~. 'T, . . :.. ~ i:' .:: '; .* . ' ' ' ' ' " ' ' - ' ' ' ' '' ' ' ~'' ' *'*

c- n. s +n'. . -

,

-

[[[7,3v.([/'M# % UNITED STATES ' '<

,h NUCLEAR REGULATORY COf.if.ilSSION *" b:;a('.O'[.[E,

' -

c ADVISORY COMMITTEE ON REACTOR SAFEGUARDS

ik7 WASHINGTON. D. C. W.55 /k 7 f".

' "i ..... April 4,1979

I

i.|

|

|.

ACRS MEMBERSi

,

THE THREE MILE ISLAND UNIT 2 INCIDENT AND A QUICK COMPARISONWITH THE WASH-1400 EVALUATION.

It is of interest to note that what appears to be the scenariosurrounding the recent Three Mile Island Unit 2 incident wasevaluated in a bounding sense by the Reactor Safety Study(WASH-1400). I have enclosed the relevant sections of thereport for your information. Of particular interest is theWASH-1400 quantification of Safety Relief Valve failure toreseat (page V-38) and its impact on the transient.

J.i&-

'/'6<John H. BickelACRS Fellow i

.

.

.

.

7 9 0 514 0 0 V8

101 145

.._s _

*; . .. ,.s.... :,-, .- - - . . . - . - .3 . . . ,

*

g .. .,

*,-' Coy

'.). .

'.Hot shuth ; 5% . Q,

downF

TE R$ MTEg R CS*

VCVC HTEg..CP

SE O. CORE STATUS AND REMARKSA B C O I E P

A O.K.,

'. - .

' A7 Retwrn to Mot sowtoown (HTEw)AE Remain At Hot ShutdownAC Eveatwas Meit. f no Coerator Action TenenACD LOCA w tm core MeltA8 Poemose O.K..

' A8F Poe,oie O.K Remain at Hot Sn too.mA8E Core Me<t

,- ABD H.gn RCC Premte Leve'. LCCA w th Core Me'tA8C M.gn RCS Premre Level. LOCA witm Core Meat"^

*'ABCD Very W.gn RCS Preswee Level. LOCA evitn Core Men

i Lagend.'

A: TE - Traan.ent E veat*

8: RS - Reactor S/cratraC: HTEM- Heat Treasfee to E a voameat De mq Cooldown of RCS to -150*8 sad A00 osiav r0; OP - Overgeste Proimon of spector Cootant SystemE. VCVC - Rector w eue. Cwt v onwm Coatrol7 HTEC- Heat Tra s'er to Eassonme9t Ow mg Cold Shwicown of RCS frorn C 150* F and S 400 PSI Ar

(Two i net.on . sho n for como.etenes tut e of e.m ted ete est to in.s stwov of PW Rtrane.ent eveno)

.

*

FIGURE I 4-13 runctional Event Tree - FWR Transient Events

Iis ees 15' s ss * 6 sai so- cy 3 a-aseCS a8 *5 vo va

|T K W L p g y ,.

hCJS 6 W 41 T

I '

! Tw' '"@ f?P S 4 (9a Tu

ky W |h-

* # -- 7 TML

$?. . .m , J }_ .

a''M" J*

(,.sC,cc.l wd v 9s'

F-

e,: % A)/ 11 Tu

( b 12 Taw.

'

g y13 TEUta TECi

0 E6

17 TKMM' ' '

18 Tuww19 TEMU70 TawQ

h ye, A 21 frMou

u.te s, ,a J ;). n Te. .

u T..,<

(Nk 24 T a MLP

FIGURE I 4-14 FWR Transient Event Tree j]

m -n tam d.ee a o ..a .

% ck%/du,. emlid w,% 1% ce4 inu. g'-

__ . -,

s

, ,- , . . , , . ,. . . . . .y -- -

. , .

u - _ - - - _ _wa y _n _ _ -- - - - --

,.;.

. .,

TABLE I 4-9 PV; W SIENTS t.

*.

Unlikely Initiating EventsLikely Initiating Events ;

1. Rupture of High Energy Piping ,1. Turbine Trip in Secondary Coolant System,

'

,

a) Rupture of Main Feefeater2. Spurious Signals f rom SICS Lines, b) Ruptu.a of Lines in *

Main Stes: Syste: Cal3. Loss of Condenser Vacuu: !

2. Rupture of Steam Cenerator 3

4. Inadvertent Closure cf Main Steam (See Preceding Discussions inLine Isolation valves section 4.1.5 for Cover age)

.

5. Less of Main Station Generator 3. Rupture of Control Rod Mechan-with Failure to Relay Auxiliary 1sm Housing on Rea: tor VesselLoads (e.g., Main Feed ater Pu=ps, Leading to Small LOCA and Con-Condensate Pu=ps) to AC Power trol Rod Ejection (See Preced-Inceming f rc= Of fsi te Network. ing Discussions in secticns4.1.3 and 4.1.4 for Coverage)

6. Loss of Main circulating WaterPu=ps for Condenser Cooling 4. Abrupt Seizure of All Main

RCS Recirculation Pu=ps7. Loss of Main Feedsater Pumps

8. Loss of Condensate P2ps 5. Startup of Inactive Reactor -

Coolant Loop with Ab rupt Open-'

9. Loss of AC Pouer Incoming from ing of Both Isolation Valvesin One RCS Leop in PWR PlantsOffsite Network Employing RCS Loop IsolationValves10. Inadvertent opening of Stea:

Generator Power-Operated ReliefValves (-10% Sudden Load Dewd) These ruptures are included some-

what arbitrarily within the Un-

II. Increase in Win Feedwater F1w; likely Event Category. How ev e r ,Malfunctions in Feedsater Flow failures of lines in the PWR

secondary coolant sys tems haveControl occur' red principally during12. Malfunctions of Control Resulting plant testing and start-up per-

in Inadvertent Opening of All iods. These types of f ailuresTurbine Stea= Bypass Valves (:40% have included inadequate initialSudden Load Demand) design of relief valve headers

in the stes: supply lines, dis-

13. Uncontrolled Rod k'ithdrawal a) At charge of secondary coolant fromFull Powe r , b) At Startup leaking feedsater valves, dis-

charge of secondary coolant fro:n14. Control Rod Asserbly Drop cracks in main feedwater lines,

etc. The RCS cooldown transients15. Boron Dilution by Malfunctions in stemning from these failures

Chemical volume and Control System would be less severe than thoseincluded under No. 12 of the Like-

16. Startup of Inactive Reactor Coolant ly Event Category above . The po-Loop (in P*.R with So RCS Loop Iso- tential impact of such high energylation Valves) line failures in specific Icca-

tions of the plant, since they

17. Accidental Opening of Pressurizer might co.monly interac: with andSaf ety or Relief Valves affect availability of the plant

ESFs, was considered as part of18. Less cf RCS Coolant Flcv (Main RCS this study. Refer to Appendices

$ni Ta'lCirculating Punp Malfunctions) II and IV..

'

tui

Fig. I 4-13 - Fig. I 4-14Table I 4 4

- _. - - .- - .- _ - . _ . -. --- .- - __,

3

3* 1

- . - .. ,. , , ' -

.- - : .- .- ,g,

, , .

,

.._ ,- ry , . _ . . . , , ,_ ;. , . - - ....

--- - - - - _ _ - . a _ ___ , _ ;-'~~-,--..--...__ _ .. .a _.

* g , Qg*%d fML lut (Co < cr u (55CI 5fc.w.12 >5Ith

p G.n J 6M k +ruma ~%&$gspgk, - 1,.ysQg - M din M Fe1 nt h & onyressd.pa(- twt { h cal & ++

3LE V 3-7 PWR TRANSIENT SEQ"ENCES vs. FILEASE CATEOORIES

Core Melt |NoCoreMelt ,

i

Pelease categories g

1 2 3 4 5 6 7 8 9 .

.

Dcminant F'a7 Transient Accident Sequences

w;5. - s " ' nc.5'-y DC.-s M -B DC.5 ' -c nc.-c6 x10-7 6x10-6 t

3x10-8 7 x10- 7 6x10-8 3.x10-10- . - . . ..__

DC3'-6 TKQ-a TKQ-8 TKQ-c

2 x.104 3x10-8 3xlo-10 3mic-6

TKAQ-a D0Q-c .

lx10-8 1x104.

Cther Transient Accident Sequences

-v:I'-s MC' y nc.P-s | OC.P- 3 DC.C'-c W -cDCT*-s DC.C ' - 6 TKP-s TKP-8 nc.T'-c TKP-c i

m 0' 2 DC.T' y TKQU-2 30"-8 VC 0'-c TKQU-t

TK O T-3 nC.T ' - 6 D XJ-s TM-8 TKOT-c 3 XJ-:

7405 2 n10' y TKMP-3 TKMOV-g UQO-c D0'.00 c

300 3 DC.C'-6 TKMQU-s ,_Tr?_"c9_. . TKCB-c DOC'-c ,

n?qT-2 D?iOT y D?C.-s TMLOU-g D2;T-c n?C.-r _~ I

74.N E s D?qT-6 PCQU-s 320.P- S' TEMQG-c T"J' U-c |

32'00-s D2";3 y W"J-s Tr?iOC-f nZOB-c TiOC.P-c

DCP0'-2 30:03-6 T Q -s D10-! UC P5'-c TV.' Q-c

DC.P5'-2 D".MQG 7 WC' cDC ? T'-s Da+0G-6 W T'-cDC PO' s TKOC y DC.PO' c

e

Tr'PC s TKoC-6 TKP3-c| n.P F 2 3QG-T TKPC cj TKP 3-2 TKQG-6 n.PT g

' TKPO- m TKOT-Y UPO- c .

| *KOUC- s TKQT-6 UQUS g

TKQtT= 3 TK05-Y TKQUC cWQUG- a nCB-6 TKQi.T, gDrJC- 3 TLMPC'-Y TK;UO c

TcCT- 2 TLT C' - 6 rsC gi UNJ3- a T*.9 5'-T TKML*3 c

Tc UG- m T:.XP S'- 6 yyJ0 gTC'P C- 2 TLT G'-6 nr.T. gTr2C'T- 1 T "?C' -i n.:- ,

D.T S- s !L.T T'-T n2ePS gDLT G- 2 TLMP T'-6 narPG gDLT UC- 3 TXPC-7 TKyJT gTr?QCT- 3 TKPT-Y nO".0UC cD?i;UC- 3 TKP3-Y Dy;U3 g30'.;L"8- s TKPG-Y n;eaLT gTK"LC- s TKPC-6 nyQuG. gn2CT- 3 TKPT-6 D?1C c700.3-s TKP3-6 n?c,5 ,DOC-3 TKPG-6 32C.T c g gSEQUC'- 2 TyQUC-6 nyL; g g

DC.0L'B'- s 3QUT-6 m QUC' g. U"J UT' s KOU3-6 -vtQU5' g

| PC.07C' s TKQUG-6 na,:,,QUT* ,

~-

,

. . .

,

- - . .. ,_ , - ..

- .- .

,, -

-_.-

__

, .

( - ..

.

.

ACCIDEST SEQUENCES vs. RELEASE CATEGORIEST ABLE V "J-6 Pk*R SF.ALL LOCA S2

Core Melt | No Core Meltjt

Release Categories 4

6( * I 9 "I1 2 3 4 5 6 7

A:cident SequencesDominant Sca11 IDCA S2

S D-C5 8-E 23 D-85 56 22

1x10-10 {x10-9 9x10 8 1x10-12 ;xio-8 8x10 3 9x10-6$ D-3 2S 5-a 5,3-y 22

$ '"> c 5,H-cS H-$ 22

1x10-9 ;x10-10 6x10-8 1x10-8 2x10-8 8x10-6$ H-35 T-a 32HF-y 22

$ T-6 5;ET-c$ C>s $ 3-6

2 2 -10 1x10-7 1x10-92

1x10-10 4x105 C-62S;G-a

9x10-10 2x10-6

S C-6S;Cs ix10-s,,,,-.

Cther S-all toCA S, Accident Sequences

S HI-S 52HTI-c S2HI-c5 30I-8 2$Hn-2 S;H TI-6 S;HI-2 2

S;LC-2 S;HTI-$ S;CI-6 S;LG-! S;HG-8 S;0T-c S;HG-g2S HU-I$ 0TI-cS LCI-8 S;HCI-S 22S KT- 8 52H0-2 2 S HOI-CS;KC-2 2 5 LT-c 23 DI-8 25 KU-8 2S,3K-2 S;KTI-6 S;CI-6 2 S 01-cS L-! S;LTI-c 2S KOI-8 25 KC y 5; HOI-6 2SjCI-s S 00-*2 S LI-f S2BK-t 2S TI-6 2$ KC-!

S DI-s S;K-S S;KT-c S20CI-c2S;TI-s 2S EK Y 2 LS2 - cS;HF-o S;EK-$ S;DC-s 5;KI-6 S;KTI-c2

32 -c S2LI-cKS DC-6S;0TI-8 2 52LG-c

$;LT-6 S;0F-3 5 LOI-t2S 0TI-oS2LU-8 2 K32 -t5 C>5S;LC-S 2 8 KI-*2S K-S S;KG-cS;Ch $ 2

S;C> 4 S ;KI-o 3 KOI-C25 KG-SS;LC-6 2S KCI-SS;ET-S 2

S 0T-3 S,KT-u2

5:5-8 ${KTI-oS;HT- 6 S;L-,

S,LI-o

S{LC-aS LCI-o2

S;LT-s5 LTI-22

-6 -12 -8 -0 -51 x 10 3 x 10 3 x 10 2 x 10

f 3 x 103 x 10' 0 2 x 10,p

(alNo seTaences in these categories are shown since negligible radicactivity release is expectedto occur when all ESTs properly eperate.

101 10

..- . .

. . . . *- .. .

.

.

t *,

cluded contributed about 11failures, contributed significantly to

or less across the whole the risk a sse ssment.spe ctrum of consequences as In quantifying (T), the first stepcan also be seen in Table V datainvolved exanination c f applicable3-16. from nuclear pcwor plant o pe ra t ing

2. n e above result f or the DWRe xpe rience for 1972 (Re f. 2). Bis

indicated a total of about 10 shutdownswould also be relatively per reactor year, of which.7 were due to

unaffected for large values equipment malf unctions, operator errors,of ECF. For exa ple, if an

10-1 etc. , and caused rapid shutdcwn by meansthe reactor prctection sys tem (RPS).ECT value as large as ofThree of the ten shutdowns were orderly,were to be applied, the

result would be that the shutcewns f or such items as leaks,large ICCA contributions slow

would increase to less than ma in ten anc e , etc. Of the seven TPS

15% cver the entire release trips, 3 per year we re due tc

spectrum. Simila r to the 1.n_te rrup tion s .of ma in f ee dwa te r and.

PWR results above, a high included a bo ut 2 per 10 years that wereBased onlevel of confidence regard- due to loss of o ff-site power.ing the likelihood of Ecr the above data, a median value of 10 wasf eilure was not required for used for T, with an error bound of 2 to

cover a variation be tween 5 and 20purposes of this risk study. transients per year.

transients involving loss of mainQUANTIFICATION OF TRANSIENT 2 se4.3

ECT TREM .eedwater and loss of of f-site power areof particular in te re st. The _ loss .o f"*in f _'.e dwate r incre a se s dependence _ onAs discussed in section 4.3 of Appendix

portion of the study's effort was bcekup systems 'f or removal of . core decay-

heat in_a_ shu_tdown The loss of off-I, a contributionsfocused on assessing risk apower causes a loss of mainfrom transient e ven t s . *t was demon- site the- his need feedwater and can potentially af fectstrated in A pendix I that t

examination of antici- availability of back-up heat rerovalinvolve onl'y at

pated transients and that less likely All the above transient events~

systems. in the quantification oftransients do not centribute to accident~ ' ~ - - - ~ were includedthe PWR and SWR transient event trees.risk.

2e transient trees p re sented in

sections 4. 3.1 and 4. 3. 2 o f Appendix I 4.3.1 PWR TPA'ISIENT TREE QUANTIFICATIONi den ti fie d the systems which can af fectthe course of events af ter an initiating This section will present the quantifi-transient. Wnere they were available, forcatien of the various events, exceptsystem failure probabilities e s timate d T (the tr ar s ien t even ts) , which haveby the fault trees presented in Appendix discussed above. Table V 4-16,

II were used in quantifying the been

accident sequences. In already presented, su rarizes the proba-values used in this analysis,transient tree bilityThe material belcw presents a discussionaddition, data available from reactor

ope ra tin g e xpe rience were used toestimate the unavailability of systems of the raticnale for the selection of(s uch as the ma in f ee dwa t e r. sys t e-',.) . informatien in that table.Summaries o f the PWR and EWR system Peactor Prctecticn System (X)_failure p robabilitie s applicable totrans ient event trees are p re sen ted inTables V 4 -1 and V 4-2, re spe c tively. The median f ailure prcbability used for

the reactor protection system (RPS)The probabilities of the dominant which serves to trip the reactor controlaccident sequences f rom these trees were and te rmin ate core pcwer wasrodsTables V 3-14 3.6 x 10-5 with an error spread of aboutpreviously presented inand V 3-16. 3 based on fault tree analyses presentedThe follcwing two sections will present in Appendix II. Use of this probability

value f or RPS is censidered to be some-the values of f ailure probability foreach of the headings in the PWR and SWR what conservative in those transientwh ich result from loss of of f-eventssite AC pewar since the pcwor loss wouldtrees, r e spe c tive ly. The discussionbelow presents the values of the

transient e ven t (T) for both trees.be e xpe c te d to interrupt hciding powerfor the rods, causing the control rods

Each tree was analy:ed as appropriate to to drop into the core. For this partic-thisidentify the particular transient events

iDi Uethe us

which, along with the other systeni ular transient event,

T%

_. .. . . . . . . . , . . .

. , .. . . _ . , . .- .. , .. . .. ._, , _ _ _

\

-,

conservatism did not lead to dominant Probability of Failurecore melt sequences. for AFWS

For all events 3.7 x 10-5Secondary Steam 9elieI and Pewernot including (error spread,y en ve r s : en sys cm (M) Lo s s o f o f f- of about 3)* * E #*Chis column heading represents portions

of the pcwer cenversion system that pro-For transient 1.5 x 10-4vides for main feedwater delivery to the e ven t re sul tin g (errer spreadsteam generators as described in sore

, frca loss of o f about 3)1detail in section 4. 3.1 of Appendix I.o f f-site powe r.As noted earlier, o pe rating experience

indicates that t he ma in feedsater (KFW)delivery can be interrupted approximate- The f unction o f secondary steam relief

as discussed in section 4. 3.1 of An=en-ly three times per year. The probabill-s e' 'e ra ldix I requires operation of but vty o f recove ry of the ma in feedwater

of a large numbe r of the sa fe ty andsystem f ollowin g its interruption de-relief valves provided in tne secondarypends on the ir it i atin g fault and thesteam system. The probability of f ail-time window available te restere the ure of c.hc of the valves to o pen issystem to operation. The ti.e available about 10-5 per deman d based c, data

to restore main feedwater celivery de-presented in Appendix III. As will bepends en whether or not o the r systemssubsequent 1v shown in section 4.3.2, thesuch as the auxiliary feedwater system probability'e f a large numher of thejAFWS) o pe ra ted o r wh( ther or not the secondary system valves' f ailing toAPa t rip pe d. If, icr example, the RPSo pe rate such that the function off ails to operate fol cwing interruptiense con da ry steam relie f would be lost isOf MTW d el ive ry, high RCS pressure very small and was de te rmine d to belevels could be reached in a few negligibly small when com=ared to themin ute s , and the likellhood of recovery likelihood of f ailure of either the ATWSof main feedwater in this pericd is very o r +'he P CS .small. On the other hand, if RP S o pe r-

stes follcwing this event but the ATWSReactor Coolant Svstem (RCS) Safety andf ails to operate, the time period avail-Relle: valves cren tP)able for recevery of m! would be about

1/2 to 1 hour pric: to boiling off theThe operation of the RCS safety and re-water inventory of the stean generatorslie f valves serves to limit RCS pressurean d loss c. core heat removal capabill-

cy. In order to cover both these cases, levels and they are designed to cop r' e nwhen the RCS pressure exceeds set es-the following values were used for the

sures. As discussed in sectica 4. 3.1 of;robability of n en-recove ry of main. , Appendix I, analyse s have indicate d thatfeedwater f ollowing its interruption:

the most severe potential o ve ry re s s -

e vent for the PWR is the interrupti c:main feedwater delivery coupled wit. a

%1/2 to 1 Several failure of the RPS to trip the reacterhour minutes centrol reds. For. this situaticn, od-

est RCS overpressures occur even withChree feedwater operation of all pressurizer safety andshutdowns per relie f valvos. Failure of cne or moreyear 10-2 (10) 1 of the three pressurizer safety valves

*

could hewever significantly increase the-

* css of o f f-site RCS overpressure and thus increase theAC powe r a t 0.2 likelihood of an RCS rupture. Accord-events per year 2 x 10-1

(3) 1

1 It should be noted that t h is n um be r wa sFecondary Steam Felief and Auxiliary derived from Appendix II cen s i de rin gt eedwa te r Sy s tem (L) that the e me rgency on -s it e AC power

source would have diccel loads g re a t l yCh e failure probability for the auxilia- reduced for the tran s ie n t event. Cem-ry feedwater system was de ve lo pe d by pa red to the LOCA e ven t s , the dicsclfault tree analyse s which are presented eme rgency loads are a bo u t halved. tiusin Appendix II. The fa: lure probabili- a factor of approx.mately 3 wasties of interest used in asse ssmen t o f c re di te d to the availability of thethe PWR transient e ven t tree wc ro as e nc ryon ey dicsol generators for thefollows: transient.

10i 1b) .'A

i -

- |* ' . ' , ' .' '. -

... . .. .,a-.

-.

t

.

ingly, the failure of one of t b _- three with an error spread of a bo u t 3 asp re ss u r i ze r sa fe ty valves '.a open was de veloped by fault tree analyscs pre-doered to be a failure in thi3 cvent. A sented in Appendix Il.probability of 3x 10-5, with an e rrorspread of a bout 3, was applied for Residual Heat Removal System (W)f ailure of t hose valv?s to open.

Estimates on the availability o f the'-

Reactor Coclant_ System (RCC) Relie f and . RHRS were not made for the presentsa f ety valves rati to Close (0) ana lyse s for the reasons discussed insection 4. 3.1 o f Appendix I. The RSTJIf the relie f and sa f e ty valves fail to was shown on the PWR transien t tre e

% ~close when the RCS pressure level re- principally f or c0mple tene ss. Its useturns to below the valve set pres s ure , depends on the s uccessful operatica cf/ ' the RCS cculd depressurize. In the PWR, CVCS in ccn j un ction with either thei f the valves fail to reclose, theY operation of ma in feedwater system erprovide a path for ecolant loss (% 1/2 " '

the auxiliary fe e dwa te r system. Mcw-di ame te r) , causin g a small RCS LOCA: ! e ve r , it is only used at cold shutdcwnthus the core cooling and containment ! and bo th MFW and AFWS could serve asESFs would be utilized.1 Operating datafor the PWR have shewn such a f ailure ,' backup heat removal systems.

of the RCS safe ty and relief valves toAdditienal Censiderationsre clo se following a tr an sient e ven t.

Accordingly, the failure probability for' In conside rin g the PWR transient eventthe PWR s a fe ty and relie f valves to resulting from the loss of off-site ACreclose, ba sed on PWR reactor operating . pcwer, a sequence to core melt (TM,) wase xpe rie n ce , was e st ima te d to be about-10-2 with an error spread of 10. found that had an important probability

con tributi ca a cross the entire releaseN s pe c trum.1 This sequence represented,Chemical volume and Control System (U) total loss of all feedwater (main and

a uxiliary; and thus represented a lossAs briefly described in secticn 4.3.1 of of both normal and alte rnate plant heatAp pen di x I, the chemical volume and cen- removal systems. If both t h.e maintrol sys tem (CVCS) is used in normal fee dwate r an d the " aux 111arv feedwaterplant operation for purposes of control- systems f ail to operate ~~fol[owing tn sling the RCS coolant volume and bo ren tran s ien t'," ' the n the^ ~s teih" de'ne ratorsconcentrations, and assists in ecoling would' be emptie'd within aboEt 1 hour.

- ~ ~~

for the main RCS circulating pumps. The The discharge of RCS co'clani~ through thIeCVCS pumps also serve to deliver concen- p re s s uri ze '' sajeyy an g , , r pTie f ' '_va lve s.~

rtrated boren and emergency coolant to (which would be caused by the loss ofthe core durin g LCCAs an d transient plant heat removal) would result in ~~theevents which cause RCS cooldewn. There- eventual uncovering ~of the reactor core,fore, the failure probability for the Within about 2 to 3 ~h eufs' ~ ~ core ha ft'CVCS was taken to be failure of the CVCS would be uhyprwail~~TEntainrent ESTsin the HPIS mode of de live ry. The could mitigate the release of radioac-probability value used was 8.6 x 10-3 tivity in this core me lt sequence;

however, the availabi..ity of the cen-tainment ESFs and their use fulness wouldbe conditicnal on recovery of AC power

y within this time period. The overallIt should be noted here that for select elements of probability that were asso-PWR transient sequences that involve ciated with the TML sequence, in cludingfailure of the reactor protection sys- the availability of containment ESFs an dtem (RPS) to trip the reactor control the con ta inr.cnt failure modes, a re 11-rods and a failure of the RCS safety / lustrated in Fig. V 4-2 through the userelie f valves to reclose, the PNR small o f a simplified event tree.LOCA event tree s were considered to be .

.

applicable. However, the small LOCA Consider, as an example frcm the simpil-fled e ven t tree a bo ve , the sequencetrees shew that, when the reactor pro-TMLB,-c, where B, represen ts the prcha-tection sys tem f ails to ope rate , a core

melt was censidered to occur. This bility o f ncn-recovery of o f f-site an7decision on the s ma ll LOCA tre e s wa s on-site AC power in a bo ut 3 hours 1.

made because core te mpe ra ture Ic ve l s they both failed. Th is sequence wasfo und to be one o f t he more Tiso t t an tcould poten tially become unacceptably

high i f RPS fails. The same core melt enes, and the e le ment s of probabilitydecisien wa s made rega rding the appli- are:

cable transient e ven t sequences. Thisis believed to be a conservative deci-sion. 3 1 j E ^j

See Tablo V 3-14. I IJL

s'

- .. . . . . .

.

t 1

|1T M L 3' c

Probability I

Values So urce[- 6 x 10*7PTMLh,-c = P xP xP)xP x $xP6 p -2 x o Appendix III, ,-1=y 2 4

1section 6.3

where:

P -: x 10'I Fig. III-13 -Loss o f of f-site AC power (repre- 2P =ysents an interruption of the main Appendix III

f ee dwate r delive ry provided by 4P ~1.5 x 10 Appendix II andthe plant pcwcr ccn ve rsion sys- 3

tem, PCS) . Appendix III

-1P ~5 x 10 Fig. III-13 -Non-recovery of off-site pcwer in 4P =

2 about 1/2 to 1 hour (represents (approximate Appendix IIIratio o f theloss of feedwater de live ry pro.3 hour valuevided by the plant pcwer conver-to the 1 hoursion system, PCS). value)

Failure of auxil.ary fee dwate rP =3 P 1 Appendix IIIsystem, ATWS, (principal f ailures 5

include f ailure of on-site emer-gency AC power and the failure of P =0.2 Attachrent 1 to

6the steam turbine driven auxalia- this appendix

ry feedwater punp) .

Non-recovery of of f-site AC powerP =4 for the containren t ESTS within a

period of about 1 hour up to rationale for the selection of informa-abot 3 hours f ollowing the tran- tion in that table.siens event.

Reactor Shutdown (C)N n-recovery of on-site energencyP =

S AC power for the centainment ESFs Reactor shutdown can be accomplished inwithin a period of about I hour one of two ways, either by the reactorup to about 3 hours following the protection system (RPS) or by the com-t r an sien t e ve n t . bination of recirculation pump trip and

operator actions to rende- the reactorProbability that cen t a inrent suberitical. The median ilure prcba-F =

6 "5 with aneventually ruptures by the path bility of the RPS is 1.3 >involving a reltthrough of the error spread of 3 base. on the faultconta inrent ve ssel base cat. tree analysis shown in Appendix II. The

failure of the recirculation pump trip-. Probability values for the above ele- and the operator actions to render the

rents of sequence TMLB -c are based on reactor suberitical is controlled by thethe following table. probability that the operator will fail

to initiate the liquid poison injectionThe remaining t ransien t s equences, e. g. ,IMLn'-s TMLD'-8, etc., were evaluatedin like manne r . Given that elect ric Simplified Fault Tree For Event C

power is available to o p2 rate thecon ta inme n t ESFs, those s eq uen ce s in- e.~.e

volving failure of centairment ESFs, '*[*, ,,

e.g., TMLC-a, T.'" F- 8 , etc., relied on n 3. oAprobability values de ri ve d from fault (~'5tree analyses presented in Appendix II. -=

4.3.2 BWR TRANSIENT TREE QUANTIFICATICN i i

...-..

This section will present the quantifi- us io . io'': *r-=""

cation of the various events, except'nr transient events (?), which have

*been discussed in provicus sections.T.ible V 4-2, summarizes the resultsof this analysis. The material below r i

cresents a discussion of the rationale . . . . . . . , . . -

,** * -", [ i ,9r the selection of informa tion in that ',,a-;--- - - ,,

table.

- - - . . .,

.

I s

.

~

I The functions required following ,a.value of 10 per year for likely events FWR transient events in order to !

is derived frcm cperating experiencefrom U.S. FWR and SWR plhnts, which perform a saf e shutdcwn and cool- |

reveals that unplanned shutdewns havedown of the plant. .

occurred fren various equipment malfunc---

and b. The FWR transient event tree intions or failures, cperator errors,related operational transients (Fef. 3), terms of systems necessary to

per f o rm the functions of safe

shutdown and cooldown.on the other hand, there are about 150reactor years of experience in which nooccurred. c. The definitions of system success /unanticipated transients have failure that are needed to assistthese data the unanticipated tran- in the development cf fault treesFromsient occurrence ra*e is pretably less and in quantification of the PWR10'3 per re>ctor year.than 10-2 toSince the amount of experience is small,

transient event tree,

these data can be supplemented byestimates of systems and reliability PWR Functions and Functionalconsiderations. An examination cf the 4.3.1.2

Event Tree.various factors involved in the occur-cf unanticipated transients and a

other analy- The functicns tha t must be performedrenceecmparisen with experience, following the transient event in orderses, s.nd nc=ters obtained in the study to preclude core damage are:is actually muchsuggest that the rateless than 10-2 or 10-3; therefore -10-5has been selected for use in the 1. The fission process must be

I terminated.illustrative ecmparisens *.ade in Figs.4-11 and I 4-12. It sh1uld be notedthat even if a high rate is used, say 2. The reactor ecolant pressure must

be limited to a value that will not10-3, the unanticipated transient tree caure failure of the reactorwould still not centribute significantly coolant system (RCs).to the everall risk.

must3. An adequate coolant inventoryThe principal aim of this portion of the be maintained within the RCS.Reactor Safety Study was to assess thesemore f:equent anticipated transient

4. The core shutdown heat energy mustevents and to establish their increment-al contribution to the public risk. To be transferred to the environment.assist in this effort, detailed FWR and on the,BWR transient event trees were developed These functions are illustratedfunctional event tree presented in Fig.and are discussed in sections 4.3.1 and

[74;137 This figure indicates that"Ithe4.3.2 respectively. core is not damaged if all four .func-tions cited above are pe rf o rmed .sgj-c e s s f_ul,1y . If any of functicns_(lt,

4.3.1 FWR TRANSIENTS not successful, core(3), or (4) is ~As indicated in section 4.3 of this damage and melt could occur. If func-

Appendix, only likely transient eventstien (2) is not successful, LOCA could

need to be covered by a transient event result and the pcssible accident se-tree. Table I 4-9 centains a list of quences tha t might subsequent 1y' cccurall transients identified as being are evaluated using the FWR LCCA and the~

centainment event' trees previouslyapplicable to the FWR plant, '~

described.A PWR event tree in terms of systems was

4.3.1.1 FWR Transient Event Tree developed frcm the functional tree usingDevelopment. the same logic that was described in

The PWR transient event tree presented section 2 of this Appendix. This logicin Fig. I 4-14 was developed using first requires that the systems that arefunctional logic similar to that ad- able to perform each of the basicdressed in some detail in section 2 of functions be identified. This identifi-this Appendix for develcpment of the cation is summarized in Table I 4-10.

logic used to develop the PWR antic-LOCA event trees. The functional logic The

underlying the FWR transient event tree ipated transient tree, Fig. I 4-14, ia

is summari:ed below to emphasize the briefly discussed in the following

various system relationships that exist paragraphs.

can operate to makefor the FWR. The systems thatthe reactor suberitical are shown inThis section discusses:

101 154T.CA

-

- -

.. > . . ..

, . .

. .

.

.

\

Table I 4-10 Included is the reactor internals could potentially causeprotection system, RPS, which can trip disruptien of the core gecretry andreactor control reds and the chemical result in elting of the core. Wherevolu.e control system (CVCS) which could very high RCS overpressure levelsprovide alternate shutdcwn capability by resulted, it was assumed that the RCSdelivery of a concentrated borcn solu- would rupture and that core elt would j,tion into the PCS. Certain transientssuch as those that cause,_an.interruptio5~ {cccur. (2)~~If the required valves open 7

but fail to reclose, then~the resuR ~Ts~or loss of the normal heat re eval f in ef fectjdy.all_LCCA , with ecclantsystems (e. g . , main feedwat,er le11very, , discharge occurrl_ng frca the pressurizerto the steam generators)ilW 'to ~ prevent'recuired rapid

(diffeisntvanor space. Since these situa tions are ---" power shutdown in or

~

and must be evaluated throughoverpressure of the BCS. The delivery use of different 14CA event trees, twoof concentrated boron solution by the separate columns were used in the PWRCVCS purps would not be rapid enough in transient event tree,such cases to prevent RCS overpressure,although eventually sufficient boron "The

column HTEC indicates that the heat [-q

could be delivered to rake the reactor ' transf er to the environment can be ac .subcritical. Fapid shutdown can be Icomplished by the plant residual heatIacccmplished only by the control rods. removal system (PERS). This sysum is a jTherefore, only the RPS was included i low pressure system that would be usedunder the column heading Reactor Sub- *to transfer core decay heat once the ,critical. The CVCS is shown under a . plant cperator decides to bring thet .',separate heading (VCVC). The VCVC : plant to cold shutdown after any ifunction is needed to enable coolant 'particular transient event that*'

hasnotjmakeup to be provided for control of resulted in a rupture of the RCS. To ,coolant centraction during cocidown, and ' bring the plant to cold shutdewn (to .to ensure shutdown margin during !where use cf the RRRS is permissible, 'cooldown of the plant if the transient requires used of the CVCS and either theevent leeds to a decision to bring the .PCS or the ATWS. The PEP.S is depicted ~plant to the cold shutdewn condition. 'by a single column heading en the treeand has been included principally forThe column HTEq (Hoat Transfer Enviren- iccepleteness. Should the RHES be incp-ment - het shutdown) indicates that dur- jerable, the plant could remain at hoting hot shutdown, core heat can be shutdcwn conditiens with either the PCSsatisfactorily transferred to the envi- gr the ATWS providing for the requiredronment after the transient event har decay heat removal from the core.occurred providing that portiens of the. L _

power ccnversion system (PCS) are oper-4.3.1.3 PWR Transient Event Treeable, er that the auxiliary feedwater (Sys tems ) .system (ATWS) is operable. Successful

operation of the PCS requires availabil- The PWR transient event tree is pre-ity of A.C. pcwer from ncn-emergencysented in te =s of systems in Fig. Isources. Since the availability of the 4-14 The rationale used to developPCS can depend on the specific transiintthis tree was su carized above. Theevent and the ATWS may not, these individual colu n headings of the sys-systems were treated as separate columnstems tree are discussed and defined inon the PWR transient event tree, Fig. I secti.on 4.3.2.5. The PWR transient4-14.event tree is generalized and isintended to apply to all anticipatedThe colunn RCS-CP indicates _that .the RCS transients which require that thepressure limiting function is. performed __ reactor be safely shut devn and cooledby the pressurizer safety valve and the- and which are not the result of a LCCA.pcwer operated relief valves. These are

two pessible failure godes._ First;.. tee The tree and accerpanying chart, Fig. Ivalves may fall to cpen and second, once 4-11, tcgether shcw in a 1cgical mannercpened, the valves rav_f_ ail _to. reclose. thoseThese two pcssibilities result in dif- certinations of system cperationsthat will adequately cool the core andferent situations: (1) if the safety those sequences of system failures thatvalves fail to open,, the RCS pressurewill either cause a LCCA or result inboundary would be subjected to very high core melting. A cceplete set of treespressure levels and in all likelihcod is formed by the anticipated transientrup tur e of the BCS would occur and tree, the LCCA event trees, and theprovide the necessary relief. If thecontainment event trees. These repre-pressure level were to beccee very high,sent coverne of all irportant situa-not only would the rupture of the RCSt. ions forsceable by this study wherebyresult in a LOCA but also the b1cwdown ccre meltloads en the core and reactor vessel could potentially occur as aresult of malfunction or failure of the

101 15 4s

.. . -- . . . ' . . . . . .

.

i - is

.

plant's mechanical or electrical equip- the control rods fail to insert and theanticipated transient event is relative-ment.ly slow, the delivery of concentrated

4.3.1.4 PWR Transient Event Tree boren to the RCS via the CVCS pu psDefinitions. could serve to limit the core pcwcr

increases and bring the reactor subcrit-

This section defines the systems repre- ical at the hot standby condition withinsented by the event columns of the PWR about 5 to 10 minutes.*

transient event tree. Minimum operabil-ity states are presented belew for those If the anticipated transient event

systems needed to carry out the corerequires the plant to be further cooleddown and depressurized frem the hot

shutdcwn and cooling functions followinga transient event. Less than the de- standby condition, the addition of boren

by the CVCS pumps is used to ensure thatfined minimum operability state for agisen system constitutes failure for

a safe shutdown margin (-lt ek/k) ismaintained through the RCS ccoldewn to

that system. the cold shutdcwn condition (5150*F and400 ps1* *

Transient Event: "'EAs noted previously, the PWR transient

The initiating events are malfunctions, event tree is censidered applicab le tofailures, or faults in the plant equip- both slcwly oecurring and rapidlyment or in the statio: 's electrical occurring anticipated transients, and,network that result in a transient being since only the reactor protection rystem.mposed en the PWR reactor coolant (PSS) would be effective in limitingsystem and core tha t (1) leads to a core pcwer for both, the PSS anddemand for the cperation of the reactor boration functions are presented sepa-protection system (PSS) to cause trip of rately en the tree.the reactor control rods to shutdcwn thereactor core and (2) requires operation railure of RPS is conservatively definedof the plant normal or alternate heat as the failure of the centrol reds toremoval systems to ensure cooling of the insert into the reacter core with noreactor core. Other sequences which more than two adjacent rods failing topotentially result in RCS cverpressures insert on demand.that could cause a rupture of the RCSboundary are included within the Secondary Stes i Relie f and Power Conver_-applicable PWR LCCA event trees pre- sien System - 55R anc KSlM)sented previously in section 4.1 of thisAppendix. This column heading includes portions of

,the PWR pcwer conversion system which

Reactor Protecticn System: RPS are normally in use (1) to raintain anadequate coolant inventory within the

The process of making the reactor PWR steam generators, and (2) to trans-suberitical at hot shutdcwn (cr standby) fer heat to the environment follcwing ais accerplished, normally, by a rapid transient event. To be successful, thisinsertion of the, control reds, which portion of the pcwcr conversion systenafter an interruption of holding pcwer must include the partial operation ofto the breakers, would be released t the main feedwater and condensate sys-drop by gravity into the PWR core. tem, which is used to deliver condensateWithin several seconds the drop (or frcm the turbine condenser to the steaminsertien) of the control rods makes the generators following a transient event.reactor suberitical at the hot shut dcwn These modes of partial PCS cperation arecondition (about - 547 *r and 2250 psi). discussed below.The rapid insertion of the control rodsserves to arrest core power increases Given a turbine trip, the steam frcm the

.

for all transient events. Mcwever, forsteam generators is norrally "du ped",these transient events which may ini- er bypassed, into the condenser via the

tially result in a rapid cooldown cf the turbine steam bypass system. To enableRCS, the core can return to critical,and, as previously noted, the deliveryof concentrated boron solution to theRCS would assist in returning the coreto a subcritical condition. Although ysuch cooldcwn transients cause reactiv- Only in the case cf tho se unlikelyity to increase, the fuel damage from initiating events (e.g., events 2these events would be limited to the through 5, Table I 4-9) would substan-release of radioactivity into the RCS, tial core damage and pc tential melt beeven if delivery of the concentrated expected to occur with f.ilure of theboron failed to occur. Alternately, if RPS to operate.

' '

101 156

*

. .~. ... . . - . _ ..

.

/I

-

'

.

heat to be reroved via this system, a could not, therefore, be restored forvacuum in the condenser must be main- this transient event until a restorationta:ned. This requires that the tran- of AC power was accorplished. As s umingsient event must not involve a loss of that the reactor protection systemcondenser vacuum. The cperation of air operates to reduce core power level, aejectors and the circulating vater total lack of feedwater delivery to thesystem enables the condenser vacuum to s te am generatcrs to remove heatbe raintained, provided that a breach of generated by the core would result inthe condenser has not cccurred. If the the steam generators boiling dry on themain feedwater pumps are driven by order of about 1/2 hour. An alternateturbine steam, as is the case for many feedsater supply is , heweve r, provided*WR designs, then less of condenser by the auxiliary feedwater systemvacuum can also result in a loss of the (AFWS). Operation of this alternatemain feedwater pumps. If the main feed- feedwater system in conjunction withwater purps are electrically driven, as steam relief to the atmosphere throughin the case of the FWR studied, then safety valves would result in successfulloss of condenser vacuum would only cooling of the core follcwing allresult in less of the turbine steam transient e ven ts involving thebypass system and not the main feedwater interruption and loss of normal PCS heatpumps. In the situation where condenser reroval capability. Should the auxil-vacuum has been lost, the electrically ia ry fe e dw a te r system f ail on demand,driven main feedwater and condensate the time available for the plant opera-purps could be used to provide water tor to restore operation of either themakeup to the steam generators, and heat PCS or the AFWS, wi thou t risking ancould still be rejected to the environ- excessive loss of PCS coolant from thement via the steam generator safety RCS pressuri:er safety and relief valvesvalves. This would lead to acceptable and tnus a core melt, wculd beheat rejection to the atmosphere, but, approximately 1 to 1 1/2 hours. A losseventually, the condensate supply from of AC power to the station auxiliariesthe condenser would beccme exhausted. In excess of this time, i t. conjunction

wi th a lo s s o f the ATWS , could result inRegardless of whether the main feed core melting.pumps are steam driven er electricallydriven, the cendensate pumps (which are For the PCS to successfully perform thedriven electrically in all FWR cases of function of transferring core heat towhich this study is aware) wculd be the environment requires certain compo-needed to enable water makeup to be nents to be cperable and certain condi-provided frcm the condenser hotwell to tions to be in existence as describedthe steam generators. Assuming failure below. Failure of PCS is defined toof the condenser vacuum cccurs and have cecurred when these operable statesaffects operability of the main feed- and conditions are not met for thewater pumps, the condensate pumps could system.potentially be used to deliver water tothe steam generators. In this case, a. Successful water makeup requires ataction by the plant operator would be least ene cceplete train of theneeded, however, to depressurize the condensate and main feedwater pip-steam generators. This is so because ing system to be intact andthe design of the condensate purps would operable to deliver water from thenot permit water delivery against the condenser hot well to the steamhigh steam pressure conditions (51100 generaters. A limiting conditionpsi) that would . prevail in the steam for cperability of the condensategenerators, if steam discharges to the and main feedwater pumps is theat=csphere at set po int pressures of the requirerent that sufficient ACsteam generator safety valves. The electrical power be available toplant cperator could manually operate drive the pumps. If the mainthe pcwer-cperated relief valves provid- feedwater purps are not cperable,ed for the steam generators and, in this success ful PCS performance requiresway, depressurize the steam generators cperability of the condensateto permit water makeup to be provided by purps, with cperator action takenthe condensate pumps. Since the conden- to reduce the pressure level in thesate pumps are electrically driven and steam generators in order toare required for each transient event in acccamodate coolant delivery at aorder for the PCS to be functional, the lower pressure by the condensateprincipal cer.ren fault leading to a less pumps. Cperability of the pcwerof PCS would te the less of AC pcwer to operated relief valves in the mainthe station auxiliaries (main feedwater steam system is also required topumps, condensate purps, circulating permit the successful performancewater pumps, etc.). The PCS function of the condensate pumps.

104 197_

.

.

/' :

(-

3

.

*

.

b. Successful heat removal frcm the system safety valvescore requires steam relief from the located on each maingenerators. This function can be staan line;accomplished cy (1) operation ofthe tutbine bypass valves to the (2) no less than two ofcondenser when availability of con- three of manuallydenser vacuum permits; or (2) oper- operable and pov.ration of the main steam system operated main steamsaf ety valves when both the conden- relief valves.sate and main feedwater pumps areoperable; or, (3) operation of themain steam system power operated b. Auxiliary Feedwater and Cendensaterelief valves under operator con- 5elivery Functicn ( Ara 5 ) -trol when only condensate pumps areoperable.

Either: (1) operability of the oneIf the heat is removed from the core by steam turbine drivensteam relief to the atmosphere via auxiliary feedwatere i the r the main steam system safety pump delivering watervalves or the main steam system power from the 100,000 gal-operated relief valves, the availability lon condensate storageof makeup water frcm the PCS is consid- tank until the tank isered to be limited to the inventory of exhausted (%8 hours)condensate initi:11y residing in the and then frcm thecendenser betwell. If heat is removed plant fire protectionby steam relief to the cendenser via system thereafter un-operation of the turbine steam bypass til such time as thevalve system, the availability of makeup plant is successfullywater to the steam generaters is not cooled dcwn and de-limited by a loss of condensate to the pressurized to permitatmosphere. Ccnditions permitting heat core heat removal toto be removed via the turbine steam be continued withoutbypass valve system also require that dependence on theth e main steam line isolation valves be AIWSiopen and that the condenser vacuum bemaintained within acceptable limits by, (2) operability of cne of(1) operability of the condenser air

the two electricallyejector system; and (2) cperability of driven auxiliary feed-the circulating water system for con-denser cooling. water pumps delivering

water as describedabove.Secondary s t e am Felief and Auxiliary

ree: water system- S5R anc AJ%5 The time period of interest for hotstandby cr cooldewn operations forIn the absence of M, above, the feed- either the PCS cr AFWS would normally bewater delive ry equivalent to the flow expected to be -6 hours following afrom at least one of the

three auxiliar{ transient.feedwater pumps was used as the basisfor the definition given below offailure for the auxiliary feedwater RCS Safety / Relief valves Opent S/R VOsystcm. Tcilure of this alternate heatrencval function, provided by the sec-

This column heading represents theondary steam relief and auxiliary feed- cpening of the FCS pressurizar safety orwater rystem, is considered to occur safety and relief valves to I Lmi t thewhen at least the principal ecmpenentsrise in the reactor coolant pressurelisted belcw are not cperating followin9 immediately fellcwing the initiatingthe transient event:transient event. Not all anticipatedtransient events (e.g., turbine trip)a. Steam Relief Function (SS R) : require operability of the safetyvalves, since the surge capacity of theEither: (1) no less than one of pressurizer would suffice to accept the

the five main steam transient event with but a small surgein the pressure being seen. For meresevere transients, such as those involv-

)The minimum operability requirement ing failure of the RPS to terminate ccrefcr powe r , the cperability of the pressuriz-the AFWS was based en analysis of ATWS er safety valves would be required. totransients as provided in WCAP-8096.

prevent a rupture of the RCS,

\,e

4

f..

.

Three RCS pressurizer safety valves and Chemical voluretwo relief valves (pewer cperated) are -~" Central System:CVCS-provided fer the PWR. For those antici- This system is norrally in _e d" ringpated transients where RPS cperates to all powe r operations to control thet e rmina t e core power, the cperation of volume of RCS coolan;, condition thecnly two of three of the pressurizer chemistry of ccolant, and assist insafety valves would suffice to limit the cooling of tha main RCS circulatingRCS overprecsure transient to less than, pumps. As wi in detailor about, 110 percent of RCS design subsequently,{'bediscussedthe chemical volume andpressure. Sequences one through nine control system provides for multipleinclude these possibilities.

functions to be carried out during plantoperations, during transients, or duringLOCA events. For example, if a cooldownFor those anticipated transients where transient or a LOCA event cccurs, anRPS f ails to termir.a te core power (i.e. , eutceatic alignment of the CVCS pumpsthe ATWS transients), the operation of takes place so the pump delivers

~

three o' three pressurizer safety valves emergency coolant and concentrated boronwould be needed to Ibr.it the RCS pres- solution to the reactor core. Thissure level to less than about 150 realignment of the CVCS system placespercent of the RCS design pressure, the system into the high pressureOperation of the two pressuri:er relief injecticn system (HPIS) tode of opera-valves with the operation of the three tion. Also, the CVCS pumps can be usedsafety valves would be expected to with suction to the purps realigned tofurther reduce the RCS pressure level to deliver concentrated boron solution fromless than, or about, 125 percent of the beric acid tanks *3AT's) in the plant.RCS design pressure. In ge.eral, the This second mode cf realignment can bespecific RCS pressure level that results initiated by the plant operater should.from the ATWS transients will depend he elect to use this realignment forconsiderably en the specific combina- ene rg en cy borction to provide for ations of systers operating during the backup shutdown capability.transient event. As noted previously,the interruption or loss of the PWR main For purposes of failure definition ferfeedwater system potentially given rise the CVCS during transient events, theto the most severe RCS overpressure previous definition, developed for thelevels. The pessible variations in the High Pressure In]ection System (saepredicted RCS cverpressure levels were small LOCA - sections 4.1.2 and 4.1.3)considered by the study, and, for reflecting failure to be less than thesequences in which the safety valves delivery from one of three HPIS pumps,failed to cperate, it was assured that is considered to be conse rvativelythe result was an RCS rupture with applicable to the transient event tree.corerelt. No ecmmonly accepted, specific* design basis" ccmbination of systens to Residual Heat Raroval Sy tem: RHRSbe used for analysis of ATWS has yetemerged (Ref. 4). Mcwever, for purposes In the PWR plant studied, the RERS wouldof this study, a reasonably conservative no r=a lly provide for continuity ofdefinition has been selected which cooling after the PCS cr ArWS has beenencenpasses all anticipated transient used in conjunction with the CVCS toevents and the ATWS events. Failure of cool and depressurize the plant from thethe RCS safety / relief valves to cpen is hot shutdcwn (or standby) ccnditions.defined as being the cperatien of less

The RHRS has been included in the tree,than three of the three RCS pressuri:er principally for completeness.2 No rmal-safety valves.ly, the RHRS would not be used following

1See Appendix II - Tault Tree Analysis,Safety /Felief Val /es Reclose: SR/VRHigh Pressure Injection System.

-9

The RCS pressurizer safety / relief valves ~ e"''2'

The RHRS was not evaluated by use ofthat open as a result of a transientthe fault tree tec hn iqu e s as describedevent must reclose to prevent a dis- t in Appendix II for a number of the PWRcharge of an ex-essive qu an ti ty of ESFs. This increment of study effortcooIant frca the RCS. Otherwise, a could be accerplished at a later time

'

valve sticking open follcwing the tran- if additional ccepleteness is felt toSier.t event of interest wculd result in be warranted. For the reasons outlineda loss of coolant event covered under above, the riskthe previously described small LOCA to PWR transient events did not requirecentribution portaining

eve't trees.this incremental effort.

g \S9. <

Sm.ww - 4 .. w._..__,.- - - - - - - - - -- --

.m.

( l

-.

.

and in the quantification of the BWRa transient event unless an extended transient event tree.shutdcwn period (for maintenance pur-poses, refueling activities, etc.) was 4.3.2.2 BUR Functions and Functionalplanned. Unless the FCS cr ATWS oper-ates in conjunction with the cvCS Event Tree.

following a transient event to allow forreduction in the RTS pressure, the The functions that must be performedcperation cf the PERS would not be following the transient event in orderpermissible. This is so because the to preclude core damage are:RHRS is a low design pressure system The reactor must be made suberiti-that can operate only after the RCS a.

pressure is reduced to less than 600 cal;

psi. Alternately, if FRRS operation The reactor coolant pressure must bewere satisfactorily instituted in ap- b. linited to a value that will notproxicately 6 hours following a plannedshutdewn , and if subsequently, faults or cause the failure of the reactor

coolant pressure beundary (RCPB);malfunctions developed in the FRPS, theoption would exist to reinstitute theheat removal capability of the ATWS. c. An adequate coolant inventory mustThis option would exist for a finite be maintained within the reactortime during the shutdown period until vessel;

such time as, for exa ple, the reactorvessel head was unbolted in preparation d. The shutdown core heat energy must

be transferred to the environment.for refueling activities to take place.Since the intent of this portion of thestudy was to focus on those transient These functions are illustrated on theevents that experience shcws to occur functional event tree presented in Fig.

frequently during reactor operations, I 4-15 This figure indicates that thecore is not damaged if all of the fourthe cperability state of the PRF.S system

was considered to te of limited inter- functions cited above are performedsuccessfully. On the other hand, if any

est. of the four functions above is notsuccessful, the core could melt.

4.3.2 BWR TPX;SIENTSA BWR event tree in terms of systems was

As in the case of PWR transients treated developed from the functional tree usingin section 4.3.1, enly likely transient the same logic that was described in theevents are covered in the BWR transient section on event tree development, sec-

tree (see also section 4.3). Table I tion 2 of this appendix. This logic4-12 contains a ccrplete list of all f rst requires that the svstems that aretransients indentified as being applica- able to perform each of the basic fune-,

ble to the SWR plant. tions be identified. This identifica-tion is summarized in Table I 4-13,

4.3.2.1 BWR Transient Event Tree This information was used in conjunctionDevelopment. with the functional event tree of Fig. I

4-15 to develop the BWR transient eventThe BWR transient event tree pressanted tree (F ig . I 4-16). The logic utilized

developed using functional to develop the anticipated transientherein waslogic similar to that addressed in some tree is briefly discussed in ths= follow-,

of this appendix. ing paragraphs.detail by section 2The functional logic underlying the BWR

,

transient is surrari:ed below to e pha- The svstems that operate to make thesize the varicus systen relationships reactor suberitical appear in Table I

~

that exist for the BWR. 4-13 only in the function colu-nentitled " Reactor Suberitical*, RS .

, is alsoThis section discusses: Therefore, this column headin5used in the systems event tree.

a. The functions required following ashutdown from power operation and The pressure limiting function is

the systems available to perform performed by the safetv valves and thethese functions. safety / relief valves, a s' shown in the

b. The BWR transient event tree interms of systems.

Detailed definitions of the systemsc. The detailed definitions of system operation that are required for success

success / failure that are needed in (or failure) are presented in section

101 16D.3.2.4.the development of the fault trees

'

s

_ . - - - - -: - -s_.--- _

. i .gts

.

auc .e. e ~. , , , , , , ,

f r., p. . = i. cw a .%.* c..to. s,ar se m. s,ee% ce +<es Q**===

oE na[.e7 O K. ma

,

.o .-e* uci . io4o E. ha.,p ,

'A-,'g te, en f o E-

' | -i?t u.me.i e . v., Lac, t. .

o n. ma* * * * *I ' "' ==a.. . w t

04 ", .eo+ o.r -

, - * *t. .

.. w= -4. mepers t Lee Lam, frement@

o K. =aI

. io 2 o n. WA' , . .; 2 .o 6 ,,, , ,, 7

wet. <te4e 4 le2 ^, a.,e 7 we. <ie4'

;-w) ?$ w,. <3ene ..u., e,q..eua i. .ew

1, a

o z_ m a.'

. ,o 2 ou =A. .o 2 o n we, . ie to

- ton . ed , , , , , ,u.. sies

p. e.cc.*u c.sT. -= 58

a m we ,c. m

NOTES

1. The power conversion system (POS) essentially consists off the main feedwater and ecnden-sate system. The f ailure probacility is est1 rated without benefit cf rigerous analysis 1however, the value chosen is en the low side so as net to bias the results. PCS is notshewn in part b of Tig. I 4-11 sir.ce it cannot cperate withcut eff-site electric power.

2. The alternate heat rencval system is the auxiliary feef ater system (ATWS). Tigures a andb indicate different failure probabilities because of its dependence en a diesel generaterthat is shared between two facilities when off-site power is lost. (See Appendix II.)

3. The value of 4 x 10~ / year for the prt bability of less of of f-site power fcr lcncer thanabcut 30 minutes is derived from data on electrical systers in the U.S. in additicn to

nuclear systems.

4. Tigure I 4-11e shows an arbitrarily chcsen trL9sient cf scre type that has not yet occurredin the 150 reacter years of creration of ec:rercial nuclear pcwer plants.

5. Figure I ~-Ild shows a tree that covers such unanticipated transients as rod ejecticn andsteL9 generator rupture; their prcbacility is very low, but they have the characteristic

that /05 cannot serve a useful function if RPS f ails.

FIGURE I 4-11 Si: plified PWR Transient Event Tree

101 161.

.

.

! i

vessel or less than anc of threc IIPIS Cour hea t exchangers during the fir 3t 24pumps delivering bara teel wa ter from the hours; thercaf ter only one is required.

'

RWCT. This definition is applicabiconly to the three loop PWR design under H - rmeroency Cnolant necirculation:

consideration..N

LC3

When a small LOCA is caused by a' break Failure of ECR is defined as failure tobetween <2" and 6* in diancter i n '- the deliver water from the containment surpRCS vapor space (pressurizer), the req- to the reactor cold legs by at least oneuisito pressurizer low level signals for high head pump taking wac tion from theautomatic initiation of the high pres- discharge frem one low haad pump. ECR

sure injegtion system (llP IS ) may not be failure is also considered to be failureobtained.1 to switch to hot Icq injection at about

1 day after the initiating event occurs.Actuation of ECI cither manually orultimately by high containment pressure I - Sedium Hydroxide Addition: SHAmay have to be relied upon in thissituation. Vendor analyses of these Same as for large LOCA.pressurizer vapor space breaks have,however, indicated that a delay of about 4.1.3 PWR S? TALL LOCA r/ENT TREE - S250 minutes could be tolerated in the

3a- As indicated in scetion 4, the sccondRCS.)cumulators category of small breaks pertains to a

HPIS provided that 2 ofdeliver coolant into the

break area of about 1/2 to 2 inches indiameter. The event tree shewn in Fig.When the small LOCA is caused by breaks

between -2" and 6" in diameter in the I. 4-4 illustrates the systens used tomitigate this incident and the possibleRCS liquid region above the reactor , folicwing this initiatingcore, the delivery from less than 1 of sequencesevent. This tree results from substitu-3 accumulators is considered failure of tion of the appropriate CSF's shown inECI. Table I 2-1 into the functional eventtree shown in Fig. I 2-8. The event

F - Containment Scray Recirenlation re s applicable yo any break locationSystem: C3 RS in the RCS that discharges the primarycoolant to the containment atmosphere.

As in the large oipe break LCCA, f a ilure- For breaks in this range, the use of

of CSRS constitutes delivery c., recircu- auxiliary feedwater (AFWS) is assumed tolation spray water through spray no::les ~e required for approximately one-halfuat less than the equivalent of the out-put of 2 of 4 recirculation spray pumps ^Y U$waugment heat removal f cm the RCS

5and u.ereby control the RCo pressure,for about the first twenty-four hours C lumn headings for the event tree areafter the incident or less than the discussed be l cw. Table I 4-4 presentsequivalent of the cutput of one recircu-

Y " a us and containment fail-lation spray pump thereafter. Note that , r this event trec."# 'for a break of -2 to 6 inches diameteroutside the reactor vessel cavity, CSRS

~

DEFINIT!CNSdoes not depend on the previous opera-tion of the containment spray injection S2 - Initiatine Eventsystem (CSIS) to build up sufficient -

inventory in the sump. The initiating event is a random rupturein the RCS boundary dur'.ng normal full-

C - Containment Heat Remova l Sys tem- power operation. This creates a breakarca ranging frcm 1/2 to 2 . inches in

, diameter through which lesn of coolantFailure of CHRS constitutes delivery of occurs. The rupture could cccur inservice water to less than two of the either the liquid or vapor-space regions

of the RCS, above or below the core.This event requires CCC injection viathe high pressure coolant in ] c e tio.)y

For example, when pressurizer safety system (!!P IS ) .valves inadvertently open and dischargeto the pressurizer quench tank. D- Electric Power - EP

1 ctric power cor siderations are the*

2These modes of actuation arc accounted same as on the larqc LOCA event tree infor in the fault trec evaluation model section 4.1.1, execpt that evaluation offor the small LOCA CCCS. Refer to the fault trees requires conniderationAppendix II. 'N of clectric power distribution to both

N:I-45

'

101 162s

..

. .

(- )*

..

.~

the hiqh pressure coolant injection s/s- requires success of CSIS as discussedten and the auxiliary feedwater system below.(ArWS) as well as the other CSFs previ-ously considered. These considerations D- rmeracncy Coolant Inicction - ECTare necessary for ccanleteness but werenot found to significantly affect the ECI failure is Icss than the equivalentprobability of electric power availabil- in delivery of one of three high hoatity to the appropria te ESFs follcwing a injection pumps. Accumulators are notspecific LOCA. required.K- Reactor Protection Svstem - RPS F - Containment Spray Recirculation

System - CShSSame as for 51 described previously.

) 'This is the same as the large LOCA with~L- Secondarv Steam Relief and , the period of operation dependent on how, Auxiliary reeduater - Sia & AFWS , " C LC S is initiated, as discussed for CSIS-l * /\ above. CSRS can depend on water deliv-,

To augment heat removal from the RCS, cred by CSIS to the containment sump for! heat frcm the primary system is trans- its supply and is assumed to fail if? ferred to water in the srcam generators CSIS fails.| which is provided by the auxiliary feed .g water system, and the resultant steam is C - Centainment Heat Re oval System -

discharged to the outside atmosphere via ,j CH RS3two of three powcr-operated relief -

,,

-

I valves or two of fifteen mechanical This is the same as the .arge LOCA.safety valves.1 Auxiliary feedwater ' H- Emeracnev Coolant Recirculatien -. delivery failure is considered to be ECR

^

,,less than full delivery frem one of two -~~

half-si:c electric-driven feedsater This is the same as the small LOCA 51,

. pumps or the equivalent flow from the ! except that the switchover to hot '. e c

. full-si:c steam-driven auxiliary feedwa- ( injection is not required because theter pump. The period of demand and I core is not uncovered during the inci-operation for the SSR and AFWS are about ; dent if ECI is successful.

; 1/2 day f or the small LOCA event. $' I- Sedium Hydroxide ?ddition - SHA. _-

C - Containment Spray Injection System -.

CSIS This is the same as the large LOCA.

This is the same as the large LOCA 4.1.4 PWR REACTOR VESSEL RUPTUREexcept that automatic initiation via the

For the purposes of this study, it wasconsequence limiting control systemconvenient to class vessel rupture into(CLCS ) cannot be expected for about 30two categories which can have differentminutes follcwing the incident because consequences:of the slow rico in containment pres-

sure. This allows for a somcwhat higher a. Potential ruptures in the vesselprcbability of operator-initiated CSIS, were considered that could be ofwhich is censidered desirable as CSRS such size and location that they are

essentially equivalent to pipebreaks and thus ECI and ECp would be

1 expected to cool the core. If theA unique feature for steam relief rypture is of such si:o as to bcexists for this- PWR to permit atmo- within pipe break size limit 9

,

spheric steam relief af ter about 1/2 equivalent to about the doubic-endedhour. This feature includes a decav bregk of the largest RCS p.pc (- 10heat release control valve, operated ft. ) and if it were to be generallyfrom the nain control rocm, and a line located above the core region, thenthat discharges to the atmosphere from ECCS should bc able to cool the corethe residual heat release header. as well as if the break were in the,

Operator usage of this featuro at p2pe. Dreaks such as these areperiods greater than about 30 minutes c vered by the previously procentedcould augment or back up the secondary LOCA trcos. Since it is expectedsteam relief capability defined above. that the likelihood of vessel rup-This feature has not been included inthe above definition be cau se its inclu-si on would not be expected to chango

3the overall availability of SSR and Sco previous LOCA sections 4.1.1,AFWS locause of the dominance of the 4.1.2, and 4.1.3 for ECI and ECHAPWS contribution, definitions.

1o\ \63,

\

... .. .. .. ,4 1

. . ,y,

e

/* ,- *},

|' *

ture of this size would be far denner but in less likely.1 tience the*

smaller than tha t of pipe ruptures, steam generator ruptura is not an in-this would not repremnt a siqnifi- portant factor in the risks due tocant contribution to the study's transient events.risk assessment.

With respect to a LOCA induced by asteam generator rupture, those sequences

b. Potentially large ruptures in the which could potentially involve a sig-vessel were considered that could nificant release of radioactivity mustprevent effective cooling of the damage the RCS, The distinguishinq fes-core by ECCS. Since certain of ture of a LOCA induced by steam genera-these ruptures appeared to be capa- tor failure is the addition of theble of causing nisstles (such as the energy in the affected generator to thatreactor vessel head) with sufficient of the RCS in blowing down to the con-momentum to rupture the containment, ta inmen t . This incremental energy wouldthis area was examined with some have a snall offect on the containmentcare., The presence of a polar crane pressure, but o the rwi se the situationweighing 200 tons was determined to would be much like other LOCAs, Itbe a sufficient obstruction to pre- should also be noted that even a severe

,

rupture of the steam generator wouldvent even a very large missile fromponctrating the top of the contain- result in a LOCA no larger than the

equivalent of a doubic-ended break,rent. Thus it is, in general, ex-pected that this type of vessel Further, the probability of a severerupture would cause a core melt rupture is low, of the order of failureinside an intact containment. of the reactor pressure vessel, which is

much less than the failure probabilityof piping. Thus, the rupture of a FWR

E7 wever, because of the physical ,

steam generator does not contributepl,nt layout, there is some small importantly as a LOCA path,pronability that a large vessel mis-sile could in fact impact directlyon the containment and penetrate 4.1.6 PWR RCS RUPTURE INTO INTERFACING

through the wall. This type of rup- SYSTEMS

ture could involve a core meltdownin a non-intact containment. Part of this study of the LOCAs included

the investigation of a number of pipingsystems that connect to the reactor

In these cases, the reactor vessel coolant system and also go through therupture leads directly to core containment. Such connections have the

,

melting and the only ESTs of inter- potential to cause a LOCA in which theest,are those which remove radioac- interior of the reactor vessel may

,

tivity and decay heat from the con- communicate to the environment. All,tainment a tmo sp he re . This can be except the LPIS check valve situationse}intheeventtree shown in Fig, discussed below, were dismissed for any

or a combination of the following*

reasons:

4.1.5 PWR STEAM GENERATOR RUPTURESa. The multiplicity of barriers that

Consideration was also given to the would be required to fail wouldconsequences that would f ollow f rom rup- render the LOCA much 1 css probabletures in either the primary or secondary than the check valves.side of one stcan generator. Scmc 30possible accident sequences cre identi- b. Failure of the barriars would notsicd using event trees, ut t..e end involve loss of vital safeguards andresult is either a rapid cooldewn tran- the loss of PCS coolant could be8 " # ^* accommodated within the design of

the interfacing systems throughTransients arc more ecmprehensively dis- safety and relief provisions, andcussed in section 4.3.1, but it should the coolant loss could be controlledbe noted here that stean generator in- or contained without a core meltduced transients do not load to core occurring.melt but could cause release of gaseousradioactivity into the RCS from thefuel-clad gap. In magnitude this resultis roughly comparahlo to a transient yinduced by the inadvertent full-opening Table I 4-10, section 4.3.1, PWR Tran-of the turbine bypass valves to the con- sients, in thin Appendix.

. 01 164_

*

I-47

g

*. . . . .e - ., -

_

s_-

.

I '.

~.

.

c. Failure of the barriers would sidered to result in core melt and theinvolve a LOCA into the containment daminant radioactivity release pathand would, therefore, bc covered by would occur throuch the ruptured LPIprevious LOCA event trees, system into a safcquards building that

houses the ifI system. The discharge ofRCS coolant and steam into the safe-During the courso of this stuh, i guards building would cause loss of

potential deficiency was identift,-! leakage integrity of the safeguards*

the design of a portion of the emergency building. Radioactivity deposition andcore cooling system (CCCS) which uses platcout in the safcquards building hasdouble (in-series) check valves as been estimated to be small since thebarriers between the low pressure injec- stcaming rate would tend to rapidlytion system (LPIS) which is outside the sweep the fission products frem thecontainment and the high pressure RCS small volume building to the atmosphere.which is inside the containment. FigureI 4-6 shows the configuration of inter- Column heading EP reflects the availa-est. Corm n failure of these double bility of electric power to operate thebarriers could result in a LOCA that high pressure injection system (HPIS)suddenly discharges into the LPIS system cump which is reflected under columnand bypasses the containment. The LPIS 'eading ECI. There would be no ECI suc-hsystem, with its low design pressure, cess in terms of oreventing a core melt.could fail due to everpressure er dynam- However, if the ' accumulators and theic loadings be yond its desigt., thus HPIS operated, core melt could beresulting in core melting. In this delayed until after the coolant deliv-situation, containment ESFs would be of ered from the RWST has been depleted.no interest since the release of radio- For example, if only one of the threeactivity would largely bypass the con- HPIS pumps were to operate, the rate oftainment system. RWST depletion wot.ld be less and core

melt could be advantageoo-ly delayed forThe check valves, when functioning as aabout 10 to 11 hours. I more than 1double barrier between tne interfacing HPIS pump we re to o; ' we, or if thesystems, make the probability of LOCA containment ESFs were t- actuated bydue to rupture of both barriers small. the plant operator, or i: the LPIS pumpsIn this specific design, however, no would operate to increase RWST deple-test provisions et procedures were found tion, then core melt could occur into exist which would assure availability about 1 to 2 hours. This was theof double barriers for plant operation. expected time of melt considered forLPIS pumps and lines are required to be purposes of determining the potentialflow tested at least yearly to ensureradic, activity release,tha t p a rge of coolant to the RCS

occurs. These tests do not, however, The column heading RPS represents suc-ensure that the check valves rescat or cess or failure of the reactor protec-that both check valves would be effec- tion system to initiate trip of thetive as barriers. It is possible there-

reactor control rods :nd is illustratedfore that one check valvo could be , stuck merely to indicate that core melt couldopen and only one barrier would indcod be hastened slightly in time if failurebe offective during plant eThispossibilitywasconsideredgeration. of RPS occurred. Column headings EP and,

and the RPS on the event tree could be readilyprobability of failure of the LPIS check excluded from the tres since thevalvos leading to an uncontrolled,

10gs probability of f'ailuro for cach is smallRLOCA was estinated to be about 4 x and their failure would simple hasten.

It was found that conthly testing, for the time of melt.exampic, could also reduce this proba-bility by more than an order of 4.2 llWil I.OSSOl?.COOI. ANT ACCIDENTSmagnitude.

Reactor coolant system (RCS) ruptures4.1.7 Event Tree for LPIS Check which result in loss of coolant acci-

Valve. dents can be categorized as a functionof rupture locaticn. RCS rupturcsins W W conta h n h ky amThe event tree for the LPIS check valve distinguished frcm rupturcs outside theshows the possibic sequence of eventsprimary c ntainment.resulting from rupture of the LPIS check

valve barriera. All sequences are con-Evaluation has shown th 3 t the signi fi-cant loss-of-coolant accidents can becovered by four ma pr a::cident categor-

y les, and t.hese are treated in theHefer to section 4 of Appendix V. following subcections:

10\ 165

-

*. e -: w a _ -__

w ,

*" ~~ :n y w 4,m-s_ - .e

, i ~-*

v jf-

*e

pace,a,s;t Tvy3[,{na afafa t aCTC a etw: vat ecog ,

S,e - .gg, Sv5fiv5 CO% 3i f icae ataCTCnTe aN5,f =1 C a i T *ca t g.,, g g y ; n , vtaanTV s $*

413* g.

et esa

' ' "*" " '05I 0

. to ,. 3 e t C wes - 3 a104 8a t s '0 M*M .t a tg

Pas s - very Lam in-

M -I e M6 = t e ofes.g9

I ? e 10 M*'t =8e97e a 10 j 4 8*1 s 10 Wa# - A e 10y0%.w

e.x y,e-.-t o ,r. ~ .

-

on se a

- 3 * '0' '#-3971""

I icd . . . "-tc'y-..i.s .- i . io 'aw.,

em e - we.meam 1.~.

* % =, . a.m. .. is

-NCTTES- the scram :ystem and (2)(1)The systems available to make the reacter s'.bcritical ares j ion. Either of thesethe co-bination of reactor coolant pu p trip and . 521e poisen in ect1.

However, there mayfor the very likely and less likely tezasients.

be sor-e very rapid unanticipated transients for which cnly the scram system operatesthe probability cf failing to make the reactersystems is sufficient

Therefore,quickly enough to be effective.suberitical is higher for the unanticipated transients.

l are

The *.ystems available to maintain an adequate inventery of water in the reactor vessethe reacter ccrethe high pressure coolant injection system (HPC15),2. Pi

and the low pressure e-ergency core cooling syste.ms.the feedwater system,isolation ecoling system (R;103),loss of eff-site pcwer increases the probability of f ailure of scme of these systems. asindica,ted in Fig. I 4-12b.

to the envirer. ment arer (1)The systems available to transfer fissien product decay heatthe ec-banation of the residual heatreecval (MR) sys-

3.the power eenversten syste- and (2) loss of off-site power increased(NPSW) system, Thetem and high pressure service water 1 4-12b.the probability of f ailure of both of these systems, as indicated in Fig.

FIGURE I 412 Simplified PNR Transier.t Event Tree.

-

101 166 ,1, , ,_11 _ ,1, , ,_1,

r-%