attachment 4, pvngs engineering study 13-es-a037, revision

EnclosureResponse to Request for Additional Information, Review of Single FailureAnalysis of Low Pressure Safety Injection Pumps for Minimum Required

Refueling Water Tank Transfer Volume

Attachment 4

PVNGS Engineering Study 13-ES-A037, Revision 0Fault Tree Analysis and Reliability Evaluation for Low PressureSafety Injection (LPSI) Pump Trip at the Recirculation Actuation

Signal (RAS)

DOCUMENT NUMBER

13-ES-A037

Q QAG NQR XPALO VERDENUCLEAR GENERATING STATION

DOCUMENT TITLE SHEET

Title / Description: Fault Tree Analysis and Reliability Evaluation for Low Pressure Safety Injection (LPSI)

Pump Trip at the Recirculation Actuation Signal (RAS)(DMWO 2938489, Revision 1)

Applicability Determination:This Engineering Study is to support DMWO 2938489 Revision 1 and clearly indicates so. Therequirement for performing a Screening and/or Evaluation is defined in procedure 81DP-OEE1O, PlantModifications. No further 50.59 review is required per procedure 93DP-OLC17 R4, paragraph 2.1.6.Applicability Determination performed by W. Butler.

V - Y - V V V

Original Issue ' Butlerf Wesley ToIa rfJenny Hook, Thomas Abbate, Adrian Hartg, AllanA(Z18905) (z05640) G(Z0688) H(ZA$148) W(Z43619)~ N/A (560 ,(Z ,,-. N/A N/A ( "

A.P. Mierisch zo )• •••~,,• .. ,•,•=z,•.,•=.=,o... , ,9/210

Document Electronically AvailableN Yes E- No

+ 4 + + 4 4

1'Preparer(Exponent)

RE Checker Mech. PRA Elec. I&C IndependentVerification

Approver(l&C Design)RE

NýO.REVISION

DESCRIPTION4 4 4- + + 4

Date Date Date Date Date Date Date Date DateU .0 4 0- ± .0.

CROSS DISCIPLINE REVIEW

PV-E0076 Ver. 7 81TD-OEEIO

i IPalo Verde Nuclear Generating Statio , Engineering Study No. 13-ES-A037

Units 1, 2 & 3 Revision 0Page 2 of32

EXECUTIVE SUMMARY

This report documents the work performed for the fault tree analysis and reliability evaluation ofthe Low Pressure Safety Injection (LPSI) pump trip circuit in response to the RecirculationActuation Signal (RAS) at the Palo Verde Nuclear Generation Station (PVNGS). The purpose ofthe study was to determine the probability that LPSI Pumps A or B for Units 1, 2, and 3 wouldfail to shut down upon RAS.

The failure rates for components that are necessary for the successful operation of the LPSI RASpump trip control circuits are obtained from PVNGS Document Number 13-NS-B063 Revision9, PVNGS, "At-Power PRA Study for Generic and Bayesian Updated Reliability DataAnalysis", which is summarized in Table 3-1. The calculation of the probability of failure foreach component upon activation of RAS is summarized in Table 3-2 and discussed in Section3.0. The final fault tree models for LPSI Pump A and LPSI Pump B are shown in Figures 7 and8 of Sections 4.1 and 4.2. The probabilities of the failure of the LPSI Pump A and LPSI Pump BTrip Circuits of Units 1, 2, and 3 at PVNGS upon activation of RAS are shown in Table 4-1 andwere determined to be 1.17x10-3 (0.117%) and 1.2x10 3 (0.120%) for LPSI Pump A and B,respectively.

An uncertainty analysis was performed for the fault tree models developed. The failure datafitted to a log-normal distribution is represented by mean value and error factor. The 95% valuesfor Failure to trip LPSI Pump A and B upon RAS were determined to be 2.98x10-0 3 (0.298%)and 3.13x10-0 3 (0.313%) for LPSI Pump A and B, respectively.

". ý, 42 ePalo Verde Nuclear Generating StaticUnits 1, 2 & 3

Engineering Study No. 13-ES-A037Revision 0

Page 3 of 32

LIST OF EFFECTIVE PAGES

Pages Revision

All 0 - Original Issue

\ý i i

Palo Verde Nuclear Generating Statior Engineering Study No. 13-ES-A037Units 1, 2 & 3 _ _ _.. Revision 0

Page 4 of 32

TABLE OF CONTENTS

Section Page

EXECUTIVE SUMMARY ....................................................................................................... 2

LIST OF EFFECTIVE PAGES ................................................................................................... 3

TABLE OF CONTENTS ......................................................................................................... 4

L IST O F T A B L E S .......................................................................................................................... 5

L IST O F F IG U R E S ........................................................................................................................ 5

1.0 INTRODUCTION AND PURPOSE .......................................................................... 6

1.1 S cop e ................................................................................................................................ 6

1.2 System Overview .......................................................................................................... 6

2.0 FAULT TREE ANALYSIS ....................................................................................... 13

2 .1 A ssum ptions ................................................................................................................... 13

2.2 Top Level Failure Modes ............................................................................................ 13

2.3 Lower Level Failure Modes Involving Failure of Breaker Trip Coil 52/TC toEnergize/Transfer ..................................................................................................... 14

2.4 Fault Tree Models ..................................................................................................... 15

3.0 RELIABILITY EVALUATION .............................................................................. 17

4.0 RESULTS AND CONCLUSIONS ......................................................................... 23

4.1 FTA Top Event: Failure to trip LPSI Pump A upon RAS ......................................... 24

4.2 FTA Top Event: Failure to trip LPSI Pump B upon RAS .................... 25

4.3 Uncertainty Analysis ................................................................................................. 27

4.4 Margin Evaluation ...................................................................................................... 30

5.0 REFERENCES .......................................................................................................... 31

Palo Verde Nuclear Generating Statiolll Engineering Study No. 13-ES-A037Units 1, 2 & 3 Revision 0

Page 5 of 32

LIST OF TABLES

Table 3-1: Failure Rates from PVNGS Document 13-NS-B063 Rev 9 .......................... 20Table 3-2: Component Failure Rate Summary ....................................................... 21Table 4-1: FTA Results (TOP Events) ................................................................. 23Table 4-2: Uncertainty Analysis Inputs ................................................................ 27Table 4-3: Uncertainty Analysis Inputs (95 % Computations) ..................................... 28Table 4-4: Uncertainty Analysis Results ............................................................. 30

LIST OF FIGURES

Figure 1: Equivalent Circuit for LPSI RAS-Pump-A Trip ....................................................... 7Figure 2: Equivalent Circuit for LPSI RAS-Pump-B Trip ......................................................... 8Figure 3: Class 1E 4.16kV AC Circuit Breaker 752 ................................................................... 8Figure 4: Equivalent Circuit for OR2 HFA Relay Terminals 13 & 14 ..................................... 9Figure 5: Equivalent Circuit for K104 Relay ............................................................................ 10Figure 6: Fault Tree Model Diagram ........................................................................................ 16Figure 7: LPSI RAS Pump A Trip Fault Tree Diagram ......................................................... 24Figure 8: LPSI RAS Pump B Trip Fault Tree Diagram ......................................................... 25Figure 9: Dominant Contributors (Shown for Pump B) ............................................ 26Figure 10: Monte Carlo Simulation Results .......................................................... 29

Palo Verde Nuclear Generating Statio., Engineering Study No. 13-ES-A037Units 1,2 & 3 Revision 0

Page 6 of 32

1.0 INTRODUCTION AND PURPOSE

This report documents the work performed for the fault tree analysis and reliability evaluation ofthe Low Pressure Safety Injection pump trip circuit in response to the Recirculation ActuationSignal (RAS) at the Palo Verde Nuclear Generation Station (PVNGS).

1.1 Scope

The scope of work performed for this study includes the following tasks:

1.1.1 Review of the most recent version of all applicable PVNGS documents for the intendedstudy of the LPSI pumps' response to the RAS.

1.1.2 Based on the operation of only certain portions of the electrical system pertaining to theshutdown of the LPSI pumps in response to the RAS, a fault tree was developed for FaultTree Analysis (FTA) that included all events or combination of events (including those inthe operating environment) that could result in the failure mode in which one or more ofthe LPSI pumps fails to power down when the RAS is received.

1.1.3 A review of PVNGS reliability data and additional reliability data was conducted for allelectronic and electrical components related to the LPSI pumps and RAS in order tocalculate the probabilities of various component failures.

1.1.4 The calculated failure probabilities were utilized to determine the likelihood of eachscenario identified that could possibly lead to the failure of the LPSI RAS pump-tripcircuitry.

1.1.5 The constructed fault tree was then utilized to perform all appropriate Fault TreeAnalyses and reliability evaluations of the LPSI RAS pump trip circuitry.

1.2 System Overview

Palo Verde Nuclear Generating Station Units 1, 2, and 3 each have two Low Pressure SafetyInjection pumps (LPSI pumps A and B). The LPSI pumps function as a part of the EmergencyCore Cooling System (ECCS) to inject large quantities of borated water into the Reactor CoolantSystem in the event of a large pipe rupture. The pumps are normally in standby andautomatically start upon receipt of the Safety Injection Actuation Signal (SIAS). During ECCSinjection, the borated water source for the injection pumps is the Refueling Water Tank (RWT).When RWT inventory is reduced to approximately the 10% level, a Recirculation ActuationSignal (RAS) is initiated and will result in a shutdown of both running LPSI pumps if allcomponents in the LPSI pump trip circuitry are operating satisfactorily.

The LPSI RAS pump trip circuits for pumps A and B are the same for each unit, with the onlyexception being that pump B has an additional control switch (Control Switch 3) and associatedcontacts (all CS-3 Contacts); this is discussed in more detail later in this section. An equivalentcircuit diagram for these circuits is shown in Figure 1, Figure 2, Figure 3, Figure 4, and Figure 5as an aid to the reader in understanding this system overview without having to refer to the

Palo Verde Nuclear Generating Stati:Units 1, 2 & 3


Page 7 of 32

complete control circuit diagrams (References 5.8 through 5.11). Each component referred to inthe subsequent discussion has its location in the complete control circuit diagrams given inparentheses. The following description of the trip circuitry applies to both of the LPSI RASpump trip circuits, with the exception that the discussion of Control Switch 3 and its associatedcontacts (all CS-3 contacts) only applies to LPSI pump B for each of the three units.

Reference 5.9

FU-2/35 ConnectionPoints 3 & 4


3 4 1 2

OR2 Contact ConnectionPoints 5 and 6

V 125 Volt DC Supply

5t6

M

K104-1 Contact ConnectioPoints L and M

1

FU 2/35 ConnectionPoints 1 & 2

2

10

ACB Trip Circuit

52/TC Breaker Trip 52 Auxiliary Drawout Switch 52 Auxiliary Drawout Switch'Coil Connection Contacts Connection Contacts ConnectionPoints 1 and 2 Points 4 & 4C Points 2 & 2C

1 2 4C 4 2C R.........................................................................................................................................................7 -R f r n e 5 1

Figure 1: Equivalent Circuit for LPSI RAS-Pump-A Trip

Palo Verde Nuclear Generating StatiolUnits 1, 2 & 3


Page 8 of 32r-

Reference 5.9



CS-3 Contact ConnectionPoints 2 & 2T

3 4 1 2

125 Volt DC Supply

1

FU 2/35 ConnectionPoints 1 & 2

2

ACB Trip Circuit

2T I I- 2

OR2 Contact ConnectionPoints 5 and 6

K104-1 Contact ConnectionPoints L and M

CS-3 Contact ConnectionPoints 4 & 4T

5

6

L

M

4T

I

52/TC Breaker Trip 52 Auxiliary Drawout Switch 52 Auxiliary Drawout Switch. 4

10

Points 1 and 2 Points 4 & 4C Points 2 & 2C

- ~ 9

1 2 4C '4 2 2C Reference 5.10

Figure 2: Equivalent Circuit for LPSI RAS-Pump-B Trip

Reference 5.8

752

1 3 4 8 9 10 11 12 13 14 15 16

CLOSING TRIPCKT CKT

FOR INTERNALSSEE DWG

01 -E-PBO-006

Figure 3: Class 1E 4.16kV AC Circuit Breaker 752

ý i i ,Palo Verde Nuclear Generating Static

Units 1, 2 & 3Engineering Study No. 13-ES-A037

Revision 0Page 9 of 32

P

9C

,eference 5.9

CS-2 ContactConnection

Points 9 & 9C

1

CS-3 ContactConnection

Points 1 & 1T1T

OR2 ContactConnection

Points 1 and 22- T 9

H

K104

12T

3

FU-3/10ConnectionPoints 3 & 4

4

3

FU-1/15ConnectionPoints 3 & 4

CS-3

Con

-1 Contact ConnectionPoints H & J

Contact ConnectionPoints 12 & 12T

OR2 HFA Relayiection Points 13 & 14

413

125 Volt DC Supply

14FU-1/15 Connection

Points 1 & 2

1 2

Figure 4: Equivalent Circuit for OR2 HFA Relay Terminals 13 & 14

ýý W-',Palo Verde Nuclear Generating StaticUnits 1, 2 & 3


Page 10 of 32

PPS Channel 1and 3 Contacts

PPS Channel 2and 4 Contacts Reference 5.11

TB 7336V DCPowerSupply

Figure 5: Equivalent Circuit for K104 Relay

The components of interest for determining the reliability of the LPSI RAS Pump B trip circuitryare connected in series as shown in Figure 2. If any of these components operate in a mannerdifferent than designed, then the associated LPSI pump will fail to trip upon initiation of theRAS signal. The series connected components of interest are FU-2/35 Connection Points 3 and41 (Sheet 2, Zone 7H of Reference 5.9), FU-3/10 Connection Points 1 and 2 (Sheet 2, Zone 5H ofReference 5.9), CS-3 Contact Connection Points 2 and 2T (Sheet 2, Zone 5H of Reference 5.9),OR2 Contact Connection Points 5 and 6 (Sheet 2, Zone 5G of Reference 5.9), K104-1 ContactConnection Points L and M (Sheet 2, Zone 5G of Reference 5.9), CS-3 Contact ConnectionPoints 4 and 4T (Sheet 2, Zone 5F of Reference 5.9), the ACB Trip Circuit (Sheet 2, Zone 5E ofReference 5.9; Consists of 52 Auxiliary Switch Drawout Contacts and 52/TC Breaker Trip CoilConnection Pointsl and 2), and FU-2/35 Connection Points 1 and 2 (Sheet 2, Zone 7E ofReference 5.9). The power supply for this trip circuit is the 125 Volt DC supply at the 4.16 kVSwitchgear (Sheet 2, Zone 7F of Reference 5.9).

1.2.1 FU-2/35 Connection Points 3 & 4, FU-3/10 Connection Points 1 & 2, and FU-2/35Connection Points 1 & 2

During normal operations, these fuses are expected to maintain continuity as long as there havebeen no over current conditions introduced into the system that would cause the fuse elements tofail open. However, there is also a possibility these fuses could fail open during normal use.

1 The term 'connection points' refers to a specific circuit location as identified in Reference 5.9.

Palo Verde Nuclear Generating Statio Engineering Study No. 13-ES-A037Units 1,2 & 3 Revision 0

Page 11 of 32

1.2.2 CS-3 Contact Connection Points 2 and 2T and Connection Points 4 and 4T

The position of Control Switch 3 determines whether its contacts are open or closed. The twopositions for Control Switch 3 are "Local" or "Remote and Local". When Control Switch 3 is inthe Local position, LPSI pump B can only be manually started/stopped using the local breakercontrol switch (Control Switch 1) at the 4.16 kV Switchgear. When Control Switch 3 is in theRemote and Local position, LPSI pump B can be manually started/stopped using the localbreaker control switch (Control Switch 1), or the control switch at the main control board(Control Switch 2). The normal and expected position for Control Switch 3 is Local and Remoteas indicated on Sheet 2, Zone 5C of Reference 5.9. If Control Switch 3 is in the Local position,an alarm in the control room will be activated, warning the control room operators that ControlSwitch 3 is out of its normal position. When Control Switch 3 is in the Remote and Localposition, the CS-3 contacts are expected to be closed across connection points 2 and 2T andconnection points 4 and 4T. When Control Switch 3 is in the Local position, both sets ofcontacts are expected to be open. There is also the possibility that the contacts could fail in astate different than the expected state.

1.2.3 OR2 Contact Connection Points 5 and 6

The position of the OR2 Contact Connection Points 5 and 6 is determined by the OR2 HFARelay Connection Points 13 and 14 (Sheet 2, Zone 2E of Reference 5.9). The equivalent circuitdiagram that illustrates how OR2 HFA Relay Connection Points 13 and 14 can be energized ispresented in Figure 4. When the OR2 HFA Relay is normally de-energized, its contacts arenormally closed across contact connection Points 5 and 6. These OR2 contacts can preventoperation of the RAS trip circuit if they fail open with the HFA relay de-energized or if the HFArelay is energized. There are two series connected paths that can result in the energizing of theOR2 HFA relay. Both paths include the K104-1 Contact Connection Points H and J (Sheet 2,Zone 2F of Reference 5.9) and CS-3 Contact Connection Points 12 and 12T (Sheet 2, Zone 2E ofReference 5.9). There are two ways for a series connection to be completed and energize theOR2 HFA relay. The first alternative involves the closing of CS-2 Contact Connection Points 9and 9C (Sheet 2, Zone 2G of Reference 5.9), which when operating as expected corresponds tothe momentary positioning of Control Switch 2 to the stop position. The second alternative tocomplete the energizing of the OR2 HFA relay would include the closing of OR2 ContactConnection Points 1 and 2 (Sheet 2, Zone 2G of Reference 5.9). These contacts normally act asa lock-in feature since they close when the OR2 HFA relay is energized. There is also apossibility that these contacts could fail closed with the OR2 HFA relay initially de-energized.

1.2.4 K104-1 Contact Connection Points L and M

The position of K104-1 Contact Connection Points L and M are determined by the status of theK104 relay (Zone 5F of Reference 5.11.1) as shown in Figure 5. When the relay is energized,the contacts are expected to be open and when it is de-energized, the contacts are normallyclosed. The K104 relay is normally energized by two dual DC power supplies. The first dualpower supply is provided by TB73 (Zone 8F of Reference 5.11.1) and TB83 (Zone 8C ofReference 5.11.1). The second dual power supply is provided by TB53 (Zone 8F of Reference

Palo Verde Nuclear Generating Statiop , Engineering Study No. 13-ES-A037Units 1, 2 & 3 Revision 0

Page 12 of 32

5.11.2) and TB63 (Zone 8C of Reference 5.11.2). In order for the K104 relay to de-energize,both dual DC power supplies must be disconnected from the relay. The first dual power supplyis disconnected when the Plant Protection System trip channel 1 or 3 contacts located in TB 75(Zone 6F of Reference 5.11.1) or TB 85 (Zone 6F of Reference 5.11.1) open. The second dualpower supply is disconnected when the Plant Protection System trip channel 2 or 4 contactslocated in TB 55 (Zone 6F of Reference 5.11.2) or TB 65 (Zone 6F of Reference 5.11.2) open.The other relays associated with the initiation of the RAS signal are K405, K312 and K309(Zone 4F of Reference 5.11.2). These relays are also powered by the same set of dual DC powersupplies that energize the K104 relay. When trip paths (1 or 3) and (2 or 4) are tripped open,power is removed from relays K405, K312 and K309 and results in the initiation of the RASsignal. The tripping of paths (1 or 3) and (2 or 4) results in the loss of power to energize theK104 relay.

1.2.5 ACB Trip Circuit

The Air Circuit Breaker (ACB) trip circuit (Zone 7G of Reference 5.10) is shown in the bottomof Figure 1 and Figure 2. The 52 Auxiliary Drawout Switch Contacts Connection Points 2 and2C and Connection Points 4 and 4C are normally closed contacts. They open when Breaker 752(Zone 8H of Reference 5.9) opens to remove the main 4.16 kV power supply from the LPSIpump. If they fail open prior to the opening of the breaker, the LPSI RAS trip circuit will fail totrip the pump upon initiation of a RAS signal. The 52/TC Breaker Trip Coil is a solenoid thatwill energize when all other series components of the RAS trip circuitry operate as expected withthe initiation of the RAS signal to actuate the trip mechanism for Breaker 752, resulting in thetrip of the LPSI pump.

1.2.6 Breaker 752

Breaker 752 (Zone 8H of Reference 5.9) opens to remove the main 4.16 kV power supply fromthe LPSI pump. As can be seen in Figure 2 (Zone E3 of Reference 5.8), Breaker 752 includes aninternal ACB trip circuit (Zone 7G of Reference 5.10) shown on the bottom of Figure 1 andFigure 2 which includes the 52 Auxiliary Drawout Switch Contacts Connection Points 2 and 2Cand Connection Points 4 and 4C as well as the 52/TC Breaker Trip Coil.

1.2.7 125 Volt DC Power Supply

The connection of the 125 Volt DC Power Supply (Sheet 2, Zones 7H and 7E of Reference 5.9)to the LPSI RAS pump trip circuitry is illustrated in Figure 1. Since this is the power supply thatshuts the LPSI Pump Breaker 752 upon initiation of SIAS and there is a relatively short amountof time between the initiation of SIAS and RAS, it is highly unlikely that this power supplywould not be available upon initiation of RAS.

l~ iPalo Verde Nuclear Generating Statio) Engineering Study No. 13-ES-A037

Units 1, 2 & 3 Revision 0Page 13 of 32

2.0 FAULT TREE ANALYSIS

The fault trees used to estimate the reliability of LPSI Pumps A and B for all three units areidentical, with the only difference being that Control Switch 3 and its associated CS-3 contactsare not present in the RAS trip circuitry for pump A. The fault tree development for LPSI PumpB will be discussed below in Sections 2.1 through 2.3 and illustrated in Section 2.4, with theunderstanding that the same logic will apply to LPSI Pump A with the exception of thediscussion of Control Switch 3 and its associated contacts, since they are not present in the pumpA control circuitry.

2.1 Assumptions

In developing the fault tree for LPSI Pump B, the following assumptions were made:

2.1.1 The 125 Volt DC power supply is available for the pump trip circuitry upon initiation ofthe RAS signal. Based on the fact that this power supply is necessary for the 752 breakerclosing circuitry upon initiation of the SIAS signal and the short amount of time betweenthe SIAS signal and the RAS signal, it is highly unlikely that this power supply willbecome unavailable when the RAS signal is initiated.

2.1.2 The RAS signal is successfully initiated when the RWT tank level reaches the 10% level.With this assumption, it can also be assumed that the ESFAS (Engineered Safety FeaturesActuation System) K104 relay is de-energized since successful initiation of the RASsignal indicates that relays K104, K309, K405 and K312 (Reference 5.12) associatedwith the RAS signal in the ESFAS auxiliary relay cabinet have been de-energized.

2.1.3 Control Switches 1 and 2 will remain in the normal position between the initiations of theSIAS and RAS signals.

2.1.4 Control switch 3 will remain in the remote and local position between the initiations ofthe SIAS and RAS signals. This assumption can be made since LPSI pump B would beunable to start upon initiation of the SIAS signal if control switch 3 were not in theremote and local position and the relatively short amount of time between initiations ofthe SIAS and RAS signals.

2.1.5 Once LPSI Pump B trips successfully after initiation of the RAS signal, no attempt willbe made to restart the pump.

2.2 Top Level 'Failure Modes

As discussed in the system overview section, the LPSI Pump B RAS trip circuit can be analyzedas a series circuit with 125 Volt DC Supply at the 4.16 kV Switchgear as the power supply inseries with Fuse 2/35 Connection Points 3 and 4, Fuse 3/10 Connection Points 1 and 2, CS-3Connection Points 2 and 2T Contact, OR2 Connection Points 5 and 6 Contact, K104-1Connection Points L and M Contact, CS-3 Connection Points 4 and 4T Contact, AuxiliaryDrawout Switch Connection Points 2 and 2C Contact 52, Auxiliary Drawout Switch ConnectionPoints 4 and 4C Contact 52, Breaker Trip Coil 52/TC Connection Points 1 and 2, and Fuse 2/35

Palo Verde Nuclear Generating Statio r Engineering Study No. 13-ES-A037Units 1, 2 & 3 Revision 0

Page 14 of 32

Connection Points 1 and 2. Upon successful initiation of a RAS signal, all of these seriesconnected components should act as a continuous circuit to enable Breaker Trip Coil 52/TC toenergize and open Breaker 752. The LPSI Pump B RAS trip circuitry will fail to successfullytrip the pump upon initiation of a RAS signal if one of the following two conditions occurs:

2.2.1 Breaker Trip Coil 52/TC is successfully energized, but Breaker 752 fails to open.

2.2.2 Breaker Trip Coil 52/TC is not energized.

If any of these series connected components act as open connections upon initiation of the RASsignal, Breaker Trip Coil 52/TC will not be energized. The possible failure modes of the seriesconnected components are discussed below.

2.3 Lower Level Failure Modes Involving Failure of Breaker Trip Coil 52/TC toEnergize/Transfer

2.3.1 Failure of Fuse 2/35 Connection Points 1 and 2, Fuse 2/35 Connection Points 3 and 4,and Fuse 3/10 Connection Points 1 and 2

The purpose of these components is to protect the pump trip circuitry from potential damage dueto overcurrent conditions. They are expected to remain continuous during normal operation ofthe pump control circuitry. These fuses would cause failure of the RAS pump trip circuitry uponinitiation of the RAS signal if they have failed open during normal wear or the presence of apreviously undetected over current condition.

2.3.2 Failure of OR2 Connection Points 5 and 6 Contact

This normally closed contact is associated with the OR2 HFA Relay Connection Points 13 and14. When the RAS signal is initiated, the relay is expected to remain de-energized and thecontact should remain normally closed. There are two modes of failure that can be associatedwith this contact. The first involves the relay remaining de-energized and the contact failingopen. The second involves the relay, being energized, resulting in the contact opening. Thesecond mode of failure and its associated fault tree component require further discussion.

There are two ways that the OR2 HFA relay could inadvertently energize. The first requires theCS-3 Connection Points 12 and 12T Contact to be closed (expected due to Control Switch 3position assumption), K104-1 Connection Points H and J Contact to be closed (expected due topresence of RAS signal), and OR2 Connection Points 1 and 2 Contacts to fail closed. Thesecond requires the CS-3 Connection Points 12 and 12T Contact to be closed (expected due toControl Switch 3 position assumption), K104-1 Connection Points H and J Contact to be closed(expected due to presence of RAS signal), and CS-2 Connection Points 9 and 9C Contact tobecome closed. With the assumption that Control Switch 2 will remain in the normal position,this failure could occur only if the CS-2 Connection Points 9 and 9C Contact fails closed.

Palo Verde Nuclear Generating Statio• Engineering Study No. 13-ES-A037Units 1,2 & 3 Revision 0

Page 15 of 32

2.3.3 Failure of CS-3 Connection Points 2 and 2T and CS-3 Connection Points 4 and 4TContacts

Based on the assumption that Control Switch 3 will remain in the remote and local position,these contacts are expected to be in the closed position upon initiation of the RAS signal. Thereis a possibility that these contacts could fail open during normal wear.

2.3.4 Failure of K104-1 Connection Points L and M Contact

The expected operation of this contact upon initiation of a RAS signal is for the contact to closewhen power is removed from the K104 relay. There are two modes of failure associated withthis contact failing open upon initiation of a RAS signal. The first involves the K104 relayfailing to transfer/dropout when power is removed from it. The second mode of failure is thatthe contacts fail open when the K104 relay successfully transfers/drops out.

2.3.5 Failure of 52/TC Trip Coil Relay Connection Points 1 & 2

There are two modes of failure associated with this component. The first mode involves the coilfailing as an open connection due to deterioration or damage to it. The second mode involves thecoil energizing successfully, but some failure occurring in the transfer mechanism between therelay and Breaker 752 that would prevent the breaker from opening.

2.3.6 Failure of Auxiliary Drawout Switch 52 Connection Points 2 and 2C Contact and 4 and4C Contact

These contacts are normally closed contacts. They open when Breaker 752 opens to remove themain 4.16 kV power supply from the LPSI pump. The failure mode for these componentsinvolve them failing open prior to the opening of the breaker, which would prevent the LPSIRAS trip circuit from tripping the pump upon initiation of a RAS signal.

2.4 Fault Tree Models

The Fault Tree Model constructed to incorporate the above listed failure scenarios are presentedin Figure 6, which model the analyzed fault-tree TOP Event (failure of LPSI Pump to trip uponinitiation of the RAS signal). The depicted FTA model is for Pump B. The model for Pump A isidentical, with the exception that all of the failure modes associated with Control Switch 3 and itsassociated CS-3 contacts will be deleted.

Palo Verde Nuclear Generating StatioUnits 1, 2 & 3


Page 16 of 32

. . . . .It•re!cO• • . . ......R/2 Connection Points 5:•6 S-2 Connection1 Poits 9&9C R-2,Connection-PoinCs IA&2

cittsfitoremainclsect 3otat fil to remain o'e. ctacit fil sý.po eranqnpn

'Cortact'5-'6 Fail.; 006n.;. .:Cntact M-C Fails CI6~ed Conitat1- ,2 Fails.Closed,

Figure 6: Fault Tree Model Diagram

\i dPalo Verde Nuclear Generating Stati •- Engineering Study No. 13-ES-A037

Units 1,2 & 3 Revision 0Ut 1Page 17 of 32

3.0 RELIABILITY EVALUATION

The reliability rates utilized for all fault tree analyses in this study were obtained from PVNGSDocument Number 13-NS-B063 Revision 9, PVNGS At-Power PRA Study for Generic andBayesian Updated Reliability Data Analysis, Reference 5.1. These reliability rates are listed inTable 3-1: Failure Rates from PVNGS Document 13-NS-B063 Rev 9. The ID code determinedby the above mentioned PVNGS study are also listed in Table 3-1 to aid the reader in followingthe calculations used to determine the probability of the failure modes given in the fault trees thatwere utilized for this study. These reliability rates were based on a thorough review of PVNGSoperating experience, other plants' operating experience, and all relevant nuclear power plantcomponent reliability studies. The probability of failure calculations for the component involvedin the LPSI RAS pump trip circuitry are summarized in the discussion below and in Table 3- 1:Failure Rates from PVNGS Document 13-NS-B063 Rev 9.

When converting the reliability rates in column 3 of Table 3-1 from failures per hour to failureprobability upon initiation of a RAS signal, a few factors come into play. These factors are thecomponent test interval (T), mission time (t), the failure rate determined for the component tochange to the necessary position, and the failure rate determined for the component to remain inthe necessary state. For a component that is required to change state the probability of failureupon initiation of a RAS signal or demand is:

P (Failure Upon Initiation of RAS Signal)= (.5 x (Mean Failure Rate To Change To Desired State) x T)+ ((Mean Failure Rate To Remain In Desired State) x t)

The first half of the equation accounts for the component switching to a failed state while instandby (elapsed time since the component was verified to be operating properly and when theRAS signal is initiated). The second half of the equation accounts for failure of the componentwhen the RAS signal creates a new demand that is placed on the contact that requires it tochange state. Rule 6 of Reference 5.2 states "If the relay has been identified as having a "fail-to-energize" or "fail-to-deenergize" mode and has a long exposure time, greater than 24 hours thendo not model the contacts with the "fail-to-remain-open" and the "fail-to-remain-closed". Thesefailure modes are considered insignificant contributors to the total failure rate." During thisstudy, in accordance with Rule 6 of Reference 5.2, the second half of the equation wasdisregarded when the test interval (T) was determined to be greater than 24 hours.

If the component of concern is not required to change state upon initiation of a RAS signal, thenthe probability of failure upon initiation of a RAS signal only needs to account for the possibilityof failure while the component is in standby and can be calculated as follows:

P (Failure Upon Initiation of RAS Signal) =(.5 x (Mean Failure Rate To Remain In Desired State) x T)

Palo Verde Nuclear Generating Statlo Engineering Study No. 13-ES-A037Units 1, 2 & 3 Revision 0

Page 18 of 32

Rule 14 of Reference 5.2 states "If there is indication in the Control Room, SEIS, or on the AORounds of the failure of a component do not include the component failure. Examples are fusesand power disconnect breakers for standby equipment. These failures are not included in theanalysis if their spurious open would cause loss of indication lights." During this study, inaccordance with Rule 14 of Reference 5.2, standby failures of components whose failure wouldresult in an indication in the control room were disregarded in the fault tree analysis conductedfor this study.

The component test intervals listed in Table 3-2 are based on the periodicity of maintenanceprocedures that verify proper operation of components associated with the LPSI RAS pump tripcircuitry. Every quarter each LPSI pump is shut down manually which verifies the properoperation of all components associated with the RAS pump trip circuitry with the exception ofOR2 Connection Points 5 and 6 Contact, K104-1 Connection Points L and M Contact, and theK104 relay. Every 18 months procedure 36-ST-9SA03 / 04 tests that Breaker 752 opens whenthe RAS signal is initiated, which verifies proper operation of the three components that are notverified when the pump is shut down manually.

The following components found in Figure 1 and Figure 2 are not included in Table 3-2 for thisanalysis because:

" Fuse 2/35 Connection Points 3&4:Failure of this fuse results in 762T Relay Connection Points LI and L2 (Zone 5E ofReference 5.9) becoming de-energized. When the 762T Relay de-energizes, the 762TContact Connection Points 5 and 3 (Zone 4D of Reference 5.9) opens. This 762TContact is part of the Safety Equipment Inoperable Status (SEIS) circuitry and when it isopen results in indication in the control room. Operations will know immediately if Fuse2/35 fails open. Reference 5.2, Rule 14.

" Fuse 3/10 Connection Points 1&2:Failure of this fuse results in 762T Relay Connection Points Li and L2 (Zone 5E ofReference 5.9) becoming de-energized. When the 762T Relay de-energizes, the 762TContact Connection Points 5 and 3 (Zone 4D of Reference 5.9) opens. This 762TContact is part of the Safety Equipment Inoperable Status (SEIS) circuitry and when it isopen results in indication in the control room. Operations will know immediately if Fuse3/10 fails open. Reference 5.2, Rule 14

" Aux. Drawout Switch Contact 52 Connection Points 2&2C:This component is considered part of the 752 breaker and its contribution to breakerfaults has already been incorporated. Reference 5.2, Rule 13, which states "For AirCircuit Breakers (ACBs), the control circuit components located on the breakersthemselves are considered part of the breakers and their contribution to breaker faults isalready accounted for in the breaker local fault events in the fault trees."

" Aux. Drawout Switch Contact 52 Connection Points 4&4C:This component is considered part of the 752 breaker and its contribution to breakerfaults has already been incorporated. Reference 5.2, Rule 13

iPalo Verde Nuclear Generating Statio Engineering Study No. 13-ES-A037

Units 1, 2 & 3 Revision 00 'Page 19 of 32

" 52/TC Coil Relay:This component is considered part of the 752 breaker and its contribution to breakerfaults has already been incorporated. Reference 5.2, Rule 13

" Fuse 2/35 Connection Points 1&2:Failure of this fuse results in 762T Relay Connection Points LI and L2 (Zone 5E ofReference 5.9) becoming de-energized. When the 762T Relay de-energizes, the 762TContact Connection Points 5 and 3 (Zone 4D of Reference 5.9) opens. This 762TContact is part of the Safety Equipment Inoperable Status (SEIS) circuitry and when it isopen results in indication in the control room. Operations will know immediately if Fuse2/35 fails open. Reference 5.2, Rule 14

The following components found in Figure 4 are not included in Table 3-2 for this analysisbecause failure of these expected shut contacts, fuses and relay will not produce a failure of thesystem:

" FU-1/15 Connection Points 3 and 4" FU-3/10 Connection Points 3 and 4" CS-3 Connection Points 1 & IT Contact" K104-1 Connection Points H & J Contact• CS-3 Connection Points 12 & 12T Contact" OR2 HFA Relay Connection Points 13 & 14" FU-1/15 Connection Points 1 and 2

In determining the failure rate value of the K104-1 Connection Point L&M Contact in Table 3-2only failure mode RXAFT (ESFAS Actuation (K###) Relay Failure To Transfer) from Table 3-1was utilized in accordance with Rule 8 of Reference 5.2 which states, "If the contacts areassociated with protection relays and the analyst has identified those relays with a failure modeof improper operation the contacts are not counted because the failure data for protection relaysis all inclusive." It was determined for this study that the RXAFT failure mode accounted forboth the failure of the relay to transfer properly and its associated contacts to change stateaccordingly.

Palo Verde Nuclear Generating StaticUnits 1, 2 & 3


Page 20 of 32

Table 3- 1: Failure Rates from PVNGS Document 13-NS-B063 Rev 9

Circuit Breaker Failure To OpenMean - 6.49E-4/D

Error Factor - 5

(CB-FO)

ESFAS Failure To Mean - 5.OE-8/HActuation TransError Factor - 9

(K###) Relay (RXAFT)

Mean 1.OE-8/H

Relay Contacts Failure To Remain Error Factor 3Closed Or Open (CP-RC And CP-RO)

". i ! ,Palo Verde Nuclear Generating Static



Table 3- 2: Component Failure Rate Summary

K104-1Connection

PointsL&M

Contact

Procedure36-ST-

9SA03/04

18Months(13140Hours)

K104 Relay Fails ToTransfer/Dropout When

Power Is Removed Due ToStandby Failure (RXAFT)

0.5 x (RXAFT) x T 3.29E-04

Contact Fails To RemainOR2 18 Closed Due To Standby

Connection Procedure Months Failure (CP-RC).36-ST- 0.5 x (CP-RC) x T 6.57E-05

Points 5&6 95A03/04 (13140 No demand is placed on thisContact Hours) component upon initiation

of RAS.

Contact Fails To RemainCS-3 3 Months Closed Due To Standby

Connection Procedure 3 Failure (CP-RC).Points 2&2T 73ST-9SI11 (2160 No demand is placed on this 0.5 x (CP-RC) x T 1.08E-05

Contact component upon initiationof RAS.

Contact Fails To RemainCS-3 3 Months Closed Due To Standby

Connection Procedure 3 Failure (CP-RC).Points 4&4T 73ST-9SI11 (2160 No demand is placed on this

Contact Hours) component upon initiationof RAS.

Mechanical Procedure 3 Months Breaker Fails To Open Upon:Breaker 752 73ST-9SI11 Demand (CB-FO). CB-FO 6.49E-04

Hours)

Palo Verde Nuclear Generating StatioUnits 1, 2 & 3


Page 22 of 32

Table 3- 2: Component Failure Rate Summary (continued)

CS-2ConnectionPoints 9&9C

Contact

Procedure36-ST-

9SA03/04

18Months(13140Hours)

Contact Fails To RemainOpen Due To Standby

Failure (CP-RO).No demand is placed on this

component upon initiation

of RAS.

0.5 x (CP-RO) x T 6.57E-05

Contact Fails To RemainOR2 Procedure 18 Open Due To Standby

Connection Poeue Months Failure (CP-RO).36-ST- 0.5 x (CP-RO) x T 6.57E-05Points 1&2 95A03/04 (13140 No demand is placed on this

Contact Hours) component upon initiation

I_ I I of RAS.

\ý I IPalo Verde Nuclear Generating Static



4.0 RESULTS AND CONCLUSIONS

Fault Tree Models were constructed per the discussions outlined in Section 2. They weresubsequently quantified per the reliability evaluations as outlined in Section 3. The FTA resultsare presented in this section.

Two Fault Tree Models were quantified during this evaluation. Figure 7 illustrates the fault treemodel for LPSI Pump A and Figure 8 illustrates the fault tree model for LPSI Pump B.

Both of these fault tree models (for LPSI Pump A and B) are identical (in structure) with the onlyexception being that all of the failure modes associated with Control Switch 3 and its associatedCS-3 contacts apply only to LPSI Pump B. These Control Switch 3 and its associated CS-3contacts failures do not apply to LPSI Pump A.

The computed FTA results are summarized in Table 4-1. The FTA results for both LPSI pumpsare similar. The differences between the two LPSI Pump configurations do not have asignificant impact on the overall FTA result.

Table 4- 1: FTA Results (TOP Events)

LPSi Pump A I 1.171-3LPSI Pump B 1.20E-3

The FTA details are presented in following sub-sections:

v kI ,Palo Verde Nuclear Generating Static



4.1 FTA Top Event: Failure to trip LPSI Pump A upon RAS

Figure 7 presents the details of the FTA analysis for Pump A.

Figure 7: LPSI RAS Pump A Trip Fault Tree Diagram

Palo Verde Nuclear Generating StaticUnits 1, 2 & 3


Page 25 of 32tr

4.2 FTA Top Event: Failure to trip LPSI Pump B upon RAS

Figure 8 presents the details of FTA analysis for Pump B.

Figure 8: LPSI RAS Pump B Trip Fault Tree Diagram

Palo Verde Nuclear Generating Statio:Units 1, 2 & 3

Engineering Study No. 1.3-ES-A037Revision 0

Page 26 of 32

The dominant contributors for the LPSI Pump Failure to Trip (upon RAS) are presented inFigure 9.

~0.000649 000

0.00030.0005ý

0.00043 *~ 00O

0. 00iK0.00021

0.0000 LI

1 a .

Figure 9: Dominant Contributors (Shown for Pump B)

As can be seen from Figure 9, the dominant contributor of the Pump Failure2 to trip upon RAS(Breaker 752 does not open) is Breaker 752 sticks closed This single failure accounts for about54% of the overall FTA result.

LPSI Pump A dominant contributors are the same as LPSI Pump B.

)tk IPalo Verde Nuclear Generating Static



4.3 Uncertainty Analysis

An uncertainty analysis was performed for the Fault Tree models developed. The input failuredata was fitted to a log-normal distribution is represented by mean value and error factor. Thetable below shows the various input distributions and associated 95% Upper bound valuesassumed for the input parameters.

Table 4-2: Uncertainty Analysis Inputs

CircuitBreaker

Failure ToOpen

Mean - 6.49E-4/DError Factor - 5

(CB-FO)6.49E-04 5 0.97838171 1 2.01E-03

ESFAS Failure To Mean - 5.OE-8/HActuation Error Factor - 9 5.OOE-08 9 1.33569883 1.84E-07

(K###) Relay (RXAFT)

Failure ToFailue To Mean 1.0E-B/HRelay RemainMen1E8HConac CedaOr Error Factor 3 1.OOE-08 3 0.66784942 2.40E-08

Contacts Closed Or (CP-RC And CP-RO)Open



Table 4-3: Uncertainty Analysis Inputs (95% Computations)

K104-1ConnectionPoints L &M Contact

Procedure 36-ST-9SA03/04

18 Months(13140 Hours)

0.5 x (RXAFT) x T 3.29E-04 1.21E-03

OR2Connection Procedure 36-ST- 18 MonthsPont 56 SA304 (114 Hur) 0.5 x (CP-RC) x T 6.57 E-05 1.58E-04Points 5&6 9SA03/04 (13140 Hours)

Contact

CS-3Connection Procedure 73ST- 3 Months (2160

Points 911 Hours) 0.5 x (CP-RC) x T 1.08E-05 1.99E-042&2T

Contact

CS-3Connection Procedure 73ST- 3 Months (2160

Points 90.5 x (CP-RC) x T 1.08E-05 1.99E-044&4T

ContactMechanical

Breaker Procedure 73ST- 3 Months (2160 CB-FO 6.49E-04 2.01E-03729S11l Hours)752

CS-2ConnectionConectonProcedure 36-ST- 18 Months

Points 9PA03/04 (13140 Hours) 0.5 x (CP-RO) x T 6.57E-05 1.58E-049&9C

ContactOR2

Connection Procedure 36-ST- 18 Months 0.5 x (CPRO) x T 6.57E05 1.58E-04Points 1&2 9SA03/04 (13140 Hours)

Contact

A Monte Carlo simulation was performed to get an estimate of the 95% value of the resultantFTA top event being modeled. The Monte Carlo Simulation results for Failure to trip LPSIPump A and B upon RAS are presented below.

\, Ai..Palo Verde Nuclear Generating StaticUnits 1, 2 & 3


Page 29 of 32r

Forecast: Pump A

Frequency Chart10,000 Trials

.026 1-

0L0.

.019

.013

.006

9,735 Displayed-259

............... 194.2

............... 129.5 .

64.75

U 0F

3.95E.4 1.17E-3 1.95E-3 2.72E -3 3.50E-3

Forecast PumpB

FrequencyChart1 ý00 Tials

.019

.014

0L

9,750 Displa~ed

186

...... 139.5

-rI-11

............ 93

............ 46.5

A 0

.009

4.78E-4 1.32E-3 216E-3 3.C0E-3 3.85E-3

Figure 10: Monte Carlo Simulation Results

Palo Verde Nuclear Generating Statio:Units 1, 2 & 3


Page 30 of 32t,

The table below lists the 95% values for failure to trip LPSI Pump A and B upon RAS

Table 4- 4: Uncertainty Analysis Results

~4Pu mp -F Pe rcje nt I~ e Vlue7

A 95.0% 2.98x10° 3

B 95.0% 3.13x10-03

4.4 Margin Evaluation

The purpose of this study is to determine the probability that LPSI Pumps A or B for Units 1, 2,and 3 would fail to shut down upon RAS and the concept of margin does not apply. (Procedure81DP-4CC03, Section 3.22, Step 7, Part d)

Palo Verde Nuclear Generating Statio, Engineering Study No. 13-ES-A037Units 1, 2 & 3 Revision 0

Page 31 of 32

5.0 REFERENCES

5.1 Document 13-NS-B063, PVNGS at-Power PRA Study for Generic and Bayesian UpdatedReliability Data Analysis, Rev. 9, January 2009

5.2 Document 13-NS-B084, At-Power PRA Control Circuit Analysis, Rev. 6, January 2009

5.3 NUREG-0492, Fault Tree Handbook, W.E. Vesely, et al, Systems and Reliability Research

Office of Nuclear Regulatory Research U.S. Nuclear Regulatory Commission, January

1981.

5.4 NUREG/CR-6823, Handbook of Parameter Estimation for Probabilistic Risk Assessment,C.L. Atwood, et al, Sandia National Laboratories, September 2003.

5.5 NUREG/CR-6928, Industry-Average Performance for Components and Initiating Events at

U.S. Commercial Nuclear Power Plants, S.A. Eide, et al, Idaho National Laboratory,

February 2007.

5.6 EGG-SSRE-8875, Generic Component Failure Data Base for Light Water and LiquidSodium Reactor PRAs, Eide, et al, EG&G Idaho, Inc., February 1990.

5.7 PVNGS UPDATED FSAR, Sections 5, 6, 7, and 9, Revisions 11, 12, & 14, June 2001, June

2003, & June 2007.

5.8

5.8.1 Control Wiring Diagram, Safety Injection & Shutdown CLG System, LP Safety

Injection Pumps 1M-SIA-PO1 and 1M-SIB-P01, Drawing No 01-E-SIF-002, Rev. 2.


Injection Pumps 2M-SIA-P01 and 2M-SIB-P01, Drawing No 02-E-SIF-002, Rev. 2.


Injection Pumps 3M-SIA-P01 and 3M-SIB-P01, Drawing No 03-E-SIF-002, Rev. 2.

5.9

5.9.1 Elementary Diagram, Safety Injection & Shutdown CLG System, LP Safety

Injection Pumps 1M-SIA-P01 and IM-SIB-PO1, Drawing No 01-E-SIB-002, Rev. 6.

5.9.2 Elementary Diagram, Safety Injection & Shutdown CLG System, LP safety

Injection Pumps 2M-SIA-PO1 and 2M-SIB-PO1, Drawing No 02-E-SIB-002, Rev.5.

5.9.3 Elementary Diagram, Safety Injection & Shutdown CLG System, LP safety

Injection Pumps 3M-SIA-PO1 & 3M-SIB-P01, Drawing No 03-E-SIB-002, Rev. 3.

Palo Verde Nuclear Generating Statior Engineering Study No. 13-ES-A037Units 1,2 & 3 Revision 0

Page 32 of 32

5.105.10.1 Elementary Diagram, 4.16 kV Class 1E & non-lE Power System, ACB Internal

Mechanism & SWGR Space Heaters & Blower Circuits, Drawing No 01-E-PBB-006, Rev. 1.

5.10.2 Elementary Diagram, 4.16 kV Class 1E & non-lE Power System, ACB InternalMechanism & SWGR Space Heaters & Blower Circuits, Drawing No 02-E-PBB-006, Rev. 1.

5.10.3 Elementary Diagram, 4.16 kV Class 1E & non-lE Power System, ACB InternalMechanism & SWGR Space Heaters & Blower Circuits, Drawing No 03-E-PBB-006, Rev. 1.

5.115.11.1 ESFAS Auxiliary Relay Cabinet, Electrical Schematics, Drawing No N001-13.06-

161, Rev. 4.5.11.2 ESFAS Auxiliary Relay Cabinet, Electrical Schematics, Drawing No N001-13.06-

162, Rev. 5.

5.125.12.1 ESFAS Train A Actuated Devices, Drawing No 13-J-SAS-001, Rev. 16.5.12.2 ESFAS Train B Actuated Devices, Drawing No 13-J-SAS-002, Rev. 17.

5.13 FW: Additional topics for pre-brief call at 2:30 p.m. today, Email Communication fromAllan Hartwig, APS, dated August 4, 2009.

5.14 RE: Follow up questions, Email Communication from Allan Hartwig, APS, datedAugust 6, 2009.

attachment 4, pvngs engineering study 13-es-a037, revision

Documents