Forwards draft rept on risk evaluation of loss of spent fuel pool … · 2018. 1. 30. · April 7, 1995 '„".„".'.Balelle Pacific Northwest Laboratories Battelle Boulevard P.O

April 7, 1995

'„".„".'.BalellePacific Northwest LaboratoriesBattelle BoulevardP.O. Box 999Richland, Washington 99352Telephone (509t 372-413.4

Mr. Robert L. PallaNuclear Regulatory CommissionOffice of Nuclear Regulatory RegulationOne White Flint NorthMail Stop 8H7Rockvi lie, Maryland 20852

Dear Bob:

Attached please find a copy of our latest report on Risk Evaluation of Loss ofSpent Fuel Pool Coolinng Susquehanna. If I can provide any additionalinformation, please let me know.

Sincerely,

Truong Vo, Ph.D.Project Manager

attachment

cc: George Vargo (PNL); w/o attachmentBryan Gore (PNL); w/o attachmentMitch Cunningham (PNL); w/o attachment

9504250393 'al50420PDR ADQCtt'5000387

PDR

RISK ANALYSIS FOR SPENT FUEL POOL COOLING ATSUSQUEHANNA ELECTRIC POWER STATION

T. R. BlackburnT. M. MittsH. K. PhanT. V. Vo, Project Manager

October 1994

Prepared forRisk Applications BranchOffice of Nuclear Reactor RegulationU.S. Nuclear Regulatory Commissionunder Contract OE-AC06-76RLO 1830

Pacific Northwest laboratoryRichland, Washington 99352

ABSTRACT

This report provides an evaluation of potential loss of spent fuel poolcooling events at Susquehanna Steam Electric Station (SSES). The evaluationestimates the likelihood of a loss of spent fuel pool cooling event at SSES

and the associated probability of spent fuel pool heat up to near boilingconditions. The evaluation also includes a qualitative assessment of theconditional contribution to core damage from such events and an order-of-magnitude core damage frequency estimation.

This evaluation is performed under contract to the NRC to support evaluationof potential generic issue (PGI) 93-01 regarding safety impact of loss ofspent fuel pool cooling incidents. This analysis was performed to assess therisk significance of event sequences that involve a loss of spent fuel poolcooling. The analysis investigates allegations and concerns identified in the10 CFR 21 report filed by two former contract employees which alleged SSES hasdesign deficiencies associated with spent fuel pool cooling which make itsusceptible to unsafe conditions.

The analysis addresses SSES plant conditions that existed prior to the 10 CFR2l (Code of Federal Regulations) report and also addresses current plantconditions. Data for this analysis was obtained from Pennsylvania Power andLight Company, the SSES licensee, and from other sources of probabilistic riskassessment information. The Integrated Reliability and Risk Analysis System(IRRAS) computer code was used to aid in performing the analysis. This reportdescribes background for the evaluations performed, the methodology used inthe evaluation, the input data and modeling used for analyses, the analysestechniques and results, and the conclusions.

~: m i e t '"~ II g~ 34tt~

1V

EXECUTIVE SUMMARY

Back round and Ob 'ectives

This draft report contains risk analysis information for the Susquehanna Steam

Electric Station (SSES) in support of the U. S. Nuclear Regulatory Commission

(NRC) evaluation of the claims made in a Title 10 of the Code of FederalRegulations (CFR) Part 21 (Part 21) report concerning spent fuel pool cooling(SFPC) systems inability to meet regulatory requirements. The Part 21 reportand supplemental letters claim that SSES has design flaws which under certaindesign bases accident conditions could cause loss of SFPC with a subsequentdetrimental effect on components required for safe operations. Theseconditions could lead to eventual core damage and eventual offsiteradioactivity releases. This project supports the NRC evaluations byperforming risk and reliability analyses to provide realistic estimates of thefollowing:

1) the likelihood of the various initiators occurring that could leadto loss of SFPC system,

2) the likelihood of the most important sequences leading toinadequate SFPC from normal and back-up systems,

3) the likelihood of the most important sequences leading toinadequate core cooling,

4) the consequences of these events in terms of core damage.

This draft report identifies and estimates the frequency of initiating eventsand accident sequences causing SFP heat-up to near boiling conditions and thepotential for the important sequences to contribute to core damage at the SSESsite.

The SSES site is located near Berwick, Pennsylvania. The power plant consistsof two General Electric BWR-4 (Boiling Water Reactor) nuclear reactors, eachrated at 3293 HWt with an electric generation output of 1050 MWe. Each unithas a spent fuel pool (SFP) capable of holding 2840 fuel assemblies. The SFPsare both located in the common reactor building. Normal cooling for the SFPsis provided by two independent spent fuel pool cooling systems. Backupcooling to the SFPs is provided from the residual heat removal (RHR) system.Cooling to both pools may be accomplished by SFPC or RHR system of one unit byconnecting the pools via the shipping cask pit. In the worst case, withoutSFPC or RHR providing closed loop cooling for the SFP, boiling can providedecay heat removal from the SFPs with makeup provided from emergency servicewater (ESW) or other systems.

Summar of Overall Nethodolo

The analysis uses probabilistic risk assessment (PRA) procedures as describedin Nuclear Regulation/Contractor Report, NUREG/CR-2300, (American Nuclear,Society [ANS] and Institute of Electronics and Electrical Engineers [IEEE]1983). This technique was used to estimate the likelihood of various

initiating events that can cause a loss of SFPC to lead to near boilingconditions in the SFP. The approach was continued to provide an order-of-magnitude estimate of the likelihood that the most important event sequencescould lead to failure of emergency core cooling equipment and thecorresponding conditional core damage frequency.

The analysis includes review of plant specific and general industryinformation to identify events and plant conditions impacting the requirementsand characteristics of plant structures, systems, and components used forcooling for the SFPs and those that can provide cooling for the reactor core.The information gathered is reviewed and PRA guidance used to estimate thepotential for failure of the normal and back-up systems used for cooling theSFPs and those that can provide cooling to the reactor core. The analysis isperformed for "As-Found" plant conditions that represent the status of plantprocedures, hardware, and, loss of SFPC issue awareness at SSES prior to thePart 21 report and for "As-Fixed" conditions that reflect the current statusof plant procedures, hardware, and loss of SFPC issue awareness at SSES.

The analysis process involved reviewing information, developing plant logicmodels to represent plant response to initiating events, making assumptionsnecessary to bound the analysis, evaluating data, and quantifying to estimateprobabilitie '. The information reviewed includes design and operationdocuments that describe the plant layout, configuration, procedures, andprobabilistic risk assessment. Information from published PRAs of otherplants was also reviewed. Additionally, two plant walkdowns were performed togather information. The plant conditions to be considered were determinedfrom evaluations of recent refueling outage information. This was used todetermine the system success criteria that are used in the plant logic models.Because of the different operating conditions and related success criteria,the model was broken down into Cases. Each Case represents a unique set ofconditions that r'equire separate modeling. Selection of the Cases is based onthe different decay heat levels present in the spent fuel pools, the availablecapacity to remove this heat via the spent fuel pool cooling system, theavailability of RHR, and the plant operating condition. Tables ES. 1 and ES.2summarize the Cases for the As-Found and As-Fixed conditions. Note that themodel was developed for the site, but the Unit 1 and Unit 2 designators aremodeling artifacts and do not represent the actual Units at the site. In themodel, Unit 1 experiences all the outages, and Unit 2 is always operating.

The plant's response to the initiating events was modeled with event trees,and the likelihood of failures in the various paths of the event trees wereestimated from fault trees that model the systems and from human reliabilityanalyses that model the operator actions. The failure probability values usedin the fault trees were obtained from the data analysis and human errorprobability values were obtained using guidance from the Accident SequenceEvaluation Program Human Reliability Analysis (ASEP HRA) methodology. TheIRRAS PRA software and commercial spreadsheet software were used to analyzeand quantify the logic models with the entered failure data. The results weretabulated and evaluated to determine insights regarding the major contributorsin the failure sequences.

~ ' I I ~

I . ~

~I

%%M~IIIIRW~~SINWHISHBM

I ~ ~

R5%%RHRRRREE% ~ ~

~ '

~ ~

I ~

I ~ ~ I ~ ~

~ ~

I ~ I ' . ~

I ~

I '~ . ~

~ I

~I

~, ~

I ~

I ~ ~ t ~ ~ ~

~ ~ I ~

~ I ~

~ t ~

~ I

~ ~ ~ I

I ~

I I ~

I I ~

I ~ ~ I ~

~ I ~

I I ~ I

As-.Found condition. The Pipe Break, Seismic, and Flooding events in As-Fixedplant conditions each contribute about 3% to 5%. The remaining initiatingevents for both the As-Found and As-Fixed plant conditions each provide a

contribution of about 1/ or less.

The overall estimated NBF for the SSES site decreases from the As-Found to theAs-Fixed plant conditions due to the changes made since the time the Part 21

report was submitted. This decrease is from 6.8E-5 per plant year in As-Foundconditions to 2.1E-5 per plant year for As-Fixed conditions.

The dominant contribution to NBF occurs in Case 1 (both units under normaloperation) for both As-Found and As-Fixed plant conditions, with about 34%contribution and 45% contribution, respectively. The NBF contribution duringCase 3 (both SFPs cooled by the operating unit's SFPC system with RHR of theshutdown unit not available for SFPC operation) is also large at approximately31/ for As-Found conditions and 23% for As-Fixed conditions. The NBFcontribution in Cases 4 and 5 together for the As-Found condition isapproximately 28%. The Case 4 contribution in As-Fixed condition isapproximately 23%. This could change significantly if refueling practices interms of heat load admitted to t: e SFP(s) and outage management practices interms of equipment taken out of service were changed from the conditionsassumed for this analysis. The SSES refueling or forced outage shutdownpractices in the future may not follow those assumed in this analysis becauseof the larger decay heat loads that could occur from fuller SFPs, longeroperating cycles, fuel shuffle practices, or required Nuclear Steam SupplySystem (NSSS) draindown during hot climate conditions. These issues couldeasily cause significant changes to both the loss of SFPC NBF and thecorresponding contributions to CDF.

The accident sequences with a total estimated NBF of greater than 1.0E-6 peryear and any cases having estimated time to reaching near boiling conditionsof less than 50 hours are evaluated to estimate the potential for contributingto core damage. The overall estimated CDF values for these most importantevent sequences for As-Found plant conditions are low at approximatel'y 5.0E-Bper year from eleven event sequences. The estimated contribution to CDF forAs-Fixed conditions is estimated at approximately 1. 1E-8 per, year, from eightevent sequences. These estimated CDF values are approximate and reflect theorder-of-magnitude nature of this analysis.

The analysis results reflect the large number of normal and alternate systemsthat are available for cooling the SFP(s) and for cooling the reactor core.The analysis results also reflect the large amounts of time available afterthe initiating event before the loss of SFPC could lead to near boilingconditions. This time period ranges from a low of 15 hours for the largestheat load conditions to well over 50 hours for most of the remainder of theoperating cycle.

The failure likelihood values used in the event trees are dominated by humanerrors. The human error probability estimates associated with these operatoractions are significantly larger than the corresponding hardware failure

'probability estimates from the system fault trees. Human actions for As-Fixedplant conditions have better procedural guidance than for the As-Found plant

conditions based on the improvements made and the increased level of awarenessabout loss of SFPC issues. Because human performance has a large contributionto the NBF and approximate CDF results, additional enhancements in variousprocedures could help reduce the likelihood of developing near boilingconditions in the SFP(s) and of isolating the steam release from a boilingSFP.

The risk assessment was performed using available SSES plant-specificinformation and relevant data sources. The preliminary results indicate thatthe estimated SSES site NBF and core damage contribution estimates are quitelow. Due to schedule and budget constraints, detailed sensitivity, as well asuncertainty analyses were not addressed. The numerical results areapproximate and plant-specific and should be interpreted cautiously. Theresults do suggest additional enhancements that are believed to have merit inreducing the likelihood of developing near boiling conditions in the SFP(s)and in isolating the steam release off a boiling SFP. All the enhancementsinvolve providing procedural guidance. The additional procedural guidanceincludes, use of an alternate back-up cooling mechanism for the SFP(s),isolation of Heating Ventilation and Air Condition (HVAC) Zones 1 and 2 fromZone 3, emergency diesel generator (EDG) backed power to the non-safety busthat powers a SFPC system, and resourceful alternatives for preventing thesteam from a boiling SFP from spreading to the reactor building.,

~ I I ~

E%%EE%%25HRER%WRHSR~EEEERelaaaaala mRIS ESIREEERIE�>eel

~SESIESSEEREIIIS ESIESESIES Seala MIRIIRassasaaaseSIENRIS SEES SRES RSISS MISIE~ESRSEESRSSIISSESSIaeaea SEINE~RE~WIESSESISENISIR SEEESESR SEISR~ISII~ssissaeaaseeIasassseeir Esaa~~ SIIEERSSIEESRSSSIEIEEEaa EERS~IEI~RRsamslsselÃssssssaeassaa~~ Eeaa EESEEESE Selaa SIIEISRelala~lal~R55IISS SISS RII SISERSE EEIEE RIEISEEI~SSISE EEESESSRESEEEEIES RESSEl~seassaeIsssaaaaaessaeseIEE~RRSMSRRIMRISRRMRWRI~~

~ ~~ ~

~ ~

imam:mmsamnr~NMRRRRRRRHIIRRRKRRRRS~RRKRRRi5%RER~% RRK~RSE'E~%&RE5REK!RREIKRRRKRRRKRREK%~3E3REESRERRRRRSRR55%NRRKR~E%5am~emammaemmaeemaeaim~rmgggiggg~i: ggpiggg~img~i+gggRRKSREK%REK%REKRSEKR~KR5~RRiRiRRRmaaemRRemRRRR~~ERBRRRKRRRIRRRRRSRRIKR~Qgg~ggg~i; Qg~i; gQ~Qgg~i~~iREKSRR)KRRR3KRREKRRRHER~E5~RIRIRRRKRRRRRRNRIIRRRKR~WIRI~RRRIHRRH~~

S«amic oi.6g

S«smc <.6g1%

Loss of SFPCLOCAWLOOP 6''

Loss ot SWS 1%LOOP,1 2%

Pt i"

~ ~ 6 '4g ~

iaaf

~

I

Figure ES.1 SSES Site As-Found SFP NBF

LOCA |sfLOOP14%

S«snso o»,6g

S«smc Qy'I%

bye Bfoak4%

Loss of SWS1'li

Loss of SFPC1% LOOP

gf6

Ffo«any414

LOCA11%

Extondod Loop43%

Figure ES.2 SSES Site As-Fixed SFP NBF

Xi

Table ES.5 SSES Site As-Found Order-of-Magnitude Estimations of CDF

Hear BoilingFrequency

Isolation/Recovery

ECCS Failure EquipmentOutsideReactorBuildin

ConditionalAnnual CDF

Estimation

Ran e From HBF 1.0 - 0.01 1.0 - 0.1 0.1 - 0.001

LOOP Case 3

LOOP Case 4

LOOP Case 5

EXLOOP Case 3

EXLOQP Case 4

EXLOOP Case 5

LOCA Case 3

LOCA Case 4

LOCA Case 5

Seismic Case I

3.1E-06

9.5E-07

I. IE-06

8. IE-063.2E-06

7.9E-06

8. IE-06B.BE-07

3.1E-06

5. BE-07

O.l'0. I0.1

0.10.1

0.1

0.1

0.1

0.1

0.5

1.01.01.01.01.01.01.01.01.00.9

0. 01

0.01

0.01

0.01

0.01

0.01

0. 01

0.01

0.01

0. 05

3. IE-09

9.5E-IO

I. IE-09

8. IE-09

3.2E-09

7.9E-O9

8. IE-09

B.BE-IO

3. IE-09

1. 3E-08

LOCA w/LOOP Case 3 8.3E-07 0.1 1.0 0.01

Total Estimated As-Found COF

8.3E-IO

5.0E-OB

Table ES.6 SSES Site As-fixed Order-of-Magnitude Estimations of COF


Isolation/Recovery

ECCS Failure EquipnentOutsideReactorBuildin

ConditionalAnnual COF

Estimation

Range From HBF 1.0 - 0.01 1.0 - 0.1 0.1 - 0.001

LOOP Case 3

LOOP Case 4

EXLOOP Case 3

EXLOOP Case 4

LOCA Case 3

LOCA Case 4

LOCA w/LOOP Case 3

LOCA w/LOOP Case 4

8.5E-074.6E-07

3.5E-062.1E-06

1.6E-06

I.IE-066.9E-07

4.6E-07

0.1

0.1

0.1

0.10.1

0.10.1

0.1

1.01.01.01.01.01.01.01.0

0.01

0.01

Q.QI

0.01

0.01

0.01

0.01

0.01

8. 5E-10

4.6E-IO3.5E-09

2. IE-091.6E-'09

I. IE-09

6.9E-IO

4.6E-IO

Total Estimated As-Fixed COF 1. IE-08

Xll

ANSASEP HRABWR

CDFCFRCRD

ECCSEDG

ESW

EXLOOPFSARHRAHVACIEIEEEIPEIRRASLOCALOOPMGL

MNHLMWe

MWtNBFNRC

NSSS

NUREGlCRPGE

PGIPNLPPE(L

PRARPVRHR

SBOSGTSSFPSFPCSLCSSESSWS

TSCVEPCO

Acronyms

American Nuclear SocietyAccident Sequence Evaluation ProgramBoiling Water ReactorCore Damage FrequencyCode of Federal RegulationsControl Rod DriveEmergency Core Cooling SystemEmergency Diesel GeneratorEmergency Service WaterExtended LOOPFinal Safety Analysis ReportHuman Reliability AnalysisHeating Ventilation and Air ConditionInitiating

Event'nstituteof Electronics and Electrical EngineersIndividual Plant ExaminationIntegrated Reliability and Risk Analysis SystemLoss-of-coolant AccidentsLoss of Offsite PowerMultiple Greek LetterMaximum Normal Heat LoadMegawatt ElectricMegawatt ThermalNear Boiling FrequencyNuclear Regulatory CommissionNuclear Steam Supply SystemNuclear Regulation/Contractor ReportPortland General ElectricPotential Generic IssuePacific Northwest LaboratoryPennsylvania Power and LightProbabilistic Risk AssessmentReactor Pressure VesselResidual Heat RemovalStation BlackoutStandby Gas Treatment SystemSpent Fuel PoolSpent Fuel Pool CoolingStandby Liquid ControlSusquehanna Steam Electric StationService Water SystemTechnical Support CenterVirginia Electric PowerACompgmy

Abstract

Executive Summary .

Acronymns .

1. 0 INTRODUCTION

2.0 ANALYSIS APPROACH .

TABLE OF CONTENTS

~ ~ ~ V

X111

2.1

2.12.22.32.4

General Information .Analysis AssumptionsNear Boiling Frequency AnalysisCore Damage Frequency .

2.12.6

2.112.17

3.0 DISCUSSIONS OF RESULTS

3.1 Near Boiling Frequency Discussion .3.2 Core Damage Frequency Discussion

4.0 SUMMARY AND CONCLUSIONS .

5.0 REFERENCES

3.1

3.1. 3.10

4.1

5.1

Xiv

Figure ES.lFigure ES.2Figure 2.1Figure 2.2

Figure 2.3

Figure 3.1Figure 3.2Figure 3.3Figure 3.4

LIST OF FIGU ES

SSES Site As-Found SFP NBF . . . . . . . . . ~ . . . . . xiSSES Site As-Fixed SFP NBF , . . . . . . . . . . . . . . xiSpent Fuel Pool Arrangement . . . . . . . . . . . . . . 2.3Representative Fuel Pool Cooling (Unit 1 Depicted)-Simplified Diagram . . . . . . . . . . . . . . . . . . 2.4Representative RHR Cooling (Unit 1 Depicted} - SimplifiedDiagram . . . ~ . . . . . . . . . . . . . . . . . . . . 2.5Example NBF Event Tree . . . . . . . . . . . . . . . . 3.5SSES Site As-Found SFP NBF . . . . . . . . . ., . . . . 3.8SSES Site As-Fixed SFP NBF . . . . . . . . . . . . . . 3.8Generic CDF Event Tree . . . . . . . . . . . . . . . . 3. 13

xv

ST OF TAB ES

Table ES.lTable ES.2Table ES.3Table ES.4Table ES.5

Table ES.6

Table 2.1Table 2:2Table 3.1Table 3.2Table 3.3Table 3.4

Table 3.5

Analysis Cases for As-Found Condition . . . . . .Analysis Cases for As-Fixed ConditionsSSES Site As-Found SFP Near Boiling Frequency . .SSES Site As-Fixed SP Near Boiling FrequencySSES Site As-Found Order-of-Magnitude Estimationsof CDF ~ o ~ ~ ~ i i a ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

SSES Site As-Fixed Order-of-Magnitude Estimationsof CDF ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

Analysi s Cases for As-Found Condition .Analysis Cases for As-Fixed ConditionsSelected 1nitiating Events and FrequenciesSSES Site As-Found SFP Near Boiling Frequency . .SSES Site As-Fixed SFP Near Boiling Frequency . .SSES Site As-Found Order-of-Magnitude Estimationsof CDF o ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

SSES Site As-Fixed Order-of-Magnitude Estimationsof CDF ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ o ~ ~ ~ ~

V11V11

X

X

X11

X11~ 2.14. 2.14

3.13.73.7

. 3.14

. 3.14

XV1

1. 0 INTRODUCTION

l.l Background

According to a report filed under Title 10 of the Code of FederalRegulations (CFR) Part 2l on November 27, 1992, and supplemented by sixadditional letters by two individuals formerly under contract toPennsylvania Power and Light (PPRL) Company, the Susquehanna SteamElectric Station (SSES) Units I and 2 spent fuel pool cooling (SFPC)systems do not meet regulatory requirements. The Part 21 report andsupplemental le'tters claim that Susquehanna Units I and 2 have designflaws that, under certain design bases accident conditions, will causethe following:

loss of SFPC resulting in boiling of spent fuel pool (SFP) water

failure of the emergency core cooling system (ECCS) and otherequipment in the reactor building due to steam releases from theSFP water or due to flooding from collection of condensed SFPwater vapors

fuel heat-up leading to core damage due to loss of ECCS

loss of the water cover over fuel in the SFP, exposure to air, andpossible spent fuel damage due to less effective removal of decayheat by air

large offsite radioactivity releases from core damage, spent fueldamage, and loss of ECCS and other mitigative features.

The U.S. Nuclear Regulatory Commission (NRC) is evaluating the claimsmade in the Part 21 report and the additional submittals made. Thisproject supports the NRC evaluations by performing risk analysis toprovide estimates of the following:

the likelihood of the v'arious initiators occurring that couldcause loss of SFP cooling

the likelihood of event sequences leading to inadequate cooling ofthe SFPs

Order-of-magnitude approximations of the most important sequencesleading to inadequate reactor core cooling

~ the consequences of these events in terms of potential forcontribution to the conditional core damage frequency.

1.2 Objective

The purpose of this draft report is to provide an analysis of potentialloss of SFPC events for the conditions at SSES site prior to the Part 21report as well as for current conditions at SSES site. This draft

1.1

report estimates the likelihood of various loss-of-SFPC initiatingevents leading to near boiling conditions in the SFP(s) and assesses thepotential for contribution to core damage for the most importantsequences. This work is performed in support of evaluating potentialgeneric issue (PGI) 93-01 concerning plant safety for loss of SFPC

events.

The analysis addresses SFP and plant operating conditions at SSES priorto the Part 21 report ("As-Found" ), and current ("As-Fixed" ) conditions.The initiating events considered are the same for both As-Found and As-Fixed plant conditions. Likewise the scope of the analysis forestimating the frequency of events leading to SFP near boiling frequency(NBF) and the potential for contribution to core damage frequency (CDF)is the same for both the As-Found and the As-Fixed plant conditions.This analysis provides input for regulatory consideration in estimatingthe safety at SSES and other nuclear power plants. The As-Found portionof the analysis looks back at conditions prior to the Part 21 report toestimate the risk significance of this issue for consideration ofpotential generic safety implications. The As-Fixed portion of theanalysis looks at current conditions and potential future conditions toestimate the risk significance of this issue for consideration ofcurrent and future safety implications at SSES.

1.3 Organization

This report provides an overall discussion of the significant elementsinvolved in performing the analysis. Section 2 describes the overallanalysis approach including assumptions that affect the model. Theresults are discussed in Section 3. Section 4 provides the summary andconclusions from the analysis. References are listed in Section 5.

Appendices describe additional details for model development, datadevelopment, and the evaluation process and results. Appendix Apresents the analysis of the case breakdown for the As-found and As-Fixed conditions. The hardware related failures used to quantify systemfailure likelihood are provided in Appendix B. Appendix C provides thedetailed accident sequence discussions for the most important eventsequences. Appendix C also contains event trees used for estimating thelikelihood of reaching near boiling conditions for each initiating eventand the event tree schematic which portrays SSES capabilities forpreventing core damage given a SFP at near boiling conditions. Theevent trees used for NBF estimations use spreadsheet calculations whichare included in Appendix C. Appendix D provides the databasedevelopment used for the NBF analysis and other information includinginitiating event frequency estimates.

1.2

2.0 ANALYSIS APPROACH

Generally, the analysis was performed using probabilistic. riskassessment (PRA) procedures as described in NUREG/CR-2300 (AmericanNuclear Society [ANS] and Institute of Electronics and ElectricalEngineers [IEEE] 1983). Descriptions of the analysis method and stepsand the sources of information are. provided in the followingsubsections.

2.l General Information

Plant La out S ent Fuel Pool Confi uration

The SSES located by the Susquehanna River near the town of Berwick,Pennsylvania, consists of two 3923-MW General Electric BWR-4 NSSS withHark II containment designs. Unit I fegan commercial operation in 1983and Unit 2 in 1985.

The simplified SFPC system arrangement, the simplified schematicdiagr ams for the SFPC system, and the key support systems are shown inFigures 2. 1, 2.2, and 2.3, respectively. The spent fuel pools of eachunit ara Seismic Category I and are located in each unit's reactorbuilding. 'The reactor buildings share a common refueling area above therefueling floor. The air space above the SFPs is contained withininsulated metal siding and buildup roofing on metal decking.

Each unit has a dedicated non-seismic SFPC system that provides normalcooling water to remove decay heat from irradiated fuel stored in thepool by transfer ring this heat to the service water system. The SFPCsystem also provides filtering and demineralizing services to maintainwater clarity, chemistry, and purity conditions within prescribedtolerances ~ The SFPC system is designed to maintain water temperaturesless than l25'F for the maximum normal heat-load condition that isassociated with 2840 spent fuel assemblies from normal refuelingdischarges retained in the pool. The decay heat associated with a fullfuel offload at 250 hours after plant shutdown from a full operatingcycle is termed emergency heat load and requires operation of the RHRsystem in the SFPC operating mode to provide adequate SFP cooling.Emergency heat load conditions are not included in this analysis.

In uts from Other PRAs

The initiating events (IEs) and their estimated frequencies, eventtrees, fault trees, and basic event probabilities prepared for thisprobabilistic risk study used information from The Pennsylvania Powerand Light Company (PP&L) SSES Individual Plant Examination (IPE) studyand other PRA studies. Specifically, IEs, event tree models, and faulttree models were developed primarily based on information provided byPP&L about SSES. In addition, information was also gathered duringmeetings with PP&L staff, subsequent plant walkdowns, and other relevantissues raised in the Part 21 report.

2.I

The IE frequency numbers were estimated based on input from the NUREG-

1150 (NRC 1989) support documentation as described in the NUREG/CR-4550PRAs (Bertucio et al. 1990a, 1990b, 1990c, 1990d; Bohn et al. 1990;Drouin et al. 1989; Ericson et al. 1990; Harper et al. 1991;Kolaczkowski et al. 1989a, 1989b; Sattison et al. 1990; and Lambright etal. 1990). Information was also gathered from the SSES IPE and SSES

loss of SFPC mini-PRA and from the other IPE information. Basic eventprobabilities were estimated primarily from data developed for relevantIPE information from Trojan IPE (Portland General Electic [PGE] 1992),Washington Nuclear Plant WNP-2 IPE (WPPSS 1992), Oconee IPE (Duke Power1992), Surry IPE (Virginia Electric Power Company [VEPCO] 1991), andfrom the SSES IPE for the component and system unavailabilityinformation.

Plant Walkdowns

Personnel from the NRC and Pacific Northwest Laboratory (PNL) met withPPEL on December I, 1993, and again on August 2, 1994 to discuss thestatus of PP&L's evaluation of the issues raised in the Part 21 report.During these meetings, PPEL presented an overview of the plant outageand administrative controls, plant systems design, and operationsprocedures used to maintain cooling to the SFPs including improvementsmade since the Part 21 report. Following these meetings, the NRC andPNL performed a walkdown of the SFP and refueling area, SFPC system,components used for the RHR SFPC operation mode, SFP area heating venti-lation and air condition (HVAC) systems, equipment inside the reactorbuildings that can be used to provide SFP cooling and that can providecore cooling, and equipment located outside the reactor building thatcan provide SFP and core cooling.

2.2

Spent Fuel Pool Arrangement

ESW

RHR

Leak TightGates

ESW

RHR

SFPC(3 pumps3 heatexchangers)

SklmmerSurgeTank

I II III Cask

Storagel Plt

SFPC(3 pumps

3 heatexchangers)

SklmmerSurgeTank

jien Fuel,S, „Pool (bnlt4

Spe'po ~2,

SFPC SFPC

S9401D832

Figure 2. 1, Spent Fuel Pool Arrangementh

Fuel Pool Cooling —Simplified Diagram

153019A 1530168

153019A 1530198

153001

153017To RHRS 153017

153045

153002A 1A 153004A

Heat Exchanger

1530028 18 1530048

153009A153006A

153010A

Pump1530098

To SFPC Unit 2

153014 153015

153013

Heat Exchanger

153006818

Pump153009C

'1530108 LV 15300 153016

153002C 153004 C153006C

1C

Pump

1530toC

Heat Exchanger 594010832

Figure 2.2, Representative Fuel Pool Cooling (Unit 1 Depicted) - S''f'D'ice - imp i ied Diagram

RHR System in Fuel Pool Cooling Mode —Simplified Diagram153070A

153071A'153070B

153071B

HV 151 F016A

151070

HV 151 F028A

153060

HV 151 F006

'153021

153001 PSV 151 F066A

HV 151 F017A

HV 151 F010A

HV 151F006B Pump

1P202BHV 151F006D

151F034B

151 F031D

HV 151 F004A 151 F031A

HV-151151

F006A Pump F034A1P202A

HV 151F006C 151 F031C

HV 151 151 F034CPump1P202C

HV 151F004B 151 F031B

HV 151F047A

HV 151

RHRServiceWater

Meat ExchangerlE206A

HV 151 F048A

PSV 151 F066B

HV 151F047B

HV 151

RHRServiceWater

Meat ExchangerIE206B

HV 151 F048B

HV 151 F010B

HV 151F028B

HV 151 F016B

HV 151 F017BHV 151F004D PumP

1P202D

151 F034D

69401083.1

Figure 2.3, Representative RHR Cooling (Unit 1 Depicted) - Simplified Diagram

2.2 Analysis Assumptions

The analysis addresses several potential causes of loss of SFPC andevaluates a variety of possible outcomes depending on the overall plantresponse and the time period after the initiating event. The scope anddepth of the analysis is bounded by the assumptions made. Theassumptions are used to clearly define conditions that are evaluated andconditions that are not evaluated. These assumptions are generallybased on information provided by PP8L about the design and operation ofSSES and also based on the defined scope of the analysis provided by theNRC staff. The major assumptions used in the analysis are listed below.The list identifies the assumptions used to perform the analysis of As-Found plant conditions first and then lists any additional assumptionsor changes in assumptions pertaining to the analysis of As-Fixed plantconditions. Appendix 0 includes an expanded list of these assumptionsthat states the basis and impact of each assumption.

As-Found Assum tions

The assumptions for the "As-Found" condition are listed below.

1. Spent fuel pools (SFP) are not initially cross-connected (i.e.,gates are installed separating the SFPs) except Case 3 in whichthe SFPs are assumed to be initially cross connected.

2. The SFPs are successfully cooled when the temperature in the SFPwith the higher decay heat load does not exceed 200'F for anisolated SFP, or the temperature of the cooler SFP does not exceed170'F when the SFPs are cross-connected.

3.

4,

5.

The heat removal capability of two or three Spent Fuel PoolCooling (SFPC) pump and heat exchanger loops is assumed to be twoor three times that of one pump and heat exchanger loop,respectively.

The heat load offloaded to the SFP is controlled such that theSFPC system maintains the temperature in the SFP within theadministrative limit of 115'F. This limit is maintained bycontrolling: the number of SFPC pumps and heat exchangers online, the time of the year the refueling is performed whichimpacts the Service Water System (SWS) temperature and associatedSFPC heat exchanger capacity, the amount of fuel offloaded, andthe timing after shutdown of core offload, the water volumesconnected to the SFPs, and use of RHR in the SFPC assist mode ifnecessary (i.e., outage with full 'core offload under summerconditions).

The heat load admitted to the SFP and pool configurations arecontrolled such that the time-to-boil after a loss of SFPC isgreater than 25 hours. However, in the past, pool configurationsmay have been such that time-to-boil could have been between 15and 25 hours for up to 10 days.

2.6

The operating cycle for a SSES unit is assumed to be 18 months and

the duration of the refueling outage from unit shutdown to startupis assumed to be 75 days.

The Residual Heat Removal (RHR) system of each unit is assumed tohave one train dedicated to reactor core decay heat removal forthe following initiating events: loss of offsite power (LOOP),Extended LOOP, SBO, LOCA with LOOP, and Seismic.

The RHR system for a unit that has a LOCA initiating event willnot be available for SFPC assist mode.

The initiating event frequency for Loss of SFPC is assumed toinclude the probability of the operator failing to performimmediate restart recovery actions.

During Case 2, the RHR system is assumed to have one trainoperating in the shutdown cooling mode. The other train is eitheraligned for shutdown cooling or out-of-service for maintenance.In both conditions, RHR is not available for SFPC assist modeoperation. The RHR System will be in this latter condition for a

total of eight days. When the RHR system is not in maintenance,one train is modeled as being available for SFPC assist to accountfor shutdown cooling operation providing cooling to the SFPs.

A thirty-day outage for SWS and/or RHR is assumed to occur eachrefueling outage after the core is offloaded, the reactor cavitygates are reinstalled, and decay heat decreases to within thecapability of 2 SFPC pump/heat exchangers (Case 3 Condition).Although this outage usually lasts only ten-days it is modeled forall of Case 3 (thir ty-days) with the SFPC and RHR systems out-of-service on Unit I and the SFPs cross-connected. This is slightlymore conservative than modeling the Unit I SFPC in service withthe pools not cross-connected. This small conservatism in themodel is based on the assumption that administrative controls donot limit the time the SFPC system is out-of-service.

Five Emergency Diesel Generators (EDGs) are installed at SSES anyof which can be aligned to supply designated emergency loads orSFPC system loads for either Unit I or Unit 2.

The SFPC system for one unit can provide adequate cooling for theSFP of the other unit when the gates separating both SFPs from thefuel shipping cask storage pool are removed. This cross-connectedcooling arrangement requires a differential bulk water temperaturebetween the SFPs of approximately 30'F to promote adequate waterexchange. Additional SFPC system line-up alterations to provideforced delivery of cooling water to both SFPs are not required.

There are two building cranes that can remove the fuel shippingcask storage pool gates, and a qualified crane operator would beavailable within 2 hours of the time requested.

2.7

15.

16.

17.

18.

19.

20.

21.

The fuel shipping 'cask storage pool is always maintained full ofwater.

Approximately eight hours are required to place the RHR system inthe SFPC assist mode of operation.

There are two diesel fire pumps that can provide makeup to eitherUnit's SFP under SBO conditions.

The gates. separating the reactor cavity from the SFP are providedwith redundant positive-sealing devices and alarm features withalarm indication of seal leakage and a low SFP level. Anysignificant loss of SFP inventory would require a concurrent majorrupture of both independent sealing devices. This potential fail-ure, as an initiating event for loss of SFPC, is not modeled sinceit is considered not credible.

The system and support system models used maintenanceunavailability values representative of normal plant operationsfor all cases analyzed unless noted otherwise. Refueling outageand associated maintenance activities are assumed to be scheduledand performed such that these systems have availabilitiescomparable to normal operating conditions.

Equipment that is located in the reactor buildings (HVAC Zones 1

and 2) and is critical for performing safety functions willexperience heatup after the onset of boiling in the SFP if notisolated from HVAC Zone 3. Successful isolation of HVAC Zone 3requires that the recirculation system be shut off and the StandbyGas Treatment System (SGTS) be operating. When HVAC Zone 3 is notisolated, the safety equipment in HVAC Zones 1 and 2 reachesequipment failing critical temperatures approximately 8 hoursafter the onset of boiling in the SFP. During refueling outages,the reactor building for the unit being refueled is isolated fromHVAC Zone 3 and therefore the safety equipment in that unit willnot experience heatup from boiling in the SFPs. With therecirculatiun fans off, the SGTS would fail approximately 15 hoursafter the SFP begins to boil and the ECCS equipment would failapproximately 24 hours after the SFP begins to boil.

A reactor scram does not occur coincident with the loss of SFPCinitiating event. Plant management is assumed to direct a plantshutdown at either, the approximate time of onset-of-boiling inthe SFP or when the area temperature in HVAC Zone 3 reaches 125'F,whichever occurs first.

22. A reactor scram occurs coincident with all initiating eventsexcept loss of SFPC. Safety functions begin at the time of thereactor scram as does the start of SFP heatup.

2.8

23. The condensate and feedwater systems have all their activecomponents necessary for post-scram alignment feeding/m-keup tothe reactor pressure vessel located in the turbine building andthe turbine building does not experience heatup in response to SFP

heatup. The condensate and feedwater systems are also assumed tobe failed after a seismic event or loss of offsite power.

24. The flood, loss of SWS, and pipe break initiating event impactsare considered local events impacting only the SFPC equipment.Plant wide floods, loss of SWS, or pipe breaks with global effectsas well as the potential for consequential damage to other safety-related equipment from these events was not 'considered.

25. Several other methods exist for backup SFPC that are not creditedin the model. These methods would prevent SFP boiling or delaythe time to SFP boiling conditions and include:

Feed and bleed to SFPs. Feed is provided through EmergencyService Water (ESW) (hard piped and EDG backed) or usingfire hose (requires operators to run hose reel to SFPs or tohook up to ESM hard pipe). Bleed is via the overflowthrough the SFP skimmer surge tank line.

Use the diesel powered fire water pumps for discharge to theSFPs through connection to existing hard pipe systems (i.e.,ESM).

Use of RHR in the shut down cooling mode of operation with, discharge to the Reactor Pressure Vessel (RPV) andsimultaneously to the SFPs (although not proven to preventSFP boiling it would certainly delay the heatup).

26.

27.

Flooding to the reactor building from SFP condensate and/oroverflow is directed to the reactor building sumps and this wateris isolated from Emergency Core Cooling System (ECCS) equipment inthe reactor buildings except one train of core spray.

The Technical Support Center (TSC) is manned and operationalwithin one hour after the initiating event. The TSC staff willfacilitate preparation of appropriate recovery action proceduresto support mitigation of the event.

28. SFP level and temperature indication in the control room was notimproved.

29. The HVAC ductwork low points did not have drains.

30. The procedures for placing RHR in the SFPC assist mode did notrequire raising the SFP level before running the RHR system in theSFPC assist mode.

2.9

3I. The LOOP emergency procedure did not prompt the operators toconsider that the SFPC needs to be restarted.

32. The administr ative controls to maintain at least 25 hours to SFP'boiling under a loss of SFPC were not formally controlled ordocumented.

33. The emergency procedures suggest a variety of ways to maintaincore cooling in the event the ECCS systems failed, including:feedwater, condensate, Core Damage Frequency (CRD) maximized, RHR-

SWS cross-tie, fire water system, CRD from other unit, ECCS keepfill system, Standby Liquid Control (SLC) boron tank, SLCdemineralized cross-tie.

34. Support system requirements are based on matrix informationprovided by SSES taken from the IPE.

35. The aluminum siding at some locations in the reactor building hashinged panels that would pivot out and relieve pressure in thebuilding due to the steam environment and thus help to removeenergy and reduce temperature.

As-Fixed Assum tions

The assumptions for the As-Fixed conditions differ from the As-Foundconditions as outlined below.

Spent fuel pools are initially cross-connected (i.e., gates thatcould separate the SFPs have been removed) for the entireoperating cycle except as may be necessary for some off-normal oremergency situation.

2. SFP level and temperature indication in the control room has beenimproved.

3. The HVAC ductwork has low point drains.

4. The procedures for placing RHR in the SFPC assist mode requireraising the SFP level before running the RHR system in the SFPCassist mode.

5. Th e LOOP emergency procedure does prompt the operators to restorecooling to the SFPs.

The administrative controls to maintain at least 25 hours to SFPboiling under a loss of SFPC are formally controlled anddocumented. This may require use of RHR in the SFPC assist modefor a full core offload under summer conditions.

2.3 Hear Boiling Frequency Analysis

The methods and approach used to perform the analysis of near boilingfrequency involves the tasks identified below.

Model Develo ment

The SFP near boiling frequency (NBF) is estimated using eventtrees to model the sequences of failures in normal and back-up SFP

cooling systems that could occur after the initiating event andresult in near boiling conditions in the SFP. The event trees aredeveloped based on SSES plant design information, input from otherPRAs, and a plant walkdowns at SSES. The IE, event tree, andfault tree comprise the framework for the model used to evaluateloss of SFPC events at SSES. This model was developed to analyzea range of possible plant and site conditions for SSES Units I and2 to estimate the likelihood of developing near boiling conditionsin the SFPs that is associated with potential loss of SFPCscenarios. Various SFP cooling requirements are considered forUnits I and 2 to address the As-Found and As-Fixed plantconditions and associated refueling conditions.

Initiatin vent

The IE is the first event-tree heading and reflects input from thereview of available information and consideration of allegationsmade in the Part 21 report. The technique used to identifyinitiating events involves determining occurrences such as systemdisturbances or failures that cause a loss of the SFPC function toone or both SSES units. The analysis considers any potentialcause of a loss of SFPC within reason and estimates theirlikelihood of occurrence. Potential causes were identified from:reviews of the concerns raised in the 10 CFR 21 report andassociated documentation; reviews of the SSES IPE and loss of SFPCmini-PRA (PP&L 1993); :he SSES walkdowns; and review of other IPEsand PRAs. Some of the initiating events considered (i.e., modelsthat include LOOP) involve a loss of SFPC for both units, whileother scenarios (i .e., pipe break, internal flooding, loss ofcoolant accident [LOCA], SFPC system failures, and loss of SWS)cause a loss of SFPC for only one unit. The initiating eventsthat cause a loss of only one unit's SFPC system, have theirfrequencies doubled to account for the two-units at the SSES site.All initiating event frequencies apply to a one year period andare across the cases analyzed according to the normalized annualtime spent in the conditions of each case.

vent Trees

The event trees present the possible combination of systemsuccesses and failures that display the various sequence of eventsfollowing each initiator. The event tree headings represent func-tions performed by specific systems and associated operator

2.11

actions. A response to any IE is successful when adequate SFPC isrestored in time to prevent the SFP temperature from reaching200'F (refer to Appendix A). Adequate cooling for the SFP isdependent on the SFP configuration and associated heat-loadconditions analyzed. The event trees follow the guidance ofNUREG/CR-2300 for model development. These event trees weredeveloped based on the best available information from PPEL onSSES, other PRA data, and plant walkdown information. Various SFP

cooling requirements are considered for Units I and 2 to addressthe As-Found and As-Fixed plant conditions and associated plantoperational and refueling conditions analyzed (cases).

~ SFP Deca Heat valuat'on and Case Selection

The analysis performed addresses the cases selected to bound thefull range of heat loads in the SFPs that are consistent withcontrols over core offload at SSES. Selection of the Cases isbased on the different decay heat levels present in the Spent FuelPools (SFP), the available capacity to remove this heat via theSpent Fuel Pool Cooling System (SFPC), the availability of RHR,and the plant operating condition. Successful cooling of theSFP(s) is based on maintaining the pools below a temperature of200'F when the pools are not cross-connected or below atemperature of 170'F in the SFP bei'ng directly cooled when theSFPs are cross-connected. It is assumed that maintaining the poolbeing directly cooled below 170'F is adequate to ensure the secondpool does not exceed 200'F. According to standard practices atSSES, fuel is not offloaded to the SFP until the time-to-boilgiven a loss of SFPC is more than 25 hours, and the total heatload is within the capacity of the available pump/heat exchangersto maintain the SFP temperature within the administrative limit of115'F. The first requirement, while in the Final Safety AnalysisReport (FSAR), was not necessarily proceduralized in the As-Foundconditions and circumstances may have existed early in someoutages where the time-to-boil given a loss of SFPC could havebeen as low as 15 hours. However, conditions in which the time-

10 days.to-boil was less than 25 hours would not have lasted. for more thm re an

The SFPC system is designed to maintain the fuel pool watertemperature below 125 F at a Maximum Normal Heat Load (NNHL). TheMNHL is based upon filling the pool with 2840 fuel assemblies fromnormal refueling discharges and 184 fuel assemblies are offloaded

9.1-2b .from the active core within 160 hours after shutdown (FSAR T bl

). In the FSAR, full core offloads are considered Emergency

for fuelHeat Load (EHL) conditions which generally credits th RHR t

pool cooling. The model was built on review of previousoutages that indicate full core offloads are normally conductedwith decay heat loads in excess of the HNHL, but less than the

desi n basisEHL. These conditions have been acceptable because of 1 w th'g 'WS inlet temperatures and corresponding increased

ower an

SFPC system capacity. This evaluation is based on information

2.12

from the recent Spring 1994 outage (SSES U26RIO) with somemodifications to provide generic coverage of other previousoutages. The representative outage schedule and plant conditionsassumed for this analysis are summarized below.

Day 0 Plant shutdown, RHR in shutdown cooling, SFP

being cooled by 1 pump/heat exchangercombination.

Day 8

Day 15

Day 25

Day 35

Day 65

One loop of RHR unavailable for maintenance.Other train still providing shutdown cooling.

Fuel offload complete. Three pumps/heatexchanger required to cool SFP. Both loops ofRHR available.

SFP isolated from reactor cavity and other SFP(Activity 4).

Activity 4 exited (by cross-connecting withother SFP), heat load has decayed to the pointthat 2 pumps/heat exchangers can handle load.SFPC and RHR systems are taken out-of-servicefor maintenance. Cooling of SFP is dependent onpumps from other SFP via cross-connect.

SFPC restored to service. Fuel reloadcompleted. One pump/heat exchanger can carrythe heat load.

Day 75 Unit restored to power.

The plant information described above was used to define the casesthat are analyzed in this report. The differences between As-Found and As-Fixed plant conditions are also considered whichresults in the two sets of cases evaluated. Development of thecases is discussed in detail in Appendix A. These cases and thecorresponding plant conditions are summarized in the followingTables 2.1 and 2.2.

2.13

Table 2.1 Analysis Cases for As-Found ConditionUnit 2

All Cases Case 1 Case 2

Unit ICase 3 Case 4 Case 5

Plant Condition 0 cretin 0 eratin Shutdown Shutdown Shutdown Shutdown

Ouration (normalized to 1 year) 8768 6368(hrs)t Pumps Initially running (SFP 1 1

<115 F

f P s Re uired SFP «200 F) I I

800 960 320 320

SFPC Availabilit Yes Yes Ko Yes Yes

RKR Availability (0 Loops) 1 1 0-8 Oays1-17 Oa s

Time-to-Boil (hrs) >50 >50 >50 »25 >25 15 - 25

Table 2.2 Analysis Cases for As-Fixed ConditionsUnit 2

All Cases Case 1

Unit ICase 2 Case 3 Case 4

Plant Condition 0 eratin 0 eratin Shutdown Shutdown ShutdownOuration (normalized to I year)(hrs)P Pumps Initially running (SFP<115 F)

I P s Re uired (SFP <200 F)

SFPC AvailabilitRKR Availability (8 loops)

Time-to-Boil (hrs)

8768

Yes

»50

6368

Yes

>50

800

Yes

0-8 Oays1-17 Oa s

>50

960

No

>25

640

Yes

>25

2.14

Fault Trees

The systems and components that are procedurally used to provideSFPC were explicitly modeled with fault trees. The followingparagraphs summarize the fault tree models. Details of the faulttree model inputs are provided in Appendix B. Fault trees areused to determine the probability of system failures. The faulttrees developed for the analysis include basic component failures,instrumentation and control failures, support system failures,maintenance unavailabilities, some component level operatorerrors, and common-cause failures.

SFPC - This system provides normal and maximum-normal cooling tothe SFPs. All pumps, heat exchangers, and major valves and

'omponents were modeled. Support system interfaces that weremodeled include electrical power, room cooling, and SWS cooling tothe heat exchangers. The SFPC system pump designs were assumednot to meet single design failure criteria. The SFPC system ofUnit 1 and Unit 2 each have three SFPC pumps and heat exchangerswhich are considered to be initially in service, unless notedotherwise.

RHR System - Under conditions where fuel is in the reactor coreduring refueling, the RHR system has one train providing shutdowncooling to the core and the other train in shutdown coolingstandby lineup (Case 2 conditions).'tandby RHR systems areconsidered available for cooling the SFPs except when needed inresponse to the event for the fuel in the reactor core of theoperating unit. The RHR system can provide normal and emergencycooling for all possible SFP heat loads. All pumps, heatexchangers, and major valves and components required for the SFPCassist mode were modeled. The support system interfaces estimatedinclude electrical failures, emergency diesel generator failures,and SWS cooling to the RHR heat exchangers.

manual cross-connection of the SFPs - The SFPs can be cross-connected using the building cranes to remove the gates frombetween the Unit 1 and 2 pools. This action increases the

pools'ffectivesize (adds the volume of the cask stor age pit) andallows cooling from one SFP to cool the other SFP. A fault treewas developed to model the cranes, gates, availability ofoperators, and availability of electrical power.

As appropriate, a simplified Human Reliability Analysis (HRA)technique was used to estimate human error probabilitiesassociated with performing key operator actions. The human errorprobabilities for critical actions were estimated followingguidance in the Accident Sequence Evaluation Procedure Guidancefrom NUREG/CR-4772 (Swain 1987) and NUREG/CR-4550, Volume 2(Harper et al. 1989).

2.15

Data Sources

The quantification process uses various sources of data, which aredescribed below for the types of data indicated:

Generic Data - Generic data were extracted from a summary in theexisting IPE and other sources. Additional reviews of some ofthese same sources for BWRs were also conducted. A summary of thevalues, sources, selected point estimate, and rational forselection is provided in the Componerit-Failure Data table portionof the Fault-Tree Basic Events section of Appendix B.

Plant-Specific, Data - Where available, SSES plant-specific„information was used. The Susquehanna IPE was considered as anadditional source of generic data values. These Susquehanna IPEvalues are included in the Component-Failure Data table portion ofthe Fault-Tree Basic Events section of Appendix B.

For some component and system availabilities, plant specific datawere extracted from the Susquehanna SFP mini-PRA (SA-TSY-OOI).Discussion of the selection of these values is included in theBasic Event Value Generation por'tion of the Fault-Tree BasicEvents section of Appendix B.

Human-Failure Data - Human errors can contribute to systemfailures or otherwise impact the sequence of events such thatcooling to the SFP(s) is not recovered. Important human actionsare addressed in the values used in the top events of the eventtrees based on a simplified approach for the treatment of humanerrors. Proceduralized actions performed in response to evolvingplant conditions were modeled as critical actions and werequantified following guidance from the Accident SequenceEvaluation Program (ASEP) provided in NUREG/CR-4772 (Swain 1987).Longer-tenn actions that involve repairs or innovative recoverieswere treated as recovery actions. These actions were quantifiedbased on ASEP guidance and estimations from NUREG/CR-4550 (Harperet al. I991) 'n Appendix C, Section C.5, "Issue 5." InnovativeRecovery Actions for Long-Term Sequences Involving Loss of Con-tainment Heat Removal." These techniques lead to human-errorprobabilities generally in the range of 0.004 to 0.1 for restart-related actions and generally in the range of 0. I to 0.5 forrepair or recovery actions. The operator actions associated withuse and recovery of cooling systems are combined with the faulttree top event failure probability and entered into the eventtrees.

Common-Cause Data - Common-cause failures are dependent failuresthat defeat the redundancy used to improve the availability ofplant systems or functions. Common-cause failures will beexplicitly depicted in the fault-tree models. However, thisanalysis does not model all the plant systems. It concentrates onthe systems required for SFP cooling. Information regarding

2.16

support systems failures was extracted from the Susquehanna IPE.Then, the common-cause failure probabilities were calculated from'independent-failure probabilities and common-cause (beta) factorsusing the Multiple Greek Letter (NGL) methodology (PGE 1992). See

the Common-Cause Data section of Appendix B for a detaileddiscussion and development of the common-cause probabilities.

Tables in Appendices B,C, and D provide all the top eventhardware, human error, and combined failure values used inquantifying the event trees.

Model uantification

The Integrated Reliability and Risk Analysis System (IRRAS), a PC-

based program developed by the Idaho National EngineeringLaboratory for the NRC (Russell et al. 1991), was used to developand analyze the fault trees and to quantify the accident sequencesshown in the event trees leading to near boiling conditions. Thefault trees and event trees used to estimate the NBF for eachinitiating event considered are provided in Appendix D.

Failure Se uences

Failure sequences are thos'e event scenarios that progress to nearboiling conditions in either or both SFPs after the initiatingevent due to various combinations of hardware and human errorsthat prevent restoration of adequate cooling to the SFP(s). Theanalysis estimates the likelihood of these failure sequencesoccurring and the time elapsed after the initiating event beforenear boiling conditions could develop in the SFPs for thesesequences. Event sequence timing estimations are described underSection 2.4. These estimations are made for each initiating eventconsidered and for each case analyzed for both the As-Found andthe As-Fixed plant conditions. Failure sequences with a total NBFfor all cases, of less than 1.0E-6 per year or with an estimatedtime-to-boil of greater than 50 hours are considered incredibleand are dropped from further analysis. The failure sequences withNBFs greater than 1.0E-6 and with estimated time-to-boil within 50hours are analyzed for potential contribution to core damage.

2.4 Core Damage Frequency

A qualitative approach is used to evaluate the potential for,the mostimportant event sequences to result in damage to the reactor core. Theevaluation describes the timeline associated with the event sequencesand identifies the major events and activities that occur or would belikely to occur from the onset of the event to the point where failureto mitigate the event could lead to core uncovery. The timelineassociated with these events and activities is approximate and indicatesthe depth of resources that can be applied in the plant response giventhe long time periods prior to core uncovery. The systems that arelikely to be used to mitigate the event are identified and grouped into

2.12

categories, The categories are based on equipment location and

functions. Given near boiling conditions, conservative order-of-magnitude failure probabilities are assigned for overall combined systemcapabilities for these categories of. systems. These order-of-magnitudeconditional failure probabilities are multiplied by the estimated NBF

for the event sequences analyzed to yield a bounding estimation of thecontribution to the core damage probability from the initiating event.The results from this evaluation for each event sequence evaluated aresummed to obtain the overall contribution to core damage frequency fromevents causing a loss of SFPC. The magnitude of the results provides an

indication of the relative significance of these events in relation 'toother contributors to core damage. The basic activities involved inperforming this qualitative assessment of conditional contribution tocore damage are described below.

Identif the Most Im ortant Event Se uences

The most important sequences are identified by applying screeningcriteria to the event sequences that involved near boilingconditions in the SFP. The event sequences associated withinitiating events which have a total estimated NBF of greater thanI.OE-6 per year and also have an estimated time-to-near-boiling ofless than 50 hours after the initiating event are evaluated forpotential contribution to core damage as described below.

Identif Barriers to Event Pro ression

Events that cause a loss of SFPC and subsequent system failuresand human errors that lead to near boiling. conditions in theSFP(s) do not present an immediate threat to the fuel in the SFPsor to the ability to maintain core cooling to the reactor. TheSFP would have to essentially boil dry before the spent fuel inthe SFPs would present any. radiological threat offsite; this eventhas been evaluated in NUREG/CR-4982. The equipment in the reactorbuilding providing cooling to the reactor core is not adverselyaffected by loss of cooling to the SFPs unless the energy releasedfrom the SFPs in the form of increased temperature and humidityconditions spreads into the reactor building. The energyreleased from the surface of the SFPs after a loss of SFPC priorto SFP boiling conditions will be kept from spreading to thereactor building by normal Zone 3 HVAC systems (when operating),by the SGTS (when operating), and by isolating the recirculationfans (if operating). The effectiveness of these systems atpreventing spread of the steam from the SFP surface to the reactorbuilding is decreased and not credited after near boilingconditions have developed. Additionally, the reactor building fora unit that is being refueled is isolated from HVAC Zone 3 tomaintain secondary containment integrity for the operating unit.Therefore steam released into Zone 3 will not spread to therefueling unit's reactor building. The reactor building of a non-isolated unit would experience temperature increase at anincreased rate after the SFP(s) begin to boil such that

2.18

temperatures adverse to equipment operation could be reached inrooms containing emergency core cooling equipment as soon as eighthours after the SFP reaches boiling conditions.

Estimate Event Se uence Timin

The reactor core would not be adversely impacted from theconsequences of an event that leads to loss of SFPC unless theECCS equipment that has not completed their safety functions wererendered inoperable due to adverse room temperatures. Asdescribed above, this is not expected to occur until at least

„ eight hours after. the onset of near boiling conditions in theSFP(s). Near boiling conditions in the SFP(s) would not developprior to 15 hours after the initiating event for the largest heatload conditions associated with Case 5 in the As-Found plantconditions. The time to near boiling conditions for Cases 3 and 4

is greater than 25 hours for both As-Found and As-Fixed plantconditions. The time to SFP near boiling conditions for Cases 1

and 2 is greater than 50 hours for both the As-Found and As-Fixedplant conditions. The evaluation that develops these times tonear boiling conditions is presented 'in= Appendix A. The timelinesfor the most important event sequences identify the major eventsand activities that occur or would be likely to occur from theonset of the event to the point where failure to mitigate theevent could lead to core uncovery. These timelines and detaileddiscussions of the progression of the event sequence are providedin Appendix 0 and the results are summarized in Section 3.0. Thetimelines of events and activities is approximate and indicatesthe depth of resources that can be applied in the plant responsegiven the long time periods prior to core uncovery.

Estimate ikelihood of Failure of Barriers to Se uence Pro ression

The most important event sequences are evaluated to identify abounding order-of-magnitude range for failures in the followinggroups or categories of systems:

~ systems and operator actions that could be used to preventexcessive steaming release to the reactor building;

normal ECCS equipment and any necessary operator actions inthe reactor building;

back-up equipment located in the other unit's reactorbuilding or located outside the reactor building that couldbe connected and aligned to provide reactor core cooling.

The success of any of these categories of systems is heavilydependent on operator actions. The order-of-magnitude ranges andselected values for the likelihood of failure associated withthese categories of equipment are estimated based on theconsideration of several factors that impact their success. These

2.19

considerations are generally human action performance shapingfactors. The factors considered in judging the likely failurerange and selecting equipment category failure values include thefollowing:

the number of systems and amount of equipment available thatcould perform the required function;

the degree of perceived importance to plant operators andTSC staff;

the dynamic significance of the event sequence withassociated competing interests for the operator's attention;

The degree of dependence among the human actions taken;

~ the approximate time available to complete the action;

the indications available to the operators or TSC staff ofplant conditions;

~ the deg'ree of procedural guidance; and

the overall plant damage state for the event sequence.

The progression of the most important event sequences aresummarized in Section 3.0. Appendix D provides a detaileddiscussion that describes the potential for these categories ofequipment to prevent event progression. Judgement based onconsideration of the above factors is used to estimate these .

failure ranges and values in evaluating the failure potential forthe human actions over the relatively long time periods associatedwith these event sequences.

stimate Event Se uence Conditional Contribution to Core Dama e~Fre nenc

The estimated order-of-magnitude conditional failure probabilityvalues used for the categories of equipment failures that couldpotentially prevent event sequence progression are multiplied bythe estimated NBF for the event sequence to yield a boundingestimation of the contribution to the core damage probability fromthe initiating event. Event sequence paths are shown in thegeneralized event tree for core damage frequency presented inSection 3.0. The sequence paths that include success of one ofthese mitigative categories of systems have successful outcomesthat do not contribute to the CDF.

stimate of Core Dama e Fre uenc Due to SFP Boilin

The results from the individual event sequence evaluations aresummed to obtain the overall contribution to core damage frequency

2.20

from events causing a loss of SFPC. The magnitude of the resultsprovides an indication of the relative significance of theseevents in relation to other contributors to core damage. Theseresults are presented in Section 3.0.

2.21

3.0 RESULTS ANO OISCUSSIONS

Results are presented and discussed for the areas of initiating eventfrequency, near boiling frequency, core damage frequency, and

sensitivity analysis issues.

3. 1 Hear Boiling Frequency Estimation Results

The discussion below presents the results of the individual activitiesperformed to support estimations of NBF. The potential for SFP drainagewas considered not credible based on SSES having redundant and diversefeatures to preclude SFP drainage and the SFPs having redundant anddiverse inventory makeup capabilities which reduce the potential for SFP

drainage. The risk associated with potential SFP drainage was addressedin detail by NUREG/CR-4982 (Sailor et al. 1987), which provides findingsconsistent with the above findings and concludes that the risks are lowand uncertain.

nitiati Event Fre uenc Discussion

The initiating events selected for evaluation in this analysis andthe annual frequencies of these initiating events are presented inTable 3. 1 below. Appendix C identifies the sources of informationused to quantify these initiating events. The frequency values ofthese initiating events represent an average of SSES 1PE (PP&L1991) and industry values selected as appropriate andrepresentative for SSES.Table 3.1 Selected Initiating Events and Frequencies

Initiatin Events and Fre Uencies

initiatin Event

SFPC Fails

LOOP

Extended LOOP

SBO

LOCA

LOCA-LOOP

LOSVS

Flocdin

Pi e Break

Seismic

Fre uenc

1.57E-4/ r

7.00E-2/ r

7.0E-3/yr 0 >4 h3.5E-3/yr 9 >10 h1.75E-3/ rg >20 h

2.73E-B/ r

3.67E-3/ r

2.57E-4/ r

2.00E-3/ r

3.90E-3/ r

3.40E-3/ r

6.55E-6/yr 0 ~ 0.69 PGA4.20E-7/ r 0 » 0.6 PGA

3.1

Event Trees Used to Estimate the NBF

The following discussion summarizes the event-tree headings (topevents) used to estimate the NBF for the As-Found and As-Fixedconditions. The event sequence paths depend on the successes andfailures associated with the top events that appear in a givenevent tree. The failure sequences are those that result in theUnit I and/or Unit 2 SFP reaching a near boiling condition. Thetop events used in the event trees reflect differences in theplant's condition and response to the event. The failure valuesused for these top events are different for the As-Found and As-Fixed conditions and also vary according to the success criteriawhich differ for the scenarios and cases analyzed. The eventtrees used to perform the analysis are presented in Appendix C.The top events that are used in one or more of the event trees aredescribed below. An example event tree is shown in Figure 3. 1.

E. POW REC: This event is defined as recovery of offsite powerwithin 4 hours. This event is considered for sequence paths inwhich the cross-connection event fails or succeeds.

L. POW REC: This event is defined as recovery of offsite powersupply after 4 hours, but within 10 hours. This event isconsidered for sequence paths in which the cross-connection eventfails or succeeds.

5th EDG: This event is defined as use of surplus emergency powersupplies to power the appropriate non-safety buses for operatingthe cranes necessary for crass-connecting the SFPs and to powerthe SFPC system(s). This event is considered for sequence pathsin which the cross-connection event fails or succeeds.

CROSSTIE: This event is defined as cross-connecting the Unit Iand Unit 2 SFPs. Actions taken include removal of the gatesseparating the SFPs, by using one of two refueling buildingcranes. The cross-connection allows free exchange of SFP waterbetween the pools such that one cooling system provides coolingfor both SFPs. This event is considered for only the As-Foundcondition scenarios, the SFPs are already cross-connected for theAs-Fixed condition.

UI SFPC RE: This event is defined as restart recovery thatreturns the SFPC system to service for Unit I after recovery ofpower to the appropriate non-safety bus, if necessary. This eventis considered for the sequence path in which the cross-connectionevent fails.U2 SFPC RE: This event is defined as restart recovery thatreturns the SFPC system to service for Unit 2 after recovery ofpower to the appropriate non-safety bus, if necessary. This eventis considered for the sequence path in which the cross-connectionevent fails.

3.2

Ul RHR: This event is defined as placement of RHR in the SFPC

assist operating mode for Unit l. It takes approximately 8 hoursto complete this action. This event is considered for thesequence path in which the cross-connection event fails.

U2 RHR: This event is defined as placement of RHR in the SFPC

assist operating mode for Unit 2. It takes approximately 8 hoursto complete this action. This event is considered for thesequence path in which the cross-connection event fails.

Ul REP REC: This event is defined as performing repair actions tothe Unit 1 SFPC system or RHR system or necessary support systemsplacing the repair ed system in service for cooling the Unit 1 SFP.This event is considered for the sequence path in which the cross-connection event fails.

U2 REP REC: This event is defined as performing repair actions tothe Unit 2 SFPC system or RHR system or necessary support systemsplacing the repaired system in service for cooling the Unit 2 SFP.This event is considered for the sequence path in which the cross-connection event fails.

ALT COOLING: This event has not been credited in quantifying thenear boiling frequency, but represents additional mitigativeactions that would likely be performed for sequences involvinglong time periods. The event is defined as cooling the Unit 1 andUnit 2 SFPs using alternate means that may not be pre-defined inthe procedures. The equipment which operations or technicalsupport center staff could use for backup cooling to the SFPsinclude: the emergency service water system, the fire watersystem, or pumper truck water supply for establishing feed andbleed cooling. This event is shown for sequence paths in whichthe cross-connection event fails or succeeds.

COMB SFPC: This event is defined as restart recovery that returnsthe SFPC system to service for Unit 1 or Unit 2 after recovery ofpower to the appropriate non-safety bus, if necessary. This eventis considered for the sequence path in which the cross-connectionevent succeeds.

COMB RHR: This event is defined as placement of RHR in the SFPCassist operating mode for Unit 1 or Unit 2. It takesapproximately 8 hours to complete this action . This event isconsidered for the sequence path in which the cross-connectionevent succeeds.

REPAIR REC: This event is defined as performing repair actions tothe Unit 1 or Unit 2 SFPC system or RHR system or necessarysupport systems placing the repaired system in service for coolingthe SFPs. This event is considered for the sequence path in whichthe cross-connection event succeeds.

3.3

Figure 3. I, "Example NBF Event Tree," shows the basic process usedwithin a commercial spreadsheet program to model event trees with theabove top events. Each event tree is characterized by a subject title,initiator title, top event titles, node success and failure values,structured logic diagram, and endstate sequence conditions and values.

The highlighted row on each event tree represents the failure values andis the input to the event tree, all other values are calculated. Therow above the highlighted failure row is for the calculated successvalues. The structured logic of the event tree uses the common eventtree practice of modeling failures as the downward path, success as theupward path. Intermediate success and failure values are shown for eachnode. The first node in the event tree is the initiating event.Subsequent nodes in the event tree represent the top events. Typicallythe top events are arranged in'n order corresponding to the systemsequential response to the transient although this may not always be thecase (e.g., "Crosstied" is always modeled as the first node after theinitiating event, but it probably occurs midway through the event). Thiswas done to simplify the modeling of the events by transferringcrosstied conditions to another event tree for each initiating event.

The "Endstate" portion of the event tree contains sequence conditiondesignation. The sequence condition designations represent a successfu1avoidance of near boiling ("ok" column), single unit boiling ("Unit I"and "Unit 2" columns), and both units boiling ("Both Boil" column). 'woadditional columns are provided for sequence transfers to other eventtrees and comments. Each column is totaled and a numerical check toensure completeness is calculated at the bottom of the "Comment" column.Please note that the total NBF does not appear on either of these tworows. A separate row is located at the bottom of each initiatingevent's "Cross-tied" event tree that provides a total for each sequencedesignation and the total NBF for the initiating event.

3.4

~KE!KIEHHEEIZRZ5~!%~~~~~~~????IH?IBEBWKXEZKISE? ~~2?mRZERIKEKBmKBRZBEI~~~~~~f~ggggf~ggfi~ijm~tt Qjm?xiii]jmfmgmmmmggmgggmmgmmmmgggm

Il ~ ~~~I'C ~ %K"'ZJ~~i

KERK3

I I ~ II ~i~It +II

KEEK)~, ~EK-=6

I ~g+I~ltl~tl~IllQlt ~@~II ~it~tl ~ ?Ill

RK~~~ :)

e

RI?. INSKKB?I'~?RKXmKEI 5~~~~~~~?IBRlKXElMHSK~LRI -8RKBBKEKIRHK!?KRZRREBBI~~~~~~EKM3EH KHNEKKtmtKXHNMKIIESIMERRmSKmmmmm5IIRNHHRmmm

~+14il

I I KWHKKKZ3

I RRTM~KK3I I ~ ~ I ~111 +11

~, ~~~REARPg~~It +IIIIggll ~tl I ~lt ~~I)+IIIIggll ~~i~tt I ~il

mma aKmtaKKK3ammlaam'lemaanK3

Fault Trees and To Events Used to Estimate the NBF

The following discussion summarizes the fault-tree top eventfailure estimations, the human error probability estimationsassociated with these top events, and the combined top eventfailure probabilities used to. estimate the NBF for the As-Foundand As-Fixed conditions. These combined top event failureprobability values are the values entered into the event trees atthe corresponding top event.

Simplified fault trees were developed for the SFPC system, the RHR

system in the SFPC assist mode, and the SFP cross-connectequipment. The data used to quantify these fault trees ispresented, in Appendix B. The resulting system hardware top eventtree unavailabilities (hardware failure rates) for the As-Foundand the As-Fixed plant conditions for all cases analyzed arepresented in Appendix B, Tables B. I and B. II.The human actions necessary to respond to the initiating eventsinvolve operator actions to recover cooling to the SFPs asreflected in the event tree top events. The human errorprobability estimations for these top events in the As-Found andthe As-Fixed plant conditions for all cases analyzed are presentedin Appendix D, Tables D. I and D. II.The overall failure probability for the event tree top events isthe sum of the system fault tree unavailabilities and the human ,

error probability values. The combined top event failureprobability estimations for the As-Found and the As-Fixed plantconditions for all cases analyzed are presented in Appendix C,Tables C. IV and C.V.

stimated Near Boilin Fre ue~nc

The NBF is estimated by performing the NBF event treecalculations. The As-Found and As-Fixed near boiling frequency(NBF) results for the cases considered, the initiating eventsanalyzed, and overall totals are presented in Table 3.2 and Table3.3. The estimated NBF contributions by initiating event arecharted in Figure 3.2 and Figure 3.3.

3.6

Table 3.2 SSES Site As-Found SFP Near Boiling Frequency

Fre uenc ( er lant ear)

Initiator Case I Case 2 Case 3 Case 4 Case 5 Total X of total

Loss of SFPC

LOOP

Extended Loo

SBO

LOCA

FloodinLoss of SMS

Pi e Break

Seismic <.6

Seismic ~>.6

LOCA w/LOOP

Total

3.4E-OB 4.8E-OB

2.7E-06 S.IE-07

1.3E-05 3.7E-06

4.0E-09 5.1E-IO

2.9E-06 3.6E-07

2.9E-07 6.4E-OB

I.SE-07 3.3E-OB

2.5E-07 5.6E-OB

2.6E-07 ?.BE-08

3. IE-07 3.8E-OB

2.9E-06 I.BE-07

2.3E-OS S.IE-06

I.OE-07 7.6E-09

3.1E-06 9.5E-07

B.IE-06 3.2E-06

1. IE-09 3.6E-IO

B. IE-06 B.BE-07

3.8E-07 1.2E-07

1.9E 07 5.9E-OB

3.3E-07 1. OE-07

2.0E-O& 2.9E-OB

4.6E 08 1.5E-OB

8.3E-07 1.7E-07

2.1E-OS 5.5E-06

7.5E-OB 2.7E-07

I. IE-06 8.3E-OB

7.9E-06 3.6E-OS

5.2E-IO 6.5E-09

3.1E-06 1.5E-OS

3.2E-07 1.2E-06

1.6E-07 6.0E-07

2.8E-07 I.OE-06

4.6E-OB 4.3E-07

1.5E-OB 4.2E-07

1.2E-07 4.2E-06

1.3E-OS 6.8E-05

0.4X

12.3X

53.3/O.OX

22.5X

1.7X

0.9X

I.SX0.6X0.6X

6.2X

X of total 33.9X 7.5 31.1X B.IX 19.4X

Table 3.3 SSES Site As-Fixed SFP Near Boiling FrequencyFre uenc ( er lant ear)

InitiatorLoss of SFPC

Case I

1. IE-07

Case 2

1.9E-OB'ase 3

S.OE-OB

Case 4

4.6E-OB

Total

2.3E-07

X of totalI.IX

LOOP

Extended Loo

SBO

LOCA

FloodinLoss of SMS

Pi e Break.

Seismic <.6

Seismic ».6LOCA w/LOOP

Total

S.SE-07 7.9E-OB

3.0E-06 4.0E-07

4.0E-09 S.OE-IO

1.5E-06 1.7E-07

2.8E-07 3.8E-OB

3.5E-OB S.OE-09

2.5E-07 3.3E-OB

1.2E-07 1.6E-OB

3.1E-07 3.8E-OB

1.6E-06 9.6E-OB

7.7E-06 9.0E-07

8.5E-07

3.5E-06

I.IE-091.6E-OB

3.8E-07

5.4E-OB

3.3E-07

6.9E-Q&

4.6E-OB

6.9E-07

7.6E-06

4.6E-07

2.1E-06

7.1E-IO1.1E-06

2.3E-07

2.9E-OB

2.0E-07

4.4E-OB

3. IE-08

4.6E-07

4.7E-06

1.9E-OB

9.0E-06

6.2E-09

4.3E-06

9.3E-07

1. 2E-07

8. IE-07

2.5E-07

4.2E-07

2.8E-06

2.1E-OS

9.3X

43.2X

O.OX

20.7X

0.6X

3.9X

1.2X

2.0X

13.6X

X of total 37.0X 4.3X 36.2X 22.4X

3.7

Seisnic ns.6y1%

Lose of SFPC

LOCAwA.OOPPspe Brook

Lose of SWS SSS

1% Floodiny2%

LOOP121k

cc>~;wCW

LOCA22SS

N¹~;~B;~K'.%4'6'P.„:egg@>

SBO0%

Encoded Loop64 es

Figure 3c2 SSES Site As-Found SFP NBF

LOCAwAOOP14%

Ssssnso c> 6y

S sly1SS

Pye Bros'k4 so

locc of SWS1ss

Loscof SFPC1SS LOOP

yes

Floodny4ss

E sfendsd Loop43'A

580PA

Figure 3.3 SSES Site As-Fixed SFP NBF

3.8

As-Found NBF Estimation Results

The total estimated SFP NBF summed over all five of the cases forall initiating events in the As-Found plant conditions is 6.8E-5per plant year. Case 1 which represents normal plant operationshas the highest contribution to NBF (approximately 34/). Thisresult is due to the relatively large exposure time as compared tothe other four cases which represent various heat load conditionsand cooling capabilities for the SFPs during a representativerefueling outage (refer to Appendix A for case descriptions).Cases 2 and 4 each contribute approximately 8% to the overall As-Found NBF. Case 3 contributes a large amount at approximately 31%

to the total NBF due to the unavailability of SFPC in one unitbecause of a SWS outage and assumed unavailability of RHR forcooling the SFPs. Case 5 finishes the As-Found contribution toNBF with approximately 19%.

The results for each case in the As-Found plant condition aredominated by the Extended LOOP event which overall contributesapproximately 53% to the NBF. Case 3 is equally dominated byEXLOOP and LOCA, both having and estimated NBF of approximately8.1E-6 per year. Overall, the second major contributinginitiating event is LOCA which contributes about 22%. The LOOP

initiating event has a total contributions to the NBF of about12%, while LOCA with LOOP contributes approximately 6/. Flooding,Pipe Break, and Seismic events each contribute less than 2%, andthe remaining initiating events each provide a contribution of 1%

or less.

As-Fixed NBF Estimation Results

The total estimated SFP NBF (Table 3.3) summed over all four ofthe cases for all initiating events in the As-Fixed plantconditions is 2.1E-5 per plant year. Case 1 which representsnormal plant operations has the highest contribution to NBF(approximately 37%). This result is due to the relatively largeexposure time as compared to the other three cases which representvarious heat load conditions and cooling capabilities for the SFPsduring a representative refueling outage (refer to Appendix A forcase descriptions). Case 3 has a significant contribution due tothe assumed unavailabilities in one unit's SFPC due to a SWS

outage and of RHR for maintenance. Case 4 contributesapproximately 22% to the overall As-Fixed NBF. Case 2 contributesapproximately 4% to the total NBF.

The results for each case in the As-Fixed plant condition are alsodominated by the Extended LOOP event which overall contributesapproximately 42% to the NBF. The second major contributinginitiating,event is LOCA which overall contributes about 21%. TheLOCA with LOOP initiating event contributes approximately 14% tothe total NBF, while LOOP contributes approximately 9%. PipeBreak, Flooding, and Seismic events each contribute between 3/. and

3.9

5% to the total As-Fixed NBF. The remaining initiating eventseach provide a contribution of less than 1%.

The results show that the overall estimated NBF is decreased bymore than a factor of three from the As-Found to the As-Fixedplant conditions. This decrease in the estimated NBF isattributed to the changes made since the time the Part 21 reportwas submitted. The changes that make this impact on the resultsinclude: maintaining the SFPs in a cross-connected configuration,"improving the overall level of awareness of the potentialseriousness of loss of SFPC events if not attended to for longperiods of time; improving the guidance in the procedures providedfor events involving a loss of SFPC; improving the administrativecontrols over management of the heat load conditions allowed toexist in the SFPs; and improving the instrumentation provided inthe control room.

The results also show that from As-Found to As-Fixed conditions,the contribution to NBF from a loss of SFPC event has shiftedslightly to normal plant operating conditions (Case 1). The shiftin the degree that the NBF is dominated by Extended LOOP fromabout 53% in the As-Found conditions to about 43% and in the As-Fixed plant conditions and similar decrease in the LOOP eventreflects the decreased reliance on electric power for being ableto cross-connect the SFPs. The LOCA event shows a small decreasein the relative contribution to NBF from As-Found to As-Fixedconditi'ons. The LOCA with LOOP event shows a decrease in absoluteestimated NBF values, but contributes a larger relative percentagein the As-Fixed case than the As-Found condition.

3.2 Core Damage Frequency Discussion

The results from this analysis do not include the contribution to CDFfrom scenarios involving reactor pressure vessel rupture and/orcontainment failure. The'se scenarios have a small contribution to thetotal CDF in the SSES IPE and are considered even less significant forloss of SFPC events which involve relatively long times before increasedtemperatures develop. Likewise, the risks from non-core-damage plantdamage states are not addressed. These event scenarios are believed toinvolve relatively minor offsite risks based on the low amounts ofradioactive materials involved and the integrity of the containment.

The discussion in Appendix C describes the accident progression frominitiating event to near boiling conditions and then to potential coredamage conditions for each of the most important event sequences. Atable depicting an approximate time line of events and likely activitiesassociated with each of these accident progressions is also provided inAppendix C.

The event tree provided in Figure 3.4 shows the failure paths andcategories of equipment failures that would be necessary to reach coredamage conditions. A brief discussion of the event sequence evaluations

3.10

for estimating the potential for contribution to core damage is providedbelow. This discussion concludes with an order-of-magnitude estimationof the potential conditional core damage frequency for each major eventsequence. The total order-of-magnitude estimation of conditional coredamage frequency for all of these most important event sequences ispresented in Tables 3.4 and 3.5.

~ Se uence Pro ression Discussion of Most Im ortant Accident~Se uences

The most important accident sequences are those that have aninitiating event with a total estimated annual NBF of greater than1.0E-6 and occur in cases that have estimated time to reach nearboiling conditions of less than 50 hours. Initiating events witha total estimated annual NBF of less than 1.0E-6 are considered'toprovide a negligible or insignificant potential contribution tocore damage. Likewise, cases estimated to reach near boilingconditions at greater than 50 hours are considered to havesufficient time to restore cooling to the SFP(s) or to preventadverse conditions in the reactor building. This certain recoveryis credited because of the multiple success paths available, andthe extended time in which to mitigate the event. The ECCSequipment required for core cooling will have completed therequired safety functions or will be otherwise protected foraccident sequences with estimated time to near boiling conditionsof greater than 50 hours. Therefore, this evaluation does notinclude the potential contribution to core damage from sequenceswhich are negligible contributors (NBF <1.0E-6) or that allowsufficient time for certain recovery (>50 hours to boil).The evaluations for the most important event sequences firstconsider the initial plant conditions which impact the sequencepath and timing. Next, the activities and events that could occurin the time between the initiating event and reaching near boilingconditions in the SFP are evaluated to estimate the potential for

. early recovery. Once the SFP has reached near boiling conditions,the potential recovery paths from isolation of, the steam releasedinto Zone 3 or from alternate methods of cooling the SFPs areestimated. Additionally; the potential for use of alternate corecooling methods with equipment outside the reactor building orwith any surviving equipment in the reactor building is estimated.Finally, the time to core uncovery is approximated. The analysis'hen uses the approximations of failure of recovery from thesemethods to obtain an order-of-magnitude estimation of theconditional contribution to core damage frequency given theinitiator. This analysis is shown schematically in the event treepresented in Figure 3.4. This event tree presents the generalsequence flow path that could lead to core damage given nearboiling conditions. The general functional failures that wouldhave to occur before the sequence could reach a core damage endstate and typical order of magnitude estimations of theirassociated failure likelihoods are as follows: 1

-3.11

Failure of alternate methods for cooling the SFPs that werenot credited in the estimation of the NBF as well as failureof operators to isolate Zone 3 from the Unit 2 reactorbuilding. The failure occurs if operators do not implementalternate feed and bleed cooling to the SFPs using one of atleast three possible systems and also do not isolate theZone 3 air space from Zone 2 air space. The likelihood thatthese actions would fail given the typically long timeperiods between exceeding the SFP temperature .technicalspecification limit and failure of ECCS equipment in Unit 2

is generally estimated at 0.1.

Failure of and non-recovery of all Unit 2 ECCS equipmentthat would normally be capable of providing sufficient longterm decay heat removal. .The initial short term post scramfunctions are completed prior to failure of the ECCS

equipment. The likelihood that these actions would failgiven the plant conditions, time frame and plant staffinvolved, and other activities is generally estimated at1.0.

Failure of all equipment outside the Unit 2 reactor buildingincluding: feedwater, condensate, standby liquid control,reactor water cl,eanup, fire water, control rod drivemaximized, RHR service water, or pumper truck, and ECCS

equipment from Unit 1 that could be crosstied to Unit 2 .Host of these alternate cooling mechanisms are identified inthe emergency procedures. The likelihood that these actionswould fail given the plant conditions, time frame and plantstaff involved, and other activities is generally estimatedat 0.01.

~ Summar of Conditional Core Dama e Fre uenc ContributionEstimations

Based on this type of analysis the resulting conditional coredamage frequency contributions from each of the most importantevent sequences are described below. The event sequencesevaluated for conditional core damage frequency contributions alsoincludes those that come close to meeting the screening criteriafor evaluation.

The overall order of magnitude estimate of the conditional coredamage frequency due to an initiating event is the product of theestimated NBF and the three general functional failure estimationabove. The order of magnitude estimated potential for thesefunctional .failures, given SFP boiling conditions, and theassociated conditional core damage frequency estimations aresummarized in Table 3.4 below for As-Found and As-Fixedconditions. The product provides the estimated CDF contributionfor each of the event sequences evaluated.

3.12

lE

Generic Core Damage Frequency (CDF) Event Tree

Near BoiTing

Frequency

holationlRecovery

-SGTS- HVAC

-Rre Water-Bc.

ECCS Failure

-CS- LPSS- WS-FW

- CROP

-Bc.

Equipmsnt'utside

Reactor

Building

- Follow EDP-Bc.

Sequence End-State

Range

Screen Value

From M3F 1.0- 0.01

0.10

1.0- 0.1 0.1 - 0.001

0.01

"o'» ~ c

~» g»

Figure 3.4 Generic CDF Event TreeCore Damage

3.13

Table 3.4 SSES Site As-Found Order-of-Magnitude Estimations of CDF


Isolation/Recovery

ECCS Failure EquipmentOutsideReactorBuildin


Estimation

Ran e From HBF 1.0 - 0.01 1.0 - 0.1 0.1 - 0.001

LOOP Case 3

LOOP Case 4

LOOP Case 5

EXLOOP Case 3

EXLOOP Case 4

EXLOOP Case 5

LOCA Case 3

LOCA Case 4

LOCA Case 5

3.1E-06

9.5E-07

I. IE-06

8.1E-OB

3.2E"06

7.9E-06

8.1E-06

B.BE-07

3.1E-06

'0.1

0.1

0.10.10.1

0.10.1

0.1

0.1

1.01.0

1.01.01.01.01.0

1.0

1.0

0. 01

0.01~ 0. 01

0.01

0. 01

0. 01

0. 01

0.01

0. 01

3. 1E-09

9.5E-10

1.1E-09

8. 1E-09

3.2E-09

7.9E-09

B.IE-09B.BE-10

3. 1E-09

Seismic Case 1

LOCA w/LOOP Case 3

5.6E-07

8.3E-07

0.50.1

0.91.0

0. 05

0.01

Total Estimated As-Found COF

1.3E-OB

8.3E-10

5.0E-OB

Table 3.5 SSES Site As-Fixed Order-of-Magnitude Estimations 'of CDF

Near BoilingFrequency

Isolation/Recovery

ECCS Failure Equi pnentOutsideReactorBuildin


Estimation

Ran e

LOOP Case 3

LOOP Case 4

From NBF

8.5E-07

4.6E-070.1

0.1

1.01.0

1.0 - 0.01 1.0 - 0.1 0.1 - 0.001

0. 01

0.01

8.5E-IO4.6E-10

EXLOOP Case 3

EXLOOP Case 4

LOCA Case 3

LOCA Case 4

LOCA w/LOOP Case 3

3.5E-06

2.1E-06

1.6E-06

1.1E-06

6.9E-07

0.1~ 0.1

0.1

0.1

0.1

1.01.01.01.01.0

0.01

0.01

0.01

0.01

0. 01

3.5E-09

2.1E-09

1.6E-09

1.1E-09

6.9E-10LOCA w/LOOP Case 4 4.6E-07 0.1 1.0 0.01

Total Estimated As-Fixed COF

4.6E-10

1. IE-08

3.l4

4.0 SUMNRY AND CONCLUSIONS

This evaluation was performed under contract to the NRC to support theevaluation of PGI 93-01 regarding the safety impact of loss of spent fuel poolcooling incidents. The evaluation is centered on the SSES because of a 10 CFR

21 report filed by two former contract employees which make allegations thatthe SSES has designed deficiencies associated with SFPC which make itsusceptible to unsafe operations. The evaluation was based on SSES plant-specific information including the SSES IPE and relevant generic data sources.The standard PRA technique was used for the evaluation.

The likelihood of a loss of, SFPC event at SSES and the probability of the SFP

heating up to near boiling conditions have been estimated. Additionally, theevent sequences that have the greatest estimated likelihood of the SFP(s)reaching near boiling conditions in a time period of less than .50 hours wereevaluated to provide an order-of-magnitude approximation of their contributionto core damage. These estimations are based on models that represent theplant conditions in the As-Found state prior to the Part 21 report and modelsthat represent present plant conditions in the As-Fixed state afterimprovements made in equipment, procedures, and personnel awareness regardingSFPC issues.

Based on the preliminary results of this study, general insights obtained fromthis .analysis include:

The overall estimated NBF values for the As-Found plant conditions arelow at 6.8E-5 per year and have been reduced to 2.1E-5 per year by thechanges made for the present state of As-Fixed plant conditions. Theseestimated NBF values reflect realistic plant conditions and show thebenefit of improvements made at SSES for maintaining cooling to theSFPs. A large portion of this benefit is realized by the change thatmaintains the Unit I and Unit 2 SFPs cross-connected. This changereduces the vulnerability to events involving a loss of offsite powerwhich inhibit the cross-connection. With the SFPs in the cross-connected state, the systems available to provide cooling to the SFPs isessentially doubled for every event and every case. The otherimprovements made at SSES related to SFPC (i.e., increased level ofawareness, better procedures, and enhanced hardware) result insignificantly lower estimated human err or probability values for the keyoperator actions necessary to respond to loss of SFPC events.

2. The overall estimated CDF values for the most important event sequencesfor As-Found plant conditions are low at 5.0E-8 per year. There are tenevent sequences that meet (or come-close to) the screening criteria forconsideration for potential contribution to core damage for the As-Foundplant conditions. The Seismic events (< 0.6 g and > 0.6g together) werealso evaluated for their contributions to core damage because of theirunique and severe plant damage state considerations. There are eightevent sequences which meet the screening criteria for evaluations ofpotential for contributions to core damage in the As-Fixed plantconditions and the estimated contribution to CDF from this eventsequence is estimated at l.lE-8 per year. These estimated CDF values

4.1

are approximate and reflect the order-of-magnitude nature of thisanalysis.

The analysis results reflect the large number of normal and alternatesystems that are available for providing cooling to the SFP(s) and tothe reactor core. The systems that can be used to provide these coolingfunctions include several that are located outside the reactor buildingand therefore would not be subjected to adverse temperature conditionsfrom SFP boiling. Many of these systems are also independent of other

'lantsupport systems and therefore are available regardless of theinitiating event (except Seismic). The analysis results also reflectthe large amounts of time available after the initiating event beforethe loss of SFPC could lead to near boiling cohditions. For the As-Found condition evaluation, this time period ranges from a low of 15hours for the largest heat load conditions that could be admitted to theSFPs (for a short duration of less than 10 days during a refuelingoutage) to over 25 hours for another part of the refueling outage, andwell over 50 hours for most of the remainder of the operating cycle.The time to near boiling conditions for the As-Fixed conditions isalways greater than 25 hours and usually much greater than 50 hours.The event sequences that involve greater than 50 hours to reaching nearboiling conditions are not evaluated further because this allowssufficient time that PPEL can assemble the support necessary to provideevent mitigation.

The failure likelihood values used in the event trees are dominated byhuman errors. Each top heading shown in the event trees requires.operator action to perfor'm the activity indicated. The operator actionsoccurring early in the event sequence generally have procedural guidancegoverning the action. The operator actions occurring later in the eventsequence tend to have less procedural guidance, or involve innovativerecovery actions that are not proceduralized. The human errorprobability estimates associated with these operator actions aresignificantly larger than the corresponding hardware failure probabilityestimates from the system fault trees. Human actions for As-Fixed plantconditions have better procedural guidance than for the As-Found plantconditions based on the improvements made and the increased level ofawareness about loss of SFPC issues. Because the human errorprobability estimations for these actions are dominant contributors, itis believed that further procedural improvements, training, and minorhardware improvements that aid the operators in handling eventsinvolving loss of SFPC would be useful to justify reduced HEPestimations and thus reduce the estimated NBF and CDF values.

Enhancements believed to have merit in effectively reducing thelikelihood of developing near boiling conditions in the SFP(s) and inisolating the steam release off a boiling SFP include the following.

Provide procedural guidance for use of an alternate back-up coolingmechanism for the SFP(s) with an independent system such as dieseldriven fire suppression.

4.2

Provide procedural guidance for operators to perform theactions'ecessaryto isolate HVAC Zones I and 2 from Zone 3 given a loss of SFPC

well in advance of reaching near boiling conditions in the SFP(s).I

Provide procedural guidance for operators to provide EOG backup power tothe non-safety bus that powers a SFPC system for events involving a lossof offsite power and to restart the SFPC system.

Provide guidance for a resourceful alternative to allowing the steamreleased from a boiling SFP to spread to the reactor building such ascreating an opening in the refueling floor area. siding or roof to allowthe steam 'to escape.

Although the dominant contribution to NBF occurs in Case 1 whichinvolves the period of normal plant operation, this could changesignificantly if refueling practices in terms of heat load admitted tothe SFP(s) and outage management practices in terms of equipment takenout of service were changed from the conditions assumed for thisanalysis. This is illustrated by the relatively large contributionduring Case 3 conditions due to the assumed unavailability of the SFPCsystem and the RHR system for the shutdown unit and the .policy that RHRfrom a unit experiencing a LOCA is not used to cool the SFPs. Thisanalysis did not address the additional impact that other outageconditions that are based on differing outage management and maintenancepractices would have on the CDF contributions. These outage riskcontributors and the issue of'shutdown risk management were beyond thescope of this analysis. Nevertheless, the SSES refueling or forcedoutage shutdown practices may need to change from those assumed in thisanalysis in order to handle the larger decay heat loads that could occurin the future due.to fuller SFPs, longer operating cycles, fuel shufflepractices, or required NSSS draindown during hot climate conditions.These issues could easily cause significant changes to both the loss ofSFPC NBF and the corresponding contributions to CDF. For this analysisequipment out of service times were based on the information provided bySSES and are representative of actual recent outages.

The risk assessment was performed using available SSES plant-specificinformation and relevant data sources. The preliminary results indicatethat the estimated NBF and core damage contribution estimates are quitelow; note that the numerical results are approximate and plant-specificand should be interpreted cautiously. Due to schedule and budgetconstraints, detailed sensitivity, as well as uncertainty analyses werenot addressed.

4.3

5.0 REFERENCES

American Nuclear Society and Institute of Electronics and Electrical'ngineers(ANS L IEEE). 1983. PRA Procedures Guide. NUREG/CR-2300, American NuclearSociety, La Grange Park, Illinois.

Bertucio, R. C. et al. 1990a. Analysis of Core Damage Frequency: Surry,Unit 1 Internal Events. NUREG/CR-4550, Volume 3, Rev. 1, Part 1, SandiaNational Laboratories, Albuquerque, New Mexico.

Bertucio, R. C. et al. 1990b. Analysis of Core Damage Frequency: surry,Unit 1 Internal Events Appendices. NUREG/CR-4550, Volume 3, Rev. 1, Part 2,Sandia National Laboratories, Albuquerque, New Mexico.

Bertucio, R. C. et al. 1990c.'nalysis of Core Damage Frequency: Sequoyah,Unit 1 Internal Events. NUREG/CR-4550, Volume 5, Rev. 1, Part 1, SandiaNational Laboratories, Albuquerque, New Mexico.

Bertucio, R. C. et al. 1990d. Analysis of Core Damage Frequency: Sequoyah,Unit 1 Internal Events Appendices. NUREG/CR-4550, Volume 5, Rev. 1, Part 2,Sandia National Laboratories, Albuquerque, New Mexico.

Bohn, M. P. et al. 1990. Analysis of Core Damage Frequency: Surry PowerStation, Unit 1 External Events. NUREG/CR-4550, Volume 3, Rev. 1, Part 3,Sandia National Laboratories, Albuquerque, New Mexico.

Drouin, M. T. et al. 1989. Analysis of Core Damage Frequency: Grand Gulf,Unit 1 Internal Events. NUREG/CR-4550, Volume 6, Rev. 1, Part 1, SandiaNational Laboratories, Albuquerque, New Mexico.

Duke Power. 1990. Oconee Units 1, 2, and 3, Individual Plant EvaluationSubmittal Report. Duke Power Company, North Carolina.

Ericson, D. M. et al. 1990. Analysis of Core Damage Frequency: InternalEvents Methodology. NUREG/CR-4550, Volume 1, Rev. 1, Sandia NationalLaboratories, Albuquerque, New Mexico.

Harper, F. T. et al. 1990. Evaluation of Severe Accident Risks:guantification of Major Input Parameters. NUREG/CR-4550, Volume 2, Rev. 1,Part 2, Sandia National Laboratories, Albuquerque, New Mexico.

Heaberlin, S. W. et al. 1983. Handbook for Performing Value-ImpactAssessment. NUREG/CR-3568, Pacific Northwest Laboratory, Richland,Washington.

Kolaczkowski, A. M. et al. 1989a. Analysis of Core Damage Frequency: PeachBottom, Unit 2 Internal Events. NUREG/CR-4550, Volume 4, Rev. 1, Part 1,Sandia National Laboratories, Albuquerque, New Mexico.

Kolaczkowski, A. M. et al. 1989b. Analysis of Core Damage Frequency: PeachBottom, Unit 2 Internal Events Appendices. NUREG/CR-4550, Volume 4, Rev. 1,Part 2, Sandia National Laboratories, Albuquerque, New Mexico.

5.1

Lambright, J. A. et al. 1990. Analysis o'f Core Damage Frequency: Peach

Bottom, Unit 2 External Events. NUREG/CR-4550, Volume 4, Rev. 1, Part 3,Sandia National Laboratories, Albuquerque, New Mexico.

Pennsylvania Power and Light Company (PP&L). 1991. Susquehanna .Steam

Electric Station - Individual Plant Examination. NPE-91-001, Pennsylv'aniaPower and Light Company, Berwick, Pennsylvania.

Pennsylvania Power and Light Company. 1993.System. In Susquehanna Operating Procedure,Pennsylvania Power & Light Company, Berwick,

Pennsylvania Power and Light Compan'y. 1993.TSY-001, Rev. 0. Pennsylvania Power & Light

Fuel Pool Cooling and CleanupOP-135-001, Rev. 16.Pennsylvania.

Susquehanna Mini-PRA. SA-Company, Berwick, Pennsylvania.

Pennsylvania Power and Light Company (PP&L). 1993. Susquehanna SteamElectric Station - Final Safety Analysis Report. Pennsylvania Power and LightCompany, Berwick, Pennsylvania.

Pennsylvania Power and Light Company. 1993. Susquehanna Steam ElectricStation Individual Plant Evaluation. NPE-91-001, Pennsylvania Power & LightCompany, Berwick, Pennsylvania.

Pennsylvania Power and Light Company. 1993. RHR Operation in Fuel PoolCooling Mode. In Susquehanna Operating Procedure, OP-149(249)-003, Rev. 11.Pennsylvania Power & Light Company, Berwick, Pennsylvania.

Pennsylvania Power and Light Company (PP&L). 1993a. Susquehanna SteamElectric Station - Evaluation of Impact on Equipment Due to Higher RoomTemperature Due to Loss of Spent Fuel Pool Cooling With LOCA and LOOP. SEA-EE-550, Pennsylvania Power and Light Company, Berwick, Pennsylvania.

Pennsylvania Power and Light Company (PP&L). 1993d. Loss of Fuel PoolCooling/Coolant Inventory - Susquehanna Off-Normal Operating Procedure. ON-135(235)-001, Rev. 13, Pennsylvania Power and Light Company, Berwick,Pennsylvania.

Pennsylvania Power and Light Company (PP&L). 1993e. Technical SupportCoordinator: Emergency Plan-Position Specific Procedure. EP-PS-102, Rev. 7,Pennsylvania Power and Light Company, Berwick, Pennsylvania.

Portland General Electric. 1992. Individual Plant Examination Report for theTrojan Nuclear Power Plant in Response to Generic Letter 88-20. PortlandGeneral Electric Company, Portland, Oregon.

Russel, K. D. et al. 1991. Integrated Reliability and Risk Analysis System(IRRAS). Idaho National Laboratory, Idaho Falls, Idaho.

Sailor, V. L. et al. 1987. Severe Accidents in Spent Fuel Pools In Supportof Generic Safety Issue 82. NUREG/CR-4982. Brookhaven National LaboratoryUpton, New York.

ora ory,

5.2

Sattison, H. B. et al. 1990. Analysis of Core Damage Frequency: Zion,Unit I Internal Events. NUREG/CR-4550, Volume 7, Rev. 1, Idaho NationalEngineering Laboratory, Idaho Falls, Idaho.

Sobel, P. 1993. Revised Livermore Seismic Hazard Estimates for 69 NuclearPower Sites East of the Rocky Hountains. NUREG/CR-1488, Nuclear RegulatoryCommission, Washington, D.C.

Swain, A. D. 1987. Accident Sequence Evaluation ProgramNHuman ReliabilityAnalysis Procedures Guide. NUREG/CR-4772, Nuclear Regulatory Commission,Washington, D.C.

.U.S. Nuclear Regulatory Commission (NRC). 1985. Probabilistic SafetyAnalysis Procedures Guide. NUREG/CR-2815, Rev. 1, U.S. Nuclear RegulatoryCommission, Washington, D.C.

U.S. Nuclear Regulatory Commission (NRC). 1988. Individual PlantExamination: Submittal Guidance. NUREG-1335, U.S. Nuclear RegulatoryCommission, Washington, D.C.

U.S. Nuclear Regulatory Commission (NRC). 1989. Severe Accident Risks: AnAssessment for Five U.S. Nuclear Power Plants. NUREG-1150, U.S. NuclearRegulatory Commission, Washington, D.C.

Virginia Electric and Power Company. 1991. Probabilistic Risk Assessment forthe Individual Plant Examination Final Report, Surry Units 1 and 2. VirginiaElectric and Power Company, Richmond, Virginia.

Wheeler, T. A. et al. 1989. Analysis of Core Damage Frequency from InternalEvents: Expert Judgment Elicitation. NUREG/CR-4550, Volume 2, SandiaNational Laboratories, Albuquerque, New Hexico.

Washington Public Power Supply System. 1992. Individual Plant ExaminationWashington Nuclear Plant 2. Washington Public Power Supply System

5.3

APPENDIX A

CASE DETEfNINATION

Appendix ACase Determination

This evaluation covers all operating modes for the Units. At different timesduring operating and shutdown conditions distinct initial conditions andsuccess criteria exist. Separate evaluations (referred to as Cases) ofrepresentative conditions were performed to ensure adequate coverage of theseseparate conditions and criter'ia. Selection of'the Cases was based on thedifferent decay heat levels present in the Spent Fuel Pools (SFP), on theavailable capacity to remove this heat via the Spent Fuel Pool Cooling System(SFPC), availability of RHR, and the plant operating condition.

.Appendix ACase Determination

1.0 OVERVIEW

Selection of the Cases was based on the different decay heat levelspresent in the Spent Fuel Pools (SFP), on the available capacity toremove this heat via the Spent Fuel Pool Cooling System (SFPC),availability of RHR, and the plant operating condition. The Casesstudied are:

Table A.I Analysis Cases for As-Found Condition

Plant ConditionDuration (normalized to 1 year)(hrs)f Pumps initially running (SFP«115 F

t P s Re uired (SFP <200 F)

SFPC AvailabilitRHR Availability (f Loops)

Time-to-Doll (hrs)

Unit 2

All Cases

0 eratin8768

Yes

»50

Case 1

0 eratin6368

Yes

~50

Case 2

Shutdown

800

Yes

0-8 Days1-17 Da s

i50

Unit 1

Case 3

Shutdown

960

No

i25

Case 4

Sh'utdown

320

Yes

i25

Case 5

Shutdown

320

Yes

15 - 25

2.0 SUCCESS CRITERIA

Success for this evaluation is based on maintaining the pools below anexcessive steaming condition, not on maintaining the SFPs below theadministrative and technical specification limits of 115'F and 125'F.It is assumed that if the pool is not transferring heat to theatmosphere through boiling mechanisms, then an excessive amount of .heatwill not be transferred. Radiative and evaporative losses off thesurface of the pool are expected to be relatively small.. TheSusquehanna SFP mini-PRA (SA-TSY-001) assumed an excessive steamingcondition existed when SFP temperature reached 200'F. When the poolsare not cross-connected via the Cask Storage Pit (CSP) this is anadequate assumption. However,, for cross-connected conditions, allcooling could come from either pool. In this latter condition, it isassumed that maintaining the pool being actively cooled below 170'F isadequate to ensure the second pool does not experience excessivesteaming.

A.2

3.0 SFPC HEAT EXCHANGERS

3.1 SFPC Heat Exchan er Desi n

Appendix'Case Determination

From FSAR Table 9. 1-1 the fuel pool heat exchangers are designedto remove 4.4 HBTU/hr at 125'F shell side temperature (SFP side)and 95'F tube side temperature (SWS.side). Specifically:

Tp 125'F

Tp 110'F

Ts 104'F0

Ts 95'F1

msf 296000 lb/hr

m „ 496000 lb/hr

presign 4.4 HBTU/hr

Design temperature of the SFP outlet (heatexchanger inlet)Design temperature of the SFP inlet (heatexchanger outlet)Design temperature of the SWS outlet (heatexchanger outlet)Design temperature of the SWS inlet (heatexchanger inlet)Design mass flow rate for the SFP side ofthe heat exchangerDesign mass flow rate for the SWS side ofthe heat exchangerDesign heat load on the heat exchangerunder the above conditions

Using the following standard counterflow heat exchangerrelationships:

(Tp,-Ts) -(Tp,-Ts,)(Tp,-Ts)(Tp, —Ts,)

(A.1)

Qh, = UAFxhT~

and substituting in the above values gives:

UAF ~ 2.47x10 BTU/hr'F

(A.2)

This UAF is similar to the UAF implied by the predicted values inPPEL calculation H-FPC-013. Predicted heat duties using this UAFwere verified to give slightly more conservative values (3% - 5%)than those presented in the table on page 14 of 84 of H-FPC-013.

A.3


3.2 Predicted SFPC Heat Exchan er Perfonnance

Using a constant UAF, the equations and values from above, and thefollowing additional relationships:

Q~ 'l~Gp (TpO —Tpl) (A.3)

Q~ = m~cp(TSO-TS (A.4)

allows the heat transfer across the SFP heat exchangers given theSMS inlet temperature and SFP temperature (SFP Outlet Temperature)to be predicted (See Figure A. 1).

300E~

2.00EM

g 1.50E~E

1 00E~

——35

oe a5

—.-55

—-.75—85

----95SWS Inlet Temperature

5.00EK6

R I 8 ~ 8 I 8 5 8 I 8 g5FP Outlet Temperature (F)

Figure A.l Susquehanna Heat Exchanger Performance

The Figure A.l results are for a single pump/heat exchanger.Multiple pump/heat exchangers will be assumed to remove multiplesof the single pump/heat exchanger values. This assumption isbased on Susquehanna procedure OP-135-001 that directs the flowrates for multiple pumps be adjusted to be multiples of 600 gpm(i.e., 1 pump/heat exchanger, m f - 600 gpm; 2 pump/heat

A.4


exchanger, m f 1200 gpm; and 3 pump/heat exchanger, m f 1800

gpm).

3.3 SFPC 0 erational Restraints

a 0

b.

Conversations with PPtIL indicate that they will not offloadfuel into the pool until two requirements can be met:

1. Time-to-boil is more than 25 hours, and2. Total heat load. is within the capacity of the

available pump/heat exchangers.

PP8L has indicated that in the past, the first requirement,while in the FSAR, was not necessarily proceduralized andconditions may have existed early in some outages wheretime-to-boil times could have been as low as 15 hours.Conditions never existed where time-to-boil was less than 25hours for greater than 10 days.

3.4 SFP Confi urations:

The following pool configurations (activities) and associatedmasses of water are assumed to exist during an outage:

Table A.II SSES SFP ActivitiesActivit Descri tion

Ul. Mell, Drypit 8

CattleshuteAll Connected

Ul. U2 8 CSP

Sin le Isolated Pool

7,084,213

10.697.928

6.622.057

3.008.341

4.0 DECAY HEAT

The SFPC system is designed to maintain the fuel pool water temperaturebelow 125'F at a maximum Normal Heat Load (HNHL). The NNHL is based uponfilling the pool with 2840 fuel assemblies from normal refuelingdischarges and 184 fuel assemblies are offloaded from the active corewithin 160 hours after shutdown (FSAR Table 9. 1-2b). In the FSAR, fullcore offloads are considered Emergency Heat Load (EHL) conditions whichgenerally credits the RHR system for fuel pool cooling. Generally theRHR system is assumed to be available for fuel pool cooling under EHLconditions. The RHR cooling system using one pump and one heatexchanger can maintain the fuel pool water temperature at or below 125'Fwith or without assistance from the SFPC system. EHL is defined as afuel core offload 250 hours after shutdown following a typical fuel

A.5


cycle discharge schedule. The model was built on review of previousoutages that indicate full core offloads are normally conducted withdecay heat loads in excess of the NNHL, but less than the EHL

(requirement for total heat load is within the capacity of the'SFPCSystem (See 3.3.a.2)). These conditions have been acceptable because oflower than design basis SWS inlet temperatures and correspondingincreased SFPC system capacity. This evaluation is based on informationfrom the recent Spring 1994 outage (SSES U26RIO) with some modificationsto provide generic coverage of other previous outages. SSES U26RIOinformation as provided by PP8L:

Table A. III SSES Outage U26RIO InformationOays

15

15

16

16

19

20

21

22

22

32

36

36

38

38

52

55

55

63

Acthv1ty

3008341

3008341

7084213

7084213

10697928

10697928

10697928

10697928

10697928

6622057

6622057

6622057

10697928

10697928

7084213

7084213

7084213

3008341

3008341

HBTU/hr

2.91

2.91

25.12

24.46

27.37

25.68

25.19

24.73

24.31

24.31

21.04

20.08

20.08

19.65

16.73

14.43

14.05

5.10

4.88

T to 8fhr)

98.21

98.21

26. 79

27. 51

37.13

39.58

40.35

41.10

41.81

25.88

29.90

31.33

50.61

51.72

40.23

46.64

47.90

56.04

58.56

Note that the heat load of 25. 12 NBTU/hr present on day 15 is beyond thecapacity of the SFPC System when it is operating at 'its design based SWSInlet and SFP temperatures. However, it can be handled by 3 SFPCpump/heat exchangers if SFP temperatures are maintained at theadministrative limit of 115'F, and SWS Inlet Temperature is at or below55'F. An SWS Inlet temperature this low is a reasonable expectationconsidering the early spring time-frame of the outage. Under these SWSand SFP temperatures, 2 SFPC pump/heat exchangers can carry the expected'load in the shutdown Unit's SFP by day 35.

A.6


For the purposes of this evaluation a slightly lower initial heat loadand higher SWS Inlet Temperature will be assumed. This is done toaccount for the SFPC operational restraint noted in Section 3.3.b, wherethe time-to-boil could be as low as 15 hours. In the past when only 15 .

hours existed before onset of boiling, it is unlikely this occurredduring Activity 1, as 15 hours implies a heat load of 44.9 NBTU/hr.Even at an SWS Inlet temperature of 35'F, the total heat load that couldhave been removed would be 35.4 MBTU/hr, which correlates to 19 hours toboiling. The most likely scenario is an offload in Activity 1 followedby entry into Activity 4. Activity 4 with a time-to-boil of. 15 hoursimplies a heat load of 19.1 HBTU/hr. Using the general shape of theSSES U26RIO Outage decay curves, assuming that the short time-to-boilcondition exist for 10 days, and that 2 SFPC pump/heat exchangers canremove the heat load by day 35, results in there being a 19. 1 NBTU/hrheat load on day 25, a 23.5 NBTU/hr heat load on day 15 and an SWS InletTemperature of about 65'F.

Higher and lower initial heat loads are bounded by this evaluation aslong as the requirements outlined in Section 3.3 are met. Initial heatload is matched to a maximum corresponding SWS Inlet temperature tomaintain less than 115'F in the SFP, which results in similar times totransitions between required pump/heat exchangers.

'5.0 PLANT OPERATING CONDITIONS

Day 0

Day 8

Day 15

Day 25Day 35

Day 65

Day 75

Plant Shutdown, RHR in Shutdown cooling, SFP being cooled by1 pump/heat exchanger combination.One loop of RHR unavailable for maintenance. Other trainstill providing Shutdown cooling.Fuel offload complete. Three pump/heat exchangers requiredto cool SFP. Both loops of RHR available.SFP isolated from reactor cavity and other SFP (Activity 4).Activity 4 exited (by cross-connecting with other SFP), Heatload has decay to the point that 2 pumps/heat exchangers canhandle load. SFPC taken out-of-service for maintenance.Cooling of SFP is dependent on pumps from other SFP viacross-connect.SFPC restored to service . Fuel reload completed. Onepump/heat exchanger can car ry the heat load.Unit restored to power.

1SFPC is normally returned to service in as little as 10 days. Hodeling the SFPC out-of-service on

Unit I and the SFPC cross-tied is slightly more conservative than modeling the Unit 1 SFPC inservice withthe pools not-cross-connected. It was decided to model this period using the former more conservativecondition because no apparent adninistrative controls were noted that limit the time the SFPC s stem is out-of-service. and the conservatism is small.

m e me P system is out-

A.7


6. 0 EVALUATION CASE DETERMINATION

Figure A.2 presents a timeline of the Cases to be discussed below thatoccur during an outage. Case 1 covers all non-outage conditions.

SFP = 200 1 SFPC Pump 2 SFPC 1 SFPC Pumps 1 SFPC Pump

SFPR115F25.N

1 SFPC Pump 3 SFPC 2 SFPC Pumps 1 SFPC Pump100.N

Uel 1 (MBTUih0Tsu8

>~ 15.N

S

u 10.NQO

75 0)70.N

65.N

60.N o

55.NE50.N

45.N

5.00

0.000 5 10 1 20 25 30 40 45 50 55 60

Outage (0~

15.N70 75

Figure A.2 Modeled SSES As-Found Outage Sequence/Conditions

6.1 Unit 2 Modelin

a ~ All Cases

Because Unit 2 is always assumed to be operating, the numberof pumps initially running and the number required to avoid200'F in the isolated pool will be modeled the same in allCases.

f Pumps initially running in Unit 2 m 1. The normal steadystate decay heat load is removable even at the design SWSInlet Temperature of 95'F. However, higher decay heat valueswould be expected just after exiting an outage that wouldrequire more than 1 pump/heat exchanger at the designtemperature. This design basis need for 2 pumps/heatexcha'ngers will not be modeled as actual SWS Inlet

A.8


temperatures have been low enough to allow 1 pump/heatexchanger to remove the load. SWS Inlet Temperatures havealways been low enough at the beginning of the outage toallow 3 pumps/heat exchangers to remove the full heat load.It is expected SWS temperatures would have similar values atthe end of the outage, thus allowing removal of the slightlyraised decay heat in the pool at plant startup using a

single pump/heat exchanger.

0 Pumps required to avoid 200 F in Unit 2 ~ 1. A singlepump/heat exchanger can remove the required heat load at200'F even assuming an immediate startup after fuel reloadin the last outage and using the design SWS InletTemperature.

RHR Availability. Since Unit 2 is assumed to be operating,its RHR is assumed to be in an ECCS lineup.

Duration. Eighteen months (one Unit is always operating-the model assumes it is Unit 2). Normalized to 1 year »8768 hours.

Time-to-Boil. >50 hours. Assuming the 5.1 MBTU/hr and theminimum pool configuration (isolated pool) results in atime-to-boil of 56 hours.

6.2 Unit 1 Hodelin

Unit 1 can be in either an operating or outage condition. Toallow for the different pool and pool cooling supportconfigurations five different Cases will be examined which boundexpected conditions. A sequential discussions of these Casesfollows. Note that the discussion order does not follow thenumbered order of the Cases.

Case 1 - Unit 1 Operating, 1 pump/heat exchanger required.

This Case is identical to the normal modeling for Unit 2,with the exception of duration.

Entry/Exit: Entry and exit to/from this Case is via Case 2

Duration: Exit from this condition occurs when the unit isshutdown. All outages are modeled to occur on Unit l. Unit1's operating time is then 18 months minus two 75 dayoutages. Normalized to 1 year 6368 hours.


Case 2 - Unit 1 Shutdown, 1 pump/heat exchanger required.I

Entry/Exit: Entry to Case 2 occurs two ways: 1) as an exitfrom Case 3, and 2) after Unit shutdown as an exit from Casel. Exit is to Case 1 or Case 4.

0 Pumps initially running in Unit 1 I. When initiallyshutdown with the core in the reactor vessel, expected decayheat loads are bounded by the Case 1 analysis and easilyremoved with 1 pump/heat exchanger regardless of SWS InletTemperature (within design parameters). For the condition

.when entry is from Case 3, decay heat may be above thatremovable with 1 pump/heat exchanger at the SWS InletTemperature design value (95'F). However, it is expectedthat SWS Inlet Temperature will be similar to that whichallowed offloading. If the decay heat can be removed with 3pump/heat exchangers at SFP Temperature 115'F, then it isexpected the remaining decay heat after refueling can beremoved by 1 pump/heat exchanger.

0 Pumps required to avoid 200'F in Unit 1 l. A single'ump/heat exchanger can remove the required heat load at

200'F, even assuming a full pool with a third of the corerecently offloaded and the design SWS Inlet Temperature.

I

RHR Availability: Since fuel is assumed to be in thereactor vessel, one loop of Unit 1's RHR is assumed to be inS/D cooling. Maintenance outages of RHR loops is allowedand is modeled as lasting for 8 days during this Case.

Duration: Twenty-five days. Exit from this conditionoccurs when fuel is offloaded (day 15) to the SFP or whenthe Unit is restarted. Case exists from day 0 to day 15,and from day 65 to 75. Normalized to 1 year and doubled fortwo outages 800 hours.

Time-to-Boil: >50 hours.

Case 4 - 3 pumps/heat exchangers required, Unit 1 S/D-Normal time-to-boil.

Entry/Exit: Entry to Case 4 is from Case 2 when the fuel isoffloaded to the SFP. Exit is to Case 5, when the Unit 1SFP is isolated, resulting in a time-to-boil less than 25hours.

8 Pumps initially running in Unit 1 ~ 3. Per therequirement expressed in Section 3.3.a.2, fuel is notoffloaded until the decay heat is within the capacity of the

I

A.10


SFPC System. It is expected offload occurs when thiscondition is reached.

0 Pumps required to avoid 200'F in Unit 1 2. For allexamined SWS Inlet Temperatures, if the decay heat can beremoved with 3 pumps/heat exchangers at SFP Temperature-115'F, then it can also be removed by 2 pumps/heatexchangers at an SFP temperature of 200'F.

RHR Availability. Since no fuel is assumed to be in thereactor vessel, both loops of Unit 1's RHR are assumed notto be in S/D cooling.

Duration. Ten days. Assuming the decay heat and SWS inlettemperature are such to just allow offload at the beginningof this condition, it is expected the decay heat decreasesto within the capacity of 2 pumps/heat exchangers in 20days. However, 10 of these days are spent in Case 5.Normalized to 1 year and doubled for two outages 320hours.

Time-to-Boil. >25 hours.

d. Case 5 - Unit 1 Shutdown, 3 pumps/heat exchangers required,Short time-to-boil.

This was a specifically requested portion of the evaluation.The Case covers conditions where boiling could have occurredin as little as 15 hours. PP&L further stipulated thesesconditions never existed for greater than 10 days.

Entry/Exit: Entry is from Case 4 when Unit 1's SFP isisolated. Exit is to Case 3, when decay heat is removablewith 2 pumps/heat exchangers, and the pool is unisolated.

f Pumps initially running in Unit 1'~ 3. See discussionsabove.

0 Pumps required to avoid 200'F in Unit 1 2. At an SFPtemperature of 200'F, heat load of 19. 1 NBTU/hr, and SWSinlet temperature of 65'F, a single pump/heat exchangercombination can marginally remove the .heat load. To accountfor inaccuracies, 2 pumps/heat exchangers will be modeled asrequired.

RHR Availability. Since no fuel is assumed to be in thereactor vessel, both loops of Unit 1's RHR are assumed notto be in S/D cooling.


Duration. Ten days. PP&L stipulated that this conditionhas never existed for more than 10 days. Case exists fromday 15 to day 25. Normalized to I year and doubled for twooutages 320 hours.

Time-to-Boil. 15-25 hours.

Case 3 - 2 pumps/heat exchangers required, Unit I S/D

Entry/Exit: Entry is from Case 5 when decay heat isremovable with 2 pumps/heat exchangers, and the pool is

'nisolated.Exit is to Case 2 when the fuel is reloadedinto the reactor vessel.

f Pumps initially running in Unit I 0. For this Case, thecooling will have to come from Unit 2, as the SFPC system isassumed to out-of-service for maintenance for the entireduration of the Case. Unit 2 will require 2 pumps to removethe Unit I heat load and I pump to remove its own heat load.This is based on assuming the decay heat and SWS inlettemperature are such to just allow offload at the beginningof this Case 4. It is thus expected the decay heatdecreases to within the capacity of 2 pump/heat exchangersin 20 days.

0 Pumps required to avoid 200'F in Unit I 1. The pumpwill have to come from Unit 2, but only I pump is required.This is based on the fact that for all examined SWS InletTemperatures, if the decay heat can be removed with 2pump/heat exchangers at SFP Temperature ll5'F, then it canalso be removed by I pump/heat exchangers at an SFPtemperature of 200'F.

RHR Availability. Discussion with NRC Staff and SSESpersonnel indicate RHR is often taken out-of-service formaintenance at the beginning of this Case, and is notcompletely restored for around 10 days. For modelingpurposes RHR is modeled as unavailable during all of Case 3.

Duration. Thirty days. Exit from this condition occurswhen fuel is reloaded. It is unlikely that an outage wouldlast long enough for decay heat to be removable with 1

pump/heat exchanger. Indications from PP&L are that thisusually occurs around day 55 (duration 20 days} of anoutage. As there are no controls requiring this, and thisCase is more limiting than'the next Case, the expectedduration of 20 days is extended to 30. Case exists from day35 to day 65. Normalized to I year and doubled for twooutages » 960 hours.


Time-to-Boil. >25 hours. Figure A.2 shows the time-to-boilto always be >50 hours. However, the more limitingcondition of time-to-boil being >25 hours was chosen toreflect conditions were the cross-connection is notmaintained and/or early entry occurs into Case 3 (withresulting higher decay heat levels). This latter condition',can occur if the operating unit's SFP decay heat is lowenough to allow the total heat load to be removed using theoperating unit's SFPC System before the shutdown unit's SFPheat load has lowered to within the capacity of twopump/heat exchangers.

6.3 Cross-Connected Pum Re uirements

For both the number of pumps initially running and the numberrequired to prevent excessive boiling, the assumed value will bethe sum of the Unit I and Unit 2 values discussed above. Theinitially,running should be fairly accurate as it is expected thateven in a cross-connected condition the operators will maintaincooling to both units. In the case of the number required toprevent excessive boiling this gives very conservative values,even when a lower maximum SFP Temperature (170'F) is implemented.Generally, one fewer pump than that predicted by the above methodis all that is required. However, this conservatism allows forsimpler modeling, and allows for the uncertainties in how wellcooling one pool will affect the other cross-connected pool.

A.13

~ ~

I I '~ I I ~

~ I I ~

I

I I ~

~ ~ ~ I

I I ~

~ I I ~ ~ ~

I . ~ ~ ~

~ '

~ ~

RHR55%IK%5~ I ~ ~ . e

NHRWE55EHMKR&KPEHREEEH%ÃPEER

II ' I

~%~%%~RARA

.I ~

I ~ ~ ~

I ~

~ I I''I

I ~

~ I

II I ~

I ~ ~

~ I

I ~ ~

I I ~~ ~ ~

APPENDIX B

FAULT TREES(Hardware Failure Rates, Fault Tree Basic Events,

Common Cause, Simplified PS IOs)

Appendix B

Fault Trees

This appendix contains the information describing the methods used to generatethe hardware failure rates used in the evaluation. Information is provided,concerning basic events selection and common cause evaluation. This appendixalso includes the graphical representation of the modeled system upon whichthe fault tree are based.

a) Hardware failure rates. A table which list the predicted hardwarefailure rates is provided. These values were obtained fromanalysis of, the fault trees using the basic and common causeevents discussed elsewhere in the appendix.

b) Component Failure Data. A table which list the component type andfailure mechanism, values from a variety of sources, the selectedvalue used in this evaluation, and the justification for using theselected value.

c) Basic Event Selection. A table is provided to explain how theComponent Failure Data was incorporated into the Basic Events usedin Fault Trees for this evaluation.

d)

e)

Common Cause. A short document is provided that gives descriptionof the methods used to generate the common cause failureprobabilities, as well as tables summarizing the data input,.selected sources, and final values.

Hodeled Systems. The indicated systems were modeled as faulttrees using the IRRAS PRA computer code.

Hardware Failure Rate Appendix BFault Trees

Table B.I, SSES As-Found Harware'Failure RatesInitratrng Event isolated

U1 SFPCRestart

Re cove

isolatedU2 SFPCRestart

Recove

mbinedSFPC

RestartRe cove

IsolatedU1 RHRSystem

IsolatedU2 RHRSystem

mbinedRHR

System

oss tie

Lass ot SFPC

LOOP

Extended Loop

SBO

N A

3.96E44 3.S6E443.96E44 3.96E44

4.33E44 3.96E444.33E44 3.96E443.96E44 3.96E443.96E44 3.96E44

NA4.33E44 3.96E444.33E44 3.96E443.96E44 3.96E443.96E44 3.96E44

4.33E44 3.96E444.33E44 3.96E44

3.41E44 843 E433.40E44 3ME41

2.04E44 8.53E432.04E44 8.53E438.99E48 9.34E438.99E48 2.5?E414.33E44 N A5.64E46 8.53E435.64E46 8.53E438.99E48 9.34 438.99E48 3.26E4'l4.33E44 N A5.64E46 8$3E435.64E46 8.53E438.99E48 9.34E438.99E48 3.26E414.33E44 N A5.64E46 8.53E435.64E48 8.53E43

NANA

N A

9.34E439.34E439.34E439.34E43

NA9.34E439.34E439.34E439.34E43

N A9.34E439.34E43

7.97E45 9.82E423.05E43 9.82E428.53E43 N A7 9?E45 9.82E427.97E45 9.82E428.73E45 S.B2E42305E43 982E428.53E43 O.OOE+007.9?E45 9.82E427.97E45 9.82E428.?3E45 9.82E423 05E43 9 82E428.53E43 N A7.9?E45 9.82E427.97E45 9.82E428.73E45 9.82E423.05E43 9.82E428.53E43 O.OOE+007.9?E45 9.82E427.97E45 9.82E42

LOCA 3.96E44 N A 8.99E48 NA 9.34E43 9.82E42

Flood

Loss of WS

Pipe Break

3.96E44 N A

NA N A4.33E44 N A4.33E44 N A

4.33E44 N A4ME44 N A3.96E44 N A3.96E44 N A

NA4.33 44 N A4.33E44 N A3.96E44 N A3.96E44 N A

NA4.33E44 N A4.33E44 N A3.96E443.96E44 N A

8.99E48 N A4.33E44 N A

NA5.64E46 N A8.99E48 8.53E438.99E48 3.26E414.33E44 N A5.64E46 8.53E435.64E46 8.53E438.99E48 8.53E438.99E48 326 E414.33E44 N A5.64E46 8.53E435.64E46 8.53E438.99E48 8.53E43B.S9E48 3.26E414.33E44 N A5.64E46 8.53E435.64E46 8.53E43

NANA

N ANANA

N AN ANANA

N AN AN A

NA

9.34E43 9.82E42N A

9.34E43 9.82E429.34E43 9.82E427.9?E45 9.82E423.05E43 9.82E428.53E43 N A7.9?E45 9.82E427.97E45 9.82E427.9?E45 9.82E423.05E43 g.82E428.53E437.97E45 9.82E427,9?E45 '.82E427.97E45 9.82f423.05E43 9.82E428.53E43 N A7.97E45 9.82E427.g7E45 9.82E42

Seismic N AN A

N A N A 9.34E43N A 3.26E41

9.34E439,34E43

NAN A N A

N A N A 8.53E43 N AN A N A N A 8.53E43 N A N A

N A N A 8.53E43 9.34E43 NAL w/L P 3.96E44 3.96E44

3.96E44 3.96E44N A

4.33E44 3.96E444.33E44 3.96E44

8.99E48 N A8.99E48 N A4.33E44 N A5.64E46 N A5.64E46 N A

9.34E439.34E43

N A9.34E439.34E43

9.43E43 9.82E429.43E43 9.82E42

N A9.43E43 9.82E429.43E43 9.82E42

B.2

Hardware Failure Rate Appendix B

Fault Trees

Table B.II, SSES As-Fixed Hardwar e Failure RatesInitiating ent

Loss ot F

IAbinedSFPG

RestartRe cove

IAblnedRHR

System

7.97 453.05 43

ended Loop

T.QT ~8.99 ~ '.73 ~8.99 ~ 3.05 ~4.33 ~ 9.34 ~5.64 ~ 7.97 ~8.99 48 8.73 458.99 ~ 3.05 ~5.64 46 747 45836 ~ 8.73 ~8.99 ~ 3.05 ~4.33 44 9.34 ~5.64 46 7.978.99 4B 9.34

4'.05

ood5.64 46 7.97 ~8.99 ~ 7.97 ~8.99 ~ 3.05 ~

pe e

ISlA C

3

5.64 46 7.97 ~8.99 ~ 7.978.99 ~ 3.05 434.33 ~ 9.34 ~5.64 ~ 7;97 ~8.99 M 7.97 458.99 48 3.05 ~4.33 ~ 9.34 ~5.64 M 7.97 ~

8.73 45

L w/L

9.34 ~8.73 ~

8.99 ~ 9.43 438.99 48 3.05 ~4.33 ~5.64 46 7.97 ~

B.3

Component Failure Data Appendix B

Fault Trees

Basic Event

Fn )

Source¹3

(Ref)¹4

(Raf)¹5

(Rel)

Soutce¹6

(Rel)

RangePoint

(Estimate)

Valve-Manual

Rugged or fouled

Valve. Manual

Leak or rupture

Valve-Manual

Unavailable dueto maintenance

Fre.

Fre.

Fre.

1E-7/h

NUREG/CR.4550 (Ref. 1)

NUCLARR(Ref. 2)

8EA/d

NUAEG/GR.4550 (Ref. 1)

3E-9/h

NUClARR(Ref. 2)

1E-7/h

ShorehamPRA (Ref. 9)

6E4/h

ORNLReliabilityData (Ref. 6)

6E4/h

OANLReliabilityData (Ref. 6)

3E-9/h -1E-

7/h

1E-7/h

6E4/h-1.1E-7/h

8EP/d

8EQ/d

Used the mostconservative valuefrom the NRGsources (NUAEG/CR-4550).

Used the availableNRG value.(NUClARA)

Used the availableNRC value.(NUREG/CM550)

Failure to doseon demand

Fre.SEA/d

NUCLARR(Ref. 2)

1&I/d

ShorehamPAA (Raf. 9)

6.32E-5/d

IEEE 500(Aaf. 7)

1'/d

Calvatt CliffslREP (Ref. 5)

6EQ/d


fEQ/d

SusquehannaIPE PRA(Ref. 8)

6.32E-5/d-6EQ/d

5EP/d

Used the availableNRG value.(NUCLARA)

B.4

Component Failure Oata Appendix BFault Trees

Source¹1

(Rei)

Source¹2

(Rel)¹3

(Ref)¹4

(Rel)¹8

(Ret)

Range

(Estkn ate)

Valve.Manual

Failure to remaindosed

Valve-Manual

Failure to open .

on demand

Valve.Manual

Failure to remainopen

Valve-Check

Rugged or fouled

Fre.

Fre.

Fre.

Fre.

1&I/d

NUREG/CR-4550 (Ref. 1)

1'/d

NUREG/CR.4550 (Ref. 1)

1.25'/d


SKI/h

NUCLARR(Ref. 2)

IEEE SQQ

(Rel. 7)

5&l/d

NUClARR(Ref. 2)

3.4'/h

Oconee PRANSAC/60(Ref. 10)

6E4I/h


1'/d


IEEE SQQ

(Aef. 7)

6,32E-S/d

IEEE 500(Aef. 7)

6&I/h

OANL

ReliabilityData (Ref. 6)

1E-4/d

Calvert GiftsIAEP (Ref. 5)

3.7'/h

ALWRReliabilityData (Ref. 3)

6'/d

OANLReliabilityData (Ref. 6)

2.3E4I/O-2.3E-T/hor IEP/d

2.3'/h

6.32E-5/d-6'/d

1'/d

2.3E4/h-2.3E-7/hor 1.25'/d

3.4E4I/h

5E-9/h

SENTI/h

No applicable NRCValue. Used the IEEE500 value.

Used the value fromthe preferred NRCsource. (NUREG/CR-4550).

No ap'pgcable NRCValue; used OconeePRA.

Used the availableNRC value(NUCLARR).

Valve-Check

Leak or ruptureFre.

1E-7/h


3.5E4/h

NUClAAR(Ref. 2)

1.07E4I/h


5E-7/h

Calvert QiflsIREP (Ref. 5)

6E-T/h


1E-7/h 3.5E-6/h

1E-7/h

Used the value fromthe preferred NRCsource (NUREG/CR-4550).

B.5


Fault Trees

Basic Event(7n )

Source

(Rel)

Source¹2

(Ref)¹4

'Ref)¹8

(Ref)

Range

(Essm ate)

Valve-Check

Failure to doseon demand

Valve-Check

Failure to remaindosed

Valve.Check

Failure to openon demand

Valve.Check

Failure to remainopen

Pump-Motor

Leak or rupture

Fre.

Ref.

Fre.

Fre.

Fre.

Fre.

2E4/h

PSAProcedureguide (Ref. 4)

1E-7/h


2E.7/h


23E-7/h


3'/d

NUCLARR(Ref. 2)

1 '/d

NUREG/CR.45SO(Ref. I)

3.5E4/h

NUCIARR(Ref, 2)

1E</d


IEEE 500(Ref. 7)

IEO/d

NUCLARR(Ref. 2)

1.6E41/h


SE-5/d

NUCIARR(Ref. 2)

2E-7/h


IE4/d


IEEE Soo(Ref. 7)

1.1EQ/d


9.6E-5/d

IEEE 500(Ref. 7)

9.8E-5/d

IEEE 500(Ref. 7)

2ER/d


2&I/d


9/6E-5/d-2'/dor 2E4/h

1 '/d

1E-7/h-3SE4/h

1E-7/h

SE-5/d - 2E-4/dor 2E-7/h

1.1'/d

2E-7/h - 2.08-6/h

23E-7/h

3E6/h

Used the value fromthe preferred NRCsource (NUREG/CR-4550). In addition theNUREG/CR4550 andNUCIARR valueswere the same.

Used the value fromthe preferred NRCsource (NUREG/CR-2815).

Used theconsenrative valuefrom SusquehannaIPE PRA.

No applicable NRCvalue. Used the valuefrom the OconeePRA.

Used the availableNRC value(NUClARR).

B.6

~ ~ ~

~ ~

~ ~ ~

~ ~

~ ~ ~ .

~ ~ ~

~ l~ ~ '

~ ~ ~ ~ ~ ~

~, ~

~ '

~ ~

~ l ~-


Fault Trees

Basic Event(Type) ¹1

(Ret)¹2

(Rel)

Source¹4

(Ret)¹5

(Rei)

Range(Estimate)

Heat Exchanger(Shell)

Unavailable dueto malnlenance

Fre.3E</h


3E-5/h

3'/h

Used the availableNRC Value(NUREG/CR4550).

Heat Exchanger(Tube)

Rugged or fouled


Leak or rupture


Unavailable dueto maintenance

Fre.

Fre.

Fre.

5.7'/h


3E.9/h



3E-?/h

NUClARR(Ref. 2)

3E4/h


3.39'/h

IEEE 500(Ref. 7)

1 '/h

NUClARR(Ref. 2)


5.7E41/h

ShoreharnPRA (Ref. 9)

3.39'/h

IEEE 500(Ref. 7)

1E4I/h


3E-7/h-5.7'/h

5.7E4I/h

3E-9/h-5.7E4I/h

3E-5/h

3E4/h

Used the availableNRC value(NUREG/CR4550).

Used the mostconservative valuefrom the NRCsources (NUREG/CR-4550).

Used the availableNRC Value(NUREG/CR4550).

Transmlttdr-Pressure

Failure to operate

Fre.3'/h


3E4/h

NUCLARR(Ref. 2)

2.1E4I/h


5E4/h


2E-7/h


2.1 E4I/h-5E41/h

3E4/h

Used the value fromthe preferred NRCsource (NUREG/CR-4550). NOTE:NUCLARR value wasidentical.

B.8


Fault Trees

Source¹1

(Ref)

&xaee¹2

(Ref)

Sxaea¹3

(Ref)¹4

(Rel)¹6

(Ref)

RangePoint

(Esffrnate)

Strainer

Plugged orFouled

Tank

Leak or rupture

Passive SafetyValve

Activates/de-activatesInadvertently

Fre.

Fre.

Fre.

3E-5/h


5E-7/h-

NUCLARR(Ref. 2)

3.75'/h


3E-5/h


1E-7/h


SEA/h

NUCLARR(Ref. 2)

3E-S/h

Calvert CliffIREP (Ref. 5)

2E4/h


2E4/h-3E-5/h

3E-5/h

IE-7/h-5E-7/h

SE-7/h

3.75'/h

3.75E4I/h

Used the mostconservative valuefrom the NRCsources. NOTE: PSAand NUClARR valueswere Identical.

Used the availableNRC Value(NUCLARR).

Used the value fromthe preferred NRCsource (NUREG/CR-4550). NOTE:NUCLARR value wasIdentical.

Room Cooler

Fails to run

Room Cooler

Fails to run

Fre.

Fre.

1'/h


1'/h


1E-5/h

NUCLARR(Ref. 2)

1E-5/h

NU GLAR(Ref. 2)

1.9E-S


1.9E-S


1E-5/h

Calvert CliffIREP (R@f. 5)

1E-5/h

Calvert CliffIREP (RBI. 5)

. 5E6/h



1.9E-5-5E4I/h

1.9E-S-5E4/h

1E-5/h

Used the value fromthe preferred NRCsource (NUREG/CR-4550). NOTE:NUCLARRvalue wasIdentical.

Used the value fromthe preferred NRCsource (NUREG/CR-4550). NOTE:NUCUIRR value wasidentical.

B.9


Fault Trees

Sash Event

Fyp ) ¹1(Rel)

Source¹2

(Rel)

Source¹3

(Rel)¹4

(Re)¹5

(Ref)¹6

(Rel)

RangePoint

(Estimate)

Pipe

Leak or ruptureFre.

1.1E4/h

NUCtARR(Ref. 2)

8.59E-9/h


8.59E-9/h-1.1E-8/h

1.1'/h

Used the availableNRC Value(NUCIARR).

Relay

Short

Relay

Open

Fre.

Fre.

3E4/h


3E4I/h


2.68E.7/h

4.3E-r/h


4.3E4/h

3E4/h

Calvert CliffsIREP (Ref. 5)

3E4/h

5.36B/h-3E4/h

2.68E-7/h-4.3'/h

Used the availableNRC Value (PSA).

Used the availableNRC Value (PSA).

Relay

Failure toactuate/deactlvate on demand

Fre.


IE6/h


Shoreham .

PRA (Ref. 9)

3EA/d

NUCLARR(Ref. 2)


12EQ/d

Calvert CliffsIREP (Ref. 5)

2.4'/d



3'/d

Calvert CliffIREP (Ref. 5)

1'/d

ALVINReliabilityData (Ref. 3)

3E4I/h

1'/d - 3E-

4/dor IE4/h

3&!/d

Used the mostconservative valuefrom the NRCsources (NUCLARR).

B.10


Fault Trees

NOTES: General - The highlighted values Indicate the selected data source to be used.

Some of these references are crossed referenced to each other and to other sources. For example the NUREG/CR4550 (Ref. 1) althe Shoreham PRA (Ref. 9) which In tern references NRC LER Data, WASH-1400, and General Bectrlc BWR Data.

v ues are sometimes obtained from

References do not always provide the same failure rate basta (I.e., hourly versus demand). The relationship used to convert b tw h rl fo conve e een ou y ailure rates and demandure ra es was: D~ (HxT)/2. Generally, lf the value was provided In a format which was not consistent with the parameter of concern (e.g., an hourly rate for a

demand failure), then the value was not considered as an option.in the ALWR (Ref. 3) specific motordrlven pump failures data was given for failure to start and failure to run. The corres ondln I e I thl brrespon ng terna n sta le are represented as

REFERENCES:

1.

2.3.4.5.e.

8.9.10.

Analysis of Core Damage Frequency From Internal Events: (NUREG/CR-1150) Methodology Guldellne, NUREG/CR-4550, Vol. 1, Rev. 1, September 1987.Generic Component Failure Database for Ught Water and Uquld Sodium Reactor PRA's (NUCLARR), EGG-SSRE4875, Februa 1990.Re'liability Database for ALWR PRA's.

e ruary 1990.

Probablflstlc Safety Analysts Procedures Guide, NUREG/CR-2815, August 1985.interim Reliability Eva'luation Program: Analysis of the Calvert Qiffs Unit 1 Nuclear Power Plant, NUREG/CR3511, March 1984.Oak Ridge Nathnal Laboratory In-Rant Rellabiflty Data Systems for Pumps, Valves, and Bectrlcal Power Components, NUREG/CR.2888, NUREG/CR4554. NUREG/CR-

Stations, IEEE Std. 500-1984, December 1983.IEEE Guide to the Collection and Presentation of Electrical, Bectronlc, Sensing Components, and Mechanical Equipment Reliability Data fo N cl P Ga a or u ear ower eneratlng

Susquehanna Steam Electric Station Individual Plant Evaluation, December 1991.Shoreham Nuclear Power Station Probabilistic Risk Assessment, June 1983.Oconee PRIL A Probabllistic Risk Assessment of Oconee Unit 3, EPRI Report NSAC/60, June 1984

Basic Event Values/Information Appendix B

Fault Trees

Com onen1T e

Check Valve

Failure Descri tion

Fails to o en on demandValue

1.00E44 d

Table B.IVBasis Com onent Failure Data unless otherwise noted

Check ValveCrane-Crane (normal)

Crane (Single FafluteProof)Cross-tie Support

Cross-tie Su rtGateHeat ExchangerHeat Exchanger

Heat Exchanger

Manual ValveManual ValveManual Valve

Manual ValveMotor OpesatedPurnMotor OperatedPurn

Operator RecoveryActionPassive Safety Valve

SFP Su rtSFP Su rtSFP Support

SFP Sup ottSFP Sup rtSFP Supporl

SFP Support

Surge TankSur e Tank

FailureFalls to release gateFalls to function

Falls to function

Air System Falls to ShutOff or DeflateLoss of PowerFalls to retnoveFailureLoss of SWS to HX

Unavailable due totest maintenanceFalls to open on demandFalls to remain dosedFalls to remain o enFailure,Falls to remain running

Falls to start

Falls to dktgnose andrestart SFP PumFailureDischarge Level TripFlow Tri FailureUne from U2 to U1 SFPfaflso enLoss of CoolingLoss of PowerMotor Operated PumpUnavailable due totest maintenanceSuction Pressure TtipS tern FailureFailureLevel Tri S stem Failure

3.30E47 h Leakorru ture and failure to remaino en1.00E44 d Mechanical dev/ce ding on demand. Smflar to valve (manual or check).6.00E43 d Motor failures for moving crane and powering wench. Motor failures assumed to occur at same rate as Motor

o crated valves or um s.3.60E45 d Motor failures for moving crane and powerlng wench. Assumes dual motors available for both functions. Motor

failures assumed to occur at same rate as Motor o crated valves or umps.1.00E46 d Screening vaiue based on multiple component supports.

1.00E45 h LOOP combined with a mean value for loss of load centers from the Su uehanna mini.PRA1.00E44 d Modeled as manual valve failure to o n.6.70E46 h

1.00E45 h Loss of SW to heat exchanger and leak or rupture and plugging. This equals about 9E4/h. Rounded up forconservatism.

9.00E45 h 3 times the normal rate of 9E-5/h to reflect modeling technique (only one of three pumps Is considered forOOS due to maintenance)

1.00E44 d2.30E48 h1.14E47 h Combination of lug or foul and fails to temaln o en2.10E47 h Combination of fallute to remain o en, leak or ru ture, and lug or fouled1.00E44 h

3.50E43 d

3.00E42 d Opetator falls to locally/manually recover pump and support systems. Based on a similar recover analysisfrom the Tro an IPE for AFW electric m recove

3.75E46 h Inadvertent Actuation3.00E46 h Transmltler failure3.00E46 h Transmitter failure1.03E47 h Pipe rupture plus valve failures In the line

1.00E45 h Room cooler Inltlall running and falls to remain running.1.00E45 h LOOP combined with a mean value for loss of load centers from the Susquehanna mini.PRA6.00E43 d 3 times the Component Failure Data sate of 2M/d to reflect modeling technique (only one of three pumps h

considered for OOS due to maintenance)

3.00E46 h Event caused by an open or short in the circuit

3.10E45 h Combination of plugged stsalner and tank supture3.00E46 h Transmitter failure

B.12

Common Cause Appendix B

Fault Trees

This portion of Appendix B documents the identification and analysis ofdependent failures to be used in the quantification of the PRA fault trees.Dependent failures are those failures that defeat the redundancy that isemployed to improve the availability of some plant system or function. These

common cause failures will be explicitly depicted in the fault tree models.This PRA does not model all the plant systems, rather it concentrates on thesystems required for Spent Fuel Pool Cooling. Information regarding supportsystems failures will be extracted from the Susquehanna IPE PRA. The adequacyof the modeling of common cause failures in the Susquehanna IPE PRA was notreviewed. Conservatism and/or omissions concerning common cause in theSusquehanna IPE PRA will be reflected in this SFP PRA. The common causefailure probability is calculated from independent failure probabilities and

common cause (beta) factors.

Plant-specific data on multiple failures is rare, so data collection forcommon cause analysis must be done on an industry-wide basis. The EPRI Common

Cause Database (as reflected in the Trojan IPE submittal) and NUREG/CR-4550

were chosen as the sources of beta factors for this PRA.

Previous PRA studies provided a guide for selection of the component types forwhich common cause data would be required. Components modeled in this PRA

which were considered for common cause analysis are:

Motor Driven Pumps~ Check Valves

The following table lists these components, failure mechanism, thecorresponding beta factor (f) factor, and the source.

Table B.V

Component

Check Valve

Check Valve

SFP MotorDriven Pump

SVS MotorDriven Pum

RHR MotorDriven Pum

FailureMechanism

Failure too en

Failure tocloseFailure tostart

Failure tostartFailure tostart

BetaFactor

2.67E-DI

2.67E-01

1.30E-01

7.41E-02

9.86E-02

Source

EPRI Corrrrron Cause Database

EPRI Corrrren Cause Database

NUREG/CR-4550, Volume 1, Table6.2-1 (Average of RHR and CS pumpvalues)EPRI Corrrren Cause Database

EPRI Cannon Cause Database

Common cause failure probabilities were calculated using the Multiple GreekLetter (NGL) method. NGL Parameters are estimated by the relationshipy - (1+x)/2, where y is the parameter to be determined and x is the precedingparameter. For example, given a beta factor, f, y may be determined asfollows:


Fault Trees

~1+

2(B.1)

Remaining parameters were calculated in the same manner. Thus for thecomponents of concern:

C onent

Check Valve

Check Valve

SFP MotorDriven P

SWS MotorDriven P

RHR MotorDriven P

FailureMechanism

Failure to0 en

Failure tocloseFailure tostartFailure tostartFailure tostart

Factor

2.67E-01

2.67E-01

1.30E-01

7.41E-02

9.86E-02

Table B.VI

Y

Factor6

Factor

6.34E-01 8. 17E-01

6.34E-01 8.17E-01

5.49E-01 7.75E-01

5.65E-01 7.83E-01

5.37E" 01 7. 69E-01

e

Factor FactorBase

Probabilit

8.91E-01 9.46E-01 3.50E-03

8.84E-01 9.42E-01 3.50E-03

8.87E-01 9.44E-01 3.50E-03

9.08E-01 9.54E-01 1.00E-04

9.08E-01 9.54E-01 1.00E-03

(B.~)

After the HGL parameters have been determined, the common cause failureprobability may be calculated using the following equations. The equationselected is dependent upon the smaller of the number of events found, or themaximum allowable order of common cause events. If failure combinations oftwo components are developed, the second order failure probability is:

P> — p xPiND

If combinations of three are developed, the equations used, are:

B. 14

Common Cause Appendix 8Fault Trees

P, = Q.5xP x(1-y) xP/Np (B.3)

Pg = P xy xP+p (B.4)

If combinations of four are developed, the equations used are:

P2 — —x P x(1 -y) x PJNp3(B.5)

Pg — —x P xy x('t —5) xPJNp1

3(B. 6)

P4 = p XfX5 XP(Np (B.7)

If combinations of five're developed, the equations used are:

P2 = —xP x(1 —y)xP~gp1

(B.8)

Pg' —xP xy x(1 —5) xP~Np (B-9)

P4 = —xPxyx5x(1 -e)xp+p (B.10)

Ps = P xyx5xexP+p (B. ll)

B.15

Common Cause

If combinations of six are developed, the equations used are:

Appendix B

Fault Trees

P2 = —x P x (1 - y) x P+>5

(B.12)

Ps = —x p xy x (1 —5) x P|Np1

10(B.13)

P4 XpXQ XIX(1 e)XP~No10

(8.14)

P5 = —x Pxyxbxex(1.—f)xp|~D1

5

Po =x Isxyxbxex(xP/ND (B.16)

In the equations above, P is the common cause failure probability, where i isthe number of independent failures in the combination, and P is theindependent failure probability (taken from the component fat Nre data).Application of these formulas to the components of concern is documented onthe following pages.

B.16


Fault Trees

Fa8ure

Mechanhm

Table B.VII Common Cause Summarya Components

pa pa

FaNure lo open

FaSure lo close

Falure lo start

2.8TE45

2.0 7E4s

a.SSE4a

CNE45

9.9OE45

1.0QE44

2STE4i

L28E40 1AOE40 1~45L28E4$ 1.03E45 t SEOl

LSOE45 1ASE45 2A)1 E4i

5.17E47 $.18E47 1~4$LlTE40 $.10E40 W5E4a

9~40 5ATE40 t.TQE4a

0~47TASE47

*tOE47 tATE47 t.15E47

LtOE40 tZIE401.15E40LSQE40 2.19640 185E40

1 2OE4l

1.7OE48

Fature lo start

Falure lo start

2.5QE4S

SASE4l

S.OOE45

7.7SE4S

woE4a

1.9OE44

aANE45 1AlTE45 1ATE4a

L1SE4$ 1A2E4$ tATE44

LSTE40 L1OE40 9ATE45

7.12E40 4.14E40 MOE44

'2.75E47

401E47

L22E40 tkaE40 1.1OE40

447E40 USE40 1ATE40

B.I7

Spent Fuel Pool Arrangement

ESW

RHR

SFPC(3 pumps3 healexchangers)

SklmmerSurgeTank

SFPC

I

~ ~.Span P'ue(

Pool (IJnlf;1),l.

Leak TightGales

I II II I

Cask

I StorageI Plt

Spe ue..oo, nit.3 ..

SFPC

SFPC(3 pumps

3 heatexchangers)

SklmmerSurgeTank

C/l

B

rbCL

aQo

C7

SS40l 0839

Figure B.l, Spent Fuel Pool ArrangementSV

M ra

M Cl-

ra xraV) IXI

- Fuel Pool Cooling —Simplified Diagram

153018A 153018B

153019A 153019B

153001

153017To RHRS 15301 T

153002A 153004A

To SFPC Unit 2

153045

Heat Exchanger

153009A153006A

1A 15301 0A 153014 153015

153013

153002B 1B 153004 B

Heat Exchanger

Pump153009 B

153006B1B

Pump153009C

153010B LU 15300 153018Qo

Cl

153002C 153004 C153006C

1C

Pump

153010C

Heat Exchanger 6940 1 0832

Figure B.2, Representative Fuel Pool Cooling (Unit 1 Depicted) -" Simplified Diagramcu W

Ur+ (D

H CL

lD XVl

RHR System in Fuel Pool Coolirllode —Simplified Diagram153070A

153071A 153071B

153070B

HV 151 F016A

151070

HV 151 F028A

153060

HV 151 F006

153021

153001 PSV 151 F066A

HV 151 F017A

HV 151 F010A

HV 151 F004A

HV 151F006A ~ Pump

1P202AHV 151F006C

151 F031A

151F034A

151 F031C

HV 151F047A

HV 151

RHRServiceWater

Heat ExchangerIE206A

HV 151 F048A HV 151 FOIOB

HV 151F006B Pump

1P202BHV 151F006D

151F034B

1st F031D

HV 151 151 F034CF004C Pump

1P202C

HV 151F004B 151 F031B

PSV 151 F066B

HV 151I 047B

HV 161

RHRServiceWater

Heat ExchangerIE206B

HV 151 FO48B

HV 151F028B

HV 151 F016B

HV 151 F017BHV 151F004D Pump

1P202D

151 F034D

69401083.1

FigUre B.3, Representative RHR Cooling (Unit 1 Depicted) - Simplified Diagram

APPENDIX C

EVENT TREES(Initiating Events, Graphical Event Trees)

Appendix C

Event Trees

This appendix contains the information describing the methods used to generateand select the values used for initiating events, and the graphicalrepresentations and discussions for the even't tree (ET). Specifically itcontains:

a)

b)

c)

Initiating Event Discussion. Contains the information describingthe methods used to generate and select the values used forinitiating events.

Initiating Event Source Table. Table C. I is provided which liststhe Initiating Events, values from a variety of sources, theselected value used in this evaluation, and the reason forselecting the value.

Initiating Events Frequency Table. Tables are provided whichlists the Initiating Events frequency for each Case for both theAs-Found and As-Fixed conditions.

d)

e)

Top Event Frequency Table. Tables are provided which list thefrequency of the top events modeled in each Event Tree. Thesevalues are a combination of the HRA and Hardware Top EventFrequencies (See Appendices B and D).

NBF Event Trees. The following NBF Event Trees for the As-Foundand As-Fixed conditions are provided.

I)2)3)4)5)6)7)8)9)10)

Loss of SFPCLOOPExtended LOOPStation BlackoutLOCAFloodingLoss of Service WaterPipe BreakSeismicLOCA w/LOOP

CDF Generic Event Tree. A single generic Event Tree is providedfor CDF.

g)

h)

Event Sequence Evaluations. Discussions of the important CDFsequences are provided. 0

Timelines. Timelines that match the discussions in item g above.

C.I

Initiating Event Discussion

C.l Initiatin Events

Appendix C

Event Trees

Initiating events (IEs) are occurrences such as systemdisturbances or component failures that cause a loss of the SFPC

function to one or both SSES units. The analysis initially soughtto consider all possible causes of a loss of SFPC and includetheir contribution in the evaluation and quantification effort.Initiating events were identified based on:

Review of the concerns raised in the 10 CFR 21 report andassociated documentation regarding alleged designdeficiencies for an event that causes a loss of SFPC and theplant response to such events.

Review of the SSES IPE and loss of SFPC mini-PRA (SA-TSY-001, Revision 0).

~ The meeting with PP8L on December I, 1993 and SSES plant'alkdown on December 2, 1993.

~ Review of other IPEs and PRAs of nuclear power plants.

C. l. 1 Description of IEs Selected for Evaluation andguantification

The IEs considered, evaluated, and quantified, are describedbelow. The sources of input information used and basis foreach estimated IE frequency is provided in Table C-l.

~ SFPC Failure

This IE includes all failures in the SFPC system or itscomponents and human errors that would render the SFPCsystem inoperable. SFPC system piping failures are excludedin order to treat them separately under the pipe breakinitiating event. The SFPC system failures that could cause' loss of SFPC system function are quantified using the zerofailure Chi Squared distribution method, The total estimatedannual frequency for the SFPC system failure IE is1.57E-4/YR.

Loss of Offsite Power, LOOP

T"..as IE includes all natural and human action occurrencesthat could cause a loss of power supply to the SSES sitefrom the offsite distribution system whether originated froman onsite or offsite location. The SFPC system is poweredfrom a non-safety power source, not provided with automaticback-up power from the onsite emergency power, supply

C.2

Initiating Event Discussion Appendix C

Event Trees

sources. The SFPC system is therefore de-energized upon a

LOOP and remains de-energized until offsite power isrestored and the appropriate buses are re-energized or untilplant operators align power from one of the plant's fiveemergency diesel generators. The LOOP initiator event canpotentially be followed by a failure of the SSES onsiteemergency power back-up power supply, which is treatedseparately as the station blackout (SBO) IE. Additionally,if the LOOP is not recovered for a period of at least fourhours, it is termed and treated separately as an extendedLOOP. The total estimated frequency for the LOOP is7.00E-2/YR.

~ Extended LOOP, (EX-LOOP)1

This IE includes all LOOPs as described above which also donot have offsite power restored to SSES within four hours.The frequency is based on the LOOP frequency times anestimate of the probability of failure to recover offsitepower within a four hour period which substantially reducesthe resultant frequency. The total estimated frequency forthe Extended LOOP is 7.0E-3/YR for > 4 hours, 3.5E-3/YR for> 10 hours, and 1.75E-3/YR for > 20 hours.

Station Blackout, SBO

This IE includes all LOOPs as described above which also'ncura failure of all emergency onsite ac power sources

(four emergency diesel generators) resulting in onl'y stationbatteries for plant indications and controls. The frequencyis based on the LOOP frequency times an estimate of theprobability of failure of all four EDGs which substantiallyreduces the resultant frequency. The total estimatedfrequency for the SBO is 2.73E-8/YR.

Loss of Coolant Accident, LOCA

This IE includes large, intermediate, and small size pipebreaks in the reactor recirculation or other piping systemin contact with the reactor coolant. These pipe breakscause emergency core cooling activation of systems to injectmake-up water to the RPV and also cause non-essentialelectric loads to be shed, including the SFPC system. Thisresults in loss of SFPC until it is successfully restarted.The frequency is based on the sum of the probabilities oflarge, intermediate, and small size LOCA pipe breaks. Thetotal estimated frequency for the LOCA is 3.67E-3/YR.

C.3


Event Trees

LOCA-LOOP

This IE includes the all LOCA as described above which alsoincur a LOOP. The frequency is based on the LOCA frequencytimes the LOOP frequency. The total estimated frequency forthe LOCA LOOP is 2.57E-4/YR.

Loss of Service Water System, LOSWS.

This IE includes all failures in the SWS or its componentsand human errors that would render the SWS inoperable. SWS

piping failures are excluded in order to treat themseparately under the pipe break initiating event. The SWS

failures that could cause a loss of SWS function arequantified from referenced PRA/IPE studies to estimated theIE frequency. The total estimated frequency for the loss ofSWS failure IE is 2.00E-3/YR.

Internal Flooding, FLOODING

This IE includes failures in systems internal to the plantsupplying water to the reactor building which could resultin accumulation of water in the SFPC room and flood the SFPCequipment (SFP pumps) causing a loss of the SFPC function.The water system failures that could cause a loss of theSFPC function are quantified from referenced PRA/IPE studiesto estimated the IE frequency. The total estimatedfrequency for the loss of SWS failure IE is 3.90E-3/YR.

~ PIPE BREAK

This IE includes failures in the SFPC or SWS piping systemswhich would cause loss of the SFPC system. The pipe breaksare considered at any location within these systems'hichwould result in inadequate flow to the SFPC system or heatexchangers (SWS). Potential flooding induced failures fromsuch potential pipe breaks is treated under the flooding IEabove. The total estimated frequency for a SFPC or SWS pipebreak IE resulting in loss of SFPC system is 3.43E-3/YR.

SEISMIC

This IE includes failures in plant systems that result inloss of the SFPC function as a result o oany seismic eventcausing ground motion %t the SSES site. The seismicinitiator frequency is estimated from NUREG/CR-4550, Volumes3 and 4 using Revised LLNL median hazard curve probabilitiesfrom draft NUREG-1488 (October 1993) at < 0.6g PGA and >0.6g PGA. The generic fragilities provided in Table 4. 11 of

C.4


Event Trees

NUREG/CR-4550 are used to identify the weakest link andestimate the associated seismic fragility values for theweakest links in the SFPC system and the RHR in SFPCoperating mode. The local accelerations at these "weakestlinks" are then estimated corresponding to given PGA values.In this manner the IE frequency at the seismic eventmagnitudes that would cause loss of SFPC and loss of RHR inthe SFPC mode of operation are estimated.

The < 0.6g PGA is estimated to result in accelerations thatcause failure of the ceramic insulators for the offsitepower supply lines. The ceramic insulators fragility basedon generic values form Table 4.11 of NUREG/CR-4550 is at0.25g. The SFPC system requires offsite power and thus isconsidered to be rendered inoperable in the seismic event.All other plant systems and equipment that are notseismically qualified are assumed to fail for seismic eventsup to 0,6g. Similarly, the seismic event at > 0.6g PGA isestimated to result in accelerations that cause seismicallyqualified systems and equipment to fail. A seismic eventproducing a PGA of 0.9g or larger is taken as rendering muchof the ECCS equipment inoperable, such that the EOGs,batteries, and RHR in the SFPC mode of operation would notbe available. Based on these considerations the estimatedIE frequency for a < 0.6g PGA is 8.55E-6/YR., and for a >0.6g PGA seismic event is 4.20E-7/YR.

C.5

Initiating Event Source Table Appendix C

Event Trees

Initiating/TopEvent (T e)

SFPC Failure(InitiatingEvent) SFPCF

loss-of-Offsite-Powerthat CausesLOSFPC

(InitiatingEvent) LOOP

Extended-LOOPthat causesLOSFPC

(InitiatingEvent) EX-LOOP

,Fre.

Ref.

Fre.

Ref.

Fre.

Hef.

Source II(unit)

0.079/YR(PeachBottom)

HUREG/CR4500

Vol.4,Rev.l, Table4.3-1

Source E2

(unit)

0.078/YR(Zion)

NUREG/CR4500

Vol.7. Rev.lTable 4.3-1

Source P3

(Unit

0.11/YR(GrandGul f)

HUREG/CR455

0 Vol.6,Rev.i PartI Table4.3-1

Source l4(Unit)

0.09/YR(Oconee)

Oconee IPETable 2.1-3

SusquehannaIPE (Unit)

0. 07/15mo.(Susquehanna)

SusquehannaIPE Page F-5

.Other(Unit)

0.07/YR(Tro]an)

Tro]an IPETable3.1.1-6

Range PointEstimate (Per

Plant Yr)

0.07/YR

average ofvalues fransources

7.0E-3/YR 94hr 3.5E-3/YR910 hr 1.75E-3/YR 920 hr

P(LOOP)~P(non-recovery 9time)

Cannent

Estimated usingthe Chi Squared2ero failuretechni ue.

LOOP that lastsfor less than 4hours duration(i.e., not anextended LOOP),frequency istaken as the meanfrom the otherstudies.

Extended LOOP

frequencies aretaken as theP(LOOP) times theprobability ofnon-recovery attimes of 4. 10,and 20 hours,respectively.The probabilityof non-recoveryvalues areestimated usingthe upper boundof the curves inNUREG/CR-4550developed perNUREG/CR-5032.P(non-recoveries)~0.194 hr,0.05 9 10 hr, and0.025 9 20 hr.

C.6


Event Trees

Initiating/TopEvent (T e)

Station-Blackout ThatCauses LOSFPC

( InitiatingEvent) SBO

LOCA thatCau"es LOSFPC

(InitiatingEvent) LOCA

Fre.

Ruf.

Pre.

Ref.

Source /IUnit

2.50E-3/YR(Surry)

Surry IPETable 3.3.1-3 8 NUREG/CR

45SO Vol.3,Rev.l PartI, Table4.3-1

Source f2(Unit)

3.40E-3/YR(Peach Bottom)

NUREG/CR4550Vol.4, Rev.lPart I Table4.3-1

Source f3Unit)

2.50E-3/YR(Sequoyah)

NUREG/CR4550 Vol.5,Rev. I Part1. Table4.33-1

Source f4(Unit)

3.40E-3/YR(Grand Gulf)

NUREG/CR4550Vo).6.Rev.lPart 1,Table 4.3-1

SusquehannaIPE (Unit

5.40E-3/15mo.(Susquehanna)

SusquehannaIPE Page F-112

OtherUnit

5.40E-3/YR(Oconee)



Plant Yr)

2.73E-B/YR

LOOP frequencytimes the EOGs

combinedunavailability

3.67E-3/YR

Average ofreferencedsources

Ccmnent

SBO frequency istaken as the LOOP

frequency (7.00E-2/YR) times thecombined unavail-ability of thefour EOIIs(0.025) . Thisis based on anassumed EOG reli-abilit of 97.5X.

LOCA frequency istaken as the meanfrom the othersources andincludes small.intermediate, andlarge size LOCAs.


Event Trees

Ini t latlng/TopEvent (T e)

LOCA with LOOP

(InitiatingEvent) LOCA-

LOOP

Loss-of-Servlce-MaterThat CausesSFPC ( Initiat-ing Event)LOS'W

Flooding ThatCauses LOSFPC

(InitiatingEvent)FLOODIHG

Fre.

Ref.

Fre.

Ref.

Fre.

Ref.

Source ElUnit)

9.40E-4/YR(Lion)

HUREG/CR4550 Vol.l.Rev.i, Table4.3-1

Source l2Unit)

I.BOE-4/YR(OlabloCanyon)

Olablo CanyonIPE

Source f3(Unit)

I.OOE-3/YR(Tro]an)

Tro]an IPETable3.1.1-6

Source I4(Unit)

5.00E-3/YR

HUREG-3662

SusquehannaIPE (Unit)

1. OOE-

4/15mo.(Susquehanna)

SusquehannaIPE Page F-341 SectionF.4.4.1.1

Other(Unit)

4.30E-3/YR(Oconee)


3.90E-3/YR(Oconee)

Oconee IPESection3.3.2.3Page 3.3-12


Plant Yr)

2.57E-4/YR

Average ofreferencedsources

2.00E-3/YR

average ofreferencedsources

3.90E-3/YR

From OconeeIPE

Conment

LOCA and LOOP

frequency is"taken as the meanof the frequencyof LOCA times thefrequency of LOOP

form the refer-enced PRAs andIPEs.

Loss of ServiceMater Systee fre-quency is takenas the mean ofthe frequency ofloss of SMS forethe referencedPRAs and IPEs.

Floodingfrequency lstaken from theOconee IPE forInternallyinitiated floodsfrom a largeauxiliarybuilding flood.

SMS Pipe-breakthat CausesLOSFPC

(Inltlat lngEvent) SVS

PIPE-BREAK

.Ref. Vo et al.1990

Fre. 4.70E-5/YR 9.90E-3/YR

HUREG/CR4550Vol.2

2.00E-4/YR

WAS!I-1400

3.40E-3

,average ofreferencedsources

5'MS pipe rupturels taken as themean of the SWS

Pipe rupture fre-quencies form thereferencedsources.

C.8


Event Trees

Initiating/1'opEvent (T e

Seismic ThatCauses LOSFPC

(InitiatingEvent) SEISHIC

Source Il(Unit)

Source I2(Unit)

Source I3(Unit)

Source l4(Unit)

SusquehannaIPE Unit

Other(Unit)


Plant Yr)

8.5SE-&/YR 0 <

0.6g PGA

4.20E-7/YR 0 >

0.6g PGA

NUREG.CR4550Vol.4. Rev.l,Part 3. Table4.9 and draftNUREG-1488(October 1993)page A-15.

Coament

Seismic initiatorfrequency Isestimated usingthe Revised LLNLmedian hazardtables pf prob-abilities at <

0.6g PGA and >

0.6g PGA. The0.6g PGA is takenas causing spec-tral acceler-ations at thricethe general HCLPF

value. This isbelieved to be areasonableestimate of themaximum sizeseismic eventthat the ECCS

equipment couldsurvive andremain

C.9-

Initiating Event Frequency Tables Appendix C

Event Trees

The values from Table C. I were ratioed with the time spent in each Case toprovide an Initiating Event Frequency for each Case.

Table C.II SSES As-Found Initiating Event FrequencyCase

Initiating Event

Loss of SFPC

LOOP

Extended LOOP

SBO

LOCA

FloodinLoss of SMS

Pine Break

eismic <.6

eismic ~).6OCA w/LOOP

Frey

1.57E-04 1.35E-04

7.00E-OZ 6.04E-OZ

7.00E-03 6.04E-03

2.73E-OB 2.36E-OB

3.67E-03 3.17E-03

3.90E-03 3.36E-03

2.00E-03 1.73E-03

3.40E-03 2.93E-03

8.55E-06 7.37E-06

4.20E-07 3.62E-07

2.57E-04 2.22E-04

7.19E-06 8.63E-06

3.21E-03 3.85E-03

3.21E-04 3.85E-04

1.25E-09 1.50E-09

1.68E-04 2.02E-04

1. 79E-04 2. 14E-04

9. 16E-05 1. 10E-04

1.56E-04 1.87E-04

3.91E-07 4.70E-07

1.92E"08 2.31E-OB

1.18E-05 1.41E-OS

2.88E-06 2.88E-06

1.28E-03 1.28E-03

1.28E-04 1.28E-04

5. 01E-10 5. 01E-10

6.72E-OS 6.72E-05

7.14E-05 7.14E-OS

3.66E-05 3.66E-OS

6.23E-OS 6.23E-OS

1.57E-07 1.57E«07

7.69E-09 7.69E-09

4.71E-06 4.71E-06

Table C.III SSES As-Fixed Initiating Event FrequencyCase

Initiating Event

Loss of SFPC

LOOP

Extended LOOP"

580

LOCA

FloodinLoss of SMS

Pine Break

Seismic «.6Seismic ~>.6

LOCA w/LOOP

Freq

1.57E-04

7.00E-02

7.0QE-03

2.73E-OB

3.67E-03

3.90E-03

Z.OOE-03

3.40E-03

8.55E-06

4.20E-07

2.57E-04

1.35E-04 7. 19E-06

6.04E-02 3.21E-03

6.04E-03 3.21E-04

2.36E-OB 1.25E-09

3. 17E-03 1. 68E-04

3.36E-03 1.79E-04

1. 73E-03 9. 16E-05

2.93E-03 1.56E-04

7.37E-06 3.91E-07

3.62E-07 1.92E-OB

2.22E-04 1.18E-OS

4

8.63E-06 5.75E-OB

3.85E-03 2.56E-03

3.85E-04 2.56E-04

1.50E-09 1.00E-09

2.02E-04 1.34E-04

2.14E-04 1.43E-04

1. 10E-04 7.33E-OS

1.87E-04 1.25E-04

4.70E-07 3.13E-07

2.31E-OB 1.54E-OB

1. 41E-05 9. 41E-06

C.10


Event Trees

Table CeIV SSES As-Found Top Event FrequencyIhrtlaohgKent

Loss otSFPC

L P

LOOP

ood

Loss cfSWS

ipeBreak

etsmtc

w/OOL P

lactated lactatedUt US

SFPC SFPCRestart Restart

Rec. Rec

1.000 N/A1.000 N/AN/A N/A

1.000 N/A1.000 N/A0.010 0.0100.010 0.010N/A N A

0.020 0.0100.050 0.0200.020 0.0200.020 0.020N/A N/A

0.050 0.0200.100 0.0200.050 0.0500.050 0.050N/A N/A

0.100 0.0500.200 0.0500.050 N A0.050 N/AN/A N/A

0.100 N/A0.200 N A0.010 N/A0.010 N AN/A N/A

0.020 N A0.050 N/A0.010 N/A0.010 N/AN/A A

0.020 N/A0.050 N/A0.010 ~ N/0.010 N/AN/A N/A

0.020 N0.050 N/ANA NAN A N/AN/A N/AN/AN/A N/

0.100 0.0500.100 0.050N/A N/A

0.100 0.0500.100 0.050

0.004

0.0060.0100.0100.0100.0200.0200.0200.0200.0200.0500.0500.0500.0500.0500.1000.1000.1000.0500.0500.1000.1000.1000.0100.0100.0200.020

0.0100.0100.0200.0200.0200.0100.0100.0200.020

N/A

N/A

0.1000.1000.1000.1000.100

Isolated lactatedUt RHR UZ RHRSystem System

0.029 N/A0.326 N/AN/A N/A

0.059 N/A0.109 N/A0.059 0.0590.307 0.059NA NA

0.109 0.0590.029 0.0590.109 0.1090.426 0.109N/A N/A

0.209 0.1090.309 0.1090.209 0.2090.526 0.209N/A N/A

0.359 0~0.509 0~N/A N/AN/A N AN/A N/ANA N/N/A N/A

0.059 N/A0.376 N/AN/A N/A

0.109 N/A0~ NA0.059 N AOM6 N/AN/A N/A

0.109 N/A0~ N/A0.059 N/0.376 N/AN/A N/A

0.109 N0.209 NIA0.109 0.1090.426 0.109N/A N/A0~ 0.1090~ 0.109N/A 0.109N/A 0.109N/A N AN/A 0.109N 0.109

0.0200.023

0.0500.1000.0500.0530.1090.1000.1000.1000.103

02000.2000.2000.203

0.3500.3500.1090.109

0.2090.2090.0500.0530.1090.100

0.100'.050

0.0530.1090.1000.100

0.0530.1090.1000.100N AN/A

0209N/AN/A

0.2090.209

Crossm IsotatedUt

Repair .

Rec

0.103 0.0500.103 0.050N/A N/A

0.108 0.1000.118 0.5000.108 0.1000.108 0.100N/A N A

0.118 0.2000.148 0.5000.11S 0.2000.118 0.200N/A N A

0.148 0.3500.198 0.5000.148 0.3000.148 0.300N/A N A

0.198 0.5000.298 0.8000.118 0.1000.118 0.100N/A . N/A

0.148 0~0.198 0.5000.108 0.1000.108 0.100N/A N/A

0.118 0~0.148 0.5000.10S 0.1000.108 0.100N/A N/A

0.118 0~0.148 0.5000.108 0.1000.108 0.100N/A N/A

0.118 0.2000.148 0.500N/A 0~NA 0~N/A N/AN A 0.350N/A 0.500

0.198 0~0.198 0.200NA A

0.198 0.3500.198 0.500

CornoUt or U2

Re carrRec

N/A 0.050N/A 0.050N/A 0.100N/A 0.100N/A 0.100

0.100 0.1000.100 0.100N A 0.200

0.100 0.2000.100 0.2000~ 0.2000.200 0~N/A 0.350

0.200 0.3500~ 0.3500.300 0.3000.300 0.500N A 0.500

0.300 0.5000.300 0.500N/A 0.100N/A 0.100N A 0.200N/A 0400N/A 0.200N A 0.100N A 0.100N/A 0~N/A 0~N/A 0.200N/A 0.100N A 0.100N A 0.200N/A 0.200N/A 0200N/A 0.100N/A 0.100N/A 0.200N/A 0.200N/A 0.2000~ 02000~ 0~N/A 0.350

0.200 0.3500~ 0.3500.200 0~0~ 0.200N/A 0.3500~ 0.3500~ 0.350

TSCCtrectedA!ramateCooang

N/AN/AN/AN/AN/AN/AN/AN/AN/AN/AN/AN/AN/AN/AN/A

0.2000.200

0.3500.500N/AN/AN/AN/AN/AN/AN/AN/AN/AN/AN/AN/ANAN/AN/AN/AN/AN/AN/AN/AN AN/AN/AN/AN/AN/AN/AN/AN/AN A

N/AN/AN/AN/AN/AN/AN/AN/AN/AN/A

0.1000.1000.2000.2000.300N/AN/AN/AN/AN/AN/AN/AN/AN/AN/AN/AN/AN/AN/AN/AN/AN/AN/AN/AN/AN/AN/AN/AN/AN/AN/AN/AN/AN/A

0.1000.1000.1000.1000.100


Event Trees

Table C.V SSES As-Fixed Top Event Frequencylnitiaang Event

Loss ot SFPC

mbrned mbinedSFPG RHR System

RestartRecovery

0.010

0.013

0.029

0.020

mainedU1 or U2

RepairRecovery

0.050

0.050

0.100

0.100

DirectedAlternateCooling

D 's

Recavery

N/AN/AN/AN/A

5th 0Recovery

N/AN/A

N/AN/A

LOOP

Extended Loop

BO

LOCA

Flood

Loss at SWS

Pipe Breatt

Seismic

LO w/LOOP

0.006

0.010

0.010

0.010

0.010

0.020

0.020

0.020

0.020

0.050

0.050

0.100

0.100

0.010

0.010

0.020

0.020

0.006

0.010

0.010

0.010

0.010

0.020

0.020

N/AN/AN/AN/A

0.100

0.100

0.020

0.059

0.050

0.053

0.109

0.100

0.100

0.103

0.109

0.103

0.050

0.053

0.109

O.10O

0.023

0.059

0.050

0.109

0.100

0.100

0.103

0.200

0.203

0.350

0.100

0.100

0200

02000.350

0.350

0.300

0.500

0.100

0.100

0200

0.100

0.100

0.100

0.100

0.1000.'100

0200020002000200

1.000

N/AN/AN/AN/AN/AN/AN/AN/A

0.350

N/AN/AN/AN/AN/AN/AN/AN/AN/AN/AN/AN/AN/AN/AN/A

N/AN/AN/AN/AN/AN/A

N/AN/A

N/AN/A

'/A

N/A0.100

0.100

0200

N/AN/A

N/AN/AN/AN/AN/AN/AN/AN/AN/AN/AN/AN/AN/AN/AN/AN/AN/AN/AN/AN/AN/AN/A

0.100

0.100

0.100

t0$5 er IIPCOre«sees 1 ofsc Re Ul Arot Ul bee Ree Mceeeeo

~ $7041 OOOO«00 011E41 ISOC41 OOOE«00

102041 IOOE«00 200242 I00042 12rOE«00

1 OIE4I

ts«e \ Ees Uel 1 Oee Oee«oee frs«ee«

0 11241

IOOE«00

$200¹22$0¹ IIIE¹ OOOO«00 1 OSK¹

I IIE41 I 00041 0 $0041 0000«00

~ SIC4$ 201141 SOCE41 isa«0010IC4I

~I Urn ~ Ses ts«t 2 Oee Oe& Oee t«er«W

~ 01141I10E47

1 11E41

I seea

~ 01E.10

INE 10

1W

I IIE¹

IOOE«00

IIIE 10

OOOEhO ~ ~ 1E 10

OOOO�«00

leer 2 Ete 12$ E4I IIII¹ IOOE«00 ~ ~ 1 E.l WNF

C. 13

Cceo 1

PyPOnaa C&oec Ttooo

E toe ceo

~ IIE41 ~ OIC41

LWE42 IOOC41

~ IIE42

ceeeeeeo I etec he etoc he MI loot IITRIOI vl eeo Ree Mt oeocee Mceeee4

002E41 ~ 00041 ~ IOC41 I ~1041 0 ~ IC41 OOOE41 OOOC47 0000eel

IOMOI IOIC42 tOIE47 LOTE42 EOTE42 l¹C41 IOIN47 I~~ OIE41

~e WlI eee 10420ee ~eel IWaeee

E72E¹

242E47OOOEeeo

242C47 I02047

2 020¹X.TTE¹

S.l IE41

EOIC¹2 OOC4l

0 Ooeeeo

0 Ttc4t

200E¹

OAOEeoe

eetc¹

200041 2JOE¹

OIICooe

I 17240~ 2 NE¹

I TOE¹ ~

'I TOC 10

00%NO

I TOE.IO

I S1E¹

\ tOE \I

IOIE47S OIE41

I WE.IO

I TOE Io

I WE I I

170E 10

0 IOCeee

~ NE.II

OOOEeOO

I TOC.IO

IOIE47 I IOE41

S OIE41

I WE.II ISOC42

0 SIC 41

LOCO 1eeeoeeet

SIOE41 ~ ICC41 OOOC4'I OOOCeOO

\OOE47 ~ OI 042 I INC41 I IOCeW

~ OIE42

~I Sect I Oee teel 2 Oee Oeee Oee teoeeler

20IE¹I lee¹

2 oec¹e ooem

~ OOE42

20IC¹OOOCeOO 0OOCeee 20IC¹ OOOCeee

teM2 ETe ~ IIE47 2 02047 Iwc47 IoeE eeel Iwt

~Nf41 ~ NC41 0SIC 41

SNC42 LNE41 IOOC41

ceeeeeeo sfoc oe sloe Le Ul Nol U2 Not Ut le oee U1 Aeo Aee 00 ceeoeo

002%41 SNC4I 0 NE4I 0 ItE41 OS?f41 00%41 OOOE4I

EOIC42 20IC42 IEIC4t Iom41 EUN41

lect I 0« II%1 oee Sect oee Itwwar

~ oocasssfa

12 IE4?I000 eO?

13104?

0 OOE ceo

I Slf4?

~ ooca02SC¹

INC4?

~ Isfa

I IIE4?

01?f41

Ist f4?

~ teca

121 04?

~ Sic¹

~ tefa

I2 1f4?

0 ?if40 I teca

~ 2?ca~SN.IO INE.IO

I elfaEACH.I 2.20E 10

22lf421 0?f41

INC lo

22IE.I0

INC ~ I

220f.to

INfcoo

SNC II

22N 10

~ Nf.lI

1 01041~ elfa ~ ~lfa

s stfa

IIOE¹~ ~ Ica

1 II E4?

~ elfdt

I ~ IE4?

~ ltfa

~ ttf4?

t IIE4t

~ ttf4?

I III4?000C eN

I IIC4?

I 1lf41

INE coo

~ I1fa~ ?224?

IOoc coo

I I IC4?

I IIC4?

I locaIOOC coo

~ ltc4t

~ 2?fa

I IOE41~ ?IE40

2 IIE40

~ ~IE.II

2 IOE4l

0OOE«N

1 IIE40

~ Ilf.le

1?Sea

aeena C&070 floss

2.1$ E 10 2 IIE.ID

2000 10

2.1IE lsOIECess

2.1$ C ID 21St.IS

2 IIE47

$200 ll$2IC 11 Slit 11

000te07

~ 0004$

2 Tsta

~ ssta

I Orna

0 OsteCI

ossta

0 Ostess

DSSta

OOIE47

0 Ittess

100047

000tess

~ 00047

0 OSE47

\ 27C470 Dstess

122047~ Ista

O 00047

S 7lta ~ 7IEa 727247 o20047I 77E

teeeeoeo Loop Icteeooeol

~ DIC41 I SDE41 ~ OOE47 ~ 00041 000tessI2SC47 2OOE42 I OOC41 20CC41 1ssteOD

~ ITAO~ 2IE47

oo Uel I Oeo LM2 Oeo Oese Oeo Treeeeoe

~ 17E47

7 0724$

~ SM4$~ S2ta

I IltaI 7104I

7 0724$

~ 022 a0 DOE ess

I20241 Osstess 0 DOE ess

I 7 IEaI llta 0 Istess

0 OOE

~V2 CTe ~ 07247 ST IE4I 0 71241 I IIE eoo Iof

KCCNTISN CEIOIC TI000

IE

~ OOE41

2 OOC41

I SOEaa

Statal2.12tal

I,IM.IO0 ~ IE 11

2 SOE.I IIOSE 11

T.INC 12

0 00feOO

17NE.I2

Cawseo SIOC Re 010C Tte vl NOI UlNOI U'I Kao Ral U2 Kao Aea Oo CeaaaO

~SSC 41 OSOE41 ~ SOE41 I~IE41 I0 Ital 1 00tat 1OOC41 0 OOEa00

I aafal SOIC42 SINC42 ?OOE at KNtal 2 OIE41 200fat I OOKa00

I lltal

ee Uaa\Oal vaa2001 ~Sea Taareaaa

I SSE al Caaaeaee

212K40

~ SIC 11

IOSE 11

TNE tl

I.IIE 10

I ISE.IO

~ NE 12

I ~ IE.II

22OE.II

~ Tlf 'llI Taf 12

~ OOC.Il

~ OOC ll

IOSE 11

1NE 12

0 Nt.lI

~ NC.N

I alf.tl

0 OOKeOO

T.Nt.l2

I OTK 12

~ Ilflt

IOSE I I

2 Tat.l2

ONE tl

0 OOEe00

0 NE.Il

1 INC.IT

I ITC.I2

11St.ll

2 NE Il

2 Slf.lI

~ STC ll12lf.ll

~ SOE la

201K 11

0 OOEeN

SSOE I~

~ 2lt Il

000fm

201E tl

0 IOE.II

7 laf I~

SSOI I~

S SOS I~ I SOE.I ~

2 ~ TE41-

1 lll I~

ISIE. Ia 2 Sat. II

SNE41llataa I IIC.IT ~ IIE 12 I ~ 1t4I llatal l1%

\ 12E.I

Caeaaee

I OOK KNIOIK4I

I lit4l

0 TTE.IO

I~ IE 10

I lit 10

~ alt 11

~ INK ll0 OOK a00

~ Olt ll

SOU ICaeaaaeei

Caee STOC Ceaae AHII Oeeee Sec AO CaeeN

Statal ~ Octal 100tal OIOE~SOOE42 20OE41 SINE41 100fe00

ee vea I oea Iaa 2 oea oeea Oea TaerNOr ceeeaaea

I 2lf41

S ~lf.ll

~ att II

~ Iaf I I

I ISE41 0000aaa OISENO ~ ON 11 0 OOE e00 I Nt

leaal 2 Ela I SIC4I 1 lit 11 ~ ISE 11 ~ OIE aaaa I%I

Pooenaac CEcorf Clooo

0 01041

Creeeceo I COAC Ae Ul Aeo Aec MCecoro

~ CIC41 020041 000f41 OCOtrco

I IIC4'I Soetrol ICCC41 IOCCrefr

22M 41

~s Cero I w Urrc 1 W Oeor oee Trwor

I SCE4S

0 OCCrco

I SitaTW 1 ~ IC4e I.SOE4I 000fr00 Oocfsoo 2 elf

~ SIC 41

21SC41

0 SOC41 OSIE41 ~ CCC41 oootr005 COE42 I NE41 1COC41 ~ 0%coo

22lf41

~I IINI W IIN2 W Wr W Trawler

~ Ilt41

12104S

I.Iota

Ooofs00

1.1004S

Ooof soo

2.1SE41 0OOCr00

120ta0 oof rco 12IC4I

0 COE

W1ETI 2%f41 I SCC4l Ooofr00 12IE ehllOl 1 ~ 'IE

cresesec 1 51 00 Ae Ul AIIA Ul Aee Aec 00 cceseo

SSSC41 ~ 12041 IIOE41 ~ Clf41 SOOE41 Ooctroo

SOCE42 Iolt41 I OCE42 S CSC42 IOCC41 ICOEroo

ec Urrc I w Uec 2 W Oecr w Treserer

IOIC41

0 ISE4C

0 lita0 oofa

1 1SC41

ISIC41

Ooof roc

1 lct41

I 11141 1 Tlta~ IIE41 lllf41 Oocfrcc Ooof roc ~ OSE41

0 000

cresses csrro 5100 ceeo Aloe Arose Aec Mceeseo

00IE41 ~ IOE41 ~ SOE41 ~ OOE41 ooctrcc5 olf41 I OOE42 SOIE42 I OOC41 I Octsa

Ioct 41IOIE41

~ 10041

es lese I w Usc 2 w wrw Trerrecsr

22OE4I

1 Slt41OOCENO

1 SSC4T

0 000 roc

0 000 roc 0 OOC roc 2 SIE4T

W 2 CTS IOIE41 1 llta 0OOEs00 2 SSE4 WMf

C. 18

AOoenau CEccl% TreeS

0 STE41

1St%a

2 ~ IE41

) I ~ Ea) 11%4e

creaoeoo I oooc Ao Ul Itlet Ul lice 14c Ao coatee

~ S)f41 ~ Otf41 0 ~ IE41 0 Oef41 0 OS%eel

I 00%41 I %I%42 00$ %42 la%41 IS%Cree

2 SIE4)

~I lect I W LHt2W WaW Tower

2 SSE41 Creeeeao

2 It%a

)2)fa

I ~If411.12% 41

I OIE40I ~Ifa I Sita

) to%el I ~lfa 0 00% a00 OOOfeOO 2SIE4) 2$ 1%4)

001%41

2$0%4)

2 Slt4)

cooe sr pc ceoe rtret haoae 14c Akceeeae

0 IOWI 0 SOE41 ~ OOC41 0OOEeel

I OOE42 S 01542 I00%4 I I OICeOO

'2 Slf4)

~c 1)ac I W 1)tc 2 W WtW Treater coaaaoac

1.11%a urea

fatale

0 Octaee 1 20%4) 0 00% aOO 2 $0%

0 OOE

~oal 2 cTo 28%4) I el%a 0 ootNII ~ sof eae oooo I OIC4

eea cawcaw toe 'I sr pell~ Ul Itlol Ul lice Aec Mcooaae

SOS%41 ~ l2E41 ~ Olf41 0 ~ IC41 lee%41 OOOfeOO

~ SCE4$ \ OOE4t I et%42 ~ OS%42 tet%et I tgfete

o aOC4)

~ SIE4)

~I loci I W Uac 2 w Wtw Treeatr

1 )IE4e

$ SIE4l$2Ma

)2$E412 O)f41

)2)%410 00% ace

)2saaTeer

$2)fa

2 S)%47

0 00% aee

$2sca$ Slt4I $ 2$ %4l 0 Ocfaes ~ Set

crwee cere %roc cooe %tet 14oac l4e Mcoeaeo

Sec%41 000%41 ~ $0%41 ~ OOE41 eel%ace~ eOE41 I OOC42 $ 0'IE42 I%0%41 100%aa

o )O%4)~ o0%4)

~ 10%41

~I Uae I w Ioet 2 w eeet w Trwear

~ Iota

221%atel%a

22I%41coot ~221 WT

Ill%a

e eef 4) 0 00% aa 0 OOE 40221WT221WT

Ieae 2 ETI ~ SO%4) )21% a 0 Set eel 2 21%4 aee ~

~~MEE3

~~MHzamazg~~RK3E3

. MKXHMHEDMEZ3~~

~EZX?5~~~~~~~~

REX'~~~

~~~WHEE

~MKKI

pppenaa C

EVOIC 'T1000

0200 10

OOOEeeo

OSOE.I 0 ~ SIR 10

2 OOC.IO

201$ 10 2 ITE.I

TOTE 10

O.TIE 11

O.IOE II ~ ISE II

~ IIE 11

~ IIC 11 ~ 102 ll

$$22a

1$0E.II1 $02.I I

OOOCelo

I SSC 11

2 0224T

S 01041

0 OOCa

2 TIE40

0$00e00

2 TICa

~ 000a

~ OsEa

0 OCCe00

~ STEa

I TICaOOOCe00

I 1 ICa

0 OSEeIO

0osEa

I 11240

I 11240

221241 S SMa 2 0004e 2 TSE

1 12C

LOCA eeEOSO IOeeee4eel

000$ 41 I ~ 1041 ~ OOC41 0000e00

100041 200C41 201041 I«Ee002 OIE41

IAee I oee Ipvl2 oee oeee oee Teeeeeeer ceeeewl

~ 2$$asolca

12saa«IEa

Teeee

1 01Ea

0 OOC e00

12SE4$

0000e00 0000e00 12SEa OOOEe00 2000

TeeelscTe $ 10041 I ATEa 221041 1200 eall

C. 21

AppenOa CEeoeC Tlooe

Creeeeeo 0700 Ee Vl 7001 171 Wee Roc MCooeeee

100Ce00 ~ 07241 OOOEe00 ~ TAC41 0$0E41 OOOEe00

20004$ 1.0$ 04I IAIReCN $20E41 SOOC47 IDOEe00

2 STC4$

ee Ieec I w Teel 2 w Oeel w Teeoc Acr

2 00241

0 OOEe00

~ SOCa

OARReCO

~ 10247 O.ISK47

~ 02240000K~ 000Ke00

2 OIE41

0 0224$

~ 0204$ 2 STC4$ 2 00K

0 00K

coco SlJc ceoo leeoI Ileeee 1ec Mcoeeeo

I OOCe00 0 $0241 0 TTK41 0 SOC41 0000e00

2 STE4S e.teK4$ 220042 $00042 IAK%e00

~\ Ieec I w Ieec 2 w Eeoc w Tleeeeee

2 STE4$

I 77247

I OOE47

2 SIE40

I 21E.IO

OOOCNO

72$ $ 10

2 ee240

12$ C 10

207241 OOOCe00 000$ e00 12$ E 10 010$ e00 2172

~eel 2 ETe 2 0024$ e 02241 0 ooci00 120K I ecol eetl 0 OAE

C. 22

ACeenaa CEeoct Trees

0 oee oec Oaaaeaac I SIIO Ile SIOC Ilc Ul o)dc L)) Ill@1 Ill tee llec L)2 )Lee Icac 00 Oecled Lee I Cee LM2 Oal Ceca Oee )a)ceca

ISIE41 0 QOE41

I40047

I)lt4)

I 1$04C

~ coda~ Nta

IICE47

2.02C47

~ 02041 0 NE41 ~ IOE41 0 NE41 ~ Clt41 ~ IOE41 ~ 00041 0ddtald

\ OIC4) IOIE42 IOIE42 20)E41 ~.NE42 120%4) IOQE41 I ddtadd

I 1)04)

~ NC41

$ 1)E4)

) Iota0 ddtadd

) NC40

0 OQE adc

~ C)t40 e e)ta

Iacta

I Seta

e NC4$~ )IE40

I 77041

I NE47

2 ISE40

0 Iaadd

Iat47

I 7704$

2 IOE41

I IIC41

I ICEadd

~ NE41

I sat4I

I SCC40

1)sta

ICot~

I SIC 41

12)ta

I IotaI02t.lI

I IOE 10

ICdt add

1102 10

00)C 10

IOdtadd

I 10C.ID

~ )IE4)I )IE4a

'I 2)t 10

I let 10

17)1 a ~

110E 10

IOOI NO

IDE I ~

OOQIKN

I lQE 10

I 10041

12)t 11

I )IE41Ilit a 12)t.)I $ ))E4)

LOOO Itraaaeee.7eeaaae deco seed caco oaec lceeee Sec ee ceeaec

II)04I IO)041 I ~ 'FC41 ~ IOE41 OdctaldS l)04) I QQE4) $ )CC42 IAOE41 ' Odtee)

SQIt41I l)04)

~ 01041I1)ta

)e)ta27)ta

I I

~a L)ae I Oea Lee 2 Oee Sea Oae )renetw

IOC04)

~ ISE41

)csta

2 72247

2 7)t47S l)t4) 0OQEaa OIOC 00

2 72047

272247 OOCCadd

Qeeca

)WC I tla S 1104) I NE4) ~ a)24$ 2 72047 )eccl)COI I 1)C4

C, 23

0 NC4l ~ OOC41

$ 00E41 IDIC4I

frog 00 Itt Stot IITAIR Irlota Eta 127 IWOat

~ 02E4I OOIC47 ~ Oaf47 $ TIE41 041E41 ~ It%41 047f4l OiSEe00

I.IOE41 2klt42 20IE42 02SE4t loafol taqf47 204E41 ISOSKN

w IPII I oot tata 2 ~ ~ oat I~

2 Iat4i

1 SIE41

a rtf47 0 TTE47

02IE»

~ OM»0 aqakg

~ OSE»

1 TIC47

1 Sit47~ SIE41

1 stf472$rt47

~ isC40

2 Srt41

4~ oooa~

OISC40 ~ isa»

0 Olf»0 OM-ta

rsof.la

0 oafKa

raaf.ta

'I STE4I~ TTE»

I taE»40OENe 0 Oqf~

1 22f. I0

s asf.la0 Oac.l 0

I lrf la0 IOEe40

I trt.ta

0 Oat.la

I Iaf»

I 'IIE la

0 1IE4i

2arf4I

2 llE41

0 SSE41

0 TIE47

0 rtc411 ltC47

7 ~ IE47

~ otE47

7 ~ TC4O

I tat.ta

2 Sl f47

1 70E»

t Ira.lq

207E 11

Iala»

I iif4a

0 qofKO 0 oof~~ ITE.IO

OOOENe Ooqfm

2 OM.II

2 2SE»

OOIC41

S aiE4I

4IOENO 000foqa

2 OSE47

2 SIE47

0 OOC e00

s rat»

I ITE.IO

sraf»

I alt»

2OSE II

2 Stt» Geeeyyy

~ IOE»

a aaa I0

1OOE la 1 oaa.la

OOOEeqq oaqa~

\ alt»I OTE4I

ISTE»

C.

Iqrt»

$27t.t 0

021C lo

I OSE.I 0

400E~ ooqam

I OTE»

022f.ta

ooqa~ 0 oaf 40

I OTE40

Aceonaa CEl»10 Troos

~ SOC-IS

1000.10 I OSE 10

110041

1220 10

I 0$0.10

2010 11

I OSC 10

0 OOCess 0 OOCea

2010 I I

I OSE 10

2010 11

1 I lE4$

I 0SE4$

2osca

121 E4$0 TIEa

2 ssca

~ lOCA

0 01047

Iosca

0 OOEeSO 0 DOE eOO

0 01 E47

070Ca

OOOEe00 000CeOS

2 OSEa

~ 0 I E47

I eSEa

I 1sEa

2 SSC47

021047

2 SSC47

0000e00 0OOEe00

220047

OOOEeOS 000Ee00

22$ 047 2 SSE47

2 SSC47

I OOE41 2 TSEa 0 77047

1 ssca0 SSE4I 0 7104I

eeeeeeeeo Lcx&Iceeee»ee)

Ceeeeee Cee» $ 700 ceeo 1leE Oeeee Oec 00 Csee»0

SSSE41 000041 ~ ~ 7041 ~ OOE41 000Ce00

SSSE41 2 DOE 4l I 01041 XCOE41 I OIEe00

S 21$ 4e$ SSE4e

$ 2IE4I

Eeeelelt

Ieee I Oee Ie» loes Oesl Oel Tie»I»e Ceca»ee

I 07EOS

~ IOEa

I IIC40~ 02047

~ 0004$

0 $2047

221047221C47

~ $1041 0 OOE ess

2 21047

211E47 OOOEe00 1 1SC41

I OSE ITeQI lCle 0 11041 2 TSC4$ ~ 71047 20004 Teeal tOS STSE

C. 25

AgoenOa C'E volt Teooe

COOAec

I OOE41

1 OOE41

Creeeeoo I OTOC Xe Sloe Oe Ul Reol U2 IUOI Ul IUO Sec U) Xeo Rec MCoeeoo

~ $)f41 ~ SOE41 ~ IOf41 ~ TIC41 7 $ 1E41 TOOC41 TOOE41 0CXReOO

I IIE41 SOIC4) $ Olf42 $20C41 2IOE41 )OOE41 )OOC41 I OCErOO

I TCC41

Urer I Oeo Ierc 1 Ooe oeor Ooo Troee err

I TOE 4I

2OIE.II

2 IIE.II

\ CIE 11

1 OTE.IO

Ie)t ll

112t 11

0 TOE.11

T.esc 12

1 SEC.I)

~ .I)t.e I

)NK 12

2 ~IK ll

7clE N

$1tt 12

22)K-Il

1 OTC.II

~ Nt.l)

$21t le

OOOEreo

~ NE-I)

0 IXXrCO

22)K.I)

1 Olf.10

~ 11C le

207K 12

~ TOE.11

$21K.11

0 OOKr00

201K 1)

$21f.le

22)K.I)

OOIC 1$

1 ~ IE4$~ Oet 10

TSI K.I)

) ISC.I)

l I)K II

~ )IC le

2.10E II

~2IC N

STOC N

1e)E I~

I OTE.I)

~ IOE I~

I Tet N

I leE N

7 ISE 1$

IOTK-Il

0 OCCrOO

0)lf.lc

0 OOEr00

~ Tef.lc

0 OetrOO

I NE N

COOK'S

7 CIE.IS

1 IIE.I)

OOSC I~

0 OOEr00

000trOO

I TIE N

~ 07 E.I)

~)If 11

I)et 11

Test Is

102K 10

0 OIE.IO

22)E 11 I llf11 ~ OIE.IO I.TOE41 2 eet~ eef I

Cnaeet

~ OOE OO

I TOC4)

cere )Toe coo0 Ilrol Oeeoe Roc Mceeeoo

~ SOE41 7ITE41 SOOE41 000trCO

SOOC42 20)E41 SCXC41 IAXCrCN

~I Uoo I Oec coal 2 Oee Seer oec Ireroeer

I TOE4$

~ SOC 11

~ m 11

I 7)C ll~ 0)C ll

~ O)f 12

~ O)t.l)

~ Tlt II

0 OOE

~ O)K.12

I SIC@I 00OCr00 00OEeCO ~ O)t.l)Crreee

~eee2Ele \ Nt4I 12$ E 12 I IIE 12 ~ COE I eeeee47

I TOE

0 ICE

I IIC I

C. 26

Pppenoa C&erE TIOOO

I 070ooe Ul Il»oel 00ceeooe

I 000oN ~ 12041 0 NCdt ~ IOE41 0 COCoN

S)SE» I IN41 0 NO42 IAOC41 1%8oN

~a toe I oos Ieo 2 W Oeeo Oos

Toodleoo

2 NEdl

I NC40~ .700»

IJN47I NC47 I NC47

SOOC41 I NC47 0ONotO

I 00Eo00 ~ SOE41 ~ 01041 ~ 00E41 0 IOCoN

2NE4l 000E42 \ NO41 IAOC41 IOICoN

2 ~ '1041

~I IOO I Oee IHl2 Ool see see Towooo

2010»

I)IEds ISIEAO

I ~ I040

1010470 OIOoCO

101247'lw

100040

0AOOoCO

I 0IE470000 o00 0 00E o00 I.~1047 0 000o00

~el2ETe SSOE» INE47 ONEotO IOIE WINe 2 ~ IE

IE

IOIE41

T,ITE»

I I)E»

cooooooe I sooc oe Ul loot UI Ive oeo ee ceeeee

~ 02041 0 NC41 02IE41 0 NCdt 0 NC o00

INC41 IOIE42 270047 INE4t 100Eo00

~ SSC»

Eeooooeo

Uoe I ooe Ioo 2 Oee oeo oel Toooeooo ceeoeooe

7 700 4S

~ 00E4'I~ NC47

) 0 I E472 71047

0 NC47

2 IIEdl

s Dl'040

1 0 IC»tw

) 01E40

)OIE» 0000o00 0000oN 0)SE» 7 1)E»0 000

Coeoooo

~ NC41~ SSE»

~ )104I

~ SSE»0010»

Oeeo 0100 Oooo Itlet oeoee oee oo Ceoeoo

INC41 ~ OTE41 000E41 000CotO

IAOE42 S)0042 IAOE41 I NCoN02104I

ee Uel I Ooe Uee 2 Oee OeO Ooe Toeeoeor Ceeooee»

0010»

) )7047

sama2 STC»

0 SSC» 0 000o00

) )7041))7040 ONCoN ESSE

IW2 ETO I t)041 ) 01041 0 NEoN ) )IE W INI

C. 27

Aopenaa CEeOIC Trees

I 0700 lte Ul IIIOI Ul ltoe ital M OeoorO

\ OOEo00 ~ 02E41 ~ $0041 02lE41 ~ OOE41 0 OOCNO

TOIC41 I OIC42 XTIE4I $ 20041 IIOCrel

ee Uact Col IIN2oal OaerReo Trvoer

10$ 04I2 ~lta 2 ~ \Ea

I ICC41

2 SM47

I SIE4712$047

I SIC4II Iota I scca

SOSC4$ $ 2ata 0 CCCrOC ICORNO $ 2$04O 1 IIE0 002

leal el OAO Ieceeeeot

~ ICCOI 011241 SOCC41 OOOEr00

I COS42 ISCCr42 ICCC4I I CORNO

troreerr~I Uret I Ral IIN1 Rel Reer Rel Trarraarr reseearrt

22$ 24l2 Sita

120047

0 OCCo00 INOo00

0 OCRNO 0 CORNO I 7$24I 0 CORNO

w2CTa SSIC4l I SIE4$ OOORNO 1.7$ E oMIAS )272

~ 01041020E4I

creaoaee I sooc ca Ut IUrrt Ul ltee Rec Moeeaee

~ IIR41 IOtal 12lt41 0OOE41 000ENO

~ OIC41 I OIC42 270041 IOCC4I IOOCoOI

S $104l

ea Urra I Ooe UrN 2 Oeo Reer Oel 7rooorr

ISIEa

~ 1124$

IIIR4S

ISIC47~ $1041

1 012412 SM47

2 ISE41ICORNO

2 SSEa

2 A@47

RORNO

I7124$1 07241

1 SIE4$ 0 CORNO 0OOE

IOOE

Roe Oraaa ICreaeeeooreaaae Oerro 0700 cerro Itret Cewr Itec MCeeorrI

I IIR41 I IOE41 ~ llt41 ~ 00241 0 OOENO

I $$04I I COE42 I $0042 100C41 I.OOENO

I llt4rI $124l

aa Urer I Oal Uae 2 oeo Reer Reo Trarrarer

2 SIC 47

2 Sl240I000 r00

2 IotaSOIR 4l 0 OOENO

1 SIE4I0 Ice No 2 Iota 0 occNo

~ I IOC ITerar2ETa 02cc4l 20$ta 0occNo 20IE aero UOI

C. 28

meme .. mrs~~~MEZZ

mcm~mzmzznmnrmm "

. ~%ED

axe a~~~~

m ~~~~~mazD

~m1m

AOOonos CCoont TI000

2270 10

SOOE I I

~ 01E ltI Sst.ll

000totst

2 DOE II

Isst.lt

SOSE tl

2 em.l I

S DOC 12

2 OSC.I 2 Ssst 12

esse 12

2 SSC.I 2

S DOC 12 2 DOE 12

2 est47

2 ISE4$

I TSEa

OTIC 1$

OTIC 12 0 IIE.I7

2 stca

2 ISE40

SSSE.IO

~ SIE '10

~ SIE 10

I Ost.ts

0 000 o00

~SIC IO

~ TIE 10

~ DSC 10

1.72ta

0 Ostoss

0 DOC e00

~ 2 I E.l0

~ TIE 10

1010 10

Iw ~ seta ~ OTEa testa 210E 10 I Osta 2$1E

Ceooeee

I DOE oss

Isst4$

I $$E4$

I ostaIetta

1 Stt472 ISE47

LOCA eoLOOOe (Ceeeooeet

Costs SIPC Cocos Iieet It~Itec AN CeeOos

~ DDE41 7 ~ l041 ~ ODE41 0OOtoDO

I 00$ 41 2 OSE41 ?ODE41 I OstotN

~ 0104$

~e Lose I w tsee 2 Ooe Oooe w 770oeese eoooosoo

I 0104$

~ etta

2 ISC47

7 seta

loess ~ OIE4$

Tsota0 00t ots 0 Ott o00 Iseta 0 Ntoss I OOE

~eel 2 css Tsst4$ ~ osta s oota I ost eeet IQs

C 30

CSOOIOES CEeono Treea

LCSSS el KTOC eeee+eeo+I

coco oofC CeeN RIOT Eeeee Eec MCwny

0 Coo coo 0 ~ IE41 ~ OOE4 I 0 COO eCO

IOMAN 0 0$047 I OOK41 IOOKeCO

ee IINI Kel Ipel t oee oeee oee Iew eee

I 01'Ea~ INE41

~ 01E 470 Coo coo

I 01241

OOSKDT

0 Coo eOI

~ TIKDS 000Ee00

I 01 E47

000oe00 I OIE47 0CNKeOO

~alt ETI 'I TIE4$ 0 OCENN 0 00K~ I O'I24 Tw eeoc

4 SIE4 I

I 01047

IE E Oeee Eee CeeO $ $OC CeeO TOOI Oeeee Ree MCeeeeN IHlloec Ieeetoee oeeloee lewis~ OSE41 ~ OOEDI ~ OCEDI ~ ~IEDI ~ OOE41 COOERS

TOSEDS I OOE41 21NE42 IOOEDI 200041 IgooeCO

0 TSKDS

I IIEa

2 oooa0OOEe00

2cooa

TW ~ OOEDS ~ OOEW 0 OOEe00 2 INKa

WtEle OOOEa OOOEe00 000oeCO IOIK W IIOI

I osoa

~ osta2 OTE4$

L oe» flee $IIKTSC Ceeo Eeoc Coco IOCI Eew Kec Mceeoeo

0OIEDI SOOE4'I IOOE41 0 $0041 14'IE41 ~ SOE41 012%eCO'I $$KDI SCOE41 200E41 0 OIK42 SOOKDI 2 SOE41 TINEMAN

IOIEDII ~ SEDI

I SSE4$

Teel ~ oee Ipel 2 oee oe& oel Teeeelsr ceeeeere

I ~ IoaI ~ IEa I ~ IEa

1 oooa

S 01KDIt OIKDI 2 01 oa

I SSE4$

Sttoa2 1ooa

I ISKa0

COERCE

I ISECN

2 Iota

0 Coo coo

I ltoa

I SSEDI

0 07Ka

I seoaS SIKa

0 OOE coo

s Sooa~ ISEa 0oooeee 7OCEDITw OOOEe00 OOOEeeo

I INE.ITW 2 0'le I SIKDI 0 OOEeoo 0 OOEeeo ~ ISO eel IW ~ ISO

AUCIOnac CEaeec 27000

Epo csl csoo sssc ceoo IUCI cease cee Mcoswe

SSCE41 COOE41 4 ~IE41 SANE41 COCCI

llOE41 IANC41 SAOC41 2 INE41 IAII%400

1.7$ 044

~a Ioel I oae Uac 2 ow owl Ose 14Nosar ceeaeave

1.7sfa

I OIE le~ 2SC 14

7012 IIlACC.II

SAIC I I4 OCCaoo

SICC ll

12SC 10

SSCC 11

l SOE.I I

I oscaI ~ I2« 0 CNEaoe 0 OOE aCN OOCENN 1 Wf

~W 2 CTS I ~If« 0OCNaeo 0COEaCN I OIE Teeea Icos

0 NE

IE coco CsSC ceoo clos close Cee MCoeeee W Ieell Oee Uaeloao OeeaOee Troaeor

I OCCeOO ~ 00041 OOCCaCN CACC4t ooef see

C.CTE41 ICCC41 IANEaoe SCOC41 IANCaOS

2 ~1241 2 ~Ic«

1 04E4$

0 OOC eIN

~ elfaOCOcaCN

0072« ~ OlcaOCCCeoe OOOEaoe ~ Olfa OOOEKN

~aal2CTe 2 eec«0CCEaOO OOOENN ~ 070 WC NOS ~ 072

S ICaeesoeel

IE cooo slee coco caol cease cse Ac Coeeoe

0 eef 41 \ WE41 4 $ 1041 ~ OOE41 0oocaeo

~ elf«1 04E42 I 01041 24NC41 I eecaIN

ITTE44

~ $4E4I

w Uae I Oee laae 2 Oee Owa Ose Troaeeee

0 $ 7244

~ 74E41

I 41044

I Slfa

ITIE472 71047

Teac

lTIE47~ $40«OCOEaee Ooocaee 27IE47 000faCO ~ $4244

I INC IroaNSCTs 044244 000CWO OOCCWO STIE easeaes

~

COERCE

I Sec«

~ 11241

~ escaIesca

~ 7IE47

I 440470 OCcelN

~ 41 441

SIOE41 ~ $ 1241 000041 000caee

244042 I CNC41 2ANE41 IOCCaoe

~ Sec«

7 esca

7 77247

Use I ow Uaa 1 see Ceca Oac 7swoon ceeseaesl

I 44047

0 OCC see I $4047 OCCN400 4SCC

0 OOE

Teaal 2 ETe 4 Sec«0 CecaOI 0 ICE aoe I 4404 ease INs I 44E

CD 32

Aooenaa CEvert Trees

~I Ipel I W Ioe 2 OII MlOol Ireveler cesaewe

~ NE41 ~ IOC41 ~ IIE41 0OOE41 000fr00

TAIE4I 2 INE42 IOOE41 240241 loofra

I0M'222a

SSOE41

220E4TTW

OBOE ool

l SOC41

SJOE41 0 Iefoyy

w1 ETI 1 olf» OOOO@XI 0 OOENO 2 TOE41 w Iror llof41

~JSE42

~ SIE41

I 02241

~ 1224I

~ IIf41 ~ OOC41 0 SOCKS

IOOE4I 2NC41 IJOCKS

~ SIE4T

clif a

IIIII ao IIvl2 Oel OI» Oel lr arel'vswvee

Tw O.IIE41 OOOENO

1 OM4IOOOEKO 20lfa OOOO~ ~ Sa4T

~ ISE41 OOOEKO 0 IOENN lolf Teal llov

I IOE41 IOOE4 I

1.10241 I OOE41

1 2224$

IOCC4I OOOO NO 0SOE41 OOOENN

1 OOC4I I StfkI LSOE41 liefW2 Olfa

~I Iovl I M Iovl2 Oel Ovol OII Trover

2 Nf40

0 0%HO

12lfaI Sita ~ .I Ifa

I ISE41

~ IIE41 ~ ISE41

2 SIEa

222E41I SIC 41 I OIC4T

0 OOOO

222E aIosfa

I 1IC 410000~

11IC4I

Ooof kO

2 IOE4T

000fm

I Sofa ~ ooEa

~ slfa0oof HO

~ ~ If41

Ooof~~ ~ 1240

0 Oof~ 0 Oof F00 022E4T 0oofNO

Wlfll 220Ea OOOE44 OOOENO ~ 22E4 WNOF

C. 33

AOOenax CEIOnl T100$

1.10040

LCSS et SIPC

creeeeee I DJtc Re Ul 1001 Ul IIee See MCeeeeD

~ l2041 IOOEeDO ~ ~ 1041 I00041 0 ICE eCO

IANKdl IASKe00 IDDK42 I OOE4'I IDOEeDO

~I Uee I See Uee 2 See Sen See T~eer

I 11041

12IE400 DDEr00

IJIK«I.ITS«

~ sma

I.lIK«

~OIK«

TDUI

2KIE«1220« 2200« 0000eOD 1020«

LOSS el SIPC ICeeeeeeel

Ceeeeee

I OCKeee

I OIE«

Ceeee SftC Ceeee KIOI Reeee Ilec MCee0el

~ DIE41 I IOEdl IOOE41 0 DOE@XI

02CE4$ $ 0'I042 IDCK41 IDINe00

I 02E4$

~0 Ueel I see Uee '2 Sel Oeee See T twirler

I 0204$

~ le E40

~ 020«

I IIE40

$ 100 10

0 CCKe00

2 I IE 10 $ 1IK ID

ODCKe00 OOCKe00 2 IIE 10 0000e00

~eel 2 KTI I 1104$ 72IE40 IDOEicD $ 100 I Tee0 MsIOOE

C. 34

E Oooo Roc Coeooooc I $70C 8 o SIIC Oo Ul IIIOI US ltHI Ul Iloo Roe U2 %so Itoe MCoosol oo UNt I oec 104 2 ooc Oocs Oos Ioooosso coooooos

~ 07E41 IOCK41 ~JSE45 ~ OK41 ~ OK41 ~ IK41 0 ~ IE41 ~ OOE41 OOOE45 000Eoll

I OOE41 I IIE45 2DIE42 I OIE42 laE45 S.OSE42 200047 100045 I OKo00

1772»24'0

IIOE47

IsccaIOOEo00

I Ossa

000Eoe0

I IsE»

S ~ SEa~ IK» IIoca

s sssa

ISK47

I.IIC411.1 0247

OOOEoCO

I IIE47

s Isca2 71240 27$Ea

s 77Ea~ 710»

I 15040

IOOEo00

IIIE»

S ISE»

I IIE»0OOEo00

~ .IIE40

OOOEo00

I 11245

1$5C41

1 72K 10

2 SIE.IO

Ills 11

IME 10

217E 11

0lsE II

I ~ SC 72

IOOEo00

2 $1s.t I

~ IIC I I

IOIC o00

I OSE 11

2 IIE.II

ICOCo00

IOOE o00

~ IK lt

2172 ~ I

I OSC. I1

2 SSE4I

Isles

2.$ $E4o Co%COP

I IK41 12$sa I eSE 11 22K45 2$ SC

1000 ICrsss4soi

crooooo cooasspc coooooset AooooAoc McsooolSSIE41 ~ $1047 ~ OOE41 100041 000so00101C41 10K42 100045 XOOE41 I IOEo00

I IK451 01K41

oo lose I Ooo use 1 Ooc Oocs Oss tssooooo Csoooooc

I IK41

5 ISC45

225K» 5 Ssca

~ 11C47

0IKo00

~ 11E45 I 11241

205245 OOCEo00 OOCEo00 ~ ISE47 IOOE o00 2 OSE

IOOE

IO012 Cls 2 20045 I IK47 22$K4I ~ 1124 oOO ~

C. 35

IODfe04 SOOE41 OODC41

2loca I IDE41 ?00441

IIIAOI IOIIIOI IIIODOHDI IROeellel DOCeeeeO

~22441 ~ $0441 ~ 00441 IN t41 0 NE41 0 JDC41 ~ DOE41 4 ODCa74$ 441 0NC42 201442 240441 IOIE4$ $1IO4$ EIOC41 IEOEKO

ID« I OeO . IPN 2 0«OeO Oel Itenaw

I Olf4l

I 0144$

1 4 7E47

~2SE47

7 «447

I 01447

$ 2$447

0 Sita

127447

121E4$

000teOO

~ Afa

0 OOC oOO

12IE47

22 IC»

0 OOEeOO

7 IDE47

0 DOE F00

I SIE40I.ltf40

~Dtfa

lltta~ Ata

0 004 e00 0 ODE e00

SDOE» 1 Sita

12$ 44I

OIOteOO

1$ $4»

I 02E41

I $ 144$

I IIC4$I ~ 1 f41

1 17247

7 ~ IC47I 02E47

I SIE47

~ IIC 10

24lf47

1llf41

2004.10

I Sst 10

I 01441

221t.14

~ ttE.I I

121 COO

111 E 11

2 $74»

~ IIt41

1274»

0 IOfe00

$ 77E 11

12IC,IO

0 004 e00

I IIE. II

~ ~ IE44

221E.I I

0 004 eIO

I ~ I E41

I~IE47

1 S104l

0000«O

$ 02E47

I 0 If47

12IC 10

127E44

$ ttt 11

~ ~ 1441

111E 11

INE47

I 2$EOII iota

S eOC»

I Iota

SIDE�»

I lst4$

2 IIC4$I 01444

I OIE4$

2114.ID

1 ltfa

I DM.IO

I Iota

0014eOD 00$ 4<0$

211E41

I DIE4I

0

DIEMEN

I 414»

~ 0$4.10

4 DOE e00 0 IOEe00

I Olt4$

1 Itf41

C. 36~ Dtt.I \

AS4ard CandEEOI

COOO 4Aooonaa CEoorx 2roos

12104I

SSSE.IO

12IE 10

ONE ll

2OIE Il

~ 020 I I

~ OOE.I I

2 OIE.I I

0 Sos ooo

OOOEooo

ONE II

~ 02E II

2OSE II

22IEaI.TTEa

OOOEooo

0 oTE41

0 TIEa2 osoa

IOOEa0 OCEooo

IOSE»

2 osEa

OOOEooo

Iossa

TSTEa1sTEa I STE4I

0 INEoso 0 IOEooo

2 OIE41

I 02041 I 02241

Tcoo S 11241 I ssoa IAE41 ~ OIE4I ~ NE4I 2 SSE4O

~ soE

Eeoeoeoo 1000 ICroeooool

ceooeoo cooo sf to coco RIK Roose Iloo a 00400I 000~ SIOE4l 0OOE41 ~ 00041 OOOEKO

I 0024O SOOE42 200E41 XSOE41 loooooo

I NE4oI NEOI

vta I ooo UM2 oee sea ooe Trow ceeoooo

I 1 Isa1 slsa

I ossa'I 21240

0 000410 000 KXI

~ NE41

101Ea

12124I

~ OSE41

0 000 ooo 0 Ooso00 0 NE41 0 000oso I SSE4O

~oo 2 Elo 2 12E4I ~ NEw 0 ISEOT I 21241 eoet&S I2IE

C. 37

ACOenaa CEven( Trees

I OOE eaa ~ SOE41

~ SIK 10 1 SOK41

0 caf.la

I SOOC he SFK'. Ee Ut lect UlCHII Ul eea Sec Ul lice Oec MCeeaea

~ 02241 a OOE41 ~ Saf 41 ~ 41E41 1 ~ If41 1 OOE41 1 COWl 0 Ocfees

I SOC4I IOOC4 I $04042 Ksaf et KCOC41 1 OCC4l 100041 I ¹Reaa

SSOC.IO

~I Uee I cel ION 2 044 ee¹ eec Irate

S 20E la Ceeeeeee

Ilaf 10

~ ISE \S

I IOE 10

$ $1E 12

IOIE.IS

~Off 12

~ 22E 12

~ NC 11

S Oaf ll1 OSE.I 2

I.ICC la

4 ~If.tl

~ $4K-Il

0 Oafere

2ssf.tl

llsf.ll

440E 12

4 ITK.IISSOK.I 1

~ 14E.I ~

220K.IS

220K 12

0 ISK-N

Oscf ece

2200-12

220K.ll

0 Oofete

2SC¹ Il

012f N

220E.I'I

~ Slf.tl

211C.I I

'I Nf.lI~22f.l~

$ 22E 14

2 NK.N

ISIC Il

I TIC N

ISIC-\ 1

0OCCesa

Sllf 14

~22E.N

I TIE.N

lllEN

~22K I~

INK N1 ~ IK 10

~ SOK.N

244E N

112K.l ~

I TIE.N

1 222.1$

TSSK I~

0 OOC o00

I 1 1 K.N

0 OOK~

TSSE.IS

I TIK tc

I 12E.IS

llsE la lllE 12 1 ~ IK 11

140K 10

1 clf-10 $200 10 0 NK.I~ IOE I

Cteeeee

I OCEVIO

$ 20C 10

$ 2OC 10

$ 2OK 11

~ 01E.I I0 IOC.I2

S ICC.tl0 eef ece

~ lsf 12

oeee saac oeee ktet Ilease Sec pa Ceeeea

~ OCC41 4 SCC41 IOOE41 Oaaf eaa

~ OOC41 SICC41 SOOE41 1¹¹e¹l~ 4IE Ia ~ OOE 10

1 SSE. I I

~ IOK 12

Uee I Oo4 . Uel 2 044 ee¹ eel Tnealec Ceeeecet

~ Isf.llTeer 1 IIE 10 0 COCKS a IOE 11 0 elfesa Slee.t

Tates Etc 0STE 10 lltf12 IStf.tt SSIE.I etalt¹e 1 0IE.I

C. 38

Aodosdds CEvoro Tloos

IE

I ddo cod

\ ssc4s

I SIE4l

creeeoed sofpcoe Ullseooes MceeHo

~ $7041 ~ OOC41 ~ OOE41 O OOOO

I ld041 I Odool 2DOE41 I IXCtdo

I 1lE4l

~I vte I w lo42w wew TrasH

I led4s

I Tsda

I sdca

0 000 tdo 0 Odotod

1 01047 1 OSE47

$00047 0 odd odd 0 ddd too I IIC4e I SSE4t

USCA treeoeeet

cresset coco OIPC Coos Itrol lloeee Iles MCeetso

I IOEtdd 00004l 7 01241 0 OOE41 0OOCtod

I.ll24l I OOE41 10SC41 120041 I OCEtoo

I 0$24lI IlCa

0 020aI IlEa

I ~ IEa2 SSEa

~ TSC47

~ 1$247

es teel I w Uss1 w Cess w TtasH

I.0IE4I

0 OOCtdo

I TSE47

TW 1.1IEa 0OOEtdo 0 OOC tdd ~ TIE 47 ~ IlE

W1 ETI I Stda 2 00247 0 dodtdd ~ TSE TW ltolt

Crssessd I SPPCOI UI IOOT UIOeeOes MCeeeoo

Ioddtod ~ STE41 000041 OSSE4l ~ OOE41 Oodotod

1SSE4I I ll241 SOIE42 IOSE4I 1COC41 I OOEtdo

1 SSE4l1 SSC4s

es lese I w Uee 2 w dost W TrasH ceossts

2 IIEa Creeeeee

0 ITE474 11247

s ITEa

~ ISC47

0 01ca

I IIE4S0 OOEtdd

I SIE44 s llEa$2sca s llda oood too 0 odd rod 1 SIE4l 1 SSE4e

1$ 124l

1 $ 124l

I0204S

~ $20a

I0$241~ 02C4'I

\ 0124'I0 OOE edo

ceoosrpc cess otot oeeeehes Mceetoo0 IOE41 ~ OOE41 ~ OOE41 4002 NO

100C41 I OOC41 200241 IOOCtot1 eed4e

tdteeooee

~I tete I w Uat 2 w wtw Trassrt cosrtste

~ $2Ea

~ 02047

I 01247

2$ 124sI OI 047I OI 241 0OOEeod 1 ad

0 OOC

~eer 2 ET I 1 IIEa I llE4I 0 doc too I Ol E4 w s&$ I IIE4

C. 39

Apoenea Cf.self 'frees

lese st OWS

creeweo 151pctte UIIIHn Ulnepttw AOceesrN

II2541 ~ 00541 ~ OIE41 ~ OOE4t OOOErOO

I.IIE41 2WC42 I.OOE41 20OC41 IOOErOO

~a lan I W Ieet2W eon W Tteeer

12tf4I Cteswee

I 1154$

1525411 NE41 1 NE41

0 OOEr00 0 INCrlN

1 01541 I0SE40

1.12E40 I0104I 0 OOE tOO I 215 4I

leal el Ow5 tcteeeeol

cross so csee Eppc corre knrt nwse nel M cessrN

I 00ftOO ~ IOE41 I00541 ~ OOC41 0005 a00

12$04l 2OOE42 1.00541 2$NE41 I OOCNO

W Ion I W levt 2 W Wa W Treoer Ceeerorc

2 SIEa

2 $1541

$ 1$54$OOOENO

S ISE4$ '

INE41

OOOEHN

12$fa OOOEKN OOOEaot

1 tsfa~ 11040 OOOCKN I 2IE4I

~ttt2ETS ~ Wfa 10$fa OOOEaOO S llf Watt&I

~2 115

Peso Orew

rf ctsswoo I 51 pc Re Ul rttoa Ul tile nec AAcsswo

I ICE HN IITE4t $ 00041 ~ ~ IE41 000541 OOOCHN

2 IIE4l I 11041 2 OIE42 I 00041 2 IOE41 I OICetO

2 tlf4I2 ~ II4I

2 ITE4$2$1f4$

INEOT

w Urn IW tore 2 Eol Eeet Eel Trwsser

2 IIE4l

SSIC41

'0 SOC4I

I $05410 INCrOO

Teer 20$fa I SOEa OOOEHN 0OOErOO 2 1054l0 OOE

Crwlw

21IE4l

2 \If4l

~ IIE4IIelfa

INC OT

1 $ 1541

~ TIEa0 Otfaoo

~rw Orsw ICsseoeotcarte 5tpc csee IIHC noose nw Mceearrl

S IOC41 0 OcC41 ~ OCC41 0OCNKO

2 00542 I OOE41 200541 I OIC arN

I IIEOI

~I teer I w Uae 2 w Oeor w Treelst

2 NE4l

10IEa1 $ 1541

0000 ttN

2 1$54I~ loca

0 000 HN ~ TIEa 0 OOC eOO 2 I IC

0 OOE

Tnot 2 ETI Islf4I I $0041 000CHO ONE esel twt I 01E4

~~~~~~~~~~REZR~%KXR~

REZl

=g=R~~~~~KKQB~

~~~~MBRH

~~~MUSD

ACO«NS Ctests Trees

I TIEa

I sita

~ Cst.l I

102f II

SSSE 10

S ICE 11

211E ll

0 120.12

~ OSE.I2

0 CCCe00

SOSE 10

0 Osfecs

CTTC.I~

0 OOCNN

0 IlfII

0 COENN

SOSC 12

~ SCE 10

1 TTE.II

1 1st ll\ 20E.IT I TSC ll

~ seta

2 «C.l 1

112t 11

~ SOE IS

2 Tlt.ll

0 COEe00

~ SOC.I 2

2 TIE Il

0COE I)

~ SIC 4I

1OOE 10

SOOE 10

I COC 'IO

0 OOEe00

1 Olt4S

0 OsteCO

~ «E 10

S 000.10

2 Olf41

I IOE 10

I TIE.IO

1012 10

10'lt '10

0 OCCe00

1 012.10

1slE ll1 SIC ll 1 SIC ll

~ l1 f41 I ~ 7f 10 1 SIE4I 0 SIC4II 0 1041

Ceeeeee

100t 00

T.slsa

1 ~ IE4I

1 SIC 4'Il ~ 1041

2 TOC41

I 7SE47

~ lsta0 «Cess

0 lsta

LOCA eCLOOP (I'ceee4eei

sees SCPC CeeN OWI Oeeee Oec AS CceNN

0OOE41 0llt41 0SOE41 OOCteCO

I COE41 SSIC41 SSOE41 \ OCCea

0 1st a

ee vec I Oec vec 1 sec sea Sec Tleeelse ceeeeec

0 Tsta

~ ~ I E47

I 11041

~ lsfaTclca 000tess OOOEkN SlSC40 000te00 1 ~If

~ ~ TE

WTETI 021ta 02SE4I ~ llt41 SICC WM

C0004

AOOOnaa CEvoeE Tloos

ceeeeeec I 0/OC Ee Ul AIOI Ul Oeo Sec ek ceeeeo

I Ostecc 002241 000te0$ ~ ~IE41 SOOE41 000te00

1.1$E4$ I.1lt41 I 00te00 ISOE41 $20041 ISOEe00

~I Ueel I sec ISN2 see seel w sceeen

1,1 1041

I Sit»

I ssta

I ssta121 E»

0 Ooteol

111ta

I 0l E41

I elt41

22$0» iSooty

IPSE»Ieol

0 00te00

1200» Issta 0 Sots I Sita I 1st0 OOE

IOIE4$

~ 0lt4$

loss el Eeoc Ic esaoonceeo sloe ceca EIOI seeee Rec Ak ceeeeeo

0 00041 000041 ~ OOE41 0 00te00

102242 I OOE41 100041 IDOte00

I COO 4$

~I Uee I W IPN 2 W Seel W Teealee

I OOE4$

I 01241

I OSE»

I OSE4l

Iceo I OIE4$ 0 00te00I OSE»

0000+00 102240 0000e00 I 0 IE

000te~Ill2 Ell I llt4$ 2 Sst» 0000 00 I 0$ E IIIIIIete 2 esE

C. 43

ADCenOu CEvent Tloes

E Peeehec

IITf41 'IOOE4I

2$ $$41 I 00$ 41

cneeeee I 07pc 14 seecce vl lect U2 IVII Ul Ilee 14c UR 74eoec Mceeens

0$2$4I ~ SOE4l ~ IOE4l ~ 11$4l ~ elE4I SOOE41 IOIC41 OOICNN

~ lcf41 Self41 ROCE42 201042 $.0)$47 ~ INC47 IN)%41 100te00

I ICE4)

~l teecIW w)W OenW Teeev

I Ist4)

)RIE4e1 I7C4e

02 IAS

1 ~ TC4I

~2l2a

) 0)f47

2 STE47

$0)fa

1 $2041

0 OOEetN

1 ~IE4l

IO)0472 lOE47 1 lOE41

2 ect471 et%47

1 lOE41

120E47

IO)ta

1 lOE40SCOE4I

$20f41

10)fa

000tetN

~ Teta

I70040

ROTE IO

2 Ilf.le

0 Iefeee

207E 10

I00tetN

I0)E II2 Ilf.lI

2 ITE 10

101t 10 RITE.II

1 SIE4)1 SSE4e

207E II1 ITE.II

2 lOE41

RITE II

2SSENI

I 71$ 4I 2ITE 11 R1lt41

Creel elI010 4 I

I SCE4)

I SSC4$

1010411 Ssta

10)fa) llt40

I000 eee

ceee slee ceee seen 14eee 14c MCeeeeo

~ 1024l ~ OOE41 ~ OOC41 00OCe00

100E41 I ett41 1.00$ 41 I ettetN\ 02041

~I Uec I w Ilail2 Oec oen w Teeeelee

1 leta

OesteeN

7 Set 47

I ISE4$ 000te00 7 Iet47 0000 ece

Ieeee) Ele Isct4) 1 eef41 1 TIE41 1 IIC4 Teee 407 I IOt

C. 44

IDOE 45 1 OOE41

I 00041 )SOE45

oeeeeeee \ 0504 Ce Oaoc w VlNOI 172 Iecl Ul Nes oec Ut Iles Oee Moeeeso

~ 02045 ~ 00045 ~ 00041 I01041 ~ I1t41 ~ OCC4I ~ «E45 0 leCeoo

ISIC41 IAOC45 2 oet42 EDOE41 IJNE45 SOI%45 200045 IODEeoo

~I Ipal I Oel I&l2 we Oe«oeelaisser

I 01141 Ceeeeeea

21124$

~ oet45~ IIE45 ~ Ilt45

2 $)04$

2 IIC40I 7)E40

1oat45) IIC45

)OIC41

I 070400 Oat coo 0 Oat coo

I 02040

4000«e ODOENO

I OTC40

) SIE40

) IIE40

1 let40

) 10040

) IIE40

S 11t40

'I ett401.12E40

1 17t401.17240

7.17040

1 ITE4$

t SSE4e

~ IIE4$5.11t4$

I OOE40

I 71041

1.11E40

~ TIE.IO

~ TSE'l4

1470 la

I TSE.la

1«e lo

11$ C.la

0 OOC coo 0 ooa coo

1 52040

7OOE.14

Daoteoa oooteoo

I TSC la

ooot«e 000040

1000 la

400ENa OOOO«e

I 7$0.10

TOOE \a

1 11041

11$ E la

I TSE 10

11504$

I TTC4S

I SIE4$

) 2$047

I let41I tlE4$

I )IE41

2 IOC45

) SSE40

7 ~ 1041

2 IIEee

7 I1t41

1 00045

1 IIE41

0 Oat coo 0ooteoa

5 1 1241

I 11E40

1 IOE41

7 l1t41

I Tata

7 III41

1IIC45 1 IIC41

2llt412 1eE40

2 TIE4$ODOC~ 0000~

) 0)t41

I 1tE40

~ ITE41

~ «IE lo~ 11E 10

C g5It)Cia

OODCHe Daoteao

~ IIE40

~ IOE \I

000teaa Ooageee

OOOO)eu CEeOIC T ICOS

1222.10 1220 10

121241

0 122.10

~ OOC40

)22E 10

OOOEe00

~ OOC.)0

122E.IO

0 OOEe00

OOOEKN

~ OOC 10

1220 10

0 tlC41000Ce00 0 OOE etO

0 TIC47

027Ea 02)Ca

).IIE40

02)Ca

~ 00047S I)047

02)Ca

0 OOEea

0 17247

02)Ca

I 2IE47

~ IIC4)

0 1 7041

120047

S 17241

0 ICONS

12SE47

0 OOCe00

S IT E41

~ ISEa 1 SIC47

12IE47I TIE47 I TIE41 2 SSE41

Oeeeeee

1000@0I 11241

I )IE4I

I 11040~ OIC40

I recaI 1)Ea

~ t00 410 1004)

Ceeeeee0 LOOP ICe tee 4ee I

Oeeo SIPC Oeeee RIIC Iteeee Oec 000eeeee

I SOC41 ~ 00041 0 SCC4t 0000e00

IOOE42 200041 2 SOE41 I OOEeOO

I SSE4I I OSE41

~ OIEa

»ssa

0 OOC ISO

Ipet ~ Oee Ieel 2 Oee oeee Oee lreee tee Oeeeewl

0 tOE41

I 71041 OOOEeIO OOOE N ~ IOE47 OOOEe00 I TIE

lw2 Efe 2 IOC4e 0 I)Ca 1 20047 1 2004 wM

C. 46

APO<IC<a CEvert TIOOS

ECO Aec

104EKe SOOE41

0 OOE 10 0 OOE41

c<ssssec I STPc Ae OTOC Ae vt AIOI v) A<01 Vt Ace Aec Vltoe Aoc MCoco<0

'1 O)COI 0OOE41 ~ SOE41 4 01141 1 'STE41 100E41 1 OOE41 OOOCNO

200COI 140C41 1 OSE42 $ IOE41 2IOE41 ~ OOE41 )OOE41 I SION'

SOS lo

es teel I ooc Is<4 2 Oec Ooc< Ooe Too«s<o

1 SOC.IO

I ~ SE 10

'I ISE.IO

2042.tt

I I)C 10

~ OOC 12

20)C IIt)IE II

'I eeE I I

T)SE 11

~ Tst.ll

120t 12

$ 04C 11

1 SIC ll

1 SSC 12

I.ISE.II

~ TSC ll

1 TTE.I1

I OOE I')

0 ISO<40

I ISE 11

I IM.IO

~ Tst.l)

0 TSE.11

0 OOE<40

I )St.l I

lilt12

4 Oct.ll

I oot.l )

I.ISE.II

TTTC I)

I SOE.I1

1 SIE I)

OOOC.I)

I SOC IS

1212.I )

40)t tl

)204 I~

22)t.l 1

2)IE le

$ 444 1$

22)t 11

~ 0)t ll

000ENO

~ OOC 1$

121C 11

4 OOC <40

21st I~

2222 ll

~ 0)C.I)

0444 IS

0 IIE 10

~ ttE 10

I 214 I)

~ 044 I~

)s<C I~

0SCC le

0 002 <04

)Ssl le

~ SCC I~

I )et<TO ' ISC.II

1 Oct. I~

4 SSE 14

I OSE 12 ~ OSE.IO 1 Sot.lo ~ SOE. I

I TSE.ll

4<sos so

I 004<00

~ ) SOE 14

lSOE 10

)SOE ll1 TIE 11

12)t 11

~ littl

0 tlC 12

4 I)C 12

SOC IC<ooseoe

CeoO AAA Aoee< Asc MCoo<so

0OOE41 ~ SOE41 SOOE41 OOOE 401

I OOE41 1 $4E41 ~ 00$41 I OTC<40

1 ISO lo l ISE 14

)TIE tl

0 000 <04

)eec 14

v«e ~ Ooo Is<4 2 ooo osc< ooe )<costs<

004EKO 0004 40 ~ 11C 12 1 SOC I

Te+<TETI ~ SOE 14 114E II IOK 12 Selt I te<ONOF 1 ISC I

C. 47

~ '

AOOenau CEvent tleee

IE Cneeeeo I SSOC Ne Ul Nee Nec MCII44 ~a Iaae I cel Iavl 2 Cet CIN Cel Tace 4

I Coca ~ 02141 4ooc41 socc41 Oooom

I SC41 100441 SSC41 I OCCaa

I OTE4l

I SIE4I2 121a 2 1244$

'I OTE»

~222a

1 SE4$

IW

0 OOEeCN

1 SEES

2 SE4l 0 OOCatN ~ 071»4 001

I 0744I

~ COE41 7 ~ IE41 040141 OOOCeoo

I OCC41 20K4I ttNC4I I OOCatN

0 4714$

ea Unl I eel Uwl1 Oal OIN eel

0 OTE4$

I OTE4$

~ IKa

11SE400 OOCaCN

~ SEa

Inca

~SOC47IW 14744l OCOEaoo

~ ICE41

0 OOC NN ~ SOE47 14704l

feel 1 CTI 131141 1 SC4$ 0OOCeoo ~ SOC47

WILLI

2 I I E

I OOEeoe

2 0Ã»

2 0$14I

Ceeeaael I STOC Ne Ul loca Ul lleo Nee IO Ceeant

~ $1E41 0 SOE41 T.SI 141 $ OCC41 OOCEKN

I IIC4'I $ 4IE42 2 INE41 0 00441 I OOEaoo

2 121 4l

~ Ol E4$

EAOI4e

~a Iaae I Cel vea 1 cel Oen Cel Teee4 ceeveeeo

1 I714l CeeeeW

~ 4114$

ISEa I osta

IIIENT227447

222247122247

222147

0 COO aoo

2222 47~ 20E4$ 222247 0OOEeto 0004eoo 1ltE» 1 0$44I

1 Toe eeeeeel

Caaeeae Ceee 0700 Caeee NHN New Nea MCeeaee

I COEN' ICC41 0OOE41 ~ OOE41 0 OCNaoo

1ltE4I 100142 1OOE41 100C41 IOKaa1 IIE»

2 ITE»~ Sita

~ escaS OK41

~ SC470 OOEaoo

0 IIEa

~a aaaa ~ Oel leal 2 Oel Oeea eel Tleee4 ceeveeee

I STEa

4 OOC coo

~ 7 1 caTW 2 I1E4I

0llta0004aoo 0OCEeol ~ TIE» 40CChN ta2E»

4 BEIeaa 2 CTI t SIE» 222247 0 IINcoo ~ IIE eel ISI 2 IK

C. 48

A040UAIS OorstttllC400 S

OPOOnare CEvert Trees

Lose ol SWS

I STOC Ae UI AAA Ul Aeo Aol MCeeeoe

~ $2241 ~ SOC41 1 ~1241 0OOE41 OOOCr00

~ 44041 0OIC42 2JOE44 $00041

INSENSE

124044

eo ION I Ooe U441 044 Seer Oeo Trerore

12104I

I Octa~ 01E41

221141I 14141

~ 141410 OOtr00

I IIE41

I,llt41

?Ilt4$1.14041

~ IIC41 000teIN 000te00 124244 I 44144

Uee I ooe Iere1 044 teer oee Treoelrr

I 00trIN 0 10041 ~ 00141 ~ OOE41 000tr00

12l044 '1 00042 I OOC41 2TNE41 I 00tr00

122044

12424l22IE40

2 4IEIN100041

1 4$E410 OOC rOO

~ SIE40

122244

12404I 0000400 OCOEr00

4 Sita4 0004N 0 00tr00 124041

Teer41 ETI 14004A I.IIE4T OOOEr00 4 Slt TIAIAto I 04041

Proo Creel

creoeoee I sloe Ae vl IOOI Ul Aee Ael Mcoeerre

I 00tr00 0 $2041 0 SOC41 I 01241 1 OOE41 000tr00244044 ~ IIE4l $ 04042 200E41 SOOE4I loots

2 \ IE44

Erraare~I Lore I 044 Lore 1 044 teel 044 Trawler cooreere

1 ITE44 Creeeeee

1 042411 ~ IE4$

I Il0 44~ 41040

1 01 E41I 01141

I 010410 000 r00

I OTE4T

1 IIE4$

141041

I 01141

0 044 ree

I SM411 0404$ ~ IIE41 0 Oetree 000te00 11IE44 24IE4I

I 00t~1 I I044

2 I I 044

~ 111 4$I ~ It40

~ 2M41220042

~ llta0OOC~

~oo trool ICoeoooor

coco slot ceoo Arel Aeooe Aoe Mcoeoee

~ 40041 ~ OOE41 ~ 00041 OOOCo00

1 OOC42 I OOE41 100041 I 00te00

10TE4I

~I vee I oee Ieel 2 Oee teer 044 1 reroll ce ~ rrrrre

2 0TE44

I~ 1041

~ 41140

1 llt44 000troe~ 41140

0 OltNO ~ 41044 000tr00 111044

TeWTETI 244044 ~ 01041 000tr00 ~ ~ 1041 TeeallNO 2 TIC4

I

!

~~~~~~~RDC3~~~~~mZEBMZEZQ~mczn~

=R=E

RK -WW~azzg

~~

~HX3~~~~I l

AOOenaa CjeWk 1 COOS

ICOEeN

IDCKeN OOOEeN

INEe40

IDDEeN

ODOEeOD

DOCEeN

IOKe00

4 NEe00 0 OOEeN

IOOEeN 4 DOWN

0 DCKeN

ODQEeN

ODDEeN

IIIK4I

0 NEeN

IIIK4I

~ SIE. I 0

~ SIE 10

ISK40

IDIE 10

I DK.I0

I NE.II INK Id

SSIE ld

~ SIE.II

I NE.ID

~ DIE.ID

I DIE.I0

OOKeN

OOKeN

~ SIE 10

INK 10

IW IIIE44 I Sl'E ld ~ IIE44 I NE ID ISIE40IOIE.SI

LOCA afLOOD ICnwoeAcceeeee CeeoIIIC CeeesloN IIeeeeOec MCeeeeO

I DOEedd ~ DOE41 ~ ~ IE41 IIDE41 OOOEeN

~ SIE4I I DOE41 I IK4I SSOE41 ~ NEeN~ ISK4I

IDIE 40

~ COE41

~ SIC 41

1 IK41ISIE41

I IK41I 10441

~ ISEa

2 IIE41

ODNW

Leel I Oel Ieel 2 Oel ~ Oel Treneler

I IIE41~2Saa IDOE edd ~ 10441 OOKe40 ISIE

W1 Kle 01144I ISIE 10 ~ ll040 I IIE W INI 12SE

C. 51

ErEIRIZ-BZBE~S~~~~~~~K~BEEB&r EBLEKMRB~RZRBKKKEZE~~~~~~KZBBBRlHHERXKKKKBBKKM~~~~~~&KGB

&K%I WXKK~~~~ .

IE~KZBBBKBKIRKBBRZUg~KGnaHmaamu&eaaaum

~ ~

,~HrZBKEBHEZBBBIZ BZB~B~~~~~~~EEEEESRl~,KZBKKZEEKEiHIRZEEKBRBRBHE~~~~~!RBKBRBKIRZKBREEBKZRERKR~~~~~KKBS~~~RKK3

~X~~ZH ~~ Qe.

~KZBBB'WEZK ~~rKKI

E3&CKHXBRXHIKKKRKZR

',~GB~XB~HKi;ZUZER~IXii

~ ~

'REIZBrEEIKKBBKZKBKKBBKBKHIRZ-BB~~~~ rEKI~~rEEB~SKI

RE% KEIBB

RBHEi~ KZBEI

WKKI~X3 Rm22

~~i. ~ )

~aHH ~KZZE

WKK3

~ZH~K3 RKZE

amrzmrzBzaazzErrrRZ53E

WEDBWKZB&KKl,ZX~

Appontttc CEvent T1005

Eta Rec

~ OOF 400 ~ OOE41

SQQE40 2.00E4 I

cone sfpC cone RHR Reoor Rec Ak cooano

0 QOE4I Q.OOE41 T.OOE41 0 Oofroo

2.00642 1 OOE41 SOOE41 1.00froo

fnoarero

oa Boer Boa Trenere

1 QQE45

3 QTE49

S 15E.IO

1.05E 10

3.18f 11

223E 11

0 S4E 12

0 5lE.12

2 QOE.10

223E 11

0 Oofrob

I SQE40

9 SlE 12

3 QTE40

S QSF40 0 OOEH33 I QQF

otal 2 ETa 1 SQE45 3 QQE otal HBF

LOCA (Croaeoadl

IE cone BFpC Corre RHR ReoenRec AQCocrmo

0 97E41 0 50E41 0 91E41 9 OOE41 0 OOEroo

1.07E43 5 00&40 1 OQE41 140E41 1.005400

2.SSE43

2 57E431 IQE44

ok Boih Boe Tranarer Comment

2.53E43

1.19E4l

1 3 IE45

1 40E40

I.3IE45

aOOEHO

1 OSE43

I 45E45

1 45E 45 0 Ooftoo 2.07E

otal 1 ETa 2 BSE43 I 40E oreI MBF

F eoon0 ICroaoeedl

IE Comb SFPC Comb RHR Reoeir Rec ArtCooano

9 94E41 9 QOE41 0 SOE41 0 OOE41 0 Oofroo50SE43 I OOE42 S OIE42 1.0OE41 I oof roo

50IE435 SSE43

5 SSE45

5 07E4S

2 SSF45

2 045400 Oofioo

2 045471 04E47

501E43

53SE45

2 55E45

2 04f471 Qlf47

Total 2 ETa 500E43 204E4 otal NBF 2 04E

IE

0 QTE41

2.91E43

2 91E43

1 74E451 71E45

S SOE47

3 15E47

0 OOEioo

Lot~ or SWS I Clot t.aediCone SFPC Con» RHR Recce Rec Aa Cootno

904E41 QQOE41 9OOE41 00OEioo0OOE43 2 01542 1.OOE41 'I cofKe2 09E43

1 71E4S

3 1SE 47

0 OOE+00

S SOE40

2 QIE43 3 Sof40 0oof rOO 2 Qlf

otN 2 ETa 2 0 IE43 S 50E otal NBF

Appencsoc CEvent T(ees

Pa«c dc«ca (Clos«eeet

IE Camo SFPC Comb ItHR Rnonde Reo Ad Cocend

9 95E41 99CEOI 9~41 9 OOE41 0 CO&CO

4 04E45 IOOE42 50(E42 1.OOE41

4 89EOS

4 0(E45~ 89E45

4 94EOS

MSEOS2 47548

Eeoc(ace

oa Sech doe Teens(ac Comment

~ 85EOS

22SEOS

2 47E47 2 470474 04EOS 2 47E47 0 OOEiOO ~ 9(E

oca(2 ETa 40(f45 24TEO otNN9F

487E 1

2 47K4

IE

I OOE«CO

0.21E45

82(f474 97KOT

1.24E47

cone RHR Reoacr Reo AkCoated

9 OOEOI d OOEOI O.OOE+OO

1.OOE4'I '1.00641 1.00&00

5 59K45

Kcaanao <.00 (Cma«eao(oa dolh 004 Teens(ac Commace

4.97E47

0 CO&CO

1.24E47 1 24E47

0 OSE48 1.24E47 0 CO&CO 021E

ota(2 ETa 808E48 124E4 otal NSF 1.14E

IE

I OOEaOO

S.TSE44

LOCA«(LOOP (Cot«eachE Pact Rac 5th EOQ Carne SFPC Cemd RHR Ranee Rea AllCOCeno

9 9OE41 9 OOEOI 9 COE41 7.91EOI 0 OOE41 0OOE cOO

1 05EOS 1 OOKOI 1 OOEO1 2.09E41 2.OOEOI I.OOKcOO

S STEOt

5 dsEO4

2 92045 2 92EO5

7 TSE48

8 15E45

0 OOEiCO

d 19E48

0 OOEiOO

1 SSE45 I SSE48

S TSE44

S 17E48 5 ITE48

5 5SEOT

2 TOE47

5 9(f48

2 79E47

591E48

I 48E48OOOEaOO

1 48E48 1 48E48

S 82847S IOE47 5 IOEOT

0 21E48

I 84548I 84848 1 04E48

S 72E44 1 58E48 OOOE+OO

otal 2 ETa s 72EOc I 58E otal NBF I 58E

mmmxmmxlulz=Kne~~~~~~~~~l-Em~amzgammammm~azm~~~~~~ KZHZ~~~:~2K ~EH

~2K3 ~'HZBRHK)

~WH~EMRDZ3%DEHEXZHRKK~KZ~

EBWKHH

~ ~

,'HHXUHZ-OJ~Hl~iKI~~KKK~~~~~MBIZB~~~

~ERR WEMWKZ3

NKHZH~Z'K3

~SEE!,~Z3

iZ26BWKKK&KcM~KK~~,

~ ~,'~IKKBREZKK~HPI~KEXCREZ~~~~~~~EHEEB&I~MiMKHl&X~I~Hl~iKI~HIKK:ZB~~~~mimmmaimmmazma~a~~~~~~SKI

REX3

~~IRQ~HX2 1

RKKIREZI

~HI l~AD

WKXH ~~EH]K3~KXHKl~)KX~~3KZHEBHXHKI~~',Z52% WKXG

OOennctac CEvent Trees

SSO ICrass»ed)

If EOO Re» Comb SFPC Comb RHR Reoor Rec MCoasnd ca Sa)n das Trer)ere r

~ oof411ROE49 2.0OE41

0 dof41 ~ OTE41 7 OOE41 0 OOEcOO

2.IS)E42 10SE4) SS)OE41 100fcOO

1 ddf49

2 sOE49S OOE. 10

SOOE 11

2 Sdf.t I

s ~ IE 12

204E 12

11SE.12

12SE 12

S54E 11

2445 12

0 OOEsod

1 2SE 12

s 99E.10

Taco) 1 OOE44 5 obf.ld 0 OOEsoo 2 s9E

cesl 2 ETs 1.99E49 5 OOE.I ocsl NSF 50of \

IE

LOCA (Crass»ed)

Cone SFPC Comb RHR Rec)err Rec MCoasnd

9 SOE41 0 OTE41 9 OOE41 0 OOEH)O

S.OOE42 1 OSE41 15)OE41 1.00fcoo

ca Sad) Sas Trans)sr

S.Ides

1 41E45

1,7SE45

I.TSE4TTaco)

I,TSE47

1 TSE47

acsI 2 ETs 2 ssf 4c 1 75E4 ocel Nsf5 »2E

1.75f4

9 995411.12E4c

1 12E4s

1 ITE445 TsE44

5 74547S SOE41

f)sacer)4 (Crassaed)

Carre SfPC Con» RHll Reoen Rec MCeased

9 OOE41 9 S1E41 9 OOE41 0 Oofcoo

I OOE41 5 SOE42 1.00E41 1 Oofcoo

1 05E4s

d TSE44

S 745440 Oofroo

S 74544

0 OOE+OO

712f4CS 74544S 74E44 OOOEK)0 7.12E

ace) 1 ETs 7 12E4I s 14E eccl NSF

IE

Lass al SWS ICrass.eed)

Cane ffPC Comb RHR Reoennec MCacwnd

1 004 sOO OOCE41 9TTE41 OOOE41 000fsOO5 d5E4S 4 Oof45 2 SOE42 'I.OOE41 I Oofcoo

1 IOE442 1sE45

505544S SSE44

21SE44

s 5IE40

0OOE coo

5 OSE49

5 OSE49

ale) 2 ETs S 45E41 5 05E csel NSF

5 s2E

hpponda C

ant Iroos

IE

9 OQE4) 9OOE41 947E41 9OOE41 000&00

1.00E42 BSOE42 1.00E41 1.00&00

0 )4544 8 14E44

5 80240 5 BQE40

2 29E472 OSE4T 2 90E47

2 298482 2QE40 0 BOER

Oto)2 ETS 0 20E44 2.29E ots) HBF

)E

T.QOE47

cons) RHR Roose Rec AkCooin0

0 OTE41 0.00E41 0 BOERS

I.OSE41 2.00E41 1.00&00

0 OOE47

ok Botn Boo Tmnste<

0 OOE47

0 OIE40

0 4SE40

1 81E48I 01E40

0 4SE40

0 00&00

1 BIE407.04E47 I 01E40 OOOEi00

'I OSE 22

atH 2 ETs 7.04E47 I 01E otal HBF I 01E

E. Pew Rec Se EDQ

I BOERS 9 OOE41 9 OOE4t204E45 105842 I OOE41

2 STE45

2 22E40

I QSE40

4 718472 77847

9 42E400 OOE+00

9 42E40

LOCA ts)UTCtt ICn)eooea)

CamoSFPC Coma RHR ReosrRec ABCoosno

9 OOE41 'T.OTE41 0 OOE41 0 DOE+00

1.00841 2.0584) 2.00E41 I.OOEe00

2 OQE45

5 77E47

000f 400

EndHste

9 el 840

2 54E45

222E47t OQE47

222E40I TTE48

I OOE47

900E 10

0 008 ~00

9OOE 10

0 OOE~OO

9 OOE.IO

2 40E47

2 40E48I OSE40

99QE 10

0 008+00

OQQE 10

0 OOEe00

999E 10

2 SSE45 9 01E40

oW2 Ets 2.25845 OBIE otVNBF

2 54E

9 01E

Appendcc C

Event Trees

LOSS or SFPC ICtbsebed)

CorrbSFPC COmb RIIR ReObr RIC A&CO«no

1 Ooftbo 0 CO&00 0 71E41 9 Oof41 0 Oofcoo

L72f45 1 t27faM 2.NE42 1.OOE41 1.00Eaoo

1.72E45

1.72E45

1 OTE45

5 OIE47

S SIE47

1 07545

~ 5If41

5 OIE48

1 71E4S

S OIE40

5 OIE4& OOOEsoo 1 72E

stall ETs 1 TIE45 50IE otal NBF 5 OIE

0 92E41

E Pew Roc

1 OOE41

LOOP ICroasbsdl

Comb SF PC Comb RHR Roost Rec A&Co«tto

9&OE41 OSIE41 OOOE41 0~'I OIE4l SNE42 20CE41 Looftoo

0 NE45

ok B«n Bos T rentier

0 OSE45

0 TTE45 0.77 f45

&27E40

8 SIE470 SIE47

7 OOE4ITcaal &.SIE47 T.dOE4I

cast 2 ETI 0 00E45 8 5IE4 ot« IIBF

4075 I

d SIE47

IE

0 095417 0554l

1 OOE4I

L Pow Rso Stn EDG

50OE4'I 0 COE41

SOOE41 2OOE41

S NE4l

7 NE400 91E40

d 505415 57E41

S OOE47

0 Oofsoo

S OOE41

Etsendsd LOOP (Croaoaedl

Comb SFPC Comb RHR Reoor Rec A&Cootno

9 00041 8 01E41 0 50E41 0 oofkXI2OIE42 1.09E41 S SOE41 '1 COERCE

S 7554I

0 07E40

5 51541

0 00&00

S OOE41

S OTE4I5 5&E40

0 &SE47

l ISE41

2 IOE412 lbf41

4 ssf 47

0 COEaoo

S NE4I

7 00545

9 5&540s eSE40

0 &SE45

S SSEM

2 955402 9SE40

Tot« 1 OSE4I

2.NE45S lTE45 0oofebb 7,0OE

stat 2 ETa 7 &sf4I 5 sTE tasl HBF

2.17E.1

s eTE

Bpbentlct CEvortl Trees

IE EDG Rec

5 SOEOl

1 99E40 2 SOE41

Comb SFPC Comb RHR Rear Rec As Coeeto

0 50E41 7 91541 5 OOE41 0 OOEe00

5 OIf42 2.00E41 5 COE41 I.OOE400

1 SSE40

0 01E.11

7.75E.11

2.05E 11

1 OSE 11

7.75E 11

I.OSE 11

2 99540

1 taf. ~ 1

\ Osf.t I

Tote \ 04549

10SE 11

1 OSEOS

1 OSE49 0 OOE~414E2

eal1ETl 104549 105E otal NSF 1

05t'E

4.02E44

4 02EOI

LocA Ioeeesereto

Comb SF PC Comb RHR Reoer Rec AkCootns

0 OOE41 8 OOE41 8 OOE41 0 OOEr00

1.00 f41 2.00f41 2.00E41 T.OOfr00

2 51EOI S 51EOI

5 25E45

Ben Boe Tranerer

1 81EOS

1.51EOS I 515451 51E45 0 OOEe00

otal 2 ETe 4 OOE44 1 51E otal NBF

4 02EOl~5 42E.

1 51E

IE

9 99E41

8 54E44

Floodtlo (Croll aed)

Cere SFPC Corno RHR Reoer Rec AltCoeno

9 SOEOI 8 91EOI 8 OOEOl 0OOEr00

10IE42 I.OOEOI 1.00E41 10OEe00

8 2 7EOI

fnceeeok Both Bel Trentier Comment

8 STEOI

I 74545I 5SERS

1 9 If45

5 82E470 OOE~CO

5 82E47

~ SSEOS

1 SSEOS

0 OOE F00

2 82E47

8 5IE44 2 82EOT 0OOENO 0 Sef~ 108E I

otal'Tl 0 SIEOI 2 8254 otal NBF

IE

LOllOl SWS ICrON ecclCornbSFPC CenbRHR ReoerRec Aacoeno

I OOE rOO 9 00E41 0 41E41 8 OOEOI 0 005 +co

4 SIEOI 1 04E42 5 0SE42 1 OOER1 I OOOO4 SSEOl 4 SSEOI

~ STEM

2 715472 1TE4'I

5 42E480 005~00

5 42548

2 ITE47

S 42E484 58544 S 42EOS

oul2ETe 458ERI 542E oteNBF

5 42E

5 42E

~mmmmmmm~uamn~~~~~~~~~mnmmzmrunmmzaz~~~~~~~~EERI~KK~ZB~~K~ REHD~~g~e

MESA

RZHB~WER3

K~WKXIWKX3KZ"%3&~KZ M

;Z5XiBWZQKl~XBZKHK~BXH,

I.~~KII~UBl~~~~~~~~~K."HSSEZRI~M,'KB3!BMZDKI~~RKlRR~~~~~~~,'KXZK~KK~HIKK~

REX)i

~KB~SKI ~NXZKI

K3~%XHXH~3KlKZ"EH~i,~EK::K,

(i

~ ~

''RBKRKKIRHHRHKIRKXIR&KIEKIZ~~~~WEIKI~~~KX RRlt

E3

WHK9 i~3K'EK3

~HZH ~&Hi%IIKI~~7lX3~%KKHK&DIKl'Z~&RE3~i',Z52%MCE3

i0

~EREPREEEZZ. EZZEZ~~~~~~~~E:"EEEE RE~I~EEEEEEERLatRZRIIEZEE~~~~~~~ERIEEZBRHRIREBZIRE-:M~~~~~~EZ"KB~~~,M~)

&KKI

~REIEIE"MRKZHRHX3RGKl%6X,

~ 0,~HREZRKEE~KEBEKERR~~~~~~~ZRRERR E,'RZZIKIREIHIRZRERIEKIRZEEEZ"ZE~~~~~,"RSKRHHIRIHEIRBEERZRZINET~

~~a

RKKWKKi

I ~RZIRI~~KIRIE3WEKRHRKKlRKZlRKRKZ~25MRED RX!KgXZRRHE3,

~ 4

'RZIRIREKIRERIRLVHSK&RKBFEFB~~~~RIEEI~RE%

REZ3WRZH

I ~RERI.%5KJ

~ ~

RHZlRERI

\ KNEE&H3H1

%KB

~GXD~HZH

IK~RHBERZIRIEK"!ERROR'ZXK2%~HMEW,ZXZKWHM

Appent)N CEeent Trees

IE EQG Rsc

ISOE41

Comb SFPC Carne RHR Reoer ReC AS CecanO

ISOE41 IOOE41 S.OOE41 0 OOEr00

S.OOEOZ ZASEO) 500E41 1.00Er00

1 2SEa

040E 11

5 10E.N

1 SOE 11

0 40&12

5.10E 11

I40E.12

0.40&'l20 40&12 040E 12

0905 10SOOE 10

LEOS 7 CSE 10 OOOENO ZOOE

4 14E-

otal 2 ETs 1.20E40 7 05E.1 otal H sr 7 05&1

LOCA (cmsoeoc)

Comb SF PC Corrb RHR Reowr Roc A)tCotano

1 00&00 IOOEO) IOOEO1 IOOEO'1 0 OSE+00

Z.OIEOI 1.00E41 2.00EO1 Z.OOEO) 1.00&r00

2 41EOt

ZSSE441.14E4$

2 SSE4$

1 41EO4

2.14E45

5 ssEa

1.07E45Total

1 OTE40

Z.STE44 1 07EOS 0OOEsOO 2 SIE

otal 2 ETs 2,07544 1 OTE otal NSF 1 OTE

F (Croseeoo)

IE Comb SFPC Comb RHR Rober Rec A)t CoosnO

9 OOE41 9 IOE41 9 OOE41 IOOE41 0 00&00S SOE44 1 OOE42 1 COE41 Z.COE41 1 OOEs00

5 SIE445 SOE44

1 OSEOS

1 llE45I 12E47

1 14E45

2 2IEOT2 25547

5 SIE44

1 OSE4$

9 12EOT

OOOEi00

Z.ZIE472ZIEOT 5 OOE

otal 2 ETs 5 OOE44 2 1IE4 atal lldF 1 2IE

)E

1 OOE+00

2 OZE44

2 02EO4

Loss or Sws (cross.esc)Comb SF PC Comb RHR Ros«r Rsc AS Coolno

9 00541 I SOE41 IOOE41 0

OCEANO

~ OOE42 $ 01EOZ Z.OOE41 1 COEN)0

2 IIEOt

2 TIEa 2.7IE40

1 4SE471.1TE47

2 OSE4S

1 OSEOI

1.17E47

0 OOEi00

2 02E4i2 osEa2OSEOI OOOO Z.OZE

otal 2 ETs 2 02E44 Z.OSE rarsHOF 2 OSE

AOOdnrTa CEvent Treea

Comb SFPC COmb RHR Reear Reo AO Ceebnd

9 80641 D OOE41 8 OOE41 0 00fe00

2,00E42 1.00641 2.00E41 1 006r00

e 80648

oe, Doer Dol Tmneler

e 0064e

Cornrnanl

0 OIE40 ~ oaf40

9 986477 95647 7.95647

I.OOE47e QSE41

1 99647'I 99647 0 006~00 e OSE41

Olal2ETe 890E41 ~ OQE4 ocNNDF I OQE47

comb RHR Reoor Rec AltCocenD

1 OOEe00 8 OOE41 8 50641 0.006 rOO

0.24647 2.00641 S.50641 1.006r00

e,QQE47

0286478.11E40

12$ E47

e QQE47

0.'IIE40

8 27f488 STE48 e STE48

5 DOE47 e 57648 028

f'rN2

ETa 5 00647 e STE mat NSF e STE

IE E PowRec QnECGLOCA rrrUXIP(Croeaeae)

Corno sFPC comb RHR Reoor Roc AO cocenoEnoaoee

oe Dain Bol 1ranaral Oonrnerg

I OOE+00 9 9OE41 d OOE41

I 88E4$ 1 05E42 2.00641

1 OSE45

2 7 IE402 4 IE40

0 elE47

0 OOF41 0 50641 4 50641 0 tOEeOO

2.00E41 $.50E41 S 50641 I.DOE rOO

1 48645 1 edE45

2 ~ 1E45

0 eiE47

e SsE470 00&00

e 55E47

0 OOE+00

~ $5E47

I 8864$

1 58E471.28E47

2 OSE48

I 28E47

2 05E45

I 10640

7 ITE49

0 DOE r00

7 ITE49

0 DOE+00

S 80649

1 97647

I SSE48

e 056480 Obfiob

8 dsf49\ dsf45 8 bsE47 0 DOER 1 086

S SOE.21

real 2 ETa I 85645 e DSE4 rear NSF

CDF Generic Event Tree Appendix C

Event Trees

Generic Core Dame Frequency (CDF) Event Tree

EQTNear Boi6ng

Frequencylactation/Recovery

-SOTS- HVAC

Wire Water-Etc.

ECCS Faiture

-CS- LPSS- HPStS

- Phf- CRDP

Wc.

- Foihvv EOP

Wc.Sequence End-State

creen Vatue

From NBF 1.0 - 0810.1 0

1.0 - 0.1 0.1 - 0.001

0.01

c~nCA)Key:::kr'.

Figure C.l, CDF Generic Event Tree

C.64

Event Sequence Evaluations Appendix C

Event Trees

Event Sequence Evaluation: Events Occurring in Case 3 As-Found PlantConditions (see Figure C.2 for timeline representation of this sequence).

INITIAL PLANT CONDITIONS

The plant's initial conditions are: ,Unit I is being refueled with the coreoffloaded into the SFP, Unit 2 is at normal operating conditions, the Unit Iand Unit 2 SFPs are cross-connected, the Unit I SFPC system is out of servicedue to a Service Water System outage and SFPC is provided from Unit 2 withthree SFPC pumps running, Unit I has no RHR available for operation in theSFPC assist mode because of maintenance, and Unit 2 has one train of RHRavailable for operation in the SFPC assist mode.

FROM INITIATING EVENT TO NEAR BOILING CONDITION IN THE SFPs

The initiating event occurs at time zero. LOOP, EXTENDED LOOP, and LOCA withLOOP cause a complete loss of offsite power to both units. LOCA'and LOCA withLOOP involve a large, medium or small break LOCA in the operating unit andresult in loss of SFPC and'cause RHR of the LOCA unit to be unavailable forSFPC assist. Coincident with all these initiators, Unit 2 scrams and the SGTSand the recirculation system automatically starts. Plant operators respond tothe event in accordance with emergency procedures and the TSC is activatedwithin one hour after the initiator. Note that for As-found plant conditions,the LOOP emergency procedures did not prompt operators to ensure SFPC isreturned to service. Operators at both units continue with emergency actionsfor these events. Offsite power is restored within four hours for the LOOPevent and after restoration of offsite power, operators return systems totheir normal alignments. Operators of Unit 2 may attempt to perform a rapidrestart of the plant within the first 6 hours after the LOOP. The TSC woulddeactivate by 6 hours after the LOOP based on recovery of offsite power andoperator's successful handling of emergency plant actions for the LOOP. Forthe EXTENDED LOOP and LOCA or LOCA with LOOP events, the TSC would not bedeactivated throughout the event as mitigation activities continue. For allthese event sequences, the SFPs would reach the technical specification limitof 125'F at approximately 8 hours after the initiator assuming that operatorsat both units do not restore SFPC to service. Operators are trained to complywith technical specifications, therefore at or near 8 hours after theinitiator the operators would recognize the need to restore cooling to theSFPs. At 8 hours after the initiator, the operators would attempt to use theavailable systems to return cooling to the SFPs. This would involve restartthe Unit 2 SFPC system, return the Unit I SFPC system to service, or align atrain of RHR from Unit I or Unit 2 for operation in the SFPC assist mode to.restore cooling to" the SFPs, as system availability allows. These actionswould continue persistently as the SFPs continued to heat up and approach nearboiling conditions. Within 10 to 20 hours after the initiator, the operatorsmay attempt to provide SFP cooling by alternate means such as ESW, Fire Water,Pumper Truck, or other feed and bleed cooling alignments.

C.65


Event Trees

FROM NEAR BOILING CONDITIONS IN THE SFPs TO CORE UNCOVERY

Without restoration of cooling to the SFPs within 25 hours after theinitiator, the SFPs would reach near boiling conditions causing an increasedrate of steam release from the surface of the SFP. Under SFP boilingconditions, the rate of steam release to Zone 3 will exceed the capacity ofthe normal HVAC system and the SGTS for removal of this energy. If therecirculation system is left running the steam spreads to the reactorbuilding. Approximately eight hours after the SFPs reach near boilingconditions (33 hours after the initiator), the steam spread to the reactorbuilding is assumed to cause ECCS equipment failure due to adverse temperatureconditions. If the TSC was deactivated (LOOP event) it would be reactivatedat about 33 hours after the LOOP based on ECCS equipment failures. If Unit 2was restarted earlier, it scrams or operators perform a controlled shutdowndue to ECCS equipment failures. The operators and TSC would make every effortpossible to provide core cooling using any available means including:

any surviving Unit 2 ECCS equipment,'

ECCS equipment from Unit I that could be crosstied to Unit 2 given thatthe Unit I reactor building was isolated from Zone 3 for refuelingconditions, or

equipment outside the reactor building of Unit I or Unit 2 such asfeedwater, condensate, standby liquid control, reactor water cleanup,fire water, control rod drive maximized, RHR service water, or pumpertruck.

Host of these alternate cooling mechanisms are identified in the emergencyprocedures. The reactor core would begin to uncover at approximately 36 hoursafter the initiator if all these actions related to restoration of cooling tothe SFPs with alternate cooling methods, isolation of Zone 3, and restorationof core cooling to Unit 2 were to fail.ORDER OF MAGNITUDE ESTIMATION OF CONDITIONAL CORE DAMAGE FRE(UENCY GIVEN THEINITIATOR IN CASE 3 CONDITIONS

The event tree presented in Figure C.2 presents the sequence flow path thatcould lead to core damage given near boiling conditions from the Case 3initiating event. The general functional failures that would have to occurbefore the sequence could reach a core damage end state and order of magnitudeestimations of their associated failure likelihoods are as follows:

~ Failure'f alternate methods for cooling the SFPs that were not credited oin the estimation of the NBF as well as failure of operators to isolateZone 3 from the Unit 2 reactor building within approximately 33 hoursafter the initiator. The failure occurs if operators do not implementalternate feed and bleed cooling to the SFPs using one of at least threepossible systems and also do not isolate the Zone 3 air space from -Zone

C.66


Event Trees

2 air space. The likelihood that these actions would fail givenapproximately 25 hours between exceeding the SFP temperature technicalspecification limit and failure of ECCS equipment in Unit 2 is estimatedat 0.1.

Failure of and non-recovery of all Unit 2 ECCS equipment that wouldnormally be capable of providing sufficient long term decay heat removalgiven the initial short term post scram functions are completed prior tofailure of the ECCS equipment. The likelihood that these actions wouldfail given the plant conditions, time frame and plant staff involved,and other activities is estimated at 1.0.

~ Failure of all equipment outside the Unit 2 reactor building includingECCS equipment from Unit I that could be crosstied to Unit 2 orequipment outside the reactor building of Unit I or Unit 2 such asfeedwater, condensate, standby liquid control, reactor water cleanup,.fire water, control rod drive maximized, RHR service water, or pumpertruck. Host of these alternate cooling, mechanisms are identified in theemergency procedures. The likelihood that these actions would failgiven the plant conditions, time frame and plant staff involved, andother activities is estimated at 0.01.

The overall order of magnitude estimate of the conditional core damagefrequency due to an initiating event in Case 3 is the product of the estimatedNBF and the three general functional failure estimation above. This productis summarized in Table C.VI below.

Event Sequence Evaluation: Events Occurring in Case 4 As-Found PlantConditions (see 'Figure C.3 for timeline representation of this sequence).


The plant's initial conditions are: Unit I is being refueled with the coreoffloaded into the SFP, Unit 2 is at normal operating conditions, the Unit Iand Unit 2 SFPs are not cross-connected, the Unit I SFPC system and Unit 2SFPC system are both inservice, each with three SFPC pumps running, Unit I hastwo trains of RHR available for operation in the SFPC assist mode, and Unit 2has one train of RHR available for operation in the SFPC assist mode.


The initiating event occurs at time zero. LOOP and EXTENDED LOOP cause acomplete loss of offsite power to both units. The LOCA event involves alarge, medium or small break LOCA in ghe operating unit and result in loss ofSFPC in the operating unft and causes RHR of the LOCA unit to be unavailablefor SFPC assist. Coincident with all these initiators, Unit 2 scrams and theSGTS and the recirculation system. automatically starts. Plant operatorsrespond to the event in accordance with emergency procedures and the TSC isactivated within one hour after the initiator. Note that for As-Found plant

C;67


Event Trees

conditions, the LOOP emergency procedures did not prompt operators to ensureSFPC is returned to service. Operators at both units continue with emergencyactions for these events. Offsite power is restored within four hours for theLOOP event and after restoration of offsite power, operators return systems totheir normal alignments. Operators of Unit 2 may attempt to perform a rapidrestart of the plant within the first 6 hours after the LOOP. The TSC woulddeactivate by 6 hours after the LOOP based on recovery of offsite power andoperator's successful handling of emergency plant actions for the LOOP. Forthe EXTENDED LOOP and LOCA events, the TSC would not be deactivated throughoutthe event as mitigation activities continue. For all these event sequences,the SFPs would reach the technical specification limit of 125'F atapproximately 8 hours after the initiator assuming that operators at bothunits do not restore SFPC to service. Operators are trained to comply withtechnical specifications, therefore at or near 8 hours after the initiator theoperators would recognize the need to restore cooling to the SFPs. At 8 hoursafter the initiator, the operators would attempt to use the available systemsto return cooling to the SFPs. This would involve use of any surplus capacityavailable from the EDGs ta power non-safety buses under LOOP or EXTENDED LOOPconditions, to support operation of the SFPC system. Offsite power may berecovered within 10 hours after the LOOP. If the power becomes available tothe non-safety bus for SFPC, operators would attempt to restart any availableSFPC system to service, cross-connect the Unit I and Unit 2 SFPs if possible,or align a train of RHR from Unit I or Unit 2 for operation in,the SFPC assistmode to restore cooling to the SFPs, as system availability allows. Theseactions would continue persistently because the SFPs continued to heat up andapproach near boiling conditions. Within 10 to 20 hours after the initiator,the operators may attempt to provide SFP cooling by alternate means such asESW, Fire Water, Pumper Truck, or other feed and bleed cooling alignments.


Without restoration of cooling to the SFPs within 25 hours after the LOOP, theSFPs would reach near boiling conditions causing an increased rate of steamrelease from the surface of the SFP. Under SFP boiling conditions, the rateof steam release to Zone 3 will exceed the capacity of the normal HVAC systemand the SGTS for removal of this energy. If the recirculation system is leftrunning the steam spreads to the reactor building. Approximately eight hoursafter the SFPs reach near boiling conditions (33 hours after the initiator),the steam spread to the reactor building is assumed to cause ECCS equipmentfailure due to adverse temperatures conditions. If the TSC was deactivated(LOOP event) it would be reactivated at about 33 hours after the LOOP based onECCS equipment failures. If Unit 2 was restarted earlier, it scrams oroperators perform a controlled shutdown due to ECCS equipment failures. Theoperators and TSC would make every effort possible to provide core coolingusing any available means including:

~ any surviving Unit 2 ECCS equipment,


Event Trees

~ ECCS equipment from Unit I that could be crosstied to Unit 2 given thatthe Unit I reactor building was isolated from Zone 3 for refuelingconditions, or

equipment outside the reactor building of Unit I or Unit 2 such asstandby liquid control, reactor water cleanup, fire water, control roddrive maximized, RHR service water, or pumper truck.

Most of these alternate cooling mechanisms are identified in the emergencyprocedures. The reactor core would begin to uncover at approximately 36 hoursafter the initiator if all these actions related to restoration of cooling tothe SFPs with alternate cooling methods, isolation of Zone 3 air space, andrestoration of core cooling to Unit 2 were to fail.ORDER OF MAGNITUDE ESTIMATION OF CONDITIONAL CORE DAMAGE FRE(UENCY GIVEN THECASE 4 INITIATOR

The event tree presented in Figure C.3 presents the sequence flow path thatcould lead to core damage given near boiling conditions from the Case 4initiating event. The general functional failures that would have to occurbefore the sequence could reach a core damage end state and order of magnitudeestimations of their failure likelihoods are as follows:

Failure of alternate methods for cooling the SFPs that were not creditedin the estimation of the NBF as well as failure of operators to isolateZone 3 from the Unit 2 reactor building within approximately 33 hoursafter the initiator. The failure occurs if operators do not implementalternate feed and bleed cooling to the SFPs using one of at least threepossible systems and also do not isolate the Zone 3 air space from Zone2 air space. The likelihood that these actions would fail given theapproximate 25 hour time period between exceeding the SFP temperaturetechnical specification limit and failure of ECCS equipment in Unit 2 isestimated at 0. l.Failure of and non-recovery of all Unit 2 ECCS equipment that wouldnormally be capable of providing sufficient long term decay heat removalgiven the initial short term post scram functions are completed prior tofailure of the ECCS equipment. The likelihood that these actions wouldfail given the plant conditions, time frame and plant staff involved,and other activities is estimated at 1.0.

Failure of all equipment outside the Unit 2 reactor building includingfCCS equipment from Unit I that could be crosstied to Unit 2 orequipment outside the reactor building of Unit 1 or Unit 2 such as 'ostandby liquid control, reactor water cleanup, fire water,'ontrol roddrive maximized, RHR service water, or pumper truck. Most of thesealternate cooling mechanisms are identified in the emergency procedures.The likelihood that these action would fail given the plant conditions,

C.69


Event Trees

time frame and plant staff involved, and level of other activities isestimated at 0.01.

The overall order of magnitude estimate of the conditional core damagefrequency due to a initiating event in Case 4 is the product of the estimatedNBF and the three general functional failure estimation above. This productis summarized in Table C.VI below.

Event Sequence Evaluation: Events Occurring in Case 5 As-Found PlantConditions (see Figure C.4 for timeline representation of this sequence).


The plant's initial conditions are: Unit I is being refueled with the coreoffloaded into the SFP, Unit 2 is at normal operating conditions, the Unit 1and Unit 2 SFPs are not cross-connected, the Unit I SFPC system and Unit 2SFPC system are both inservice, each with three SFPC pumps running, Unit I hastwo trains of RHR available for operation in the SFPC assist mode, and Unit 2has one train of RHR available for operation in the SFPC assist mode.


The initiating event occurs at time zero. LOOP and EXTENDED LOOP cause acomplete loss of offsite power to both units. The LOCA event involves alarge, medium or small break LOCA in the operating unit and result in loss ofSFPC in the operating unit and causes RHR of the LOCA unit to be unavailablefor SFPC assist. Coincident with all these initiators, Unit 2 scrams and theSGTS and the recirculation system automatically starts. Plant operatorsrespond to the event in accordance with emergency procedures and the TSC isactivated within one hour after the initiator. Note that for As-Found plantconditions, the LOOP emergency procedures did not prompt operators to ensureSFPC is returned to service. Operators at both units continue with emergencyactions for these events. Offsite power is restored within four hours for,theLOOP event and after restoration of offsite power, operators return systems totheir normal alignments. Operators of Unit 2 may attempt to perform a rapidrestart of the plant within the first 6 hours after the LOOP. The TSC woulddeactivate by 6 hours after the LOOP based on recovery of offsite power andoperator's successful handling of emergency plant actions for the LOOP. Forthe EXTENDED LOOP and LOCA events, the TSC would not be deactivated throughoutthe event as mitigation activities continue. For all these event sequences,the SFPs would reach the technical specification limit of 125'F atapproximately 5 hours after the initiator assuming that operators at bothunits do not restore SFPC to service. Operators 'are trained to comply withtechnical speci,ications and the:+fore at or near 5 hours after the LOOP, theoperators would recognize the need to restore cooling to the SFPs. Theoperators would attempt to use the available systems to return cooling to theSFPs. This would involve use of any surplus capacity available from the EDGsto power non-safety buses under LOOP or EXTENDED LOOP conditions, to supportoperation of the SFPC system. By 8 hours after the LOOP, operators or the TSC

'C.70


Event Trees

would likely attempt to provide an alternate means of cooling to the SFPs suchas ESW, diesel backed fire water, or pumper truck for feed and bleed coolingof the SFPs. Offsite power may be recovered within 10 hours after the LOOP.If the power becomes available to the non-safety bus for SFPC, operator s wouldattempt to restart any available SFPC system to service, cross-connect theUnit I and Unit 2 SFPs if possible, or align a train of RHR from Unit I orUnit 2 for operation in the SFPC assist mode to restore cooling to the SFPs,as system availability allows. These actions would continue persistentlybecause the SFPs continued to heat up and approach near boiling conditions.


Without restoration of cooling to the SFPs within 15 hours after theinitiator, the SFPs would reach near boiling conditions causing an increasedrate of steam release from the surface of the SFP. Under SFP boilingconditions, the rate of steam. release to Zone 3 will exceed the capacity ofthe normal HVAC system and the SGTS for removal of this energy. If therecirculation system is left running the steam spreads to the reactorbuilding. Within 20 hours after a LOOP initiator, there is the possibilityfor a very late recovery of offsite power. Approximately eight hours afterthe SFPs reach near boiling conditions (23 hours after the initiator), thesteam spread to the reactor building is assumed to cause ECCS equipmentfailure due to adverse temperature conditions. The operators and TSC wouldmake every effort possible to provide core cooling using any available meansincluding:


ECCS equipment from Unit I that could be crosstied to Unit 2 given thatthe Unit I reactor building was isolated from Zone. 3 for refuelingconditions, or

~ equipment outside the reactor building of Unit I or Unit 2 such asstandby liquid control, reactor water cleanup, fire water, control roddrive maximized, RHR service water, or pumper truck.

Most of these alternate cooling mechanisms are identified in the emergencyprocedures. The reactor core would begin to uncover at approximately 26 hoursafter the initiator if all these actions related to restoration of cooling tothe SFPs with alternate cooling methods, isolation of Zone 3 air space, andrestoration of core cooling to Unit 2 were to fail.ORDER OF MAGNITUDE ESTIMATION OF CONDITIONAL CORE DAMAGE FREQUENCY GIVEN THECASE 5 INITIATOR

The event tree" presented in Figure C.4 presents the sequence flow path thatcould lead to core damage given near boiling conditions from the Case 5initiating event. The general functional failures that would have to occur


Event Trees

before the sequence could reach a core damage end state and order of magnitudeestimations of their failure likelihoods are as follows:

~ Failure of alternate methods for cooling the SFPs that were not creditedin the estimation of the NBF as well as failure of operators to isolateZone 3 from the Unit 2 reactor building within approximately 23 hoursafter the initiator. The failure occurs if operators do not implementalternate feed and bleed cooling to the SFPs using one of at least threepossible systems and also do not isolate .the Zone 3 air space from Zone2 air space. The likelihood that these actions would fail givenapproximately 18 hours between exceeding the SFP temperature technicalspecification limit and failure of ECCS equipment in Unit 2 is estimatedat 0.1.

Failure of and non-recovery of all Unit 2 ECCS equipment that wouldnormally be capable of providing sufficient long term decay heat removalgiven the initial short term post scram functions are completed prior tofailure of the ECCS equipment. The likelihood that these actions wouldfail given the plant conditions, time frame and plant staff involved,and level of other activities is estimated at 1.0.

~ Failure of all equipment outside the Unit 2 reactor building includingECCS equipment from Unit I that could be crosstied to Unit 2 orequipment outside the" reactor building of'nit I or Unit 2 such asstandby liquid control, reactor water cleanup, fire water, control roddrive maximized, RHR service water, or pumper truck. Host of thesealternate cooling mechanisms are identified in the emergency procedures.The likelihood that these actions would fail given the plant conditions,time frame and plant staff involved, and level of other activities isestimated at 0.01.

The overall order of magnitude estimate of the conditional core damagefrequency due to an initiating event in Case 5 is the product of the estimatedNBF and the three general functional failure estimation above. This productis summarized in Table C.VI below.

Event Sequence Evaluation: Events Occurring in Case I As-Found PlantConditions (see Figure C.G for timeline representation of this sequence).

INITIALPLANT CONDITIONS

Unit I and Unit 2 Spent Fuel Pools (SFP) are initially isolated from eachother with three Spent Fuel Pool Cooling (SFPC) pumps providing cooling. toeach SFP. Both Units are initially operating with one train of Residual HeatRemoval (RHR) available for SFPC assist mode. 0


C.72


Event Trees

The initiating event (earthquake) occurs at time zero and causes a loss ofoffsite power (LOOP) due to the seismic motion. Both Units scram and theStandby Gas Treatment System (SGTS) and recirculation systems automaticallystart. The plant operators respond to the seismic event and the LOOP"inaccordance with the emergency procedures. Within one hour the TechnicalSupport Center (TSC) is activated and provides support to the operators. Notethat the emergency procedures for these events in the As-Found plantconditions did not prompt operators to ensure that SFPC is returned toservice. Operators at both units continue with emergency actions for thefirst four hours after the LOOP. At the four hour point offsite power isstill not restored, and the plant enters an Extended LOOP condition.Operators align systems for emergency power supply in accordance with theemergency procedures. The TSC remains activated throughout the event andoperators successfully respond to emergency plant actions for the seismicevent with Extended LOOP conditions. Offsite power may be recovered within 10hours after the LOOP. This recovery is not credited in the estimation of NearBoiling Frequency (NBF).

The SFPs would exceed theitechnical specification limit of 125'F approximately15 hours after the seismic event if operators do not restore cooling to theSFPs. Operators are trained to complying with technical specifications andtherefore by 25 hours after the seismic event (when the SFPs would be at about140 F), the operators would recognize the need to restore cooling to the SFPs.The most likely action would be to align RHR for SFPC assist mode. Power isnot available for cross-connecting the pools, and each pool must beindependently recovered. The TSC and Operators could attempt to powerappropriate non-safety bus from the Emergency Diesel Generators (EDG)(including the 5th unit) for support of any surviving SFPC system(s). If theabove actions were not successful, the Operators and the TSC would likelyattempt to provide an alternate means of cooling to the SFPs such as EmergencyService Water (ESW), diesel backed fire water, or pumper truck for feed andbleed cooling of the SFPs. These actions would continue persistently as theSFPs continued to heat up and approach near boiling conditions.

'ROM NEAR BOILING CONDITIONS IN THE SFPs TO CORE UNCOVER

0

Without restoration of cooling to the SFPs within 50 hours after the seismicevent, the SFPs would reach near boiling conditions and release steam from thesurface of the SFPC at an increased, rate. Under SFP boiling conditions, therate of steam released will exceed the normal systems'apacity for removalof this energy. The steam spreads to the reactor building through the runningrecirculation system. Approximately eight hours after either SFP reaches nearboiling conditions (58 hours after the seismic. event), Both Unit's EmergencyCore Cooling System (ECCS) ecgipment fails due to the encroaching steamenvironmeri. The operators and TSC would make every effort possible toprovide core cooling using any surviving ECCS equipment or equipment outsidethe reactor buildings such as: standby liquid control, reactor water cleanup,fire water, control rod drive maximized, RHR service water, or pumper truck.Most of these alternate cooling mechanisms are identified in the emergency

C.73


Event Trees

procedures. The reactor core would begin to uncover at approximately 64 hoursafter the seismic event if all these actions related to restoration of coolingto the SFPs with alternate cooling methods, isolation of Zone 3 air space, andrestoration of core cooling to were to fail.ORDER OF MAGNITUDE ESTIMATION OF CONDITIONAL CORE DAMAGE FREQUENCY GIVEN THECASE I INITIATOR

The event tree presented in Figure C.5 presents the sequence flow path thatcould lead to core damage given near boiling conditions from the Case Iinitiating event. The general functional failures that need to occur beforethe sequence could reach a core damage end state and order of magnitudeestimations of their failure likelihoods are as follows:

Failure of alternate methods for cooling the SFPs that were n'ot creditedin the estimation of the NBF as well as failure of operators to isolateZone 3 from the reactor buildings within approximately 58 hours afterthe initiating event'. The failure occurs if operators do not implementalternate feed and bleed cooling to the SFPs using one of at least threepossible systems and do not isolate the Zone 3 air space from Zone I andZone 2 air spaces. The alternate cooling methods all depend on non-seismically qualified equipment. However, the likelihood of totalfailure of all alternate methods in a small earthquake is small. Forthe larger seismic events where total failure is much more likely, itwould also attract outside agency attention. It is expected the outsideagencies, the TSC and operators would all be persistent in theirrecovery actions for the approximate 40 hour time period betweenexceeding the SFP temperature technical specification limit and failureof ECCS equipment. The likelihood that these actions would fail giventhe above conditions, is estimated at 0.5.

Failure of and non-recovery of all ECCS equipment that would normally becapable of providing sufficient long term decay heat removal given theinitial short term post scram functions are completed prior to failureof the ECCS equipment. Identical failure times for all ECCS equipmentavailable for long term cooling to both Units is unlikely. Loss of corecooling eq'uipment will highlight the operator's and TSC attention to theproblem, its cause and potential solutions. Some possibility ofrecovery and/or avoidance is likely at this point. Given the plantconditions, time frame, plant staff involved, and level of otheractivities, this is estimated at 0.9.

Failure of all equipment outside the reactor buildings including ECCSequipment from either Unit that could be cross-tied to the other Unit orequipment outside the reactor buildings such as: feedwater, condensate,standby liquid control, reactor water cleanup, fire water, control roddrive maximized, RHR service'water, or pumper trucks. Most of thesealternate cooling mechanisms are identified in the emergency procedures.Many of these systems are not seismically qualified, but total failure

C.74


Event Trees

in seismic events is unlikely. In addition, resources exist from both,internal and external organizations to support repair and replacement ofequipment if required. The likelihood that these actions would failgiven the plant conditions, time frame and plant staff involved, andlevel of other activities is estimated at 0.05.

The overall order of magnitude estimate of the conditional core damagefrequency due to an initiating event in Case I is the product of the estimatedNBF and the three general functional failure estimation above. This productis summarized in Table C.VI below.

Event Sequence Evaluation: Events Occurring in Case 3 As-Fixed PlantConditions (see Figure C.6 for timeline representation of this sequence).


The plant's initial conditions are: Unit I is being refueled with the coreoffloaded into the SFP, Unit 2 is at normal operating conditions, the Unit Iand Unit 2 SFPs are cross-connected, the Unit I SFPC system is out of servicefor maintenance and the Unit 2 SFPC system is inservice with three SFPC pumpsrunning, the Unit I RHR system is out of service for maintenance, and the Unit2 RHR system has one train available for operation in the SFPC assist mode.


The initiating event occurs at time zero. LOOP, EXTENDED LOOP, and LOCA withLOOP cause a complete loss of offsite power to both units. LOCA and LOCA withLOOP involve a large, medium or small break LOCA in the operating unit andresult in loss of SFPC and cause RHR of the LOCA unit to be unavailable forSFPC assist. Coincident with all these initiators, Unit 2 scrams and the SGTSand the recirculation system automatically starts. Plant operators respond tothe event in accordance with emergency procedures and the TSC is activatedwithin one hour after the initiator. Note that for As-Fixed plant conditionsthe LOOP emergency procedures provide a prompt for operators to ensure thatSFPC is returned to service. Operators at both units continue with emergencyactions after the initiating event and at I hour, operators recognize the needto restore cooling to the SFPs. If offsite power is not restored to the plantwithin 4 hours,'he LOOP conditions are EXTENDED. Operators align systems foremergency power supply in accordance with the emergency procedures. The TSCremains activated and operators successfully respond to emergency plantactions for the EXTENDED LOOP. Within 5 hours after the LOOP, the operatorsand TSC may decide to use any surplus capacity available from the EDGs topower non-safety buses to support operation of the. SFPC system. If the powerbecomes available to the non-safety bus for SFPC, operators would attempt torestart the Unit 2 SFPC system or return the Unit I SFPC system to 'service.Alternatively, the operators would align any available train of RHR from UnitI or Unit 2 for operation in the SFPC assist mode as necessary to restorecooling to the SFPs. Within 8 hours the operators or TSC may attempt toprovide SFP cooling by alternate means such as: ESM, diesel backed Fire-

C.75

It


Event Trees

Water, Pumper Truck, or other feed and bleed cooling alignments. Theseactions would continue persistently as the SFPs continued to heat up andapproach near boiling conditions. Offsite power may be recovered later,within 10 hours or within 20 hours after the LOOP. The SFPs would reach thetechnica1 specification limit of 125'F at approximately 25 hours after theinitiator assuming that operators at both units do not restore SFPC toservice.

FROM HEAR BOILIHG CONDITIONS IN THE SFPs TO CORE UNCOVERY

Without restoration of cooling to the SFPs within 25 hours after theinitiator, the SFPs would reach near boiling conditions causing an increasedrate of steam release from the surface of the SFP. Under SFP boilingconditions, the rate of steam release to Zone 3 will exceed the capacity ofthe normal HVAC system and the SGTS for removal of'his energy. If therecirculation system is left running the steam spreads to the reactorbuilding. Approximately eight hours after the SFPs reach near boilingconditions (33 hours after the initiator), the steam spread to the reactorbuilding is assumed to cause ECCS equipment failure due to adverse temperature

'onditions.The operators and TSC would make every effort possible to providecore cooling using any available means including:


ECCS equipment from Unit I that could be crosstied to Unit 2 given thatthe Unit I reactor building was isolated from Zone 3 for refuelingconditions, or

~ equipment outside the reactor building of Unit I or Unit 2 such asstandby liquid control, reactor water cleanup, fire water, control roddrive maximized, RHR service water, or pumper truck.

Most of these alternate cooling mechanisms are identified in the emergencyprocedures. The reactor core'would begin to uncover at approximately 36 hoursafter the initiator if all these'ctions related to restoration of cooling tothe SFPs with alternate cooling methods, isolation of Zone 3 air space, andrestoration of core cooling to Unit 2 were to fail.ORDER OF MAGNITUDE ESTIMATION OF CONDITIONAL CORE DAMAGE FREQUENCY GIVEN THEAS-FIXED CASE 3 INITIATOR

The event tree presented in Figure C.6 presents the sequence flow path thatcould lead to core damage given near boiling conditions from the Case 3initiating ev@t. The general functional failures that would have 'to occurbefore the sequence could reach a core damage end state and order of magnitudeestimations of their failure likelihoods are as follows:

~ Failure of alternate methods for cooling the SFPs that were not creditedin the estimation of the NBF as well as failure of operators to isolate

C.76


Event Trees

Zone 3 from the Unit 2 reactor building within approximately 33 hoursafter the initiator. The failure occurs if operators do not implementalternate feed and bleed cooling to the SFPs using one of at least'hreepossible systems and also do not isolate the Zone 3 air space from Zone2 air space. The likelihood that these actions would fail givenapproximately 25 hours between exceeding the SFP temperature technicalspecification limit and failure of ECCS equipment in Unit 2 is estimatedat O.I.

Failure of and non-recovery of all Unit 2 ECCS equipment that wouldnormally be capable of providing sufficient long term decay heat removalgiven the initial short term post scram functions are completed prior tofailure of the ECCS equipment. The likelihood that these actions wouldfail given the plant conditions, time frame and plant staff involved,and level of other activities is estimated at 1.0.

Failure of all equipment outside the Unit 2 reactor building includingECCS equipment fram Unit I that could be crosstied to Unit 2 orequipment outside the reactor building of Unit I or Unit 2 such asstandby liquid control, reactor water cleanup, fire water, control roddrive maximized, RHR service water, or pumper truck. Host of thesealternate cooling mechanisms are identified in the emergency procedures.The likelihood that these action would fail given the plant conditions,time frame and plant staff involved, and level of other activities isestimated at 0.01.

The overall order of magnitude estimate of the conditional core damagefrequency due to a initiating event in Case 3 is the product of the estimatedNBF and the three general functional failure estimation above. This productis summarized in Table C.VII below.

Event Sequence Evaluation: Events Occurring in Case 4 As-Fixed PlantConditions (see Figure C.7 for timeline representation of this sequence).


The plant's initial conditions are: Unit I is being refueled with the coreoffloaded into the SFP, Unit 2 is at normal operating conditions, the Unit Iand Unit 2 SFPs are cross-connected, the Unit I SFPC system is in service andthe Unit 2 SFPC system is inservice each with three SFPC pumps running, theUnit I RHR system has two trains available for SFPC assist operation, and theUnit 2 RHR system has one train available for operation in the SFPC assistmode.


The, initiating event occurs at time zero. LOOP, EXTENDED LOOP, and LOCA withLOOP cause a complete loss of offsite power to both units. LOCA and LOCA withLOOP involve a large, medium or small break LOCA in the operating unit and

C.77


Event Trees

result in loss of SFPC and cause RHR of the LOCA unit to .be unavailable forSFPC assist. Coincident with all these initiators, Unit 2 scrams and the SGTS

and the recirculation system automatically starts. Plant operators respond tothe event in accordance with emergency procedures and the TSC is activatedwithin one hour after the initiator. Note that for As-Fixed plant conditionsthe LOOP emergency procedures provide a prompt for operators'to ensure thatSFPC is returned to service. Operators at both units continue with emergencyactions after the initiating event and at 1 hour, operators recognize the needto restore cooling to the SFPs. If offsite power is not restored to the plantwithin 4 hours, the LOOP conditions are EXTENDED. Operators align systems foremergency power supply in accordance with the emergency procedures. The TSCremains activated and operators successfully respond to emergency plantactions for the EXTENDED LOOP. Within 5 hours after the LOOP, the operatorsand TSC may decide to use any surplus capacity available from the EDGs topower non-safety buses to support operation of the SFPC system. If the powerbecomes available to the non-safety bus for SFPC, operators would attempt torestart the Unit 2 or Unit 1 SFPC system to service. Alternatively, theoperators would align any available train of RHR from Unit 1 or Unit 2 foroperation in the SFPC assist mode as necessary to restore cooling to the SFPs.Within 8 hours the operators or TSC may attempt to provide SFP cooling byalternate means such as: ESW, diesel backed Fire Water, Pumper Truck, orother feed and bleed cooling alignments. These actions would continuepersistently as the SFPs continued to heat up and approach near boilingconditions. Offsite power may'be recovered later, within 10 hours or within20 hours after the LOOP. The SFPs would reach the technical specificationlimit of 125'F at'approximately 25 hours after the initiator assuming thatoperators at both units do not restore SFPC to service.

FROM NEAR BOILING CONDITIONS IN THE SFPs TO CORE.UNCOVERY

Without restoration of cooling to the SFPs within 25 hours after theinitiator, the SFPs would reach near boiling conditions causing an increasedrate of steam release from the surface of the SFP. Under SFP boilingconditions, the rate of steam release to Zone 3 will exceed the capacity ofthe normal HVAC system and the SGTS for removal of this energy. If therecirculation system is left running the steam spreads to the reactorbuilding. Approximately eight hours after the SFPs reach near boilingconditions (33 hours after the initiator), the steam spread to the reactorbuilding is assumed to cause ECCS equipment failure due to adverse temperatureconditions. The operators and TSC would make every effort possible to providecore cooling using any available means including:

any surviving Unit 2 ECCS equipment,O

ECCS equip'Sent from Unit 1 that could be crosstied to Unit 2 given thatthe Unit 1 reactor building was isolated from Zone 3 for refuelingconditions, or

C.78


Event Trees

~ equipment 'outside the reactor building of Unit I or Unit 2 such asstandby liquid control, reactor water cleanup, fire water, control roddrive maximized, RHR service 'water, or pumper truck.

Host of these alternate cooling mechanisms are identified in the emergencyprocedures. The reactor core would begin to uncover at approximately 36 hoursafter the initiator if all these actions related to restoration of cooling tothe SFPs with alternate cooling methods, isolation of Zone 3 air space, andrestoration of core cooling to Unit 2 were to fail.ORDER OF HAGNITUDE ESTIHATION OF CONDITIONAL CORE DAHAGE FRE(UENCY GIVEN THEAS-FIXED CASE 4 INITIATOR

The event tree presented in Figure C.T presents the sequence 'flow path thatcould lead to core damage given near boiling conditions from the Case 4initiating event. The general functional failures that would have to occurbefore the sequence could reach a core damage end state and order of magnitudeestimations of their failure likelihoods are as follows:

~ Failure of alternate methods for cooling the SFPs that were not creditedin the estimation of the NBF as well as failure of operators to isolateZone 3 from the Unit 2 reactor building within approximately 33 hoursafter the initiator. The failure occurs if operators do not implementalternate feed and bleed cooling to the SFPs using one of at least threepossible systems and also do not isolate the Zone 3 air space from Zone2 air space. The likelihood that these actions would fail givenapproximately 25 hours between exceeding the SFP temperature technicalspecification limit and failure of ECCS equipment in Unit 2 is estimatedat O.I.

Failure of and non-recovery of all Unit 2 ECCS equipment that wouldnormally be capable of providing sufficient long term decay heat removalgiven the initial short term post scram functions are completed prior tofailure of the ECCS equipment. The likelihood that these actions wouldfail given the plant conditions, time frame and plant staff involved,

'ndlevel of other activities is estimated at 1.0.

Failure of all equipment outside the Unit 2 reactor building includingECCS equipment from Unit I that could be crosstied to Unit 2 orequipment outside the reactor building of Unit I or Unit 2 such asstandby liquid control, reactor water cleanup, fire water, control roddrive maximized, RHR service water, or pumper truck. Host of thesealternate cooling mechanisms are identified in the emergency procedures.The likelihood that these action would fail given the plant conditions,time frame and plant staff involved, and level of other activities isestimated at 0.01.

The overall order of magnitude estimate of the conditional core damagefrequency due to a initiating event in Case 4 is the product of the estimated

C.79


Event Trees

NBF and the three general functional failure estimation above. This productis summarized in Table C.VII below.

Table C.VI SSES Site As-Found Order-of-Magnitude Estimations of CDF


Isolation/Recovery

ECCS Failure Equi pmentOutsideReactorBuildin


Estimation

Ran e From HBF 1.0 - 0.01 1.0 - 0.1 0.1 - 0.001

LOOP Case 3

LOOP Case 4

LOOP Case 5

EXLOOP Case.3

EXLOOP Case 4

EXLOOP Case 5

LOCA Case 3

LOCA Case 4

LOCA Case 5

3.1E-06

9.5E-07

1.1E-06

8.1E-06

3.2E-06

7.9E-06

8. 1E-06

B.BE-07

3. 1E-OS

0.1

0.10.1

0.1

0.10.1

0.10.1

0.1

1.0

1.01.0

1.0

1.01.0

1.01.0

1.0

0.01

0. 01

0.01

0.01

0.01

0.01

0.01

0.01

0.01

3.1E-09

9. 5E-10

1.1E-09

8. IE-09

3.2E-09

7.9E-09

8.1E-09

B.BE-10

3. 1E-09

Seismic Case 1

LOCA w/LOOP Case 3

5.6E-07

8.3E-07

0.50.1

0.91.0

0.050.01

I Total Estimated As-Found COF

1.3E-OB

8.3E-10

S.OE-OB

Table C.VII SSES Site As-Fixed Order-of-Magnitude Estimations of CDF


Isolation/Recovery

ECCS Failure EquipnentOutsideReactorBuildin


Estimation

Ran e From NBF 1.0 - 0.01 1.0 - 0.1 0.1 - 0.001

LOOP Case 3

LOOP Case 4

EXLOOP Case 3

EXLOOP Case=4

LOCA Case 3

LOCA Case 4

LOCA w/LOOP Case 3

LOCA w/LOOP Case 4

8.5E-07

4.6E-07

3.5E-06

2. 1E-06

1.6E-06

1. 1E-06

6.9E-07

4.6E-07

0.1

0.10.10.10.1

0.10.10.1

1.01.0

1.0

1.0).01.01.01.0

0.01

0.01

0.01

0.01

0. 01

0.01

0. 01

0.01

8.5E-10

4.6E-10

3.5E-09

2.1E-09

1. 6E-09

1.1E-09

6.9E-10

4. 6E-10

Totai Estimated As-Fixed COF 1.1E-OB

C.80

I ~ Iuc IQh Ao eeeesaf vou cevouesI 4 rc foueu la a c of se»uo ue Ac»soaaaco.I Q tC eelseu u 4 eso»u eesN 5 $Pc te»as.I Null ls Qt. Iue I Is Nvesos.I fc sl ls Ac el oe»esa lee vs»uaeau e»l Is A»eave ase eeouau lee Qlc ss slle.I fc rc 4o I ales AleLus 4s QKNoise uecets IN locA clou»eaacoasf.

TIMES 0 hour 1 how 4 hours 4 hours 8 hows 10 hows 20 hews 26 hows 33 hows 34 hours

EVEHTSI

Oot. SSIIICEOOot, ICAL5OCA»floot

lees I SCSasl'IICCfuue.

fuoaun.

Ous4 to»v ts aalSeseveA 4Ioot Aceuaef.

Vto sesca 'IIII IIKASloe Iuec5

tosoeWI 4l 4so Ncosvr ol~us4t »N.

4s svilss1~caMIfel au see ee»vIluc cs»sloe es ceo»Nasa~I NII. Sits aoe» lo 4A

tuw iuei4 es

~cuoloc uss

CAN 5 ICC5 Iovoseou Iscs AA loueaa eaAveeeu.

lue 5 Cva 4SA.le»coeM

A0TIVITIE4IOt» Nel ~ Vetoes

fSCAco ssoo

of»ouse ceases»Nstoeso eu fSC aloe 4(Ne»ssc loot coeca also. 0~SCNC IOCA Ioot.

Ololslslo alsfIwa e lllel

~NAIaf IAO 1.C loot

Nve »setose eeoclo Nu»e cooSAI se Vhl5C ~ Otvssola a»soyaso t»ev apllolewo l»a.uusf 4s ova IooaIAAesal Sess 4s QK~ss44 ea» sae»Olellule Vfuse«eleSftC.6jwasvs Ay4 sole flII4l SIIC ssau.

l5C 5 Oeelssels A»fNso»N~aeeeuo »sew al cvaes SftuISW. feo»»v. lees ~ el~Aee IS»tee asc4 Pue

~Alee 4 eueeoew oe lull.

assw»c cus~t»»As ce AN~cicsus»e Sse»

l5c 4 lolllslssec c IAKeweec N ICot~fsu taws NsNleaeA

I5C 5 Olelssols eeef oaooec aaslalso~»soe el cuvlc seKsv cue ecaesesauc, oeessL foe wslv, coo

~4. A0 Sw. te»ev e»csOAIvsauc 4 os»aulas el Cofl5 lelulsK. Iaes 1 ScfsauS el IsI»coo~ A»55 TT llA so.

Figure C.2, As-Found Conditions - Case 3 (50 'Z3

t+ r0

W CL

r0 xr0Ili O

I 5 uH 5 Sits are 4ALIHIwcaal VHassscoereuuo.IH I VIC sl essa N sauces areas 5 SlpC Heapa

I VtC oroaa Is 4 HHVIIISO 5 SltC HartaI cero ls 4 Vt. lws I Io ataaray.I 4 sl 4c I aw OH4w w Srrc s Naa

M I II4 Vs I eau aea4us lee vK assw leeceH 4e IocA oew oorcar4wf.

TMEEI 0 hour 1 hour I hows 6 h'ows 8 hows 10 hows 20 hours 25 hows 33 hows 38 hours

n03

EVENTS:LOOt, IXIIIXXOOot. 5 lOCA

LSH I SCrwlI'OIC C Iww'.oaINNI.

Orrrcs tcaa Ls w4alaeA uIOOP eeaarLHII.

Vte Ieacsr ISS I IIIIA5ooc ILoco.

PrrarHLC 4I ase Iscoeaa ol~III1I teera,

teeeasrr 4I Hrl4ioraoarf «I eueeo loaaWs aeouc la eaeaaoa~I leo I. Iltsa Oavaec

IIIIH IHeecs NrrlCIOIII1IHO.

LSH 5 ICC5 IOHaoeo Isa Na so

No aa IaeaaeeescLaa S CarO letarH rocera

ACTIVITIES:Oper asses eospear

Cpa INIS Ceaaava

~Ileaa aaIaoacec IOut ee

loC4

ISC Vel ao~ulrale1, 1

ICot.

Opaaaa Nel

~alai el ues 51IOOP.

Opaaws secolrrao sealN HINrS CWN1 H Vta

ISC 5 Opaseers HarepoIo loeae opcroHNH we~IINIave OIH IOOIHrcaeHO 4II 4s Sr IC~pNoerwaaaaaOaaaaa al v HHallrtc.Eteraas al v aaeHIIICue 5ltC ~ sara

ISC 5 Oaerew a eeoc Iaseaac~aware Hosea Ol cacao Sits:I5W. Iae Nasa, Ieec HHlaaS rsaaa I vrl. LHHUION1 H saraolroo ac IHSI

AIarreec Irra~PHHHI 1IIHIIrocecruaea 4es.

15C N IIHNrNalrl aeKWWO 4 LootHla teaa IIIWAHA

ISC 5 Oper sea Iaal olaaas IawrIN«seel H cvass HKINcsa ersaeHO:IIC.OWCXA lee uraW, CIOaaerae1. 4 4 Sw. Preerlra assitas ueces1 H aueoa1H ol CCII.1 HNNNALOH I SCILAIISH IsNarcem Na Ia ICCE areola,

Figure C.3, As-Found Conditions - Case 4 m34

l0 'Cl

c+ ID

M C3.

I0 XIDIPI n

1$EQlRR G8NLQQMl?lQN~SF KILQQEXXL2QP A.LQCd.lI 5 w 2 5Its ase soc4af lsahsoa o«s uses oaaecsoo.

acs I VIC SIswa N o«sao aaao 5 SflC Post«ala I SIIC sf4« N 4 WeAa soOO 2 SIIC p«eOA

I cue N Ia 5fl'.W IIaaua4S-IVPISN2«w«wu WVICss4AI Ia 8 4s I a» s eeNNso SN afpC osNN loosops IN IOCA eosaa cooouo4I.

0TIME: 0 how 1 how I bows 5 bours 6 bows 8 bows 10 hews 15 holus 20 bows 23 bows 26 houcs

nCO

EVENTS:

ACTIVITIESI

soot, ISIISSSIOIOOP S LOCA

sao 2 5csallSCIE Ehao4aoeswa

IIp«swc NapaeaIe al4s4

ssa Passu lrool 4N«eAdW«loa lootcao4scou.

Oa«owa co«Noes~ Noose W

Iesooooa lOOP ee

IOCA.

Vto asses 125 f II«ASloe Isail.

Oa«ewe secosuseN NN«t cesaoo

N V Pa.

ISC ruarlo4«4NoA IIlCOP.

IIC ~ OP«awa~saaepo aa Io«as~ffoopwaa oea osresfaoa SON IOCao«44O Ioc w VIC~Sea«a aa«tata

Nsl ~ Naf~ assoc

~N«l al ssss 2.~ loof'.

Ores N«s ay N IsN«l5ITC,OfeIWIO ay aa escaNNIN5IIC aINN

ISC ~ Oaeeews e«sf eswepeNwwo assets al c«aoo5I ts: Issf. Iso «sw. Iota~aa IJooA Po«p« a«N. OSN«wacs la esse«sate el Nlfl.

IINI«s'ilW WeIosao«f al elise ~

~asses,

Isesa spoeoas as

«classes lese

A sat«so aau~a«ews oa AN~NP IOCtsslssaal«N.

Puoof«s us wy Wo~Cas«f al str»N pa««Ital ss«uec la~ NeaN«O ISI Iofl,

sa«2 Co ~

lau I ICOS II«e««N Isos 4o aeo«s so

N New aaseeoooec. vaceNs,

ISC ««acwuto ~ 4scs«uaa« luot toto Oo«N stew w»I-

l5C 5 Oyos was avf Nssoae~as«we a«sos sl coo«OItscNs ca ~ Ilos»s«N sl cNefCu, fee frNN. CAONs«slseA fa flSaf. Iatatees«ca oui utosoc 4~ «a«soot ol CSS I.5 sess«NA Iles 2 SCISsSSS se

o ssoo4«o 4a ss ICOS

ISW.I

figure C.4, As-Found Conditions - Case 5 Cfl( %CD Cl

C3M ID

W EL

CD XCDIll O

IZ-.EQQNOMANLCQBSIIIM~BSEXJMlSNIClrs 1 5 IM2 Sfts oro bvdrhsy lso4ted.

iM I St tC Syslenr ls In s seeks ush$ 2 Sf tC prenphM 2 Sf tC Sysr«n ls 4 seeks uslns 1 Sf tC prsnps.M I S IM2 Na Mhay ep«ethp.M I fa flbte I I rh avsetbh lot Sf tC asslsl.

2 fe pl bss I I eh evsctbh loe Sf tC ssslsb

TIMEl 0 hour T how 4 hours 10 holllS 16 hows 60 hours 68 hours 64 hows

EVENTS: lvdewloIEot dm so suavernsrtsru

Ollsae tew«4 aolSoslored Ifsltndedloot cendshul.

toINII411st 4I~ LN v«y 4lo wth10 lvlrecovery el ollsbo powerInos vedi ed 4 e srsnsuon al Nl

Sfta toads spproe. Iso F

Lfocb 5poc Lords la 11$ fl.

Ilail I Sft bophs le IkW I 5/ot LM2oea, IUnls 2 boas al IM I blot LM2 Secs frpcfm«d cere basins Io~pproa. 100 Iunasl. Fels dvs Io steve onvb«vnsnb vncavor.

IMs 1 1, 1 SCSaaa

TdiK"Csecac.nnovvl.

Iner Sss lsd rale,

ACTIVITIES:

opN«ors rslpen4 so

Ssrunk ovens SLOOt. ISC Assessed

Opere«vs comhvs<slponse 1st Selunkfvenl 5 fetrnde4lOOt.

OFNSI«a Iolosrcte nes4 leroll«o coolno lo Sf ts.fsccopcruslrcaarsllvnpl le pew«epptspr4ronNS safety bue &em 5 OOs

Pncardhd Sod loe Sf tCsysl«n ep«srhtu Shluedr«4 lor erlsMdon ol

A awned tires

oper slots 4a rud sloprocbcWIhn Isns.

lSC ~ Operas«l msy olternpl~avesta means ol ceased I sachs

cere uslnp any tetnhhhp syvemslSLC. CIO IMseeue. fir~ WVV. attumpor uncs. Noc u sdcsd k~ atsnsdon al cof1.

op«vers uy se shfn tuul I«SFtC sstht

ISC Sr Op«SIOro msyeu«npl ok«MIo resene olcooled Sf ts snlns anyrernsedns syslsnul 5Sly. Fbe

wstv. Feo4 on4 bhs4.turne« Iruca IHolctedro4ss eulmsrlon ol ubf1.

Figure C.5, As-Found Conditions - Case 1

& 'Oet. FDa-Iafu xFDLrs

ararat uwz.aamunan~smuaae.zscaae..cacaw iaaf.+warnI 5 uso 5 5lto eu NeusN cuss we»os«AI SfKLasso»» N saeva ea»S 5 VKteats.

~N I sl tC Sew» ss Ia sc»No w«O 5 VK«eeo«I sw N «Vt. Nw I la N«ss»OI fool «ea s»o»s oeaeosv loe slrc asaw.INu «w I ae» aesseLN Ne LIICoc«as

TQIEI 0 hocu 1 hour 6 hours 6 hosts 'IO hours 20 how« 26 hours 33 bosos 36 bows

EVENTS:

soot, Illout,COCA. v LOCA»4LOOt

uv I SO«ANICIEsa~»ass«a

Oos«a ts»» N eos

AesWeA 6 ass»eelOot coeowess

Lite esse« III I II»AStoa~ws

raov44 Sv Nse~oce «role«srv

teuewl Ae e» I lw~coe» I sl ausw taws

l»N veoce4 Lo esse»ow~I soul. ura Lassoes Leo

Svw wr 'sveeso N~eo OW 4»N

uW I ICC5 I«»ee»e lev 4w~e ovw eeeoe»ow

uw I C»oso V» oo

evaev B0)

ID

ACTIVITIESIOt«wv oaotaW

~we ce»«»a~roose fvIosoaooo

00t ease» IOCAc aooaew.IICAcsews

Oe»N«s eecoeeuo~eoc N sva«a

~osu u Vto.

I IC ~ Oe»asses o»eeoc so

~teestow ew swor N»Lew IOCa Secses»4544 «eaftC as saw w»«Les

Oeee Wse»r so ee»»a 5frC.dieess«ai ifse cooi «su IvIflCosew

l5C ~ Owesseo we vs«ew~»»esse woes el cwses Vto;lLao. Iso «sw. Ivo oeo Lassot»e»» «ecs. Sao c«A«4 N~a«»caw ar curl

Oo»ewe acs»ets ao

Nee SOC«seWeea uae

rsc ~ owcove wr swats~a»ew New ol c»4»O Ne~sscw co o eo«O SIC. OOwWec» foe»aw. tveeecwca. OW ueooo4 v a»ewwo~I554«

Figure C.6, As-Fixed Conditions - Case 3

Cl& 'uet ED

ITI XA)Ifl A

'I ~ lars 1 Sits sro I>west uses oew«assesI VtC Sysss¹ o k ssrrsso «ws 1 SrtC p«eps.

Js 1 MtC Ssusro Is Ia sarelco eosN 1 IIICpc«suI cuo ls k srt. sacs 1 u ep«awpI rc rlpas 1 srso¹ oeacsssa w IIIcaasrsL

cs 1 so plw I srJo eeasrMa w vtC asaeu

~QQL.EX~QCl klQCBMLQM

TDCEI 0 hour ~ 1 hour & hews ~ 6 bows 10 hows 20 hours 2S hows 33 hours 3& hours

EVENTS:

oot. sysoot,lOCA.¹lOCA«I loot

OOSISO terra Sa ¹l4swoA llsseacas vts roacss IIII crace SpecOot a«osao¹1. lleau.

~eeoc«el ler arse

~eoeery ol Vcsiaopo«er

~W'wy I«o~os«eery ol cow p¹«rWl lreeu J la o ss¹eae«~I lrclk Vps ~ o«so oec.

laee 1 ICCS Ie«sr««¹ ru< Jrors use« eeaeere¹rc

uec I Ca ~

leo«s leU¹e«I

raao 1 SCSAIIICICClicK

Sreau r¹y apollos~s kueaseJ lass Jaal laouloJ.

ACTIVITIES:Operas soaps«lre Sesrew. ISC As*wc

Operawa cases«o IIC1 Op«asoe w«eps so

~spools kisses«cae «ee approptw «¹ classyOot oatw loCA oes So¹ Iooa Sacoas«S Sco~«Jrsa¹. lvSltC ssu«o op«osiers

ISC 1 Oeeasaars aray aswreo~Cor«oso usa¹ ol cars«S Sl taISW. Ioo «es«. Icos ¹Jlos N, pre«pes s««L pses

uo«sec k ouse¹«o ol Iso I

Oyu was uae«sc sa

wp aec rcsoares

ysc s opusws «say l««aplsoar«uo e«s¹ sc cukO W~ acw cus wlu Sl C. Coro

r¹e'e«re. Ies «slu. pseeper

wca. Oeesuaocockosu¹¹«~I Csyl.

Op«awe aeaepcro¹oJ oo slowscessor Vts. Operasors «y so sea« s SlrC

dpcrowa sry se ~lieiT«IIPC areal

Figure C.7, As-Fixed Conditions - Case 4( %ID Cl

C+ ID

M CL

ID xIDIyy

APPENDIX D

MISCELLANEOUS INFORMATION(HRA Analysis, Assumptions - Basis and Impact)

Appendix 0Miscellaneous Information

This appendix contains the information describing the methods used to generateand select the values used for human reliability. In addition, the .

assumptions and their basis and impact, used in this evaluation are includedin this appendix.

a) Human Reliability Analysis.'ontains information describing themethods used to generate and select the values used for humanfailure data.

b) Assumptions - Basis and Impact. Contains a listing of theassumptions used in this evaluation. The basis and impact areprovided for each assumption.

HRA Analysis Appendix D

Hiscellaneous Information

Human-Failure Data--Human errors can contribute to system failures orotherwise impact the sequence of events such that cooling to the SFP(s) is notrecovered,. 'mportant human actions are addressed in the values used in thetop events of the event trees based on a simplified approach for the treatmentof human errors. Proceduralized actions performed in response to evolvingplant conditions were modeled as critical actions and were quantifiedfollowing guidance from the Accident Sequence Evaluation Program (ASEP)provided in NUREG/CR-4772 (Swain 1987). Longer-term actions that involverepairs or innovative recoveries were treated as recovery actions. Theseactions were quantified based on ASEP guidance and estimations from NUREG/CR-

4550 (Harper et al. 1991} in Appendix C, Section C.5, "Issue 5." InnovativeRecovery Actions for Long-Term Sequences Involving Loss of Containment HeatRemoval'." These techniques lead to human-error probabilities generally in therange of 0.004 to 0.1 for restart-related actions and generally in the rangeof O.l to 0.5 for repair or recovery actions.

The human error probability values that represent the likelihood of operatorfailures associated with operation of the systems and equipment presented inthe event trees are estimated based on the consideration of several factorsthat impact operator performance. These performance shaping factors areconsidered within the guidance of the ASEP methodology when judging the likelyfailure range and selecting failure values. The factors considered generallyincluded the following as applicable for the equipment and actions under beingevaluated:

~ the number of systems and amount of equipment available that couldperform the required function;

~ the degree of perceived importance to plant operators and TSC staff;the significance of the event sequence and associated disturbances thatwould be competing for the operator's attention;

the approximate time available to complete the action;

the indications of plant and system conditions that are available to theoperators or TSC staff;

the degree of procedural guidance'; and

~ the overall plant damage state for the event sequence.

The progression of the most important event sequences involves requiredoperator action at every possible success path presented in the event trees.The initial actions generally require the operators to restart a system orbring a standby train or system into service. These type actions are

tgenerally proceduralized. Subsequent actions would involve recovery actionhat involve systems not normally used for the function intended or repair

ions

actions that require returning a system to service after completing some

D.2

HRA Analysis Appendix DMiscellaneous Information

maintenance activity. Guidance for these actions may not be addressed as wellin procedures and these actions would take longer to perform. The actionsattempted in later stages of the event sequence may involve more significantrepair activities or use of alternate methods of performing the desiredfunction. The guidance for these types of actions typically would bedeveloped at the time of need. These actions would be taken after other morestandard approaches have failed as time allows. Judgement is used to estimatethe human error probability ranges and values for each of the actionsconsidered based on consideration of the action type and the performanceshaping factors involved with the action.

The specific human actions that are assessed in this evaluation to estimatehuman error probability values are:

Restart recovery of the SFPC system, Unit I or Unit 2 (as-available)

Place RHR in the SFPC assist mode of operation, Unit I or Unit 2 (as-available)

Cross-connect the Unit I and Unit 2 SFPs (as available)I

Repair recovery using either unit's SFPC system or RHR system in theSFPC assist mode (as-available)

Power appropriate non-safety bus using surplus EDG capacity (as-available)

Recover EDGs after their initial failureIsolate the HVAC Zone 3 air space from Zones I and 2, or providealternate (non-routine) cooling mechanism to the SFPs to precludefailure of the ECCS equipment (as-available)

~ Connect and align alternate (non-routine) cooling mechanisms fromoutside the reactor building for cooling the reactor core (as-available)~ Recover any surviving ECCS or alternate cooling equipment from eitherunit that can be aligned for reactor core cooling (as-available)

The Tables below show the human error probability values used for each ofthese operator actions for both the As-Found and the As-Fixed plant conditionsand for all initiating events and cases analyzed.

D.3

~ o ~

t ~

gg~o ~ i KERQeritmQstigKT~QrritIgiittggiittgKERQslitl~ss< Kggggg~~sr o KgQeritm ~so s s Kfgg+itiiggiiti.mgiittgggg fiit17~ss ~ Kgggjg@Kf~~st i KT~Kf~giitrg~KT~RLERpier /~so i R

gg~oe gpggQiitt:gQitrtgR77~giii-gsgii<gigiittgRpgggittg~s ~ i Kggggg~~< ~~ os gggg giiiggiiiig~~giitt7giitiig~i ~ o gggg giitg~s ~ s KERf/'g

QstigtQsiigi Qstig Q<tit]Q<~<gsQsitIQetige QsSt~7 Qsittg Qittg~sr t gggggg~gill t pili t gilt t xiii»gIgiilglgllllggill s gllltlgglllllggiitl)~l ~ e

KRKTLRKTLRQsMKTL%KTLS~<rRVLRK7L%KES~s ~~ << ~e ~~ ss KERRY+ggiitg~is 'shiit/ giit~Qgii''/~et ~'s giittgQiirgQt<~~'I~so s KERgggg~fiick.gQsi«g~ss s Qsrig Qstiig Qeettg QsiitI[iiQQsQgsitg ~o ~ i KERggg~giittlgiit,tggiitggiitt7giitrlgiitrg fiick.@~i< i ~is i fiick+ ~» ~ ~ KERgiitr)~giitggiitrlgiirg~rsi giiiiggiittggiit.ggiitg~iei ~s ~~ s< ~o ~ i Kf~giitg

KT~KgjgQssIKT~KT~~ss R77~gJpgjg KER~~Rgg giiQigiitrgs Qetetl~is s ~ss i giitgQsiiig~ss giitggiQ<~so i gggg[si~g

is pier.tg~ie o giittJQiit+~sss giittggiitt7giitg~t< ~s ~ i KEg~e ~ s

gg giit~g< QrtillgiitQi~s' Qiittg fiick'gigsgiitt7giittggci@~ss 'ss s ggg~gill+i QIIQe Qs111g ~o ~ ~ ~tl o fllltglllgl~IO t ~l ~ o ~t ~ ~ ~l ~ ~ ~llo gpgg~g~~'p~~ee s ~gj7~~ss K<f~KT~R77~~i ~ s ~s ~~ ss giig+gg/g /litt/~ll t /IIII/~ss giiLttggllge ~eo 'I ~ll~ ~<s ~ ~l ~ ~ ~l ~ ~ ~ss~giitg~ii s ~st i giiltlgiittggiiog~is s Q<<sooolgsitt /~it s ~ss i fiickeI+gggg Qstitg KfjPggiiigiKT+Kf+pigQstitIgitgKf~~rs i ~ss i KEgggg~giittIKf~giitQKERgg~giittgpier /~et s Kf~~i ~ i ~os s KERgPggamRLTimKTLRRKBKrLSKTLmrmlRLrimKTLWKERL'KmrmlKERKmQg ~< ~ ~ KT~glllllKERKf~/IIIII'llllg ~ol o KT~~s ~ ~ ~eo o KERgggg~ ~r ~ e KERgiirrgKf~Kf~giit~g~r ~ i giittgR77~giittl~s ~ s KERQggQg ~ss Kf~giittggiittgKERQiit.QfiirQgiittggg~giittg~ss ~ KEggggg~~is s Kf~~ii ~ ~is ~ Kf~giitg~ii < ~is i KT~~ss ~ ~s ~ s KEggP~aaKTSRKEaaxHIKrLRK7L%l9KaaLrLSKERKfcammEK~&KERKKR

~ia s ~~i ~ ~ ~ee ~ Kf~~s ~ i ~is s ~<. ~ s R77~giitg~s ~ s KERgjggg~[IIII(Kgbgiillg glE(tgKgb~so 'o gttlg< giitlgKfgjg~sa ~ ~ ~er 'o KERgjggggQ<tigiggg Qiiitlgiit-gs KfjPRgiitQ<QsiigiPiirgKERQsStg~i ~ s KERggg

tggg~~ii i ~is ~ KfjPg~is i giittIgiittgKf~gsittg~s ~ s KERgjgggaaKERKEaax'zi1KERKEEQKIKTMKERKTLRRmlaEmKERELmQg /IIIIg~ fillipgllllgKER~0l ~ ~OI o ~lt o gpjgg ~lt ~ ~le o KERgjpjgg~giitIKEggiit.@~i ~ s KEg~ss s fiick-+~is s Kf~~is ~ ~s ~ s KEggggg~QgiittgKERgiitQfiick.QKERgiit.QgiitrggiitlKERQiii+~s~ s KERgjggg~ giiils ggjgg giitQ~i ~ s KEg~is s giittg~ss ~ Kf~giittg~o ~ ~ KERggggKRKERKTLS~«KERKTLSC9K~IKTLRKTLREiKRQssIRK~HRVLRKTC%+g~ll t KT~Qlll<gl~lso gj7~~ll o fillipQoo~o~olKf~~llo ~s ~ o gjJ~QPgg~(littgKEggiilgi gllllIggg giillggill'ge giitlIKT~~ll~ ~l ~ ~ KERgjpgg R77~ KERKER~sr s ~ss i KERKERgiittggiirtIlgiittI~os ~ Kf~gpjP~amKERKTL'RKTC%ISEIKKEiamaKTLRLmlRmlKKQmmKrLSarRRKTCRKTCSKTCRKERKTLRK9K~IKTLSKTLRKTLR~~~IK~MKTCRKK~KSKTLVKESKERL'ZM~<i~o KESKTSS~REM~s~ s RKtHKTCSKK%~Kf~ggggKT~giitg~s ~ ~ KERKEg~is s ~is s giit7~ts ~ Kf~ggjggggiir)giitg'gsitgKERQiittg~i ~ ~ QittlgsittI[iiQigiitr)~<s o gEg Qitg~Pg Qiirtggiitrg~s ~ s ~giitt7~se ~ Qiitt7~rs s giitQgiitrg~<s ~

aa RLTLSKTL'RISBQKTLRELmrmlamKTMR77L'RKmlamuaVCammQg ~el ~ ~l ~ t ~ll~ KER~o ~ o glllg ~o ~ ~ ~ss Qsso~ol~ts ~<s o Kf~/litt/

~ ~ ~l ~ ~ ~l ~ ~ KER~l ~ ~ ~ts ~s ~ ~ ~e ~ ~ ~oe ~ ~<l ~s ~ o Kf~+litt

g

'ss ~ I

ee

hlkmmeRRRSI~HR~~i~os ~es~e~es~s~s~ss~~i~so ~es~s~es .~i~i~os~~i~os ~ee i~s~ei~o ~ ~+e ~ s+~~

~i~os ~ee .~s~ei~ss ~i~os~~so~i. ~eo ~i~i~os ~s~o ~ ~~~LF~~~~so s ~~so~re ~i~so ~i~osQ+~so~s~ss~s~s:~os ~i~soQQ~eo~s~oo~o~o~es ~i~os

MR~~&~~ss .~s~s~o ~ ~s~s~s~oo ~~~i.~se~~os~i ~e~s~ e ~i~so ~i~os ~s.~es~~se~s~s~s ~ ~i~so ~+so i+~i.~so ~g+~~ops.~s~s.~ss ~e.~es ~i~os ~eRRR'L'MNXR%%XR%%RRM5%%iE%~MX~IE'K~MK~~~~~~EM~~i~el ~s.~el ~s.~oe ~i~osMZ~~~~K'M~~MV~QQ ~os~i ~so~i ~i~os ~i~os~~se ~i ~se~~ s ~s~o ~ ~i~os~ ~so~re ~i~so ~s.~os ~i~os~H~MSEMMZ~~~~~MVKMmmmK~mZ~mSummK'mmV~mV~++i ~ ~~se~s~s~oo ~i~os~MX~MX~MZ~~~~~M2RM

~so~i ~so~i ~i~os ~i~os~MX~ME~~~~~~MB~~~so~i ~ss~~ e ~i~os ~i~os~~so ~~s ~i~so ~s.~se ~s~s ~

M&BHRKRHRZMKKMHZ%%iER~~K~ MK~MK~~M~MR~

MK~

Assumptions - Basis and Impact Appendix D

Miscellaneous Information

The assumptions for the As-Found condition are listed below. Modifications tothese assumptions to reflect the As-Fixed condition are provided at the end ofthis list.

Spent fuel pools (SFP) are not initially cross-connected (ice., gatesare installed separating the SFPs) except Case 3 in which the SFPs areassumed to be initially cross connected.

Basis: This assumption is based on observations during the initialplant walkdown and statements by PP8L regarding past operationalpractices.

Impact: This assumption effects all the event trees except seismic(seismic is taken as failing crosstie) and all cases except Case 3 thatassumes the SFPs are initially cross-connected. Successful completionof SFP cross-connection is necessary to credit cooling the SFPs fromavailable systems in either or both units in the success sequences.This assumption leads to estimated NBFs that are larger than forconditions in which the SFPs are assumed to .be initially cross-connectedSee As-Fixed conditions.

2. The SFPs are successfully cooled when the temperature in the SFP withthe higher decay heat load does not exceed 200'F for an isolated SFP, orthe temperature of the cooler SFP does not exceed 170'F when the SFPsare cross-connected.

Basis: This assumption is based on an estimate of a temperaturereflecting imminent boiling conditions in which heat transfer to theroom would be accelerated. A 30 degree F differential temperaturebetween cross-connected SFPs is considered necessary to promote adequateheat transfer to prevent the hotter SFP from reaching imminent boilingconditions.

Impact: This assumption effects the time to boil estimations after aloss of SFPC event. The time to boil estimations affect the eventscenario time line evaluations.

3. The heat removal capability of two or three Spent Fuel Pool Cooling(SFPC) pump and heat exchanger loops is assumed to be two or three timesthat of one pump and heat exchanger loop, respectively.

Basis: This assumption is based on SSES procedure OP-135-001 thatindicates that the SFPC flaw rate is adjusted in multiples of 600 gpmaccording to the number of pump and heat exchanger loops in service.

Impact: This assumption effects the success criteria for the number ofSFPC pumps and heat exchanger loops that are necessary to prevent SFPboiling.

D.6

Assumptions - Basis and Impact Appendix DNiscellaneous Information

t

The heat load offloaded to the SFP is controlled such that the SFPCsystem maintains the temperature in the SFP within the administrativelimit of 115'F. This limit is maintained by controlling: the number ofSFPC pumps and heat exchangers on line, the time of the year therefueling is performed which impacts the Service Water System (SWS)temperature and associated SFPC heat exchanger capacity, the amount offuel offloaded, and the timing after shutdown of core offload, the watervolumes connected to the SFPs, and use of RHR in the SFPC assist mode ifnecessary (i.e., outage with full core offload under summer conditions).

Basis: This assumption is based on discussions with SSES personnel andNRC staff to set the conditions for the As-Found analysis.

Impact: The assumption effects the heat load conditions and is used toestablish the various As-Found plant conditions (cases) that areanalyzed. These conditions do not reflect the design basis limits ofthe plant regarding SWS temperature limits and SFP capacity, but reflectestimations that bound the plant's prior operating history. SeeAppendix A for detailed discussion of the Case definitions and theirdeterminations.

The heat load admitted to the SFP and the pool configurations arecontrolled such that the time-to-boil after a loss of SFPC is greaterthan 25 hours. However, in the past, pool configurations may have beensuch that time-to-boil could have been between 15 and 25 hours for up to10 days.

Basis: This assumption is based on discussions with SSES personnel andNRC staff to set the conditions for the As-Found analysis.

Impact: The assumption effects the heat load conditions and is used toestablish the various As-Found plant conditions (cases) that areanalyzed. These conditions do not reflect the design basis limits ofthe plant regarding SWS temperature limits and SFP capacity, but reflectestimations that bound the plant's prior operating history. SeeAppendix A for detailed discussion of the Case definitions and theirdeterminations.

The operating cycle for a SSES unit is assumed to be 18 months and theduration of the refueling outage from unit shutdown to startup isassumed to be 75 days.

Basis: This assumption is based on discussions with SSES personnel andNRC staff for defining the case durations in order to estimate theannual near boiling frequency.

Impact: This assumption effects the normalized time that an SSES unitis in each condition analyzed.

D.7



The Residual Heat Removal (RHR) system of each unit is assumed to haveone train dedicated to reactor core decay heat removal for the followinginitiating events: LOOP, Extended LOOP, SBO, LOCA with LOOP, andSeismic.

Basis: This assumption is based on the expectation that the reactors ofan operating unit will scram for these events and core decay heatremoval needs will require dedicated support form one train of RHR.

Impact: This assumption effects the availability of the RHR system forperforming in the SFPC assist mode.

The RHR system for a unit that has a LOCA initiating event will not beavailable for SFPC assist mode.

Basis: This assumption is based on statements made by SSES personnel.

Impact: This assumption results in the event trees for initiatingevents involving a LOCA not including a success path using this unit'sRHR in the SFPC assist mode.

The initiating event frequency for Loss of SFPC is assumed to includethe probability of the operator failing to perform immediate restartrecovery actions.

Basis: This assumption is based on the implications associated with thezero failure probability technique used to estimate the initiating eventfrequency. This approach is taken as providing the system failureprobability after operator response to minor system disturbances.

Impact: This assumption results in the event tree not showing a topevent or applying a failure value of 1.0 for restart recovery of theSFPC system,

D.S


Hiscellaneous Information

During Case 2, the RHR system is assumed to have one train operating inthe shutdown cooling mode. The other train is either aligned forshutdown cooling or out-of-service for maintenance. In both conditions,RHR is not available for SFPC assist mode operation. The RHR Systemwill be in this latter condition for a total of eight days. When theRHR system is not in maintenance, one train is modeled as beingavailable for SFPC assist to account for shutdown cooling operationproviding cooling to the SFPs.

Basis: This assumption is based on the statements of SSES procedure GO-

100-006 and discussions with the NRC.

Impact: This assumption results in only one train of RHR beingavailable for realignment to the SFPC assist mode given a loss of SFPC

during a majority of this Case, and in no RHR being available for sevendays.

A thirty-day outage for SWS and/or RHR is assumed to occur eachrefueling outage after the core is offloaded, the reactor cavity gatesare reinstalled, and decay heat decreases to within the capability of 2SFPC pump/heat exchangers (Case 3 Condition). Although this outageusually lasts only ten-days it is modeled for all of Case 3 (thirty-days) with the SFPC and RHR systems out-of-service on Uni.t I and theSFPs cross-connected. This is slightly more conservative than modelingthe Unit I SFPC in service with the pools not cross-connected. Thissmall conservatism in the model is based on the assumption thatadministrative controls do not limit the time the SFPC system is out-of-service.

Basis: This assumption is based on discussions with SSES personnel andNRC staff.

Impact: This results in out-of-service SFPC and RHR systems duringrefueling. The SFPs are cooled by the operating unit's SFPC system viathe cross-connect. The SFPC and RHR systems of the unit being refueledare not available for return to service in less than two days after aloss of SFPC in the operating unit. For modeling purposes, this outageis taken to last the entire duration of Case 3 (30 days). This isacceptable, as modeling the SFPC and RHR systems out-of-service on UnitI and the SFPC cross-connected is slightly more conservative thanmodeling the Unit I SFPC inservice with the pools not-cross-connected.It was decided to model 'this period using the former more conservativecondition because no apparent administrative controls were noted thatlimit the time the SFPC system is out-of-ser vice, and the conservatismis small.

D.9



Five Emergency Diesel Generators (EDGs) are installed at SSES any ofwhich can be aligned to supply designated emergency loads or SFPC systemloads for either Unit I or Unit 2.

Basis: This assumption is based on SSES IPE station blackout (SBO)discussion presented in Section F. 1.2.1.4 and discussions with SSES

personnel during plant walkdowns.

Impact: This assumption effects the Extended LOOP and SBO event treesin consideration of EDG availability to support subsequent recoveryactions for restoration of SFPC. This assumption leads to estimatedNBFs that are lower than for conditions in which EDGs are assumed to beunavailable or not recovered.

The SFPC system for one unit can provide adequate cooling for the SFP ofthe other unit when the gates separating both SFPs from the fuelshipping cask storage pool are removed. This cross-connected coolingarrangement requires a differential bulk water temperature between theSFPs of approximately 30'F to promote adequate water exchange.Additional SFPC system line-up alterations to provide forced delivery ofcooling water to both SFPs are not required.

Basis: This assumption is based on statements by PPLL that single unitSFPC operations have been demonstrated and engineering judgment that a30'F temperature differential between the SFPs will provide adequatethermal driving head for mixing.

Impact: This assumption effects all the event trees except seismic(seismic is taken as failing crosstie) and requires successfulcompletion of SFP cross-connection to credit SFPC from available systemsin either or both units in the success sequences. This assumption leadsto estimated NBFs that are larger than for conditions in which the SFPsare assumed to be initially cross-connected.

There are two building cranes that can remove the fuel shipping caskstorage pool gates, and a qualified crane operator would be availablewithin 2 hours of the time requested.

Basis: This assumption is based on statements made by PP8L andengineering judgment.

Impact: This assumption effects the estimation of availability ofcross-connecting the SFPs. The resulting cross-connect failure valueestimates are smaller than if only one crane were considered or iflonger times were required for the qualified crane operator to be readyto operate the crane.


Miscellaneous Infopmation

15. The fuel shipping cask storage pool'is always maintained full of water.

Basis: This assumption is based on statements by PP&L and observationsduring the walkdown, and the need to eliminate radiation streaming fromthe SFPs.

Impact: This assumption effects the complexity of the cross-connecti.ngthe SFPs. The result is that cross-connecting the SFPs is lesscomplicated and takes less time than if the cask storage pit had to befilled with water prior to cross-connecting the SFPs.

16. 'Approximately eight hours are required to pl'ace the RHR system in theSFPC assist mode of operation.

Basis: This assumption is based on PP&L submittal to the NRC, dated May24, 1993, page 19.

Impact: This assumption effects the estimation of the availability ofthe RHR system for SFPC assist operation. Human reliability provides alarge portion of this estimation and in this case results in largerunavailability, due to estimated human error probability than would beestimated for a less complicated procedure that takes less time toperform (i.e., significantly less than 8 hours).

17. There are two diesel fire pumps that can provide makeup to either Unit'sSFP under SBO conditions.

Basis: This assumption is based on discussions with PP&L and the FinalSafety Analysis Report (FSAR) and piping and instrument diagram (P&ID)information.

Impact: This assumption effects the considerations made for longer terminnovative recovery actions by the TSC. These innovative recoveryactions involve alternate cooling methods and are used in developingorder-of-magnitude estimates of the potential contribution to coredamage.


miscellaneous Information

18. The gates separating the reactor cavity from the SFP are provided withredundant positive-sealing devices and alarm features with alarmindication of seal leakage and a low SFP level. Any significant loss ofSFP inventory would require a concurrent major rupture of bothindependent sealing devices. This potential failure, as an initiatingevent for loss of SFPC, is not modeled since it is considered notcredible.

Basis: This assumption is based on statements by PP&L and a submittalfrom PP&L to the NRC in response to IE Bulletin 84-03 concluding thatgross failure of the reactor cavity seals is not credible.

Impact: This assumption effects the possible initiating eventsconsidered and renders the potential for drain down of the SFPincredible.

lg. The system and support system models used maintenance unavailabilityvalues representative of normal plant operations for all cases analyzedunless noted otherwise. Refueling outage and associated maintenanceactivities are assumed to be scheduled and performed such that thesesystems have availabilities comparable to normal operating conditions.

Basis: This assumption is based on SSES practices of maintaining decayheat removal systems and/or demonstrated alternate cooling capability attechnical specification requirements plus one additional method; or whentechnical specifications do not apply, one method plus a backup methodare available (NDAP-00-06l2, NDAP-00-0613, and Nuclear Safety AssessmentGroup Report 4-93 regarding Outage Safety Review).

Impact: This assumption effects the potential availability of any plantsystem that provides or supports the SFPC function including backupsystems. Consideration of the spectrum of possible outage maintenanceconditions and their effects is considered a shutdown risk issue beyondthe scope of this analysis.

D.12

20.

2l.



Equipment that is located in the reactor buildings (HVAC Zones I and 2)and is critical for performing safety functions will experience heatupafter the onset of boiling in the SFP if not isolated from HVAC Zone 3.Successful isolation of HVAC Zone 3 requires that the regirculationsystem be shut off and the Standby Gas Treatment System (SGTS) beoperating. When HVAC Zone 3 is not isolated, the safety equipment inHVAC Zones I and 2 reaches equipment failing critical temperaturesapproximately 8 hours after'he onset of boiling in the SFP. Duringrefueling outages, the reactor building for the unit being refueled isisolated from HVAC Zone 3 and therefore the safety equipment in thatunit will not experience heatup from boiling in the SFPs. Mith therecirculation fans off, the SGTS would fail approximately 15 hours afterthe SFP begins to boil and'the ECCS equipment would fail approximately24 hours after the SFP begins to boil.

Basis: PNL discussions with the NRC after the second plant walkdown;PPEL telephone discussion with Mr. Steve Jones (NRC) providing verbalresponse to questions from NRC and PNL discussed in March 25, 1994telephone call; PP8L letter to NRC dated August 16, 1993 (PLA-4012),Attachment, page 7; and SSES procedures G0-100-006, Rev 16, "ColdShutdown, Defueled, and Refueling."

Impact: This effects the event sequence time line and the Zone 3isolation considerations for the order-of-magnitude estimation ofpotential for contribution to core damage for. the most important eventsequences.

A reactor scram does not occur coincident with the loss of SFPCinitiating event. Plant management is assumed to direct a plantshutdown at either, the approximate time of onset-of-boiling in the SFPor when the area temperature in HVAC Zone 3 reaches 125'F, whicheveroccurs first.Basis: Judgement that SSES management would direct plant shutdown afterthe area temperatures exceeded the normal maximum temperature limitassumed in the FSAR (typically 104 F). SSES procedures ON-135(235)-001and EP-PS-]02 (As-Fixed plant condition revisions) caution aboutpotential adverse effects on safety related equipment.

Impact: This effects the time line evaluation for equipment performingpost-scram reactor core cooldown functions prior to heatup of reactorbuilding.

J ~

~ A

g 'l I

Assumptions - Basis and Impact Appendix 0Miscellaneous Information

22. A reactor scram occurs coincident with all initiating events except lossof SFPC. Safety functions begin at the time of the reactor scram asdoes the start of SFP heatup.

Basis: A loss of SFPC in itself does not immediately have animpact on safe power operations. For modeling purposes, theinitiating event for all other loss of SFPC events is treated ascausing a reactor scram.

Impact: This effects the time line evaluation for equipment performingpost-scram reactor core cooldown functions prior to heatup of reactorbuilding.

23. The condensate and feedwater systems have all their active'componentsnecessary for post-scram alignment feeding/makeup to the reactorpressure vessel located in the turbine building and the turbine buildingdoes not experience heatup in response to SFP heatup. The condensateand feedwater systems are also assumed to be failed after a seismicevent or loss of offsite power.

Basis: The observations made during the plant walkdown and SSESIPE information (PP8L 1993b, pages F-5, A-85, and A-96).

Impact: This effects the availability of systems that could be used foralternate core cooling in assisting the potential for contribution tocore damage.

24. The flood, loss of SWS, and pipe break initiating event impacts areconsidered local events impacting only the SFPC equipment. Plant widefloods, loss of SWS, or pipe breaks with global effects, as well as thepotential for consequential damage to other safety-related equipmentfrom these events was not considered.

Basis: Evaluation of plant wide effects are beyond the scope ofthis analysis, these events were only considered as possible lossof SFPC initiators for this bounding case analysis.

Impact: This effects the loss of SFPC initiating event frequencies forlocal failures affecting SFPC operation and results in initiating eventsthat are somewhat conservative since they may double count localfailures.

0.14



25. Several methods exist for backup SFPC that are not credited in the NBF

evaluation model. These methods would prevent SFP boiling or delay thetime to SFP boiling conditions and include:

Feed and bleed to SFPs. Feed is provided through EmergencyService Water (ESW) (hard piped and EDG backed) or using fire hose(requires operators to run hose reel to SFPs or to hook up to ESW

hard pipe). Bleed is via the overflow through the SFP skimmersurge tank line.

Use the diesel powered fire water pumps for discharge to the SFPs

through connection to existing hard pipe systems (i.e., ESW).

Use of RHR in the shut down cooling mode of operation withdischarge to the Reactor Pressure Vessel (RPV) and simultaneously

„ to the SFPs (although not proven to prevent SFP boiling it wouldcertainly delay the heatup).

Basis: These alternate cooling methods are not procedurally directedand would require innovative recovery actions. These types of actionsare considered in the order-of-magnitude estimation of potential forcontribution to core damage from the most important event sequences.

Impact: This effects the recovery paths evaluated in the NBF and CDFevent trees.

26. Flooding to the reactor building from SFP condensate and/or overflow isdirected'to the reactor building sumps and this water is isolated fromEmergency Core Cooling System (ECCS) equipment in the reactor buildingsexcept one train of core spray.

Basis: The sump room has water tight doors and drain line isolationvalves to barrier it from the reactor building equipment. The sump roomand ECCS equipment rooms have level indication and alarms and the sumproom has the ability to be pumped out from overhead access ports usingportable pumping devices.

Impact: This effects the consideration of potential for ECCS equipmentfailure due to SFP overflow drainage and condensation.

27. The Technical Support Center (TSC) is manned and operational within onehour after the initiating event. The TSC staff will facilitatepreparation of appropriate recovery action procedures to supportmitigation of the event.

Basis: This is a designated function of the TSC.

Impact: This effects the activities time line evaluation for the mostimportant event sequences.

0.15


Niscellaneous Information

28. SFP level and temperature indication in the control room was notimproved in the As-Found conditions.

Basis: PP&L letter to NRC dated August 16, 1993, Attachment, page 14.

Impact: This effects the evaluation of human actions for mitigation ofloss of SFPC events.

29. The HVAC ductwork low points did not have drains.

Basis: PP8L letter to NRC dated August 16, 1993, Attachment, page. 14.


30. The procedures for placing RHR in the SFPC assist mode'id not requireraising the SFP level before running the RHR system in the SFPC assistmode



31. The LOOP emergency procedure did not prompt the operators to considerthat the SFPC needs to be restarted.

Basis: PP8L letter to NRC dated August 16, 1993, Attachment, page 14.


32. The administrative controls to maintain at least 25 hours to SFP boilingunder a loss of SFPC were not formally controlled or documented.

Basis: Discussions with PP&L and NRC during meetings before the secondplant walkdown.

Impact: This effects case determination definition differences betweenthe As-Found and As-fixed plant conditions.

D.16

Assumptions - Basis and Impact Appendix DMiscellaneous Information

33. The emergency procedures suggest a variety of ways to maintain corecooling in the event the ECCS systems failed,'ncluding: feedwater,condensate, CRD maximized, RHR-SWS cross-tie, fire water. system, CRDfrom other unit, ECCS keep fill system, SLC boron tank, SLCdemineralized cross-tie.

Basis: Emergency procedure flow chart diagram for RPV Control 102.

Impact: This effects the systems considered for alternate core coolingmethods for assessing the potential for contribution to core damage forthe most important event sequences.

34. Support systems are required as identified in the matrix of informationprovided by SSES taken from the IPE.

Basis: The support system requirements as evaluated by SSES in theirIPE.

Impact: The effects of the fault tree models used to estimate systemfailure likelihoods for the NBF evaluation.

35. The aluminum siding at some locations in the reactor building has hingedpanels that would pivot out and relieve pressure in the building due tothe steam environment and thus help to remove energy and reducetemperature.

Basis: Discussions with PPEL and NRC during meetings before the secondplant walkdown.

Impact: This effects the consideration of potential for adverseconditions to develop in the reactor building.

D.17

Assumptions - Basis and Impact Appendix 0Miscellaneous Information

AS-FIXED ASSUNPTIONS

The assumptions for the As-Fixed conditions differ from the As-Foundconditions as outlined below.

1. Spent fuel pools are initially cross-connected (i.e., gates that couldseparate the SFPs have been removed) for the entire operating cycleexcept as may be necessary for some off-normal or emergency situation.

Basis: Discussions with PP&L and NRC prior to the second plant walkdownand observations during the second plant walkdown.

Impact: This effects the event trees, success criteria, and casedetermination for the NBF evaluations.

2. SFP level and temperature indication in the control room has beenimproved.



3.

4.

The HVAC ductwork has low point drains.

Basis: PP&L letter to NRC dated August 16, 1993, Attachment, page 14,


The procedures for placing RHR in the SFPC assist mode require raisingthe SFP level before running the RHR system in the SFPC assist mode.

Basis: PP&L letter to NRC dated August 16, 1993, Attachment, page 14,


5. The LOOP emergency procedure does prompt the operators to restorecooling to the SFPs.





The administrative controls to maintain at least 25 hours to SFP boilingunder a loss of SFPC are formally controlled and documented. This mayrequire use of RHR in the SFPC assist mode for a full core offloa'd undersummer conditions.



D.19

O~

't

Documents

Forwards draft rept on risk evaluation of loss of spent fuel pool … · 2018. 1. 30. · April 7, 1995 '„".„".'.Balelle Pacific Northwest Laboratories Battelle Boulevard P.O