ML20112F524

Final ASP Analysis - Davis-Besse (LER 346-98-006)

ML20112F524
Person / Time
Site:	Davis Besse
Issue date:	05/12/2020
From:	Christopher Hunter NRC/RES/DRA/PRB
To:
Hunter C (301) 415-1394
References
LER 98-006
Download: ML20112F524 (18)

Text

Appendix B B.5 LER No. 346/98-006 Event

Description:

A tornado touchdown causes a complete (weather-related) loss of offsite power Date of Event: June 24, 1998 Plant: Davis-Besse I B.5.1 Event Summary The Davis-Besse Plant was in Mode I at 99% power at -2040 on June 24, 1998, when a severe thunderstorm cell moved into the area. Several minutes later, a tornado touched down either near or in the switchyard, damaging switchyard equipment and causing a complete loss of offsite power (LOOP). Before the touchdown of the tornado, the senior reactor operator (SRO) instructed the operators to start the EDGs from the control room because of the severe weather conditions. Although EDG 2 started successfully, EDG I failed to start. Operators then attempted to start EDG I locally; EDG I started successfully. Several minutes later, a tornado touched down in or near the switchyard, causing a complete LOOP. The LOOP caused the turbine control valves to close in response to a load rejection by the main generator. The reactor protection system (RPS) initiated a reactor trip on high reactor coolant system (RCS) pressure. At 2118 on June 24, the licensee declared an Alert as prescribed by the plant's emergency procedures. On June 25, 1998, at -2330, following the restoration of the Ohio Edison offsite line, the EDGs were shut down. The Alert was subsequently downgraded to an Unusual Event at 0200 on June 26, 1998, because personnel had restored one offsite power source. The Unusual Event was terminated at 1405 on June 26, after personnel had restored a second offsite power source."' The conditional core damage probability (CCDP) for this event is 5.6 x 10'.

B.5.2 Event Description At 1946 on June 24, 1998, with the Davis-Besse Plant operating at -99% power, a severe thunderstorm warning was issued for Ottawa County, Ohio, by the National Weather Service. A few minutes later, this was upgraded to a tornado warning when a tornado was spotted -17.7 km (11 mi) northwest of Port Clinton, Ohio. At 2040, a lightning strike caused switchyard air circuit breaker (ACB) 34561 to open. In addition, the lightning strike caused switchyard ACB 34562 to cycle three times; this ACB eventually stayed open. The senior reactor operator (SRO) instructed the operators to start the EDGs from the control room because of the severe weather conditions. Although EDG 2 started successfully, EDG I failed to start. Operators then attempted to start EDG I locally; EDG I started successfully. Several minutes later, a tornado touched down in or near the switchyard, causing a complete LOOP. Simultaneously, the plant computer system failed because of the loss of power to a 120V-ac electrical distribution panel (panel YAU).

After the LOOP and the resulting reactor trip, all control rods inserted. The EDGs, which were already running, automatically connected to their respective emergency buses. Because the EDGs were running, the station blackout diesel generator (SBODG) was not required. The two turbine-driven auxiliary feedwater (TDAFW)

B.5-1 NUREG/CR-4674, Vol. 27

Appendix B I FR No~ 346/98g-006 Apni pumps started successfully. Although the TDAFW pumps operated successfully, the operators started the motor driven auxiliary feedwater pump and used that pump to supply feedwater to the steam generators. The LOOP had caused a loss of power to the reactor coolant pumps (RCPs); however, operators established natural circulation cooling and began circulating the reactor coolant. The transient that followed the LOOP and the subsequent reactor trip caused the secondary system pressure to rise. As a result, the main steam safety valves (MSSVs) lifted to relieve pressure and the operators opened the atmospheric relief valves to control steam pressure. One MSSV actuated below its set point and failed to reseat fully. However, as the header pressure decreased, that MSSV fully reseated. With all critical safety functions successful, at 2353, the operators commenced a plant cooldown.

With the offsite power sources still unavailable on June 25, the EDGs continued supplying power to the emergency buses. That day, the operator noted that the EDG room temperatures were increasing with time. At 0817, the doors leading to the outside from both EDG rooms were opened to stop the temperature rise. The EDG 0

room ventilating system is sized to maintain each "operating" EDG room at 48.9'C (120 F) assuming outside air at 35 °C (95 °F). In spite of the opened door, the temperature in the EDG I room continued to increase because the recirculation damper to the room had failed in the open position. The open damper allowed hot outside air to enter the EDG room and eventually caused the room temperature to increase beyond its design value. To arrest the temperature rise in this EDG room, the operators mechanically disconnected and closed the recirculation damper. In addition, personnel placed two portable fans in the room to enhance air circulation. In spite of these compensatory actions, at 1313 the EDG 1 room temperature rose to 50.0 °C (122 °F). Finally, by using additional portable fans and blocking open the door between the EDG I room and the plant, the licensee 0 0 successfully arrested the temperature rise. By 1640, the room temperature stabilized at 45.6 C (1 14 F).

Although EDG 1 was declared inoperable per plant procedures because of the high EDG room temperature, it was in fact available to perform its safety function-EDG I provided essential electric power during this event.

The recirculation damper in EDG 2 room had also failed in a slightly open position. An operator mechanically disconnected this damper and put the damper in the fully closed position. Unlike the situation with the EDG I room, this action, in conjunction with opening the EDG 2 room door to the outside, was sufficient to maintain the EDG 2 room temperature below 45.0°C (I 13'F).

Besides the malfunctions experienced in controlling the room temperatures, personnel encountered other complications while transferring electrical power from the EDGs to the offsite power sources. At -2100 on June 25, when operators attempted to transfer the power supply to buses C 1/C2 from bus B (bus B is powered from the offsite source), circuit breaker ABDC 1 failed to close. The transfer was performed using a dead bus.

While personnel were transferring the power supply to buses DIiD2 from the EDGs to the offsite source, they received EDG 2 fault and frequency alarms. The root cause of the malfunction that caused the alarms on EDG 2 was a failed open contact that affected the EDG's governor. If the EDG had to be stopped and restarted during the LOOP, this failure would be easily recoverable.

B.5.3 Additional Event-Related Information During a LOOP, the EDGs provide power to the emergency buses. If both EDGs were to fail, the plant's SBODG would automatically start and load onto one of the emergency buses. When the SBODG successfully starts, it supplies its own auxiliaries. When the SBODG is in standby, the nonessential D2 bus supplies power NUREG/CR-4674, Vol. 27 B.5-2

Appendix B to its auxiliaries. A 125V-dc battery system is one of the SBODG auxiliaries. These batteries have sufficient capacity to maintain dc control power and diesel-generator starting and loading ability. If bus D2 is not powered and the SBODG is not running, the SBODG batteries will deplete in 2.0 h. SBODG breaker AD 213 is normally closed and receives its control power from train 2 of the dc distribution system. The SBODG fuel oil tank is separate from the EDGs' fuel oil tanks. This tank has enough fuel capacity for an 8-h run of the SBODG at the rated load.

The SBODG and its auxiliaries (except the engine radiator) are inside their own structure, which is in a different part of the site from tie EDGs. The structure was designed and built to meet the Ohio State Basic Building Code.

Meeting this code assures protection for the SBODG from the most likely weather-related events that could cause a LOOP, such as rain, ice, or moderate to heavy straight winds (e.g., during a thunderstorm).

However, it does not afford protection against damage from the effects of more severe weather conditions (e.g.,

tornado-caused missiles). Although the SBODG engine radiator is located outside, it has been designed to withstand the same types of weather conditions as the SBODG enclosure (i.e., it is also vulnerable to tornado-generated missiles).

The electrical cabling associated with the SBODG is routed through a buried duct bank.

B.5.4 Modeling Assumptions This event was analyzed as an extremely severe weather-related LOOP. The Integrated Reliability and Risk Analysis System (IRRAS)-based models and analysis tools used by the ASP Program for precursor quantification automatically revised the probabilities for certain basic events and nonrecovery probabilities.

The revised probabilities more accurately reflect the effect that extremely severe weather would have on the parameters used in calculating the likelihood of recovering offsite power, the probability of a reactor coolant pump (RCP) seal loss-of-coolant accident (LOCA), the likelihood of battery depletion, and the probability of demanding the EDGs to start and run. Each revised probability is discussed below. Not all equipment malfunctions impacted the core damage probability (CDP) associated with this event. Justification for not revising the base probability of equipment failure or operator action is also discussed below.

Equipment abnormalities and operator actions that impact the CDP Duration of the LOOP event The LOOP event occurred at 2047 on June 24, 1998. The first offsite power source was restored at 1926 on June 25, 1998. In consideration of the above, this analysis used a 24-h duration for this LOOP event.

The offsite power nonrecovery probabilities for the following basic events in the models were set to TRUE (i.e., probability of occurrence is 1.0) for this initiating event to reflect the anticipated longer times that would be required to recover offsite power. (1) OEP-XHE-NOREC-ST (failure to recover offsite power in the short term), (2)

OEP-XHE-NOREC-2H (failure to recover offsite power within 2 h), (3) OEP-XHE-NOREC-6H (failure to recover offsite power within 6 h), and (4) OEP-XHE-NOREC-SL (failure to recover offsite power before RCP seal failure).

B.5-3 NUREG/CR-4674, Vol. 27

LER No. 346/98-006 Appendix B Failure probabilities of the EDGs The IRRAS-based models and analysis tools used by the ASP Program for precursor quantification automatically revised the probabilities for certain basic events and nonrecovery probabilities. The revised probabilities more accurately reflect the effect that extremely severe weather would have on the parameters used in calculating the likelihood of recovering offsite power, the probability of a reactor coolant pump seal LOCA, and the likelihood of battery depletion. The basic event probabilities that were revised include the probability that the EDGs (basic events EPS-DGN-FC-DGA and -DGB) and the SBODG (basic event EPS-DGN-FC-SBO) will fail to start and 2 2 run because of the extremely severe weather (increased from the nominal value of 3.6 x 10- to 7.8 x10 ).

When the operators attempted to start the EDGs manually from the control room as a result of the severe weather warnngs at 2044, EDG 1 failed to start. However, in the modeling of the event in the ASP analysis, the probability of random failure of EDG I (basic event EPS-DGN-FC-DGA) was neither set to "TRUE" nor increased from the probability associated with a severe weather-related LOOP. The reasons for not changing the random failure probability are as follows:

• Operators started EDG 1 before the LOOP occurred. Although the operators originally had failed to start EDG I using the hand switch in the control room, within 2 min operators had successfully started it manually.

• Subsequent investigations concluded that the contact for the hand switch in the control room was defective; despite the bad contacts, if EDG I had received an automatic signal, it would have started successfully.

Although both EDGs were running before the LOOP occurred, the EDG failure-to-start probability contribution was not removed from the overall EDG failure probability; both EDGs were started only a few minutes before the LOOP. EDG 1 started -1 min before the LOOP, and EDG 2 started -3 min before the LOOP. If the EDGs had been running for a significant amount of time before the LOOP occurred (e.g., for several hours), the EDG failure-to-start probability contribution would have been removed from the overall EDG failure probability.

SBODG vulnerability to tornadoes Unlike the EDGs, the SBODG is not protected from tornado-generated missiles. Reasonable protection from high wind and tornado effects is provided to the SBODG as follows: First, the cabling associated with the SBODG is routed through a buried duct bank. Therefore, these cables are protected from tornado effects.

Second, according to the final safety analysis report (FSAR), only the engine radiator of the SBODG is outside 3

except the building. However, the radiator has been designed to withstand most types of outdoor conditions, effects of the most severe weather (e.g., tornado-generated missiles). Finally, the SBODG is enclosed in a against falling light structure that meets the Ohio building code. Although this structure provides protection EDGs, debris, the building does not afford protection against tornado-generated missiles. Therefore, unlike the the SBODG is vulnerable to missiles. References 1 and 2 documents the damage incurred at the Davis-Besse site because of this tornado. While there was damage to several onsite and offsite systems (e.g., offsite power, was no the telephone system, meteorological tower instruments, and the roof of the turbine building), there observed during evidence of damage caused by heavy missiles anywhere on the site, and no heavy missiles were the storm. Most of the damage incurred by equipment and buildings because of the tornado was caused by high as winds and accompanying heavy ram. That is, during this tornado [classified by the National Weather Service NUREG/CR-4674, Vol. 27 B .5-4

Appendix B I VV Nn 'AAA/Q.Q nd"LKJ ApDendix B I FR Nn LIAIOR.naf "F2" due to wind speeds between 182-253 km/h (113-157 mi/h)], the small target area of the SBODG was not threatened by heavy missiles. The SBODG building is at the southern edge of the site; it is not near the turbine building or the switchyard. Also, the SBODG building is not on a straight line path between these two site structures. Most of the physical damage to structures because of the tornado that struck the site occurred at the switchyard and at the turbine building. Based on these considerations, this analysis assumed that the likelihood of failure of the SBODG as a result of missiles, given that the tornado occurred, was negligible compared to the random SBODG failure probability of 7.8 x 10-2. Hence, the probability of SBODG failing to start or run (EPS-DGN-FC-SBO) was not revised further from the probability used to reflect the effects of the severe weather conditions based on the SBODG providing power to its own auxiliaries and its reliance on nonessential bus D2.

A new basic event was added to the Davis-Besse model, ACP-XHE-XE-ALT, to represent the probability that the operator fails to start the SBODG and to align it to supply power to bus D2 (probability = 1.0 x 10.2).

Common-cause failure considerations between the SBODG and the EDGs The SBODG provides diversity against common-cause failure (CCF) of the EDGs. The CCF coupling mechanisms between the SBODG and the EDGs are few. For example, the two EDGs and the SBODG are of different design. While the EDGs are cooled by service water, the SBODG is air-cooled. Unlike the EDGs, which are located in adjacent structures, the SBODG has its own structure. The SBODG does not share auxiliaries, such as fuel tanks, with the EDGs. The test and maintenance practices on the EDGs are different from those for the SBODG. Therefore, the IRRAS-based model for Davis-Besse was modified to capture the distinction between the CCF considerations for the EDGs and those involving the SBODG. The failure probability for the basic event, EPS-DGN-CF-ALL, which represents the CCF probability for the two EDGs and the SBODG, was reduced to 3.6 x 10'. to reflect the weak coupling among the three EDGs. A new basic event, EPS-DGN-CF-AB, was added to account for the CCF susceptibilities between the two EDGs. The probability for this basic event was estimated using Ref. 5 to figure out the alpha factor for two-out-of-two EDG failures.

This resulted in an EDG CCF probability of 3.0 x 10'. The Nuclear Regulatory Commission's (NRC's) CCF database was reviewed to identify events that could fail two EDGs and the SBODG. Four events were identified.

During two of these events, the cold weather common to the site caused the failures. During the other two events, biofouling of the EDGs' fuel oil caused the failures. Based on these four failures, the alpha factor used in the CCF calculations for three-out-of-three EDG failures was estimated to be 4.6 x 10'.

Equipment abnormalities that do not impact the CDP Switchyard ACB failures During the storm, ACB 34561 opened. Subsequently, ACB 34562 cycled open three times and eventually stayed open. These two breakers connect offsite power lines to the switchyard at the Davis-Besse site. The opening of these breakers along with damage to the switchyard, led to the LOOP. Therefore, the impact of the condition of these breakers was implicitly captured in the CCDP assessment.

NUREG/CR-4674, Vol. 27 B.5-5 B.S-5 NUREG/CR-4674, Vol. 27

LER No. 346/98-006 Appendix B Non-1E power for SBODG auxiliaries When the SBODG successfully starts, it supplies power to its own auxiliaries. However, if the SBODG is in standby, nonessential bus D2 supplies power to the SBODG auxiliaries. If bus D2 were not powered, then some SBODG auxiliaries (e.g., SBODG battery) would degrade. Without recharging from either the SBODG or bus D2, the SBODG batteries will deplete in 2.0 h Because of this and the need to power the motor-driven feedwater pump (in the auxiliary feedwater mode), the emergency procedure gives high priority to powering bus D2 as soon as possible. During the event, the operators restored power to bus D2 from EDG 2 within 15 min. Hence, the probability of the operators failing to restore power to nonessential bus D2 (ACP-XHE-BUS-D2) was not revised from its base probability of 1.0 x 102.

Limited capacity of SBODG fuel oil tank The SBODG fuel oil tank is separate from the EDGs' fuel oil tanks. It has enough capacity for an 8-h run at the rated load. Although detailed procedures exist for routine refilling of the tank, no procedures exist for checking the fuel oil tank level during a LOOP. Regardless, in comparison to the random failure of the SBODG (7.8 x 10.2), the probability of failing to refill the SBODG fuel tank is low. Therefore, that failure probability is not explicitly modeled in this analysis. Hence, the probability of SBODG failing to start or run (EPS-DGN FC-SBO) was not revised further from the probability used to reflect the effects of the severe weather conditions based on the limited capacity of the fuel oil tank.

Loss of power to the 120V-ac electrical distribution panel YAU During cleanup activities, personnel discovered that the LOOP, in combination with the loss of electrical distribution panel YAU, resulted in the condensate polisher's isolation valves and the condensate recirculation valve failing open. This failure caused the release of condensate system resin to the hotwell, that in turn, elevated the sulfate level in the secondary-side water. Other consequences of the loss of panel YAU were speculated to be the loss of input signals to the safety parameter display system (SPDS). Although the loss of the SPDS results in a loss of critical information on RCS parameters in a graphical display format, the operators have access to this information via other means. Therefore, loss of this bus was assumed to have no impact on CDP.

Failure of a main steam safety valve to reseat When the reactor tripped because of the LOOP, this caused a pressure transient on the secondary side. One main steam safety valve (MSSV) lifted below its set point and did not fully reseat. However, when the steam pressure dropped, this MSSV fully reseated. The impact of this degradation (deviation of the actual lift pressure from the set point) was assumed to be negligible because the valve did reclose at a lower pressure.

Failure of the EDG 2 electronic governor After recovering offsite power, while operators began transferring power to busses D I/D2 from EDG 2 to offsite power, the EDG 2 electronic governor failed. This failure was attributed to a contact pair failing to open. This condition could have influenced the CDP if the EDG had to be stopped and restarted during the LOOP. The NUREG/CR-4674, Vol. 27 B.5-6

ADoendix B

..... No 346/98-006 LER licensee's procedures do not specify the stopping and the restarting of the EDG during a LOOP. Further, the failure was easily recoverable. Therefore, this failure was assumed to have no impact on the CDP.

Failure of the EDG I room ventilation recirculation damper Because of the continued heating up of the EDG I room, the operators determined that the ventilation recirculation damper had failed open. This analysis did not increase the EDG "failure to run" probability in spite of this degradation and assumed that the impact on CDP was negligible based on the following justification:

• As illustrated by the actions pursued during this event, the operators had the capability to detect and take compensatory measures (opening doors and installing fans) to arrest the temperature rise.

• The maximum temperature reached was 51.7°C (125 'F). Per plant procedures, this resulted in EDG I being declared inoperable, because it exceeded the 48.9'C (120'F) design parameter for the EDG ventilation system. Subsequent analysis performed by the licensee determined that the most limiting components for temperature in the rooms were the EDG differential relays and that the limiting temperature for these relays was 55.0'C (131 'F).

• Although personnel declared EDG I inoperable per plant procedures, it was available to perform its safety function; in fact, it continued to provide essential electric power during the event.

Degraded EDG 2 ventilation recirculation damper The operators determnined that the recirculation damper in the EDG 2 ventilation system had failed slightly open.

However, the impact on the CDP attributed to this condition was assumed to be negligible due to the following:

• As illustrated by actions taken during this event, the operators had the capability to detect and take compensatory measures (opening doors and installing fans) to arrest the temperature rise.

• The maximum temperature reached was 45.0°C (113 OF).

Failure of circuit breaker ABDC I After the initial recovery of offsite power, while personnel were transferring the supply for bus C 1/C2 from EDG I to offsite power, breaker ABDC I failed to close. Operators had to accomplish a dead bus transfer shortly thereafter. The condition that caused the breaker failure affected the recovery of offsite power. However, it did not affect the capability to establish power from EDG I to the emergency bus. Further, it did not affect the capability of the EDG to continue to run. As illustrated, operators easily compensated for the failure of the breaker by providing offsite power to the emergency bus via an alternate path. Because this failure had no adverse impact, the failure was not explicitly modeled in the CCDP calculations.

Automatic reset of the CREVS train I from water- to air-cooled mode The CREVS train operated properly in the air-cooled mode until operators reset the system to the water-cooled mode. Therefore, there was no impact on the CDP.

NUREG/CR-4674, Vol.27 B.5-7 B5-7 NUREG/CR-4674, Vol. 27

LER No. 346/98-006 Appendix B Loss of power to emergency notification system equipment and loss of all wind speed and direction sensors The loss of power to some equipment, such as sirens, and wind damage to the wind speed and direction sensors in the meteorological tower had some impact on emergency management and risk to the public. However, there was no impact on the CDP.

Water intrusion into the turbine building cable trays and MCC E5 Rainfall that entered the turbine building through the storm-induced hole in the roof caused water intrusion in the cable trays. The impact of this on the CDP was assumed to be negligible because the cables that got wet were not safety-related, and water impinging on the cable jackets did not impact their functionality. The water intrusion in motor-control center (MCC) E5 caused damage (i.e., the ground faulting of a circuit breaker).

However, MCC E5 supplies nonessential lighting only. Therefore, this failure had no impact on the CDP.

B.5.5 Analysis Results The CCDP estimated for this event is 5.6 x 10'. All of the dominant sequences for this event involve station blackout (SBO) sequences coincident with the depletion of the batteries (sequences 18-02 and 18-11 in Fig.

B.5.2), the failure of the RCP seals because offsite power was not recovered in a timely manner (sequences 18-09 and 18-18), or a PORV sticking open with the failure to recover offsite power in the short term (sequence 18-20).

The dominant sequence, highlighted on the event trees in Figs. B.5.1 and B.5.2, involves a SBO sequence, LOOP Sequence 18-02:

• a LOOP,

• a successful reactor trip,

• a failure of emergency ac power,

• a successful initiation of auxiliary feedwater,

"* no challenge to the power-operated relief valves (PORVs) or the safety valves,

"* sufficient cooling so that the RCP seals do not fail, and a failure to recover offsite power before the batteries are depleted, which leads to core damage.

The next most dominant sequences, LOOP Sequences 18-11 and 18-09 in Fig. B.5.1 and Fig. B.5.2, contribute approximately 32% and 7%, respectively, to the CCDP. LOOP Sequence 18-1 1 involves an SBO, the PORVs open and reclose successfully, the RCP seals do not fail, and failure to recover offsite power before battery depletion, resulting in core damage. LOOP Sequence 18-09 involves an SBO, failure to recover offsite power in the short-term, and failure to recover offsite power before a seal LOCA occurs, leading to core damage.

All dominant cut sets include the failure of the EDGs and the SBODG. The duration of the LOOP event is a significant contribution.

Definitions and probabilities for selected basic events are shown in Table B.5. 1. The conditional probabilities associated with the highest probability sequences are shown in Table B.5.2. Table B.5.3 lists the sequence logic B.5-8 NUREG/CR-4674, Vol.27 Vol. 27 B.5-8

Atmendix B A I nI x ,IilJl" 1 *1./

NJ iA*OlfVI.*U*lA*li associated with the sequences listed in Table B.5.2. Table B.5.4 describes the system names associated with the dominant sequences. Minimal cut sets associated with the dominant sequences are shown in Table B.5.5.

B.5.6 References

1. LER 346/98-006, "Tornado Damage to Switchyard Causing Loss of Offsite Power," August 21, 1998.

2. NRC Team Inspection Report 50-346/98012 (DRP), August 14, 1998.

3. Davis-Besse Unit 1, Final Safety Analysis Report.

4. Davis-Besse Unit I, Individual Plant Examination, February 26, 1993.

5. Marshall, Rasmuson, and Mosleh, Common-Cause Failure Parameter Estimations, USNRC Report NUREG/CR-5497, October 1998.

NUREG/CR-4674, Vol. 27 B.5-9 B.5-9 NUREG/CR-4674, Vol. 27

ADvendix B S_,,'D , 2,.)IUlO-flfUU Anzendi B Fig. B.5.1 Dominant core damage sequence for LER 346/98-006.

B.5-1O NUREG/CR-4674, Vol. Vol. 27 27 B.5-1 0

Appendix B I [*D Nit, *AKIQQ AppendixB ~~~~~I VD .,J

%I, IAQIOQ , tAiAai.

Kl a Y 0ý Ca 0 00 a ~0 x e a w 00 a a W N 0 0000U 0 0 0 U 0 Q 0 0 0 0 0 0 0 0 0 0 0 Fig. B.5.2 Dominant core damage sequence for LER 346/98-006.

Vol. 27 B.5-11 B.5-II NUREG/CR-4674, NUREG/CR-4674, Vol. 27

I 1ETl NT.. 2-

]AllflQ 'll'bt Annendix B Lr.l*J~o j.tl*OWU=4 Table B.5.1. Definitions and Probabilities for Selected Basic Events for LER No. 346/98-006 Modified Base Current for this Event name Description probability probability Type event Initiating Event-LOOP 1.6 E-005 1.0 E+O00 TRUE Yes IE-LOOP Initiating Event-Steam 1.6 E-006 0.0 E+000 Yes IE-SGTR Generator Tube Rupture Initiating Event-Small Loss-of- 2.3 E-O06 0.0 E+O00 Yes IE-SLOCA Coolant Accident (SLOCA)

Operator Fails to Power 1.0 E-002 1.0 E-002 NEW No ACP-XHE-BUS-D2 Nonessential Bus D2 Operator Fails to Align the 1.0 E-002 1.0 E-002 NEW No ACP-XHE-XE-ALT Station Blackout Diesel Generator (SBODG)

Common-Cause Failure (CCF) 3.0 E-003 3.0 E-003 NEW No EPS-DGN-CF-AB of the Emergency Diesel Generators (EDGs)

CCF of EDGs and SBODG 3.6 E-005 3.6 E-005 NEW No EPS-DGN-CF-ALL EDG I Fails to Start and Run 3.6 E-002 7.8 E-002 Extremely Yes EPS-DGN-FC-DGA severe weather LOOP EDG 2 Fails to Start and Run 3.6 E-002 7.8 E-002 Extremely Yes EPS-DGN-FC-DGB severe weather LOOP SBODG Fails to Start and Run 3.6 E-002 7.8 E-002 Extremely Yes EPS-DGN-FC-SBO severe weather LOOP LOOP Sequence 18-02 8.0 E-001 8.0 E-001 No LOOP-18-02-NREC Nonrecovery Probability Failure to Recover Electric Power (EP)

LOOP Sequence 18-09 8.0 E-001 8.0 E-001 No LOOP-18-09-NREC Nonrecovery Probability Failure to Recover EP B.5-1Z NUREG/CR-4674, Vol.27 Vol. 27 B.5-12

Appendix B LER No. 346/98-006 Table B.5.1. Definitions and Probabilities for Selected Basic Events for LER No. 346/98-006 (Continued)

Modified Base Current for this Event name Description probability probability Type event LOOP- 18-11 -N REC LOOP Sequence 18-11 8.0 E-001 8.0 E-00I No Nonrecovery Probability Failure to Recover El' LOOP-18-18-NREC LOOP Sequence 18-18 8.0 E-001 8.0 E-001 No Nonrecovery Probability Failure to Recover EP LOOP-18-20-NREC LOOP Sequence 18-20 8.0 E-001 8.0 E-O01 No Nonrecovery Probability Failure to Recover EP OEP-XHE-NOREC-2H Operator Fails to Recover 6.4 E-002 1.0 E+O00 TRUE Yes Offsite Power Within 2 h OEP-XHE-NOREC-6H Operator Fails to Recover 3.7 E-002 1.0 E+O00 TRUE Yes Offsite Power Within 6 h OEP-XHE-NOREC-BD Operator Fails to Recover 2.0 E-002 7.1 E-001 Extremely Yes Otfsite Power Before Battery severe weather Depletion LOOP OEP-XHE-NOREC-SL Operator Fails to Recover 7.5 E-001 1.0 E+O00 TRUE Yes Offsite Power Before RCP Seals Fail OEP-XHE-NOREC-ST Operator Fails to Recover 2.4 E-001 1.0 E+O00 TRUE Yes Electric Power in Short Term PPR-SRV-CO-SBO PORV/SRVs Open During 3.7 E-001 3.7 E-001 No Station Blackout PPR-SRV-OO-PORV PORV Fails to Reclose after 3.0 E-002 3.0 E-002 No Opening RCS-MDP-LK-SEALS RCP Seals Fail Without 9.3 E-003 8.3 E-002 Extremely Yes Cooling and Injection severe weather LOOP B.5-13 B.5-13 NUREG/CR-4674, Vol. 27 NUREG/CR-4674, Vol. 27

Anoendlix B LER No. 346/98-006 All-ix Table B.5.2. Sequence Conditional Probabilities for LER No. 346/98-006 Conditional Event tree Sequence core damage Percent name number probability contribution (CCDP)

LOOP 18-02 3.0 E-004 53.6 LOOP 18-11 1.8 E-004 32.1 LOOP 18-09 3.9 E-005 7.0 LOOP 18-18 2.3 E-005 4.1 LOOP 18-20 8.2 E-006 1.5 Total (all sequences) 5.6 E-004 Table B.5.3. Sequence Logic for Dominant Sequences for LER No. 346/98-006 Event tree name Sequence Logic number LOOP 18-02 /RT-L, EP, /AFW-L, /PORV-SBO,

/SEALLOCA, OP-BD LOOP 18-11 /RT-L, EP, /AFW-L, PORV-SBO,

/PRVL-RES, /SEALLOCA, OP-BD LOOP 18-09 /RT-L, EP, /AFW-L,/PORV-SBO, SEALLOCA, OP-SL LOOP 18-18 /RT-L, EP, /AFW-L, PORV-SBO,

/PRVL-RES, SEALLOCA, OP-SL LOOP 18-20 /RT-L, EP, /AFW-L, PORV-SBO, PRVL-RES, ACP-ST B.5-14 NUREG/CR-4674, Vol. 27 NUREG/CR-4674, Vol. 27 B.5-14

,t nn*nrllv 1R A arln~di R LER No. 346/98-006 Table B.5.4. System Names for LER No. 346/98-006 System name Logic ACP-ST Offsite Power Recovery in Short Term AFW-L No or Insufficient EFW Flow During a LOOP EP Emergency Power Fails OP-BD Operator Fails to Recover Offsite Power Before Battery Depletion OP-SL Operator Fails to Recover Offsite Power Before a Seal LOCA Occurs PORV-SBO PORVs/Safety Relief Valves Open During an SBO PRVL-RES PORVs, Block Valves, and SRVs Fail to Reseat RT-L Reactor Fails to Trip During a LOOP SEALLOCA RCP Seals Fail During a LOOP NUREG/CR-4674, Vol. 27 B.5-15 B.5-15 NURIEG/CR-4674, Vol. 27

LER No. 346/98-006 Table B.5. 5. Conditional Cut Sets for Higher Probability Sequences for LER No. 346/98-006 Cut set Percent number contribution CCDpa Cut setsb LOOPSequence_18-02 3.0 E-004 .- '

1 51.3 1.6 E-004 EPS-DGN-FC-DGA, EPS-DGN-FC-DGB, EPS-DON-FC-SBO, LOOP-I 8-02-NREC, IPPR-SRV-CO-SBO, /RCS-MDP-LK-SEALS, OEP-XHE-NOREC-BD 2 25.0 7.6 E-005 EPS-DGN-CF-AB, EPS-DON-FC-SBO, LOOP-18-02-NREC,

____________/PPR-SRV-CO-SBO, /RC S-MDP-LK-SEALS, OEP-XH-E-NOREC-BD 3 6.6 2.0 E-005 EPS-DGN-FC-DGA, EPS-DON-FC-DGB, ACP-XHE-BUS-D2, LOOP-I 8-02-NREC, /PPR-SRV-CO-SBO, IRCS-MDP-LK-SEAIS, OEP-XHE-NOREC-BD 4 6.6 2.0 E-005 EPS-DGN-FC-DOA, EPS-DON-FC-DGB, ACP-XHE-XE-ALT, LOOP- I 8-02-NREC, IPPR-SRV-CO-SBO, /RCS-MDP-LK-SEALS,

__________________OEP-XHE-NOREC-BD 5 3.9 1.2 E-005 EPS-DGN-CF-ALL, LOOP- I8-02.-NREC, /PPR-SRV-CO-SBO,

_________/RCS-MDP-LK-SEALS, OEP-XHE-NOREC-BD 6 3.2 9.7 E-006 EPS-DGN-CF-AB, ACP-XHE-XE--ALT, LOOP- I8-02-NREC,

_________________ _______/PPR-SRV-CO-SBO, /RCS-MDP-LK-SEALS, OEP-XHE-NOREC-BD 7 3.2 9.7 E-006 EPS-DGN-CF-AB, ACP-XHE-BUS-D2, LOOP- I NREC,

/PPR-SRV-CO-SBO, /RCS-MDP-LK-SEALS, OEP-XHE-NOREC-BD LOOP Sequence_18-11 1.8 E-004 1 51.3 9.2 E-005 EPS-DGN-FC-DCA, EPS-DON-FC-DOB, EPS-DGN-FC-SBO, LOOP-18-1 I-NREC, PPR-SRV CO SBO, /RCS-MDP-LK-SEALS, OEP-XHE-NOREC-BD 2 25.0 4.5 E-005 EPS-DGN-CF-AB, EPS-DON-FC-SBO, LOOP-]18-11 -NREC.

__________________PPR-SRV-CO-SBO, IRCS-MDP-LK-SEALS, OEP-XHE-NOREC-BD 3 6.6 1.2 E-005 EPS-DGN-FC-DGA. EPS-DON-FC-DGB, ACP-XHE-BUS-D2, LOOP- 18-1Il-NREC. PPR-SRV-CO-SBO, IRCS-MDP-LK-SEALS, OEP-XHE-NOREC-BD 4 6.6 1.2 E-005 EPS-DON-FC-DGA, EPS-DGN-FC-DGB, ACP-XHE-XE-ALT, LOOP- 18-1Il -NREC, PPR-SRV-CO-SBO, /RCS-MDP-LK-SEALS, OEP-XHE-NOREC-BD 5 3.9 6.9 E-006 EPS-DGN-CF-ALL, LOOP-i18-i1 -NREC, PPR-SRV-CO-SBO,

______I _______ ____ RCS-MDP-LK-SEALs, OEP-XHE-NOREC-BD 27 B.5-16 NUREGICR-4674, Vol.

NUREG/CR-4674, Vol. 27 B.5-16

Appendix B LER No. 346/98-006 Table B.5.5. Conditional Cut Sets for Higher Probability Sequences for LER No. 346/98-006 (Continued)

Cut set Percent number contribution CCDPa Cut setsb 6 3.2 5.7 E-006 EPS-DON-CF-AB, ACP-XJ-iE-XE-ALT, LOOP-18-11I-NREC,

_______________PPR-SRV-CO-SBO, /RCS-MDP-LK-SEALS, OEP-XHE-NOREC-BD 7 3.2 5.7 E-006 EPS-DGN-CF-AB, ACP-XHE-BUS-D2, LOOP-18-1 1-NREC,

_________ ______PPR-SRV-CO-SBO, /RCS-MDP-LK-SEALS, OEP-XHE-NOREC-BD LOOP Sequence 18-09 3.9 E-005 1 51.3 2.0 E-005 EPS-DON-FC-DGA, EPS-DGN-FC-DGB, EPS-DON-FC-SBO.

LOOP- I8-09-NREC, /PPR-SRV-CO-SBO, RCS-MDP-LK-SEALS, OEP-XHE-NOREC-SL 2 25.0 9.7 E-006 EPS-DGN-CF-AB, EPS-DGN-FC-SBO, LOOP- 18-09-NREC.

___________/PPR-SRV-CO-SBO, RCS-MDP-LK-SEALS, OEP-XHE-NOREC-SL 3 6.6 2.6 E-006 EPS-DGN-FC-DGA. EPS-DGN-FC-DGB, ACP-XHE-BUS-D2, LOOP- I 8-09-NREC, /PPR-SRV-CO-SBO, RCS-MDP-LK-SEALS,

________OEP-XHE-NOREC-SL 4 6.6 2.6 E-006 EPS-DGN-FC-DGA, EPS-DGN-FC-DGB. ACP-XHE-XE-AIT, LOOP- I8-09-NREC, /PPR-SRV-CO-SBO, RCS-MDP-LK-SEALS, OEP-XHE-NOREC-SL 5 3.9 1.5 E-006 EPS-DGN-CF-ALL, LOOP-lI8-09-NREC, IPPR-SRV-CO-SBO,

___________RCS-MDP-LK-SEALS, OEP-XHE-NOREC-SL 6 3.2 1.2 E-006 EPS-DGN-CF-AB. ACP-XHE-XE-AIT. LOOP-18-09-NREC,

__________ ________/PPR-SRV-CO-SBO, RCS-MDP-LK-SEALS, OEP-XHE-NOREC-SL 7 3.2 1.2 E-006 EPS-IDiN-CF-AB, ACP-XHiE-BUS-D2, LOOP- I8-09-NREC, LOOPSequence 18-18 2.3 E-005 ~~

1 51.3 1.2 E-005 EPS-DGN-FC-DGA. EPS-DON-FC-DOB, EPS-DGN-FC-SBO, LOOP- I 8-I 8-NREC, PPR-SRV--CO-SBO. RCS-MDP-LK-SEALS, OEP-XHE-NOREC-SL 2 25.0 5.7 E-006 EPS-DGN-CF-AB, EPS-DON-FC-SBO, LOOP-IS-I 8-NREC,

__________ _______PPR-SRV-CO-SBO, RCS-MDP-LK-SEALS, OEP-XHE-NOREC-SL 3 6.6 1,5 E-006 EPS-DGN-FC-DGA, EPS-DGN-FC-DG;B, ACP-XHE-BUS-D2.

L-OOP- 18-I 8-NREC, PPR-SRV-CO-SBO, RCS-MDP-LK-SEALS,

()EP-XHE-NOREC-SL 4 6.6 1.5 E-006 EPS-DGN-FC-DGA, EPS-DON-FC-DGB, ACP-XHE-XE-ALT, LOOP- I8-1 8-NREC. PPR-SRV-CO-SBO, RCS-MDP-LK-SEALS,

___________OEP-XHE-NOREC-SL N1JREGICR-4674, Vol. 27 B.5-17 B.5-17 NUREG/CR-4674, Vol. 27

Appendix B LER No. 346/98-006Aei Table B.5.5. Conditional Cut Sets for Higher Probability Sequences for LER No. 346/98-006 (Continued)

Cut set Percent number contribution CCDP° Cut setsb 5 3.9 8.8 E-007 EPS-DGN-CF-ALL, LOOP-18-18-NREC, PPR-SRV-CO-SBO, RCS-MDP-LK-SEALS, OEP-XHE-NOREC-SL 6 3.2 7.3 E-007 EPS-DGN-CF-AB, ACP-XHE-XE-ALT, LOOP-18-18-NREC, PPR-SRV-CO-SBO, RCS-MDP-LK-SEALS, OEP-XHE-NOREC-SL 7 3.2 7.3 E-007 EPS-DGN-CF-AB, ACP-XHE-BUS-D2, LOOP-18-18-NREC, PPR-SRV-CO-SBO, RCS-MDP-LK-SEALS, OEP-XI-IE-NOREC-SL LOOP Sequence 18-20 8.2 E-006 i .. . *

. .. .- <, - -/ ,,- ,

1 51.3 4.2 E-006 EPS-DGN-FC-DGA, EPS-DGN-FC-DGB, EPS-DGN-FC-SBO, LOOP- 18-20-NREC, PPR-SRV-CO-SBO, PPR-SRV-OO-PORV, OEP-XHE-NOREC-ST 2 25.0 2.1 E-006 EPS-DGN-CF-AB, EPS-DGN-FC-SBO, LOOP- I-20-NREC, PPR-SRV-CO-SBO, PPR-SRV-OO-PORV, OEP-XHE-NOREC-ST 3 6.6 5.4 E-007 EPS-DON-FC-DGA, EPS-DGN-FC-DGB, ACP-XHE-BUS-D2, LOOP-18-20-NREC, PPR-SRV-CO-SBO. PPR-SRV-00-PORV, OEP-XHE-NOREC-ST 4 6.6 5.4 E-007 EPS-DGN-FC-DGA, EPS-DGN-FC-DGB, ACP-XHE-XE-ALT, LOOP-18-20-NREC, PPR-SRV-CO-SBO, PPR-SRV-OO-PORV, OEP-XHE-NOREC-ST 5 3.9 3.2 E-007 EPS-DGN-CF-ALL, LOOP-18-20-NREC. PPR-SRV-CO-SBO, PPR-SRV-OO-PORV, OEP-XHE-NOREC-ST 6 3.2 2.6 E-007 EPS-DGN-CF-AB. ACP-XHE-XE-ALT, LOOP-I8-20-NREC, PPR-SRV-CO-SBO, PPR-SRV-OO-PORV, OEP-XHE-NOREC-ST 7 3.2 2.6 E-007 EPS-DGN-CF-AB, ACP-XHE-BUS-D2, LOOP- 18-20-NREC, PPR-SRV-CO-SBO, PPR-SRV-0-PORV, OEP-XHE-NOREC-ST Total (all sequences) 5.6 E-004 "0The conditional probability for each cut set is detcrmined by multiplying the probability of the initiating event by the probabilities of the basic events in that minimal cut set. The probabilities for the initiating events and the basic events are given in Table B.5.I.

b'Basic events OEP-XHE-NOREC-2H, OEP-XHE-NOREC-6H, OEP-XHE-NOREC-SL, and OEP-XHE-NOREC-ST are TRUE type events which are not normally included in the output of fault tree reduction programs but have been added to aid in understanding the sequences to potential core damage associated with the event.

Vol. 27 B.5-18 NUREG/CR-4674, Vol. 27 B.5-18