS AFW system benchmark failure 2.0E-5 -- (PUMPil) (PUffl7) (XCONNC) probability (PIJRPIT) (RUMP 12) (21DIVR) (PUMP 12) (UlCWRT) (PUMPil) (CWIT) (E6RE) (PUMP 12) (tWI7) Recovery of 75% of turbine- 8.0E-6 -1.2E-5 (PUMPil) (PUfiF17) (XCONNC) driven pump #11 failures (PIURF17) (UlCWRT) (PUMP 12) (CWl7) Upper bound estimate for turbine- 3.0E-5 +1.0E-5 (PUMPlI) (PUMP 12) (XCONNC) driven pump #11 failure-to-run (PUMP 11) (PUMP 12) (21DIVR) (PUMP 11) (TWIT) (XCONNC) (PUMP 12)(UlCWRT) (PUMP 12) (CWIY) (PUMP 11) (PEWIP) (PUMP 21) Page 223 of 4
TABLE A-10 SENSITIVITIES FOR SINGLE-UNIT LOSS OF MAIN FEEDWATER (continued) NEW SYSTEM CHANGE FROM FAILURE BENCHMARK DESCRIPTION PROBABILITY VALUE KEY CONTRIBUTORS I AFW pump common cooling water supply and return valves
- 1. Assume: - Transfer closed 1.4E-5 -6.0E-6 (PUMPll) (PUMP 12) (XCONNC) numbers are high (PUNPll) (PUMP 12) (21DIVR)
- Improved test and maintenance procedures
- 2. Assume: - Imptoved test and 1.6E-5 -4.0E-6 (PUMPll)(PUMP 12)(XCONNC) maintenance procedures (PUMPil)(PUMP 12)(21DIVR)
(PUMP 12) (UlCWRT) ,
- 3. Assume: - Upper bound limited 2.2E-5 +2.0E-6 (PUMPll) (PUMP 12) (XCONNC) by AFW pump failure probabilities (PUMP 12) (UlCWRT) 1 NOTE: The UICWRT term includes both cooling water supply and return failures.
Page 224 of 453
TABLE A-10 SENSITIVITIES FOR SINGLE-UNIT LOSS OF MAIN FEEDWATER (continued) NEW SYSTEM CHANGE FROM FAILURE BENCHMARK DESCRIPTION PROBABILITY VALUE KEY CONTRIBUTORS Availability of the #21 pump: 5.5E-6 -1.5E-5 (PUMP 12)(UlCWRT)
- Includes availability and (PUMPil) (PUMP 12) (XCONNC) perfonnance values for entire '
train (PUMP 12)(CWV12)
- Accounts for new procedures and proper training in use of cross-connect and #21 pump
- Modifications to cross-connect values Use of station cooling water for backup suction for the AFW pumps
- Dominated by human error in baseline case. Assume error factor of 10 on HEP
- Using lowar bound value 2.0E-5 -- Same as benchmark.
- Using upper bound value 2.lE-5 +1.0E-6 Same as benchmark.
Turbine-driven AFW pump failure 1.0E-5 -1.0E-5 (PUMPil) (PUMP 12) (TC6t#iC) probability using the upper bound time-dependent failure and assuming (PUMP 12) (UlGRT) 75% of the pump failures will be recovered. (PUMP 12) (CWV12) (PUMPil) (PUMP 12) (21DIVR) G G Page 225 of 45
p q f3 L) J NI TABLE A-10 SENSITIVITIES FOR SINGLE-UNIT LOSS OF MAIN FEEDWATER (continued) NEW SYSTEM CHANGE FROM FAILURE BENCHMARK DESCRIPTION PROBABILITY VALUE KEY CONTRIBUTORS Upper bound estimate of AFW system 3.3E-5 +1.3E-5 (PUMPll)(F0HPT2)(ICDEC) failure probability (PUMP 12)(UTCkn7) (PUMPil)(PUMP 12)(21DIVR) (PUMPll)(PUMP 12)(PUMP 21) Lower bound estimate of AFW system 1.9E-6 -1.8E-5 (DPIPEll) failure probability (DPIPE12) (SGilV)(5tT2V) Best-estimate of Unit 1 AFW system 1.9E-6 .-1.8E-5 (DPIPEll) failure probability, given a loss-of-main-feedwater initiating event (DPIPE12) (including key changes evaluated above) (SGilV)(SG12V) Upper bound on best-estimate of 1.0E-5 -1.0E-5 (PUMPil)(PMPT2)(XCONNC) Unit 1 AFW system failure prob-ability, given a loss-of-main- (PUMP 12) (UlCWRT) feedwater initiating event (including key changes evaluated (PUMPll)(PUMP 12)(PUMP 21) above) i Page 226 of 453
TABLE A-11 DESCRIPTION OF EACH KEY CONTRIBUTION TO THE SINGLE-UNIT LOSS OF MAIN FEEDWATER ANALYSIS PUMP 11 = AFW Pump #11 Faults PUMP 12 = AFW Pump #12 Faults PUMP 21 = AFW Pump #21 Faults XCONNC = U1/U2 AF4 Cross-Connection Valves Closed 210lVR = AFW Train #21 Flow Diversion to Unit 2 UICWRT = Unit 1 Cooling Water Supply / Return Faults CWV11 = Unit 2 Cooling Water Supply Valve CV-1-1 Faults CdV12 = Unit 1 Cooling Water Supply Valve C4-1-2 Faults
- O OPIPE11 = Rupture of AF4 Discharge Header to SG11 DPIPE12 = Rupture of AF4 Discharge Header to SG12 SG11V = Faults in AFW Valves in Discharge Header to SG11 SG12V = Faults in AFW Valves in Discharge Header to SG12 O
Page 227 of 453
~N Table A-12 summarizes the results of the single-unit loss of offsite power (d analysis. Recall that a separate model was used to derive these results. That model is described in Appendix F, which is the two-unit analysis discussion.
Table A-13 gives simplified expressions for the various cut sets identified in Table A-12. The total probability of AFW System failure, given a single-unit loss of offsite power is estimated to be 6.0E-5. This value was derived under the same assumptions used to derive the baseline loss of main feedwater value discussed above (i.e., MS-22-2 no longer significant and no common-cause contribution). Since it is more likely for a loss of offsite power to affect both units, any additional system analysis was conducted under the assumption that both unit's AP4 systems would be required for response to the initiator. Consequently, one should refer to Appendix F for additional insights into the affects of a loss of offsite power on the AFW System.
7.0 REFERENCES
- 1. G.J. Kolb, Interim Reliability Evaluation Procram: Analysis of the Arkansas Nuclear One - Unit 1 Nuclear Power Plant, SAND 82-0978, Sandia National Laboratories, June 1982.
- 2. Palisades pRA User's Guide, Appendix 8, Delian Corporation, (To be published in June 1986).
- 3. A.D. Swain and H.E. Guttmann, Handbook of Human Reliability Analysis with Emphasis on Nuclear Power Plant Applications, NUREG/CR-1278, SAND 80-0200, Sandia National Laboratories, August 1983.
t O Page 228 of 453
r TABLE A-12 KEY CUT-SETS FOR SINGLE-UNIT LOSS OF 0FFSITE POWER INDEPENDENT COMMON P11
- P12
- P21X C00L1
- P12 DG2
- P11
- P21X OG2
- C00L1 DG1
- Pil
- P12 N/A DG1
- DG2
- FIT N/A DCWP12
- DCWP22
- CSTC00L N/A DCWP12
- OCWP22
- Fil N/A O
C00L1 = Failure of pump cooling to Pil and P21 (Common Piping) CSTCOOL = Failure to supply pump cooling using CSTs D5T = Failure of OG1 D52 = Failure of DG2 DCWP12 = Failure of Diesel Cooling Water Pump 12 DCWP22 = Failure of' Diesel Cooling Water Pump 22 P21 = Pump 21 train failure P21X = Failure of pump 21 train when used to supply cooling to Unit 1 Pfl = Pump 11 train failure P12 = Pump 12 train failure O Page 229 of 453
TABLE A-13 SIMPLIFIED EXPRESSIONS FOR SINGLE UNIT LOSS OF OFFSITE POWER INDEPENDENT C0fMON TMM g LM D TM 2 C 2 0 TM -- 3 2 0T -- 2 C3 __ 2 CT -- T = Turbine-Driven Pump M = . Motor-Driven Pump Dg= Diesel Generator No. 1 D2= Diesel Generator No. 2 l C = Diesel Cooling Water Pump , i S = CST Backup Cooling L = Common l';be Oil Cooling Mg= Cross-Conr.ect Motor-Driven Pump l O Page 230 of 453
APPENDIX B SUPPORT SYSTEM ANALYSIS l l O I l l 1 l l l O l 1 Page 231 of 453 1 1
U ; L t t : l' 4 'k - ? 1 4 r' i TABLE OF CONTENTS 't I j P_ age , i:
- l. -
1.0 ' INTRODUCTION . . . . . . . . . . . . . . . . . . . . . . . . . . . . 233 t I 2.0 APPROACH . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 234 j F 3.0 ; LOSS OF MAIN FEEDWATER SEQUENCES . . . . . . . . . . . . . . . . . . 241 4.0 LOSS OF OFFSITE POWER SEQUENCES .................. 244 I !' 5.0 QUANTIFICATION . . . . . . . . . . . . . . . . . . . . . . . . . . 246 i: ; { 5.1 Loss of Main Feedwater .................... 246 i
- f. 5.2 Los s o f Of f si te Power . . . . . . . . . . . . . . . . . . . . . 247 I i, i j; 6.0 '
SUMMARY
.............................. 247 !
I 4 , i J 4 . j .- l 4- .- t i i e i I . l' s 4-i
?
i t I' .- " c~ - f i i '
. t
!. [ l. i-i 4 i Page 232 of 453 1
- i-U- _.-.-..___ .
1.0 INTRODUCTION
The support systems used by the auxiliary feedwater (AP4) system were determined during construction of the AP4 system fault tree. These systems perfs rm the following functions:
- 1. Motive power for the motor driven AFd pumps.
- 2. Cooling of AFW pump components
- 3. Control and actuation for APd pumps and valves.
The systems performing these functions (electrical and cooling water) were examined to identify potential inter-train dependencies and to estimate support system importance to overall AFW system unreliability and the figure-of-merit (yearly frequency of steam generator dryout). 2.0 APPROACH The AFW system fault tree was developed to the major electrical bus (15,16, 25, 26) and individual cooling water system " header", CW1 or CW2. Based on the electrical and cooling water system cependencies shown in Figures B-1 through B-6, event trees were developed to illustrate the impact of these dependencies on AF# system components. Figure B-7 provides the event tree / impact matrix for a loss of main feedwater - initiating event. Safety injection is included because an SI signal will result in an auto-isolation of the Unit 1 and 2 cooling water headers; thus, the AFW pumps will not receive cooling water (CW) from a common header. Electric power (AC/DC) is not included because of the low likelihood of multiple bus losses (4 buses); 3 of which are involved in a single unit loss of main feedwater initiating event. They are considered for the loss of offsite power (LOOP) case. O Page 233 of 453
p p 3 pb V V
.r-se-e .r ie ,
% y ana w <. ire, <me>
g
/ q%.,i, ,3 g3ep
,, m _ .,.
w -se- w -i.-s
/
# ri stre e,.s.t.
EMh.iro < <mo , y q,i,.;,. gg,.
--wr., X-0
.~,
X-0 . ,..we., ~-"I.',1 D-X X-{Jrn-!er - -G!a"
,s n ,
o o es es %s As
*-*i >
- ik?" %;F'* - -#t*s
<r *
--g - ; -wy,3x_{-) gy gre.7 "2M i1 * ,%\ ,_1 ,.103* .tK3' tnia'i' tK3' ,.t 6 3 ' 'NE Xy "uM {'t
( , es.gu (2 > rarse seen rues sore r . sca r o sue H -M' ---,
"c31X --g rg;=r X g3' Tii>' X K2* "3M X 'E ,
- K** 'sv= "#M 4 4 ?!3' =%t2 4 4 gair
,, "eM Zt Zt EM" Z t "3" " 2 45 / t
,3-{>-jghl**~ C.
t'.7,' t'a' C. T#.*i>' tri
-C M""~
4 N- N N--
"in *iM' *iM' * *iM' km --=p,JEO --"acO-I --'7/>X-0 wX-0 C-et-t
- ) ) X ) ) N , s' 2 ro. gr,r 1E*'af pag ,
N N ' ,B S '."'
&*7LA'.G tum C . " ' * * ' Figure B-1 Simplified Flow of the Prairie Island Auxiliary Feedwater System Page 234 of 453 .
CIRCUIT / BREAKER POWER / AIR 50LEt0!D SUPPLY PUMP -- [' : : 32 16-1 12 16 12 145-331 21 26-0 21 26 SV-33299 11 F.S. 21 245-331 11 11 CV-31998 Cty1 TROL CIRCUIT s CONDENSATE SYSTEM PMEL 12 (IPPI) SG BLOWDOWN < 12 < CONTROL POWER 12 SV-33288 (SDLEt10!D FOR CV-31682) CmDENSATE SYSTEM l PArCL 21 (21P3) SG BLOWDOWN : 21 < CONTROL POWER 21 SV-33494 (SILEt10!D FOR CV-31683) Cry 1DENSATE SYSTEM PANEL 11 (11P20) SG stuuDown : it : conTRot pouEn : SV-33287 (SDLErOID FOR CV-31681) l ACTUATION CIRCU1T I2 PMEL 16 FROM PANCL 12 a OUTPUTS ALSD INCLUDO : EQUIPMENT HE AT REMOVAL p El PArCL 5 FRD'1 PANEL 21 g
^ 11 PANEL 15 FROM PANEL 11
- Figure B-2 Sumary of AFW Pump r rol Circuit Interfaces Page 235 of 453
__ _ __..m ._ _ _ O 'i i (_/ $sd 4 'U s , ,-
- u ., 1 ,y e
% ;. N ,is - ,\ ? ,- ~ ~ \; + * 'a
, 1,,"
, , 4 i
h
- s
,/ C j
, N I MV-32383 't 4' 1 g ;^
s '
- MOR3e4 N gt
- f s i s, (,' ,.,'_
v, , 7 g 212- 2 "
.- -r CKT BRK f l
'lT..
2R-4 < ~.. O i n -
'rROM 2RY McC2A esov 2 01 N*
! BUS i BUS 210 STATION AUK 4160v 4
' TRANSFORNER BUS 26 -
~
CONTROL . ' < DGt CIRCuiTL s. 1
' n MCCEA 400V Pot 1
\(
BUS 1 SUS 210 STATION AL% 1^ TRACFORMER s __ FROM PRY ] ACTUATION POWER (tO1E) NN, CJRCUIT b ,. ,
/~ c -
- - t160v BUS 26
,s SPRING RCTURN SWITCH LDCAL SWITCH 46e40 (ANNUNCIATED IN CR (SEAL-IN) If IN LOCAL POSITION)
! 46e41 ,
. s.
j Figure B-3 Simplified Diagram of the Unit 2 Diversion 2Reso7Au-a Valve Control and Actuation Circuitry Page 236 of 453
~ NV-32025 NV-32026 MV-32027 % DGt AC f U 11 2 - 1 : CKT BRK. < a ,'a3 u - g,m I "S
- NCCIA 490V 101 BUS 1 BUS 110 ST ATI!21 AUX. 4160V
" TRAnsr0RMER BUS 15 Ctr1 TROL
< DGl CIRCUIT n NCC2A 490V 201 BUS 1 BUS 210 STATItri AUX.
TRANSFORMER % FROM 2RY ACTU4TIOrt POWER (NI210 1 NS CIRCUIT 4160V BUS 26 LOCAL Su!TCH MCCIA 480V 102 SPRING RETURN SulTCH 46433 (Arir1UNCIATED IN CR BUS 2 BUS 120 STATION Aux. TRANSTORNER rp (SE AL -Iro IF Ir1 LOCAL POSITION) 1Ri v 46767 . h p,C 46434 . 4160V BUS 16 l ! Figure B-4 Simplified Diagram of the AFW Pump Cooling Water Suction ! eReso7au Valve Control and Actuation Circuitry O O Page237of45O,
.) .
r
/
2RY DG1 PANEL 11/21 - DG2 PANEL 12/22 I .g I
) NC M NC ( NC(
. I 1. 2 PANEL 11 PANEL 21 2 no J L> noC )to d L> roc l
4160V 4160V 4160V 4160V BUS 15 BUS 26 DUS 16 BUS 25 tot 201 102 202 mm mm mm mm 480V 400V 480V 480V BUS 110 DUS 210 BUS 120 BUS 220 490V MCC 480V MCC 480V MCC 480V MCC 1A BUS 1 2A DUS 1 1A DOS 2 2A SUS 2 480V MCC 480V MCC 480V MCC 490V MCC 1AC SUS 1 2AC SUS 1 LAC SUS 2 2AC SUS 2 11 21 12 22 in l I ! 25 I I l
" I i !
22 I I ! U1 DC PANEL 11 U2 DC PANEL 21 U1 DC PANEL 12 U2 DC PANEL 22 (TRAIN A) (TRAIN A) (TRAIN B) (TRAIN B) (3-4 HRS) (4-6 HRS) (I HR) (1-15 HRS)
" ^'
Figure B-5 Simplified Diagram of the Prairie Island Electrical Distribution System Page 238 of 453 , ,
. -a l ,a E
S. I f k a y
- =
g >j >- g >j >- g >j >- g >, < > - t t t i d t & d C $ d d _a_ t a t a a [
,. 5'__ O'_ O _ 3 __
E f+ g1+ f+ g1 + d [ht . N [! t d [! t . d [! t e
,. a , .. ,. -
6, + .
.+ , U+ = . + g 5 5
L Y L e e e e l I t e
- W E l g c
a< e e s
-. a-p =
5 E I N E
@ =
G l* 1 l
AE 5$ 5$ 5l 5d
== sem sem a- m asm a y
' g
=W W s . ~. ==
J
=W =W -
m E5 25 5 25 M E% n og og "% g og o, e m W W
- o 5 o
~v
.=
e e e 5.m n= , W J e J a5 o
=
= sz oc f3 3e
-Q A
.. o ..= m-E .. o ma == ma c E m c-
- a. g o .- o- o mm N N %
o b u "a m m E 5
- 3 E O- I a EU
~m M
o a o s sa <
- i
< gm ,
m 5 E e
- U
" 3 >- E b NN -.
*D --
3 . m o
< ~-
N$ o-am o-amo on amu W
- g mm o 3
=
m E
= o 5
- O U U o
U o -
.8m o
- a m .
7o E o u
\d N .. a .. s .. m (
~~
"8
$" ~
v m se ."- Uo ."- on W amu e a
.$w seu u g 3
- o cc 2 s.
>= W 3
w s. e-6- m n - r= g e ay em
= 5 s ~
#4W MG L La-R.e
- o. -
DN W M E". t g. m
- ~ m . m . ~ m ,
CD' W L
)
m m .= y =e b 6
=5
, , > , u - -
,. a ,. , - .- - -- ,, ~n -.. -., _ . , , , . , . , , . ..m_,,,4 . ~-._-s,. -.,-n,..,,.ng-..-,m, ,,c,,, _ . ,., , , . , ,,- -wr. .-n
Figure B-8 provides the event tree / impact matrix for the loss of offsite power (LOOP) initiatsag event. Figure B-9 provides a reduced matrix and corresponding sequence cut-sets. In this case, the diesel generators have been included in the event trees. The CW Unit 1/2 top event has been replaced by diesel driven cooling water pumps 12 and 22 (DWCP12, DCWP22). 3.0 LOSS OF MAIN FEEDWATER SEQUENCES Each sequence is described briefly below. Secuence 1 (No SI Signal, Both CW System Trains Succeed) No impact on matrix elements. Sequence 2 (No SI Signal, Unit 2 CW Fails) In this case, adequate cooling water flow is available because without an SI ) signal Unit 1 CW will supply flow to all AFW system components using cooling water; cooling water faults within the AFW system are treated explicitly in the AFW system fault tree. A (? mark) is shown in the main feedwater (MFW) matrix element because the effects of reduced cooling water on main feedwater are unclear. Also, effects on continued operation of the " unaffected unit" are unclear. Many systems are dependent on the operating status of the Cooling Water System (CWS). This sequence illustrates the dependence of both main feedwater and auxiliary feedwater on the CWS. An initiating event caused by loss or degradation of the CVS is not in the scope of this analysis; the frequency and consequences of such an event are not considered. The u.ireliability of this system following a loss of feedwater event (or loss of offsite power) is considered. In both cases, the initiating event is assumed to not be caused by cooling water system problems. O Page 241 of 453
1 REPLICA E I 2 3 4 3 9 1 2 3 4 4 5 6 1 7 1 9 1 1 U F F F F F F F B 2 F F 2 C F F P M t ev i n U F F F F F F F U B n 3 2 1 o 5 1 C F F F F g . P a 4 M t E F F F F d f M F F F T S n o Y e p S F F F F F e 2 U F F d B 4 m W 9 2 F 4 A 1 2 C F F F F 2 2 e P 3 g M d a.
, E F F F F F n P T M F F a 5 .
T 8 S 4 F F F F F 2 W U F F 2 F B 3 A N l F F F F g O i P C 3 r S 4 o T 2 f C 2 A M 3 P s M d n e I B B B B B a c 2 B B n . 2 2 4 e
- 2 u q
2 B B B B B B B 2 R 1 3
- e E V S W M O B B B B B n P 1 B B o C
2 t i o D l B B B B B a t 1 B B n i 1 g d Si n 5 2 F F F F F F F n o B e C p R 6 O y E 1 F F F F F F F s r W O 8 d n ar P e de C 6 2 F F F F F F F s nw uo A B o s oP S l B I F F F F F F F A /e B mt ei t s sf yf E SO C - N tf Ef I 2 3 4 5 6 7 8 9 0 1 21 131 4 1 1 151 1 61 7 8 ro U Q E o-ps S ps uo Sl G1 8 D
,' B l
e R r NE G1 u g OW IO D i TP - I g F DE hT OI (5 F P vF W2 AO C2 K - D UF NO O - D$ BS
/O ML P E W2 TR C1 SO D YF S
S TE
- RC L ON A PE N)
PU GV UQ I/ 5E $N S ( 1 1 P . O O E. L1 l;
U F F F F F F - B 2 2 C F F F 5 P 4 M f o U F F F F F F 3 B 4 2 2 M C F F F E 1 P e T g S Y M F F F F F F a S P W F F F F F F F U A B 1 2 C F F F P M F F F F F F U F F F F F F B 1 1 C F F F P M 2 B B B B B B 2 R B E 2 B B B B B W 1 O P B B B 1 B B B C 2 D 1 B B B B B B 1 5 F 9 2 F F F F F O
- B B
R 6 F F E E 1 F F F F R W 8 U O G P 6 2 F F F F F F I F C B A S F F I F F F F B T 2 5 2 G G T 2 U D E P 2 z S W 2 - l
- T
- U D
C D F W 2 C i W 2 C 2 1 N O U C K 2" L U -
- D P D P I O D D W W 2
- C
- C S
S E L A M U D 1 P 1 D I D R I W 5
- S
- P N C X I D 1 I E M 5 S E
R U L 1 2
\ 2 F P W 2 E
C O 2 C D U D G D N
- 2 2 E G P * *
- U 5 7 T D W 2 Z 2 Q T 5 5 C 2 2 E E 5 TD 5
- D 1 P
2 2 P I P 1 P U*G S S P
- *
- 1 1
- W W W W W T
U 2 2 D U 2 5 5 D 2 D 2 C D D C C D C D C D C 1 1 1
- 1 1 P P
- P
- P
- P * * * *
- W C W T W W K
O C D 5 1 ED W 1 5 AD C 1 5 U D C D 5 1 C D S I 1 5 1 5 1 5 1 5
. . 0 . . 1 . . 2 . . 3. . 8 4 5 6 7 1
1 5 1 2 6 1 3 7 1 4 8 1 9 1 1 1 1 1 7 I 2 3 4 5 6 7 8 9 0 0 QQ E S E U I N U E U Q N U E U Q I N U E U Q I N U E U Q I N U E U Q N U E U Q N U E U Q I N U E U IQ N U 6 8 R 2 9
Sequence 3 (Same as Sequence 2 Except Different CW Train) ( Sequence 4 (No SI Signal, Both CW Trains Fail) In this case, the mfd System will be made unavailable (no cooling) and normal cooling to the AFW pumps is lost. In addition, the backup suction supply to all AFW pumps is lost. The condensate storage tanks (CSTs) can be used to cool the AFW pumps. The , impact matrix designates this backup cooling source as " CST BU". The backup cooling source requires local manual action by operations personnel. Sequence 5 (SI Signal Occurs, Both CW System Trains Succeed) This sequence is the same as Sequence 1 except MFW pumps are auto-tripped and motor-operated valves MV-32242 and 32243 are signaled to open. , Secuence 6 (SI Signal Occurs, CW2 Fails) MFW tripped; normal cooling to pumps P12/22 lost; backup suction to pumps P12/22 lost; motor-operated valves MV-32242, 43 are signaled to open. The CSTs can be used to supply cooling to pumps P12/22. Sequence 7 (SI Signal Occurs, CW1 Fails) This sequence is the same as Sequence 6'except that different components are affected. Secuence 8 (SI Signal Occurs, CW1 and CW2 Fail) Normal cooling to all AFW pumps is lost; backup suction source is lost to all AFW pumps; MFW is lost; both units will require auxiliary feedwater. The CSTs are available to supply cooling to the AFW pump. 4.0 LOSS OF OFFSITE POWER SEQUENCES The loss-of-offsite power (LOOP) event tree includes SI signal, diesel cooling water pumps (DCWPs), and diesel generators (DGs). The status of the top events impacts the status of AC and DC power buses and AFW system components. The 4 AC and 4 DC buses are shown in the matrix. Motive (M), normal cooling (C) and backup suction (BU) functions are shown for each AFW train. The final column, Replicate, is used to note those sequences that impact each matrix element identically. The impact on motor-operated valves MV-32242, 43 and MV-32248, 49 is not shown because it complicates the analysis to a degree that the resulting sequences become more burdensome to analyze then is worthwhile for the minor impact of having an open signal sent to these valves. MFW is not shown since it is lost because its 4160 V buses are de-energized on a loss of offsite power. , Sequence 1 (All Necessary Top Events Operate) No impact on matrix elements. Page 244 of 453 1
-, .- - , _ _ _ _ . - -- . . - , - . . - _ _ _ . -- ~ , _, ,-.+_-w. .
4 ,
Sequence 2 (DG2 Fails)
- 1. Emergency 4160 v buses 16 and 25 (B16 and 25) are de-energized.
- 2. CC buses 12 and 22 (DC12 and 22) are supplied by respective batteries only.
- 3. Power to Pump 22 (P22) backup suction valve is lost.
- 4. Power to P12 is lost.
- 5. Power to P12 backup suction valve is lost.
Sequence 3 (CGI Fails)
- 1. 815 and B26 have no power.
- 2. DC11 and 21 supplied by respective batteries only.
- 3. Power to Pump 11 (F11) backup suction valve is lost.
- 4. Power to Pump 21 (P21) lost.
- 5. Power to P21 backup suction valve is lost.
Sequence 4 (DG1 and DG2 Fail)
- 1. B15, 16, 25 and 26 have no power.
- 2. OC11, 21,12 and 22 supplied by respective batteries only.
- 3. Power to P11 backup suction valve is lost.
- 4. Power to P21 is lost.
- 5. Power to P21 backup suction valve is lost.
- 6. Power to P12 is lost.
- 7. Power to P12 backup suction valve is lost.
- 8. Power to P22 backup suction valve is lost.
Sequence 5 (DCWP12 Fails) Same as Sequence 1. Sequence 6 (DCWP12 Fails and CG2 Fails) Same as Sequence 2. Sequence 7 (DCWP12 Fails and CG1 Fails) Same as Sequence 3. Page 245 of 453
v /$ 'O
' Sequence 8 (DCWP12 Fails and OG1 and DG2 Fail)
-~
~Sa ne as Sequence 4.
Sequence 9 (DCWP12 and DCWP22 Fail) Same as Sequence 4 plus the following:
- 1. Normal cooling to P11 is lost.
- 2. Normal cooling to P21.is lost.
- 3. Normal cooling to P12 is lost.
- 4. Normal cooling to P22 is lost.
~
Sequences 10 through 18 display the influence of an SI signal. Since an SI signal is not anticipated during a normal loss of offsite power initiating event, these sequences will not be considered further. If, in the future, it is determined that there is a reasonable probability of an SI signal occurring concurrent with or during a loss of offsite power, these sequences should be re-considered. A probability of about 10% (conditional probability of receiving an SI during a loss of offsite power event) is a reasonable screening value. 5.0 QUANTIFICATION , Each initiating event is addressed separately below. ( 5.1 Loss of Main Feedwater Motive and Control Power Each of the motor-driven AFW ' pumps (P12 and P21) are supplied by separate AC and DC buses. AC power for P12 is supplied from 4160V Bus 16 which is powered by either the IRY reserve transformer or diesel generator 2(DG2). Control power is supplied by U1 OC Panel 12 which is also supplied from 4160V Bus 16. AC power for P21 is supplied from 4160V Bus 26 which is powered by either the 2RY reserve transformer or DGl. Control power is supplied by U2 DC Panel 21 which is also supplied from 4160V Bus 26. Turbine-driven pump 11 fails safe (starts) on loss of DC power; the governor is a mechanical type design and CV-31998 opens on loss of DC or air. The overall failure probability of the AC and OC buses associated with the motor-driven AFW pumps should be significantly lower than individual pump failure rates during the six hour mission time. In addition, it is likely that the failure probability of the buses is already included in the pump and vave failure rates. Therefore, degradation of these buses during operation sufficient to both cause an initiating event and impact AFW system availability was not considered in this study. . For this stedy, the contribution of AC or DC power failures will be considered as being included in the individual AFW system component failure probabilities. p/ y The separation between those buses supplying motive and control power to the motor-driven pumps and associated valves justifies this approach. Page 246 of 453 4
7 Pump Cooling A detailed model of the cooling water system (CWS) was not developed and quantified. Instead, PI-specific CWS performance was used to estimate its failure probability as described below. The impact on continued operation of both units on degradation of the CWS was not considered. Degradation of this system imcacts systems other than the main fdedwater and auxiliary feedwater systems. Treatment of a degradation or loss of normal cooling water as an initiating event was beyond the scope of this study. Unit I has operated for about 12 years without CWS problems sufficient to cause either a loss of the main feedwater system or degradation of the auxiliary feedwater system. Evidence 0 events in 12 years, or 0 events in 105120 hours If a " half-failure" is assumed, the hourly failure rate is 4.8E-6. If it is conservatively assumed that operation of the two DCWps reduces this value by a factor of 10, the overall hourly failure rate is 4.8E-7. For a 6 hour mission time, the failure probability is 2.9E-6. This value is negligible when compared to the overall failure probability of the AFW system. Hence, failure of the CWS during a loss of main feedwater initiating event will not be explicitly addressed further. 5.2 Loss Of Offsite Power For this initiating event, electric power and cooling become potentially significant contributors to the overall AF4 system failure probability. Appendix F addresses each of these functions in detail. 6.0 SU S.ARY Electric power and AFd pump cooling from the CWS will not be explicitly treated for a loss of main feedwater initiating event. DC power and CWS dependencies between the main feedwater system and AFW system can be considered ir. the future, if necessary. Appendix F explicitly examines the impact of electric power and cooling water for a loss of offsite power initiating event. For this event, reliance on the DGs and DCWPs exists until offsite power is restored. O Page 247 of 453
4 i i i i i J t APPENDIX C 1 STEAM GENERATOR PERFORMANCE i , i-t-
- i i i 1
- i
- i. t r
i i I i f ! l-i i ! i 1 1 r 1, , It !9 r' l l I l i l i i , 1. i i ) i l I L r I i 1 f l I, , !9 i f Page 248 of 453 F i I f
1.0 Introduction As stated in Cbjective 1 of Section 1.2, the figure of merit for the reliability of the auxiliary feedwater system is the yearly frequency of an event that results in steam generator dryout. When dryout occurs, there is a complete loss of decay heat removal capability through the steam generators and an alternate method of decay heat removal must be initiated to prevent core damage. This section describes the steam generator performance analysis conducted to determine how long it takes to reach steam generator dryout conditions given a wide range of transient conditions. These dryout times are used to determine how long the operating crew has to either (a) restore feedwater flow to the steam generators, or (b) initiate an alternate method of decay heat removal. Additional analysis was performed to evaluate how long the operators have before they must throttle back the auxiliary feedwater flow to prevent overfilling the steam generators. These .nalyses were performed using the DYNCDE-P computer program (Reference C.1). A description of the DYNCDE-P code and the NSP transient analysis methodology is contained in Reference C.2. These methods have been reviewed and approved by the NRC (Reference C.3). 2.0 Calculations Two general categories of transients were considered, loss of offsite power and loss of feedwater. Sensitivities were determined to various parameters such as decay heat generation, time of reactor trip, amount of auxiliary feeawater available, etc. Also, it was determined how long it would take to fill the steam generators to the upper tap elevation if the auxiliary feedwater flow was not throttled back. A description of the individual cases is as follows. 2.1 Loss of AC Several loss of AC (LOAC) cases were considered. All cases assumed a loss of AC power at time = 0 sec causing reactor coolant pump trip, reactor trip, and loss of main feedwater. Condenser and atmospheric dump systems are assumed not available. The following sensitives were analyzed. LOAC This case assumed I auxiliary feedwater (AFW) pump available and 1.0 ANS decay Feat generation. LOAC This case assumed 0 AFW and 1.0 ANS decay heat generation. LOAC This case assumed 0 AFd and 1.2 ANS decay heat (120*; of the predicted decay heat generation). LOAC This case assumed 2 AF4 pumps running and 1.0 ANS decay heat generation. This case was used to determine when the AF4 pumps must be thro *.tled back. O Page 249 of 453
I 2.2 Loss 01 Feedwater V Several Loss of Feedwater (LOPW) cases were considered. All cases assumed a main feedwater isolation signal at time = 0 seconds, followed by a 5 second linear ramp down of the main feedwater flow. Reactor trip is caused by eitter steam generator low level coincident with a steam / feed flow mismatch signal, or a low-low steam generator level signal. The following specific cases were run. LOPd This case assumed 1 AFW pump available, 1.0 ANS decay heat generation and coincident low level-steam / feed mismatch reactor trip. LOFW This case assumed 0 AFW, 1.0 ANS decay heat, and coincident reactor trip. LOFW This case assumed 0 APd, 1.2 ANS decay heat, and coincident r! actor trip. LOFW This case assumed 0 AP4, 1.0 ANS decay heat, and low-low steam generator level reactor trip. LOFW This case assumed 0 AFW, 1.0 ANS decay heat, coincident reactor trip, and no condenser or atmospheric dump available. LOFV This case assumed 0 AP4,1.2 ANS decay heat, and low-low steam generator level reactor trip. LOFW This case assumed 2 APd pumps running, 1.0 ANS decay heat, and a coincident reactor trip. This case was used to deterruine when the APd pumps must be O throttled back. V In addition to the calculations described above, the steam generator dryout time following a loss of AFW 1, 2, and 3 hours after reactor trip has been estimated. These calculations assumed steam generator level of 60*.' wide range span at the time of loss of AFW, as called for in the Prairie Island operating procedures. 3.0 Results For the purpose of comparing relative steam generator dryout times, it was decided the criteria used for dryout would be 10% wide range level indication. This level provides margin for instrument and modeling uncertainties, as well as some time for the implementation of alternate cooling methods. A discussion of the results as well as plots of steam generator level versus time follows. 3.1 Loss of AC The loss of AC results show that approximately 60 minutes are required for the steam generators to dryout. The main sensitivity of the dryout time is to decay heat level. A conservative case assuming 120*; of the ANS decay heat generation standard causes the steam generator to reach 10*; wide range level at 46 minutes, with complete dryout occurring at 60 minutes. Cases were also run to determine the time required to fill the steam generators up to the upper tap elevation assuming 1 or 2 APd aumps running. With 2 pumps running the water level reaches the upper level tap at 50 minutes. With only 1 AFW pump OV available, it will take over 4 hours to full the steam generators to the upper tap elevation. Page 250 of 453
. 1
3.2 Loss of Feedwater The loss of feedwater cases show that, in general, the steam generators will dry out in approximately 30 minutes if no auxiliary feedwater is available, The main sensitivity of dryout time following a loss of feedwater event is length of time from the loss of feedwater until a reactor trip signal is generated. The time to dryout is also sensitive to the decay heat generation level. A conservative case using the most limiting assumptions with regard to trip time, decay heat level etc. caused the steam generator to reach 10% wide range level in 21 minutes, and complete dryout occurs in 32 minutes. As with the loss of AC cases, calculations were performed to determine when the steam generator will reach the upper tap deviation given 1 or 2 AFW pumps running. With 2 AFW pumps running, the level will reach the upper tap elevation at approximately 65 minutes, With only 1 pump running, it will take over 4 hours to reach the upper tap elevation. 3.3 Failure of AFW Supoly After Successful Initiation The possibility that the AF4 system fails af ter an initial period of successful operating has been investigated. These calculations assumed that the AFd system failed after successful operation of 1, 2, or 3 hours, It was assumed that the steam generators were at 60*. wide range level at the time of AFW failure. The results are shown in Table C.1. O O Page 251 of 453
I 1 References C.1 NSPNAD OYNODE-P Manual, Version 84163, Rev 0, March 1985. C.2 NSPNAD-8102P, Rev 2, " Reload Safety Evaluation Methods for Application to PI Units" March 1983. C.3 Letter, James R Miller (NRC) to Dave M Musolf (NSP), SER related to NSNPNAD-8102P, Rev 2, Dec 11, 1984. O O Page 252 of 453
Table C-1 Steam Generator Dryout Ti..es e Following AFV f ailure <; 1, 2, and 3 Hours After Shutdown AFW Failure Time Steam Generater Dryout Time (hours after shutdown) (hours after AFW failure) RCP On RCP Off 1 1:10 1:45 2 1:25 2:10 3 1:30 2:15 O O Page 253 of 453
3
- Prairie Island Nuclear Plant
- Loss of AC
. Hgure C-1 f
LOAC-1
~. 6e l ,
; * ; 4
. i 4g. L. .. . . . .. . . . . . . .p . , . . .
{' 3 j 3
, . .3 .
l gg. . . .. ..<..
..,.. . ..) .
.g..
t i
- l. e e see i.e. i ee sees eies ....
he (sec adi) . .i . l J.
, .' Figure C-2 l LOAC-2 ee h
i+ t . 4, ._i. . , . , . . . .j.. . , i
- . 0 1
, 0 .
4 a 3, . . ..<.. .
$ 5
'e see teso isee seco sees aces Me (seconde)
I 1
- Page 254 of 453 w- - a, -w.~.,,-~--- , - - ,. , - - , m-.,,, ,_ ,-,,g,,- ,--,,,-_,-,-.-.,wn,,,m,-y-,,.w,,,- e, -,.,.,-m ,, _ne,,,_mw---+-ygy , -w-
Prairie Island Nuclear Plant Loss of AC Figure C-3 LOAC-3 I 4
- s. .
a
.j.
1,.. <s......> Figure C-4 LOAC-4
.. .e. . .
O
=
'E
... . a. 4 s
1, . . i s . . . . . , g Page 255 of 453
i* i F Prairie Island Nuclear Plant -
- s Loss of Feedwater j' Fi ure C-5
,' , W-1
- 1. :
- i. .
i . . 6 *
- . = -
O
- a. .
3
... .. ..3...
s 1 : t . ri. . <s... a ,>
- j. -
P 1. e a 4 4 i Figure C-6
. LOFW-2 p
..~. . .. . . .. .
1
=
w . i 1 -
= . :
me o - 4
- G9ip
- ri.. cs...a >
Page 256 of 453
.--..-,__,,.,my.,_,-., _ _ . _ . _ . , - _,. ,m,..._,, ,.,m,,m,..w.,-._,,_,-,.,..m--.
J l
. Prairie Island Nuclear Plant a~
Loss of Feedwater W Figure C-7 LOFW-3 s .
, 3
. 3._ . . .; .. ..;... .;.
. ... i... .... ....
n . . < s... .a.) - O Figure C-8 LOFW-4
- s l 3
. Is n . . cs....s.>
l Page 257 of 453
~
Prairie Island Nuclear Plant loss of Feedwater 1 Figure C-9 LOFW-5 se 4g. l.. . . . . , . . . . . . . .. 2 . O ' ' l
- 3 '
, ie. . . . . . . . . . . . . . . ...
'e see sees esse sees Tim. (s... d0 .
l . Figure C-10
. LOFW-6
.e eey . .. ..p.. .
2 C 3 ' no. . ..; . ..;. .;. a e see iese isee see. Ti.. (s....do Page 258 of 453
Prairie Island Nuclear Plant Loss of Feedwater h Figur C-Il LOFW-7 as 4e- t-e N , a as- .. o
* 'se ioee .... ,,,,
Tim. (E.c. d ) O l' t E ' O 1 s Page 259 of 453
i i- l l . APPENDIX 0 l l l DATA ANALYSIS AND EVENT PROBABILITY CALCULATION I i 4 I i. I 1 .l 4 4 l i I i 1 t i 4 ; 4 i 1 i O i l i , i i i i i
- i 1 i I
i ' 1 I i, i 1 l i k i i l I i i Page 260 of 453 4 f i
- . . - - - . - - - - _ _ - - - -- - w--~-
TABLE OF CONTENTS :
1.0 INTRODUCTION
. . . . . . . ... .................. 262 2.0 EVENT PROBABILITY MODELS . . . . . . . . . . . . . . . . . . . . . . 262 3.0 ESTIMATION METHOD .......... ............... 264 4.0 DATA SOURCES . . . . . . . . . . . . . . . . . . . . . . . . . . . . 265 5.0 DATA ANALYSIS RESULTS ...... ................. 277
6.0 REFERENCES
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 289 9
9 Page 261 of 453
c 1.0 INTRODUCTICN The method of analysis in the Prairie Island AFW system reliability study requires the ca'iculation of a probability of an important event (i.e., system unavailability) as a function of many constituent event probabilities. The N1ation of these constituent events to the important event of particular interest and to each other is specified in the system model. Calculating the prcitability of interest, however, requires that the constituent event precabilities be specified. The purpose of this appendix is to explain the derivaticn of event probabilities used by the models of this study. The discussion includes individual component failures and maintenance and testing unavstlabilities. Human errors, common-cause failures, and initiating events are discussed in other sections, and are not included here. In order to maximize the plant-specific nature of the Prairie Island auxiliary feedwater system reliability study, the reliability and availability histories of components at the plant were used as much as possible to derive the event probabilities used in the study. Plant records were surveyed for failure, demand, operating time, and exposure time data, which were used to estimate failure rates for major components in the auxilia/y feedwater system, diesel generators, and diesel-driven cooling water pumps. The failure rate estimates were used to calculate component failure probabilities in the auxiliary feedwater system fault tree, as well as failure probabilities of diesel generators and diesel-driven cooling water pumps. Plant testing and mainte. nance records were surveyed to obtain data on the
- frequency and duration of test and maintenance outages of major components.
These data were used to estimate test and maintenance unavailabilities used in the analysis. The appendix contains sections discussing the probabilistic models serving as the basis for the derivation of the event probability estimates, the method of estimating parameters of these models, the sources providing data for the parameter estimates, and the results of the data analysis. The " bottom line" of the appendix is contained in Tables 0-13 and 0-14, which give the AFW system basic event probabilities and support system component event probabilities. 2.0 EVENT PROBABILITY MODELS Each APd basic event and support system event was assigned an event probability model. Data were used to estimate parameters of the model; the parameter estimates were used to derive the basic event probability. The models used in this study are common models described in a variety of sources (Refs.1, 2, 3). Component hardware failure events were assigned either a time failure rate model or a demand failure probability model. The model for a particular event was selected according to the component type, failure mode, and the nature of failure events in the data. Maintenance and testing unavaflabilities were modeled as the product of the frequency of maintenance or testing activity and the duration of the component outage resulting from the activity. This section now discusses the application of these models in estimating basic event proba-bilities in the AF4 fault tree and support system event probabilities, page 262 of 453
Hardware Failures - Demand Failure probability The demand failure probability (or demand failure rate) model assumes component O failures occur with a constant probability at each demand of the component, regardless of the time between demands; the probability of failure on demand is independent of whether or not the component failed at any previous demand. The number of failures in a given number of demands follows a binomial distribution. The model parameter estimated from data is the probability of component failure at a single demand. This probability gives the component unavailability for use as a basic event probability. This model was applied to failures of components to perform some active function when required. Events using the demand failure probability model include failures to start of diesel generators and pumps, and failures to open and close of valves. These failure modes involve failures to perform some act on demand by a component that is inactive before the demand. Hardware Failures - Time Failure Rate The constant time failure rate model assumes failures occur at a constant rate in time; the probability of failure in an interval is independent of the time of previous failures, if any. The time between failures follows an exponential distribution. The model parameter estimated from data is the hourly rate of component failure. In one version of this model, component unavailability is approximated as the product of the failure rate and one-half the time between activities that verify the component's operability. This version ef the model was applied to standby components that do not operate normally, but may be demanded in an emergency. It was also applied to " passive" components that must remain in a particular state for successful system operation. The state of the component is checked periodically. While in a standby condition, the components are exposed to various failure mechanisms occurring over time, which may cause component failure. Periodic tests or other activities verify the operability of the components, but a component remains failed between the time it initially fails and a periodic test and subsequer t repair. If it is assumed that failure mechanisms occur with uniform likelihood over the time between tests, then the average amount of time the standby component is unavailable if it fails is one-half the time between tests, hence the formula for component unavailability indicated earlier. This version of the time failure rate model was applied in this study to standby and passive component failure modes, including failures to remain open of normally-open manual and motor-operated valves, some pipe ruptures, and control circuit faults of diesel generator and diesel cooling water pumps that are only detectable at a demand on the oiesel generator or pump. O Page 263 of 453
~
p
- 9 o InanotherversionofthisNbdel,thestatusofastandbyorpassivecomponent is immediately (or nearly immediately) detectable in the plant's control room..
The componenU 1s unavailable after a failure, therefore, only during the time between the fRlure occurs and the time the component is restored to its opera-ble status. Component unavailability is approximated under this version of the model as the product of the component failure rate and the average time required to restore the compenent to operability after it fails. This version of.the time failure rate model is applied in this study to failures to remain open df the turbine-driven AFV pump trip / throttle valve and irradiately-detectable contrel circuit
- e(Alises of diesel generators and diesel cooling water pumps.
In another version of the constant time failure rate model, component unavail-ability is approximated.as-the product of the failure rate and the time the component is required to operate successfully. This length of time is often called the " mission time." This version of the model is appropriate for compo-nents that must operate for a substantial amount of time after starting successfully. It is also appropriate for components that must change state and then remain in a changed state for the mission time. This version of the model was applied to failure to run of pumps and diesel generators and failures to remain opet or closed 4 valves that are required to change state for their proper function. j Maintenance and Testing Models Plant data were used to estimate the unavailability of some components due to maintenance and testing activities. In this model, maintenance or test unavail-p ability approximately equals the product of the average frequency of maintenance
-Q or testin) events and the average duration of saintenance or test activities that disable a particular component. The model assumes the time between mair.te-nance outages follows an exponential distribution, like the time failure rate model; the frequency of component maintenance is estimated like a component failure rate.
3.0 ESTIMATION METHOD d Parameters of the event probability models discussed in the previous section were estimated from plant data, if available for the particular camponent and failure mode of interest. Otherwise, the parameter values were taken from a generic data source. If a failure-rate or failure probability was estimated from plant data, then the following procedure was followed. Failure, demand, operating time, and exposure time data were pooled for compo-nents of the same type. For example, data were pooled for both turbine-driven AFW pur.ips, all motor-operated valves in the AFW system, motor-operated valves in the cooling water system, etc. The pooled data were used to estimate failure rates ta apply to all components of the data pool. For demand-related failure modes (pump or diesel generator fails to start, valve fails to open or close), the failure probability was estimated by dividing the number of failures counted for the. data pool by the number of demands. For operating time-related failure modes (pdmp or diesel generator fails to run), the failure rate was estimated by dividing the number of failures by the number of operating hours. For passive (valve ~ fails to remain open) failure modes or standby-related failure modes n (initiation and control circuit failures), the failure rate was estimated as the number cf failure divided by the number of exposure hours. Page 264 of 453
Some component data pool experienced no failures. In these cases, the failure rate was not estimated as stated above, because this would result in a failure rate estimate of zero. Instead, the number 0.5 was divided by the appropriate
" denominator" (demands or operating time or exposure time) to estimate the failure rate. This allowed a non-zero failure rate estimate for those component data pools with no failures. Furthermore, this failure rate estimate is lower than the estimate that would have been calculated had one failure been experienced, so some credit is given to the components in the data pool for not failing at all.
The use of 0.5 as the " number of failures" when no actual failures have been recorded is similar to a Bayesian treatment of the data using a non-informative prior distribution for the failure rate or failure probability (see Refs. 1, 4, 5). Under such a treatment, the mean of the posterior distribution is calculated by adding 0.5 to the number of failures and dividing either by the number of operating or exposure hours (for time failure rates) or by the number of demands plus one (for demand failure probabilities). Thus, if zero failures are recorded, the estimation method of this study yields the same results as such a Bayesian treatment for time failure rates, and very close results for demand failure probabilities. Maintenanct and testing frequencies were estimated by taking the number of maintenance or testing outages of a component, and dividing by either plant non-shutdown hours (for maintenance) or calendar hours (for testing). Mainte-nance duration was estimated by the average duration of maintenance outages recorded for a component. The estimated duration of testing outages associated with particular test procedures were provided by plant personnel. 4.0 DATA SOURCES Plant data were used as much as possible to obtain parameter estimates for calculating the event probabilities of this study. Plant data were used to obtain all maintenance and testing frequency and duration estimates. Some failures rates and failure probability estimates, however, were not obtainable from plant data, and so were obtained from generic sources. This was necessary if the failure or exposure data for a particular component were not recorded consistently in plant records, or if the data were recorded, they were sparse. Two generic sources were used to provide the estimates not obtained from plant data. The first source was NUREG/CR-2815 (Ref. 3), which includes a table of generic failure rate estimates (Table C-1). The numbers of this table were used to cover as many components and failure modes (not covered by plant data) as possible, but certain events in the AFW system fault tree required estimates for components and failure modes not included in the table. The remainder of the needed estimates were obtained from the component failure rate tables of WASH-1400 (Ref. 6; Appendix III, Tables III 4-1, 4-2). Failure rates were estimated from plant data for the component types and failure modes listed in Table D-1. O Page 265 of 453
,rN Failure data from plant records were obtained from event descriptions in Abnor-(-) mal Occurrence (AO) reports, Reportable Occurrence (RO) reports, Significant Opersting Event (SOE) reports, Licensee Event Reports (LER), and Nuclear Power Reliability Data System (NPRDS) entries. These sources were surveyed for events occurring during the years 1975 to 1985 for Prairie Island Unit 1 components and 1976 to 1985 for Unit 2 components. If an event was considered a failure under the failure mode definitions for components included in the study, then the event was added to the failure count for the appropriate component and failure mode. It was assumed these sources included all relevant failures of the components listed in Table D-1. Records of maintenance on AFW system components were surveyed in plant Work Request Authorizations (WRAs) and no additional failures were found. It is possible that some failures were not included in the plant records surveyed, but it is likely that the unrecorded failures were immediately corrected or did not truly disable the component. Tables D-2 through D-6 catalog the component failures that were included in the failure rate estimates derived from plant data. Each table covers one of the component types listed in Table D-1. No failures were found for check valves or air-operated valves, so no table of failure events exists for these components. Each table entry gives the identifier of the specific component experiencing the failure, the document type and number recording the failure, the date of the failure, the failure mode, and a brief description of the event. Table D-7 lists the failure mode codes used in the failure entries of Tables D-2 through D-6. r (m'j Component demand and operating time data were obtained from surveillance test records (for demands and operating time occurring during testing) and from plant outage records (for demands and operating time occurring at plant shutdowns, startups, and during outages). If complete information about component demands and operating time during a particular outage could not be obtained, then the judgement of the plant operations staff was used to estimate the number of demands and operating hours that occurred. Failure rates for some component failure modes were derived from a component exposure time other than operating time. For the motor-operated valve fails to remain open failure mode, the exposure time was the number of plant non-shutdown hours. For the turbine-driven auxiliary feedwater pump trip / throttle valve fails to remain open failure mode and all failure modes related to diesel generator and diesel-driven cooling water pump initiation and control circuits, the exposure time was the number of calendar hours during 1975-1985. Data on maintenance cutages were obtained from plant Work Request Authorizations (WRA). The frequency of component maintenance was estimated by dividing the number of instances of component maintenance outage by the number of plant non-shutdown hours (for AFW system components) or the number of calendar hours (for diesel generators and diesel-driven cooling water pumps). The average duration of maintenance outage for a particular component was derived from the outage durations reported in the WRAs. A separate contribution to the maintenance unavailability of diesel generators was added to account for preventive maintenance. The frequency and average duration of preventive maintenance was calculated from information provided by plant personnel. (q v/ Page 266 of 453
TABLE D-1 h COMPONENT TYPE FAILURE MODE Turbine-Driven AFd Pump Fails to Start Fails to Run Trip / Throttle Valve Fails to Remain Open Motor-Driven AFW Pump Fails to Start Fails to Run Motor-Operated Valve Fails to Open Fails to Close Fails to Remain Open Air-Operated Valve Fails to Open Check Valve Fails to Open Diesel Generator Fails to Start Fails to Run Control Circuit Faults (Immediately Detectable) (Control Circuit Faults (Detectable at Diesel Start) Diesei Cooling Water Pump Fails to Start Fails to Run Control Circuit Faults (Immediately i Detectable) Control Circuit Faults (Detectable at Diesel Start) O Page 267 of 453
_ . . - - m . . - . .- .- ._, . . . .. _ , - ..
'W.
./
\
J. S
.e a a a a 64w' e
=e> V8 9 O @ G -
+
1C 0 6 3 C ce. db sgg g e O b d e b e 6 e e e 6 e C m m A a 9-6 C e2 L = =
> 3 6 ywa w .. .. .. .. A et b Oda M d 9 G S O U- = 0 mea C C =C C > > > > Cbwa .
j ee C Ogc 6 2 . e e e e 3 3 6 6 .. C e ged G . y as .N Caess-6 aC > > > > wodang N C w=
-nab 600 ca boo
=a e 3 a@=
as- a: 2 a w a sa beac
>ECO ce 2
o m 3 C) Cb -be =67 % N % % --awS e
>em
* -b w w w e a 6 Te 8 O C e.=edag
> We 69-
' T- a 03 D- D V V V Q: 0 -e >c c 0 m o o 3X.2ed bow 6e -- as a a a a ' -me-c C 6u *) es se a3 g. g e aNe-6C Q e 9 mn 3. DC
>DO>DO 3W DC D.
3 D . d me 0 9 N % h= C d 65 cc be- 6 C C C b d
< a CO 9- Cub c C- CE- C- C- C V S .. w e edh ad - C: m e= mE g gE et de NU6 d6- Se- We b7 . GC & EO a $ ad@@C W
A Co gm-463 bow og b6 ggg 4) Eg Xe am 4c asambw
>66 6- 6 6 6 6 ==dN6e E >O Q&e >a O O Om OC3-OC 3* gc CC 663 og 3
A WQ 30- Oo On6 3> . 3- Mw69ub E W 9 m b 4 3 3 Q --O D W W W w 6 6 6 6 6 W eO d W wE Mw
. ss w f ' eN E>
wg 4 s C >< W- < . N. O W J - w J W* g N . C EX C '& @ N = 0 C C C 4 22 a e A N e e c e e e V '44 % @ b % % % % % %
= C N % e @ N @ > e N 4E O a e N N - - N - -
wW > N %
- N N N N N N W @ n
- N e @ @ g 3 E
O e W E C ' % E @ 3 - @ @ m m 3 . X N O C N - e e m O l e e e e e e e s o o N N e o o o o C C C C C @ c c c s N w C W . = a u Z -W O a O O O O O O O O O E @ g x x x . x x x L s O O e C C O O a= a- a- a- a- a= a-
=e =e -e =e -m -e -m 6 6> 6> 6> 6> b> 6> 6>
ao -> > > - - > w C- D D 9 O O @ D* gh A- a & A- L- A- L- L- A-C- 3d 3 3 3a 3d-d34 39 3d 3d
/. ca ws w
- wa wa we wa -w
' tg aC 40 (' < (c 40 <o6 40 (o 40 sc 6 6 6 6 6 6 CD NC " " NE "C NC N NC NC O- Nw e w Nw en Nn Nw Nw NM i
,,,w,- ,. , - - - + - n. , ,,- , , - . , - - - -m,,, , , . , , , , , - . - . - .-w,,,_ , , , , - - ,_,an,,,, <- -
,,.n. -, w ,.,,,g - -., - . , - - ~
IAQl0 0-2 FAltilRE EVENIS TURBINE - DRIVEN AUXILIARY FEEDWATER PUHPS (continued) Component Document Doc. # Event Data failure Event identifier Mode Description 22 Af WP Trip RO 79-29 11/2/79 f Trip valve found in trip posi-Thrott le Va lve tion shortly arter a successrut run of 22 AfWP. 11 Af WP Trip RO 79-29 11/2/79 f Trip valve found in trip posi-Throttle Valve tion shortly arter a successful run or 11 AfWP. 22 AfWP RO 77-38 11/10/77 S Overspeed trip linkage loose. 22 AfWP RO 77-21 5/22/17 S Low flow and pressure due to improperly adjusted governor. 22 AfWP RO 77-21 $/19/77 S I rlp on overspeed. 11 AFWP HO 71-15 $/1/7? S Overspeed trip. 11 AIWP LLR 75-08 3/2//75 S Controi linkage sticky. Page 269 or 453 O O O
~. . ,_. .. -- ..n... . . - . .---.- . . . . _ . . ~ . . - - . . - . , . . .. . . - , . ~ - . . - . . . . _ . - . . - . . ~ .. . . . ~ ,
i TABLE D-3 1 FAILURE EVENTS ' MOTOR - DRIVEN AUX 1LIARY..fEEDWATER PUMPS 1 Component Document Doc. # Event Date Failure Event identifier Mode Desc ript ion i 12 AFWP RO 82-11 6/22/82 S Lube oil filter was replaced , backwa rds-maintenance error. 12 AFWP SOE 77-6 4/18/77 - S Helay TB3/816 in load restoring scheme for 12 AFWP had tarnished . contacts. l i 1 i i 1 i 5 ,i , t I I i 1 ! 1 4 I i i ' t 1 l 2 l 4 1 4 i i I 4 I Page 270 or 453 > l i i ' . t i t _ _ _ _ _ _ _ _ _ . . . . _ . . . ~ . . . . _ _ , _ _ _ , - . . ._ _ _ _. . . . , . . ._. . . . . . , _ . _
JAILLE D-4 FAILUHE EVENTS MOIOR - OPERATED VALVES Component Document Doc. # Event Date Failure Event identifier Mode Description MV-32333 NPRDS - 6/26/85 M Torque switch out or adjustment. MV-32248 NPRDS - 12/8/78 M Torque /11mit switch out or adjustment. MV-32247 RO 78-2 3/25/78 K Auxilia ry contact in motor contactor ci rcui t stuck open. MV-32381 RO 77-24 6/18/77 H Breaker tripped on overload during attempt to throttle. Page 271 or 453 O O O
. _ . . . _ _, . ., _ -. .m ,
,7 7 . -
-g. _.
O O
^
l 4 TABLE D-5 . . . FAILURE EVENTS DIESEL - DRIVEN COOLING WATER PUMPS Component Document Doc. # Event Date- Failure Event , Identifier Mode Desc ri pt ion ! 4 12 Diosol CW SOE 85-13 10/21/85 S Heat exchanger tube rupture-Pump Control water sprayed on 12 diesel Ci rcu i t curttrol panel. 4 12 Diesel CW RO 83-34 12/14/83 S false signal led to over-Pump Control speed trip and lockout-Circuit faulty connection at speed [ sensor. 22 Diesel CW RO 83-30 11/4/83 S False .ignal sent to speed
- Pump Control _
sw. Indicating pump running i Ci rcu i t when not-would have blocked , start signal. 22 Diesel CW RO 82-22 11/12/82 S Loss or control power-loose i Pump Control fuse clip. Ci rcu i t 22 Diesel CW RO 82-19 9/17/82 S Pump resta rted quick 9y-
, Pump cause of failure unknown.
4 , 22 Diosol CW RO 81-16 9/25/81- S Wi re supplying DC power l Pump Control to local panel was lifted-l Circuit green indicating light discovered to be out, t . a j ' l i 4 i L Page 272 of 453 i I e - -- - - -
IAllLE D-5 FAILURE EVENTS DIESEL - DHIVfN COOLING WATER PUMPS (continued) Component Document Doc. # Event Dato failure Event identifier Mode De sc ri p t ion 22 Diesel CW RO 79-13 4/17/79 R While investigating cause of Pump tiluminated disagreement light, pump was accidently tripped by electrician. 22 Diesel CW RO 79-2 1/26/79 S Sluggish switch stuck closed-Pump did not allow air start solenoids to open. 12 Diesel CW RO 77-6 2/25/77 S Overspeed trip-thought to be Pump due to governor ma l-adjustment. Page 273 or 453 O O O
{# Q u 4
, Os y
TABLE D-6 FAILURE EVENTS DIESEL GENERATORS j _ Component Document Doc. # Event Date ra i lure Event identifier Mode Description DI SOE 85-8 7/23/85 R Would not load past 2350 kw-governor problem.
. D1 SOE 85-6 5/21/85 R Tripped on he cranchcase
! pres -water in lube oil (oil added af ter diesel ran 20 min; diesel tripped 5 min a later). D2 RO 63-11 5/10/83 R T ripped on hi cranchcase pres.-pres, sw. had dri f ted. j D1 SOE 83-5 1/31/83 S Gove rno r s . d . solenoid plunger stuck in s.d. position w/ sol. i deenergized. j D2 Cont ro l RO 82-15 . 8/27/82 S Procedural error:CS-46919 lef t a Ci rcu i t in manual (preventing D2 supply to bus 16)-corrected , immediately. D2 Control SOE 80-1 1/15/80 S ruso ful blew in 02 DC Ci rcu i t control circuit. Automatic . start-up, remote gov, control f rom control room lost; local control available. 1 D2 RO 77-23 6/17/77 R DG did not respond to load change signals-engine w/o , .; governor control; v i b ra t ion had loosened capscrews on , governor fuel control linkage , ( load wa s a t 2700 kw, wouldn't . go higher). ; i J 'l i i
! Page 274 of 453 i
IABLE D-6 FAILURE EVENIS DIESEL CENERAIORS (continued) Document Doc. # Event Date railure Event Component De scrip t ion identifier Mode 77-4 4/15/77 S Relay 27A/D1 movablo contactor D2 control SOE was cocked; would ps t " pick up" Circuit to change contact state when relay coil energized-would have prevented auto closure of D1 onto bus 15. 71-14 4/12/71 S Loss or control powe r-b l own D2 Control RO Circuit ruso. 80 76-38 9/10/76 S Tripped on high crankcase Of pressure just prior to placing gen, on line-pipo connect-ing crankcaso eductor to scavenging air pipe fell orr. D2 Control RO 76-18 4/2/76 S Personnel error-diesel locked out momentarily; immediately Ci rcu i t co r rec t ed . 10/3/75 V i b ra t ion, smoke f rom generator D2 A0 75-3' R bearing outer cover led to shutdown or diesel. Foreign material, low oil level, low oil viscosity IrJ to problem ( ran 15 min before shutting down). I i i Page 275 or 453 O O O
TABLE D-7 FAILURE MODE CODES l FAILURE MODE CODE Fails to Start S Fails to Run R Fails to Open M Fails to Close K Fails to Remain Open F O 4 O Page 276 of 453
Plant test records provided the data used to estimate the frequency of testing of each component of interest. Plant operations personnel provided estimates of the duration of component outages at each test. 5.0 DATA ANALYSIS RESULTS The results of the data analysis are summarized in the following tables. Tables D-9 through D-11 give the failure rate estimates derived from plant data for APW system components, diesel generators, and diesel cooling water pumps. Table D-12 gives the maintenance and testing frequencies, durations and unavailabili-ties estimated from plant data for major components. Table D-13 summarizes the calculation of APd fault tree basic event probabili-ties. Each basic event is represented in the table. If the event is a component failure, the table gives the failure rate estimate, a code indicating the event probability model, the test interval, restoration time, or mission time used to calculate the event probability (if applicable under the event probability model), the basic event probability, and explanatory comments. If the failure rate estimate was taken from a generic data source, then the source is given in the comments; otherwise, the failure rate estimate was derived from plant data. If an estimate covering one component type is applied to another component type, then this fact is also mentioned in the comments. For example, the control valve fails to remain open failure rate estimate from WASH-1400 is also applied to manual valves in the study, and the motor-driven APW pump fails to run failure rate estimate derived from plant data is also applied to the turbine-driving AP4 pump fails to run event in this study. O I Page 277 of 453 I l l l
D b J
\
(V TABLE D-9 IAILURE RATES FROM PLANT DATA: AUXILIARY FEEDWATER SYSTEM COMPONENTS NUM8FR OF NUHOFH OF FAILURE RATE COMPONENT TYPE FAILURE MODE FAILURES DEMANDS /il0URS ESTIMATE fdl th)- Turbine-Driven Af W Pump Falls to Start 8 314 d 2.5E-02 Falls to Run 0 '155 h 3.2E-03 Turbino-Driven AfW Pump 4 Trip / Throttle Valve Falls to Remain Open 8 184104 h 4.3E-05 , Motor-Driven AFW Pump Fails to Start 2 1382 d 1.4E-03 Fails to Run 0 4559 h 1.10-04 Motor-Operated Va lvo falls to open (1) 0 50 d 1.0E-02 fails to close 1 1693 d 5.90-04 Fails to Remain Open (2) 0 1352115 h 3.7E-07 Ai r-Ope ra ted Va lve rails to Open (3) 0 167 d 3.OE-03 Check Valve Falls to Open 0 2084 d 2.4E-04 , Notes to Table D-9: )
- 1 Data for AFW pump suction valves From cooling water (MV-32025, -32026, -32027, and -32030) only.
- 2. Data for norma lly-open AFW system motor-operated valves during plant non-shutdown hours only. !
- 3. Data for Af W pump turbine steam inlet control valves (CV-31998 and -31999) only.
- i l
} I i 4 f i 1 Pa9e 278 of 453 4 i I 4
- -- - - _- - -- - - - - - .- -, - e
TABLE D-10 FAILURE RATES THOH PLANI DATA: DIESEL GENLHATCHS NUMBIR Of NUMBER Of fAllOHE RAIE COMPONENT TYPE Fall _URE MODE FAILURES DE MAND 5/ HOURS ESTIMAli _id1 ihL _ Diesel Generator Falls to Start 2 783 2.6E-03 IaiIs to Run 5 2305 2.20-03 Diesel Gene ra to r immediately Control Circuit Detectable faults 4 192864 2.1E-05 faults Detectable at Diesel Demand 1 192864 5.2E-06 i Page 219 of 4$3 O O O
.. - .. . - . . ~ ~ . . .. . - ~ . ~ . - . . . - . - . . . . . . . . . . - . - .. . ..-. .. . . . - . . . . . -..~.
I 1 JADLE D-11 FAILURE RATES FROM PL ANT DATA: DIESEL-DRIVEN COOLING WATER PUMPS {' NUMBER OF NUMBER Of FAILURE RATE
) COMPONENT TYPE FAILURE MODE FAILURES DEMANDS / HOURS ESilMATE
- 4 (d) th)
- Diesel-Driven CW Pump Falls to Start 3 440 6.8E-03 Falls to Run 1 614 1.6E-03 l Diesel-Driven CW Pump lamediately i Control Circuit Detectable Faults 4 192864 2.1E-05 ,
} Faults Detectable j at Poap Demand 1 192864 5.2E-06 ;
{, I l i i
; t 1 ,
e l i I L i I ! i . ) i t ! i i !
) .1 i !
i i h [ t I i j Page 280 or 453 -! l 1
- 1 m
% - . - - - - - - --r,e-- . - - - ~ , - - - .. -- e r - -tr--,-- - = = . -w.w - . . _ - - - - .- e- , - . - - . - .-,-1, e,e - w -
le3Lf D-12 COMPONENT MAINTENANCE /1ESTINC UNAVAILABILITIES UNAVAILABILITY fitEQUENCY AVERACE DURATION UNAVAILABILITY COHLONLi(I TYPE {po d Lourl ihonra1 Motor-Driven AlW Pump 12 Test 1.5E-03 0.25 3.7E-04 Motor-Driven Af W Pump 21 Test 1.4E-03 0.25 3.5E-04 Turbine-Driven AfW Pump 11 Test 1.5[-03 0.17 2.4E-04 Turbine-Driven AfW Pump Maintenance 3.5E-05 5.36 1.90-04 Motor-Driven Af W Pump Maintenance 2.1E-05 14.45 3.0E-04 Coo l i ng Wa te r MOVs (1) Maintenance 3.5E-06 31.83 1.1E-04 Diesel Generator D1 Maintenance ( Prevent i ve ) 1.10-04 81.66 9.3E-03 Maintenance (Unscheduled) 9.4E-05 20.17 1.9E-03 Diesel Generator D2 Maintenance ( Pr oven t i ve ) 1.1E-04 81.66 9.30-03 Maintenance (Unscheduled) 1.6E-04 32.63 5.2E-03 Diesel-Driven CW Pump Maintenance 1.00-04 17.2 1.10-03 Notes to Table D-12:
- 1. Valves MV-32025. -32026, -32027, -32030.
Page 281 or 453 O O O
(N The codes indicating the event probability model are explained below. The model (j dictates how the event probability is calculated from the failure rate and mission time or test interval. These models are explained in a previous section of the appendix. Code Medel 1 Demand Failure Probability 2 Time Failure Rate - Test Interval 3 Time Failure Rate - Mission Time or Restoration Time The mission time assumed in this study is six hours. The test intervals assumed for different events are explained in the comments to the table. For maintenance and testing events, the table gives the maintenance or testing frequency estimate, an event probability model code of 3 (ir.cicating that the component unavailabiility is calculated as frequency times duration), the average duration, the maintenance or testing unavailability, and explanatory comments. Many AFW fault tree basic events were not assigned probabilities, because the failures or unavailabilities represented by the events were assumed to be captured by other events in the fault tree. These events are indicated in Table D-13. Table D-14 gives the same information as Table 0-13 for support system events (diesel generators and diesel cooling water pumps). Of note in Table D-14 is n the fact that the total probability for the diesel generators fails to start and Q diesel CW pump fails to start events was calculated as the sum of the appropriate demand failure probability, the immediately-detectable control-circuit fault probability and the probability of control circuit fault detectable only at component demands. Also, separate maintenance unavailabilities are provided for preventive maintenance and corrective (unscheduled) maintenance of diesel generators. O Page 282 of 453
aa . E. Nb C b Nk> W
-mm 2 $
- = A*$ $. &
- . = u.. .
a a "d
- Uw -
- g
- aa WW Ew..-m t
. - aa ag J
. 4. - - -
g 55 B&gg t= *
- W
=
9 p
...oo 88
=
4 o u Q
.- dd d d . t e=
w w o o
. u w .. .. .
. . .. d~.. W m v
.. .~~~ .- w... w .=
- m
- -- .4 .
$h kh, a.. .-=..~--.... masm
..W.=.
. - = -. =
n o
. c.
...o o2...-
x 33. .
=..m - w w s e,5 W
....... 4-_.WW- EE = .oW m a
-m
.o
- -o
. ~. .. .~ ~ .. ~ .3 . . . .
~~-~......w..............
. .85 -m -
s. c ...o o S e 0 8M. w
-----.....oh>.
w w w
- - -o -w o w m u m o -
u - 2.. o.
. ..R...t .. . C.. o.
..8. t.
.. m WE-W.v - - - - -w w o w w- ~~~ -~~ -y
.....Q~QEa*Q*QO.OWWWWWB16 -
C' ~ 6%BBBS$ BB5EBh8&
- 3 G'EE*
g
*. 'gw . .E. . . . . . . . . * *a
- s u m. e. d . d. e. =. c. r. e. d =.==dded
= ..~ ...--
a.$'E.....
- . = $ u. S=EgEm * %. h E S' Y *** ** -
=>w D.. w. wu m
..g. . $_,6. .....E5 31E
- r. s %L r
. .=%..n c n=%w >.... m. a. .#>... .. m. . oc L w .... ~-
. c~~
~. w.. * *w. ... . .. ...
=
r 5 5...........................- 3W*BTT7????-
. . . . ~ ~ . . . . . ..... .. . .. .2.........a............-
..... . ... .. Tv77s833
. . . . . . . . = ........Z...
wEstt%ABTBBBgs-IB 11 . ........ t
= = =
"E*o 2Q*3- = z WW=
z z =W= =W g g g==ggg=*=*=*=rd.
** &*tttak.autt-~~g - a kh w3wwww w=ww ww wwwwu w
- . . .w W= .. = . r g g g g g g* g g g WW23aagn=-~~
. .=v w w-s
. . . .............................. ........... ...... .... 2...............
G'; W : ***********M.W.5.=.W.W.*.n.M.=.W.M.M.M.u.m.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.
, 2.g .
.. - ~~~~- - - - - ... ....... ........
e .
.o d-~ . .. .
-=W
. - . R. E. C. C. o n. ~.e.. . .. e. m~ L, Ls n . . e.
. . ....r..=.~
m r.
......r~..~.. ~ o. L,. C.
E.r .~ . ..-<.e... I
= = 2 o=
-o
..-. . ~.R..n --
~.,~~c.
E. - o . .... . y =. w
-=-.
~
a .. :. m . w - - a
- ~
w
.s W..g . .
m ma mma==~~~~~~~~~~~~~~~~ m
= *a :
U E :.
- v
- o. ~. . ..
~ . ~ ~.... . ~ . ~ . ~ ~ . .~ . ~ ~ . ~ . ~ . ~.. ~... ..~. . .~ ..~ . ~ ~.. ~ . ~ . ~r.. ~.
B
. . . . . . . . . W enn~n . .
.w . .
* * * * * * * *
- W W W W W W. W. en n. W. W. r. *. *. *. *. .
- 2. 2 '. .s * . . . . . . .
. . . . . . . m
- . m
~~enenn. emmemn m e e 5.: .
.- === . .. =
- . W
=
L EbxWWh*a
- W EEEwWW===S.
- . ==
. ...- - -.2m .2 . 2 .=~,=~--~ U ~d = = = = = = E h
**g BBE.h======
=w
*a *
.===
o-- t...
.o.885
.*a
-. babb5==
= =
. ..~~o . a $3 = sham 8
.s .,. -2 = .= .=J..
. - -. ==..=2 . = .4 .J *r 2
-2 -
- m. 4 = 8 g .m .===_=
m
.- 2222-2 = = ~= 2ggg.... - - *.-. . ...~~.o.o
. - ~....... .===... -a s
= , . .
=
=
222Wo
= =
-* . . ~P . WW .. - -
w-o . m ww - -s
.....o
= = = = = = = = = =-
.~.~.~..-
g.=,_w __.s.777ege;
- -...~ ........
g W.w = =. ;
,u- deege=.g-
..W..e . ....
.- .hswEhhta&8E . a a
===Wew>u>...ws =
=- =
= _= .s..-
W . ~. n. .- n. .
- .m .
= = = - - w,w
- n. W T - E - _= - . -
-a s .-
. . . 2 .,
C~..... ..--W. .-. .m . -. = =2 . . 2.. 2 n =.. . V .
. . . . . . W W
..-. W
.~ .
~.
W. . W
- W w ~.
..> > > n. m. e. - = =
e_. g ~M.. -- . a... - ~- ~ ~. c
..~.. ~. .-
omo - . .~~~. m mm . c.
. . . - . . ~. o .
m.,.= m '
=- =
w w w w d w =ww= s u..-~. S S S m.. " K" _. g *. .*. *. o* _o a .o..o. .o. ..o .o. oMo a o.
* .t - - - - -- .
a a n " "W gW - sW122? x; Es,E E>g.w** E guT*WWWWWWWW
, M d 4 4 4 M d J.
W s2 C.===
~- e . W W .... . a w w a. W = = > >
. = ~ -
- . . . g 5 .W
, W.
~ a n .a s..r. W. W W.
a . ~ . ~. W. 2. d - d a
- . - . e. . .~ a. . . .agn.
- d. =. =. d n =.
. M. 5.s 6 . .= . mo .. b~~ W W W..==- atatt2gggw- = ......
o o o o a a .*
. .b e.M".~= d o* #g#
= r+
.s g r.
.9 e . ** e . e . n ~r m m r =f y ; a - =
e
* ** o=
- a w- . oe
@h 7 .7 ~ 7r. 7 r " e 7 7, r.
7 o" v 7 *.z el W n .ag >. g M. g e. ~ g .8 8 .= C - ~ c. ~ c. yggwwga -..Ek
= = =5E =
- . . .g ~ .~ .~ .>. g .r. ~. .
.b
. .o W
.s 9 w w "5 " . . . . .- . .. ....- .
. N r. . ~ . ~ . .~...M M m . .,g N.-W@M . W ..(g N f~.p . -..t.p. t f, . r- ....f. . et. ... N r-
.s . e. D
- s. = -
e
- 8 <
u-y- E.o .
. n t. * *C.
-c..* ~ ~ . ~..m t Ma-Am.r* .W .
.% . n . t. t,% W
.. . . -*W
. ~ ~
F D,,
. -.re y.y r4. -t. h.
. "2 t t t .h t 2 n. A t t. h
......~..r. . 9 . . . . @ . r R a. 4,, . - 3. *& t. h. B
. . ~ *
- g .. *
~6 % . .
v E . . . 6 .. . A 3" 3" .I .S $. $ > .> .> y .- . n. . , ..$ .5 5 .$ .5 e .S .$ .$ $. 5 .$ .5 3 > I I I O N S S %w' T W E % .- sb = bs========$==$-
$$2 .
.E . . ww w =======
...e .e .e
. e.
1
'k III c c
.=.
OUU
- . 353 teh r 3 GG3
- . e. --
ue s,
.') ... m e
- == e
=MM M-- e
*** w
- EEEEME EEE EEEE o
- ====== ===
u w w
====
u u u u o uu uu u u 3 WWWWWW WWW 4WWW m N
= ....... ... ....
EEMEEC. - Ett CEtt e EEEE =
- i. EEEEEEE -
WEE % g J JJJ a f* f dJJJM
- 'E
- gw gf wgw GEE g g
--w f' g g f gESR.
a
=ff .{J8E Sg8 22
- = e e. e. "$"b*Ekke
$ T " "E *E =M d E w t =s =d d d Eu d t E.
E w ===== *k!"
*
- e. e.
---e. yy y
..BuyEa- 2 .y y s = s s.d. _ _ _ . s_
- . __ s_
__ _s s s s_ s a $25y s terrEr. 2Erds3s3333333s EEEE C EEE EEEEEC CCC
'...===.==
.s'. ..- g-m
. .- .- - . . .. .. .. M ~. ~. E E E M . .W . W
. . u. W
. .W . W. .W . .W. W. ~W . .W. E.
- : .a =2 e g : -==gEg=g -
======e'e'62*
=====:":~s ==warrrrrrrre====s::===mazz a
- i: *iAgBgig*w:amere Ess -a B- !iiEEE i iiiii zusazz a anne iisigg- 5 ggggEmamm Aid
- : a.
= :. a. :. :. . a. y :. . m. a. :. :. =. =. =. = =. =. =. =. =. s. z. . t. . s. a. m. a. s. t. a. =. =. Y =. =. =. =. =. =. =. =.
m--
- ===wwwwwww=wxxx ==wszwww=============444444444 ======== =4
?_ a g :g }
K_ Ada444aa44aanda d44444A4444444444444 s e 2 : c = _ _ _ =, a e. . c . - : w- azama o E u - = E z. ! : == m amazz encens=mauss ;;;;; e gs:: s=ess; m sa s sessea5saaaa===
- == ~
n w =E-_ 2: = =
-a=== W ,r, m, er=2=.
t > ____1 u-w a m -
=
- E -; =a
= =ms =: ~~ ~ ~~ - ~~~~~~~ ~~~
u E g _--g - -... ....
= = =. ~~ ~ ~~~~~
trrer se,m
?? ? titte tett.ttverer wwwww
**
- wwwww ************
==u==
= s:
frl: AA A AdAdA Jadadaadda *a adaad m as Ea m e
- . mms . =
z =
- . . =. =. . . . m _z _a _n r =
- -rwgggr=..- = w
.i * = = _. _. _... = . = = _. _. g. =
=
meennzeeeema
-s g
- r.-u a..r r .r = =_ _= a= . . s- sesses
-_-_--E_ss_ss_se . =. =. =. =. e.
---...___v.
- raaamm _g_gr.s~=.
g e- - g "s-a g - E s -g s -y "s ss:::: w:=- =
.et.
eTveee=rev . 522*-
-e,"a8E " " a'a' **
z _s m2
=
. = x~ g : : =eee. e w eemme s e . a-__~
- t-~e- E, en=x E"-sa==&s,ma g=. e- c re.E13,! . . . .=. s=.s=. t a.t
.u,,,
=. e--
- n. =. =. -
- n. n
=
- =
t ???*w r.y *f e :; => f a- n c_~rre emar - r rs - - - - - ,==== s g _2-ar == a
=
=$E xxH Es e a t. a. . . .. ..... wwm m W 5
***WWW=TWW: 5..- EzWEGEgn.!yEassamam=8883*E===a==ma=2 ==w =E E "
. . . = M W . . = I - s. m. E m. E m. E E w.
- --w
- 8EEE8EEE
= ===v,===az*,eee ;Ig-I
__ee - r -
- . * "**-BsB _:2 y BBE - .w- w~~- ww-w - wo w ---_._._._. -
.=ww
". =. " = = g _ _ _ d # : : wg*
- . .~~..._ ___m *
- n. M. O.
a,guuu 3-e T.*
. g. . ) R _
n . . 3 3 3. 0 3. 3 3 3 3. 0 a. s. g g w 3 "nuusas- nannuartmunn- rs .= s-e- "
=. s v . =. =. =. s =" =" =" s. . c 444 S. d. ._ E. a" n* e- 4 4 s S. M g E g E M E E g g d g E _= g .g g g =.
_ .. u e - - . . f'%3 _ . . _ I
\ 'j ==s
- n== nan.- ====n ~.~.== =======n==n=c==e=a.~ ~ .
____: 22M233223339222222*2 MMMpT=M25 E
- L -
s h. *a.u*. Nv 3. . n a.
=
W
- _ :~W
- ,.:m: *.~*s.g a t m=,M A*W -
sW e:f :. ~= k t, y y g. c .= s. g- t *s .g e
- n. u =. h =u=w =vu =ww s t_
- s*
t o= m= c = = m uuuuw
=
e = = =we ~ - E-
= = =- m= =
2 :___2 : =_
=m caget U.
=_
mgz.g :. c. E. g n . E s s .:. .. . r $*=.= .. m m l l
~ 'p/ JO $8Z C33d 1D f (m \
\
V I Q) Dn3! sin et 368 4150U 912t-ed ' Lt t91Huv ifCf Dvu]Intru 01 Et $15013 t-il-N M1VA 1VncW &l fitIYhof fbWf f6tives M* W8 Den 11alvu 01 Ino 0150U t-!I-N 3AWA ENvu il Drullutn 01 E4 8350U 1-11-# MlWA 1V0mVd 1 fit!?MW H+W8 lu!W 81 Et 114111 tate I-il-NZ 3A1VA kNO3-8 maw $1 (!!!?hAV N'We H+We lain 013ng 11dylivavM I-II-N 3Awa um03-t man 51 titv me fbWf Dve114!vu et 3nd (150U 86411-0 M1441041m03 i f!66fter
'8*J MODI los $108 H-M*I tt *C t SFK*t 33kn11 min 01 Int 1Nviltet'ei lie mid as t rllffidt YJ 131U4110m 5104 tf-W1 tral t SO31*Z Dv411 elta 01 Et IIt111tArm 128 MJ an el il:Huds H-W1 trtl 1 CFil*Z 3]mp31 min 01 El 114v119814:1:10 MJsN C filNway
*s'd 3001351 105 5108 H+38 5 *Intru 31 N 4350V SAM allino a0 IIDI In 81 Ill Il foll:IHe H'Wf *1mlW 01 Ed 435013 SAM 1311f10 30 illN1 IN 01:18 92 ralltru ff*WS *1alW 31 Int REQU SAM 111100 30131NI IN al lit I t0!!Illev HeWt 9 ell 51101 EG 0114v510 lif (-M LZ IL:Hua 9u1151101300 0118:516 flf !-M tZ lt afdAa H+ Ff 9a1151101 E4 Giliv5It C f!!-Ad 11 lt:Hwa H+Wf Sal 151101 Int 815013 Z-t-O MWA wnnvu it Illa] Man H+Wf Shl153101 N 8150U 1-1-41 MitA Wed it lita2MAA Helf *f 8bW8 1511Il Dt 8350V SAM 1]11no 1111m! O tsnt 11e en 6 leillum Helf *f Sal 153101 Int 11Ef11ta?M SM1WA #3n 133 R3 Z lima 9E laeltsifta Sal 151101 N 11tv11tnVM 51AWA 8CM 135 O I !!M 8 IDisim ObWf SN!!51191 M4 6350U l-K-4:Z 3Alv4 lynned 91 IIK]M3 SbWf ObW8 SmitS1101 Int 8159U Z-It-3 3AWA limmW ti IllohA3 H+WS 94115]1813nd 1350U I-10-3 34194 Ivnuvu el IllOhA3 ebWO Ss!! Sit 81 W 8150U I-12-3 MWA ltnuW 11 Illl]MO 941153181 E4 8150U I-L:-tr M1v41:nnes El IIL32nA3 tbWf ff*W9 $N!!S11 et Int GEOU 281!t-M S I 8tfut Salts 1101 E4 41501318ilt-AM ! II9ipet H.Ws Sm!!51101 E4 4150V tit t-M tZ litteet abre Shl151101 El 41500 tit t-M 82 Ittifde H+W8 Sall511013:10 8150U titlt-M ZI littfor ibWS 9N1151101 El 41500 ft!!!-N 6 litfde hew 8 9h!!534 01 Et fl50U lt2ZI-M Z 126:fde H+W8 ib 3f *f Sn!!511 O! Et tiiOU 6t!Zi-AG t 16t!f df H+F8 thil53101 E4 4E013 tilli-M t litZfnAt Sn!!51101 E4 0150U lif!!-M ft lilNde
#bWe 9n11514 01 E4 (E013 tit:t-M il 19188 0 s fbW8 9N!!51181 E4 435013 t-il-N 3AlWA IgnWWW 61 It!!fMAt N*W9 Su!151181 N 8150U 6-tl-N 3ADA Mhw 18 IttivHAv ObWS H+Wf Smit $11 Ot MG (150U t-il-N MivA Mpvu 9 litives 151101 Int 4]SOU $641t-A3 M1VA 1041533 1 18640 48 ef* We t IFK*l 9al153101 Int 116fl!VAVW) lit MJ AM i IllHlH 318v11tAv MJ 18VW 0153Alv4 m3d6 AH 5401V83d0 !Ifil JS H-It *Z 11*8 6FK*t LUf t 103r1 941151101 Int 11tv11vArm its MJ aN f: If tfu n 31tW11VAf MJ livu 01 SM1UA sid0 Am Su01tu3do !fflZ 45 9N11511 el ya juvigenwi gle ma ajt tg Igluva, CZ'8 t IFK*l 31tv111At MJ Jnu 0153AWA N3JO Avu la01td1JO IHit 45 H 31*t Il till!!NW 8bW9 151101 N 01500 SAM 111101: s0131NI IW di 128 H+ 38
- f 151101 Et 41500 SAM 111100 80131hl IN 01 :ll 1: 10!Zitus
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .! . . . .! . . . . . . I. . . .
I I ISNI N0livant I I IA]uin013J l I All11tyt084 1 * .stW/1511 1 1130s 1 1511t *thlvus i N0114133518 i Ca 1 3.te i owin n0IS5is I siiilosou ! iiH I immi i SJ : inui ! SiouuG3 I anni ! I /1VA311NI 1511 I talAl 3 34011tj I 31598 I IJ ! 3!51 8 *
! 315WG 5311111tVfDdd Inu) 315VI 3351 IFVJ ##
"' (Panunuo3) EI-0 T10V1
=
e. t 55 Y - g 8 iA
,n
. 44
- 22 21
- ge e ! sE s-/ :. **
m c
- . ct 4
- 2. M. 0
- 55
~
.~. e
. =* m
- EW N
. w o
t** .. - , g a s U*as* m a.
=. ~
www I
- w W~~
y
- gwW "EE E
! a 5-
. .--. n.
.E5
.,.g....
" 125
- 1222 12:213 w
B
. .~ 2"I g g s s s s ~s ~s ~su~ s a s-
=
- zug ecs sgf,ccececerece ew
.........T.T.,..
u
=.
. 3. 2. . E. . R. ... R.
***************WutzaugTW=
. t.
. ... .. .. t......
. .. .. ..... .,.. .. T. . *** . . ........
**WWWWWWWWWWWWW
=
3 5 =3 4444444444444444444444AA; AAA A.AAAAAAAAAAAAA n.oe, l 1 :
+=
5 s - . . . c=1 : e % - " 4 * . ....,
- .. 2.,. s s s s s s s s s c E.
. d 'W =. M.:-
..... s s . s .
.g===========
o g . rag = gg "" " C 33 . 3r - E E ~ E. :
-an== aa E ,
=
="W5
-=
w -
=
J _ ~~ - - - - -- eW
= =: =
- - -~
F.- E= o
==
.=. .
u .a. m . 5 ~. W: . . .
. ... .. C. .
W. ca-W. E ". WWW WWW 2 gaf AAA AA
- A AAAAAAAAAAAAA
-. .. = g s .
" w,E d WW
. W Y .s .gg ==
. ==
D D Ng* W
- . s W == d b. :-
.= ".1 =.5 0 ,a s, 5. 2 V. =O . = =
.= - .
- EWWW52*g=W
- N = -
.W -**
8 g=h
-g=
255EE n wTT
" =
- =wo-
. - - g=.= = g ,s d 5 5. w g =w Ahh -a
- . s==ww2 w a o =s .s .= .= .==w=- =- .= = = .= B
.=
o h.
= w k. U 3222= = _o = oWrW= =
, M. w d w., w.. e .. .,2 =. ==
. 1 .
.~ - -
2 2 2 2 2 2 = Wg,e o. o. I ,. g . WWW w" 2"=2&BhbaBh&hB
= WWWWWWWW=EE.EEw.U: s i: 3* Ig. 555 WAG;. = 5ara -
....e,
~~
o=2
~.
- = 1 1 =. =.* =* n e n z : 2w... ass ~B. ams -
- O ".; ** * * - * * * * * * * * * -
.. v., *;u .
'*' 2 2 2 2 . 7 4 = d e c a d d "d d M E'
=
.--=-=-=- = = 2 '=' 2 *= .2 2 " M '*' * 5 *#
======""** dossc"g ss ddd-a cd B Eh 8a ddg==
w *************** su - - - - - - t7v7 EgpgWgWWwg8grATTTa**WTT,,,. -8 e==
-7ggynn;97 us u W..: :. :.c.. e. c. c. e. =. =. c.
" ws. ":.gA== L= = , = s *s m eeggd A a W
..........=s = Ag n. s - 44
- . tM M W m m * "$" ~$
- 8 a o E m gggggw- = sgg 2 A
.1'" - " *-'
a " *' M 3 7. S S =u . w *g g g w*e * *w *w w *w *w * *w *w amo
- : mew o
- eedececocess = W-wy
- .~..,.., 3 ,fL ,= 3 5 5 "' f ,. = =. =. r. . x .= '~ "
. ~ .-. ~ .,.
~ <~
< ,n .,n
.,-,-r..,V.
==g cf "sgd555655555c n.'. W W W W W W W W W W W AR., O S w
. n. .
V. m MMA44AMRAAAMM'{Tsg"s-~~T},,n.~.~ s- 4==4 =4Em= 4g4-
' -1 4 g =s =g 4= 4= s s ..===g7m *"s.RM4 2 = = =4 4 = =
-l, A '
=E o- ~= g E .ef3 w = j rw Twwww T T W ww W Ywwww YWTT
)
". . nn e..,~..nn..nn.,...-...~- .- - . =~..nnnn.~.
-~
w./ -g w . -~~ - ~ nn. ~ - ~~~
. ., .,e.,-.. ., 2 ,s. .., ~ ~. .,
*g =.N**- rg .w M. .r.> E' .e
- .% ."'. a I..r, , Ww a- - = <*= .r
. ~.
m me.., eP 2. ,9 M w e 4 .. .e 5 gg. = ~ . * ~.,.
*pN . . .eug 1 F Z .= .*
===.,.N
~
e-
- P
.4 ."* . .r .r .1 e.* * .. .e .**.'s W*4 d
' .' . . =
G.B
=
e
. . (4 #.1 9 p.
- e. &,
. F.S . . = = .. . h 8 f.. .** -=. . .'".* .== 5- g M"'" . N P.e f.9 .9. M. V.a .'" V.s e . v . Eg "'. 3 4 g g
= .
; . .fi, . . . . h . .> .h . . . w. J ww **
w n' s = => h. -
= s . .
wCw . . . . $. . .$ . .$ . . .$ .
T t i: R
- . 4 t
O
- w" s
. - m
. w -
m
- = E =
- s
~ ec
= '
=
- a -
S s i n.gs ...
- - E
- e E r m e := - -
2 mass --a-s .
. eee.eee
-2 E a
i: $%$))) E i=
. .. -...... .w . ..
=.22 a-- 2a a
- -2 - -
2 w 5 : 2-a...E.s_--
-_ssss _ _
s =E an=a cecm3BBs-azzus=s- Bece een ecce
-t-e... ,~~.~t
.t
- ~ , , ~
- -t m-= = === ==x=w 151= : aaaaaaaaa : = = = w w w = = = =a a= =a aaa aaaaa
- = . . .a =- : e.,4 e -: c = - . c _= , ~=m.: o w w _ m: .. . ... ... ., .... o . . maa ama . . maa~. v o
== e: ~
- a,, = m .:
n . . - = 0 . c w - . w - = : dE
- 5E.n w . i. .
~ . u- =
.. . .~ ... .,
. =. w :.:
... ~.
===
..~.
~. ...
===: ==wn e ===
- =un. =w:
e-: . aaa aa: aaa: gEg -=
- =
- e ==www w
=w
- s a. y
. e. r_-88 es:E .
- . r-as- e en E ,
5_-
= e v .:;v.
aw. :. . e. .e e -a _,.2a1.. ,s
.. m
= :
- .,. .- .e.g., ma=ma .
. . .see ,. w w a.n....
r a 8a8 vu- --- sagas
. ,,.,..,~.
- ,.v. . r =. . =. . . . , = , , , , , , , , . , , . , ,
- . .t -r y. s- ~.g . . a ,
- .,. Ews - a_ E E s w.
i www_5_a."." E 5 -, ,w a s s s ~. =. _= _ __ ~_ .- = = = a .-s. a .
, tt
. .- ... . .a.- m. - r.:. a..e~,. =
. ~ w~
1
.m .s r
- EEB===5-e- gi=ve r.. .....
== === =====
-.. . 5 .
3 ~
-- . ... - ~ ~- n~- ---~~ n.. . ~ n ,.
i M55 M .. S,. E u . S E M .E .M. .A - E .5. F . ,i E.
,,. ~. . .-
-S .
.g -g M . 4e. . ....
7.*..& ..e.
.f $ .2
.I gE 4=ms. Esse: = == = =
eg M E E y. 5. o= N.'. i-g o=
=
.. n.
3 a m
. in
. ~*
= t.4
- O
- m C
w in m 1 2 v
. a. r. co G
. .e C e.
e e. e c.,
. . e . .
W W
- W W
- ~
"Y E* E*
f. h$ m E. Eg 6g
- MS= E3 =
"a ==
. w .
.=
5 E=a E*a 293 ytE
- -W -
M t*.
- 3* =
.3='.
,. w .
s~. M.a **
=t 5-d. d.
- e. .
i. u u u w
'E 'd'*
. z g. g g .
- .. s- ...- w . -Q
- gWE j =*2 E g=E g --
G-F . 2.= - - g =2... 2 . EE S :. ErI 5Es= 5- a 8 5 .e d 55 "W I' ."1 =.W- o E' .E. .=.=.'e. oE' =="w
...=.w . . - -
.n -
=_, .o..
.. n..e.
e ,, a
.gWWWWWW M W= l WWWW W E. WW
- . . W ,W W W n c.
- 3. =. =. W. n M.
W. . . n o. e <
- o. .
' 3
-J W
=
R5;g::
#~
s
= a. s a.
.. . s
= .-
- n. a. ~ =R, n ..
.. . e, .
. c.
cm E. . . .. c n, .= - e:t
- e. .=. E . = - ...
c.
..,..m ,
r. c . - v.
.. . ..aa
-.=
= .. .
- B.;.
8 -. G. . 3 - r
- -s .
yfu *
-mm - mm nm me nn ~ ~~ - e n mm mm
-3. 2 :.
It
't
*, W"' :. 4 . , . . .
m 3-
. .C. . .
. . .o...
ww e, WW
-... W,W WwW w w .m
- n. -.
..._W
=~.
n eW
.w
.. e c
-.-. ~n c n
. e.
s e. M c. y 5, y>
. =
m5 a-e 3-5 4545 E o. u 5 .,EW, .W5".i., E .n, M=-c,
~
- ==< = =g.a
#.= -
e .=W
.O
.e .4 f.
y W 888 E SIj ( E g
. .E 4 L y ..A
. e 4.a. m# 4.e .i .C. M O Sh O O OO
. .= $* N .N N N d d*-x.n m. d.- .- d .n4 b .5
. -$ -Q3. .*- .$. sg -- -- a e.n.d e.. m
=
.o
. e.E g.J U 4Eeg
.a.s.*=
uD u .rE D e M .=.*t M
.=-*
B us- *=m 5 6Q .m EW .a. m *3
.=6.* C. C g 5 .g p.
7
. .= .;g
. .R e -
.E
.4 .4 *
=
.=m .Fca at .S .g h Q kJ e. e. w bJ m .g .=.?O'.=
6
.d Ed W"* E = E
.E w O O O .me.A O OO P4 e.9
* ** rw. f e P* c
*4* t' F4 P ** N P8 rw
.5 . .= g g .- g g .* .=.= gggg m
** .4
=
** tw M . . . === =. .. .
- dw r,a E.
nd d= - E EsS I. .E $. E% $
.c d. de..=. ~8MM o .=. s u C e. a . m. i., e.
. W.= h e .a* O 6 W M & 5 E sh M
- .e N c. P'. P, ** Pe .e f4 fe M. .& g,,.
e., em
.= w d., ee. &. .M M.
.*8
.I.
M** M M GD OO GB E E O 4. ** G O O S. p .- p. .
- .a n n =- - g .a-
.ha- -
n
= -= a*
m ,
= = = = = = .= /
r ) :. -EEEg=EEs - - Es Egsg . . .X m... .. W
. E I E E .E E W E .8 .2 .4 .5 E R = 2 - - M 6
.E
-5 - . .E . . = .X .3 - - -
YY$ Y Y Y $
- ======== = = mamm O e4 .'. m ed E
J ad me m ad em me .4 ed .4 .6 & m
.4 .A =4 m
ed
- i. d ad on .6 Y ** Y, Y w Y ww Y
. w w - - ** *'*e .* .=
w M a M M M M ME* M
. M 2 me .3 .e.=
B . .= w.M. - . . .M M S . M e MM
. .5
6.0 REFERENCES
- 1. U.S. Nuclear Regulatory Commission, 1983, PRA Procedures Guide: A Guide to the Performance of Probabilistic Risk Assessments for Nuclear Power Plants, NUREG/CR-2300, Vols. I and 2, Washington, D.C.
- 2. Haasi, David F. , et al,1981, Fault Tree Handbook, NUREG-0492, U.S.
Nuclear Regulatory Commission, Wasnington, D.C.
- 3. Papazoglou, I.A., et al, 1984, Probabilistic Safety Analysis Procedures Guide, NUREG/CR-2815, U.S. Nuclear Regulatory Commission, Washington, D.C.
- 4. Martz, Harry F. , and Waller, Roy A. , Bayesian Reliability Analysis, New York: John Wiley and Sons, 1982
- 5. Box, George E.P., and Tiao, George C., Bayesian Inference in Statistical Analysis, Reading, Massachusetts: Addison-Wesley Publisning Company, 1973
- 6. U.S. Nuclear Regulatory Commission, 1975, Reactor Safety Study: An Assessment of Accident Risks in U.S. Commercial Nuclear Power Plants, WASH-1400, NUREG 75/014, Washington, D.C.
O i
\
O Page 289 of 453
W APPENDIX E - G DEPENDENCY ANALYSIS l 1 i 1 1 i I
}
i l 4 I 4 4 ,i l 1 a I I i 1 i ! f b i f I i .i iG i Page 290 of 453 I 1 i
----_..__....m_. ,, . .._ . , _ . .. . _ , . . _ _ _ _ , , , _. _ _ _ . _ , , ,___ . _ _ _ , , - _ . _
TABLE OF CONTENTS Page
1.0 INTRODUCTION
. . . . . . . . . . . . . . . . . . . . . . ...... 292 2.0 TYPES OF DEPENDENT EVENTS ..................... 292 3.0 OVERVIEW OF DEPENDENT ANALYSIS . . . . . . . . . . . . . . . . . . . 297 4.0 TECHNICAL APPROACH . . . . . . . . . . . . . . . . . . . . . . . . . 300 4.1 Identification of Initiating Events . . . . . . . . . . . . . . 300 4.2 Intersystem Dependencies .............. .... 300 4.3 Intercomponent Depende.1cies . . . . . . . . . . . . . . . . . . 301 4.4 Common Cause Analysis . . . . . . . . . . . . . . . . . . . . . 302 4.4.1 Methodology ...................... 303 4.4.2 Technical Approach . .................. 307 5.0 REVIEW OF" PRAIRIE ISLAND AFW SYSTEM PERFORMANCE .......... 316 6.0 APPLICATION OF THE EXAMINATION OF OPERATING EXPERIENCE . . . . . . . 319 6.1 Task #1: Gathering Industry Data For D-B AFWS ........ 319 6.2 Task #2: Filtering Industry Data for PI APWS . . . . . . . . . 319 6.3 Task #3: Grouping Common Cause Failure Mechanisms Fo r P I A PdS . . . . . . . . . . . . . . . . . . . . . 319 6.4 Task #4: Evaluation of Prairie Island APd System . ...... 320 7.0 COMMON CAUSE PARAMETRIC ANALYSIS . . . . . . . . . . . . . . . . . . 328 7.1 Step 1 - Block Diagram ......... ... ...... 328 7.2 Step 2 - WAMCUT Model . . . . . . . . . . . . . . . . . . . . . 329 7.3 Step 3 - Benchmark of Simple Fault Tree . . . . . . . . . . . 329 7.4 Step 4 - Expansion of Tree to Include Common Cause Events . . . 329 7.5 Step 5 - Benchmark Expanded Model . . . . . . . . . . . . . . . 330 7.6 Step 6 - Develop Parameter Values . . . . . . . . . . . . . . . 330 7.6.1 Parameter Values Based on EPRI Report ......... 330 7.6.2 Parameter Values Based on BFR Reports ......... 331 7.6.3 Prai rie Is'.and Speci fic Data . . . . . . . . . . . . . . 332 7.6.4 Parameter Values Uted ........... ..... 332 7.7 Basic Even: Failure Probabilities . . . . . . . . . . . . . . . 333 7.8 Baseline Results ....................... 333 8.0 APPLICATION OF PLANT SPECIFIC DESIGN ANALYSIS ... ....... 355 8.1 Task #1: Determine Components to Be Examined . . . ...... 355 8.2 Task #2: Select Common CAuse Linking Mechanisms and Failure Causes ............. ... 355 8.3 Task #3: Determine Susceptibility of Components to Failure Causes . . . . . . . . . . . . . . . . . . 356 8.4 Task #4: Assess opportunity for Occurrence of Failure Causes .... ............. 356 8.5 Task #5: Assess Significance of Findings . . . . . . . . . . . 356
9.0 REFERENCES
. ..................... ..... 363 0
Page 291 of 453
y [fj:p
, ev DEPENDENCY ANALYSIS kb 1.0 INNODUCTION y
Many difNre'n't terms have been used to describe severa7 of tne areas considered when evaluating dependencies among components and systems, such as common mode failures and common cause failures. Some of the more familiar terms and their definitions, as provided in the PRA Procedures Guide (Reference 1) are discussed briefly below. Common mode failures are generally considered as multiple, concurrent, and dependent faibres of identical equipment that fails in the same mode. Propagating failures occur when equipment fails in a mode that causes sufficient changes in operating conditions, environments, or requirements to cause other items of equipment to fail. Common cause failures are failures of multiple equipment items occurring . from some single cause that is common to all of them. Unfortunately, these categories are neither mutually exclusive nor exhaustiee. The discussion provided below describes the specific means and associated terms used in this study to evaluate dependent failures, among which common cause failures, propagating failures, and common mode failures are but three of the elements. 2.0 TYPES OF DEPENDENT EVENTS i
Dependene events have been defined and categ'orized in various ways. The categories and descriptions provided below are generally based on the PRA Procedures Guide (Reference 1) and the NREP Procedures Guide (Reference 2).
Dependent Event Categories There are four elements of a PRA which involve dependent failure analysis:
- 1. Identification of Inittating Events
- 2. Definition of Sequences
- 3. Mitigative System Failure Analysis
- 4. Quantification of Sequence Frequencies In each of these areas, the potential for intercomponent (often called intrasystem) or intersystem dependencies exists. Three types of dependencies are used to account for these areas:
Type l'- Dependent Inf,tiating Events For examole, a loss of offsite power results in a plant trip, a
' reduction in those systems available to satisfy critical safety fonctions, e.g., main feedwater, and a reduction in the
,,; reliability of other mitigative systems, such as auxiliary v feedwater because of the reliance on diesel generators.
> 'I Page 292 of-453
Type 2 - Intersystem Dependencies For example, both the motor driven auxiliary feedwater pumps and ECCS rely on power from the same emergency buses. Type 3 - Intercomponent Dependencies For example, 2 redundant pumps are maintained by the same individuals using the same procedures, were manufactured by the same company, and are in the same location. There is also a class of events, generally referred to as " external events" which include fires, floods, earthquakes, and other events that can cause extreme environmental stresses that might impact more than one component. These can be considered as subcategories within each of the 3 basic types listed above. Dependent failures involve some type of coupling among different components or systems. The next level of categorization considers ways in which coupling might occur.
- 1. Functional Dependencies
- 2. Environmental Dependencies
- 3. Human Dependencies
- 4. Physical Similarity Dependencies This categorization with examples is provided in Table 2-1. In some cases the distinction between categories is not sharp, but this breakdown is effective in describing and evaluating dependent events.
Functional Dependency These dependencies are in one of two basic areas: Sharing of Equipment or Process Coupling. Difference systems, or functions, of ten use (share) the same equipment. For example, the RHR pumps are generally used to perform several functions, including injection of borated water following a large loca, recirculation of water from the sump to the core and to the containment spray pumps, and normal closed loop shutdown cooling. A process coupling exists when one component or system depends directly or indirectly on the performance of another component or system. A direct dependency exists when the input (s) to a system are the outputs of other systems. An indirect dependency exists whenever the performance of a component or system depends on the state of another. An example of a direct process coupling is the dependence of the emergency core cooling system on electric power. Since the auxiliary feedwater system is also dependent on electric power, all three of these systems are interdependent. Support systems are typically the most important systems involving direct process coupling. O Page 293 of 453
cs An example of an indirect dependency is the dependence of the post loca ('~# ) recirculation system, generally involving use of the RHR pumps, on the containment spray system: for some designs, if the containment spray system does not operate, sump temperatures will be elevated sufficiently to cause cavitation of the RHR pumps. Environmental Dependencies These types of dependent events occur because different equipment is either located in close proximity or is otherwises linked and subject to similar environmental stresses. These environmental stresses might be severe, such as in the case of failure of a high energy line or they might be routine. Reference 12 considers coupling of 2 specific types: Spatial Proximity refers to equipment found within a common room, fire barriers, flood barriers, or missile barriers. Linked Equipment refers to equipment in different locations tb:t. although not necessarily functionally related, is similarly affected by either a routine or extreme environment. Being located at the same site results in the existence of environmental dependencies among equipment because of external events such as earthquakes and tornadoes. Human Dependencies (n) Human involvement at every phase of a plant's lifetime results in some degree of coupling among different plant equipment. Some human dependencies are treated explicitly, such as determining the likelihood of errors either during maintenance and test activities or in response to an abnormal event. Others must be treated either qualitatively or parametrically. Examples of dependent events related to human performance are provided below.
- 1. Equipment restoration errors during or following test, maintenance, or other activities that result in equipment being aligned differently than appropriate and that affect multiple components or systems.
Two redundant manually operated isolation valves are left closed after maintenance.
- 2. Inappropriate maintenance, testing or operation of equipment that affect multiple components or systems.
Two redundant MOVs fail to open due to binding caused by insufficient lubrication.
- 3. Design, fabrication, or installation deficiencies not identified or corrected during system acceptance testing, including those resulting from plant modifications, that affect multiple components or systems.
Condensation in steam lines exceeds trap removal capacity and results in overspeed trip of redundant turbine driven auxiliary feedwater pumps. LJ Page 294 of 453
Physical Similarity Dependencies Similar components operating in similar environments are coupled to some degree because they are physically similar. For example, consider the following idealistic example: If two identical engines were operated and maintained identically, we should expect each to perform the same and fail at the same time as parts of the engine that were not replaced before they wore out indeed wear out. Components are never exactly identical. Many are, however, sufficiently sim:lar that although they might not fail at exactly the same time, they have a reasonable chance of failing within times of interest when considering the overall reliability of a system. These times of interest are generally the testing interval and the mission time. O i l O Page 295 of 453 l t
f '-) TABLE 2-1
\s / TYPES OF DEPENDENT FAILURES DEPENDENT SUBTYPES EXAMPLES FAILURE TYPE
- 1. Dependent 1A Functional Loss of Offsite Power Initiating Event IB Environmental Steam Line Rupture IC Human Maintenance Error Causes Shorting Out Instrument Bus ID Physical Earthquake (Also falls Similarity in Environmental Subtype)
- 2. Intersystem 2A Functional Pump Fails Due To Dependency Electric Power Unavailability (N- ') 2B Environmental Fire Causes Loss of Equipment in Two Systems 2C Human Operator Error Causes Loss of Two Systems 2D Physical Pumps in Two Separate Similarity Systems Fail Due To Wearout of Identical Piece-parts
- 3. Intercomponent 3A Functional Redundant Pumps Fail Dependency Because Control Circuit Fails 3B Environmental Fire Causes Loss of Redundant Pumps 3C Human Maintenance Error Results in Failure of Redundant Motor Operated Valves t
3D Physical Redundant Pumps Fail Due Similarity to Wearout of Identical Piece-parts O Page 296 of 453
, 9 .r - ...
c ,m , . . - . - - . ., -_ .- -.._.,,y m, . -.__ .. _.
3.0 OVERVIEW 0F DEPENDENT ANALYSIS The basic approaches used to consider dependent events fall into one of four basic categories.
- 1. Explicit For example, common support systems among frontline systems can be identified and explicitly modeled.
- 2. Parametric Failure rates for groups of components are used to take into account dependencies among components and systems.
- 3. Sensitivity Evaluations The degree of dependence required for the results of an investigation to be changed significantly can be used to guide examination of areas '
that can not be reasonably investigated by explicit modeling or parametrically.
- 4. Qualitative Some areas are not amenable to quantitative investigations. Often systematic qualitative investigations supported by expert judgment is sufficient to investigate the significance of these areas. Sensitivity investigations might be used to guide these investigations.
Often, these are supported by computer-aided searches for common susceptibilities among different components and systems. Explicit Methods These involve the identification and evaluation of specific causes of multiple failures. Explicit methods are effective in identifying and evaluating several types of dependencies in each of the four areas of a typical PRA listed earlier: initiating event identification; event sequence development; individual systems failure analysis, and sequence quantification. Parametric Methods These are used to quantify several types of dependent events that are not amenable to detailed logic modeling and data development at the level of resolution required to explicitly consider them. With parametric methods, operating experience is used to estimate the likelihood that multiple components fail. Examples of parametric models include the beta factor, binomial failure rate, multiple Greek letter, and basic parameter methods. O Page 297 of 453
Qualitative The use of parametric models only permits direct consideration of those events that have occurred. It does not easily permit an examination of the significance of other susceptibilities. For example, some of the dependent events that are included in data bases developed for parametric models resulted in a conditional component failure rate of 1.0 for the conditions present in the event. Combining this dependent event with other failures to develop a dependent event, or common cause, failure rate does not provide information as to whether the system or component being examined has a failure rate of 1.0 or 0.0 for the specific causes of those events that have occurred. These types of dependent events can be addressed by investigating a system's basic design, maintenance, testing, and operation. Sensitivities Sensitivity investigations can be used to help focus investigations by examining the potential significance of different types of dependent events, or causes, on the overall results and conclusions, Components, and the types of potential failure causes, are not all equally important. For example, complete coupling (dependence) between two similar components might be assumed without markedly changing the results or conclusions of the investigation. Where possible, it is important to account for these possibilities so that efforts can be devoted to more important areas of the A evaluation. f ) Principal Methods Used And Their Aoplicability No single method is adequate to censider all dependent failure types. It has proven fruitless to attempt to model all of the dependent failures explicitly in logic models such as event and fault trees. The factors influencing component performance are too great in number and often to obscure to explicitly model and quantify. Incomplete innumeration of important causes of failures, which is always a problem when attempting to explicitly model and quantify everything that impacts performance, will almost always result in an underestimation of a system's failure frequency, or sequence frequency. Functional dependencies are the easiest to model. Human and physical similarity dependencies are extremely difficult to model and quantify explicitly. Parametric models supported by sensitivity and qualitative investigations are useful in considering the significance of failure causes not amenable to explicit modeling. The principal methods used are summarized in Table 3-1. LJ Page 298 of 453
TABLE 3-1 -
SUMMARY
OF PRINCIPAL METHODS Category Methods Applicability Initiating Definition Mitigative Quanti-Event of System fication Selection Sequences Failure Analysis Explicit Event- X X X X Specific Models Event Tree X X X X Analysis Fault Tree X X X X Analysis FMEAs X X X Human X X X Reliability Analysis Parametric Beta Factor X X Multiple Greek X X Letter Binomial Failure X X Rate Qualitative Checklist X Computer Aided X Sensitivi ty X X X X Studies O Page 299 of 453
'l
'.p ' 4.0 TECHNICAL APPROACH -
'V 4.1 Identification of Initiating Events The loss of offsite power initiating event was assumed to be caused by grid problems. Plant induced causes were not investigated. The possible causes of a loss of main feedwater event were investigated as follows:
- 1) Review of AN Fault Tree The AFW fault tree includes identification of direct functional dependencies with other systems. These other systems were reviewed to determine if their failure or degradation could result in a plant -
trip. The AFW system fault tree basic events and cut sets were reviewed to determine if failure of the ccmponents included in these events and cut sets could_ result in an initiating event or impact the performance of a normally operating system.
- 2) . Review Main Feedwater and Condensate System A review of the main feedwater and condensate system was performed to determine if there were any component commonalities with the AFW system, or support systems used by either system.
A This provides a check of the first step described above.
\'~J 4.2 Intersystem Dependencies Each type of intersystem dependency is discussed sept ately below.
4 Functional Event trees and fault trees were used to identify and model these types of dependencies. Event Trees for Loss of Main Feedwater and Loss of Offsite Power were developed. These event trees consider support systems, recovery of systems, and recovery of offsite power. A detailed auxiliary feedwater system fault trees was produced. This tree was developed to show all major component failure contributions to system unavailability as well as all important support system contributions. Environmental Dependencies Intersystem environmental dependencies are not addressed in this study. Other environmental dependencies peculiar to the auxiliary feedwater system are addressed, except for the exclusion of external events such as fires, flooding and earthquakes. O Page 300 of 453
Human Dependencies Intersystem dependencies related to operations personnel responses to a loss of O feedwater or loss of offsite power event are considered. Physical Similarity Decendencies Intersystem physical dependencies are not considered in this study. This is consistent with the state-of-the-art in reliability assessment when external events are not being considered. 4.3 Intercomponent Dependencies The approach used for each subcategory of dependency is described separately below. Functional Dependencies Intercomponent functional dependencies are explicitly include in the fault tree analysis of the auxiliary feedwater system and the other systems supporting the auxiliary feedwater system. Environmental Decendencies The impacts of normal environments and offnormal environments are specifically addressed for the auxiliary feedwater system. External events are not included in this' assessment. Plant specific failure rate information and parametric common cause models are O used to address the impact of normal environments. The possibility of offnormal environments is considered explicitly, including their potential as a result of possible failure modes of components in the auxiliary feedwater system. Human Dependencies Human interaction that is amenable to explicit modeling is considered using human reliability techniques. Others are treated using parametric common cause models. Both latent and dynamic interactions are considered. Plant specific operating practices are used. Physical Similarity Dependencies Physical dependencies are treated parametrically. This is consistent with state-of-the-art systems analysis that consider " common cause" types of failures. The following descr!ption of the common cause analysis provides additional information on the manner in which physical similarity dependencies were considered. O Page 301 of 453
(3 Common-Cause Failures b) Several of the activities described.above address those dependent events typically referred to as common cause failures. The activities being performed to address these types of events are the following.
- 1. Industry operating experience review defined potential coupling mechanisms between auxiliary feedwater system trains. A qualitative examination of the potential for similar events occurring at Prairie Island was performed by 1) defining the coupling mechanism, 2) examining the susceptibility Prairie Island components to this mechanism, 3) examining the opportunity for Prairie Island components being exposed to such mechanisms, and 4) examining the test and maintenance procedures which could detect and minimize the possibility of the mechanism occurring.
- 2. Statistical parametric analysis of the frequency of common cause events in auxiliary feedwater systems was performed and incorporated in the overall system reliability analysis. For this effort, existing data documented in available literature was used only as it is applicable to Prairie Island.
- 3. Potential common cause events that have yet to occur in AFW systems will not be identified by the operating experience review described above. To consider these other potential common cause failure mechanisms a limited review of key component design and operating A characteristic susceptibility to performance influences that have
'Q caused problems for similar components in other types of systems was conducted. This review consists of the following activities: Selected components for examination. Determine key failure mechanisms to be considered based on the components characteristics and previously observed problems with similar components. Determine susceptibility of these components to these causes. Assess opportunity for occurrence of these causes. Assess significance of finding. These activities are in addition to the explicit modeling and quantification activities described above. The next section examines common cause methods in detail. 4.4 Common Cause Analysis Parametric analysis is used to " help fill in the quantitative gaps" of the explicit modeling and quantification activities. Qualitative analysis is used to help fill in any remaining gaps of the analysis. This analysis will be referred to as the " common cause analysis" since the approach used is generally referred to in this way. Table 4-1 provides a summary of the types of common cause failures considered. Page 302 of 453
These common cause failures can easily dominate the unavailability of multipit. train systems. One recent antlysis (Reference 3) suggests that the contribution from common cause failures to overall system unavailability of a typical auxil-iary feedwater system can reach 95-99% of the total unavailability. This is not unexpected from complex systems that are designed to have multiple redundancies and that operate under similar, if not identical, influences. 4.4.1 General Methodology The importance of common cause failures in only exceeded by the difficulty of analyzing such failures. These type of failures do not occur frequently; the data base for common cause failures is fairly limited. When they do occur, the documentation of the event aften does not provide sufficient details to allow a full understanding of the underlying coupling mechanism. In fact, sometimes it is difficult to even determine if multiple failures have occurred from the documentation of failure events. Also, many of the coupling mechanisms are subtle and are very sensitive to the plant specific design and operating conditions; therefore, the ability to determine the applicability of data obtained at one plant to an analysis of another is often low. The difficulty of modeling common cause failure events is heightened by the f act that there are a multitude of potential coupling mechanisms ranging from all types of adverse environmental conditions (high temperature, radiation, vibration, etc.) to mechanisms associated with common designer, manufacturer, installation, etc., as discussed earlier. The susceptibility of any component or group of components to such potential failure mechanisms is very sensitive to the plant-specific design and operation. For these reasons, it is virtually impossible to explicitly model all of the potential common cause failure events directly in the system failure models. Recognizing both the importance of common cause failures and the inherent difficulty of analyzing such failures, any analysis of common cause failures must be carried out at a variety of levels if it is expected to provide the knowledge and insights that can adequately support a quality reliability analy-sis of a system or plant and can be subseouently used to improve the design and operation of the system or plant. Given that the fundamental objective of the common cause analysis is to provide such additional knowledge and insights, the scope and methods ef the analysis should be structured around the three major ways, introduced above, of producing this knowledge:
- 1. Examination of Operating Experience to Gain Qualitative Insights
- 2. Plant Specific Design and Operation Review
- 3. Statistical Analysis O
Page 303 of 453
TABLE 4-1
~( COMMON CAUSE CATEGORIES I. Failure to Verify Proper Design, Construction, or Fabrication Plant Definition Requirements Inadequacy Design Error or Inadequacy Manufacturing Error or Inadequacy Construction Error or Inadequacy Inadequate Acceptance Testing II. Failure to Properly Maintain / Operate System Component Inappropriate Instructions Supplied By Manufacturer Inappropriate Use of Manufacturer's Instructions Frequency Inappropriate Practices Inappropriate Procedures Inappropriate Inappropriate Use of Procedures III. Failure to Restore System Following Test, Maintenance, or Operation Procedure Inadequacy Failure to Follow Procedures Accidental Action IV. Failure to Protect System from Abnormal Operating Environment Moisture
- s Fire Q Temperature Vibration Impact Loads Dirt, Grease, etc.
Other? , V. Physical Commonalities Identical /Similar Components or Piece parts O Page 304 of 453
4.4.1.1 Operating Experience Review to Gain Qualitative Insights When confronted with a difficult modeling problem, the best source of informa-tion about what can happen is a description of what has already happened. Any common cause analysis should begin with a careful examination of events that have occurred at other plants and (if possible) at the plant under examination. This examination should not simply be limited to actual common cause events. Because of differences among plants, an event at one plant that only resulted in a single component being unavailable might have adversely impacted multiple components at the plant under study. This examination of actual operaing experience will allow a delineation of specific coupling mechanisms that have actually occurred. The design and opera-tional characteristics of the plant being analyzed can then be examined to judge its potential vulnerabilities to similar events and define defenses (or poten-tial defenses) against such events. Benefits The value of performing such an analysis is high. It would be very difficult to assure that a system (or plant) is adequately protected from common cause failure (CCF) events without specifically examining the actual events that have occurred in the industry. In addition, the examination of history will provide valuable insights into the specific failure mechanisms underlying the statistical data and will therefore allow more practical and meaningful defense options to be identified if the need, exists. Drawbacks This examination however, is not adequate to stand alone as a CCF analysis. It cannot by itself provide quantitative information required to support a system or plant reliability or safety assessment, and it (by definition) only attempts to look at what has happened. Because of this designed-in perspective, it may overlook important potential common cause failure events that have not actually happened and been recorded as such. Because of these limitations it is also important to include the other two elements of a CCF analysis discussed below. 4.4.1.2 Plant Specific Design and Operation Analysis This portion of the common cause analysis looks at the plant specific design and operation and attempts to explicitly identify specific coupling mechanisms that could result in the failure of multiple components in redundant trains or systems. This type of analysis utilizes a predefined list of coupling mechanisms and examines each of the components in the system model for their susceptibility to each mechanism, the opportunity for these mechanisms to actually impact that component, and the domain of influence of each of these mechanisms. The cut-sets of the system fault model are then examined to see if they are all susceptible to the same ccmmon cause failure mechanism. If they are, the actual opportunity for all of the components to be affected by this mechanism can be examined. In this way, potential common cause failure mechanisms that can fail the specific system being examined may be identified and incorporated in the reliability or safety analysis. A variety of computer codes have been developed which allow for the search for common susceptibilites among elements of cut-sets. Page 305 of 453
Benefits (oV) The importance of this step is that the analyst is using his knowledge of system and component design and operation to actually search for potential failure causes in a systematic way. This mode of analysis is analogous to the fault tree production process itself where the analyst utilizes his system knowledge in a logical structured investigation of the system. Potential vulnerabilities can be identified in this process that deserve atten-tion which may not be identified in processes that only look at what has happened in the past. In addition, the systematic examination of the suscepti-bility of specific sets of components (for example, all sets of identical redundant active components such as three parallel pumps) to potential common cause failure mechanisms and the opportunity for these mechanisms to actually influence these components can help assure that important common cause failures are not overlooked. Drawbacks The drawback to this type of common cause analysis is that it is difficult to assign high confidence to a process that is based on the explicit identification and combination of potential common cause coupling mechanisms for each compo-nent. Common cause failure mechanisms, susceptibilities, opportunities, and domains of influence are all often very difficult to analyze with any precision. While the process can often identify important potential CCF events, it cannot ,m alone be relied upon to identify all important potential mechanisms. Because of (d ) the uncertainty in the modeling, it should not be used alone to identify or quantify potential common cause failure events but should be part of a multi-element analysis which includes the examination of experience noted above and the statistical analysis discussed below. 4.4.1.3 Statistical / Para;;:etric Analysis Parametric analysis involves the use of data that represent failure rates for groups of components and the associated models required to use this data. Instead of individual component failure rates, failure rates for groups of components are used. A variety of logical procedures have been developed for quantifying the fre-quency of common cause failure contributors to system unreliability or unavail-ability. These models include the Multiple Greek Letter method, the Binomial Failure Rate method, the Beta Factor method, the Basic Parameter method, etc. In addition, data bases have been developed to support these quantification methods and computer codes exist to perform complex statistical analysis of raw data to produce estimates of the parameters used in the various quantification methods. All of these models incorporate the incorporation of common cause events in the fault models, the generation of cut-sets involving these common cause events, and the quantification of these cut-sets using common cause failure rate esti-mates extracted from industry data or developed from industry failure events. The modeling is relatively straightforward; development of appropriate failure () v rates is difficult. Page 306 of 453
Benefits The value of performing the statistical analysis lies in the ability to put the importance of the potential common cause failure events in perspective with the overall system or plant safety. It also allows the analyst to focus subsequent detailed analysis on those specific common cause events that would be most significant to overall system or plant performance. Drawbacks The weakness of the statistical approach lies in the quality of the data base used. Common Cause failure events do not happen frequently and the documentation of such events is often sparse. It is also difficult to determine if the common cause failure events reported in underlying data bases apply to the plant being analyzed. There is large subjectivity inherent in the data analysis where judgements are made about whether an event which actually failed both trains of a two train system would have failed all three in a three train system. It is even more difficult to determine the potential impact on the system being analyzed of the many more events that have occurred at other plants but did not result in a common cause failure. Finally, the question of completeness remains: What about those events that have yet to occur? 4.4.2 Technical Approach 4.4.2.1 Technical Approach to the Examinatica of' Operating Experience The analysis is based on review of industry data and evaluation of the implica- O tions of that data to the Prairie Island AFW system. This procedure involves four basic tasks:
- 1. Gathering data on events that have happened at Prairie Island or other plants.
- 2. Filtering the data.
- 3. Grouping these events based on the common cause failure mechanism.
- 4. Evaluating the susceptibility of the Prairie Island APd system to similar events.
Each of these tasks is described below. Task #1: Gathering Industry Data The first step in tnis procedure is to gather information about cammon cause failure events from industry data. There are several sources for this type of data. One such source is the work of Atwood and others using licensee event reports (LERs) to estimate parameters for the binomial f ailure rate model (References 5 through 8). Another is information available in the Nuclear Power Experience publications (Reference 10). The third source for this analy-sis is the EPRI NP-3967 report on operating experience involving dependent events (Reference 11). Page 307 of 453
O It is important to note that the purpose for gathering this data is to derive a (") set of typical common cause events rather than a complete list of all such events that have happened. Thus, if the data provides several example events relating to failure to restore a system following test or maintenance, it is not crucial to the evaluation that a_1_1 such events are found. The sources of Industry data used in this effort were:
- 1) the work of Atwood and others using licensee event report (References 5 through 8)
- 2) Nuclear Power Experience publications (Reference 10)
- 3) EPRI NP-3967 (Reference 11)
Only those events relating to AFW system were used in this effort. In addition, only those events relating to components that are in the AFW system at Prairie Island were used. The review and collection of the data included AFW system failures in motor operated valves, check valves, manual valves, turbine driven pumps, motor driven pumps, air operated valves, steam generator level detectors and actuation. Task #2: Filtering Industry Data The next step is to filter the data that has b,een gathered. The purpose of this q task it to focus attention on those events considered to be most relevant to the Q specific system or plant being analyzed. Filtering out extraneous data allows a more efficient analysis and focus resources on those events which will provide the most insights into potential vulnerabilities at the plant being analyzed. There are a variety of filters that can be effectively used. For example, the first filter might be to exclude data for types of components that do not exist at the plant in question. Of course, care should be taken here because many similar (but not identical) components will exhibit the same failure modes and be susceptible to the same common cause failure mechanisms. Additional filters can be based on whether the events reported are actually common cause failures in which redundant components failed. Because of often poor event documentation, this filter is often subjective. In addition, the analyst must look at single failures which would have (or could have) failed , multiple redundant component if they had existed. For example, a failure of a single steam-driven pump in a plant that has only one such pump may have been due to a cause that would have also failed other steam-driven pumps had they existed. This data may be very relevant to a plant that has multiple steam-driven pumps and should not be excluded merely because the original event was not actually a common cause failure. 1 1 2 age 308 of 453
Figure 4-1 provides a simple flowchart of the process used to filter industry data. Following elimination of events associated with components not applicable to the Prairie Island AFV system, the next step involved filtering this data to eliminate events that did not involve common cause failure mechanisms. This was done in part by reliance on the work of others (such as the Atwood work and the EPRI work) to classify each of the failure events as potential common cause mechanisms or not. For the NPE derived events, subjective judgement based on the description of the event was used. The next step in the filtering process was to exclude events that did not actually result in failure of redundant components as a result of the common cause failure mechanism. Comparison of the data for actual common cause failure of redundant components with data for events that did not results in failure of redundant components reduced the number of events in the data base without deleting any of the failure mecha-nisms. However, for turbine driven pumps, both actual common mode failure events and potential ones are in the data base. This is due to the fact that very few plants have multiple turbine driven pumps. For common cause failure mechanisms at plants with only one pump, there is no easy way to determine if the event would have failed a redundant turbine driven pump if one had been there. Because the Prairie Island AFW uses dual turbine driven pumps (one per unit), all turbine driven pump data relating to common cause failure mechanisms are in the data base. Task #3: Groupine of Events Once all the data has been gathered and filtered, it was grouped into categories based on the general common cause failure mechanisms. This group.ing process, by itself, provides important insights by identifying the important types of coupling mechanisms between multiple components that have been experienced. It also serves to structure and focus the subsequent steps in the analyses. Task #4: Evaluate Susceptibility of plant to Similar CCF Events In this final step, the plant is examined to ascertain whether it is vulnerable to common cause events similar to those which have occurred at other plants, and to identify defenses that exist (or could be implemented) that limit the likelihood of such CCF events. Three areas are reviewed in this structured examination:
- 1) the opportunity for the common cause failure event to occur (i.e. are there components that are susceptible to failure due to causes which have occurred at other plants?);
- 2) the preventive measures at that plant which work to diminish the likelihood that the mechanisms will affect redundant components;
- 3) the detection measures at that plant which work to increase the likelihood that the failures will be detected and fixed before the system is required to operate.
O Page 309 of 453
, 4.4.2.2 Technical Approach to Statistical CCF Analysis Y The process for performing the quantitative assessment of common cause failures of the auxiliary feedwater system can be divided into four major tasks:
- 1) Development of underlying system fault model
- 2) Incorporation of common cause failure events in fault model
- 3) Estimation of common cause failure event p-obabilities
- 4) Quantification of system unavailability Each of these tasks is described below.
Task #1: Underlying System Fault Model The common cause failure analysis was based upon the detailed fault tree. A key to the efficient completion of this CCF analysis is the production of a simplified (pruned) fault tree which explicitly represents redundant identical components. This simplifying step represents an important modeling assumption. This assumption is based upon a conclusion cited in Reference 3:
" Experience with common cause events that have occurred indicate that most such events involve identical active components that are initially in the same operational mode; i.e. operating or standby, and fail in the same (o) v mode."
This assumption is consistent with the assumptions made in virtually all CCF analyses performed and published to date as part of Level 1 or Level 3 PRAs. Task #2: Incorporation of CCF Events in Simplified Fault Trees Each of the individual events in the simplified fault tree can fail due to an independent failure or due to a common cause failure. This fault tree substructure is illustrated in Figure 4-2. The common cause portion of this subtree can be further developed to include the contribution from common cause failure which impact two conponents, three components, and so forth up to all components of that type. While subsequent data analysis might show that one or two of these common cause failure subevents dominate the contributions to overall common cause failure probability, all possible events were included in the tree development at this stage of the analysis. This subtree development is illustrated in Figure 4-3. An example of what the addition of this common cause failure would look like for a component which is one of three identical redun-dant components is illustrated in Figure 4-4 A common cause failure subtree similar to Figure 4-4 was developed and incorporated into the simplified fault tree. (D Li Page 310 of 453
FIGURE 4-1 FLOW CllART R)R FILTERING INDUSITlY DATA O INDUSTRY DATA ON AUXILIARY FEEDWATER COMPONENT FAILURES s NO PI DOES HAtt THIS TYPE OF COWPONENT T V wS ELIMINATE is THjs NO rAituRE A COMMON CAUSE WECHANISM T YES A NO NO DID REDUNDANT DOES FALURE COMPONENTS > INVotVE STEAM pg 9 DRIVEN PUMP 1 YES YES V INCLUDE g Page 311 of 453
i. l l' ! Task #3: Estimation of CCF Event Probabilities In the fault models, a component can fail in a variety of failure modes and it can either fail by itself or due to common cause failure events that fail two identical
- l. redundant components or (if there are three redundant components) due to common cause failure events that fail three identical redundant components, etc. Therefore, the boolean reduced expression for system unavailability will be comprised of combinations of the following terms for each type of component failure mode:
I 1) failure rate for each component due to independent events
- 2) failure rate for each component due to common cause events that fail two identical redundan. components
- 3) failure rate for each component due to common cause events that fail three identical redundant components I,.
- 4) etc.
These terms correspond to the events put into the CCF subtrees in Task #2. In this study, the estimation of these parameters was performed using two logically equivalent procedures: the Multiple Greek Letter (MGL) method (Refer-ence 3) and the Binomial Failura Rate (BFR) model (Reference 4). Development of parameter values is a subjective process. The limited amount of information available and the impact of plant-specific characteristics on the O applicability of this information makes it impossible to develop parameter values with uncertainty levels similar to.those of individual component failure rates. However,.without some consideration of common cause potential using parametric means, the overall unreliability of the AFd system will be underestimated. Because of these issues, the following app Nach was taken:
- 1. Information and processes provided in EPRI NP-3967 (Reference 11) were used to develop parameter values for the AF4 system pumps.
- 2. References 5 - 8 were reviewed to develop parameter values developed to support the BFR model.
- 3. Other sources were reviewed to determine " typical" parameter values.
- 4. PI specific data was used.
- 5. Judgment was used to determine parameter values based on the findings of these four tasks.
Task #4: Quantification of System Unavailability WAMCUT was used to quantify the CCF model using the data developed in Task #3. The results of the analysis provide an indication of the significance of common cause events on the overall system unavailability /unreliability. Rather than an absolute measure of the system's failure probability, these results are used to O . help focus investigation into aspects of the system most vulnerable to common cause failure. This facilitates the implementation of the plant-spectfic design and operating experience review described next. Page 312 of 453
As a sanity-check, plant-specific operating performance was used. For example, there have been about 1800 demands of the AFW system pumps without a common cause failure. This is strong evidence that the common cause failure rate of 2 or 3 pumps is less than 10 ~3 per demand. 4.4.2.3 Technical Approach For Plant-Specific Design Analysis A plant-specific design and operation review can be performed at a variety of levels. These range from a brief walkdown of a system to a detailed independent design and operation review in which individual component characteristics and intracomponent and intersystem relationships are considered. Since it was not the purpose of this study to review the adequacy of the AFW system design, a limited scope approach was used to supplement the examination of operating history and the statistical analysis. This investigation focused on those common groups of components identified in developing the common cause statistical analysis model. The investigation is analagous to that used to examine operating history. It consists of defining the susceptibility of key components to particular CCF mechanisms, and then assessing the opportunity for this mechanism. Although the results are qualitative, and completeness can not be assured, this process provides important understanding and insights into potentially important areas that otherwise might be overlooked. The following task descriptions describe this process. Task #1: Determine Components to be Examired The first step is to determine what components will be examined for common cause failure susceptibility. Components were grouped by type. For example, in determining the susceptibility of motor operated valves to the environmental factors, all motor operated valves were treated the same, rather than looking at each valve individually. Task #2: Select Common Cause Linking Mechanisms and Failure Causes The next step in the process is to determine what linking mechanisms to examine as potential initiators of common cause events. It is important to understand the failure causes that might result in common cause events, and what linking mechanisms might be present to produce these multiple failures. Identification of these linking mechanisms is critical to determining the opportunity for the CCF to actually occur. Components that are susceptible to the same failure cause and have a common linking mechanism would be expected to have a higher likelihood for multiple failure. Tasks 3 through 5 describe a process for evaluating the susceptibility and opportunity for common cause failures of similar components. O Page 313 of 453
-7 rsampt er ebpPeseff N I
.i b i i enwen can. I scenecer ransar er $ rasant er coureses? N i coceport N I PIGRE 4-2
~
Extension of Fault Tree Events ,1 l 1 s an== cmse ram m er enmeesere N f N I
- e, emmencase e===e= cas m
*** cts 2
. S99 wacts su. y eem : c ,,,en,
'l ggyggryg ceur o offJ FIGRE 4-3 Comon Cause Subtree for Component X which is one of M identical Redundant Components Page 314 of 453
I-[
>I-i g-2 C
n C4 e lt . f ' k.i*l$ i. e g c l 5 O
.i,t' T
Y - I 4 1lC t
~
Igl!. ll 1 ll1=I: i O
. - _ . ._. _ _ - - _ = _ _ _ __ _ ._ . ._ _
l l f Task #3: Determine Susceptibility of Components to Failure Causes I V After the linking mechanisms and failure causes that will be considered have been specified (Task 2), and the list of components prepared (Task 1), the next step is to determine the susceptibility of those components to these failure causes. ,, Evaluating the susceptibility of each component involves an assessment by an analyst familiar with the component design and operation. This is accomplished in a variety of ways: Plant walkdown with personnel knowledgeable of the system operation. Review of available design information (e.g., design descriptions, l drawings, vendor documentation, FMEAs). Review of operaing experience with that particular ce1ponent. Task #4: Assess Opportunity for Occurrence of Failure Causes l The previous task determines which components are susceptible to particular failure causes. The next step is to determine if there is an opportunity for that failure cause to occur. This involves answering the following questions for the failure causes of concern:
- 1) How can the failure cause exist?
- 2) What is the likelihood that this failure cause will exist? !
Task #5: Assess Significance of Findings j This is a subjective judgment by the evaluation team. The most important outcome of such an analysis is generally the development of an information base that knowledgeable plant personnel can use when considering inservice inspection and testing program practices and schedules. 5.0 REVIEW OF PRAIRIE ISLAND AFW SYSTEM PERFORMANCE The performance of AFW system components can be characterized as follows:
- 1. Motor-driven pump performance has been excellent, with only 2 demand failures in about 1400 demands. There have been no running failures ,
in about 4600 hours of operation. "
- 2. The turbine-driven pumps have exhibited poorer performance, with 8 demand failures in about 300 demands and 8 standby failures involving inadvertent closure of the trip / throttle valves.
- 3. Motor-operated valves have performed better than average, with only 2 !
failures in about 1700 demands. l O Page 316 of 453 i l l l i
Motor-Driven pumps - Of the two demand failures of the motor-driven pumps, one event was caused by a maintenance error that could have occurred on both motor-drivan pumps. This maintenance error resulted in backwards installation of the puno's lube oil filter. To prevent this from occurring again, design changes were made to eliminate this possibility. Turbine-Oriven Pumos Several problems with the governor and trip / throttle valve have been experienced at Prairie Island. These problems are typical of those experienced at other facilities. One of these event resulted in the simultaneous unavailability of both turbine-driven pumps. This event involved the inadvertent closure of both trip / throttle valves, and was discovered during surveillance testing. Prairie Island has taken several actions to minimize the likelihood of inadvertent closure of these valves and to improve the detection of sucn events. For example, administrative controls were enhanced and signs were posted to minimize the likelihood of personnel inadvertently dislodging these valves from their appropriate position. More importantly, control room annunciation of an overspeed trip condition was installed. Events which have occurred since installation of the annunciation have been detected and corrected within about 15 minutes on average. So although the potential for inadvertent closure remains, the detection means has reduced the significance of this event significantly. The data analysis indicates that the average pump unavailability from such event is 1.6E-05. Motor Operated Valves No common cause event have been experienced. Performance has been excellent. As will be illustrated in Section 6.0, the common cause events (or potential common cause events) that have occurred can be assigned to one of the following form categories.
- 1. Failure to restore the system to an operational standby status following testing, maintenance, or operation of the system.
- 2. Failure to verify proper design or construction of the system for all possible operating nodes.
- 3. Failure to protect the system from abnormal operating environments.
4 Failure to properly maintain or operate the system. Characteristics of the human interactions at PI related to category 1 were described in Appendix A. Each of the other categories is addressed briefly below. O Page 317 of 453
Design / Construction The majority of the major components included in this analysis have been operated for more than ten years; there has been significant opportunity to
" shake-out" the equipment. Thus, most inherent design or construction problems should have been corrected or actions taken to minimize their impact. The primary area to be considered with regard to future equipment performance is the impact of any future design changes. To minimize the potential for design / construction related common cause failures in the future, it is important L that acceptance testing of any future modification adequately represent expected p equipment performance requirements. In this way, the potential for these types of common cause failures can be controlled.
Environment The majority of the AFW system components are located in a " clean", controlled environment. The more severe environments are present internal to some o these components. Turbine-driven AFW pump components are subject to high temperature steam which has caused some generally highly reliable components (such as check valves) to fail at other plants. All of the AFW pumps are subject to backleakage of high pressure, hot water from the steam generators through AFW line check valves. l AFW pump cooling sub-system is subject to the effects of the water supplied form the Mississippi River by the Cooling Water System. All components are subject to normal vibrations, the characteristics varying among individual components. Maintenance / Operation Important characteristics of the AFW system that influence the potential for common cause failures are the follow'ng: Preventive maintenance is generally performed off-line. Unlike some plants
- that use a startup feedwater pump when returning the unit to service, PI uses a motor-driven AFW pump. Thus, there is opportunity to identify and correct many of the potential problems that mght have occurred during activities.
Even though the pumps used by the turbine-driven and motor-driven AFW pumps are the same, their operating history is significantly different. Whereas the i motor-driven punps have operated for about 4600 hours, the turbine-driven pumps have only operated for about 150 hours. Thus, wearout common cause failures would not be expected to be a major concern among the different pump types. The pumps normally aligned to each unit are not generally maintained at the same time because both units are not usually off-line at the same time. This staggering of maintenance activities should minimize the potential for maintenance-related common cause events between two motor-driven pumps or two O 1 turbine-driven pumps. 1 U page 318 of 453
6.0 APPLICATION OF THE EXAMINATION OF OPERATING EXPERIENCE The details of this analysis are presented below in a manner consistent with the four-task structure of the previously outlined technical approach. 6.1 Task #1: Gathering Industry Data For D-B APWS The sources of industry data used in this effort were:
- 1) The work of Atwood and others using licensee event report (References 5-9)
- 2) Nuclear Power Experience publications (Reference 10)
- 3) EPRI NP-3967 (Reference 11)
Only those events relating to AFW system were used in this effort. In addition, only those events relating to components that are in the AFW system at Prairie Island were used. The review and collection of the data included AFV system failures in motor operated valves, check valves, manual valves, turbine driven pumps, motor driven pumps, and steam generator level detectors and actuation. 6.2 Task #2: Filtering Industry Data For PI AFWS Following elimination of events associated with components not applicable to the Prairie Island AFW system, the next step involved filtering this data to eliminate events that did not involve common cause failure mechanisms. This was done in part by reliance on the work of others (such as the Atwood work and the EPRI work) to classify each of the failure events as potential common cause mechanisms or not. For the NPE derived events, where subjective Judgement based on the description of the event was used, the next step in the filtering process was to exclude events that did not actually result in failure of redundant components as a result of the common cause failure mechanisms. Comparison of the data for actual common cause failure of redundant components with data for events that did not result in failure of redundant components reduced the number of events in the data base without deleting any of the failure mechanisms. However, for turbine driven pumps, both actual common mode failure events and potential ones are in the data base. This is due to the fact that very few plants have multiple turbine driven pumps. For common cause failure mechanisms at plants with only one pump, there is no easy way to determine if the event would have failed a redundant turbine driven pump if one had been there. 6.3 Task #3: Grouping Common Cause Failure Mechanisms for PI APWS Four categories which cover the spectrum of events were identified from the list of common cause failure events from industry data. These four categories are:
- 1. Failure to restore the system to an operational standby status following testing, maintenance, or operation of the system.
- 2. Failure to verify proper design or construction of the system for all possible operating modes.
Page 319 of 453
- 3. Failare,to protect the system from abnormal operating environments.
=
- 4. Failure to properly maintain or operate the system.
The first category is failure to restore the system following testing, i maintenance, or operation. Table 6-1 lists the events that belong to this category. Typical events in this category include failure to open valves in the . suction line to a pump following maintenance or failure to replace fuses to control circuits after testing. ( J The second category is failure to verify proper design or construction of the system for all possible operation modes. While this common cause failure mechanism does not appear as frequently in the original data base for all AFV component faults as failure to restore faults, it does appear frequently in the 7 data base for CCF mechanisms that actually fail redund. int components. This indicates that, while these events do not occur frequently compared to failure to restore events, they have important consequences when they occur. Table 6-2
; lists the events belonging to this category. An example of this type of event m would be failure of components due to water hammer caused by failure to install steam traps in the line to a turbine driven pump.
{ 7 Table 6-3 contains the list of events pertaining to failure to protect the system from abnormal operation environments. This group of events is often i closely related to the first category since these events often occur due to some i kind of operator intervention in system operation. Examples of these types of events include aligning pumps to sources of water that are too hot for them to b pump or steam binding pumps due to inadequate isolation from sources of hot water. The last category is for eve:its relating to improper maintenance or operation of E the system. This differs from failure to restore faults in that this event involves failure to keep the ; system operational. An example of this type of r failure would be failure to lubricate a pump or valve operator as often as g required to make sure it will operate. Table 6-4 lists the events for this category. i 6.4 Task #4: Eval $ation of Prairie Island APd System For each common cause failure mechanism presented above, there are three things which must occur in order for a CCF event to happen at Prairie Island. Fi rst, there must be an opportunity for a common causa failure event. Second, there =_ must be a failure to prevent the mechanism from affecting redundant components. Third, there must be a failure to detect that such an event has taken place . before the system is required to operate. The evaluation team reviewed each of these events to determine the opportunity, = prevention mechanisms, and detection means at Prairie Island. In some cases, primarily those involving restoration errors, this review is redundant to the - explicit modeling of human errors conducted as part of the fault tree e development and analysis process. This additional investigation provides added E assurance that important potential causes of either individual component or E multiple component failure have not been missed. E r
=
0 Page 320 of 453
Findings The entries in Table 6-1 through 6-4 were further analyzed to determine if the opportunity for each event identified could exist at Prairie Island. When the opportunity for the event was judged to exist, the event was then analyzed to determine means of prevention of similar events at Prairie Island and means of detecting the event, should it occur. The results of this investigation are summarized in Table 6-5. If it was judged that there was no opportunity for a given event to occur at Prairie Island, that event was usually omitted from Table 6-5. If it was unclear as to whether or not the event could occtr, or if the event seemed particularly interesting and the analysts felt it sho..ld be brought to the attention of the reader, the event was entered in Table 5-5. Careful investigation of the entries in Table 6-5 should help plant personnel identify potential common cause failures that could affect operation of the Prairie Island AFW system. Then, based upon their judgement, the detection and prevention mechanisms, or recommendations, given in the table could be verified, established or improved upon in order to further ensure improved reliability of the AFW system. O O Page 321 of 453
-TABLE 6-1 j- LIST OF COMMON CAUSE EVENTS FOR RESTORATION ERRORS DATE PLA COMP DESCRIPTION 7803 JF1 MOVLV BYPASS VALVES FOR AFW PUMPS LEFT OPEN 7410 RS1 PUMPT OPERATOR LEFT SUCTION ISOLATED 7408 KE1 PUMPT OPERATORS DID NOT RESTORE OIL PRES BEFORE START 7601 TR1 PUMPT IMPROPER RESTORATION OF AUTO START CIRCUITRY 7306 TV4 PUMPT FUSES FOR AUTO START NOT REINSTALLED AFTER MAINT 7407 ZIl PUMPT PWR SUPPLY BKR TO LUBE OIL PUMP LEFT OPEN i
O Page 322 of 453
TABLE 6-2 - LIST OF COMMON CAUSE EVENTS FOR DESIGN / CONSTRUCTION DATE PLA COMP DESCRIPTION 7809 JF1 MOVLV DEFECTIVE RELAY PREVENTS PROPER FLOW CONTROL 7906 AR1 PUMPT WATER IN STM LINE (ISOL TRAPS) CAUSES OVERSPEED 7710 081 PUMPT VIBRATION CAUSES GOVERNCR FAILURE 7711 081 PUMPT SURGING VIBRATIONS PREVENTS GOVENOR OPERATION 8002 JF1 PUMPT DESIGN CHANGE CONTROL ERRORS 7909 SL1 SGLVL INCORRECT LVL SPAN CAUSES 2*. NONCONSERV ERROR 8103 JF1 PUMPT WIRING ERROR IN CNTRL CKT CAUSES PUMP FAILURE 8109 Z12 PUMPT IMPROPER DESIGN MODICICATIONS 8112 NA1 PUMPT CHECK VALVE PARTS JAM TRIP VALVE DUE TO INSTALL ERRORS 8110 AR1 CHCKVL MAN ERROR PREVENTS FULL CLOSURE OF CHECK VALVES 8402 SL2 PUMPT PS PROBLEMS DUE TO FAULTY DESIGN CHANGE 8409 PA1 PUMPT FAILED BRNG ASSEMBLY AND BENT SPINDLE IN GOVtiRNOR 8501 AR1 PUMPT INSUF STEAM / DESIGN CHANGE FAILED TO REMOVE ORIFICE 8502 SA1 PUMPT DESIGN ERROR IN TRIP CKTS FAILS ALL 3 PUMPS 8008 SE1 MOVLV DESIGN /CONSTR ERROR CAUSES MISMATCH BETWEEN MOTOR AND GPERATOR 8007 AR1 PUMPT BROKEN STUDS RESULTING FROM IMPROPER STUD-TYPE USE 8102 DC1 CHKVLV CHECK VALVE FAIL TO CLOSE-DESIGN CHANGED 8105 IP2 PUMPM LEVEL CONTROL VALVE TRIMMED IMPROPERLY 8001 SUI CHKVLV IMPROPER MATERIAL FOR COTTER PIN CAUSED FAILURE TO CLOSE OF AT LEAST TWO VALVES O Page 323 of 453
.,s TABLE 6-3
-- LIST OF COMMON CAUSE EVENTS FOR ENVIRONMENT
.DATE PLA COMP DESCRIPTION 8004 AR2 PUMPT TUR AND MTR PUMP CAVITATE DUE TO OVERHEAD WATER 7607 HN1 PUMPT LACK OF DISCH PRES DUE TO VAPOR BINDING (CHECK VALVES) 7312 RG1 PUMPT AIR IN SUCTION HEADER CAUSES PUMPS TO LOOSE SUCT 7402 -Z12 PUMPT AIR ASPIRATED INTO PUMP CAUSING OVERSPEED 8106 R02 PUMPT STEAM BINDING DUE TO LEAKING CHK AND MTR VALVES 8107 DC2 PUMPT STEAM BINDING DUE TO LEAKING CHK VALVE 8307 R02 PUMPT STEAM BINDING DUE TO LEAKING DISCHARGE VALVE 8311 SU2 PUMPT STEAM BINDING DUE TO LEAKING DISC CHK VALVE 8307 R02 PUMPT STEAM BINDING DUE TO LEAKING DISC CHK VALVE 8501 AR1 PUMPT BRING TEMPERATURE HIGH/ FORMAT FROM OUTAGE RELATED MODS 8307 R02 PUMPT CAVITATION DUE TO LEAKING DISCHARGE VALVES 8005 DC2 PUMPT CONSTRUCTION ACTIVITIES CAUSED TDAFWP TO BE UNAVAILABLE 7712 R02 MOVLV BACKLEAKAGE FROM DOWNSTREAM CHECK VALVE CAUSED BINDING 8012 AR2 PUMPM WATER IN LUVE OIL DUE TO PACKING LEAKAGE CAUSED BEARING FAILURE 8108 SA1 PUMPT OPERATIONAL VIBRATION CAUSED LOOSE LINKAGE 8408 MG2 PUMPT REVERSE ROTATION CAUSED BY CRACKED WELD IN CHECK VALVE 7901 DB1 MOVLV DIRT FROM CONSTRUCTION ACTIVITIES CAUSED VALVE STEM STICKING
(_./ p\s_) Page 324 of 453
TABLE 6-4 LIST OF COMMON CAUSE EVENTS FOR MAINTENANCE /0PERATION DATE PLA COMP DESCRIPTION 7809 JF1 PUMPT TRIP THROTTLE VALVE TRIPPED 7511 KE1 PUMPT REDUCED FLOW FROM PUMPS DUE TO STRN CLOGGING 7701 SA1 PUMPT TURBINE MANUALLY TRIPPED 7405 TU3 PUMPT PACKING TO TIGHT DUE TO DEFECTIVE PROCEDURES 8102 CC1 FUMPT BRNG WEAR FROM LOW LUBE OIL 8103 CC1 PUMPT BRNG DUE TO LOW LUBE OIL 8104 ARI PUMPT WORN TRIP MECH 8104 MI2 PUMPT OLD PACKING LEAKS 8104 CC1 PUMPT SEAL RINGS WORN CAUSES HI BRNG TEMPERATURE / CHANGE PROCEDURE 8104 OE2 PUMPT LOOSE TRIP PLATE AND SPRING / CHANGE SURV PROCEDURES 8105 MI2 PUMPT IMPROPER CLRNC ON DRUM CAUSED BY FAULTY MAINT PROCEDURE 8102 CC1 PUMPT BRNG DAMAGE DUE TO IMPROPER OIL LEVEL 8110 SU2 PUMPT INADEQUATE ADMIN CONTROL ALLOWS IMPROPER RESTORE 8203 MI2 PUMPT IMPROPER CLEARANCE ON DRUM CAUSED BY FAULTY MAINTENANCE PROCED 8206 PRI PUMPT SUCTION FILTER INSTALLED BACKWARD / PROCEDURE REVISED 8209 BV1 PUMPT WASHER BLOCKS TRIP VALVE 8207 S02 MOVLV IMPROPER LIMIT SW SETTINGS CAUSE VALVE OPEN SLOW 8211 S02 PUMPT LOW OIL LEVEL CAUSES OVERSPEED TRIP 8211 CC1 PUMPT LOW OIL LEVEL DUE TO IMPROPER MARKED OIL LEVEL INDICATOR 8310 DC2 PUMPT FAILED TO TRIP / RUST ON TRIP VALVE / CHANGED PM PROGRAM 8401 TV3 PUMPT GOVERNOR SPEED KNOBS MISPOSITIONED 8010 NA1 PUMPT RELIEF VALVE STICKING-SETPOINT TO LOW 8105 CR3 PUMP PACKING GLAND DVERHEAT 8202 SE2 PUMPT SEAL PACKING ON PUMP BLEW OUT 8411 HNL A0VLV INSUFFICIENT EXERCISING CAUSED 2 0F 4 A0Vs TO FAIL TO OPEN AUTOMATICALLY 9 Page 325 of 453
(~ ; BLE 6-5 I
>. OPERATING EX NCE REVIEW FINDINGS (_
DESCRIPTION C0ft1EfGS DATE PLA COMP 7410 RS1 PUMPT OPERATOR LEIT SUCTION ISOLATED SAFECUARDS-Il0LD TACCED. CllECKED WIDI HONMILY TEST. VERIFIED WITil PUMP FUNCTIONAL TEST FOLIDWING MAINTENANCE. 7306 TU4 PtNIT FUSES FOR AUTO START NOT REINSTALLED AFTER HAllG DOES NGE APPLY TO TURBINE-DRIVEN PUMP - STARTS IF POWER IDST FOR HOTOR-DRIVEN PtNP - WILL IDSE INDICATING LITES ON CONTROL PANEL IN CR - Cl!ECKED ONCE PER SitIFT. MAY ALARM. 7906 AR1 PUMPT WATER IN STN LINE (ISOL TRAPS) CAUSES OVERSPEED CANDIDATE H0DIFICATION IS TO INSTALL SAFECUARDS-Il0LD TACS ON ALL VALVES IN PATil FROM STEAM LINE TO CONDENSER. ALL VALVES WILL ALSO BE ADDED TO SYSTIM STARTUP CllECKOFF LIST. 7909 SL1 SCLVL INCORRECT LVL SPAN CAUSES 2% NONCONSERV ERROR REQUIRES WO OR HORE COUPLED ERRORS PER STEAM GENERATOR. 8103 JF1 PUMPT WIRING ERROR IN CNTRL CKT CAUSES PtMP FAILURE FOUND BY POST-HAINTENANCE OR PRE-OP TEST. COULD BE PROBLEM IF AUW-START CIRCUITRY HISWIRED. COULD BE DETECTED BY BY INTECRATED ACCEPTANCE TEST. 8112 NA1 PtNPT CllK VALVE PARTS JAM TRIP VALVE DUE W INST ERRORS VALVE IS NORMALLY OPEN. TilEREFORE, PORE LIKELY TO JAM 8209 BVL PUMPT WASilER BLOCKS TRIP VALVE ADMISSION VALVE SilUT. DETECTED BY HolGHLY TESTING. PREVENTED BY PERIODIC INSPECTION OF UPSTREAM COMPONEIGS. 8004 AR2 PtHPT TUR AND KTR PUMP CAVITATE DUE TO OVERitEAD WATER DISQtARGE PRESSURE MONITORED. IfEAT SENSITIVE TAPE INSTALLED 7607 IINI PtHIT LACK OF DISCll PRES DUE E VAPOR BINDING (Cite VLVS) ON DISCllARCE PIPING AND MONITORED AT LEAST EVERY S111FT. 8106 R02 PtNPT STEAM BINDING DUE TO LEAKING CHK AND MTR VALVES PERIODICALLY INSPECT AND LAP CHECK VALVE SEATING SURFACES. 8107 DC2 PUMPT STEAM BINDING DUE TO LEAKING CllK VALVE 8307 R02 PINPI STEAM BINDING DUE TO LEAKING DISCitARCE VALVE 8311 SU2 PLMPT STEAM BINDING DUE TO LEAKING DISC CIIK VALVE 8307 R02 PtNPT STEAM BINDING DUE TO LEAKING DISC OIK VALVE 8307 RO2 PUMPT CAVITATION DUE E LEAKING DISC 11ARGE VALVES 7712 R02 HOVLV BACKLEAKAGE FROM DOWNSTREAM OIK VLV CAUSED BINDING 7312 RC1 PtNPT AIR IN SUCTION IIEADER CAUSES PUMPS TO IDOSE SUCT DISCUSSED WIT 11 PLAMI PERSONNEL. FELT WAS NOT A PROBLEH. 7402 Z12 PtHPT AIR ASPIRATED INTO PtNP CAUSING OVERSPEED SUCTION PRESS RUNS AT 8-10 PSI. WNCTIONAL TEST FOLIDWING MAINTENANCE DETECTS ANY LATENT PROBIIMS.111W SUCTION / DIS 01 8012 AR2 PlNIH WATER IN LUBE OIL DUE TO PACKING LEAKACE CAUSED DISCUSSED WITil PIJLNT PERSONNEL. UNRESOLVED. COULD NOT BEARING FAILURE DETERMINE CAUSE. PERIODIC INSPECTION FOR WATER IN LUBE OIL. 8202 SE2 PtNPT SEAL PACKING ON PtNP BLEW OUT OtANCE OIL FREQUENTLY. SECOND EVENT (SE2) COULD BE A MECitANISM AS COULD Tite TilIRD (MI2). IF SO, COUID PREVENI 8104 M12 PtHPT 01D PACKING RESULTS IN EXCESSIVE LEAKACE 8104 CCI PUMPT CARBON SEAL RINGS FOR WRBINE SilAFT SEAL WORN - BY PERIODIC INSPECTION AND REPIJLCEMEtG OF PACKING. CAUSES tlICH BEARING TEMPERAWRE FOURTil EVENT (CC1) COUID BE HEGIANISM FOR DECRADATION OF TURBINE LUBE OIL. AGAIN PREVENTED BY PERIODIC INSPECTION. Page 326 of 453
i TABLE 6 5 OPERATING EXPERIENCE REVIEW FINDINGS (Continu:d) DESCRIPTION COMMENTS DATE PLA COMP DB1 MOVLV DIRT FROM CONSTRUCTION ACTIVITIES CAUSED VALVE MAY ltAVE SIMILAR EFFECTS ON TURBINE STEAM INLET AIR-OPERATED 7901 STEM TO STICK VALVE. IIOWEVER, VALVE IS IN ENCIDSURE IllAT SilOULD PREVENT 8411 IINL A0VLV INSUFFICIENT EXERCISING CAUSED 2 0F 4 AOVs TO FAIL CONTAMINATION. NO 011IER IMPORTAtrI VALVES ARE REQUIRED TO TO OPEN Alfr0MATICALLY OIANGE STATE. VALVE IS OPERATED AT LEAST HONDILY. 7809 JF1 PUMIT TRIP TliROITLE VALVE TRIPPED PUMP TRIP IS ANNUNCIATED IN THE CONTROL ROOM. WARNING 7701 SA1 PUMPT TURBINE MANUALLY TRIPPED SIGNS IN AREA ALERT PERSONNEL TO P0nXflAL PROBLEM. FLOOR 8104 AR1 PUMPT W0kN TRIP MECit IN AREA IS MARKED TO ALERT PERSONNEL. CRITICAL MECitANICAL 8104 OE2 PUMPT IDOSE TRIP PLATE AND SPRING /QtANGE SURV PROCEDURES PARTS ARE PAINTED IN BRICllT COIDRS TO ALERT PERSONNEL. HECitANICAL FAULTS DETECTED BY PERIODIC TESTING. 7405 TU3 PUMPT PACKING TOO TIGHT DUE TO DEFECTIVE PROCEDURES DETECTED BY PERIODIC TESTS AND FUNCTIONAL TESTS AFTER 8105 CR3 PUMP PACKING GLAND OVERllEAT MAINTENENCE. OPERATOR (S) ALWAYS IN VICINITY FOR PUMP TESTING. TEST AND MAINTENANCE IS STACCERED FOR PUMPS. 8102 CCI PUMPT BRNG WEAR FROM IDW LUBE OIL PLANT PERSONNEL ARE AWARE OF POTENTIAL PROBlJ2IS. OIL LEVEL 8103 CC1 PUMPT BRNC DUE TO LOW LUBE OIL IS OIECKED ONCE PER SilIFT. SYSTEM ENGINEERS IIAVE ENSURED 8102 CC1 PUMPT BRNG DAMAGE DUE TO IMPROPER OIL LEVEL LEVEL INDICATION AND SICitTCLASS MARKINGS REFLECT DESIRED 8211 SO2 PUMPT LOW OIL LEVEL CAUSES OVERSPEED TRIP SUMP LEVEL. 8211 CCI PlatPT IDW OIL LEVEL DUE TO IMPROPERLY MARKED OIL LEVEL INDICATOR 8310 DC2 PUMPT FAILED TO TRIP / RUST ON TRIP VALVE - CilANCED COULD BE IMPORTANT TO RECOVERY FROM SOME ODIER FAULT. PREVENTATIVE MAltrfENANCE PROGRAM RESULTS IN NONRECOVERABLE DAMAGE TO TITRBINE-DRIVEN PUMP. DETECTED BY PERIODIC TT. STING OF OVERSPEED TRIP CAPABILITY. 8401 TV3 PUMPT GOVERNOR SPEED KNOBS MISPOSITIONED DETECTED BY PERIODIC TESTING AND FUNCIlONAL TEST FOLIDWING MAINTENANCE. REQUIRED GOVERNOR SPEED CIIANGER SETTING IS DETAILED AND CllECKED BY Tile SYSTEM PRESTART O!ECKLIST. O O Pape '197 nf 4% O
-s 7.0 C0fNON CAUSE PARAMETRIC ANALYSIS / \
i ! L' The de'. ails of the analysis are presented below. The four major tasks described in Se'. tion 4.0 were further divided into the following 9 steps. Step 1 Develop simplified block diagram that illustrates common caJse groups of components (use insights gained in development of master fault tree to develop this model. Step 2 Develop WAMCUT model based on block diagram representation. Step 3 Benchmark WAMCUT model (use master fault tree failure rate information). Step 4 Expand simplified model to include common cause events using multiple Greek letter (MGL) method and create WAMCUT model. ! Step 5 Benchmark expanded model. Step 6 Develop common cause failure parameter probabilities. Steo 7 Develop WAMCUT input basic event failure probabilities. Step 8 Develop quantitative estimate of common cause failure probability using WAMCUT. Steo 9 Perform sensitivity evaluations. l b 7.1 Step 1 - Block Diagram ( Figure 7-1 provides a simplified drawing of the AFW system. Figure 7-2 provides the associated block diagram used to develop the CCF model. In general this block diagram follows the schematic of Figure 7-1; however, some components (in series) have been rearranged so that modules that have a similar or identical components could be shown side-by-side. The column (#Similar Components) indicates the number of components among modules (side-by-side) that are similar or identical. These components are the common cause groups or interest. There are 6 such groups, prefixes A, B, C, 0, E, and F. Other groups of components are treated independently (11417). Note the following differences between this block diagram and the master fault tree and Figure 7-1 schematic. Schematic Differences
- 1. The pumps have been divided into the fluid portion (the actual pump) and its driver (motor or turbine) so that common cause effects among l these different sub-components could be investigated separately.
[ - ! 2. The pump cooling components (modules I6 & 17 ) are shown separately. This accounts for the common inlet and outlet valves between the 11 and 21 pumps; and the 22/12 pumps as shown in Figure 7-3. D Page 328 of 453
The backup pump suction from the cooling water system (Module 14) is 3. shown as being common to all 3 pumps rather than as shown in Figure 7-1. I l This simplying and conservative assumption was made to facilitate modeling. Because of the low likelihood of loss of suction from the CST, this module can be assumed to be dominated by human error at a probability sufficient to account for the components included in this module and their actual logical relationship. 4 The suction from the CSTs is modeled as a single module. Because of the low likelihood of failing to have suction, this simplifying assumption can be made. Furthermore, by assuming that instead of having valve C412 in its current location, there are two valves C412A and C412B, suction faults from the CST to each pump become identical. Master Fault Tree Difference The only major difference is the grouping of components. The quantitative benchmark and review of cut-sets demonstrate that this grouping did not affect the results. 7.2 Step 2 - WAMCUT Model The WAMCUT model is shown in Figure 7-4. 7.3 Step 3 - Benchmark of Simple Fault Tree Table 7-1 provides the components included in each block and failure probabilities for each of these components. The first term in column 1 is the basic event name used in the expanded model described next. The cut-sets were compared to the master fault tree cut-sets to confirm that the key contributors were the same. 7.4 Step - 4 Expansion of Tree to Include Common Cause Events The common cause tree was developed by expanding each module. This was accom-plished by changing each module from a basic event in WAMCUT to a GATE. E.g. Consider modules Al & A2 GATE A1 = All + A1A1 Independent failure of Common cause failure of module Al modules Al and A2 GATE A2 = A21 + A1A2 Independent failure of Common cause failure of module A2 modules Al and A2 Instead of 2 WAMCUT basic events, 3 result: A1I, A21, A1A2. O Page 329 of 453
,, -The same process was used for each module containing common cause groups of components.
{O} The independent modules remained as basic events or were expanded to include an additional element to facilitate conversion of the simplified WAMCUT model. Each new gate is provided.in Figure 7-5. 7.5 Step 5 - Benchmark Expanded Model In order to benchmark the master fault tree ar.d simplified tree, all common cause basic event valves were set to 0.0. The cut sets were compared to those develop from the simplified tree to confirm that the key contributors were the same. 7.6 Step 6 - Develop Parameter Values Development of parameter values is a subjective process. The limited amount of information available and the impact of plant-specific characteristics on the applicability of this information makes it impossible to develop parameter. values with uncertainty levels similar to those of individual component failure rates. However, without some consideration of common cause potential using parametric means, the overall unreliability of the AFW system will be underestimated. Because of these issues, the following approach was taken:
/ 1. Information and processes provided in EPRI NP-3967 (Reference 11) were used to develop parameter values for the AFW system pumps.
- 2. References 5 - 8 were reviewed to develop parameter values initially developed to support the BFR model.
- 3. Other sources were reviewed to determine " typical" parameter values.
- 4. PI specific data was used.
- 5. Judgement was used to determine parameter values based on the findings of these four tasks.
7.6.1 Parameter Values Based on EpRI Report Information provided in EPRI NP-3967 was used to develop estimates of common cause parameters (8,7) for the AFW system pumps and drivers (motor / turbine). EPRI Np-3967 does~ not indicate the fault mode of the components (start, run, open, close, etc.) for the common cause parameter values (S-factors) presented. Combined fault modes, the total number of failures, functional unavailabilities, potentially failed states, etc. are provided. In addition, higher order parameters (7,6, etc.) are not provided. The additional information required was developed from a review of Reference 3. From this review it was possible to estimate the following parameters:
"1pr = Number of events in which a pump failed to run n
(J 1 Page 330 of 453
"1ps = Number of events in which a pump failed to start "ims = Number of events in which a motor failed to start "imr = Number of events in which a motor failed to run The following values for "n," were determined:
"1pr = 28.6 "1ps = 12.5 "Ims = 62 "Imr = 14.7 "1turb = 60.9 The values in some cases are not whole numbers because Reference 3 assumed that potentially failed states had a 10*.' probability of failure.
Assessment procedure The documentation format provided in Reference 3 served as the basis for documenting this assessment. Tables 7-2 and 7-3 provide th results of this assessment for Prairie Island. In some instances, event reports indicate dependent events that involve initiation and control that might effect both turbines and motors. These were included as pump faults so that these dependencies between turbines and motors would not be missed. It is possible that this approach results in a conservative bias; however, the impact is expected to be within the uncertainty bounds of the evaluation. Common Cause parameter Values Table 7-4 provides the results for each common cause parameter, As described in Appendix D, Data Analysis, when the number of common cause events in the numerator of each parameter was 0, a value of .5 was used; when in the denominator, a value of 1.0. These values were used so that a value of 0.0 would not be developed for any parameter. This method was not used to develop quantitative estimates of parameters for other AFW system components, Other components fault modes are either passive (normally open MOVs, check valves, etc.) or the significance of the components would be low even if significant coupling were assumed. For the other components, information provided in References 5-9 was used as described below. 7.6.2 Parameter Values Based on 8FR Reoorts Parameter estimates reported in References 5-9 were derived form LER data based on the Binomal Failure Rate (BFR) common cause failure model. The parameter estimates in these references were converted to MGL model parameters, given in Table 7-5. Page 331 of 453
/3 Because a single set of BFR common cause failure rates was developed to cover h both motor-driven and turbine-driven auxiliary feedwater pumps, the values for T in Table 7-5 are the same for both types of pumps. Separate individual failure rates for motor-driven and turbine-driven pumps were developed, however, so a separate S is given for each_ type of pump. Failures of the pump driver (motor or turbine) are not separated from pump failures in the BFR data, so the MGL parameters of Table 7-5 derived from the BFR estimates cover both the pump and the driver.
Note that S is higher for motor-driven pumps than for turbine-driven pumps. Since the rate of common cause failure was assumed the same for both type of pumps in the BFR estimates, this higher S stems from the fact that the motor-driven pumps exhibited a lower individual failure rate. Note also that T is much higher than S, particularly for turbine-driven pumps. This is in part due to the inclusion of " lethal common cause shocks" in the BFR model, which, by their nature, fail all components in the system. The BFR parameter accounting for lethal shocks is most heavily weighted in the formula for T, because the system size is assumed to be three for the auxiliary feedwater pumps. Finally, the valve common cause failure rate estimates reported in the BFR references were based on data not considered applicable to the value failure modes included in this study. Hence, no MGL parameter estimates were derived from the data or estimates of the BFR common cause data report covering valves. 7.6.3 Prairie Island Specific Data
'a There have been no common cause demand or operating failures of AFW system components. The one common cause standby failure (inadvertent closure of both turbine-driven pump trip / throttle valves) has been made insignificant from an unavailability viewpoint by installation of instrumentation to detect this occurrence as described earlier. The potential common cause failure of the motor-driven pump (backwards installation of the lube oil filter) has been eliminated as a future common cause by a design change.
The information on motor-driven pumps and all valves is insufficient to estimate common cause parameters. For the turbine-driven pump, the 8 demand failures can be considered as described in the Data Analysis appendix. S = .5/8+1 = .06 7.6.4 Parameter Values Used Table 7-6 provides the parameter values used in the baseline analysis. A minimum value of .05 and a maximum value of 0.5 were used. These lower and upper bound values were judgmentally determined on the basis of the general characteristics of the various sources reviewed. It is possible that a lower bound of .05 is conservative in some cases; there simply is insufficient information available to support a lower value, however. It is doubtful that a value of .5 is non-conservative; this value implies that third and fourth levels of redundancy are only worth a factor of 2 each. O Page 332 of 453
As shown in the Block Diagram described in Section 7.2, the valves appear in - groups whose size varies from 2 to 4. It was determined that the few or no common cause events that have occurred involving the valve types and failure modes shown in Table 7-6 were insufficient to support determination of specific parameter values for different group sizes. The values shown in Table 7-6 are used for all groups. 7.7 Basic Event Failure Probabilities The basic event values for each of the common cause terms are provided in Table 7-7. 7.8 Baseline Results Table 7-8 provides the most significant cut sets and corresponding values. The total failure probability was calculated to be 8.5E-5. Of this total, 1.9E-5 corresponds to cut sets involving only independent failures. The total value of the cut sets involving common cause failures (complete coupling or combinations of common cause and independent failures) is 6.6E-5. Table 7-9 divides the results into two sets: Pump / Drivers Only and Valve Failures. CCF of valves contributors about 65% of the total common cause failure probability. Each of these valve common cause failures is discussed below.
- 1. A1A2 This value is believed to be quite conservative for two reasons: 1) human error resulting in inadvertent closure of the two manual valves inside containment was explicitly considered; 2) the only other credible failure modes are disc-shaft separation of the manual valves or failure of two check valves to open which are probably less likely than determined using a Beta factor of .05 with the individual valve failure rates.
Quantifying disc-shaft separation and check valve failing to open faults is difficult. Proper maintenance and inservice inspection should make these events essentially unquantifiable. No such event have occurred in these valve types or operating situations in an AFW system. For this reason, and assuming Prairie Island staff continue to perform appropriate inservice inspection and maintenance, it will be assumed that the calculated value can be reduced by a factor of 10 to 2.8E-6.
- 2. CIC2C3 and B182B384 For reasons similar to those discussed for A1A2, these cut set values are believed to be very conservative. Their total value of 1.45E-5 can be reduced to 1.45E-6, if PI staff continue to perform appropriate preventive maintenance and inservice inspections to ensure that these valves are not deteriorating.
O Page 333 of 453
t 4 ( In summary, a reasonable CCF probability for the situation in which PI staff confirm valve integrity is the following: l i PCCF = 6.6E-5 ! -2.8E-5 >
-8,5E-6
-6.0E-6 .
+2.8E-6 i'
+8.5E-7 ,
+6.0E-7 -
= 2.8E-5 A Value of 6.6E-5 will be used in the baseline analysis; a value of ,
2.8E-5 will be used when candidate modifications are considered. ' i l i 1 1 i l 1 i 1. I }' 1 t 1-4 I l 4 I. '
; Page 334 of 453 i
t.. . __... -__ _ __ _ _ . . . . . - . . _ _ . . _ _ . . - . _ , _ _ . . . _ , _ _ _ _ _ - _ _ - . - - . , _ _ . . - , _ - .
TABLE 7-1 MAJOR COMPONENT CHARACTERISTICS INDEPENDENT COMPONENTS COMPONENT TOTAL U AND TOTAL RUN TOTAL BASIC EVENT IN IND. TYPE DEMAND FAILURE FAILURE I.D. BASIC EVENT FAIL. PROB. PROB. PROB. A11/A1 AF-12-1 N.0. MV 1.4-4 N/A AF-16-1 CV 2.4-4 N/A MV-32242 N.O. MOV 1.8-4 N/A 5.6-4 A21/A2 AF-12-2 N.O. MV 1.4-4 N/A AF-16-2 CV 2.4-4 N/A MV-32243 N.O. MOV 1.8-4 N/A 5.6-4 B11/B1 MV-32239 N.O. MOV 2.9-4 N/A AF-15-2 CV 2.4-4 N/A 5.3-4 B21/82 MV-32238 N.O. M1V 2.9-4 N/A AF-15-1 CV 2.4-4 N/A 5.3-4 B31/83 MV-32382 N.O. MOV 1.8-4 N/A AF-15-4 CV 2.4-4 N/A 4.2-4 B41/B4 MV-32381 N.O. MOV 1.8-4 N/A AF-15-3 CV 2.4-4 N/A 4.2-4 - C11/C1 AF-13-3 N.0. MV 1.0-4 N/A AF-15-9 CV 2.4-4 N/A 3.4-4 9 Page 335 of 453
(/)
'J TABLE 7-1 MAJOR COMPONENT CHARACTERISTICS (Continued)
INDEPENDENT COMPONENTS COMPONENT TOTAL U AND TOTAL RUN TOTAL BASIC EVENT IN IND. TYPE DEMAND FAILURE FAILURE I.D. BASIC EVENT FAIL. PROB. PROB. PROB. C2I/C2 AF-13-5 N.0, MV 1.1-4 N/A AF-15-11 CV 2.4-4 N/A 3.5-4 C31/C3 AF-13-4 N.O. MV 1.0-4 N/A AF-15-10 CV 2.4-4 N/A 3.4-4 011/01 Pil PUMP 5.9-4 6(5.3-5)= 9.1-4 3.2-4 021/02 P21 PUMP 5.9-4 6(5.3-5)= 9.1-4 3.2-4 031/03 P12 PUMP 5.9-4 6(5.3-5)= 9.1-4 3.2-4
' {J} E11/El M21 MOTOR 1.4-3* 6(5.5-5)= 1.7-3 3.3-4 F2I/E2 M12 MOTOR 1.4-3* 6(5.5-5)= 1.7-3 3.3-4 F11/F1 AF-14-1 CV 2.4-4 N/A MV-32333 N.O. MOV 1.4-4 N/A 3.8-4 F2I/F2 AF-14-5 CV 2.4-4 N/A MV-32336 N.O. MOV 1.4-4 N/A 3.8-4
- Includes Maintenance and Testing.
O
]
Page 336 of 453
TABLE 7-1 MAJOR COMPONENT CHARACTERISTICS (Continued) INDEPENDENT COMPONENTS COMPONENT TOTAL U AND TOTAL RUN TOTAL BASIC EVENT IN IND. TYPE DEMAND FAILURE FAILURE I.D. BASIC EVENT FAIL. PROB. PROB. PROB. F31/F3 AF-14-3 CV 2.4-4 N/A MV-32335 N.O. MOV 1.4-4 N/A 3.8-4 Il TURBINE TURBINE 2.5-2" 6(5.5-5)= 3.3-4 CV-31998 A0V 3.3-3 N/A 2.9-2 REMAINDER NEGLIGIBLE 12 2-AF-13-1 N.C. MV 5.3-3 N/A AF-13-1 N.C. MV 5.3-3 N/A OPERATOR N/A 1.3-2 N/A FAILS TO OPEN VALVES AVAILABILITY N/A .1 .12 0F PUMP 21 13 MV-32383 MOV FTC 5.9-4 N/A MV-32384 POV FTC 5.9-4 N/A OPERATOR N/A 1.3-2 N/A 1.4-2 FAILS TO CLOSE VALVES I4 BACKUP MANY 1.0-2 N/A 1.0-2 SUCTION COMPONENTS
- Includes Maintenance and Testing.
9 Page 337 of 453
l. TABLE 7-1 f MAJOR COMPONENT CHARACTERISTICS (Continued)
, INDEPENDENT COMPONENTS COMPONENT TOTAL U AND TOTAL RUN TOTAL BASIC EVENT IN IND. TYPE DEMAND FAILURE FAILURE
! I.D. BASIC EVENT FAIL. PROB. PROB. PROB. i IS CONDENSATE MANY 1.0-5 N/A 1.0-5 STORAGE COMPONENTS i TANK SUCTION 16 CW-1-2 N.O. MV 1.0-4 N/A CL-48-9 N.0. MV 1.0-4 N/A CL-48-10 N.O. MV 1.0-4 N/A HUMAN ERROR 4.2-4 N/A 7.2-4 17 CW-1-1 N.O. MV 1.0-4 N/A 2CL-49-2 N.O. MV 1.0-4 N/A 2CL-49-3 N.O. MV 1.0-4 N/A HUMAN ERROR 4.2-4 N/A 7.2-4 O Page 338 of 453
TABLE 7-2 P ^ '" '**" "8 ""* * I* Plant Status Events Description Application O 1 2 3 4 Type Mode Category (date) 0 0 0 0 0 L S DSN Cinna Critical Two motor-driven auxiliary feed- Cinna , 1 water pumps inoperable due to air (Note A) (December 1973) in common suction line. PI O O O O O 1 Two motor-driven auxiliary feed- Zion 2 0 0 1 0 0 0 L S DSN Zion 2 Power Escalation water pumps inoperable due to (Note A) Test air in suction lines. PI O O O O O 1 Kewaunee Shutdown Resin clogged auxiliary feed- Kewaunee 0.9 0 0 0.1 0 0 water pump strainers causing reduced flow. 98% Power Auxiliary feedwater pumps A and B Turkey 0 0 1 0 0 0 N S Operating Turkey Point 3 failed to start due to tight pack- Point 3 Practices (May 1974) ing. Pump C started, but tripped (Note B) due to governor failure. PI O .9 .09 .01 0 0 Point Beach Power Preoperation strainers lef t in Point 0 0.9 0 0 0.1 0 1 and 2 suction line plugged, making Beach 1 motor-driven auxiliary f eedwater hamp A on Unit 1 inoperable. Similar strainers were found in Unit 1 motor-driven auxiliary feedwater pump B and Units 1 and 2 turbine-driven auxiliary feed-water pumps. All three auxiliary feedwater Zion 2 0 0 1 0 0 0 N S Operating Zion 2 Shutdown Practices (September 1981) pumps failed to start. Pumps 28 and 2C failed due to a backfeed (Note C) circuit that resulted from pump PI O O O O O 1 control switch modification. Failure of pump 2A was due to a pressure switch drift.
- - Page 339 of 4 w l
/m ,, m I \ b $
V T '7-2 C (Continued) Plant Status Events Description Application P O 4
* **" 8 "E" **I*
1 2 3 (date) Type Mode Category Zion 2 Power Auxiliary feedwater pumps 2B and Zion 2 0 0 1 0 0 0 N S Different (November 1979) 2C failed to start due to miscali- Setpoints brated pressure gauges. Different Units P1 0 0 .9 .1 0 0 (Note D) Zion 2 Power Auxiliary feedwater pumps 28 and Zion 2 0 0 1 0 0 0 N S (December 1979) 2C failed to start due to start (Note C) circuitry design problem. PI O O O O O 1 Turkey Point 4 Prior to All three auxiliary feedwater pumps Turkey 0 0 0 0 0 1 L S 2 (June 1973) Initial failed to start automatically due to Point 4 Power missing fuses in pump autostart Testing circuit. PI O O O O O 1 Arkcasas One 2 0% Power h emergency feedwater pumps lost ANO 2 0 0 1 0 0 0 N S (Note E) (April 1980) sue. tion due to steam flashing; system design problem. P1 0 .9 .09 .01 Total 0 1.8 1.08 .12 0 5 Notss:
- 1. 1 = events that are modeled explicitly in systems analysis. These include events caused by failure of support systems, cascade failures due to system configuration, and certain types of operator actions.
- 2. 2 = events occurring prior to commercial operation detected as a result of startup testing.
- 3. 3 = events occurring during shutdown conditions that cannot occur during power ope:'ation.
- 4. 4 = events involving failures or potential failures that do not have a significane impact in analyses for PRA applications (e.g., components setpoints slightly outside of the technical specification limits).
- 5. C = common cause events applicable to parametric modeling.
A. Functional Testing follows T/M. Pump suction pressure is always greater than atmospheric. B. Separate Maintenance. Functional Testing follows T/M. Motor-driven pumps used to return unit to service. Significant difference in operating hours between IDAW and MDAW pumps. C. Functional Testing follows T/M. Assumes any modifications involving actuation with be subject to an integrated functional test. D. TDAFW and MDA N pumps have different setpoints. Motor-driven pumps are in opposite units. E. Fxcept for backleakage from main feedwater lines, no hot water sources exist. Included as one means to account for events that have yet to occur. 3Page 340 of 453
TABLE 7-3 Status Events Description Application P # # **" "8 "* **
- Plant O 1 2 3 4 Type Mode Category (date)
*Iko motor-driven auxiliary feed- Ginna 0 0 1 0 0 0 Ginna Critical (Deces.ber 1973) water pumps inoperable due to air in common suction line.
Two motor-driven auxiliary feed- Zion 2 0 0 1 0 0 0 Zion 2 Powe r (Fabruary 1974) Escalation water pumps inoperable due to , Test air in suction lines. Shutdown Resin clogged auxiliary feed- Kewaunee 0.9 0 0 0.1 0 0 Kewaunee N R Removed (November 1975) water pump strainers causing reduced flow. Turkey Point 3 98% Power Auxiliary feedwater pumps A and B Turkey 0 0 1 0 0 0 (Ray 1974) failed to start due to tight pack- Point 3 ing. Pump C started, but tripped due to governor failure. Point Beach Power Preoperation strainers left in Point 0 0.9 0 0 0.1 0 1 cod 2 suction line plugged, making Beach 1 L R Removed (April 1974) motor-driven auxiliary feedwater Pump A on Unit 1 inoperable. 1 0 0 0 0 1 Similar strainers were found in Unit 1 motor-driven auxiliary feedwater pump B and Units 1 and 2 turbine-driven auxiliary feed-water pumps. Zion 2 0 0 1 0 0 0 Zion 2 Shutdown All three auxiliary leedwater (September 1981) pumps failed to start. Pumps 2B and 20 failed due CO a backfeed circuit that resulted from pump control switch modification. Failure of pump 2A was due to a pressure switch drift. Page 341 of 4
T -3 (Continued) Events Description Application P ' "'** I "* 'I' Plant Status O 1 2 3 4 Type Hode Category (date) Power Auxiliary feedwater pumps 25 and Zion 2 0 0 1 0 0 0 Zion 2 (November 1979) 2C failed to start due to miscali-brated pressure gauges. Auxiliary feedwater pumps 2B and Zion 2 0 0 1 0 0 0 Zion 2 Power (December 1979) 2C failed to start due to start circuitry design problem. Turkey Point 4 Prior to All three auxiliary feedwater pumps Turkey C 0 0 0 0 1 (June 1973) Initial failed to start automatically due to Point 4 Power missing luses in pump autostart Testing circuit. Arkanus One 2 0% Power "No emergency feedwater pumps lost ANO 2 0 0 1 0 0 0 (April 1980) suction due to steam flashing; system design problem. Total 2 0 0 0 0 2 Notts:
- 1. 1 = events that are modeled explicitly in systems analysis. These include events caused by failure of support systems, cascade failures due to system configuration, and certain types of operator actions.
- 2. 2 = events occurring prior to commercial operation detected as a result of startup testing.
- 3. 3 = events occurring during shutdown conditions that cannot occur during power operation.
- 4. 4 events involving failures or potential failures that do not itave a significant impact in analyses for PRA applications (e.g., components setpoints slightly outside of the technical specification limits).
- 5. C = cosmon cause events applicable to parametric modeling.
Page 342 of 453
I I I TABLE 7-4 i i COMMON CAUSE PARAMETER VALUES
- EPRI NP-3967 BASED -
Component Failure Mode Parameter Value Pump FTS 8 .15 y .14 FTR S .02* y .5* Motor FTS' S .01**
~
O FTR 8 .03** FOOTNOTES l
- No applicable events
** No applicable events that were not already included in pump term evaluation l
Page 343 of 453
4
. ._ )' TABLE 7-5 COMMON CAUSE PARAMETER VALUES I
v
-BFR MODEL- ;
c I COMPONENT FAILURE MODE PARAMETER VALUE s' MOTOR-DRIVEN PUMP FTS 6 .20 i y T .38 ' t , FTR S .17 i !, r .34 ). TURBINE-DRIVEN PUMP FTS 6 .062 ' i-T .38 i I. 1-FTR 6 .046
< r .34 I
t f i- ! j- t i l' : i . ! l i 1-5 r
- i e
4 i i t i f ) i iO f i 4 1 Page 344 of 453 4 4 , i i
TABLE 7-6 PARAMETER VALUES USED IN ANALYSIS COMPONENT FAILURE TYPE MODE 6 T 6 NOTE N.0 MV FTR .05 .5 .5 1 CV FTO .05 .5 .5 1 N.O. MOV FTRO .05 .5 .5 1 PUMP FTS .15 .14 -- 2 FTR .05 .14 -- 3 MOTOR FTS .05 -- -- 4 FTR .06 -- -- 5 TURBINE FTS .06 -- 6 FTR .06 -- -- 7 NOTE 1 No relevant data available; lower and upper bound values (0.05 and 0.50) are used to assess potential significance. NOTE 2 Based on Table 7-1 results. NOTE 3 S based on lower bound value; I based on pump FTS value because there were no applicable events. NOTE 4 No applicable events not already included in pump FTS value. Lower bound value of 0.05 used. NOTE 5 No applicable events not already included in pump FTR value. NOTE 6 No Prairie Island events in 8 failures. NOTE 7 Demand value (Note 6) used, l O' l Page 345 of 453
i l
/' TABLE 7-7 \ COMMON CAUSE PARAMETER EQUATIONS BASIC EVENT ALGEBRAIC EXPRESSION FAILURE RATE EXPRESSION VALUE 2
- 1. AIA2 A ST 2.8E-5 2
- 2. B182 B 1/3(1-r)SA 4.0E-6 B183 i B184
- 8283 B284 B384 3
- 3. BIB 2B3 B 1/3(1-6) Sri 2.0E-6 BIB 284 818384 B28384 4
- 4. B182B384 B Sr61 6.0E-6 2
- 5. CIC2 C 1/2(1-r)SA 4.3E-6 CIC3 .
C2C3
- 6. CIC2C3 C Sri 8.5E-6 2
, 7. 0102 0 1/2(1-r)Si 4.5E-5
~
) 0103 D203 3
- 8. 0102D3 0 Br1 1.5E-5 2
< 9. E1E2 E S1 5.6E-5 2
1
- 10. FIF2 F 1/2(1-T)Si 4.8E-6 :
.FIF3 !
F2F3 3 I
- 11. FIF2F3 F Sn 9.5E-6 1
I O Page 346 of 453
. - - . . - - - , _ . _ . . _ , . . . _ _ . _ _ . - , _ , _ . - - . _ . . . _ _ . - _ . _ . . _ _ . _ - _ - _ . . . _ . , _ . _ _ _ , . . . . _ . . . _ _ _ . _ _ - _ . . _ , _ . . = , _ _ _
TABLE 7-8 PARAMETRIC COMMON CAUSE ANALYSIS RESULTS CUT SET VALUE DESCRIPTION AIA2 2.8E-5 Comon cause failure; normally open manual or motor operated valves fail to remain open or check valves fail to open D102D3 1.5E-5 Common cause failure of all three pumps CIC2C3 8.5E-6 Common cause failure of all pump discharge valves B182B384 6.0E-6 Common cause failure of four injection line valves (MOVs fail to remain open; check valves fail to open) E21
- 11
- 12 5.9E-6 Independent failu'res of P12 motor and P11 turbine; P21 out-for-maintenance D103
- I2 5.4E-6 Common cause failure of Pil and P12 pumps and P21 out for maintenance Il
- 12
- 17 2.5E-6 Independent failure of turbine and P21 out-for-maintenance and independent failure of the PT2 cooling water valves to remain open D31
- 11
- 12 2.1E-6 Independent failure of P12's pump and independent failure of turbine and P21 out-for-maintenance EIE2
- Il 1.6E-6 Common cause failure of P12 and P21's motors and independent failure of turbine D2D3
- Il 1.3E-6 Common cause failure of motor-driven pumps and independent failure of turbine O
Page 347 of 453
) _
k i ,1 TABLE 7-8 - PARAMETRIC COMMON CAUSE ANALYSIS RESULTS (continued) d 4 CUT SET VALUE DESCRIPTION E2I
- 16
- 1.2E-6 Independent failure of P12's motor and independent failure of the comon cooling water inlet / outlet valves to P11/P21 i
~
i i
\
f l / i >l' y i O Page 348 of 453
l i l i l TABLE 7-9 COMMON CAUSE COMPONENT CONTRIBUTIONS l 1. CCF PUMPS /0 RIVERS ONLY D10203 1.5E-5 0103
- 12 5.4E-6 E1E2
- Il 1.6E-6 t
D203
- II 1.3E-6 TOTAL FOR THESE CUT SETS 2.3E-5
- 2. CCF VALVES ONLY A1A2 2.8E-5 CIC2C3 8.5E-6 B1828384 6.0E-6 TOTAL FOR THESE CUT SETS 4.3E-5
- 3. TOTAL FOR 1 AND 2 6.6E-5 l I l
O l Page 349 of 453 l
o o .t o ei 3 x =y a a 5]~ 5C X ' h i1 3 r-25 g i) c! - o l Ao E
- l. -> 8 g .s a 5
s i i$k -> I- $'" S I>
=,, c. : v! e
;g .s_: x- . 1 v2s.B I re s,
i3 ki5 k3 h! is I I 3 73
-, ?g + D
-,?
L, 22 L,t:s e a X
*- O T
8e3g 5 u n ~ x m m x 15 s N- ~ M $$ Ts R ($ ?S {s *
- i =j -, E g Q 1
i-osc i E
% :a- 1 .
15 s.2
- te
, S
+6
+.
.- 8 x3 ts v3 w k + + 2 .
O
^
- af] Il s- ;M= 7,?h p U i I;.8 E T ls = t-e b.cg c 35 4.I P 4 -t is 6a 1 'g is 8 42 y- + g X:s I s 7 u t 15 is
,x s
" ^
2
- 8 X_
! is tg
.- 8 E N
te l- r e_, ms
- tjit t a,P E h k3 te R $
= 7 r-( J O .
E ' b
] , -* rz.fi I
- E
,m n, o, , m; s, .. =- A'g I -I.
a 5
= 1
! n. !!
i
. 9,, -
N N N IO d r g tg av gsy.s
- - s tgi't L. -g gg 3i' e6 6 se ,f 80 i'fsiTS . k i i t ?
e 55 55 l
] . >6. m
( s) II ! r -
- sk G 3
h* , { d X >!I $ !lg
SurrlCIENT FLCW 10 EITHER SG11 or SG12 4\ IFLOW A A SG SG e 11 12 SIMILAR COMPC-NCNTS FLDutt ITLOW12 Ar-12-1 d g 2 b III 472i22 M711Ef3 !N
/ \l flat tr1A2 @
k l/ % 1r0B1 f tra!2 m + 1m a s tr us e i MV-32239 A MV-32238 N MV-32382 b MV-32381 (4) Ar-15-3 (4) V 2 W 1 W 4
@ IrDC1 $ @ ITDC2C3 @
l I IFCC2 IFCC3 I V 3 b Ar-13-5 Ar-13-4 (3) Ar-15-9 Ar-15-It AF-15-10 (3) h h h Q g l D3 Pit P21 P12 (3) h h h Ttt
.5vg158,1 ,31 31 ,1, M (23 RS-15-2. t
@lrilt @ @ FIE2
# ~I WA g ,'I _
WA (1) h h _ h 8 -
y,
4 >- l >4 >-- l kj >- t t t td t t t td ~ d d 4 _E $ t E t E E l . $ __ 5 __ = __ ) __
- e. 8, . ?. g. n s
O ,%_!
^
d
,. _i ,
d_i ,.
MI
_i !'
.+ , U+ w .+ n U +
5 e e L
e Y
a l 7
e-b 5 !
c :
k k
,k5La *41h!
I : 3 a<- *a e t '
g % s l 0
h s s ,
3 l0 8 =
G l
FIGURE 7-4 h
WAMCUT INPUT NSP PI AFW SIMPLIFIED FAULT TREE-2/11/86 X 1E-09 1 2 IFLOW AND 2 0 IFLOW11 IFLOW12 IFIA1 AND 2 0 IF082 IF084 IFIA2 AND 2 0 IF081 IF083 IFIE2 AND 1 1 IF0F3 I4 IFIII AND 1 1 IF0F1 I4 IFII3 AND 1 1 IF0F2 I4 IFLOW11 OR 1 1 IFIA1 Al IFLOW12 OR 1 1 IFIA2 A2 IF081 OR 1 1 IFOC1 B1 IFOB2 OR I 1 IFOC1 82 IFOB3 OR 1 1 IFOC2C3 B3 IF084 OR 1 1 IF0C2C3 B4 IFOC1 OR 1 4 IFIII D1 C1 11 16 IFOC2 OR 1 6 IFII3 D2 C2 El 12 1 13 I6 IFOC2C3 AND 2 0 IFOC2 IF0C3 IFOC3 OR 1 4 IFIE2 C3 D3 E2 17 IF0F1 OR 0 2 F1 IS IF0F2 OR 0 2 F2 I5 IF0F3 OR 0 2 F3 IT END A1 5.6E-04 A2 5.6E-04 B1 5.3E-04 B2 , 5.3E-04 B3 4.2E-04 B4 4.2E-04 C1 3.4E-04 C2 3.5E-04 C3 3.4E-04 D1 9.1E-04 02 9.1E-04 D3 9.1E-04 El 2.0E-03 E2 2.0E-03 t F1 3.8E-04 F2 3.8E-04 F3 3.8E-04 Il 2.9E-02 I2 1.2E-01 13 1.4E-02 I4 1.0E-02 15 1.0E-05 I6 7.2E-04 17 7.2E-04 END Page 353 of 453
~' ~
FIGURE 7-5 ks- L EXPANDED MODEL CCF GATES
'GATEA1 OR 0 2 All AIA2 GATEA2 OR 0 2 A2I AIA2 GATEB1 OR 0 8 811 B182 B1B3 B184 818283 1 B18284 B1B384 B1828384 GATEB2 OR 0 8 B21 BIB 2 B283 B2B4 B18283 -
1 B182B4 B28384 B1828384 '
GATEB3 OR 0 8 B3I BIB 3 B283 B384 B18283 1 B18384 B2B384 B1828384 GATEB4 OR 0 8 B4I B184 B284 B384 B182B4 1 818384 828384 81828384 GATEC1 OR 0 4 C1I CIC2 CIC3 CIC2C3 GATEC2 OR 0 4 C2I CIC2 C2C3 CIC2C3 GATEC3 OR 0 4 C3I CIC3 C2C3 CIC2C3 GATED 1 OR 0 5 01I 0102 01D3 010203 16 GATED 2 OR 0 5 02I' D102 D203 D10203 I6 GATED 3 OR 0 5 03I 0103 D203 01D203 17 GATEE1 OR 0 2 Ell E1E2 GATEE2 OR 0 2 E2I E1E2 GATEFI OR 0 4 F1I FIF2 FIF3 FIF2F3 GATEF2 OR 0 4- F2I FIF2 F2F3 FIF2F3 GATEF3 OR 0 4 F3I FIF3 F2F3 FIF2F3 GATEIl OR 0 2 IIII III2
\_- -GATEI2 OR 0 2 I2Il 12I2 GATEI3 OR 0 2 I3Il 1312 GATEI4 OR 0 2 I4I1 I4I2 GATEIS OR 0 2 I5Il 15I2 O
Page 354 of 453
8.0 APPLICATION OF PLANT-SPECIFIC DESIGN ANALYSIS Each of the tasks described in Section 4.4.2.3 was carried out for key components in the Prairia Island AFW system. The results of this qualitative analysis are discussed in this section.
8.1 Task #1: Determine Components to Be Examined The components examined for the plant-specific design analysis were grouped for examination as folicws:
Group 1 - Manual valves AF-12-1 and AF-12-2 Group 2 - Check valves AF-16-1 and AF-16-2 Group 3 - Motor-operated valves MV-32242 and MV-32243 Group 4 - Motor-operated valves MV-32238, MV-32239, MV-32381 and MV-32382 Group 5 - Check valves AF-15-1, AF-15-2, AF-15-3, and AF-15-4 Group 6 - Manual valves AF-13-3, AF-13-4, and AF-13-5 Group 7 - Check valves AF-15-9, AF-15-10, and AF-15-11 These groups were formed because of the physical and functional similarities among the components contained in each group.
8.2 Task #2: Select Common Cause Linking Mechanisms and Failure Causes Typical common cause linking mechanisms are:
Location Energy Source Calibration Design Installation Maintenance Operator Testing The mechanisms selected for this analysis are location, energy flow path and design. The remaining mechanisms are considered either explicitly in the reliability model or are evaluated with parametric techniques. For example, common energy sources and operator testing, maintenance and operational errors can be identified and accounted for in the system model. The parametric techniques are designed to consider those mechanisms not included in the system model.
O Page 355 of 453
T Typical failure causes for common cause failures are: .
-(G .
Impact Vibration Pressure Temperature Steam Water Grit
. Electromagnectic Interference Radiation Damage Voltage Out of Tolerance Current Out of Tolerance Corrosion Chemical Reactions Carbonization Biological Hazards Each of these causes will be appropriately considered in the analysis.
8.3 Task #3: Determine Susceptibility of Components to Failure Causes Table 8-1 identifies component groups and their susceptibilities to various failure causes. The table is also used as a vehicle for consolidating the information gathered by performing Task #4 and Task #5.
- l'~') 8.4 Task #4
- Assess Opportunity for Occurrence of Failure Causes
\J
- . The information gathered by performing this task is summarized in Table 8-1.
The likelihood of existence of a cause is either assessed to be "High" or " Low" based on the relative frequency of the failure cause being assessed. Typically, causes that can be reasonably expected to occur during normal plant operations were given a relative likelihood of "High", while causes that are expected to i.
occur only during abnormal plant conditions are given a relative likelihood of
" Low."
8.5 Task #5: Assess Significance of Findings Table 8-1 provides this information.
l i
,s Ns Page 356 of 453
TABLE 8-1 PLANT-SPECIFIC DESIGN ANALYSIS POTENTIALLY LIKELIHOOD COMPONENT LINKING IMPORTANT CAUSE WILL GROUP MECHANISM FAILURE CAUSE HOW CAN CAUSE EXIST? EXIST SIGNIFICANCE OF FINDINGS 1 Location None - - Located in containment. Essen-Identified tially a passive component. Assume considerable separation. There-fore, no potentially important failure causes identified.
Energy Flow Vibration Proximity of main liigh Could expect coupled failures due Path feedwater piping. to vibrations. More likely to result from main feedwater opera-Some discharge flow liigh tion than auxiliary feedwater from AfW pumps. operation (cause typically exists for longer periods).
Pressure Subject to steam High Could expect coupled failures generator pressure (e.g., packing leakage) due to high pressure.
Design Same as Same as for Energy liigh Valves are of the same design.
Energy Flow Flow Path Therefore, the likelihood of the coupled failures mentioned above is increased. Likely failure would be separation of valve disk from valve stem.
2 Location None - - Same as for Group 1 Identified O O Page 357 of 45
O O O
- TABLE 8-1 1
, PLANT-SPECIFIC DESIGN ANALYSIS (continued)
POTENTIALLY LIKELIHOOD COMPONENT LINKING IMPORTANT CAUSE WILL GROUP MECHANISM FAILURE CAUSE HOW CAN CAUSE EXIST? EXIST SIGNIFICANCE OF FINDINGS Energy Flow Impact Water-hammer due to Low Valve disk is normally in flow 2
(cont.) Path emptying of feedwater path. Thus, water-hammer could cause valve disk to exceed design limits in acceleration and cause impact with valve seat or disk-opening stop; which could result 1
in valve damage (e.g., disk separation from hinge or valve back-leakage). Could expect coupled failures.
4 Vibration Similar to Group 1 High Could expect coupled failures due
' to' vibration. Likely failures are separation of disk from hinge, or hinge pivot, or excessive leakage.
Pressure Similar to Group 1 High Could expect coupled failures i
(e.g., body-bonnet leaks) due to 1
high pressure.
Same as Same as Energy Flow Same as Valves are of the same design.
) Design Energy Path (EFP) for,EFP Therefore, the likelihood of the j
Flow Path coupled failures mentioned above is increased, l
3 Location None - -
Valves are located outside of the i
i Identified containment. Specific location j
and resulting effects were not determined.
1 Energy Flow Vibration Discharge Flow from High Probably not significant. Rela-Path AFW Pumps tively short duration.
Page 358 of 453
TABLE 8-1 PLANT-SPECIFIC DESIGN ANALYSIS (continued)
POTENTIALLY LIKELil1000 COMPONENT LINKING IMPORTANT CAUSE WILL GROUP MECilANISM FAILURE CAUSE il0W CAN CAUSE EXIST? EXIST SIGNIFICANCE OF FINDINGS 3 Pressure Discharge pressure of liigh Will not exist for significant AFW pumps periods unless Group 2 valves (cont.) leak. Probably not significant.
Design Same as Same as for Energy liigh Assumed to be same design as Energy Flow Flow Path MV-32238 and MV-32239. Since Path valves are of same design, likelihood of any coupled failures is increased.
4 Location Temperature Fire in AFW room Low Could cause coupled failure of Steam in AFW room all four valves. Fire would be mitigated by fire door, which would close and separate MV-32238 and 239 from 381 and 382. Ilowever steam would potentially cause failure of valves regardless of fire door position. Potential sources of excessive steam admission to room have been identified and are being eliminated.
Steam Steam in AFW room Low See discussion above. Can also result in increased likelihood of moisture-related failures of electrical components in valves.
Water Break of Fire Low Coupled failure unlikely since Protection or valves for each pump are Cooling Water physically separated. Common System Line flooding is unlikely due to relatively high elevation of components in AFW room.
G 9 Page359of45e
~ [J TABLE 8-1 PLANT-SPECIFIC DESIGN ANALYSIS (continued)
POTENTIALLY LIKELIHOOD COMPONENT LINKING IMPORTANT CAUSE WILL GROUP MECHANISM FAILURE CAUSE HOW CAN CAUSE EXIST? EXIST SIGNIFICANCE OF FINDINGS 4 Grit Construction Probably Fire door that could separate l valves for this cause is usually activities During Low (cont.) open. Plant is relatively Outage clean. Susceptible parts of valves appear to be adequately _
protected by housings. Probably not significant.
Energy Flow Similar to Similar to Group 3 Similar Similar to Group 3.
Path Group 3 to Group 3 Design Similar to Similar to Group 3 Similar MV-32238 and MV-32239 are of a Group 3 to different design than MV-32381 and Group 3 MV-32382. Therefore, the design linking mechanism for this group is significantly different among
' the components. Thus, the likeli-
' hood of coupled failures of these i valves due to failure causes from that mechanism is decreased significantly.
5 Location None - - Essentially passive components.
Identified Considerable separation combined with little or no susceptibility to typical failure causes result-ing from this linking mechanism.
Energy Flow Impact Similar to Group 2 Low Similar to Group 2. Unlikely that Path affects will be severe at this distance from the steam generators.
Probably not significant.
Page 360 of 453
TABLE 8-1 PLANT-SPECIFIC DESIGN ANALYSIS (continued)
POTENTIALLY LIKELIl100D COMPONENT LINKING IMPORTANT CAUSE WILL GROUP MECllANISM FAILURE cat!SE IIOW CAN CAUSE EXIST? EXIST SIGNIFICANCE OF FINDINGS 5 Vibration Discharge Flow From liigh Probably not significant. Rela-(cont.) AFW Pumps tively short duration.
Pressure Discharge Pressure liigh Will not exist for significant From AFW Pumps periods unless Group 2 valves leak. Probably not significant.
Design Same as Same as Energy Flow Same as All valves are of the same design.
Energy Flow Path EFP Therefore, the likelihood of any Path coupled failure is increased.
6 Location None - -
Essentially passive components.
Identified Considerable separation combined with little or no susceptibility to typical failure causes result-
- ing from this linking mechanism.
Energy Flow Vibration Discharge Flow From liigh Probably not significant. Rela-Path AFW Pumps tively short duration.
Pressure Discharge Pressure liigh Will not exist for significant From AFW Pumps periods unless Group 2 and Group 5 valves leak. Probably not significant.
Design Same as Same as Energy Flow liigh All valves are of the same design.
Energy Flow Path Therefore, the likelihood of any Path coupled failure is increased.
7 Location None - - Similar to Group 5.
Identified Page 361 of 4
__ - _ . _ - . .. ~ _ . _ _ _ _ _ _ ._ . _ _ . .
TABLE 8-1 PLANT-SPECIFIC DESIGN ANALYSIS (continued).
POTENTIALLY LIKELIHOOD COMPONENT LINKING IMPORTANT CAUSE WILL GROUP MECHANISM FAILURE CAUSE HOW CAN CAUSE EXIST? EXIST SIGNIFICANCE OF FINDINGS 7 Energy Flow Impact Similar to Group 5 Low Similar to Group 5.
(cont.) Path Vibration Similar to Group 5 High Similar to Group 5.
i
) Pressure Similar to Group 5 High Will not exist for significant periods unless Group 2 and Group 5 valves leak. Probably not i
significant.
Design Same as Same as Energy Flow Same as All valves are of the same design.
4 Energy Flow Path EFP Therefore, the likelihood of any Path coupled failure is increased.
I i
i i
i Page 362 of 453
9.0 REFERENCES
- 1. NUREG/CR-2300, "PRA Procedures Guide."
- 2. NUREG/CR-2815, " National Reliability Evaluation Program (NREP)
Procedures Guide."
- 3. Fleming, K.N. et al., "A Systematic Procedure for the Incorporation of Common Cause Events in Risk and Reliability Models," Presented at Nuclear Engineering and Design International Seminar, August, 1985.
- 4. Vesely, W.E., 1977. " Estimating Common Cause Failure Probabilities in Reliability and Risk Analyses: Marchal-Olkin Specializations", in Nuclear Systems Reliability Engineering and Risk Assessment, Fussell, J.B. , and Burdick, G.R., Eds. , Society for Industrial and Applied Mathematics, Philadelphia, Pa.
- 5. Atwood, C.L., 1982. Common Cause Fault Rates for Pumps: Estimates Based on Licensee Event Reports at U.S. Commercial Nuclear Power Plants, January 1, 1972 through September 30, 1980, NUREG/CR-2098, EGG-EA-5289, U.S. Nuclear Regulatory Commission, Washington D.C., EG&G Idaho, Inc., Idaho Falls, Id.
- 6. Steverson, J.A., and Atwood, C.L., 1983. Common Cause Fault Rates for Valves: Estimates Based on Licensee Event Reports at U.S. Commercial Nuclear Power Plants, 1976-1980, NUREG/CR-2770, EGG-EA-5485, U.S.
Nuclear Regulatory Commission, Washington D.C., EG&G Idaho, Inc., Idaho Falls, Id.
- 7. Atwood, C.L., 1983. Common Cause Fault Rates for Instrumentation and Control Assemblies: Estimates Based on Licensee Event Reports at U.S.
Commercial Nuclear Power Plants, 1976-1978, NUREG/CR-2771 EGG-EA-5623, U.S. Nuclear Regulatory Commission, Washington D.C., EG&G Idaho, Inc., Idaho Falls, Id.
- 8. Atwood, C.L. , and Steverson, J. A. ,1982. Common Cause Fault Rates for Diesel Generators: Estimates Based on Licensee Event Reports at U.S.
Commercial Nuclear Power Plants, 1976-1978, NUREG/CR-2099, EGG-EA-5359 Rev.1, U.S. Nuclear Regulatory Commission, Washington D.C., EG&G Idaho, Inc., Idaho Falls, Id.
- 9. Atwood, C.L., 1980. Estimators for the Binomial Failure Rate Common Cause Model, NUREG/CR-1404, EGG-EA-5112, U.S. Nuclear Regulatory Commission, Washington, D.C., EG&G Idaho, Inc., Idaho Falls, Id.
- 10. S.M. Stoller Corporation, " Nuclear Power Experience."
- 11. EPRI-NP3967, June 1985, " Classification and Analysis of Reactor Operating Experience Involving Dependent Events."
O Page 363 of 453 t-
J APPENDIX F TWO UNIT LOSS OF OFFSITE POWER ANALYSIS l i i e i i i i j i i i
- G i
} 1 .i 1 4 'l j d i 1 I 4 1 i 1 0 . l t Page 364 of 453 4 1
TABLE OF CONTENTS Page
1.0 INTRODUCTION
, . . . . . . . . . . . . . .............. 366 2.0 APPROACH . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 366 -
2.1 Support System States . . . . . . . . . . . . . . . . . . . . . 367 2.2 Recovery Considerations . . . . . . . . . . . . . . . . . . . . 367 3.0 0FFSITE POWER RECOVERY INFORMATION . . . . . . . . . . . . . . . . . 371 4.0 RESULTS PRESENTATION . . . ..................... 371 5.0 ADDITIONAL CONSIDERATIONS ..................... 372 6.0 AFW SYSTEM CUT-SET ELEMENT VALUES ................. 374 7.0 SUPPORT SYSTEM ELEMENT VALUES ................... 375 8.0 RESULTS DISCUSSION ........................ 375 9.0 COMMON CAUSE FAILURES ....................... 377 10.0 SENSITIVITY EVALUATIONS ...................... 378 11.0 IMPACT OF CANDIDATE MODIFICATIONS ........ ........ 380 i O Page 365 of 453 t
G
1.0 INTRODUCTION
\ )
If both units are operating prior to a loss-of-offsite puer event, both will require operation of the AFW system. The AFW system cut-sets and significance of the support states determined for a single unit event change. Figure F-1 displays the impacts of various support system states on important AFV compo-nents for each unit. The cooling water system and electric power system failure probabilities are assumed to be dominated by the failure probabilities of the diesel cooling water pumps (DCWPs) and diesel generators (DGs), respectively. The impact matrix includes the following functions:
- 1. F = AFW Pump Flow l
- 2. C = Cooling to AFV Pumps
- 3. BU = Backup Suction Source (the Cooling Water System) to AFW Pumps.
Table F-1 indicates the key cut-sets for each sequence. Table 2 provides a simplified set of algebraic expressions that represent these cut-sets. 2.0 APPROACH The master fault tree described in Appendix A was developed to determine the probability of failing to provide sufficient feedwater to a least one steam generatqr of Unit i following a loss of main feedwater initiating event affect- ' p) ( ing only Unit 1. This fault tree is not directly applicable to a loss of offsite power initiating event because it is most likely that such an event will affect both units, and thus the cross-connect motor-driven pumps will serve dual ! roles: 1) supply feedwater to the unit to which it is normally aligned; 2) sup-l ply feedwater to the other unit if the unit to which it is normally aligned is being supplied feedwater from its turbine-driven AFW pump and both the turbine-driven and motor-driven pumps of the other unit are unavailable. The simplified , fault tree developed for the common cause analysis described in Appendix E is also only directly applicable for an initiating event that affects a single unit. As demonstrated for the loss of main feedwater initiating event fault tree analysis using the master fault tree, the most significant components, and cut-sets, involve AFW pump train components, not individual steam generator inlet lines or the CST suction header or Cooling Water System backup suction. These components are those shown in the following blocks of the block diagram shown in Figure F-2.
- 1. Turbine-Oriven Pump 11 C1 + D1 + Il + F1 Turbine-Driven Pump 22 has the same component types in each of these blocks.
O V Page 366 of 453
- 2. Motor-Driven Pump 12 to Unit 1.
C3 + D3 + E2 + F3 Motor-Driven Pump 21 flow to Unit 2 has the same component types in each of these blocks.
- 3. Cross-Connect Pump For Unit 2 Motor-Driven Pump 21 to Unit i use, these blocks are:
C2 + D2 + El + I2 + I3 + F2
- 4. Common AFW Pump Cooling For the 11/21 pumps these components are included in block 16; for the 22/12 pumps, block 17.
To facilitate the time-dependent two-unit loss of offsite power initiating event analysis only those components repre ented by the blocks listed above were analyzed. This approach results in a minor (negligible) level of optimism in the results. 2.1 Support System States Appendix B reviewed the influence of support systems on AFW system components of both units. For a loss of offsite power, the key support system components are the diesel generators (DGs) and diesel cooling water pumps (DCWPs). Figure F-1 displays the impact of various support system states on AFW system components. Table F-1 indicates the key cut-sets for each sequence, Table 2 a simplified set of algebraic expressions that represent these cut-sets. These cut-sets can be expanded to include the components included in each block described above and used to determine the probability of failing to provide sufficient feedwater to either unit following a loss of offsite power initiating event. To assess the significance of operating failures and consider the influence of offsite power recovery, the resulting cut-sets were solved temporally. The approximate method used is described below. As described it includes consideration of recovery of diesel generators and diesel cooling water pumps. As used, however, only offsite power recovery was considered explicitly in the method. Recovery of cgs, DCWps and APd pumps were treated in the sensitivity evaluations described later. 2.2 Recovery Considerations Figure F-3 displays the impact of recovery considerations. In this event tree, recovery of DGs, DCWPs, and offsite power are considered. O Page 367 of 453
j'] The following sequences are of interest:
!.,._)
(4) DG2
- DG2RCV
- OPRCV : DG2 Out (7) DG1
- OG1RCV
- OPRCV : DG1 Out (10) DG1
- DG2 DG2RCV
- OPRCV : DG2 Out (12) DG1
- OG2 DG1RCV
- OPRCV : DG1 Out (13) DG1
- DG2
- DGIRCV
- OG2RCV
- OPRCV : DG1
- OG2 Out (31) DCWP12
- OCWP22
- DG2RCV
- OPRCV : DG2 Out (33) DCWP12
- DCWP22
- OG1RCV
- OPRCV : DG1 Out (35) DCWP12
- DCWP22
- OGIRCV
- OG2RCV
- OPRCV : DG1 OG2 Out
,(44) DCWP12
- DWCP22
- DCWP12RCV
- DCWP22RCV
- OPRCV DG1
- OG2 Out No Normal Pump Cooling The reduced sequences and corresponding algebraic expressions are provided below.
- 1. OG1 Out DG1
- OGIRCV
- OPRCV DCWP12
- DCWP22
- OGIRCV
- OPRCV or DG1RCV
- OPRCV (DG1 + DCWP12
- DCWP22)
- 2. OG2 Out GG2
- OG2RCV
- OPRCV DCWP12
- DCWP22
- DG2RCV
- OPRCV Page 368 of 453
or DG2RCV
- DPRCV (DG2 + DCWP12 ' DCWP22)
- 3. DG1 DG2 Out DG1
- DG2
- DG1RCV
- DG2RCV OPRCV DCWP12 ' DCWP22
- DG1RCV ' DG2RCV
- OPRCV or (DG1
- DG2 + DCWP12
- DCWP22) DG1RCV ' DG2RCV OPRCV
- 4. DG1
- DG2 Out, No Normal Pump Cooling DCWP12
- DCWP22 ' DCWP12RCV
- DCWP22RCV ' OPRCV Summary
- 1. 1 DG Out .
2 2 DGRCV
- OPRCV (DG + (DCWP) )
- 2. 2 DGS Out 2 2 2
[(DG) + (DCWP) ] (DGRCV) OPRCV
- 3. Both DGs Out, No Normal Pump Cooling 2 2 (DCWP) * (DCWPRCV)
- OPRCV If both DCWPs have failed, the DGs should trip on high temperature. Recovery of the DGs following recovery of a DCWP does not require DG repair; thus, the recovery probability should be significantly higher than the recovery proba-bility of a failed DG. One should note that, should an SI signal be present, the DGs will not trip on high temperature. In that case, it should be assumed the diesels would be damaged and therefore unreccverable. However, for the initiating events considered in this study, no SI signal is expected. Hence, recoverable failure of the DGs is a reasonable expectation.
To facilitate quantification, the DCWP contribution to the first two equations was eliminated. This approach could result in a small degree of optimism in the results. Since no credit is taken for DG or DCWP recovery in the baseline analyses, this approach does not impact the results. O Page 369 of 453
. _ _ _ _ _ . _ _ _ _ . . - ._ .. . . . - . . - _ _ _ _ _ .. . . . - _ . .. = _ . . . ~ . _
I l l I The support state equations used are the following: l'- p'V-- i
- 1. 1 DG Out 2 DG
- OPRCV Diesel generator recovery is only considered for demand failures and '
is treated as a sensitivity by changing the demand failure rate. 1
- 2. 2 DGs Out
_2 DG
- OPRCV Recovery is treated as a sensitivity by changing the DG demand failure ,
rate.
- 3. Both DGs Out, No Normal Pump Cooling 2
(DCWP)
- OPRCV I
Recovery is treated as a sensitivity by changing the DCWP demand failure rate. E O l i t I , 4 i h i a i Page 370 of 453
.. , _ . . _ . _ - _ _ _ . _ . . , . . _ _ _ , _ . . . - _ , . _ _ _ . . _ . . ~ . _ _ _ . , _ _ _ . _ _ _ _ _ - . _ - . _ _ - . , - . - _ - . _ - _
3.0 0FFSITE POWER RECOVERY INFORMATION NSAC/80 was used to estimate the probability of recovery of offsite power. Figure 2-1 of this report was used to develop Table F-3. The recovery information in this table is representative of industry average characteristics. It is difficult to determine its applicability to the Prairie Island site. There is, however, evidence that this industry average information is reasonable since the only loss-of-offsite power at PI lasted about I hour. (This single event is not a classical loss-of-offsite power as typically viewed in PRA analyses since it occurred about 1 hour after shutdown. A loss at that time is much less consequential than a loss when the plant is operating at full power.) The most uncertain aspects of the NSAC/80 information involve NSP grid variables and weather induced events. Table F-3 indicates that the yearly frequency of an event
~3 that results in a loss-of- offsite power greater than 8 hours is less than 10 .
As an industry average value (i.e., per site year), this is representative; the corresponding value for a specific plant cannot be determined without examining the grid, the weather-related design bases for this grid, and weather characteristics. It is typical to design a grid for the 100 year storm, implying that major damage will not occur at a frequency exceeding 10-2/ year. Determining if inherent safety factors and grid layout are such that major damage will not be sufficient to fail all power supplies to a plant for an extended period (days) with a frequency less than 10-3/ year is beyond the scope of this analysis. . Because this study is aimed at determining the reliability characteristics of the AFW system, it is not appropriate to examine this area in detail. Table F-3 values will be used as follows. The sensitivity to other assumptions can be determined if needed at some future time. The values shown in column 3 of Table F-3 will be used between 0 and 8 Fours. The conditional likelihood of an event lasting longer than 8 hours will be assumed to decrease linearly from .01 at 8 hours to 0.0 at 24 hours. 4.0 RESULTS PRESENTATION Table F-4 is used to describe the method used to determine the time dependent characteristics of AFW system reliability. The following information is provided. J. Column 1 specifies the status of the support systems (e.g., O signi-fies that one DG has failed).
- 2. Column 2 shows the AFW system cut-sets for this support state.
M = Motor Driven Pump T = Turbine Driven Pump MC = Cross-Connect Pump TSQ = T*T The terms CON 1, CON 2, etc., are variables used to modify the value of these cut-sets when used for the single unit analysis (some cut-sets are not applicable). Page 371 of 453
- 3. Column 3 indicates the time interval for the calculation.
The quantification of these sequences was performed by dividing the 24 hour period into 12 intervals so that the effects of time dependent failures and change in recovery probability could be determined.
- 4. Column 4 shows the assumed time of failure (midpoint) between each interval.
- 5. Column 5 provides the failure probability for the support state cut-set.
- 6. Column 6 provides the AFW system cut-set values and the sum of these cut-sets. The common terms (2LM, 2LT, and 2LO) are included quantita-tively as appropriate.
- 7. Column 7 is the total probability of failing the AFW system (Column 5
- 6).
- 8. Column 8 provides the probability of failing AFW between the end of the last interval and the end of the current interval.
- 9. Column 9 provides the time available to restore offsite power. Table F-5 summarizes the calculations performed to develop this information.
The first column in Table F-5 corresponds to column 4 of Table F-4.'
'The time to SG dryout (Column 2 of Table F-5) was developed from the v transient analysis work described in Appendix C. The Appendix C analysis did not consider the change in time available for losses of AFW beyond 3 hours. It has been conservatively assumed that the time available does not increase beyond 2.3 hours.
Column 3 of Table F-5 is the sum of columns 1 and 2. Column 4 was developed by comparing these times to Table F-3. Column 10 of Table F-4 presents this information also.
- 10. Column 11 provides the probability of steam generator dryout for each interval. This equals Column 7
- Column 10.
- 11. Column 12 provides a cumulative sum for the support state.
- 12. Column 13 provides a cumulative sum for all support states.
5.0 ADDITIONAL CONSIDERATIONS Sequences in which one or both DGs fail or are unavailable result in the respective de buses being supplied only from the station batteries until either offsite power is restored or the failed OG(s) is returned to service. The design capacity of each battery is: ,
- 1. Battery 11: 3-4 hours
- 2. Battery 21: 4-6 hours Page 372 of 453
- 3. Battery 12: I hour
- 4. Battery 22: 1-1.5 hours Realistic best-estimate evaluations of the capacity of each battery (including shedding of unnecessary loads) were not performed. It is estimated however that the lower capacity buses have a realistic discharge time of about 3 hours instead of 1-1.5 hours.
Degradation of the de buses impacts two areas of the analysis:
- 1. Instrumentation to monitor APd flow and steam generator level.
- 2. Procedures required to restore offsite power to onsite buse).
Should de power be lost, APd flow to the steam generators should not be significantly affected. The steam inlet valve for the turbine-driven auxiliary feedwater will fail open on loss of de power, thus assuring the motive power source for the turbine-driven pump. Sound powered phones and bsttery-powered (integral batteries for each lighting unit) emergency lighting in the AFW pump room will allow for local manual operation of the turbine-driven pump. There is also local indication of pump discharge pressure and flow. Should the security diesel also fail, the operators will have keys to the AFW pump room at their disposal. The only significant heat load in the AFW pump room will be the turbine-driven AFW pumps. Although the need will be unlikely, the ambient temperature in the AFW pump room could be controlled by opening the AEW pump room doors. Since overfilling of the steam generators, given uncontrolled operation of the turbine-driven AFW pump, is not expected to occur for some time in excess of four hours following the initial loss of feedwater, there should be ample time for local manual control of the APd pumps to be implemented. The turbine governors are strictly mechanical in their operation. Thus, the loss of de should have no effect on the governor control of the turbine. Furthermore, mechanical control of the governor can be accomplished locally and thereby provide one means of controlling steam generator level. Another means of controlling level is by throttling the turbine-driven pump discharge header valves (MV-32238 & MV-32239) with their local manual operators. These valves are accessible and are in the general location of the turbine-driven pump. A final, though relatively unimportant, aid in steam generator level control would be a plot or table of required AFW flow versus time following trip. This would assist the operators in determing the required amount of APd flow for the given condition at the time of the de power loss. In summary, because of the large number of mitigating factors discussed above, degradation of the dc buses is expected to have little impact on the APd system function. Since de control power supplies the motive power for the major breakers required for restoration of onsite power from the offsite power source, there is a potential for the loss of de power to result in the inability to restore onsite power from the offsite source. O Page 373 of 453
l (3 Fortunately, the major breakers that are required to be reclosed in order to b' restore onsite power from offsite power can be operated manually. The procedures for manual operation of these breakers and subsequent restoration of onsite power are contained in the documents implemented for compliance with Appendix R. Consequently, degradation of the dc buses is expected to have only a minor effect on the restoration of onsite power from the offsite source. In terms of the overall AFV system reliability analysis, the effect is judged to be insignificant. 6.0 AFW SYSTEM CUT-SET ELEMENT VALUES The value of each cut-set element was developed by comoining the values for the basic events included in the simplified fault tree used as the foundation for the common cause failure analysis. The block diagram used to develop this simplified fault tree is shown in Figure F-2. Table F-6 provides the values for each of the blocks of this diagram. Based on the results of the evaluation of the detailed fault tree, it was determined that the key components are repre-sented by the individual AFW train blocks. Thus, the following approach was used to develop each AFV system element in the loss-of-offsite power analysis.
- 1. T = C1 + 01 + Il + F1
= 3.4
- 10~4 + 5.9
- 10~4 + 2.83 x 10-2 + 3.8
- 10~4
=
2.9
- 10-2(Demand)
= 1.1
- 10~4
- t (Operating)
[] V
- 2. M = C3 + 03 + E2 + F3
= 3.4
- 10~4 + 5.9
- 10~4 + 1.4
- 10~3 + 3.8
- 10~4
= 2.7
- 10-3 (Demand)
= 1.1
- 10~4
- t (Operating)
- 3. MC = C2 + O2 + El + I2 + 13 + F2
= 3.5
- 10~4 + 5.9
- 10~4 + 1.4
- 10-3 + 2.4 x 10-2 + .014
~4
+ 3.8 x 10
= 4.1
- 10-2 (Demand) 1.1
- 10~4, 3 (Operating)
The value for 12 does not include the " Availability of Pump 21" term because if both units are operating prior to a loss-uf-offsite power initiating event, both motor-driven pumps should be available. Typical on-line maintenance and test availabilities are included in the El term. O) i V Page 374 of 453
L = I6 4.
= 7.2
- 10 -4 There is no value provided for the term "S" (Use of CSTs to provide AFW pump cooling) in Table F-6. This cooling source was not credited in the common cause analysis because it is not significant for a loss of main feedwater event. The value assigned to this element is dominated by human error. Based on the human reliability analysis, a value of .2_5 is used for the present plant situation.
Changes in this value were investigated as part of the candidate modification identification and evaluation analysis. 7.0 SUPPORT SYSTEM ELEMENT VALUES The total average demand failure rate for a diesel general was calculated to be 3.2E-03. The operating failure rate was calculated to be 2.2E-03 per hour. The average unavailability due to maintenance was calculated to be 1.3E-02. There-fore, the value for D is the following D = 3.2
- 10-3 + 1.3
- 10-2 = 1.6
- 10-2 (Demand)
= 2.2
- 10-3
- t (Operating)
The total average demard failure rate for a diesel cooling water pump was calculated to be 8.4E-03; the operating failure rate 1.6E-03. The average unavailability due to maintenance was calculated to be 1.7E-03. - C = 8.4
- 10-3 + 1.7
- 10-3 = 1.0
- 10-2 (Demand)
= 1.6
- 10-3
- t (Operating) 8.0 RESULTS DISCUSSION As was the case for the single unit analysis, the contribution from MS-22-2 that dominated the loss of main feedwater analysis is assumed to be eliminated by a change in system design (e.g., piped into the turbine exhaust as with other steam leakoffs in the vicinity of MS-22-2). Support system failures are assumed to be dominated by diesel generator failures, diesel-driven cooling water pump failures and failure of the operators to align the cooling water supply for the given AFW pump to the Condensate Storage Tanks (:~ 7s).
The first set of values presented below include tre probability of AP4/ Support System failure ag nonrecovery of offsite power before steam generator dryout. No credit for recovery of a failed diesel generator or diesel cooling water pump is given. The sensitivity of the results to each of these is then described. Support Stato 1: Both Diesel Generators Operate 2TMMC + 2MT2 = 2.1 E-05 (0)
= 2.1 E-05 (D plus 24h)
The key contributor is 2MT2, in which either motor-driven pump P12 or P21 fails and both turbine driven pumps, Pil and P22, fail, about 80". of the 2.1 E-05 value. Failure on demand dominates this support state. Page 375 of 453 1 -
(^'* Support State 2: One Diesel Generator Fails 20MT + 2DTM C 2DT2 = 3.1 E-05 (D) e, = 3.9 E-05 (D plus 24h) Demand failures dominate the overall failure probability for this support state also. Each term contributes the following: s 2DMT 3%
/ j 20TM C
67% 20T2 30% I Support Sthte 3: Both Diesel Generators Fail 2DT2 = 5.0 E-06 (D)
= 8.5 E-06 (D plus 24h)
Demand failures contribute approximately 59% for this support state. Failures of either turbine-driven pump train, failure probability of 2.9 E-02 per train on demand, causes a complete loss of feedwater to one of the two units. The failure probability of 2 diesel generators on demand was estimated to be 2.6 E-04 (excluding parametric common cause influences); the probability of not recovering off-site power within I hour was calculated to be .34. Support State 4: Both Diesel Cooling Water pumps Fail . (j C2S + 2C2T = 1.0 E-05 (D)
= 1.9 E-05 (0 plus 24h)
Demand and operating failures contribute about equally, 53% and 47% respec-tively, for this support state. If both DCWPs fail, the DGs will be unavailable and the normal cooling supply (Cooling Water System) for the AFW pumps will be unavailable. 'Because the manual action to align the condensate storage tanks (CSTs) to supqly cooling to the AFW pumps is neither proceduralized nor understood by all operations personnel, a high failure probability was assigned to the S term, 0.25. This failure dominates the failure probability of this support state, about 81%. Summary The total demand value for all support states is 6.5E-05; the 24 hour value is 8.7E-05. This does not include the frequency of a loss-of-offsite power initiating event, about .08. The yearly frequency of steam generator dryout as a result of a loss-of-offsite pcwer is:
.08'~* 8.7 E-05 = 7E-6 v ) ,
Page 376 of 453
The analyses documented in NUREG-0611 did not consider recovery of offsite power - or operating failures. So that a valid comparison can be made, these results are summarized below.
= 6.0 E-05, 2 7.
2TMMC + 2 MT2
= 9.1 E-05, 46%
2DMT + 2DTMC + 2DT2 2D2T = 1.5 E-05, 8% C2S + 2C2T = 3.1 E-05, 16% TOTAL = 2.0 E-04 9.0 COMMON CAUSE FAILURES A limited analysis of the impact of common cause failures was conducted as part of the sensitivity studies described in the next section. Available information was reviewed to estimate the potential cegree of DG or DCWP coupling. The common cause analysis of the AFW system components for a loss of main feedwater analysis was not performed for a loss of offsite power event. The analysis described in Appendix E is believed to be sufficient for the two-unit loss of offsite power event. Although the AFV system cut-sets differ between these two initiating events, the results of the Appendix E analysis should not change appreciably. Additional sensitivities can be performed in the future if required. This analysis concentrates on common cause failures of the DGs and DCWPs. As seen in Table F-7, estimates of Beta factors vary from about 1% to 8%. For this study, a possibly conservative value of 7% was used for the demand Beta factor; a value of 0% was used for the operating Beta factor. The model used to quanti-fy the time dependent likelihood of AFW system failure and steam generator dryout was not amenable to use of an operating Beta factor. The 7% value was used to compensate for this limitation. The approximate expression for including common cause failures is provided below. Pp = [(1-S D ) 10+Im * (1-0R ) AR t3
- ODD *O1t RR Diesel Generators 10 = 3.2E-3 (Demand) 1R = 2.2E-3 (Run) ig = 1.3E-2 (Maintenance)
=
P p (t=0) [(1-BD ) AD*IE*OD m 1 0
= [(1 .07)(3.2E-3 + 1.3E-2]2 + (.07)(3.2E-3) = 4.8E-4 Page 377 of 453
f3 'The square root of 4.8E-4 = 2.2E-2. This value was used in the sensitivity - V evaluations described in the next section. Table F-8 compares the results of using this value with a specific use of SD = .05 and SR = .05, as shown by the following equation. 2 P = [(1 .05)(3.2E-3) + 1.3E-2 + (1 05) 2.2E-3(t)] F 2 t
+ (.05)(3.2E-3) + (.05)(2.2E-3)(t)
= [1.6E-2 + 2.1E-3(t)]2 + 1.6E-4 + 1.1E-4(t)
Diesel Cooling Water pumps The saae value for SD was used, 0.07. 10 = 8.4E-3 1R = 1.6E-3 ig = 1.7E-3 2 P (t=0) = [(1 .07)(8.4E-3) + 1.7E-3] F 3 .
+ (.07)(8.4E-3)
=.6.8E-4 The square root of 6.8E-4 = 2.6E-2. This value was used in the sensitivity evaluations described in the next section. Table F-9 compares the results using this value to those using SR"00 = .05.
10.0 SENSITIVITY EVALUATIONS Section 5.4 of the main report described the approach used to identify key uncertain-ties and the sensitivity studies performed to assess their impact on AFW system failure probability. The table from Section 5.4 is repeated here as Table F-10. Table F-11 provides the specific changes to the baseline failure probabilities for each sensitivity evaluation. Note that none of the values reported include consider-ation of the parametrically determined failure probability for the AFW system. upper BOUND Case CASE 2U7 was evaluated to develop an estimate of the upper bound failure probability for the current design / operation situation. Each parameter value is discussed below.
- 1. Turbine-driven pump operating failure rate (Tg ) = 3.2E-3/hr As described in Section 5.2 of the main report, this value is based on 0-failures in 155 hr. The maximum value provided in NUREG/CR-2815 is (m >
1.0E-4/hr. Using a value of 3.2E-3/hr should represent a very conservative upper bound value, even considering the sparse operating information for i the TDAFW pumps at Prairie Island. ' Page 378 of 453
- 2. AFW pump common cooling water supply and return valves (L = 1.0E-3).
This is believed to be a very conservative value because no such failures have been experienced in over 1700 pump starts or 4700 hours of pump operation.
- 3. Common cause failure of both diesel generators modeled by assuming a Beta factor of 0.07 (DD = 2.2E-2).
Common cause failures other than those explicitly included in the fault tree models were not investigated as part of the NUREG-0611 analyses. A Beta factor of 0.07 is not necessarily representative of an upper bound on the possible coupling between the two DGs. Overall, however, because recovery is not credited (and since most failures could be recovered in a short period of time), it is believed to be representative of an upper bound value.
- 4. Common cause failure of both DCWPs (CD = 2.6E-2).
For the same reasons discussed above, this value of the DCWP demand failure rate is believed to be a reasonable upper bound value.
- 5. No credit for use of CSTs to provide cooling to AFW pumps. (S = 1.0).
By making this assumption, failure of both DCWPs results in AFW system failure. Motor-driven AFW pump failure rates and AFW system valve failure rates were not increased. The baseline values are based on extremely strong evidence, 1400 pump starts and 4400 hours of operation. The baselice values are believed to be somewhat conservative. Turbine-driven pump demand failure rates were also not increased for the same reasons. Recovery of the motor-driven or turbine-driven pumps is not credited in this upper bound analysis. As shown in Tables F-10 and F-11, the failure probabilitie for this upper bound case are: 4.4E-4 (Demand plus 24 hours) 9.7E-4 (Damand; no credit for offsite power recovery) If the CCF probability determined in Appendix E is added to each value, the failure probabilities become: 5.1E-4 ((Demand plus 24 hours) 1.0E-3 (Demand; no credit for offsite power recovery) As described earlier, the CCF failure probability is based on a loss cf main feedwater initiating event. As such, it is not directly applicable to a loss of offsite power event. Because recovery of faulted components was not considered, however, it is believed that its direct use for a loss of offsite power initiating event is reasonable. Page 379 of 453
(3 - LOWER BOUND
\ ]
The lower bound estimate was determined by considering recovery of faulted
- components (TDAFW pump, DGs and DCWPs), by using lower bound values for human error rates, and by neglecting parametrically determine CCFs. The failure probabilities determined are:
, 5.0E-6 (Demandplus24 hours) 8.8E-6 (Demand; no credit for offsite power recovery) Best-Estimate The best estimate value is deternined by adding the AFW system common cause value (6.6E-5) to the baseline results described in Section 8.0. 1.5E-4 (Demand plus 24 hours) 2.7E-4 (Demand; no credit for offsite power recovery) If CCF of the DGs and DCWPs is included, these values increase to 2.4E-4 and 6.0E-4. 11.0 IMPACT OF CANDIDATE MODIFICATIONS The sensitivity evaluations provided in Section 10.0 considered the impact of candidate modifications. Table F-12 summarizes these evaluations.
/ \
Common Cause Failures Common cause failures of the AFW pumps can be considered by reviewing the dominant CCF cut sets shown in Table F-13. i
- 1. A1A2 This value is beliesed to be quite conservative for two reasons: 1) human error resulting in inadvertent closure of the two manual valves inside containment was explicitly considered; 2) the only other credible failure modes are disc-shaft separation of the manual valves or failure of two check valves to open which are probably less likely than determined using a Beta factor of .05 with the individual valve failure rates.
Quantifying disc-shaft separation and check valve failing to open faults is difficult. Proper maintenance and inservice inspection should make these events essentially unquantifiable. No such events have occurred in these valve types or operating situations in an AFW system. For this reason, and assuming Prairie Island Staff continue to perform appropriate inservice inspection and maintenance, it will be assumed that t'ie calculated value can be reduced by a factor of 10_ to 2.8E-6.
,0 i /
Page 380 of 453
- 2. 010203 This event, common cause failure of three pumps (excluding their h
drivers), is appropriate for the loss of offsite initiating event. It is possible that it is higher for a loss of offsite power event, but as stated earlier, if recovery is credited, the resultant value is expected to be in this range.
- 3. CIC2C3 and 81828384 For reasons similar to those discussed for AIA2, these cut set values are believed to be very conservative. Their total value of 1.45E-5 can be reduced to 1.45E-6, if PI staff continue to perform appropriate preventive maintenance and inservice inspections to ensure that these valves are not deteriorating.
- 4. The remainder of the terms involve combinations of common cause pump driver failures coupled with an independent failure. Their total value of 8.9E-6 is believed to be appropriate for the loss of offsite power event. The potential non-conservatism of not addressing the additional pump train cut sets is offset by the conservation included in the II, 12 and I3 terms.
In summary, a reasonable CCF probability for the situation in which PI staff confirm valve integrity is the following: PCCF = 6.6E-5 &
- 2.8E-5 W
- 8.5E-6
- 6.0E-6
+ 2.8E-6
+ 8.5E-7
+ 6.0E-7
= 2.8E-5 Best Estimate With AFW System CCFs The best estimate value is:
8.7E-6 + 2.8E-5 = 3.7E-5 (Demand plus 24 hr) 1.8E-5 + 2.8E-5 = 4.6E-5 (Demand; no credit for offsite power recovery) Upper Bound With AFW System CCFs This value is determined using CASE 2023 results 1.6E-4 + 2.8E-5 = 1.9E-4 (Demand plus 24 hr) 3.2E-4 + 2.8E-5 = 3.5E-4 (Demand; no credit for of f site power recovery) Using Case CASE 2V24 would reduce these results somewhat. O Page 381 of 453
U :
- y. . i i- ,
4 ,
~
i , l
- ).D l
- t. .__
C- -
' Lower Bound :
y.. 1 j~ ~ ' ~ Case CASE 2U21 adequately represent this: situation ! L 5.0E-6 (Demand plus 24 hr) l t '8.8E-6 (Demand; nc credit for offsite power recovery)- ! l-i.i
- i-1-
i~ 4-I g. c i *
- i. - .,
- v. ;
e .< ;) ? , i. L. . 1
- b
$: .I
- L i '>
g. e l 4 -: r 'i i
- j. (
3 I i F- : !' i t i l" ! 4. f I 4 e : ! -l r- 3 1 : k i t. i l- Page 382 of-453 I r
TABLE F-1 XEY CUT-SETS (PUMP RELATED) INDEPENDENT COMMON PT2
- M
- FT2X EGDR
- M PTf
- PT2
- F2TX CDDTT
- PTZ PTf
- PT2
- F2T C60U
- P'22 PTT
- F22
- PTE CDDR
- PTT DT2
- PT2
- PTI N/A DT2
- PTT
- PTfX DTI
- EUD U D52
- FTf
- PT2 N/A UGT
- PT2
- PT2X UGT
- MOR DUT
- PTT
- PT2 N/A DTI
- FTI
- PT2 N/A DTf
- DT2
- P72 N/A l DTf
- DGE
- PTT N/A DTQFf2
- DCWP22
- CSTC00L N/A DCWP12
- DCWP22
- PT2 N/A DCWP12
- DCWP22
- PIT N/A l
CSTC00L = Failure to Supply Pump Cooling using CST C00L2 = Failure of Pump Cooling to P22 and P12 (Comon Piping) l MOU = Failure of Pump Cooling to Pil and P21 (Comon Piping) O Page 383 of 453
l (' TABLE F-1 (continued) i Fil = Pump 22 Train Failure ' FYI = Pump 21 Train Failure P12X- = Failure Of Pump 12 Train When Used to Supply Flow to Unit 2 PIT = Pump 11 Train Failure Pil = Pump 12 Train Failure P21X = Failure of Pump 21 Train When Used to Supply Flow to Unit 1 DEI = Failure of DG1 D52 = Failure of DG2 OCWP12 = Failure of Diesel Cooling Water Pump 12 DCWP22 = Failure of Diesel Cooling Water Pump 22 E O l f Page 384 of 453 n-- ,
,4 , . _ . , , _ . . _-, -.-,,, ,- ,,,.-..,._.,_,.-_._m... -e - , , . , - , - - .- -- . . ~ , . - , - - ~.-- , ,e+-
TABLE F-2 SIMPLIFIED EXPRESSIONS INDEPENDENT COMMON 2TMM 2LM C 2 2T M 2LT 2DMT -- 2DTM D C 2 2DT ,, 2 2D T -- 2 C3 ,, 2 2C T -- O T = Turbine-Driven Pump l M = Motor-Driven Pump D = Diesel Generator l C = Diesel Cooling Water Pump l S = CST Backup Cooling l L = Common Pump Cooling MC = Cross-Connect Motor-Driven Pump I O Page 385 of 453
TABLE F-3
. LOSS OF OFFSITE POWER RECOVERY TIME EXCEEDANCE EXCEEDANCE FREQUENCY /
(HOURS) FREQUENCY EXCEEDANCE FREQUENCY (t=0) 0 .088 1
.5 .047 .53 . 1.0 .030 .34 3
1.5 .021 .24 2.0 .017 .19 2.5 .014 .16 ! 3.0 .011 .13
~3.5 .010 .11
. 4.0 .008 .09 4.5 .007 .08
- 5.0 .006 .07
- 1. 5.5 .005 .06 6.0 .004 .05 7.0 .003 .03 8.0 .001 .01 9.0 0.0 ---
i. O ) i t i i d i i b I I !O !: Page 386 of 453 }
\ , . , . , _ , . , - , . , + . . _ . . . , , . - . _ . _ , _ , , _ _ _ - _ . , , . - _ _ . _ _ . _ . _ _ _ , . _ _ _ _ . . _ _ - - . _ - , , _ _ . . _ _ . , _ - - . - . _ _ . _ _ _ . _ - - . . _ - - . _ _ _
TABLE F-4 RESULTS PRESENTATION
. . uu .. . ;
O
.u. .un....u.. uunune.. . .uu u...u u .u. . ...u . .u. .uu. uu.a u nuouu
- . .u I I $ 6 9 1 88 1 la t il ! 13 II 4 1 2 1 I I 4 I $ . 6 I It
.6 t . Pe?,6A4. t &# OF t tJe p 8.
' re 1 11Mi t a12P&tst t $pDel 1 are I t&tas ! Intle.46 :tLi'>st!Qs. Pet 6A6. I . 3pp 3sf Serta t litfts t f.lgt i p s!6 JPt i IInt I a f y i M3f f u .t
- 1. Billt' I lis'te t tatui46 t P8;*.s. 4 P.co.6. I a.attatJ t 341 : l't ap t l'5fta t ldP3Bt t 11 (41 M11 I hl Mil . I i*3*t1 84tM 8 f *I.WM P43e.t. t t t KIMatan; Maltsf 3h t Stolt t st1'ta Il t 8*3 1 8 Pt.nas. 8 t 8 4 2 1 1 8 al e el t t taCJ18 i SITh.S I htQgt t 8 t lT8I($ it 1 1
! Istilakeitant 8 8 s'8B 18 1 seMt. t t . !
I . 8 1848 8 8814f1 si t (Ca. 8D :CWesilsest! 1 I t 4.edhlt t 6 8 4
....u.
4
.uu .u. u.u.ue - uu. . u u.
.. u.u.u u un usu....u u uu 35 8
. s t t 8.2 41 1 6 8 8 8 8
.6 .
i sia 1 - 1 4.7I en t 6.M-#5 I s. 4 I I 3.34 1 3.1t 93 t 1. 18 1. t 6.7t-f5 11 - t *TerC 1 3 I I e I 1 3 . t I 6 it
.. . 3 tid s I I at
- I 8 6. M
- d3 1 I I I I 6
. 8 Cad 5 I t t I 1.M f. 6 I I 1 1 1 18 .6 8 C3a.
e 8*I ! 6.5 t - t 4. K-ti . 6.tt-n : I.d-47 8 8.8 s.28 n.E-et i *.1145 t 7.X 45 11
- 6. 8 88 I 2 1 1 --t i t 8 8 4 I 6.11-95 8 8 I I I I I 18
.3 I 1 *
.1
.8 8 I 1. 48 1. 3 I I I I t i 18
- 1. t 1 s it I t.d se 1 2.tt n 1 F.7tt tt 1; I . #- 1 1.5 3
- t 4.E 83 1 6.3 f. t 4.7147 1 1.1 3 1 -~ I t t 8 : 8 8 88 .. t # #
I I I !!
.; 3 I I I t 6.3 *fS 6 8 8
.e 6 61 3.*(s51
.
- 8
. 1 8 1 .
4 6 a.2 et e.7 e. 04 3 7.E et ; 2.1[ ft t 1.9tE 11 1 6 6- I t 1.3 1 - I 4.M41 . 4.M -67 1 4 t 1 : 8 I ! !! 4 6 . I t 6.M 41 8 L t I t i e !! I 8.M4 6 4 I I i 1 6 11
- t t .
- . 4.M-e5 t 6.4E-n 1 8.M 47 i S8 8 0.2 8 4.4f 94 2. tt-93 1 5. ti f. 1
- 6. 6 8 e-4 1 3.1 1 8 8 t it
.? I t ! # 1 8 8 8 i s.4E4 8 1 8 t t 1 11
- t t 8 8 8 4
i e I 4 8 18
;; 6 & 8 i i 8.M-d 1 1 6 I 8*3 8 4.1 1 - . 4.M n 1 6.M 4 8 8.9t-07 8 6. 4 1 0.91 1 2.71 -04 1 2.11 81 ! 8.3 41 !!
.3 1 I t et 3 I I I ; I 6 3
! I t i I I 1r 6 . 8 . t 6.M -fi t t t 18 8 4.elt t t t .
( l
. 1 5.5 - 1.d el 8 a.d n f.K -4 7 1 fI a et t 9.W -#9 1 2.11 81 8 9.M43 13 1 . #- a 1 1 t i l . t 1 1 I 1 .
I t ! 6.ef-ft i 6 .
, . . - - -; t a 6
! I t ! I 18 i ! i . t..! r. I e-1 1 6.5 t - 1 5.M-85 1 6.71 1. I t.E 11 ! 88 1 f. sets t 8.X -89 I 2.st-ti i 8.M-f5 ti tt .
I t 6 I t 16
? I I I e 6.71 di 8 8 1 I t !!
18 I 4 8 8 . t a !!
. I t e 1.'t 93 . I I 1 8 1 1 66 1 4-t I 3.1 t - 6 1.1E-st t e art i 9.18 -17 I t.I i 8.N E4 1 f.K f9 8 2.1141 3 4.4t45 .6 t; 1 1 8 8 8 1 8 t i it 8 1 1 I a. M t
- 1 1 6 I e a 6 t 6 6 n
6 1 8 8 8 1 It
. I 8 4 8. *E 4* #
8.5 - e 5.11 8! ! 6.4141
- 9.3P 6 18.8 1 8.8881 1 7 M 89 8 1.11-81 8 8 4tf. 6.
.. I ! 6-9 1 1 6 8 I 8 !!
1 1 6 4
. . t i ! I s.
;t . t t 6.E-63 8 I 1 .
.
- 8 ft
- I 4 8 8 8.M et .
4
. I 8 t 3.ti-ei
- 6.91 ft I t.3 67 ! 11.3 I e es?. I 7. H.e9 6 :.it.e5 ; s.4(.e5 6
, . 6 - to I f.S 4 ft 1 6 ~~--1 ! 1 ! 1 4 1 1
,6 e.M ft '
t 1 I 6 !! 6 4 I I . I ! 18 1 1 3 6 2.M 85 t i t t 1
.6 6
-
- 3.81-65 a 8. M 4 & t.44 1 19.3 8 8.M19 8 4.M 94 1 2.1141 18.7t 85 18
- . t 9 - 24 : 88 s
! I I 8 1 It 8 8 8 8 .
.. 8 1 8 1 S. 2 -41 6 8 I t ! 1 !!
# 1 8 .
it . . . . . . . . - O Page 387 of 453
TABLE F-4 (conte) RESULTS PRESENTATION l
; g,nessessee eesueessess.seee seeeeeee.coneees.eeeeee.sesso..see.se.eeeeesenessee.eeeeeeeeeeeeeee.eeeeee.sesesses.eeeeeeeeeeeeeeeeeeeees.eeeeee.eeeeeef t k tt 6 8 2 8 3 I 4 1 5 8 4 I I I $ 1 9 8 18 8 la t I: I 13 it
;g .. I . ; t -- -; - , ! . . t -l .;t 4, 5#P31 3 ar e 8 flE I slWStaf I kPult t 46 e i 13!at t tette.at IKitzalth. Pe;446. I MJH&.I MW I MN 18 114 y W t mms t i ett
!! St.the t liitte ! tarts.et t '
tt$tte t 5,$tta 1 f alsvat t f al6 tat 1 3 it C.I stil I Cui Mll ! 8 3*3*II t&!LM t faldt t Plasal. t Patnes. 8 a.a ate stt t act 8 litna 1 li$tta t M.pt !! It ! I 8*3 I -I W.446. 4 FtCW4. ! 6 e t M10stf 84: $DO&te! Sta!! I lin!!e 5. t t 2 1 It t er I t ueM5e i ettsie I gavowl I e I sta!!S II It
;t ! I .seball 8 L : I IKitesitDI I t if G5 18
. I t I enGJets t . 1 I I t itK t el!&!! se t ECL. til 1:3veella 86
. uu. e.neuseuse ese es ennuwensen.euune.unnusese.neau ennu.senannousunnuunese.nu.euse .ne.ne.neen.uon 18 . I t i
- 2.8(-e4 I I & . I I I It t t 8 I + 1. 5 43 8 t 1 I I t it st 8 : et t 8 I 54 I 8.fie 6 1.M 83 8 9.tE4 I tie I I 4.34 . 3.18-91 2 3.! tit ! 6.7t 95 !!
- a. + Ifpl I 8 I t ! . I I I i 18 t *N 1 t t 3.M-93 I t t t t t t !!
1 11 t Laat t t t ' 2.et 44 8 t I e : I I 18
.I C.A* 1 1 ! I L K 4* 1 . ! t I t 8 18
.e 8 Lhi t 4 t t 8.3 I f.til . 1. M-d3 1 8.8E H I l. 2 61 & l.8 8 8. *! ! 2.K 4e t 3. 4t -f". I7.X-M !!
It t t t 8 8 8 I I I 3 & I !! I; I I I I I S.M d* ! 6 8 8 I I 4 it
~ 88 It 1
;8 : 1 : I I 1.11-84 1 I I I I & 18 18 t t I I I 3.lf-43 I I I 8 8 8 t 18
- 1 I 8*3 3 8.3 8 f.8:8 8 8.7E4: I 1.34e 1 8.X-85 8 3.1 8 8.88 8 8.M4e i LM-85 5 7.?te it It I 1 8 I I I 8 I 8 3 3 83
- 3. 3 I I I t 1.K d3 3 8 8 I I 8 8 81 it
!! I
!! t I I I I 2. 3 -84 I I I t i I I 88 11 8 I I e L 9t-8; 1 I 1 _ t t t I 11
!! ! I83 3 2.3 3 8.83 1 8.7843 8 1.2 44 8 1.24 8 4.7 8 8.04 2 1.144e t 1.d 45 I ?.9t-f3 et
- e. I t t i 1 I i 1 I I I 1 l' . 4 1 I t 1.K -f; I I ! t : 8 I 88
. I 6 . I I 8 2.M-64 8 8 8 8 8 8 I !!
1 L 3.M-8 3 8 8 8 8 8 8 8 88
.: 1 i e.4 : L5 I 8.C 8 8.M 88 . l.4(44 3 1.4( M I 3.8 0.8% ? 6.K -87 8 3.M 41 ; 4.3t-81 It t I I . 1 I 1 1 ! 13 I I I t
/ h
\
?; I I
. I 1 . 3.M-43 I I
~
is
) .
d .. I t 1 I
- 2.24e t : 8 8 f it
.. t 1 8 i t 3.M 83
- t
- t t i ! et
.' I 8 8-5 8 4.5 3 8.f;7 1 8.71-83 8.d44 I t.att ! .3 a.e3 3 4.lt-ev I LM-es I s.3-e. tt
.' 1 : 1 I f . 8 2 8 8 . It
. 8 I I I 1 1.*t43 ? 8 3 8 1 3 !!
+i
. t I I I t 2.e(44 . t t t t . I tt
.. t 1 8 8 1 3. 4-83 1 1 1 8 I I I !!
1 18 6 5 1.5 8 f. f ?' I l.K-88 8 1.M 44 : 1.4L-f1 8 7.8 8 8.01 I t.4E-97 1 3.K-81 18.3-f". !!
- 3. i 8 I 2 8 1 I I I I ! II
.* I I I 8 S.M-8I I ! I 1 I I . It 18
- t. I 88 I I I I I :.3(4e t g I 8 . It t . I i : 3.M-d 1 : I I I I t !!
1* 3 8 f. F 4.3 . s.838 8 4.K-83 I l.M de t 3.at-#1 I s.3 I s.se*4 8 8.R.07 8 3.K 45 1 8.M -01
- I 3 8 I I I I I I 8 i 8 8 is 81 8 t . 8 8 1. 4 -48 I t 8 8 8 t I !!
--** .i
.. 1
' . . I ! 8 ..d ee 6 8 8 8 8 8 it
. I 1 8 8 8 3.41 % ! 4 1 1 8 I 83
.. 8 Ie-0 t 7.5 8 f.8 4 I a.4s-83 . 2.st e4 . 8.*(-95 8 9. I
- f.edil I l.2 if I 3.st et t 4. 4(-95 8.
14 3 I t i a t i 1 ! t & !!
.; . I I t s.e(E 4 I t !
8 I: tt
. t . I 1 + 2.et 64 : ! I t t 8 .!
- ! 1 1 1 . ! 4. et - e t 8 6 I
! I !;
1; . I 6= 1 8 8.5 . f. f *4 8.Id f 3 2. 3 -04 1.et 93 4 10.8 8 f. set! I t.3-47 .K r5 8 8.e(4) 18 e . 4 8 8 6 8 6 e i t t t !! I I 8 8 . I 4.4643 I I 8 8 8 I t! si 1 1; a I i 1 2 2.M-es I t t 8 : g it 1; 8 I i 1 4.8C-f t ! 4 : 8 I . 8 !! It 1 1 0 . to I t.5 1 0.8;8 8 8.8(-83 t 2.X-64 6 1.M 45 t 31.0 i f.ed's a t.it4? I 3. M -#1 ! 3.at.61 it
.; I 8 8 8 1 1 I t 8 8 1 11 45 8 8 i I t 6. tl-f 3 3 4 ! ! I i 1 !!
.4 8
.6 I i 1 8 I 3.K44 8 I I I I I 88 e 4.:141 8 I I I at pq !!
4. t I 1 i 8 24 I 8 II 8 I f.est 8 2.st f; I 4.Y H t !.3 44 3 39.3 8 8 8 I g.ssit i 6.*187 1 3.W 45 8 M-f3 It kj) t! I I I I I --t I t i ! I i 1I I i i 8 ..dm I 8 i i ! i II. n..e.eeee ..u.se.se. e.e e. es es.o ..es.. e..eeee. ....u.e..so s.o.e.e..e.e.....see ...es.o.e..ee.. ... ..o._. . . Page 388 of 453
=-_
TABLE F-4 (cont.) RESULTS PRESENTATION O n...a...........-................m...................................................:
. I 1 . . 3 i . . i 4 . , , t I . I ie i n . i: I n n i .- . -- t . t.---------i , i .8
. w... . . n= i .mm t semi . .. t tot i mt. asteina. nau. I na.i. . i-. I ww n
. 1: Lite St5'te ! Is!L&.A I t les:!' t liitto I f a t.ig fattet a tint a y a y I W71 : At i.
48 Egi $tli 8 Ett uit . t 3*3.ti f als#! I fat.Uhl 1 Pt.,64t . 8 PtJ at. I 6 61L&8.18 a;1 4 litte ! IllitR 3&#fp1 It Et8 antes; at.W); $1< I lettis 6'
. I t 83 8 8 ni.e-4. i 9% 6. I 1 e 3%* ;
i 2 . . 4 al o ts t t teodne g sit.ls t I 1 glatts tg
.. 4 6 these i ! I t ! IEt1 Eat F 1 8 eft It t 4 I tutchit a . I 4 4 1 tint i t81611 si ! (CA. Its it7tef tl>*t.
. . . . . . . . . . . - . - . . ~ . . . . . - . . . - . . - . ~ . ~ ~ . . ~ ~ . - . ~ . - -
. 8 I I I :.1!-91 t . I t a ..
- 3. Chi i t I t ts e 1 8.Si-94 8 1.0t-9: 8 3.st ft I t< a I I I 0.34 8 8.04 4 6 8.ti-d; I 4.7Et si
- 4. ' ;1 3 1 1 e ; I I t ! I 8 88 6 . 1 8 8 6 3.iE4i & 1 8 f I t i It
!. t .1 la 4 Ch4 I I 1 8 2.M -8 8 8 8 8 8 8 I 11 8; 4 8 da i I 8.5 I 8.3t 94 3 1.af t t e.11-f1 2 8.tt45 3 8.8 8 8.21 8 2.5 ee I t.XE I ?.3tt is
'; I I I I I --I I 1 1 I I It it t i I I i Lit 46 I t i I I I I ti 18 8 at 6; 1 8 t . . 1.M-64 8 I 6 1 8 !!
. . 5- 2 8 8.3 1 1.71 04 a 1.01-8; i 1.4t 0; I t.H4 8 3.3 I 8. I t t 3.R 8. t 8.41 45 t 7.7t45 18
. I t t t t 6 I t i I 11
, a 1 8 . . 3. 81 4 . t . I 4 8 e ! 81 11 . it 8 e 6 1 . 3.X 4. 8 & I 1 : I I n
.. t 8 8- 3 a 1.1 ! ;.3-04 i S.M s; I s.M-fi t I.atit 6 4.7 a f.si ! 8.it fe ! 8.50 8 F.ft -il II
- 4. . e 8 2 6 t 1 i 8 8 8 8 il
- 6. t . 8 I . 3.it 48 I I . !
- 8 I tt
- it
- 4. 6
. I 1 I I 2.St et . I t t t I It 6 a s-e ! L3 6 2.7t - 64 t 1.'i 8; . 4.3a si I t.X 4: . 1.4 1 6.01 8 7.M 47 8 8.M 83 8 8.tt-f It
; 8 . I i . I ! I 1 8 8 !!
8 s I 3.!!-01 8 8 & 8 I t 1 18
+
. 4 ! I t
- X di t
. ! I 1 1 4 I !!
. 4 ae1 I 4.1 g 3.3 44 '
5.M-e: 1. A 64 8 8.71 81 3 6.8 1 00: 1 S.81-f ? I t.at 45 18.3 4 .+
; t t ! I t 1 8 i s t .!
! ? . ! I e L il41 ! ! I t 8 !!
. t . t I ;.M -e t I ! . ! 8 8 8 81 6 1 0* e 1.3 1 3.0. 4e . 09t t 1.21 se 4 3.91-#*. t 7.8 8 0.84 8 8. M -t ' I t.71-e3 8 3.N45 .!
. 1 6 I + 4 8 8 3 1 8 t l'
. ! 8 Lil 93 : ! I t ! 68
. 6 .4 1 6 1 1 1.M d. . . t . 6 3 !!
. . . #* 1 ! a.1 1 4.M-84 8 a. fi- f 8 8.4144 8 2.6t t I t.8 t 0. pe t e 1.9t 97 6 8.?t 45 38.2 % !!
, t '
1 i ! ! e I . ! . 83
. 3 . I 8 I E!! f t t 8 8 1 1 ft t! ! I I I 1 !.M -91 I I '
4 1 1 II at . I e8 I !.3 1 1. 3 04 6.8t 6: 4 8.g.se t ;.g.eg I g.g ! g.se; I 9t.g. 8,71.g: I g.st.g: gt t s t i I t I ! ! . I t !! g, t I t I i 1.16 -91 t ! ? ! I t t it f. I i ! ! . 1.1811 1 1 4 6 . I et i 1 0- 9 8 1.3 1 6 fi-f 4 6.8it s.E 84 8 2.61 81 18.4 8 8.88!; t I.M 87 . s.71 80 t 4. 08 -f; ; I . I e ! s a . 'a
.
- i . 1. II-s i . I 1 + t st
- 1 1 ; I 3 . 2.it 8. 4 . 1 I ! t I t.
- 6. . I e - ad I f.3 I a.8(44 I a. 8! 8.- 4 .8144 8 2.ME 1 11.8 i f.9f ?s I 1.ft-8? 6 8.7t 4; I 8.41-95 18
. 6 6 ! & ~ ~- e ! I i 1 4 6 18
. a . I i 1 3.t( 91 4 3 I t ! 18 8; t ..
. t 6 1 1.M 01 8 + 8 ! ! I t 8'
; 6 1 #
- 24 8 If a 2.X 83 8 6.2 f; I 7.X #4 8 1.3-#4 19.3 a 0.00'9 1 8.M se, I t.9t s) 13.44 1.
18 ! : 8 . t I 1 I i ! ! 18 n 1 : ! I L Lit 4: 1 8 8 8 i t ! n n.......-~.........-.--..~.-.........-~..~.~.~.............................t8 O Page 389 of 453
TABLE F-4 (cont.)
-s '-
RESULTS PRESENTATION - l t s v t .
.. m -. . 88 38 3 3 2 3 1 4 I $ 8 4 1 7 8 8 1 9 I 88 8 18 8 12 1 13 88 . !! . t .
t ! . I t ! It
.3 pf Get ! Fe 1 134 8 813P& Int t 5#F981 1 Fe I 15 % ! tatti.A !El!pattik: pe06a6. I pahaa. I tye 3F I go gr 88
- 2. Silt' s Irltta 1 thiinsA I L lilite I testto I f astsat t FatWI I Ilmi i p I W t p*W1 3 41 !!
Il C.1 bill 1.1 Eli i t IeIe3 f at.*I f.I41 1 Pea.J. I Ph 44. 8 mal 668'I . I Et I litar t let'in I appt 11
.. t + 0** t ! Pt464. . pg 4. ! t t ! CMalk. N IL *&'Oh : Start t 3Y3fta 88
. .
- I 2 I t ! it e e ! . teve ! e.te te I tees.i 8 a 1 Ita!!l it t i senw. 3 8 t i ! t IEl!G.e'lk 8 8 ff ar 88
. I 3 5 sWie I ! ! ! I I t I t e. I 18 Mt al 8 eCA. IID IIDrapIWests
. ..unw. u .=. .um. = =.m. .... n um. um m u.a* ..u n mm an mu m.m
. sit e 21 5 6 I t -8 8 2.d 44 s 1.tF 0; I t.M *f*. e t& I 8 8 0.34
- 1.M 44 i Lii-es t 4.?t-f! t' et 8 .+
.. I CW . 6- I t 8.3 4 3.X -**
- 1.k #; . 3.ti-f'. 8 8.41 4 . t 8.8 8 8.23 8 9. 3i -8 ' I 6. M -4. 8 7.M-d! It
!! ! 38 t ! I e.2 4 8.5 8 4. 3 -64 8 1.E-8; I :.st < . i.et se 1 3.1 . 8.88 1 1.X 4- t 6.tt-ss t 7.nf. !!
[h g. t .
. 6,
.j +
. 8 i e.3 2 .3 8 3.!E-94 t 1.91-d 8 3.ses! I 1.d4. 4 4.7 1 0.85 1 4.N -87 8 f.M-66 i F.M45 !!
- 8. . 8.
*4 4 8 8-4 8 3.1 1 6.344 1 1.lt-e: I 3.6t t. 6 4.E4s 8 3.4 8 a si t 3. It-d ' I 7. 2 -66 3 8. tit .8
. ! It
. t e*3 1 4.5 t F.38 es i 1. M -d. a 4.h 41 I e.9142 2 6.0 t 6.81 4 2.1F0' . P.M 4. t 4.2-83 88, i g . - II 6 . t 0- e 8 1.3 8 8.W-64 4 1.h-4 8 5.1083 i f.St-8s I f.8 4 8. 8 ; I F.2 -61
- 7.et #s 8 8.Xf. It gi . .- -t!
! I . e*1 8 4.5 1 9.91-08 8 6.6: f: '
- l. M -t. I 4.It es 8 8.8 1 9.N 4 I f.al-es t 7.71-fs 8 8.2 -fi tt
; g .. . -;t
.. t 0- t t 1.1 I t.1083 1 6. 0. -9.- . 6. fit . 6.ti-es
- 4.3 8 8. se.L I 7.7t et i 7. 't -8e t 8 e(41 88 81 . - .?
8 . 9- 9 6 8.1 3 1.5 e8 8 s. h - 8. I !.718% . 9.41 4. ' 18.0 t f. H !.* I f.71-fe 7.6bes I t.4t-f*. !
.. I ~ 38 I $ - 30 1 4.5 t 8.4! 08 8 6.dv8. e 8.fi l* I t. I' 9*. I 13.4 5 8.ed's ! 7.al'81 6 7.W+0e I S.4bfi tt
.. t - - + ~ .
It t 4.n.e: ! ..v.s; I 3.epp
- I: 1 I e . :4 8 . 2. it 4 I te.3 e.N:s t ..:t-r s.u-ei . s.n t It
, . - . ..m. ... . . . ...... m.. .. .mm . .. ........m m.m.m. -m.m -mo ! t i
ah Page 390 of 453
- a
TABLE F-5 RESTORATION TIME AVAILABLE PROBABILITY TIME WHEN OF NOT FEEDWATER TIME TO RECOVERING IS LOST (HRS) DRYOUT SG (HRS) TOTAL TIME (HRS) 0FFSITE POWER 0 1.0 1.0 .34
.5 1.35 1.85 .21 1.0 1.75 2.75 .15 1.5 1.96 3.46 .11 2.0 2.17 4.17 .09 2.5 2.21 4.71 .08 3.0 2.25 5.25 .07 3.5 2.3 5.8 .05 4.5 2.3 6.8 .03 5.5 2.3 7.8 .01 6.5 2.3 8.8 .0094 7.5 2.3 9.8 .0088 8.5 2.3 10.8 .0082 9.5 2.3 11.8 .0076 17 2.3 19.3 .0029 O
l l 9 Page 391 of 453
TABLE F-6 MAJOR COMP 0NENT CHARACTERISTICS
-INDEPENDENT COMPONENTS COMPONENT TOTAL U AND TOTAL RUN TOTAL BASIC EVENT IN IND. TYPE DEMAND FAILURE FAILURE I.D. BASIC EVENT FAIL. PROB. PROB. PROB.
A11/A1 AF-12-1 N.O. MV 1.4-4 N//1 AF-16-1 CV 2.4-4 N/A MV-32242 N.0. MOV 1.8-4 N/A 5.6-4 A21/A2 AF-12-2 N.O. MV 1.4-4 N/A AF-16-2 CV 2.4-4 N/A MV-32243 N.0. MOV 1.8-4 N/A 5.6-4 B11/81 MV-32239 N.O. MOV 2.9-4 N/A AF-15-2 CV 2.4-4 N/A 5.3-4 B21/82 MV-32238 N.0. MOV 2.9-4 N/A AF-15-1 CV 2.4-4 N/A 5.3-4 B31/B3 MV-32382 N.0. MOV 1.8-4 N/A AF-15-4 CV 2.4-4 N/A 4.2-4 B4I/84 MV-32381 N.0. MOV 1.8-4 N/A AF-15-3 CV 2.4-4 N/A 4.2-4 C11/C1 AF-13-3 N.O. MV 1.0-4 N/A AF-15-9 CV 2.4-4 N/A 3.4-4 O Page 392 of 453
TABLE F-6 MAJOR COMPONENT CHARACTERISTICS (Continued) INDEPENDENT COMPONENTS COMPONENT TOTAL U AND TOTAL RUN TOTAL BASIC EVENT IN IND. TYPE DEMAND FAILURE FAILURE I.D. BASIC EVENT FAIL. PROB. PROB. PROB. C2I/C2 AF-13-5 N.O. MV 1.1-4 N/A AF-15-11 CV 2.4-4 N/A 3.5-4 C31/C3 AF-13-4 N.O. MV 1.0-4 N/A AF-15-10 CV 2.4-4 N/A 3.4-4 011/01 Pil PUMP 5.9-4 6(5.3-5)= 9.1-4 3.2-4 D21/D2 P21 PUMP 5.9-4 6(5.3-5)= 9.1-4 3.2-4 D31/D3 P12 PUMP 5.9-4 G(5.3-5)= 9.1-4 3.2-4 Ell /El M21 MOTOR 1.4-3* 6(5.5-5)= 1.7-3 3.3-4 E21/E2 M12 MOTOR 1.4-3* 6(5.5-5)= 1.7-3 3.3-4 F11/F1 AF-14-1 CV 2.4-4 N/A MV-32333 N.0. M0V 1.4-4 N/A 3.8-4 F21/F2 AF-14-5 CV 2.4-4 N/A MV-32336 H.O. MOV 1,4-4 N/A 3.8-4 l
- Includes Maintenance and Testing, j l
Page 393 of 453 l
TABLE F-6 MAJOR COMPONENT CHARACTERISTICS (Continued) INDEPENDENT COMPONENTS COMPONENT TOTAL U AND TOTAL RUN TOTAL BASIC EVENT IN IND. TYPE DEMAND FAILURE FAILURE I.D. BASIC EVENT FAIL. PROB. PROB. PROB. F31/F3 AF-14-3 CV 2.4-4 N/A MV-32335 N.0. MOV 1.4-4 N/A 3.8-4 Il TURBINE TURBINE 2.5-2* 6(5.5-5)= 3.3-4 CV-31998 A0V 3.3-3 N/A 2.9-2 REMAINDER NEGLIGIBLE [ 12 2-AF-13-1 N.C. MV 5.3-3 N/A AF-13-1 N.C. MV 5.3-3 N/A OPERATOR N/A 1.3-2 N/A FAILS TO . OPEN VALVES AVAILABILITY N/A .1 .12 0F PUMP 21 13 MV-32383 MOV FTC 5.9-4 N/A MV-32384 MOV FTC 5.9-4 N/A OPERATOR N/A 1.3-2 N/A 1.4-2 FAILS TO CLOSE VALVES l I4 BACKUP MANY 1.0-2 N/A 1.0-2 SUCTION COMPONENTS
- Includes Maintenance and Testing.
Page 394 of 453
TABLE F-6 MAJOR COMPONENT CHARACTERISTICS (Continued) INDEPENDENT COMPONENTS COMP 0NENT TOTAL U AND TOTAL RUN TOTAL BASIC EVENT IN IND. TYPE DEMAND FAILURE FAILURE I.D. BASIC EVENT FAIL. PROB. PROB. PROB. 15 CONDENSATE MANY 1.0-5 N/A 1.0-5 STORAGE COMPONENTS TANK SUCTION I6 CW-1-2 N.0. MV 1.0-4 N/A CL-48-9 N.0. MV 1.0-4 N/A CL-48-10 N.0. MV 1.0-4 N/A HUMAN ERROR 4.2-4 N/A 7.2-4 17 CW-1-1 N.O. MV 1.0-4 N/A 2CL-49-2 N.0. MV 1.0-4 N/A 2CL-49-3 N.0. MV 1.0-4 N/A HUMAN ERROR 4.2-4 N/A 7.2-4 l l l O1i Page 395 of 453 . l
I TABLE F-7 DIESEL GENERATOR AND DIESEL COOLING WATER PUMP BETA FACTORS i FAILURE-MODE VALUE SOURCE FTS 1.46E-2 SB' FTR 3.25E-2 FTS 5.0E-2 EPRIS '
. FTR 5.0E-2 EPRI8 FTS 7.7E-2 BFR2 FTR 7.7E-2 BFR8 FTS .07 Judgement FTR 0.0 Judgement 8 1: Only 1 value reported (EPRI NP-3967) 2: Only 1 value reported (NUREG/CR-2099) 3: Demand value conservatively envelopes this term.
4: Seabrook Probabilistic Safety Study i l O Page 396 of 453
l TABLE F-8 COMPARIS0N OF DEMAND COMMON CAUSE i FAILURE APPROACH TO OPERATING-0Gs- l BETA = .05 DEMAND TIME (HRS) BETA = .07 (DEMAND) = .05 RUN 0 4.8E-4 4.2E-4 1 5.9E-4 6.0E-4 2 7.0E-4 7.9E-4 3 8.2E-4 9.9E-4 4 9.5E-4 1.2E-3 5 1.1E-3 1.4E-3 6 1.2E-3 1.6E-3 7 1.4E-3 1.9E-3 8 1.6E-3 2.1E-3 9 1.8E-3 2.4E-3 10 1.9E-3 2.6E-3 0 l l l 9 l Page 397 of 453
i-TABLE F-9 COMPARISON'0F DEMAND COMMON CAUSE FAILURE APPROACH TO OPERATING-DCWPs-BETA = .05 DEMAND TIME (HRS) BETA = .07 (DEMAND) = .05 RUN 0 6.8E-4 5.1E-4 1 7.6E-4 6.3E-4 2 8.5E-4 7.2E-4 3 9.5E-4 8.6E-4 4 1.1E-3 9.9E-4 5 1.2E-3 1.1E-3 6 1.3E-3 1.2E-3 7 1.4E-3 1.4E-3 8 1.5E-3 1.5E-3 9 1.6E-3 1.7E-3 10 1.8E-3 1.8E-3 O t O Page 398 of 453
TABLE F-10 SENSITIVITIES FOR TWO-UNIT LOSS OF 0FFSITE POWER CONTRIBUTORS 2DMT NEW + 2 DESCRIPTION SYSTEM CHANGE 2TMM 2DTM C3 c c 2 FAILURE FROM ,2 20 T PROBABILITY BASELINE
+2 2MT 2DT
+2 2C T i
8.7E-5 I 2.1E-5 3.9E-5 8.5E-6 1.9E-5 Baseline -- 2 3.1E-5 2.0E-4 -- 6.0E-5 9.1E-5 1.5E-5 Recovery of 75% of turbine-driven 4.1E-5 -4.6E-5 6.4E-6 1.5E-5 2.3E-6 1.7E-5 pump failures 1.2E-4 -8.0E-5 1.8E-5 3.5E-5 3.8E-6 2.7E-5 Upper bound estimate for turbine driven 1.1E-4 +2.4E-5 2.5E-5 5.3E-5 1.2E-5 2.1E-5 l pump failure-to-run value ! 2.0E-4 Neg. 6.0E-5 9.1E-5 1.5E-5 3.1E-5 AFW pump common cooling water supply 6.5E-5 -2.2E-5 7.2E-6 3.0E-5 8.5E-6 1.9E-5 and return valves 1.4E-4 -6.0E-5 2.0E-5 7.1E-5 1.5E-5 3.1E-5
- Transfer closed numbers are high - Improved T/M procedures AFW pump comon cooling water supply 7.3E-5 -1.4E-5 1.2E-5 3.3E-5 8.5E-6 1.9E-5 and return valves 1.6E-4 -4.0E-5 3.5E-5 7.8E-5 1.5E-5 3.1E-5 - Improved T/M procedures l
l l g g Page 399 of 45
-n s TABLE F-10 SENSITIVITIES FOR TWO-UNIT LOSS OF 0FFSITE POWER (continued)
CONTRIBUTORS 2DMT NEW + 2 DESCRIPTION SYSTEM CHANGE 2TMM 2DTM 2 C3 C C FAILURE FROM 2D T BASELINE
+2 +2 2DT
+2 2C T PROBABILITY 2MT Baseline 8.7E-5 --
2.1E-5 3.9E-5 8.5E-6 1.9E-5 2.0E-4 -- 6.0E-5 9.1E-5 1.5E-5 3.1E-5 AFW pump common cooling water supply 9.7E-5 +1.0E-5 2.7E-5 4.2E-5 8.5E-6 1.9E-5 and return valves 2.3E-4 +3.0E-5 7.9E-5 1.0E-4 1.5E-5 3.1E-5 - Upper bound; limited by AFW pump failure probabilities - New procedures and proper training 7.3E-5 -1.4E-5 1.9E-5 2.7E-5 8.5E-6 1.9E-5 in use of cross-connect pumps 1.6E-4 -4.0E-5 5.4E-5 6.2E-5 1.5E-5 3.1E-5 - Assurance that cross-connect valves can be opened without ac power Recovery of 50% of diesel generator 6.7E-5 -2.0E-5 2.1E-5 2.3E-5 3.5E-6 1.9E-5 demand failures 1.4E-4 -6.0E-5 6.0E-5 4.6E-5 3.7E-6 3.1E-5 Common cause failure of diesel 1.0E-4 +1.3E-5 2.1E-5 5.DE-5 1.4E-5 1.9E-5 generators assumed to be 7% (6-Factor = .07) 2.5E-4 +1.5E-4 6.0E-5 1.3E-4 2.8E-5 3.1E-5 Page 400 of 453
TABLE F-10 SENSITIVITIES FOR TWO-UNIT LOSS OF 0FFSITE POWER (continued) CONTRIBUTORS 2DMT NEW + 2 DESCRIPTION SYSTEM CHANGE 2TMM 2DTM 2 C3 c c FAILURE FROM ,2 2D T BASELINE
+2 2MT 20T
+2 2C T PROBABILITY Baseline 8.7E-5 --
2.1E-5 3.9E-5 8.5E-6 1.9E-5 2.0E-4 -- 6.0E-5 9.1E-5 1.5E-5 3.1E-5 Recovery of 50% of diesel cooling 7.7E-5 -1.0E-5 2.1E-5 3.9E-5 8.5E-6 8.3E-6 water pump demand failures 1.7E-4 -3.0E-5 6.0E-5 9.1E-5 1.5E-5 7.7E-6 Common cause failures of diesel 1.6E-4 +7.3E-5 2.1E-5 3.9E-5 8.5E-6 8.8E-5 cooling water pumps assumed to be 3.8E-4 +1.8E-4 6.0E-5 9.1E-5 1.5E-5 2.1E-4 7% (8-factor = .07) Changes in failure probability for use Neg. of station cooling water system for backup suction to AFW pumps New procedures and proper training in 7.2E-5 -1.5E-5 2.1E-5 3.9E-5 8.5E-6 4.2E-6 use of CSTs for backup cooling to AFW pumps 1.7E-4 -3.0E-5 6.0E-5 9.1E-5 1.5E-5 6.8E-6 Page 401 of 45
t
;^\
(')/
% G ()
TABLE F-10 SENSITIVITIES FOR TWO-UNIT LOSS OF 0FFSITE POWER (continued) CONTRIBUTORS 2DMT NEW + 2 DESCRIPTION SYSTEM CHANGE 2TMM 2DTM 2 C3 C c FAILURE 20 T PROBABILITY FROM BASELINE
+2 2MT
+2 2DT
+2 2C T Baseline 8.7E-5 --
2.1E-5 3.9E-5 8.5E-6 1.9E-5 2.0E.4 -- 6.0E-5 9.1E-5 1.5E-5 3.1E-5 No credit for use of CSTs to provide 1.3E-4 +4.3E-5 2.1E-5 3.9E-5 8.5E-6 6.5E-5 cooling to AFW pumps 2.8E-4 +8.0E-5 6.0E-5 9.1E-5 1.5E-5 1.1E-4 Turbine-driven pump failure probability 6.0E-5 -2.7E-5 1.0E-5 2.5E-5 6.3E-6 1.8E-5 , using the upper bound time-dependent failure and assuming 75% of the pump 8.4E-5 -1.2E-4 1.8E-5 3.5E-5 3.8E-6 2.7E-5 failures are recovered Upper bound estimate for current design / 4.4E-4 +3.5E-4 3.3E-5 7.2E-5 1.9E-5 3.1E-4 operation 9.7E-4 +7.7E-4 7.9E-5 1.4E-4 2.8E-5 7.2E-4 . Lower bound estimate for current design / 5.0E-6 -8.2E-5 1.1E-6 2.2E-6 9.7E-7 7.1E-7 operation
' 8.8E-6 -1.9E-4 3.1E-6 4.1E-6 9.6E-7 6.3E-7 l
Page 402 of 453
TABLE F-10 SENSITIVITIES FOR TWO-UNIT LOSS OF 0FFSITE POWER (continued) CONTRIBUTORS 2DMT NEW + 2 DESCRIPTION SYSTEM CHANGE 2TMM 2DTM C5 c c 2 FAILL'RE FROM ,2 2D T BASELINE
+2 2MT 2DT
+2 2C T PROBABILITY 8.7E-5 -- 2.1E-5 3.9E-5 8.5E-6 1.9E-5 Baseline 2.0E-4 -- 6.0E-5 9.1E-5 1.5E-5 3.1E-5 8.7E-6 -7.8E-5 1.1E-6 3.6E-6 2.3E-6 1.7E-6 Best-estimate two-unit failure probability, including key changes 3.8E-6 2.5E-6 evaluated above 1.8E-5 -1.8E-4 3.1E-6 8.2E-6 Best-estimate two-unit upper bound 1.6E-4 +7.3E-5 3.1E-5 5.9E-5 1.9E-5 5.1E-5 l
l failure probability, including key 1.1E-4 changes evaluated above 3.2E-4 +1.2E-4 7.4E-5 1.1E-4 2.8E-5 i FOOTNOTES: ( ! 1 24-hour value includina recovery of offsite power. 2 Demand value, no cicJit for recovery of offsite power. O O Page403of45&,
.g ,
.s
/ TABt.E F-11 SENSITIVITIES FOR TWO-UNIT
. LOSS OF 0FFSITE POWER
-INPUT PARAMETER CHANGES- - DESCRIPTION FILE PARAMETER SYSTEM FAILURE PROB.
NAME VALUES e Recovery of 75% of CASE 2005 TD = 7.5E-3 4.1E-5, 1.2E-4 TDAFWP failures Upper bound estimate for CASE 2008 TR = 3.2E-3 1.1E-4, 2.0E-4 TDAFWP failure to run value AFW pump common cooling CASE 2009 L = 1.0E 4 6.5E-5, 1.4E-4 water supply and return valves Transfer closed numbers are too high
- Improved T/M procedures AFW pump common cooling CASE 2010 L = 3.2E-4 7.3E-5, 1.6E-4 water supply and return valves
- Improved T/M procedures t
. O
) Page 404 of 453
TABLE F-11 (Continued) - SENSITIVITIES FOR TWO-UNIT LOSS OF 0FFSITE POWER
-INPUT PARAMETER CHANGES-DESCRIPTION FILE PARAMETER SYSTEM FAILURE PROB.
NAME VALUES AFW pump common CASE 2U11 L = 1.0E-3 9.7E-5, 2.3E-4 cooling water supply and return valves
- Upper bound limited by AFW pump failure probabilities
- New procedures and CASE 2012 7.3E-5, 1.6E-4 O
MCD = 0.01 proper training in use e of cross-connect pumps
- Assurance that cross-connect valves can bc l -
opened without ac power Recovery of 50% of DG CASE 2013 6.7E-5, 1.4E-4 DD = 8.0E-3 demand failures (includes maintenance recovery) Common cause failure CASE 2U14 1.0E-4, 2.5E-4 DD = 2.2E-2 of DGs (8 factor = .07) O Page 405 of 453
TABLE F-11 (Continued) SENSITIVITIES FOR TWO-UNIT LOSS OF 0FFSITE POWER
-INPUT PARAMETER CHANGES-DESCRIPTION FILE PARAMETER SYSTEM FAILURE PROB.
NAME VALUES Recovery of 50% of DCWP CASE 2015 CD = 5.0E-3 7.7E-5, 1.7E-4 demand failures Comon cause failure CASE 2U16 CD = 2.6E-2 1.6E-4, 3.8E-4 of DCWPs (8 factor = .07) New procedures and CASE 2U17 S = 0.01 7.2E-5, 1.7E-4 proper. training for use of CSTs for backup . cooling to AFW pumps No credit for use of CSTs CASE 2018 S = 1.0 1.3E-4, 2.8E-4 to provide cooling to ,
.AFW pumps TDAFWP failure probability CASE 2U19 6.0E-5, 8.4E-5 TD = 7.5E-3 using upper bound TR = 3.2E-3 operating failure rate and assuming 75% of pump demand failures are recovered O
Page 406 of 453
TABLE F-11 (Continued) - SENSITIVITIES FOR TWO-UNIT LOSS OF 0FFSITE POWER
-INPUT PARAMETER CHANGES-DESCRIPTION FILE PARAMETER SYSTEM FAILURE PROB.
NAME VALUES Upper bound estimate CASE 2U7 4.4E-4, 9.7E-4 TR = 3.2E-3 for current design / operation L = 1.0E-3 DD = 2.2E-2 CD = 2.6E-2 S = 1.0 Lower bound estimate CASE 2U21 5.0E-6, 8.8E-6 TD = 7.5E-3 for current design / operation MC = 0.01 D S = 0.01 h L = 1.0E-4 DD = 8.0E-3 CD = 5.0E-3 East estimate 2 Unit CASE 2U22 8.7E-6, 1.8E-5 TD = 7.5E-3 failure probability MCD = 0.01 including key changes S = 0.01 evaluated above L = 1.0E-4 l ! e Page 407 of 453
TABLE F-11 m (Continued) SENSITIVITIES FOR TWO-UNIT LOSS OF 0FFSITE POWER
-INPUT PARAMETER CHANGES-DESCRIPTION FILE PARAMETER SYSTEM FAILURE PROB.
NAME VALUES Best estimate 2 Unit CASE 2U23 TR = 3.2E-3 1.6E-4, 3.2E-4 upper bound including MCD = 0.02 key changes evaluated S = 0.01 above L = 1.0E-3 DD = 2.2E-2 CD = 2.6E-3 5 Best estimate 2 Unit CASE 2U24 TR = 3.2E-3 1.3E-4, 2.5E-4 upper bound including MCD = 0.02 key changes evaluated S = 0.0 above plus elimination L = 1.0E-3 of CWS dependency for DD = 2.2E-2 AFW pump cooling CD = 2.6E-3 t O
- . Page 408 of 453 4
TABLE F-12 CANDIDATE MODIFICATIONS AMENABLE TO QUANTIFICATION CANDIDATE FAILURE MODIFICATION CASE PROBABILITY l 2 Baseline CASE 2001 8.7E-5 2.0E-4
- 1. Discharge AFW pump recirculation CASE 2U17 7.2E-5(17%)
thru lube oil coolers / turbine 1.7E-4 (15%)
- 2. Proceduralize and train CASE 2U17 7.2E-5(17%)
operations personnel in action 1.7E-4 (15%) required to recognize need for backup CST cooling
- 3. Verify common AFW pump cooling CASE 2U10 7.3E-5(16%)
water valves are in correct 1.6E-4 (20%) position with cooling water return line sight glass during pump test and verify valve position with post-maintenance test
- 4. Ensure cross-connect pump has a CASE 2U12 7.3E-5 (16%)
high availability; procedurize 1.6E-4(20%) use and train operators; ensure cross-connect valves can be opened; test cross-connect valves
- 5. Procedurize and train operations CASE 2UO5 4.1E-5(53%)
personnel in manual start / control 1.2E-4(40%) TDAFW pump 4
- 6. Candidate modifications CASE 2022 8.7E-6(90%)
1.8E-5 (90%) 1 Baseline values assume MS-22-2 issue is resolved. Excludes parametric common cause which was not included in NUREG-0611 scope. 2 24-hour value including recovery of offsite power. 3 Demand value without crediting recovery of offsite power. 4 Cumulative effect of modifications. O Page 409 of 453 1
. _ ._ m ._ __ _ . _ . . . . . -.._ .- m_.
TABLE F-13 COMMON CAUSE CUT SETS i
~ CUT SET VALUE CUM
- A1A2 2.8E-5 01D203 1.5E-5 4.3E-5
.- CIC2C3 8.5E-6 5.2E-5 B1828384 6.0E-6 5.8E-5 D103
- I2 5.4E-6 6.3E-5
[f . E1E2
- Il- 1.6E-6 6.5E-5
- j. 0203
- Il 1.3E-6 6.6E-5
- D103
- I3 6.3E-7 6.6E-5 4
f I i I i l 1 8 !O ! 6 . 410 453 l
+ . - + - . .cr-ge..---- , ,-w,,r.,..-w-, - - - - - , --.w -%-,,,..,.w_r-e-,y~,w- e,---,... .---s.;e--,-., , .,-,,,-w,m.....-,.w+,. . - - ,.. - . . . . - , . . . -
U r r r r B 3 5 r r F r 4 2 C U f r r r r F r r r r o r r r r 1 - 1 U r r r r 4 B r r r r e g 1 U C a r r P r r r r r r r r r r r E C N 23 4 5 67 8 9 90 1 2 e E U 1 g 3 4 5'7 *9 0 1 23 4 5671 18 190 1 1 1 1 1 1 1 l 2E222 2222 2 s6 6 6 e Q r E T S t n e v rrrr E 1 2 P t, 7
- t 7 rTGGG,GGG7rr G
rrrrrT GG GGGG m e t s g g g y I 1 I S t rrF r rrrr r 2 rr r r N GGGG o 1 Ni GG G G i t GGGG p P t p u S g y r e w 2 o P 2 P e t g i l g y ; s f f O 1 1 f P o s s o L 2 r G G D 1
)
8 - 5 F 0 r e G 1 3 ( G r D u g A i F 2 2 P N J ; 7 t C D 21 P J t C D
t F 1 HER
) SGtt or- SGt2 4\ trLOW b M SG SG e 11 12 SIMILAR CcMea-IrLOWt2 NCNTS FLOW 11 M-12-tLat M-i2-2 Laa_ -(2)
N-3'lih M:stit3 $
/Nariat trt42 @
N Ir031 f trCEP k .t un ) ,e m i MV-32239 1 MV-32234 5 MV-32382 N MV-32381 A (4)
< -ts-2 M -ts-t M -t3-4 M-tS-3 (*)
@ trDC1 @ @ tr0C2C3 @
l I tr0C2 trCC3 I M 3 b M -t3-5 M 4 ( M 9 M-15-st M 10 I})) h h h Lot LE LE (3) P11 Pat Pit
@ @ h Ttt 1 Lu Mit M (2)
M 3 dt' 7 M21
$1r!!! @ @ trlC2
~
WA g, ), INA (1)
+ + +
3238 gg) fVA y4 MV-32304
@ Ir!!3 $ @
CW-t-2 LLt CW-t-2 LL CW-t-il17 CL-48-9 CL-48-9 2CL-49-2 (1) CL-48-10 CL-4 8-10 2CL-49-3
/\ /\ /\ /\ /\ /\
l COOLING WATCA b CDreOrtNTs. PUpr (3) suCT10M VALVES. ETC. IFCrt grCr2 IFCr3 Ar-14-1 b M 5 M 3 MV-32333 MV-32336 MV-32335 (}) I)
/\ /\ /\
l CcNocnsATE ll5.,
/ sTenAcc TArw. (s)
><AntA. vALvcs
( 2,.wM Figure F-2 AFW System Block Diagram Page 412 of 453
DG2 DCWP DCWP DG1 DG2 OP DCWP DCWP DG1 STATUS 12 22 RCV RCV RCV 12 22 RCV RCV A ALL S$s OK (1) Nr; :: Nr; NN Nn
,;, ; SUCCESS (2)
Nr; tt; Nr SUCCESS (3) NPDG2 (4) Nr; Nr; SUCCESS (5) MN ifi SUCCESS (6) fvt NPDG1 (7) I nn SUCCESS (8) i Nr; Nr' SUCCESS (9) NPDG2 (10) SUCCESS (ID NPDG1 (12) SUCCESS (13) NPOWER (14) A (15-28) pp pr. ;;i; B (29'35) GF = GUARANTEED FAILURE B (36-42) 55= SutTORT ST ATE h = Rb RABL AILURE (DGs WILL 1 RIP DN HIGH TEMPERATURE) SUCCESS (43) GF GF NPDG2 = POLJER TD DG2 BUSES UNAVAILABLE NPDG1 = POWER TD DG1 BUSES UNAVAIL ABLE NPOLJER = POWER TO ALL EMERGENCY PUSES UNAVAILAPLE (44) SUCCESS = POLJER AVAILABLE Ai ALL EMERGENCY guSES BEFORE SG DRYOUT NO POWEyR OF = Off SliE POWER COOLING LOSTs RCV = RECOVERY BACKUP SUC110N LOST " en no7so Figure F-3 Recovery Event Tree Page 413 of 4
e ,__, ;s.- --. s& a -aa m . m -,JL -,s- ., ~ , - , _ . , , ,AL .a. s, +_. _ a NUREG-0611 BASED ANALYSIS i l t I [ 1 i g ( i > b 4 i l I 1 1 1 Page 414 of 453 1 1
- - - - ---n,-_,_m,, --
TABLE OF CONTENTS
1.0 INTRODUCTION
. . . . . ....................... 416 1.1 Pre-TMI . . . . . . . . . .................. 416 1.2 Fault Tree .......................... 416 1.3 WAMCUT Output for Loss of Feedwater . . . . . . ........ 416 1.4 WAMCUT Output for Station Blackout .............. 420 1.5 Sources of Basic Event Values . . . . . . . . . . . . . . . . . 423 1.6 Summary of Results ...................... 423 1.6.1 Loss of Main Feedwater . . . . . . . . ......... 423 1.6.2 Loss of Offsite Power - Diesel Generators Operate . . . . . . . . ........... 424 1.6.3 Station Blackout . ................... 424 2.0 POST-TMI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 424 2.1 Fault Tree .......................... 424 2.2 WAMCUT Output for Loss of Feedwater . . . .......... 425 2.3 WAMCUT Output for Station Blackout .............. 428 2.4 Sources of Basic Event Values . . . . . . . . . . . . . . . . . 434 2.5 Summary of Results ...................... 434 2.5.1 Loss of Main Feedwater . . . . . . . . ......... 434 2.5.2 Loss of Offsite Power - Diesel Generators Operate . . . . . . . . . . . . . . . . . . . 435 2.5.3 Station Blackout . ................... 435
3.0 REFERENCES
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 435 9
Page 415 of 453
1.0 INTRODUCTION
This appendix describes in detail the models that were used in this portion of the AFW system analysis and their results. The first part of this appendix will be devoted to the pre-TMI plant conditions and the second part to the post-TMI plant conditions. Performing an analysis of AFW reliability using the approach of NUREG-0611 (ref.
- 1) permits benchmarking the pre-TMI situation and allows a determination of the effect of the changes made as a result of this NUREG and NUREG-0737 (ref. 2).
Since this is meant to be a benchmark of the NRC's NUREG-0611 model, wherever possible basic event data is taken from Table III-2 of the NUREG. The specific values used for the basic events are documented below. The code used in this analysis was obtained from EPRI and has been designated WAME-02.WAMCUT (ref. 3). The NSP version of the code used is CUT 86003. 1.1 Pre-TMI The models described in this section represent conditions at the plant prior to the changes made for NUREG-0737. These are the same conditions that were evaluated by the NRC in NUREG-0611. 1.2 Fault Tree The fault tree for the pre-tmi situation is shown in Figure G-2. It is based on the simplified flow diagram of the Auxiliary Feedwater System given in Figure !g) w' G-1. Since the dominant contributor to system failure (described in section 1.6.1 of this appendix) was added in by hand and not included in the computer runs, the fault tree does no include it. The fault tree represents the logic input to the WAMCUT computer code. To include the common cause event (probability of the two manual valves inside containment being left closed due to coupled human error) in the fault tree, a new basic event would be added as input to OR gates IFLOW11 and IFLOW12. Since these two gates are immediately below the top event, and it is the same event for both gates, this event can be included in the value for system reliability by adding it's probability of occurence directly to the output of the WAMCUT runs. 1.3 WAMCUT Output for Loss of Feedwater Selected portions of the file produced by WAMCUT for this case has been reproduced below. Since the WAMCUT output file is normally in a 132 character per line format, any lines that were over 80 characters in length have been copied below with ' wrap-around' (two lines with the second line containing columns 81 through 132). O INPUT FAULT TREE DESCRIPTION (1) GATE NUMBER (2) GATE NAME (3) GATE TYPE (4) NUMBER OF GATES INPUT (5) NUMBER OF COMPONENTS INPUT [] V (6) NUMBER OF EVENTS IN COM GATE TO BE CONSIDERED AT ONE TIME (7)-(14) NAMES OF THE INPUTS Page 416 of 453
(1) (2) (3) (4) (5) (6) (7) (8) (9) (10) (11) (12) (13) (14) 1 IFLOWMFW AND 2 0 0 IFLOW11 IFLOW12 2 IFLOW11 OR 1 3 0 IAFWSG11 MANVA121 CHKVA161 MOV242 3 IAFWSG11 AND 2 0 0 I11SG11 112SG11 4 I11SG11 OR 1 2 0 TRAIN 11 M0V238 CHKVA151 5 TRAIN 11 OR 2 2 0 ISUCTN11 IPF11 MANVA133 CHKVA1 59 6 ISUCTN11 AND 2 0 0 ICW11 ICST11 7 ICW11 OR 0 5 0 MOV25 MANVCW12 CWU1 PPROT1 1 RESTRT11 8 ICST11 OR 1 2 0 IFCST11 CHKVA141 MOV333 9 IFCST11 AND 2 0 0 IFT11P11 IF2TP11 10 IFT11P11 OR 0 2 0 MANVC271 CST 11
~
11 IF2TP11 OR 1 2 0 ICST2122 MANVC412 MANVC411 12 ICST2122 AND 2 0 0 IFLCST21 IFLCST22 13 IFLCST21 OR 0 2 0 MANV2C71 CST 21 14 IFLCST22 OR 0 2 0 MANVC541 CST 22 15 IPF11 OR 1 1 0 ISF11 TDP11 16 ISF11 OR 1 1 0 ISFUI M0V264 17 ISFU1 AND 2 0 0 ISFSG11 ISFSG12 18 ISFSG11 OR 0 2 0 CHKVR152 MOV16 19 ISFSG12 OR 0 2 0 CHKVR151 MOV17 20 I12SG11 OR 1 2 0 TRAIN 12 MOV381 CHKVA153 21 TRAIN 12 OR 1 3 0 ISUCTN12 MANVA134 CHKVA510 MDP12 22 ISUCTN12 AND 2 0 0 ICW12 ICST12 23 ICW12 OR 0 5 0 MOV27 MANVCW11 CWU2 PPROT1 2 RESTRT12 24 ICST12 OR 1 2 0 IFCST12 CHKVA143 MOV335 25 IFCST12 AND 2 0 0 IFT11P12 IF2TP12 26 IFT11P12 OR 0 3 0 MANVC412 MANVC271 CST 11 27 IF2TP12 OR 1 1 0 ICST2122 MANVC411 28 IFLOW12 OR 1 3 0 IAFWSG12 MANVA122 CHKVA162 MOV243 29 IAFWSG12 AND 2 0 0 111SG12 112SG12 30 111SG12 OR 1 2 0 TRAIN 11 MOV239 CHKVA152 31 112SG12 OR 1 2 0 TRAIN 12 MOV382 CHKVA154 0 INPUT COMPONENT LIST (1) COMPONENT NUMBER (2) COMPONENT NAME (3) FIRST MOMENT OF COMPONENT UNAVAILABILITY (4) SECOND MOMENT OF COMPONENT UNAVAILABILITY (1) (2) (3) (4) 1 CHKVA141 0.100000E-03 0.000000E+00 2 CHKVA143 0.100000E-03 0.000000E+00 3 CHKVA151 0.100000E-03 0.000000E+00 4 CHKVA152 0.100000E-03 0.000000E+00 9 Page 417 of 453
l I\ ) 5 CHKVA153 0.100000E-03 0.000000E+00 6 CHKVA154 0.100000E-03 0.000000E+00 7 CHKVA159 0.100000E-03 0.000000Et00 8 CHKVA161 0.100000E-03 0.000000E400 9 CHKVA162 0.100000E-03 0.000000E+00 10 CHKVA510 0.100000E-03 0.000000E+00 l 11 CHKVR151 0.100000E-03 0.000000E+00 L 12 CHKVR152 0.100000E-03 0.000000E+00 h 13 CST 11 0.480000E-05 0.000000E+00 L 14 CST 21 0.480000E-05 0.000000E+00 15 CST 22 0.480000E-05 0.000000E+00 L 16 CWU1 0.100000E-01 0.000000E+00 17 CWV2 0.100000E-01 0.000000E+00 l 18 MANV2C71 0.210000E-02 0.000000E+00 i 19 MANVA121 0.100000E-01 0.000000E+00 20 MANVA122 0.100000E-01 0.000000E+00 l* 21 MANVA133 22 MANVA134 0.210000E-02 0.210000E-02 0.000000E+00 0.000000E+00 23 MANVC271 0.210000E-02 0.000000E+00 24 MANVC411 0.210000E-02 0.000000E+00 25 MANVC412 0.210000E-02 0.000000E+00 26 MANVC541 0.210000E-02 0.000000E+00 l 27 MANVCW11 0.500000E-02 0.000000E+00 28 MANVCW12 0.500000E-02 0.000000E+00 29 MDP12 0.700000E-02 0.000000E+00
,-- 30 MOV16 0.700000E-02 0.000000E+00
-'s) i 31 MOV17 0.700000E-02 0.000000E+00 l 32 MOV238 0.300000E-02 0.000000E+00 33 MOV239 0.300000E-02 0.000000E+00
! 34 MOV242 0.700000E-02 0.000000E+00 35 MOV243 0.700000E-02 0.000000E+00 j 36 MOV25 0.700000E-02 0.000000E+00 i 37 MOV264 0.300000E-02 0.000000E+00 38 MOV27 0.700000E-02 0.000000E+00 39 MOV333 0.700000E-02 0.000000E+00 40 MOV335 0.700000E-02 0.000000E+00 41 MOV381 0.300000E-02 0.000000E+00 42 MOV382 0.300000E-02 0.000000E+00 l 43 PPROT11 0.100000E-08 0.000000E+00 44 PPROT12 0.100000E-08 0.000000E+00 45 RESTRT11 0.100000E-08 0.000000E+00 46 RESTRT12 0.100000E-08 0.000000E+00 47 TOP 11 0.700000E-02 0.000000E+00 l l lO Page 418 of 453
' - - - - - - - , - ,,,,---.gn,? -,--, ---,---.-n..
-------n--. ,- -~.- , ---, - ,~ c-- e--,- .- - ---
CUT SETS FOR GATE IFLOWMFW ORDERED BY PROBABILITY
- 1. 1.00E-04 MANVA121 MANVA122
- 2. 7.00E-05 MANVA122 M0V242
- 3. 7.00E-05 MANVA121 MOV243
- 4. 4.90E-05 MOV242 MOV243
- 5. 4.90E-05 MDP12 TDP11
- 6. 2.10E-05 MDP12 M0V264
- 7. 1.47E-05 MANVA133 MDP12
- 8. 1.47E-05 MANVA134 TDoll
- 9. 6.30E-06 MANVA134 M0V264
- 10. 4.41E-06 MANVA133 MANVA134
- 11. 1.00E-06 CHKVA161 MANVA122
- 12. 1.00E-06 CHKVA162 MANVA121
- 13. 7.00E-07 CHKVA162 MOV242
- 14. 7.00E-07 CHKVA161 MOV243
- 15. 7.00E-07 CHKVA159 MDP12
- 16. '7.00E-07 CHKVA510 TDP11
- 17. 4.90E-07 CWU2 MOV335 TDP11
- 18. 4.90E-07 CWU1 MDP12 MOV333
- 19. 3.43E-07 MOV27 MOV335 TDP11
- 20. 3.43E-07 MDP12 MOV16 MOV17
- 21. 3.43E-07 MDP12 MOV25 MOV333
- 22. 3.00E-07 CHKVA510 MOV264
- 23. 2.45E-07 MANVCW11 MOV335 TDP11 24, 2.45E-07 MANVCW12 MDP12 MOV333
- 25. 2.10E-07 CHKVA159 MANVA134
- 26. 2.10E-07 CHKVA510 MANVA133
- 27. 2.10E-07 MANVA121 MDP12 MOV239
- 28. 2.10E-07 MANVA121 MOV382 TDP11
- 29. 2.10E-07 MANVA122 MDP12 MOV238
- 30. 2.10E-07 MANVA122 MOV381 TDP11
- 31. 2.10E-07 CWU2 MOV264 MOV335
- 32. 1.47E-07 MDP12 MOV239 MOV242
- 33. 1.47E-07 MOV242 MOV382 TDP11
- 34. 1.47E-07 MDP12 MOV238 MOV243
- 35. 1.47E-07 CWU2 MANVA133 MOV335
- 36. 1.47E-07 M0V243 MOV381 TDP11
- 37. 1.47E-07 CWU1 MANVA134 MOV333 38, 1.47E-07 MOV264 MOV27 MOV335
- 39. 1.05E-07 MANVCW11 MOV264 M0V335
- 40. 1.03E-07 MANVA133 MOV27 MOV335
- 41. 1.03E-07 MANVA134 MOV16 MOV17
- 42. 1.03E-07 MANVA134 MOV25 MOV333
- 43. 9.00E-08 MANVA121 M0V239 MOV382
- 44. 9.00E-08 MANVA121 MOV264 MOV382
- 45. 9.00E-08 MANVA122 MOV238 MOV381
- 46. 9.00E-08 MANVA122 M0V264 M0V381
- 47. 7.35E-08 MANVA133 MANVCW11 MOV335
- 48. 7.35E-08 MANVA134 MANVCW12 MOV333
- 49. 6.30E-08 MOV239 MOV242 MOV382
- 50. 6.30E-08 M0V242 MOV264 MOV382 9
Page 419 of 453
(~ 51. 6.30E-08 MANVA121 MANVA134 MOV239 i 52. 6.30E-08 MANVA121 MANVA133 MOV382
- 53. 6.30E-08 MOV238 MOV243 M0V331
- 54. 6.30E-08 MANVA122 MANVA134 M0V238
- 55. 6.30E-08 MANVA122 MANVA133 MOV381
- 56. 6.30E-08 MOV243 MOV264 MOV381
- 57. 6.30E-08 MDP12 NOV238 MOV239
- 58. 6.30E-08 MOV381 M0V382 TDP11
- 59. 4.41E-08 MANVA134 MOV239 M0V242
- 60. 4.41E-08 MANVA133 MOV242 MOV382
- 61. 4.41E-08 MANVA134 MOV238 MOV243
- 62. 4.41E-08 MANVA133 MOV243 M0V381 .
- 63. 2.70E-08 MOV264 MOV381 MOV382
- 64. 1.89E-08 MANVA134 MOV238 MOV239
- 65. 1.89E-08 MANVA133 MOV381 MOV382
- 66. 1.00E-08 CHKVA161 CHKVA162
- 67. 1.00E-08 CHKVA159 CHKVA510 O1ST MOMENT = 4.0806E-04 1.4 WAMCUT Output for Station Blackout The only difference in the input for this case and the previous one is that the values for three of the basic events have been changed. The probability of failure for MOP 12, MOV25, and MOV27 has been increased to one since they require AC power for operation. For this reason only the cut sets have been reproduced
() below. The logic and basic event values can be obtained from the case above. CUT SETS FOR GATE IFLOWMFW WITH PROBABILITY .GE. 1.00E-08
- 1. 6.30E-06 MANVA134 MOV264
- 2. 3.00E-07 CHKVA510 MOV264
- 3. 3.00E-03 MDP12 MOV264
- 4. 1.47E-05 MANVA134 TDP11 5, 7.00E-07 CHKVA510 TDP11
- 6. 7.00E-03 MDP12 TOP 11
- 7. 4.41E-06 MANVA133 MANVA134
- 8. 2.10E-07 CHKVA510 MANVA133
- 9. 2.10E-03 MANVA133 MDP12
- 10. 2.10E-07 CHKVA159 MANVA134
- 11. 1.00E-08 CHKVA159 CHKVA510
- 12. 1.00E-04 CHKVA159 MOP 12
- 13. 1.00E-04 MANVA121 MANVA122
- 14. 1.00E-06 CHKVA162 MANVA121
- 15. 7.00E-05 MANVA121 MOV243
- 16. 1.00E-06 CHKVA161 MANVA122
- 17. 1.00E-08 CHKVA161 CHKVA162
- 18. 7.00E-07 CHKVA161 MOV243
- 19. 7.00E-05 MANVA122 MOV242
- 20. 7.00E-07 CHKVA162 MOV242 O
Page 420 of 453
i
- 21. 4.90E-05 MOV242 MOV243
- 22. 2.10E-07 CHKVA141 MANVA134 M0V25
- 23. 1.00E-08 CHKVA141 CHKVA510 M0V25
- 24. 1.00E-04 CHKVA141 MOP 12 MOV25
- 25. 1.47E-05 MANVA134 MOV25 MOV333
- 26. 7.00E-07 CHKVA510 MOV25 F0V333
- 27. 7.00E-03 MDP12 MOV25 M0V333
- 28. 5.00E-07 CHKVA141 MANVCW12 MDP12
- 29. 7. .'5 E-08 MANVA134 MANVCW12 MOV333
- 30. 3.50E-05 MANVCW12 MDP12 MOV333
) 31. 1.00E-06, CHKVA141 CWU1 MDP12
- 32. 1.47E-07 CWU1 MANVA134 M3V333
- 33. 7.00E-05 CWU1 MOP 12 MOV333
- 34. 1.00E-08 CHKVR151 CHKVR152 MDP12
- 35. 7.00E-07 CHKVR152 MDP12 MOV17
- 36. 7.00E-07 CHKVR151 MDP12 MOV16
- 37. 1.03E-07 MAN'VA134 MOV16 MOV17
- 38. 4.90E-05 MDP12 MOV16 MOV17
- 39. 3.00E-07 CHKVA143 M0V264 MOV27
- 40. 2.10E-05 MOV264 MOV27 MOV335
- 41. 1.05E-07 MANVCW11 MOV264 MOV335
- 42. 2.10E-07 CWU2 M0V264 MOV335
- 43. 2.70E-08 MOV264 M0V381 MOV382
- 44. 9.00E-08 MANVA122 MOV264 MOV381
- 45. 6.30E-08 M0V243 MOV264 MCV381
- 46. 7.00E-07 CHKVA143 MOV27 TCP11
- 47. 4.90E-05 MOV27 MOV335 TOP 11
- 48. 2.45E-07 MANVCW11 MOV335 TOP 11
- 49. 4.90E-07 CWU2 MOV335 TOP 11
- 50. 6.30E-08 MOV381 MOV382 TDP11
- 51. 2.10E-07 MANVA122 MOV381 TOP 11
- 52. 1.47E-07 MOV243 M0V381 TOP 11
- 53. 2.10E-07 CHKVA143 MANVA133 MOV27
- 54. 1.47E-05 MANVA133 MOV27 MOV335
- 55. 7.35E-08 MANVA133 MANVCW11 MOV335
- 56. 1.47E-07 CWU2 MANVA133 MOV335
- 57. 1.89E-08 MANVA133 MOV381 MOV382
- 58. 6.30E-08 MANVA122 MANVA133 M0V381
- 59. 4.41E-08 MANVA133 MOV243 MOV381
- 60. 1.00E-08 CHKVA143 CHKVA159 MOV27
- 61. 7.00E-07 CHKVA159 MOV27 MOV335
- 62. 1.89E-08 MANVA134 M0V238 MOV239
- 63. 6.30E-08 MANVA122 MANVA134 MOV238
- 64. 4.41E-08 MANVA134 MOV238 MOV243
- 65. 9.00E-06 MOP 12 MOV238 MOV239
- 66. 3.00E-07 CHKVA152 MDP12 MOV238
- 67. 3.00E-05 MANVA122 MDP12 MOV238
- 68. 3.00E-07 CHKVA162 MDP12 MOV238
- 69. 2.10E-05 MDP12 MOV238 MOV243
- 70. 9.00E-08 MANVA122 MOV238 MOV381 9
Page 421 of 453
[D ~ \~ / '
- 71. 6.30E-08 MOV238 MOV243 MOV381
- 72. 3.00E-07 CHKVA151 MDP12 MOV239
- 73. 1.00E-08 CHKVA151 CHKVA152 MDP12
- 74. 1.00E-06 CHKVA151 MANVA122 MDP12
- 75. 1.00E-08 CHKVA151 CHKVA162 MDP12
- 76. 7.00E-07 CHKVA151 MDP12 MOV243
- 77. 9.00E-08 MANVA121- M0V264 M0V382
- 78. 2.10E-07 MANVA121 M0V382 TDP11
- 79. 6.30E-08 MANVA121 MANVA133 MOV382
- 80. 6.30E-08 MANVA121 MANVA134 MOV239
- 81. 3.00E-05 MANVA121 MDP12 MOV239
- 82. 9.00E-08 MANVA121 MOV239 MOV382
- 83. 1.00E-06 CHKVA152 MANVA121 MOP 12
- 84. 3.00E-07 CHKVA161 MDP12 MOV239
- 85. 1.00E-08 CHKVA152 CHKVA161 MDP12
- 86. 6.30E-08 MOV242 M0V264 MOV382
- 87. 1.47E-07 ' MOV242 MOV382 TDP11
- 88. 4.41E-08 MANVA133 M0V242 MOV382
- 89. 4.41E-08 MANVA134 MOV239 MOV242
- 90. 2.10E-05 MDP12 MOV239 MOV242
- 91. 6.30E-08 MOV239 MOV242 MOV382
- 92. 7.00E-07 CHKVA152 MOP 12 MOV242
- 93. 4.41E-06 MANVC271 MANVC412 MDP12 MOV25
- 94. 4.41E-06 MANVC271 MANVC411 MOV25 MOV27
- 95. 2.20E-08 MANVC271 MANVC411 MANVCW11 MOV25
,. 96. 4.41E-08 CWU2 MANVC271 MANVC411 MOV25
( ) 97. 4.41E-06 MANVC271 MANVC411 MDP12 MOV25
\- ' 98. 1.01E-08 CST 11 MANVC412 MDP12 MOV25
- 99. 1.01E-08 CST 11 MANVC411 MOV25 MOV27 100. 1.01E-08 CST 11 MANVC411 MDP12 MOV25 101. 1.00E-08 CHKVA141 CHKVA143 MOV25 MOV27 102. 7.00E-07 CHKVA141 MOV25 MOV27 M0V335 103. 7.00E-07 CHKVA143 MOV25 MOV27 MOV333 104. 4.90E-05 MOV25 MOV27 MOV333 MOV335 105. 2.45E-07 MANVCW11 MOV25 MOV333 M0V335 106. 4.90E-07 CWU2 MOV25 MOV333 MOV335 107. 6.30E-08 MOV25 M0V333 MOV381 MOV382 108. 2.10E-07 MANVA122 MOV25 MOV333 MOV381 109. 1.47E-07 MOV243 MOV25 M0V333 M0V381 110. 2.20E-08 MANVC271 MANVC412 MANVCW12 MOP 12 111. 2.20E-08 MANVC271 MANVC411 MANVCW12 MOV27 112. 2.20E-08 MANVC271 MANVC411 MANVCW12 MDP12 113. 2.45E-07 MANVCW12 MOV27 MOV333 MOV335 114. 4.41E-08 CWU1 MANVC271 MANVC412 MOP 12 115. 4.41E-08 CWU1 MANVC271 MANVC411 MOV27 116. 4.41E-08 CWU1 MANVC271 MANVC411 MDP12 117. 4.90E-07 CWU1 MOV27 MOV333 MOV335 118. 3.43E-07 MOV16 MOV17 MOV27 MOV335 119. 1.32E-08 MANVC411 MANVC412 MOV264 MOV27 120. 1.32E-08 MANVC271 MANVC411 MOV264 MOV27 O
V Page 422 of 453
- -. . . _ _ _ - ,y.. -
121. 3.09E-08 MANVC411 MANVC412 MOV27 TDP11 < 122. 3.09E-08 MANVC271 MANVC411 MOV27 TDP11 123. 6.30E-08 MOV238 MOV239 MOV27 M0V335 124. 2.10E-07 MANVA122 MOV238 MOV27 MOV335 125. 1.47E-07 MOV238 MOV243 MOV27 MOV335 126. 2.10E-07 MANVA121 M0V25 MOV333 MOV382 127. 2.10E-07 MANVA121 MOV239 MOV27 MOV335 128. 1.47E-07 MOV242 MOV25 M0V333 M0V382 129. 1.47E-07 MOV239 MOV242 MOV27 MOV335 130. 3.09E-08 MANVC271 MANVC412 MOV25 MOV27 M0 V335 131. 3.09E-08 MANVC411 MANVC412 MOV25 MOV27 M0 V333 O1ST MOMENT = 1.9626E-02 , 1.5 Sources of Basic Event Values The majority of the basic event values were taken from Table III-2 of NUREG-0611. The basic events with values that were not taken from NUREG-0611 are listed below along with the value used and it's source. CST 11 4.8E-06 Delian Corp. generic number CST 21 4.8E-06 CST'22 4.8E-06 CWUI 1.0E-02 Engineering Judgement W CWU2 1.0E-02 PPROT11 1.0E-09 Assigned epsilon value bec~ause these basic events should not PPROT12 1.0E-09 be in this model since the pump protective switches were RESTRT11 1.0E-09 installed later (they are included in the post-TMI model). RESTRT12 1.0E-09 The low value essentially removes them from the model. 1.6 Summary of Results The results for each of the three initiating events evaluated in NUREG-0611 is summarized in a section below. 1.6.1 Loss of Main Feedwater The unreliability of the AFW system determined by our analysis for this event is 3.4E-03. This compares favoribly with the value, determined by the NRC in NUREG0611, of 1E-03. From this it is concluded that we have developed a good understanding of the approach used in NUREG-0611 and can use these same methods for licensing calculations. As was stated in the Prairie Island specific section of NUREG-0611, the dominant failure mode of the AFW system for this transient is the blockage of flow to the two steam generators due to inadvertant closure of two manual valves ( AF-12-1 and AF-12-2) in the pump discharge lines inside containment. The probability assigned to this event, 3E-03, is taken from Table III-2 in the NUREG and pertains to common cause events due to human error. Due to the high probability of this event and its location in the fault tree, it alone brings the AFW system outside the high range of reliability defined in the NUREG. Page 423 of 453
i The next eight _ largest contributors are listed belcw along with their probabilities. 1.00E-04 Valves AF-12-1 and AF-12-2 fault, or are inadvertantly left in the closed position. This probability is for uncoupled events. The probability of a coupled failure of these valves was the dominant failure mode described above. 7.00E-05 Valves AF-12-2 and MV-32242 fault. 7.00E-05 Valves AF-12-1 and MV-32243 fault. 4.90E-05 Valves MV-32242 and MV-32243 fault. 4.90E-05 #11 and #12 AFW pumps fault. 2.10E-05 #12 AFW pump and valve MV-32264 fault. 1.47E-05 #12 AFW pump and valve AF-13-3 fault. 1.47E-05 #11 AFW pump and valve AF-13-4 fault. 1.6.2 Loss of Offsite power - Diesel Generators Operate l l .This transient is the same as the above transient when analyzed using the NUREG-0611 approach. All components included in this model that require AC power receive it from the diesel generators. $1nce this event assumes the ( s diesel generators operate properly ,it doesn't matter whether the components are
- operated with offsite power or the diesel generators.
1.6.3 Station Blackout In this transient only DC power is available which reduces the AFW system to one steam-driven pump train. The AFW system unavailability associated with this L event is 2E-02. The four largest contributors to this unavailiblity (given that t the motor driven train has failed due to loss of AC) are failure of the #11 AFW pump, or failure of valve MV-32264 (turbine steam inlet valve), or failure of valve AF-13-3 or the failure of both valve MV-32025 and valve MV-32333, 2.0 POST-TMI - l l The models described in this section represent conditions at the plant after l changes were made for NUREG-0737. This allows a determination of AFW system reliability to be made based on the modified plant conditions and the analysis methods of NUREG-0611. The new values of reliability can then be evaluated to see if they affect'the conclusions of NUREG-0611, 2.1 Fault Tree l The fault tree for the post-TMI situation is shown in Figure G-3. It is based on the simplified flow diagram of the Auxiliary Feedwater System given in Figure G-1 and the post-TMI conditions at the plant. The fault tree represents the i l CD Page 424 of 453
2.2 WAMCUT Output for Loss of Feedwater Selected portions of the file produced by WAMCUT for this case have been reproduced below. Since the WAMCUT output file is normally in a 132 character per line format, any lines that were over 80 characters in length have been copied below with ' wrap-around' (two lines with the second line containing columns 81 through 132). O INPUT FAULT TREE DESCRIPTION (1) GATE NUMBER (2) GATE NAME (3) GATE TYPE (4) NUMBER OF GATES INPUT (5) NUMBER OF COMPONENTS INPUT (6) NUMBER OF EVENTS IN COM GATE TO BE CONSIDERED AT ONE TIME (7)-(14) NAMES OF THE INPUTS (1) (2) (3) (4) (5) (6) (7) (8) (9) (10) (11) (12) (13) (14) 1 IFLOWMFW AND 2 0 0 IFLOW11 IFLOW12 2 IFLOW11 OR 1 3 0 IAFWSG11 MANVA121 CHKVA161 M0V242 3 IAFWSG11 AND 2 0 0 111SG11 112SG11 4 111SG11 OR 1 2 0 TRAIN 11 MOV238 CHKVA151 5 TRAIN 11 OR 2 2 0 ISUCTN11 IPF11 MANVA133 CHKVA1 59 6 ISUCTN11 AND 2 0 0 ICW11 ICST11 7 ICW11 OR 0 5 0 MOV25 MANVCW12 CWU1 PPROTI 1 RESTRT11 8 ICST11 OR 1 2 0 IFCST11 CHKVA141 MOV333 9 IFCST11 AND 2 0 0 IFT11P11 IF2TP11 10 IFT11P11 OR 0 2 0 MANVC271 CST 11 11 IF2TP11 OR 1 2 0 ICST2122 MANVC412 MANVC411 12 ICST2122 AND 2 0 0 IFLCST21 IFLCST22 13 IFLCST21 OR 0 2 0 MANV2C71 CST 21 14 IFLCST22 OR 0 2 0 MANVC541 CST 22 15 IPF11 OR 1 1 0 ISF11 TOP 11 16 ISF11 OR 1 1 0 ISFU1 M0V264 17 ISFU1 AND 2 0 0 ISFSG11 ISFSG12 18 ISFSG11 OR 0 2 0 CHKVR152 MOV16 19 ISFSG12 OR 0 2 0 CHKVR151 MOV17 20 1125G11 OR 1 2 0 IFLOWMTA MOV381 CHKVA153 21 TRAIN 12 OR 2 3 0 ISUCTN12 OIV12U2 MANVA134 CHKVA5 10 MDP12 22 ISUCTN12 AND 2 0 0 ICW12 ICST12 23 ICW12 OR 0 5 0 MOV27 MANVCW11 CWU2 PPROT1 O Page 425 of 453
p 2 RESTRT12 24 ICST12 OR 1 2 0 IFCST12 CHKVA143 M0V335 25 IFCST12 AND 2 0 0 IFT11P12 IF2TP12 26 IFT11P12 OR 0 3 0 MANVC412 MANVC271 CST 11 27 IF2TP12 OR 1 1 0 ICST2122 MANVC411 28 IFLOW12 OR 1 3 0 IAFWSG12 MANVA122 CHKVA162 M0V243 29 IAFWSG12 AND 2 0 0 111SG12 112SG12 '
'30 I11SG12 OR 1 2 0 TRAIN 11 MOV239 CHKVA152 31 112SG12 OR 1 2 0 IFLOWMTA MOV382 CHKVA154 32 TRAIN 21 OR 1 6 0 ISUCTN21 DIV21U2 MANV2A31 MANVA1 31 MANVA135 CHKVA511 MDP21 33 ISUCTN21 AND 2 0 0 ICST21 ICW21 34 ICST21 OR 1 2 0 IFCST11 CHKVA145 M0V336 35 ICW21 OR 0 5 0 MOV26 MANVCW12 CWU1 PPROT2 1 RESTRT21 .
36 IFLOWMTA AND 2 0 0 TRAIN 12 TRAIN 21 37 DIV1202 AND 0 2 0 MANVXCON MOVOIV 0 INPUT COMPONENT LIST (1) COMPONENT NUMBER (2) COMPONENT NAME (3) FIRST MOMENT OF COMPONENT UNAVAILABILITY (4) SECOND MOMENT OF COMPONENT UNAVAILABILITY (1) (2) (3) (4) .p) s 1 CHKVA141 0.100000E-03 0.000000E+00 2 CHKVA143 0.100000E-03 0.000000E+00 , 3 CHKVA145 0.100000E-03 0.000000E+00 4 CHKVA151 0.100000E-03 0.000000E+00 5 CHKVA152 0.100000E-03 0.000000E+00 6 CHKVA153 0.100000E-03 0.000000E+00 7 CHKVA154 0.100000E-03 0.000000E+00 8 CHKVA159 0.100000E-03 0.000000E+00 9 CHKVA161 0.100000E-03 0.000000E+00 10 CHKVA162 0.100000E-03 0.000000E+00 11 CHKVA510 0.100000E-03 0.000000E+00 12 CHKVA511 0.100000E-03 0.000000E+00 13 CHKVR151 0.100000E-03 0.000000E+00 14 CHKVR152 0.100000E-03 0.000000E+00 15 CST 11 0.480000E-05 0.000000E+00 16 CST 21 0.480000E-05 0.000000E+C0 17 CST 22 0.480000E-05 0.000000E+00 18 CWU1 0.100000E-01 0.000000E+00 19 CWU2 0.100000E-01 0.000000E+00 20 01V21U2 0.100000E-02 0.000000E+00 21 MANV2A31 0.100000E-02 0.000000E+00 22 MANV2C71 0.210000E-02 0.000000E+00
- 23. MANVA121 0.100000E-03 0.000000E+00 24 MANVA122 0.100000E-03 0.000000E+00 25 MANVA131 0.100000E-02 0.000000E+00 26 MANVA133 0.210000E-02 0.000000E+00 (n) 27 MANVA134 28 MANVA135 0.210000E-02 0.2100002-02 0.000000E+00 0.000000E+00 Page 426 of 453
29 MANVC271 0.210000E-02 0.000000E+00 - 30 MANVC411 0.210000E-02 0.000000E+00 31 MANVC412 0.210000E-02 0.000000E+00 32 MANVC541 0.210000E-02 0.000000E+00 33 MANVCW11 0.500000E-02 0.000000E+00 34 MANVCW12 0.500000E-02 0.000000E+00 35 MANVXCON 0.100000E-06 0.000000E+00 36 MDP12 0.700000E-02 0.000000E+00 37 MDP21 0.700000E-02 0.000000E+00 38 MOV16 0.700000E-02 0.000000E+00 39 MOV17 0.700000E-02 0.000000E+00 40 M0V238 0.300000E-02 0.000000E+00 41 MOV239 0.300000E-02 0.000000E+00 42 MOV242 0.700000E-02 0.000000E+00 43 MOV243 0.700000E-02 0.000000E+00 44 M0V25 0.700000E-02 0.000000E+00 45 MOV26 0.700000E-02 0.000000E+00 46 MOV264 0.210000E-02 0.000000E+00 47 MOV27 0.700000E-02 0.000000E+00 48 MOV333 0.700000E-02 0.000000E+00 49 M0V335 0.700000E-02 0.000000E+00 50 MOV336 0.700000E-02 0.000000E+00 51 MOV381 0.300000E-02 0.000000E+00 52 MOV382 0.300000E-02 0.000000E+00 53 MOVDIV 0.100000E-02 0.000000E+00 54 PPROT11 0.500000E-02 0.000000E+00 55 PPROT12 0.500000E-02 0.000000E+30 56 PPROT21 0.500000E-02 0.000000E+00 57 RESTRT11 0.100000E-02 0.000000E+00 58 RESTRT12 0.100000E-02 0.000000E+00 59 RESTRT21 0.100000E-02 0.000000E+00 60 TDP11 0.700000E-02 0.000000E+00 CUT SETS FOR GATE IFLOWMFW ORDERED BY PROBABILITY
- 1. 4.90E-05 MOV242 MOV243
- 2. 7.00E-07 CHKVA162 MOV242
- 3. 7.00E-07 MANVA122 40V242
- 4. 7.00E-07 CHKVA161 MOV243
- 5. 7.00E-07 MANVA121 MOV243
- 6. 3.43E-07 MOP 12 MOP 21 TOP 11
- 7. 1.47E-07 MOV242 M0V382 TOP 11
- 8. 1.47E-07 MOV243 MOV381 TDP11
- 9. 1.03E-07 MANVA133 MOP 12 MDP21
- 10. 1.03E-07 MANVA135 MOP 12 TDP11
- 11. 1.03E-07 MANVA134 MOP 21 TDP11
- 12. 1.03E-07 MOP 12 MDP21 MOV264
- 13. 6.30E-08 MOV239 MOV242 M0V382
- 14. 6.30E-08 MOV238 MOV243 MOV381
- 15. 6.30E-08 MOV381 MOV382 TDP11 O
Page 427 of 453
f- s 16. 4.90E-08 MANVA131 MDP12 TOP 11 ('- ') 17. 4.90E-08 MANV2A31 MOP 12 TOP 11
- 18. 4.90E-08 OIV2102 MOP 12 TOP 11
- 19. 4.41E-08 MANVA133 M0V242 MOV382
- 20. 4.41E-08 M0V242 M0V264 M0V382
- 21. 4.41E-08 MANVA133 M0V243 M0V381 ,
- 22. 4.41E-08 MOV243 M0V264 MOV381
- 23. 3.09E-08 MANVA133 MANVA135 MOP 12
- 24. 3.09E-08 MANVA133 MANVA134 MOP 21
- 25. 3.09E-08 MANVA135 MOP 12 MOV264
- 26. 3.09E-08 MANVA134 MOP 21 MOV264
- 27. 3.09E-08 MANVA134 MANVA135 TOP 11
- 28. 1.89E-08 MANVA133 MOV381 MOV382
- 29. 1.89E-08 M0V264 MOV381 MOV382
- 30. 1.47E-08 MANVA131 MANVA133 MOP 12
- 31. 1.47E-08 MANV2A31 MANVA133 MOP 12
- 32. 1.47E-08 DIV2102 MANVA133 MOP 12
- 33. 1.47E-08 MANVA131 MOP 12 MOV264
- 34. 1.47E-08 MANV2A31 MOP 12 MOV264
- 35. 1.47E-08 DIV21U2 MOP 12 MOV264
- 36. 1.47E-08 MANVA131 MANVA134 TOP 11 37, 1.47E-08 MANV2A31 MANVA134 TOP 11
- 38. 1.47E-08 OIV21U2 MANVA134 TOP 11
- 39. 1.00E-08 CHKVA161 CHKVA162
- 40. 1.00E-08 CHKVA161 MANVA122
- 41. 1.00E-08 CHKVA162 MANVA121 n
v
- 42. 1.00E-08 O1ST MCMENT = 5.3725E-05 MANVA121 MANVA122 2.3 WAMCUT Output for Station Blackout The only difference in the input for this case and the previous one is that the values for five of the basic events have been changed. The probability of failure for MOP 12, MOP 21, MOV25, MOV26, and MOV27 has been increased to one since they require AC power for operation. For this reason only the Cutsets have been reproduced below. The logic and basic event values can be cbtained from the case above.
CUT SETS FOR GATE IFLOWMFW WITH PROBADILITY .GE. 1.00E-08
- 1. 1.00E-08 MANVA121 MANVA122
- 2. 1.00E-08 CHKVA162 MANVA121
- 3. 7.00E-07 MANVA121 M0V243
- 4. 1.00E-08 CHKVA161 MANVA122
- 5. 1.00E-08 CHKVA161 CHKVA162
- 6. 7.00E-07 CHKVA161 MOV243
- 7. 7.00E-07 MANVA122 MOV242
- 8. 7.00E-07 CHKVA162 MOV242
- 9. 4.90E-05 MOV242 MOV243
- 10. 4.41E-06 MANVA134 MDP21 M0V264
- 11. 2.10E-07 CHKVA510 MOP 21 MOV264
- 12. 2.10E-06 DIV21U2 MOP 12 MOV264
- 13. 2.10E-06 MANV2A31 MOP 12 MOV264
- 14. 2.10E-06 MANVA131 MOP 12 MOV264
~ 15. 4.41E-06 MANVA135 MOP 12 MOV264 Page 428 of 453
- 16. 2.10E-07 CHKVA511 MDP12 MOV264
- 17. 2.10E-03 MCP12 MDP21 MOV264
- 18. 1.89E-08 MOV264 MOV381 MOV382
- 19. 4.41E-08 MOV243 MOV264 M0V381
- 20. 1.47E-08 DIV21U2 MANVA134 TDP11
- 21. 1.47E-08 MANV2A31 MANVA134 TDP11
- 22. 1.47E-08 MANVA131 MANVA134 TDP11
- 23. 3.09E-08 MANVA134 MANVA135 TOP 11
- 24. 1.47E-05 MANVA134 MDP21 TOP 11
- 25. 7.00E-07 CHKVA510 MDP21 TOP 11
- 26. 7.00E-06 OIV21U2 MDP12 TOP 11
- 27. 7.00E-06 MANV2A31 MDP12 TDP11
- 28. 7.00E-06 MANVA131 MDP12 TOP 11
- 29. 1.47E-05 MANVA135 MDP12 TOP 11
- 30. 7.00E-07 CHKVA511 MDP12 TOP 11
- 31. 7.00E-03 MOP 12 MOP 21 TOP 11
- 32. 6.30E-08 MOV381 MOV382 TDP11
- 33. 1.47E-07 MOV243 MOV381 TOP 11
- 34. 4.41E-06 MANVA133 MANVA134 MDP21
- 35. 2.10E-07 CHKVA510 MANVA133 MOP 21
- 36. 2.10E-06 OIV21U2 MANVA133 MDP12
- 37. 2.10E-06 MANV2A31 MANVA1.33 MDP12
- 38. 2.10E-06 MANVA131 MANVA133 MDP12
- 39. 4.41E-06 MANVA133 MANVA135 MOP 12
- 40. 2.10E-07 CHKVA511 MANVA133 MDP12
- 41. 2.10E-03 MANVA133 MDP12 MOP 21
- 42. 1.89E-08 MANVA133 MOV381 MOV382
- 43. 4.41E-08 MANVA133 MOV243 MOV381
- 44. 2.10E-07 CHKVA159 MANVA134 MDP21
- 45. 1.00E-08 CHKVA159 CHKVA510 MDP21
- 46. 1.00E-07 CHKVA159 DIV21U2 MDP12
- 47. 1.00E-07 CHKVA159 MANV2A31 MDP12
- 48. 1.00E-07 CHKVA159 MANVA131 MDP12
- 49. 2.10E-07 CHKVA159 MANVA135 MDP12
- 50. 1.00E-08 CHKVA159 CHKVA511 MDP12
- 51. 1.00E-04 CHKVA159 MDP12 MDP21
- 52. 6.30E-08 MOV238 MOV243 M0V381
- 53. 4.41E-08 MOV242 MOV264 MOV382
- 54. 1.47E-07 MOV242 MOV382 TOP 11
- 55. 4.41E-08 MANVA133 MOV242 M0V382
- 56. 6.30E-08 MOV239 MOV242 MOV382
- 57. 2.10E-07 CHKVA141 MANVA134 MDP21 MOV25
- 58. 1.00E-08 CHKVA141 CHKVA510 MDP21 MOV25
- 59. 1.00E-07 CHKVA141 DIV21U2 MDP12 MOV25
- 60. 1.00E-07 CHKVA141 MANV2A31 MDP12 MOV25
- 61. 1.00E-07 CHKVA141 MANVA131 MOP 12 MOV25
- 62. 2.10E-07 CHKVA141 MANVA135 MDP12 MOV25
- 63. 1.00E-08 CHKVA141 CHKVA511 MOP 12 MOV25
- 64. 1.00E-04 CHKVA141 MDP12 MDP21 M0V25
- 65. 1.47E-08 DIV21U2 MANVA134 MOV25 M0V333
- 66. 1.47E-08 MANV2A31 MANVA134 MOV25 M0V333
- 67. 1.47E-08 MANVA131 MANVA134 MOV25 M0V333
- 68. 3.09E-08 MANVA134 MANVA135 MOV25 M0V333
- 69. 1.47E-05 MANVA134 MDP21 MOV25 M0V333
- 70. 7.00E-07 CHKVA510 MDP21 MOV25 MOV333 Page 429 of 453
- 71. 7.00E-06 DIV21U2 MDP12 MOV25 M0V333
(} \m / 72. 73. 7.00E-06 7.00E-06 MANV2A31 MANVA131 MOP 12 MOP 12 MOV25 MOV25 M0V333 M0V333 74, 1.47E-05 MANVA135 MOP 12 MOV25 M0V333
- 75. 7.00E-07 CHKVA511 MOP 12 MOV25 M0V333
- 76. 7.00E-03 MDP12 MOP 21 MOV25 M0V333
- 77. 6.30E-08 MOV25 MOV333 MOV381 MOV382
- 78. 1.47E-07 MOV243 MOV25 MOV333 MOV381
- 79. 2.20E-08 MANVC271 MANVC412 MANVCW12 MDP12
- 80. 2.20E-08 MANVC271 MANVC411 MANVCW12 MOV27
- 81. 2.20E-08 MANVC271 MANVC411 MANVCW12 MOP 12
- 82. 5.00E-07 CHKVA141 MANVCW12 MOP 12 MOP 21
- 83. 7,35E-08 MANVA134 MANVCW12 MDP21 MOV333
- 84. 2.45E-07 MANVCW12 MOP 12 MOV333 MOV336
- 85. 3.50E-08 DIV21U2 MANVCW12 MOP 12 MOV333
- 86. 3.50E-08 MANV2A31 MANVCW12 MDP12 MOV333
- 87. 3.50E-08 MANVA131 MANVCW12 MDP12 MOV333
- 88. 7.35E-08 MANVA135 MANVCW12 MDP12 MOV333
- 89. 3.50E-05 MANVCW12 MOP 12 MOP 21 MOV333
- 90. 4.41E-08 CWul MANVC271 MANVC412 MOP 12
- 91. 4.41E-08 CWU1 MANVC271 MANVC411 MOV27
- 92. 4.41E-08 CWV1 MANVC271 MANVC411 MOP 12
- 93. 1.00E-06 CHKVA141 CWU1 MDP12 MOP 21
- 94. 1.47E-07 CWV1 MANVA134 MOP 21 MOV333
- 95. 4.90E-07 CWU1 MDP12 MOV333 M0V336
- 96. 7.00E-08 CWU1 DIV21U2 MOP 12 MOV333
- 97. 7.00E-08 CWU1 MANV2A31 MOP 12 MOV333 IN 98. 7.00E-08 CWU1 MANVA131 MDP12 MOV333
\_) 99. 1.47E-07 CWU1 MANVA135 MOP 12 MOV333 100. 7.00E-05 CWU1 MDP12 MDP21 MOV333 101. 5.00E-07 CHKVA141 MOP 12 MOP 21 PPROT11 102. 7.35E-08 MANVA134 MOP 21 MOV333 PPROT11 103. 3.50E-08 DIV21U2 MDP12 MOV333 PPROT11 104. 3.50E-08 MANV2A31 MOP 12 MOV333 PPROT11 105. 3.50E-08 MANVA131 MDP12 M0V333 PPROT11 106. 7.35E-08 MANVA135 MOP 12 MOV333 PPROT11 107. 3.50E-05 MOP 12 MOP 21 MOV333 PPROT11 108. 1.00E-07 CHKVA141 MOP 12 MDP21 RESTRT11 109. 1.47E-08 MANVA134 MDP21 MOV333 RESTRT11 110. 1.47E-08 MANVA135 MOP 12 MOV333 RESTRT11 111. 7.00E-06 MDP12 'MDP21 MOV333 RESTRT11 112. 1.00E-08 CHKVR151 CHKVR152 MOP 12 MDP21 113. 7.00E-07 CHKVR152 MOP 12 MOP 21 MOV17 114. 7.00E-07 CHKVR151 MOP 12 MOP 21 MOV16 115. 1.03E-07 MANVA134 MDP21 MOV16 MOV17 116. 4.90E-08 DIV21U2 MOP 12 MOV16 MOV17 117. 4.90E-08 MANV2A31 MCP12 MOV16 MOV17 118. 4.90E-08 MANVA131 MDP12 MOV16 MOV17 119. 1.03E-07 MANVA135 MDP12 MOV16 MOV17 120. 4.90E-05 MOP 12 MOP 21 M0V16 MOV17 k Page 47 of 453
121. 2.10E-07 CHKVA143 MDP21 MOV264 MOV27 122. 1.47E-08 DIV21U2 MOV264 MOV27 MOV335 123. 1.47E-08 MANV2A31 MOV264 MOV27 MOV335 124. 1.47E-08 MANVA131 MOV264 MOV27 MOV335 125. 3.09E-08 MANVA135 MOV264 MOV27 MOV335 126. 1.47E-05 MDP21 M0V264 MOV27 MOV335 127. 7.35E 08 MANVCW11 MDP21 MOV264 M0V335 128. 1.47E-07 CWU2 MDP21 MOV264 MOV335 129. 7.35E-08 MDP21 MOV264 MOV335 PPROT12 130. 1.47E-08 MDP21 MOV264 M0V335 RESTRT12 131. 3.09E-08 MANVA134 MOV26 MOV264 MOV336 132. 2.10E-07 CHKVA145 MDP12 MOV26 MOV264 133. 1.47E-05 MDP12 MOV26 MOV264 MOV336 134. 7.35E-98 MANVCW12 MDP12 MOV264 MOV336 135. 1.47E-07 CWU1 MCP12 M0V264 MOV336 136. 7.35E-08 MDP12 MOV264 MOV336 PPROT21 137. 1.47E-08 MDP12 MOV264 MOV336 RESTRT21 138. 7.00E-07 CHKVA143 MDP21 MOV27 TCP11 139. 4.90E-08 DIV21U2 MOV27 MOV335 TDP11 140. 4.90E-08 MANV2A31 MOV27 MOV335 TDP11 141, 4.90E-08 MANVA131 MOV27 MOV335 TDP11 142. 1.03E-07 MANVA135 MOV27 MOV335 TDP11 143. 4.90E-05 MDP21 MOV27 MOV335 TDP11 144. 2.45E-07 MANVCW11 MDP21 MOV335 TDP11 145. 4.90E-07 CWU2 MDP21 MOV335 TDP11 146. 2.45E-07 MDP21 MOV335 PPROT12 TDP11 147. 4.90E-08 MDP21 MOV335 RESTRT12 TDP11 148. 1.03E-07 MANVA134 MOV26 M0V336 TOP 11 149. 7.00E-07 CHKVA145 MDP12 MOV26 TDP11 150. 4.90E-05 MDP12 MOV26 MOV336 TDP11 151. 2.45E-07 MANVCW12 MDP12 MOV336 TDP11 152. 4.90E-07 CWV1 MDP12 MOV336 TDP11 153. 2.45E-07 MDP12 MOV336 PPROT21 TDP11 154 4.90E-08 MDP12 MOV336 RESTRT21 TDP11 155. 2.10E-07 CHKVA143 MANVA133 MDP21 MOV27 156. 1.47E-08 DIV21U2 MANVA133 MOV27 MOV335 157. 1.47E-08 MANV2A31 MANVA133 MOV27 MOV335 158. 1.47E-08 MANVA131 MANVA133 MOV27 MOV335 159. 3.09E-08 MANVA133 MANVA135 MOV27 MOV335 160. 1.47E-05 MANVA133 MDP21 MOV27 MOV335 161. 7.35E-08 MANVA133 MANVCW11 MDP21 M0V335 162. 1.47E-07 CWU2 MANVA133 MDP21 MOV335 163. 7.35E-08 MANVA133 M0P21 M0V335 PPROT12 164. 1.47E-08 MANVA133 MCP21 MOV335 RESTRT12 165. 3.09E-08 MANVA133 MANVA134 MOV26 MOV336 166. 2.10E-07 CHKVA145 MANVA133 MDP12 MOV26 167. 1.47E-05 MANVA133 MDP12 MOV26 MOV336 168. 7.35E-08 MANVA133 MANVCW12 MDP12 MOV336 169. 1.47E-07 CWU1 MANVA133 MDP12 MOV336 170. 7.35E-08 MANVA133 MDP12 MOV336 PPROT21 O Page 431 of 453
c'~x 171. 1.47E-08 MANVA133 MDP12 M0V336 RESTRT21 , ) 172. 1.00E-08 CHKVA143 CHKVA159 MDP21 MOV27 173. 7.00E-07 CHKVA159 MDP21 MOV27 M0V335 174. 1.00E-08 CHKVA145 CHKVA159 MDP12 MOV26 175. 7.00E-07 CHKVA159 MDP12 MOV?.5 M0V336 7 176. 1.89E-08 MANVA134 MDP21 MOV238 MOV239 / 177. 4.41E-08 MANVA134 MDP21 MOV238 MOV243 178. 2.10E-08 DIV21U2 MDP12 MOV238 MOV243 179. 2.10E-08 MANV2A31 MDP12 M0V238 MOV243 180. 2.10E-08 MANVA131 MDP12 MOV238 MOV243 181. 1.89E-08 MANVA135 MDP12 MOV238 MOV239 182. 4.41E-08 MANVA135 MDP12 MOV238 MOV243 183. 9.00E-06 MDP12 MDP21 MOV238 MOV239 184. 3.00E-07 CHKVA152 MDP12 MDP21 M0V238 185. 3.00E-07 MANVA122 MDP12 MDP21 M0V238 186. 3.00E-07 CHKVA162 MDP12 MDP21 MOV238 187. 2.10E-05 MDP12 MDP21 MOV238 MOV243 188. 3.00E-07 CHKVA151 MDP12 MDP21 MOV239 189. 1.00E-08 CHKVA151 CHKVA152 MDP12 MDP21 190. 1.00E-08 CHKVA151 MANVA122 MDP12 MDP21 191. 1.00E-08 CHKVA151 CHKVA162 MDP12 MDP21 192. 7.00E-07 CHKVA151 MDP12 MDP21 M0V243 193. 3.00E-07 MANVA121 MDP12 MDP21 MOV239 194 1.00E-08 CHKVA152 MANVA121 MDP12 MOP 21 195. 3.00E-07 CHKVA161 MDP12 MDP21 M0V239 196. 1.00E-08 CHKVA152 CHKVA161 MDP12 MDP21 197. 1.47E-07 MOV242 MOV25 MOV333 MOV382 7-)g ('- 198. 4.41E-08 MANVA134 MDP21 MOV239 MOV242 199. 2.10E-08 DIV21U2 MDP12 MOV239 MOV242 200. 2.10E-08 MANV2A31 MDP12 MOV239 MOV242 201. 2.10E-08 MANVA131 MDP12 MOV239 MOV242 202. 4.41E-08 MANVA135 MDP12 MOV239 MOV242 203.. 2.10E-05 MDP12 MDP21 MOV239 MOV242 204. 7.00E-07 CHKVA152 MDP12 MDP21 MOV242 205. 4.41E-06 MANVC271 MANVC412 MDP12 MOV25 MOV26 206. 2.20E-08 MANVC271 MANVC412 MDP12 MOV25 PPROT21 207. 4.41E-06 MANVC271 MANVC412 MDP12 MDP21 M0V25 208. 4.41E-06 MANVC271 MANVC411 MOV25 MOV26 MOV27 209. 2.20E-08 MANVC271 MANVC411 M0V25 MOV27 PPROT21 210, 4.41E-06 MANVC271 MANVC411 MDP21 MOV25 MOV27 211. 2.20E-08 MANVC271 MANVC411 MANVCW11 MOV25 MOV26 212. 2.20E-08 MANVC271 MANVC411 MANVCW11 MDP21 MOV25 213. 4.41E-08 CWU2 MANVC271 MANVC411 MOV25 MOV26 214. 4. 41E-08 CWU2 MANVC271 MANVC411 MDP21 MOV25 215, 2.20E-08 MANVC271 MANVC411 MOV25 MOV26 PPROT12 216. 2.20E-08 MANVC271 MANVC411 MDP21 MOV25 PPROT12 217. 4.41E-06 MANVC271 MANVC411 MDP12 MOV25 MOV26 218. 2.20E-08 MANVC271 MANVC411 MDP12 MOV25 PPROT21 219. 4.41E-06 MANVC271 MANVC411 MDP12 MDP21 MOV25 220. 1.31E-08 CST 11 MANVC412 MDP12 MOV25 MOV26 e O V ' Page 432 of 453
221. 1.01E-08 CST 11 MANVC412 MDP12 MDP21 MOV25 222. 1.01E-08 CST 11 MANVC411 M0V25 MOV26 MOV27 223. 1.01E-08 CST 11 MANVC411 MDP21 MOV25 MOV27 224. 1.01E-08 CST 11 MANVC411 MDP12 MOV25 MOV26 225. 1.01E-08 CST 11 MANVC411 MDP12 MDP21 MOV25 226. 1.00E-08 CHKVA141 CHKVA143 MDP21 MOV25 MOV27 227. 7.00E-07 CHKVA141 MDP21 MOV25 MOV27 MOV335 228. 1.00E-08 CHKVA141 CHKVA145 MDP12 M0V25 MOV26 229. 7.00E-07 CHKVA141 MDP12 M0V25 MOV26 MOV336 230. 7.00E-07 CHKVA143 MDP21 MOV25 MOV27 MOV333 231. 4.90E-08 DIV21U2 MOV25 MOV27 MOV333 MOV335 232. 4.90E-08 MANV2A31 MOV25 MOV27 MOV333 MOV335 233. 4.90E-08 MANVA131 MOV25 MOV27 MOV333 MOV335 234 1.03E-07 MANVA135 MOV25 MOV27 MOV333 MOV335 235. 4.90E-05 MDP21 MOV25 MOV27 MOV333 MOV335 236. 2.45E-07 MANVCW11 MDP21 MOV25 MOV333 MOV335 237. 4.90E-07 CWU2 MDP21 MOV25 MOV333 MOV335 238. 2.45E-07 MDP21 M0V25 MOV333 M0V335 PPROT12 239. 4.90E-08 MDF21 MOV25 M0V333 MOV335 RESTRT12 240. 1.03E-07 MANVA134 MOV25 MOV26 MOV333 MOV336 241. 7.00E-07 CHKVA145 MDP12 MOV25 MOV26 MOV333 242. 4.90E-05 MDP12 MOV25 MOV26 MOV333 MOV336 243. 2.45E-07 MDP12 MOV25 MOV333 M0V336 PPROT21 244. 4.90E-08 MDP12 M0V25 MOV333 MOV336 RESTRT21 245. 2.45E-07 MANVCW12 MDP21 MOV27 M0V333 MOV335 246. 4.90E-07 CWU1 MDP21 MOV27 MOV333 MOV335 247. 2.20E-08 MANVC271 MANVC412 MDP12 MOV26 PPROT11 248. 2.20E-08 MANVC271 MANVC412 MDP12 MDP21 PPROTIl 249. 2.20E-08 MANVC271 MANVC411 MOV26 MOV27 PPROT11 250. 2.20E-08 MANVC271 MANVC411 MOP 21 MOV27 PPROT11 251. 2.20E-08 MANVC271 MANVC411 MDP12 MOV26 PPROT11 252. 2.20E-08 MANVC271 MANVC411 MDP12 MDP21 PPROT11 253. 2.45E-07 MDP21 MOV27 MOV333 MOV335 PPROT11 254. 2.45E-07 MDP12 MOV26 M0V333 MOV336 PPROT11 255. 4.90E-08 MDP21 MOV27 MOV333 MOV335 RESTRT11 256. 4.90E-08 MDP12 MOV26 MOV333 MOV336 RESTRT11 257. 3.43E-07 MDP21 MOV16 MOV17 MOV27 MOV?35 258. 3.43E-G7 MDP12 MOV16 MOV17 MOV26 MOV336 259. 1.03E-07 MOV26 MOV264 MOV27 M0V335 M0V336 260. 3.09E-08 MANVC411 MANVC412 MDP21 MOV27 TOP 11 261. 3.09E-08 MANVC271 MANVC411 MOV26 MOV27 TOP 11 262. 3.09E-08 MANVC2/1 MANVC411 MDP21 MOV27 TDP11 263. 3.43E-07 MOV26 MOV27 MOV335 MOV336 TDP11 264 3.09E-08 MANVC271 MANVC412 MDP12 MOV26 TDP11 265. 3.09E-08 MANVC271 MANVC411 MDP12 MOV26 TDP11 266. 1.03E-07 MANVA133 MOV26 MOV27 M0V335 MOV336 267. 6.30E-08 MDP21 MOV238 MOV239 MOV27 MOV335 268. 1.47E-07 MDP21 M0V238 MOV243 MOV27 MOV335 269. 6.30E-08 MDP12 MOV238 MOV239 MOV26 MOV336 270. 1.47E-07 MDP12 MOV238 MOV243 MOV26 M0V336 271. 1.47E-07 MCP21 MOV239 MOV242 MOV27 MOV335 272. 1.47E-07 MDP12 MOV239 MOV242 MOV26 MOV336 275. 3.09E-08 MANVC411 MANVC412 MDP21 MOV25 MOV27 MOV333 276. 3.43E-07 MOV25 MOV26 MOV27 MOV333 MOV335 MOV336 O1ST MOMENT = 1.8462E-02 Page 433 of 453
.m '2.4 Sources of Basic Event Values
'] The majority of.the basic event values were taken.from Table III-2 of NUREG-0611. The basic events with values that were not taken from NUREG-0611 are listed below along with the value used and it's source.
. CST 11- 4.8E-06 Delian Corp. generic number CST 21' 4.8E-06 CST 22 4.8E-06 CWU1 1.0E-02 Engineering Judgement CWV2~ 1.0E-02 MANVXCON 1.0E-07 Probability of both cross connects failing open assigned value of epsilon.
2.5 Summary of Results The results for each of the three initiating events evaluated in NUREG-0611 are summarized below. 2.5.1 Loss of Main Feedwater b The post-TMI changes were sufficient to bring the reliability of the AFW system up into the high range as defined in NUREG-0611. In this case, the unreliability of the system was determined to be 5.4E-05. The main reason for the increase in reliability between this model and the pre-TMI model is in the treatment of the valves inside containment. Due to the three reasons _given below, the valves no longer have human error as the dominant contribution to failure.
'V a) Double independent verification of correct valve position prior to startup.
b) After Cold Shutdown and prior to 10% power a test is performed to verify the normal flow path from the CSTs to the Steam Generators. c) Maintenance that requires closure of these valves will be conducted at less than 350 degrees (most likely at cold shutdown). .Following maintenance the test described in (b) above is required. Another reason for the higher reliability is that the Unit 2 Motor Driven AFW Pump along with the cross connect is included in this model. This would have little effect on the dominant contributors of the pre-TMI model and therefore it's value for reliability, but does have some effect on this model. The six largest contributers to the AFW systems unreliability along with their probabilities are listed below. 4.9E-05 Valves MV-32242 and MV-32243 fault 7.0E-07 Valves AF-16-2 and MV-32242 fault 7.0E-07 Valves AF-12-2 and MV-32242 fault 7.0E-07 Valves AF-16-1 and MV-32243 fault 7.0E-07 Valves AF-12-I and MV-32243 f ault 3.4E-07. #11, #12 and #21 AFW pumps fault Page 434 of 453
2.5.2 Loss of Offsite Power - Diesel Generators Goerate - Since this case is so similar to the Loss of Main Feedwater initiating event O (for the reasons described in pre-TMI discussion of this event) no further analysis was performed. 2.5.3 Station Blackout As was stated in the pre-TMI discussion of this event, only the turbine driven train can be expected to perform in this situation. There is very little improvement in reliability between this case and the pre-TMI since the changes to the system had little effect on the dominant contributors to system unreliability. The four highest probability cut sets for this case were the same as those in the pre-TMI model. Replacing the motor operated turbine steam admission valve with an air operated valve did result in a small increase in . system reliability.
3.0 REFERENCES
- 1. USNRC Report NUREG-0611, January 1980, " Generic Evaluation of Feedwater Transients and Small Break Loss-of-Coolant Accidents in Westinghouse-Designed Operating Plants".
- 2. USNRC Report NUREG-0737, November 1980, " Clarification of TMI Action Plan Requirements".
- 3. EPRI Interim Report RP 2507-1, January 1986, "WAM-E USER'S Manual."
G ~ Page 435 of 453
,l i
a,U "r Ee 6i h p'
,s 3
5 e X a, " 4
- v. ~ I g
e s g 3' a'J f
= . E E
g y o
' g
,,4 )
=
. " y r i ,
s P {
,*l 6
3 4 e 3 o
- e
,M i
g v . s . 7 g g V M'"' - 4 o t m e g e i g 3a' r 3 e, e e V'
- ' a
>-e3 g- e 3 5 g
a s C ! i P r i' g, 2 1cN Mw"# p,, s a= - e e G S ;-
! 3' t.
t 0 =N s'
~ i' ~ i,, '-
i . X d g?
. )
w" ' . e s X- n e> s6 ' M i i e t 2 l a
$/// j g -
v, <,r R "d. n r. v3 7
' s K " - I O
X-s e x. t c'. 4.- s i r e O%g3 i a y 3' g- N y w P a r t e i h X- f t 0 * ' fm oe 1 A' , Y-2 K e' n ms ay rS t
- t i 0 g ar X ) i e g u X- Dt ww a
O . v o
"di N'E S' 'T>.w*A C' 5 3
/
?
v od l e Fe 1 3)i 4 g" d ey F 13N 5 re-A
- V f3 i r e
a( 2 g ii E d M f i f a ii
" t . Nlu : ll pi mx
?'
i
?".
's s
(/ e X c.
) i u SA
. i i
G 7i a X-e g ' S e D
=
r 5> i 0 g "
' i m X' r
F "' t~ 's t 1 1
?
a e' d i f 4 3' 6 v
- G 4 i. % 3
}
$f3 a
e X \
/ D - V r
u g M i 9 5 0' F G t 4 - t' 1 3" V X-g g N
/"
A V l {I l G oudi C i l j/// ,f y iO T. 1
- " 0
- I' g "Mi X e '"
i
)
e is s - a t s
- F R
- )
a a i t t X- ' Z Z t ;
; g 5 t.w i
e
- ) - > 3
>, A 3 rn N .i 7
=N **
r&<iweui e e r e i c ; 2 i r i a g-t u 7 2 " "a "di e jW s e g = v n
=
4 g g ' V g m = M
% 'p.R yb
- 's ; g, a
& ,% a[L a J
@ ,, k- sL c L'
G REV. 0 11/14/85 FIWGJAM Afw nai .w 2NFMAT1 9 a(Rm Lett F.19ervh 11
~
l I
= = = . = = ...= -
FL.* 1 FL.= T. M 10 M 93 FL.49 ft.us 3 f I I I I I I I
, == = .= .., . now . . .c = M =n
== .. ==.. o.r - en ww n =< o , -
FautF9 FMATS Fas411 DIAers TO M 99 FM f1 FMT3 fuT3 1 RAMS 19 9 93
-J . oJ, .Jo G "'=" Jin .J,.3 .Jo Q "'"'a '
I I I I
, n.- . .n .,.= no. ..,n F1tes arW FurJat arW P1 fpths arv et fees afw F3 Dame 10 18 PS Stage 19 M 95 Stams T. M 93 Dass F. M 93 A.. . A.. . A.. . A.. .
Figure G-2 PRAIRIE ISLAND AFW SYSTEM FAULT TREE (NUREG-0611 BENCHMARK) Page 437 of 4
c ,
?
.V i
i i e g
.,. ,. n,o.
.Mhsa.W y.. ,
yy w IBMW F OfW 8
,, 3,
=..<.=. =..=.== ;
i
. i y "' , ,
J. .J, MetM ,.15. ,as 3 u ,. . 1
= rw ei . ..Stwt.'n- wa,s.w a.s33 wa,t.e a,se A
n3 H r'a b .J,
,'_.,2 i, maar.e.a.u mas' ,.
su.aes - 5 ,.im. .1 A. n
.T t I
i i Figure G-2 l (con't).. PRAIRIE ISLAND AFW SYSTEM FAULT TREE (NUREG-0611 BENCllMARK) I i ! i j Page 438 of 453 1
jA,- . " _ _ ." '". 1r= = I I
,,_,m. - = = = = =
,.es tw RPrti FN O' "I
- = - 'i f => A es e i ' '
unkrrr- eambrur 0,." : . ",:TO. 'L"n" "~' *:"ts, , ;', o " nJ.'.J.
. a%
.o ->i .
g PrWOftg K3mrts Figure G-2 (con't).. PRAIRIE ISLAND AFW SYSTEM FAULT TREE (NUREG-0611 BENCitMARK) Page 439 of 4
- t. 1 * , ,t F l- . ir
- 3 5
4 f o 0 4 - 4 e g a P
)
K R A M t i C N
. E
.Sn t B
.Ea
.Lr 1 e 1
.t 6
0 G E R nn U N I
. =a
. U,- (
. =r E
. 3, E
-W ,
a 9 3 R
- M'E we3
.s8 W -
T
.0 9#
W y I t fN s ss at 3 f T L O U
.R" s
.mFir A
.s F .
. M E
..n U.
T
-=-
I t S M =- . Y S W F
- t. A
-tm s e
t D
=e_ N s
A
-.W. p u
rs L O, S L= F I E I R I a ., U. A . l
..n R
P . t 0 . 3 . uet eS W ) L I -FM h t
- a. W=st sis h A 'n F o
( c
= 2
..n U n
G
-=-
l
=r e
. r g u i F
- i i 4 ; : ' - Il ,I' l' i' ;
i^ t1 !j -
6 7, ,
- m m.
10 ru , tg H. I I O.- .. n ..i,
= = . . .
,= n, .m. .....m.
Omv 1 0 estiv333 i i os ,W
,nm. O.ust now
.easvasAW n.s Peas
- i. n es.t i.i ef
- 3.C.1fB F191Ptt f FffP.9 I I I I
- m. '== A 4
n -- m..n m, .n . . . .n. .
.m
" oW, LJ'==n .,L. L.
i i
. - ~ < .au n n - .
Of3 CST If nom y nom I I I I
,ala .M, 'L,,
*g U u u U
- o. om . - - , . am Figure G-2 (con't).. PRAIRIE ISLAND AFW SYSTEM FAULT TREE (NUREG-0611 BENCllMARK)
G G a Page 441 of 4 y
*L
*E*. "*.,.!".
h 9 R4tet, i i e FauLFS '",-,M, I M. II H ==as J., g,,
, i i 100,151-.ItW pM M
==.4,=
ME
==.... --,M, ,O,f,,,gja,g e n e, run . v.n ran
~
~
.J.>. #... J, g =c=is I I oo< .a MtD' F998 Car .JpFLT RsC,W.u.
8 Pacer C3 $J8Ptf f 1 => p3, 1
.i . A c. pe.u..m. b _ ne.r E. ,. m, petes Ism,.
p CM W
~ , .
.,. 25 FMn FalA,3 3 p U U y U U K9mft$
MI 8M8 HEW 1, MI FFW9ftt Figure G-2 (con't).. PRAIRIE ISLAND AFW SYSTEM FAULT TREE (NUREG-0611 BENCllMARK) Page 442 of 453
f [p Fees tff SFPLY f 3 ItSTIS i i
== .. i n. ..
WRg as43 Fatas M C315 944 335 FAULTS 10 PUbF $3 FMIS Oerv 143 b INI 33 9 i DIADEOU44 FLOW BEADfSJ44 RM Pno.d 437 31 racas met 3 10 PJer II CTf3 79 Pur of h ') FTitPit )FTW11 , I I f I i a a- - a< c " . R nw l =,4 :
=,.= ern r== , ,e, . c, . n a=
U U U. - c U. -. 6.\. P FigureG-2(con't).. PRAIRIE ISLAND AFW SYSTEM FAULT TREE (NUREG-0611 BENCliMARK) Page 443 of 4
, ..y T p. f g 4 i i ( I. .,a= n ' pitsu
.arv
. .pg h 3 919513 i
i i i e.- - .
- c. <== =f, ,'," == ;;" ~
=#= f.=
e. i, t i i i t f Be,aM.W. s a= R,ee h 9 fett.43 i i _ l , , , , , , - , ,= = . == .
,,,,,, sants raia no u u
.9W358 98149
.h I
1 i i i Figure G- 2 (con' t). . PRAIRIE ISLAND AFW SYSTEM FAULT TREE (NUREG-0611 BENCHMARK) _Page 444 of 453
eD ,% O M/25/te BIMIRJAE MT FUM TO SWAss GENERATORS 11419 AFWN LDSS F WW_ l I
,,--1.A,. --i.-
FUM 10 FLOW 10 Se 11 30 12 ftOutt flouit I I I I I I I IW4WL OftM tsoftR W SUS tRJA1E FLOW IIApeJAL Ofot es01tst y 34ADE1NAY fum VEW Aiet vuw 242 rios Mw VRW A122 VALE Atts vn W 243 FMas WW VAW A121 FALET3 FMETE FAIATS DIAINS TO 3G tt FAIAT3 FMETS FAliTS h1 TO M 19 RWry 121 Ooty 1M
' teANY 122 09tV 198 esuv243 I
WOV142 I I I I DeacrtRJA1 FLOW suarmaAE FtmW puerINAE PLes DemarouAW FLOW rios WW Pt FMas ArW P2 riethe MW Pt FMas WW P2 DtAse 10 Se et liuss 10 Se 11 DtAssTO SG12 Duas 10 Se it Fiqure G-3 PRAIRIE ISLAND AFW SYSTEM FAULT TREE (NUREG-0611) POST TMI BENCHMARK h h rage 445 of 4
. - , ,)
mi M/JS/W "r"="A5 7 d,, , was = sci 9..,
=== w oem A . , , , ,
WALW E3B %#LW AISI Q3 pg rAAATS FAalLYs rssAfs
,e e Is0VT3. Ogry ige I I I y 4 Sea 0faua4 AF9F nae Pi IMeduAL O.EN sucto rALS TO DrWLir 'pLW A133 14LE AtM n nse ePW ci === rom, run ran
.Em h
H '"' manvYin eta = = = Ar noe ci noe ci run A PG 4 J, Figure G-3 (con' t). . PRAIRIE ISLAND AFW SYSTEM FAULT TREE (NUREG-0611) POST TMI BENCllMARK Page 446 of 453
arv t e /rs/es DaActas A
=>c==.rm At arv ruur ei U aucun l I MADfGAAE SUC110pe MADfEAAE sJC1tlBd i
fifthsCW 9FFtY rRohl CST BFPLT 10 PULF 11 TO Puhr 13 I 7 ICWitI I I I wmAL mneaun ceam.e _"" ," , % ",, **,,*.,.",c' nam Atw 3.ce vuw C=3 = = rts.rnew iseT 1 FAULT 3 FAULTS tsG FAULTS recirm WW* U U U U C'~ movss enAnvewis caus pruom ersinm Figure G-3 (con't).. PRAIRIE ISLAND AFW SYSTEM FAULT TREE (NUREG-0611) POST TMI BENCHMARK Page 447 of 4
\ [h U d U j MVt et/ts/me seacNuAM SEAtf
,$, '%"4" Im1 I I samargumE SWAte FLaur feces test t .IMrIWI 4 384S' SWAnd MM3tA10sts FasATB b) W I I
- -. -=
! SWaas Ptser Swans Ptser i fpou Se et FIsons Se et h M3 h h IEF#53 I I I I
==. .,,
0
.. . = = . . . .
FaAAT5 FAIAf5 FAIAT5 Fan &M J., #. JG .,3,
; Figure G-3 (con' t). . PRAIRIE ISLAND AFW SYSTEM FAULT TREE (NUREG-0611) POST TMI BENCitMARK Page 448 of 453
4 f o 9 K 4 R 4 A e M g iM n a 1 l l a
@vSI
=/ acn 1 4
UCV C N P u.Wu I S . A f up E m v(Ar g B I M N 2 U2 T T
=
r S C T S s : r S O uT oS5 Pa 1 7 m e P 3 tC/ s r 4W t
&33 3T 21 1
cs 3 m A C J Wn r ) 1 t N EWA L "m i E fP Aes - ct Uca I EF 1 r 1 T F l EMF A m i ueu et t P cgrwa p A tWu p0c A 1 6 tW r s g g =t ce0 A e 1 v bP 0 eW - sF t G e
"E S UC E
R
.,E W
f f A M U N U ' ( E
=0un A
u,. E
, a r } R nm { T
=tn
=rC o
T L
. . U o, i n
F NS1
- N 1 A Wn e
- UT2 F u
s n.e A.a u.M o= e. 1 UT2S/ F M AMra J GsM En Dos C1 1 0 O r d,, Tf l a t e t e s
' C S
M E T S Ai1 Aoi Y w
. Mf I J Ws Ef I
S
)l Et u n Dpc A t W Mf F A
M A.3,
, Af[,g .. *"n U2 C D N
E VE d A A L
'" M S I
" )
UTI
"*,, S C E I
t i R t n 1 rt i I 12 i t u1/ r T F A C t5 ni Y1 1 R 0 Af Yv mT CP P i I A fWa OLA F m us a onoM d W o c W cFO A T M ) n r s M t cr 7 Wu UW ff 'n Lr A A M o W c ( 3 G e r u g i F
G is i ,sa
- m V, , t 2
[' < t 8 5 2 3 til I g to li g 2 lIl al 5 i E
*h8' a
_ "._Ii 3 -I>5 g- E 3[ -
$ E Ik U llt I 1
E 1.- K u, E 5 b- I{l ,, 8
{ a 311 $
ki _ al di m j l IB ,]-i 5 Il e- l'-i & {gI 'l il t ta ;i 0_ i e l il e "g lla e w ah } "E it- < e a
<di m
~
I! di- l$ ' g - e j
- ~
ta - I $
=
3
-c
'?
e x a be c C O - f'x$k k
~
III 3g
- = m /ns A maormsAM suC100ss g ritete Cs1 surriv
- - ' =
P. . h M3 i ' OEOt peactoWAR rup. mefest GP wsLW A343 waLW 3M rautn ritchs DE C,313 m nae 2 run cerv 143 b N3 estwsyg i i
.sancua= cto. aorma= rum.
F1 tons CST 11 FIN 3bs ISGT 2 10 PUMP 12 CSTS TD Pube 12 F11tPl2 F11P12 h I I I l 1 massuat euerauAu wasesat manuat rupe waLW C4I2 WALW C273 rautn vsLW
, ,,C,es en ,,rac,es rautn run CS 1 thasfVC4t1 mAffWC4l2
- r. .
Figure G-3 (con't).. PRAIRIE ISLAND AFW SYSTEM FAULT TREE (NUREG-0611) POST TMI BENCHMARK Page 451 of 4
O v mmm , f seera= = ns. FItend AFW p1
,, inass le so 13 h 3 Mis 00t t
4
, i i ,,, meia e over
,,,,i,,,,,,, = = = == .in run run u u IDOW3M oElwlm PS 2 i
.ia.F = n 4 FIISII AFT @3 g, WhaNI 19 M 12 j H a==
l I I AFW IItass3 toevet y gget d en en = = = == u FM13 Faul13 Pal &TB i
- u u IsOW333 WerW194 Pc e i Figure G-3 (con't).. PRAIRIE ISLAND AFW SYSTEM FAULT TREE (NUREG-0611) POST TMI BENCitMARK I
I r Page 452 of 453
i i
,s O
e2/ts/es A uw wm far w run ra e 11 TAM 21 I I I I I I I MAfRIAL esAMUAL MANUAL l OEm MOTOR-OfEWN WADESJAE "*""*" vAtw 3Asi vaw Assi v m Aiss vAtw Asn uw ruur m sucnow ran " "' 8 rAuta rAutn run rAutn ran uw ruur m asANVA131 NANY 135 OuvASit Wor 21 2 I I seAcfouATE esA0ftRJATE SJCBON F1Mhl SJCTIGf FP0tl CW SPFLY CST 3.lertY H icwri @ osm voib er . At suorAAx orm^'c act$'" iss Om uns er B.Accada eto= vAtw a va Cwi2 coau e =Aun g,'m",",,,', y'" va w A1.s vAtw su rnow >< Cm rAutn run rame =T 1 g,7,m,ouc,,to
,, ,, ,,,,,cy , run run m rw m u u u u u u u /\
isovre MANYCwit twLrt r7tt0T21 sq[sttT!t O WVAs45 esov13e /lA PC S , figure G-3 (con't).. PRAIRIE ISLAND AFW SYSTEM FAULT TREE (NUREG-0611) POST TMI BENCHMARK
.Page 453 of 4}}