ML20235Z180

Rev 2 to Pennsylvania Power & Light Co Approach to Risk Mgt & Risk Assessment

ML20235Z180
Person / Time
Site:	Susquehanna
Issue date:	01/31/1989
From:	Hill P, Kukielka C PENNSYLVANIA POWER & LIGHT CO.
To:
Shared Package
ML18040B241	List: ML20235Z180
References
NPE-89-001, NPE-89-001-R02, NPE-89-1, NPE-89-1-R2, NUDOCS 8903150245
Download: ML20235Z180 (430)

Text

--- -----

Nuclear Plant ENGINEERING 1 .

g Technical Report i

no.

N PE-89-001 The PP&L Approach To Risk Management And Risk Assessment

. (Second Revision) l

i. January 1989 s

PENNSYLVANIA POWER & LIGHT COMPANY

<pruas.

n,c

THE PP&L APPROACH TO

~

RISK MANAGEMENT AND RISK ASSESSMENT P. R. HILL C. A. KUKIELKA SECOND REVISION JANUARY 1989 i

APPROVED BY:

J. EFANK MA ER-NUCL FUELS & SYSTEMS ENGINEERING l

DISCLAIMER 1

The material presented here represents the current status of work in progress at PP&L as of August 1988 to address resolution of the severe accident issue.

Not all.of this material has been formally adopted by PPEL management at this

. time for application to. management of risk at Susquehanna. The material-

.should be considered only to represent current technical efforts at PP&L to resolve the issue of adequacy against the occurrence of severe accidents at Susquehanna. The material is only intended to represent an approach being-considered for applicability to Susquehanna.

The material contained in this document is intended for infomation purposes

-only. PP&L will not be responsible for use of this information for application or reference by any other organization, i

1

I I-s Table of Contents Acknowledgements iii Preface v Preface to the Revision . ix Preface to the Second Revision x Introduction 1 The PP&L Approach to Risk Assessment 9 An Overview of the PP&L Risk Analysis Process 59 t:

Initiating Events 109 Event Tree Construction and Success Criteria 123 Accident Sequence Quantification 193 organization of Results 247

- An IPE Application 253 Human Error in Risk Assessment 267 Conventional PRA Conservatism 305 Categories of Uncertainty 219 Sununary 339 Appendix 1 349 Eric Haskin Decay Heat Table Appendix 2 353 Shutdown Make Up Flow Requirements Appendix 3 357 BWR Volumes and Masses

- Appendix 4 363 Simplified Depressurization Calculation Appendix 5 367 Useful FSAR Data Appendix 6 377 Plant Damage State Dispositioning With Equipment Recovery i

i

Appendix ' 383 Offsite AC Power Recovery Table Appendix 8 397 FP&L Definitions Appendix 9 . 407 Discussion of Assumption 6 Appendix 10 411 Treatment of External Events l

ii

Acknewledeements The material presented in this document represents the work of several individuals other than the authors. In particular Mike Carr, Chris Boschetti, Jim Harven, Jack Refling, and Shahin Seyedhesseini are responsible for many cf the calculations and studies which are the basis for the material presented.

The efforts of Paul Wasson, Tim Hill, and Dennis Raudenbusch of the Engineering and Scientific Systems Programming Section have been invaluable in bringing BWRSAR to operational status and in developing the Risk Analysis Program described in this document. It is equally important to note that PP&L management has provided an environment which encourages and expects performance of the work presented here. In the chain of command involved are Mike Detamore, Jerry Stefanko, Chuck Myers, and Harry Keiser.

We have also benefitted greatly from the assistance from the NRC, Tom Walker, and ORNL, Steve Hodge, and their associates in helping us bring the BWRSAR program to full operational status at PP&L and in assisting us in mastering and interpreting its many intricacies. This program has had a major influence on our risk assessment work.

Finally, the credit for preparation of this document must go to our clerical staff, Evelyn Lugo and Lisa Jacoby.

l iii

sk '

e O

9 iv

Preface In early 1988 PP&L volunteered to present a seminar on the PPsL approach to ,

performance of the Susquehanna Individual Plant Evaluat:en to the Boiling t

Water Reactor owners Group. This offer was accep.ted by A. R. Diederick, Chairman of the Risk Assessment Issues Committee, and through the efforts of Rick-Hill of the General Electric Company arrangements were made for an Individual- Plant Evaluation Seminar in August 1988.

The intent of this document is to provide a written version of the presentations which have been prepared. Since the topics to be covered are rather complex, we anticipate that retention of the presentation material will be incomplete and temporary at best. The document is intended to preserve the presentations made for future reference.

The document has been prepared during a period of intense activity in the risk analysis and risk management areas at PP&L. Major activities which are in various stages of planning or completion are:

1. completion of a defense-in-depth evaluation based on the initial Susquehanna IPE,

2. incorporation of Revision 4 of the BWROG Emergency Procedure Guidelines into the Susquehanna EOPs,

3. revision 1 of the Susquehanna IPE,

4. a formalization of the PP&L approach to IPE execution and creation of a computer program to perform the analysis,

5. adoption of the BWRSAR program for accident progression analysis, l

6. procurement and adoption of the CONTAIN program for analysis of containment performance in severe accidents.

7. recommendations for formalization of the risk management process at PP&L.

8.. recommendations for resolution for outstanding severe accident issues for Susquehanna.

This situation has presented us with several problems in the preparation of the presentations. The fundamental issue here has been:

"Shall we present only information based on what we have actually completed, or shall we present our latest thinkir.g and methods which have not yet seen full application?"

We have opted for the latter course in preparing this presentation. We have done so because we believe that otherwise much of the broader view of risk assessment and its value which have been developed at PP&L over the past 3 years would be lost.

I v

'e The implication of this approach is that muen af wnat will ce presented is net actually* solidly in place at PP&L at this time, and the actual results presented are based on our original :PE work. This will cause some confusion because the original IPE work, for example, was based on MAAP for accident progression analysis and success criteria obtained from the IDCCR contractors.

Presently, we are using the BWRSAR program for this purpose and our new success criteria lead to significantly different results. We have not yet developed in-house experience at the use of CONTAIN, but we anticipate significant changes in the success criteria relating to containment performance as well.

We, nevertheless, believe that the risk of confusion must be accepted in return for presenting what we believe is a much more comprehensive view of the risk analysis process. At this time we are reasonably confident that the above activities which are not yet complete will be successful and that our current view of the expected results are fairly accurate.

The following cautions are nevertheless offered to those who choose to study this material.

1. Our current view of the success rate at saving the reactor vessel is much more favorable than presented in the Susquehanna IPE (N99% vs.

70%).

2. The dispositioning of the final' containment status is more complex due to a greater ganeration of noncondensible gases by accident processes.

3. The PP&L position on wetwell venting has not yet been resolved.

4. We face a potential for taking additional exceptions to the BWROG EPGs, particularly with regard to suppression pool mass addition.

5. We have not yet developed a comprehensive set of success criteria for the containment. This must await our installation of the CONTAIN program at PP&L.

6. In our IPE revision there will be a great proliferation of support states. While we do not expect any radical change in our results because of this, we cannot be certain of this. 1 In spite of these rather major cautions we believe the material in this presentation is worthwhile. The material which we feel has enduring value regardless of the cautions above are:

1. the concept of and approach to risk management,

2. the definition of the role played by Emergency Operating Procedures in the risk management process,

3. the treatment of human response in the control room,

4. the conventional PRA conservatism and their influence, and

5. the PP&L approach to application of the support state method of risk analysis.

vi

t i

We reali:e snat the : pinions and talue ;udgements presented here are uni:ne;y applicaole only o PPSL and that indiscriminant adoption Of these riews':v another utility may be inappropriate. Nevertheless, we believe there s mu:n here that could be pretitsoly exploited by others snould they choose to do so.

1 vii

vitt

Preface to the Revision Preparation of ' the original presentation inaterial uced for the *PE 'dorkshop in August 1988 suffered from lack of time for proper editing and incorporation of related.useful material. "pon completion of-the workshop we have had the time to make :he.necessary repairs to bring the document to a more acceptable level and quality.

• n this process, we have not knowingly changed the meaning or intent'of any of the original material. We have attempted to remove most of the ob:ectionaole grammatic and spelling errors and to improve the clarity of some (but probably not all) of.the discussion of the viewgraph material. We have added eight Appendices in order to remove some' material from'the main body of the document and also to provide some additional material to demonstrate the potential sources of much of the necessary data for analysis of transients.

iX

-i Preface to the Second ?evision

! The second revision.of this document incorporates new information as follows:

1

1. modifications to the equations. for calculating support systems I failure combinations to account for the influence of demand failures,

2. . a new Appendix 9 to discuss the assumption that i. outages of length I T, can be treated as a single outage of length equal to the total of 2 tne T , and g

3. a new Appendix 10 which outlines the approach to be taken to i describe external events such as flooding, fires, and seismic l i

events.

As in the first revision, numerous corrections in spelling and grammar have also been made.

At this time we have made considerable progress on the. computer program for

~

calculation of accident sequence frequencies discussed in this document. The calculation part of the program is now operational as a FORTRAN program on an IBM PS/2 machine. Our current efforts are now directed toward the creation of input and output formats and options for the calculation which will give the user some reasonable level of control over the titles and labels for the input j and output data. Upon completion of the input / output routines, the program will.be ready for trial runs and serious use. The next objective beyond this capability will be the creation of a Monte Carlo driver routine for the calculation which will permit direct propagation of a wide variety of uncertainties through the calculation.

i l

x q l

i 1

i

- - _ - _ _ - _ _ _ - - - - . _ _ . _ - - - _ _ - - . . __ __ _ _ _- _ h

i INTRODUCTION 1

i i

4

INTRODUCTION (1) 3 o PURPOSE  !

ACQUAINT OTHER BWR UTILITIES WITH OUR IPE FINDINGS DESCRIBE THE IPE PROCESS DESCRIBE HOW THE IPE METHOD CAN BE EXTENDED TO INCLUDE CONTAINMENT DESCRIBE CRITICAL MODEL ASSUMPTIONS AND THEIR IMPACT i o APPROACH SUSQUEHANNA IS A TWO UNIT BWR4 USING THE MARK II CONTAINMENT OUR APPROACH TO RESOLUTION OF SEVERE ACCIDENT ISSUES HAS SHAPED OUR APPROACH TO RISK ASSESSMENT OUR PRESENTATION WILL COVER OUR APPROACH TO RISK MANAGEMENT o RESERVATIONS WE DO NOT EXPECT OTHER UTILITIES TO ACCEPT OUR APPROACH TO RISK MANAGEMENT WHILE OUR APPROACH HAS GENERAL APPLICABILITY FOR THE BWR, THE MATERIAL PRESENTED WILL NOT COVER ALL ASPECTS OF BWR PLANTS (BWR2, MARK III)

THE PRESENTATION WILL DESCRIBE THE METHODS BEING DEVELOPED FOR THE REVISION TO THE SUSQUEHANNA IPE PPal HAS USED ACCIDENT ANALYSIS CODES NOT CURRENTLY USED BY OTHER UTILITIES 2

introduction (1)

The fundamental purpose of the PP&L presentations on the IPE is to familiar;:e other SWR utilities with the important elements of the IPE and to demonstrate the nature of the information needed to perform the IPE. In additier, PPsL has discovered that calculations of BWR plant performance in response to a severe accident is critically dependent on a moderate nwnber of modeling assumptions in the analysis. We wish to advise others of these sensitivities.

The NRC has clearly indicated that the IDCOR IPE does not go far enough into the analysis of risk and that they expect the equivalent' of a level 2 PRA treatment. PP&L believes that extension of the IPE to disposition all accident sequences to the final spectrum of plant damage states is a relatively simple extension of the methodology. We also believe that it is important to perform this extended analysis with care that conservative simplifying assumptions do not result in an improperly negative representation of containment performance.

The presentations will necessarily be made from the perspective of a BWR4, Mark II plant. To date, all PP&L analysis has been for a single unit of susquehanna. While'we believe our analysis approach is applicable to the BWR plant in general, plants having such features as no Jet pumps, isolation condensers, other ECCS networks, motor driven feed pumps, or Mark III containments, may find that the Susquehanna analysis omits features of importance in a specific plant or least requires some modeling changes for a proper. representation. We cannot address these issues in our presentations.

An important consideration in the PP&L approach to risk analysis and performance of the IPE, is the PPEL approach to risk management and severe accident management. Many of the features of the analysis may seem to be unnecessary or extreme unless the PP&L approach to severe accident issues is understood. In order to avoid logical problems we will present our approach to severe accident issues in order to provide the rationale for our approach to risk analysis.

While we clearly believe that our approach is the correct approach for PP&L, we are not so unrealistic as to expect any general level of agreement with our approach by other utilities. Nevertheless, there are some real and practical advantages to the PP&L approach to IPE Lpplementation which we believe will benefit any BWR utility which chooses to adopt it.

The very lowest level of benefit that we would expect would be that other utilities will be able to avoid the very negative assessments of BWR containment performance that conventional PRA methods yield. These negative I assessments are not a consequence of the approach to risk analysis, but are a consequence of simplifying assumptions, or sometimes deficiencies in existing Emergency Operating Procedures.

3 l

INTR 000CTION(2)

MOTIVATION o TO DEMONSTRATE THAT THE CONVENTIONAL VIEW 0F BWR RISK IS IMPROPERLY NEGATIVE.

O TO DEMONSTRATE THAT THE ROLE OF THE OPERATOR IS NOT PROPERLY UNDERST0OD.

o TO DEMONSTRATE THAT THE CAPABILITIES OF THE BWR PLANT ARE MISREPRESENTED.

o TO PERSUADE BWR UTILITIES TO BETTER UNDERSTAND THEIR VULNERABILITIES AND TO EXPLOIT THEIR OPPORTUNITIES FOR RISK REDUCTION.

EXPECTATIONS o TO ENCOURAGE A CLOSER AND MORE DEFINITIVE LOOK AT E0Ps.

o TO ENCOURAGE AVOIDANCE OF CONVENTIONAL PRA CONSERVATISM WHICH MISREPRESENT THE BWR.

o TO ENCOURAGE INCREASED OPERATOR TRAINING ON E0Ps.

110fES o TO ENCOURAGE UTILITY PROGRAMS TO MONITOR PERFORMANCE.

o TO ENCOURAGE OTHER UTILITIES TO ADOPT SOME DEGREE OF RISK MANAGEMENT.

4

introduction C' The PP&L motivation, expectations, and hepes in preparing the material to be presented here is outlined in.the viewgraph. We are aware that our approach to risk analysis differs in many important aspects from previous PRA work for the SWR plant. Further, we are aware that we have used many new analysis and .

computer models which differ greatly from those in prior usc.

We expect these differences to make adoption of much of what we have done-very difficult for many SWR utilities. Nevertheless, we believe there are many valuable. lessons to.be learned.from what we have done which can not only improve the calculated performance of other BWR plants in response to severe accident situations, but.can also result in a real reduction in the risk of severe plant damage and severe off-site consequences for those plants wnich choose to heed these lessons and respond. These improvements need not involve total acceptance of the PP&L approach.

l

\ U 1

L _ _ _______.___. _ ___._ _._ _ - - .

PRESENTATION OUTLINE i

o THE PP&L APPROACH TO RISK ASSESSMENT o AN OVERVIEW 0F THE PP&L RISK ANALYSIS PROCESS o INITIATING EVENTS o EVENT TREE CONSTRUCTION AND SUCCESS CRITERIA o ACCIDENT SEQUENCE QUANTIFICATION o ORGANIZATION OF RESULTS o AN IPE APPLICATION o HUMAN ERROR IN RISK ASSESSMENT o CONVENTIONAL PRA CONSERVATISM o CATEGORIES OF UNCERTAINTY o

SUMMARY

6

Presentat cn Outline s

The view graph presents the ma;cr topics which will be presented.

l 7

s I

1_.' i l, '

1 k

1 8

1 THE PP&L APPROACH TO RISK ASSESSMENT 1

l 9

l

FRONT-END AND BACK-END ANALYSIS FRONT END ANALYSIS.

l THE ANALYSIS USED TO DETERMINE CORE DAMAGE FREQUENCY.

AS APPLIED BY PPSL THIS ANALYSIS IS EXTENDED TO DEFINE ALL FORMS OF PLANT DAMAGE, SLIGHT TO CATASTROPHIC, OUT TO STABLE OR UNCONTROLLED PLANT CONDITIONS.

BACK END ANALYSIS.

THE ANALYSIS OF THE SPECIFIC NATURE OF LOSS OF CONTAINMENT INTEGRITY (VENTING AND TRIVIAL THROUGH CATASTROPHIC), THE DETAILS OF FISSION PRODUCT TRANSPORT PROCESSES,. AND THE NATURE OF THE OFF-SITE CONSEQUENCES OF THE FISSION PRODUCT RELEASE.

10

)

Fren*-End and Back-End Analvsis a

In probabilistic risk assessment the front-end analysis is generally considered to be only that part of the analysis which determines that plant damage, usually core damage, will occur. This portion of the analysis generally involved consideration of equipment performance and operator performance that has a relatively low level of uncertainty associated with it. s Equipment unavailability is reasonably well known, transient codes have been ,

well benchmarked (except for ATWS response), and human performance is imeeeded in tae data for initiating events and equipment unavailability. PP&L has H extended the front-end analysis to determine the extent of core damage, the status of the reactor vessel, the release of core debris to the drywell floor and the containment status.

This extension introduces new contributions to uncertainty which are considerably greater. These involves p" L

1. the core damage progression phenomena,

2. the reactor vessel failure phenomena,

3. the core debris interaction with the containment components, and

4. the containment failure mode and magnitude.

While these uncertainties are much greater, the magnitude of their contribution to overall plant damage frequency should be greatly reduced as the extent of the damage increases. This characteristic permits one to control and limit the impact of large uncertainties on the nature of the profile of plant damage derived by a probabilistic risk assessment. This extension, which avoids the even more uncertain back-end analysis phenomena, can be readily accomplished with the IPE methodology and can provide fine resolution of the potential range of plant damage states while minimizing the obscuring influence of the large uncertainties always associated with the back-end analysis.

This permits attention to be focussed on equipment and operator performance in order to optimize Emergency operating Procedures. This process tiso permits evaluation of the entire range of plant conditions to which ECPs apply without an artificial interface in the analysis process, 1

l 11

.~~

ii ii

i DEFENSE-IN-DEPTH CRITERIA J

l (FREQUENCY AND EQUIPMENT) l 0 ACCIDENT SEQUENCES HAVING HIGH CALCULATED FREQUENCIES ARE I

NOT ACCEPTABLE.

o ACCIDENT SEQUENCES HAVING THE LOW CALCULATED FREQUENCIES MUST ALSO HAVE DEFENSE-IN-DEPTH BOTH IN THE FORM 0F EQUIPMENT AND PROCEDURES. DEFENSE-IN-DEPTH IS DEFINED FOR EQUIPMENT AND PROCEDURES AS FOLLOWS:

o EQUIPMENT CORE OR CONTAINMENT DAMAGE SHALL NOT OCCUR WITHOUT MULTIPLE FAILURES OF REDUNDANT OR DIVERSE EQUIPENT.

VESSEL FAILURE SHALL NOT 0CCUR FOLLOWING CORE DAMAGE UNLESS ADDITIONAL INDEPENDENT EQUIPMENT FAILURES OCCUR.

CONTAINMENT FAILURE SHALL NOT OCCUR FOLLOWING CORE DAMAGE UNLESS ADDITIONAL INDEPENDENT EQUIPMENT FAILURES OCCUR. l CONTAINMENT FAILURE SHALL NOT OCCUR FOLLOWING VESSEL FAILURE UNLESS ADDITIONAL INDEPENDENT EQUIPMENT FAILURES OCCUR.

12

Defense-in-Decth criteria (Frequency and Equipment) l PP&L does not consider a low calculated frequency to be a sufficient indication of adequacy of our defenses against a severe accident. We attempt to insure that we have defense in depth against the occurrence of plant damage. If we can demonstrate defense in depth against all Susquehanna -

iccident sequences, we expect a very low calculated frequency of damage from ,

that sequence.

We impose the requirement for defense in depth on the basis that our estimates of initiator frequency, equipment failure rates, and, most important, our understanding of commonalities and interactions may be deficient. Use of the defense in depth concept in combination with symptom based procedures and high quality operator training in their use gives us assurance that the full ,

facilities of the plant will be utilized to avoid or minimize damage regardless of the initiator and the coincident combination of equipment failures.

For equipment we impose a requirement for three stages of equipment protection. These three stages of protection are intended to make the l likelihood of a given level of damage less as the severity of the damage level increases. The third and fourth criteria are both directed at assuring containment integrity in the event of core damage. At this time the ability to meet the fourth criterion is in diapute. IDCOR models for reactor vessel failure and core debris behavior indicate a high degree of containment protection is possible while the models of some NRC contractors, indicate a very low degree of success in containment protection. PP&L is actively pursuing this issue at present.

t' i

13

DEFENSE-IN-DEPTH CRITERIA (PROCEDURES AND INSTRUMENTATION) o PROCEDURAL NO PROCEDURE SHALL HAVE ADVERSE CONSEQUENCES IN THE CASE OF ADDITIONAL EQUIPMENT FAILURES BEYOND THOSE OCCURRING INITIALLY.

THE NECESSARY ANTICIPATORY ACTIONS SHALL BE PERFORMED TO AVOID LOSS OF ADDITIONAL EQUIPMENT BUT SHALL NOT DEGRADE THE EXISTING SITUATION.

THE NECESSARY ANTICIPATORY ACTIONS SHALL BE PERFORMED TO PERMIT SUCCESSFUL RESPONSE TO POTENTIAL ADDITIONAL FAILURES, BUT, SHALL NOT DEGRADE THE EXISTING SITUATION.

o INTERFACE THE NATURE AND TIMING 0F INFORMATION TO THE OPERATOR SHALL BE SUFFICIENT TO ASSURE TIMELY EXECUTION OF ALL APPROPRIATE PROCEDURAL STEPS.

l 14

i 1 l

l Oefense-in-Cecth Oriteria (Procedures and Instrumentation)

n the BWR plant the close coupling of systems which provide adequate core cooling and those which provide. containment heat removal requires direct consideration in the preparation of Emergency Operating Procedures (EOPs). In addition the great redundancy in the means for providing cooling water to the core also require explicit consideration if plant capability is to be fully exploited in reducing the likelihood of core damage.

Three procedural criteria are stated which minimize the likelihood of damage caused by actions taken or additional loss of equipment due to actions taken or not taken. These criteria were developed in late 1981 in the process of maximizing the coping time for Susquehanna in the event of Station Blackout.

We have since found these criteria to have a dramatic impact on reducing calculated frequency of plant damage for other initiators as well.

The EOPs are tested against these criteria by examining every accident sequence for susqueh' anna against them. While this is a tedious process, it doep provide a very thorough check of the adequacy of the EOPs.

The use of symptom based procedures imposed a heavy burden on the plant instrumentation. For this reason it is important to also investigate the actual instrumentation which will be available in the course of an accident sequence to assure that the operators will be prompted to take the necessary actions to protect the plant. Station Blackout has been found to be.the most severe event in this regard as a result of the loss of AC power. The relatively slow nature of the Station Blackout transient makes this deficiency

.less severe by allowing time for appropriate compensating actions.

15

E -  !:- =

=.

=

i 2 5 =-

s e

33!

2 -

" d,.

y , 5 k 5 2 -i 3 m x - * ::: C

= 5 E 35* --

= e *-

• a E - -

c -

=

=

?

E ga=

3 .

= 2 2 *C =*m

% = *'t 5 m ^5 s e a g sa g B w m s 3,

- , s. =

W ma

g-m=

2 E  :

= 4 5" > ta 4>2 g E s:

• :- gE

- E ew aE W"g W b a" 5s a E

S 5

v m

I m m EEt m

- o W e ag m-a a

as m-a5-wgg g w W g g8 -

w ml E #

= w w E. 5 W5 a m-m IWEN e

v O 83 5 5 Wt S 52 RIa W a

'E a a a a s a E- w j 5E t-

+

E w

N M

= *

=

v1 2 vl "I 5 a * < a 3

at

• • w E

E S W W g w

E a e

=

m W

w E

5 16 s

Potential Accident Tra7ectories There_ appears to be suen confusion over the issue of severe accident management and what cbjectives snould be set for it. The diagram en the view graph is intended to define the varicus phases which can occur in the accident sequences for a plant.

The limits on the definition for Severe Accident Management and ECP applicability are presented in the form of a time line for potential accident sequences in the view graph. 'The EOPs govern actions taken during those portions of potential accident sequences labeled AB and AC. In the case of the segment AC stabilization and control of the plant are eventually re-established by control room actions, although in some cases with varying degrees of plant damage up to, but not including, the point of containment failure. Venting could take place during the segment AC in order to avoid uncontrolled failure-of the containment. Upon reaching point C, a period begins during which recovery actions are initiated. These are actions which would re-establish long term safe conditions in the plant. In a sequence where little or no plant damage is sustained recovery could involve refurbishing as needed for continued operation of the plant. In cases, such as for TMI-2, it could involve clean up of fission products and removal of fuel in preparation for decommissioning of the plant. In all cases, the EOPs completely govern the time segment AC, but do not apply over the time period, CD. There are currently no formal programs or procedures defined for the segment CD other than the Emergency Plan. That plan, however, primarily addresses communications, evacuation, and monitoring of fission product releases.

The alternative time line, AB, represents an accident sequence where control of the plant cannot be regained by application of the EOPs, usually as a consequence of massive levels of equipment failure. In those cases containment would fail, either with or without prior core damage, and control room habitability would be lost. In cases where no core damage had occurred, the possibility of core damage resulting from consequential loss of equipment would require consideration. In such cases, it is likely that control room occupancy and reactor building access would be lost so that further actions would be initiated from outsida the control room. At the point where control room actions are no longer effective or cannot be taken, the EOPs are no longer applicable to defining the actions to be taken. Currently, we have defined the actions to be taken during the time segment BC to be coping actions. As'in the case of recovery actions, no formal programs or procedures have been defined other than the general provisions for activation of the EOF and General Office support. By the nature of the situation in such cases, a formal definition of actions to be taken to bring about stabilization and control will be difficult to develop.

The view graph then defines the time period for severe Accident Management (segments AC and AB only), and the EOPs fully define the actions to be taken during those time periods. The EOPs, therefore, are by definition the Severe Accident Management program.

17

SEVERE ACCIDENT MANAGEMENT o DEFINITIONS:

ACTIONS TAKEN TO AVOID OR MINIMIZE PLANT DAMAGE RESULTING  ;

FROM AN INITIATING EVENT AND ANY COMBINATION OF ADDITIONAL EQUIPMENT FAILURES.

o APPLICABLE TIME PERIOD:

FROM THE TIME OF THE INITIATING EVENT UNTIL THE OPERATORS ACHIEVE A LONG TERM STABLE PLANT CONDITION OR UNTIL CONTROL ROOM ACTIONS CAN NO LONGER INFLUENCE THE PLANT CONDITION.

o SOURCE OF GUIDANCE:

THE EMERGENCY OPERATING PROCEDURES AND SUPPLEMENTAL PROCEDURES REFERENCED BY THE E0Ps.

o ROLE OF RISK ASSESSMENT:

DETERMINE OPTIMAL RESPONSE STRATEGIES FOR STRUCTURING E0Ps AND THE DEGREE AND NATURE OF PLANT DAMAGE TO BE EXPECTED IN EACH ACCIDENT SEQUENCE.

i i

18

Severe Accident Manacement The view graph on Severe Accident Management (SAM). represents the PP&L view of 5AM. The important feature of this viewgraph is the statement that the ICPs are the source of guidance for SAM.

In the PP&L view, however, this is not a passive relationship. The ECPs are deliberately structured to assure optimum use of all plant capability to avoid or limit the consequences of an accident regardless of the initiating event and the number of equipment failures. The means for accomplishing this'is performance of a risk assessment which considers the actual procedures for the plant and the actual equipment capability. The results are examined to assure that all'possible plant capabilities have been utilized for all accident sequences.

Thus, the EOPs are the heart of PP&L's Severe Accident Management process.

19 I_-____-__-_____

EMERGENCY OPERATING PROCEDURES I o THE E0Ps MUST COVER ALL ACTIONS REQUIRED TO REGAIN CONTROL OF L THE PLANT AND TO STABILIZE IT.

8 o' THE E0Ps MUST BE FUNDAMENTALLY BASED ON PLANT SYMPTOMS WHICH I ARE RELIABLY INDICATED BY PLANT INSTRUMENTATION.

o THE OPTIMAL FORM FOR THE E0Ps IS A FLOW CHART FORMAT WHICH PERMITS TIMELY INDICATION OF ALL ACTIONS FOR WHICH TIME IS CRITICAL, 1 o ACTIONS WHICH ARE NOT TIME CRITICAL MAY BE REFERENCED TO l EXTERNAL SUPPLEMENTAL PROCEDURES.

o THE PROCEDURES MUST AVOID COMPLEXITIES AND AMBIGUITIES.

o THE PROCEDURES OR TRAINING MUST ADVISE THE OPERATOR OF TIME CONSTRAINTS AND PRIORITIES.

o THE ACTIONS SPECIFIED MUST BE FEASIBLE.

o THE PROCEDURES SHOULD REINFORCE BASIC OPERATOR TRAINING.

o PROCEDURES AND TRAINING FOR THEM MUST EXIST IF OPERATOR ACTION IS TO BE CONSIDERED SUCCESSFUL AND EFFECTIVE.

20

Emergency Ocerating ?rocedures This viewgraph is self explanatory and represents PP&L criteria for effective IOPs. The process'of-assuring effectiveness is not yet complete at PP&L.

-' At the present time the concepts of severe Accident Management and Risk Management and their relationship to and demands-on ECPs and ECP training are being actively addressed.

The definitions presented here-represent the Engineering perspective on.this subject.

A i

21 i

I L__________ .__ _- ___ - - - _ J

m - s i

5W = w 2m i =

$=

G 23 s<

M tk \

-< E"W 5

o sE

em w

I ka a e~

_.D u

~*

gg u

y

$E"

--=

M5 ly g U EE

== --

E

-_ N .

EO g E~- $s m g "w m W

m

=

L w

g &

1>

A >

d

> 4 w - =

5 m s W a s 5 m: 3:

E g' =*W

- 9- M a E as G5 -

=

= - .___  : - a= _ EaaE'

_E . m [E':

=

-g

- d:

<e - W SE - w 5 EmE b

w O s a w -e  ; .* =

• w e w" 5g -

W=

_ we t ^= ;- a g A ~t i*r W s 55

- W:

m .___. I E = w-a e

22

The Risk Analysis Process h

This1 diagram represents the process which PP&L intends to use to maintain a-valid' Risk Assessment for Susquehanna.

-We have' structured our approach after the IDCCR BWR IPE methodology with enhancements which PP&L considers to be important. The most important of these enhancements are:

1. Extension of the support states to represent divisionality and channelization of systems.

2. The dispositioning of each Level 1 event tree end point to the full' spectrum of final plant. damage states using support state. and event tree information.

3. The introduction of accident class definitions which permit a fine resolution of plant damage states and timing.

At the present time PP&L'is preparing'this analysis method for programming.

The portions of the process which will be executed by the Risk Analysis program are indicated by P. The purpose of the diagram is'to illustrate the important role that simulator experiments will play in the evaluation-of risk at Susquehanna.' The. Human Response model which will be'used'is the HCR method with parameters derived from the program of Susquehanna simulator measurements.

This is.particularly important because PP&L'does not accept a low calculated plant damage frequency as proof of acceptability. PP&L examines each individual plant damage sequence to assure that the PP&L defense in depth-criteria have been met. This process focuses-direct attention to EOPs and expected operator performance in executing them. This process results in an-intensive. review of all.EOPs, operator training and operator performance for those accident sequences identified for susquehanna.

23 l

r RISK MANAGEMENT I

o DEFINITION: .

l THE PROCESS OF MONITORING PERFORMANCE, RISK ASSESSMENT, FEED BACK AND MODIFICATIONS INTENDED TO ASSURE VERY LOW

. PLANT DAMAGE FREQUENCY AND OPTIMAL USE OF PLANT FACILITIES TO PREVENT OR MITIGATE DAMAGE FROM AN INITIATING l EVENT AND ANY COMBINATION OF EQUIPMENT FAILURES.

i o APPLICATION TIME PERIOD:

FROM START UP THROUGH DECOMMISSIONING.

o SOURCE OF GUIDANCE THE STUDY WHICH DEMONSTRATES THE DEFENSE IN DEPTH PERFORMANCE OF THE PLANT, THE PERFORMANCE MONITORING PROGRAMS, AND THE PLANT RISK ASSESSMENT. PERIODIC UPDATING TO REFLECT CHANGES IN PERFORMANCE, PROCEDURES OR PLANT EQUIPMENT MUST BE DONE FOR THE RISK

{ ASSESSMENT AND THE DEFENSE IN DEPTH STUDY.

l l

l 24 f

i

Risk Manacement This viewgraph identifies the Risk Management process as defined by PPSL. At the present time we are in the process of performing the first cycle of this continuing process. We are performing an Integrated Risk ? eduction Study which will identify all instances.in which the PP&L defense in depth criteria are violated. This study is based on the current (and committed) state of the plant and the results of the first Susquehanna IPE performed for IDCOR.

When all deviations from the defense in depth :riteria are identified a recommendation for correction (or justification) of all deficiencies will be made for management consideration. This recommendation will include both plant modifications and procedural modifications. These modifications will be selected to eliminate all defense in depth deviations at minimum cost and with minimum impact on plant operations. Several alternative combinations will be identified.

This process will permit us to select modifications which have the maximum impact for reducing the severe accident risk for Susquehanna and will provide the basis for justifying the adequacy of the actions taken.

s 25 i,

w_ _ _ _ _ _ _ - - _ _ _ _ _ _ - - - - _ - . _ - - - - _ - - - - . - - . _ . - - - - - - - - - - - - - - --

THE RISK ".ANAGEMENT PROCESS

%DIFY !QUIPE NT t uinl% -

• CR 890CEDURES h 1' 1r 1r

' OI

'9001FY EQUIPMENT TRAltl% PROCEDURES k

1r if u MONITOR EQUIPMENT MONITOR OPERATCR PEFOM M MO MANCE PERFORMNCE TRANSIENT ANALYSIS i

b lf ll i

PERFORMANCE NO NO PERFOMANCE NO ARE PADCEDURES EETS Nams EETS noms UFECTIVE ES ES E3 lI If U PROCEDURAL EQUIPMENT OPEMTOR PERFORM MCE NORMS PEMORMNCE NORMS

<r

? 2 R!$K ANAlf313 1F DU ENSE 15 K PTH STIElf C

NO YES NO DEFENSE IN DEPTH ACCEPT C JUSTIFY DEV1ATIONS N

YES 26

_____m.__.- _ _ . - . . _ . . ____.__. _ _ _ . _ _ _._

,7-The Risk Mana:ement Process l

The viewgraph is intended to represent a continuing process of risk management. There are five major activities in the overall process. These are:

1. Monitor equipment performance (unavailabilities of systems).

2. Monitor. operator' performance (All deviations, errors, and execution time in performance of EOPs).

3. Transient analysis (determination of flow and timing requirements against various criteria).

4. Risk analysis (the IPE process to determine the impact ofl changes).

5. Demonstration of defense in depth (evaluation of all damage sequences from the risk analysis).

This cycle of calculations must be performed on a periodic basis to determine the effects of changes.in:

1. Equipment

2. Procedures

3. Operator training

4. Improved analysis methods

5. Improved plant models This process is intended not only to detect the influence of changes, but also-to incorporate the influence of accumulative measurements of plant performance in reducing uncertainties in the input data to the risk analysis process.

PP&L will. use this approach to obtaining closure on severe accident issues.

We shall consider absence of high frequency damage events and demonstration of defense in depth as demonstration of an adequate 1evel of public safety. We

~

do not intend to perform off-site consequence calculations. We believe that when we have dennonstrated defense in depth, any reasonable calculation of off-site consequence will show negligible public risk when calculated event sequence frequencies are considered in combination with the consequence.

Our approach allows us to focus on factors which we can monitor and control -

equipment and operator performance.

27 I

I

~ <;

APPLICATION OF RISK ASSESSMENT (1) o BOTTOM LINE APPLICATIONS 0FF-SITE CONSEQUENCES CORE DAMAGE FREQUENCY o FOR THESE APPLICATIONS THERE IS A TENDENCY'TO A CONSERVATIVE BIAS AVOIDANCE OF COMPLEX TRANSIENT ANALYSIS SIMPLIFICATION OF EQUIPMENT AND OPERATIONAL DEPENDENCIES.

IGNORANCE OF ACTUAL CAPABILITIES OF THE PLANT o THE TENDENCY TO CONSERVATIVE REPRESENTATION OF THE BWR IS PARTICULARLY STRONG BECAUSE OF:

THE COMPLEX INTERRELATIONSHIPS BETWEEN PLANT SYSTEMS THE MULTIPLE FUNCTIONS OF SOME PLANT SYSTEMS THE COMPLEXITIES OF THE PRESSURE SUPPRESSION SYSTEM 28

1

' Application of Risk Assessment (1) l L

There is often.a tendency in risk' assessment to. focus on the " bottom line",

the core damage frequency or tne' extent of off-site. consequences. When tne

" bottom-line" is the dominant ob]ective for performing a risk assessment, there is' generally a powerful motivation to-use conservative assumptions for a number of reasons. The motivations which are most clearly seen are:

1.. Simplification of-the analysis, particularly the analysis of the accident transient.

2.. Derivation of credible results which cannot be challenged on the basis of optimism in the analysis.

Generally these two motivations go hand in hand,.and, while they may be laudable objectives, the conservatism do not produce results which can tithstand close scrutiny when subjected to critical examination in the. light of our experience.

The key weakness in any risk analysis is'the treatment of:

1. conunonalities,

2. interactions, and 3.. the effectiveness of procedures and training. l Doubt can be cast on virtually any prior analysis based upon close examination of these factors.' .Further, our experience tells us that prior risk assessments have had a very poor record in predicting the actual events which

.have occurred.

While ppt.L believes that calculation of a low frequency of plant damage for Susquehanna is mandatory, we do not believe that such a calculation-is sufficient. We are certain that our analysis is' incomplete in terms of the total array of event combinations which can be expected to threaten a nuclear power station. While we~are striving to broaden our evaluations to cover all credible event combinations, we do not expect ever to achieve this goal.

29 I

_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . _ _ . _ _ . _ _ _ _ i

APPLICATION OF RISK ASSESSMENT (2) o DEMONSTRATION OF ADEQUACY EVALUATE ADEQUACY OF PLANT DESIGN EVALUATE ADEQUACY OF E0Ps AND OPERATOR TRAINING EVALUATE IMPACT OF MODIFICATIONS o EXCESSIVE CONSERVATISM IN THE RISK ASSESSMENT PROCESS IS FULLY AS OBJECTIONABLE AS EXCESSIVE OPTIMISM.

o THE EVALUATION MUST BE AS REALISTIC AS POSSIBLE AND CONTAIN AS FEW ASSUMPTIONS AS POSSIBLE.

o OTHERWISE, ATTENTION WILL BE FOCUSSED ON EVENT SEQUENCES WHICH ARE AN ARTIFICE OF THE ASSUMPTIONS, AND THE MOST PROBABLE EVENT SEQUENCES WHICH MAY REQUIRE EXPLICIT OPERATOR TRAINING MAY BE MISSED.

30

o i-

[.

Applica*. ion of Risk Assessments:)

The PPsL objective in performing risk assessment is to demonstrate adequacy :f 5usquenanna against deficiencies in:

. plant design,

2. procedures, and

3. training In addition, we wish to assure that any changes in these items will not have-an adverse impact on safe operation of the plant.

In pursuing this objective we have found that excessive conservatism in the risk assessment is fully as objectionable as excessive optimism. The reason for this is that a conservatism will often obscure some lower probability combinations of circumstances which may in fact be the most likely circumstances to be encountered given the occurrence of the accident scenario.

This will then prevent such occurrences from being. covered either in procedures or in operator training. This then causes a vulnerability to such an occurrence.

For this reason, we must attempt to perform the analysis on the most realistic basis possible so that the most probable event circumstances in accident sequences are not obscured, and we can then be certain to accommodate them in our' procedures and training.

1 31

l THE PP&L APPROACH TO RISK ASSESSMENT 1

INTENT WE WISH TO ASSURE THAT ALL POSSIBLE CAPABILITY OF THE PLANT TO PREVENT OR MITIGATE THE CONSEQUENCES OF PLANT DAMAGE WILL l BE EFFICIENTLY AND EFFECTIVELY APPLIED FOR ANY INITIATING EVENT AND FOR ANY COMBINATION OF EQUIPMENT FAILURES.

s l

l 32 i

The PP&L Approacn to Risk Assessment Cur goal is to assure that all possible capability of the plant to prevent or' mitigate the consequences of plant damage will be efficiently and effectively applied for any initiating event and any combination of equipment failures.

Our realistic approach to risk analysis with incorporation of the results into our procedures and training when combined with symptom based procedures give us the most credible defense against accidents having severe consequences.

This approach also results in calculation of greatly reduced plant damage frequencies. While we do not necessarily believe that our calculated values are a proper representation of reality due to lack of completeness, we do believe that. much of the calculated reduction in risk in comparison with the

" bottom line" approach to risk analysis is real.

33

_ 4

USE OF RISK ASSESSMENT AT PP&L o WE USE RISK ANALYSIS METHODS T0:

DEVELOP OPTIMAL EMERGENCY OPERATING PROCEDURES DEVELOP OPERATOR TRAINING PROGRAMS TO ASSURE OPERATOR KNOWLEDGE OF CRITICAL RESPONSE ACTIONS.

IDENTIFY POTENTIAL MINOR MODIFICATIONS WHICH CAN REDUCE THE FREQUENCY OF OR MITIGATE THE CONSEQUENCES OF SIGNIFICANT SEVERE ACCIDENT SEQUENCES.

ASSURE " DEFENSE IN DEPTH" IN OUR EQUIPMENT AND OUR PROCEDURES.

EVALUATE ALTERNATIVES FOR PLANT MODIFICATIONS.

TRAIN AND INFORM MANAGEMENT TO ASSURE PROPER COORDINATION OF RISK IN DECISION MAKING.

DEMONSTRATE A HIGH LEVEL OF SAFETY IN SUSQUEHANNA OPERATIONS.

1 34

i

-l Use of Risk Assessment at ?PCL The Susquehanna IPE, in spite of its known deficiencies, has preven to be a very useful document for PP&L and has had a very significant impact en many Of our most important activities. This view graph lists the types of applications which have already been made of this work. In time it is intended that our risk assessment activity will be directly integrated into the process of plant and procedural modifications and cperater training.

l 35

THE PP&L APPLICATION OF THE !PE METHODOLOGY o WE USE AN EXPANDED VERSION OF -THE SUPPORT STATE METHOD INTRODUCED FOR THE BWR-IPEM.

c WE USE THE FUNCTIONAL FAULT TREE CONCEPT TO DEVELOP SYSTEM UNAVAILABILITIES.

o WE HAVE DEVELOPED SUSQUEHANNA SUCCESS CRITERIA USING.

BWRSAR/CONTAIN-0RNL IN-HOUSE CODES FOR ATWS AND SB0 SIMPLE END-POINT THERMODYNAMICS o WE USE THE FRONT-LINE AND SUPPORT SYSTEM STATUS INFORMATION FOR EACH INDIVIDUAL EVENT TREE END POINT TO DISPOSITION IT TO A-SET OF FINAL PLANT DAMAGE STATES.

o WE USE AN ACCIDENT CLASSIFICATION SCHEME WHICH GIVES THE TIME, NATURE AND DEGREE OF CORE DAMAGE, REACTOR VESSEL STATUS, THE QUANTITY OF CORE DEBRIS ON THE DRYWELL FLOOR, AND THE TIME AND NATURE OF CONTAINMENT LOSS OF INTEGRITY.

o WE DO NOT BIN SEQUENCES AND WE DO NOT.USE A FORMAL CONTAINMENT EVENT TREE.

o WE DO N07 CERIVE OR CONSIDER FISSION PRODUCT SOURCE TERMS.

36 E___.____._____

The PP&L Application of the IPE Methodoloev PPsL has incorporated a number of enhancements to the IDCOR :PE methodology wnich are intended :o both ennance the credibility of the results and enance the ability to utilice its results in practical applications. The mos:

important enhancements ares-

1. extension of the support state representations to provide greater resolution of support system failure combinations,

2. development of an accident classification scheme which permits a user-defined degree of resolution of plant damage states and timing,

3. a method of dispositioning each Front-line Function Event Tree end point to a full spectrum of final plant damage states individually,

4. new transient analysis methods which we consider to provide more credible results than predecessor methods,

5. methods for directly incorporating response time distribution into the results of the analysis, and

6. methods for incorporating the influence of Technical Specifications into the results of the analysis.

While we have not yet accomplished our goal of creating a computer program to perform these calculations, the mathematical models and computational logic have all been developed.

We admit that what we have done carries the IDCOR method far beyond what was originally intended. Nevertheless, we believe these enhancements have a profound influence on the utility of the final results, and we believe that, if the approach can be computer based, that its application is no more labor intensive than the unenhanced approach.

37

(

SUSQUEHANNA !?E 2CCIDENT CLASSES TIME OF CORE DAMAGE A. 0 - 2 HRS D. 10 - 24 HRS B. 2 - 4 HRS E. CONSEQUENTIAL C. 4 - 10 HRS Z. NO FAILURE VESSEL ~ STATUS I - INTACT F - FAILED X - NOT DETERMINED TIME OF CONTAINMENT FAILURE A. 0 - 4 HRS V. VENTED B. 4 - 10 HRS Z. NO FAILURE C. 10 .24 HRS X. NOT DETERMINED D. > 24 HRS .

TYPICAL CLASSES AIZ - CORE DAMAGE BEFORE 2 HRS, BUT VESSEL AND CONTAINMENT INTACT AXX - CORE DAMAGE BEFORE 2 HRS, VESSEL AND CONTAINMENT STATUS NOT DETERMINED EFD - CORE MELT AND VESSEL FAILURE AS A CONSEQUENCE OF CONTAINMENT FAILURE AFTER 24 HOURS 38 4

l 1

3;squehanna :PE Accident Tlasses When the :PE was performed for Susquehanna in the latter half of 1985, PP&L believed that an accident classification scheme was needed which would identify the time of core damage and containment failure. In addition we wished to identify the status of the reactor vessel because we believed that it was important to attempt to arrest the core damage progression before reactor vessel failure if possible. By so doing we believed we would achieve a great reduction in the relative frequency of events in which the core on the floor phenomena greatly increase the challenge to containment integrity while adding a high level of uncertainty to these relatively severe sequences. We also wished to segregate the instances where containment integrity was lose through deliberate venting as opposed to overpressure failure. We believe that venting can greatly reduce the likelihood of truly severe accident sequences in which containment failure can release fission products to the environment without scrubbing through the suppression pool. We devised a very simple three letter scheme for classifying all accident sequences. The first letter specifies the time of core damage (but not the degree) including damage that occurs as a consequence of containment failure prior to core damage. The second specifies the status of the reactor vessel and the third specifies the time of containment damage or the occurrence of venting.

Since the IPE event trees are only level 1 event trees many sequences and with only core damage assured, but with the eventual status of the reactor vessel or the containment not determined. The classification scheme also identifies these occurrences.

The use of the support state method in combination with the event tree successes and failures, however, gives essentially complete knowledge of the plant status at the time of core damage and so with this knowledge and knowledge of the initiating event it is a relatively simple matter to calculate the likelihood of success at:

1. Regaining vessel injection capability,

2. Venting the containment, and

3. Regaining or losing containment heat removal capability.

This information was then used to disposition the full spectrum of final plant damage states for each individual event tree end point.

This information is of vital importance in demonstrating defense in depth for all accident sequences of the plant. In addition this approach allows us to isolate the high uncertainty sequences (both those having high potential consequence and those having low potential consequence) so that high uncertainty sequences are not allowed to distort the overall assessment of plant performance in severe accidents. ,

1 39

CAPABILITY FOR SUSQUEHANNA IPE ACCIDENT CLASS DEFINITION PLANT DAMAGE STATE (1)

1. NO DAMAGE

2. REACTIVITY TRANSIENTS (2)

3. METAL WATER REACTION

4. CORE MELT AND REACTOR VESSEL FAILURE

5. VENT +1 (3)

6. VENT +2 (3)

7. VENT +3 (3)

8. VENT +4.-(3)

9. 1..+ COPF (4)

10. 2. + COPF (4)

11. 3. + COPF (4)

12. 4. + COPF (4)

13. COPF + 4. (4)

(1) TIME DEFINITION IS THE SAME AS FOR THE SSES IPE (2) MECHANICAL CLAD FAILURE (3) SEQUENCE NOT IMPLIED BY ORDER (4) SEQUENCE IMPLIED BY ORDER, COPF = CONTAINMENT OVER PRESSURE j

FAILURE 40

I Capaci11ty for Susquehanna :PE Accident Class Oefinition l

The actual capability of the simple accident classifiestion seneme used for I the Susquehanna IPE' Is considerably greater than shown in the preceding viewgraph. In this viewgraph it is shown that this simple scheme actually gives the capability of defining twelve damage classes. These twelve classes have been used in sensitivity studies to demonstrate the selective influence of various risk analysis assumptions and models. The IPE methodology as executed by PP&L allows execution of such sensitivity studies with minimal effort.

-Based on the investigations we have carried out, we are inclined to believe that the current accident classification scheme does not yet have sufficient resolution. For example, we believe it is worth while to distinguish:

1. the degree and nature of core damage,

2. the quantity of corre dabris material falling to the drywell floor, and

3. the nature of containment failure (over pressure or over temperature).

This capability will require a more elaborate accident classification scheme and a more elaborate specification of success criteria. It is our intent to provide this additional resolution of plant damage states in our first IPE revision. It is our intent to create a program which will automate the calculations required.

l l

41 1

. j i

OBJECTIVES FOR PROVIDING DEFINITION l OF PLANT DAMAGE STATES (1) l' o UNCERTAINTY ANALYSIS THE FURTHER DAMAGE PROGRESSES < THE HIGHER THE UNCERTAINTY..

THEREFORE WE WISH TO SEGREGATE THE EARLY STAGES WITH LOW' UNCERTAINTY FROM THE LATER STAGES HAVING HIGHER UNCERTAINTY.

o UNCERTAINTY ISSUES ,

E CHANICAL CLAD DAMAGE FROM' POWER TRANSIENTS.

(BELIEVED TO BE TREATED VERY CONSERVATIVELY)

CORE MATERIAL RELOCATION.

(CONTROL BLADES RELOCATE FIRST)

CORE MATERIAL HOLDUP ON THE CORE SUPPORT PLATE.

(CORE SUPPORT PLATE FAILS BEFORE U02 ELT)

REACTOR LOWER HEAD FAILURE.

(FAILS LOCALLY AFTER LOWER PLENUM DRY OUT) 42

l k

Ob:ective for Providing Oefinition of Plant Damace States (1)

The plant processes which are important prior to plant damage are well understood and have relatively little uncertainty associated with them. As the accident progresses and core damage _is initiated, the degree of

i. uncertainty associated with the physical processes involved begins to increase. When large scale relocation of core material begins, the uncertainties become very great indeed. These uncertainties involve not only the rate of the progress of the event, but also the phenomena which are the dominant and controlling influences. These uncertainties become even greater when reactor vessel failure occurs and core debris falls or it ejected to the drywell floor.

Current risk evaluations have made extensive, if not exclusive, use of expert judgement to quantify the effects of such events in lieu of definitive calculations using credible computer models. For the BWR plant, these phenomena which dominate the late phases in an. accident sequence have.an overwhelming impact on the assessment of the degree of plant damage and on the severity of off-site consequences.

For this reason the PP&L approach involves use of the best available computer programs to calculate such accident transients in detail. While this process removes much of the subjectiveness of expert judgement, it nevertheless conceals a considerable degree of subjectiveness which is exercised when the specific mathematical models and physical data are chosen to perform such calculations. While we believe this process is far superior to expert judgement because it focuses and confines the factors which involve-subjectivity, we do not believe that is removes entirely the great uncertainty over the results of such analysis.

Therefore, we wish to develop a sufficient degree of resolution in definition of plant damage categories such that sequences of high uncertainty can be maintained separated from sequences of lower uncertainty. Further, we wish to segregate sequences having high uncertainty resulting from different physical phenomena. While it is not possible to do this with complete success, it is possible to accomplish this to a degree which prevents the. influence of the large uncertainties from fully obscuring the overall results of the risk analysis. The definition of the criteria for core stabilization is a major contributor to this type of compartmentalization of uncertainty.

43

OBJECTIVES FOR PROVIDING DEFINITION OF PLANT DAMAGE STATES (2)

CORE DEBRIS SPREADING ON THE DRYWELL FLOOR ATTACK ON FLOOR RATE OF NON-CONDENSIBLE PRODUCTION ATTACK ON PEDESTAL ATTACK ON FLOOR PENETRATIONS l

ATTACK ON DRYWELL LINER CONTAINENT FAILURE MODE WETWELL OR DRYWELL OVER PRESSURE OR OVER TEMPERATURE PRESSURE AT TIE OF FAILURE SIZE OF LEAKAGE PATH WAY f

i 44

.Cb;ectives fer Providing Oefinition of Plant Camace States (2)

This;is so because we expect a very high degree of success at saving the reactor vessel with relatively low uncertainty so that the high uncertainty phenomena which can lead to high. consequence events are sharply limited. The additional resolution provided in terms'of the' extent of core damages and the quantity of core debris reaching the drywell floor are additional means for compartmentalizing the nature and. impact of uncertainties.

I l

l 1~

45 i

l l

L_=_--_________-.____ _. _ _ _ _ _ _ _

j

IMPORTANT ISSUES OF'THE CONTAINMENT FAILURE MECHANISM o SEVERE CONTAINMENT FAILURE COULD CAUSE LOSS OF REACTOR-INJECTION CAPABILITY WITH SUBSEQUENT CORE MELT-AND REACTOR VESSEL FAILURE.

O CONTAINMENT FAILURE IN THE DRYWELL IMPLIES RELEASE WITHOUT POOL SCRUBBING.

o A DISTINCTION BETWEEN DRYWELL OVER TEMPERATURE AND CONTAINMENT OVER PRESSURE FAILURE COULD BE MADE ON THE BASIS OF-THE ACCIDENT SEQUENCE.

o THE DISTINCTION BETWEEN WETWELL FAILURE AND DRYWELL FAILURE FROM OVER PRESSURE CANNOT BE MADE ON THE BASIS OF THE ACCIDENT SEQUENCE.

o THE MAGNITUDE OF THE FAILURE PROBABLY CANNOT BE MADE ON THE BASIS OF THE ACCIDENT SEQUENCE.

o IF THE CONDITIONAL CONTAINMENT FAILURE PROBABILITY CAN BE SUFFICIENTLY REDUCED, THE CONTAINMENT FAILURE MODE IS REALLY NOT IMPORTANT.

o THE PPal 60AL FOR CONDITIONAL CONTAINMENT FAILURE PROBABILITY IS AROUND 11 0F ALL CORE DAMAGE EVENTS. WE DO NOT YET KNOW IF THIS GOAL IS PRACTICABLE.

o WHEN :.iE UNCUfiAINTIES IN THE ANALYSIS ARE CONSIDERED, IT IS PROBABLY BETTER TO CONSIDER CONDITIONAL CONTAINMENT FAILURE PROBABILITY INITIATOR BY INITIATOR.

46 '

Important. Issues of-the Containment Failure Mechanism

- This' view graph lists some of the important considerations made when selecting the degree of resolution'to.be.used in plant damage states and success criteria'in order'to compartmentalize uncertainty. The view graph is intended to indicate what kinds of uncertainty can be compartmentalized and what kinds-cannot. These are the types of considerations required for an effective choice of plant damage states.

a 47

_____-__________2__________-____. _ - _ _ _ . _ _ _

\

1 i

UNCERTAINTY o UNCERTAINTY IN EQUIPMENT' PERFORMANCE AND OPERATOR PERFORMANCE CAN BE REDUCED BY PROGRAMS TO MONITOR PERFORMANCE.

o UNCERTAINTY IN CORE DAMAGE PROGRESSION, REACTOR VESSEL FAILURE, CORE DEBRIS BEHAVIOR, CONTAINMENT FAILURE CANNOT BE MONITORED OR DIRECTLY MEASURED.

O A STRATEGY-WHICH SEGREGATES HIGH UNCERTAINTY SEQUENCES FROM.

LOW UNCERTAINTY SEQUENCES CAN PROVIDE A BETTER UNDERSTANDING 0F DOMINANT RISK CONTRIBUTORS.

o HIGH UNCERTAINTY, LOW FREQUENCY SEQUENCES SHOULD BE SEGREGATED.

o THIS SEGREGATION SHOULD KEEP SEPARATE LOW CONSEQUENCE SEQUENCES AND HIGH CONSEQUENCE SEQUENCES.

o. THIS APPROACH AVOIDS APPLICATION OF LARGE UNCERTAINTY BOUNDS TO THE LARGEST FRACTION OF ACCIDENT SEQUENCES AND LIMITS THE EXAGGERATION OF SEVERE CONSEQUENCE EVENTS.

l l

48 l

E_- -- _ - - - - -- - - - - - .

[,.

Uncertainty

' Tor the front-end analysis of risk up co the point of severe core damage, equipment and cperator performance can be monitored so that the uncertainty in the analysis associated with these inputs can be continually reduced by the

- availability of a growing database.

Beyond'the initiation of' core material relocation in the reactor vessel nothing can be done in the plant to further reduce the associated uncertainties. Unless further experimental work is done by industry or the government, improvement in the state of our knowledge of these phenomena cannot be expected. 'For this reason accident sequences should be segregated on the basis of the extent of. damage in risk analysis. This process tends to-segregate high consequence sequences from low consequence sequences as well as segregating high uncertainty from low uncertainty sequences.

'The purpose, again,'is to avoid allowing the uncertainties to obscure the overall nature of the risk associated with plant operation.

1 i

49

OBJECTIVES OF THE SUSQUEHANNA INDIVIDUAL PLANT EVALUATION 1 o WE WISH TO DISTINGUISH THE TIME AT WHICH CORE DAMAGE BEGINS AND TO CHARACTERIZE THE EXTENT OF CORE DAMAGE.

o WE WISH TO DISTINGUISH THE TIME AT WHICH VENTING BECOMES NECESSARY TO SAVE THE CONTAINMENT PRESSURE B0UNDARY INTEGRITY.

o' WE WISH TO DISTINGUISH THE TIME OF CONTAINMENT FAILURE.

o WE WISH TO DISTINGUISH THE NATURE OF CONTAINMENT FAILURE

. (OVER TEMPERATURE OR OVER PRESSURE).

o WE DO NOT INTEND TO DEFINE THE MAGNITUDE OR LOCATION OF CONTAINENT FAILURE.

o WE DO NOT INTEND TO CALCULATE FISSION PRODUCT RELEASE OR OFF-SITE CONSEQUENCE.

o WE PROVIDE SUFFICI$NT DEFINITION TO ALLOW THE HIGH UNCERTAINTY, HIGH CONSEQUENCE SEQUENCES TO BE SEGREGATED.

o SIMILARLY WE WISH TO SEGREGATE THE HIGH UNCERTAINTY, MINOR CONSEQUENCE SEQUENCES.

50  ;

l

f 2

Objectives for the Revision of.:he suscuehanna Individual Plant Evaluation -

This view graph.oresents our primary objectives, relative to resolu' tion of -

'7 plant damage states, which we wish to accomplish in our revision to the Susquehanna IPE.. While the resolution provided by the original Susquehanna

'IPE exceeded that provided by.any prior study,.we have found that newly developed concerns over a variety of accident phenomena' require greater l.

resolution detail yet.

9 51

l APPLICATION OF THE RISK ASSESSMENT TO DEMONSTRATE ,

DEFENSE IN DEPTH o' PPal IS CONDUCTING AN " INTEGRATED RISK REDUCTION STUDY".

o I THE GOAL'0F THIS STUDY IS TO DEMONSTRATE " DEFENSE IN DEPTH" FOR EVERY PLANT DAMAGE SEQUENCE DERIVED FOR SUSQUEHANNA

(*120 SEQUENCES) o BOTH EQUIPENT AND PROCEDURAL CRITERIA ARE EVALUATED FOR EACH l SEQUENCE.

0- EVALUATION OF THE PROCEDURAL CRITERIA INVOLVE AN EXHAUSTIVE REVIEW OF THE SUSQUEHANNA E0Ps AGAINST EACH PLANT DAMAGE SEQUENCE.

O COMPLETION OF THE STUDY WILL RESULT IN IDENTIFICATION OF ALL VIOLATIONS OF " DEFENSE IN DEPTH" FOR THE PRESENT CONDITION OF OUR PLANT AND PROCEDURES EVALUATED AGAINST THE SUSQUEHANNA IPE. ,

o MODIFICATIONS TO EQUIPMENT AND PROCEDURES SHALL BE DEVELOPED WHICH MOST EFFICIENTLY AND EFFECTIVELY RESOLVE THE DERIVED

" DEFENSE IN DEPTH" VIOLATIONS.

o REC 0ffENDATIONS FOR A SET OF ALTERNATIVE MODIFICATION i PACKAGES SHALL BE DEVELOPED FOR MANAGEENT CONSIDERATION.

i l

I s2 L

t

e Application of the Risk Assessment o Demonstrate Defense-in-Depth The " Integrated Risk Reduction Study" represents the first systematic and integrated feedback from the Susquehanna IPE to PP&L management to identify potential vulnerabilities in Susquehanna equipment and procedures. . This study' is the " bottom line" of our risk management. process which was described in a previous _ view graph. The first round of this process, while tedious, has been

a reasonable undertaking since the simple support state structure of the IDCOR-IPE resulted in.only about 120 separate core damage sequences for Susquehanna.

We have currently completed cur evaluation of each sequence against our defense-in-depth criteria and have identified a number of deviations.

On the equipment side this evaluation has shown a number of problem areas such as wetwell venting, backup DC power, and others which we have already recognized from our dominant accident sequences. We have also identified a.

number of procedural problem areas related to suppression pool mass addition, reactor reflood, and blowdown cooling which we are currently evaluating. The report on this work will include recommendations to management for actions to resolve the deviations we have found in an integrated manner. Various alternatives will'also be provided with the rationale for each recommendation.

This information.will then permit PP&L to demonstrate low core damage frequency, and defense-in-depth for all analyzed accident sequences to respond-to the NRC's IPE generic letter and severe accident policy.

This process for our revised IPE will be more complex because with the finer ~

resolution of support states and plant damage states we will have a much larger number of accident sequences. Nevertheless, we expect repetition of the process of demonstrating defense-in-depth to be practicable since any accident sequence more severe that one which just meets defense-in-depth need not be analyzed. . This is expected to greatly reduce the number of sequences requiring detailed examination.

In addition we expect relatively few deviations when the initial series of i recommendations are implemented. j

\

l l l l 1

l 1

l  !

I j l

l l

53

1 RATIONALE FOR THE PP8L APPROACH o WE WISH TO ASSURE OURSELVES THAT:

THERE ARE NO INHERENT DESIGN FLAWS IN OUR PLANT, OUR PROCEDURES HAVE ELIMINATED OR GREATLY DIMINISHED THE LIKELIHOOD OF DAMAGE FROM THE MOST PROBABLE COMBINATIONS OF EVENTS AND EQUIPMENT FAILURES.

OUR OPERATORS WILL MAKE OPTIMUM USE OF PLANT EQUIPMENT TO AVOID OR MINIMIZE SEVERE DAMAGE TO THE PLANT.

PLANT OPERATION POSES A MINIMAL RISK TO THE PUBLIC.

o WE ALSO WISH TO ACHIEVE CLOSURE ON: "HOW SAFE IS SAFE EN0 UGH?"

WE DO NOT CONSIDER A LOW BOTTOM LINE DAMAGE FREQUENCY AS PROOF 0F ADEQUACY.

WE WISH TO DEMONSTRATE " DEFENSE IN DEPTH" AS THE MEASURE OF ADEQUACY OF SUSQUEHANNA OPERATIONAL RISK.

IF WE DEMONSTRATE " DEFENSE IN DEPTH" WE BELIEVE:

l THE FREQUENCY OF PLANT DAMAGE FROM INTERNAL EVENTS I l

WILL BE FOUND TO BE EXTREMELY LOW.

0FF-SITE CONSEQUENCES WILL BE FOUND TO BE EXTREMELY LOW BY ANY REASONABLE ANALYSIS.

l THE REDUCTION IN CALCULATED FREQUENCY OF PLANT DAMAGE IS REAL.

54

-Rationale for the PPGL Approach E PPsL does not wish to demonstrate Edequacy of the safety of susquehanna operations. on the basis of a low frequency of severe fission product release and correspondingly low expected consequences from plant operation. We believe this strategy is seriously flawed in several respects.

1. The physical processes and phenomena involved in developing this information have an extremely high degree of uncertainties.

2 The basis for determination of long term health effects cannot be considered to be much better than conjecture by experts without universa1' acceptance.

3. The process does not focus on what is really important in operation of the plant, but rather on consequences of failure.

4. The result, regardless of its nature, assures a negative public and political reaction.

Since many believe that demonstration of low consequence even with poor containment performance is acceptable, they pay little attention to assumptions and actions that can have a dramatic influence on calculated or actual containment performance.

PPEL believes.that the importance of containment integrity is. greatest when fission product releases have occurred or can occur, and, therefore, we believe that is essential to demonstrate a low conditional probability of containment failure when fission product release is involved-in the event.

The defense-in-depth approach is very much structured to accomplish exactly this goal. Meeting the defense-in-depth criteria assures that three levels of independent equipment failure must occur before severe fission product release to the environment can occur, and it also assures that procedural actions taken or not taken will not cause the sequence to deteriorate. Thus, satisfying the criteria, we believe, assures a very low probability of severe consequence (containment failure). Further, the fact that a wide variety of-initiating events in combination with all possible combinations of equipment .

failure, up to a level where severe consequences will occur, in combination with symptom based procedures, which in general are independent of the nature of the event and equipment failures, gives us the best capability we know how to achieve to accommodate accidents which are unforeseen in the risk analysis.

That is, they are unforeseen in the calculation of frequency, but they, or their , equivalent, are considered in the development of procedures and the testing of their adequacy.

On this basis we believe that our greatest vulnerability is that our calculated plant damage frequencies may be in error as a result of event sequences we have not considered, but we believe our procedures and training are structured to assure full utilization of the plant's capabilities in response to any event.

55

RAT 10NALE FOR THE PPtl APPROACH 1

o- DEMONSTRATION OF ACCEPTABLE OFF-SITE CONSEQUENCES PUTS

~

THE PRIMARY ATTENTION ON THE BACK END ANALYSIS:

CORE MELT PROGRESSION VESSEL FAILURE E CHANISMS

-- CONTAINMENT FAILURE ECHANISMS FISSION PRODUCT TRANSPORT o THIS FOCUS ON THE BACK END ANALYSIS: j HAS HIGH UNCERTAINTY ASSURES A NEGATIVE PUBLIC AND POLITICAL REACTION DOES NOT FOCUS ON WHAT'IS IMORTANT IN OPERATION OFiHEPLANT l

t o DEMONSTRATION OF " DEFENSE IN DEPTH

• PUTS THE' PRIMARY ATTENTION ON THE FRONT END ANALYSIS:

EQUIPENT PERFORMANCE PLANT RESPONSE CHARACTERISTICS EFFECTIVENESS OF PROCEDURES l EFFECTIVENESS OF OPERATOR TRAINING o IF WE FOCUS ON THE FRONT END ANALYSIS:

WE CAN MONITOR AND CONTROL THE ELEENTS INVOLVED IN DETERMINATION OF. RISK WE PRESENT A POSITIVE IMAGE OF OUR PERFORMANCE 56 .

l "?ur'r:sk management process, in vnich we

1. monitor equipment performance,

2. monitor 'perator o ECP performance, and l

l 3.- . test the effectiveness of our procedures against the various accident-

-sequences-which have been identified for the plant using the latest-analysis methods and programs gives us.the basis for a convincing demonstration that we are properly' managing plant operations. This approach has the advantage that we'are able

-to focus on monitoring and controlling equipment.and operator performance and that it presents a positive rather than a negative image of our performance.

I 57

a e

i l

I e

f 58

AN OVERVIEW 0F j THE PPal RISK ANALYSIS PROCESS I

59

t AN OVERVIEW 0F THE PP&L RISK-ANALYSIS PROCESS e

~

o DESCRIPTION CATEGORIES INPUT DATA THE PROCESS ELEENTS EXTERNAL PROCESSES OUTPUT 60

4 An Sver'tiew of tne PPSL Risk Analysis Process In the following description the PPSL risk analysis precess sna11 be described as a cceputer program. At tnis time no ecmputer program to perform this analysis exists, but computational algorithms and program logic have been created which describe the mathematical features of such a program. This approach is taken because it is believed that the descriptions will be easier.

to understand, particularly in terms of the logical structure and interrelationships of the various parts of the process.

In the material which follows, the descriptions are organized into the following categories.

1. Input data

2. The process elements (subroutines)

3. External processes

4. Output This order is chosen for.the presentation because it is necessary to understand the nature of the various blocks of input data before the computational processes can be properly understood. This does introduce the question, during the input description process, as to why a particular item is-needed. The need will become apparent when the computational processes are described.

The descriptions offered here will not be detailed mathematical descriptions, but will be functional descriptions of what the calculations do and why they are done in a particular fashion. More detailed mathematical descriptions will be presented in a later part of the presentation agenda. This descriptive material is primarily intended to present an overview of the process, separate from the more detailed descriptive material, in the hope of minimizing the confusion which would otherwise result.

61

INPUT DATA (1) l 4

o INITIATING EVENTS EACH TYPE HAS INPUT ANNUAL FREQUENCY IMPACT ON SUPPORT SYSTEMS AND FRONT-LINE SYSTEMS o SUPPORT SYSTEM UNAVAILABILITIES I -

OPERATING SYSTEMS o FAILURE CAN BE AN INITIATING EVENT o OTHERWISE FAILURE FREQUENCY AND ALLOWABLE OUTAGE TIE MUST BE SPECIFIED STANDBY SYSTEMS o FAILURE ON DEMAND REQUIRED 62 j

4 Incut Data (1)

This description will deal only with ma;or groups of nput data.  :: wzil net deal with input wnich centrols program logic,.cutput formats, or similar nput required for a viable program.

Initiating Events All initiating events to be considered in the analysis must be input. This input must include the frequency of the event and the impact of the event on plant equipment and systems. For example, a Station Blackout will disable all AC power systems in the plant, except uninterruptable systems, and this impact must be input to the calculation. This is accomplished by means of a vector array for the initiator, which indicates which systems have been disabled and which are not, in the form of ones and zeros corresponding to the disabled and functioning systems.

It is also necessary to segregate events which are similar in nature but different in impact. As an example, LOCA may occur as a result of a recirculation line break which eliminates the injection capability from one division of RHR. This type of event must be kept separate from a LOCA which does not have this impact.

In a similar manner, initiating events of a similar nature may involve failures or processes which require different specification of success criteria. A typical example would be the difference in requirements for responding to a large liquid break compared to a small steam break.

The specification of initiating events and their associated input data must be carefully chosen to reflect these considerations.

Support System Unavailabilities Support systems are those systems which are required to allow operation of the front-line systems. This includes such items as AC power, DC power, compressed gas, cooling water, etc. Typically each of these must be broken up into subsystems in order to adequately describe the possible failure combinations which can result in differing consequences for the plant.

It is also necessary to distinguish between standby systems and operating systems. In the case of operating systems, failure could result in a plant trip in which case it would be classed as an initiating event. If, on the other hand, the plant could continue operating, it is necessary to consider the Allowable Outage Time (AOT) perinitted by Technical Specifications. The reason for this is that an initiating event could occur during the AOT and the response of the plant could be quite sensitive to the specific sequence of events. In the case of the operating system the frequency of failure and AOT both must be input.

In the case of standby systems it is necessary to provide the failure on demand probability as input data.

63

INPUT DATA (2) o FRONT LINE SYSTEM UNAVAILABILITIES

. FRONT-LINE SYSTEMS ARE THOSE WHICH CONTRIBUTE TO A FRONT-LINE FUNCTION.

SYSTEM UNAVAILABILITY MUST BE PROVIDED THIS UNAVAILABILITY MUST NOT INCLUDE UNAVAILABILITY CAUSED BY SUPPORT SYSTEMS-0 SUPPORT SYSTEM INTERDEPENDENCIES

- IN GENERAL, SUPPORT SYSTEMS DEPEND ON OTHER SUPPORT SYSTEMS FOR OPERATION FIRST ORDER DEPENDENCIES MUST BE INPUT HIGHER ORDER DEPENDENCIES ARE AUTOMATICALLY DERIVED o FRONT LINE - SUPPORT SYSTEM DEPENDENCIES FRONT-LINE SYSTEMS REQUIRE PROPER OPERATION OF CERTAIN SUPPORT SYSTEMS THESE DEPENDENCIES MUST BE INPUT 64

- - - _ _ _ _ _ _ _ \

Input Data G) l l

Front-line System 'Jnavailab111 ties Front-line systems are those systems which contribute to a front-line function. The front-line functions are those functions which are required to restore the plant to a safe and controllable condition after the occurrence of an initiat:,ng event. The front-line functions are the' top. level events in the front-line event trees. As an example, high pressure injection may be specified as a front-line function for which there may be success or failure.

Contributing to success could be RCIC, HPCI, Feedwater puups, or CRD pumps.

The particular combination needed for success is dependent upon the initiating event in general, and, further, the availability of a system may depend on the initiating event. The input data required for the system is its inherent unavailability.

In the case of operating systems, availability is' generally assumed unless disabled by the initiating event since such systems are needed for normal plant operation. As an example we would assume the feedwater system to be available in non-isolation transients which do not over burden the control system. Standby systems may be partially or completely out of service, however. The frequency of such conditions and the allowable outage time must be input data for the calculation.

The impact of the initiator is input separately as initiating event input as described in previously.

Support system Interdependencies In general, each support system will depend on some other support system. For example, cooling water systems will need AC power from various systems to provide motive power and power for logic circuits. The system, in general, will also require DC power for its logic circuits as well. Further, the AC systems involved will require DC power for breaker functioning.

It is only necessary to provide as input the direct dependencies, however.

The indirect dependencies are automatically derived by the program. The input is made in the form of a square matrix having a dimension equal to the number of support systems. The first order dependencies are simply put in as zeros or ones to indicate no dependence or dependence respectively.

Front-line - Support System Dependencies The front-line systems similarly require the support systems to assure proper functioning. This data is input by means of a rectangular matrix having dimensions given by the number of front-line systems and the number of support systems. Dependency is similarly indicated by zeros or ones.

65

INPUT DATA (3) o FUNCTIONAL FAULT TREE (FFT) LOGIC FFTs ARE USED TO DETERMINE THE FAILURE PROBABILITY FOR FRONT-LINE FUNCTIONS THE FFT USES INPUT FROM THE INITIATING EVENT, FRONT-LINE SYSTEM UNAVAILABILITIES, AND THE SUPPORT STATE o SUPPORT STATE EVENT TREE (SSET) LOGIC THE PURPOSE IS TO DE ELOP THE FREQUENCY OF ALL POSSIBLE COMBINATIONS OF INDEPENDENT SUPPORT SYSTEM FAILURES A SEPARATE SSET IS SPECIFIED SEPARATELY FOR EACH INITIATING EVENT AND INCLUDES THE IMPACT OF THE INITIATOR ON SUPPORT SYSTEMS THE SSET END POINTS BEC0E INPUT TO THE FRONT-LINE FUNCTION EVENT TREES FOR THE SUPPORT STATE REPRESENTED BY THE ENDPOINT o FRONT LINE FUNCTION EVENT TREE (FFET) LOGIC THE FFET REPRESENTS THE SERIES OF PLANT ACTUATIONS OR OPERATOR ACTIONS REQUIRED TO AVOID SOME LEVEL 0F DAMAGE TO THE PLANT THE SEQUENCE OF TOP LEVEL EVENTS MUST BE DEFINED TO REPRESENT THE VARIOUS POSSIBLE SEQUENCES OF SUCCESSES OR FAILURES FOR THE INITIATOR AND SUPPORT STATE 66

i 1

Inout Oata(3)

Functional Fault Tree Locic The front-line event tree top event functions are typically provided by combinations of various front line systems. These ecmoinations may also

~

l include support systems as well. The logic which determines the availability of-sufficient system capacity to provide success in the top event function must be input to the program. *his input actually determines the structure and content of the functional fault tree (FFT) from which the failure probability of the top event function is calculated.

The dependence of front-line systems on the various support systems mu'st be considered in determining the frequency of the failure condition for the top function in the functional fault tree. This is accomplished by means of input data to describe the dependencies of each front line system on the various' support systems.

With this information, the actual failure probability for the top front-line function can be calculated for each support state corresponding to a given set -

of support system failures.

Support state Event Tree Logic The support state event tree (SSET) has the purpose of developing all combinations of. support system failures which occur as a consequence of random failures in a support syrtes. Each initiating event has a separate support state event tree, and this tree is structured so that the impact of the -

initiating event on the support systems is accounted for.

In the calculation of support state frequencies, the fact that the various support systems may depend one another must be considered. This is accomplished by input of a support system dependency matrix which includes all of the first order (direct) dependencies. Second order and higher level dependencies are calculated by the program.

The end points of the support state event tree, in combination with its initiator frequency, are used as entry events for the front-line function event trees for the same initiator. An end point frequency of the SSET is simply the entry frequency for the front'line event tree for that support state. End points which have an identical or equivalent set of failed support systems may be accumulated into a single support state in order to reduce the total' number of support states and their corresponding front line function event trees.

The input data.for support system unavailabilities are used to determine the end point frequencies of the Support State Event Tree.

Front-line Function Event Tree Logic The successful response to an initiating event for a given support state will require success of a number of front-line functions to avoid plant damage.

The sequencing of these top functions for the event tree should be done so that no top event depends on any subsequent event. This structure is necessary in order to avoid cut set algebra in the quantification of the event tree.

67

INPUT DATA (4)

o. ' SUCCESS CRITERIA SUCCESS CRITERIA ARE USED TO DEFINE THE VARIOUS LEVELS OF PLANT DAMAGE WHICH CAN OCCUR THE DEGREE OF RESOLUTION IN PLANT DAMAGE STATES DETERMINE THE COMPLEXITY OF THE SUCCESS CRITERIA-THE SPECIFICATION OF SUCCESS CRITERIA IS DERIVED FROM ANALYSIS OF THE ACCIDENT TRANSIENT I

I 68

_____-__ - _ _ _ _ _ _ _ - = _ _ _ _ _ _ - _ _ _ _ _ _ _ - - _ - _ - _ _ - _ _ _ _ - _ _ _ _ _ _ _ _ _ . _ _ _ _ _ _ _ _ _ _ _ _ _ _ . . . - _ _ _ -

[.

~

nput Data (4)

Success Criteria

1 The success criteria for the tree must be structured to reflect the top' event functions for-the tree so that varying degrees of plant damage can be-determined.

The structure for the front-line function event tree.is created by input logic

.to specify the' top event functions and their sequence.

. Success criteria are derived by a process external to the. risk analysis process, namely transient analysis of the accident sequences. Success 'l criteria, in general, consist of two parts. The first is a' flow rate, for example, required to re-cover the core within a fixed period of time. The-second part of the: input-is the time by'which in]ection must be restored. A separate criterion may be specified for each increasing level of damage, for example as a function of the time'at which injection is restored. As the complexity of the plant damage state definition increases, the complexity of the input must also increase.

In selecting the degree of resolution desired in plant damage states, the strategy given priority should be an attempt to allow segregation of those plant damage states for sequences having high uncertainty.

Increasing complexity of the plant damage resolution does not always imply a

. corresponding increase in the amount of transient analysis required since a single transient run can provide the latest time for operator action, which would be +.he flow rate.and the time available to provide it. The information would come from an analysis of.the accident transient in which it is:

determined how late the core can be reflooded before a certain level of damage is reached. In such a calculation several levels of damage'may be defined including core melt and reactor vessel failure. If the program used also has containment analysis capability various success levels can be defined for the containment as well as for the fuel and reactor vessel. In more simple cases a success criterion may simply be'a minimum flow to the reactor to assure adequate core cooling. In general success criteria answer one of two questions pertaining to top level functions in'the front-line event trees.

These are:

1. what is the minimum level of performance needed for success, or

2. what is the latest time for action of a certain magnitude?

The structure of the success criteria naast be chosen to reflect the degree of resolution in plant damage states. Success criteria input will be in the fem of logic statements which specify cperator actions required and the corresponding time constraints.

69

INPUT' DATA (5) {

i o PROCEDURAL GUIDANCE THE E0Ps ARE THE BASIS FOR PROCEDURAL GUIDANCE AN ACTION MAY ONLY BE CONSIDERED IF THE E0Ps SPECIFY IT FOR THE SITUATION CONSIDERED THE LEVEL OF SUCCESS OF THE ACTION IS' DETERMINED BY THE TIME AVAILABLE FOR IT o TIME REQUIRED FOR ACTION THIS INPUT SPECIFIES THE TIME AVAILABLE FOR AN ACTION THE INFORMATION IS DERIVED FROM ANALYSIS OF THE ACCIDENT TRANSIENT 70

_ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ . _ _ . - l

Incut Data (5) h Precedural Guidance Procedural guidance is based on the plant Emergency Operating Procedures (ECPs). This information is not used directly as input to the risk analysis but is used to constrain the specification of operator actions. The rules used by PP&L are:

1.. If the EOPs specify an action, it should be included.

2. If the EOPs do not specify an action, it should not be included.

_3 .. If-the EOP specifies an action and the symptom which initiates it will be available, it should be assumed that the operator will execute it successfully if time is available.

4. The only limitation on operator success is time available, and the level of success is calculated by the HCR method.

This approach is essential if a useful evaluation of plant capability against severe accidents is to be derived. If one assumes some level of operator violation of procedural instructions, it then becomes necessary to consider why the violation occurred. There'is_no credible guidance for such a consideration, and, more important, the implication for the effectiveness of plant operators for response to severe accidents is extremely negative.

Development of EOPs which have been examined for the severe accident sequences which characterize a plant and shown to be effective in combination with demonstrated high quality operator response in following EOPs is essential to demonstrating the ability to effectively exploit the plant's capabilities in response to'a severe accident.

!~ Time Required for Action As an input to the.HCR model it is necessary to specify the median or-characteristic time required for the operator to take an action. In addition it is also required to specify the nature of the actions skill, rule or knowledge based in the HCR methodology. This information must be specified t

for each action where time is considered to be limiting to operator success.

71

THE PROCESS ELEMENTS o INITIATING EVENTS ]

I j

o SUPPORT STATE EVENT TREES ,

i o FUNCTIONAL FAULT TREES o FRONT-LINE FUNCTION EVENT TREES o- S0dCESS CRITERIA o PLANT DAMAGE STATES 72

\.

The Process Elements This section will' describe the six casic components which make;up the overall

'r sk analysis program. These ecmponents are:

1. ' Initiating Events

2. Support State Event Trees

3. Functional Fault Trees:

4. Front-line Function Event Trees 5.. Success Criteria Y 6. . . Plant Damage States'

.The purpose of these descriptions is to provide'information on the function of these components of the calculation-and to point out the important features'of each.

l l

73 i

1 l

l. INITIATING EVENTS l'

o REQUIRE OPERATION OF FRONT-LINE SYSTEMS TO RESTORE' PLANT STABILITY AND CONTROL o MUST BE DIFFERENTIATED ON THE BASIS OF IMPACT ON PLANT SYSTEFS FRONT-LINE SYSTEM OPERATION REQUIRED TO AVOID PLANT DAMAGE o NUMBER SHOULD BE MINIMIZED TO AVOID EXCESSIVE NUMBER OF ACCIDENT SEQUENCES 74 l

1' e:

nitiattne Events

'The initiating event portion of-the calculation is actually only input data necessary to quantify the initiator frequency for a given support state event tree. The initiating' event frequency is used as the initiating frequency of

.the support state event tree for that initiator.

The' initiator may have an impaction support system and front-line system

, availability. This impact is input as a part of the initiating event l definition. Since each initiating event will have a, support state event tree of its own wnich will define several support states, each of which has.its own-front-line event tree, it is important to keep the number of initiating events at a minimum. The primary incentive for this is to limit the final numbe- af front-line event tree end points. The number can become. extremely large.

This tendency also is severely aggravated by increasing the resolution detail in the plant damage spectrum.

In selecting the set of initiating events it is important to separate initiators which have

1. a different impact on support or front-line systems or

2. require different combinations of equipment functioning or operator actions to avoid or minimize plant damage.

Typically the basic initiating event types identified are:

1. Transients

2. LOCAs

3. Station Blackout

,4 . ATWS

5. Combinations of these Actually,. Station Blackout and ATWS are special cases of the transient and LOCA. classes and the initiating event input need not identify them separately.

They may be derived by accumulation of appropriate end points of the transient initiators and LOCA initiators. They are kept segregated because these events I

are generally perceived to represent the most serious threat of severe plant damage.

There are, in general, several transient initiators and LOCA types. In addition,'there are special initiators which can be caused by operating or standby system failures which can either directly or indirectly lead to a requirement for shutdown. In many cases such events can be shown to be equivalent to a specific support state event tree end point. In such cases it-is highly advantageous to combine such an initiator with the appropriate support state and point.

75 l

SUPPORT STATE EVENT TREES

)

o THE SUPPORT STATE EVENT TREE DETERMINES THE FREQUENCY'0F VARIOUS COMBINATIONS OF SUPPORT SYSTEM FAILURES, INDEPENDENT AND AS A CONSEQUENCE OF THE INITIATOR {

o THE SSET END POINTS ARE USED AS INITIATORS FOR THE FRONT-LINE FUNCTION EVENT TREES o THE IDCOR REPRESENTATION OF SUPPORT SYSTEMS LACKS SUFFICIENT RESOLUTION o SUPPORT SYSTEMS MUST BE RESOLVED AT LEAST TO THE DIVISION AND CHANNEL LEVEL o SUFFICIENT-RESOLUTION WILL RESULT IN AN EXTREMELY LARGE NUMBER OF SUPPORT STATES o THE NUMBER CAN BE REDUCED BY:

COLLAPSING SIMILAR SUPPORT STATES USING A LOW FREQUENCY CUT-0FF l

76

Succort State Event Trees The support state event trees defined by the IDCOR BWR :ndividual Plant Evaluation Methodology are extremely coarse representations of the BWR plant support systems. ;s a result, it is difficult to represent the two division, four channel nature of BWR4 plant systems. For this reason PP&L has expanded the definition of the support state structure to permit this level of detail in the support states for the plant. As a result of this expansion, the complexity of the support state event tree is enormously increased.

Because of this increase in complexity, we have developed a matrix algebra method for derivation and definition of the support states. Event trees are not actually used although it is convenient for conceptual purposes to think in terms of event trees.

The use of the support state concept has an enormous advantage over the more commonly used event sequence fault tree method. This advantageous characteristic is the property of segregating the support system failures caused by the initiating event and random failures into groups having identical characteristics for propagation through the front-line function event trees. This property permits numerical quantification of the front-line function event tree without any requirement for cut set manipulations. For this reason the end points of the front-line function event tree represent fully defined states of the plant rather than combinations of differing equipment failure combinations. This definitive knowledge of the plant state then permits propagation of each front-line function event tree and point into a full spectrum of the potential final plant damage. states.

The input to the support state event tree is the frequency of a given initiating event. The support state event tree partitions this frequency into the various support states for that initiator. The end points of the support state event tree are then frequencies for that support state and initiating event which acts as the input to the corresponding front-line function event tree.

It is seen that each initiator therefore has many front-line function event trees, one for each support state defined. Since the number of support systems which must be considered is large, and a support state is simply a combination of support system failures, a very large number of support states is possible. In order to control the magnitude of the computational burden and the magnitude of the output information, it is important to collapse support states together which are functionally equivalent. This process is not expected to result in a sufficient reduction, however, and a cutoff frequency for support states to be considered may be specified.

1 77

r FUNCTIONAL FAULT TREES o THESE ARE GENERALLY SYSTEM BASED FAULT TREES WHICH DETERMINE THE UNAVAILABILITY OF FRONT-LINE FUNCTIONS. THEY QUANTIFY THE TOP EVENTS IN THE FFETs o THE UNAVAILABILITY ( INCLUDES THE IMPACT OF SUPPORT SYSTEMS AND INITIATORS. THERE IS A SET OF FFTs FOR EVERY INITIATOR-SUPPORT STATE COMBINATION o THE EQUIPENT REQUIRED FOR SUCCESS IN THE TOP EVENT OF THE FFET IS DEPENDENT ON THE INITIATING EVENT, IN GENERAL 78

7 ,

Functicnal Fault Trees The purpose of the functional. fault. trees (FFTs) . is to develop the unavailability for'the front-line functions. In general this unavailability is'different for every initiator and every support state. The front-line functions considered in the front-line function event trees are:

1. Reactivity control

2. Reactor pressure control

3. High pressure in]ection

4. Reactor depressurization

5. Low pressure injection j

6. Containment heat removal '

7. Core cooling given containment failure In the case of loss of AC power, further consideration may be given to loss ~of .

diesel generators or recovery of off-site or on-site AC power sources. In the case of LOCA it is necessary to consider the functioning of the pressure suppression system. Finally, in the case of ATWS it is necessary to consider-the condensate pumps, HPCI.and RCIC/CRD separately, SLCS, and manual rod insertion. In general, the event trees must be structured to consider the functioning of equipment needed and the time available to respond to the initiating event.

The purpose of the FFT is to determine the availability of equipment to.

perform each of these top level functions. The calculation must consider:

1. The inherent unavailability of the equipment,

2. the impact of the initiating event on equipment availability

3. the support state being considered.

This determination is generally quite straight forward. The fault tree elements are complete systems or divisions or channels of systems.

l I

79

FRONT-LINE FUNCTION EVENT TREES 0: FOR A GIVEN INITIATOR AND' SUPPORT STATE THE FFET DETERMINES ALL POSSIBLE EVENT SEQUENCES ,

)

o SUPPLEMENTAL LOGIC IS USED TO DISPOSITION EACH EVENT SEQUENCE TO THE COMPLETE SPECTRUM 0F FINAL PLANT DAMAGE STATES o THIS IS FEASIBLE SINCE THE INITIATOR, THE SUPPORT STATE, AND THE EVENT SEQUENCE FULLY DETERMINE THE PLANT STATUS S0 THAT THE FINAL OUTCOE IS EASILY CALCULATED o FFET END POINTS ARE NOT BINNED, BUT ARE INDIVIDUALLY DISPOSITIONED 80

l Trent-line Function Event Tree The front-line function event tree is most effective wnen it is structured to reflect the effect of the initiator on support and front-line systems and the -

support state to be considered. The structuring of a tree is done by considering the nature of the initiating event and support system failures and the resulting guidance to-the operator offered by the ECPs. The tree becomes primarily a reflection of the actions he is instructed to take and considers his success or failure at executing these steps. If the problem is failure of the equipment called for, consideration is given to the possibilities for correction of the failure. If time is available, the corrective action is considered. In all cases where time for an action is limited, the distribution of execution times, determined by the HCR method, is used to calculate the level of success or failure in accordance with the success criteria structure which has been devised. This process then allows determination of the actual spectrum of success (or failure) to be expected.

We believe that this approach is very important because very often the probability of failure falls off very rapidly in time, and, even though there may be a fairly high probability of sustaining some degree of damage, the probability of severe damage is low. This consideration is the primary motivation that caused PP&L to originally consider the possibility of arresting core damage before reactor vessel failure.

Using the typical level 1 approach to the structuring of front-line function event trous, the tree ends when some form of damage to the plant has occurred.

In general, these trees do not consider containment status unless there is no threat to the core before containment failure. This approach does not provide a complete picture of plant damage, and for this reason we have extended the typical level 1 methodology. This is accomplished by use of the knowledge of event sequence timing which is inherent in the end point determination through the success criteria and the knowledge of the complete plant status which comes from the support state and the front-line failures which have occurred.

With this information, the time available for further operator corrective or repair actions may be determined, and the level of success in executing them determined.

In the formulation of this process for a computer program, the event tree concept is not actually used, but logic equations which are their equivalent are developed and used for the quantification. It is useful nevertheless to think of the process in terms of event trees.

81 I

_ _ _ - _ _ _ _ _ 1

SUCCESS CRITERIA o SUCCESS CRITERIA ARE DERIVED FROM TRANSIENT ANALYSIS OF THE ACCIDENT SEQUENCE o IF TIME FOR AN ACTION IS CRITICAL, THE TIME DETERMINES THE DEGREE OF PLANT DAMAGE o IN MANY CASES A SINGLE CALCULATION MAY PROVIDE A SERIES OF TIME CONSTRAINTS FOR ESCALATING PLANT DAMAGE STATES o IN SOE CASES WHERE MULTIPLE ACTIONS ARE INVOLVED SIMPLIFICATIONS MAY BE REQUIRED i

l 82

l L

]

Success Criteria I

success. criteria are primarily an expression of the results of performing an analysis of accident transients. The nature'and extent of transient analysis required depends, to some extent, on the-complexity.of the success criteria E devised. In the case of a simple criterion for avoidance 'of reactor vessel l failure, it would only be necessary to perform an analysis of the event to determine the latest time at which make.up flow to the reactor could be restored in order to maintain a coolable geometry for the core and core debr s l -in the reactor. If'it is desired to consider the challenge to-the containment-should makeup not be restored in time, it is necessary to extend the calculation through reactor vessel failure and to determine the influence of core debris challenges to containment integrity in terms of non-condensible gas generatien or attack on critical containment components. For each of these, criteria must be devised to determine the degree of gas generation or critical component degradation which can be tolerated. In combination with these criteria, actions must be defined which will terminate the progress of the accident: transient.

In general a single transient analysis can provide an entire sequence of success criteria because a single operator action of the proper type will.

terminate'the accident progression and avoid further damage to the plant. In these cases, it is simply a matter of performing an analysis of the entire accident sequence and determining the various times at which such actions-would terminate the sequence and therefore determine the level of plant damage.

In some' cases, however, it may be found that a single action does not suffice to terminate the accident progression. In such cases a multiplicity of accident trajectories may be possible which reflect the influence'of the timing and sequence of the actions. In other cases, the timing of an accident sequence may be influenced by the time of occurrence of a failure in that the decay heat level is monotonically decreasing ~with time. In such cases it may be necessary to' select somewhat conservative criteria to reduce the analysis burden to an acceptable level. Careful consideration must be given to the-consequence of such simplifications, both in terms of characterizing the dominant accident sequences for the plant and the process of developing optimized EOPs.

A very important consideration in the PP&L approach to developing success criteria structures is the desire to isolate' phenomena or calculations which have a relatively high degree of uncertainty associated with them. The purpose is to permit such events to be segregated from the general popuistion of accident sequences so that the relatively high degree of uncertainty is not improperly attributed to the entire population of accident sequences, t

83

]

PLANT DAMAGE STATES q

)

1 o IN DEFINING PLANT DAMAGE STATES THE OBJECTIVES ARE:

TO IDENTIFY THE TIME OF CORE DAMAGE AND CONTAINMENT l FAILURE TO DISTINGUISH BETWEEN DIFFERENT LEVELS OF SEVERITY AND DAMAGE TYPES TO SEGREGATE HIGH UNCERTAINTY SEQUENCES FROM LOW UNCERTAINTY SEQUENCES o THIS APPROACH PERMITS THE INFLUENCE OF HIGH UNCERTAINTY EVENTS OR PHEN 0ENA TO BE B0UNDED o THIS APPROACH ALSO PERMITS THE INFLUENCE OF VARIATIONS IN RESPONSE TIMES TO BE PROPERLY REPRESENTED l

l 84

4 m-.

Plant Damage States The definition of a Plant Damage State (PDSi is. achieved by analysis of the accident transient. The results are translated into.a requirement for a certain action of a specific l magnitude prior;to a specific time in order to-avoid exceeding a specific level and type of plant damage. The purpose of defining a high resolution system for accident classification'n is tos

.l. identify.the time of core damage and containment failure,

-2. distinguish between differing levels of severity of the sequence and between different types of damage, and

3. permit segregation of sequences having high uncertainty, mild consequence, or. severe consequence.

We believe that.it'is important to do this in order to establish proper and credible bounds on the importance of such phenomena as core damage progression, reactor vessel failure, core concrete interactions, and: core debris attack on critical containment components.

The Susquehanna IPE accident class definitions established this capability'in part, but failed to provide adequate resolution on the extent of core damage and the severity of core debri < challenge to containment integrity. We believe that it is necessary <o correct this deficiency in future risk assessment work.'

In the case of' core damage progression, we wish to' identify not only the time at which the damage initiates but also to identify the-nature of.the damage.

and the extent of it.~

l There are two basic types of core damage to be considered:

1. mechanical clad' damage and

2. metal-water reaction damage.

The first of.these results from severe or repeated power transients or unstable limit cycle operation such as might be encountered in ATWS events, particularly those involving inadequate crew response or equipment failure.

This form of damage involves mechanical interactions between the fuel and the clad with consequential high stress and loss of clad integrity. These events are believed to be capable of releasing very large. fractions of the noble gas inventory and considerable fractions of the volatile fission product inventories, particularly in the case of severe power cycling continuing for an extended Mme period. The uncertainties associated with this type of fuel damage are very large, but the potentially large release of fission products I

has a significant impact on EOP structure to minimize the potential consequences of such releases. For this reason we wish to segregate and, if possible, quantify the severity of this type of damage in any. analysis of the impact of uncertainties on optimal EOP development, crew training, and mitigating modifications to plant equipment.

The second type of damage is a consequence of inadequate core cooling and results from high clad temperatures leading to metal-water reactions with the clad and other components. We suspect that quantification on the basis of the j

l.  !

L 85 4

O O

l i

hI

l l

f )

86 1 l

1

extent of the reaction is procably not an effective approach. 'The reascn ;s-that ;nithe absence of-adequate core cooling, the decay heat and the :. nit:al chemical rea'ction energy results in a gradual increase in clad' temperature, but with~relatively small. reaction fractions. Once this temperature reaches a

threshold value 6 2500 F) the rate of reaction and the temperature rise l' ,

rapidly, and the conditional probability of inhibiting this process by recovered water in]ection capability.is relatively small. Once started, the reaction goes from a small fraction of the metal involved to a plateau value which is achieved when the metallic materials have relocated and been quenched!

~

in cooler regions of the reactor vessel.

This process does not' occur across the entire core simultaneously, however, but proceeds by regions of similar and increasingly' lower power generation history. This process, furthermore is characterized by the following sequence of events:

1. n.elting of the control' rod materials and relocation of the material to the region-of the core support plate or lower plenum,

2. auto-catalytic reaction of the channel box zirconium with extensive-metal' water reaction, molting, and melt relocation to the core support plate or. lower plenum,

3. auto-catalytic reaction of the' clad zirconium and relocation of molten zirconium to the lower regions of the core,

4. eventual loss of columnar integrity of the UO, rods and collapse into a rubble bed supported by the-core suppoft plate, 5.: failure of.the core support p ate and associated structure by high temperature caused by decay heat release and' stored energy of the unmolten fuel material, and

6. relocation of the fuel material to the lower plenum and quench by the remaining water inventory.

In this progression, the debris bed in the lower plenum retains a coolable geometry and does not threaten the integrity of the lower head until lower-head dry out and heat up of the debris to a temperature which no longer permits quench even with water addition.

This process takes a considerable period of time before the lower. head integrity is threatened, and an even longer' time before complete relocation of all core material to the lower plenum. There is a potential hazard of initiating makeup flow to the reactor vessel during this process. That is the possibility of reflooding fuel bundles after the control rod material has' relocated. The fact that this process occurs over an extended time period means that the conditional probability of core reflood of unrodded bundles may not be low.

We believe, based on fuel bundle reflood experiments performed at Argonne, that the reflood process will.cause the high temperature fuel .to shatter and form a non-critical debris bed. This view, however, is subject to challenge and represents a source of uncertainty in the accident progression and the -

severity of the energy input into the reactor vessel. Because of this, we do  ;

believe that it is important to track the fraction of fuel bundles that have l 87

O

.4 O

1 1

1 1

88 )

l' l

l

~

l l .-

' undergone control red material relocation. Similarly we must siso track:wnat fraction of the.unredded bundles have reached a temperature sufficient to cause collapse of.the fuel rods into a non-critical geometry. *n this manner, we can characterize the potential magnitude of the threat frem unredded bundles.and thereby bound the magnitude of-the potential threat. The SWREAR

code makes tracking the status of the core very simple in this regard.

,In the case of reactor vessel failure, not all core debris material is believed to relocate to the. pedestal room floor immediately on failure. In fact the BWRSAR models indicate that the initial pour of material from the.

vessel will be the molton' metallic components of the denris which have a considerably lower temperature than the UO, melting point, but have a higher melt temperature than the reactor vessel dterial. Initial failure is believed likely to be at instrument tube penetrations, the drain penetration, or possibly CRD penetrations rather than general high temperature failure of the lower head. In'this case, the release of material to the pedestal room floor is a'relatively long term process involving a considerable change in debris content (and decay heat content) with time. The initial pour does have-sufficient temperature and energy content to initiate release of water vapor.

from the concrete which in turn reacts with the metals of the pour releasing considerable . energy. This process can potentially become entirely self-driven and can result in considerable damage to containment. structures and release of large quantities of non-condensible gases.

On the positive side, the presence of water on the drywell floor should quench the molten metal and prevent this reaction, or' initiation of injection of water into the vessel or the drywell could stop the progression of the reaction early in the process if the metal is released over a reasonably long

~

time period. In all cases, injection of water'into the vessel should stabilize a large fraction of the remaining fuel and greatly' reduce the challenge from decay heat driven attack of the drywell concrete.

For this reason, we wish to characterize the vessel failure process on the basis of the amount of metal and Uo, released from the vessel before injection is restored and the process of rele&se from the vessel terminated.

Finally, we wish to discriminate between the nature of the various challenges to containment integrity. The classifications which we believe should be '

considered are:

1. wetwell venting,

2. attack on the I4CA vent tubes or SRV discharge line penetrations which could cause pool bypass and defeat of pressure suppression,

3. direct attack on the drywell liner which could cause an unscrubbed release from the containment,

4. high drywell temperature combins.d with pressure causing drywell failure as a consequence of uncooled core debris on the drywell floor, and

5. simple over pressure failure of the containment caused by high suppression pool temperature, large quantities of non-condensible gases generated by the accident, or a combination of the two.

l 89

i i

90

- _~~---- ._.-.___ -"' --- _-____. ____.__ - ._

i ' It may be ' desirable to split item 5 above into cases, with and without non-condensible gas generation. We believe the ma;cr challenges to i containment will be' simple inadequate decay heat remeval and that there is relatively small uncertainty in such sequences. Similarly, we believe venting will be a dominating mode of loss of containment integrity if venting capability is.provided. Once again, the uncertainty is small and also, the consequences relatively minor.

In the case cf the other categories', however, the uncertainties are high primarily due to the phenomena involved which can also strongly influence the accident progression. Nevertt.eless, we believe the relative frequency of l events of this type will be low so that we wish to segregate them, both because of high uncertainties and high potential consequence.

We believe that the original classification scheme devised for the Susquehanna IPE will need to be extended from a three letter code to a four or five letter code to provide the degree of resolution desired. The decision on what specifically shall be provided will be based on examination of a number of BWRSAR and CONTAIN runs. This decision will only lock in the nature of the characterization and the complexity of the class identification scheme. The actual quantification of event severity within the scheme would be user selected.

1 i

91

1 L

EXTERNAL PROCESSES o THERMODYNAMIC END POINT CALCULATIONS l

-SIMPLE B0ll:DOWN TIME SIMPLE DEPRESSURIZATION SIMPLE CONTAINMENT PRESSURE RISE L- o IN-HOUSE CODES l' -

' STATION BLACK 0UT ATWS-(CHEXAL-LAYMAN POWER) o RETRAN (LIMITED USE)

.O SIMULATE ATWS' POWER SINGLE VS.. DOUBLE SDV FAILURE A'nfS REFLOOD RATE LIMIT (INTENDED) o MAAP (N0 LONGER USED) o BWRSAR (ORNL)

EVENTS WITH DECAY HEAT ONLY ,

CORE DAMAGE EVENTS CONTAINENT TRANSIENT WITHOUT REACTOR VESSEL FAILURE i o SAMBA (EPRI PRE-RELEASE) I ATWS TRANSIENTS  :

STABILITY LIMITS LIMIT CYCLE OPERATION i

o CONTAIN (REQUESTED FROM NRC/0RNL) i CONTAINMENT TRANSIENTS WITH REACTOR VESSEL FAILURE 92

--- _ - .I

L l

p .

lL External Processes I:

The phrase, external processes, is used'to refer to the 'rarious types of.

transient analysis calculations. Several types of analysis are included in '

this category. Th *e are 1.- the BWRSAR program,

-2. an in-house program for analysis of ATWS transients,

3. simple end point thermodynamics calculations, and

4. the CONTAIN program.

.We have in addition used an in-house program for Station Blackout, RETRAN, SIMULATE, SAMBAi and, in earlier work, MAAP.

l- These programs and analysis methods are used to determine constrain'ts on timing, flow rates, and pressure required to avoid a specific form of damage or.to limit'the accident transient not to exceed a specific level.of. plant damage. Typically end point thermodynamics' calculations are used to calculate boildown time for a suberitical reactor with makeup' inadequate to' maintain level. This type of calculation can also be used to calculate the capability

.for reactor pressure reduction without reaching a condition of inadequate core

~

cooling.

The BWRSAR program is used.to track boildown and depressurization transients in more detail than is possible with end point thermodynamics analysis.. The more important use of BWRSAR is to track core damage progression sequences and to track containment pressurization sequences up to-the point of reactor vessel failure. The program cannot follow a sequenes beyond reactor vessel-failure since it does not have core concrete interaction models. This program is extremely important in' allowing success criteria having considerable resolution to be developed. For example the following characteristics of an accident sequence can be tracked:

1. the extent of metal water reaction,

2. the number of control rods which have melted and relocated,.

3. the number of fuel bundles which have collapsed to the core support plate,

4. the number of free standing fuel bundles which are unrodded.

5. the extent of core support plate local failure with fuel debris

-relocation to the lower plenum,

6. the time of reactor vessel failure,

7. the rate and composition of core debris pours from the reactor vessel, and

8. the rate of containment pressure increase up to the time or reactor vessel failure.

93

. _ _ _ _=___ _. - _ . . - - _ . . _ _ .

O 94

These characteristics of an accident transient which can be quantitatively extracted from a BWRSAR calculation may be used to develop ttme quantifications for success criteria. It is easily seen that there is wide latitude in the definition possible in the plant damage states. :t is also seen that a single transient calculation can define multiple action times for termination of a given type of damage progression, such as core damage or containment pressure buildup. After suen an action, the plant may not be stabilized and further actions may be required to establish a stable condition. In such cases, multiple transient cases may be required, but engineering judgement and acceptance of mild conservattsms may greatly reduce the quantity of calculations required.

PP&L has developed an in-house transient calculation based on the Chexa16 Layman correlation for power in an ATWS event which allows rapid and efficient evaluation of alternative operator response strategies in response to the event and time limits for operator success. In addition to calculations of this type, very simple calculations can be made assuming linear power reductions from a stable ATws power level at full makeup flow to decay heat level power in cases where boren is injected or control rods are manually inserted using CRD drive flow. Calculations of these two kinds allow a reasonably reliable assessment of a wide variety of ATWS response strategies and time limits for successful operator action.

Finally, CONTAIN calculations allow determination of time constraints for mitigating actions to arrest damage resulting from core debris falling to the drywell floor. PPsL has not yet performed calculations of this type, but we are certain that development of a range of quantified success criteria to tenninate such accident progressions should be possible.

95

OBJ5CTIVES OF TRANSIENT ANALYSIS DETERMINE:

TIME AVAILABLE FOR OPERATOR ACTION MINIMUM ALLOWABLE FLOW RATES

. REQUIRED DEPRESSURIZATION RATES INFLUENCE OF BORON MIXING EFFICIENCY MASS LOSS FOR RPV BLOWDOWN POOL MASS AND TEMPERATURE INCREASE FOR RPV BLOWDOWN CONTAINMENT PRESSURE TRANSIENT STAGES OF CORE DAMA6E PROGRESSION TIE OF REACTOR VESSEL FAILURE STA6ES OF CORE DEBRIS RELEASE TO THE DRYWELL FLOOR TIE OF CONTAINENT FAILURE 96 w_-_-_--_----_---_____ _ - _ _ _ _ _ _ _ _ .

r Cbyectives of Transient Analysis The basic purpose of transient analysis is to detemine the time available for the operator to take an action to avoid or minimize plant damage. The transient analysis must also determine the necessarf level of ecuipment

- performance to result in a successful operator ' action.

Much of the analysis of this type is directed to a determination of the l minimum level of make up flow to the vessel required to meet one of the i

various success criteria that may be specified. In some cases, the rate of l depressurization and water mass loss from the reactor vessel before low pressure pumps can function is an important issue for resolution. In the case of ATWS sequences, the influence of SLCS initiation time and boron mixing efficiency is important in establishing the probability of success in avoiding plant damage.

Finally, if plant damage cannot be avoided, it is important to establish the timing for occurrence of various levels of plant damage in order to determine the probability of terminating the damage progression at various stages in the transient. The infonnation required from the various analyses performed is strongly dependent on the success criteria structure selected.

i 97 l

l TRANSIENT CALCULATIONS (l)

GENERAL FOR ALL INITIATORS o BOILDOWN TIME AFTER LOSS OF INJECTION 3

l o DEPRESSURIZATION WITH LIMITED INJECTION l

0 MINIMUM INJECTION RATE AND LATEST TIME FOR INJECTION TO AVOID:  !

FUEL DAMAGE CONTROL R0D RELOCATION FUEL RELOCATION TO CORE SUPPORT PLATE CORE SUPPORT PLATE FAILURE LOWER PLENUM DRY OUT o GENERATION RATE OF NON-CONDENSIBLES METAL / WATER REACTION CORE / CONCRETE INTERACTION o CONTAINMENT PRESSURE TRANSIENT NON-CONDENSIBLES IN DRYWELL NON-CONDENSIBLES IN WFTWELL l

NON-CONDENSIBLES SPLIT o CORE DEBRIS ATTACX ON CRITICAL COMPONENTS LOCA DOWNCOER VENTS SRV DISCHARGE LINE PENETRATIONS DRYWELL LINER 9R Q_-_-_-__-__--_---___--___-___-___.___-___________--_

Transient Calea1ations (1)

-In this viewgraph the type of information that must be generated in general for all initiators is listed. The items listed are not. intended to represent l

the specific information :needed, but only the type of information that can be j extracted from the analyses performed. The specific information required will '

, be related to the parameters listed, but will depend on the success criteria selected.

A given set cf transient runs could in principle allow several differing sets of success criteria to be examined. These different sets, for example, could simply specify differing degrees of resolution in the plant damage states. - At -

this time we have not performed a sufficient range of analyses to select the optimum set of success criteria. It is most effective to select plant damage levels that will be reasonably well separated in time so that the rate of reduction in probability from one level to the next is depicted in reasonably uniform steps.

99

TRANSIENT CALCULATIONS (2)

ATWS o LATEST TIME FOR BORON INJECTION ONE PUMP TWO PUMPS o LATEST TIME FOR HPCI BYPASS ACTIONS o MINIMUM FLOW TO AVOID FUEL DAMAGE WITH BORON INJECTION WITHOUT BORON INJECTION o TIME AND FLOW RATE FOR INCREASING POOL MASS STATION BLACKOUT o DRYWELL TEMPERATURE AND PRESSURE o HPCI/RCIC ROOM TEMPERATURE o CONTROL ROOM TEMPERATURE o TIME AND FLOW RATE FOR INCREASING POOL MASS 100

Transient !alculattens(2)

For ATWS and Station Blackout information unique to the initiator is required.

In the case of ATWS, the ability to determine the latest time for ceren injection is important. In the caea that timely boron injection is not available, we need to know how much time is available to perform bypass operations On HPCI logic to avoid loss of the system due to high suppression pool temperatures or high containment back pressure.

The Chexal-Layman correlation has made possible the use of very simple global transient calculations for the reactor vessel thermodynamic state which permits a great deal of the necessary information to be generated. There are deficiencies in the treatment of horon injection and core inlet subcooling effects in this correlation which must be examined, however.

A potentially important strategy for extending the time before containment failure pressure is reached in ATWS transients is to add water to the suppression pool. This action has the effect of drastically reducing the rate of pressure increase and provides much more time for operator actions. -

In the case of Station Blackout several important pieces of equipment are subjected to transient conditions which will ultimately cause their loss.

These are drywell, HPCI/RCIC, and control room temperatures. These analyses have been done using very simple single temperature models for the room atmosphere. These crude models indicate that sufficient time to failure is available that such losses have only a small impact.

The addition of water to the suppression pool is also a potentially effective strategy for slowing containment pressure increase for Station Blackout sequences as well as ATWS sequences. These calculations require a reliable containment ptogram.

101

OUTPUT o THE BASIC CALCULATION OUTPUT SHALL BE THE FREQUENCY FOR PLANT DAMAGE STATE FOR EACH:

INITIATOR SUPPORT STATE FFET END POINT o FOR USEFUL DISPLAY OF THE OUTPUT A. VARIETY OF EDIT FORMATS ARE REQUIRED:

GLOBAL DAMAGE FREQUENCY TOTAL DAMAGE FREQUENCY BY PLANT DAMAGE STATE TOTAL DAMAGE FREQUENCY FOR EACH PLANT DAMAGE STATE BY INITIATOR ETC.

1 i

102 L___-__-_-_______________---

h output The raw output of the :alculation shall be organized by init:ator and support state. For each initiator / support state ecmbination the output shall be a set of plant damage states and their corresponding frequency for each end point of the front-line function event tree - that is for each' combination of front-line function failures.

This type of output data organization implies an extremely large volume of output data with an extremely wide range of frequencies. Except for possible truncation or simplification of the support state combinations considered, no cut-off frequency will be used to drop sequences or plant damage state contributions to a sequence. All data will be retained. In order to organize the output in a more useful form, a variety of edit routines shall be provided.- These routines shall permit grouping of the sequences and plant damage states into a variety of formats. For example, a display of all plant damage states for all support states combined for a given initiator would be a potentially useful form of edit. Similarly an edit of all plant damage states j for all initiators and their support states combined would also be of interest. A variety of edits of this type would be provided.

Ultimately, we believe it will'be feasible to provide distribution functions for each of the input parameters to the calculation and to create a Monte Carlo sampler and driver for the risk analysis calculation. For this type of calculation special edit programs would be required to collapse the output data into the desired format and to provide statistical distribution parameters for each element of the output format.

)

l l

l

[

1 103

~

L

=

• 1 ,

• t M

2 NN $=

• 3"~ ps _:

$ 5 s N- 5

~E = c -

3 ,f I of i O C5 =

f . s  := 5 1

5 35 i e

_ m$. i i

a= O

• -

• e EGE 5 -

$ ~5E +--" I s

l E~

g I$r R A 3

-tm s - [D 4 -

s.

C; h

e E*

M V J -

kJ '

g -- r x

o

~

w

- !E

==

as

-m ==

E W e {0 5

~l ,

- :s

-4

-m agag

==

J

o. -> a < me. -

(;,,r "" - "g" m @

e >=

en

- 8 2 as W. .

E_m_ -E

" ==w

> -i - -- - W= 5 ac f.O g"

x Wi g " .- ====

c.

E >

= = _

hN i--- -ty d

-Eh, $

m5 d --- egg = E 3 %G "g 52  :

5 E

• =< E g

W....

I I WN e Il

~

U

!_. -n.

=

Y N gw on 104 h

Sucport State 'ethod Information Flow

-The' view graph diagram is intended to demonstrate the overall flow of information through the calculation process. The input dataL for the calculation are.

1. initiating events, frequency and impact on equipment,

2. , support' system'unavailabilities and interdependencies,

3. ' front-line system Inherent unavailabilities and dependencies, and

4. success criteria.

It should be noted that the actual success criteria may have to be derived before constructing the FFET. As an example, actions which are not effective should not be incorporated into the FFET. : The effectiveness of a potential action can only be determined by an analysis of the transient in question.

Thus, to some extent, development of the FFET.and development of success criteria must go hand in hand. We have ignored this consideration in this-diagram.

ty With the above input information and the SSETs, FFETs and FFTs, we may start the calculation. . First, the initiator is partitioned _by the SSET into Support State frequencies.. These Support States represent support system failure

. combinations which have an equivalent effect on the front-line systems. The branching probabilities .in the SSET are simply determined on the basis of the. '

inherent unavailabilities of the support' systems, the interdependencies of the support system, and the influence of the initiator on the various support systems. These calculations are very straightforward, but the selection of ,

support system failure combinations having an equivalent Lapact on front-line  !

systems does involve a knowledge of the Front-line System dependencies on the l Support Systems. This' link is also not shown on this diagram. The fact that ,

a-number of-SSET endpoints may have an equivalent effect on front-line systems l is not shown in the diagram. This process involves binning of such equivalent l endpoints and their frequencies. This binning process does not introduce'any j error or obscure the nature of the sequence.

In the computer program based calculation an SSET is not actually used due to the very large number of support systems. The computation is actually performed on the basis of Boolean logic which is much more efficient than an j event tree.

Nevertheless, the SSET is a useful conceptual device which clearly shows the partitioning of the initiating event frequency -into an array of support state 1 frequencies. For each support state, then, a Front-line Function event tree j is prepared which takes into account equipment which is disabled by the initiating event and the Support System failures. The Support State frequency is then partitioned by the FFET into a series of event sequences representing various success and failure combinations of the Front-line Functions. The determination of the timing and nature of plant damage resulting from one of ]

these sequences must be determined from the success criteria. The event tree, l, I and the success criteria associated with it, however, only will determine the nature of the initial damage to the plant, initial core damage or containment 105

i i

l l

t l

106 .

- --- ----u-- - - - - _. .___,___,

f a :. lure. They will not and,.as-a practical matter, cannot deter:une the p:

eventual nature of plant damage as the event secuence progresses beyond the.

events covered by the FFET.

There are, however, additional success criteria provided which are structured to determine the spectrum of final plant damage states for each endpoint of the FFET. These additional success' criteria are based en the initiating, event-and the combination of support system and front-line function failures which define the sequence. With this information, the various probabilities for equipment recovery to terminate the accident progression can be calculated which then permits allocating the frequency of the endpoint in question among the possible plant damage states. .This process cannot readily be accomplished by an extension of the FFET since the logic involved is too complex for the-simple event tree structure (see Appendix 6).

The' flow of information in thJ risk analysis process is quite complex, but if taken a step at a time is actually very straightforward. The diagram can be

~

useful, within the limits of the cautions stated above, in developing a comfortable understanding of the workings of the Support State method.

l' l

l-l.

107 L_____.____ _. _ _ _ _

7- ____ ,__ -. _, _

108

i l

INITIATING EVENTS 109

, - - - - - . , - - - - _ , - _ _ - - - - - - - - - - - - , e- --_,- - , , , _ _ _ . - , _ , - .,---,--- , - - - - - - -,. -

DEVELOPMENT OF INITIATING EVENTS i

DEFINITION OF INITIATING EVENTS TYPES OF INITIATING EVENTS CONSIDERED 4

FREQUENCY 0F INITIATING EVENTS 110 l

j. Develop of Initiating Ivents

nitiating events are discussed in this section. The discussion includes a definition of initiating events, the types of initiating events considered, and the estimation of initiating event frequency.

i 111

DEFINITION OF INITIATING EVENT l

AN' INITIATING EVENT-IS THE OCCURRENCE OF SOME EVENT.THAT PLACES THE PLANT IN A STATE THAT REQUIRES THE' ACTUATION OF STANDBY SYSTEMS TO MITIGATE ITS EFFECT.

l 1

i l

i f

1 112 L-____._________________________________________. )

Definition of Initiating Events It has been demonstrated that steady state operation of a nuclear pcwer plant represents an insignificant safety hazard to the general public. Therefore, to create a hazard, the plant must at-least be perturbed away frem its steady state operating point. The plant is designed, however to adjust' process parameters and thus compensate for the majority of the perturbations experienced by the plant. On occasion the deviation from the steady state is so severe that the plant control systems are ineffective at compensation.

These situations require prompt intervention by operators or standby systems .

to bring the plant back to a steady state conditions _usually plant shutdown.

These severe deviations from the steady state are defined to be -initiating events. The initiating events may be the direct result of failure or misoperation of plant equipment which results in a prompt automatic or manual shutdown of the reactor or an indirect result of failure or misoperation of plant equipcent that cause an orderly forced plant shutdown.

I 113 l

l l

l

, TYPES OF INITIATING EVENTS TRANSIENT INITIATORS MANUAL SHUTDOWNS REACTOR SCRAM WITHOUT CONTAINMENT ISOLATION INADVERTENT OPENING OF A SAFETY RELIEF VALVE REACTOR SCRAM WITH CONTAINMENT ISOLATION LOSS OF 0FFSITE POWER LOSS OF COOLANT ACCIDENTS RECIRCULATION SYSTEM LINE BREAKS CORE SPRAY LINE BREAKS INSTRUMENT LINE BREAKS OTHERS TO BE DETERMINED _

ANTICIPATED TRANSIENTS WITHOUT SCRAM WITHOUT CONTAINMENT ISOLATION WITH CONTAINMENT ISOLATION STATION BLACK 0UT SPECIAL TRANSIENTS LOSS OF A VITAL DC SUS LOSS OF SWITCH 6 EAR ROOM COOLING LOSS OF CONTROL STRUCTURE HVAC 114 l -

l Types of Initiatine Ivents {

The nummer of events which satisfy this definition is quite 'arge, thus evaluation of each specific initiator type becemes impracticable. Many of these initiating events have an identical or perhaps very similar impact on the plant. Theref:re, it is logical to group these similar events into classes. Traditi:nally these initiators have been classified by the plant's transient response to the event. The transient response is used to define what processes are required to successfully restore the plant to a steady state - that is, the success criteria. Transients with the same or similar success criteria are grouped into the same class.

In the past, evaluations of initiating events have been limited to events that directly result in a reactor scram. In more recent studies the initiating events have been expanded to events which degrade plant systems and result in a plant shutdown. In these situations the plant transient response may be identical, however, the equipment available to respond to the event may be much different. Thus plant equipment availability is also a logical means by which to classify initiators.

Many sources of operational, design, and transient data exist which can be used to identify and categorize initiating events. Plant operational and design data represents the best source of information for defining initiating events and their frequencies. Unfortunately, much of this data is difficult to obtain, insufficient for making inference, or nonexistent. Therefore, other sources of data aust be used to determine the type and frequency of initiating events. Compilations of industry wide initiating event data have been prepared which represent an excellent starting point for such evaluations. A limited set of reports contain the bulk of the data. A synopsis of these reports appears in Table 1.

These data sources were used when preparing the Susquehanna IPE. The initiating events were divided into principal categories: transients and loss-of-coolant accidents (LOCAs). Transients are events involving a perturbation to the plant without an uncontrolled loss of reactor coolant into the drywell and include the inadvertent opening of a safety relief valve.

LOCAs are events involving an uncontrolled less of reactor coolant into the drywell. These two principal categories of initiating events are distinguished by a different configuration of the reactor and different demands on mitigating systems. Each of these categories are further divided into finer classes.

Transients are divided into the following classes: manual reactor shutdown, reactor scram without containment isolation, stuck open safety relief valve, reactor scram with containment isolation, and loss of offsite power. The reactor transient response for these initiating events is similar, however the equipment available is different. Each case represents a degraded state of the plant. A manual reactor shutdown is an orderly plant evolution and therefore represents a very benign event. A reactor scram without isolation is more severe than a manual shutdown since it requires prompt action by operators or equipment to reestablish control of the plant. Because the main condenser is available as a heat sink and the feedwater-condensate system is used for inventory control, these events are still benign. The case where an SRV inadvertently opens while at power represents a direct challenge to the primary containment. For this reason a plant scram is required if the SRV 115

e 116

cannot be closed in 2 minutes. The suppress en poc1 is at an elevated-temperature and the nigh pressure turbine in]ection systems are icst early in the event due to the reactor depressuri:ation. Thus this event represents a more significant threat to the plant. Reactor scrams with :entainment, isolation result in loss of the main condenser and the feedwater pump." Thus a layer of defense in both heat removal and inventory centrol is lost as a result of this event. A loss of offsite power is even more severe in that only the onsite generators are available to provide power to safety related e

equipment.

The second general category of initiators considered in the Susquehanna IPE were LOCAs. LOCAs and their characterization were not treated mechanistically in the Susquehanna IPE. This was seen as a deficiency which is being rectified in our revision activity. LOCA's are classified in terms of the time required to lower the reactor vessel pressure to the low pressure ECOS i operating range and the equipment that is lost as a result of the pipe break. l 4

Each vessel penetration is broken at the vessel and at the first isolation valve. A LOCA calculation is then performed to determine the transient response. Breaks having similar response are then grouped into a break class.

As an example a break of the core spray line would result in a. rapid reactor depressurization, the loss of RCIC and NPCI due to the depressurization, and tho' loss of a core spray loop due to the break.

The anticipated transient without scram (ATWS) and the station blackout (SBO) event are identified as unique initiators since they represent a significantly different plant condition than those identified thus far. The ATWS represents a significant challenge to the containment and requires prompt specific operator response if a favorable outcome is to be realized. ATWS is subdivided into the two categories: non-isolation and isolation. In the non-isolation case the main condenser is still available as a heat sink. If the power is reduced to the turbine bypass capability no immediate threat to the containment exists. The isolation case is much more demanding in that all the heat generated in the reactor must be rejected to the suppression pool.

Occurrence of the SBO on the other hand represents an indirect challenge to the plant in that most of the plant's safety systems are lost. Therefore, these events are treated as unique initiators.

A final class of Initiating Events to consider involves equipment malfunctions which degrades the plant's ability to respond to transients and results in a reactor scram. These events are called special transiente. These events include: loss of a vital DC bus, loss of switchgear room cooling, and loss of control structure EVAC., These events will result in a reactor scram and disable safety related equipment. Since they are the cause of reactor scram, they must be considered as an initiator.

This may not be true if motor driven feedwater pumps are utilized.  ;

117

l

\

118

TABLE

)

Synopsis of Reports Containing nitiating Event Data Repert Identifier Syneesis e

NUREG/CR-2097 June 22 These reports contain an evaluation of LER NUREG/CR-3591 from 1969 to the present. They identify the NUREG/CR-4674 Vol. I-VI types of initiating events that have occurred, years 82 and 83 are missing a historical estimate of the frequency and a description of the plant response for each event reviewed.

NSAC-80 This report describes all the loss of offsite NSAC-111 power events, and their durations through the present.

EPRI-NP-801 This report gives a description of the EPRI-NP-2230 possible transient initiators and their frequencies.

NUREG-1032 This report offers a methodology for assessing the frequency of loss of offsite power events lasting T hours.

Final Safety Analysis. This report describes the type of accidents Report Chapters 6 and 15 considered when designing the plant.

119

E 4 I - S

.- I 9 0 -

- S 6 4 8 4 5 1 0 O 8 9 1 2 0 x 1

- P .

6 x M 3 1 0 1 0 0 7 O

A C 1 6 T

A D

L I

F I

5 5 C 2 9 - -

E 0 3 2 5 0 0 P T 4 7 1 4 0 1 1 S I . . x x N 3 1 0 0 0 3 3 A U N 9 2 N

A H

S E E U I

Q C S 4 N U -

- 5 E S 1 9 0 -

U 2 3 0 2 5 1 0 Q T 2 1 3 8 0 x 1 E I . 1 x R N 4 2 0 1 0 2 8 F U 1 9 T

N E

V E

G N -

I T A 4 A T - 5 I A 0 -

T D 1 0 I x 1 N C 7 7 3 4 x I. I 3 4 0 9 5 5 R . -

E 4 6 0 0 1 4 N

E G

F TN O N R TTN T N U O O E NUO N O OI G I W E OI E I HT N HT O I HT I HT S TA I TA P S TA ST A T S I L N I L N I L NI L N N WO E WO E A WO AWO E W S P S T R S R S V O MI O MI I TMI TNI E D A A S A A T RT T RT F DRT DR T G U C N N CN F ECN EC N N H E SEM 0 TS E TS I S S E i T A - N A E T RN R Rf F PTN PT N A L OI EV Ol 0 I UI I UI I A TA VR TA -

C OA C OA T U CT DS CT S I HT I H T I N AN A  ! N S TTN TTN N A EO NN EO O NI O NI O I M RC I A RC-L A WC AWC b

i'

nitiat n: Event Trecuenezes I

I

)

This section covers how the frequency of each initiating event is estimated.

Generic data was used n the SSES-IPE to estimate init:ater event frequency.

Tables 7.3-2 through 7.9+4 of the SSES-IPE identify what events were considered and the ratzenale for inclusion into a particular class. This information :s then used to estimate the frequency of a given transient initiator. NUREG-1032 was used to estimate the loss of of fsite power frequency. The LOCA frequencies were based upon WASH-1400. The ATWS probability was derived from the transient initiator frequency and the NUREG-0460 without scram prot %bility. The station elackout frequency is ;ust the LOOP frequency from NUREG-1032 times the failure probability of the onsite AC power system. If sufficient plant specific data sources are not available, then this approach seems reasonable.

Since publishing the Susquehanna IPE we have examined our plant shutdown history. We plan to use this data in our revision where possible. A comparison of generic data to SSES specific data is presented in the accompanying view graph.

The LOCA frequency is estimated by counting pipe sections for.a particular pipe run and then multiplying it by a generic pipe break frequency per pipe section. This is shown with the following equation.

LOCA g Pipe Section Count X

1. • ""#Y #*"

Frequency -

in pipe run pipe section 121

l l

l e

122

I EVENT TREE CONSTRUCTION AND SUCCESS CRITERIA i

123

t EVENT TREE CONSTRUCTION AND SUCCESS CRITERIA o HEALTH AND SAFETY OF GENERAL POPULATION GUARANTEED BY ENSURING BARRIER INTEGRITY

-0 RULES OF EVENT TREE CONSTRUCTION o PERFORMANCE REQUIREMENT FOR CORE INTEGRITY o PERFORMANCE REQUIREMENT FOR CONTAINENT INTEGRITY WITH THE VESSEL INTACT o PERFORMANCE REQUIREMENT FOR VESSEL INTEGRITY o PERFORMANCE REQUIREMENT FOR CONTAINMENT INTEGRITY VESSEL NOT INTACT i

o STATION BLACK 00T EXAMPLE 124

i p

s b,

-Ivent Tree Construction and Success Orateria The requirements for siting a nuclear pcwer station are. presented in'100TR100, c

Theseprequirements;specify a set of reference radiation exposure limits which 1

are used to determine the acceptability of a site. These~ radiation exposure 1: nits -are not given as acceptable levels of exposure for the generai pub 1 c, but are meant.to be limiting values ef. exposure which could occur in extremely low probability accidents in a nuclear ~ plant. The. presumption is, in the evaluations made,sthat severe core damage has occurred with a release of.

" appreciable quantities of fission products". _This release is normally.taken to be 100% of noble gases.and 25%.of halogens released to the containment-atmosphere. The' containment is nevertheless considered to remain intactLand functional. In the calculation of public exposure, it is. presumed that the Epopulaticn in a " low population (LPZ)", zone can be evacuated within a time

-period of.not less than two hours after the start of the fission product release such 'that the reference exposures are not exceeded, and such that

-those beyond the LPZ will'not receive exposures greater than the reference values with no evacuation'or any other form' of protection from the airborne E fission products.

We shall use's rather loose form of the guidance given in-10CFR100 to

-distinguish between accident sequences which represent a threat to public-health and safety and those which do not. In general, we shall assume:

1)- if no core damage occurs, there is no consequence,.

2) if core damage occurs, but containment integrity is not lost, the consequences are-acceptable, but LPZ equivalent evacuation'may be-required to assure conformance to 10CFR100 limits, and-

3) if core damage occurs and containment integrity is lost, off-site consequences must be considered.

The loss of containment integrity can take many forms from wetwell venting to overpressure failure:in the'drywell. corresponding to relatively benign failure type and the most. severe failure type respectively.- For this reason the-severity.of off-site consequence depends not only on the time and nature of

~

core damage but also on the form of containment loss.of integrity.

'It must be recognized that with these definitions, the avoidance of off-site consequence could require some level of evacuation even in the event that containment integrity is not icst because of the design value of the containment leak rate. Even in the realm of probabilistic risk assessment where we attempt.to use realistic analysis models, some accident sequences could result in sufficient ' containment leak rates that 10CTR100 limits could -

,. be threatened without some level of evacuation.

In thir discussion we have identified only the fuel clad and the containment

! - as fission product barriers, and in the strictest sense this is a proper assessment. Nevertheless, the reactor vessel also represents an important barrier in that if the fuel damage can be confined within an intact reactor vessel, the core debris does not directly threaten containment integrity. If the core damage progresses to a point where high temperature debris causes vessel failure with release of the debris to the drywell floor, the containment is threatened by several new phenomena.

125 l

_____________m L-t l

126

?

For.this reason we explic;tly' ensider the performance of three barr:ers ;n-cur analysis .

) 'the fuel clad,

'2) . .'the reactor vessel, and

3) the containment.

This presentation will address the various issues whien must be considered in the protection of these barriers, and will describe the analysis process used to determine . die outcome of the various event sequences.

In the construction of the Front-line Function Event Tree (FFET), the tree will be terminated when'adequecy of core' cooling or lack of it, has been-determined. In the case of ATWS the tree is terminated when' successful shutdown, or failure to shutdown, has been determined. If shutdown is not accomplished, containment overpressure failure is the' consequence.

[- ,0 overpressure failure in turn can result in reactor injection capability-and i

therefore lead to inadequate core cooling and core damage with the' containment failed.

In cases where reactor shutdown has occurred and'an extended period of inadequate core cooling with' loss of clad integrity has'not occurred, an extension of the TFET to consider successful restoration of decay heat removal

, or venting can be used to determine the eventual status of the containment.

-In those cases where inadequate core cooling has occurred and core damage results, tho' situation is much more complex and cannot readily be represented as an extension of the FRET because of the complex interactions which must be considered. These cases can be fully dispositioned to the full spectrum of final: plant damage states however by relatively simple logic equations which account'for what equipment is unavailable and the probability of recovery in time to avoid specific levels of plant damage.

For this reason the FTET is'always' terminated without establishing'the. final reactor vessel or containment status. In the case where adequate core cooling-

, is assured, however, reactor vessel integrity may be inferred. The subsequent viewgraphs and discussion will attempt to outline the approach taken to represent the various accident sequence types; This information will then be used to given an example of the process for Station Blackout

'/ ,

127

. i n-y

, 'jil .

R F

C .

0 0 0 1 0 1

0 1

F R R O F 0 C 0 F 0 1 C 0 N 0 R 0 1 O 1 ' 1 R I E F E F T B T C Bf C T A E 0 E 0 N Y L Y E 1 YE 1 E T O A M AM MI I M F M F N R V O O O O I G N T NT A E L O N N T T A I D O O 'D I

O N N I T E I TE I T A R T AR O I N U I A T C C U UI A E L CU L T A Q O AQ O K O V E I VE I O P E R V ER V S O S O Y E N N S O T Y E E N L I Y Y ER S G S E ET E VN E I R

T T

N S E E V Y Y E T I

L R A G R E E T N N E I G

E R

O C

S O E N Y

G N

I TT AN I E TV I E N

I M

I fIllll

3eneral Event Tree The event tree depicted in the viewgraph does not represent the actual nature l of the event trees used by PP&L in risk analysis. It is, rather, a conceptual (

device used to present ene overall flow of the risk analysis precess. The intent here is to show that there are three barriers to be considered in the accident progression (only two of which are properly considered fission product barriers) and to show the necessary sequence for their evaluation. In actual practice an event tree type of 1:qic is used only to the point of determining whether core damage has occurred. For sequences where ccre damage has occurred an event tree structure is not well suited to describe ene logic which determines the various branchings which can occur and the actions which infidence them. The basic reason for this is that a unique set of top event questions which will apply to all branches in the sequence of events cannot be developed. The logic of the various event sequences is, nevertheless, straight forward and tractable.

For this reason we do not use an event tree structure beyond the point of core damage, but rather develop a set of logic equations which can properly describe and quantify the various possible outcomes as the sequence progresses. The logic required when no core damage has occurred is much simpler than when the reactor vessel integrity is subjected to a threat by inadequate core cooling. For that reason these two cases will be treated separately in the following discussion.

The conceptual event tree presented here does indicate the crude degree of accident classification which can be made on the basis of success and failure combinations in preserving barrier integrity. The following discussion presents some of the considerations involved in developing a logical structure for determining the various courses an accident may follow.

The event tree is a graphic method of logically linking questions about the status of the fission product barriers to the impact on them from the initiating event. The event tree for a specific initiator is developed by deducing specific questions about the plant response from general questions concerning barrier integrity. .The most general event tree is identified in the view graph. The first heading identifies the initiating event being considered. The initial conditions that the plant must respond to are identified at this point.

The questions are ordered to pre serve the natural dependence of the damage progression. For example, the evaluation of containment integrity depends upon the status of the reactor vessel. If the vessel is intact then the containment integrity is only challenged by pressurization. If on the other hand the vessel bottom head is breached by the melted cora, containment challenges due to core concrete interactions, which may be overpressure or overtemperature or both, must be evaluated. Therefore, the status of the vessel must be established prior to considering containment integrity. Vessel integrity, however, can only be challenged if core cooling is lost.

Therefore, the integrity of the core must be considered first. If core cooling is maintained then vessel integrity is implied. The containment integrity, however, is not guaranteed by ensuring clad integrity since it can still be challenged by pressurization, but only by loss or decay heat removal capability. Therefore, the status of containment must be questioned even if 129

q r

e m

f 1

l l

l I

l I.'

130 f

re damage has been avo;ded. :f .' css of cooling causes ne integr :> :f :ne

lad to be lost, then the vessel integrity cannet be amplied. Therefore, if

lad integrity is lost vessel integrity must be evaluated. :f tne vessel integrity is preserved then the :nallenge to the :entainment is limited :

pressurization frem loss of decay heat rencval, hydrogen generation, and :ne addit;onal chemical energy release. :f on the other hand the vessal is lost enen the containment w;11 be challenged by : ore concrete interactions n addition. The core concrete interactions may involve additional chemical energy release, edditional pressurization due to noncondensible gas generation, higher drywell temperatures which weaken components and increase gas pressure, failure of the drywell-suppression pool pressure barrier and loss of suppression pool quenching, and direct core debris attack on the drywell liner causing loss of containment integrity. _

We also consider venting to reduce containment pressure as loss of containment integrity.

Specific questions concerning the plant response to the initiating event are deduced from the general questions on barrier integrity. This is performed by determining what performance is required to maintain barrier integrity for the plant state associated with the initiating event. The success criteria are defined by the performance requirements. The plant design data and procedures are used to identify what plant equipment can be used to satisfy the given performance requirement. The performance of this equipment then is specified as the top events identified in the event tree.

The general rules for event tree construction are as follows.

1. Determine the plant initial conditions associated with the initiating event.

2. Identify the performance requirements sufficient to ensure barrier integrity.

3. Use the plant design data and the operating procedures to identify equipment that satisfy the performance requirement. Operation of specified equipment becomes the success criteria.  !

4. Group equipment by performance requirement.

5. Successively fail equipment identified by the success criteria until barrier integrity is lost.

In the following discussion performance requirements are developed for the clad, the vessel and the primary containment. The station blackout event is used to demonstrate equipment success criteria which satisfy these perfernance l criteria. This information is used to build an event tree for station j blackout.

131 1

BWR FRONT-LINE FUNCTIONS l

l l

o REACTOR SHUTDOWN REDUCES HEAT GENERATION RATE TO SHUTDOWN COOLING SYSTEM  ;

LEVELS. I AVOIDS DAMAGE FROM DEGRADED ATWS SEQUENCES.

o RE/.CTOR VESSEL MAKE UP ASSURES TWO PHASE CORE COOLING AND AVOIDS HIGH TEMPERATURE FUEL FAILURES.

o CONTAINMENT HEAT REMOVAL ASSURES PROTECTION AGAINST CONTAINMENT OVERPRESSURE FAILURE GIVEN ADEQUATE PERFORMANCE OF REACTOR SHUTDOWN AND REACTOR VESSEL MAKE UP.

l 1

1 0 DEBRIS COOLING 1

MINIMIZES THE THREAT TO CONTAINMENT INTEGRITY GIVEN-INITIAL FAILURE OF REACTOR VESSEL MAKE UP.

l l

l 132

SWR Front-Line Tunctions b :n hhe preceding view graph the general ' event tree which poses the questions from which the degree and nature of the threat to the health andLsafety of the public are derived is presented. 'In developing the specific questions from-which core, vessel, and containment integrity are determined it is necessary

' to consider the front-line functions which protect the health and safety of the public. These are:

1) Reactor Shutdown,

2) Reactor Vessel Make Up,

3) Containment Heat Removal, and

4) Debris' Cooling.

The questions to be posed must address each of these front-line functions.

They are briefly discussed individually below.

Reacter Shutdown Failure to shutdown the reactor when the turbine has tripped exposes the plant to loss of clad integrity and loss of containment integrity and their consequences if the backup systems which must operate.on failure to scram also fail. Such failures can cause loss of clad integrity due to potential reactivity transients'or unstable behavior when ARI and SLCS have failed in-response to ATWS.

Since the shutdown heat removal systems'can only accommodate decay heat levels' it is. essential to reduce the fission power to avoid containment failure when ARI and SLCS have failed. 'For non-isolation cases this is accomplished by

. recirculation pump trip and feed water runback to a rate which can be

- accommodated by the steam by pass system. ' For isolation cases actions must be taken to extend the time available to allow manual rod insertion. These are:

1) trip of'the recirculation pumps

2) reduction of reactor pressure,

3) addition of mass to the suppression pool, and

4) if available and permissible, use of the wetwell vent, m

t . Reactor Vessel Make Up If sufficient reactor vessel make up is not provided in a timely manner, the core will lose two phase cooling and fuel temperatures will begin to rise due to.the reduction in heat transfer and transport rates. If high pressure systems are available, it is.necessary to derive the minimum flow necessary to maintain adequate core cooling and the time at which such flow must be provided. Factors which can influence this are: I I

1) initial vessel inventory, 133 l

_ _ _ _ _ . _ _ _ - - - - - _ _ _ _ - - - _ _ _ - --. i

5 O

l l

e 1

s 1

1 i

I 134

l

)

w o

2) reactor shutdown, and

3) a loss ' of coolant, causing vessel pressure reduction.

~l These issues are presented in subsequent view graphs and simplified. hand calculations for some cases are presented.

Containment Heat Removal The normal and preferred-method for removal of heat from the containment after I a turbine trip is directly from the reactor, in the form of steam, to the main )

condenser via the_ main steam bypass line. If suppression-pool heat up has-occurred, the bypass system cannot remove the heat involved, and the-suppression pool cooling system must be used. The suppression pool cooling.

system, however, can only stabilize the pool temperature at decay heat power levels. For this reason it is essential to either shutdown the reactor or maintain availability of the main condenser. Even when the main condenser is-available, however, it is essential to achieve reactor shutdown as quickly as possible since it is necessary to operate the reactor with a makeup flow in adequate to maintain the normal reactor water level, a poorly analyzed and untested mode of reactor operations.

Debris Cooling If adequate core cooling is not ytovided initially and core damage initiates,'

the operator respetse strategy must bei

1) to restore vessel makeup at the earliest possible time to terminate the damage progression before reactor vessel-failure, and-

2) to prepare for reactor vessel failure by flooding the drywell floor and operating drywell sprays.

If the reactor vessel- can be saved, the threat to containment integrity is greatly reduced. This threat involves:

1) generation of large quantities of non-condensible gases,

2) severe heating of the drywell atmosphere and components, and

3) potential direct thermal attack on critical drywell components by core debris If vessel failure cannot be prevented, preparation for its failure can reduce the magnitude of the threat by cooling the debris as it falls to the pedestal room floor.

135

l. . .. . _ _ _ - - _ _ _ _ - _ - _ _ _ _ - -_ _

u-CONSIDERATIONS FOR CLAD INTEGRITY o DEFINITIONS OF REQUIREMENTS FOR CLAD INTEGRITY o MAKE UP FLOW REQUIREMENTS o BOILDOWN TRANSIENTS-0 BLOWDOWN TRANSIENTS o MECHANICAL CLAD INTEGRITY i

136 l

, _ _ _ _ _ __ _ _ _ _ . - . _ _ _ = _

'I}

I Considerations for 011d Intecrisv When we;. speak' of core integrity, we are actually speaking of integr;ty if. the fuel clad. As icng as the clad maintains integrity, the fission products

.cannet escape and the potential'for hazardous levels ofEradiation exposure.tc the.public is quite low.

Clad integrity.may-be lost by two different' mechanisms,

'~ '

1. ' severe clad oxidation and.

2. mechanical failure of the clad.

' The first bf these is caused by lack of two phase cooling for some period of time. In this event, cooling is arhieved only by heat transfer to the steam environment and as a result, the. fuel and clad heat up to temperatures at which chemical reaction rates between the' zirconium clad'and the' steam becomes significant. Since this reaction is. exothermic and the rate increases with.

temperature, a temperature level can be reached at which the heat produced by.

the chemical reaction exceeds the decay heat' level.. At that temperature 'the rate of temperature increase increases rapidly until the melting point of the clad material is reached and relocation of molten material reduces the reaction rate locally. The molten material flows or falls to lower regions of the' core where lower. temperatures may cause refreezing may cause. refreezing of the melt or water may quench the melt and terminate the chemical reaction.

Mechanical-loss of clad integrity.is primarily a result of stresses in the clad caused by internal gas pressure or mechanical interference with the U0 pellets or a combination of these two sources of stress.r .The only credible 2 source of.this type of clad damage are:

'1. a'brief period of inadequate core cooling with a rapid quench by refloods or

2. an ATws event involving unstable operation or a severe reactivity transient.

In the case of the first, we do not make a distinction between this form of' clad damage and that caused by severe oxidation.. The time period in which clad is vulnerable to this form of loss of integrity as opposed to severe oxidation or melt loss of integrity is very short and the conditional probability of vessel injection recovery in that time period is relatively small.

Mechanical clad damage in ATWS events may occur when the reactor is taken into a range of operating conditions where it becomes unstable or when a rapid insertion of reactivity occurs. In the case of unstable operation the reactor goes'into an oscillatory power mode of operation. These oscillations can become quite large and the resulting cycles in thermal expansion and contraction can result in eventual mechanical failure of the clad by crack formation. In the case of reactivity insertions, the cause may be a sudden increase in the rate of injection of water.

The criteria for occurrence of each of these forms of clad damage is discussed below.

i 137

,-___2 ...-- -.-

[.

f'.

(

i-138

ore Oamace Oue to 0xidaticn The reactor core is composed of three major :cmponents: cir:aloy : lad fuel red, :1r:aloy :hannel boxes and stainless stea_ :ontrol clades. These components continuous experience seme extremely small imount of oxidation at normal Operating temperatures. Thus, some amount of uxadation can occur without considering the core to be damaged. The oxidation reaction rate is strongly temperature dependent. If core cooling is interrupted, the core temperature will increase which in turn increases the : lad oxidation rate.

This oxidation reaction causes the zircaloy to become brittle and thus more susceptible to thermal shock upon reflood. Experimental data indicates that at temperatures greater than 2000 F and with more than 30% of the clad oxidized the fuel clad shatters upon reflood, (ref. 1) forming a rubble bed.

Clearly this represents ma]or core damage. This condition is very unlikely to occur in an actual reactor accident sequence, however, since at 2000 F the fraction of clad oxidized is only a few percent and the temperature is rising rapidly. The maximum clad temperature which would characterize a 30%

oxidation level would be far in excess of 2000 F and would probably involve some degree of clad melt.

The data also demonstrates that restoration of core cooling prior to exceeding the 2200 F and 17% equivalent clad reaction limits set by the Code of Federal Regulations (ref. 2) assures integrity of the clad barrier. The integrity of the other core components is inferred. Therefore, if adequate core cooling is lost, core damage will not occur if adequate core cooling is restored prior to exceeding 2200 F and 17% equivalent clad reaction.

Adequate core cooling is assured as long as the fuel is cooled by two phase flow. Two phase cooling of the fuel is assured if the downcomer water level is above the top of the active fuel (TAF) . Because of the swell in the core due to the boiling process, two phase cooling can be demonstrated, in the short term, at downcomer water levels of 2/3 core height. This level is also known as the jet pump throat elevation. Therefore adequate core cooling for the short term is defined in terms of a downcomer water level above the jet pump throat elevation. Because of the limited water volume inside the core shroud, core dryout may occur only a short time after water level falls to the jet pump throat elevation.

At later times in the transient, the 2/3 core height criterion becomes invalid as a result of the decreased amount of swell due to boiling as decay heat decreases. In such cases a downcomer level approaching TAF may be required to j assure adequate core cooling. In such a case, high temperatures would be j experienced in the low powered bundles first as a consequence of reduced swell.

In Susquehanna cores the axial power profile may also influence the definition of adequate core cooling since various bundle types have differing axial l profiles. Some bundles may have power peaked toward the top of the bundle j while others are strongly bottom peaked. This difference will strongly i influence the degree of swell and the vapor superheat developed above the top of the two phase level.

l Adequate core cooling can be lost in two ways. First, injection flow to the vessel can be lost, in which case the water inventory will be boiled off and transported as steam through the SRVs to the suppression pool. In this l situation adequate core cooling is assured until the downcomer water level l 139

e i

140

-___-...-_--2 __ - _ - - _ - _ _ _ _ _ _ - . _ _ _ - - _ _ _ . _ _ - _ _ _ _ _ _ _

/ k-falls down :oi he t ;et pump throat aslevation. Second, a rapid depressurizat:.:n or an.unisolated; break in the primary system piping can occur wnich will

-bicwdown-the reactor pressure' vessel. The differer.:e in phenomena between these sequence types imposes different timing and performance requirements en

'the plant equipment.

Mechanical Tallure of the Clad Pressure Mechanical failure of the clad pressure boundary can result from extensive severe power. cycling of the fuel or-from a severe power excursion. Rapid '

gross failure of this nature is not expected to occur except for ATWS events.

~

The fundamental technical issue, relative to BWR ATWS is the lack of any experimental; data for reactor operation in the physical regimes appropriate to ATWS combined'with a deficiency of adequate analytical tools to describe reactor behavior by theoretical means. ~Certain limits on reactor response-to ATWS can be reliably derived from conservation considerations. As an example, it is obvious that, within certain limits, the power level of a critical'

. reactor in natural circulation flow will be just sufficient to transform the makeup water into steam for release from the reactor at a rate.which-just equals the makeup rate. ~What we cannot derive, with fully benchmarked methods, is the downconer water level and core flow rate that will result.

Perhaps.even more important, we cannot assure that the reactor will.not operate in an oscillatory, limit cycle mode under the conditions selected for evaluation with a " time averaged" mass balance being maintained.

The two technical issues which have been identified as important to success in mitigation of ATWS events are:

-1. Limit cycle operation.

'2. Reactivity excursions during vessel reflood.

- The criterion that we have defined for avoidance of this type of clad damage is that if the reactor is not depressurized while critical, no damage will occur. 'If depressurization becomes necessary due to exceeding the HCTL or failure of high pressure injection while the reactor is still critical, clad damage is postulated to occur.; This damage is not related to inadequate core-

ooling, however. The need to depressurize exposes the reactor to potential reactivity excursions in the. case of loss of high pressure injection due to the^ fact that a core dryout and reflood sequence is likely to be generated.

In the case of depressurization because of exceeding HCTL, the pressure reduction is know to reduce stability when the reactor is already known to be L operating in a region of marginal stability. The assumption of oscillations

. of sufficient. severity to result in loss of clad integrity may be excessively conservative, but at this time we are unable to perform quantitative analyses of the consequences.

l: In subsequent view graphs we will discussa I L 1. make up for requirements, l 2. boildown transients,

3. blowdown transients, and

4. mechanical clad integrity.

ref. 1 Embrittlement criteria for Zircaloy Fuel Cladding Applicable to Accident Situations in Light Water Reactors: Summary Report, g .H. M. Chung and T.-F. Kassner, NUREG/CR-1344, January 1980.  ;

l: ref. 2 10CFR50 Appendix K. 141

MAKE UP FLOW REQUIREMENTS

\

200 -

b 150 -

i s

1 3 10 0 - ,

~

d m

B x

y 5'0- -

o i  ; & 4 4 4 4 EME (SEC) - NATURAL LOG 142

\

Makeup Flew Requirements Makeup flow can be lest at any time during the accident sequence and at any point in the operating pressure range. The loss cf makeup may also be complete er partial. To evaluate the adequacy of core cooling in this situation it is necessary to know the minimum makeup flow required at the time makeup is lost and how much time is available to restore makeup. Botn tne minimum makeup flow rate and the boildown time can be determined using end point thermodynamics and the decay heat curve. As recommended by the L'SNRC, this evaluation utilizes the more realistic decay heat curve generated by Eric Haskin of Sandia. This data is presented in Appendix 1.

The minimum makeup flow must be sufficient to replace the water boiled off by decay heat. If it is loss than this value boildown will commence. If a constant pressure saturated system is assumed and the reactor water level remains constant, the minimum makeup flow can be computed using the folicwing equation

= a (t) , (1) min '

(hg-hzu) here, W

,1 (t) is the makeup flow required at time t, #/sec.

q(t) is the decay heat at time t obtained from Table 1, BTU /sec.

h is the enthalpy of saturated steam at the reactor pressure, 9 BTU /#, and h ,is the enthalpy of the makeup flow, 58 BTUs/lbm at 85 F.

The steam enthalpy varies only slightly over a broad pressure range and so a constant value can be used without significant error. Makeug flow from sources external to the primary containment rarely exceed 85 F. If 85 F water is assumed to be used for makeup the minimum flow is only a function of decay heat. The flow rate for these conditions is plotted as a function of time after shutdown in the view graph. This data is also presented numerically in Appendix 2.

143

4 l, i i

>2?j~<n o r g0rOog2 ix22t~mzH - -

=n h-c $*

'L 5 3 5_ 5,,S 3 4 } E

- + 3._

+ + ,

• t

=

=.. =, "

v g "!

t v

L Pt * . L, d At

' a t A s

5 5 F " i.

e . !,

">, E' t* 6 l

d -4 6 0_ e n U e n i

0 0 "6

W O o=

oP

• =

" P t,

?,

P "-

d" D L 3 3 sO "

T 5 U 2 H g e '-

4 g

S A..

- ~

- R '- - -

~

~

- . ~

L y

-. ~

I t - ,

- - 0 A

' - 2 E

... )R MN ,

U

~

~

TO I -

- O H

y ' .,,

I , -

(

S T ,

VC E ,

- - - N T J

.5W 1

AN "

- O O

I

- D RY ,

~

~

~

T U

H T N

. ~

~ ~

H A ' - _

S PT ,- -

MU 7 ".

- .0RE 1

UO e,

- / T F

PHT A

/,/

I I

a

, d_ E LW

/ M J ,, ".. I T

O T

., , 5

/

/ - .

E */ .,

T M

I

/

, ' . , /, - '

".-a -

N /, l.

o'# '1 '

WO 0

~

g 0

~

4 lo:to .

2 i [

D 0

D 1

l -

l 0 mWDOI* V4Og* n g3k. pW, OF y1pZyOO 6W

- I -

8 wa*

l ll t "

o 3

. 1 i'

f p Analysis of Boildewn Transients with Scram The bo11down time is regaired to determine now much time is available to i restore makeup. If the reactor press'are is assumed to remain constant, the bcildown time is computed using a simple energy balance. The integrated decay heat is used to boil off the liquid water mass in the vessel. This energy balance takes the following forms

( s + Vg (1-s) ] ig in f g' in' 9(

here V is the water volume outside the shroud, above jet pump throat, ft.

V is the water volume inside the shroud, above jet pumpt throat, ft.

a is the average void fraction inside the shroud, W is the inlet flow rate (less than Wdn) , #/sec.

is the boildown time, sec.

f dtq(t) is the integrated decay heat at the boildown time given in the decay o heat table, BTU u, is'the specific volume of the liquid, ft /#,

h ' is the enthalpy of the inlet flow, BTU /#, and b"istheenthalpyofthesteam, BTU /#.

9 The water volumes inside and outside the shroud can be obtained from the weights and volume drawing (Appendix 3). When applying this equation, equilibrium thermodynamics and a constant pressure are assumed. A constant pressure is not realistic. However, the pressure will vary only by about 100 psi. The thermodynamic properties of water do not change radically over this range thus the constant pressure assumption does not introduce much error.

Because the boildown time is a limit of integration and is also used to determine the total makeup mass, the solution of this equation is iterative.

In the special case where the makeup flow is zero the boildown time can be read directly off the integrated decay heat curve. This information is used to determine what equipment provides adequate core cooling.

145

ANALYSIS OF BOILDOWN WITHOUT SCRAM FULL ATWS60-180 SECONDS TO TAF l

PARTIAL ATWS UP TO 780 SEC FOR TURBINE TRIP 48 t

146

Anal / sis of Bo11down without Scram As in the scrimmed condition adequate. core cooling is assured if the core is l :ocied by two phase flow. Again two phase flow can be expected along the entire length of the core if the water level is kept above the et pump throat. During an ATws condition, however, the water level and fission power l are dependent upon one another. A transient reactor kinetics code is required I to determine this relationship. CRNL has studied the water level as a function of steady stata power at various reactor pressures, if the reactor power remained constant at a set water level and pressure, the minimum makeup flow rate could be computed using a formulation similar to the one presented in-the previous decay heat discussion. However, the boiling water reactor develops thermal-hydraulic instabilities as the core flow is reduced. Because of these instabilities we cannot be sure all channels are receiving two phase cooling. Because of this, the minimum water level that will avoid severe oxidation is restricted to top of the active fuel.

If makeup flow is lost during the ATWS transient the boildown is very fast due to the high power state of the core. This problem must also be solved using a reactor transient code. Several such calculations for the full ATWS case have been performed by the industry and the NRC. These calculations indicate that the time required for the water level to fall to TAF is between 60 and 180 seconds. At the other extreme, if the boildown starts at the feedwater high level trip setpoint during a partial ATWS, the boildown could take as long as 790 seconds. 1&ue evaluation of adequate core cooling for the ATWS transient 1 squires a transient computer code.

i 147

ANALYSIS OF BLOWDOWN BLOWDOWN RESULTS IN RAPID LOSS OF COOLANT INVENTORY AMOUNT OF COOLANT LOST DEPENDS ON PRESSURE REDUCTION RATE OF DEPRESSURIZATION TIME AFTER SHUTDOWN MUST REFLOOD PR.10R TO VIOLATING CLAD INTEGRITY l

1 148 i

l l

Analysis of Blowdown l

If the reactor is rapidly depressurized through either the safety relief valves or a primary system pipe break, liquid phase will be lost as mass flowing out the break depressurizes the vessel. The blowdown may be intended to allow a low pressure pump to be used for vessel makeup when ADS is activated or undesired as in the case of a pipe break. In any event, the important phenomena to consider are the rate of depressurization and the mass lost during the depressurization. The rate of depressurization and the mass inventory lost depends upon the phase of water being discharged and the size of the opening. Steam breaks will depressurize the reactor more rapidly and ,

result in less mass loss than a liquid break. This is because latent cooling is a much more effective than sensible cooling. The reactor vessel will begin to depressurize when the energy flow out the break exceeds the energy generation rate. There are two sources of energy to consider. These are the decay heat and the sensible heat stored in tha reactor water, the reactor core, the vessel, and the vessel internals. If cold water is being injected during the depressurization it must also be considered in the energy balance since it will reduce the enthalpy of the water in the RPV and therefore reduce the reactor pressure. This is a very complicated process which is best analyzed by a transient computer code. Several LOCA cases are documented in the FSAR as part of the design basis analysis. GE has also documented detailed LOCA analysis for each of the product lines in.NEDO 24708. These analyses are success oriented in that they demonstrate what equipment combinations are sufficient to mitigate a LOCA without exceeding the criteria specified in the Code of Federal Regulations. The necessary requirements, however, must be inferred.

Vessel depressurization calculations are best done using suitable computer codes designed for the purpose. If such codes are not available, the special case for a pure steam blowdown can be evaluated approximately by hand calculations. To perform such a calculation, we must be select the time interval required for the blowdown. The calculation is most valid for depressurization events which are relatively slow (several minutes or greater) in order to assure a high degree of thermal equilibrium at the end of the process. More rapid depressurization events can also be evaluated, but generally some allowance for a non-equilibrium final state should be made.

The calculation is performed by consideration of conservation equations for energy, mass, and reactor volume. These three equations permit derivation of an equation for the blowdown steam mass as a function of the initial state of the system (fully known), the mass and energy of makeup water added during the process, the decay heat released, and the final thermodynamic state of the system (temperature and pressure only). The solution of these equations and the symbol definitions used are presented in Table 1 and Table 2 of Appendix 4 respectively.

It should be noted that an allowance may be made for failure to fully achieve thermodynamic equilibrium in the blowdown process through the provision of the factors f y, f , pf, which account for the fact that these large masses may not fully come into thermal equilibrium with the liquid and vapor phases in the vessel if the depressurization event is too rapid. In reality, the reactor vessel almost certainly will never be in complete equilibrium when the depressurization process is complete. That portion in contact with the liquid 149

_-.c ,----r----,- - - - - - - - - - - - - , - . , - - - - - - - - - - - - - - - - , - - - ------------------------r--, , - - - - - - , , -- - - - . - , - , - - - - - -,- , - - , . - - - , - - - , - , - - - - - - - - - - - - - - - -

e

~

a 1

)

1 1

1 I

l l

l l

1.

1 150

- --- - - _ _ _ __ __ __ __ _ __ . 1.

phase would probaoly be close to the same temperature as the final liquid phase, but the portion of the vessel in contact with steam only would pr:caoly be at a considerably higher temperature due to relatively poor heat transfer.

The portion of the vessel in contact with steam 7tves up its energy as superheat to the steam, in any event, which was not considered in the derivation. For this reason the value of f.7 chosen should reflect the fraction of vessel mass in contact with steem only using an average water level over the depressurization period in the determination.

A similar situation may also apply to some vessel internals scch as the steam dryer which is well above the water level. Some portion of the steam separators may also be involved. Nevertheless, the value of f, *chosen should usually be much nearer unity than f y.

In the case of f it is probably best to assume two phase cooling always F

exists unless the final water level calculoted is extremely low.

The calculation of final water level is quite simple. Using the final value of liquid mass and density, the liquid volume is calculated and this is used to determine the final water level from a table of free volume in the vessel as a function of elevation. This table is fairly simple to develop. An example for Susquehanna is given in Appendix 3. The influence of core voiding on final elevation is neglected since the pressuro losses due to natural cire21ation flow are low. This means that collapsed water level inside the shroud must equal that outside the shroud. This assumption is slightly conservative in terms of estimating final water level. For final water level which is calculated to be below the jet pump throat elevation, some caution must be used sinco the downcomer/recire loop volume becomes uncov.71 ed from the lower plenum and the volume inside the shroud.

Caution should also be used in the values of M and h g use The Mgg should consider all liquid phase including the recirculation koops.d. The value of h g should be an average value which reflects the variations in initial liquid enthalpy throughout the reacter vessel.

151 l

w_-________________.

1

. 1

)

s LOSS OF CLAD PRESSURE BOUNDARY )

{

i-i THE LOSS OF THE CLAD PRESSURE BOUNDARY IS POSTULATED TO OCCUR FOR EITHER OF TWO REASONS LIMIT CYCLE OPERATION, OR REACTIVITY EXCURSIONS LIMIT CYCLE DECAY RATIO OSCILLATION w me& m n m l5llS

, Ru- is i i i i i 12e g 4 .

,e

/.

M  ! N e

g se

/

[:

....s.................).............

i o  :

Q.  :

i i 1 se -. . ... ...... ........ .. .........._

e i i se 4e ** **

FLOW %

152

toss of Clad Pressure Boundary Limit :ycle operation represents an unstable mode of reactor Operation in wht:n the system non-linearities limit the magnitude of the unstable excursiens and result in a bounded oscillatory mode of operation. The l

magnitude of the oscillations are dependent upon the operating parameters of the system, and the magnitude may be ruite large under some conditions. Limit cycle operation has been observed in 64Rs under natural circulation flew conditions with normal downcomer water levels. The concern then is that as downcomer water level falls, as it must in an ATWS event, is there an increasing trend to limit cycle operation, and, if so, what are the magnitude and the frequency of the resulting oscillations in reactor parameters.

We do not expect resolution of this issue within the next several years, and we are forced to rely on our Judgement to assess the importance of this issue.

Our approach has been to limit the degree to which downcomer level is allowed to drop, except under extreme conditions of equipment failure, in order to minimize the probability and magnitude of limit cycle operation. It is our expectation that oscillatory behavior will be sufficiently mild that there will be no significant risk of core damage or loss of instrument readability.

In the event that limit cycle operation does occur, we would not expect damage more severe than mechanical failure of the clad in some bundles.

For our evaluation of ATWS we have assumed that severe extended limit cycle operation does not occur when adequate makeup flow is available and when reactor pressure is maintained at the design value. In this situation adequate makeup flow is defined in terms of sufficient flow to keep the water level above the top of the upper plenum. This is full HPCI flow.

If the reactor pressure vessel is ever depressurized while the reactor is still critical the void formation as a result of the blowdown will cause the core to become subcritical. If the reactor is reflooded using the high volume low pressure pumps, a prompt critical insertion could occur. Such insertions have been calculated using the TRAC-G code. The magnitude of the power excursion depends on the rate and magnitude of reactivity insertion.

'Sufficiently powerful excursions can cause clad failure from the combined effects of pellet-clad interface forces and increased internal gas pressure.

If such severe reactivity insertions are avoided, the low pressure of the new operating power nevertheless assures LCo. In this case we have postulated some degree of clad damage dependent upon the duration of this condition.

In the view graph diagram we have shown lines of constant decay ratio in the stable operating regime (to the right of the heavy line corresponding to D.R.=1.0), and lines of constant power variation magnitude to the left of the heavy line on a power flow map derived for design pressure. At lower flows than 30%, the reactor was found to go into an aperiodic mode of power variation having widely varying amplitudes. This mode of operation is probably more severe than pure limit cycle operation behavior.

If reactor pressure is reduced, the boundary between stable and unstable operation will move to the right as will the flow at which aperiodic behavior initiates. For this reason we ascribe mechanical clad damage to event sequences in which reactor pressure is reduced while the reactor is still critical.

153

CONTAINMENT INTEGRITY WITH ADEQUATE CORE COOLING f o REJECT DECAY HEAT PRIOR TO EXCEEDING THE CONTAINMENT ULTIMATE STRENGTH o TIME TO ESTABLISH DECAY HEAT REMOVAL ESTIMATED BY CONVERTING INTEGRATED DECAY HEAT TO VAPOR PRESSURE 4 i

o DECAY HEAT REMOVAL MUST BE ESTABLISHED PRIOR TO VAPOR PRESSURE AND NONCONDENSIBLES IN THE WETWELL AIR SPACE EXCEEDING THE CONTAINMENT ULTIMATE STRENGTH WITHOUT MASS' ADDITION WITH MASS ADDITION l

154 i

m.__________________ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

h l-Containment Intecrity with Adecuate Core Cooling 1

l l :n accident sequenceu where hydrogen is not generated by metal water reaction the ultimate status of the containment may be determined by consideration of j the rate of suppression pool heatup. In LOCAs and transients this is simply a matter of considering the stored energy released from the vessel and the deccy heat. Frequently, this calculation may be done without use of transient computer programs if containment heat sinks are neglected. Consideration of heat sinks can extend the time before containment overpressure failure, or a need to vent to avoid it, by a significant amount, however.

In the case of ATWS events sbnilar calculations may also be done, but the fission power will represent a much greater rate of heat generation.

Approximate hand calculations may be used to determine the time available for boren injection of manual rod insertion simply by assuming a linear decrease in power from the stable level associated with initial makeup flow down to the decay heat level when shutdown boron has been injected or sufficient rods have been inserted for hot shutdown. The transient boildown energy from the start of the ATWS transient must be added to this.

If a conservative (and upper bound) calculation is desired, constant power can be assumed out to the time of hot shutdown. In the case of manual rod insertion, this conservatism is not recommended.

In all cases, IOCAs, transients, and ATWS, mass addition to the suppression pool can greatly extend the time to containment overpressure failure or the time to venting to avoid such failure. A simple calculation can be made to estimate the degree of time extension.

Initially in a transient, stored energy in the reactor and decay heat are rejected to the suppression pool. This energy raises the temperature of the suppression pool water, and thus increases the vapor pressure. The suppression pool is a large volume of water and therefore, the pressurization of the containment is slow. If this energy is not eventually rejected from the containment, it will fail on overpressure when the pressure reaches the containment's ultimate strength.

The containment ultimate strength must be evaluated prior to establishing a containment performance requirement. Such an evaluation has been performed for the Mark I by the BWROG. An analysis of the Mark II is presented in Appendix J of the Limerick PRA.

With this information established the time to reach containment overpressure failure can be estirated using the following simple energy balance. Two cases are reviewed: without and with mass addition.

Increasing the suppression pool mass increases the containment heat sink and therefore decrease the containment pressurization rate. Studies performed by PP&L show that the time to containment failure can be increased up to a factor  ;

of 3.

The time to containment failure can be estimated using the following equations.

155

)

J f

l i

i;.

..s 156

- -- - - . . - ~ - - - _ _ _ _ _ _ ___

Case 1, no supplemental mass' addition to the pool:

Specific' Mh-Mh Inthalpy " s-s-M M, where M = initial' pool. mass, 4 .

M, = mass of steam condensed in pool, e h, = initial pool specific enthalpy, BTU /#

h .= specific enthalpy of steam, BTU /#

Case 2, supplemental mass added to pool Specific M_h_ + M h; + M_h_

Enthalpy " " M + M" + M~ ~

where Mg=massofwateraddedtothepool,#

h, = specific enthalpy of added water, BTU /#

6 The maximum allowable final pool mass is 15.2x10 ,, r The specific enthalpy is that of the bulk suppression pool. The vapor pressure, however, is determined by the pool surfgce temperature. If the pool

. stratifies the. pool' temperature could he-20 to 30 F higher than the bulk.

This is accounted for by adjusting the allowable bulk temperature to account for the stratification and-then use the specific enthalpy of the adjusted bulk l

temperature in the evaluation of the time to containment failure.- The time to containment failure is obtained from the integrated decay heat curve.

As stated above, the calculation of time to containment failure can be done withisimple hand. calculations in this case where no significant hydrogen generation has occurred. The vapor pressure of the suppression pool is easily calculated as a function of time from the equations above and the decay heat curve of Appendix 1.. Some care must be used however in the' treatment of containment non-condensibles.

In the case of LOCA the non-condensibles are driven from the drywell into the wetwell by the flow of steam through the LOCA vents. If reflood of the vessel and subsequent makeup is controlled so that decay heat is subsequently removed from the core by boiling and release of steam through the break to the

!. drywell, the non-condensibles will remain' contained in the wetwell air space and the vapor pressure in the drywell will equal the combined partial pressure of the suppression peol vapor pressure and the non-condensibles in the wetwell.

on the other hand, if heat is removed from the core sensibly by supplying a sufficient quantity of water to flood the core and remove heat without boiling, the vapor pressure in the drywell could exceed that of the 157

y__..__ _ _.

q

.i

'h I

l i

158 t

(

l l

I i

n i

suppression pool. nly by a'.small'a= cunt, depending on the flow-rate used, and.

some portien of the non-condensibles would then flow back. into the drywell via '

the vacuum breakers. A precise :alculation of a.his situation would require use of a transient containment : ode,.but bounding calculations can be made by arbitrary assignment of the non-condcnsible partitioning.

In the case where LOCA has.not occurred and decay heat is removed from the core by steam which is routed to the suppression pool via SRVs, the entire non-condensible inventory will' ultimately be driven into the drywell by water vapor pressure above the pool. If,drywell temperatures can be approximated, this case also:is amenable to hand calculation estimates for time to failure.

l 1.

159 L

I ^

L _ _ _ _ _ _ _ _ _ _ . _ _ . _ _ _ _ . . . . _ _ _ _ _ _ _ _

m _____r_

SEQUENCES WITH INADEQUATE CORE COOLING CONTAINMENT INTEGRITY LINKED TO CORE DAMAGE PROGRESS 10N.

THIS REQUIRES VESSEL AND CONTAINMENT INTEGRITY.TO'BE EXAMINED SIMULTANE0USLY

. MUST COMPUTE PROBABILITY OF CORE DAMAGE STATES WITH CONTAINMENT FAILURE MODES VESSEL INTACT VESSEL FAILED CONTAINMENT INTACT CONTAINENT VENTED CONTAINENT OVERTEMPERATURE FAILURE CONTAINENT OVERPRESSURE FAILURE l

j 160

- - - - - - - - _ _ _ _ . - - . _ _ - - - - . _ . , _ . - . - - ...--_.._.__-_.n.- . - - - _ _ . _ . . _ - _ _ _ . , _ . . _.-__n_,__ - _. _ __._- .,-.__ __ -- , . _ _____

f Sequences With :nadecuate Core Coolinc

n accident sequences where less of injectien capability leads to inadequate core cooling a number of complexit es arise. These include l

l

1. metal-water reactions add non-cendensibles to the containment free j volume, q

1

2. if injection is not recovered, the core damage will progress to the J point of reactor vessel failure, j

3. if the reactor vessel fails, additional non-condensibles are produced and various critical containment components may be attacked,

4. there is commonality in pumps which can supply the reactor vessel, drywell sprays, and provide suppression pool cooling.

These factors create a series of inter-relationships which are too complex to adequately represent with an event tree. The process of dispositioning the various outcomes of such a sequence is best demonstrated by listing the allowable outcomes of the sequence. These are:

1. core damage with reactor vessel and containment intact,

2. core damage with reactor vessel intact but with containment vented,

3. core damage with reactor vessel intact but with containment overpressure failure,

4. reactor vessel failure with containment intact,

5. reactor vessel failure with containment vented,

6. reactor vessel failure with overtemperature failure of the drywell, and

7. reactor vessel failure and containment overpressure failure.

Reactor vessel failure here implies that core damage has progressed to the point of lower plenum dryout and high temperature failure in the lower head area. In general, venting implies that overtemperature failure has been avoided or will be avoided by drywell spray operation and that overpressure failure will be avoided. In general venting will not prevent drywell overtemperature failure caused by liner attack or suppression pool bypass, and such cases result in unscrubbed releases. It can avoid failures caused by a combination of temperature and pressure and it can scrub the early releases before the debris causes liner attack or suppression pool by pass. Venting will generally prevent containment overpressure failure, except possibly in the case of ATWS events.

While these seven final plant states are considered to be the only possibilities, there are degrees of damage that may be considered. For example, BWRSAR permits characterization of the extent of core damage before recovery of vessel injection and core stabilization at several stages of the 161

,_ __m. r.__,__-._,-____ _-. . ,,,_ __ - _ _. . __,__

7-__.__

,i,,

I'

(.

> t

- l'62

l damage progression oefore reactor vessel failure must occur. Similarly we )

believe that an analogous situatien exists for the core debris pour frem the i failed reactor vessel either in terms of the points at which the debris pour I can-be terminated or the point at which the debris :an be stabili:ed on the i drywell floor, or both. We do not currently have experience with the CONTAIN i code so that we :annot state any firm conclusions in this regard.

Consideration of the seven final plant states which are allowable and the various degrees of damage progression which may.be derived for them :learly indicates that the probability of a given final stata depends on the ,

probability of one or more successful operator actions within a given period '

of time. These actions involve:

1. restoring vessel injection, i

2. initiating drywell sprays, ,

I

3. initiating suppression pool cooling, and l l

4. operation of the containment vent, j The times by which these actions must be taken are determined by the calculation of the accident transient and by specification of the actions needed to avoid a given level of plant damage. The process by which the 4 conditional probabilities are derived is presented in Appendix 6.

i l

163 ,

l CORE DAMAGE PROGRESSION'

' BUNDLE BLOCKAGE MODEL 0

RESTORE CORE COOLING PRIOR TO ANY CORE N0DE EXCEEDING 3000 F o BOILDOWN 48 MINUTES AFTER 2/3 CORE HEIGHT i 0

16 MINUTES AFTER 2200 F o RAPID BLOWDOWN 14.4 MINUTES AFTER CORE DRYOUT

~

COMPONENT REL0 CATION MODEL RESTORE COOLING PRIOR TO BOTTOM HEAD DRYOUT o BOILDOWN 158 MINUTES AFTER 2/3 CORE HEIGHT 0

112 MINUTES AFTER 2200 F o RAPID BLOWDOWN 83.9 MINUTES AFTER CORE DRYOUT TIMES OBTAINED USING BWRSAR 164 1

Core Damace Progression The determination of the initiation of core damage is a relatively simple matter with very little uncertainty inv ;ved in the case of inadequate core cooling. The simple hand calculations cescribed or referenced in previous view graphs are quite simple, and a number of transient programs exist wnich also provide reliable results. Description of the core damage progression is not nearly so straight forward. There are, in fact, alternative models for this process which produce drastically different results. In this presentation we shall discuss only the two models with which PP&L has had experience, MAAP and BWRSAR.

The MAAP code uses only two temperatures to characterize a core node, one for the fuel, clad, and channel box, and a second for the control rod. The relocatian of material of a core node only begins when the node temperature reaches a pre-specified temperature. Relocation of different materials at different temperatures is not described. It is further assumed that for some degree of relocation the channel becomes completely blocked and neither water or steam can any longer cool the bundle. The blockage also causes the metal-water reaction to terminate from lack of a steam supply.

The molten material eventually relocates to the lower plenum where the melt quickly attacks instrument or CRD penetrations and causes failure of the penetration and flow of the melt from the vessel.

The criterion given by IDCOR for stopping the damage progression was that the core should be reflooded before ang core node reaches 3000 F. Shortly after i some part of the core reaches 3000 F, it is assumed that the core is essentially uncoolable because of the blockage phenomenon. This criteeion imposes a very severe limit on the time available to restore vessel ir jection.

Further, if vessel injection is restored after the 3000 F limit, the melt progression and vessel failure cannot be prevented. For Susquehanna accident sequences we determined that we could save the reactor vessel in only 70% of all core damage sequences.

We believe that the MAAP core damage progression models and material relocation models are not realistic, however, and that the criterion imposed for core stabilization (preventing reactor vessel failure) is overly conservative.

In 1987 PP&L began trial calculations using the BWRSAR code developed at ORNL.

The models used in BWRSAR seemed to provide a more realistic (although still crude) representation of the process of core heatup and the subsequent relocation of materials. It uses a four temperature model for each core node (UO3 , clad, channel box, and control rod) and provides the capability for  ;

des 5ribing the different temperatures at which various materials initiate relocation. The model also does not presume channel blockage as a consequence of melt relocation, and this difference does result in much greater degrees of metal-water reaction. Considering the nature of the BWR core, we believe this representation is more credible than a model which presumes a fully coherent blockage which cuts off all flow of steam and water.

The use of multiple relocation temperatures allows a description of heat up and melt relocation of control rod and channel box materials while the fuel j rods remain in place (consistent with the results of the DF-4 experiment).

165

)

O 166

-_ x--___----_-_-___-____

The UO, material, clad by a thin Cro, sheath, remains in place af ter the : lad

enlum has all reacted with steam'er relocated downward by melting. The UO, rods continue to heat up and eventually lose their strength and ecllapse in'a mostly solid state to the core support plate. Cepending on the axial power profile and the nature of the accident sequence the :cre plate may already have failed due o water boil off and heatup to the failure temperature by falling :entrol rod, channel box and clad material. f net, the collapse of the UO, structures quickly leads to this result, and in either case, the UO., and other debris, fall into the lower plenum in an essentially solid debris' form and are quenched by the water in the lower plenum. The resulting debris bed is then considered to remain coolable until dryout.

This criterion, that the debris bed remains coolable until dryout, results in an allowance of much longer time period to regain vessel injection capability.

Equally important, it is not aecessary to reflood the core region to do this since the debris to be cooled is in the lowest part of the reactor vessel.

This allows the reactor vessel to be judged as saved with a much smaller injection flow capability (a few hundred gpm) much lacer than for the MAAP criterion. Preliminary evaluations have lead us to expect a 99% rate of saving the reactor vessel using BWRSAR and its criterion as opposed to 70%

using MAAP.

This difference has far reaching implications for containment challenges since less than 1% of all core damage sequences will result in core debris j threatening containment integrity. ]

The dramatic differences in these two models is illustrated by the view graph.

The results of a BWRSAR run has been used here to derive the timing for MAAP, but this provides a valid comparison since material relocation has not occurred in either model when a core node temperature of 3000 r is reached and the heat transfer models used are essentially equivalent.

In the case of simple boildown calculations the gain is 96 minutes and in the case of rapid blowdown the gain is nearly 70 minutes. The conditional probability of regaining vessel inj4ction in that increment of time approaches unity and the amount of flow required is much less which allows success with low flow systems such as the fire pumps.

l 1

167 L____________

l i.

CONTAINMENT INTEGRITY WITH VESSEL FAILURE l 1

1). HEAD FLANGE FAILURE $

i 2) DRYWELL LINER MELT THROUGH

3) LOSS OF VAPOR. SUPPRESSION FROM DOWNCOMER MELT THROUGH

4) OVERPRESSURE FAILURE DUE TO LOSS OF DECAY HEAT REMOVAL

5) PEDESTAL ABLATION 168

r___ _

l i

• cntainment :nte rity with 'lessel Failure i

l If vessel integrity cannot be guaranteed, then challenges to :entainmen* '

integrity from core debris on the drywell floor must 'ce considered, rive j failure modes are postulated. These ares l

1

- drywell head flange failure, I drywell liner melt through, loss of vapor suppression from downecmer melt through, {'

overpressure failure due to loss of decay heat removal.

- pedestal failure from ablation, Each of these are discussed below. )

As the core debris pours onto the drywell floor from the reactor vessel it spreads until it freezes. Water vapor is driven out of the drywell floor concrete as it heats up. This vapor reacts with zirconium in the core debris generating H, gas and heat. The dabris also reacts with the concrete to produce Co, {as. These hot gases transfer their heat to the drywell liner.

In Mark I End II containment the drywell liner and the containment head are flanged together with a seal to form a pressure beundary. Test data in NUREG/CR-4977 indicates that this seal fails catastrophically at 730 T. Thus if the convective heat transfer from the hot gases and radiation heat transfer from debris bed cause the seal to exceed 730 F, it will fail and containment integrity will be lost in the drywell.

If the debris does not freeze or remelts after freezing, it will spread until it intersects the drywell liner. If the heat flux from the debris bed to the liner is sufficient the liner will fail. In steel containments, integrity will again be lost in the drywell. In steel lined concrete containment it represents a loss of the containment pressure integrity and thus some fission products may escape.

If the debris spreads to and fails the LOCA downcomer vents or SRV penetrations in the Mark II containment, the drywell and wetwell air space will communicate, thus vapor suppression will be lost. As the core debris penetrates the downcomer and falls into the suppression pool, large quantities of steam will be generated. In the absence of vapor suppression the pressure will rapidly rise until the containment fails on high pressure. This failure mode represents a containment failure with suppression pool bypass.

If the heat flux into the containment structures is insufficient to cause a loss of containment integrity, then a challenge from overpressure nevertheless still exists. The reaction of the dabris with water vapor and concrete produces H and CO gas. Vapor may also be produced if water is used to cool 2 2 the debris. The presence of additional noncondensible gas reduces the amount of water vapor pressure that can be accommodated prior to overpressure failure. Therefore, decay heat removal must be established earlier if containment overpressure failure is to be avoided.

Finally as the core debris pours from the vessel it intersects the lower pedestal. Pedestal ablation occurs, and could be so significant that the pedestal could no longer support the reactor vessel. If this is the case the collapse of the vessel would have to be investigated.

169

l ISSUES EFFECTING CONTAINMENT INTEGRITY o

o CONCRETE COMPOSITION 1

0 PRESENCE OF WATER ON THE DRYWELL FLOOR o AMOUNT OF UNREACTED-ZR o RATE OF POUR OUT OF THE BOTTOM HEAD i

i I

170 L-----_. _ _ _ _ _ _ _ _ . _ _ _ _ _ . _ _ _ _ _ _ _ _ _ _ _ _ _ ___ - - - - - - - _ - _ _

1 L

• ssues Effectine Containment inteerity Tour' issues influence the behavior of core debris on the drywell floor; These eres

- the concrete composition, the amount of unreacted zirconium in the pour,

- the presence of water on the drywell floor, and

- the rate of pour out of the bottom head.

A discussion of each of these issues follows.

Two types of concrete have been evaluated by the USNRO. These are limestone cosanon sand and high lisentone concrete. Limestone conunon sand concrete is typical of most concretes. It consists of 1 part cement, 2 parts quartz sand, and 3 parts limestone aggregate. In high limestone concrete the quarts sand is replaced with a limestone based material. The limestone casunon sand concrete has a much lower ablation temperature. This results in a greater mass of concrete ablating which dilutes the core debris. If the debris is low in unreacted zirconium, the debris will freeze. .If the core debris is rich in unreacted airconium the water vapor degassing from the concrete will react with the zirconium and generate sufficient heat to prevent the debris from freezing. If the concrete is high limestone, the amount of ablation is much less. In this case dilution does not occur and the debris remains liquid independent of the amount of unreacted zirconium.

The presence of water on the drywell floor has a significant impact on the containment's response to core debris. For the case of limestone common sand concrete, the addition of water to the drywell floor provides sufficient cooling to prevent head flange failure, drywell liner melt through and downconer melt through. Some forc. of decay heat removal is still required to prevent overpressure failure.

Finally the rate at which the debris pours out of' the vessel has a significant effect on the containment response. The core damage progression model directly influences the core debris pour rate. In the bundle blockage model the core first melts behind the postulated block. It finally melts through the block rapidly pour to lower plenum, melts the bottom head and pours onto the drywell floor.

In this model a major fraction of the entire core is on the floor in a matter of minutes. Freezing cannot be expected prior to intersecting metal components in the drywell. Therefore, containment failure can be expected to occur if the bundle blockage model is used.

In the component relocation model the time frame for damage is much greater.

In this model it takes about 40 minutes for the debris metals and several i hours for the UO, to pour out of the bottom head. Heat transfer from the debris to the containment structure can be expected. This results in a much more favorable containment performance.

171 l

L-_----__----_-___-___.-____--.________

i STATION BLACK 0UT EXAMPLE USING COMPONENT RELOCATION MODEL i

INITIAL CONDITIONS

, PERFORMANCE REQUIREMENT FOR CORE INTEGRITY PERFORMANCE REQUIREMENT FOR CONTAINMENT INTEGRITY VESSEL INTACT PERFORMANCE REQUIREENT FOR VESSEL AND CONTAINMENT INTEGRITY l

l l

l l

172

9 l

l i

. .I l

1 1

173 i

i

THE REACTOR AND PRIMARY CONTAINMENT INITIAL CONDITIONS

,. REACTOR PROCESS PARAMETERS y_ALUE A

, WATER LEVEL 28 2/5 INCHES AB0VE VESSEL ZERO PRESSURE 1034.7 PSIA POWER DECAY HEAT l

PRIMARY CONTAINMENT PARAMETERS DRYWELL PRESSURE 15 PSIA DRYWELL TEMPERATURE 1300F SUPPRESSION P0OL TEMPERATURE 900F SUPPRESSION P0OL LEVEL 22 FEET 174

I Yhe' Reactor and Primary Containment Initial Conditions Li The; initiating event is a station blackout. l i

The~ reactor' and primary containment procesis parameters are listed in view graph. _The reactor data represents the state of the reactor.at.the conclusion of the feedwater coast down 36 seconds after scram. The containment process parameters are obtained from normal operational data. ~The containment-parameters have a fair amount of inertia and do not change much over 36 seconds.

175 l'

I N

I E E L 6 G L N N S L L S L l E L l V S Y V A A R W

T H H O l I

C C S A E +

R G L L 0

+

G N E E B 0 E E S S B S S T L S S N L E E R R I

A V V E E H D D C , , N N R E E U U E T G G I N A A D D R E M M E E M A A P P R N D D O O A I L L B A E E E E T R R V V E N O O E E R O C C D D C

U S

N .

E D EG O D N T NI E u C T E T Xm EC N

E I

C I

F F E U R S U S

S S P T E U D N RE l

- E PK l A

M HM E G R I I H U

Q E

R T

E VE R C RS S

- N S E R

A M

R O

F R

E P

_ M A

_ R S

_ C W S .

0 0 B 8 S

S l

L ,

Performance Requirements Sufficient to Ensure Barrier Integrity The first barrier-to censider is the. clad. ,The clad can suffer damage in two

.wayss loss of mechanical-integrity or exidation. 'A different' performance l requirement is applied to avoiding each of these failure modes. I s l Mechanicel Failure l

l Mechanical clad damage is avoided.if the reactor is suberitical or if.the j water level is maintained above the top of the upper plenum and design 'I pressure is maintained if scram has failed. EIf either of these requirements are satisfied then mechanical clad damage is not expected. Thus.the'first question to consider is whether the reactor is scranmed or not. If the answer:

is yes then clad oxidation must be considered. If a' scram has not occurred then the reactor water. level and pressure must be explored. In this illustration only the scrasuned case is decoloped. Therefore; oxidation is

. considered next.

Oxidation oxidation of the fuel clad, the channel boxes, and the control blades occurs when cooling is lost. Cooling is ensured.as long as adequate makeup flow is supplied to the reactor vessel prior to the water level dropping below the jet

. pump throat. . The-requirements for adequate makeup depends upon the time after shutdown. The time required for the water level to fall to the jet pump throat elevation depends upon whether the water is lost through blowdown er.

boildown. During a station blackout no pipes are assumed to be broken.

However, the relief valves cycle and can stick open resulting in a reactor vessel blowdown. If the valves cycle without failure then the accident timing is set by boildown. Thus the second question to consider is the status of.the relief valve. . Cases where the relief. valves stick open are not developed in this illustration. Therefore, the boildown case is considered.

Boildown The minimum flow required to ensure adequate core cooling depends upon the time after shutdown and the water level when the boildown comunences.

Examining the boildown plots and the initial conditions, the following.-

performance requirement is developed, Provide 250 gym at 1000 psia to the reactor vessel within 50 minutes of the reactor scram.

The following equipment is identified in the emergency procedures that satisfies this requirements reedwater, RCIC, HPCI All of this equipment operates at high pressure, therefore the success criteria for high pressure injection becomes: provide flow from any of these pumps by 50 minutes. Reactor isolation occurs in a station blackout and therefore the feedpumps are unavailable due to lack of motive steam and condensate pump inoperability.

177

t g ,( .4

)

I' .

f i

d 178

o .

1

-If this success criterien is satisfied, then core cooling must be satisfied in the long term. Cooling can be performed by either the RCIC or HPCI systems er p should they fail'the diesel fire pump'if the reactor is depressuriced. .The j SSES. procedural response te station blackout requires the reactor be i o depressurized to 150-200 psig. Thus,'should the high pressure pumps fail,'the

! - fire pump is available for injection. Both the high pressure pumps and the l relief valves which maintain'the reactor at low pressure require DC centrol ..

power. OC power is normally provided by station batteries. These batteries I

- however are depleted within about 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />. This problem has been circumvented

- at SSES by providing 480 V AC power from a mobile generator to the battery chargers. :The chargers then feed *he DC loads. If the generator and at-least one injection source are successful then~ core cooling is assured. .With core cooling assured the vessel is not challenged, and.the containment must be j considered. i If the mobile generator fails, the batteries willLdeplete,' injection will be lost, and boildown will commence. If adequate cooling is not restored prior to the downcomer water level falling below the jet pump throat, core damage is assumed to occur.. Adequate cooling is again defined using the boildown plots.

. If injection is. assumed to be lost at 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> due to battery depletion, the water level will reach the jet pump throat in 2.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />. The makeup ficw rate required at 6.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> (4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> + 2.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />) is 145 gym. The performance requirement becomes.

Provide 145 gym to the reactor by 6.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />.

All the equipment identified in the procedures requires either AC motive power or DC control power. Thus with a station blackout and loss of DC power core damage will occur unless-AC power is recovered. The success criteria for long term cooling includes recovery of AC power before 6.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />. Failure to provide core cooling will result in a vessel challenge.

If the high pressure injection pumps fail, the procedures instruct the operator to depressure the reactor and use low pressure pumps to provide cooling. Review of the blowdown analysis section results in the following performance requirement.

At'50 minutes rapidly depressurize the reactor pressure vessel and inject 800 gym into the reactor vessel.

The following equipment is identified in the emergency operating procedures which satisfies this requirement.

Depressurization Safety Relief Valves Turbine Bypass Valves Injection Condensate pump Core Spray pumps I,ow pressure coolant injection pumps I

success requires both depressurization and injection. The injection sources identified all require AC power. Therefore AC power must be recovered to 179

- _ _ _ _ _ _ = _ _ - - _ _ _ _ - _ .

I l

l l

l l

f 4

j l

1 1

4 l

l l

l 180

'l

(

I

' ' .L---....--.-_-_ _ _ _ __ __ _

l L -

l L

l satisfy this success criterion, and AC power must be recovered within 50 minutes or the vessel willibe. challenged.

The information discussed above is depicted in the event tree. This event tree dispositions the status of the reactor. core integrity and identifies if additienal barrier :ha11enges exist. The first sequence is an extended station blackout with no additional failures. This sequence does not challenge the core integrity. However, unless decay heat is rejected from'the containment.it will fail on overpressure. This challenge to the containment will be discussed next. The remaining two sequences result in a challenge to the vessel integrity. These are discussed following the discussion on containment.

181

en t n u t oem t i o p g t u aS g p r m n n t o i t i y y i cr t a l a a l ei l e o r r o r v UH o p p o i n c s s c d e g r nr W W o

W A i e l t W S S WS /

oa S E E SE N oW C

n m m m e e e e t t t t t e s s Ss S s c rc y y S y S y a er s srE srE s A t wu o vv o v v

/

N n oo v v kk k k I PS k k l 3 3 43 4 3 e 1 1 1 1 s

s e

v y t t e l t i

r b n g A A i A e e l / / s / t a

t a N M n M n gt e l I ns s io t l C n o e o m C n

i f a o t

n d e o o e l C hr l t o t b t b t et n i n i n Nc e s e s e a t n t n t e a e a o a B l s l m l g l n o i o e l p d o o o n m

'r c i o

n t a m n s w m

a

=

s o a m r e d e d r w

&d a

r P

n a

t s

y S

t h

S u

p p

u S

l b

o r n U t A i R C s

n a E . .

n e i

m M B a b I V e

t s

y . . . .

S 1 2 3 4 g

c 1i i

i i

l L

Containment Integrity 7essel !ntact In cases where the vessel integrity is preserved, containment integrity can st:11 be challenged by pressurization due to storage of decay heat in the suppression pool. Decay heat removal is normally accomplished by rejecting heat through the main condenser. If the main condenser is unavailable, energy is stored in the suppression pool and then transferred to the spray pond by the RHR system. If the RHR system is also unavailable, a blowdown path from '

the reactor to either the main condenser or liquid radwaste exists through the

. reactor water cleanup (RWCU) system. Addition of mass to the suppression pool

-during the blowdown will result in reduced peak containment pressures, but, even without mass addition, the peak pressure is below the estimated containment rupture pressure. Finally procedures instruct operators to vent the containment prior to exceeding its. design pressure. Venting the watwell represents a loss of containment integrity and is used only as a last resort.

It is preferable to containment failure in that the suppression pool is used to scrub the release.

These methods of rejecting decay heat are both redundant and diverse. The diversity spans both the type of equipment and the phenomena used to transfer

. heat, as described in the view graph.

183 1

0 1

O l

O l

o t

^ 3d x x x x

. 1 1 3 1

.:* :%2 M*3$ . . .

9 9 1 1 dR- 0*3$

3 5 5

.S 3 2o 3a23. "O 6 "E 2 .e:* m 0tbp. 7 0 0 1 1 2 3

_"

• 0 3 0 0 2 2 9 2

• B .

E5" o 0*3 3 2 2 1 2

• gi&51 "o E 0 2

7 2

8 0

0 2

t%= d*3$ 2 2 2 2 t

n e

V l

l e

_4E d*$Q 6 3 4 9 w .S a" j 3aE*1b 0 1 1 0 t 2 2 2 1 e h t.g.2mGtyD e N

r o

f _w w 0 7 2 0 9 8 9 1 e

c 2E 15" 3ad'[O 1 1 1 2 n

a m

r o

f r 3 ~13g .S 9 9 4 9 e

P 4Eo"S*A 8 3E 4 0 1

1 1

6 1

3 2

l l

e n w hg o t n i e u o t w o i i r t 5d 5 o 5h 4i 1 d 1 t 1 t d a td t t s t s aa ass asa asa ns ws na wm nm w

nms w y oa o od od a d m d o dd ddwapr w wn wa s

oo l n l o , o l ,

o l ,

B , Bs B s B sl e e el Vs Vt Vt Vt e R r R u R u R S ny uw S u S n S n o i i i r 1h 1 m 1 m 1 md 1 2 3 4

- l

Performance Requirement for Wetwell Vent 1

"nder Station Blackout conditions all decay heat removal (DHR) systems recuiring AC power are unavailable. .If the wetwell vent can be operated wd :hout AC power, it may be. considered for the DHR function.. At'PP&L the' vent

'is considered to be a last ditch option so that vent opening is delayed as=

long as possible. At the present time the vent path available involves EVAC duct work.which can withstand internal pressures of only 10'psid before.ma]or failure. This allews a containment pressure of only 30 psia before vent opening is required since we will not consider venting massive quantities of water vapor into the reactor building.

The view graph presents the time available for opening the vent before

. containment pressure reaches 30 psia.

We would prefer to recover AC power to permit use of the RHR systen as opposed to venting. The view graph clearly demonstrates that there should.be a very good chance of'AC power recovery before venting becomes necessary. This time can be greatly extended if water is deliberately added'to the wetwell.

Further, if this water is added via drywell sprays,'which keep the.drywell temperature down, nearly 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> are available before venting is required.

The~ cases which must be considered, then, in'dispositioning end point 1 of the SBC event trea are:

1) AC power recovery with no water addition before 11.9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br />,

2) venting at 11.9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> with no water addition,

3) . recovery of AC power before containment failure with no venting and no water addition,

4) failure to recover AC power before containment failure with no venting and no water addition,

5) AC power recovery with water addition before 23.9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> (assuming use of drywell sprays),

6) venting at 23.9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> with water addition,

7) recovery of AC power before containment failure with no vent but with water addition, or

8) Failure to recover.AC power before containment failure with water addition but no vent.

If it is necessary to consider the case where water is added directly to the suppression pool additional cases must be considered. The specification of success criteria determine what combinations will be considered.

In order to quantify the equations for conditional probability that are derived it is necessary to have an AC power recovery curve (Appendix 7) and transient calculations to determine the time of containment failure for the three potential water addition cases. t 185

w--w- --

.'1 1

N 4

l l

l l

186 l

l

f't e risk analysis WC09 tan bein9 developed wi~si^ "1Y need a 4

^ e 8uccess

=rtteria s r various ,,nal

. Plant dama T , g various action,' --.he R Power recover'. eu e h=h'tiecons - or vent.ng when nee,,,,xy, l

I i

187

liiIO 1Ii I I D I D 0 I D D D .

C C l C [ L I [ _

A A i A EI l C I C L l I I N I N l A N A I

N l

N N [ N [ A I L I A I I V I V F N V N [ F I I V t

i l

u 5

H 5 g G

I HP v Min I I Y

A O

W RC H

DM t

ll I u S

C S A

L E' P .

N 8 1 e i -

I 0 1 W L

E S

S E

V Y

E R G E N 0 E R t ME L OR L

A H

C '

R T 0 T N l l N E l D E e

e B I l

l AEI I A A $T T T S N W MTOO C

(

C T

A E

MLS t A f YNET CA KES NSY -

L E

S S

T N

W EK lW R -

l E T A L 1 L K MANN

( C I I

5.

i!: l!l  : l

I containment Challengest Vessel' Intact An event tree organizing these questions is illustrated in the view graph.

The containment status is identified ass. intact, vented, or failed. The latter two cases represent a loss of containment integrity. In'the vented case, however, credit for suppression pool scrubbing can be taken.

.)

At SSES the venting issue is under evaluation by management. No credit is taken for venting for this reason. -1 1

In the situation being considered, Station 31ackout, no AC power is available.

Review of previous view graph indicates that all the decay heat removal systems at SSES require AC power. Therefore, no decay heat removal systems are available. The next question to consider deals with the addition of mass to the suppression pool. To answer this question the emergency operating procedures must be consulted. At SSES the procedure instructs the operator to spray the drywell on high pressure and also to align the fire protection system to the RHRSW system to be used for injection. Therefore, the success  ;

criteria for this event becomess.  !

Add mass to the containment using the fire pump.

Finally, if containment failure is to be avoided, decay heat removal.must be established. This requires the recovery of AC power. The amount of time available for AC power recovery depends upon the' water mass added to the pool.

If no mass is added to the pool beyond that of condensed steam from the SRV's, then the containment failure pressure is reached in about I day. If the maximum amount of mass is added, then this time can be extended to 3 days.

Therefore, at SSES the success criteria for this event becomes restore AC power within 1 day if no mass is added and 2.5 days if maximum mass is added.

Failure to satisfy this criterion will result in containment failure.

1 189

PERFORMANCE REQUIREMENT FOR VESSEL AND CONTAINMENT INTEGRITY VESSEL INTEGRITY PROVIDE 120 GPM PRIOR TO BOTTOM HEAD DRYOUT AT 3.5 HOURS CONTAINMENT INTEGRITY - OVERTEMPERATURE i

PROVIDE 500 GPM TO DRYWELL PRIOR TO VESSEL PENETRATION AT 5.5 HOURS )

l l

CONTAINENT INTEGRITY - OVERPRESSURE PROVIDE DECAY HEAT REMOVAL PRIOR TO EXCEEDING THE CONTAINMENT ULTIMATE STRENGTH l

190

Performance Requirement for Vessel and tentainment Intecrity The integrity of- the reactor vessel and primary containment are linked througn the gross generation of noncondensible gas. Performance requirements, however, can be written which will prevent the phenomena challenging the integrity of each the last two barriers.

In the case of the reactor vessel, the stabilization criterion requires injection prior to bottom head dryout. Prior to bottom head dryout the debris bed is quinched. .Therefore, it is only necessary to reject decay heat. Based upon this criterion the performance requirement to ensure vessel integrity becomes:

Provide 120 gpm to the reactor vessel prior to bottom head dryout at.

3.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />.

l:

If' sufficient injection is not provided to the bottom prior to dryout the reactor vessel is postulated to fail and the core debris will pour onto the drywell floor. Many containment challenges associated with core debris interactions with the containment have been discussed. Two different

. phenomena challenge the containment integrity once the vessel has been breached. -These are overtemperature and overpressure failure. Stabilization criteria for each case are reviewed below.

In the case of overtemperature failure the presence of sufficient water on the drywell floor is a sufficient condition to preclude overtemperature. At this point PPEL is still evaluating the containment response in vessel failure cases. However if water is injected onto the drywell floor prior to vessel penetration failure it is reasonable to assume that the debris will be quinched. Therefore the following criterion is suggested as an interim stabilization criterion for containment overtemperature failure.

l Provide 500 gym to the drywell prior to vessel penetration of 5.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />. I The 500 gym is the SSES drywell spray flow rate.

Finally, if the containment temperature is stabilized below the failure point, the containment pressure must still be controlled. The criteria for overpressure failure is unaffected by vessel penetration. However, the timing l associated with the event is changed. Core concrete interaction produce large volumes of noncondensible gas which reduces the amount of vapor generation allowable prior to overpressure failure. The following criterion is suggested as a stabilization criteria for containment overpressure failure.

Provide decay heat removal prior to exceeding the containment ultimate strength.

At this point PP&L has not performed sufficient calculation to estimate the partial pressure of the noncondensible gas generated during core concrete interactions. Therefore, timing information is undetermined.

191 l

-_____u____ _ _ ._,_._ -- -_ _

e I

192

i I

l 1

)

ACCIDENT SEQUENCE QUANTIFICATION 193

ACCfDENT SEQUENCE QUANTTFTCATION DEFINITION OF BOUNDARIES SUPPORT STATE METHOD CONSTRUCTION OF FUNCTIONAL FAULT TREES DEVELOPMENT OF SYSTEM DEPENDENCY MATRICES DEVELOPMENT OF SUPPORT STATE ACCIDENT SEQUENCE QUANTIFICATION STATION BLACK 0UT EXAMPLE 194

l-Accident Secuence Ouantification

t. ;

Quantification of the accident sequences defined by the event trees requires that the probability of the event tree top events be computed. These probabilities are then combined with the initiating event frequency to-yield l-

.the accident sequence frequency. Discussion of the process requires a common set of terms and an outline of the support state method. Therefore, these topics are discussed first in this section. With a common understanding of the terms'and the method, details of the calculation can be discussed. This discussion includes the construction of functional-fault trees, the development of system dependency matrices, the development of.the support state, and the the accident sequence quantification, These topics will follow the discussion of definition and methodology.

195 a' _ _ - _ _ _ _ _ _ _ _ _ _ - _ _ _ _ - _ - _ - _ _ _ _ - - _ - _ _ _ _ _ _ _ _ _ - - - _ . _ _ _ - _ - _ _ _ _ . _ - _ _ - - _ - _ _ _ _ _ _ _ - _ _ - - _ _ _ _ -______-__________--_:

DEFINITION OF BOUNDARIES FRONT-LINE SYSTEM BOUNDARIES COMPONENTS ARE GROUPED WITH FRONT-LINE SYSTEMS IF THEY ARE DEDICATED TO THE FRONT-LINE SYSTEMS OPERATION SUPPORT SYSTEM BOUNDARIES COMPONENTS ARE GROUPED WITH SUPPORT SYSTEMS IF THEY ARE REQUIRED TO SUPPORT MULTIPLE SYSTEMS DIVISION BOUNDARIES COMPONENTS ARE GROUPED WITH A DIVISION IF THEY ARE REQUIRED TO SUPPORT AN ENTIRE DIVISION OF A SYSTEM CHANNEL BOUNDARIES COMPONENTS ARE GROUPED WITH A CHANNEL IF THEY ARE ONLY REQUIRED TO SUPPORT A CHANNEL IN THE DIVISION OF A SYSTEM 196

Oefinition of Boundaries Front-line and Support System Boundaries-Prior to constructing plant models, boundaries must be defined to assure components are properly treated in the models. When drawing boundaries two classes of systems considered: front-line and support systems. Front-line systems perform a specific safety function such as injecting water into the vessel. Support systems supply necessary facilities to enable a front-line system to perform its safety function, e.g., AC power provides motive force to perform the safety function. A failure is grouped with the front-line system if its failure only causes the front-line system to fail. A failure is grouped with was support system if its failure causes more than one front-line system to fail. As an example, if the circuit breaker for the RER injection valve failed it would be collected with the RHR system because it only affected the RNR system. If, however, the actor control center failed, it would be collected with the AC power system, because its failure would cause other systems to become unavailable.

Divisions and Channels Each SSES unit may be considered as having two divisions of safety equipment.

One division is sufficient to perform the intended safety function should a failure disable the second division. Some systems, such as RHR, have redundancy within a division. This intra-divisional redundancy is called a channel. Whereas channel usually refers to electrical systems, in this presentation it is also used for mechanical systems. The PRA model is-structured in terms of divisions and channels. The components are therefore grouped along these lines. Failures are grouped by channel if they affect only one channel in a division. A failure is grouped by division if the failure affects an entire division. As an example, failure of the breaker to the "A" RNR injection valve is grouped with Division I of RHR. A failure of the "A" RHR pu g , however, is grouped with channel "A" of RHR.

l l

l 197 L-___._________-----_-_--__--___-------- _ - - - _ - . - - - - - - - - - - - - - - - - - - - - - - - - - - - - ~ - - - - - - - - - - - - - - - - - - - --- -- - - - - - -

SUPPORT STATE METHOD o CONSTRUCT FUNCTIONAL FAULT TREES FROM FRONT-LINE FUNCTIONS o IDENTIFY SYSTEM COMMON IN FUNCTIONAL FAULT TREES o COMPUTE FRONT-LINE SYSTEM FAILURE PROBABILITY FOR EACH SUPPORT SYSTEM FAILURE COMBINATION. CONSIDERED.

o GROUP. SUPPORT SYSTEM FAILURE COMBINATIONS BY SIMILAR IMPACT ON THE FRONT-LINE FUNCTIONS o PARTITION INITIATING EVENT BY SUPPORT STATE o COMPUTE ACCIDENT SEQUENCE FREQUENCY BY ACCIDENT SEQUENCE.

198

Support state Method The event tree'is used to link functions which fulfill the perf:rmance requirement for barrier integrity. Computation of the accident sequence frequency requires that the failure probability of these functions be estimated.' These functions are composed of systems that uniquely or in combination satisfy the performance requirement. The functional-fault tree identifies the set of system failures which must occur if the function is not satisfied. Estimates of the function failure probability then becomes the probability of the set of system failures occurring. Failures in these systems can result from loss of either system components or loss of support systems. In the support state methodology, support system failures are treated explicitly. This is performed by computing the conditional-probability of the top event for a given support system failure. This is executed for the various combination of support systems. Support system combinations which have a similar impact on the front-line functions are grouped into a support state. The initiating events are partitioned by these support states. The accident sequence frequency for a given support state is then computed using the conditional failure probability of the front-line function for the given support state. This event tree quantification process is summarized with the following rules.

1. Construct 1*;nctional fault trees for the front-line functions identified in the event trees.

2. Identify support system dependencies common to the functional fault treas.

3. Compute the conditional probability of failure for the front-line function for each support system failure combination considered.

4. Group the support system failure combinations that have a similar impact on the front-line function. These groups are called support states.-

5. Partition the initiating event frequency by the probability of each support state.

6. Cospute the accident sequence frequency for each support state using the front-line system failure probability computed in step 3.

A diecussion of each of these steps follows. The station blackout sequence developed earlier is used for illustration.

199

REFERENCES ON FAULT TREE ANALYSIS e

1. FAULT. TREE HANDBOOK, USNRC NUREG-0492, W. E. VESELY, ET. AL. ,

JANUARY 1981

2. STATISTICAL THEORY OF RELIABILITY AND LIFE TESTING R. E. BARLOW AND F. PROSCHAN, TO BEGIN WITH PRESS, 1981

3. RELIABILITY AND RISK ANALYSIS, NORMAN J. McCORMICK ACADEMIC PRESS, 1981

4. DISCRETE MATHEMATICAL STRUCTURES WITH APPLICATIONS TO COMPUTER SCIENCE, J. P. TREMBLAY AND R. MAN 0LAR, McGRAW-HILL COMPUTER SCIENCE SERIES I

I 200 f

References on Fault' Tree' Analysis The failure probability of the frent-line functions are required when ecmputing the accident sequence frequency. Little' failure data exist at the function level, therefore, the function failure probability must be deduced from the function's basic constituents upon which data exist. The fault tree is a deductive logic method traditionally used in PRA. It is a hierarchial structure in which a complex failure is represented in terms of faults in more basic constituents. The statement of faults must be concise and allow for only two outcomes, success or failure. Many references exist on fault tree analysis. The atxached Table list a few. Reference 1 of this Table lists concise rules for construction. These references should be consulted if more discussion on fault tree construction is desired. A description of the functional fault tree for high pressure make up, however, is presented to illustrate the process.

l i

j i

l 1

l 201 1

l l

1 L---_----------------_-----_------------------------------------------------_---------------------

E

=

_-k

=,~

11 y n.  ? ;5 -

~

e 1 .,

" =

c - g

)Q[

~

o D C $

yo-

.s 4 s e,n. -

• @  % N K

• 5' ;.) T

. w -

r .-.";

9 C:: C

@-]:5- C

- I M _8

"- - =

= s.

, 59 m- - e-g

~-S TT SC 0- _

f(f I

x

'e l  ;

d t w

\ 2 a

w .a sa a s

ummemmunmusam

{qp=

_- y s e p ., @ O,

- u .- .

.s. ,,

=, 3I n.. _ 3" $_

e 4.) : _

e-O -

?m 3-K .~

- 8 e w ,o

. g m W

- o ./ .n =

u- s s.o E

~s g ph8,&+:!eH:] GH:j e-1 :- e D? .

ME

\"6 elf we

- 8F/3

=r w a w m _g L

a

• ,as.y '

a

y J 4=

ll ll:g1 I at , .

~

n e

T-g* G- e 5 '

) g a eg 202

Simplified Diacram of the HPCI System The HPCI system is a single loop system consisting of turbine-driven in ecticn and booster pumps, piping, valves, controls, and instrumentation. A' simplified flow diagram is shown in Figure 1. The system is designed to pump water into the reactor vessel with a maximum capacity of 5000 gpm for a range of reactor pressures between 150 and 1150 psig. Upon initiation of the HPC:

system, a normally closed injection valve, F006, automatically opens, allowing water to be pumped into the reactor vessel through the main feedwater header B. The HPCI turbine is driven by reactor steam. The inboard and outboard HPCI isolation valves, F002 and F003, in the steam line to the HPC: turbine are normally open to keep the piping to the turbine at an elevated  ;

temperature, thus permitting rapid startup of the HPCI system, dteam is  !

admitted to the HPCI turbine through supply valve F001, turbine stop valve I 15612, and turbine control valve 15611, all of which are normally closed and  !

are opened by a HPCI initiation signal. Exhaust steam from the turbine is discharged to the suppression pool, while condensed steam from the steam lines and leakage from the turbine gland seals are routed to a barometric condenser.

.l The HPCI system is automatically &ctuated on low reactor water level. If  !

automatic actuation fails, the system can be manually initiated from the  !

control room.

1 i

i l

l l

1-s l

l 203 l l I

FUNCTIONAL FAULT TREE FOR HIGH PRESSURE MAKEUP

.autassit 8L3 'O u F434 44E81 ME55ust tatut up

• duac!3 O

I I INADERATE FLOW FNOR innataisrt sta page wic/wc I$%

Fttsuarts THE CRD viinie to situts se Ptfr$ WITHIN 818713 8 88WYt3 #

p ggyg EXTen EnaR REXTOA scram m i C390s

(\ %DE FAILUIE y RCIC/NPCI I

i i insatsasig

$",j zic to a -

A O T

i 1 "I WI INTRI5tC SkifCN I F44Ef5

• o A i

m i ,

SUPPORT INiflAfl5 STATE N i

1,0 1,0 204

_ _ _ _ _ _ _ _ _ _ . _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 1

I I

1 Tunctional Fault Tree for High Pressure Makeuo l

l l

f-l This view graph shows the functional fault tree for high pressure make up.

The event, inadequate flow from HPCI to the reactor, consists of two inputs:

l HPC intrinsic faults and the HPCI switch. An intrinsic fault is one that I l only prevents the system from performing its function. These faults includes l

failure of valves, pumps, controls and other components in the HPCI system.

The probability of HPCI failure is estimated with a model. The model detail depends upon the amount of system data available. The more data available at the system level the less detail required in the model. If no data exist then all components required for HPCI operation must be included in the fault tree.

If a large source of system level data exists, then the model may consist of the single input, HPCI intrinsic faults. The functional fault tree must be detailed enough, however, to preserve the independence of subsystems which are capable of satisfying the performance requirement. The HPCI system is a single train system and therefore meets this definition.

The second input to the event, inadequate flow from NPCI to reactor, is: the HPCI switch. This switch contains faults external to NPCI that influence its operability. These are the influence of the support state'and the initiating event. If the particular support state and initiating event have no impact on HPCI operability then the output of the gate is zero and the HPCI failure probability is completely determined by the intrinsic faults. If the support system or the initiating event results in loss of HPCI operability then the output of the gate is one and the HPCI failure probability is 1 O. The influence of the support state on the front-line systems is determined using the dependency matrices. Development of these matrices is the' subject of the next discussion.

205

EQUIPMENT UNAVAILABILITY DATA TYPE OF DATA AVAILABILITY OF DATA 206

Equipment #1 availability Data Iquipment unavailability data'is required if_the failure ~ probability of the front-line functions are to be estimated. Equipment unavailability data is input;into the support: state model at the point where the unavailabilities are independent. This usually implies at the division or channel level; however,-

in-some instance it'could involve components. Estimates of these unavailabilities can be obtained from plant records -or industry data or if necessary synthesized from fault tree models of the ',nannel or division. The type and source of data utilized is, reviewed in thG next view graphs.-

207 1

TYPE OF EQUIPMENT UN/. AVAILABILITY DATA PREVENTIVE MAINTENANCE CORRECTIVE MAINTENANCE TESTING MODIFICATIONS FAILURE DURING OPERATION FAILURE TO START ON DEMAND 1

i 208

j Type of Equipment Unavailability Data ,

l l

There are many causes of equipment unavailability. These include:

- preventive maintenance, l

- corrective maintenance, j

- testing,

- modifications,

- failure during operation, and failure to start on demand.

The first four of these items generally result in unavailability of the equipment involved. Technical specification, however, control the degree of degradation of plant capability by imposing constraints on the duration of the outage and requirements for demonstrated operability of redundant systems or equipment. The last two of these contributors to unavailability may occur in response to a surveillance test, in which case the outage is collected as a part of corrective maintenance. Definitions of the above contributors follow.

Provantive Maintenance - Preventive maintenance is performed to ensure that equipment maintains a givec level of performance.

Corrective Maintenance - carrective maintenance is performed when a component's performance is degraded or failed.

Testing - Testing is performed to verify equipment is within specifications.

These tests are considered equipment outages if they rendered the equipment functionally inoperable.

Modifications - Modifications are physical changes in the system that render equipment inoperable during the modification process.

Failure during opetation - Failure during operation occurs when equipment ceases to perform its function while operating.

Failure on Demand - Failure on demand occurs when standby equipment does not resTond when challenged.

I 209

I AVAILABILITY OF DATA GENERIC DATA PLANT SPECIFIC 210 I

i Availability of Data There are two sources of data. These are generic data and plant ~ specific data. Generic data is generally derived in two ways. Failure data from manyL

-sources is pooled. This pool' population is used to make estimates of component or system unavailability. A second method is also employed. This

. involves soliciting judgement of experts. These judgements are then pooled to-

~

make estimates of component or system unavailability.

Another source of data is plant records. While'this source is very appealing it is labor intensive and for early life plants may be insufficient for parameter estimation.

1 l

211 1

4 GENERIC INDUSTRY UNAVAILABILITY DATA

- REACTOR SAFETY STUDY NUREG LER SUMARY l

IEEE 500-1977 IEEE 500-1984 NUCLAAR-NPRDS 212

I Generic Industry Unavailability Cata The principal sources of generic data used in risk studies are listed in the view graph. The applicable component failure rates published in these references are in the centext of the medel assumed when generating the estimates. The interpretation of the estimates is not clear in every case, but the following assumptions seem reasonable for the following sources.

1. Reactor Safety Study. Estimates are given as a median value and an error factor on the assumption of a log normal distribution. These distributions were interpreted as representing the generic distribution of component failure rates.

i

2. NUREG LER Summaries. The estimates are evaluated on the basis of an assif Ah common value of the failure rate or probability for all ecct ewrts in a particular category. The uncertainties presented in the A rFIG reports are statistical uncertainties on the quoted best estimates, obtained by accumulating the data from individual plants.

3. IEEE Std 500-1977 Following the guidelines of paragraph 3.6 of the IEEE document, the quoted maximum failure rate or probability is interpreted as the 95% uncertainty limit on the generic distribution, and the recommended value is interpreted as the mean value of the distribution. The results are given in such a way that it is impossible to be more precise, but this choice does give the broadest distribution.

4. IEEE Std 500-1984 The recommended values are assumed to be mean values. The high and low values are assumed to be the 5% and 954 uncertainty limits on the generic distribution.

5. NUCLAAR. Is an automated data base management system used to process, store and retrieve human and hardware reliability data in a ready-to-use format. A description of this data base is presented in NUREG/CR-4639.

6. RPRDS. A industry data based maintained by INPO. This system contains failure reports on components required to support plant operations. The boundary is drawn at the turbine stop valve. A large volume engineering data on these components is also available.

.213

--rm---r- ,--- ,,---- - - , - , - - - - - , _ -,--

3 . .

.P1 ANT SPECIFIC DATA EQU'IPMENTLOUTAGE.

- FAILURE'TO RUN-FAILURE ON DEMAND.'

r, c

i l

214 1_t:_ _ ___- --_ - . _ _

l Plant Soecific Data Plant specific data can be collected and utilized in the risk evaluation.

Three types of data can be collected. These ares equipment outage, failure to run, and f ailure en demand. Each of these are discussed below.

Equipment outage data is the most abundant source of data available. It can be obtained~from LCO logs, work authorization and other maintenance records.

It is Just the sum of the hours the equipment is out of service. This data has been collected at PPEL for the scope of systems in the IPE.

Failure to run data requires two pieces of information the number of failures and the total run time. If the constant failure rate model is assumed, the maximum likelihood estimate of the failure rate is just the number of failures divided by the total'run time. The. number of failures is obtained from plant maintenenew records. The total number of operation hours may not be available on all components. However, for large electrical equipment it can be estimated from the total hour meter.

Finally the failure on demand probability also requires two pieces of data:

the number of failures and the total number of demands. These data are obtained from maintenance records and plant testing schedules. The maximum likelihood estimate of the failure probability on demand is the number of failures divided by the number of demands.

At PP&L we are developing a system that automatically collects all this data for systems that are monitored by the plant history computer. This systen should be operational by the end of 1988.

4 215

SYSTEM DEPENDENCY MATRICES ,

FRONT-LINE SYSTEM VS, SUPPORT SYSTEM IDENTIFIES THE IMPACT OF THE SUPPORT SYSTEM ON THE FRONT-LINE SYSTEMS SUPPORT SYSTEM-IDENTIFIES THE IMPACT OF SUPPORT SYSTEM ON OTHER SUPPORT SYSTEMS l

l l

216 l

l

System Decendency Matrices i

The output of the switch gate in the functional fault tree is set by the support state. The support stato maps the effect of the support systems onto the front-line system. This mapping allows explicit treatment of the support systens. Construction of the support states require that the dependency between the front-line system and the support systems and the dependencies between the support systems be determined. Only the primary dependencies must be identified. A primary dependency is one where a direct cause and effect relationship exists. As an example a motor operated valve may require AC power from a 480 volt motor control center. This motor control center in turn requires power from a 480 volt load center which is powered by a 4160 volt bus. The bus may receive power from offsite circuits or emergency diesel-generators. In this example the motor operated valve has a primary dependency on the 480 volt motor control center.- All the others are higher order. These higher dependencies are accounted for by the algorithm which constructs the support state. This example points out that dependencies exist between support systems. The 4160 volt bus supplies power to many.480 volt load centers. The 480V load center in turn provides power to many 480V motor centrol centers. Finally, these motor control centers may power many front-line functions. These primary dependencies between support systems must also be captured. Therefore, two tables must be constructed. First, the primary dependencies between the front-line systems and support systems must be identified. Then the primary dependencies between the support systems must be identified.

217

l: U C-O C2l:

gj M CC*

• CM C g

N C*C

~

x 5

y-

- G v* 2 W M* ~

W i-

[

=

[

-g -

$M u .-.

i-N ...

, u 1

5

~

MOO

• w 3

A R g g -ee m

g _=

W ee m

_==

g--

I m

218 L-__-___-__-_-____-

t Front-line system Support system Deeendenev Matrix l[ An example of the. front-line system vs. support system dependency table is 1

_l illustrated in the view graph. In this table the support systems are identified as rows and the front-line systems'are identified with the columns.

If a primary dependency exist between the front-line system and the support ,

systent a 1,is entered in the Table, otherwise a zero is entered. In this example primary dependencies exist between the HPC system and the 125 and 250'

~

volt buses and the RPR divisions and channels and the 480V motor control centers. Therefore, l's are entered at the intersections of the front-line cystems and support systems in the Table. Notice that the RHR.:hannels are listed with the support systems. At Susquehanna the RHR pumps support many functions, i.e., vessel injection, suppression pool cooling, containment spray etc. 'This is a sufficient condition for classification as a support system.

'They, therefore, are classified as such.

The components in the RHR system that perform a single function are classified as front-line systems. The injection valves serve as an example.

219

SUPPORT SYSTEM DEPENDENCY MATRIX DEPENDENT SYSTEM I 121V 460V 480V'LC RHR Ejy- )

ABCD ABCD ABCD ABCD 1 2

.125V DC A 1 1 B 1 1 C 1 1 D 1 1 4160V A 1 1 1 1 B 1 1 1 l' C 1 1 1 1 g D 1 1 1 1 G

M 480V LC A 1 e B 1 E C 1 E

g D 1 e

RHR A. 1 4

B 1 C 1 l

D 1 1 ESW- 1 1 1 1 2 11 1 i

l i

220 I

Support System Oependency Matrix l

1 An example of a support system dependency Table is shown in the view graph.

This Table is constructed by replacing the front-line systems in the columns by the support systems. If a one to one correspondence exists between the rows and columns a symmetric matrix will result. While not a necessary condition, a symmetric matrix is visually more appealing and simplifies the mathematical manipulation. Again primary dependencies are identified by l's.

If a primary dependency does not exist then a O is entered. Notice that additional support system are included in the table beyond what is identified in the front-line system vs. support system dependency Table. This is required because a primary dependency between these systems and those identified in the front-line system dependency table exists. As an example, although the ESW system does not appear in the front-line system vs. support system dependency Table, it provides cooling water to the RHR pump. Without this cooling the pumps are postulated to fail. This primary dependency must be captured. In this table the independent variables are identified by the column and the dependencies are identified by the rows. As an example there is a primary dependency between 4160 volt has A, and 125 VDC bus A. Note that a primary dependency always exists between a system and itself. In this example 125 VDC depends upon itself.

These tables are the front-line system vs. support system and the support system primary dependency matrices. These matrices form the basis of the support states.

221

DEVELOPMENT OF SUPPORT STATES

1. DETERMINE ALL SUPPORT SYSTEM INTERDEPENDENCIES'

2. DETERMINE IMPACT OF SUPPORT SYSTEMS ON FRONT-LINE FUNCTIONS

3. GROUP SUPPORT SYSTEM C0fBINATIONS WHICH HAVE SIMILAR IMPACT ON FRONT-LINE FUNCTIONS.

I 222 l

I- Development of Support States l

I!

1 The support state maps the.effect of support system failures onto the front-line systems. This requires that the interrelationship between the support systems be determined. Once these interrelationships are accounted for, the effect of support system failures on the plant front line systems can be determined. This process utilizes the following algorithm.

1. Identify the dependencies of the support systems upon one another.

2. Evaluate if all front-line systems are unavailable.

3. Pick support system i in the front-line vs. support system dependency matrix.

4. Check to see if support i is dependent on a support system already selected in the string. If not, continue.

5. Check to see if the support system fails additional equipment. If it does, continue.

6. Check frequency of the support system combination.

7. Group support system combinations which have similar impact on the front-line functions.

223

l ,

' IDENTIFICATION OF SUPPORT SYSTEM INTERDEPENDENCIES 1

A" = AN -1 X AN -1 i

-IF N

A = AN -1 ALL INTERDEPENDENCIES IDENTIFIED 224

i i

l L

Identification of Support System :nterdependencies As discussed previcusly many support systems require other support systems to function. As an example AC power provides motive force to many pumps and valves in the plant. The AC power source in many cases requires DC power for control of the AC equipment. Thus a failure of DC power may indirectly fail a front-line system. These interdependencies must be accounted for to properly identify the influences of the support systems upon the front-line systems.

An algorithm has been developed to determine these interdependencies. This algorithm consist of four steps. The first step is input to the process and requires that the primary support system dependency matrix be developed. The second step involves taking higher products of this matrix to determine support system interdependencies. After taking each new product of the matrix it is compared to the previous step to determine if additional dependencies were identified. This process is continued until no additional dependencies are identified.

The interdependencies of support systems must be identified through input.

This input is in the form of a square matrix. A one is entered in element i, j if system j depends upon system 1. If no dependency exist between system i and j then a zero is entered. Only direct dependencies need be identified.

As an example a 480 volt motor control center depends upon a 480 volt load center. This load center in turn depends upon a 4160 volt bus which in turn depends upon DC control power. Only the primary dependency between the motor control center and the load center need to be supplied as input to the support system vs. support system matrix. Higher level dependencies are determined by taking products of the matrix with itself.

It is shown in by induction (see reference 4 on fault tree analysis) that all the support' system interdependencies can be determined by taking higher products of the input support system dependency matrix. Since matrix multiplication does not comumate the operation must be performed as follows:

gn , gn-1 X A"~

Here A is the support system vs. support system dependency, A" is the product of the support system vs. support system dependency, and, n is the number of products taken.

These higher level products are taken until the elements in the matrix A" equals the elements in the matrix A"~ . When this has occurred all intra-support system dependencies are determined. This information is used to map the effects of support system failures into the front-line systems.

225

SUPPORT STATE DEVELOPMENT EXAMINE ALL SUPPORT SYSTEM FAILURE COMBINATIONS DEFINE RULES TO ELIMINATE IMPROPER COMBINATIONS COMINE SUPPORT SYSTEM FAILURE COMBINATIONS THAT HAVE SIMILAR IMPACT ON FRONT-LINE SYSTEMS l

226

Support State Development l

i The identification of front-line system dependencies as a function of the I systems requires that the primary dependencies of the front-line support systems on the support systems be input. This is Just the front-line system vs. support system dependency matrix discussed earlier. Once this relationship has been established, the support systems are combined to

. determine their influence on the front-line systems. ~here is a problem, however, with just examining all possible support system combinations. The l support systems depend upon one another and therefore combinations which include dependent support system will result in double counting. In some cases an additional support system failure does not alter the influence the ,

failure combination has on the front-line system. This situation would again j result in double counting. Many combinations of support system failures may have an equivalent impact on the plant. This situations lends itself to j grouping which substantially reduces the computational burden. The outage of j many support systems is controlled by plant technical specifications and their  !

failure will result in a forced shutdown. Thus the order of failure in the  !

combination of support systema becomes isportant when computing the combination frequency.

• l An algorithm to generate the support system combinations which accounts for these complications is discussed below. Strings of support system i

! combinations are considered. At each point where an additional support  !

system failure is considered the combination is tested against criteria to  !

I properly account for the above problems.

l l

Various forms of support are required for operation of the front-line systems. I As an example a pump may require electric power and cooling for operation. i These requirements form the basis of the support states. The approach taken l is analogous to that used for support systems. The primary dependencies are l input in matrix form. This matrix is called the front-line system vs support i system dependency table. The colusms_and rows represent support systems and front-line systems respectively. A 1 in element i,j, identifies that i front-line system j requires support system i for its operation. Only the l primary support system dependencies need to be input. Higher order j dependencies art identified through tho' support system matrix.

All possible combinations of support system are determined by taking sequential strings of support systems. This method is best demonstrated by example.

Consider the case of four support systems. _

The first support system is considered by itself. Then the first and second, then the first, second and third and so forth. Numerically this becomes: .!

1 1 124 2 3 12 13 23 34 123 134 234 4 1234 14 24 227

,I RULES FOR SUPPORT SYSTEM COMBINATIONS .j i

l SUPPORT-SYSTEMS IN STRING ARE DEPENDENT l J

SUPPORT. SYSTEMS HAVE UNIQUE EFFECT ON FRONT-LINE FUNCTIONS i

THE SUPPORT SYSTEM STRING HAS A SIMILAR IMPACT ON FRONT-LINE SYSTEMS ALL COMBINATIONS CONSIDERED THE SUPPORT SYSTEM FAILURE STRING HAS AN ACCEPTABLE FAILURE PROBABILITY j

228

n Rules por support System Ocmbination 1

~ f.the support. systems are combined as described in the previous view graph

-the number of ccmcinations'would grow to an unmanageable _nummer. Some of tne ecmbinations have an. equivalent'effect on the plant while others do not represent minimal failure' combinations. A set of rules are imposed-on each-new string of support system failures considered.

~

Eact new: combination of support systems is tested to ensure the combination is appropriate.' 'Each string is. tested to determines whether the combination consists of dependent support systems, the impact of the additional support system failure on the front-line systems, the equivalence of the present support system combination to a previous combination, that the consideration of all permutations is considered in the frequency calculation, and ,

whether the frequency of-the combination is below an input cutoff value, Each of these items is discussed below.

The test for a dependency between support systems in a combination is determined by checking 'he support system vs. support system dependency matrix for a one in the row that corresponds to the support system under consideration. If support system j is being considered then the previous the elements 1 through (j-1) which appear in the combination are querried in the support system vs. support system matrix. Should a one appear, a dependency exists, and the jth support system will not be included in the string. The checking will.be terminated and the calculation will proceed to the j+1 support system. If only a.'ro's exist in these matrix elements the jth aupport system will be tested ft 2- its impact on the front-line systems.

If the jth support system is independent of the j-1 support systems in the combination being considered, it must be tested to see if it results in additional front-line system failures.

This test is performed by complementary addition of the rows in the front line system support matrix which correspond to the support systems in the j-1 string and the support systest being tested. If no additional de'pndences between the jth support system and the front-line system exist then the tasult of the complementary additional will remain the same. This implies that the jth support system failure has had no additional effect on the n'ront-linw systems and therefore the jth support system will not be included in the string. If additional dependencies exist between'the front-lins systems and jth support system then the result of the complementing additions will cherige.

This change in status represent additional dependencies.

r 229

- _ _ _ - - _ - _ - - _ _ _ _ - _ _ - _ _ - _ _ _ - _ _ _ _ = _ - _ .

e l

230

Once a: combination of support systems is identified, the frequency Of ;ts occurrence is computed. The following information is required- to perf:rm the computations the support systems in the combination, the failure rate.cf each

=of the support systems and the allowed cutage time.for each support system.

The support system combination is prov fed by the cceputer program, while the failure rate and the allowed outage time for each of.the support system is-user input. With -this- information the frequency of the event can be computed.

We Save developed an equation to- compute the fsupport state probability. This equation is based upon the following assumptions. .

1. All operating system failures follow the constant failure rate

~

model. The failure rate is represented by A.

2. Each support system i has an allowed outage time ACT which'is represented by A g.

3. Should two or more failures occur the allowed outage time for th'e combination of. support systems is set by a constant time, C. This time is analogous to the 3.0.3 action statement in the plant Technical Specification.

4. After an initiating event ,I, the equipment must operate for a period sufficient to place the unit in cold shutdown. .This time is represented by M.

5. The plant operates for a time T.

6. i outages of length T can be treated as one outage who's length is the sum of the Tg 's. gThis assumption is discussed in Appendix 9.

Given a support system failure or an initiating event at time t, the probability of a subsequent event P is computed using the constant failure l

model T

P, = f dt ypdf(t).

o Failures can occur before or after an initiating event. If the failure occurs before the initiating event, the exposure time is set by the Allowed Outage l Time of the first failure. If the first failure oceurs after the initiating event, then the support systass at;st function for the sistion time. Thus the order of failure West be preserved when perfor.aint frequency calculations.-

The form of this integral- for nach sailnre is the seme as the above case with the initiating event I being tae point at which the limits of integrate change. Using this fact induction can be used write an expression for n+m failure 9cyfurring prior to and after an initiating event as shown below:

L L

231 l

9 232

- ' ----_.___ __ - ---- ^-- - - _ _ _ _ . _ . ____ , .L._._____ _

l1 The form of the integral becomes:

(T-A)' (t,+A-C)' (t,*C) ( t , -C.) (T-Al (t.*A) lt.-A) (t.+A)

P,(t) = fdt A /dt A f dE3 )) f tdE 4 A 4 ... +.'dt[g.dE,'

o

. ." d E [*. )

dE[q t o t,+A v t t; 3 3 t)

T T-C t,+C t,+C T. T' T. T

/ dty A / dt22A f at331 / at44A ... + / d 11 A / dt 32' 1

+

T-A t t t T-A T-C t M3* t 44 y 2' 3- 2 3 The pdf_for the constant failure rate model is an exponential which can be expanded in an infinite series.

pdf(t) ==e\ ~

= (1-At + (At) /2: ...)

The ACT is designed to minimize the amount of time the plant is operated with failures, therefore if the A is small, At terms are much smaller.than_1. This situation allows the pdf to be approximated by just A. This greatly-simplifies the integral. .The process can be generalized to deal with demand failures by: realizing that operating systems cannot experience demand failure while operating and likewise standby systems cannot experience operating failures while in standby. Both,-however, can experience maintenance prior to an initiating event. Using this fact induction can be used to write an expression for n+m failures occurring prior to and after an initiating event as shown below.

No failures prior to an initiating event.

P, , b ( Ag +P ) M

_),7 A +P i=1 3

One failure prior to an initiating event.

r 'r . (r-d+dj -1) p

• U i+P M @ 2))

g

~

31 . g,1 More than one failure prior to an initiating event

~ ~

r r-d+d +1 r

+1)! k(r-d+d -k)

P, = g g d U

j j._ ( gA +P[l (r-d MC j=1 k=1 A j j) i,3 (k-1) : (r-k d+d ) : j (TA - TC - -fCT)

T 233 l:

T t-(

• i

(.

t

\

l l

l

)

1 1

I, I

i j

i 4

l 2

J l

l

'i 234 i I

i 1

Here, 3

l r is the total number of failures in a string i, ,k are indices, is the operating system failure rate of the i '5 component, M is the mission time from the start of the initiating event, C is the allowed outage time associated with two or more failures, A is the allowed outage time for the j failure, and T'is the total time failures are to be considered.

a = (Total outage time)/AOT/T: and is the maintenance rate.

p is the demand failure probability r

d= E d-i and is equal to the number of demands i=1 ii d , _P P +1 3

If a support system failure combination satisfies the above selection rules, and it has a sufficient frequency of occurrence, it is then evaluated to determine if it is represented by an existing support state or if it represents a new support system configuration. This evaluation is performed using the support system failure combination, the front-line system vs.

support system dependency table, the functional fault trees and the basic event data. Prior to this evaluation, however, matrices used to evaluate the logical consistency of the support system failure combination are updated.

The functional fault trees are evaluated using the support system failure combinations to determine the influence the support system failure combination has on the event tree top events. The results of this evaluation are compared to the event tree top events for other support states. If the influence of the combination on the event tree top events is the same as another existing support state, the combination being evaluated is included as an ulement of that support state. If the influence of the combination on the event tree top events is unique, then a new support state is created. In either case the calculation proceeds to the next support system failure combination. When all the support system failure combinations are evaluated the influence of the support systems on the front-line systems is mapped.

235 l

f CALCULATION OF ACCIDENT SEQUENCE FREQUENCY F

ACI

= IXP33; xP TE1,1 xP TR,1 . .. P TEN,I 236 l

l Calculation of the Accident Secuence Frequencies The evaluation of accident sequences requires evaluation of logical relationships of the plant ecmponents and estimation of the failure probability. The interdependencies are explicitly treated when develeping the event tree top event probabilities in a manner which preserves their ,

independence. Accident sequence frequency evaluation therefore reduces to the  !

product of the initiating event frequency and the event tree top event j probabilities in the accident sequence. This process is descrued by the l following equation, ACi 'SSi

• TEl,i

• TE2,1 *** TEN,1 Here, F is the accident sequence frequency for support state i, I is the initiating event frequency, P is'the probability of support state i, and, P th. tough P are the event tree top event probabilities for supportsE&gi.

l l

237 l

l.

STATION BLACXOUT EXAMPLE INPUT DATA DEVELOPMENT OF' SUPPORT STATES ACCIDENT SEQUENCE FREQUENCY CALCULATIONS i

l 238

c____.__..- _ _ . . _ - -

s Station Blackout Example ~

1 "hisiprocess is illustrated using the station blackout sequence with a

)

successful scram, proper operation of the 35,Vs, but a failure.of HPCI and-

-'RCIC. In this evaluation input data is required. This' data will be used in-developing the support states.

Once the support states are defined the accident' sequence frequency for each support state is computed.

l 239 c_____.____._ . - - - _ - _ - _ - _ - - _ _ _ - . . - _ _ _ - - - .

i Input data for Accident Sequence Calet.lation Item value Reference

~

'1. SBO frequency 2.2x10 /yr NUREG-1032 and SSES-IPE

2. DC bus failure 3.4x10" /hr SSES-IPE

~

?. HPCI failure probability 4.2x10 /dem SSES-IPE

~

4. ICIC failure probability 4.2x10 /dem SSES-IPE

5. Offsite power 0.23 NUREG-1032 nonrecovery probability at 50 minutes

6. Casite poser non- 0.91 SSES-IPE recowery probability at 50 minutes

7. AC poser non-recovery 0.21 Item 6 x Itam 7 probability at 50 minutes

8. DC bus Apr 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> + 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> SSES Tech Spec

~

9. Firs p g failure 2.9x10 /dem SSES-IPE probability

10. Bottom head Dryout 3.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> BNRSAR Calculation

11. Non-recovery probability 0.09 Application of at 3.5 hmars EUREG1032 240

1 Incut Oata for Accident Secuence Osleulation

• his view graph identifies the initiating event frequency, the system failure {

data, timing information associated with the event, and the probabilities I associated with loss of each barrier. These probabilities are associated with the recovery of AC power in many instances and therefore are called non-recovery probabilities.

241 l

L__ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _

l l i 1ll y

r e

v oy ct ei rl 7 7 7 i 2 2 2 nb 0 0 9 0 oa 0 0 0 0 Nb o 0 0 0 0 l r eP s

s e

V deg dn 1 1 1 1 2

ni 2 2 2 el t o 0 0 0 0 xo EC s

e t

a t a S c i

t ft r

o '

oce p yj) p t g u iI ~ ~

S l 0 0 8 ied 1 1 1 f brn x x 0 o aua 2 2 0 0 l sm 4 0 t ise 4 1 n aed e

m vr(

u aP g n l

o Uh g e i v H e

D

)

' 8

~ ~

s 0 0 ~0 7 9

r 1 1 1 a x x x 9 e 1 1 6 9 Y

F( 1 1 5 0 a

i c

t ea e t n d r ai n u tb m a l Su i n 4 4 44 a te 1 2 12 F r 6 6 66 oe D D DD o pr 1 1 11 N pu ul Si a

F

%u

s .

=

Example Development of Support States This process is demonstrated using the accident sequence SBO.HP.EC. This accident. sequence is defined in the discussion on' event tree construction. It represents a station blackout with a failure of-HPCI and RCIC ar.d a failure to recover AC Power. Only the DC power support systems will be considered ~in-this example. Additional data' required for the analysis is given in the -

previous view graph.. In this example the support system-failure combinations.

to consider are no failures, loss of 1D614, loss of 1D624, and loss of'both DC-

. buses. The effect of these support system is shown in the development of the support system view graph. Examining this table reveals that loss of 1D614 and 1D624 have the same - effect on the front-line' system.- Therefore, they'are.

combined. -These support states are therefore considered no failures,. loss of 1 DC bus, and loss of'2 DC buses.

l 243 I b

1 I

a *

• 2

! 'o 'e 'e 'o 311 a  %

a a

1* 7

~ - ~ ~

W N ll M N N

[g e

8 8

i 8

i W M M E 1 O

?*

1 E

'8 A2 '.1 '.1 A

e 7 5 i

?

W N A 7

g i N 8 5 3 li i 8 3 a 4 i i 4

8 N

Bu * '* '*

$25 i A e

&** i 4 i w d 3 i T T Jg 2 2 2 ynnn

- 4 4 4 5

~

toa 4 3 A 3 8 8 a-~ E  :

244 i

i

______-mmm_.__-_ _ _ _ _ . _ _ _ _ _ .

.\

l ..

i Accident Secuence Frecuency Calculation This view graph demonstrates how the accident sequence frequencies are computed. *he initiating event. frequency is partitioned by the support state.

In this example the three support states are considered. The frequency cf the front-line functions for each support state are used in the calculation.

These are obtained from the previous view graph.

Since each probability is independent the accident sequence frequence for a given support state is obtained by multiplication. The plant damage frequency for a given accident uequence is obtained by summing the support states.

245 )

i

I I

i i

F l

l 246

~_ . - _ _ _ .

1 ORGANIZATION OF RESULTS

ORGANIZATION OF RESULTS(1)-

i INPUT DATA o INITIATING EVENTS TYPE FREQUENCY IMPACT VECTOR o SUPPORT SYSTEMS UNAVAILABILITY DEPENDENCY MATRIX o FRONT LINE SYSTEMS UNAVAILABILITY DEPENDENCY MATRIX o SUCCESS CRITERIA i

UNAVAILABILITY OF NEEDED EQUIPENT TIE AVAILABLE FOR OPERATOR ACTION l 248

l l

Orcanizatien of Results fi)

PP&L takes the position that in order for any r sk assessment to have credibility, the input data for the calculation must be presented in the final report document. On the basis of pract cality we exclude from this presentation the various transient analysis and supporting : calculations necessary to the risk analysis. These calculations should be available in the form of auditable records supporting the risk analysis, however. Further, the results of these analyses which are used in the risk analysis should be identified and their origin unambiguously referenced. This requirement for an unambiguous reference applies to all data used in the risk analysis.

The input data for initiating events must include a list of the initiators considered and the frequency of each. In addition the impact vector must be provided. This data specifies the equipment made unavailable by the initiator. The equipment list must include all items from the list of Support Systems and the list of Front-line Systems.

In the case of Support Systems the inherent unavailability and the primary dependencies must be provided. It is probably desirable to present the final dependency matrices as calculated with all dependencies indicated as well as the primary dependencies. This type of information could be useful in evaluating the results of the risk analysis. If the system is a standby system, the unavailability will be on a demand basis. If it is an operating, system, however, the Allowable outage Time (ACT) must also be provided in order to determine the expected unavailability.

The information required for Front-line Systems is similar in nature.

The success Criteria, in general, have the form of a set of equipment required and a time constraint for its successful operation. This data is generally derived from the various transient analyses and should be carefully referenced to them.

249

ORGANIZATION OF RESULTS(2)

OUTPUT DATA o UNAVAILABILITY MATRICES INITIATOR-SUPPORT STATE X FRONT-LINE FUNCTION o SUPPORT STATE FREQUENCY FOR EACH INITIATOR o ACCIDENT SEQUENCE FREQUENCY MATRIX INITIATOR-SUPPORT STATE X PLANT DAMAGE STATE o PLANT DAMAGE STATE BY INITIATOR MATRIX INITIATOR X PLANT DAMAGE STATE o PLANT DAMAGE STATE VECTOR TOTAL CONTRIBUTION TO EACH PLANT DAMAGE STATE o TOTAL PLANT DAMAGE

I Organization of Results(2)

The presentation of the output of the calculation should include the unavailability matrices, the accident sequence frequency matrtx, the plant damage state by initiator, the distribution of total plant damage state frequencies, and the total plant damage state frequency.

l The accident sequence frequency matrix actually contains all of the information developed by the risk analysis. It is this data which must be l edited in order to cast the results of the analysis into various formats. The i t* ' itifiers of the accident sequences are:

- the initiator,

- the support state,

- the Front-line Function failure sequence,

- and the plant damage state distribution The last of these is a series of plant damage state descriptors which describes

- the time of core damage

- the extent of reactor damage

- the amount of core debris released to the drywell floor,

- the time of containment loss of integrity, and

- the nature of the loss of containment integrity.

This data provides great flexibility. in the manner in which susanary data can be displayed. It can for example be used to determine the nature and frequency of the contribution to plant damage from specific system failures.

It can also be used to perform sensitivity studies. The primary requirement for such activities, if the risk analysis is computer based, is a flexible edit program to collect and organize the appropriate data.

251

- . _ _ . _ _ _ _ _ . _ _ _ _ _ _ _ _ _ l

l c

f I

252

O AN IPE APPLICATION 1

1

{

1 i

1

\

\

l 253 m

O THE INTEGRATED' RISK' REDUCTION STUDY

PURPOSE OF THE STUDY THE APPROACH TAKEN STUDY DELIVERABLES 1.

254 l -

J

The Integrated Risk Reduction Study This view graph outlines the presentation of the integrated risk reduction study. This study is one application of the 53ES-:PE. It is reviewed here t:

demonstrate the utility of the support state method, and also demonstrates PP&L approach to bring closure to the severe accident issues. The purpose of the study, the method employed and the deliverables expected are reviewed.

255

PURPOSE OF THE INTEGRATED' RISK REDUCTION STUDY TO BRING CLOSURE TO THE SEVERE ACCIDENT' ISSUES FOR SUSQUEHANNA IDE"TIFY WEAKNESSES SPECIFY IMPROVEMENTS-1 l 4 256 .

i l

j

?

Intecrated Risk Reduction

~

The purpose of the integrated risk reduction study (IRAS) is to systematically ident:.fy the initiating events and subsequent failures which contribute the greatest to Susquehanna Plant risk, and then to specify the most promtsing actions to reduce this risk. Through various other studies and evaluations PPEL is aware of potential weaknesses in Susquehanna's design and procedures.

Many of these weaknesses, however, and thus their solutions, are interconnected. Therefore resolution of any severe accident problem requires

.an integrated approach. The goal of the IRRS study then is to identify severe accident problems at SSES and to integrate proposed solutions into a consistent and coordinated long term resolution of severe accident concerns at SSES, and thus reduce the risk of core damage, and containment failure.

l 257

N:

1' IRRS METHODOLOGY DEVELOPMENT OF EVALUATION CRITERIA EVALUATION OF ACCIDENT SEQUENCES AGAINST CRITERIA EVALUATE PROPOSED SOLUTIONS TO IDENTIFIED WEAKNESSES 258

IRRS Methodology As discussed previously, the scope of this study could quickly grow out of centrol due to real uncertainties that exist in accident sequente evaluation, a potential for a broad spectrum of vulnerabilities, and a mul::plicity 'of solutions to identified problems. However, a methodology has been devised which limits the scope of this effort. This methodology consists of tnree steps. First, a qualitative evaluation is carried out to identify weaknesses in the plant design or procedures. The second step involves identifying root problems which result in the plant weaknesses identified in the step one.

Finally, solutions to these root problems are evaluated to determine the optimal approach to dispositioning the problems. A description of the approach to each step is provided in the following paragraphs.

The first step is structured around qualitative evaluation criteria. This approach has been utilized at PP&L for many years as demonstrated by the Station Blackout and ATWS safety evaluations and more recently by the SSES IPE. The criteria employed in those efforts were formalized as defense-in-depth criteria at the NRC Region I PRA workshop in March 1987.

They were again revised for use in this study and appear earlier in this presentation.

Many assumptions concerning plant design and operations, and analytical models used in quantitative analysis, are necessary in a study of this nature. These assumptions must be collected and submitted to Engineering and Operations to ensure they are realistic.

With the evaluation criteria established, the next question to consider is what set of accident sequences should be judged against the criteria. The SSES IPE represents the largest collection of accidents evaluated for SSES and includes those considered in other sources such as the FSAR. Because the evaluation criteria require all accident sequences, including those having low calculated frequencies, to be subject to the defense-in-depth criteria, all SSES IPE sequences are being evaluated.

} Each accident sequence is evaluated against the defense-in-depth criteria.

The evaluation is performed by constructing a table that for each accident sequence identifies the plant damage sequence, the sequence frequency, and the results of the defense-in-depth evaluation. Each criterion is listed:

equipment, procedures, and interface requirements. A discussion cf how the accident sequence is evaluated against each criterion is discussed below.

After all accident sequences are reviewed a list of weakness is compiled.

Modifications will then be proposed which eliminate the weaknesses. Risk calculations will be performed to determine which set of proposals are most effective of reducing risk.

4 259 I

l

EQUIPMENT EVALUATION CRITERIA SEQUENCE FREQUENCY 1. 2 3 4 SB0.HP.EC. 8.3x10-8 HPCI E DIESEL FIRE MAIN E DIESEL RCIC INJECTION L

l 260

Equipment Evaluation 1

~

The equipment criteria state that additional independent failures must occur before the loss of the fission product barriers,-that is the fuel clad, and the primary containment. The reactor pressure vessel is considered also to be a barrier to core debris. This barrier is not a fission product barrier, but-it does serve the important role of preventing an attack on critical.

containment components by core debris if integrity of the lower vessel head is lost. saving this barrier greatly reduces the magnitude of the challenge to containment integrity.

The equipment failures that must occur prior to loss of a barrier are listed in the evaluation table identified. As an example, core damage (loss of-the cladding barrier) will occur during station blackout if the HPCI and RCIC pumps also fail. Thus the failures of the diesels or components in Emergency Service Water (ESW) and of HPCI and RCIC are listed in the evaluation table under core damage. BWRSAR calculations indicate that fire main injection within one hour will terminate core damage with the reactor vessel intact.

Therefore the fire main is listed under the criteria for vessel failure.

Finally, should the core melt breach the vessel, tying in the fifth diesel for decay heat removal and remote manual operation of the two inch vent line for noncondensibles gas control will prevent containment overpressure failure.

Thus, these systems are listed under the containment barrier criteria. This process is performed for each accident sequence in the IPE. Instances where

. defense-in-depth is not satisfied are documented.

261 -

PROCEDURAL AND INTERFACE EVALUATION PROCEDURAL INTERFACE l SEQUENCE FREQUENCY 1 2 3 4 SB0.HP.EC 8.3x10-8 N0 VIOLATION HPI FIRE MAIN INSTRUMENTATIC IDENTIFIED SUCTION ALIGNMENT ON DC POWER TRANSFER DIESEL

! ALIGNMENT 262 i

Procedural and :nterface Evaluation

. The method of evaluating the procedural criteria is radically different from that used for the equipment criteria. .In this evaluation each procedural step performed by the operator in response'to the accident sequence is evaluated against the criteria. The EOP flow chart steps taken by the operator during the particular sequence:are highlighted. Steps that satisfy the criteria are ls labeled with that particular-procedure. criteria number, while steps that may:

? violate the procedural criteria.are marked with an asterisk (*) and the number of the. criterion violated, and steps that are not applicable are left unmarked. In the defense-in-depth table, only those steps that may violate the criteria are identified.

The. procedural criteria are' targeted at ensuring that no deleterious actions lf, are performed, that necessary actions are performed to protect operable equipment, and that the necessary actions are taken to accommodate additional failures. In the accident sequence used to illustrate the equipment. .

defense-in-depth, the first procedural criterion is satisfied. The procedures instruct the operator to prevent q I and RCIC suction from the suppression pool if its temperature exceeds 150 F. This action protects the pumps which' may be challenged if they.should pump water with a temperature that exceed '

170 F. That step satisfies procedural' criterion No. 2. Finally, the procedures instruct the operator to align the fire main system for RPV injection. This step anticipates the loss of HPCI and RCIC and therefore satisfies procedural criterion No. 3. This is an expected result for station blackout, however, since PP&L developed these_ procedures using this philosophy.

The third criterion requires that the information and time necessary to make the decisions identified in the procedures exist. '. Equipment and procedural requirements are thus integrated. The method used.to evaluate this criterion is similar to that used for procedural defense. Required instrumentation and sequence timing information must be available to evaluate acceptance.

This type of defense-in-depkh evaluation is performed on each sequence in the SSES-IPE. *Ihe result of the evaluation will be a list of instances where the equipment or procedures fail to satisfy defense-in-depth. In phase two of the study these deficiencies will be grouped by root problem or by system interaction. Once this information is cataloged integrated solutions can be investigated.

263

IRRS DELIVERABLES A TECHNICAL REPORT TO PPat MANAGEMENT IDENTIFIES WEAKNESSES IN DEFENSE-IN-DEPTH EXPLAINS WHY WEAKNESSES EXIST OUTLINES PROPOSALS TO CORRECT WEAKNESSES RECOMMENDS PREFERRED MODIFICATIONS 1

l 264

RRS Deliverables The output.of this study will be a technical report. -The purpose of the report will be three fold. Ti'st r it will identify those instances when SSES has not met'our definition of defense-in-depth. Second, it will describe on'a cenceptual level why defense-in-depth was not' met. ~ Finally, a preferred set of modifications'and procedures will be proposed to establish defense-in-depth or a justification for any deficiency will be presented. Alternate proposals will also be presented which may not produce the same benefit'as the preferred set but may be more practical to implement. Proposals _will be sufficiently detailed to-allow preliminary cost estimates to be made.

In conclusion, we believe that the approach being taken in IRRS represents a L major step toward resolving severe accident concerns at SSES.

Lo 265

z l

1 l

l 266

---~-------_ - - - -._-___________ ----___

____7-..

HUMAN ERROR TREATMENT IN RISK ASSESSMENT i

i l

1 267 I

I l

HUMAN ERROR P(PES o ERRORS WHICH LEAVE STANDBY EQUIPENT UNAVAILABLE INCLUDED IN UNAVAILABILITIES o ERRORS WHICH CAUSE A TRANSIENT (INITIATING EVENT)

INCLUDED IN INITIATING EVENTS o ERRORS IN RESPONSE TO AN INITIATING EVENT PPSL HAS ASSUED OPERATORS FOLLOW PROCEDURES WITHOUT ERROR.

FAILURE TO EXECUTE THE PROCEDURE OCCURS ONLY WHEN THE TIE AVAILABLE IS INSUFFICIENT. -l 268

l Human Error Types In performing the Susquehanna IPE human error which :entributes to in initiating event or to equipment unavailabilities were assumed to be imbedded in the initiating events and equipment unavailabilities used to characters:e Susquehanna. Initially generic data was used for this purpose, but, as operating data is gathered for the plant, actual plant data will be used for this purpose. In both cases the actual human error contribution is included in the data used.

This leaves us with the problem of characterizing and quantifying operator error in response to an initiating event which challenges the safety systems of the plant and which could lead to severe accident conditions in the event of sufficiently severe equipment failure or operator error. In performing the Susquehanna IPE we determined that the answers to two questions were necessary

~

to characterize and quantify the operator error in response to an initiating event. These were:

1. Does the operator follow the procedural step as the symptom (cue) which calls for it occurs?

2. -How long does execution of the procedural step require?

The first of these questions we resolved simply by stating that we would assume that the operator would follow procedures and that failure to follow procedures would have a negligible contribution to the risk of plant damage.

The second we resolved by application of the Human Cognitive Response (HCR) model developed by G. W. (Bill) Hannaman of NUS, San Diego.

The assumption made with respect to the first of the above questions has been characterized by many as unrealistic and extremely optimistic. We did not make this assumption casually, however. We believed that our new symptom based EOPs were comprehensive and would be optimal for any initiating event and additional equipment failures for which operator response could have a j favorable impact. This judgement was based on experience gained in detailed j studies performed for Susquehanna on Station Blackout and ATWS accident '

sequences.

We further believed that our operator training in the use of the EOPs was very thorough and emphasized ' rigorous adherence to procedures. For these reasons we believed that our assumption represented a closer approximation to reality than some arbitrarily assumed probability of a deviation of an undefined type.

It must be recognized that if some rate of procedural deviation were to be ,

considered, several very difficult questions must be answered. The first l layer of such questions is: '

1. Why was the procedure violated?

2. What is the nature of the violation?

It is clear that the answer to the second question is strongly dependent on the answer to the first. We therefore examined potential answers to the first of these questions.

269

~'-'V-----r-i 4

270

It is reasonable to postulate

• hat the reasons for dev:.ation on a precedural step :ould be due to one of the foll: wing reasensi

1. The violation was willful and represents the cperator's preference in responding to the plant conditions.

2. The operator misunderstood t..e procedural instruction ar.d executed it improperly as a result.

3. The operator was unaware of the occurrence of the cue'for the action.

4. The. operator did not have adequate time to successfully perform the action.

The first of these possible answers we reject on the basis that our operators are indoctrinated in the necessity to adhere rigorously to procedures. The second, we believed would be unlikely since considerable care had gone into preparing and formatting the ECPs. The third we believed to also be unlikely as a consequence of our symptom based procedures and the generally slow nature of BWR transient response which allows considerable time to monitor the results of an action and take corrective action if necessary. For the very severe events for which time limited actions are involved, Station Blackout and ATWS, we believed the symptoms of the event to be unmistakable and that operator misinterpretation was simply not credible.

This leaves only the fourth item above as a credible answer, and therefore, the nature of the procedural deviation is simply failure to take the action in time to be effective. The critically important aspect of this type of failure, however, is that the operator is aware of the situation and therefore we must believe that he will attempt to execute the backup actions which would generally be available.

Quantification and characterization for the fourth of these potential answers is therefore straightforward. The HCR method may be used to quantify the failure probability, and the backup actions will characterize those cases where failure occurred. Quantification and characterization of the first three of the potential answers have no currently credible basis for either quantification or characterization.

271

l-l ERRORS IN RESPONSE TO AN INITIATING EVENT 1 i

i o MOST BWR TRANSIENTS ARE SLOW AND ABUNDANT TIME IS AVAILABLE FOR OPERATOR ACTION AND CORRECTION OF ERRORS.

o FOR A LIMITED CLASS OF EVENTS THE TIME AVAILABLE FOR

. 0PERATOR ACTION IS LIMITED AND PROMPT ACTION IS CRITICAL.

-- CLARITY OF PROCEDURES IS ESSENTIAL OPERATOR TRAINING IS ESSENTIAL 272

~

l

_mm___.m.____ ._. _._ _ . . _ -m..

l Error in Response

,to an Initiating Event

• l l . . ..

L We reiterate here'that in most BWR transient events the reactor and plant y response is slow and provides:the operator with ampleLtime for diagnosis and corrective. action.

In those cases when-the time for this is~ limited, it is essential that the l .EOPs be direct,-unambiguous, and complete. Further, it is important that

~t hese situations be' covered in operator training to assure a awareness of

~

i these time critical situations.

273

)

1 1

u

TIME CONSTRAINED ACTIONS SLCS INITIATION IN RESPONSE TO ISOLATION ATWS.

FEEDWATER RUNBACK IN RESPONSE TO NON-ISOLATION ATWS.

DEPRESSURIZATION IN RESPONSE TO ISOLATION ATWS WITH SLCS FAILURE.

PREVENTION OF HPCI SUCTION TRANSFER IN ATWS.

PREVENTION OF HPCI TRIP IN A1WS.

MANUAL VALVE OPERATION FOR LPECCS INJECTION VALVE FAILURE.

l COMPLETION OF CONNECTION AND ALIGNMENT TO PERMIT FIRE MAIN INJECTION IN STATION BLACK 0UT.

1 1

274 V l

Time Constrained Actions l

This viewgraph.' lists the important time constrained' actions derived for the

~

Susquehanna PE. It should be noted, that with one exception, these actions are required in accident sequences which the operator must immediately recognize as a consequence of the symptoms which accompany the event. he do not believe that an error is credible in prompt recognition of these events.

The one exception, failure of the LPECCS injection-valves to open, requires that the operators monitor plant response to assure that water level response l 1s as expected with low pressure pump injection. Since operator training emphasizes the importance of monitoring plant response to actions taken, ve believe that this symptom is very unlikely to be overlooked and that the failure rate, which is high for this action, will be dominated by the-time available limitation..

i 1

275  !

I m

.Cl -

c C

M f

a -

n i G N

J . -

Lu 8 Q - a o ..

g c

E 5 -

cc e U s' I .c=4 w

g.

4, .

=+ m. y w w An IIge40Jd BSU0dS88-UON

! 1 1

i 276 ,

l'

_ - - - _ - _ .._ -__ . _ _ - _ - _ _ _ - _ _ _ - _ - _ _ _ - _ - . - - - = - . . _ - _ . _ _ _ _ _ _ - - _ - _ _ _ - - _ - _ - _ - - . . _ _ _ . - _ _ - - _ _ -

HCR Model This figure represents the time dependence for operator..'non-response probability in executing an action required. This probability is seen to depend on'a normalized time variable and on the nature of-the cognitive processing involved .. skill, rule, or knowledge. -The curses used are Weibull distributions which have a-fundamental negative exponential nature.

277

REQUIRED STEPS FOR THE HCR METHOD l

o DETERMINE THE TIME AVAILABLE TO TAKE THE ACTION.

TRANSIENT ANALYSIS l

o DETERMINE THE MEDIAN TIME REQUIRED FOR THE ACTION.

USE JUDGEMENT OR MEASURE o DETERMINE THE PERFORMANCE SHAPING FACTORS.

- EXPERIENCE, STRESS, INTERFACE QUALITY o CALCULATE THE ADJUSTED MEDIAN TIME FOR THE ACTION.

o CALCULATE THE NORMALIZED AVAILABLE TIME FOR THE ACTION, i

o DETERMINE THE TYPE OF CO6NITIVE PROCESSING.

o USE THE CURVE TO DETERMINE THE FAILURE PROBABILITY,

• 278

1 1

-j.

Required Steps for the.

-HCR Method 1.-

mis viewgraph presents the several steps required to apply the HC:t method.

The first of,these steps is not actually'a part of the HCR model but only represents an input parameter for the model.

The seven steps are described'further in subsequent viewgraphs.

9 279 l

1

_ _ _ _ _ _ _ _ _ _ - - _ _ _ _ _ _ _ _ _ _ _ _ - _ - _ _ _ _ _ __J

TRANSIENT ANALYSIS o DETERMINE THE TIME AT WHICH THE SYMPTOM WHICH WILL TRIGSER THE ACTION OCCURS, o DETERMINE THE LAST TIME AT WHICH THE ACTION CAN BE COMPLETED AND BE SUCCESSFUL, o THE DIFFERENCE IN THESE TW) VALUES IS THE AVAILABLE TIE.

. p.

l 280

1 1

l Transient Analysis j d

Determination of the time available to take a procedural action is a critical step in-the quantification of the non-success probability for the action. The-determination must ccme from a transient analysis of.the accident sequence.

No times must be determined. The first is the time at.which the symptom 3

' occurs which will trigger the action. -The second is ths latest.possible time at which the action can be taken and accomplish its purpose. . The difference in these two times is the available time.

- For those actions which.are found to be time constrained, a realistic determination of the available time is extremely important.

281 L-- _ - - _ - - - - - - . _ - _ _ - _ _ - - _ - - - - _ - _ _ _ _ _ . - - - . . _ . _ . _ _ - - - . - - - . - _ _ - . _ - - . _ . - - - - _

i MEDIAN TIME o JUDGEMENT SELECT A TIME FOR WHICH YOU BELIEVE 50% OF ALL INDIVIDUALS OR GROUPS WILL HAVE SUCCESSFULLY COMPLETED THE ACTION AND 50% WILL EXCEED.

o MEASUREMENT HAVE INDIVIDUALS, OR GROUPS, PERFORM THE ACTION ONE TIE, INDEPENDENTLY, AND SELECT THE TIE FOR WHICH 50% OF THE TRIALS ARE LESS AND 50% ARE GREATER.

282

l l

i

.- 1 I

l Median Time

An equally important aspect of the HCR method is the determination of a

haracterist'.c time required to take an action. For this purpcse, the median time is used the time for which 50% of the actions in a series of independent cperations will exceed.

The median action is..best determined by execution of a series of experiments in which the actual time required to take the action can be measured. The median time, then, is just the middle value of the rank ordered time-measurements. In general such measurements ara not available in which case, expert judgement must be utilized. This judgement should be exercised by operators and simulator instructors whenever possible.

283

-__=--_______:___-_-__- - _ _ _ _ - _ - .

8 s

t n

i e

t c ~

2 04 4 808 2 04 82 f 204 7 9 f 204 4 202 -

e 0000 00000 o 000 C

S R

0 1

C y A c F n )

3 e

yg K G c r e (

N g ne c I

P n e ge n n a

E C

i g A nn r l A H ii el i F S

- d ri a n mayi e1 g R E

t cv T E et a n r enn N C i et v ee w I N a g at go A rd m ro rl T t eu gp e N r M )

g l m m , A o O K l wi ff ey L o p

F ( l on oo oi t P

/ -

R eni_ y E E wk m '

nnnv oo i R

O t

n l

_ P C ,e , ) i 1 ,t T e e N 2 t t ec A i m E t ge R l e I r a c K auui

(

a v a E ad rrr R e ri t t t w P coiot E pev O x oa ox P x v o L ii co EGF PE X EAN E SSAL F E V O E

R L . . . .

Y . . . . .

O . . .

T 1 23 S 1 234 TI 1 23 4 5 A S L

_ R E A E R U P T Q O S E

ll l

t y'!

Performance shaping Facters In general, it is considered that the edian time required for an acti:n will depend on various factors which :an fa nrably or adversely influence the time required. In the original HCR model.three such factors were pcstulated.

' These were:

1. Operator experience

2. Stress level

3. Quality of the operator / Plant Interface The table in the viewgraph indicated a means for characterizing the nature of these factors and quantifying them. Of course, if the median time has been determined by measurement of the actual action, such corrections may not be needed.-

PP&L has reservations about the use of performance shaping factors of this type.

285

PERFORMANCE SHAPING FACTORS APPLICATION o ADJUST THE VALUE OF MEDIAN TIME SELECTED BY THE EQUATION:

Tg = (1 + K1 ) (1 + K2 } (1 + K3 ) Tg*

T'=g THE MEDIAN TIME Tg = THE ADJUSTED TIME Ky = EXPERIENCE FACTOR K = STRESS FACTOR 2

K = INTERFACE QUALITY FACTOR 3

o NORMALIZED TIE-T = Tcg

/T

• T c

= AVAILABLE TIE FROM ANALYSIS l

l' 286

(

I L

Performance Shaping Factor Application I

• • performance shaping facters are used, they are applied in confermance to the equatien shewn in the viewgraph. This viewgraph also shows the determination of the dimensionless Ime parameter by dividing the actual time by the ad;usted median time. This normalization is also perferned for the available time.

287

l 21g l jg- d E

em RaaE1 d -

j=jj

} i I

I I

I l i I ,

i l , i i i i i s l l l -

l l l 5 m

..e* , ,

8 hiss l

l i

l l

l l

e w

l l l i i E l . , l l g

, i i . i i e l l l l f

• l 3 , i i i e l

• l i

i i

w g i .

l l w i

i s i

l  !!

II I Ah l l 8 s- > -

l !b li

~

Ia 1]!

-! l

!1 il i

288

An Approach for Characterizing the Type of Coenitive Processing

'Jse of the HCR curve requires a determination of whether the action is skill, rule, or knowledge based. One approach to this determination is to use the series of questions shown on the viewgraph.

PP&L also has reservations on this characterization of cognitive processing types. First, we would expect.all E0P actions to be either skill'or rule based. Actual measurements at the Susquehanna simulator have shown Weibull

- distribution parameters having even sharper time variation than the skill based curve. We believe that the use of the skill based curve is probably conservative for actions where the.HCR approach is valid.

l l

289

t m

a

= .

x2 O

e a

a 2 -

w. =

ca t o N

.m

- m m

Cl$ , g U .-.

.- C-x M E

La,)

x O s a u, s o

w e v> -

w D .

m d

5 Y u y , , - -

g. . . . . . . .

A, o q }' ' ' '

w i

e

- e - w -

AMI?4840dd asuodss8-uoN 290

• 'se

. of the MCR Model

n the preceding steps sil of the parameters necessary to determine the operster non-success probability for an action have been determined. To determine the non-success probability one s uply determines the value on the appropriate curve at the normalized value of the available time for the action.

l l

l l

291 I

l SUSQUEHANNA SIMULATOR MEASUREMENTS l

BACKGROUND I

o A SYSTEM 1 VAllDATION PROGRAM HAD BEEN PLANNED FOR EARLY 1987 TO DEMONSTRATE THE ADEQUACY OF OUR PROCEDURES, OPERATOR TRAINING, AND CONTROL ROOM FACILITIES TO COPE WITH A SEVERE ACCIDENT.

I

. o THE SUSQUEHANNA IPE TOOK A NEW APPROACH TO QUANTIFICATION OF OPERATOR ERROR.

MAINTENANCE AND SURVEILLANCE ERRORS ARE IMBEDDED IN HISTORICAL DATA ON UNAVAILABILITY AND INITIATING EVENTS CONTROL ROOM OPERATOR ERROR DURING NORMAL OPERATION IS IMBEDDED IN INITIATING EVENT RECORDS ALWAYS FOLLOWS PROCEDURES IN RESPONSE TO AN INITIATING EVENT ONLY FAILS TO EXECUTE A PROCEDURE WHEN 11ME IS LIMITED o PPal MANAGEMENT SAW A NEED TO DEVELOP SUPPORTING l

INFORMATION FOR THE SUSQUEHANNA IPE AND APPROVED USE OF THE SYSTEM 1 VALIDATION FOR THIS PURPOSE.

292

I 1 k

Sus =uehanna 3imulator Measurements

(

I shen the results of the Susquehanna IPE were presented to PP&L management in'  !

early 1986, thsre was considerable skepticism over the treatment of operater error. Many of the managers reviewing the document intuitively believed that centrol room operators were prone to error. In some cases this attitude was based on considerable experience in plant operations. For this reason a program to perform measurements at the Susquehanna simulator was given high priority. PP&L had planned to perform a series of tests to determine the effectiveness of our EOP procedures and various control room enhancements.

This program was titled System 1 validation.

It was decided to utilize the System 1 Validation program to make measurements of operator performance. The objectives of the two programs were highly compatible since both had the objectives of observing the performance of all Susquehanna operating crews and to subject these crews to the most difficult and challenging accident sequences which would exercise as much of the ECPs as possible. The measurements were scheduled for and performed in early 1987.

293

i SUSQUEHANNA SIMULATOR MEASUREMENT OBJECTIVES INITIAL MEASUREMENT OBJECTIVES

1. TO DETERMINE THE EXTENT OF CONTROL ROOM OPERATOR FAILURE TO FOLLOW PROCEDURES.

1

2. TO DETERMINE OPERATOR RESPONSE TIME IN EXECUTING AN ACTION IN RESPONSE TO A SYMPTOM OF AN EMERGENCY SEQUENCE.

3. TO DETERMINE THE ACTUAL DEGREE AND QUALITY OF THE OPERATOR'S UNDERSTANDING 0F THE CONTROLLING PHENOMENA IN AN EMERGENCY SEQUENCE.

4. TO DETERMINE THE ADEQUACY OF OUR PROCEDURES.

1

5. TO DETERMINE THE QUALITY OF OUR SIMULATOR 1+2 -% HCR MODEL 3+4+5 ---> SYSTEM 1 VALIDATION 294

}

i Susquehanna Simulator Measurement l j

Ob ective  !

l

.The eb;ectives of the System 1 Valication program :or.cined with the operator performance measurements are tabulated on the viewgraph. In order to achieve these ob]ectives the ectual simulator runs were videotaped and the post test debriefing session was performed by having the crew observe the videotape and explain the reasons for their actions and their thought processes as the event progressed. An experienced facilitatory kept the discussion going by use of neutral prompts to obtain further comment when comments become infrequent.

These video tapes and the audio tapes taken during crew debriefing have been used by independent observers to extract times and actions for the scenario.

The results of these independent observations have shown almost total agreement with observations taken during the actual measurements.

This observer data,; independently verified, when supplemented by data printed and recorded by the simulator computer has provided very reliable information on actual crew simulator performance, and, most important, the crew's reasons for their actions.

i l

295

SUSQUEHANNA SIMULATOR MEASUREMENT RESULTS PRELIMINARY OPERATOR PERFORMANCE OBSERVATIONS' o NO CLEAR CASE OF PROCEDURAL ERROR WAS OBSERVED OUT OF APPR0XIMATELY 1650 PROCEDURAL STEPS..

o A FEW INSTANCES WERE OBSERVED WHERE PROCEDURAL AMBIGUITY OR LACK OF PRECISION CAUSED QUESTIONABLE RESPONSE ACTIONS.

o OUR GENERAL PERCEPTION OF THE UNANALYZED EXECUTION TIME DATA IS THAT THE SUSQUEHANNA IPE IS PROBABLY CONSERVATIVE.

o THERE MAY BE DEFICIENCIES IN OPERATOR PERFORMANCE IN TAKING ANTICIPATORY ACTIONS.

296

d

-1 Susquehanna simulator Measurement Results The1results of the System 1 Validation measurements are considered to represent strong support for the operator performance assumption made in the Susquehanna :pE. Only a few apparent deviation from' procedures were observed.

Sdosequent review of the information available revealed two important facts.

1. The procedural step in question was worded ambiguously, and

^2. the crews involved had members out of place.

The second of these factors is unavoidable in that1Susquehanna has a two unit control room with a single shift supervisor. This means that in one half the crews tested at least one'and generally two substitutions are required. As a result of these findings we will give'the issue of crew substitution closer attention in future measurements. In the meantime the ambiguities which

~

caused.the problems have been corrected. In each instance, however, .the crew

. involved had a very logical interpretation of the procedural instruction in justification of their actual action.

For this reason, we believe that we have seen no instances of procedural error or deviation in measurements which involved well over 1600 procedural steps.

We helieve_that this-supports our view that given complete and unambiguous procedures the operators will follow procedures with a very low frequency.of errors or deviations. At this time we have no such errors which enable a characterization of such errgrs. We can only say that the frequency of such errors is probably below 10 . 'This rate is small in comparison with equipment failure in general. Since there is no evidence to date of willful deviation, improper execution or failure to observe a symptom, we are inclined to believe that failure to execute the procedural step is dominated by equipment failure and in a small fraction of cases lack of time. In these cases the operator will execute the backup actions, if available, and in most cases avoid the' extremely severe consequences which could result from the other causes for error or deviation. At this time we see no evidence that supports the need to consider procedural error involving a failure to

'understandtheplantegreumstancesandtheassociatedactionsrequiredata level greater than 10 . We suspect the actual frequency is much below this. j We will continue to devote our primary attention to this issue in future simulator measurements. -f l The measurements of execution time were limited to actions taken within the control room. In general the observed times were shorter than the distributions used in the Susquehanna IPE yielded. Observations of execution times for actions taken outside the control room have not been measured at this time. Based upon the data obtained for control room actions we see much

)

less variance in action time than that implied by the HCR model skill based curve. At this time we do not fully understand the reasons for this, but it 4 may be the result of the small scale tests from which the HCR model parameters )

were derived are not truly representative of the actions of highly trained and {

skilled control room operators in following EOPs. ]

We are concerned over the execution of anticipatory actions. These actions all involve actions outside the control room and cannot be realistically 4

297 i u______________---_______ _ _ _ _ _ - . _ J

4 l-l l

1 1

298

I simulated on the simulator. This ma 'a e 5 -

a i

-8 i n hese actions in training or more erobabl7 a Psyc..cl gical response o' ~we

- ~ ~-e ~~

.ge ,Aack of realism involved in these ac* dons * -

icserattentioninfuturemeasurementprogr1Ns.h 299

THE PP&L VIEW 0F OPERATOR ERROR o THE PREFERRED SOURCE OF DATA FOR INITIATING EVENTS AND EQUIPMENT UNAVAILABILITIES IS OPERATING PLANT DATA AS OPPOSED TO THEORETICAL MODELS.

o THE OPERATOR ERROR CONTRIBUTION TO THESE ITEMS IS IMBEDDED IN

. THE DATA AND NEED NOT BE SEPARATELY CONSIDERED.

o '0PERATOR ERROR IN EXECOTING E0Ps IS DOMINATED BY EQUIPMENT 3 FAILURE WITH A SMALL' CONTRIBUTION FROM LACK 0F TIME FOR ADEQUATE EXECUTION OF THE ACTION REQUIRED IN SOME CASES.

o THE DOMINANT ISSUE IN ERRORS IN EXECUTING E0Ps IS OPERATOR FAILURE TO FOLLOW A PROCEDURAL STEP OR TO EXECUTE IT PROPERLY.

o PPal BELIEVES THE DATA ON SUSQUEHANNA OPERATOR PERFORMANCE TO DATE SUPPORTS AN ERROR RATE OF THIS TYPE OF LESS THAN 10-3, o WE BELIEVE THAT WHEN SUFFICIENT DATA IS AVAILABLE TO PROPERLY QUANTIFY AND CHARACTERIZE SUCH ERRORS, THEY WILL BE FOUND TO HAVE A VERY MINOR CONTRIBUTION AT MOST.

300

l i

The PP&L view of Operator Error i

• n the case of human error which leads to an initiator.or failure of equipment, . we much prefer actual operating experience as a basis for the data )

used.' In the original Susquehanna IPE this was not possible since little operating experience had been developed in mid-1985 at Susquehanna. for that reason, we used generic data considered' to be generally applicable to SWR and plants, in some' cases, where generic data was lacking, we used a precursor model which imposes the limited plant experience on a theoretical model to derive a partially theoretical partially operating experience based model. We consider.this'to be superior to a completely theora.ical model. This technique is most useful for very highly reliable ,ystems which rarely experience complete failures, but do experience occasional partial failures (unavailability of one division or channel) which may be considered as

" precursors" to a-complete failure. This technique was used in.the Susquehanna IPE for the RHR suppression pool cooling' mode (the limiting safety. ~

related mode of RHR which envelops all other contributions to risk). It would also have been very useful to have applied the technique to the scram function as well. Unfortunately we had neither the time nor resources to do.so.

. Instead we simply adopted the NRC values presented in NUREG-0460 as reasonable est,imates of the actual value.

It is important when the precursor method is used to examine the model and the data very closely when the precursor technique yields a significantly

.different value of unavailability than the theoretical model. In general, the source of such a discrepancy is the treatment of common mode failure in the theoretical model. In the case of RHR the pure theoretical model and the precursor model gave comparable results of a very credible nature. Loss of the function was due to one division in maintenance with sufficient equipment failures in the other division to make it unavailable.

We have recently completed a precursor model for the scram function using LER data for the operating experience data base. When the precursor model was applied to the pre-10CFR50.62 design for Susquehanna, we found that the expected probability of failure to scram (due to SDV system failure) was very close to the NUREG-0460 value if a two to one partitioning between electrical and mechanical failure is assumed.

We continue to believe the contribution due to error in following EOPs represents a minor contribution at most. Some care must be taken with interpretation of this assumption, however, since even very low probabilities of operator error here can result in a dramatic increase in the frequency of sequences having severs consequences if the cause is failure of the operator to understand the seriousness of the failure to follow the procedure or failure to be aware that the action is required. This comes about since, in general not only must equipment fail, but a backup mitigating action must also fail due to equipment failure. This means that the operator error rgte for which no backup action can be postulated must be in the range of 10 or greater in order for such errors to be a significant contribution. We believe that our expectation of a low probability below this range is a reasonable expectation for Susquehanna crews based on information available at this time.

301 l

I

l~

1 A CAUTION o THE'PP&L VIEW IS CRITICALLY DEPENDENT ON THE EXISTENCE OF:

CAREFULLY DERIVED E0Ps, EXTENSIVELY TESTED AGAINST A BROAD RANGE OF ACCIDENT SCENARIOS EXTENSIVE TRANSIENT ANALYSIS OF ACCIDENT SEQUENCES TO OPTIMIZE THE E0Ps 1

A THOROUGH PROGRAM 0F TRAINING 0F THE OPERATORS ON E0Ps AND INDOCTRINATION IN THE IMPORTANCE OF RIGOROUSLY I FOLLOWING THESE PROCEDURES o IN THE ABSENCE OF ANY OF THESE REQUIREMENTS, THE PPal TREATMENT OF CONTROL ROOM OPERATOR PERFORMANCE IN FOLLOWING E0Ps IS PROBABLY NOT VALID.

o WE DO NOT BELIEVE THERE IS ANY CREDIBLE WAY TO CHARACTERIZE AND QUANTIFY OPERATOR ERROR IN THAT CASE.

302

L_

A Caution

'he PPC., attitude in preparation of ECPs and the training of_ cur operators was that the threat of a severe accident is real and our primary defense against such an event would be good procedures and operators well trained in their use. The view that the' risk of a severe accident can better be controlled by sufficient attention to good maintenance practices and concentration of operator training on nomal operating conditions was shown by the results of the Susquehanna IPE to be largely invalid. These actions primarily are directed at avoiding transients which lead to an initiating event and the Susquehanna IPE results show that the contribution of transients to plant damage frequency is very small even with the extremely conservative transient initiator frequencies used in the analysis. Such occurrences y e a major economic factor, however, and therefore deserve close attention in order to avoid poor financial performance in operation of the plant.

If careful attention is not devoted to EOPs and EOP training, we simply do not know how to quantify and characterize the nature of operator errors to be expected. We guld expect a much higher frequency of such procedural errors and, further, we would expect a high likelihood of very severe consequences from them. We find the prospect of dealing with this type of problem very negative, and we are convinced that we are much better off by avoiding that type of situation. We believe that in the long run the economics are more

. favorable if the investment in procedure development and training are made.

We believe that closure of the severe accident issue may not be possible otherwise and as a result, a long series of escalating requirements and unduly expensive plant modifications could be expected.

We believe we can obtain closure on the severe accident issue by our approach with a minimum of plant modifications. This does not mean no modifications however.

l i

f 303

._,7 -)

1 l

1 1

1 k

1 a

I

,j-4

)

i l

L i

304

CONVENTIONAL PRA CONSERVATISM 4

\

305

f CONVENTIONAL PRA CONSERVATISM 1

.l o FAILURE T0:

INITIATE SLCS CONTROL WATER LEVEL IN ATWS PREVENT HPCI/RCIC SUCTION TRANSFER AND HIGH BACK PRESSURE TRIP 1

DEPRESSURIZE WHEN THE HEAT CAPACITY TEMPERATURE LIMIT (HCTL) IS REACHED IN ATWS SHUTDOWN BY MANUAL ROD INSERTION FOR SLCS FAILURE IN ATWS PARTITION ATWS EVENTS ACCOUNT FOR SAVING THE REACTOR PRESSURE VESSEL PROVIDE BACKUP WATER INVENTORY FOR THE CONDENSATE STORAGE TANK STRIP NON-ESSENTIAL DC LOADS IN STATION BLACK 0UT DEPRESSURIZE EARLY IN STATION BLACK 0UT TO ALLOW ,

SUCCESSFUL FIRE MAIN INJECTION MAKE EARLY FIRE MAIN CONNECTION TO RHR SERVICE WATER (RHRSW)

USE ALTERNATE WATER INJECTION SOURCES USE ALTERNATE DEPRESSURIZATION METHODS USE REACTOR WATER CLEANUP (RWCU) BLOWDOWN FOR DHR IN TRANSIENTS WITH RHR FAILURE INCREASE THE HEAT CAPACITY TEWERATURE LIMIT (HCTL)

CURVE FOR ATWS o USE OF UNREALISTIC COP 990N MODE FAILURE (CN ) TREATMENT 306

Conventional PRA Conservatism

n the performance of the Susquehanna ~PE a number of potential operator actions using non-safety systems and using safety related equipment in unconventional ways was found to have a dramatic impact on the calculated frequency of plant damage. In order to derive the full benefit of these actions, however, it was necessary to improve some of the conventional models used to represent the . plant and to modify the HCTL for ATWS. These improvements also involved, o conunon mode failure treatment o ATWS partitioning o Arresting core damage progression before reactor vessel failures-Taking.more realistic credit for the various actions and modeling assumptions in this list can reduce calculated plant damage frequency by about two decades. More important, to do so has a dramatic impact on the plant damage profile reducing the conditional probability of containment failure by as much as two decades or more also. ,

1 1

307 i

,1 l l I

' ' ~

0 L 0 1

- 0 i<5 n

i 1 0

N1 ._ l

?

i t 0 'O s0 I A4 m -

d 1 i 3 1

l a 5 r r) - ~ - ~

) uo1 0 0 0 0 1 dr

(

1 1 1 1

_ er0 x x x x .

cE( 1 1 0 1 n o o

_ r 4 8 2 6 i P t c

I a

5 s I g n

oCa I s 0 1

'01

~

0 0 i

_ 1 1 t NP p x x x x a Hy 5 2 5 g B O. i 4 9 7 4 t M i A g m H

C n I t S i 6 n n - ~ ~ ~ e T o 0 0 0 0 u f

A oi 1 1 1 1 q K Nt x x x 1 e I

) i 2 2 2 2 s T 1 t

r 2 b I

r a 2 7 2 u W y P s -

T y E

N -

7 n

a I y -

~ ~

S c 0 0 0 0 r N n I 1 1 1 1 o A e oR x ' x x x H u NA 2 9 3 2 S .

T q e 2 1 6 2 Ce I s .

D r S a E F e _

( .

T I el A 8 I t e P S p - ~ ~ ar .

I efm 0 0 0 0 i e C nI u 1 1 1 1 tt c I OSP x x x x i nn T 8 6 2 9 nae N 1 i cr A 6 2 1 i r .

of ue ti cr -

9 I

I ' egol ncu t ~ ~ ri i n

eE 0

1

'0 1

0 1

0 1 l useagf sP x x x x i oa eI r

3 6 2 3 f

anme ar P 9 6 ssedu s 2 9 i uf s nc aoer e oerp -

r iber -

u t de l ul rv i b aoo a it F rost s t t en t nl n t e noe eis onam cicn it s i i sce tdda naV nent ae adin nu o e

g a

T rRg ye r

il +c mc on- _= r m t tt di :

ae i al 1 23 FF -

F Dt a

vWeM+++. P et ;P tt i -

tl O

C h

TNcC o =- O nS caetttt a at rnnnn ++

l P

eeoeee RMCVVV 23 E

) ) ) )

1 234 A ( ( ( (

• . . . . . . . t 234567 I 1 1 o T

x llllI

Anticipated Transients Without 5 cram In this table we have shown the results of systematically stepping back from the Susquehanna IPE representation of ATWS to the situation which prevailed at the time of WASH-1400. It is easily seen that the plant and procedural modifications made since that time have a dramatic effect on core damage frequency.

The single assumption of an operator error rate of 10% in failing to initiate SLCS not only has a dramatic effect on core damage frequency, but also increases the frequency of containment overpressure failure by over five decades. In comparing the values derived to WASH-1400, it is important to note that the type of core damage identified here (Plant. Damage State 2) would not have been considered to be core damage and so the 4.1x10 value under Procedural Error would have zero in WASH-1400. On this basis the comparison to WASH-1400 is quite good.

The comparison with NUREG-1150 suast consider that NUREG-1150 did give credit for ARI and two pump equivalent SICS. The "No Partitioning" column most directly compares to the NUREG-1150 models, but without consideration of manual rod insertion to save the containment.

309 l

l

r i

a e .

vs .

~.

sg s s_  :

... ~. .

a!5 lii' 3

i 1 T. -  ?.?.?. -?.  ?.

a211 333 -

! 3 ki" JJ4 4  ;

>F 777

• 7 o ___ _.

gas. as - -

a  :

444 4  ;

~T se en-. .~ e d

W v.

2 a.3-n g -.43 .. 4 A ca  :::a a a a s -

a a t??? t t 2 v !.y sans ?? ss s 2.-  ;

444 :  : '

3sa 2;ee as a  ; .lm :l

_i::: (

1st  ;

g *; s's's g'* * '

f.s, * :'2.

nsas e :aae a  : sg e in-11-4

= ju 3.

u: 3

,1);  :

_1_1p2 ,, l s

,:h = gr ua.--

. -m

f a a _....

2..... .-l lll.

- 11'nl1 '

Es alilllll!';I  : Esssa

4ase;esseddd E l

0 310

l l

l Station Blackout l

A similar sensitivity study. perfomed for Statien Blackout shews similar results. Here the various cperator actions called out hy the Susquehanna EOPs reduce vessel failure frequency by over one decade with similar improvement for containment failure. The addition of a fifth diesel generator to the plant produced another decade improvement in these plant damage states.

This result then compares well with the recent NUREr-1150 results for Peach Bottom.

211

7 8 9 9 9 7 0 0 0 0

- 0 0 E

- 1 1 1 1 1 1 G

A x x x x x E E E x M

A 3 9 3 5 3 1 D .

1 5 9 8 5 2.

A I

N I

A H

E U

Q S 4 8  % 3 U - - - -

S 0 0 0 0 S 1 1 1 1 R 1 U x x x x . - - - _

C 8 C 4 9 0 3 O 3 1 5 2 E

E K

E A

)R -

F E 6 6 6 6 7 7 7 5 F Y - - - - - - - -

I 0 0 0 0 0 0 0 0 1 1 1 1 1 1 D R 1 1 E x x x E P M x - x x x x H M 7 2 8 1 1 2 T , A 6 1 Y D .

3 6 2 F

• 8 4 1 6 3 O E E

M O

E U T Q

EE E R T

O B

U F L ( H 7 C 7 5 3 E A -

I E

P S 9

0 0

1 F1 0 9

0 1

M C

1 x y x 2

? x  ? -

C x 1 6 7 1 O .

3 3 2 1 8 T

N E

N l

l A S T R T N G U O T E 0 C A I

P K Y C E T T A S D E I S

L W S I R N B T S U I L E T N T T A A

E E

N O a E

I U

O P

U L

A T

O S R I T U I C

Q T A S A N A E

E A C W C A C V S T O T O R O P P S L A L T L R S M"

i.

Influence of the Differences The !"COR IPEM Appendix D provides models that are essent ally comparable to these used .n WASH-1400. This table shows the rather interesting impact that the conservatism identified can have.

It is seen that the frequency of occurrence of the various initiators'is not greatly different between Appendix D and the Susquehanna IPE. The frequency of plant damage is radically different, however. The difference:r, caused by various models and assumptions for ATWS and Station Blackout were shown on the previous tables. Similar transformations could easily be developed for each of the initiators to demonstrate the origin of the difference in results.

e l

313 1

REASONS FOR THE DIFFERENCES SB0 o FAILURE TO:

CONSIDER VENTING ,

EXTEND DC POWER ENDURANCE CONSIDER MASS ADDITION TO POOL PROVIDE BACKUP FOR VESSEL INJECTION DEPRESSURIZE EARLY I

CONSIDER BACKUP DIESEL (SUSQUEHANNA UNIQUE)

CONSIDER BACKUP FOR DRYWELL SPRAYS ADfS o FAILURE TO:

PARTITION ATVS EVENTS ASSURE HPCI OPERATION CONTROL LEVEL OR INJECT BORON CONSIDER MANUAL ROD INSERTION TAKE CREDIT FOR POWER REDUCTION BY PRESSURE REDUCTION RAISE HCTL CURVE USE LOW PRESSURE BACKUP INJECTION TRANSIENTS o FAILURE TO:

VENT J CONSIDER RWCU FOR DECAY HEAT REMOVAL CONSIDER ALTERNATIVE DEPRESSURIZATION METHODS CONSIDER BACKUP YESSEL INJECTION SOURCES CONSIDER BACKUP INVENTORY FOR THE CST CONSIDER BACKUP FOR DRYWELL SPRAYS j t 1 314

1 Reascns for tne Differences f 1

l~

. M is viewgraph lists the various contr.butors to the difference in results between the Appendix D and the Susquenanna results. It is true that not all BWR plants may have all of the various plant capabilities exploited by Susquehanna ECPs. On the other hand, many plants may have other capabilities not available at Susquehanna. The plant specific differences can have a very strong influence on calculated values of plant damage frequency and on the dominant contributors to it.

315

= - _ _ _ _ - - - - _ _ _ - . . _ - __ - - - - - - - - - - - - - -

THE REQUIREMENTS FOR ELIMINATION OF CONSERVATISM-o THE CONTRIBUTIONS OF THESE CONSERVATISM MAY BE ELIMINATED ONLY IF:

THE ACTIONS ARE SPECIFICALLY INCLUDED IN THE PLANT E0PS ANALYSIS HAS BEEN DONE TO SHOW THAT THE ACTION WILL BE SUCCESSFUL OPERATORS HAVE RECEIVED TRAINING ON THE REASONS FOR THE ACTIONS AND IN EXECUTION OF THE ACTIONS j o OTHERWISE SOE CONTRIBUTION MUST BE CONSIDERED:

E DO NOT KNOW HOW TO QUANTIFY THE PROPER I CONTRIBUTION ,

WE DOUBT THAT THERE IS A CREDIBLE METHOD FOR QUANTIFICATION l

l 316

i i

T-The Requirements for Elimination of Conseriatisms

f the negative influence of the conventional PRA assumptions identified are to be avoided in a credible manner, it is essential that the plant ECPs call for the necessary actions at the appropriate time and that the operators have been trained and understand the reasons for the actions. Cbviously, a credible analysis must also be performec o assure that the actions are effective.

If the procedure and training do not cover an action, we believe that some contribution from failure to take the action must be considered. Since this failure would be based on the operator's lack of knowledge of the need for the

, action, we do not know how to quantify the failure probability. Our inclination is to assume a 100% probability of failure since we do not know how to quantify it. In the absence of EOP and training guidance we believe, in general, that the failure rate would be high.

i, I

l 317

7-_._.--.--.---,.-- , - - - , _, .,

318

CATEGORIES OF UNCERTAINTY 319

l L

CATEGORIES OF UNCERTAINT(

o PHENOMENA i

PROCESS MODELS i

i o DATA i

PHYSICAL DATA EQUIP!ENT PERFORMANCE i HUMAN PERFORMANCE 320

.- - . _ _ _ _ _ _ = _ _ _ _ _ _ . - _ _ . _ _ _ _ . _- . .___ ____. _- . . _ - _ _ _ _ _ _ _ _ _ - _ _ _ - - _ _ _ - _ _ - . __ . _ _ _

Categories of Uncertainty Thefac*erswhichcanresultinuncertaintyintheresultsofariskanalhsis are quite complex and diverse in nature. The presentation given here is intended to present a rather simplified view of the issue and to point out the most critical factors to be considered.

We consider uncertainty to have two basic sources, phenomena and data, which are fundamentally different in their nature and their impact on the results of the analysis.

321

PROCESS MODEL UNCERTAINTIES I

0 MAY BE A RESULT OF MATHEMATICAL APPROXIMATIONS USE OF EMPIRICAL METHODS LACK OF A ECHANISTIC MODEL o PROCESS MODELS OF CONCERN CORE DAMAGE PROGRESSION REACTOR VESSEL FAILURE I

CORE DEBRIS ATTACK ON CONTAllWENT COMPONENTS NATURE AND MAGNITUDE OF THE CONTAINENT FAILURE FISSION PRODUCT RELEASE FROM FUEL FISSION PRODUCT TRANSPORT PROCESSES ETEOR0 LOGICAL PROCESSES VARIOUS RADIATION EXPOSURE PROCESSES

~

HEALTH EFFECTS FROM RADIATION EXPOSURE 322 i

i i

Process Model "ncertainty l There are a var:ety of types of uncertainties in the various process models i used in risk. analysis. By process model we mean mathematical description of some physical process. The uncertainties may be a result of:

1. mathematical approximations,

2. use of empirical methods, or

3. lack of a comprehensive mechanistic description of the physical processes and their interactions.

.kkaples of process models for which this source of uncertainty is important are:

1. the core damage progression process,

2. the reactor vessel failure process,

3. the attack of core debris on various containment components, If we were to decide to use fission product release to the environment to judge adequacy of our plant against severe accidents, we would need to include:

4. the nature and magnitude of the containment failure process, l

5. the process of fission product release from the fuel and

6. the nature of transport processes for fission products.

If we were to use off-site consequence as the basis for our judgements we would need to include in addition:

I

7. meteorological processes,

8. the various exposure processes, and

9. the assessment of health effects resulting from exposure.

If we consider this sequence of nine process issues, it becomes clear that each of them has a vary high level of uncertainty that has its basis in our inability to construct a credible mathematical model which can be shown to be consistent or compatible with observation. In some cases we can say that there have been no observations and therefore there is nothing to compare against. In others we can say that the observations are so obscured by interfering phenomena that the statistical level of confidence is very low.

For this reason PP&L prefers to limit consideration to only the first three of ,

l these items. These are sufficient to derive an estimate of the frequency of the conditions which could have severe off-site consequences. While the uncertainties in these first three items are very large, we can show by our probabilistic analysis that the frequency of the first is very low, the frequency of the second is a small fraction of the first, and the frequency of 323

1

\

1

]

1 324

i k

i the third is, in our opinion, only a small fraction of the second. This strategy of focusing on the progression from core damage to core debris attack j on-containment components clearly demonstrates the progressively icwer {

pr bability as the severity of the plant damage state becomes worse. This permits the impact of the uncertainties in these phenomena to be bounded so that the most severe condition - core melt, vessel failure, and unquenchable core debris causing severe containment challenges - is clearly constrained to a very low contribution to the overall uncertainty in the calculations. ,

4 Finally, in the case of the remaining six items, we can say that the mathematical approximations are so poor, that the results are very questionable. For all nine it may be stated with some confidence that all ,

three of the sources of uncertainty cited above influence the final '

uncertainty in off-site consequence. When an attempt is made to judge adequacy of a plant on the basis of such a performance indicator, there is a virtually unlimited field of opportunity for undisciplined and unfocused controversy. The general approach to avoiding such controversy is to use such conservative models that the room for controversy is limited. Unfortunately, this produces answers which PP&L believes to be unrealistic and negative.

Even worse, this practice obscures the actual nature of the early stages involving the failure progression and obscures the nature of the accident sequence and the opportunities for operator intervention.

l l

i 1

325

TREATMENT OF PROCESS MODEL UNCERTAINTIES o FOR PROCESS MODELS <

THE DOMINANT ISSUE IS THE CHOICE OF ALTERNATIVE MODELS 1 THESE MODELS ARE OFTEN CHOSEN ON AN INTUITIVE BASIS i RATHER THAN AN EM IRICAL BASIS THE UNCERTAINTIES IN THE PARAETERS OF THE MODEL CHOSEN ARE OF LESS CONSEQUENCE IN GENERAL o THE EFFECTS OF AN IMROPER MODEL CHOICE SHOULD NOT BE TREATED AS AN UNCERTAINTY OR A STATISTICAL VARIABLE, BUT SHOULD ONLY BE LOOKED AT AS A SENSITIVITY.

326

l Treatment of Process Model ' Uncertainties i

l The nature of the uncertainty in what we have characterized as process models is generally.not a. matter of degree but, rather, is a' matter of kind. The most immediate example of this is the contrast between the core damage progression model of MAAP-BWR in comparison with that of SWRSAR. ' In the former, there is early channel blockage resulting in inability to cool the core, in situ, with resulting melt of.large quantities of core material. When this molten mass reaches a.certain magnitude, it is released to the lower plenum where failure of a penetration occurs immediately regardless of water inventory in the lower plenum.

In contrast, the BWRSAR model sequentially melts and relocates control rods, channel . boxes, and fuel clad without channel blockage. The fuel later relocates to the core support plate before melting and causes local failure of the core support plate due to high temperature. The core debris then falls i- into the lower plenum, unmolten, where it is quenched. - Failure of a lower vessel head penetration does not occur until boil off of the lower plenum water is complete and the debris begins to reheat.

PPGL feels that the BWRSAR model is the more credible for the great majority of BWR accident sequences. Only in the case that water level is some how maintained in the lower few feet of the core, and so protects.the core support plate, would the MAAP description of core damage progression have credibility.

Based on our current information, however, we believe that such sequences are-extremely unlikely and that nearly all BWR core damage sequences involve complete core dryout.

If one wishes to address the issue of the consequences of having made the

-wrong choice, one can do a sensitivity vesiculation, that is, perform the calculations using the rejected model to observe the consequences. Sometimes this is useful to determine whether or not actions could be taken to accommodate the consequences of either model.

We object, however, to attaching a probability to the validity of each model and using a weighted average of the vesults to characterize risk. We believe this is an improper use of probabiligtic methods.

327

PHYSICAL DATA UNCERTAINTY o MEASURED SYSTEM PARAMETERS ARE NOT INCLUDED o PHYSICAL DATA PARAE TERS INCLUDE:

- HEAT TRANSFER COEFFICIENTS, i- - MASS OF VESSEL COMPONENTS,

- VESSEL INTERNAL VOLUES,

- SPECIFIC HEAT OF MATERIALS, ETC.

o THESE UNCERTAINTIES ARE REFLECTED AS UNCERTAINTIES IN TRANSIENT TIES o THE TIE VARIATION IS STRONGLY CORRELATED THROU6H THE DATA PARAETER VARIATIONS 328

Physical Oata Uncertainty Physical data is the data used in transient models that cannot be directly measured from a system test. HPCI flow rate, for example would not be considered as physical data on this basis. Physical data involves such parameters as

1. heat transfer coefficients,

2. mass of vessel components,

3. vessel internal volumes,

4. specific heat of materials, etc.

The primary influence of variability of parameters of this type will be to determine the variation in timing of the various transients. The effect of physical data variability, therefore, must be reflected in uncertainty in the various time constraints used in the various success criteria.

Extreme care must be taken in representing such uncertainty, however, since the variability in the various times derived are strongly correlated through the variation in the physical data. If the time variations are important, treating the uncertainties in the various input times as independent could lead to a serious misrepresentation of the final resulting distributions.

329

EQUIPMENT PERFORMANCE UNCERTAINTIES l

I o THREE CATEGORIES MUST BE CONSIDERED UNAVAILABILITY FAILURE THRESHOLD I l

PERFORMANCE PARAETERS o UNAVAILABILITY AFFECTS FAULT TREE AND EVENT TREE BRANCHING PROBABILITIES AND IS AN INDEPENDENT RANDOM INPUT VARIABLE o FAILURE THRESHOLD AND PERFORMANCE PARAETERS INFLUENCE TIMES IN VARIOUS SUCCESS CRITERIA. THESE VARIATIONS MUST BE TREATED AS CORRELATED VARIABLES IN THE INPUT DATA.

330

e Equipment Performance Uncerninties Iquipment performance uncertainties must be divided into three categories.

These are:

1. Unavailability

2. Failure threshold

3. Performance parameters The unavailability is direct input into the IPE and determines branching .

probabilities in event trees or fault trees. These uncertainties feed directly into the final uncertainty in plant damage state frequencies.

The other two,.however, ultimately determine a time parameter which again will feed into one of the success criteria. The failure threshold is generally a temperature or pressure value beyond which a piece of equipment will not function. The time at which this occurs is determined from a transient calculation and the uncertainty is influenced both by the uncertainty in the transient timing and by the parameter value at which the equipment will aetually fail, since it is likely that the latter contribution is the greater, the uncertainty in failure time would generally be expected to be not correlated-very closely to the parameter variations which determine the transient timing.

1 The performance parameter will be a physically measured parameter of the system, such as a flow rate. In general, these uncertainties will be rather small in comparison with the actual value of the parameter. The influence of the uncertainty is once again a time uncertainty which may either influence the rate of a transient event or which may set'a limit in the transient on the time at which an action must be taken. l In some marginal cases, such as CRD pump success in preventing core damage in a transient event, the actual flow rate any be the critical parameter. That is, above a.certain flow rate, no damage will occur, but below that flow rate some form of damage must occur. If the actual CRD pump flow is close to this threshold, the uncertainty in the value of flow may directly impact'the distribution of plant damage state frequencies.

When equipment performance uncertainties are to be addressed, it is essential that the characteristics outlined above be kept clearly in mind.  !

331

i c.. j HUMAN PERFORMANCE UNCERTAINTIES o PROCEDURAL ERROR FAILURE TO FOLLOW PROCEDURE IFROPER EXECUTION OF PROCEDURAL STEP o LACK OF ADEQUATE TIE FOR EXECUTION.

332

Human Performance Uncertainties l

I Human error, which causes initiating events or which contributes to equipment unavailability, is taken into account in derivation of the data used for risk '

analysis. This leaves for consideration only those human errors which are

' associated with execution of ECPs. PP&L has devoted considerable resources and effort to development of ECPs, and it has-been our intention to derive EOPs which always direct the operator to take the optimum action. Cautions have been provided for actions which are sensitive.in some way, and all actions are fundamentally symptom based. In addition there has been a considerable investment in training our operating crews in the use of these procedures by classroom and simulator instruction.

For this reason, PP&L has taken the position that control room operators will follow procedures in response to symptoms, as indicated by control room instruments, without error either in conformance to the procedure or in execution. A more precise, but less clear statement of our position would'be:

"The error rate of operators in executing procedural steps is very small in comparison with the unavailability _of the equipment required for. execution of the step." This is an extremely important assumption, because if the operator does not follow the procedure we must consider the reason for his deviation if we are to correctly assess the consequences.

If the operator fails to execute the procedure simply because of improper ,

execution or lack of time, we know that he understands what is required, and,  !

if he fails, we can assume with confidence that he will attempt to execute the backup actions that are nearly always available which will limit the consequences of his failure. These backup actions do not, in general, prevent plant damage, but they do avoid an event having potentially severe consequences. These actions, too, are limited in effectiveness as a consequence of the unavailability of the equipment involved, and'should the.

equipment fail, the consequences may be severe. The probability of such compounded failures, however, becomes extremely low and when combined with the probability of the initiators which can result in such circumstances (ATWS, Station Blackout, and severe LOCA). The overall frequency of such events becomes so low as to represent a negligible threat.

This line of reasoning is'the basis for requiring an operator to follow procedures with an extremely low probability of misinterpretation. This probability must be as low'as the combined unavailabilities of the equipment neededfortheproceduralstepandfortheequipmentneededfogthebacgup sctions. This will typically yield a value in the range of 10 to 10 per demand.

PP&L does not yet have sufficient data to demonstrate this low an errog rate for operating crews. At present we can argue that it is less than 10 . We believe, however, that achieving such a low probability of error is quite practical sig e we can infer error rates, on the part of commercial air craft crews, of 10 per demand or less.

333

VULNERABILITIES IN HUMAN ERROR ESTIMATES o VALIDITY OF E0Ps FOR ALL ACCIDENT SEQUENCES o INCOMPLETE EVALUATION OF INSTRUENT FAILURE o THESE ARE NOT PROPERLY CONSIDERED HUMAN ERROR, BUT ARE A POTENTIAL SOURCE OF ERROR IN OUR RESULTS o THESE ISSUES REQUIRE CONTINUING ATTENTION 334

Vulnerabilities in Human Error Estimates If we can assume that Our training of operators is effectrie and that our operators accept the critical nature of adherence to procedures, we are left with two major vulnerabilities.

1. Validity of the EOPs for all accident sequences

2. Instrument failure With regard to the first of these, we had a considerable background in analytical studies of ATWS and Station Blackout before our current ECPs were developed, and this information was accommodated in the development of the EOPs. In addition, we have conducted a series of tests, our System 1 validation, which tested as much as our EOP structure as possible using two or three sequences on each Susquehanna operating crew. As might be expected, we discovered some problems with ambiguity.in the EOPs which has since been corrected.' The sequences chosen were variations of the dominant sequences from our IPE and represented very complex and difficult sequences.

In the case of instrumentation failure, we have not found this contribution to be significant primarily because of the high level of redundancy in BWR instrumentation. -We believe, however, that this source of failure deserves more attention, and we'will give it a more detailed examination in our future work.

Both of these sources of failure to execute procedures are not properly to be considered human error, however. The possibility of imperfect EOPs is a very serious concern. Our Integrated Risk Reduction Study has evaluated our ECPs.

against every plant damage sequence identified by the Susquehanna IPE. In this process we have found a number of problem areas which we will resolve in the process of adopting Revision 4 of the BWROG EPGs into our EOPs.

We are unable to be certain, however, that there are not sequences which we have not considered for which our EOPs are not effective and which we have missed as a consequence of incompleteness in our IPE. We believe the probability of this is low. Our only defense is continued review of our analytical and probabilistic models of the plant.

335

THE PP&L VIEW 0F UNCERTAINTY ANALYSIS I

o ONLY MEAN VALUES CAN BE PROPAGATED THROUGH THE RISK ANALYSIS CALCULATION o PROPAGATION OF DISTRIBUTION FUNCTIONS AND STATISTICAL PARAMETERS REQUIRES MULTIPLE CALCULATIONS FOR RANDOM SAMPLES OF THE INPUT DATA o CORRELATED INPUT DATA EST BE TREATED AS EQUALLY PROBABLE SETS OF THE VARIABLES INVOLVED WHICH HAVE BEEN DERIVED FROM A CONSISTENT SET OF INPUT 1

0 THE DISTRIBUTION FUNCTION RESULTS OF THE ANALYSIS MUST BE TREATED AS CORRELATED DATA l

I 1

I 336

l The PP&L 71ew of ' Uncertainty Analysis L

The only statistical parameter which can be propagated through a risk analysis without repeated trials is the mean value. That is, if the mean values of all input parameters for the analysis are used, the results of the analysis will also be mean values. If it is desired to develop statistical distribution functions for the results, we believe that it can only be accomplished by means of Monte Carlo techniques.

The approach to developing such results would require that the statistical distribution function of every independent input parameter be specified as input data and that a large number of calculations be performed in which random choices of the independent input variables were made from the distribution function characterizing each. In the case of correlated input variables, such as times from a transient analysis, the random sampling technique must be applied to the selection of input data to the transient calculation. The output would be a set of times for that transient calculation. Several sets of such times would have to be developed and then each set would constitute an equally probable correlated set. In the performance of the risk analysis, then, these sets would be randomly chosen by means of a uniform probability distribution.

The approach therefore to developing the distribution functions for the results of a risk analysis is therefore to identify all independent and correlated sets of input data. Distribution functions would be input for each of the independent variables, and a sufficiently large set of equally probable sets of each of thw correlated variables would have to be developed. A large number of risk calculations would then be made by selecting random values for each of the input variables and propagating this input through the analysis.

This process would yield a distribution function then for each plant damage state. Some care would be required in interpreting this data, however, since these distribution functions would be very strongly correlated. In the interpretation it would be necessary to treat the set of results for each calculation as a correlated set. The variations in a given plant damage state could not be viewed as variations of an ind.apendent variable.

While this approach to uncertainty analysis appears to be very burdensome and complex, we believe it is the only credible approach to the derivation of uncertainties. We believe, that with a computer program of the type described ,

in these presentations, that it is feasible to carry out such investigations.

337

7 q c

h.

c .

l. l l

4

)

1 1

l.

l l

O 338 i

SUPMARY l

339

SUMMARY

OUR PURPOSE HAS BEEN TO PRESENT:

o ISSUES IMPORTANT TO RISK ASSESSMENT o HOW TO DO RISK ASSESSMENT o HOW TO USE RISK ASSESSENT i

340

Su= mar /

n closing this presentation we will state our views and Observations en

1. important issues in risk assessment,

2. how to do, and

3. how to use risk assessment.

I l

341

E .

l IMPORTANT ISSUES o HUMAN ERROR:

THE IMPORTANCE OF E0Ps THE IMPORTANCE OF TRANSIENT ANALYSIS THE IMPORTANCE OF OPERATOR TRAINING o CONSERVATISM:

DO NOT COVER UP IGNORANCE WITH CONSERVATISM DO NOT USE CONSERVATISM TO COVER SHORTCUTS IN ANALYSIS.

DO NOT FAIL TO TAKE CREDIT FOR ALL PLANT FACILITIES AND CAPABILITIES IF NECESSARY MAKE MINOR MODIFICATIONS TO PERMIT USE OF. 1 ALL EQUIPENT o PLANT DAMA6E FREQUENCY:

BE SENSITIVE TO THE FACT THAT THE ANALYSIS IS UNAVOIDABLY INC0frLETE.

DO NOT ATTEFFT TO ACCOUNT FOR INCOMPLETENESS BY CONSERVATISM. THIS ONLY INCREASES RISK.

o THE GOAL FOR SAFE OPERATION:

DEVELOP ASSURANCE THAT PRILTIPLE LAYERS OF FAILURES MUST OCCUR FOR ANY KNOWN INITIATOR TO LEAD TO PLANT DAMAGE.

IMPOSE A REQUIREENT FOR ADDITIONAL FAILURES BEFORE LOSS OF CONTAINENT INTEGRITY CANNOT BE AVOIDED.

TEST E0Ps TO ASSURE ABSENCE OF NEGATIVE CONSEQUENCES AND PRESENCE OF APPROPRIATE ANTICIPATORY ACTIONS.

342

Important :ssues The position that ppt.L has taken on human error is critically dependent on

..;gh quality procedures and high quality operator. training. If we cannot claim that our procedures are effective against all known accident sequences for the plant and that our operators will rigorously and effectively follow them, we do not know how to make a credible case for the adequacy of plant operation relative to public safety.

We believe that it 1.s essential to avoid conservatism for the sake of reducing the analytical burden without considering the potential consequences i of such conservatism. We believe the analysis must take full credit for use of all plant capability and provide convincing evidence that such capability will be used for all known accident sequences. In some cases, very minor and inexpensive modifications may be needed to assure effective use and we believe these modifications should be made, subject to a careful review for adverse impact.

We know that our analysis is incomplete and that it may contain potentially important inaccuracies. Nevertheless, it represents our best understanding of our plant and it should not be confused or obscured by conservative assumptions. We do not accept low frequency as a demonstration of adequacy.

We attempt to demonstrate that multiple failures must occur before any form of plant damage can occur for any initiator including ATWS and Station Blackout.

Further, we attempt to demonstrate that additional failures would be required before containment integrity is lost given core damage. We have examined our ECPs in depth to assure ourselves that we can effectively use plant capability to achieve these objectives.

343 l

l

HOW-T0 DO o EVENT SEQUENCE-ANALYSIS DO NOT BIN FRONT-LINE FUNCTION EVENT TREE ENDPOINTS CARRY ALL SEQUENCES OUT TO ALL POSSIBLE FINAL STATES o- TIE REPRESENT DIRECTLY IN SUCCESS CRITERIA REPRESENT TIE OF CORE DAMAGE EXPLICITLY IN PLANT DAMAGE STATES REPRESENT TIE OF CONTAllGENT LOSS OF INTE6RITY EXPLICITLY IN PLANT DAMAGE STATES

o. ANALYSIS MODELS ACCURATELY REPPESENT WATER INVENTORY AND ITS LOCATION USE SIPPLE HAND CALCULATIONS WHEN POSSIBLE. CHECK AGAINST TRANSIENT CODES.

USE PLANT EASURED DATA WHEN POSSIBLE.

o PLANT DAMAGE STATES REPRESENT CRITICAL TIMING SEGREGATE SEVERE CONSEQUENCE SEQUENCES SE6RE6 ATE MINOR CONSEQUENCE SEQUENCES SEGREGATE HIGH UNCERTAINTY SEQUENCES o UNCERTAINTY TREAT PHENOENA ISSUES AS SENSITIVITIES L -

PROPAGATE UNCERTAINTIES DIRECTLY THROUGH THE ANALYSIS PRESERVE VARIABLE CORRELATION IN UNCERTAINTY ANALYSIS L

344

How To Do

n order to achieve.the objective of. explicit demonstration of plant capabilities in avoiding accidents having severe consequences, we believe that each event sequence must be individually followed out to the complete array of possible final plant states. We have demonstrated ~how this can be done with the support state method.

We also believe that a proper and explicit representation of time in the analysis and its results is also essential. We have shown how this can be done in the structuring of suecast criteria. This approach permits an explicit representation of the constraints imposed by Technical-Specifications.

It is extremely important to properly represent the amount of water in the reactor vessel and elsewhere. . For the reactor vessel this means that a proper representation of free area versus elevation be described and that void fractions in.various reactor. volumes be, properly represented, particularly in-the upper plenum. We also recosmond the use of hand calculations to check against transient analysis codes whenever possible, but we always prefer actual plant measurements when available. This is an extremely important aspect of the analysis since a proper representation of reactor water inventory along with losses and gains, is a dominant influence on the early stages of timing in an scciiknt ecTmee.,

we believe that it is very important to define a spectrum of plant damage states having adequate resolution to permit segregation of specific classes of events and to explicitly represent the time of core damage and loss of containment integrity. This is particularly important in order to isolate sequences involving high uncertainty or controversy over the phenomena involved. This is necessary to avoid confusion over the actual impact of the uncertainty.

We believe that uncertainty analysis should be performed by direct propagation of random variations in input parameters through'the analysis. We urge caution, however, since many of the inputs are correlated variables and to treat them as independent could result in a gross distortion of.the results.

It is also important to understand that the resulting array of plant damage states are also strongly correlated variables. That is, the individual plant damage states cannot be considered to be independent, and the variations in them are correlated. We do not currently have experience on how to deal with this issue or its significance, i

l 345

4...

l HOW TO USE o FUNDAMENTAL PURPOSE DEMONSTRATE ACCEPTABLY LOW LEVEL OF RISK TO THE GENERAL PUBLIC o CONSTRAINT

]

THE RESULT IS ONLY A " SNAPSHOT" o REQUIREENT THE ANALYSIS PROCESS MUST BE A CONTINUOUS CYCLE PLANT PERFORMANCE EST BE MONITORED OPERATOR PERFORMANCE EST BE MONITORED PROCEDURES MUST BE TESTED ALL CHANGES MUST BE INCORPORATED ON A REGULAR CYCLE o THE ANALYSIS PROVIDES A DIRECT MASURE OF THE QUALITY OF PLANT OPERATION RELATIVE TO PUBLIC RISK o WE BELIEVE OFF-SITE CONSEQUENCE IS NOT A GOOD EASURE. WE PREFER TO FOCUS ON EQUIPENT AND OPERATOR PERFORMANCE.

l 346 I

iiow To Use The fundamental purpose of a probabilistic risk assessment is to demonstrate an acceptably low level of risk to the general public from plant operation.

This ob3ective cannot realistically be achieved as a one time effort, however, since the plant, its procedures, and its personnel are changing er a continual' basis. We believe, therefore, that the plant must be evaluated on a continuing basis, and that performance monitoring of equipment and operators is an important aspect of the process. Only in this way can a credible evaluation of performance be accomplished. This would include recording initiating events, precursor evaluations of close calls, recording equipment chavailabithy, ahd ma&ahr.Ntn: os opahatet phricemance lh axecutzen cf and knowledge of ECPs.

Changes in procedures should be incorporated into the risk analysis also, and any improvements to transient analysis methods should be used to reassess any procedures which could be influenced.

Initially, this would involve a considerable effort, but maintenance of such an approach should be quite reasonable. It is expected that performance.

tracking requirements already in place could be modified to provide the necessary data with reasonable cost.

We believe that it is essential to redirect efforts at demonstration of safe operation of nuclear plants from the off-site consequence arens to focus on performance of plant equipment and operators. Further, we believe this is the only credible approach to demonstrating safe operation.

i 347 s

I l

348

l APPENDIX 1 ERIC HASKIN DECAY HEAT TABLE f

r 349

.. . . ~ _ - _ _ - - _ - - - - - - . _ - _ - _ _ .- _ .-_

j.: 'q..

L is 350

I l ERIC HASKIN TABULAR DECAY HEAT l

1 l Time (Seconds) Power Fraction Power LMW) Cum Power (MW-Sec) 0.00000000CE+00 0.599999987E-01 197.579987 0.000000000E+00 1.00000000 0.5714999E8E-01 180.194931 192.887451 1.50000000 0.555200018E-01 182.827362 285.642822 2.00000000 0.543700010E-01 179.040405 376.109619 3.00000000 0.520399995E-01 171.367706 551.313477 4.00000000 0.504000001E-01 165.967194 719.980713 6.00000000 0.480699986E-01 158.294495 1044.24219 8.00000000 0.461900011E-01 152.103668 1354.64014 10.0000000 0.447300002E-01 147.295883 1654.03955 15.0000000 0.420500003E-01 138.470642 2368.45532 20.0000000 0.401500016E-01 132.213943 3045.16675-30.0000000 0.375600010E-01 123.685074 4324.66016 .

40.0000000 0.357199982E-01 117.625946 5531.21484 60.0000000 0.331300013E-01 109.097092 7798.44141 80.0000000 0.313699991E-01 103.301407 9922.42578 100.000000 0.300000012E-01 98.7899933 11943.3359 150.000000 0.277700014E-01 91.4466095 16699.2500 200.000000 0.261900015E-01 86.2436676 21141.5039 300.000000 0.242800005E-01 79.9540405 29451.3867 400.000000 0.229300000E-01 75.5084839 37224.5117 600.000000 0.210199989E-01 69.2188416 51697.2422 800.000000 0.196500011E-01 64.7074432 65089.8672 1000.00000 0.185899995E-01 61.2168579 77682.2500 1500.00000 0.166199990E-01 54.7296448 106668.075 2000.00000 0.152200013E-01 50.1194611 132881.125 3000.00000 0.135399997E-01 44.5872040 180234.437 4000.00000 0.123500004E-01 40.6685486 222862.312 6000.00000 0.106699988E-01 35.1362915 298667.125 8000.00000 0.981500000E-02 32.3207855 366124.187 10000.0000 0.915199891E-02 30.1375275 428582.500 15000.0000 0.819300115E-02 26.9795380 571375.125 20000.0000 0.751199946E-02 24.7369995 700666.437 30000.0000 0.676399842E-02 22.2739342 935720.562 40000.0000 0.623200089E-02 20.5219727 1149699.00 60000.0000 0.548399985E-02 18.0588074 1535506.00 80000.0000 0.503899902E-02 16.5934143< 1882028.00 100000.000 0.469300151E-02 15.4540539 2202502.00 150000.000 0.414099917E-02 13.6363096 2929761.00 200000.000 0.374899991E-02 12.3454561 3579305.00 300000.000 0.327500002E-02 10.7845745 4735806.00 400000.000 0.294000003E-02 9.68141937 5759105.00 600000.000 0.246599992E-02 8.12053680 7539300.00 800000.000 0.218699989E-02 7.20178986 9071532.00 1000000.00 0.197100011E-02 6.49050331 10440761.0 Notes 1) Power (MW) = Power Fraction x 3293.0 MW

2) Cum Power (MW-sec) is obtained using Trapezoidal rule 351

q l

O il t

I 352

9 l

APPENDIX 2 SHUTDOWN MAKEUP FLOW REQUIREMENTS 353

1.

e l .

1 1

i '

I 354

AFTER SHUT 00&N MAKEUP FLOM NEEDED TO KEEP CONSTANT MATER LEVEL (MINCR PRESSURE OEPENDENCY )

IWECTION ENTHALPY 58.0 STU/LBM INECTICH SPECIFIC YCLUHE a .0161 CU. FT./LSM l t

ENTHALPY.OF VAPOR

• 1199.19 STV/LSM TIME (SEC1 et T >- ( STU/'SEC 1 MtT1-1LBW SEC1 MtT1 !GPM) 0.000000000E+00 187457.937' 164.265320 1187.06348 1.00000000 178553.687- 156.462723 1130.67798 3 1.50000000 173461.062 152.000153 1098.42896 ,

2.00000000- 16?868.125 144.851746 1075.67725 l 3.00000000- 162588.500 142.472763 1029.57935 4.00000000. 157464.687 137.982880 997.133301 6.00000000 150185.062 131.603912 951.035849 8.00000000 144311.375 126.456924 913.841064 10.0000000 139749.875 122.459778- 884.955811 15.0000000 131376.750 115.122589 831.933594 20.0000000 125440.625 109.920898 794.343262 30.0000000 117348.687 102.830109 743.101807 40.0000000 111599.937 97.7926025 706.697998 60.0000000 103508.000 90.7018127 655.456543 80.0000000 98009.2500 85.8833771 620.635986 100.000000 93728.9375 82.1326294 593.531494 150.000000 86761.7500 76.0274353 '549.412109 200.000000 81825.3750 71.7017975 518.153076 300.000000 75857.9375 66.4726562 440.364502 400.000000- 71640.1250 62.7766876 453.655518 600.000000 65672.7500 57.5475922 415.867676 .

800.000000 61392.4805 53.7968903 388.763184 i 1000.00000 53080.7187 50.8944669 367.791748 1500.00000 51925.8437 45.5014401 328.816406 2000.00000 47551.8398 41.6686401 301.118408 3000.00000 42303.0000 37.0691986 267.880615 4000.00000 38585.0977 33.8112793 244.337280 6000.00000 33334.2578 29.2118378 211.099396 1 8000.00000-- 30664.9922 26.8710632 194.183792 10000.0000 28593.5820 25.0559235 181.066681 15000.0000 25597.3750 22.4304199 162.093475 20000.0000 23469.7227 20.5659 % 3 148.620193 30000.0000 21132.7461 18.5181580 133.821447 40000.0000 19470.6289 17.0616760 123.296219 l 60000.0000 17071.1562 14.9590836 108.101822 i 80000.0000 99.6934967 15743.3320 13.7955399  !

92.8481750 100000.000 14662.3398 12.8482904 150000.000 12937.7187 11.3370419 81.9271393 200000.000 11712.9961 10.2638445 74.1716766 300000.000 10232.0781 4.96614742 64.7934690 400000.000 9185.43750 4.04499883 58.1660767  :

600000.000 7704.51953 6.75130272 44.7882690 800000.000 6832.83984 5.98746472 43.2684479 1000000.00 6157.99219 5.39611435 38.9950104

\

I 355 l

r~---n _ _ ._

l

-i l

I 356

< 1 1

i

_ _ . _ . _ _ _ . . . . _ _ _.________.________..______________.___m

APPENDIX 3 BWR VOLUMES AND MASSES i

357 i f

j

l l

l 358

;p g _,

~

1 ngi = - - 3 s E!@ l?

d an gn 3

!{!In p No e 1:i;p.!nel' sa qi.h l -M p,Ji ;;o-H-

' lid '1' .;y;l;ps;n ihii' lFd)i "l s'w"t f,i  ?

O!;ri!*i 1 a

~^

r.

li? 9p p 5

.Ejj i liiIM'i/!F!!?!lIA i lliii3I!MIBlii .

IjW(jiiilh;Ai ~I.

'h 4lii iM !EI ikj!iil!! bp.lipli!!

• l!l!!!i!!] Pi-l{j! !!!h.!l$

fl-  !- i xiit/ Eixlitii!H ji'pA'il! !!f!Illiff i'ildii!!

m 1 i g 'i  !!!,!iii

! i W.16i .,

XXXXXXXXXILX ,.

i el$i.,.i

~~

E i- XXXXXWX,U dlI!!illifX i-p wn d 1 XXiX,lr --

k.

.j Id '!lil iii LI '

!!! kkXXM XkI!!! l '. li!

e umiaturrii: : :u. ::t ri 4 lo ss u : , ; a:. grg g . ga,.

g(e; '.jij'l.t tplijrp 4 1l sjt X: jQ)

- .m .. m , , , . m 4.:. . . ,, .. o liu !

il:i;ii; ;p g

.pa: .

Is,#,:; il9li!!tiittli Irjij jylu 11~g g

! NFM k.- N"- :-4 HS "d.-E i l , 3 c.

c,: nt:.  :

. 4,-

. 8

[. g;Jdi

- I .I 11 I ylj ,.

=

- -: 22 1 ,

- g I v sit 4 ten it i L.gI 1 1

tt,,I:

e 3 3 3- 1, ,

[ .

V -l ft ?I . 1.1 a

• I vlil

~

.1 I N i,l, l?lf s, i, -l, i

.i '. i i, l i. $

i l, o m __- -

+ .

i 2

Aa

.I i -

l l_..w _a_ .r _;_ t. , .z .__ o _. _o w .

(-

t

_I

__g._g I ,

I y o

d 8 11 g 9

!!-4 sw l 11 4 re 11h>i? <

Iq:

g it i/ >:pl i ,

a

!o

~ "

8i]l,_ lil l} < )f T j '

}i (3 c p , .

. "4' .

,.gk..i f [ 5

. m= '1 ti m- r{  ;

d .I.Pl O:1f4IOlh8hNIt 7.

- M ; jy 4 I F- IE !Iddd!h, y'd10!! -:

_ . . .___t' .. ,

4..3135 i O f ik

.,.i..,,.

i f f .8a ll'*)l 8if i

a

..2.. .__i__.__

i . . .. . ....

1 -

rr ----

e s.* '

L.

{ Id!g I j.

c  ;

n at . .,

.I.I - lYN I. I

. , I. ., ,.

}'

'I E t--i ' I ..

i

' ll1l !b b 3 E7?j.i

                                                                                                               . t -(     .#. r. a..-.~                         .
                                                                                                                                                         .f i... .:

L , m. jh i 5.!Il bhNhbNh[ j![h -! !g h' *"* *E'2' 'l r j 3;e}.Ij!,b

              'O                                                                       ir n a s il iF m;;;u;;;n;:::;n=i                                   i.. l. it                                                                              j.c-..w-,w+u....                                                  "

l- @#d! i n arrrI - %mL6...... -

ie. : '. s i i i

4 II 3I

                                                                                'I                                                                g9 I                                          {l I                                                 3
                                                                              !;cd l] 5
                                                                            '"!!lii3k't                                   lie UE N{                                                                         f
                                                                                                                                                                                                            $3%                    "ihI;h                                      #=F"~ $h'il51.!!                      5 l!!!Hnihtfliai                                   h' yt4     alu $

1 a > 1-9

             ,l                                                  la
               ;                                                   i.sl a                                                                  N g-i i                                                        -

ao Rla ** = I f<. s, ws

                                                                                     ~{        82                                                                                                                                                                                   .:5 "t                   /T                                                                                                                                                                                  Ig!                             .

Se 15 4-

                                                                                                                                                                                              *                                                                      ~

y I T)i

            ~

l. S ,  !

i) ] il./ i Y L 9.,  !

                                                                                                       .jh                                ,

e _ i l l] 2 b; $ h, w!!.!

                                                                          ;                                                              !                                                          : !!!                                                                      f8!

rm- tii ' 4 J, ,w ,

            ;                                                                             II          s-u
            .

• l i en .

I d

                                                                                                                                                                                                                                                                                                     .          r.

i \ . . g

                                -                                                                              be                   hEj s,2 l                                 5l I
                                                                                                                                                                                                                                  %gI g                                                                               t1
      .-                                                                             .                                                                                                                                   i
              ,., ,                               l                                                                               :                                                                     ,                         .,rI_
                                                                                                                                                                                                                              'a, a m I                                                                                                             .i
                                       '.20 'I
                                        .                                                                       e I                                           :                                       1::,                                                             t                                         .
                 ==             **
                                       .d ,

r f. Fl g ol " ' 51 -il L2-. -

                               .                ---g                                                                                                                                                                                                                                      ,

i p' * ' - 8 i

                                                                     -          i       .
                                                                                                  ; . . .i .

i . i . i.... j i , , , A i

  " ~ * "              **                                                                                                       ***?**.e***-                                                               . . . . .                                                            . _ , . .

3/ t ..

                                                                                                                                                                                                                                                                                          ,y        .

36v

                    -         m,
                         ,m T                          r 4_

g7 ,L

                           .A 2_g-                                                          n ss    e so, a                                          4 e s            s s m ,aTr                                                                                       -                                   !**
                                                                               .              e.

r r s

                                                                                                                          #(e sosu u        a ]ae
                                                                                                                                            ~%

t -

                                                                                                                                                                                            -'hn o gs 8_       f8 l

g ei

                                                                         )    ,
                                                                              . s  e .se                                           g) e]
                                                                               . ,    eeo r r.
                                                                                                                              )    s om       hrs                                                             . sg s

h M e_ep ce **7 t ( o7 w a ])m e .

                                                                                                                                                                                                 %,.OyM g

ooe ft ts S s . 1 A e . i_ t N M ._.  !! . D r O ) U - H a O i ps

s. a s

G me N- R tts

                                        .                      O      T              e sa m                         E                 _t     s                                       E                  E s        .* t R                                                     R      T          _t     r                                       t T u _* u H      N              st ss                                     N      se

_u uL P N r t "0e

                    .                                          S      E           oeaeL                              C      E                 e                                                   E      F       _* 9 N          nscsA e

R N t_ssl iA R e

• E O e

amt aT O O eo o t r t T E N D O RgsS S

• E R P e es mrp sorTeO C P SO W P S

i . O M o ap a M ms s t 3T a

• O M TEeNP '

a C O c eutr O s ano t e " O a**M T

                                        .                             C           apss C         .s      m                                                   C w 5" u e t c                                         tr         o 9"P f

m es e c*e c o Fc uo uo - e *'i nmC

                                        .                                                                                                     e                                                          =

rC m

• 0" C

                                                                                                                                                                                                         = !8 C         J
                                        . T3 M

• i.io=

s .

                                                                                                                            -      =1       E u
                                                                                                                                                                                                   =-    as   !L.
                                                                                                                                                                                                              !!e E

SN

                   .                  TOP                                                               ..
         .                            H       M                                                       .

G I O t a EC J. W. 4 A 4 S R N

                 .                    E E                                                                                                                                                  .

NI U lN . L

                                      )       L WE      5 5

E V ) s e  ? e o e s e r' s ( .n s eoAem rsa a n H S [ *se*s so' e [ er*sswf8 e s e f_ m M oecs o s6e A j e ae s e s S m e s s Le s e Rs e sas sc. A ss rse R !__s s ( O g s 2_ ss ses" s

                .                                            R                           T T
                                         -                   E Y                      sAn 4

4 T t v R e w e M _' ss n_'E

                                         -                                                                                                               t                                           ,

U N s a D E a SL P E e ' s6Sen o __*A *L E 5 M t aLtA S N 0n pop A .senS se AO T M O 4o P Dws os pvao*T a u_" a . E T a.es

                                                                             . ueT   s   ET                                        A E

M E n8 o=on e s ao*T u"O a S ,A0u k T O 0o r T tapn" C s S ie** a C , Ms et ju uS sr o_ *es* s ' n

                                                                      *      .as es                                                           -

• L e
• _ e a 9 . . ' '

a e . a

                                                                                                                                                                                               ~
                                                                                                                                                                                               ~
                                                                                                                                                                                               ~
                                                           -       *$        -           e              .      ~      *_#-           -          .           -

• _ _. -

                               .                                                                                                                                        , .                                           t .

yy a-

                                                                    .                                        .          i*t
                               .;.I.                 a                         . y
                                                                                      .hgJ . .

1, : . I * .

                                                                           ,  .?

sO

s. .8

           .                                                                                                                                                                             (

l a

                                                                                                                       ,(5                                                          '

1 t

• 9 . ,

i

1- 3

                                                                  ^

• E' ,

i s a

s  : 2.s "

                                    -2*                  4                               8 js                   a      1J :>

_ s. 2-c8 oc :s- 5

                                           .              ss     -                     :

j '3 33 "1 . 3 E si 53  ?- 2 s-

                                     ,ea
                                                          .:     **-x
                             .:                           1,. agg1
                              =

1[x 25 - 8 3 . 2 s:

                                    > :. e s .

3 a. .g e  ! is. - : - - e, se - 2a  : "

                             >, .9s Lg
                                                                    ]                     I y.to=  u 2-a      t.

e 2> i  : n = 5

                          =  IIE II!!II!!!!Ilii!Ii435fII!!!!!i!!ssEiII!*!Esi!!Eisii                                                                                                        -              a 3   vgg * ::::::~:

g_ -a gggggg=:syg:e:ggmerege::::rgEE.gf'i.g:angsg=s::

                                                             ~                                     _                    :..::: s:::::                                                                        :
                                                                                                                                                                                                                     . ~ . -:=.
                         -Q e

I !g c IIIIIIIIIIIIIIIIIIIIIIII!!!!!!!!I!!!!!!!!E!!!!ilII 3 yysesseeeeeeeeeeeeeeeeeeesiggggggggy*ggggggggaggees O - **aaaa

• aaa.a3*.

u 3 . a s c II!!!Ie,..fil=...I,.,I,,III!I,,.,.,.i.. ag- - s: .- -

                                                                                                                                                 . ns.:       -

c x::::::: -

                                                                                                                                                                                                                  - III a           *
                         ,. lfa: eaigaagaggIaas!!.E.!..!.aaaaag=eag
                                 -                         :.. :es . .. .s..e.n.ge..                                    . . . .c.~ gs.:. gn:g-                       .. ss                 aaa[aeaaa;8aaaagassee s33..=,~:e~

lDIIIIIIIIIIIIIIIIIIIIIIIII!!!!!!!IIIIIIIII!III!!III glldidisisidiitinsisiiffigifiigllififfilljillfigiif l n

                                   """****** ::::::: * :: 12k 2 22:213:22:35                       .                                                                                                        $$$33$3 l

362

 .-     ,                                                                                                                                                              j i

1 APPENDIX 4 SIMPLIFIED DEPRESSURIZATION' CALCULATION 1 363

    . p; -                                                                              a
 .y H,           c l

l' 2 BLE 1 Simplified Depressurization Calculation l Mg = !AMg -3M - CM3 + D(Q + Qg )l/E M gg = (F Mg + GMgg - d gg (Mg + .Mg) ] /D M g =M g+Mgg + Mg -M gg -M g d A = (h 1. - h g) (d g -d gg) - m gg -hLf) (dLg -dLg) d ei B= (h gg -hLg) (dLg -d ggd) (h gg -hLg) (dLg -dag) g Gi C = (hg - g) (d g -dag) + (h gg - (g)dgg D =d g -d gg E = (h -h g) (d g -d gg) - (hgg -h Lg)dgg A F = (d g -dg) g

                                                                                                           *Li G = (d Lg       -dgg)     g Gi Q3 = (M C fyyy+MCfFFF                  Mggg C f ] Rg-Tg ]

364

F. TABLE 2 SYMBOL DEFINITIONS dg - density of water vapor, 4/ft d - density of liquid water, #/ft f - subscript denoting final state f., c

                                                                  - fraction' of available sensible heat from fuel released f .- fraction of available sensible heat from reactor internals released f y- fraction of available sensible heat from reactor vessel released' h -. average'enthalpy of steam released from vessel, BTU /#

3 hg- saturation enthalphy of water vapor, BTU /# h - saturation enthalphy of liquid water, BTU /# hg- enthalpy of makeup water, BTU /# i - subscript denoting initial conditions Mg'- mass of water vapor in vessel, # M - mass of liquid in vessel, # Mg - mass of makeup water added, # M - mass of steam released from vessel, # 3 MC - thermal capacitance of fuel, BTU / F 7F MCyg- thermal capacitance of vessel internals, BTU / F. i Mc yy- thermal capacitance of reactor vessel, BTU / F l Q - decay heat released in the time period (t y, t g), BTU 1 l l l 365

-.m----~__..____ ._ _ d 366 L___________-.__..

APPENDIX 5 USEFUL FSAR DATA l l l l l l 367 I

         . ~ _ _ _ _ _ _ _ _ _ _ __

Og

                                                                                                                                     .;                      CR 1
                                 '                                                                                   ()[V/

o bf-Q L-

                                                                                                                                                @             ,D)

STEAM On vE RS MAIN STEAM FLOW 70 TUA8tNE

                                                                               \=

i \:

                                                                                                                                                /,-//

Q) }

                                                                                                         %                   /
                                                                                                                                   /
                                                                                                                                           /                                                 b
                                              - sTEAw sEPAa Atoms                                                                                           /    -

p s N _ a_;g.; . l _ _t p _ g- ,,,,,,,,,c, {"t 4 ontviso rLow _

                                                                                                                    --T --_ _3-Y] p(g g                                                  :

3 g Cont s o ' s [A

                                                          -                                                        X                                                _
                                               +                                                                                                                                                     =
                                                                                                                }ul                                                 v nacincutATioN PuuP                                                                             g                                    @       @

u( l Pagspung Flow TEMPtnATunE ENTHALPY (peal (t/hrt (*F) (Stulet t comeautrT 1053 100.0x10f 528 521.8

2. cone OUTLET 1030 100.0x10f '548 634.2

s. saranATon ourtsT isTsAu sous' 1020' 13.48x1C 6 547 1191.5

4. sTEAu uma (2No isoLArca vaLvel 985' 13.48x1C,6 543 1191.5

5. FEEoWATEn INLET (INCLUoES CLEANUP

(",ogs,uge,nA,uzArma sysT " 1045 - 13.57x1C 6 383 357.7

s. nacmc PUMP SUCTON f 528 521.6 1034 34.2x10

7. necmc ruuP oiscHAnos 0 529 522.6 1268 34.2x10 Rev. 35, 07/84 SUSOUEHANNA STEAM ELECTRIC UNITS 1 AND 2 FINAL SAFETY ANALYSIS REPORT RATED OPERATING CON 0lil0NS OF l THE 80ll.ING IATER REACTOR 368 FIGURE 5.1-1

(D Q kV G d-() L-

                                                                                                                                                       @)) Il[y k

sTE AM oR VERS = MAIN STEAM Flow to TupssNE N ,

                                                                                                                                         /             /        /        c     X          X                                     >

j/ < bi-stE AM sEP A A ATORS I ' K ---____

                                                                                                                  @%s                    .
                                                                                                                                 ~                                  "
                                                                                                                            %                -   -    -   - -   -                      MAIN F EED 8 LOW i                                                                                    oRivimo rtow           :-
                                                                                                                              ,[-_.-____N,-
                                                                                                                                                , 3 (,-

[{ -

                                                                                                                                                                                                                         'C CORE g          9 g                [ JET. PUMP
                                                                                                        -                        X                                                        -
                                                                                           --._--_                                 l                                                                                =

q(! 1r RECIRCULATION PUMP _A_ g -+- VOLUME OF FLut0 (ft3) A. LOWER PLENUM 3887

a. CORE 2054

c. UPPER PLENUM AND SEPARATORS 1321

c. ooME (AsoVE NORMAL WATER LEVEL) 7934 E. ooWNCOMER REGION 58E P RECIRC LOOPS AND JET PUMPS 1398 Rev. 35, 07/84

                                                                                                                                                                           $USQUEHANNA STEAM ELECTRIC STATION UNITS 1 AND 2 FINAL SAFETY ANALYSIS REPORT COOLANT VOLUMES OF THE BOILING                                        !

WATER REACTOR 369 FIGURE 5.1-2 L... _ _ _ _ - - _ - _ - _ - _ _ _ _ - _ - - - - - - _ _ . - - - - - - - _ _ - - - - - -

s . SSES-FSAR TABLE 6.2-1 CONTAINMENT OESIGN PARAMETERS Driwell Suppression Chamber A. DRYWELL AND SUPPRESSION CHAMBER:

1. Internal Design Pressure, psig 53 53

2. External Design Pressure, psig 5 5

3. Drywell Deck Design Differential Pressure

a. Download, paid 28

b. Upload, paid 5.5 l.

4. Design Temperature, 'T 340 220

5. Drywell'(including vents) Net Free Volume, fta 239,600 -

6. Design Leak Ratio, t/ day 0.5 0.5 1 7. Maximum Allowable Leak Rate, 0.5 0.5 l

t/ day

8. Suppression Chamber 159,130 (low water)

Free Volume, ft8 148,590 (high watec

9. Suppression Chamber Water Volume Minimum, ft* 122,410 Maximum, ft* . 131,550

10. Pool Free Cross-sectional Area, fta 5,277

11. Pool Depth (normal) , ft 23

12. Drywell Free Volume / Pressure Suppression Chamber Free volume 1.51 to 1.61

13. Primary System Volume / Pressure Suppression Poc1 Volume .15 i Rev. 39, 07/88 370 l

l l L_____________.____________.____.______________

SSES-FSAR TABLE 6.2-1 (Continued) Page 2 S. VENT SYSTEM:

1. No. of Active Downcomers 82

2. No. of Capped Downecmers S J. Nominal Downcemer Diameter, ft. 2 4.- . Total Downcomer Vent Area, ft: 242

5. Downcomer Submergence, ft - high water level 12

                                                                                                       - normal water level                                                                                                                          11
                                                                                                       -low water level                                                                                                                              10

6. Downcomer Loris Factor 2.17 371 Rev. 39, 07/88 .

                                                    . . . . _ . _ _ . _ _ _ _ _ _ _ _ _ ____m__ . _ _ _ _ _ _ _ _ _ _ . _ _ _ _ _ _ _ _ . _ _ _ . _ _ _ _ . _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

l

                                                                                                                                                                                                                                                                                     'i Page-1 of :

SSES-FSAR TABLE 6.2-3 1 ACCIDENT ASSUMPTIONS AND INITIAL CONDITICNS FOR LARGE LINE BREAKS A. Effective Accident Break Area (Total) 4.158 Recirculation Line Break, fta B. Effective Accident Break Area, See Figure Main Steam Line Break, fta 6.2-10 C. Components of Effective Break Area (Recirculation Line Break):

1. Recirculation Line Area, fta 3.540

2. Cleanup Line Area, fta .080

3. Jet Pump Area, fta .538 D. Primary System Energy Distribution I}

6

1. . Steam Energy, 10 Btu 22.1 6

2. Liquid Energy, 10 Btu 333.8 6

3. Sensible Energy, 10 Stu

a. Reactor Vessel 108.2

b. Reactor Internais-(less core) 48.0

c. Primary System , Piping 30.5

d. Fue1 II 6.5 E. Other Assumptions Used in Analysis

1. Feedwater Valve Closure Time See Table 6.2-9a

2. MSIV Closure Time (sec) 4+1

3. Scram Time (sec) 1

4. Liquid Carryover, t 100 372 Rev. 39, 07/88

_ . _ . _ _ _ _ _ _ _ ___-____m _________m_.-_.-____-a.- _ _ . - _ _ . _ _ - - - -

   .s Page 2 of 2 SSES-FSAR TABLE 6.2-3 (continued)

I' NOTES: All energy values except fuel ~are' based on. a 32'F datum. (2) Fuel energy is based on a datum of 285'F.- 373

                                                                                                                         - Rev. 39, 07/88

TABLE 6.2-4 INITIAL CONDITIONS EMPLOYED IN CONTAINMENT RESPONSE ANALYSES A. REACTOR COOLANT SYSTEM: (at design overpower of 105% rated steam flow)

1. Reactor Power Level, MWT 3,434

2. Average. Coolant Pressure, psia 1,055

3. Average Coolant Temperature, OF 551.14

4. Mass of Reactor Coolant System Liquid, ibm 610,500

5. -Mass of Reactor Coolant System Steam, ihm 19,900

6. Liquid'Plus' Steam Energy, Stu 355.9x10 6

7. . volume of Water in Vessel, ft 3 11,978

8. Volume of Steam in' Vessel, f t 3 6,990

9. Volume of Water in Recirculation Loops, ft 1,236

10. Volume of Steam in Steam Lines, ft 3 1,390

11. Volume of Water in Feedwater Line, ft 3 See Table 6.2-9a

12. Volume of Water in Miscellaneous Lines, ft3 0

13. Total Reactor Coolant Volume, ft 21,594 l

Rev 39, 07/88

• TABLE 6.2-4 Icontinued)

CONTAINMENT Suppression Drvwell Chamber

1. Pressure, psig 0.1 to 1.5 0.1 to 1.5

2. Temperature, OF 120 to 150 90 to 150

3. Outside Temperature, F 40 to 55 100

4. Relative Humi 90.2 max Temperature,gity,t F

5. Water Volume, ft 3 N/A 122410 to 133540

6. Downcomer Submergence, ft N/A 10.0 to 12.0 -

i Rev 39, 07/88

 ' s 1

i l l l l 376

_______r___-______._______,,,______m___ _ _ _ __, _ _ - _ _ _ - - .- -_- _ _ , , , _ O \ APPENDIX 6 PLANT DAMA6E STATE DISPOSITIONING WITH EQUIPENT RECOVERY I 377

Plant Oamage State Dispositioning with ~cuipment Recovery Equipment may fail in response to or after an initiating event. Such failures may be due to:

1. An undetected failure.in standby equipment,

2. loss of support systems,

3. failure of equipment during operation, or

4. failure caused by consequential plant conditions.

In the. event of such failures, however, the operators may initiate recovery actions which will result in restoration of one or more items of failed equipment. Therefore, as the transient progresses in time, the unavailability of equipment must be considered to change with time. The models and information required to determine the availability of equipment, or probability thereof, involve the transient calculation used to track the progress of the, event and various equipment recovery and failure models for the various items of equipment important to the event. The equipment failed may be either front-line systems or support systems. In the case of front-line systems, the capability of these systems to perform the front-line functions, A which represent the top events of the Front-line FunctionEventTreesarh,determinedbymeansofappropriateFunctionalFault

                                           . Trees.

The support state for a given event tree specifies what support functions are-unavailable. In general, it is true that more than one support function may

l. have the identical effect on front-line function unavailability. In such cases the support functions are grouped together to form a support state.

Thus, in general, we consider support state I to be made up of equipment-failure combinations S , 5 , --- S where each 5 is a combination of

                                            'aquipmentfailureswhibhwkilprodIcesupportsthteI.

The failure strings St each consist of one or more failed components. In the development of~the inrluence of recovery actions presented here, recovery of any one of these failed oosponents is considered to terminate the support state condition and to restore the front-line functions made unavailable by the restored support system. In order to describe the process of event tree quantification and determination of the frequency contribution to each plant damage state let us first consider the basic elements of the process. First, we select an initiating event and a support state. The support state has the character described above. Second, we must develop a Front-line Function Event Tree (or its logical equivalent) for that initiating event and support state. This Front-line Function Event Tree consists of n top events (A , A , --- A ) each 1 of which represents a front-line function needed to assure avokdance oE minimization of damage to the plant as a consequence of the initiating event l and the associated support system failures corresponding to the support state. In the most general case the outcome of the initiator will be all possible combinations of successes and failures of the set of top events (A , --- A ). 378 {

                                                           .                    -1 Many of'these combinations'can usually be eliminated, however, because the outeeme of a given top event .nay have.the result that some or all subsequent top events are immaterial to the outcome. The transient analysis of the sequence provides the information necessary to determine the endpoints which can be eliminated (or combined) in this manner.

7.iven that all.cf the end points of the e'ent v tree are now developed two tasks remain:

1) assignment of each endpoint to a plant damage class,'and

2) calculation of the frequency of the end point.

The assignment of endpoints to a plant damage class is once again detemined by the analysis of the transient using an accident code such as MAAP or BWRSAR, Certain combinations of top event successes and failures can be assigned to a specific plant damage state based on the transient analysis. The success criteria to. avoid a given plant damage state (or a failure . criterion which assures its occurrence) must be stated in terms of front-line function failure combinations. Examples of plant damage states which could be defined are:

1. core damage with loss of clad integrity but geometry intact,

2. metal-water reaction resulting in control rod relocation to the core support plate,

3. metal water reaction with channel box relocation to the core support plate,

4. - core heat up with fuel relocation to the core support plate,

5. core support plate failure with debris relocation to the lower plenua,

6. Iower plenum dryout with lower head failure and debris relocation to the drywell floor, and

7. debris heatup and spreading on the drywell floor with consequential i over temperature failure of drywell component. '

These definitions are very simple-minded and do not reflect that there are various degrees of material relocation (relocation proceeds locally at differing times) and do not reflect the complications resulting from generation of non-condensible gases. The example given does show the progressive nature of the plant damage progression, however, which is an important-and general aspect of the accident progression. A complication which exists in this process is the fact that in the most ' general case, more than one combination of the top event successes and failures may result in the same plant damage state. Further, the recovery time constraints for recovering the top event functions may differ among these success and failure combinations due to the nature of the transient trajectory for the different success and failure cases. These differences must be considered in the calculation of the event tree endpoint conditional probabilities. The frequency contribution of the endpoint to the plant damage 379

i state is then the product of this conditional probability and the frequency of the initiating event-support state combination. Oefine a specific set of successes and failures of event tree top events C. (A,, A,, -- , A ). .If there are n top avents in the tree, there are 2" *

   'possible endpoiEts. As stated above many of these endpoints may be degenerate in the sense that successes or failures subsequent to a given set of successes and fatt ares in the first part of the set can become irrelevant.                                            *hus, in general, we have k possible success / failure combinations where                                              n k<2    . Each of these combinations must be assigned to a plant damage state, and Tet us assume that q plant damage states with associated success criteria have been defined.

These are (D , D,, --- D ). For the first plant damage state 1, a subset of E the ( combinations will be assigned, say r(r<k) of them. In general the time constraint for restoration of a top event in one of the subsets will be different for each member of the subset. Therefore, r times must be defined for D (T T l T7) corresponding to the differing time limits for restohinhtheko,peve,ntfunction. There is then an array of time constraints T corresponding to the jth member of the subset of defined for plant dhi$ age state D . The total number of such times will viously be just equal tok,thenumbkrofsuccess/failurecombinations. , While this sounds very complex and formidable, in actual practice it is a much simpler matter than the above discussion would indicate. For example, in a particularly simple case there may only be a need for q times since all times for each plant damage state subset of the C, are identical. Thus the recovery time constraint is simply associated with tBe plant damage state. In realistic application this simple example is much nearer the degree of complexity found than the theoretical maximum of the general case. The time constraints on successful execution of the top events, A g, and the recovery functions for the various systems which are required for availability cf A must be used for determining the probabilities of the various event tree end ints. The probability of a given endpoint combination is denoted by P(Cg ) and is given by a P(C ) = P(C /S )P(S /I) where P (A/B) = the conditional probability of A given the occurrence of B l Cg = the ith top event success / failure combination S) = the jth support system component failure combination causing support state I. m = the maximum value of j.

 . The term P(C    g /S)) is given by:

P(Cg /S ) = P(C g /R )P(R /S ) + P(C g /R )P(R /S)) 380

where R = success in recovery of S by time T, (value 0 or 1). E = the complement of R u, failure to recever S by time T . s- t P(C,/R

                                                 ) = the conditional probability of C given that S. is recovered at T .                                   3 P(C /R ) =.the conditional probability of C given that S is not recovered at time T g.

We assume that if S is recoversd at time T , it will be available at all times subsequent to T,. On t M other hand, if it is not recovered by time T,, there is a non-zero probabiliT; that it will be recovered prior to the next

• time in the sequence of time constraints being considered, T This fact mustbeaccountedforinde$4lo'ingtheprobabilitiesforthMa.rious C, of the set C. Inductivt may be af d to develop a general expression for t!!is process.

In the cet of success / failure combinations, C , consider that a top event function, A , is to be recovered before time , where T is a time later than the initial time T * * "' 0

                                           .P(C/S)=P(C/RyP(Ryg/510' g g          g               +     i 11        11   10' where Rg      = the recovery state for support system string, Sg at time T .

S = the support system string status at the initial time. 10 Ag = a member of the set C g l If two recovery times are to be considered, A must have been recovered at T g and P(Cg /S 1 ) = P(Cg /Rg)P(Rg/S10}

                                                          + P(A /f )P(R /S10'     (i 12'       12 8

11'

                                                          + P(Cg /Rg)P(Ig/Syg)]

where Rg = the recovery state for support system string S at time T). S = the support system string status at time T . 381

l t The terms in the brackets repeat, and, therefore, the express:en for a recovery times becomes: P(Cg/Sg ) a P(Cg /R )P(R /Sg)

                   +

P(Ag /E n )P(E /S10' i-1 12( 12 ! 11' l.

                   +
                     ... + P(Cg ,,,g/E   ,1) (P (Cg ,,/Rg)P(R h / 'M4)
                   +

P(C g ,,/E y P(I /Sg)]) !- where C gq = the combination Cg with A 7removed. Cg , = the combination Cg with Ay , A ' ~~~ A rem ved. 2 s Therefore, in order to deternLine the probability of any success / failure combination C in general the above process can be executed to derive it. These relationships have been programmed and incorporated into a computer program which generates support states and quantifies the corresponding event trees using input data which describes the initiating events, success and failure combinations, plant damage states, equipment dependencies and unavailabilities, time constraints, and other information needed to evaluate the final outcome of a given initiating event. This program is currently in the process of being debugged. When this process is complete, input and output routines will be added to create a comprehensive risk analysis calculation package that will generate the type of information described in this document. 382

J l l I i APPENDIX 7 AC POWER RECOVERY TABLE 1 383 l

r-l Recoverv of Off-site AC Power

                            *he tables included in this Appendix represent the occurrence and recovery of loss of off-site AC power. The data presented represent the frequency of loss of off-site power for a time equal to or greater than the tabular values of time presented.

Forexample,theoccurrenceoflossofoff-s{tepoweratSusquehannais , calculated to have a frequency of 0.0566 yr for losses of very short j duration (a few minutes or less) , while the frequ ycy a loss which will last ' one hour or longer is calculated to be 0.01164 yr . These values are calettlated using the methods and data from NUREG-1032 and have been accepted as valid for Susquehanna by the NRC. The symbols I(t), GR(t), SR(t), and SS(t) are defined in the NUREG as losses j due to i I(t) = plant related problems, GR(t) = grid related problems, , SR(t) = severe weather, SS(t) = extremely severe weather. For the case of severe weather, different frequencies are derived depending on the routing of the off-site power lines. The lines at Susquehanna are considered to be not obtuse. The sum of I, GR, SR, and SS then yields to total frequency of loss of off-site power from all causes. This data must be used in conjunction with a model for loss of all site based AC power and its recovery in order to derive its recovery in order to derive the appropriate curve for recovery from Station Blackout. l l 384 l

i l i 185

                         =

A .CC000C000C0000C000CC000000000C0COOOOOOOCCCCCCCCCCCCCCCCCOOC ag , C =. N M T W @ m a m O = N. M. ,T W @ h. .e. m

                                        . , . . . . . .                                                                               . . C
                                                                                                                                          . . =. N M T W 4

• e @ C. = N M T W @ h e m O = N M v e @ h m e. c = N M T W @ m a, p =

                       .*b.CCOOOOOOOC==========NNNNNNNNNNMMMMMMMMMMTTTTTTTTTTWWWWWWWWWW@

t

           .e            A i e       w    3 e      z   +

e - e . e eaw .a============NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN e=W t'O O O 0 0 0 0 0 0 0 0i0e0i0s0i0 e0 e0 i0 s0 e0 e0 s0 e0 s0 e0 i0 s0 e0 i0 0 s . , i . e 0 0 04 0e 0 i 0, 0 0 e 0 e 0 0 0i 0 0 s0i 0 0 0 0 0 0 0.0i .0 0, 0e0a 0, 0 0 n e ewm 4 e3* IwwwwwwwwwwwwWWwwWWWWWWWWWWWWWWWWWWWWWWWWWWwwwwwwWWwwWwWWwwwww lO d e W N M e M M - T o - s e e M - m O M N W a e T a e w m T W O O N e h @ M c C = W N O

• M m T N N M c - m W @ m m m e e:S e40 l@chN@T*TMT@mT=echamWN==MeeMSTONemomeWTTTTTTW@Nem=MWhmNTACM@cM e se m m N e m W T M N - C o m eemamm-~@e..

iWM~M-========. T .M N o m e > W T M N = O m e m @ e T M N N = O m e e > @ @ e vl

                                                                                                              .T = N T = m h W M - S m@ @ WWWWWWWWWT,*TTTTTTTTMMMMMnMnMM e         .C        - * - - - - ' * * * - * - . - - - - - * - - - - - - - ~ - - - - - - * - = ~ - - - - - - - - - - ~ ~ + - ~ - - -

e z 000000000000'0000000000000000000000000000000000000000000000000- l e o e A e W e z e e

                        =

s NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN em CC00000000000000000000000000000000000000000000000000000000000 e s e i e e 4 a e a e e i e e e e a e s a e e a e a e a i e a a e a e a e e i e e e e s e a e e i i e i s i e e e e 4 e*W WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWuwwwWWWWWWWWWWWWWWWWWWWw e=d' eg3 CNmW@SeeeMC=MedeST=O-WomeSmeeWeeMSW@eemeWTMTm=@NOSmCNeceMammo eW>- h=WOWOWNSWNSWM=ShWWTMNN="*NNMTWGeS=MWNONWe*Th=TONWSTONha@=WCW' CemeTM=ce>@TMN=SSN8WTMN=Opeh@WTMN==OSee>@WWTMMN==OSeemmheeWWT e e e Q e.m. m . .m. m . m . .h .h.@ . @. .@. .@. @ . .@ . W. .W . W. .W . W W W W W W W T.T.T.T T T. T. .T. T T.T.M.M.M.M.M.M

                                                                                                                                                       . . . . . .                                                                       . .. . .                M.M M M M.M.M M.N N e

e C CC00000000000000000000000000000000000000000000000000000000000

e. 2 e

A W W ===========NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN

             >          W     0000000000000000000000000000000000000000000000000000000000000 Eaz                ee e e e e e e e                            e e e e a s                                  ee e a s e e e e a e e : e e ee e ee e e a e                                        s ee e e e s : i e e e                          e r e e e s e Ok=

Wwd WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW WMeO=Wa=TWC==WNes*MSWNMMON=NS=meNSOMSeeNhTWWeMS*me-ememme=Ted OCW 3 eMO*OeNeeSNMMOGOGNmTWWGNNNSGMNOGGeSSSO-MT@eONWhOMWOMhCTeNh=WO WWG=eWTN=OOWOdestNSNWM=cehWTMN=Seh@WTTMNaOSpe>@eWTTMNNacomeme WWW

            >           3- W. .M. N N. =. =. =. =. =. =. =. S. S. e..e.. M.                                                 . M. h @ G G. G. G. W. W. W. W. W. W. W. W. T. T T. T. T. T. T. T. T. T. T. M. M. M. M M M. M. M.

4

• E. O C000000000000000000000000000000000000000000000000000000000000 WO 2

W O. MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM 4 m OOO0000000000000000000000009000000000000000000000000000000000 oe e eea a a e aa e e e a eee a e ee e a e aa eaeeaae a eeee eeeee e ae e e s a e e a e s e e e i s da QM WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW M=SMcM=OsmWTMN=OSee>>GGGWWWGGGGkmeG90=NMTJheO=McGeONT@e=MWe=M WW w MacGTNOeWM-ShWM=eWTNOeGTNOGGTNeeGTNOSkWM*SmWTNOc@TMammWTheehe MMNNNNN====COOOOSSSSGesesekhh>MGGGGGWWWWWTTTTTTMMMMMNNNNNN=== WW W W. W . .W . W . .W . W . .W. W . .W W. W

                                                                            . .  . W W W W W T. T. T. T. T. T. T. T. T. T. T. T. T. T T. T. T. T. T. T. T. T T. T. T. T. T T. T. T. T. T T T. T. T. T. T. T. T W                0000000000000000000000000000000000000000000000000000000000000 e

o e e W G W NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN e 2 0000000000000000000000000000000000000000000000000000000000000 e *. e i e e e ee e i e e e e e eea e a eae a eea e e a e aa e e e eie e e a e ei e a a a e i e e e e 6 e a e e e i ead WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW em OWWGSTNNTGWMMGOGTTWSMOceONmMOSS-TeTOSeeOM8=>WMNNMeeN>MONWTTWh ewW Ne>WMM=OSeeeeeGGO*NMWheOMWMORWSNeeNGSMhNGOWSTSTSTSTOWomNeTOWN

            *EW              M = O S e > @ W M N = O S e h W W W T M N = O O S e k h W W T T M N N

• C O S rt e e k d W W W T T M M M N N = = C O O S S eW3 e > @ . $. W. W. W. W. W. W. W. W. W. W. T. T. T. T. T. T. T. T. T. T. T. T. . M. M. M. M. M. M. . M M. M. M. M.. .M. M. M.

                                                                                                                                                                                                              .                            . .N. N.
                                                                                                                                                                                                                                                  . .N. . N.. .N. N.
                                                                                                                                                                                                                                                                   . .N.  . N N N. N. N N N N N N e          e     C000000000000000000000000000000000000000000000000000000000000 e C e
           .e o

e e NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNMMMMMMMMMMMMMMMMMMMMMMMMMMM e CC00000000000000000000000000000000000000000000000000000000000 e s i e e : a e e e a e e e e ee e e e e e a e e i a e e e s e e e e e e e e a e e e e e a e e e i e e i e a e e e e e e e sa WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW em O@@eGWNWNTMMSWSGS==SN=WMTSTMTW=WTNWNSWOTOGMeSh==>fde@edeWG==T

            *w               OWOceeGOOTNMGNeeeONTSNW=G=>MSGNeWN=NMGOTSWNSmWGOWNS-TM-WOW =hM es               OS=MhNSWNShWMNOSeeNSWWTTMMNN===OOOSGMeeWNOeWM-SMWM=ceWWMNOSh@

00 e e. d. @. W. T. T. M. M. M. N. N. N. N. N. N. =. =. =. =. *. =. =. =. =. *. =. =. =. =. *. *. *. *. *. S. $. $. 9.. e. . .s. e. e. m > N N. @. @. @. @. @. @. W. W. W. W. @. e. .

• C000000000000000000000000000000000000000000000000000000000000 e

e e

                             ===NNNNNNNNNNMMMMMMMMMMMTTTTTTTTTTTWWWWWWWWWWWWeegGgg@@@@hhhh 0000000000000000000000000000000000000000000000000000000000000 ee e e e a e ee e ea e o ee aeese e e ee e eas ea s e e a ea e eee                                                                                                         ea a ee e e i ee ee i s e e e e e a        WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW
                    >       OThWWWW=WWWGNNeOSOMTMOWMOOMOSeTh>TTSTWMSTT*TMGmeNGSOTW=MmeNhc w       OWMNW**eMOeTMSSMWONSemMWNTSMGONSWNWWeTSMmWWT=TSNOTOWMMMOM=NW=

• C=MNeMNMNNhT*TGNO*MG=hT=TG=CONG=hT=MW= SON #*NT=NW-SONW=NT=NTOS T. N. =. S. G. W. T M. N. N. =. =. =. 9. M. G. W. T. M. N. N. .=..=.. =. S. m @ @ T. M. N.

                                                        .                                                                                                                           . .N. =. =. =.... S..k. W T. T. M. N N = .= .= .S..M.                    .. G.
                                                                                                                                                                                                                                                                  . .T. T. M N N = *

• S. N @ T.

0000000000000000000000000000000000000000000000000000000000000 a CC00000000000000000000000000000000000000000000000000000000000 W

                    >E       O. *. N. M. T. W. @.. m e. S. O. * .N M. T. W e. N e #. O                                  .
                                                                                                                                 -N
                                                                                                                               . . . M. T. W, G h e S. O.
                                                                                                                                                 . . .          . N. M . .T. W  . . e.
                                                                                                                                                                                     . .m e S. O = N M. T. W. .W.                      . .h .e.S. O
                                                                                                                                                                                                                                                  . -. N  . M.
                                                                                                                                                                                                                                                            . T W e m e S. C.

I COCOOOOOOO==========NNNNNNNNNNMMMMMMMMMMTTTTTTTTTTWWWWWWWWWWW

f-286

                                                     .i I

og

                                =

A JO0000000000000000000000000000000000000000000000000000000000:

                                                    ]1*. N. .M                                       T. W. W. m e. S. O - N M T W W h a m e =. N M T W @
                                                                                                                   ..             .          , . . . .                                       . .                 .                              . .m                    . .z       @. c. =. N M T
                                                                                                                                                                                                                                                                                 . .                                . .W
                                                                                                                                                                                                                                                                                                                       .   @ h a m e. =. N M T W @ m e. m O. = N M T W 4  . . .

w

                                                    ;@                           @ @ @ @ @ @ @ @ h h h h h h h h N h e s s e e e e e=======                                                                                                                                                                        meSO            S@@SS@@@OOOOO
                                                                                                                                                                                                                                                                                                                              =============

e a ) e Z , e = i e - w I e eaw tNNNNNNNNNNNNNNNNNNNNNN%NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN e.a 10e0 0,e0e 0. 0e 0i 0 le e a0 .0 i0e0e 0i 0s 0 0 0 0 0 0 e0 e0 e0 e0 a0 e0 e0 e0 0 0, e0 e0 e0 e0 ee o 0 0e0a0e0e0a0a0 e0 0 0 0e 0 0000000000000 e i n t a e i 4 s 5 e-3 e3* IWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW

                                                      !@TMe@SMmWMNNRWeNmMSmWWW@e=TeMSWNoemhmeS=ThCTSTOWMOe@TMNNNMMW ese m                                               e d. S M N N d = @ = @ = @ = = N e M S W = = M e @ N e W = e W N e W N S G M m e W M O N W M O e @ m e m m W M e @ m W eMO                                    NNaCOSScammd@@@TTMMNNN==COOSSSeeemm=@@@GWWWWTTTTMMMMNNN e

e o M.M.M.M . . .M . .N.N.N . . . N.N. N. .N.N. N.N . . .N. N . N.N

                                                                                                                                                                                                        . . .N     . N. .N. N                                                 . N . N N N = = = = = = = = = =.=.=.=.=.=.=.=.=.=.=.=.=.        . . . . .

e Z e CC0000000000000000000000000000000000000000000000000000000000 e e A e W e E e = NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNMMMMMMMMMMMMMMM e s ea 000000000000000000000000000000000000000000000000000000000000 e e i s e e a a e e a e e e e e e e e e e e e e a e e a e e e a e e e e a e e ea e e a e a e a e e a e i a e i a i e>W WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW ewe NeeMSTNemeSONTeNNNSGM=OOOO*MWGNWOWOWNSWTN=OSSTOOM*NetWSmeNam es3 =GammeTOW=mTOWNSWNeWNSGMONT=eWMOeWMOeWM-SkWNOSO=NTWe=Wm*WOTm eM> e g TMMNN===COSS$eenhhWGOWWWWTTTMMMMNNNN****OOOOO e Q N N N. N N N. N. N N N. =. =. =. =. =. =. =. =. =. =. =. =. =. =. =. =. =. S.S.S.S.e.e

                                                             . . . .                                                    . .                                                                                                                                                                                                    =. =. =. =.        =.. e.=.
                                                                                                                                                                                                                                                                                                                                              .s.e.s
                                                                                                                                                                                                                                                                                                                                                  .         .=.

e. m .m . =.

mm =. =. =. =. =. =

• O C0000000000000000000000000000000@@@0000000000000000000000000 e E e

e WW MNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNM

               > W                                    C00090000000000000000000000000000000000000000000000000000000 g=3 3km                                       ee e e ee e e e s e e ee e e e e e e ee e ee a e e a a e a e e ea ae e e e e a e a ea e e e e e e e a e a e ee wws                                    WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW M*C=MWSMSGM===NMGSMeTe>WMNNNMTeeNGOWOGMemeM* COCO =MMWmOMGSMe=

03W 3 WOWOWOW=GNeTOGNeTOMMOMMemT=eWNSGT*SGT*SeTNOeGeNeeGTNOGNWMMON hhWWWWTTMMMNN==COOSSpesehmh899WWWWTTTTMMMMMNNNNN==*==OOOOOOS WWW

               > 3
               < >                                   NN.N.N.N.N.NNN.N.N.N.N.N.N.N.N.N.=.=.=.=.=.*.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.*.*.=.=.*.=.=.=.=.=.=.=.=9.

g a @@@@eO000000000000000000000000000000000000000000000000000000 WO E W T MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMnMMMMMMMMMMMMMMMM

               >                                    000000000000000000000000000099900000006099000000000000000000 e e e eaee ea e a e ea e e ea e eee e ee e e ea ee e ea ea eeae e e eaeee e ee sea e e e e e e e da Ok                                    WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW GSNWe=WMOWh=TSNWSMm*WOTeNh*G=WOWOWOWOWOS*hNSMSWOGNSTOMMSched WW w

MaceGWM*OeWWM*Oe@WMNOShWTN*SeGWMNOSmeen-Oe>WTN=Oe>WWM=cendem WW ==*COOOOOSSSSSSeeeeeekhmmmhWGG99999WWWWWWTTTTTTTMMMMMMMNNNNN e T.T.T.T T.T.T.T.T.M.M.M. M.M.M. M.M.M.M.M.M.M.M.M.M.M.M. M.M.M.M.M. M.M.M.M.M.M.M.M.M.M.M.M.M.M.M.M.M.M.M.M.M.M.M W @@O000000000000000000000000000000000000000000000000000000000 e e e o M e W NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNMMMMMMMMMMMMMMMMMMMMMMMMMMM e E CC0000000000000000000000000000000000000000000000000000000000 e = e o eeee e ae e e e e e ee eea eee e ea e a e e e e e e a ee a e e4 ee eeae ea eie e a a ee e e e a ead e> WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW SNWOWe>TNOSSSO-MOSN>=eneW=SmWTMNNmWWOecommMNMenemee=GMThMOOM ewW SW=eT=hT=eT=eGMONTNSmWNSMWMOeGTNONMTOMONWGNWOTSTOW=WT=eWM-Sh eEM SeemmhWGGWWWTTTTMMMNNNN****=OOOOOe9TNOGNWMNOShWTM=SeMGTMN=Se em3 e > =.= .= =. =.=.= .. = = ...= = =.=.= ...........

                                                                                                                                     = = = = = = = =.=.= .     * =.=.= .                       = =. =.= .= S.   . e. e. S. m. e. s. s. e. e. e. m. m. m. m m. .m. m                                                                     . O. G. G. G. G. G G. W. W.

e e C0000000000000000000000000000000@O00000000000000000000000000 1 e O ' e e o e e MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMTTTTTTTW e CC0000009000000000000000000000000000000000000000000000000000 e ee eaea a ees e ae eeaee e eeee e ea e e a ee a e ee e e e i a eea ea eee eae e a e e e e e e e sa WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW em NMeecTMTemeNeeSTOS=ToeecTomme=GNOGG=WSWMe=NWh=GNekSGTONMNSNM ew ONTNOSe>GGGhheS=MehSNTm=Te=WSeenemmmeMSWehMSGNSW=eWNSMOMh=hM eg WMM*Oeh839MN=OSSeMGWWTMMN==OSSeem>GOWWgTTMMNNN===OOOSGT=eGM-e T. T. T. T. T. M. M. M M. M. M. M. M. M. M. N. N N. N. N. N. N. N. N. N N. N. N. =. =. =. =. =. =. =. =. =. =. *. *. =. =. =. =. *. =. =. =. =. =. =. =. S. S. S e C00000000000000000000000000000000000000000000000000000C00000 e e o i

                                                   **NhhhheesessesseeOSSSSSSSSSSOCOOOOOOOOO-==========NNNNNNNNN 00000000000000000000000000000===============================

a e e ee e e ee e a e eo e a ae e e eee e a e a eee4 3 eeeeeeeeeeeaeeiee8 eeeeeeeeee a WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW

                  >                                OGWOSMSONNMONSTWN=MNehmeOSMNMGSTNNWMMONTeWOSMNeSeNOMOWameONG w                                SN=N=SNW==>WOSOCSNWSOMNNNSSka=ONOSWWheGOTWeOSMMWWW$eOMMMONTW
                  =                                SNG =hM==TOWSNWahM=OMSGS=WOSM=OMQes=WOGM=SNeme*WOGMOeNSNe=WCW M. M. N. N. =. =. =.. S.                                                 . h 6. T M. M. N. N. =. =. =. S. M. W. T. M. M.                                        ... N. N. =. =. =. S h W T. M. M. N N. =.                        .                                             . =. =. e. >. W.. . T. M. M. N N. =. =. *. e. M W T. M 000000000000000000000000000000000000000000000000000000000000 a

W 000000000000000000000000000000000000000000000000000000000000 pg =. N M. T. W. G. . . . h e S. O = N. M. T. W. G. h. e. S. O = N..M. 4 . . .T.. W.

                                                                                                                                                                                                                . . G h 3. S O - N M. T W G. h. e. .                            .                                        S.. O.
                                                                                                                                                                                                                                                                                                                              . =. N. M. T W G m. e. S. O - M M T. W G. h e S. O.

I w $ $ G G G G G G e m m m h h h h h h h e m e s e s s e m e 8 S S S S S S S S S O -- O .O.==========<===== O O. O O O O O * = = = = = = = = = N - _ -_ ___.____ - _ - - - _ _ - _ _ _ _ _ - _ _ . _ _ _ _ . - - _ - - . _ _ _ _ - _ _ . _ - - . _ - _ _ _ .- . _ - . _ . - _ _ - . _ - _ _ _ - _ - - _ ~ _ - . _ - . - - , _ _ - - - . ~ _ -

                                                                                                                                                                                                    * =

d 1 I i e lCCeceCOceocceOOQeeeeeceoco OceQOceOCOeGeOccecocceeOOOcceeece-

                                                                                                               !=.
                                                                                                       =g      j .N . MT . c.@.m.e. S. O. . N.M.. T.@.@. h. .S.c .a .~ .       M .T .o .@.h.e .S .O-= .~..M. T o @ h e S. O.. .. N. .M. T. .o. @ h e S. c. = N M T o @ h e m e 3     NNNNNNNNNMMMMMMMMMMTWTTTTTTTT@@@@@@@dd@@@@@@@@@@@hhhhhhhhhh3,
                                                                                                                 ==---==========-=========-.=-========----=----==----===---=-

e e e e

• 3 I e =  ;

e . e e eaw lN N N N N N N N N M M M M M O s MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM

                                                                                                  =e=a          C: 0 0e 0e 0  0 .0 0 0s 0e 0e 0 e s               e 0 0. W. D 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 s i e e e e a e e a i a e e e e e e i e e i s e e s e s e i e e s i e .s                           s          e e-3                                                                                                                                                                                   .

e3 WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWw ee=MeOMNNMNwShhCWedeTNNdONGMCmMNMGehod@ST=eme=TSeMNMehe@ Nome e23 MaceGmM=C@=@=hMcWMohdM=Se@mTTMMMMMetcWheONMe>CNThCMWSN@SMhCT eWO ==-COOOOcendTN=cem@TMN=SeN@@TMN=OSehGdWMMN= OSSE >@@WWMMN==CCS e e o =.=.=.=.=.=.=.=.=.S.S.S S S S S e e s e.s. s. e. k. h. h

                                                                                                                                                                                        . .h .h .h .h.h
                                                                                                                                                                                                      . .h.h.@
                                                                                                                                                                                                             . G G G.@.S.G.G.G G.@.d e m.W.@.@.c m d.W.W.4 4 d c T.

e e 2 000000000000000000000000000000000000000000000000000000000000-e e A e W e E e e

                                                                                                          =

MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM em J COOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO000000000000000000000000000 e s e e ee a e e e e e e e e e e e a e e e i a e e s e e a e eee e e e a e a e e e e a e s e e e e e e e e e s e e>J e-m WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW NeGeNSeOWN=MMMNMG=she=GN==TmMOSp=WOOT9990$=eGGhSMONeeTTT@eN@ eE3 WOGNSWNONWM=SemGWWT99WWehSSONSWmONWMOMGSMGOMh=WSTOMMNhhhNhme eM> e e MMOShWWTN=OSkWWTMN=OSe>$WTMMN=OSeeMGOWTMMNN=OOSeehhWGWetTMMN e g k.h.... h W W G.G.G.G.G.G.W.W.W.W.W.W.W.W.W.T.9 9 9 9 T T.T.T T.T.M.M.M.M.M.M.M.M.M.M.M.M.M.M.M.N.N

                                                                                                                                                                                . . . .           .                                                 . . . .               . . . . . .            N N N N.N.N N N e C          00000000000000000000000000000000@@@S900000000000000000000000 e      3 e

W WW M M M M M M M M M M M M M M M M elm M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M

                                                                                                   > W         OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO000000000000000000000000000 Ea3           e e e e s e e e a e e e e e eie ee e e e a e e e a s eea e ee s e ee e ei e e a e e e e e e e e a e e e e e e e 3h=

W=J WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW SOT ==McGGSTNNTSW9dee=O=TeWMMTSNSmWmOMSWMNMeh=hM=SSONWSTS@TMN C3W 3 GNkMSW=edNOGGTN=OSeSeeeeOSO*NMWGeONWhSNWS-TN=*eNWSteme=WOWOW

                                                                                                               >$TM=OSMGWTN=SpehWTMN=OSehhSWTMN==OSehhWWWTMMM*=OSSeehhWWWWW WWW
                                                                                                   > 3        S. S. S. S. S. O. S. e. e. e. e. e e. S. .m.

h .M.. M. N h h k N G. G. G. G. G. G. G. G G. G. G. G. W. W. W. W. W. W. W W. W. W. W. W. W 4 > O O O O O O O O O O O O O O O O O C 3 O O O O O O O O O O O O O O O O O O O O O c t." O O O O O O O O O O O O O O O O O O E S WO 3 W MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM 4

                                                                                                   >          OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO000000000000000000000000000 eeea ee a e ee ea e eee e a a e ee ae e eeaeeeeee eaa ase eee e e e e ee e e e i e i e e e e da Ok         WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW met =SWNSGmem*=SGM=SGT=SmWMOGGWM-SMGTN*Se>WTMNOSSmWWWWMN==COS w

WW NOSSSWTN=99hWWMN=OShWWMN=OSMGWWM=OSeMGTMN*OSGNWTMN=OSemWWTM= _ WW MN========OOOOOOOOSSSSSSSSSSSSSeechmmmh>NhmWGGGGGGGOWWWWWWWW W M.M.M.M.M.M.M.M.M.M.M.M.M.M.M.M.M.M.N.N..N.N.N.N N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N N.N.N.N.N.N.N.N.N.N.N M' 000000000000000000000000000000099900000000000000000000000000 e o e e e e W MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM e E e = GOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO000090000000000000000000000 a e eoe a e a se a e e e ese eea ea e e e ee ae e ea ee e ee e e es s : a e i e eeseeeeeeeea sad e= WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW SWWWSWMNTSM.O*WS9N=NWSt=OO=MMMSSWWNSMhMOSh>hSNGOGN&mWGGeONGC , owW WWMN======NMWWGMS*MWMSNWe=9kOTh*WSMhMG=GOWOWOG=hNeMSW=hMcGNS i i

                                                                                                   *EW eW3-NGWTMN=OSemWWTMN==OSekhWWW9MMN==OSGSemm88WWTTMMNN==OOOSSSSSN 1

e > W. W W .W. W

                                                                                                                   ....       . W W W 9 9 9. T. T. T. T. T. T. T. T. M. M. M M. M. M. M. M. M. M. M. M. M. M. N. N. N. N. N. N. N.
                                                                                                                                                                             .                                                                                 . N.
                                                                                                                                                                                                                                                                 . . N.  . ..N..N.  . N. N. N. N. N. N. N. N N.

e e COOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO9000000000000000000000000 .

• O e

o e e e geweTwTegeTT999TweewT wwTewTTeTwwww eveveggTTTTe TTwevew wTevewT e CC000000000000000000000000000000000000000000D000009900000000 e e ee 4 e e seea eee a e e e e ea e e a e e e e ee e e oeea ee ee e a e e e e ee ese a e e e ae a e em WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW em' ow

                                                                                                              =WWNWTSSGONMOS9999eTThWWSGh=SNOWMThM=NWONGNOWN=NTeMOSSOMhMoe OmWTRMMWeemem=G=GNSWNSkWMN==OOa=NMTGSONWhCMhCTSNGOWOTSWOdehN og e6 SOTNOGGTNOSkWTN=SeGWTN*CSGMGWWMNmOSehhWWT9MMW=COS$eGMGGGWWTT e          m. m ..m m.>.G.G.G.G.G.W.W.W.W.W.W.9 9 9 9.T.9                 . 9 9.M.M.M.M.M.M.M.M.M.M.N.N.N.N.N.N.N.N.N.N N.=.=.=.=.=.=.=.=.=.=.=.=.
                                                                                                                                                                                                                                      .         . N.N.N

• O@O000000000000000000000000000000000000000000000000000000000 e

e e N..... N M M M M...M. M M.===. M. M. M M T T T .9. 9...........9 9 9.T T T==... W W W W W W W W W W W..G=== GG . G G. G. G G G. G G h N m h. .m m. m h h h h e e S

                                                                                                                                                                                                                                                                ..======

eeel 's e eeeies el ee4 ee8 e6 e oeee4 eee eeei8 8 eeeees8 eseeeet 6 eeeeeet a WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW h MemhMGOW=MMMONT==GMMN=NNNNemOO9hSN9MSGMMSGMMMGOSTSWWGSWMehmM w TS*TS90eONTMeWSWGMGS*MNhSTONW999==GNS$9N=99COWGMNWSSNGSSTSee MOS=hGeOWOGMOMOmWh090GMOGOMONOTOGMOGSGemOTOGROWSGWGSWSWMOved

                                                                                                              =. =.G.N.W.T.M.M.N.N.=.=.=. e.k.W.T. M.M               . N.N. =.=.=.G.m.. W T.M.M.N. =.=.*. =.e.G. W.W.M.M.N.=.=.=.=.S.G.W.9.M.N.N.=.=.=.=.S.$.W.

CO0000000000000000000000000000000000000000000000000000000000 a W C00000000000000000000000000000000000000000SC0000000000000000 pg - .N.M. T . .W G. h. e. S. O. =. N. M 9. W.

                                                                                                                                                   .            . . G. h e S. O. =. N M. T. W. G. N e. S. O. =. N. M T. W. G. h e. S. O. =. N s1. T. W. e. h e. S. O. =. N. M. W. W. G.
                                                                                                         .I   N. N. N. N. .N. N N. N.  . .N. M M. M      == M.
                                                                                                                                                             .. M. M M M...............=..=.

M M .w .9 T T T 9 T e w T W W W W W W W W W . W G..=.. G. G...-===== G. G G. G. G G G h h h. h h

• h h h h e

288 I- )

                                                                     .e
                                               =

W 10000000000000000000000000000000@O000000000000000000030000000

                                   .,-                                i-
                                                                      . M le.                            M     T W99 G h e. e c. =. N..m .                                             e d. G. h a.                                    . . m.
                                                                                                                                                                                                                                              . . O.
                                                                                                                                                                                                                                                   . . =. m m T W G h e.. m        .O  . =
                                                                                                                                                                                                                                                                                         . N. M.. .e.. d. G. h. e.@   . c. =.
                                                                                                                                                                                                                                                                                                                           . . N .m. T W G. h e m C = N w

9999e35e

                                                                        ===================NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN 00e0000000=======-=-~~~~NN~~~NamMmmmmmmeT e                     H e                      W

• E o

e

                                               = .j e

o=W- mmmmmmMmmmmmmmmmmmmmMMmmmmmmmmmmmmmmmmmmmmMMmmMMmmmMmmmmmmmm e=m C i 0 0 e e0e0i 0 0 0 e s0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0, 0 ewe WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW . e e e e i e e a e e s e e e e i e i e e s e e # e i s i e s i a i t s e e i t is i i t i s 5 3 e3= eOMGehMemeSc=TNNhmSGTMNNNTGe=WSTOGNShWMMNNMem>SNWeNG=G=hMONT ece .emh=GOWCTSTOWOW=GNhM92=hMSW=eTohTOMMONTaeWNeemceWNONWNOhmmes e e W O - !a c h m @ @ W W T M M M N N = = O c e S e G e h h G G G W W W T T T M M M N N N = = = C O O o m S S S e e m e h h h h G e O T. T T T.T T T.T T T T.T T.T.T T T.T.M M.M.M.M.M.M.M. M M.M.M.M.M.M.M.M M.M.M.M.M.M.M

                                                                                      . . . . . . . .                                                                   . .                                   .                                        .                    .                . . .              . . . . . . . . M.M
                                                                                                                                                                                                                                                                                                                                .       M M.M.N.N N.N N N e                     Z                       CC0000000000000000000000000000000000000000000000000000000000 e

e e H e W e 2 e e a MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMTTTTTTTTTTTTTTTTTTT Ga 00000000000000000000000000000000@@O0000000000000000000000000 i 6 e e e a e e e 8 e e e i l 4 8 e l e e 8 e i e i e e i l e e G l i e i s 9 i e e I ee e i ea e e e i e 6 e t i a e=W WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW ewe =hWNOOO=MmeNNNSWM=SeeSO=MGSMmMNMSGM-SmS$WNGWeTWhTTNTWNMNTehe ese TSW=hM9dahMOGMSGMOGMONWNSGM=eGMmeGTNShWM=WWGNS=MGONGOTSTSTOG eW> N===OCS9eseehh6999WWWTTTMMMMMMNN====OOOOO9mWM=OGGTMaceGWMN=S e e e O N. N - N - N.

                                                                                                         * -N*N*= *= -= =          * =      * =* =* =*=*= -= *                                              ==        * ** =** ** =* =* =****          = = =* =** *= *= ** =*=***
                                                                                                                                                                                                                                                                               = = *= *= =
                                                                                                                                                                                                                                                                                         - 9* 9-9*9 -9 *e e- e* e*e-e -e -m.*m* h->-h -m G-e O@e000000000000000000000'000000000099900000000000000000000000 e

1 W WW MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM

                        > W gas                                          090000000000000000000000000000000000000000000000000000000000 a s e s e a e a e e e e ee e e a e e e t s e e ee e i eee

• e e 6 e e e ee e se e a e ea a ee i e a e i e e i n Ok=

Wwd WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW NTGSNmNeTNOSee9=MWONNNetCmWMN===NMTGe=TeMG=GNNTONTN$meWTMMMM C3W S OWOW=GN>MeWOWNeW=hMOGMSGMSGMOmT=eWNSGT*eGM*eGM=SWTNe>WM=endM TMMMM==OOSSeeemphWGGWWTTTMMMMNNN===OOOO998SeeeemhnhGGOGGWWWW } WWW 1 1

                       > c                                           T. T.T.T.T.T. T.T.T.M. M.M.M.M.M.M.M.M.M. M.M.M. M.M.M M.M.M.M.M.M. M.M.M.M. M.M. M.M.N.N.N.N.N. N.N. N.N.N.N.N.N.N. N.N.N.                                                 .

4 > m e OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO000000000000000000000000000 WO E W G MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM 4 m @eOO0000000000000000000000000000@@e0000000000000000000000000 ae a e eeaeae e ee a e e e aae e aeeee eeea ea eee s: eeee eeaaeie e eeee i e ie e e s da O> WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW Seekkhm>GGGGGGNhhhkeseSece=NNMTW99meGe=NTWWheO=NTWheONMWheON w OSehWWTMN=O@e>WWWMN=OSemh6WTMN=OSehGWWTMNaOSeeMGWTMNN=Opem>G WW WTTTTTTTTTTMMMMMMMMMMNNNNNNNNNNN===========99000000000039999 WW W N.N.N.N.N.N.N.N.N.N.N N.N.N N.N.N.N.N.N.N. N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N N.*. *.*.*.*. W @@@OO0000000000000000000000000090900000000000000000000000000 e o e e H e W MMMMMMMMMMMMMMMMMMMMMMMMMMMMMTTTT9999T999T9999999999999999TT e 3 000000000000000000000000000000000000000000000000000000000000 e = es a ea e e ea a ea e e a e s a e e ea ee eeee e ea eie aa e e oa e ea a a ea se e e i ea i e s

                       **J                                         WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW
                       *>                                         W=hW=OceeSONTMOTSM9p*eWM*OSeeTOOT=NmWGOeSM**TOS=WN*WeddhahGN
                       #wW                                        WNeWNSGNSGeweWMOmWNOeWM-SmWMOeSO=MWmOMh0TSTSTOWNSONSGTNOSMGW eEW eW3 mh899WWWTTTTMMMMNNNN====OOOOOeGWM*Sh6TN*SMGTMNOSMGWMN=OSMGWT e >                                         =...       ===                   . =. =.=..         = =.= .= .
                                                                                                                                = =..= =                 = = = = = =. =.=.= .= =
                                                                                                                                                 .........                                                                                  = = = $. 9 3 9 9. e. s. e. s. s. a. m. m. m. >. >. m. h. S. G. G. G. G. G. G. G. W. W. W. W. W.

e e COOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO000000000000000000000000000 e 4 e e o e e TTTTTTTTTTTTWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW e C000030999900000000000000000000GOOOOOOOOOOOOOOOOOOOOOOOOOOOO e e e eee a eeaeesea e eae i se e s# ea e ee a e e st ae6 e e ee e eee s e e e a eeoeeiee e e sa WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW

                       *>                                         h > 9= WOGNOeeeNNO G SOeMT Nh m T S T eN=O W NGMGNNk WhMMW

• O MSM SMOONh T MWS G ew eTOMMOSMOGMOS=Th*NMSGTN===MMWe=TSNhMSTOhWNOekSWWWWWGheS=MWMC og MMMNNN===OOOmWNemTNOMWM-ShWM=SeGTM=ce>GTMN=SehWWWMN=OSeeNOWW e9 e =.= ........... = = = = = = = = = = 9. S. S. e. e. e. e. >. >. m m. >. G G. G. G. G. W. W. W. W. W. W. W. T. T. T. T. T. T. T. M. M. M. M M.. M. . . . . . . M. M. M M. N. N. N N N N e 000000000000000000000000000000000050000000000000000000000000 e

e e esseemeOSSSSSSSSSSSOOOOOOOOOOO*==========NNNNNNNNNNNMMMMMMMM

                                                                  ===================MNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN i sa6 ee1 el e4 8 ei6 eist eiee                                                                                                                                           eI 6 eeI t ee5 4 ee1 6 6 e6 4 I eiI e6 eieeee8 1 et i

• WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW w

WSMOTTTOTG=N==NONTMNGOSTOWWOWWOGOGhem=9deeOSM*GOGMSOMGSOTWNN NGmadgeTMMTSTWOMm>MmeSW*MmMGGN=MONeOW=TW=Te=SGeT9MT=eMNOMGhe

                            -                                     WG999WNeveWTGSMSGNOMmWTGSMSWNOMhTTWSMSGNONSTMWeMSWNO=GMMeeMe T. M. N N. =. =. =. =. e. G.e W. T M. N. N. =. =. =. =. e. G. W. T. M. N. N. =e =. *. =. e G. W. T. M. N. N. =.
                                                                                                  .                                                                                                                                                            e                                         e  =. =. =. e. G. W. T. R. M N. =. =. =. =. e. G. W.

CO0000000000000000000000000000000000000000000000000000000000

                                         =

M 000000000000000000000000000000000000000000000000000000000000 pg * .N. - M T. W.... Gm. e O O. =. N. M. T. W. G. . h..e.. 9 0 = N M. T. W. G. N S. 9 0. =. N. M. T. W. O. M. S 9 0. =. N.. M.

                                                                                                                                                                                                                                                     .                                                             . . T. W. G. m.  . .e. S. O = N M T. W. G. m w

I emesseeeeOSSSSSSSSSOCOCOOOOOO==========NNNNNNNNNNMMMMMMMMMMT.

                                                                   ***================NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNhNN

_ _ _ _ _ _ . _ _ _ _ _ _ _ _ _ _ _ _ _ _ - - _ _ - - - _ _ ~ 289

• l l

a A m2

10. N M T c @ h e m O

• N m T c @ h e m c00000000000000000000000000000000000000000000000000000000000 t- * <>* ~ = N* m **~~T -4 @ h e m c = N M T 4 W h a. m Q - N M T 4 @ h e m O = N m- T- -c @ h e m e I lT T T T g T T T T d @ d d @ c d d e d @ @ @ @ @ @ @ @ @ @ h h h h h h h h h h" e c e m m e' m a g e m o m m m m m m m m C

          =
              ,NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNm e      A e      a e      Z j e     = ;                                                                                                                                                                                                                     i e      =  l e

o=W ,mmmmmMmMmmmmMmMmmmmMenMmMMmmmMmmmmmmmmmmmmmmmMmmMmmMmmmmmmmm e=A e=3 000000000000000Q000Q0000000000000Q000000000Q00000Q0000000000 eieinsisieseieieisieseeoeieastitiseisisiinie i e . i . . . . . . . e3 ece WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW

                 =m>@TMmNNNMMT@hm=Mme=The@SMhNNNNNSMmmaeTeeWNe>TNoe@wM=QSh@d@

eeQ e

                @M=mhcM=ShcM-shcTNochemNQehdTNammedMN=meh@TM*CSehdTMNaceh@@T
                @@@cccccTTTTTMMMMMMNNNNNN======COOOOOOmmmememmemememem ======

e o o NNNNNNNNNNNNNNNNN.N.NNNN.NNNNNNNNNNNNNNNN===========*====enkhhh l Z e e C0000000000000000000000000Q00000000000000000000000000000Q000. e e e W e Z e e em

         =

4 9999999TTT9TW9999T9999999999TT9TT9T999T999999T9999999999999T C000000000000000000000000000000000000Q0000000000000000000000 e=W Ieeeeeeieeisei1eeseee4e48eili1eesIe4iittttttt4Il46i$titiinet ewe WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW

                =heh=h@h=WWT>=eseemesmemmTMMvhNecTTeeteeTTweemet mesomemTcht oz2 em>         MeeM=e@TM*CeeemhhheseO=MTWeONTheNee=Te=deMh=covavemeTewmm=@N e@mTM= Ope >@TMN=cesh@cWWMN=CCeemWWmTTMNN=OcemeemeWedTTmmNNN==

e e e o @ @ e. W. @. @. e c c. W. W. m. c. W. W. m. T .T .T.. T.

                                                                                                                . .v . v..v.w. T. T. T. T.  . .M.   . . M.M. M.          . .M        . M.  . .M        . M.M . . .M M M M M N N e      O    C00000000000000000000000000000000000000000000000000000000000 e      Z e

m W d

  >      W    MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMmmmMMM CC000000000000000000000000000000000000000000000000000000000Q M*E s>=            e e I e e 4 e s I e e a e e a e e ee i 1 e e e a e e e e a e e e 6 s e e e 6 ee aa a e e 4 se e i t t s i t i t t i Www          WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW MTeeme=Mee=Te=meMmNe=@NhMeTOmmoencemNomeTNoah@mMNN=Ocemesese 3

03W =m>cM=ceeWM=emeWMece>@TNamendTM=cehWWTN=cesecTMN=OmehcTMN=Om WTTTTTTMMMMMNNNNNNN======CCCCCOOommemmemmeseemeesehhhhhhhhh WMW = m 3 N. .N.. .N N. N N N. .N. . .N.. .N.

                                                              . . N. . .N . .N N N. N N N N. N N N N. N N N. N. N. .N.N.                 .                            . . . N.       . . . N.. .N.. .=.. =. =. =. =. =. =.

4 > E e C0000000000000000000000000000000000000000000000000000000000C WO E W Q 4 MnMMMMnMMMMMMMMMnMMMMMMMmMMMMMMMMMMMMMMMmMMMMMMmmMMMMMmMmmmm

 >           00000000000000000000000Q000000000000000000000000000000000000 s ee         e i e e ea ai se I t e ae e i e e a e a s ee e e a e i e a a eaeiea I n a eea e i eie 6 6 e e e i Tm Om          WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW Twee=MeeONTes=MmeompeOMeeOmes=#NoMemNee=TNOMWOMeOM@CMNOTh=#m w

Me WWMNN=OmmeheWWTMNN=OmeSh@@WWMMN==ceeemeccTTMNN=Comesh@We#TMN We e m e e e e e e e e.e e e e e e e e e e m m m h h h h h h h m m m h e.s.e W ======================= ese@WWWWWeemccomecdede m ..=.=.=.=.=.=.=....=.=.=.=.=a=e=.=e=.=.=.=.=.=.=e=.=.=.=.=e=.=..

                                                                                                                     . . .    . . ... . . . . . . . . . . . . e . . s .

A C000Q000000000Q000000000000000000000000000000000000000000000. e e o e A e W 999T999999999999999T999999999T99999999999T9T9999999999T99T99 e Z C00000000000D00000000000000000000000000000000000000000000000 e = sa e e e e e e e i e it e ee es e a e i 6 ee e e I e ee a e ee aa aa e e e ee ae i a a e e a e e s i e e a e ead em WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW OmMmMemeemeMeeWWm=@M*C=MWah@MMWeeMeWMN=NMemmeWNOmeme=Mhad=hM ewW WTTTTT@nemeO*MWheNTh0MWONeeMm=ceMcNMNmMhNNNemem=WNeT=hMoemme eSA eM3 MN=OmahecTMMN=CemenWWWTMMN==COmeehmeWWWTTMMNN===Ocemeseekh@@ e w d c.@.@.T.T.T.T.T.T.T.T.T.T.T.M.M.M

                 .                                                 e    M.M.M.M M.M.M.M.M.M.M.M.N.N
                                                                               .                            e e             N N.N.N.N.N.N.N N.N N.N.N.N
                                                                                                                                  . .                                                    N.N.N N.*.=.=.=.=.=.=.=.=.=.

e e C00000000000000000000000000000000000000000000000000000000000 e C e e o e e i

 +           @mee@@@e0@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

e C00000000000000000000000000000Q00000000000000000000000000000 e a e e e a e e a ae ae i e a e e e a e e e e s i e e e e a e i e e ee I s I e e s e a e e i e i e a e e i e I e e em WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW e> ew meeMWOveMmNo.ONechTMmeseTemNacQemeO=evemONOTpONechseeTvecche WThahechosame mNmMSTOWNST*hT=eWNONTONeNemMaceeO=NehCTeMSMSGNm

• oa

 .g          T M N N = = O 9. m. e. e. m.> W===========.m. e d c T T T M M N N N = = = O.O.O m W M O m e n c e @ T h e m e T N o e m d M N O e h e W M e           NNNN. . . . NNN.* + . .    . . . . . . . . . * . . *.. * * . .. . .                         p e.e.m.e.s.s.a.m.m.>.>.g
                                                                                                           .                                   . .e.o.g. . g g e.c.e c c.c.T T T T T - .                  - - -

o e C00000000000000000000000000000000000000000000000000000000000-e o MMMTTTTTTTTTwmcccemececW9ecesseeeGe>>>hhhhmkhheeeeeeeeeeemme NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN 4 6 S I t e9 1 1 4 I t s eaeI I I eeI eB 4 eeI et i e1 1 3 4 4 6 I I I 8 0 e8 4 I e6 1 1 eI eit 1 9 6 e a

     >       WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW ehMmhCeewmeceN>eceNMemmeemO=TNM*=NomeMMM*=Tm==MeeMNe=eTON==e w
     =

NMON e T NO T oe= N eeMOSeN e mO = h omeemem T ee cT T NMMeWNe Q Me e W OO W M-h e @ M T cNQacMMeeMemNSOMMNTSNepNSOWNNWeNeTheeTNNTNNeTN>eM*NTmNeT=@eM

             =.= .* e. e c .T M. N. N. =. =. =. S. e. @. @. T. M. N. N. =. =.=.S.. e..e. .c T M. N N. =. =. =. a. m. @. p T. M.
                        . ..                                                                                                     . .N. N. =. =. =. e. m e. W. W. M. N N.                  .
                                                                                                                                                                                              =. =. *. m. >. @.

C00000000000000000000000000000000000000000000000000000000000 i a m C00000000000000000000000000000000000000000000000000000000000 wg - .N. . .M

                        . T. m e h e. m...O.=. N M T. @..@.      . . m
                                                                     . . e e. C =. N M T. c. W. h .e. N s.
                                                                                                          . M.O.

e. m e h e m. O . N M. T. m. @. m e m. .O.

                                                                                                                    . . . .            .                 . .                      N. M . . T e. e. m e. m. Q. .

I TTTTTTTTT@@dd@dWWW@@@@@@@@@@@hmmhhhhhhhemememegememppmeme@mO w NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNhNNNNM

MO I l a

                                                                           'Q00000000000000000000000000000000000000000000000C00000000000
                                                           =Z A       .NmTc@heeQ=NmTcche@c=NMT4@hemo-NmeccheSQ=NmTo@heec=NmT4@haSQ I       C O O O O O O O O = = = = = = = = = = N N N N N N N N N N m m M m m m m m m m e w' w w w w w w w' w' c e c c a c c c c c @

mMmmmmMmMmmmmmmmmMmMmmmmMmmmmmmMmmmmMmmMmmmmmmmmmmmmmmmmmmmm e A e a a e z l e = t e s i e immmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmMmmmmmmmmmmmmmmmmmmmmmmm eam C 0 0e i0. 0 0 C 0 0 0,e0e0.0i0e0e0e0e0e0e0e0e0s0e0e0e0e0e0e0a0e0e0e0s0i0e0e0a0e0eQe 0e 0e 0e 0e 0i 0e 0e 0e 0s 0e 0e 0e 0e 0s 0i 0i 0n 0 0 0 e=m e s ewo WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWwwwWwW e3= wTmemMmmmmwwccWheeO=NecmeQNweeQNT@e-MWe.wceNce=Th=ghown.TeNo ece mN=cesh@dTMN=OSehe@cwMNaccee>@@@TmNN=OSeeh@ecT9mMN=COSeeh@@c emo e h N N h @ @ @ @ @ @ c. e. @= @.

                                                                             ........=.                                               . . @. @. d. @ @..=         d d. d. @. @. @. d. T T        . .T .v=.T .T T. .T .T .w T.= T M. M. M M. M. M.                 . M. M. M. M. M. M M. m. m. N. N e                 C            . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

e E C00000000000000000000000000000000000000000000000000000000000 e e e e e W e E e = wwwevTTTwwwwwwwwwwwTTTwwTvwwTwwwwTTTTwemecccccccccccmecccccc e J 0000000000000000000000000000000000000000000000000000C0000000 ea e>W e e e e a e e e e e a e e e e e e a e e i e s e e a e a e e e e e e e e e a ee e e e e e e e e a e e e e e e e e e : WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW ewM NNNNe@eMmmedNQemMNemaghadeTOeMQmdMN===M=Nmeewmc=ONe@hNem=Wem eg3 eToeNew=hwCNT->w=emMONWNeeWNe>@NCeeTNO=NMWee=ThacememeTQMmch ee> cocem m m e e N N N. =. m==== ==== = ggggggggggemmmmmmm

                                                                                                . .. .e. m.
                                                                                                         . . e.
                                                                                                              . . .. m
                                                                                                                     . .h . e. .c. e. m.
                                                                                                                                      . . .e. d.T. . .T T .w M. M. M N N N N. = == == == = C C C Q o m e w N o c h e M N Q e m e T N = Q e >

e O . . . e . . . . e C00000000000000000000000000000000000000000000000000000000000 e C e E e W WM MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMeimMmmmmmmm

                                                 > W                        0 0 0 0 0 0 Q 0 C 0 0 0 0 0 0 0 0 0 0 0 0 2 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0. . e 0 0 0 0 0 0 0 0 0 mag                           e e e e e a e e e e e e e e e e e e e e e e e e e e e a e e e e i e a t e e e e e e s ee e e ee i                                                             s a e e e e e e e ON=                         WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW www                         meQC=NNMemeseONmemeONedeOMemONWMCMmeatmCMeOncemeCMk-weNeOMm=

3 emmeewmNecommmeewMNN=cememeedwmMN=cemenhemeWMNN==OSeehhe@@TT COW www G. e. d. e. c. .e m.............

e. c e d e n d c W W W W m m. ===================

e. =T T T 9 4 T T T T T T T T M M M M M M M M. M M M M. M. M.. M. N N .N.N N. N. N N N. N n O . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...............=.=.=.....=.=.=....=....

4 > E e C00000000000000000000000000000000000000000000000000000000000 W O E W O mmMMMmMMMMMMMMenMMMMMnnnMMMMMMMMMMMMMMMMMMMMMnmMMMmnMmmmmmmm 4 000000000000000000000000000000000000000000000000000000000000

                                               >                             a : s e e eae e e e e e e e a e eae e i eee a e o e e e eea e e ee e a eeeeee e e ee e a e e e e e e e e sa                         WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW Om                          NWeMecTENeeMMadeMSNWOweMhacOweMhNe=WOvemenhNh=e=eacomCWCWOcQ WW w                 N=QQSeehheWWTTMNN==OO9eekmeeWTTMMNN==OmeeemmeemewTmmNN==Ocee We                          W       W e n W T T T T w T==========
                                                                            =====================                  T T T T T T T T T T M. M M M M M M M M M M M.w=M M M. =M Mwe====                    N. N N N N N N N. N.========   N. N. N N  == N N N N N N N. = =

m . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. . . . . . . . . . . . . . M 000000000000000000000000000000000000000000000000000000000000 e o e e e e W 99TeTWTewwwTwwwvTTTTTTTWvecepWWWedmeddeWecededeemeceedmedmec

• Z C0000000000000000000000000000000000000000000000000000000000Q e = s e e e e a e e a e e e e e e e e e e# t e e ea e e e a e a e e s e e e e oe e eo e e e e e e e a e a e e e e e e e ead WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW

                                               #>                          *eenhmSQNmeNe=WNSWNosemwT=GeeWTeTWeWeemWhMO= woe =W=O*WOeSe@Na owW                         MeeMONTNeeMaeeMaeWTNemeM=TTdeeONme=W9meMSTOWNemMOSWTN=ememhh
                                               *EW                         cemmcTTTMMMMNNNN====COcocemeMaceeTMaeseWMNameseTMacemmdemN=0 ems                         =. =. =. =. =         = .= .=.=. =. =. =. = = .= .=.=. =. =. =. =   = .= .=.= g g 3 3 3. g e. g. g. g. g. >       > .> .>.m. m e =                                           . .                     . .                     . .                                          . .            . .m.g
                                                                                                                                                                                                              . ..g.g. g. g. g   . e.g
                                                                                                                                                                                                                                   . . c.
                                                                                                                                                                                                                                        . .c c.c c @ @ @ c.

e e C00000000000000000000000000000000000000000000000000000000000 e e o e o e e ececceeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeechhhhhhhhh e Q00000000000000000000000000000000000000000000000000000000000 e a e a e e eee e e e e e e e e e e ea e e e e e e e e a e e s e a e e e e e e e e a e e e e e e a e e e a e a e e e em WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW e> NO=cewome=>m>Chee@@MNTNMOSOMMNOSe=TeW=Ses*TeMemMNNNeheTS=Qes aw meM=Omememec=MeesondeNeeMemmeveMegevoe=>MOeNacNeeMOMWWNeNSTa e5 N=OmmecTMN==Ome>@eWTMMN==CommemkeemenWTMMMNN===CCQome=Se#=eh so T. T . .T. .M M.M M.M.M.M.M.M.M M.N.N.N.N.N.N.N.N.N.N.N.N.N e . e . * = . =. =. =.=.=.= *= .= .==.=. =e =. =.=.= .= .= . == . =

                                                                                                                                                                                                                                    . =. =. e.3.8 .e .3e- e* m  . >.

• C00000000000000000000000000000000000000000000000000000000000 e

e e meeseemeCOOOOOOOOOO===========NNNNNNNNNNNMMMMMMMMMMMWTTTTTTT NNNNNNNMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM e eee et i ea e e e e e e ee e i 6 e e e e e eeeeeee e e e eeei eeeeea e eeeeI e a e i e e e a e a WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW

                                                         >                 m==O*=eM9MahOeQchSTecTOe=C#TeemeeNSWON=>heNNmeNoWemesseeme=Q w                  ThewNOmeshCOWmMOSTN==ch0MQehmeWWOMMOsmeMckOWeTeecT=TOvacacTW
                                                         =                 ==MNNeTechM==MmNhT=@mNomMN=mT=TONOOMW=>T=MW=eCNeamT=Mc=eONW=

e. q .M. N. N. =. =. =. S. h e. @. T. M

                                                                                                              .          . . N N. =. =. =. e. >. W. @. T. M. N. . N .= .= =
                                                                                                                                                                           . e. m. e. @. T. M. N. N. =. =. =. e. m. e. T.. T M. N. N. =. =. = e. >. @. . .T. T
                                                                                                                                                                                                                                                             . M N N 000000000000000000000000000000000000000000000000000000000000.

a CC0000000000000000000000000000000000000000000000000000000000 d

                                                         >g                 * .N. M  . .T.m  . . e N e. S. Q =. N M w e e. n e m. o. . N. M. T. e. e.
                                                                                                                           .                                 . .m. e
                                                                                                                                                                   . .S.O . .= N M v c. W. h e. e. C .=..
                                                                                                                                                                                               .          N .M.e c. W. h e e. O. =. N. M
                                                                                                                                                                                                                             . .               . T. @. .e. .m. e S. O I       COOOOOOOC==========NNNNNNNNNNMMMMMMMMMmTTTwweTTTwodd@@de@dde w        MmmmmmMMMMMMMMMMMMMMMMMMMMmmmMMMMMMMMMMMMMmmmmmmMMMMmmmMMMMM

391

               ,1 a

l A CC0000000000000000000000000000000000000000000000000000000000

                - N m T. c @ m o. g C = N M. T c. @. m e p O.

mz . . . . . . . . . . . . N M. T.

                                                                                                         . .4.@ m e. g C.=.N. m                                . T
                                                                                                                                                                 . c. @. m. W. .@
                                                                                                                                                                                . .@. .=
                                                                                                                                                                                       . N M w e. @. .m          .

e. g C = N M T 4 @ m e m o i

)  : w

                @@@@@@@@@mmmmmmm==meeeeeeeeeemmememgemmOOOOOOOOCC==========%.                                                                                                                                                                                             >

I mmmmMMMMMMMMMmmMmmmmMMMmmmmmmmmmmmmmMMMTTTTTTTTTTTTTTTTTTTTT ] l >

    .e     .  .i e      z e                                                                                                                                                                                                                                                          1 e      -

e . e I eaW mMmenMmmmmmmmmmmMnMMMmMMMnMMMMnMMMMMMMMMMMmmenmWTweTTTTTTTTT C00000000000000000000000000000000000000000000000000000000000 eme e s e i e e e e a e e e e e i e a s e e e e e=3 e e e a i e e e e a e s e e e e i e e e a s e e i e i e i n n i e e e WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW i e3m amm=cemm=mpTeN@=coveMemmNmM@=@=@ @~@=@NmNmmemeTememTOWNecNe@ eOS. TTmmN==COm emg .....--. . . == e N. N. =. N N..N. N. . . .N

                                                          . .N
                                                             . = N.
                                                                 = = .= e.
                                                                        = =e= =m= m               . . .@

C O.@O.dO.W . O. T O O. m.O.M = N. O. O ON.

                                                                                                                                                                    .==       * *=

O .O O O.mCO.OO--S OO e Oe @ e@ mem e e@m a@ d@ mdW c @W v WmmMN e c . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . = g e.g e.g g e m.a.g e m e e 3 e 000000000000000000000000000000000000000000000000000000000CC0 e e A e W-e 2 - e = meeWWWWWWWWWWWWWeWWWWWWWWWWWWWeemWWWWWWWWWWWWeWWccWWecWedede-e em J CC0000000000000000000000000000000000000000000000000000000000 e e i e e e e I e s 8 8 0 e i e e e e i e e e e e e 4 a t I e e 4 9 e e i I t eeeI t 4 4 e e i 1 e s I t a 1 4 e i l eNW ewe WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW SM=NTSmeeNSWWhamTTWGNSGGm8999mWGSMeTN==MWOTOGTMMTG9NmMgGTMMT

    *E3 eA>        TNOGOTMN==COOO==NMWWMSONTGG=TmOMOOMm*WSMm=GOWOWOWOWa@NmMSc=>

MN=SenGWTMN=OsenGmTMN==O9emmGWWTMMM.=OSSeemmWG@@TTMMNN==COOg e e g e G.G.G.W.W.W.W.W.W.W.W.W.W.T T.T.T.T.T.T.T.T.T.T.M.M.M.M.M.M.M.M M.M M.M.M.M.N.N.N.N.N.N

                                                                 .                                                                                           . .                             . .                     . .          . N.N .N.N.N. . .       N N.N.N.N N.N.

e 0 @c000000000000000000000000000000@O00000000000000000000000000 e 2 e H W W MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMTTTTTTTTTTTTTT

    > W @cc000000000000000000000000000000000000000000000000000000000 s=3          i e a e a e i ee e ie e e i e a e e eie i e : e eaas a i ea e e a : a ea s # # e e s e e a a a e e e e i s e e 3>.

WwJ WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW WOTeNG=WSeeNm=G=WOWSTATSTSMGMST999TSWCWOGamMGMWOGNeT=SWNSmWM S MMN=*OOSeem>GGWWTTMNNp=CO99eem>GGWWTTTMMNN==OOSWedO@NmMSTOGN 03W Wew N. N. .N .. N N .N .M . .= .= .= .= .= .= .= .= .= .= .= .=. .= ...=......

                                                                                                                 .= = .=...                   OO          = .O O O O O O O .O O O         . O .O O .O .O O c. c e s s e m e N a @ @ m W W T T
   > 3           . .... . . . . . . . .. ... . . . . . . . . . . . . .. ..... . . . . . ...                                                                                                   . .- .g .3.3. g 3 3 3 3 3 3 3 3 3. g                       .

4 m E S OOO000000000000000000000000000000000000000000000000000000000 WO E W 4 MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMTTTTTTTTTTTTTTTTTTT

   >          000000000000000000000000000000000000000000000000000000000000 eee i es e e e ae s i a e ee e ee e eeaeea eeeeeee ea e aaeoeee ee i e e ae e e a s e a e s e da Om WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW WOWOW=$=GanNmmeMSW9dOGa>NSMSWOG=>MSTOG** MSS $W9MMNN==NNNMT@GN w

me e. e. m. >....... G G W. W

                                           ... TT   = M. M N. N = = O. O p e s e e m m O G W W W T T M M N N N = = C O S T O W N e T O G N S T O G N O T O G We         ..................C@C.00000000000C.                           .. = O O. O                   . .O. . .O. O O O .S. S S e e m m m W G W W W T T M M M N
                                                                                                                                                                               =.-333333.g333333333333 m             . .. . . . . . . . . . . . .. . . . . . . . . .... . . . e . . ... .                                                                                           . . .                             .

M CO0000000000000000000000000000000000000000000000000000000000 e e e e M

• W WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWecccmemcedede o E C00000000000000000000000000090000000000000000000000000000000 e = ee e eee e e ea e e a e ea eeee e e e eeee eoeeeea e a e a s e eaeasee e s : e e i e e e i e e a

   **J        WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW ek         =TeWMMWeMOSSOMeWoO=MGOGM=O*MGOW=eGGGNOMmNSTNOS$ONTmadamMOsm@

ewW mmmeScaNTGmeNTGSNWe=TS*WOMm=WOT9MGMGMSTSWOGNOMSGNST=mTOmWOmW

   *EM        SemSWeTMN=ceSemWWWTTMNN=OOSGeem8962TTMMNNN==CO90eseemmmWGGW@

eW3 e > T.T.T.T. T.T. T.T.T.T. T. M.M.M.M.M.M.M.M.M.M.M.M.M.M.M.N.N. N.N.N. N.N.N.N.N.N.N.N.N.N.N.N. N.N.N.=.=.=.=.=.=.=.=.=.=.=.=.=.=. O G CO0000000000000000000000000000000000000000000000000000000000

• O e

e e e e mmmmmmmmmmmmmmmm>>mmm>>mmmmmmmmmmmmmmmmmmmmmmm%mmmmm>>=mmmmm o C00000000000000000000000000000000000000000000000000000000000 e ee i ee se i eeeea a eeaeeeeisa s e e e eia e a e a e ee e eae: e s ee e e e e e a e e e e e e e em WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW e> T=$@@NGNeGWW ew S T G W m G = = G G = C W M G T W O O N e e N S S N e m S T N M T O F* m O T = C = M e W M M W S. 9 = W O G = G N m M $ d memmmeONem=ceTOW=eTNSmWTMMMMMMTWGGS=TGSNWe=WSMm es TNeeGTMaemSTNamencTM-09e>GWTMNacgemmWWTTMNN=OcessemmWGWWTTMM e@ e m. m . .m S.G. G.G.G.W. W. W.W.W.W.T.T.T.T.T.T.T.T.M.M.M.M. M.M.M.M.M.M.N.N.N.N.N. N.N..N.N.N.N N.N.N.=.=.=.=.=.=.=.=.=.=. =.= =.=. e C00000000000000000000000000000000000000000000000000000000000 e e e TTTWWWWWWWWWWWGGGGGGGGGGGmmmmmmmmmmmeeeeeeeeeeeSeSeSeesemeOO MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMTT eeI eeeaeeee eeeeeea e ee aeea e eeeeeeae eeeeeI eee eI ese eeee i e e et # # I

• WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW

      >      WGOOO**ST=WNSNNmSWOONOSGMTON90$NMmWWWWSM=NMSTWmO=TSMSTNNWeTm w      MOTTSmMGMNNNOMMMMOG=COOSNOceTMeeOSm=MMM=cegmeGOmmemmMTWheSO*

• NT*MTOS$NewmM*=TOSSNG=mM*=MSGS=WOSM*OMSSS=WOGM*SNeme=WOGMOSN

              * .* .* S.
                      . m. O. T. M. M. M. N. =. =. =. .S. M G. T. M. M. N. N. =. =. =. 9 m. W. T. M. M.       .                                                           N. N. =. =. . $. m W T. M. M N. N. *. *. =.. e.
                                                                                                                                                                                                                                    . . W. T M. M. N N = = = e >

CC0000000000000000000000000000000000000000000000000000000000 a C00000000000000000000000000000000000000000000000000000000000 A kg =. N.M. . .. T d. @ m e m. O = N M. T c. .G. m e. m. O. =. N. M. T.c...e m . .e ... p O = N M. T. c. e. m e.. S. O. =. N M. .T. c. @. m .e. m. O. = N M. T. c. @ m e @. @

• Z @@@@@@@@@mmmmmmmmmmeeeeeeeeeemmee99990m0000000000=========~N w MMMMMMMMMMMMMMMMMMMMMMMM9MMMMMMMMMMMMMMTTTTTTTTTTTTTTTTTTTTT

i i 192

                                          =

00 A '0. C 0 0 0 0 0 0 0 0 0 0 0 0, c @ 0. .0.C. .C 0 C 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0,4 000000 @hmeC ,

                                       =g        N M e c. @.m e m.O.
                                                    . . .             . .          .N M . . . h e s c =. N M e d @ h e m O.
                                                                                      . .                        4   . . . . . .            .N .M. T. @
                                                                                                                                                         . *. e. s O. . N. M   . .T. @
                                                                                                                                                                                     . .@ . .m e e O = N M4 1

l I I

                                          -  N   N, N N N N N N e wwwwwwwwwe,w               N M M M M M M M M M M e w wewww,,ewewww.wwwv.,v,,w,,,ewwwe ewwTvw                                   w T w w w w e d d e d @ @ @ d @ @ @ @ @ @ @ @ @ @ @ @ h m k hwh, h,w,,                                     h h. h a g j
                                    . a e     a e     3 e      =
                                   . =

e eaW wwwewwwwwwwewwwwwwwwwwwwwwwwwwwwwwwwww.wwwwwwegwwwwewwe,wwwe e=W C00000000000000000000000000000000000000000000000000000000000 i s e e . e ieeeeeeeaeeeeeeaoeeeseeeeeeeeeeeeeeeeasaeeeeeieniissi ewm WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW e3m game @meMNNNNNMMemmeONwWeNee-weMSOweveesweeNew=hwaeeMee@whame eme Nemec=hmee-mMem=hMe@NeTohMSGNemaewohMOWMo@Me@Me@Me@MC@Mohwom eMO WMMNNN==COOppesemmWWWWWWTTMMMNNN===CO e e O m.a m m.e m e.s p e e.e e.e e.e.e.e

                                                  - . - -                  . - . -                . -e e e
                                                                                                       - -e e e.e.e e.e.e e.e e e e.e e e.e.O

9. 9. 0. s.e-n.h.h.@

e.mmmmmmmmmmmhammham*>mh @@decove-MMMN

                                                                                                                                                                                             - - . - . . . - + . . . .

e E e C00000000000000000000000000000000000000000000000000000000000-e e A e W e Z e = ddecWWWWWWWWWWWWWe@@cWWWWWWWWmmWWWWWWeeGWWWWW@@@@@@@@@@@@@@@ e em J C00000000000000000000000000000000000000000000000000000000000 e e e e e e e e a e e e e e e s e e e e e a e e e e e e e ee e e e e e : e a e e ee s e a e e e e e s e e e : e a e e enW WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW e=W WhCMeMemNe>@GemeONWeNmMhMOOWacemmhCGN=SCTMweheMOOTO9=dMNce>@ e53 een MSGNSW=ed=SWNSOMaeWNONWNoeWM=eGwNOhmeO=wSSNeeMeMcMev=hwae@Ma e g s. e e s h m m e e W W W e e v v w M 6 M M N N N N = = = = C O O c c e s e M a s h W e N o c h e T M - 0 9 h @ @ M N = O e O - =. =. = =. =. =. =. =. =. =. =. =. =. =. =. =. =. =. =. =. = =. =. =. =* =* =. =. =. =. =. =. =. e. s. .e. g e. e. . g e. m. e s. . h. m.

                                                                                                                                                                                               * .m .m.m...

m m. e.

                                                                                                                                                                                                                - g. g.g g g g g e        C00000000000000000000000000000000000000000000000000000000000

• O e E e

W W W wwwwwwwwwwwwwwwwwwwwevwwwwwwwwevewwwwwwwwwwevewwwwwwwwweggve

                                   > W C00000000000000000000000000000000000000000000000000000000000 a=E       e e e e e e e e sa s ee e e e e e e e e e e ee a e                                     e eee e e s            e e e e eae ee e l a e e a ee a e e e e e e 3mm wwd WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW NOmemmmmmmeseOMMWhe=weeNWeNeOweMcMeMewec=>wohMOeWNoeWMNoemem C3W 3     eveWahMcW=>MeeNevCeMeW=evo>MeeNeWNeW=ew=ew-eT=ew=emamWNecNe@

WWW MMNNN==OccesseemmmWWWWWewwMMMNN===OccommememmheceWWeetwMMMNN

                                   > 3      e.p e.c. e a. s. e. e.e.e. e e. e. e.e e e. e e. e. e. e. e.e. e.e. e. e.e.e.e. e.e. e. e.

e. m m.>. >.>.>. >.>.m m m m m.m m m m m. m m. m m m 4 m g e C00000000000000000000000000000000000000000000000000000000000.

W C E W Q owevvvegvewwwwwevewwwwwwwTwevwwwwwwwwwvTewwwwwgewwTwwwwwwwww 4

                                   >        000000000000000000000000000000000000000000000000000000000000 eoe e e ae aea e e e eee e e ae e ee ee a e eeee e ee a ee ee ee ea eae e ee e e oe e ee a e e e da On usWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW SONTWeawWSNWSNSOTeN9=90W=e=>                                                       met =MMOGMOmWNONWMammWWMN=OeSemeh w     WSWehMOONep*mwCMMeWNSWNedeeT=mT=hf=>w=hwaeT*ed*eWNeWMOGMONT=

WW N = = = COOSem es h m>99mme w T T MMMNNN== =Os3OSe se gehhh eSWWW W T T T T MMMNN N WW W 9 9 9 9. e. s. e. e. e. e e. e. e. e. e.e. e e. e.e. e e. e.e. e. e.e. e.e. e.e. e. s.s4. e.m.m.m. >..>.>.h

                                                                              .                 .        .                                                                   h. m.*. >.m .m. m    m.. m
                                                                                                                                                                                                . .   . .m. m
                                                                                                                                                                                                            . m
                                                                                                                                                                                                              . .m. m . h h h h W        C00000000000000000000000000000000@c0000000000000000000000000 e

e e o W e e E W WWecWWWWemWWWWWWWWWWWWWWWWWWWWW9999999999999999999@@@@@@@@@@ e = C00000000000000000000000000000000000000000000000000000000000 e e a ea aaeeaeoe eee eeee ea eeee eeea eee eaeaa eeeeaeeae e e a eeee e ee e e e eaJ em WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW WGheOMeeMememacGTN=OceM*Nmeede>MNwCSOT*=wehe=mmeeM=ON@ NOON @N ewW *emMCMw=eOT=SmwNOeWTN80=NMWMOMSOTeMhMSTOGNeGemehWTMN=COOOOO= eEM aW3 deTTTMMMNNNN=====COOOsS99NOGmWMNOsmWTNmOs>WwMNOcemWWeMN=OSe> e > =. =. =. =. =. =. =. =. =. =. =. =. =. =. =. =. =. =. =. =. =. g .e. s. e. s. s. e. m. p e. . e. e. m. >. >. >. >. >. >. g g. e.

                                                                                                                                                                           . o. g e. .g .m. W. W. W. W. W. W. . pW. .p T. T. v e e e    o   C00000000000000000000000000000000000000000000000000000000000.

e e e e e khmmmhhhhhecemeGesessesseseeSeWemeseeeeeesseeG9eeeeeeOSEseme e CC0000000000000000000000000000000000000000000000000000000000 e sa ae e a e eeeee ae e ee e e eaee e e e ee eeae e e e e ae e e e e e ea e ee e e e o e e e e a e e e e WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW em GONWNeGTTwe>MecedeseeeTWNTNWM9TeMWOOM=NheeMNeemeNeheMC9=wome ew amTOMMONT=vSeNhamMOWSWWWWhe=Tm= WOW =hMOmeNOcemeG9mme8=MeneNeh ea MNNN===OOceWNOhWNeeWM=eNWM=OGGWMMommeWMN*CenWeeMN=Oppem@eWwM e@ e =..= *. *. =. =. =. =. =. =* e. e. s. e. s. e. e. S. h. m. >. >. G. G 9 9 9 9 9. W. W. W. W. C. T. T. T. T. T. T. T. T. M. M. M. M. M. M.. *M. M. M. N. N. N. N N. N N N.

                                                                                                                   .                                                                                                      6 e

e C00000000000000000000000000000000000000000000000000000000000-e e COOOOOOcc===========NNNNNNNNNNNMMMMMMMMMMMeweggewegewWmd@@m@ 99999TTT999999999T99eT999999999TTTTTTTTwT9TTeTTTTTvwTTTTTTTT eea e e aeeoeeee eee e e eeeeeeaeeeeeeeee eeeI aee ee eeeae6 6 eaee e6 ee e e a WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW

                                      >     CNTSGheWOeTm>WMmNmWNM=TNNOe>WSTesNeemOMMeewheTNWNm=WeGenOwNw w     WTw=NTWTSMWOOmeOMwMemmememe=MNmOWNMWe>CN=GTOmOMNWe=CWeWMmOOM
                                      =     She=WOSMeeaemeOWCWMON=>ONOTOGMOMOhe>OTOSMOWOWONOweGMOme@@ MOT S.w.M M N.N.=.=.=.S.m. .W T.M.M.N.N.=.=e=ee.m.W.T
                                                          .                                                        .e     M M.N. e ...N = *

• e >.W.e.M.M.N **... N = = = G.N.W.T.M.M N.=.=e=.=.S.$. @.T.M M. N. .

000000000000000000000000000000000000000000000000000000000000 a C00000000000000000000000000000000000000000000000000000000000 W mg = N. M. e. d e m e s O. =. N. M. T. c. @. m e. s. e. . N M. T O. W. h e. 9 0. =. N. M. T. @. e. m e. s. O. *. N. M.. .e .m. e. m. e. s.

                                              .             . . . . .                           .           . .                                            .                      .                                    . -O - N M. T. W. @. m e e 1  NNNNNNNNNMMMMMMMMMmwewgTewgTg@cd@@WemWW@@@@@@@@@@mmmhhmmmmme w  TTTTTTTTTTTwTTTgTTTTTTwTTTTTTTTTTTTTTTTTTTTTTTvwTTTTTTTTTTTW

_ __ _ _ _ _ _ ._ _ _ . _ _ _ ~ - _ . _ _ _ _ = _ . _ _ . _ _ _ _ . _ _ _ . _ _ _ _ _ _ _ . _ _ _ _ _ _ . __ . _ . _ . _ _ _ _ _ _ . _ _ _ _ _ _ _ _ _ _ _ . . _ _ _ _ . _ _ _ _ _ _ - _ _ , _ _ _ _ _ _ . _ _ 393

• a 00000000000000000000000000000000000000000000000000000000000

                     .Ag      C.. .N.M               e .c ...
                                                   . .    @h  . .e .m. O. .* . N.M. e          . .c .e .m. e. e. .O.=. N M e c @ m e m. O. .* .N.M. .e .c .d.h. e m. O
                                                                                                                                                                                                                                                                                                         -MmecWhemO-NMe wI seeeeeeeeeeemessmeeOOOOCCOOOO*====**===NNNNNNNNNNMMMMMMMMMMe
                            ;evevegegegegevegevecccmecccccccccccccccccccccccccccccccccccc i

e e e e e 2 e =

• a e

e=W weegevevegeweveveeeeeweveweeveveveveeeveveeweveeeeeeeeeeeeev \ e=e Ce Ca a0 e0a0e0e0 0 e0 i0 40 e 0 i0 e0 e0 e0 e0 0 e 0 a 0e 0e 0 e 0 e 0 e 0 a 0 a0 e0e0e0a 0e 0a 0e 0e 0e 0e 0e 0o 0e 0e 0e 0e 0a0e0e0oe 00 i 0 e 0 e 0 e 0a 0 e0 a0i0 e0 i 0, s0i 0 e-3 e3= WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW. h@meMMMNNNMmete@meO=Me@echch0MeSmeeNeeMh*WeeeMSNhMGMeece-hme e38 e=eeNSGMOhwae@N9@M=ScNS@e=eeMOheNSGeme@M*WWMeseMOsmMOS@M=SWM eWO e- IN N = = = C O O O s o s e e c h h m > @ e s e c c e e w e e M M M N N N N = = = = O O O O S e m e s s e e m m m h @ @ @ e c h.h.h.h.h.h.h.h..h e...@. @ . .$.9

                                                                         . .@. @            . .W  .W. W W W W W e.W. e.W.W.W.W.W.W.W.W.W.W.W.W.W.W                                               .                                 . . . . .. . ..                                               W.e.G
                                                                                                                                                                                                                                                                                                    .. . .G. G.e . e
                                                                                                                                                                                                                                                                                                                   . c e c o m e c c c c c c c e - I e           C00000000000000000000000000000000000000000000000000000000000.

e, o A e W e E e = 000000000000000000000$0000000000000000000000000000000000@@@@ e s 000000000000000000000000000&OO900099000009090000000000000000 em e e e e e a e ae e ee e ae e e e e e e e e e e e e e e a ee aae e e ee e e e a e e e e e a eae e e e e e e a emW WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW owd eMeseMec e ep e = O OMh meeONe-h ee9th> MeeOOheSeNeceseheO WNeh e me es-w eg3 eeemeeMMMMMeeGmeS=Mehe**GSNeeNeeM99pSMSMh=GodNNNSMSWOONewomM em> o e emceeMM*OcenGeeMNN=OSeem$ce#MMN==SeseemmeemeeeMMNN===COSmase e o o e.m.e.e,$.c.c.e.p e.e.w.e.v e.v.e.g e.e.M.M.M.M.M.M.M.M.M.M.M.M.M.M.M.N.N.N.N.N.N N.N.N.N N.N.N.N N.N.N.N.N.N.=.=.=.*.*. e o OOOOOOOOOOOOOOOOOOOOOOOOOceOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO e E e A W d

                   > W        wwweveeeeeeeewwwweeweveeeeeeeeeeeeweveeeeeeeeeeewwevevevevee g=3 000e90000000000000990009099999899000090999999900000000000000 e e e e a e e e e e e ee a e e e e s e e e e e e e e ee e a e e sea e                                                                                ee                             eee eaeea e e e e e e i e e ee 3mm wws         WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW eMNNN**==MMMMeeees-NeeeONe>OMeeNeeNGSMhacSesMONmMcMuescahmec aIW         Meme*eeNeememe=echeme=eGMemeNSGe=eeMeseMemeNemeNemeNeheMOsem Wmm NN== =OOme999eech m >> SSecessw e e MMMMNNNN == =* OOOOOOSSeesch hm m499 p    3      > ........
                                 > > > > > h > S. e. G. G. G. G. G. G. W. W. W. G. G. G                      . G. G. G. G. G. G. G. G. G. G. G. G.G. G. G. G. G. G. W. 9 9.9 .9.. p o. p p e. c. e. c. e. m. e. d. e. c. e.

4 m E e 4008e000008090000090000000080000@e99999808900000988090000000 WO E W J eweveeeeevevewwwwwevevevegegeveveeeevegegevevevevevevevevege

                  =

4 O@eO608000009000930999990006080900e00e0000999999998090000000 e e a ee ae s e e ea ea ee eeeee e ea eeeeea eeeeea e oeee8 e a e eeeeeeee e ee e e e sa WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW em m eseOSO =NMe mm EON # 99 emes = MOSMOSMm e e sNe= e9e ST SMS v e meg = = MecN e e = WM w seNOGMeecNSGMeecNSGeaseMemeNSGw=9eMacWMeseMOSemee@M*eSM=S$wM

                              *==OOOO999eseenhhSGeseece***MMMMMNNN=*==OOOOpeSeeeeemmmmeees
                 -WM w           m. .m. m. m m.             . . m. m W G. G. G.999999999999999989999                                        .          e.O. S. S.G. O. W.9 9 9 9 9.e.c.e.m.e.c.e.m.e.s.c.o.c. e.c.e.

d 6000e0000099080900000000000999990ee9000900000000990000000000 e e e e e e W #99999999999999999999999999999999999999999999999eeWeeeeeeeee e 3 e = OSSOOOOOOOOOOOSSOGOOOOOOOOSeeseeeeeeeeGOSeteOOOOOeeOOOOceOOO a e : a e ee eeiae a e ee e ea e ae eeee e aea e eeeee ee e eee e e eeaea eae e ee e e e s sad WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW em SGOMetNNMcGeN==NWS9*SOSOhephM*Se=MSOeOmeM*=NMee=G=GMONGeeece awW =NemeeON T O Se e > OMOSMmet emm = Geegetees eeNmMee=>MesNee wee-esN eem osm WeeMN==Oce>>GemeMNN==ecesemmeGeeveMMNN==OOOSeceshm>Geseceeve eW3 e > * ...

• w e. v. e. W. 9. M. M. M. M. M. M. M. M. M. M. M. M. M. M. N. N. N. N. N. N. N. N. N. N. N. N. N. N. N. N. N. N. N. N. N. =. =. =. =. =. *. *. *. *. *. =. =. =. =. =. =.
• O OOOOOOOOOOOOOOOOOOOOOSeeSOOOOOOeO999999000000000000000000000 e

e o e e e e seeeeeeeeeeeeeeeeeeeeeeeeeeeepopsspappasseSegeSSeaposeppppSe e COOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOe000000000000000000000000000 e eeesi aeeaeeea ee e e eea e e a eeaae e ea e e eeaeeeoee ae ee e eee eoee eee s ee sa WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW em ceemme*ehese=eSeM*==Me=GheneeMeNMNaNMOveNeeeeee=NeSemmemMMhw ow

• W e = W9e en>Nm MGMee-m meeNee= ecNGmOM m= hMeh me MMMete ** * =G= GNe eN Sh

                   *E         MN==OSSeemmWGemee*MMMMN===OceG99=SOM=SGwNOS$eNOShe9N=9SSWWN=

OO e N.N. . N ..... N. M ..=.=.=.=.=.=.=.=.=.. == . = ....... = = = = = = = = = = = = 9 9 9 9. e. s. e. e. m. >. >. >. >. $. $. $. $. $. $. d. e. m. e. c. e. v. e. t. e. v. e. e O@e00000000000000999999990000000GOOOOOOOOOOOOOOOOOOOOOOOOOOO e o e mede99996999999mhhmmmmhmmheemeeesesee99998SSSSSSeeOOOOOOOOO= eeeeeeeweeeeteewegeweeeeeeeeeeeeeeeweveveeeeeeetmmesseseesce eeoeeeeeeeaeeaeea eeeee aeeeeeee eaeee eeeoe ee4 eeoeeeeeeeaee e e e a WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW

                     >        M99=GMSGNOGehmMeNeNeestGhe*NMSNGOSeGeGNMG9eMcNeeeNNMSMc==9Nm
                     =        >SSc=99MNG=cestepecemeth>MSO*GNMSNGSNMe>MS=9aceNGenOSeecev=O i

a ScNOW9eeG9emeNOveceseMSWNOMemeOSMedNOMmeteSMSGNON>weseM9eNON i 1 =.=. =..= G. G. e ee. M. Me N. =. =. =. =. e. G. e. e. M. N. N. =. =. =. =. S. G. e. e9. M. M N. =. =. *. *. e. G. e. e. M. N. N. =. =. =. =. e W. $ 9. M. N. N. =. =. =. *. e. l 000000000000000000000000000000000000000000000000000000000000

• OOO000000000000000000000000000000000000000000000000000000000 W

mg =. M. M. e. e. G. m.e 9. C. *. N M. e. e.. S. h e. S. O.

                                                            .        .                                       . *. N M. e. e. W. h. e. S. O. . M. M.                            . e d. e m e. 9 9. =.N M. e. d. e.  .                                                       .                     .. m. e. 9 9 = N..M. e. c. e m e. @. Q.

Z egeeeeeee999999999900COOOOOOO==***=====NNNNNNNNNNMMMMMMMMMMe w weTeveettwevevegewe@@@@@@@@@@@medede@@e@@ceme@@@@@@@@@@@@@@@ l

394 a A C00000000000000000000000000000000000000000000000000000000000

              =y.

• N. M e. @ e. m . .e. C. =. N . . M. e.@ e m e. e O. =.

                                                                                                           . .N. .M. e @ e. m e. e. O. . N.. M      . e @ e. m e. . c. =. N m mO.m=.NmM m         e @ e. m e. e O.

eveeeeeeW@@@@@e@@@@eeeeeeeeeemm .eeeeeeeeee m m.Om e m M e @ e.

                     @@@@@@@@@@@@@@@@@@@@@@@@@@@@e@@@@@@@@@@DCD@@@@@@@@@@@@@@@@@@

e

         . e. w e   z e   a e    .

e eaW weeeeeeeeeeeeeewevevewwweveeeeeeeeeeeeeeeeeeeeeeeeeeeeee,eee ewe Oa e @e C e O 0 e 0e 0e 0e 0e 0a 0e0e0a0e0e0e0e0e0e0e0e0s0e0e0e0e0a0e0a0e0e0e04 e 0e 0e 0e 0e 0se0 a0 e0 ea 0 0e0e0e0e0e0e0e0 e0 e0 e0 i0s0 0 0, 0 e a0 ewo WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW e3> e3e enemme@meme=SeeNeeeenOsmomeMN=eesemaneseemmmmesee-ame@WWWWWW meGemameNOe9M=e>@Nemee=emeM=Sh@meseemeesenceegmeendMee>@ Mace emeONM e40 ocemmeevveMMMMNNNNN====OcecesepeasessemmmmmeceeemescoveveveM e e g d. e. c. e d. W. W. W. W. W. W. W. W. W. W. W. W. W. W. e. d. d. @. e. e. m. e. d. e. e. w. e. e. w. e. v. e v. e. e. e. e. e. e. e. e. e. e. w. e. v. e. e. e v. e. v e g e. e e 2 @eO00999990090eO09999e000009999eeceOSSSSOOOOOOOOOOGOOOOOOOOO e e d e W e E e = cesseeeeeeeeeeeeeeeeeeeeeeWOWemhmmmmmmmmkhmmmmmmmmmmmmmmmmmm o a $990000000000ee00000000ee90808990006080899999008090000000000 ea ea e e ea e e o e e a e e e o e e e e e e e e a e e a e s ea e ee a eaea s s e e e eaeeaeeeeae e=W WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW ewd eMew=9me@peceOMeeeeeeeneteeMMMmmme==emeneeevveNO-m=Omem= men =

            *S3     eeMeeNeeMeme=OGM=SeM=ece-emeM*mMeeme*ehGeeMhNmRed-edNomdM=Op eW>     mmmegememoveeMMMMhMMN====ceeGeomeM=eseemmeesenmeseeeemeceone o e e

e O =. =. =. =. =. =. =. =. =. = =. =. =* =. =* =. =. =. =. =. =. = =. =* =. =a =. *=.* =. = e. s. e. e. e. e. e. e. e. e. e. m. 9009900909089999999999998S099e089999999999330990999999900000

E W

WW wwwwwweveeeeeeeeeeeeeeeeeeeeweveveeeeeeeveveewevevewwwwweewe

            > W     eGOOOOSeeeeeeeeeeeeeeeeeeeOSeGOOe999999803999000000000000000 gas      e e e a e a a eee a eeae e e se e e e e e ae e ee s e ae e e e e a e e se e e eeaee                                                                                           eis e e e e e e 3>=

wws WWWWWWWWWWWWWWWWWWWWWWWWWWWWoWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW mesaseheem-seMaomeM*OSedeMaes checedessesseseewegeo-mneemeeN B =ese-ememeceMaceWNOSeMacheMas eMcGeeheceemeegemeseeM=SheM=Se e5W emeseewevenMMMamma=====eeseet seeeeeeemmmameseeeeeeeeeeeewen WWW

          > 3      e.e.e.e.e.e.e.e.e.e.m.e.d.p. e.p                                        . e.a.m.s.W.e.e.s.s.e.e.e.e.e.e.e.e.e.e.e.e.e.t.w.e.e.v.e.#.9.e.v.e.e.e.e.t.w.e.v.e.v.e.e.

e > eesseeeeGGegeeseOSegeSeeeeeeeeeee999e999999998es00e000000000 a 9 WG E W e e eeweeweveeweveeveeveveeeeeeeeeeeeeweveveveveveeeeeewweveveee

           >        90099e0599999.e0890098e3309999990e999980060ee0e98808980000000 e ee5 e ea a e ees                                                  a 6 e e a eee a ee : ee eeieaeeeea eaeeaeeeeee a ee e eae e a e e e sa e>       WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW se-ephonemememechemmeemeseMh=Seeeeeeeeeeeeeee==NMesehse=Mese de w    emeheeommecemeesM*SheheeceM9ee9=9meMaoneM=emeeMeeeemesmeMaom meespeeevnMMMMMMMM-====SeeeeeeeeeeeeemmmmmeeeeeeeeeeeeeeeeMM WW e       p o.m.p e.s.p. a.
                      .                .            . .p.o.p s.p e.e.W.e.e.d.e.e.m.m.e.d.e.d.e.e.e.e.e.e.e.e.e.e.e.e.e.e.e.e.e.e.e.e.e.e.e.e.e.e.e.e.e.e.e.e.e.

A G888e99999e999999999999999998e8eesseceeeeeeeeceseOSOSeeOOOOO e e e e e e W eGeeeeeeeeceeeeee9mhhhhhmmmmmhhmmmmm*>>>>=hmmmmmmmmmmmmmmmmm

         -o     B
           . =     O aec e. se e.ee           e e eee eeeee e e e e.ee eeee                   e e e e e. e. e.

e ee e e.e e. e e. s e. e a S.e O. S 9 se. e. e. e e9 9 9 9 s 9 e. e 8ee0 a0 0 ee0 0 0 9 9 e 9 9 e 9ea9 9 0 0 0

           .-s     WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW
           .-      S=Mm                                                                                                                              .ge                                 .~~e owW                               ~ e G.e .~    em~. . M e.e.m e .s e.e es. e . e ~ .m 9MMMM                       e..====...e.I
                                               .                                                     .e     =Me   3 > =$e=.e S e.e s e e . * ~ M e.~
                                                                                                                               .m.eM=.e                              e ~ 3. M .d e m e e .~ m.e .~ W
                                                                                                                                                                        =                        =O.MMeM.me@.m          em     MMM9=.
                   =.=.=.=.. =.=.=.=.=                                                            = = = = = ..S         = =.=. O2m...       . . .. .. .... ..3WM.M.e.~..eM ee.e..

e .3m.Me.m.e. - - s.s.e..

                                                                                                                                                                                         ~ e.e.e.e.e.w.e.v.

o.3

           . m                          .                 .............e....e....                               .             ...                                      . .

e 8800e0999 9999......e.999 . 9 0899903e980e0080900 00000 e e. e

e 88:38.eea3838:3888888.:e:e:e.3838:38383.8:38:383.:.3:388.e2:*!.!,!!*222*2 e s. s aee ee se ees e e.ee ee e. e e ee ee.e .ee sa WWWWWWWoWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW em esem-mmeome>MemeencheeN=neemeceeMmme>>me-eemmesse==cepe>Nene ow eMN==ce===Receenemenmeeemogeeeeeee-emetemmeeMeenee-M*=emoeem os 99emeseMM=SpehmeseeMMM-SeeseekSGemme*MMmmm====OcemeNehemen*M ee i o W. M.M.M.M.M.M.M.M.M.M.M.M.M.M.M.M.M.M.M.M.M.N.N.M.*.=.*.*.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.e.9.e.e.e.3.e.m.>.>.>.

o OOOOOOOOceeemeseeceOSeecesseSGOSO9908e3809008e00000000000000 e e e

                    ==========NNNNNNNEMMMMMMMMMMMMMeweveeeeeeeWeWeemeWWedeeeease
                   @ e a  @ e@e@e @@@@          a e e eoeae  @@ @e                       a e neeeea C eemen e ae eaae @ Os e epeseO.eeoeeaeaeee O Op* *

• me neendeeeeaees e nse O OOO O n. pO eaee n eOe ea 0@ e e@ee @

a WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW

              >     Mh=MmemeSeemme>==Re=eceMe=9eshameemmagmeGMeheeMeseNWeGeschen w    esmemMSNeeeScM.W===Mmed=G9MeseNOMGMmes>99= Neem *MeemeOmewe==9
              =    GMMeeMedhe*eMMeeMeeNeeeMMeeNeeMeeeNMeeMeeMeeeNMemmeeMmew= hem l                   e. m. e. M. N. N. =. =. =. =. S. e. m. e. M. M. N. =. =. =. S. e. e. p .e. M M.                    e M. *. =. =. S. e. e. e. 9. M. h. M. =. =. =. e. k. e. W. W. M. N. M. =. =. =. O. k. e. W. e. M. N.

SeceasOSoceseOceseOOceaeOOcescoceoo006080008e008900o00000000 l

                =

M OOOOOOOOcceeOOOOOOOOOOOOOOOOOOcce050000980000000000000000000 - l wg . N. M.. e. ..c.o m e O. O. =. m. m. e. c. e. m e. c. c. a n. M. .e. d. e. m e. s. e. . N. .M. e. d. e. m e. O. O. .=.. m. M t. e. e. m e. s e. =.N M. e. @. @. m e. e. I eveeeeeee@@dpee@@@deceeeeeeeemmmmmmmmmmeSeceaseeSpesepeppeeC w W@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@d@@@@@@@@@@@@@@@@@@e

_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . - - _ _ _ __ _ _ . _ _ _ _ _ _ _ _ ~ _ _ . __ _ _ _ - 295 i

                                                                                               .Ag C00000000000000000000000000000000000000000000C00000000000000
                                                                                                       =. N M e c. @. m e S. O.
                                                                                                                                                . N M e c @ m e S. O. =. N M e 4. @. m e S. O. =. N M. T d. @. m e S O - N M e c. @.m e. S. c. =. N w    COOOOOOOO==========NNNNNNNNNNMMMMMMMMMMeewwwwwwwedd@@mec@cc4
                                                                                                       @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@GW@@@@@@@@@@@@@@@

e e e e e Z e = e = eaW wwwegwwwwwwwweveewwwwwevevevevewwwweveveveewwwwwwwwwwwwwwwww e=@ C00000000000000000000000000000000000000000000000000000000000

                                                                                                       $ e e e e a f e e s 6 e 4 0 # e e e a e e s 4 e a e e s I e a e e s a e a 0 e e a 4 ee e 4 & e e e t e t i t S 4                                                      5 ew3 eSe        WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW emeONemene@S=emSNeO=ce=ee=eSNGOweN0=eSTeMmNm=@=@=@NmNmmeece=

e3e wen =SmeMNOe@@M*SeWeM*SeeeM=SeecM=cemeMNOSmeem=cenceN*Se@ men = i eMO MMMMNNNNNN=====COCOOOSSSSpScesseeShm>>mmeGeeeeede@@@@Teewege e weewwTwevvveveeweveveMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM I e 0 - - * * * * . - * * - * * - - * - * * - * * * * * * * * * * *

• e * * * **** ** - * * * * * * - * - - - * -

e Z e C0000000000000000000000000000000000'0000000000000000000000000-e e e e W e 3 e = o >>mmmmmmmmmmmmmmmm**mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm em J O@@@O00000000000000000090000000 COO 990009ee993000000009900000 e e e e e e i e ee e e e a e a e e e e e e e ee oe e ae e e a ee e e e e e e a ea aeea a eea e a e a e ae i onW WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW' ewm es3 -MeeeemhesesNaeMMeeNSeces=e*ShenSme=meMMMeeSMSe=SammeSN@eMee emecocemmeSONMWNS=Mee=#>OTm*eeMeOWSweMGMcMGMSWOW=mmec=seOmMO een eMN=OSememeeMN=OSeekeedeeMNN=OOSeemmeespeeMMNNN==COSSSeesm>= a

e. g c.o.m.m.a.g e.w.e.v.e v.e.v e.e M.M.M.M.M.M.M M.M.M.M.M.M.M.M.N.N.N.N.N.N.N. N.N.N.N.N. N.N.N. N

                                                                                                                                                                                                                                       . N.N.N.N.=.=.=.=.=.=.=.=.=.

e C COOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO00000000000000000000000000 o 2 e W WW ewweveveeeewweveveveveteWevewwweewevevegvewweveeTweveveveeve

                                                                                          > W        @SO30000000099000eO999999999999999980eOOOOOOOOOOOOOOOOOOOOOO gag          eie        a e e e a e e e a a e a ee e e a ee ae see a a e e e e oe ee a ea e e e eae                                               e e e a e e e ae a e a 3>=

Wwd WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW WWmS=MOSOMWoOMes=en=ThOem-seNGSMeNeeeGMehmae=e=e=e=GNmMeepee O3W 3 GeNeSheMmeeseM=SSGWM-SegeM-Gesem=SemeMNGSheeM=OsmewN=SeceMN= WWW MMMMNNNNNN=====OOOOOOSSSSSeeeeeeeekmmmmmecesseeecedemeewwwww

                                                                                         > 3 e >         e.T.e.v.e. T.e.v.e.e v.e.T.w.e.v.e.v e.e.T M.M.M.M.M.M.M.M.M.M.M.M.M.M.M.M.M.M.M.M.M.M e                        M.M.M.M.M. e    M.M.M.M.M.M.M.M M E e        000009999000000000000000099900000000000000000000000000000000 WO E

W e eeweveveveveveweveveveegevewwwwweeweveveveveggeveweveveeeeve

                                                                                         >          OOOOOOOOOOOOOOOOOOOOOcOOOOOOOceOOO9eO90099990000000000000000 e eea e e e ee e e ea e a ea e ea eee ee eee aeee eae : eaeeeeeeaea e eea e e eaee a ae sa         WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW Ok         S = M em O N e O S = e n O N ee = T e = W e = WSM O SM m = $ 9 e e su m m e O WO W S 9 9 e p e O @ O o m m m e e 9 w      ceNeempM Seewn=SmeeN=SmeeN=SmeeM=SeepMNeekeeN=ScomeN=SegeMNO em         MMMMNNNNN=====*OOOOOOSSSSSSeSeesemmm%mmmeeeeeeeeeeemceewwwwe Wm e          T.T .w. e.v.e.v.e.g e T.T.T.v.e.v.e.e.e.9
                                                                                                                                   . .                       9.m.M.M.M.M.M.M.M.M.M.M.M.M.M.M.M.M.M.M.M.M.M.M.M.M.M.M.M.M.M.M.M.M.M .M.M                         . .

M.M M. W OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO999980099000000090000000000 e e e e e o o E W mmmmmmmmm>>mm>>mmmmm>>mm>>mmmm>>>>mmmm>>mmmmmmmmmmmmmmmmmmmm e = 00099999900009999990099900eO99899990099900000900000000000000 seeeaeeeae eaeeeaeaee aeaeeeeoeeee e: oee aaasee eaeea e ses e e e ea e a e sad

                                                                                         ** WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW NeceseN>eN=NeenemeenSNmMS> pee >OMeMSmeMMMeeShe-eMSmeeMMeceS-m owW SOmees=Me9NWe=eeNegeeMmme=e=e-mmmmeeSeMeeeeMSchecNSeMOme=eem ese NN=OSeemeemeMMN==OSeeenheempeeMMNN===9eSSpeem>>SeemmmmegeMMM eW3 e >        e. v. e. 9. M. M. M. M. M. M. M. M. M. M. M. M. M. M. M. N. N. N. N. N. N. N. N. N. N. N. N. N. N. N. N. N. N. N. M. *. =. =. =. =. =. =. =. =. =. =. =.

• S e C C0000000000000099ee900000900960900000880@eO00000000000000000 e

e e e e e 9 C00000000000000000000OO.0000000000000000000000000000000000000

                                                                                                    ======.================                                                   e==================================

eeeeeaeeeeeeeeaB e6 eeB eieee8 eeeeeE l eeieeeel e8 eel e8 esieeeat aoe sa en WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW mesemeOSMNemeNNee>MNe=OMemenOSNeeMeSeeem-mee>Se=SSSNeemeMMe@ ew ===NMmecesNamegOmemeenemetepeceS=Me>OMeSmeeTeMmNe=emmMeTOWNe es *SmWM-SegeM*OekeeMN=SemedeMN=OSSemeWWTMNN==OSeesmkee@meteMMN e0 e h .e. W. o. e. o. W. W. W. C. W. e. m. v. e.. g e. e. W. e. M. M. M. M. M. M. M. M. M. M. N. N. N. N. N. N. N. N. N. N. N.

                                                                                                                                                                                                                             ....N. N. N = = = = =. =. =. =. =. =. =. =. =. =. =. =.

o C00000000000000000000000000999900000000000000000000000000000 e e e Gesem>>m>>>>>>heesessesseeOSSSSSSSSSSOOOOOOOOOOO.*=========N 0000000000000000000000@@@e0000000eneneccesecosesseeeeeeeee@@ e e ee e e a eea eae ease e e ee e a eea e s eeee e a ee eea eeeoe eaeee eeae e ees e e e

                                                                                             >      WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW MeepeSMm=Sh>WMcN=WSOenO=NmmeS=SSeeeme=mMeSege@=OOOmmeON=NO==

w vanSeeeemeTNOce=S** MON =SWNWMes=MOpmeekhmes=emeMeONmOWSeeWNWM

                                                                                             =      NOT=$eM*=Mmmee=emM*=MmNheadmMO*Mm=me=veNOOMemm9=es=OONe=mT=M N....
                                                                                                        = =. = S.m e.@.Te M.N.N.=.=e=.S.m.e.d.e.M.N.N.*.*.=.S.k.e.@.T.M.N                           N = = = S.k.e.@.e.M.N.N.=.=.=.S.k.e.pe e.M N.N.=.=.=.9*

0000000000000000000000000000000000000000000000005C@O00000000 a e O@@000000000000000000000000000000000000000000000000000000000 mg =..N M. T. c. @. . . m e S. C. = N M. . . .T

                                                                                                                                                          . @ @ m e .S.. O. *. N M. e d. e. n.
                                                                                                                                                                                             . . e. S. c. =.. N M e. d. e. n. e.
                                                                                                                                                                                                                              . . S.
                                                                                                                                                                                                                                  . . c.
                                                                                                                                                                                                                                      . = N. M. e      m e n e S. -O.
                                                                                                                                                                                                                                                     . .              .  =. N M. e O. W. M S K

w OOOOOOOOO*=========NNNNNNNNNNMMMMMMMMMMWTeeeeeeve@@@@@@@@@@@.

                                                                                                    @@@e@@@@@@@@@e@@@@@@@@@@@@@ece$e@@@ee@@@@@@@@eW@@@@@@@@@@@@@

I l

                                                                                                    .396
      =g a

M C00000000000000000000000000000000000000000000000000000000000

               =. N e w d. @, m e S. O.
                                             .N. M. T, W. @   . m e m C. =.

s . N.. .M. .w. d. ,@

                                                                                  . .               . m e m. O = N M. g d. @. m
                                                                                                                           . ..               e.. m
                                                                                                                                           . ..   . O. =. N M. T W @ m e. m. O - N M e W @ % e m,
               @@@@@@@@@mmmmmmmmmmeeeeeeeeeemmSemememmOOSOCCCCOO==========N g:

2 w

               @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@m***mmmm==mmmmmm%mmmm                                                                                                                                                                              .

e A e a A e Z m e = Z

   * .                                                                                                                                                                                                                                                   =

e . e=W wwwwwwwwwwwwwwwwwwwweewwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww ewe C 0 0a e0 0 0e 0e 0e 0s 0e 0a 0e 0e 0i 0e 0e 0e 0e 0i 0e 0<0<0e0i0s0e0e0e0is e 0 0s 0i 0s 0, 0e 0s 0i 0e 0s 0e 0i 0i 0i 0, 0e 0i 0e 0e0e0e0e0 e0 e0 a0 0 0000aw s i e e e ihm i ew3 i e3> WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWw3 mMSe=mMSWNeT==W=mT=eWNS$MOeWNOmWNONWM=SmWM=SmWTNOSm@TMNOSemW3m ese SeeWTN=SemWTM-OSMGWMN=SenGwMN=eemOTMN=Se*WWMN=OSeGmeMN=OsmeW3e eWO e MMMMMMMNNNNNNNN=======COOOOOOOSSSSSSeGeeeeeeeeemmmmmmmm*@@e@et

  , O M.M       M.M M.M M M.M.M.M.M.M.M.M M.M.M M.M.M.M.M.M.M.M.M.M.M.M.N N.N.N.N.N.N.N.N.N.N.N.N
                   . . . .                              n         .
                                                                                                         .                                    .                           .                                                 . . . . . . . . N.N.N.N.N    f,     N.N.N e E e          C00000000000000000009090000000000000000009900000000000000000.                                                                                                                                                                               .'

e e e e W e e 2 - W e = mmmmmmmmmmmmmmmmmmmmmmmmmmeesesseeeeeeeeeeeeeeeeeeeeeegemese E e = em J 000000000000000000000000000000000000000990000000000000000000 e e ee e i e e e e eae e i e e ee e e e e e e e a e e e e e e e a e e e e e ee e ee ea e e e e ea e e e a e a em 4 e>W WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW>W ewe e53 -eSTTM9Wes=TmMGamMemWN=OSSWSmSTTGMMWa=MSmST==TOeSNeGmOWMMWSWwe eWW mMONT=SWNSNT=SGW=SNTNOGGM-SSSOMWGSNWSMm*S=mMOWNeWMOGGWMN=OSSs3 GGGWWWTTTMMMMMNNN=====OOOOSmW9NOeGWM=OSmWTN=SemW9MNOSem@WTN=m> 4 e g g 1 e g . . . . .. . . . . .

             ====...=======                         =. =. =. =. =. = . =  = ....
                                                                             = = =.

• S. 9 9 9 9 9 5. e. s. s. e. s. >. >. >. >. >. >. 3. G. G. G. G. G G. G. W. W. O W. W. W. W.

                                                .4                      . .                                                                                                                       .

e e O COOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO O e E o E

a. -l W e geweegewwwwwegwevewegweeweveTTewowwwwwwwwevevewwwwweveweewte m

  > W        OOOOOOOOOOOOOOSOOOOOOOOOOOOOOOOOO000000000000000000000000000                                                                                                                                                                            W gaK         aeee e e ae ee e                     ee e ea e e e ee a ee e e eeeaee aea eaeea eaea ee e eea e l a a e e e a<*3 3>-        WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWk=

wwa ONeeOGNemese=meONT=eWNSGMemWNGmehemWM-99eM=GmWMNOGmGeM=OSe>Gws S GetWTN=Se>WTM=OSmWWMN=Se>GTMNGSemGeMN*SemeWMM=OSSGWTMN*OemWWE G3W MMMMMMMMMNNNNNM=======OOOOOOOe99999999esesseegemmmmmmmmmOGGe5W Wwe p 3 M M. M. M. M. M. M. M. M. M. M. M. M. M. M. M. M. M. M. M. M. M. M. M. M. M. M. M. M. M.. .N. N. N. N. N. N. N. N.3N. N. N. M. M. e > s e ,OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO > WO 8 E O W < Q 999eeeTTTveevevve99e999Tv4TTT999999ee999evee99wwwweewevevege 4

 >          OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOc@c0000000000000000000000000 e e aee e e a eeeaeae e e eeeeseaeeeesaeeee ees a e ee eeeesee s aea ee ae e e a a da Ok         WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWa WanMSW=e90mMOGMSGMOmW=eWMSm9=gG9aSmTNOeG9MOGGWM=Os>WTN*OSmWWW MM w

SGOWMN=SemWWM=OMMOSMM*Se>WeMNSSe>WTMN=Se>GSMN=OSSGWTMN*OsmWWw WW MMMMMMMMMNNNNNN=======OOOOOOOOSSSSSS9eeseesseeemmmmmmmmmWGGem e M.M.M.M.M.M.M.M.Fe. M. M. M.M.M.M. M.M. M.M. M.M.M.M. M.M.M.M.M.M. M.M.M.M.N.N.N. N.N.N.N. N.N. N.N.N.N.N.N.N.N.N.N. N N . . W OOOOOOOOOOOOOOOOOO9eOOOOOOOOOOOOO000060890000000000000000000 e e e e W W e W mmmmmkhmmmmm>>SeceSegemeeeeeOSeeGeeGeeeeeeeeeeeeeeeeeGGSeeme W e E ooc 000000000000000000000000000000000000 COO 000000000000000000 E o = a e e eeeeieaeeee nse eeae ee ee ee aeeee e e ae e eeae eeeaee i e ee e e e e a e t = ead op WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWas GMGM9pMSmWMNNNmMNOMMGMWeWOOGGSWMTS9McSGWSOGWWSMSGSNmMNNT*MOe> owW OWWMOWSM=SmdMe*NM99e9MOSMMMG=GNeTOMT=eGTN=Se>GGWWWGGmS30=MWGwW eSW eM3 MNNNN==**OOOOO9mWM=SeG9N=SSGWMNOSeGWTMmeGOOWTMN=OSe>GWTTMN=OEM

            ==**a=====

e > .. . . . . . ..  ;.- ..

                                               = = S. S. S S. e. e. g e.. m. e. e. m. >. >. >. >. >. m. O. G. G. G. G. G. G. e. W. W. W. W. W. W. W W. W.9 9 .9 9 9 9 9 9 9 9 9.W >3 e e        OOOOOOOOO&OQ9900SeeOOOOOOOOOOOOOO000000000000000000000000000 e e C                                                                                                                                                                                                                                                  O e

o e e s 00000000========a===============**========================== e ==============..*========= ===========================**==== e ail e4 4 8 e9 4 e4 e8 l aa0 eeiI 8 I e8 8 4 i eieI eef eit ea8 e6 8 eeeeee1 9 6 4 ea ee e sa WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWa em SMSWN=OOSN>eteMWTONO9eO=cemSGmMwemeneNO=GTWemm=GWSOSWG9WNNMm> ew game *eWMONeeNONeWMaOSSe=NWMO9eMcMSGNSmWM*SSGeeOSO*MeGeOMGSNew

 *E e@

NN===OOO99M$eGmeeG9NSmWeNee>WSNOSMGWMM-OSeGmeMN==OSemWGWTMMNE e * ........

               = = = = = =

• 9 9 9 9 0. e. s. e. m. m. m. >. G. e. t. J. G........ O W W W W W W T. T. T. 9 9 9 9 9. M. M. M. M. M. M. M. M. M. M. N. N. N. N. N. N. N. N. N.

o e OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO999999990099009000000000000 e e NNNNNNNNNNMMMMMFMMMMMT9999999eeTWWWWWWWWWWWWGGGGGGGGGGmm>>mm G696999999996S9996GG9999999999999999999999999999999999999999 e e eee a e eas a eeeeea s e e eee eaeees e e ea eea eae eineaaasee eeee ee e e e i e a WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWa

     >      T=OemmWSOMNGOMSwmOSSTWha>SheWMSGGmGOOMSS=SeeMme=OSmeeSmeeSNG>

w WMmMGveM=eG9eMSTNMMSMSWWGG=O==SMNS9999eSem=WWWNamGeeGOSSOSOTw

    =       W*SONGamf=MWOSSNG=>M-=90eSNW=mMa*MSe9=WOmM=OMeeS*WOSM-SN9me==

N.G. . T 9. M. M. M.. =. =. S. M. G. S. M. M. N. N. =. =. =. 9. m. e. t. M. M. N. N. =. =. =. S. m. W. . ..9. m. M. N. N. a *

• S. m. W. T. M. M. N. N. =. =. =. e. >. W. e.

COOOOOOOGOOOOOOOOOOOOOOOOOOOOOOOO000000000000000000000000000 a 0000000000000000000000000 COO 00000000000000000000000000000000 a W e t

     >g       . N. M. T. W. .G.. m e G. O. =. N. M. T. W. G. m. e. .. 9 0

• N. M...,T.W G m e. S. O. =. N.. M T. W. G. . m e. 9 0. =.

                                                                                                                                        . .M. .M. T W G. m S. 9 0

• N. M T W . . G m e. S. O. p g 1 Z GGGGGGGGGmkhammmmmmesessesseeSSSSSSSSS9OOOOOOOOOO==**======N I

       *    $$$$$$$$$9999999999998GG99999999GGGGGGG*mmmmm>>mmmmmmmmmmmmm                                                                                                                                                                              w 1

l i l l APPENDIX 8 PP&L DEFINITIONS 397

DEFINITIONS (l'i (PPal USAGE) BACK END ANALYSIS CORE DAMAGE CORE STABILIZATION DEBRIS STABILIZATION DEFENSE IN DEPTH EERGENCY PROCEDURES GUIDELINES EER6ENCY OPERATING PROCEDURES EVENT SEQUENCE FAULT TREE ETHOD . l 398

Definitions (1) (PP&L Usage) Back End Analysis The analysis of the specific nature of loss cf containment integrity (venting through catastrophic), the details of the fission product transport processes, and the nature of off-site consequences of the fission product release. Core Damage Damage to the fuel elements involving mechanical rupture of the fuel clad or~ high temperature oxidation of the clad by steam. The threshold for damage is defined as a level.at which total noble gas release exceeds some selected fraction of the total core inventory of noble gas, for example it. Core stabilization This phrase refers to termination of a core damage progression sequence prior to reactor vessel failure with no further damage to fuel or the reactor vessel as a consequence of the core damage at the time the progression is terminated. Debris stabilization This phrase refers to terminating the attack of core debris on the drywell floor or other containment components. Termination is usually considered to occur as a result of cooling the debris by means of water. Defense-in-Depth The PP&L criteria to assure a multiple layer of defanses against severe accident consequences, both in terms of. equipment and procedures. Emergency Procedures Guidelines (EPGs) A set of generic procedures for response to an initiating event intended to bring'the plant to stable, controllable conditions with minimum damage. These procedures were developed by the BWR Owners' Group. Emergency Operating Procedures (EOPs) The EOPs are derived from the EPGs for a specific plant and reflect the specific features of the plant design. The PP&L EOPs take the form of flow charts which reference supplemental procedures as necessary. Event Sequence Fault Tree Method An alternative to the support state method for performing a PRA. The event tree top events require quantification by fault trees and involve Boolean algebraic combinations of successes and failures of prior top events. I I I 399

DEFINIT 10NS(2) FRONT END ANALYSIS FRONT-LINE FUNCTION. INDIVIDUAL PLANT EVALUATION METHOD INITIATING EVENT LEVEL 1 PRA LEVEL 2 PRA LEVEL 3 PRA LIMIT CYCLE OPERATION LOSS OF CONTAINENT INTEGRITY 400

Definitions (2) Front-End Analysis

                                                                                                                   *he analysis used to determine core damage frequency. As applied by PP&L this analysis is extended to define all forms of plant damage out to stable or uncontrolled plant conditions.

Front-Line Function A function of plant systems which is required to avoid or limit plant damage as a result of an initiating event and independent equipment failures. Individual Plant Evaluation Methods (IPEM) A PRA methodology developed by IDCOR to allow a simplified evaluation of core damage frequency. The BWR methodology is based on the Support State approach. PP&L has enhanced the IDCOR IPEM to provide more detail in 52pport State and Plant Damage States. Initiating Event Any deviation in plant operation that requires the operation of front-line systems to restore the plant to an undamaged stable condition. Level 1 PRA A risk assessment that does not carry the analysis beyond core damage, or if core damage had not occurred, the sequence is carried to containment failure or successful termination of the ev6nt. Level 2 PRA A risk assessment which determines the final containment status and the fission product release to the environment. Level 3 PRA A risk assessment which determines the off-site consequences of the severe accident contributions for a plant. Limit Cycle operation A form of oscillatory BWR instability in which the oscillation magnitude is limited by the system non-linearities. This behavior is only expected in situations of high power to flow ratio. Loss of Containment Integrity Any situation in which fission products are released from the containment exceeding that corresponding to the design basis leak rate. This includes containment venting actions to reduce pressure with large fission product inventories in the containment. 401

L DEFINITIONS (3) ( 1 1 MECHANICAL CLAD DAMAGE PERFORMANCE MONITORING PLANT DAMAGE STATE' 1 PROBABILISTIC RISK ASSESSENT PROMPT CRITICAL PROMPT CRITICAL ACCIDENT RISK RISK ASSESSENT l 402

                                                                                                                                                                                               ~

Definitions (31 Mechanical Clad Damage

                                                                                                                            . Loss of clad integrity resulting frem pellet clad interactions resulting from power cycling or transients.

Performance Monitoring The process of recording and tracking equipment failures in the plant for the purpose of tracking the risk associated with plant operation. This term also applies to a continuing program of measuring control room operator performance for the same purpose. Plant Damage State A specific level of damage to the plant resulting from an accident sequence. In general'the state specifies the nature and extent of core damage, reactor vessel dwaage, core debris release to the containment, and the nature of containment failure. Probabilistic Risk Assessment A'probabilistic determination of the various kinds of accidents, damage, and consequence for a nuclear plant. The IPE is a form of PRA. Prossat Critical An excess reactivity insertion above just critical plus the magnitude of the delayed neutron fraction. In such a condition reactor power rises at a rate characteristic of the neutron lifetime and the excess reactivity above prompt critical. Damaging power excursions can occur when the prompt critical reactivity lower limit is exceeded. Prompt Critical Accident An event in which the prompt critical reactivity lower limit has been exceeded. The only credible threats of this in the BWR are ATWS sequences with depressurization and core damage events with control rod relocation and subsequent reflood. Risk PP&L uses this term in a much broader sense than is commonly used in PRA work. It is used to refer to the likelihood of any form of plant damage or off-site consequence without distinction. The precise meaning must be determined from context. Risk Assessment An abbreviated phrase for probabilistic risk assessment. 403

DEFINITIONS (4) RISX MANAGEMENT SEVERE ACCIDENT COPING SEVERE ACCIDENT MANAGEENT SEVERE ACCIDENT RECOVERY STABILITY SUPPORT FUNCTIONS 1 SUPPORT STATE ETHOD SUPPRESSION POOL BYPASS 404 {

Definitions (4) Y Risk Management The process of monitoring performance, risk assessment, feedback, and modifications intended to assure very low plant damage frequency and optimal use of plant facilities to prevent or mitigate damage from an initiating' event and any combination of equipment failures. Severe Accident coping This phrase refers to actions taken after control room ability to terminate an accident sequence has been lost which are required to bring the plant to a stabilized and controllable condition without further fission product release. Severe Accident Management Actions taken to avoid or minimize plant damage resulting from an initiating event and any combination of additional equipment failures. A11'such actions

 'are defined by the EOPs and supplemental procedures referenced by the EOPs.

Severe Accident Recovery . Actions taken after termination (control and stabilization) of a severe accident to place the plant in a long term safe condition. Stability Relative to ATWS, the absence of oscillatory or excursive behavior of the reactor. Relative to severe accidents, plant parameters holding and controlled at non-threatening steady values or trending, under control, in a safe direction. Support Functions The function of plant systems which are required for the operation of one or more front-line systems of the plant. In some cases a system which provides a support function may also, under certain conditions, provide a front-line function. Support State Method A method of probabilistic risk assessment which partitions support system failures into groups having equivalent effects and treating these groups separately in the event trees. Suppression' Pool Bypass A circumstances in which steam produced by the fuel may enter the wetwell airspace without first passing through the suppression pool. l 405

1 I

                                                                                                              '\

k o l 406

I i 1 APPENDIX 9 DISCUSSION OF ASSUMPTION 6 1 407

This appendix develops the argument that j outages of length T can be treated as one outage who's length is the sum of the T.'s. Mathematic 311y this question becomes: 3 When.is j IT g j T i=1

/ Adtpdf(t) = / Adtpdf(t) i=1 o o (LHS) (RHS) a good approximation?

Solve the RHS def j T = Tg T i=1

                                                                                                   ~

Assume pdf(t) = e

                                                                                                                   ~

dtAe" = (1-e T) o Solve the LMS

                                                                                              ~A I         dtle             = I (1-e ~A                     i) i=1        o                    i=1 Recall that e  -At = 1-At + '                                -

3f + 'A ... For the RHS (1-e"A T) = 1-1 + ATT ~ # ~ *** For the LHS I 2 3 4 I (1-e - AT1 ) = i=1 i=1 I 1_1 1,1 _ (2i AT l . .!4:1 3 . .!4.g 1 ,,, The susmaation is a linear operator therefore thie expression can be written as l follows. j j 2 3 4 i=1 g (1-e~A i) = IT-i=1 g

                                                                                                                                  ,I i
                                                                                                                                         +2 (1fil-3*           ( fil ...

408

I 2 0 2 I 3 4 ) 4 AT 7 1 I T1 . 3_3 I (T ) ,, 1 ' I T 1 ... 2: i=1 3: i=1 4: 1-1 A good approximation is guaranteed by ensuring that the differences between the two equations is small therefore, RHS-LHS = - + Tg ,T T i - T - i - T We consider only the square term since the effect of the higher order terms rapidly becomes insignificant. Recall the identity j T = I Tg T i=1 Therefore for the square ters 2 2 )~1 d T =IT + 2 I Tg I T T g k i=1 i=1 k=1+1 2 I \ 2 2 {$ $ I~1 {I \

    ~L           IT        I     T          "~

A 2 I I T I- I T 2+2 I T1 I T l ' 21 i=1 /~ 2I (i=1 g/ i=1 i=1 g(k=1+1 /, 2

                                       $~1                        3               b
                   ,L               2 I Tg                         I Tk             l 2             i=1 k=i+1J                    -

let Tg =fT gT T T k" k T l ne error term then becomes. 2 2 I~1 [I T I I k QuadraticError=-h g,g i ,g Recall that j $ T ET

• T i=1 I 'i T " i=1 i 409 L - _ - . _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

i j j now If g = 1. herefore : f <1 i=1 k=i+1 note that 3 . J fg = (1-f, ) and I fg = (1-f -f ) s that the error 2 i=2 i=3 term becomes j j I fi 1- I f i i=1 k=1 Expanding this formulation yields j-1 j-1 2-

                                      $~1      )~1 I fi I fi        I f     I      f k

i=1 i=1 i=1 k=1+1 .The quadratic error term becomes 2 j-1 j-1 j-1 j-1

                                 - fr

• 2T T E I i=1 i

                                                             ~

I fi i=1

                                                                       ~

I I i=1 E Ik k=1+1 It is obvious that the term in brackets is always less than 1. Therefore the Error < - 1 T T Examining the quadradic error term shows that this approximation always over-estimate the true failure probability by a small amount. For a 1T of 0.1 the error will be less than it. This is an insignificant errer for this application. One must realize that IT is usually much less than 0.1. 410

 - . _ _ . _ _ _ . _ _ _ _ . _ _ . _ . - . _ _ _ .  .y .

APPENDIX 10 TREATENT OF EXTERNAL EVENTS i l 411 i

Dependencies exist between plant equipment and the initiating event.

The. occurrence of certain. initiating event can result in equipment failure. As'an exanrple rupture of the recirculation system piping fails the injecting path of 1 loop of :.PCI. These dependencies between the initiator and the-front line equipment must be captured in the systems analysis. They are captured.in a manner analogous to that used to identify dependencies between front-line systems and support systems. The application of matrices to identify dependencies between IE and equipment is a logical extension of the mathematical formation thus far developed. A layer of complexity is added, however since the initiator can fail front-line systems, support systems or beth. We will first discuss the method in general terms and then give a specific example of its application. , i We 1st identify the dependencies between the initiating events and the plant equipment using two mIstricess_ one for front-line systems, and one for support

   . systems. The initiating events are identified by the row and the plant systems are identified by the column. If plant system J depends upon initiating event I then a 1 appears in column J of row I.                                         If no dependency exist then a zero appears in that location.

This information is used when computing the vslue of a given functional fault. As shown in the functional fault tree on page 204 a basic event is labeled

    " initiator switch". Suppose a functional fault tree contains a system J.

When evaluating this functional fault tree for event I, the initiating event vs. plant equipment matrices are examined. If a one is present in location I,J then a one is passed up through the functional fault tree for test system, otherwise a zero will be passed up. If the dependency exist between the initiator and a front-line system the influence of the initiator is treated directly in the FFT. If the dependency exist between the initiator and a support system, the influence on the functional fault tree is treated indirectly through the front-line system vs. support system matrix. This is performed by first identify the support system effected. All higher order support dependencies are the identified using the support vs. support matrix. Finally the front-line system which depend on the affected support systems are identified using the front-line system support system matrix. This information'is then feed into the functional fault trees. This process is summarized below.

1. Identify dependencies between the initiating event and the plant equipment in a set of matrices.

2. If front-line systems are effected by the initiating event, change the the initiator switch in the functional fault tree from the effected system from o to 1.

412 i

f i

 .q-                                                                                                                                                               I

3. If support systems are effected by the initiating event then perform the following steps.

3.1 Ensure all dependencies between the initiator and the support I systems are identified using the support system vs. support

                                                                                                                                                      ~

system dependency matrix. j 3.2 Identify what front-line system depend upon the support system identified in step 3.1. 3.3 Change the initiator switch from zero to one for all front-line system identified in 3.2.

4. Once the initiator influence is accounted for compute value of functional fault tree and compute accident sequence frequency.

Consider the following example to illustrate this point. This example concerns several earthquake initiator. Earthquake represent a convenient event to illustrate this algorith, however, it can be equally applied to other events such as floods and fires. First we review how earthquakes induce plant failures. Earthquakes are the result of. ground motion.- This motion is transferred to structures and equipment in the plant. The resulting acceleration from this motion results is a force or load on the plant structure and equipment in proportion to the acceleration and the equipment mass. When the loads imposed exceed the equipment capability, the equipment is assumed to fail. Thus, for a given piece of equipment, earthquake imposed failure can be related to ground acceleration. An example of such information is identified in Table 1. This data is presented for illustration purposes only and is not deemed reliable. This information is used to develop matrices that relate the earthquake initiating events to plant equipment failure. Five earthquake initiating events are chosen for this example. They are earthquakes with the ground accelerations in the following ranges: 1 0.35 < x < 0.35 2 0.35 < x < 0.43 3 0.42 < x I 0.55 4 0.55 < x I 0.9 5 0.9 < x 173 l These ranges are referenced to the gravitational acceleration of the earth. l The initiator vs. plant equipment dependency matrices are identified in Tables 1 2 and 3, for front-line and support systems respectively. This information is used in computing value of the functional fault trees. Refer to the functions 1 fault tree for high pressure make up found on page 204. The value of this fault tree depends upon the status of the input labeled " initiators switch". We first consider the influence of the earthquake on the front-line systems. 413 I- _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . . _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . _ _ _ _ _ __ _ a

L. This influence is identified in Table 2. Earthquake 1 through 4 have no influence on the HPCI systems therefore the value of the initiating event switch for-these earthquakes is 'O'. Table 2 shows, however that earthquake number 5 will produce ground accelerations sufficient to fail the HPCI system. Therefore, the initiating' event switch for earthquake number 5 is set to '1'. Next the earthquake influence on the high pressure makeup function due to support system failures must be considered. Table 3 shows earthquake number 1 fails'offsite power. However, reviewing the support system dependency matrix on page 220 and the front-line system support system depending matrix on page 218 shows no dependency between earthquake number 1 and high pressure makeup through the NPCI system. This result is also true for earthquakes 2 and 3. The occurrence of earthquake numbers 4 and 5, however, results in the failure of the 125 volt DC power switch gear. A dependency between 125V DC power and HPCI is identified in the front-line system support system dependency table on page 218. Therefore the initiating event switch for the HPCI system is set to '1' for those earthquakes. The value of the functional fault tree is computed for each initiator.. These values are used when estimating the frequency of plant damage as a result of the initiating event. 414

i TABLE . ] l

                                               .                                      Significant Earthquake-Induced Failures This data is for information only and is not deemed reliable.

Median Ground Com pa Caponent Failed Acceleration No. Component Name or Failure Mode Capa ity $p gy 1 480-V AC breakers Cabinet structure 0.74 0.28 0.22 2 Reactor internals Core-support aligners 0.78 0.21 0.28  ! 3 Reactor internals Shroud support 0.68 0.30 0.36 4 Reactor-scram CR0 guide tubes and 0.66 0.25 0.26 system fuel bundles 5 500- and 230-kV Ceramic insulators 0.20 0.20 0.25 switchyard 1 6 230/13.8-kV . Ceramic insulators 0.20 .0.20 0.25 transformer 7 13. 8/ 4.16-kV Slide off foundation 0.30 0.20 0.25 l transformer 8 ESWS and MR-SW Soil liquefaction 0.42' O.15 0.10 9 HPCI turbine steam- Yoke bending 0.78 0.24 0.38 supply valve 10 HPCI turbine Structural failure 0.95 0.12 0.40 auxiliary 11 HPCI pump-suction Yoke bending 0.93 0.24 0.38 valve 12 Condensate storage Anchor-bolt 0.'79 0.22 0.31 tank 13 ACIC turbine steam Yoke bending 0.54 0.25 0.38 supply valve 14 Core-spray pumps Foundation bolting 0.80 0.17 0.27 15 MR puep Support failure 0.78 0. 23 0.21 16 MR outboard injec- Bonnet studs 0.87 0.25 0.38 17 MR heat exchangers Lower support bolts 0.87 0.32 0.34 18 OG jacket water Mounting bolts 1.06 0.18 0.21 19 DG control panel Function 1.21 0.32 0.43 20 125/250-V DC Welds at base 0.70 0.27 0.22 switchgear 21 Reactor vessel Sacrificial shield wall 1.10 0.32 0.21 22 Reactor and Control Shear wall between 0.70 0.31 0.24 building Units 1 and 2 l l Rectreviation pe ps Motor-support lugs 0.79 0.30 0.28 23 24 Refueling water Tank val) 0.16 0.28 0.29 storage tank ' 415 l 1

TABLE 2 The Impact.of Earthquakes upon' front-line' systems Tront-line systems Earthquake. RCIC HPCI LPCI- CS ADS Initiator DIV I- DIV'II 'DIV I DIV-II- DIV I' DIV'II 1 'O 0 0- 0- 0 0 0 0 2 0 0' 0' 0 0 0 0' 0 3 1 0 0 0 0 0 'O O 4 1- 0 1 -1 1 1 o o. 5 1- 'l 1~ 1 1 1 .o o l L 1 ? \ i

                                                                                                                                                                                                                             -]

416 Y _ _ _ _ _ _ - - _ _ - - _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ - _ _ -

l. i L l [ TM u 3-l: l The Impact of Earthquakes upon Support Systems Earthquakes 125V 4160V 480V LC ~ RHR- ESW Offsite l' Initiator ABCD ABCD ABCD ABCD 12 Power 1 0 0 0 0- 0000 0000 0000 00 1 2 0000 0000 0000 0.0 0 0- l' 1 1 3 .0000 0000 0000 000'O :1 1 1 4 1111 0000 1111 1111 11 1 l- 5 1111 0 0 0 0- 1111 1111 1 l' 1-l-

                                                                                                                                                                                                  %.81 417
     - _ _ _ _ _ - _ _ _ _ _ - -    . _ _ - _}}