ML022060200

Regulatory Conference Supplemental Information

ML022060200
Person / Time
Site:	Cook
Issue date:	07/23/2002
From:	Greenlee S American Electric Power Co, Indiana Michigan Power Co
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
AEP:NRC:2609-01, IR-01-017 NTS-2002-010-REP, Rev 0 - CS-1, NTS-2002-023-REP, Rev 0
Download: ML022060200 (83)

Text

I I I I'iii

'Cr

'1:4 I

July 23, 2002 AEP:NRC:2609-01 10 CFR 50.4 Docket Nos.: 50-315 50-316 U. S. Nuclear Regulatory Commission ATTN: Document Control Desk Mail Stop O-P 1-17 Washington, DC 20555-001 Donald C. Cook Nuclear Plant Units 1 and 2 REGULATORY CONFERENCE SUPPLEMENTAL INFORMATION

Reference:

D. C. Cook Nuclear Power Plant, Units 1 and 2 NRC Special Inspection Report 50-315/01-17 (DRP); 50-316/01-17 (DRP);

Preliminary Yellow Finding The referenced Inspection Report requested that Indiana Michigan Power Company provide supplemental information prior to the Regulatory Conference.

Attachments 1 and 2 provide the requested information. Attachment 1 is NTS-2002-010-REP, Rev. 0 - CS-1 "Debris Intrusion into the Essential Service Water System - Probabilistic Evaluation, April 2002," and Attachment 2 is NTS-2002-023-REP, Rev. 0 "Debris Intrusion into the Essential Service Water System - Reassessment of Probabilistic Evaluation, July 2002."

This letter contains no new commitments. Should you have any questions, please contact Mr. Gordon P. Arent, Manager of Regulatory Affairs, at (616) 697-5553.

S. A. Greenlee Director of Nuclear Technical Services DB/dmb Attachments K

I

U. S. Nuclear Regulatory Commission AEP:NRC:2609-01 Page 2 c: K. D. Curry, w/o attachments J. E. Dyer MDEQ - DW & RPD, w/o attachments NRC Resident Inspector, w/o attachments D. G. Passehl R. Whale, w/o attachments

ATTACHMENT 1 TO AEP:NRC:2609-01 NTS-2002-01O-REP, Revision 0 - CS-I Debris Intrusion into the Essential Service Water System Probabilistic Evaluation, April 2002

Debris Intrusion into the Essential Service Water System Probabilistic Evaluation April 2002 Note: This report should be used with report NTS-2002-023-REP, Rev. 0. The purpose of NTS-2002 023-REP-023-REP is to provide supplementary information to:

• Identify and explore key differences in the evaluation approaches and application of judgement used by NRC and AEP in the significance determination of this event. CS-1

"* Provide additional/clarifying information to help resolve selected differences.

"* Present AEP's reassessment of the change in CDF and LERF for the dual-unit LOOP scenario, taking into account NRC and independent third party review comments.

Donald C. Cook Nuclear Plant NTS-2002-01 0-REP, Rev. 0 - CS-1 Prepared by:

M. K. Scarpello Date Reviewed by:

J/I Hawley / Date Approved by:

DR. Hae ate Reason for This report is revised to provide linkage between this report and report NTS-2002-023 Revision: REP, Rev. 0 and to correct a typographical error in Table 2. Pages 1 (cover page) and Rev. 0 - 29 of the Rev. 0 report are revised by this change sheet.

Table of Contents A b stra c t ............................................................................................................... 3 Introduction and Purpose .............................................................................. 3 Background .................................................................................................... 5 The Event ............................................................................................... 5 Initial Investigations ................................................................................ 5 Corrective Actions ................................................................................... 6 Subsequent Investigations .................................................................... 6 Probabilistic Analysis of Events Leading to the Loss of an EDG ............... 7 Event Probability ............................................................................................. 7 Block 1: Loss of off-site power occurs .................................................. 8 Block 2: Suspended debris is sufficient to challenge ESW system .......... 8 Block 3: Suspended debris reaches the Unit 1 East ESW pump ........... 15 Block 4: Failed strainer basket in service during the LOOP event .......... 15 Block 5B: Flow through ESW strainer is high ....................................... 16 Block 6: Ingested debris bypasses Unit 1 East ESW strainer ............ 18 Block 7: Debris reaches the Unit 2 EDG coolers ................................. 19 Block 8: Cooling flow degradation impacts EDG function ................... 20 Block 9: Condition is not identified and cleared by operators ............. 26 Summary of Event Probability ............................................................. 29 PRA Evaluation of ESW Debris .................................................................. 30 Calculation of Conditional Probabilities .............................................. 30 Cook Nuclear Plant PRA Model Modifications .................................... 32 Cook Nuclear Plant PRA Model Results .............................................. 34 Conclusions ................................................................................................. 34 R efe re n ce s .................................................................................................. . . 35 F ig u re s ....................................................................................................... . . 38 NTS-2002-010-REP, REV. 0 PAGE 2 OF ,51

Debris Intrusion into the Essential Service Water System Probabilistic Evaluation Abstract The August 2001 essential service water (ESW) debris intrusion event that restricted cooling water flow to all four emergency diesel generators (EDGs) at Cook Nuclear Plant Units 1 and 2 resulted in a finding of potentially "greater-than-green" by the NRC Special Inspection Team (SIT). Post-event deterministic evaluations of equipment performance indicated that, with reasonable assurance, the EDGs could have performed their function during the August 2001 event and other credible debris intrusion scenarios following a Loss-of-Offsite Power (LOOP) event. However, to address uncertainties in the deterministic studies, a separate probabilistic evaluation of the impact of the failed ESW strainer on plant response following a LOOP event was prepared to support the Significance Determination Process.

Taking single-unit or dual-unit LOOP as the initiating event, a logical sequence of steps leading to EDG failure following a debris intrusion event was determined. A subjective probability estimate for each of the steps in the sequence was selected using a technique described in NUREG/CR-5424, "Eliciting and Analyzing Expert Judgement: A Practical Guide." The individual probabilities were then combined to determine the conditional failure probability of each sequence. The conditional probabilities were used in the full plant PRA model to determine quantitative estimates for increases in core damage frequency (CDF) and large early release frequency (LERF) that could be associated with the assumed condition. The results of the probabilistic analyses indicate that the increase in plant risk due to the condition identified following the August 2001 event is very small, even with conservative (i.e., worse than expected performance) assumptions.

Specifically, the PRA model estimates a CDF increase of 2.8E-O7/year and a LERF increase of 4.2E-08/year.

Introduction and Purpose On August 29, 2001, a damaged essential service water (ESW) strainer basket allowed debris to be distributed throughout the ESW system, resulting in degraded cooling flow to all four emergency diesel generators (EDGs). More details of this event are described in the Background sections titled "The Event" and "Initial Investigations." This event was investigated by a Special Inspection Team (SIT) led by the NRC Resident Inspectors at Cook Plant. The outcome of their investigation was a finding against Cook Plant implementation of 10CFR50 Appendix B, since inadequate maintenance apparently had been performed on an ESW strainer, and had not been detected prior to August 29, 2001.

This finding was then evaluated using the NRC's Significance Determination Process (SDP). Based on the nature of the August 2001 event, the finding identifies a potential common-cause failure of two or more EDGs. Accordingly, application of the SDP has NTS-2002-010-REP, REV. 0 PAGE 3 OF 51

focused on the two initiating events in the SDP for which EDGs play a mitigating role.

These two initiating events are single-unit Loss-of-Offsite Power (LOOP) and dual-unit Loss-of-Offsite Power (DLOOP). Based on the initial information available, the risk significance of this finding was characterized by the SIT as potentially "greater-than-green" during their exit meeting in late September 2001. This greater-than-green designation implies that, within the context of the SDP, the expected risk increase attributable to the finding is above a threshold value. For increases in core damage frequency (CDF), the greater-than-green threshold value is 1 x 10.6 (or 1 E-6) per year, while for increases in large early release frequency (LERF), the greater-than-green threshold value is 1 x 10-7 (or 1E-7) per year.

In response to the NRC determination that ESW debris intrusion might involve a greater than-green risk level, AEP undertook extensive analyses related to the events of August 29, 2001. The purpose of these analyses was to better understand the response of the plant and affected systems and to determine the extent that any safety function could have been adversely affected. The scope of these analyses are identified below in the Background section titled "Subsequent Investigations." These analyses developed a detailed theory of the sequence of events that would occur following debris intrusion into the ESW system and accounted for realistic equipment performance.

Results of these deterministic analyses were provided to the NRC inspection team for consideration in January 2002 and were discussed with NRC staff during the continuing inspection. These results indicate that the EDGs would have performed their function even with the degraded flow experienced in August 2001 and suggest that the debris conditions existing during the August event would envelope conditions existing under hypothetical LOOP events. To supplement the studies and to address uncertainties surrounding the nature of worst-case debris conditions, an additional probabilistic analysis of the impact of the failed ESW strainer on plant response following LOOP and DLOOP initiating events was undertaken to assess the risk associated with a damaged ESW strainer basket. Some additional elements of the postulated event that were not addressed in the deterministic studies become important in the probabilistic evaluation.

Some examples include:

"* Quantity and type of available debris inventory, specifically with regard to a change in zebra mussel biocide treatment that makes debris conditions during the August 2001 event unusual, if not unique

"* Possibility that the damaged strainer basket (half of a duplex strainer) is not in service Possibility that debris entering the failed basket will not flow through the bypass area Possibility that alignment of the ESW/CCW systems will not carry debris to all four EDGs given that all four ESW pumps would be running following a single-unit or dual unit LOOP Other previously presented elements of the failure scenario, such as debris entrainment as a result of water draining back from the condenser, have shifted in importance after further review of the likely plant response under LOOP conditions.

The approach taken in this report consists of breaking the probabilistic analysis effort into two major tasks. The first task is to estimate the probability that the damaged ESW strainer, in conjunction with an assumed LOOP or DLOOP initiating event, could lead to one or more EDGs failing due to overheating. This task involves considering the availability of debris in the forebay and the mechanisms for moving the debris from the NTSI20021010-REP, REV. 0 PAGE 4 OF 51

forebay to the EDG coolers via the ESW system. This task also considers how the debris that reaches the EDG coolers could collect there and cause degraded ESW flows to these coolers. Finally, this task considers the operators' responses to the initiating event with the complications introduced by debris in the ESW system. The results of this task are the conditional probabilities for the occurrence of one, two, three, and four EDG failures following the assumed LOOP or DLOOP initiating event. These results are called conditional failure probabilities because they represent the probability that one or more EDGs will fail due to conditions resulting from the LOOP initiating event. A decomposition event tree (DET) is constructed to trace the possible sequences of events for each LOOP event. The DET starts from the initiating event and assigns probabilities at each success/failure branch in the DET. The assumed initiating event is assigned a probability of 1.0 in the DET since the values calculated for the end states of the DET are the EDG failure probabilities given the occurrence of the initiating event. These conditional EDG failure probabilities are then used as an input to the second task in this report.

The second task in this report uses the conditional EDG failure probabilities from the first task as inputs to the D. C. Cook Probabilistic Risk Assessment (PRA) model. This task involves modifying the EDG fault trees in the full PRA model to include the additional failure mode that is caused by degraded ESW flow to the EDGs due to the failed Unit 1 East ESW strainer. To accomplish this task, new basic events corresponding to the various EDG failure combinations are added to each EDG fault tree. These new basic events correspond to failures of one, two, three, and all four EDGs. The values for these basic events are the conditional failure probabilities obtained from the first task. The modified PRA model including the revised EDG fault trees is then recalculated to obtain new CDF and LERF values. The increase in CDF and LERF is obtained by subtracting the base values from the revised values.

Background

The Event On August 29, 2001, with Unit 1 cooled to Mode 5 to perform corrective maintenance and Unit 2 operating in Mode 1, ESW flow to multiple components was found below minimum design values. ESW flow to coolers on all four EDGs was impacted. Due to potential loss of function of both EDGs, Technical Specification (TIS) 3.0.3 for Unit 2 was entered at 22:55 hours.1 Cycling of ESW supply valves to the EDG coolers was successful in restoring flow to acceptable levels, indicating that the low flow was likely caused by debris accumulation within the ESW system. Although the T/S 3.0.3 action statement was exited at 23:47 hours, a conservative decision was made to remove Unit 2 from service and not restart either unit until the causes of the event could be understood and appropriate corrective actions taken. The EDGs were not running at the time of the event, nor were they called upon to auto-start during the troubleshooting period and subsequent Unit 2 shutdown.

Initial Investigations Investigations (Ref. 1, 11) determined that the reduced ESW flow to the EDGs was due to oversize debris entering the ESW system (Figure 6) through a previously failed strainer basket on the Unit 1 East ESW pump discharge. With the exception of the EDG coolers, 1 It was later determined that T/S 3.8.1.1.e should have been entered instead of TlS 3.0.3. All actions necessary for either T/S were completed (Ref. 41).

NTS-2002-010-REP, REV. 0 PAGE 5 OF 51

the single-failure proof design of the ESW system prevented adverse effects on redundant trains of safety equipment. However, an original plant design feature intended to enhance EDG reliability allowed each EDG cooler string to be fed from either ESW header. The alternate supply valves were typically open during normal operation, but even if closed, would have automatically opened upon starting an EDG, The potential for debris bypass was not considered in the original failure mode analysis for the system. In the plant's operating configuration during the August 2001 event, a portion of the ESW flow to each of the four EDGs was supplied by the Unit 1 East ESW pump, which resulted in debris entering all four EDG cooler strings.

While the strainer basket damage was determined to have existed for some time, this was the first identified instance in which oversize debris intrusion actually impacted system performance, which indicated that the amount of debris bypassing the failed strainer was unusually high during the August 2001 event.

Corrective Actions All of the Unit 1 and Unit 2 ESW strainers were inspected and their associated baskets were replaced with baskets having stronger bracket support welds. Non-destructive examinations of the replacement baskets were performed to ensure that critical parameters and welds were satisfactory. The maintenance procedure for the ESW strainers was revised to ensure that the strainers are properly assembled and installed.

Operating procedures were revised to provide enhanced monitoring of ESW system performance. CW pump discharge valve refurbishment was initiated.

Susceptible heat exchangers and piping were inspected for debris deposits and were cleaned and/or flushed. ESW flow to system components was verified to be adequate.

Operation of the alternate ESW supply to the EDG coolers was modified. The alternate supply valves will generally remain closed; a design change to eliminate automatic opening following an EDG auto-start was implemented.

Subsequent Investigations The EDGs were not running nor were they required to auto-start during the August 2001 debris intrusion event. However, the severity of the flow reduction raised questions about the ability of the EDGs to perform their function had they been called upon. Additionally, it became apparent that some conditions present during the actual event are likely to be created as a result of a postulated loss-of-offsite-power (LOOP) event, 2 during which the EDGs would obviously be required to operate. Consequently, AEP embarked on additional studies to help understand the level of risk associated with the original system design and the undetected strainer failure. The studies included the following key analyses and evaluations:

"* Debris entrainment and transport evaluation (Ref. 3)

"* Screenhouse flow evaluation (Ref. 4)

"* Seismic event impact (Ref. 5) 2 For example, CW pumps would trip with their discharge motor-operated valves open, setting up the potential for a debris cloud caused by reverse flow through the CW pumps. Also, depending on which electrical buses were involved inthe LOOP, a cross flow inthe screenhouse might be present. These and other transient conditions are discussed later in this report.

NTS-2002-010O-REP, REV. 0 PAGE 6 OF 51

0 EDG cooler hydraulic analysis (Ref. 6)

"* EDG cooler heat load evaluation (Ref. 7)

"* EDG temperature limit evaluation (Ref. 8)

"* EDG heat exchanger performance (Ref. 9)

"* Operator action evaluation (Ref. 13)

Probabilistic Analysis of Events Leading to the Lo~ss of an EDG Results of the above deterministic studies indicate that the EDGs would have performed their function even with the degraded flow experienced in August 2001 and suggest that the debris conditions existing during the August event would envelope conditions existing under hypothetical LOOP events. However, due to uncertainties attendant in all deterministic analyses, it is possible that one or more EDGs could have failed during a hypothetical LOOP event in the period that the damaged strainer basket was installed.

The possibility of an EDG failure due to ESW debris intrusion during a LOOP event has been investigated using Probabilistic Risk Assessment (PRA) techniques. Events necessary for such a loss of an EDG are depicted in Figure 3 and discussed in the following sections. Block numbers referred to in the section and subsection titles correspond to the sequence steps in Figures 3, 4, and 5. Estimates of the probability of occurrence for each block in the sequence are also provided below. Since the probability of occurrence for some events depends on flow patterns in the screenhouse, which are themselves a function of the type of LOOP event (i.e., one or both units affected), separate event probabilities for single-unit LOOP and dual-unit LOOP initiators are provided where appropriate. The conditional probability for the consequential failure of each EDG for both types of LOOP events is also determined.

The results of the conditional probability analysis are then used as input to additional PRA analyses using the full Cook Plant PRA model to determine the impact of the postulated failure mechanism for single-unit and dual-unit LOOP events.

Event Probability Where possible, event probability values used in this analysis reflect Cook Plant PRA data or are determined based on historical plant operating states during the period of vulnerability. In cases where the event is unique to this investigation, the results of various analyses and evaluations are used to subjectively determine the relative probability of an event happening. In the latter cases, Table 1 is used to assign a probability value based on the relative probability of occurrence.

The subjective probability values and their corresponding characterizations shown in Table 1 represent a hybrid approach that combines elements of a normal probability distribution function with a rating scale (e.g., the Sherman Kent Rating Scale). Both of these approaches are discussed in NUREG/CR-5424, "Eliciting and Analyzing Expert Judgement: A Practical Guide" (Ref. 18). It is recognized that the values chosen for use in the "Assigned Probability" column are discretionary, but they arejudged to be reasonable.

NTS-2002-010-REP, REV. 0 PAGE 7 OF 51

Table 1 - Subjective Probability Scale Relative chance of an Assigned probability event happening "Certain" to happen 0.99 Highly likely to happen 0.95 Likely to happen 0.90 No bias in either direction 0.50 Unlikely to happen 0.10 Highly unlikely to happen 0.05 "Certain" not to happen 0.01 Block 1: Loss of off-site power occurs For this portion of the analysis, the LOOP event is a given. Thus, the probability of a LOOP event is taken as 1.0. Separate scenarios were evaluated for LOOP events affecting one unit or both units. The use of the value of 1.0 for the single-unit and dual-unit LOOP initiating event frequencies assures that the result of this part of the analysis is the conditional failure probability of an EDG, given the occurrence of a single-unit or dual-unit LOOP event.

The ESW system response to a LOOP event affecting one or both units is as follows.

Upon initiation of a dual-unit LOOP, all ESW pumps would receive a load-shed signal and would sequence onto their EDGs automatically. During a single-unit LOOP, the LOOP affected unit's ESW pumps would sequence onto their respective EDG automatically. The ESW pumps in the unaffected unit would start on low ESW header pressure unless they were already running. Therefore, both the single-unit and dual-unit LOOP would result in all four ESW pumps running. Consequently, the Unit 1 East ESW pump is expected to start during any LOOP and the failed basket in the Unit 1 East ESW strainer is a potential mechanism for debris ingestion. Since the Unit 1 East ESW header is cross-tied to the Unit 2 West ESW header and each EDG in both units could receive flow from either ESW header, the potential for impacting any or all of the EDGs was present during the time that the failed strainer was installed.

Block 2: Suspended debris is sufficient to challenge ESW system Implicit in the design and operation of the Cook Plant raw water systems is the presumption that the quantity of debris present at any given time is more than sufficient to challenge downstream components if the debris could reach them. To prevent this from happening, raw water entering the plant is cleaned by trash racks and traveling water screens (T-IWS) before being fed to piped systems. In addition, the water to key cooling systems is strained before use. Breakdown of this latter barrier, specifically failure of the Unit 1 East ESW strainer, created the potential to feed oversize debris into the ESW system.

The Unit 1 East ESW strainer failure existed for an extended period of time without causing noticeable effects on the flow passing capability of the EDG coolers. This observation indicates that the remaining barriers (i.e., trash racks and TWS) are adequate NTS-2002-010-REP, REV. 0 PAGE 8 OF 51

to protect against ESW debris intrusion under nearly all conditions. For debris to challenge the ESW system, it is necessary for the right type of debris to be present in sufficient quantities and for it to become suspended in the water of the forebay near the inlet of the ESW pumps. Suspension of debris near the ESW pump bays could occur in two ways:

"* Entrainment in the incoming CW flow

"* Agitation of debris piles already resident in the screenhouse Each of these two ways to suspend debris near the ESW pump bays is decomposed into various contributing mechanisms that are assessed individually in the following paragraphs. Also discussed is the likelihood that debris present at the time of a LOOP event is of the right type and quantity to result in a challenge to plant systems. For convenience, the logical combination of conditions that can lead to challenging the ESW system is illustrated in Figure 4, with constituent blocks designated 2a through 2i. These block numbers are included in the following subsection headings to promote clarity.

Incoming CW has abnormally high debris loading Wind and wave action, seismic action, intake tunnel configuration changes, and biocide treatment of zebra mussels all may affect debris loading in the incoming CW flow. During the period that the failed Unit 1 East ESW strainer may have been in service, the quantity and size distribution of incoming debris was never sufficient to seriously challenge the ability of the ESW system to cope. 3 However, the various factors are evaluated for frequency of occurrence to predict a conservative estimate of the probability that., by itself, the amount of debris entrained in the incoming CW could challenge the ESW system.

Wind and wave action (Block 2a)

Development of waves of sufficient magnitude to agitate the lake bottom and suspend large quantities of debris depends on complex interaction of a variety of factors, including wind speed, wind direction, wind duration, water depth, and seasonal lake bottom characteristics. Although a direct correlation between wind speed and lake agitation could not be located, experience and judgement suggest that hourly average wind speeds during violent storms that create rough lake conditions are typically greater than 15 mph.

For simplicity, significant debris entrainment in the incoming lake water is assumed to occur any time the local wind speed is over 15 mph. Based on review of meteorological data (from input to Ref. 23) from the Cook Plant meteorological tower for the years of 1995, 1996, and 1997, hourly average wind speeds greater than 15 mph occurred 267 hours0.00309 days <br />0.0742 hours <br />4.414683e-4 weeks <br />1.015935e-4 months <br /> out of a total of 26,231 recorded hours. Since significant climatic changes have not occurred in recent years, data from 1995, 1996, and 1997 is considered representative of the period in which the damaged Unit 1 East strainer basket was installed. The probability of occurrence for wind speeds greater than 15 mph would be 267/26,231 = 0.0102.

However, since the occurrence of LOOP events and high winds are not necessarily independent, i.e., a LOOP can be caused by high winds, the incidence of wind-initiated LOOP events was investigated. Reference 21 provides industry data on causes of LOOP events. These data indicate that one of the single-unit LOOP events, or 4% of the total, was caused by high winds. One of four, or 25%, of dual-unit LOOP events was the result of high winds. Although wind speed is not reported in Reference 21, it seems likely that 3 In August 1996, sand and silt intrusion created problems with ESW instrument lines and caused frequent strainer backwash cycles. This event involved the Unit 2 East ESW pump only (Ref. 12).

NTS-2002-010I-RE P, REV. 0 PAGE 9 OF 51

wind speed was greater than 15 mph during those events. Since the industry data for single-unit LOOP events suggests a higher event frequency than the plant-specific wind data would suggest, the probability of wind and wave action is taken as 0.04 for single-unit LOOP events. For the dual-unit LOOP event, Reference 22 indicates that the event in question actually caused a degraded grid voltage, not an actual offsite power loss. In this case, the reported voltage degradation was small and would not have caused a unit trip or initiated an EDG auto-start at Cook Plant with the relay settings that existed during the time period of this analysis. As a result, dual-unit LOOP events and high winds are considered to be independent events. Thus, the probability of wind and wave action being sufficient to generate high debris loading at the time of a dual-unit LOOP event is taken as the plant-specific value of 0.0102.

Seismic action (Block 2b)

A direct correlation could not be found between the peak ground acceleration experienced during a seismic event and the debris loading that would be generated in the lake.

However, Reference 5 determined that a design basis earthquake (DBE) might result in disturbances of debris piles in the screenhouse. To be conservative, an operating basis earthquake (OBE), with an acceleration of 0.1 g vice 0.2 g for a DBE, is also assumed to generate suspended debris in the lake. Consequently, debris caused by seismic events will be given the same probability as an OBE at Cook Plant. Based on Ref. 17, the probability of an operating basis earthquake at Cook Plant is approximately 0.0002.

Intake tunnel configuration changes (Block 2c_)

Whenever the center intake tunnel is in use as an outlet to promote intake deicing, debris piles may accumulate in the vicinity of the CW tunnel intake shutoff valve, WMO-30.

When the center intake tunnel is subsequently returned to intake service by opening WMO-30, the accumulated debris is fed into the screenhouse. This alignment change typically occurs only once a year and is performed gradually so that the impact of debris transported to downstream components is minimized. However, if the valve is repositioned quickly, which it was at least once in recent history, the debris effect is noticeable and may be ongoing for up to three days. It is conservatively assumed that the valve is opened quickly so the probability of high debris loading caused by the transition from deicing mode to normal mode would be 3/365 = 0.0082.

Biocide treatment of zebra mussels (Block 2d)

Biocide treatment to kill zebra mussels in the intake tunnels results in dead mussels sloughing off the tunnel walls and being transported to the screenhouse. Treatments were typically performed annually. Previous plant experience indicates that higher-than-normal ingress of dead mussel shells may occur for up to two weeks after each treatment. The probability of high debris loading from biocide treatments would be 14/365 = 0.0384.

Debris characteristics (Block 2e)

The vast majority of debris generated by wind and wave action would settle out or be caught on the TWS prior to reaching the ESW pump bays. Debris that did not settle would generally be small particles that are very unlikely to cause flow restrictions. Debris generated by seismic action, intake tunnel configuration changes, or biocide treatment of zebra mussels is likely to be predominately zebra mussel shells. The TWS may allow some carryover of oversize pieces, but the amount of suspended debris downstream of the traveling water screens as a function of the incoming CW flow is likely to be very small.

Prior to the LOOP event, particles that did pass the screens would be preferentially swept NTS-2002-010-REP, REV. 0 PAGE 10 OF 51

into the CW pumps or would deposit in the low velocity area in front of the ESW pump bays. Thus, the likelihood of challenging the ESW pumps by the amount of debris entering the screenhouse in real time (i.e., without first being deposited in low flow areas and then re-entrained as a result of flow pattern changes) is considered very unlikely.

Accordingly, the probability of occurrence is selected as 0.05 from Table 1.

Probability of occurrence The probability of debris loading in the incoming CW being abnormally high may be estimated as the probability of Block 2e multiplied by the sum of the individual probabilities for Blocks 2a, 2b, 2c, and 2d. The latter sum is a conservative representation of the real situation, since the above conditions are not independent and may overlap in time; the sum cannot exceed 1.0. The resulting probability values for dual-unit and single-unit LOOP events are 0.0029 and 0.0043, respectively.

Flow transients suspend debris in forebay The potential to suspend debris already resident in the screenhouse during a LOOP event comes from three possible effects:4

• The water inflow needed to restore the drawn down screenhouse level to lake level following the cessation of CW flow might agitate the forebay, with the potential to entrain previously deposited sand, shells, and other debris.

• Tripping of CW pumps might result in a debris cloud due to water draining back into the forebay from the condenser (Figure 1).

• If only one unit's CW system trips, a cross flow sufficient to entrain debris may develop in front of the ESW pump bays as water is drawn from the tripped unit towards the operating unit (Figure 2).

Water inflow to refill screenhouse following trip of CW pumps (Block 2f)

During normal operation with both units in service, about 1.6-million gpm is supplied through the screenhouse to the CW water pumps. With all seven CW pumps operating, the screenhouse water level is drawn down about seven to ten feet due to friction losses in the inlet tunnels. At the instant the CW pumps trip as a result of a LOOP event, water is still entering and flowing through the screenhouse at a rate of 1.6-million gpm. A dual-unit LOOP provides the bounding conditions for causing debris in the forebay to be elevated because the largest forebay refill volume occurs for this case. The dual-unit LOOP causes all seven CW pumps to trip. Although some CW system flow may continue due to the momentum of the water already in motion, most of the incoming water will stay in the screenhouse, where it serves to increase the water level. An attendant effect is to add a temporary vertical velocity component to the flow patterns in the screenhouse.

Under normal flow conditions, the horizontal velocity component at the pump inlets is about 1.5 fps, as shown in Figures 28 and 29 of the June 1970 Alden Research

' Seismic action might also be included as a screenhouse transient since DBE conditions were determined to possibly result in minor shifting of debris deposits in the screenhouse (Ref. 5). However, as determined in earlier discussions, the probability of an OBE is only 0.0002. The probability of a DBE is considered negligible for purposes of this evaluation.

N S-2002-01O-REP, REV. 0 PAGE 11 OF 51

Laboratories (ARL) screenhouse flow model study (Ref. 24) . The horizontal velocity component in the direction of the CW pump suctions will be generally redirected in other horizontal directions as CW pump flow stops.

As the screenhouse level increases, the incoming flow rate will decrease as the static head difference between the lake and the screenhouse is reduced. The momentum of the water in the intake tunnels may cause the screenhouse level to temporarily rise above the lake level, resulting in a level oscillation until equilibrium is reached. The effect on debris entrainment due to oscillation is considered negligible, since this phenomenon isjudged to occur relatively slowly.

Evaluations (Ref. 3) determined that the approximate vertical velocity component needed to entrain sand and mussel shells (before being broken in the ESW pumps) is 0.15 fps and 0.30 fps, respectively. For a dual-unit LOOP event, in which all seven CW pumps trip, the vertical component of velocity involved in restoring the screenhouse water level can be estimated as follows.

Assumptions/inputs:

"* Screenhouse level is initially drawn down dfeet from lake level; the typical draw down with all seven CW pumps operating is about 7 to 10 ft.

"* The nominal surface area of the water in the screen house is about 200 ft x 100 ft (Ref. 25, 26, 27, 28), or about 20,000 sq. ft.

"* Refilling occurs at a maximum flow rate equal to initial CW flow rate, which is 1.6 million gpm or about 3565 cfs.

At the maximum inflow rate, the time in seconds necessary to restore screenhouse level to lake level would be d ftcx 3565 0,000sq.ft.

cu. ft./sec The maximum vertical velocity component under these conditions would be d ft. or (dft.x 20,000 sq. ft.) /3565 cu. ft./sec or about 0.18 fps. The average vertical velocity during the transient would be lower since the inflow rate would decay with time.

Consequently, under screenhouse refill conditions following trip of all seven CW pumps, it is unlikely that debris other than small sand particles would be entrained in the screenhouse water. Accordingly, the probability of suspending substantial amounts of large debris due to refilling the screenhouse following a dual-unit LOOP is selected as 0.10, as suggested by Table 1.

For a single unit LOOP, only three or four pumps would be tripped and the effect would be even less. Under these conditions, the chance of suspending debris other than small sand particles is considered highly unlikely. Accordingly, the probability is selected from Table 1 as 0.05.

5 Figure 3 of MPR calculation 025-103-EB1 (Ref. 4) shows a higher velocity in the vicinity of CW pump 12; this anomaly was noted during the calculation preparation but was not fully resolved since the model was used more qualitatively than quantitatively. The magnitude of values in the ARL report (Ref. 24) is considered correct.

NTS-2002-O10-REP, REV. 0 PAGE 12 OF 51

Reverse flow from CW pump (Block 2g)

During the August 2001 event and other previous events in which CW pumps were observed to rotate backwards, other CW pumps were still in service when a pump was stopped with its discharge valve partially open. In those cases, the flow path through the idle pump was in parallel with the flow path through the condenser, so the operating pump(s) ensured that some reverse flow would occur. However, in a single-unit or dual unit LOOP, all operating CW pumps on a unit will trip simultaneously with their motor operated discharge valves open, leaving no pressure source to ensure reverse flow.

Since both ends of the CW system are submerged in the lake, the siphon in the CW flow path through the condensers has to be broken in order to achieve substantial reverse flow under a LOOP scenario. Breaking the siphon would allow the static head in the condenser water box and the CW piping to drain the water back into the forebay. While this could occur if a sufficient amount of air enters the condenser water boxes, there is no normal pathway for such air ingestion. Consequently, it is unlikely that rapid draining would occur.

A likely system response would be for the forward flow of CW to continue briefly due to the momentum of the fluid already in motion. Water would continue to be drawn in through the idle pumps and their open discharge valves to support the siphon flow during this interval. As the momentum dissipates, the flow would gradually stop with the system still filled. At that time, if a hydraulic gradient still existed between the discharge vault and the forebay, a slight siphon flow towards the screenhouse would occur. By engineering judgement, this flow would be insignificant in terms of agitating debris in the forebay. If the discharge vault and forebay were at the same level, the piping and condenser would remain full with no flow in either direction. With no flow, heating of the water trapped in the condenser tubes might occur, in which case a vapor space would form, forcing a minor amount of flow out both ends of the system. Again, this minor flow is judged insignificant in terms of agitating debris in the forebay. The system should remain stable in this condition for an extended time.

Overall, the chance of having significant reverse flow that suspends debris in the vicinity of the CW pumps is judged highly unlikely, and is accordingly assigned a probability of 0.05 as suggested by Table 1. This probability would be the same for both dual-unit and single-unit LOOP events.

Cross flow in front of ESW pump bays (Block 2h)

In the event of a dual-unit LOOP, all CW flow ceases and there is no mechanism for cross flow to occur. In this case, cross flow is considered certain not to happen and is assigned a probability of 0.01 in accordance with Table 1.

In the event of a single-unit LOOP, one unit's CW pumps will trip while the other unit's pumps continue to operate. The configuration of the screenhouse ensures that cross flow in front of the ESW pump bays develops in the direction of the operating unit's CW pumps.

In this case, cross flow is considered certain to happen and is assigned a probability of 0.99 in accordance with Table 1.

Debris type, quantity, and location (Block 2i)

Residual debris removed from ESW system components following the August 2001 event was predominately comprised of small zebra mussel shells and shell fragments. Although sand and other small debris likely played a role in the formation of flow restrictions in the NTS-2002-010-REP, REV. 0 PAGE 13 OF 51

EDG coolers, sand by itself would not have caused the August 2001 event. Other types of debris, specifically organic matter such as leaves and algae, may challenge TWS performance at times, but because of its nearly neutral buoyancy, does not tend to accumulate in low flow areas of the screenhouse. Consequently, an accumulation of zebra mussel shells downstream of the TWS is considered necessary before screenhouse flow transients become a concern with regard to transporting debris to the ESW pumps.

Some live mussel larva may attach themselves to screenhouse structural components downstream of the TWS and spend their life cycle there, but the bulk of mussel shells downstream of the TWS result from carryover from or passage through the TWS. While some deposited zebra mussel shells are likely to be present at any given time, the accumulations downstream of the TWS at the time of the August 2001 event were almost certainly larger than at any time during plant history. Two factors account for this.

" A zebra mussel biocide treatment was conducted on July 1 and 2, 2001. Both units remained at power from that time until the shutdown of Unit 1 on August 29, 2001, so no screenhouse transients, e.g., significant cross flow, which would have removed piles of dead mussel shells prior to the event, had occurred.

" The biocide treatment was performed mid-way through the summer growing season.

A second treatment had been planned for late September 2001, but was cancelled after the August experience. Prior to 1999, treatments had been performed once a year only, typically in September or October at the end of the growing season. With annual treatments, mussels grow to a size of 1/2-inch to one-inch in length and do not easily pass through the 3/8-inch screen mesh of the TWS. Mid-season biocide applications result in smaller killed mussels, which can more easily pass through the mesh of the TWS and accumulate in low flow areas downstream of the -1WS, particularly at the edges of and in front of the ESW pump bays. As corroboration, some shell halves of a size that could get through the mesh of the TWS were removed from components served by the Unit 1 East/Unit 2 West ESW header following the August 2001 event (Ref. 11). Partial biocide treatments were performed in July 1999, when both units were in an extended shutdown, and June 2000, with only Unit 2 in service. Neither unit operated for nearly a year following the July 1999 treatment, so there was no opportunity to observe the debris impact. Only Unit 2 operated for about six months following the June 2000 treatment, so there would have been a constant cross flow to prevent shell deposition in front of the ESW pump bays.

The above discussion suggests that the debris conditions in the screenhouse during August 2001 were unique in plant operating history. Consequently, the presence of a sufficient quantity of the right type of debris in the right location to result in the August 2001 event is considered unlikely over the period that the damaged Unit 1 East ESW strainer was installed. Accordingly, the probability of occurrence is selected as 0.10, as suggested by Table 1.

Probability of occurrence The probability that flow transients during a LOOP event suspend sufficient debris in the forebay may be estimated as the probability of Block 2i multiplied by the sum of the individual probabilities for Blocks 2f, 2g, and 2h. The latter sum cannot exceed a total of 0.99. Of course, this value is a conservative representation of the real situation, since the above conditions are not mutually exclusive. For a dual-unit LOOP event, the probability of occurrence using this approach is 0.0160. The corresponding probability for a single unit LOOP is 0.0990.

NTS-2002-01O-REP, REV. 0 PAGE 14 OF 51

Summary of probability of occurrence (Block 2)

The probability of occurrence for Block 2 may be estimated as the sum of the probability of debris being present in the incoming CW and the probability of screenhouse flow transients causing debris to go into suspension, not to exceed a total of 0.99. This value is a conservative representation of the real situation, since the two conditions are not mutually exclusive.

For a dual-unit LOOP event, the probability that sufficient debris is in suspension to represent a threat to the ESW system is 0.0029 + 0.0160 = 0.0189. Using the same approach, the probability for a single-unit LOOP event is 0.0043 + 0.0990 = 0.1033.

Block 3: Suspended debris reaches the Unit I East ESW pump Given that sufficient debris is suspended in the water of the forebay and the Unit 1 East ESW pump is in operation, it is nearly certain that at least some of the debris will reach the Unit 1 East ESW pump suction and be ingested. Accordingly, for purposes of this study, the probability that suspended debris reaches the ESW pump suctions will be taken as 0.99, as suggested by Table 1, for both dual-unit and single-unit LOOP events.

Block 4: Failed strainer basket in service during the LOOP event The ESW system strainers are of the duplex type, each consisting of two separate strainer baskets. The Unit 1 East ESW strainer had one damaged basket and one undamaged basket. For the purposes of Block 4, the likelihood that either the failed strainer basket is in service at the start of the assumed LOOP event or would be switched into service during the event must be assessed. The logical combination of conditions that can lead to the failed strainer basket being in sei-vice during a LOOP event is shown ir the lower portion of Figure 5.

Failed strainer basket in service at the time of the LOOP event (Block 4a)

Either strainer basket has an equal chance of being in service at the time of the event.

From Table 1, the probability (P 4a) of the failed strainer basket being in service is taken as 0.50 for both dual-unit and single-unit LOOP events.

Failed strainer basket switched into service during the LOOP event The strainer baskets automatically switch on high differential pressure or on a time basis of once per 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> (Ref. 37, 38, 39, 40) to allow backwashing. Thus, if the intact strainer is in service at the time of the LOOP event, there is a possibility that it would be switched to the failed strainer during the course of the event, either by the timer or by high differential pressure.

Strainer basket switch due to timer (Block 4b)

The time period of interest for a dual-unit LOOP event is at most one hour (Ref. 3) because once the initial screenhouse transient is over, there is no continued mechanism to feed debris to the ESW system. If the timer cycle had less than one hour left at the time of the LOOP, the failed basket would be put in service while debris might still be ingested.

Thus, the probability (P4b) of switching to the failed strainer during the course of a dual-unit LOOP event would be 1/24, or 0.0417.

NTS-2002-010-REP, REV. 0 PAGE 15 OF 51

The period of interest for a single-unit LOOP event is longer because of the continuing nature of cross flow entrainment of debris, but can be limited to the time it takes to cool down to Mode 5. This period is conservatively estimated at 16 hours1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br /> assuming a cooldown rate of 250F/hour with two hours of hold time for various procedure transitions.

Thus, if the timer cycle had less than 16 hours1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br /> left at the time of the LOOP, the failed basket would be placed into service while debris might still be ingested. Thus, the probability of switching to the failed strainer basket during the course of a single-unit LOOP event would be 16/24, or 0.6667.

Strainer basket switch due to high differential pressure (Block 4c)

Strainer basket switching due to high differential pressure does not typically occur at Cook Plant, even during periods of high debris loading. The sand intrusion incident in 1996 (Ref. 12) is one exception. During the August 2001 event, there is anecdotal information that at least one strainer switch occurred during the course of the event. Whether this was due to elapsed time or differential pressure is not known with certainty. Since there is no evidence to support a preference one way or the other, the probability (P4 ) of switching from the intact basket to the failed basket due to high differential pressure during the course of a LOOP event was taken as 0.50 for both dual-unit and single-unit LOOP events.

Probability of occurrence The probability of the failed basket being in service during the event is the sum of the probability that it is in service at the time of the event and the probability that it is switched into service during the event. Using the variables introduced in the text above, this probability value can be found by the relationship P 4a + (1-P 4J(P 4b+P4C), not to exceed a total of 1.0. Using the values determined above, the probability that the failed basket is in service at any time during a dual-unit or single-unit LOOP event is 0.7708 and 1.0, respectively.

Block 5B: Flow through ESW strainer is high An ESW pump flow rate is considered "high" for purposes of this evaluation if it results in sufficient vertical velocity in the strainer body to overcome the settling velocity of the particles, thereby allowing them to flow upward to the gap area. A simple evaluation using flow continuity principles and the expected settling velocity of various size and shape particles (using the approach provided in Ref. 3) shows that the average upward vertical velocity in the strainer housing equals the expected settling velocity at about 6000 gpm.

For conservatism, a value of 5000 gpm is selected as the threshold for "high" flow. Flows at this level or above could occur during:

"* Design basis accident response

"* Surveillance testing

"* Unit cooldown

" Operation when lake temperature is near its upper limit The logical combination of conditions that can lead to high ESW flow is shown in the upper portion of Figure 5.

NTS-2002-010-REP, REV. 0 PAGE 16 OF 51

High ESW pump flow during design basis accidents (Block 5a)

The probability (P5a) of occurrence of a design basis accident that would require high ESW flow is extremely low and is considered negligible for purposes of this evaluation.

High ESW pump flow during surveillance testing (Block 5b)

Surveillance testing to perform ESW flow balancing is performed with the unit cross-ties closed so there is no jeopardy of the Unit 1 East ESW pump/strainer supplying debris to the Unit 2 EDG coolers under these conditions. This testing has historically been performed in Mode 5, so there is no at-power consequence for Unit 1 if the Unit 1 East ESW pump/strainer supplies debris to the Unit 1 EDG coolers. Surveillance testing during power operation is limited to quarterly ESW pump runs to confirm that IST limits are met.

The testing frequency may be increased from quarterly to monthly if a pump's performance is in the IST alert range, which is conservatively assumed to be the case for the Unit 1 East ESW pump. The period of high ESW flow during a typical IST run is less than three hours. Thus, the probability (P5b) of being in a high flow condition on the Unit 1 East ESW pump/strainer due to at-power testing is (12 x 3)/8760, or 0.0041.

High ESW flow during unit cooldown (Block 5c)

ESW flow to a CCW heat exchanger may be "high" during the RHR portion of a unit cooldown, which is conservatively estimated to be about 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> for each typical cooldown. Using the plant transient logs, it was determined that since 1989 wher. the strainer basket was last known to be positioned correctly, Unit 1 has undergone 12 cooldowns and Unit 2 has undergone 19 cooldowns. Because both units were shut down from late 1997 through most of 2000, the evaluation period is taken as nine rather than 12 years. Thus, the probability (P5,) of either unit being ;n a cooldown can be estimated by (19 + 12) events x 12 hrs/event

= 0.0047.

9 yrsx 8760 hrs/yr Unit cooldown(s) would also be entered following a LOOP event, but the cooldown rate would be limited to 25 0F/hour due to the concurrent loss of reactor coolant pumps. Under these conditions, high ESW flow to CCW would not be necessary except in periods when lake temperature was also high. Operation during periods of high lake temperature is included in the next section dealing with normal operation.

High ESW flow during operation at high lake temperature (Block 5d)

Based on discussions with Operations personnel and application of engineering judgement, "high" ESW flow in the range of 5000 gpm during normal operation is conservatively not required unless lake temperature is above 70 0 F. Review of lake temperature data for the years 1989 through 1997 indicates that this threshold was reached or exceeded on 461 days during the nine-year period. Thus, the probability (P5d) of requiring high ESW flow during normal operation is found by dividing 461 days by the number of days in the period, which yields a value of 0.1402. This period also bounds the slow unit cooldown(s) that would follow a LOOP event.

NTS-2002-010-REP, REV. 0 PAGE 17 OF 51

Probability of occurrence Using the variables introduced in the text above, the probability (P5B) of debris passing the failed Unit 1 East ESW strainer basket if it is in service following a LOOP event is found by the relationship P5B = Psa + P 5 b+ P5 C+ P5d, which results in a probability value of 0.1490.

The probability of low flow through the Unit 1 East ESW pump is 1.0 - P51, or 0.8510.

This corresponds to Block 5A in Figure 3.

Block 6: Ingested debris bypasses Unit 1 East ESW strainer During the August 2001 event, the pump was operating at about 7000 gpm. Although this is well below the design flow, it is substantially higher than typical flow rates, which are on the order of 3000 gpm. By engineering judgement, high ESW pump flow rates do not noticeably affect the concentration of debris (solids/water) ingested by the pump since the velocity profile around the pump suction is modest even at the full design flow. However, at a given concentration of debris in the forebay, high ESW flow rates increase the total mass of solids ingested into the system and will adversely affect strainer effectiveness, as described below.

After being ingested into the Unit 1 East ESW pump, debris will flow into the housing of the Unit 1 East ESW strainer. The strainer has two baskets, one that was intact over the plant's history and one that was damaged, i.e., had an approximately 3-inch gap at the top of the basket that allowed flow to bypass the basket screen material. The bypass area in the damaged basket represented about 10 to 12% of the total screen open area and was estimated to pass about 20% of the total water flow when the screen material was clean.

For purposes of this report, "low" ESW flow is considered to result in a vertical velocity ir the strainer housing that is insufficient to overcome the settling velocity of the debris in the incoming ESW flow (see discussion for Block 5B). Consequently, if the damaged strainer basket is in service when ESW pump flow is low, debris entering the strainer is much more likely to settle in the strainer housing or be collected on the strainer basket as intended, rather than being carried up and over the gap at the top of the basket. On this basis, at low flow rates, the debris carryover through the gap is judged to be significantly less than its flow-proportionate 20% of the total debris entering the strainer housing, and is likely not to occur at all. However, at high flow rates with a clean strainer basket, the settling characteristics become less important and the debris carryover would approach a flow proportionate 20% of the total debris. With a less-than-clean strainer basket, the situation is exacerbated. At high flow rates with debris-laden water, the resistance factor of the basket screen increases in relation to the gap area as debris accumulates on the screen, resulting in a larger proportion of the total flow bypassing the basket screen.

In summary, based on plant experience, at low flow rates the failed Unit 1 East ESW strainer is likely to be effective in removing enough debris to protect downstream equipment. Accordingly, the probability (P6A) of passing sufficient debris to challenge downstream equipment with "low" ESW flow through the Unit 1 East ESW strainer is taken as 0.10, as suggested by Table 1. At "high" ESW flows, the amount of bypass flow increases and debris carryover is highly likely to be sufficient to challenge downstream components, which suggests a probability (PUB) of 0.95, again from Table 1.

NTS-2002-010-REP, REV. 0 PAGE 18 OF 51

Block 7: Debris reaches the Unit 2 EDG coolers The Cook Plant ESW systems consist of four pumps, two in each unit. The systems are cross-tied between units such that the Unit 1 East ESW pump can feed the West ESW header in Unit 2 and vice versa. Likewise, the Unit 1 West ESW pump can feed the East ESW header in Unit 2 and vice versa. Additionally, the design of the ESW supplies to the EDG coolers includes a flow path for ESW to any EDG from both the Train A and Train B headers in its respective unit. A simplified schematic of the system is included as Figure

6. Prior to the debris intrusion event in August 2001, the ESW system would have aligned automatically at the time of an EDG start to supply ESW to the EDG from both trains. The combination of these two design features made it possible to supply flow from any running ESW pump to any of the four EDGs. At any given time, whether or not the flow from a specific pump could reach a specific EDG depended on the system alignment and ESW demand at that time.

Both the single-unit and dual-unit LOOP result in all four ESW pumps running. This was not the case during the August 2001 debris intrusion event. The dominant factor that carried debris into the Unit 2 West ESW header during that event was the fact that the Unit 2 West ESW pump was not operating.

Unit 1 EDG coolers Very few factors affect the likelihood that the Unit 1 EDG coolers will be supplied by flow from the Unit 1 East ESW pump during a LOOP event. Both the normal and alternate ESW supplies to any EDGs that start would have automatically opened upon reaching running speed. With these supplies open, ESW flow model sensitivity cases (using Ref.

30) indicates that each Unit 1 EDG cooler string will receive a portion of its flow from both ESW headers unless the difference between the ESW header pressures is at least 30 psi.

The pressure difference between headers is almost certain to be less than 30 psi with all four ESW pumps running. Therefore, the coolers for both Unit 1 EDGs will receive some flow from the Unit 1 East ESW pump during a LOOP event for virtually all ESW system alignments and flow conditions. Accordingly, this occurrence is treated as a given condition, i.e., probability of 1.0, in the conditional probability assessment.

Unit 2 EDG coolers The Unit 2 situation is quite different. For the Unit 2 EDG coolers to receive flow from the Unit 1 East ESW pump, flow across the Unit 1 East/Unit 2 West unit cross-tie must be in the direction of Unit 2. Several factors affect the likelihood that this condition will exist. In addition, even if some flow from the Unit 1 East ESW pump does reach the Unit 2 EDG coolers, the total flow across the Unit 1 East/Unit 2 West unit cross-tie must be high enough to provide a flow velocity that can carry debris. The flow rate in the 20-inch diameter cross-tie line needed to provide the minimum transport velocity is 2500 gpm (Ref. 3).

The significant loads on the ESW headers during non-accident conditions are the flows to the in-service CCW heat exchangers and the supplies to the EDG coolers. The ESW flow to the EDG coolers is fairly constant regardless of plant conditions. The flow contribution from an ESW header to a pair of EDGs is also a fairly constant value and is approximately equal from header to header. Flow from an ESW header to a CCW heat exchanger varies seasonally, but is generally less than 2000 gpm except during hot weather periods or during a unit cooldown. During the warmest part of the year, the flow may exceed 2000 NTS-2002-OIO-REP, REV. 0 PAGE 19 OF 51

gpm, but is less than 5000 gpm and is about the same to each unit's in-service CCW heat exchanger.

Because all ESW pumps are operating during a LOOP event, the likelihood of establishing a 2500 gpm flow in the direction of Unit 2 across the Unit 1 East/Unit 2 West cross-tie is low. The only pre-LOOP combination of in-service CCW heat exchangers with the potential for this high cross-tie flow is the Unit 1 West and Unit 2 West CCW heat exchangers, which is one of four system alignments available to Operations. In this case, the only significant load on the Unit 1 East ESW header is the flow to the EDG coolers, while the Unit 2 West ESW header is supplying its EDGs and the Unit 2 West CCW heat exchanger. Upon start of all pumps at the initiation of the LOOP event, flow to the Unit 2 West CCW heat exchanger could potentially increase to a value that would result in a contribution of 2500 gpm from the Unit 1 East ESW header. Such a condition would carry debris to the Unit 2 EDG coolers. In general, a pre-LOOP flow rate of at least 5000 gpm on the Unit 2 West ESW header would be necessary to result in drawing 2500 gpm across the cross-tie during the LOOP event.

The probability that debris passing the failed strainer reaches the Unit 2 EDG coolers is the product of the probability of having flow through the Unit 1 East/Unit 2 West ESW cross-tie in the direction of Unit 2 and the probability of that flow being at least 2500 gpm.

However, the latter probability corresponds to the probability of having "high" ESW flow (0.1490 from Block 5B above). Since this factor has already been accounted for in the logic structure of Figure 3, the value for Block 7 includes only the probability of having the CCW and ESW systems aligned in the susceptible condition. Thus, the probability value is determined to be 1/4 = 0.25 for both dual-unit and single-unit LOOP events.

Block 8: Cooling flow degradation impacts EDG function Postulated mechanism for restricting flow AEP's evaluation of the August 2001 event concluded that the flow reduction in the EDG cooler string was due primarily to an increase in flow resistance in the EDG lube oil coolers. Post-flushing physical inspection of all heat exchangers in the ESW system following the August 2001 event revealed that very few heat exchanger tubes remained blocked by pieces of debris. Additionally, the amount of residual debris found in heat exchangers and system piping was low and the individual pieces were typically very small (Ref. 1). From this it was concluded that the majority of debris in the ESW system during the event was much smaller than the heat exchanger tube openings. This suggests that the flow restriction in the EDG lube oil coolers resulted from a mechanism other than lodging individual pieces of debris in the tubes. Two possibilities were investigated and are discussed below.

Accumulation of debris in EDG lube oil cooler inlet channel heads One postulated mechanism is that the velocity reduction that occurs when the ESW flow enters the heat exchanger is of sufficient magnitude to allow settling of entrained debris particles, which in turn would accumulate at the bottom of the channel head and prevent or restrict flow from entering tubes. As the accumulation grows, more and more tubes are affected and flow continues to decline. This scenario is considered unlikely to be the cause of flow restriction in the EDG lube oil coolers for several reasons.

• Based on comparison to information provided in Reference 3, the horizontal channel head velocity in the lube oil coolers is high enough under typical flow conditions to NTS-2002-010-REP, REV. 0 PAGE 20 OF 51

prevent significant settling in the channel head. Consequently, it is difficult to postulate a reasonable way to initiate a flow restriction of this type.

"Flow restrictions of this type would be physically supported by the channel head and would not rely on differential pressure to be held in place. Thus, cycling the ESW flow supply valves would have little effect on the stability of the blockage and would be unlikely to restore flow. This was not the case during the August 2001 event, in which cycling of the ESW valves and heat exchanger vents one or more times resulted in rapid flow restoration.

"Debris accumulation in the channel head due to particle settling that initiated under normal flow conditions would not likely have been completely cleared away by flushing at the same flow rate under which it developed. Consequently, a larger amount of residual debris would have been anticipated to be present at the time of the post-event inspections.

While this postulated mechanism cannot be precluded since all conditions surrounding the event are not known with certainty, it is not considered to be the predominant mechanism involved in the August 2001 event. Even ifit were to occur, as the flow area in the channel head is reduced due to debris accumulation, the velocity at any given flow would increase and an equilibrium point would be reached where the velocity was sufficient to prevent further debris deposition.

Debris bed formation due to bridging Another postulated mechanism for flow restriction was formation of a debris bed or "cake" on the surface of the tubesheet (Ref 2). Although the individual pieces of entrained debris entering the channel head could generally fit through the tubesheet holes, instead they interacted with each other to bridge over the holes, forming a porous cake. The potential to create and maintain a debris bed ot this type on the tubesheet is dependent on three principal forces:

"* The differential pressure across the debris bed acting perpendicular to the debris bed face area tends to hold the bed in place against the tubesheet.

"* Gravity acting on the individual pieces of the debris bed tends to make the particles fall downward, thus breaking apart the bed. In a larger sense, gravity acts on the cake itself and tries to shear italong its angle of internal friction.

"* Forces created by water flow parallel to the tubesheet surface acting on the projected cross sectional area of the debris bed tend to break the debris bed apart or inhibit its formation.

A debris bed comprised predominately of broken zebra mussel shells and developed under opposing forces resulting from gravity and differential pressure is postulated to have the following characteristics:

" Not uniform over the surface of the tubesheet. There is an element of random behavior in the postulated mechanism for debris bed formation, i.e., the interaction of the debris particles as they try to enter a tube is random - sometimes they will go through and sometimes they will bridge.

"* Not stable over time. As long as there is a source of new debris, additional material will tend to accumulate on an existing debris cake. At the same time, particles already NTS-2002-010-REP, REV. 0 PAGE 21 OF 51

in the cake will tend to separate from the mass and work their way into a tube and flow out of the heat exchanger. As such, material is being added and removed simultaneously, so the bed thickness varies continually, sometimes increasing and sometimes decreasing depending on the relative amounts of material added and removed. It is likely that material leaving the bed creates a dome-shaped void at the face of the tubesheet that then collapses and momentarily clears a portion of the tubesheet.

" Relatively fragile. Upsets or changes in ESW flow or pressure may change the force balance sufficiently for the debris cake to break apart and for the cake material to either drop to the bottom of the channel head or flow through the tubes. This characteristic is supported by the relative ease with which blockages were cleared by operator action; cycling of the ESW supply valves and heat exchanger vents one or more times resulted in rapid flow restoration.

" Stronger in one direction. Although relatively fragile, the debris bed is stronger and more rigid in the direction of the tube axis ("horizontal") than in the vertical direction.

Like an anisotropic soil material that has non-uniformly oriented particles, the shear strength in the two principal directions is different (Ref. 36). Since the cake was formed as a result of flow and force in the horizontal direction, it is logical that its strength is greater in that direction.

"Filtering effect. An established debris bed of zebra mussel shell pieces acts like a filter to trap fine shell particles and sand. Although this tendency increases the flow resistance of the cake, it also makes the cake denser without adding appreciable structural stability in the vertical direction.

These above postulated debris bed characteristics caii be used to qualitatively explain the nature of the flow restriction phenomenon. As the debris bed grows, the differential pressure across it increases due to the greater bed depth. The bed also begins to trap fine shell particles and sand, which further increases the pressure drop as a result of decreased bed porosity. The increased differential pressure increases the force holding the bed in place against the tubesheet. The maximum holding force would occur at the point that flow actually stopped.

However, as the differential pressure increases, several other factors work together to break apart the bed or limit its continuing formation:

" The reduced ESW flow associated with increased flow resistance results in a decrease in the quantity of debris transported to the channel head, not just as a function of the reduced quantity of ESW flow, but also because of the reduced ability to transport material at lower velocity. The relative balance between material added and material removed from the bed shifts in favor of reducing the bed depth.

"* Complete blockage of the flow would require blockage across the entire face of the tubesheet, which is unlikely due to the bed's non-uniform behavior.

" Growth of the debris bed takes time, and due to the unstable nature of the bed over time, it is likely that random fluctuations in bed characteristics would prevent complete blockage from occurring.

" An increase in mass of the debris bed increases the gravitational force that is trying to shear the bed. This effect is particularly important with respect to the mass addition due to sand and fine shell particles, because these add little if any strength in the NTS-2002-01IO-REP, REV. 0 PAGE 22 OF 51

vertical direction, which is the weaker of the two directions due to anisotropy. At some point, the gravitational force will overcome the ability of the bed to resist it, and the debris bed will collapse.

Based on available data and observations, formation of debris beds on the tubesheet surface is judged to be the most likely cause of flow restrictions in the EDG lube oil coolers. Restrictions of this type are not expected to drive flow to zero, however, the flow rate at which the bed is expected to collapse cannot be quantitatively determined due to the many variables involved. The experience in August 2001 with the Unit 1 AB EDG indicates that this point is well below the design flow. Estimation of minimum flow experienced during the event is discussed later.

Combination of mechanisms A third possibility is that the event starts with formation of a debris bed as described above. Upon collapse of the bed, the debris concentration in the channel head could increase rapidly and allow debris to settle and accumulate in the channel head, thus initiating growth of a new flow restriction. This scenario is considered unlikely for the same general reasons that the settling mechanism alone was considered unlikely.

Flow experience during the August 2001 event Reference 2 concludes that the EDGs can perform their function at cooling water flows significantly below the design value of 610 gpm. For design basis conditions of LOOP and LOCA, the required flow is about 185 gpm. For LOOP without LOCA, the required flow is about 130 gpm. Investigation of the August 2001 event determined that three EDG cooler strings showed ESW flow trending downward, but all remained at 250 gpm or greater, which ensures that they could have perforrmed their design function. The fourth cooler string, Unit 1 AB EDG, trended down to a low level and then fluctuated between that point and about 300 gpm until such time that the blockage was permanently cleared by operator action.

The above determination is based on a combination of flow data archived by the plant process computer (PPC) and operator statements of observed ESW flow during the event.

Discrepancies between the two sources are discussed and evaluated in the following paragraphs. The first step in explaining the discrepancies is to describe the various flow data available during and after the event:

" Each EDG cooler string has only one flow orifice that was the source of all of the flow indication for that EDG during the event. The instrument loop for each flow orifice consists of the flow orifice, a transmitter, a control room indicator, and a PPC analog to-digital converter. One voltage signal is transmitted to the control room indicator and the PPC. The control room board indicator converts the voltage signal to flow (in gpm) using a square root scale on the meter face. The PPC uses an algorithm to extract the square root for the conversion to flow rate. The control room board indicator is available continually for observation. PPC data is available in real time in the control room via computer terminals, with points updated typically at a frequency of about a minute. The PPC data is also archived in electronic files, although only a fraction of the data available in real time is actually saved. Archived points are typically saved on a frequency of ten minutes to one hour.

"* Calculated uncertainty for this instrument loop suggests that uncertainty in the low flow range is high. However, subsequent field testing of one EDG flow instrument NTS-2002-0110-RE P, REV. 0 PAGE 23 OF-51

loop using an ultrasonic flow meter provided good correlation between "actual" flow, as measured by the ultrasonic meter, and "indicated" flow, as measured by real-time PPC data. Accuracy is considered good down to a value of about 100 gpm.

A number of significant inconsistencies between the archived PPC data and operator observations of the event call into question the validity of the archived PPC data. For example, in Unit 2, Operations declared the Unit 2 AB EDG available at 23:47 on August 29 after flow was restored to approximately 800 gpm. The archived PPC data for this time frame indicated that the flow to this EDG cooler string was near zero (listed as "bad data,"

which is associated with values below the lower reasonable limit) until 02:17 on August 30.

Similarly, the Unit 1 CD EDG was reported available at 00:40 on August 30 with a flow of 760 gpm and the Unit 1 AB EDG was reported available at 01:25 on August 30 with a flow of 700 gpm. The archived PPC data for this time frame does not correlate well with these reported flow values.

Additionally, although the archived PPC data suggests that the Unit 1 AB EDG cooler string approached zero flow for a period of time after the event was recognized, this is not consistent with real time observations by Operations personnel. Operator statements indicate that ESW flow to the lAB EDG cooler string was maintained between 100 gpm and 300 gpm during the event. Operations staff monitored ESW flow closely after the degraded flow condition to the EDGs was first identified on Unit 2. Real-time PPC trends were created and ESW flow was continuously monitored in the control room for the duration of the event to provide early identification of further degradation of the ESW system.

The specific cause of the data discrepancies has not been identified, but it is believed that errors occurred in retrieval of archived data from the PPC. Regardless of the cause, clearly the archived PPC data alone cannot be relied upon as an accurate indicator of ESW flow during the event. Operator observations are considered credible and more representative of conditions during the event.

There is one period prior to identification of the flow restriction on either unit in which archived PPC data for the Unit 1 AB EDG coolers indicates near zero flow ("bad data").

This condition continued for almost two hours until the recorded values returned to about 300 gpm and then oscillated between "bad data" and about 300 gpm. Since the debris intrusion event had not been identified at this point, there are no operator observations available for comparison. Based on the later correlation of real time observations to archived PPC data in similar "bad data" instances, it is likely that flow during this period was at least 100 gpm.

Comparison of lube oil coolers to other EDG coolers The cooler string for an EDG includes two air aftercoolers in parallel, one lube oil cooler, and one jacket water cooler. ESW flow to the EDG cooler string is typically in service, even when the EDGs are not running. Since the August 2001 flow restriction occurred primarily in the EDG lube oil coolers, differences between the lube oil coolers and the other EDG coolers were investigated to determine if they might be more susceptible to flow restrictions or flow blockage under other operating scenarios.

Each EDG has two turbocharger air aftercoolers located upstream of its lube oil cooler. A temperature controlled three-way valve regulates flow through the two air aftercoolers.

Since the EDGs were not running during the August 2001 event, most or all of the ESW flow bypassed the air aftercoolers. Consequently, they were not challenged by debris NTS-2002-010-REP, REV. 0 PAGE 24 OF 51

during the August 2001 event. Three differences between the air aftercoolers and the lube oil coolers that could affect susceptibility to debris are discussed below:

" The tubesheet pattern is quite different. The lube oil cooler tubes are spaced closely together, with very little ligament between tubes. The air aftercooler tubes are much further apart, leaving a large ligament between tubes. With regard to postulated bridging of debris particles at the tube inlet, the wide tube spacing makes it more difficult to create a bridge across a number of tubes because the particles streaming into one tube would be separated from those streaming into adjacent tubes.

" Although the tube diameter is the same, the velocity at the tube inlet of the air aftercoolers at full design flow is only about 65% of the velocity at the tube inlet of the lube oil coolers. For a given concentration of debris particles in the incoming ESW flow, the lower flow per tube in the air aftercoolers would result in less propensity to form a debris bridge at the tube inlet.

" The channel head of the air aftercooler represents a larger flow expansion than does the channel head of the lube oil cooler. Additionally, the air aftercooler flow is temperature controlled and due to relatively low anticipated EDG electrical load during a LOOP without LOCA scenario, the flow demand to the air aftercoolers is likely to be well below the design flow. The relatively large channel head and low flow rate combine to produce low channel head flow velocity, so some settling of debris would be expected to occur under most flow conditions. As flow area is lost to debris accumulation in the channel head, velocity at the demanded flow rate will increase and an equilibrium point would be reached where the velocity is sufficient to prevent further deposition. A flow restriction of this type is mitigated by the conservative design of the aftercoolers, which could tolerate blockage of a significant number of tubes under LOOP without LOCA conditions.

Based on these differences, the air aftercoolers are considered much less susceptible to debris bed formation on the tubesheet and less likely overall to experience complete flow blockage. Consequently, the plugging potential of the lube oil coolers is judged to bound the plugging potential of the air aftercoolers.

The jacket water cooler for each EDG is in series with and downstream of the lube oil cooler for that EDG, so the jacket water coolers were also receiving ESW flow during the August 2001 event. Although the tube length is different, the tubesheet and channel head arrangement of the jacket water coolers is essentially identical to the lube oil coolers.

Therefore the debris-plugging potential of the jacket water coolers is bounded by the assessment of lube oil cooler plugging.

The potential for multiple debris beds to develop in the same EDG cooler string was also investigated, but was judged to be highly improbable for the following reasons. During a debris intrusion event, if a second debris bed began to accumulate upstream of an existing debris bed, it would act as an upstream filter, capturing much of the debris flowing through the piping. Less debris would be fed to the downstream bed and it would be expected to break apart. By the same token, a second debris bed is very unlikely to occur downstream of an existing debris bed because of the filtering effect of the upstream bed.

Probability of occurrence Of the postulated mechanisms for creating flow restrictions from entrained debris smaller than the heat exchanger tubes, formation of debris beds on the tubesheet surface is most NTS-2002-OIO-REP, REV. 0 PAGE 25 OF 51

consistent with observations from the August 2001 event. Flow data indicates that flow in the Unit 1 AB EDG cooler string oscillated between a low flow and a higher flow for some period of time, which is consistent with the postulated flow restriction mechanism.

Consideration of subjective evidence, particularly the fact that cycling the ESW valves was sufficient to rapidly restore flow, supports a conclusion that ESW flow never stopped entirely.

It should also be qualitatively recognized that the system alignment during the August 2001 event had only the Unit 1 East ESW pump feeding the Unit 1 East/Unit 2 West ESW header. In the postulated LOOP event, all four ESW pumps would be running, so the debris concentration reaching the EDG cooler strings would be reduced due to dilution from the other pumps.

To be conservative, the probability that an EDG cooler string will suffer a flow restriction of sufficient magnitude and duration to prevent the associated EDG from performing its function will be selected as 0.25. This value bounds the August 2001 event in which one out of four EDGs experienced a significantly greater flow reduction than the other three. It is also consistent with the intuitive judgement that in any hypothetical debris intrusion event, one EDG cooler string will receive more debris than the other three and thus be more prone to cause its EDG to suffer loss of function. This probability estimate applies to both dual-unit and single-unit LOOP events.

Block 9: Condition is not identified and cleared by operators The operator response to the event in August 2001 involved identifying the low ESW flow conditions in the EDG cooling heat exchangers and taking actions to restore higher ESW flow rates to the EDG heat exchangers. This plant experience was used as a starting point of a human reliability analysis (HRA) to evaluate and numerically quantify the operator actions to restore ESW flow to the EDGs after a flow blockage event. The probability of the operator to detect, diagnose, and recover the ilow conditions is the result of this quantification.

The human reliability analysis approach is described in a letter report prepared by SCIENTECH (Ref. 13.) As described in that reference, the HRA approach followed a structured framework as detailed in two EPRI studies, "Systematic Human Action Reliability Procedure" and "An approach to the Analysis of Operator Actions in Probabilistic Risk Assessment" (Ref. 14, 15). The approach systematically defined and accounted for qualitative and quantitative factors affecting the human error probability (HEP). The human reliability analysis of this event evaluated both cognitive (diagnostic) and execution types of errors. The cognitive part of the HEP was evaluated using the EPRI Cause Based Decision Tree Methodology (CBDTM) that is explained in detail in Reference 15. The CBDTM approach was applied to major decision steps such as transfers to another procedure, or the decision to initiate some process. Decision trees were used to evaluate each of the above error types. Cognitive failures were not applied to execution steps that were purely directions to perform a specific task. Execution errors were considered and evaluated using the methods from the Human Reliability Handbook (THERP) in Reference 16.

The scenario conditions used in this analysis are derived from the actual operator's experience in recovering ESW during the August 2001 event (Ref. 1) and operator interviews (Ref. 13). The scenario conditions are noted below:

PAGE 26 OF 51 NTS-2002-010-REP, NEv. 0U Nib 2002 010 REP, REV. PAGE 26 OF 51

Single Unit LOOP PRA Scenario:

"* ESW blockage exists prior to the initiating event or develops after the initiating event causing low flow to the EDG heat exchangers.

"* A LOOP occurs causing a reactor trip at one unit with the other unit unaffected.

Automatic EDG start and loading of the busses is successful.

"* No safety injection or other failures are postulated.

"* EDGs overheat on low ESW flow and actuate first the high temperature alarms on the control room EDG panel and then the high-high temperature alarms (see EDG alarms list in operator response below).

"* It is assumed the operators trip the EDGs on high-high temperature alarm for jacket water or lube oil.

" The degree of blockage and amount of ESW flow to EDG heat exchangers is variable and the time to EDG overheat is also variable. Therefore, scenario timing was treated as variable from short (immediate overheating within 5 minutes) to overheating up to 20 or 30 minutes or longer after EDG start.

Operator Response to Single Unit LOOP Scenario:

"* Upon reactor trip, the control room operators enter procedure E-0 and check EDG operation at step 3 within minutes. At this time, the EDGs are operating and busses are loaded.

" Control room operators continue with procedure transitioning to procedure ES-0.1 and stabilizing plant conditions.

" At the start of the reactor trip, auxiliary equipment operators (AEOs) assigned to the turbine building would proceed to the EDGs in accordance with procedure OHI-4023, Attachment 2, step 2.3, Initial AEO Response, step 2.3.1, AEO assigned to the turbine building. The affected unit's AEO is assigned to the auxiliary feedwater (AFW) pumps and one of the EDG rooms. The unaffected unit's AEO in the turbine building is assigned to the other EDG room:

" The affected unit's AEO first has to check the AFW pumps to ensure they are running. This requires the operator to go into all three AFW pump rooms and perform visual checks that are very quick (2 to 3 minutes per pump room).

Overall, it takes from 10 to 15 minutes to perform AFW checks prior to going to the EDG Room.

" After completing AFW checks, the AEO proceeds to the EDG room to perform EDG checks and remains in the EDG room to perform trending duties unless directed to go elsewhere by the control room operators.

" The unaffected unit's AEO proceeds directly to the EDG room and performs the EDG checks unless directed to go elsewhere by the control room operators.

" During EDG room checks, the EDG temperatures are monitored and trended.

ESW valve lineups would be checked, turbocharger, lube oil and jacket water temperatures are monitored. Although there is no ESW flow indication, there is NTS-20021010-REP, REV. 0 PAGE 27 OF 51

local temperature indication in the EDG room. The EDG temperatures would all be rising due to low ESW flow and would be noticed by the AEO locally.

"TheEDGs overheating due to loss of ESW flow would actuate several alarms on the control room EDG panel:

"* The Air Chest High Temperature Alarm (at 150 0 F), Jacket Water Temperature High Alarm (at 175 0 F) and Lube Oil High Temperature Alarm (at 175°F).

"* These alarms may occur before the AEO is in the EDG room.

" The control room operator would respond to the EDG alarms in accordance with procedure (OHP-4024-119, Annunciator Response #119: Station Auxiliary AB) and follow the procedure to check ESW flow to heat exchangers. ESW flow indication to the EDG heat exchangers is on the ESW control panel in the control room.

" The control room operator would contact the AEO and instruct him to check EDG status and operation in the EDG room and check to ensure the ESW valves to the heat exchangers are open.

" Ifthe ESW flow path is open and flow is still blocked and EDG temperature is rising, the operator would then try cycling valves to clear blockage.

" Ifblockage was not cleared by valve cycling, then the AEO in the EDG room would be instructed to open the heat exchanger drain valves and drain any material from the heat exchangers. Afterwards, the supply valves would be cycled to see if flow is restored.

"* If the EDG reaches the jacket water or lube oil high-high temperature alarms, the operator would manually trip the EDG in accordance with the procedure (OHP-4024 119).

" Ifthe EDGs are tripped on high-high temperature before the ESW supply valves can be cycled, power is lost to the Motor Control Centers (MCCs) for these valves and they must be cycled manually from a location adjacent to the EDG room. This can be accomplished on a single unit LOOP with the EDGs tripped because the other unit's ESW pumps are available on offsite power to supply flow to the EDG heat exchangers.

" Ifthe blockage is removed and flow is restored from either valve cycling or draining the heat exchangers, then the EDGs can be restored to service. No other operator actions are immediately available to restore ESW to the EDGs.

Dual-unit LOOP (DLOOP) Initiating Event Scenario:

• This scenario is the same as the single unit LOOP with the following exceptions:

N A DLOOP would cause a reactor trip at both units.

Operator Response to Dual-unit LOOP Scenario:

E This scenario is the same as the single unit LOOP with the following exceptions:

NTS-2002-010 -REP, REV. 0 PAGE 28 OF 51

"* Each unit would be responsible for its own equipment so each unit would be required to use its own turbine building and auxiliary building AEOs, one for each EDG room.

" Because both units are on EDGs, if all the EDGs are tripped on high-high temperature (either lube oil or jacket water), there would be no ESW flow to use to try to unblock the EDG heat exchangers. All valve cycling attempts to unblock flow would only work while at least one of the EDGs is running and the associated ESW pump on that EDG bus is also running and providing flow.

The operators would attempt valve cycling and heat exchanger draining to clear blockage while there is at least one ESW pump running.

The HEPs determined for these actions are:

Human Error Probabilities Fail to recover ESW after LOOP 0.054 Fail to recover ESW after DLOOP 0.13 Summary of Event Probability The probability of occurrence of each event block in Figure 3 is summarized in Table 3 for both dual-unit and single-unit LOOP events.

Table 2 - Event Probabilities during LOOP Event Dual-unit Single-unit Event LOOP LOOP Block 1: LOOP occurs 1.0 1.0 Block 2: Sufficient suspended debris is present 0.0189 0.1033 Block 3: Suspended debris reaches ESW pump suctions 0.99 0.99 Block 4: 1 E ESW damaged strainer basket is in service 0.7708 1.0 Block 5A: Flow through 1E ESW strainer is "low" 0.8510 0.8510 CS-1 Block 5B: Flow through 1 E ESW strainer is "high" 0.1490 0.1490 Block 6A: Ingested debris bypasses 1E ESW strainer 0.10 0.10 Block 6B: Ingested debris bypasses 1E ESW strainer 0.95 0.95 Condition: Bypassed debris enters Unit 1 EDG coolers 1.0 1.0 Block 7: Bypassed debris reaches Unit 2 EDG coolers 0.25 0.25 Block 8: Cooling flow degradation impacts EDG function 0.25 0.25 Block 9: Condition is not identified/cleared by operators 0.1300 0.0540 NTS-2002-01O-REP, REV. 0 - CS-1 PAGE 29 OF 51 1

Calculation of Conditional Probabilities To calculate the conditional probabilities of the EDGs being plugged by ESW debris during a Loss-Of-Offsite Power (LOOP) 6 at either Unit 1, Unit 2, or both units, the three event trees in Figures 7, 8, and 9 were created. The top events in these event trees correspond to the events discussed previously. Table 3 relates the event tree top events with the events in Figure 3.

Table 3 Relationship Between EDG Conditional Failure Event Trees and EDG Failure Block Diagram Event Tree Top Event Figure 3 Block DEB Event Fails To Place Debris 2 Suspended debris is sufficient In Suspension to challenge ESW system IN Debris Settles Before ESW 3 Suspended debris reaches Ingestion ESW pump suctions DMG Damaged Basket Is Not In 4 1 E ESW damaged strainer Use basket is in service HI 1E ESW Low Flow Conditions 5A/5B Flow through 1E ESW strainer is low/high Debris Does Not Bypass 6A and Ingested debris bypasses 1E Strainer 6B ESW strainer No Ul To U2 ESW Cross-tie Debris reaches Unit 2 ESW Flow header and EDG coolers 1A Cooling flow degradation 8A Cooling flow degradation does not impact EDG 1 AB impacts EDG 1 AB function 1C Cooling flow degradation 8B Cooling flow degradation does not impact EDG 1 CD impacts EDG 1 CD function 1NR Operator Perform Ul EDG 9A Unsuccessful in performing Restoration Unit 1 flow restoration activities 2A Cooling flow degradation 8C Cooling flow degradation does not impact EDG 2 AB impacts EDG 2 AB function 2C Cooling flow degradation 8D Cooling flow degradation does not impact EDG 2 CD impacts EDG 2 CD function 2NR Operator Perform U2 EDG 9B Unsuccessful in performing Restoration Unit 2 flow restoration activities Each sequence in an event tree determines a particular end state that is identified in the column labeled Plant Damage State (PDS). The possible entrainment of debris into the

' The Loss-of-Offsite Power is also called Loss-of-Station Power (LOSP). These names and acronyms are interchangeable and both are used in this evaluation.

NTS-2002-010-REP, REV. 0 PAGE 30 OF 51

ESW system and EDG cooling degradation during a LOOP results in 16 PDSs. Table 4 identifies the 16 unique end states or PDSs defined in the event trees.

Table 4 PDS Definitions for EDG Conditional Failure Event Trees Number of Identifiers for EDGs Assumed to Become PDS EDGs Unavailable Due to ESW Debris Unavailable OK 0 NoEDGs lAB 1 Unit 1 EDG AB 1CD 1 Unit 1 EDG CD 2AB 1 Unit 2 EDG AB 2CD 1 Unit 2 EDG CD U1 2 Unit 1 EDGs (AB and CD)

U2 2 Unit 2 EDGs (AB and CD)

A-A 2 Unit 1 EDG AB and Unit 2 EDG AB A-C 2 Unit 1 EDG AB and Unit 2 EDG CD C-A 2 Unit 1 EDG CD and Unit 2 EDG AB C-C 2 Unit 1 EDG CD and Unit 2 EDG CD UIA 3 Unit 1 EDGs (AB and CD) and Unit 2 EDG AB Ul1C 3 Unit 1 EDGs (AB and CD) and Unit 2 EDG CD AU2 3 Unit 1 EDG AB and Unit 2 EDGs (AB and CD)

CU2 3 Unit 1 EDG CD and Unit 2 EDGs (AB and CD)

U12 4 Unit 1 and 2 EDGs (AB and CD)

The event trees use a LOOP (single unit or dual unit) initiating event frequency of 1.0 to calculate the conditional probability of EDG failure during the event. For the other top events, the probabilities in Table 2 are used to quantify the event trees. Table 5 lists the conditional probabilities calculated by the event trees.

NTS-2002-010 REP, REV. 0 PAGE 31 OF 51

Table 5 EDG Conditional Failure Probabilities Initiating Event PDS Conditional Probability U1 LOOP lAB 2.35E-04 U1 LOOP 1CD 2.35E-04 U1 LOOP U1 7.82E-05 U2 LOOP 2AB 3.66E-05 U2 LOOP 2CD 3.66E-05 U2 LOOP U2 1.22E-05 DLOOP lAB 7.90E-05 DLOOP 1CD 7.90E-05 DLOOP 2AB 1.17E-05 DLOOP 2CD 1.17E-05 DLOOP UL1 2.63E-05 DLOOP U2 3.91 E-06 DLOOP A-A 3.03E-07 DLOCP A-C 3.03E-07 DLOOP C-A 3.03E-07 DLOOP C-C 3.03E-07 DLOOP UlA 1.01 E-07 DLOOP U1C 1.01 E-07 DLOOP AU2 1.01 E-07 DLOOP CU2 1.01 E-07 DLOOP U12 3.37E-08 Cook Nuclear Plant PRA Model Modifications Each of the event tree PDSs represent the conditional probability of one or more EDGs failing during the corresponding LOOP. To evaluate the impact of ESW debris on the Cook Nuclear Plant PRA model, i.e., Core Damage Frequency (CDF) and Large Early Release Frequency (LERF), basic events representing each of the PDSs in the event trees were created. Table 6 lists the basic events and the corresponding event tree PDSs.

The probability value assigned to each basic event is the conditional probability determined by the event tree for the particular initiating event.

NTS-2002-010-REP, REV. 0 PAGE 32 OF 51

Table 6 Mapping of EDG Conditional Failure PDSs to Basic Events Initiating Event PDS Basic Event U1 LOOP lAB DEBI-lAB U1 LOOP lCD DEBI-lCD U1 LOOP U1 DEB1-BOTH-EDGS U2 LOOP 2AB DEB2-2AB U2 LOOP 2CD DEB2-2CD U2 LOOP U2 DEB2-BOTH-EDGS DLOOP lAB DEBD-1AB DLOOP lCD DEBD-lCD DLOOP 2AB DEBD-2AB DLOOP 2CD DEBD-2CD DLOOP U1 DEBD-1AB-1CD DLOOP U2 DEBD-2AB-2CD DLOOP A-A DEBD-1AB-2AB DLOOP A-C DEBD-1AB-2CD DLOOP C-A DEBD-1CD-2AB DLOOP C-C DEBD-lCD-2CD DLOOP UlA DEBD-1AB-lCD-2AB DLOOP UlC DEBD-IAB-ICD-2CD DLOOP AU2 DEBD-1AB-2AB-2CD DLOOP CU2 DEBD-l CD-2AB-2CD DLOOP U12 DEBD-FOUR-EDGS In fault tree file DEB (Figures IOa, lOb, 1Oc, and lOd), these basic events were used to construct four top gates (GDEB100, GDEB200, GDEB300, and GDEB400) to evaluate the probability that ESW debris would cause failure of EDGs lAB, lCD, 2AB, and 2CD during the relevant LOOP events. Since these basic events are conditional probabilities during LOOP events, "AND" logic with house events XHOS-LOSP-Ul, XHOS-LOSP-U2, and XHOS-LOSP-DUAL is used to limit the use of these basic events to the appropriate LOOP scenario. It is noted that although the PRA model credits automatic operation of a single EDG to recover a randomly lost electrical train during non-LOOP events, the risk significance of ESW debris on non-LOOP events is considered negligible since at least one train has off-site power.

The PRA model for the Cook Nuclear Plant (Ref. 29) was modified by adding transfers to top gates GDEB100, GDEB200, GDEB300, and GDEB400 to the fault trees for EDGs lAB, 1CD, 2AB, and 2CD, respectively.

NTS-2002-010-REP, REV. 0 PAGE 33 OF 51

Since the event trees explicitly calculated the probability of each EDG failure combination, these new basic events are mutually exclusive events. However, given the magnitude of these basic events, random combinations of these basic events will not significantly affect the CDF and LERF values. Therefore, PRA model modifications to identify these basic events as mutually exclusive events, i.e., to the MEX fault tree, were conservatively omitted.

Cook Nuclear Plant PRA Model Results Table 7 - PRA Results Parameter Cook PRA ESW Debris Delta (PA-01 -02) Evaluation Unit 1 CDF 4.848E-05 4.876E-05 2.8E-07 Unit 1 LERF 5.588E-06 5.630E-06 4.2E-08 Unit 2 CDF 4.870E-05 4.874E-05 4.E-08 Unit 2 LERF 5.589E-06 5.595E-06 6.E-09 Conclusions This report has evaluated the potential risk impact associated with the damaged ESW strainer that led to debris intrusion into ihe ESW system at the D. C. Cook Plant on August 29, 2001. The evaluations in this report supplement the deterministic analyses performed after the occurrence of the eveni. The deterministic analyses provide a basis for concluding that the EDGs remained available to perform their safety function throughout the event and suggest that the EDGs would have been available whenever they might have been needed while the failed strainer is believed to have existed. To supplement the deterministic analyses and to address uncertainties surrounding the nature of worst-case debris conditions, an additional probabilistic analysis of the impact of the failed ESW strainer on plant response following LOOP and DLOOP initiating events was undertaken to assess the risk associated with a damaged ESW strainer basket.

Probabilistic techniques included logically decomposing the process of EDG failure due to ESW debris intrusion into the individual events that must occur to reach that failure state and estimating probabilities for each of these events, as well as estimating the operator recovery probability. After the probabilities were determined for these individual events, they were used to determine the conditional failure probabilities for each EDG due to debris intrusion into the ESW system. These conditional failure probabilities were then inserted into the full plant PRA model to determine quantitative estimates for CDF and LERF increases that could be associated with the condition.

The results of these probabilistic analyses indicate that the increase in plant risk due to the condition identified following the August 2001 event is very small, even with conservative (i.e., worse than expected performance) assumptions. Specifically, the PRA model estimates a CDF increase of 2.8E-07/year and a LERF increase of 4.2E-O8/year).

NTS-2002-010- REP, REV. 0 PAGE 34 OF 51

1. AEP Report NED-2001-038-REP, Rev. 0A, "Debris Intrusion into the Essential Service Water System, Donald C. Cook Nuclear Plant," American Electric Power, Buchanan, Michigan, September 15, 2001.

2. AEP Report NTS-2002-002-REP, Rev. 0 (MPR-2356, Rev. 0), "D. C. Cook Nuclear Plant, ESW Debris Intrusion Event Evaluation," MPR Associates, Inc.,

Alexandria, Virginia, January 2002.

3. Reference 2, Attachment A, MPR Calculation 025-103-RCS1, Rev. 0, "Potential for Debris Ingestion/Entrainment in ESW System," MPR Associates, Inc.,

Alexandria, Virginia, January 15, 2002

4. Reference 2, Attachment B, MPR Calculation 025-103-EBI, Rev. 0, "Screenhouse CFD Flow Model and Results," MPR Associates, Inc., Alexandria, Virginia, January 15, 2002.

5. Reference 2, Attachment C, MPR Calculation 025-103-RS1, "Impact of Seismic Event on Screenhouse Debris," MPR Associates, Inc., Alexandria, Virginia, January 15, 2002.

6. Reference 2, Attachment D, MPR Calculation 025-103-AWl, "ESW EDG Loop Hydraulic Analysis," MPR Associates, Inc., Alexandria, Virginia, January 15, 2002.

7. Reference 2, Attachment E, MPR Calculation 025-103-MH-01, "EDG Heat Exchanger Heat Loads," MPR Associates, Inc., Alexandria, Virginia, January 15, 2002.

8. Reference 2, Attachment F, MPR Calculation 025-103-RCS2, "EDG Lube Oil Temperature Limits," MPR Associates, Inc., Alexandria, Virginia, January 15, 2002.

9. Reference 2, Attachment G, MPR Calculation 025-103-LS-01, "EDG Cooler Thermal Performance," MPR Associates, Inc., Alexandria, Virginia, January 16, 2002.

10. Reference 2, Attachment H, "August 29, 2001 ESW Flow Degradation Evaluation,"

MPR Associates, Inc., Alexandria, Virginia, January 2002.

11. CR-01242013, Category 1 Condition Report (root cause evaluation for August 2001 ESW debris intrusion event), evaluation approved December 27, 2001; overall closure on April 17, 2002.

12. CR-96-1270, Category C Condition Report (investigation of August 1996 ESW sand intrusion event), final disposition approved January 17, 1997.

13. Letter 17141-0008-01, Enclosure 2, "Human Reliability Analysis of the Recovery of ESW Flow to Emergency Diesel Generators after Blockage at Cook Nuclear Plant," SCIENTECH, Gaithersburg, Maryland, January 7, 2002.

14. EPRI NP-3583, "Systematic Human Action Reliability Procedure (SHARP)," EPRI Research Project 2170-3, June 1984.

NTS-2002-010-REP, REV. 0 PAGE 35 OF 51

15. EPRI TR-100259, "An Approach to the Analysis of Operator Actions in Probabilistic Risk Assessment," June 1992.

16. NUREG/CR-1278, "Handbook of Human Reliability Analysis with Emphasis on Nuclear Power Plant Applications," (also known as THERP), Swain, A. D. and Guttman, H. E., August 1983.

17. AEP Report, "Donald C. Cook Nuclear Plant, Units 1 and 2, Individual Plant Examination of External Events Summary Report," April 1992.

18. NUREG/CR-5424 and LA-11667-MS, "Eliciting and Analyzing Expert Judgement:

A Practical Guide," Los Alamos National Laboratory (prepared for U. S. Nuclear Regulatory Commission), January 1990.

19. LER 05000-316-2001-003-00, "Degraded ESW Flow Renders Both Unit 2 Emergency Diesel Generators Inoperable," AEP, October 25, 2001.

20. LER 05000-316-2001-003-01, "Degraded ESW Flow Renders Both Unit 2 Emergency Diesel Generators Inoperable," AEP, March 12, 2002.

21. AEP Calculation EVAL-PA-01-07, Rev. 0, "Initiating Events Environmental/Testing Factors and Indirect Effects for Use in the D. C. Cook Safety Monitor At Power Model," March 2002.

22. Letter 17141-0008-01, Enclosure 1, "Assessment Of The Loss Of Offsite Power Frequency At The D.C. Cook Nuclear Plant," SC!ENTECH, Gaithersburg, Maryland, January 7, 2002.

23. AEP Calculation RD.99-05, Rev. 2, "Control Room Chi/Q Values for Selected Release Points at the Donald C. Cock Nuclear Plant,' November 15, 2001.

24. "Screenhouse Model Test of the Donald C. Cook Nuclear Plant," Frazier P. Colon, Alden Research Laboratories, June 1970.

25. AEP Drawing 12-3650, Rev. 4, "Screenhouse Plan at Elevation 546', Centerline Plant to Column 18, East Portion," April 25, 1974.

26. AEP Drawing 12-3652, Rev. 5, "Screenhouse Plan at Elevation 546', Centerline Plant to Column 18, West Portion," April 25, 1974.

27. AEP Drawing 12-3657, Rev. 16, "Screenhouse Plan at Elevation 591', Centerline Plant to Column 18, East Portion," August 21, 1981.

28. AEP Drawing 12-3658, Rev. 11, "Screenhouse Plan at Elevation 591', Centerline Plant to Column 9, East Portion," April 25, 1974.

29. AEP Calculation EVAL-PA-01-02, "Unit 1 and Unit 2 Core Damage and Large Early Release Quantification," April 12, 2002.

30. AEP Calculation MD-12-ESW-069-N, Rev. 0, "D. C. Cook Units 1 and 2 ESW/CCW Model Calibration," March 16, 2000.

31. D. C. Cook Nuclear Plant Unit 2 Technical Specifications PACE 36 OF 51 REV. 00 NTS 2002 010 REP, REV.

NTS-2002-OIO-REP, PAGE 36 OF 51

32. John W. Clark, Warren Viessman, Jr., and Mark J. Hammer, Water Supply and Pollution Control, Second Edition, International Textbook Company, Scranton, Pennsylvania, 1971.

33. Merritt, Frederick S., Standard Handbook for Civil Engineers, McGraw-Hill, New York, New York, 1968.

34. Reuben M. Olson, Essentials of Engineering Fluid Mechanics, Second Edition, International Textbook Company, Scranton, Pennsylvania; 1966.

35. Jan J. Tuma, Handbook of Physical Calculations, McGraw-Hill, New York, New York, 1976.

36. George B. Sowers and George F. Sowers, Introductory Soil Mechanics and Foundations,Third Edition, The Macmillan Company, London, England, 1970.

37. AEP Drawing OP-1-98415-39, "Essential Service Water System East, Sheet #1, Elementary Diagram," March 16, 2002.

38. AEP Drawing OP-1-984151-15, "Essential Service Water System West, Sheet #1, Elementary Diagram," March 16, 2002.

39. AEP Drawing OP-2-98415-47, "Essential Service Water System East, Sheet #1, Elementary Diagram," March 16, 2002.

40. AEP Drawing OP-2-984151-14, "Essential Service Water System West, Sheet #1, Elementary Diagram," March 16, 2002.

41. CR-01247001, Category 4 Condition Report, evaluation approved October 6, 2001; overall closure on October 9, 2001.

NTS-2002-010-REP, REV. 0 PAGE 37 OF 51

Figure 1 - Effect of Condenser Draining Figure 2 - Screenhouse Cross Flow Figure 3 - EDG Failure Scenario for ESW Debris Intrusion Figure 4 - Conditions Causing Events Represented by Blocks 4 and 5 Figure 5 - Conditions Causing Events Represented by Blocks 2 Figure 6 - Simplified Schematic of ESW Systems Figure 7 - EDG Conditional Failure Probability Event Tree for Unit 1 LOOP Figure 8 - EDG Conditional Failure Probability Event Tree for Unit 1 LOOP Figure 9 - EDG Conditional Failure Probability Event Tree for DLOOP Figure 1Oa - EDG 1 AB Fault Tree Modification for ESW Debris Intrusion Figure 1Ob - EDG 1 CD Fault Tree Modification for ESW Debris Intrusion Figure 1Oc- EDG 2 AB Fault Tree Modification for ESW Debris intrusion Figure 1Od - FDG 2 CD Fault Tree Modification for ESW Debris Intrusion 38 OF PIWE 38 51 OF 51 NTS-2002-OIO-REP, NTS REV. 0 2002 010-REP, REV. P*AGE

Figure 1 Potential Effect of Condenser Draining CW Pump ESW Pump 7

Water returning through an open discharge valve on an idle circulating Bay walls block water pump may agitate horizontal radial debris in the immediate path to ESW vicinity of the pump pumps In order to reach ESW pumps, debris suspended by CW pump draining must be transported by cross flows Entraining Debris as a Result of CW Pump Trip NTS-2002-010-REP, REV. 0 PAGE 39 OF 51

Figure 2 - Screenhouse Cross Flow J / / - i No cross flow 4.

9 VeIocit through scr ns 1 -7 and 2-1

,\/

essensftly JW'gv'%

zero A

'-V Baffles direct -43% Baffles direct -57% ý"

incoming flow to Unit 1 incoming flow to Unit 2, IM-3 Closed Two-Unit Operation with Two Intakes (1?1F ýOFF Substantial cross flo w V , .

-V

<N K

-'ens1 Velocity through sci and 2-1

• ,/

essen

./-/ /

I ty zero Baffles direct -43% Baffles direct -57%

incoming flowv to Unit I in rincomnq flo wto Unit 2 Unit 1 LOOP with Two Intakes HALL u U[ I NTS NTS-2OOZ-OIO-REF, REV. 00 2002-010 REP, REV. PAGE 40U OF5

Figure 3 EDG Failure Scenario for ESW Debris Intrusion 2 3 4 Loss of otts1te pnys'r Sosperded debris is SPen ded debrs l ESW damaged o r e o challenge sufficient reaches ESW puoop strainer basket is in occurs ESW system suctions service 8A 9A Cooling flow Unsoccessful in fAB EDG fails degradation impacts performing Unit 1 flow EDG 1 AG function restoration actinitves

,A DGebris reaches Fl.osthrough 1b ESW Ingested debris Unit 1 ESW header ibypasses 1 ESW ,, and D coolers strainer islow P strainer , n c 8B 9A Cooling flow Iosuccessfull in 1CD EDG fails degradation impacts performing Unit 1 flow EDG 1 CD function restoration activities 8A 9A Cooling flow t Unsuccesstol in lAB EDCf1,Is 5h Ingested debris bag E ESW L_,ý' Debris reaches U ni 1 ESW header F-> degradat on impacts EOG 1 AS function performing Unit 1 low restoration activities L- Ela:throgh 1E ESW bsne tra and FCC COOlers strainer is high SA Cooling 'low Unsuccessful in 1CC FCCGa,.s d'gradation ,mpact performing Unit 1 flow LCG 1 CD function restoration cti vities 9B Cool ng flow Unsucccssful in 2AB EDG fails degradation impact performing Unnt2 flos LEG 2 Ag function restoration actisties Debris reaches enit2 ESW header and EDG cool-s 8D 9B Cooping Isos Unsuccessfu in 2 CD EDG fails degbadation impacrs poerermrngUnir 2 beer EDG 2 CD funcion restoraton acItvilies PAGE 41 OF 51 NTS-2002 010 PEP, REV.

NTS-2002-010-REP, REV. 00 PAGE 41 OF51

Figure 4 Conditions Causing Events Represented by Block 2 High debris loading in incoming CW 2d Biocide treatment of zebra mussels Block 2 Suspended debris is sufficient to challenge ESW system 2f Screenhouse refill following loss of CW 2i Flow patterns in Sufficent debris forebay are sufficient to suspend debris screenhouse 2h Cross flow in front of ESW pump bays NTS-2002-010 -REP, REV- 0 PAGE 42 OF 51

Figure 5 Conditions Causing Events Represented by Blocks 4 and 5 5d 5a 5b 5c High ESW flow during High ESW flow during High ESW flow during High ESW flow during high lake temperature DBAs surveillance testing unit cooldown periods Block 5A "Low" flow periods 1- (Pc+PD+PE+PF)

Block 4 Failed strainer basket in service during event 7

4a Failed strainer basket I! I Failed strainer basket switched into service in service at time of

,,during the LOOP event/,

LOOP event 4c 4b Strainer switches due Strainer switches due high differential to timer pressure NTS-2002-010-REP, REV, 0 PAUL 43 OF 51

Figure 6 Simplified Schematic of ESW Systems North Lake Michigan WMO 706 WVMO 707 NTS-2002-010-REP, REV. 0 PAGE 44 OF 51

S01 1LOOP UK S02 1LOOP-DEB OK 1.000.000 53 1LOOP -DEBIN OK S04 1LOOP0DEB-IN-DMG OK 1.01-001 SOS ILOOP-DEB-IN DMG-BY OK SOC 1LOOP-DEB-IN-DMG-BY-lC OK 0 000-001 2.5E-O01 071 1LOOP-D0ECIN-DMG-BY-1C-1N l.CD 001-CO 5.40E-002 S08 1LOOP-DEB-IN-DMG-BY-lA OK I 5.40E-002 S09 iLOOP-DEB-1N-0MG-BY-lA-iNR lAB 8.81E-0OS 1000002.5E-001 S10 ILOOP-DEB-IN-DMG-BY-iA IC OK 2,50E-001]

t -- - Il511 1LOOP-DE -IN-DMG-BY-1A-.I NI L' 294N0-005 5.40E-002 S12 1LOOP-DEB-IN-DMG-HI OK S13 iLOOP-DEBC1N-DMG-HI-BY OK 1.490 001 S14 1LOOP-DEB-IN-DMG-HI-BY-iC OK S1S iLOOP-DEB-IN-DMGHI-BY-iC-iNR lCD 1.470004 5.40E-002 S16 1LOOPOE0B-IN-DMG-HI-BY1A OK S17 iLOOP-DEB-IN-DMG-HI-BY-1A-NR lAB 1.47E-004 5.40E.002 S18 1LOOP-DEB00N-DMG-H1-BY lA-iC OK 2.50E-001 519 1LOOP DEG-BIC-MG-HI-BY-iA- 1C-1NU1 4090005 IlAepngg29,ENSAPPRAFilesýILOOP.EVT 041271200216:08:14 WinNUPRA2.1 L

Quantifical'cn lat,: 041271,2002150032 TOTAL CMF 5.49E0-04 Licensed to: C COOK Figure 7 - EDG Conditional Failure Probability Event Tree for Unit 1 LOOP NTS-2002-010-REP, REV. 0 PAGE 45 C)F 51

Unit 2 EUent Debris Damaged 1E ESW Debris Insignificani Clng Flo, Clog Flow Operators ClngFow Clg ngFow Operators S p Loss of Fails To Settles Strainer Low Flow Does Not U1 To U2 Degradtn Degradon Perform Degradtn Degradtn Perform E D Offsite Place Before Basket Is Conditions Bypass Crosstie Does Not Does Not U1 EDG Does Not Does Not U2 EDG Q S Flow Impact Impact Restoration Impact Impact Restoration # SEQUENCE DESCRIPTOR # FREQUENCY Power Debris In ESW Not In Use Strainer Suspension Ingestion EDG lAB EDG 1CD EDG 2AB EDG 2CD 2LOOP -DES -IN -DMG -HI -BY -XT -1A -1C .1NR -2A -2C -2NR

, '0 2LOOP OK

. S0; 2LOOP-DER OK 1.00E+DO0 I SO. 00 1.03E-001 2LOOP-DEB.INoDMG

. Sb. OK 9.90E-001 2LOOP-DEB-IN-DMG-HI OK 1.OOEoUOOO SOB 2LOOP-DER-IN DMG-HI-BY OK 1.49E-o01 SO7 2LOOP-DEBIN-DMG-H IBY XT OK 9.5OE-00t SOO 2LOOP-DEB-N-D00G-HI-BY-XT-2C OK0 SO9I 2LOOP-DEB-IN-DMG-Hi-BY-XT2C-20, 3.66E-005 0400 002 2.500E001 S101 2LOOP-DEB-IN-DMG.HI-BY-XT-2A OK 400 002 b1I 2LOOP-DEB-IN.DMG-HI-BY.XT-2A-2NI2AR 3.66E005U 2 500 001 S12 2LOOP-DEB-IN-DMG-HIBY-XT-2A.2C 0 2.50E-001 S1312LOOP-DEB IN-D0G-HH-iY-XT.2A-2CL 2 12EOOUS 5 40E-002 lIAepngg2HtENSA\PRAFiles2LOOP EVT 0412712002 16:12:05 WinNUPRA 2.1 Quantification Date: 04/2i12002 15:14:07 TOTAL CMF - 854E-0005 Licensed to: DC COOK Figure 8 - EDG Conditional Failure Probability Event Tree for Unit 2 LOOP NTS-2002-010-REP, REV 0 PAGE 46 OF 51

Dual Unit Event Debris Damaged CEESW Debris nsigniticant Clng Flow Clng Flow Operators CIngFlow Clng .Flw Operaters P LosS of Fails To Settles Strainer Low Flow Does Not Ul To U2 Degradtn Degradm Perform Degrader Degrader Perform D Offst Place Before Basket Is Conditions Bypass Crosstie Does Not Does Not U1 EDG Does Not Does Not U2 EDG QI P=wer Debris In ESW Not In Use Strainer Flow Impact Impact Restoralion Impact Impact Restoration SEQUENCE DESCRIPTOR FREQUENCY Suspension Ingestion I EDG CAB EDG lCD EDG 2AB EDG 2CD DLOOP -DEB IN -DMG -HI -BY -XT -lA -1C -1NR -2A -2C -2NR SO1 DLOOP OK S02 DLOOP-DEB OK 1 -EBS03 DLOOP-DEB-IN OK S04 DLOOPCDEB-IN-DMG OK 1.69E-002 S0 DLOOP-DEB-IN-DMGBY OK eSg DLOOC-DEB-IN-DMG-BY-lC OK 1.30E-001 SO7 DLOOP-DEB-IN-DMGBY-1C-INR l1D 2.99E-005 9.9E-001 1e0E-001 S08 DLOOP-DEB-IN-DMGOBY 1A Ox S09 DLOOP-DIEB-IN-DMGBY-lA-1NR lAB 2.99E-005 2.50E 1 O Ibig $10 DLOCPDE8-IN-DMG0BY-1A-iC 0K S1? DLOOP-DES-IN-DMG-BY1A 10C-CNR Ul 9.97E-006 S1 ODLOOP-DEB-IN.DMG-I-IYl OK E-B1 571 DLOOPCDEN-IN-DMG-HI-NY OK bid1 BLOCP-BED-IN-DMG-HIl-.Y-l. K1 2ib0E-O0 ELOOP-DEB- N DMG-HI-BY-1C-1NR CO B 3.73E-005

__ 1.30E-001 S BLOOP DEB IN DMG HI-BY-tA OK CC DLO0P-DEB-IN.DMG-HI-BY-CA-tONR 1 3.73E<}0 2.50E-01 IbigOLOPDE DLOOP-DEB-IN I DMG-HI-BYA-UT D0.I3Y0AE01..CO4En1 OK 2.50E-001 1 i BLOOP-DEB-IN-DMG-HI-BY-1A-lC1 U 1.24EO005 1.3lE-E01 S20 DLOCPDEB-INBDMG-HI-BY-XT OK 1.50Eý001 121 LOOP-DEB-IN-.MG3-Il-BY-.T-2C S22 DLOOP-DEB-IN-DMG-HI-BY-XT-2C-2N 2D 7.OE-OD6 1.30E-CD1 2 DLOOP-DEB-IN-DMG-HI-BY-XT-2A 2E 7.1E0C06 100 DLOOP-DEB-IN-DMG-HI-BY-XT-2A-2N 2,50E001 DLOCP-DEB-IN-DMG-HI-BY-XT-2A-2COK 2 S.E-O0i S2C DLOOP-DEB-IN-DMG-HI.BY-XT-lO-2A2( 2.33E-O06 1.30E-(}0 12g LOOP-DEB-IN-DM0GHIBYY-XT CE 2.5E_-O,1.0E01 S29 DLOOP-DEB-IN-DMG -HI-BY-XT-1C-C2CD 2

S31 DLOOP-DEBIlN-DM0-HI.BY-XT-lC-2C .3-0 bOO DLOOP-DEB-IN-DMGHI-BYXT01C02A 1DO D3LOP-DEB-IN-DMG0HI-BY-XT-OC-2AU 2 0OE-0UO 2,50E-0S1 DLOOP-DEB-IN-DMGHI BY XT-1C CA 2.0E013051 533 DLOOPCDEB- IN-DM G-HI-BY .XTolC t 2At 6 76E-,07 S34 DLOOP-DEB IN DMGHI BYXT-l-C-N CO 7.2OE-006 SAD DLOOP-DEB-INSDMG-HI-BY.XT-t-C 1C-U 2.03E-006 215DE001 D50LOOP-DEB-I-1MGHIG-U.XT-tOCON02 1.E- 00 13010 0015 DLOOP-DEB-IN-ODMG-HI -BYXT-C1N C 2.03-906 2 DLOCP-DEB-IN-DMG-HI-BY T-1C-1N O 3.03E-007 2.50E-001 D 3 DLOOP DEB-IN-DMG-HI-BY-XT-ICA0N 2GB 6.76E-O07 lC CN 2 1.01E-007 1.30E-001 IS DLOCP-DEB-IN-DMG-HI-BY-XTO 040 DLOOP-DEB-IN-DMG-.HIBY-XT-UA 2D DLOOP-DEB-INB-DG-HI-BY-XT-lA-2Ot 2 ZOEDO50DLCODODEBIN DM0-HI g 00-2BY*XTDDE-.2C DLCC?-DEB-IN-DMG-HI-BY00-OH-2C CB b.0EOOg{ 0-0

2. 10E-0101S4 DLOOP-DEB-IN-DM-GHI-BY-XTD-AA 1 2C D2 C.0DE-0 S4b DLOOP-DEBDIN-DMG HI-BYXT-1A-CO CK DLOOP-DEB-IN-DMGHI-BY-XT-lA-CN CE S4DbODLOOP-DEB-IN-DMG-HI-CY*UT-tA-ONA- .0E-005 0DOUD 2.000-Dot bOOE-OlOLOOP-DEB- N-DM0-HI-DY-DO-CA-ONoe2OEAD 50 DLOOP-DEB-IN-DMG0HI-BY-XT-lA-1N 12 .O3E-.00 13011-001 1.30E.001 S51DOLOOP-DEB+INDMG-HI-BY-XT-lA-N 2.03E-006 C 2

-BY-XT-1A °N D03E-007 1 DLOOP-DEB-IN DMG-DHI 1.30E-001 21E00 0 D IIDLOOP-DE DLOOP-DEB-lN-.M1G-HI BY-XT-1A-1 B-IN-DMGC-HI-BY-XTIA-lC C 00CK O E°O7 2 ý()l ýýl S060 DOCO?DODIS DM0-HI-BY-OrlA1 00 tO76CE S bD7 2 DLOOP-DEB-IN.DMG-HI-BY0XT-1A-U C CD 606E000 LODE.00 1.D E00 SD1DC?

SD? DLCO? DDEBIS E3l0E-01-00000t1 DM0 HI BY-UT-lAlCO DO 2 6OE-0 2201E007 SD5 DLCCP-DED-lN-DMGH100 CAto so 2 33E DO SDD DLOOP-DEBDIN-DMG-HI BY XT-1A-IL CA 1.00 S2DLOOP-DEB-IN-DM.G-HI-BY-XTolA-1C U .3 20E_E-160 DLOOP-DEB-IN-DMG-HI.BY-XTC1A-1CO .

S DC BLOC? BE IN- 01 0 II-BY-OT C 00 LI??E000 0000E.0-0 1.30E-001 Cb T 00 Qur DLOOPaDEBDaN-D2MG-HI-0Y-00Tb1A-1C (0 (O S7 DLOOP.D EB-IN*DMG-HI.BY-XT- A-1C U 2.25E-007 1.30E-i01 Figure01 9 Ev n Tre E orDL 6 DLCOPiDEBa NFDMGlHr BYaXT-iA-1C 21.30E-001 DLOOP-DREBEVN.DMG-HPABYGXT-1A-1C 2.25E-007 NTS-20.2- 1 2.50E*001 S68 DLOOP-DEB.IN_-DMIG-_HJBY*XT1AM 1 2 3.37E*008 LýAepngg29ENSAkPRA FilestDLOOP.EVT O411712OO 16:15:10 Wi*nNUPRA2.1 Quantification Date: 0412712002 14:57:20 TOTAL CNIF= 2.13E,004 Licensed to: DC COOK Figure 9 - EDG Conditional Failure Probability Event Tree for DLOOP NTS-2002-OIO-REP, REV. 0 PAGE 47 OF 51

0 1 4 5 EDG lAB FAILS DUE TO DEBRIS IN ESW EDG FAILURES DUE TO DEBRIS DEB, 1 IN ESSENTIAL SERVICE WATER GDEBI00 Analyst: RFS Creation Date: 04-16-2002 Revision: 04-22-2002 DEB.LGC(Rev 11)WVnNUPRA 2.1 EDG lAB FAILS DUE EDG lAB FAILS DUE TO DEBRIS N ESW TO DEBRIS IN ESW DURING DUAL LOSP DURING Ul LOSP GDEB110 GDEBI14 EDG lAB FAILURES SET TO TRUE FOR EDG lAB FAILURES I SET TO TRUE DUE TO ESW DEBRIS FOR DUAL UNIT DUE TO ESW DEBRIS SINGLE UNIT LOSP LOSP DURING DUAL LOSP (UNIT 11 DURING UI LOSP 2

XHOS-LOSP-U1 GDEB125 XHOS-LosP-DUAL GDEB121 E.Oe+-eDSS 6 0.00e+000 6 ESW DEBRIS FAILURE EDG lAB FAILS EDG lAB FAILS ESW DEBRIS FAILURE ESW DEBRIS FAILURE ESW DEBRIS FAILURE DURING DLOSP DURING DLOSP DURING DLOSP DURING U1 LOSP DURING UI LOSP DURING DLOSP FOR ALL FOUR EDGS WITH ONE OTHER EDG WITH TWO OTHER EDGS FOR EDG 1AB FOR BOTH EDGS FOR EDG lAB 3

DEBD-1AB DEBD-FOUR-EDGS GDEEI32 SGDEB133 DEBI-IAB DEB1-BOTH-EDGS 3.37e-008 3 2.35e-004 3 1 7.82.e-05 3 7.9e)-05D 3 ESW DEBRIS FAILURE ESW DEBRIS FAILURE ESW DEBRIS FAILURE ESW DEBRIS FAILURE ESW DEBRIS FAILURE ESW DEBRIS FAILURE DURING DLOSP - EDGS DURING OLOSP - EDGS DURING DLOSP - EDGS DURING DLOSP - EDGS DURING DLOSP -EDGS DURING DLOSP - EDGS lAB AND 1CD lAB AND 2AB lAB AND 2CD lAB AND 1CD AND 2AB lAB AND 1CD AND 2CD lAB AND ZAB AND 2CD 4

DEBD-IAB-2AB DEBD-1AB-2CD DEBD-1AB-1CD-2AB DEBD-lAB-ICD-2CD DEBD-1AB-2A3-2CD DEBD-1AB-1CD 3.03e-007 3 3.03e-007  ; 3 1 .le-007 3 101e-007 3 1.01c-0D7 3 2.63e-005 3 Figure 1Oa - EDG 1 AB Fault Tree Modification for ESW Debris Intrusion C

NTS-2002-010-REP, REV. 0 PAGE 48 OF 51

0 I 4 5 EDG 1CD FAILS DUE EDG FAILURES DUE TO DEBRIS TO DEBRIS IN ESW D 2 IN ESSENTIAL SERVICE WATER GDEB200 Analyst RES Creation Date: 04-16-2002 Revisaon: 04-22-2002 DEB.LGC (Rev. 11) WInNUPRA 2.1 EDG 1CD FAILS DUE EDG lCD FAILS DUE TO DEBRIS IN ESW TO DEBRIS IN ESW DURING DUAL LOSP DURING UI LOSP GDEB210 GDEB214 SET TO TRUE EDG 1CD FAILURES SET TO TRUE FOR EDG 1CD FAILURES FOR DUAL UNIT DUE TO ESW DEBRIS SINGLE UNIT LOSP DUE TO ESW DEBRIS LOSP DURING DUAL LOSP (UNITI) DURING Ul LOSP 2 XHOS-LOSP-JUI GDEB225 XHOS-LOSP-DUAL S GDEB221 0.00e+ 00 0 1 6 0.0e+S000 B ESW DEBRIS FAILURE ESW DEBRIS FAILURE EDG 1C0 FAILS EDG 1CD FAILS ESW DEBRIS FAILURE "EsW DEBRIS FAILURE DURING Ul LOSP DURING DLOSP DURING DLOSP DURING DLOSP DURING DLOOP DURING Ul LOSP FOR EDG lCD FOR ALL FOUR EDGS 1 WITH ONE OTHER EDG WITH TWO OTHER EDGS FOR EDG 1CD FOR BOTH EDGS 3

DEBD-FOUR-EDGS GDEB232 GDEB233 DEBl-lOD DEB1 -BOTH-EDGS DEBD-1CD 3.37e-O"B 3 2.35e-004 3 7.82e-S05 3 7.90e-005 3 ESW DEBRIS FAILURE ESW DEBRIS FAILURE ESW DEBRIS FAILURE ESW DEBRIS FAILURE EsW DEBRIS FAILURE EsW DEBRIS FAILURE DURING DLOSP - EGGS DURING DLOSP - EBGS DURING DLOSP - EDGS DURING DLOSP - EDGS DURING DLOSP - EOGS DURING DLOSP - EDGS lAB AND 10D 1CD AND 2AB 1 CD AND 2CD lAB AND 1CD AND 2AB lAB AND 1CD AND 2CD 1eD AND 2AB AND 2CD 4

DEBD-ICD-1AB DEBD-1CD-2CD DEBD-lAB-ICD-2AB DEBD-IAB-ICD-2CD DEBD-1CD-2AB-2CD DEBD-lAB-1CD 3.03e-007 3 3.03e-007 , 3 1.01e-007 3 I.0le-OD7 3 1.01e-007 3 2.63e-005 3 B Figure 1 Ob - EDG 1 CD Fault Tree Modification for ESW Debris Intrusion C

NTS-2002-010-REP, REV. 0 PAGE 49 OF 51

0 1 2 5 EDG ZAB FAILS DUE TO DEBRIS IN ESW EDG FAILURES DUE TO DEBRIS DEB, 3 IN ESSENTIAL SERVICE WATER GDEB309 Analyst: RFS Creation Date: 04-16-2002 Revision: 04-22-2002 DEB.LGC (Rev. 11) WnNUPRA 2.1 EDG ?AB FAILS DUE EDG 2AB FAILS DUE TO DEBRIS IN ESW TO DEBRIS IN ESW DURING DUAL LOP DURING U2 LOSP GDEB310 GDEB314 SET TO TRUE EDG 2AB FAILURES SET TO TRUE FOR EDG 2AB FAILURES FOR DUAL UNIT DUE TO ESW DEBRIS SINGLE UNIT LOSP DUE TO ESW DEBRIS LOSP DURING DUAL LOSP (UNIT 21 DURING U2 L0SP 2

GDEB321 XHOS-LOSP-U2 GDEB325 XHOS-LOSF-DUAL 0.S 0e+000 S O.S0e+5O5 6 ESW DEBRIS FAILURE ESW DEBRIS FAILURE EDG SAB FAILS EDOG2AB FAILS ESW DEERIS FAILURE ESW DEBRIS FAILURE DURING OLOSP DURING DLOSP DURING DLOSP DURING DLOSP DURING U2 LOSp DURING U2 LOSP FOR EDG 2AB FOR ALL FOUR EDGS WiTH ONE OTHER EDG WITH TWO OTHER EDGS FOR EDG 2AB FOR BOTH EDGS 3

i DEBD-2AB DEBD-FOUR-EDGS GDEB332 GDEB333 DEB2-2AB DEB2-BOTH-EDGS 1 17-e-05 3 3.37e-008 3 3.66"e-05 3 1.22e-005 3 ESW DEBRIS FAILURE ESW DEBRIS FAILURE ESW DEBRIS FAILURE ESW DEBRIS FAILURE ESW DEBRIS FAILURE ESW DEBRIS FAILURE DURING DLOSP - EDGS DURING DLOSP - EDGS DURING DLOSP -EDGS DURING DLOSP - EDGS DURING DLOSP - EDGS DURING DLOSP - EDGS 1AB AND 2AB 1CD AND 2AB 2AB AND 2CD lAB AND 1 CD AND 2AB lAB AND ZAB AND 2CD 1CD AND 2AB AND 2CD 4

DEBD-1AB-2AB DEBD-iCD-2AB DEBD-2AB-2CD DEBD-1AB-iCD-2AB DEBD-IAB-2AB-2CD DEBD-1CD-0AB-2CD 3.03e-"07 3 3.03e-007 I 3 3.9le-SD6 3 1.01e-007 1 3 1.01e4-07 1.01e-007 3 Figure 1Oc - EDG 2 AB Fault Tree Modification for ESW Debris Intrusion C

NTS-2002-010-REP, REV. 0 PAGE 50 OF 51

0 2 3 5 EDG 2COD FAILS DUE EDG FAILURES DUE TO DEBRIS TO DEBRIS IN ESW DEB, 4 IN ESSENTIAL SERVICE WATER GDEB400 Revision: 04-22-2002 Analyst: RFS Creation Date 04-16-2002 DEB.LGC(Rev 11)VInNUPRA2,1 EDG 2CD FAILS DUE EDG 2CD FALLSDUE TO DEBRIS IN ESW TO DEBRIS IN ESW DURING U2 LOSP DURING DUAL LOSP GDEB414 GDEB410 EDG 2CD FAILURES SET TO TRUE FOR EDO SOD FAILURES SET TO TRUE DUE TO ESW DEBRIS SINGLE UNIT LOSP DUE TO ESW DEBRIS FOR DUAL UNIT DURING DUAL LOSP (UNIT 2) DURING U2 LOSP XHOS-LOSP-U2 GDEB425 XHOS-LOsPE-UAL GDEB421 0.00e000 6 0.00e+000 B ESW DEBRIS FAILURE ESW DEBRIS FAILURE EDG 2CD FAILS EDG 2C0 FAILS "EESW DEBRIS FAILURE ESW DEBRIS FAILURE DURING U2 LOSP DURING DLOSP DURING DLOSP DURING DLOSP DURING U2 LOSP DURING DLOSP WITH ONE OTHER EDOG WITH TWO OTHER EDGE FOR EDOG 2CD FOR BOTH EDGS FOR EDG 2CO FOR ALL FOUR EDGE 3 DEB2-2CD DEB2-BOTH-EDGS DEBD-2CD DEBD-FOUR-EDGS ODEB5432 GDEB433 3,66e.-5S *3 1.22e-05 3 1.17e-005 3 3.37e-B08 3 ESW DEBRIS FAILURE EESWDEBRIS FAILURE ESW DEBRIS FAILURE ESW DEBRIS FAILURE ESW DEBRIS FAILURE ESW DEBRIS FAILURE DURING DLOSP - EDGS DURING DLOSP - EDGE DURING DLOSP - EDGE DURING DLOSP - EDGE DURING DLOSP - EDGE DURING DLOSP - EDGe 2AB AND 2CD lAB AND 1CDAND 2CD lAB AND 2AB AND 2CD 1CD AND 2AB AND 2CD lAB AND 2C0 ICD AND 2CD DEBD-1 CD-2CD DEBD-2AB-2CD DEBD-1AB-1CD-2CD DEBD-1AB-ZAB-2CD DEBD-lCD-2AB-2CD DEBD-1AB-2CD 3.91e-. 0 3 i.Dle-007 3 1.01e-007 3 1.01e-007 3 3.03e-007  :' 3 3.03e-007 3 A

B Figure 1Od - EDG 2 CD Fault Tree Modification for ESW Debris Intrusion C

NTS-2002-010-REP, REV. 0 PAGE 51 OF 51

ATTACHMENT 2 TO AEP:NRC:2609-01 NTS-2002-023-REP, Revision 0 Debris Intrusion into the Essential Service Water System Reassessment of Probabilistic Evaluation, July 2002

Debris Intrusion into the Essential Service Water System Reassessment of Probabilistic Evaluation July 2002 Donald C. Cook Nuclear Plant NTS-2002-023-REP, Rev. 0 Prepared by:

0. R. Hafer', Date 7 C

'7TT. Hawley Date Contributors: P. B. Cowan A. Feliciano W. J. Miller R. F. Sartor M. K. Scarpe Reviewed by:

Approved by:

Table of Contents Ab stra ct .......................................................................................................................................................... 3 Introduction and Purpose .............................................................................................................................. 3 Differences Between AEP and NRC Significance Determ ination ....................................................... 4 AEP Approach ....................................................................................... 4 NRC Approach ....................................................................................... 5 Reassessm ent of Event Probability ........................................................................................................ 6 Subjective Probability Scale .................................................................... 6 Block 1: Loss of off-site power occurs ................................................... 7 Block 2: Suspended debris is sufficient to challenge ESW system ........... 7 Block 3: Suspended debris reaches the Unit 1 East ESW pump ........... 10 Block 4: Failed strainer basket in service during the LOOP event ......... 11 Block 5: Low/high flow through 1-East ESW strainer ......................... 11 Block 6: Ingested debris bypasses Unit 1 East ESW strainer ............ 12 Block 7: Debris reaches the Unit 2 EDG coolers ................................. 14 Block 8: Cooling flow degradation impacts EDG function ................... 14 Block 9: Condition is not identified and cleared by operators ............ 15 Sum m ary of Event Probability ............................................................ 16 PRA Evaluation ........................................................................................................................................... 16 LERF-to-CDF Ratio .............................................................................. 16 Calculation of Conditional Probabilities ................................................ 18 Cook Nuclear Plant PRA Model Results .............................................. 18 Sum m ary and Conclusions ........................................................................................................................ 18 R e fe re n c e s .................................................................................................................................................. 20 F igu re s ......................................................................................................................................................... 22 PAGE2 OF 28 NTS 2002-023-REP, REV.

NTS-2002-023-REP, REV. 00 PAGE 2 OF 28

Debris Intrusion into the Essential Service Water System Reassessment of Probabilistic Evaluation - July 2002 Abstract The August 2001 essential service water debris intrusion event that restricted cooling water flow to all four emergency diesel generators at Donald C. Cook Nuclear Plant (CNP) resulted in a finding of potentially greater-than-green by the NRC Special Inspection Team. In its June 2002 inspection report, the NRC staff did not agree with certain technical arguments made in an earlier AEP probabilistic assessment report and concluded that dual-unit loss-of-offsite-power (LOOP) was the risk-dominant scenario.

The finding was preliminarily characterized as yellow.

This report identifies and explores key differences in AEP and NRC approaches, provides additional information to help resolve selected differences, and presents AEP's reassessment of the change in core damage frequency (CDF) and large early release frequency (LERF) for the dual-unit LOOP scenario. Single-unit LOOP initiators are addressed qualitatively and are shown to have little risk significance. Results of AEP's reassessment for dual-unit LOOP initiators are as follows:

Base Case ESW Debris Case Delta Unit 1 CDF 4.848E-05 4.909E-05 6.1 E-07 Unit 1 LERF 5.588E-06 5.701 E-06 1.2E-07 Unit 2 CDF 4.870E-05 4.874E-05 4E-08 Unit 2 LERF 5.589E-06 5.598E-06 9E-09 The calculated changes in CDF for both units and the change in LERF for Unit 2 are below the greater-than-green threshold. Although the change in LERF for Unit 1 is marginally above the green-to-white threshold, conservatism in the CNP probabilistic risk assessment model leads to the conclusion that overall risk significance of the damaged ESW strainer is very low and could be characterized as green. Examples of model conservatism include classification of LERF sequences, not crediting inter-unit charging system crossties, and not crediting the 69 kV alternate power supply.

Introduction and Purpose The August 2001 essential service water (ESW) debris intrusion event that restricted cooling water flow to all four emergency diesel generators (EDGs) at Donald C. Cook Nuclear Plant (CNP) Units 1 and 2 resulted in a finding of potentially greater-than-green by the NRC Special Inspection Team. AEP's post-event deterministic evaluations (Refs. 8 - 17) of equipment performance indicated that, with reasonable assurance, the EDGs could have performed their function during the August 2001 event and other similar NTS-2002-023-REP, REV. 0 PAGE 3 OF 28

debris intrusion scenarios postulated to occur following loss-of-offsite power (LOOP) events. To address uncertainties in the deterministic studies, a separate probabilistic evaluation of the impact of the failed ESW strainer on plant response following either a single-unit or dual-unit LOOP event was prepared by AEP to support the Significance Determination Process (SDP). The evaluation was documented in report NTS-2002-010 REP, Rev. 0 (Ref. 1) and supplied to the NRC staff on April 29, 2002, as part of the ongoing inspection effort. The changes in both core damage frequency (CDF) and large early release frequency (LERF) determined in that report were below the SDP greater than-green threshold, with the dominant scenario being a single-unit LOOP.

On May 17, 2002, the NRC staff completed the Special Inspection, including review of the AEP probabilistic report (Ref. 1), with a preliminary determination that the safety significance of the event was yellow. In the inspection report issued on June 10, 2002 (Ref. 2), the staff did not agree with certain technical arguments made in the AEP report and concluded that dual-unit LOOP represents the bounding scenario for risk significance.

Additional discussion of the NRC staff position was provided in a letter dated July 9, 2002 (Ref. 3), which responded to AEP's request for additional information.

To help evaluate differences in the approaches taken and the conclusions reached by AEP and the NRC staff, AEP also commissioned independent third party review of the deterministic studies, probabilistic study, and NRC inspection report. Comments from experts in the fields of probabilistic risk assessment (PRA) and applied hydraulics were factored into this reassessment.

The purposes of this report1 are to:

"* Identify and explore key differences in the evaluation approaches and application of judgement used by NRC and AEP in the significance determination of this event.

"* Provide additional/clarifying information to help resolve selected differences.

"* Present AEP's reassessment of the change in CDF and LERF for the dual-unit LOOP scenario, taking into account NRC and independent third party review comments.

Differences Between AEP and NIRC Significance Determination AEP Approach Using PRA techniques, AEP investigated the possibility of an EDG failure due to ESW debris intrusion following a LOOP initiating event (Ref. 1). Taking either single-unit or dual-unit LOOP as the initiator, a logical sequence of steps leading to EDG failure as a result of ESW debris intrusion was determined (Figure 1). A probability estimate for each of the steps in the sequence was determined. Next, the individual probabilities for Blocks 1 through 9 were combined to obtain the conditional failure probability of each sequence.

The conditional probabilities were used in the full plant PRA model (Ref. 20) to determine quantitative estimates for increases in CDF and LERF that could be associated with the assumed condition. Possible EDG failure combinations were considered in determining 1 This report is not intended to be a comprehensive, stand-alone report, but rather focuses on the reassessment of a particular scenario previously evaluated in NTS-2002-010-REP, Rev. 0. Background information and overall explanation of the methodology can be found in the original report (Ref. 1). Note that the original AEP probabilistic report, NTS-2002-01 0-REP, Rev. 0, has been reissued with Change Sheet 1; the change sheet corrects a minor typographical error and acknowledges the relationship of the original report to this reassessment report.

NTS-2002-023-REP, REV. 0 PAGE 4 OF 28

the PRA effect. The change in LERF value was determined within the framework of the CNP PRA model rather than being calculated as a constant factor of the change in CDF.

The results of AEP's original probabilistic analyses indicated a very small increase in plant risk due to the condition identified following the August 2001 event, with single-unit LOOP being the bounding initiating event. Specifically, the PRA model estimated a CDF increase of 2.8E-07/year and a LERF increase of 4.2E-08/year, indicating that the finding associated with the strainer failure and the common cause failure susceptibility is below the greater-than-green threshold for CDF and LERF increases. The implicit LERF-to-CDF ratio derived from the model results is 0.15.

NRC Approach The NRC staff concluded in Reference 2 that the overall methodology used by AEP was reasonable and that the identified steps in the sequence of events were consistent with the course of events that would be necessary for a debris intrusion event to occur.

However, the subjective probability scale used by AEP was considered weighted too heavily towards the extreme ends of 1 and 0. Use of a more continuous scale was suggested.

The NRC staff evaluated the engineering and probability information provided for each of the AEP-defined blocks and determined revised estimates for several blocks, as noted in Table 1. Specific differences in individual block probabilities are identified and discussed later in the Event Probability section below.

Table 1 - Comparison of Event Probabilities during DLOOP Event AEP NRC Event (Ref. 1) (Ref. 2)

Block 1: LOOP occurs 1.0 1.0 Block 2: Sufficient suspended debris is present 0.0189 0.5 Block 3: Suspended debris reaches ESW pump suctions 0.99 1.0 Block 4: 1E ESW damaged strainer basket is in service 0.7708 0.77 Block 5A: Flow through 1E ESW strainer is "low" 0.851 0.0 Block 5B: Flow through 1E ESW strainer is "high" 0.1490 1.0 Block 6A: Ingested debris bypasses 1E ESW strainer 0.10 1.0 Block 6B: Ingested debris bypasses 1E ESW strainer 0.95 1.0 Condition: Bypassed debris enters Unit 1 EDG coolers 1.0 1.0 Block 7: Bypassed debris reaches Unit 2 EDG coolers 0.25 0.25 0.25 0.707 Note 1 Block 8: Cooling flow degradation impacts EDG function 0.13 0.36 Note 2 Block 9: Condition is not identified/cleared by operators Note 1 - Block 8 value is a combined probability of 0.25 for failure of all four EDGs, which gives an individual EDG failure probability of ý0.25 = 0.707.

Note 2 - Block 9 value when applied on a per plant basis results in a probability of 0.13 = 0.36.

NTS-2002-023-REP, REV. 0 PAGE 5 OF 28

The NRC-revised block probability estimates were used to determine an EDG common cause failure factor (CCFF), which was calculated as the product of the values for Blocks 1 through 8. This factor was then used to modify the NRC's plant-specific SPAR model results to determine risk significance. The Block 9 probability value for failure to recover a degraded EDG was applied within the SPAR model rather than in the CCFF. The change in LERF was determined by applying a factor of 0.4 to the change in CDF.

Reassessment of Event Probability Subjective Probability Scale Where possible, event probability values used in the original AEP analysis reflected CNP and industry PRA data or were determined based on historical plant operating states during the period the damaged strainer basket was installed. In cases where the event was unique to this investigation, the results of various analyses and evaluations were used to subjectively determine the likelihood of an event happening. In the latter cases, the "original" values shown in Table 2 were used to assign a probability value based on the relative probability of occurrence.

The values in the table were developed using guidance from NUREGtCR-5424, "Eliciting and Analyzing Expert Judgement: A Practical Guide" (Ref. 19). NUREG/CR-5424 is not prescriptive in presenting subjective probability schemes, but offers several alternative approaches. The original subjective probability scale used features of a probability distribution function in combination with a rating scheme. However, the subjective probability scale used by AEP was considered by the NRC staff to be weighted too heavily towards the extreme ends of 1 and 0. AEP's independent third party PRA reviewer endorsed this concern. As a result, AEP developed a revision to the subjective probability scale, as shown in the right hand column of Table 2 that uses the same basic approach but employs a more uniform distribution function.

Table 2 - Subjective Probability Scale Relative chance of an event happening Assigned probability Original Revised "Certain" to happen 0.99 0.99 Highly likely to happen 0.95 0.90 Likely to happen 0.90 0.70 No bias in either direction 0.50 0.50 Unlikely to happen 0.10 0.30 Highly unlikely to happen 0.05 0.10 "Certain" not to happen 0.01 0.01 PAGE 6 OF 26 NTS-2002-023-REP, REv. 0C NTS-2002-023-REP, REV. PAGE 6 OF 28

Block 1: Loss of off-site power occurs For this portion of the analysis, the LOOP event is a given. Thus, both AEP and NRC took the probability of a LOOP event as 1.0. The NRC staff concluded that the risk associated with the finding was dominated by a dual-unit LOOP with the subsequent loss of all four EDGs. No other greater-than-green initiating events, scenarios, or sequences were identified (Ref. 3).

AEP previously determined that single-unit LOOP was the dominant initiator when conservatively assuming that postulated EDG failure(s) occur instantaneously. When considering, as did the NRC staff, that EDG failures resulting from debris intrusion following a single-unit LOOP would be delayed by a number of hours, AEP concluded that the change in risk associated with the single-unit LOOP case is not significant.

Consequently, consistent with the NRC approach, this reassessment focuses only on a dual-unit LOOP initiating event. Single-unit LOOP events are not given weight based on the following considerations:

"Thesequence of events for such a case is expected to be extremely slow. Following the loss of power to a single unit, the transportation and rate of accumulation of debris would be expected to be similar to the August 2001 event debris transient. This transient took many hours to develop to the point that the function of a single EDG was affected. Additional time would elapse before a second EDG would be affected.

As a result, a much longer time period would be available for off-site power recovery activities (including use of the 69 kV backup) than is assumed in the CNP PRA model and a reduced non-recovery probability would be justified.

"The slow sequence development would increase the likelihood of restoring an affected EDG. Since the initiating event would focus operator attention on the performance of the EDGs, diagnosis of the degradation of EDG cooling would occur with much more time available to restore the full EDG functionality than the human reliability analysis (HRA) assumed. This factor would reduce the likelihood that the operators would not diagnose the faulted condition. It would also increase the types of actions that could be taken to recover the EDGs, as well as the likelihood that these recovery actions would be successful.

" An aspect to the slowly developing LOOP sequence is the likelihood that plant management and other stakeholders (e.g., NRC, State of Michigan) would be engaged well before significant degradation occurred. These interactions would likely include discussion of potential contingency actions, including use of plant mitigation capabilities (e.g., the charging system inter-unit crosstie). The use of this charging crosstie is proceduralized in abnormal procedures and is included in periodic training.

Consideration of such mitigation strategies would further reduce the likelihood that the sequence progresses unsatisfactorily, although the impact of such mitigation on numerical risk estimates cannot readily be quantified.

Block 2: Suspended debris is sufficient to challenge ESW system A large difference between the NRC and AEP analyses is the treatment of the probability estimate for Block 2. AEP's original analysis decomposed this block into two main areas, specifically, factors affecting the quantity of incoming debris and factors affecting the uptake of debris already resident in the screenhouse at the time of the event (Figure 2).

PAGE! Uh 25 RE 00 NTS-2002-023-REP, REV. PAGE 7 OF-28

For the dual-unit LOOP case, it is AEP's understanding that the NRC analysis simplified the event decomposition to consider only the effect of screenhouse refilling following th-e trip of all CW pumps (Figure 2, Block 2f) and the availability of debris (Figure 2, Block 2i).

Block 2f: Screenhouse refill following loss of circulating water The NRC staff concluded that screenhouse refill following a trip of all operating CW pumps will, with certainty, i.e., a probability of 1.0, result in transient flow patterns that will entrain or suspend substantial debris in the screenhouse water. AEP's estimate for this same probability was 0.10 (unlikely). As discussed below, AEP has developed information to better assess the probability estimate for Block 2f.

Screenhouse Level Response A simplified hydraulic model was developed to predict the screenhouse level response following loss of circulating water (CW) (Ref. 4). The model was benchmarked to a 1977 test performed to ensure that the screenhouse level transient following a trip of all operating CW pumps would not cause plant flooding (Ref. 18).2 The hydraulic model was then used to determine screenhouse level response to the bounding case of tripping seven CW pumps with two intakes in service.

The model results show that in the bounding case upward vertical velocities in the screenhouse may exist for up to 135 seconds due to refill following trip of the pumps. At that time, water level is maximized and velocities in the screenhouse (with the exception of fluid entering the ESW pump suctions) are zero. After reaching maximum water level, the forebay, intake tunnels, and lake act together to form an unbalanced manometer. Since the forebay level initially overshoots the lake level, the flow in the intake tunnels reverses and the level begins to drop. The forebay level continues to oscillate in a damped manner until the level reaches equilibrium with the lake. To illustrate this effect, the actual plot of data from the 1977 test at a CW flow of 1,587,000 gpm is included as Figure 3.

Data from the screenhouse level response model was used to investigate bulk vertical velocity during the initial refill period. The highest bulk velocity value (0.20 fps) occurs about 10 seconds after the trip when the CW pumps effectively stop pumping and the level rises at its maximum rate. The bulk vertical velocity then decreases as the flow decreases, and reaches zero in about 135 seconds at the point of maximum water level.

In the bounding case where the initial refill and overshoot is about 20 feet, the average bulk velocity during the initial refill is about 0.13 fps. Velocities during subsequent oscillations are considerably lower, with the highest upward vertical velocity being about 0.04 fps.

However, as noted by the NRC staff (Ref. 3), higher-than-average velocities will exist in some areas due to localized effects. Using the NRC assumption that velocity on the downstream side of the traveling water screens may be as much as three times the bulk velocity in the screenhouse, the peak local velocity could be as high as 0.60 fps. Although such a high localized velocity difference could not be sustained for any length of time in an open pool, the factor of three will be assumed to remain constant during the initial refill cycle. A plot of bulk vertical velocity and assumed peak vertical velocity versus time for the 135-second period immediately following CW cessation is shown in Figure 4.

2 The test included tripping four, five, and six operating CV pumps with three intake tunnels inservice. Forebay level following the CW trip was measured as a function of time. The highest flow rate tested was 1,587,000 gpm.

NTS-2002-023-REP, REV. 0 PAGE 8 OF 28

Vertical Settling Velocity The previous vertical settling calculation (Ref. 10) was revised to include more realistic specific gravity values for sand and mussel shells, and the conclusions were adjusted to reflect settling behavior for applicable levels of debris concentration in the screenhouse.

Terminal settling velocities for sand and zebra mussels were recalculated to be 0.3 fps and 0.5 fps, respectively. Shape factor effects for zebra mussel shells were included in the analysis. Additional airfoil effects, if any, were not specifically addressed.

Field demonstration of vertical settling behavior for zebra mussel shells was performed to corroborate the calculated results (Ref. 5). The settling time for zebra mussel shells in a four-foot cylinder was measured at a nominal value of 8 seconds, implying an average velocity of 0.5 fps during the first four feet of travel. The results of the demonstration correlate well with the analytical results and indicate that the settling velocity calculation provides acceptable estimates of zebra mussel shell settling characteristics without additional consideration of airfoil effects.

Ability to Suspend Debris Absent sustained horizontal velocities that can move debris beds in the direction of the ESW pumps, as was the case during the August 2001 event, the vertical velocity component in the vicinity of debris piles must be higher than the settling velocity in order to take debris into temporary suspension. Based on demonstrated settling velocities (0.5 fps for mussel shells and 0.3 fps for sand particles) and conservatively assuming a peak vertical velocity in the vicinity of the ESW pumps of 0.60 fps, debris suspension could occur for a brief period. However, when the vertical velocity decays below the settling velocity, the debris begins to move downward towards the screenhouse floor. Using the velocity data from Figure 4, the expected behavior of shells and sand particles during this period is shown in Figure 5. Sand particles rise to a height of about 13 feet and settle back onto the screenhouse floor in about 150 seconds. Shells, which constitute the only credible threat to equipment served by ESW, rise to a height of just over two feet and settle back onto the screenhouse floor in about 70 seconds.

Since the ESW pumps trip at the same time as the CW pumps and are not restarted on EDG power for about 30 seconds, the total period of vulnerability to temporarily suspended mussel shells is only about 40 seconds. However, as noted above, the debris would barely be off the floor of the screenhouse during this time period. During subsequent damping oscillations, vertical velocities in the screenhouse are not sufficient to move debris off the floor.

Probability Estimate for Block 2f With the exception of using the NRC staffs judgement to conservatively quantify the peak vertical velocity component, the subjective engineering judgements previously used to support the probability estimate for Block 2f have been replaced with test data and evaluations. Based on this additional information, the transient caused by screenhouse refill following loss of CW does not constitute a credible source of temporarily suspended debris. Based on these considerations, the probability estimate for this block is selected as 0.01.

NTS-2002-023-REP, REV. 0 PAGE 9 OF 28

Block 2i - Availability of Sufficient Debris AEP provided its position that pertinent debris conditions in the screenhouse during the August 2001 event were rare, if not unique, and suggested a probability of 0.10 that sufficient debris inventory of the right type would be present in the screenhouse.

However, the NRC tied availability of debris to periodic screenhouse cleaning efforts and concluded that sufficient debris would be available half of the time (probability of 0.50).

Plant history has shown that development of a debris inventory in the screenhouse sufficient to jeopardize plant operation is a function of abnormally high influxes of debris over a short period of time rather than a function of gradual buildup since the last cleaning.

Debris intrusion events, such as the unit trip that occurred in June 2002 as a result of debris transported to a feed pump turbine condenser (Ref. 7), have been attributed to screenhouse transients following a specific period of high debris loading.

Consequently, the approach used in Reference 1 to determine the probability that sufficient debris inventory of the right type is present is considered valid. The subjective probability of "unlikely" is justified. Due to the change in the subjective probability scale in Table 2, the actual value increases from 0.10 to 0.30.

Other Components of Block 2 Blocks 2a, 2b, 2c, and 2d are not based on subjective probabilities and have not changed from the initial report (Ref. 1). Blocks 2e, 2g, and 2h used subjective probability values, and although the arguments supporting them have not changed, the subjective probability estimates are changed to reflect the revised values in Table 2. AEP's current probability estimates for each component of Block 2 are as follows:

Block 2a 0.01 Block 2b 0.00 (0.0002)

Block 2c 0.01 Block 2d 0.04 Block 2e 0.10 Block 2f 0.01 Block 2g 0.10 Block 2h 0.01 Block 21 0.30 Probability Estimate for Block 2 Combining the component probability estimates in the same manner as originally, the overall probability estimate for Block 2 is 0.04.

Block 3: Suspended debris reaches the Unit I East ESW pump Given that sufficient debris is suspended or entrained in the water of the forebay for a sustained period and the Unit 1 East ESW pump is in operation, it is nearly certain that some of the debris will reach the Unit 1 East ESW pump suction and be ingested. The NTS-2002-023-REP, REV. 0 PAGE 10 OF 28

likelihood of debris being suspended and the impact of timing have already been accounted for in the development of Block 2.

Accordingly, for purposes of this study, the probability that suspended debris reaches the ESW pump suctions will be taken as 0.99 as suggested in Table 2.

Block 4: Failed strainer basket in service during the LOOP event The ESW system strainers are of the duplex type, each consisting of two separate strainer baskets. The Unit 1 East ESW strainer had one damaged basket and one undamaged basket. The likelihood that either the failed strainer basket is in service at the start of an assumed LOOP event or would be switched into service during the event was assessed.

Based on the design and operation of the automatic ESW strainer backwash system, a time-based probability estimate was developed by AEP (Ref. 1). The NRC staff concurred with AEP's recommended value of 0.77 for dual-unit LOOP (Ref. 2).

Block 5: Low/high flow through 1-East ESW strainer Relationship of Blocks 5, 6, and 7 Conceptually, ESW system flow rate has two effects on the probability of failing an EDG due to debris ingestion during the period that the damaged 1-East ESW strainer basket was in service. First, the higher probability of carrying debris from Unit 1 to Unit 2 during periods of high ESW flow demand affects the failure potential of the Unit 2 EDGs.

Second, although damaged, the 1-East ESW strainer basket still performed a straining function and provided some measure of protection to downstream equipment.

Effectiveness of the damaged strainer is a function of flow rate.

Although not totally reflected in the title, Block 5 establishes the basis for "high" versus "low" ESW flow and splits the event tree into two paths. The low-flow path results in the damaged strainer affecting only Unit 1; the high-flow path results in the damaged strainer affecting both units. Block 6 assesses the effectiveness of the damaged strainer basket under high and low flow conditions. Block 7 assesses the physical plant configurations that can allow debris to travel from Unit 1 to Unit 2.

Development of Block 5 The Cook Plant ESW systems consist of four pumps, two in each unit. The systems are cross-tied between units such that the 1-East ESW pump can feed the 2-West ESW header and vice versa. Likewise, the 1-West ESW pump can feed the 2-East ESW header and vice versa. For convenience, a simplified schematic of the system is included as Figure 6. ESW unit crosstie valves typically remain open except during certain system testing and maintenance activities. At any given time, the direction and magnitude of flow in the unit crosstie lines depend on system alignment and ESW demand.

For the Unit 2 EDG coolers to receive flow from the 1-East ESW pump, flow through the 1-EastI2-West unit crosstie must be in the direction of Unit 2. In addition, even if flow through the crosstie is in the direction of Unit 2, the flow rate must be high enough to provide a velocity that can reasonably carry debris.

Assuming debris enters the ESW pumps and bypasses the ESW pump strainer, the potential to distribute debris throughout the system depends on the minimum velocities in NTS-2002-023-REP, REV. 0 PAGE 11 OF28

vertical and horizontal piping required to transport the debris concentration likely needed to initiate a debris layer in the EDG lube oil cooler. From Reference 4, these minimum velocities are estimated to be 800 gpm and 10,000 gpm in vertical 6-inch and 20-inch piping and 150 gpm and 3,000 gpm in horizontal 6-inch and 20-inch piping.

Consequently, if the ESW unit crosstie flow were less than approximately 3000 gpm, transport of considerable shells and similar debris between the two units would not be expected. For purposes of this evaluation, the threshold value for significant debris transport through the ESW crosstie is conservatively selected as 2500 gpm.

Major flow loads on the ESW headers during operation (non-accident and non-cooldown conditions) are the component cooling water (CCW) heat exchangers and the supplies to the EDG coolers. The ESW flow to the EDG coolers is fairly constant regardless of plant conditions. Flow from an ESW header to a CCW heat exchanger varies seasonally, but is generally less than 2000 gpm except during hot weather periods or during a unit cooldown. During the warmest part of the year, the flow may exceed 2000 gpm, but is less than 5000 gpm.

Because all ESW pumps are operating during a LOOP event, the likelihood of establishing a 2500 gpm flow in the direction of Unit 2 through the 1-East/2-West crosstie is low. The only pre-LOOP combination of in-service CCW heat exchangers with the potential to induce high flow in the 1-East/2-West ESW crosstie in the direction of Unit 2 when the 1-East pump is started is to have the West CCW heat exchanger on each unit in service.

Evaluation (Ref. 6) of this potential was performed using an existing ESW flow model.

The results of the evaluation, included as Figure 7, show that the pre-LOOP 2-West ESW pump flow rate that results in a crosstie flow of 2500 gpm following start of the standby pump is about 5900 gpm. The probability of being in the particular configuration necessary to achieve the high flow through the 1-East/2-West crosstie is taken into account later in Block 7.

For conservatism, a value of 5000 gpm is selected as the threshold for "high" ESW flow.

Flows at this level or above could occur during design basis accident response, surveillance testing, unit cooldown, or operation when lake temperature is near its upper limit. The probability estimate of 0.1490 developed to represent operation during periods of high ESW flow in AEP's original probability assessment (Ref. 1) is considered valid.

Consequently, the probability estimates for Blocks 5A and 5B are taken as 0.85 and 0.15, respectively.

Block 6: Ingested debris bypasses Unit I East ESW strainer After being ingested into the 1-East ESW pump, debris will be carried into the housing of the 1-East ESW strainer. The strainer has two baskets, one that was intact over the plant's history and one that was damaged, i.e., had an approximately 3-inch gap at the top of the basket and a smaller 1.5-inch gap at the strainer basket outlet (Ref. 21). The 3-inch gap extended around the entire circumference (approximately 75 inches) of the strainer basket at its upper rim at the top of the strainer assembly. The smaller 1.5-inch gap, located approximately 12 inches below the top of the strainer assembly, extended for a length of approximately 16 inches where the outlet of the basket joins the strainer discharge piping. These gaps allowed flow to bypass the basket screen material. The bypass area in the damaged basket represented about 12% of the total screen open area.

A simplified conceptual drawing of the strainer is included as Figure 8.

In order for debris to bypass the screen and flow through the damaged areas, the flow rate must provide sufficient vertical velocity in the strainer body to overcome the settling PAGE 12 OF 28 NTS-2002-023-REP, REV.

REV. 00 NTS-2002-023-REP, PAGE 12 OF 28

velocity of the particles, thereby allowing them to flow upward to the gap areas. The vertical velocity of fluid in the strainer housing available to carry debris up and through the bypass areas can be estimated as the vertical velocity necessary to maintain the strain&

body full of water. This approach conservatively assumes that flow within the strainer body is evenly mixed.

The maximum vertical velocity of fluid in the strainer can be estimated by calculating the volume of the strainer and determining the fill time for the strainer based on ESW flow rates. Using the fill time, the maximum vertical velocity of fluid in the top of the strainer is calculated based on the height of the strainer above the strainer inlet. This value is taken as two feet based on the distance from the centerline of the inlet piping to the top of the strainer. The volume of the strainer can be approximated by a right round cylinder with a radius of 18 inches and a height of 60 inches, resulting in a volume of approximately 35 cubic feet (Refs. 22 and 23). The maximum vertical velocity of fluid in the upper portion of the strainer at various flow rates is as follows:

Flow (gpm} Velocity (fps) 2000 0.25 3000 0.38 4000 0.51 5000 0.64 6000 0.76 7000 0.89 8000 1.02 9000 1.15 The terminal settling velocity of shells fragments with dimensions typical of debris removed from the ESW system downstream of the ESW pumps following the August 2001 event was determined to be 0.76 fps using the methodology of Reference 4. This correlates well with the field demonstration (Ref. 5) of debris settling characteristics, which indicated that the settling velocity of crushed shells was approximately 0.8 fps. Based on the tabulated results above, an upward velocity of 0.76 fps corresponds to a flow rate of at least 6000 gpm. Consequently, flow through the 1-East ESW strainer must be at 6000 gpm or greater before a significant amount of debris is expected to bypass the strainer basket.

For conservatism and consistency with Block 5, a value of 5000 gpm is selected as the threshold for high flow.

Block 6A - Low flow condition If the damaged strainer basket is in service when the 1-East ESW pump flow is below 5000 gpm, debris entering the strainer is much more likely to settle in the strainer housing or be collected on the strainer basket as intended, rather than being carried to the bypass areas. To do so, the debris has to flow upward to pass over the gap at the top of the basket or around the basket and up to the smaller bypass area on the opposite side of the strainer assembly. On this basis, the debris carryover through the gaps at low flow rates is judged to be significantly less than if it were proportionate to either the area fraction or flow fraction of the gaps, and is likely not to occur at all. The substantial free volume between the strainer housing and the basket (19 to 20 cubic feet) would allow for accumulation of several cubic feet of settled debris before the vertical velocity increased to the point that PAGE 13 OF 28 NTS-2002-023-REP, REV. 0

significant carryover would occur. Due to the short nature of the debris threat following a dual-unit LOOP, excessive material accumulation in the strainer housing at low flow rates is not likely to occur.

In summary, the damaged 1-East ESW strainer is likely to be effective in removing enough debris to protect downstream equipment during the period of vulnerability following a dual-unit LOOP. Accordingly, the probability of passing sufficient debris to challenge downstream equipment with low ESW flow through the Unit 1 East ESW strainer (Block 6A) is 0.30, as suggested by the revised subjective probabilities in Table 2.

Block 6B - High flow rates At high flow rates through the strainer, the settling characteristics become less important and the debris carryover begins to approach the area fraction or flow fraction associated with the gaps. Consequently, debris carryover at high ESW pump flow is nearly certain to occur, which suggests a probability of 0.99, based on the revised values in Table 2.

Block 7: Debris reaches the Unit 2 EDG coolers The probability that debris passing the failed strainer reaches the Unit 2 EDG coolers is the product of the probability of having flow through the 1-East/2-West ESW cross tie in the direction of Unit 2 and the probability of that flow being at least 2500 gpm. However, the latter probability corresponds to the probability of having "high" ESW flow (0.15 from Block 5B above). Since this factor has already been accounted for in the logic structure of Figure 1, the value for Block 7 includes only the probability of having the CCW and ESW systems aligned in the susceptible condition. Thus, the probability value is determined to be 1/4 = 0.25. The NRC staff agreed with this value in its inspection report (Ref. 2).

Block 8: Cooling flow degradation impacts EDG function The difference in probability estimates for EDG failure between AEP and NRC is substantial. Since the case of greatest interest is loss of all four EDGs, the joint probability of failure is pertinent. AEP's selection of 0.25 for loss of a single EDG implies a joint probability of 0.254, or 0.0039, for losing all four EDGs. The NRC's assumption of 0.25 for the joint probability of losing all four EDGs is higher by a factor of 64.

In Reference 1, AEP discussed analyses, observations, and use of engineering judgment leading to selection of 0.25 as the probability that an EDG would be adversely impacted by debris to the point that it could no longer perform its function.

Additional internal review of the August 2001 event led AEP to conclude that the original estimate may be nonconservative. Although it is still believed that only one EDG, i.e.,

Unit 1 AB EDG, might have failed without operator intervention, applying this one potential failure to a base of four EDGs is not appropriate. The lesser effects observed on the Unit 2 EDGs are undoubtedly the result of less severe debris loading to the Unit 2 EDGs, a mechanistic factor that has already been taken into account in the structure of the failure sequence. Therefore, the presumed failure of one Unit 1 EDG should be applied to a base of only two EDGs, resulting in a failure probability estimate of 0.50 per EDG. This individual failure probability yields a joint probability of 0.0625 for failure of all four EDGs.

PAGE 14 0F28 NTS-2002-023-REP, REV 00 NT5-2002-023-REP, REV. PAGE 14 OF 28

Block 9: Condition is not identified and cleared by operators The Human Error Probability (HEP) values for the operating crews' responses to a dual unit LOOP event were determined using accepted HRA techniques that were applied in a scrutable, conservative manner (Ref. 26). These HEP values were then used by AEP in Reference 1 in a conservative manner.

One important area that the HRA considered was the interrelationship between the operating crews within each unit, as well as between the two units. Based on extensive interviews with operating crews, the proceduralized response to LOOP events was determined. The operating crew that would respond to a dual-unit LOOP event includes each unit's Control Room (CR) operators as well as Auxiliary Equipment Operators (AEOs) who are normally stationed in each unit's Turbine Building and Auxiliary Building.

At the onset of the event, these operators are procedurally directed to go to the EDG rooms to verify start of the machines. They would then remain in the EDG rooms to assure their continued operation. All of the AEOs would be acting independently except for communications with their unit's CR crew. The two CR crews would be in contact via phone, but would otherwise be acting independently due to the physical separation of the CRs. The HRA performed states that HEP values are applicable to both EDGs of a single unit because the Control Room crew is a common element in the recovery for both EDGs in a unit. However, given the independence between the two units, the HEP values are meant to be applied to each unit independently. This assumption of CR independence is underscored by a significant conservatism included in the HRA. Specifically, although a successful diagnosis by either unit's Control Room would be a success for both units, no credit is taken for the second, independent operating crew making such a diagnosis. Not applying the HEP value for each unit in determining the failure probability of all four EDGs is effectively not crediting either EDG in one of the units.

Another significant conservatism underlying the HRA is the representation that all four EDGs would be experiencing the same debris transient at the same time. Although the severity of the debris transient was treated as a variable to establish suitable time intervals for operator recovery actions, the August 2001 event showed significantly different fouling times among the four EDGs. The wide variation in debris fouling experienced by the EDGs is the result of the flow distribution in the ESW system and the fact that only one pump introduced debris into the system. During the August 2001 event, the Unit 2 West ESW pump was not operating. As a result, the inter-unit cross flows from the Unit 1 East ESW pump were larger than would be expected following any LOOP event (since all four pumps start following any LOOP). Nonetheless, the Unit 2 EDGs fouled at a significantly lower rate than the Unit 1 EDGs. Furthermore, following a LOOP event, the difference in rate of EDG fouling would likely be even greater between the two units since the effect of the failed Unit 1 strainer would be reduced with both Unit 2 ESW pumps operating. The HRA notes that ifonly five more minutes are available than assumed, the lower HEP value of 0.054 can be used to characterize the failure of the operators to recover an EDG.

Based on these considerations, two conclusions may be drawn. First, the HRA treatment in Reference 1 that applies the HEP value independently for each unit is appropriate, since the units and crews actually respond independently. Second, the use of the HEP value of 0.13 for each unit is conservative because no credit is taken for the longer time available for recovery action in Unit 2 due to the slower debris transient that would occur there.

PA(Th lb UI- Zb NTS-2002-023-REP, REV. 00 NTS-2002-023-REP, REV. PAGE 15 rOF 28

Summary of Event Probability The probability of occurrence of each event block in Figure 3 is summarized in Table 3 for dual-unit LOOP events. Both the original and the revised values are shown.

Table 3 - Event Probabilities during Dual-Unit LOOP Event Original Revised Event AEP AEP Block 1: LOOP occurs 1.0 1.0 Block 2: Sufficient suspended debris is present 0.0189 0.04 Block 3: Suspended debris reaches ESW pump suctions 0.99 0.99 Block 4: 1E ESW damaged strainer basket is in service 0.7708 0.7708 Block 5A: Flow through 1E ESW strainer is "low" 0.8510 0.85 Block 5B: Flow through 1E ESW strainer is "high" 0.1490 0.15 Block 6A: Ingested debris bypasses 1E ESW strainer 0.10 0.30 Block 6B: Ingested debris bypasses 1 E ESW strainer 0.95 1.0 Condition: Bypassed debris enters Unit 1 EDG coolers 1.0 1.0 Block 7: Bypassed debris reaches Unit 2 EDG coolers 0.25 0.25 Block 8: Cooling flow degradation impacts EDG function 0.25 0.50 Block 9: Condition is not identified/cleared by operators 0.13 0.13 PRA Evaluation LERF-to-CDF Ratio The LERF values provided in Reference 1 were determined using the CNP PRA model (Ref. 20). The CNP PRA LERF model was developed based on the methodology presented in NUREG/CR-6595 (Ref. 25). This methodology identifies key characteristics for core damage sequences that affect the likelihood of severe accident phenomena occurring if core melting is not arrested in-vessel. The CNP PRA LERF model conservatively neglects the possibility of arresting core melt in-vessel. As a result, all core damage sequences in the CNP PRA model are assumed to progress to reactor vessel failure, with an associated release of core debris into containment.

The probability that containment failure could occur shortly after core debris release into containment is assessed for every individual core damage sequence in the CNP PRA model using the methodology and recommended values presented in NUREG/CR-6595.

The largest probability of containment failure immediately following reactor vessel failure that is assigned in the CNP PRA model is 0.28 (obtained by combining independent phenomena probabilities). During the CNP PRA model update in which the LERF model was added, no new phenomenological studies were performed. Accordingly, the only core melt sequence information available was from the original IPE model. Due to lack of new detailed sequence timing information for events following core damage, the CNP PRA model conservatively assumed that the so-called "early" containment failure NTS-2002-023-REP, REV. 0 PAGE 16 OF 28

mechanisms would also result in an "early" release from a LERF standpoint. Assigning LERF probabilities to individual sequences results in LERF-to-CDF ratios of about 0.15 to 0.18 for LOOP-initiated events.

The CNP PRA model adopted the following definition of LERF:

"... the frequency of those accidents leading to significant, unmitigated releases from containment in a time frame prior to effective evacuation of the close-in population such that there is a potential for early health effects."

This definition is taken from Regulatory Guide 1.174, which also notes:

"Such accidents generally include unscrubbed releases associated with early isolation. This definition is consistent with accident analyses used in the safety goal screening criteria discussed in the Commission's regulatory analysis guidelines. An NRC contractor's report (NUREG/CR-6595) describes a simple screening approach for calculating LERF."

Although, CNP has conservatively applied the LERF definition in its PRA model, additional sequence timing information would allow a re-evaluation of the LERF value assignments.

The purpose of such a reevaluation would be to assure that large LERF probabilities are only assigned to a core damage sequence if the predicted "early" containment failure is also "early" in accordance with the LERF definition.

The following example provides insight into the level of conservatism implied by the current CNP PRA model approach to assigning LERF. The CNP PRA LERF Notebook includes evacuation timing estimates of less than three hours for the population within five miles of the plant and slightly longer than four hours for the population within ten miles of the plant. Since AEP does not have plant-specific detailed sequence timing following core damage based on the modern severe accident codes, such information was sought. It is noteworthy that NUREG/CR-6427 (Ref. 24) provides modern, best estimate sequence timing for a "fast" station blackout (SBO), i.e., a SBO for which the turbine-driven auxiliary feed water pump also fails. Using the information in this report, a fast SBO at CNP would lead to a general emergency declaration between 2.48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> and 3.11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br /> following the LOOP occurrence. Hot leg creep rupture would occur at 4.70 hours8.101852e-4 days <br />0.0194 hours <br />1.157407e-4 weeks <br />2.6635e-5 months <br />, thereby precluding the high pressure necessary for direct containment heating following vessel failure.

Further, the lower head failure is predicted to occur at 7.48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />, which is well after the time frame that evacuation would typically occur.

Using such information would allow the fastest SBO sequence to be removed from the LERF category of sequences for most SBO initiators. Slower developing SBO sequences would be expected to yield more favorable sequence timing than the fast SBO and likewise could be excluded from the LERF category for most SBO initiators. On the other hand, it is recognized that evacuation timing would be dependent on the circumstances resulting in the SBO initiating event, so some of these sequences would correctly be classified as LERF events. Since the net effect of these considerations would be to remove some but not all SBO sequences from the LERF category, the CNP PRA model can be concluded to be quite conservative for LERF modeling and the resulting LERF-to CDF ratio that is predicted. As a result, the use of the delta-LERF value obtained from either the CNP PRA model or by multiplying delta-CDF by 0.2 will yield a conservative estimate of delta-LERF for the purposes of significance determination.

Another noteworthy result of NUREG/CR-6427 is the recommended conditional containment failure probability of 0.82 for CNP attributed to direct containment heating. As NTS-2002-023-REP, REV. 0 PAGE 17 OF 28

described above, that report presents sequence timing for fast SBO sequences that would be applicable to CNP. These sequences progress so slowly that reactor vessel failure occurs after the close-in population evacuation is completed for most SBO sequences.

This implies that the value of 0.82 should not be used to characterize the likelihood of LERF for all SBO sequences that would be predicted to progress to core damage at Cook.

Calculation of Conditional Probabilities To calculate the conditional probabilities of all of the EDGs being plugged by ESW debris during a dual-unit LOOP, the event tree presented in Figure 9 of Reference 1 was reanalyzed with the revised AEP values. Table 4 presents the results from this reanalysis.

Cook Nuclear Plant PRA Model Results Table 4 - PRA Results Cook PRA ESW Debris Delta Note 1 Parameter (PA-01-02) Evaluation Unit 1 CDF 4.848E-05 4.909E-05 6.1 E-07 Unit 1 LERF 5.588E-06 5.701 E-06 1.2E-07 (0.2 factor used)

Unit 2 CDF 4.870E-05 4.874E-05 4E-08 Unit 2 LERF 5.589E-06 5.598E-06 9E-09 Note 1 - Delta LERF values in the table reflect the higher of either the calculated difference between model results or 0.2 times the Delta CDF.

Summary and Conclusions This report has evaluated the potential risk impact associated with the damaged ESW strainer that led to debris intrusion into the ESW system at the CNP in August 2001. The evaluations in this report supplement the deterministic analyses performed after the occurrence of the event. The deterministic analyses provide a basis for concluding that the EDGs remained available to perform their safety function throughout the event and suggest that the EDGs would have been available if needed during the period the failed strainer is believed to have existed. To supplement the deterministic analyses and to address uncertainties surrounding the nature of worst-case debris conditions, an additional probabilistic analysis of the impact of the failed ESW strainer on plant response following single-unit LOOP and dual-unit LOOP initiating events was undertaken to assess the risk associated with a damaged ESW strainer basket.

Probabilistic techniques included logically decomposing the process of EDG failure due to ESW debris intrusion into the individual events that must occur to reach that failure state and estimating probabilities for each of these events, as well as estimating the operator recovery probability. After the probabilities were determined for these individual events, they were used to determine the conditional failure probabilities for each EDG due to debris intrusion into the ESW system. These conditional failure probabilities were then inserted into the full plant PRA model to determine quantitative estimates for CDF and LERF increases that could be associated with the condition.

NTS-2002-023-REP, REV. 0 PAGE 18 OF28

The results of these probabilistic analyses indicate that the increase in plant risk due to the condition identified following the August 2001 event is very small, even with conservative (i.e., worse than expected performance) assumptions. Specifically, the PRA model estimates CDF increases of 6.1 E-07/year for Unit 1 and 4E-08/year for Unit 2, and LERF increases of 1.2E-07lyear for Unit 1 and 9E-09/year for Unit 2.

The calculated changes in CDF for both units and the change in LERF for Unit 2 are below the greater-than-green threshold. Although the change in LERF for Unit 1 is marginally above the green-to-white threshold, inherent conservatism in the Cook Plant PRA model leads to the conclusion that overall risk significance of the damaged ESW strainer is very low and reasonably could be characterized as green. Examples of model conservatism identified in the report include application of LERF sequences, not crediting inter-unit charging system crossties, and not crediting the 69 kV alternate power supply.

PAGE 19 OF 28 NTS-2002-023-REP, REV. 00 NTS-2002-023-REP, REV. PAGE 19 OF 28

References

1. AEP Report NTS-2002-010-REP, Rev. 0, CS-1, "Debris Intrusion into the Essential Service Water System - Probabilistic Evaluation, April 2002," American Electric Power, Buchanan, Michigan, April 28, 2002.

2. NRC Inspection Report 50-315/01-17(DRP); 50-316/01-17(DRP), Preliminary Yellow Finding; USNRC Region Il1,June 10, 2002.

3. NRC Response Letter re: Report 50-315/01-17(DRP); 50-316/01-17(DRP),

Preliminary Yellow Finding, USNRC Region III, July 9, 2002.

4. AEP Report NTS-2002-025-REP, Rev. 0, "Cook Screenhouse Forebay Response to Dual Unit LOOP - Potential for Debris Intrusion in ESW System,"

MPR Associates, Inc., Alexandria, Virginia, July 2002.

5. AEP Report NTS-2002-026-REP, Rev. 0, "Physical Observations of Zebra Mussel Shell Behavior in Aquatic Environment," American Electric Power, Buchanan, Michigan, July 2002.

6. AEP Design Information Transmittal, DIT-B-02497-00, "1-East/2-West ESW Header Flow Study," American Electric Power, Buchanan, Michigan, July 2002.

7. CR-02165064, Category 1 Condition Report (root cause evaluation for June 14, 2002 Unit 1 reactor trip due to debris intrusion into circulating water system),

evaluation approved July 19, 2002.

8. AEP Report NED-2001-038-REP, Rev. OA, "Debris Intrusion into the Essential Service Water System, Donald C. Cook Nuclear Plant," American Electric Power, Buchanan, Michigan, September 15, 2001.

9. AEP Report NTS-2002-002-REP, Rev. 0 (MPR-2356, Rev. 0), "D. C. Cook Nuclear Plant, ESW Debris Intrusion Event Evaluation," MPR Associates, Inc.,

Alexandria, Virginia, January 2002.

10. Reference 9, Attachment A, MPR Calculation 025-103-RCS1, Rev. 0, "Potential for Debris Ingestion/Entrainment in ESW System," MPR Associates, Inc.,

Alexandria, Virginia, January 15, 2002

11. Reference 9, Attachment B, MPR Calculation 025-103-EB1, Rev. 0, "Screenhouse CFD Flow Model and Results," MPR Associates, Inc., Alexandria, Virginia, January 15, 2002.

12. Reference 9, Attachment C, MPR Calculation 025-103-RSl, "Impact of Seismic Event on Screenhouse Debris," MPR Associates, Inc., Alexandria, Virginia, January 15, 2002.

13. Reference 9, Attachment D, MPR Calculation 025-103-AWl, "ESW EDG Loop Hydraulic Analysis," MPR Associates, Inc., Alexandria, Virginia, January 15, 2002.

14. Reference 9, Attachment E, MPR Calculation 025-103-MH-01, "EDG Heat Exchanger Heat Loads," MPR Associates, Inc., Alexandria, Virginia, January 15, 2002.

15. Reference 9, Attachment F, MPR Calculation 025-103-RCS2, "EDG Lube Oil Temperature Limits," MPR Associates, Inc., Alexandria, Virginia, January 15, 2002.

16. Reference 9, Attachment G, MPR Calculation 025-103-LS-01, "EDG Cooler Thermal Performance," MPR Associates, Inc., Alexandria, Virginia, January 16, 2002.

NTS-2002-023-REP, REV. 0 PAGE 20 OF 28

17. Reference 9, Attachment H, "August 29, 2001 ESW Flow Degradation Evaluation,"

MPR Associates, Inc., Alexandria, Virginia, January 2002.

18. AEP Memorandum, "Donald C. Cook Nuclear Plant, Circulating Water System Surge Test", June 28, 1977, J.A. Kobyra to R.W Jurgensen, D.V. Shaller, A.S.

Grimes, and J.J. Markowsky.

19. NUREG/CR-5424 and LA-1 1667-MS, "Eliciting and Analyzing Expert Judgement:

A Practical Guide," Los Alamos National Laboratory (prepared for U. S. Nuclear Regulatory Commission), January 1990.

20. AEP Calculation EVAL-PA-01 -02, "Unit 1 and Unit 2 Core Damage and Large Early Release Quantification," April 12, 2002.

21. CR-01242013, Category 1 Condition Report (root cause evaluation for August 2001 ESW debris intrusion event), evaluation approved December 27, 2001; overall closure on April 17, 2002.

22. Tate Andale, Inc. Drawing X-1 10117, "Body - 24" Type AL Strainer," September 25,1956.

23. Tate Tempco, Inc. Drawing ALR-24008, "24-inch ALR Basket Assembly,"

February 13, 1985.

24. NUREG/CR-6427 and SAND99-2253, "Assessment of DCH Issue for Plants with Ice Condenser Containments," Sandia National Laboratory (prepared for U. S.

Nuclear Regulatory Commission), April 2000.

25. NUREG/CR-6595 and BNL-NUREG-52539, "An Approach for Estimating the Frequencies of Various Containment Failure Modes and Bypass Event,"

Brookhaven National Laboratory (prepared for U. S. Nuclear Regulatory Commission), January 1999.

26. Letter 17141-0008-01, Enclosure 2, "Human Reliability Analysis of the Recovery of ESW Flow to Emergency Diesel Generators after Blockage at Cook Nuclear Plant," SCIENTECH, Gaithersburg, Maryland, January 7, 2002.

27. G. W. Govier and K. Aziz, "The Flow of Complex Mixtures in Pipes," Van Nostrand Company, 1972.

PAGE 21 OF 2B REV 00 NTS-2002-023-REP, REV. PAGE 21OF 28

Figures Figure 1 - Risk Analysis Matrix Figure 2 - Block 2 Development for Dual-Unit LOOP (AEP Original Inputs)

Figure 3- Screenhouse Level Response Testing (1977)

Figure 4 - Post Dual-Unit LOOP Screenhouse Vertical Velocity Figure 5 - Debris Lift Following Dual-Unit LOOP Figure 6 - Simplified Schematic of ESW Systems Figure 7 - ESW Unit Crosstie Flow vs. ESW Pump Flow Figure 8 - Simplified View of ESW Strainer PAGE 22 OF 2 REV. 0C NTS-2002-023-REP, REV.

NTS-2002-023-REP, PAGE 22 OF 28

Risk Analysis LO& ofoffke s owe Sspede Supededdebis deris IE SW amaedMatrix

~

occurs ES ytm ~ utos ~ a evc

]_*~~

A ~

lAB EDO functin r.1orimn -Mmviie 5A netddd8 Debrisreahes

-I Flow throgh 1E bpse1 EW Unit I ESW header ESW str.iner is highrane and EOG c°ieIs F B L A L Cooling faelow L UI I CDsEfu fin degradatin, ireact - promigU: 1 1 f~w - 1C O fit 1D ED ucin restorallon activities Cooling Ilow Unsuccess ul in A D fil dlegradation imp~act perormig Uni 1low A ED fal SC~oolIng l *grada"°n flow impac'ts

• 1nSfli CD EDO fail.

Cooingg Unit2Aflowail 7200 EDO function at..t- ctvle Figure 1 Figure 2 PAGE 23 OF 28 NTS-2002-023-REP, REV. REV. 0C PAGE 23 OF 28

00 (N

q K LU Cr, 0D

'I) t.

0)

-p E

0 0) 0D 0

00 LO r (D w

w (t)

(NJ 9)

Post Dual-Unit LOOP Screenhouse Vertical Velocity Figure 4 0.7 0.6 0.5 0.4 U-0.3 0.2 0.1 0.0 0 20 40 60 s0 100 120 140 160 Seconds Debris Lift Following Dual-Unit LOOP Figure 5 16.0 .

14.0 12.0 10.0 S8.0 20 40 60 80 100 120 140 160 Seconds PAGE 25 OF 28 REV. 0 NTS-2002-023-REP, REV, 0 PAGE 25 OF 28

Figure 6 Circulating Water Circulaling W.I.,

Discharge Discharge Tunnel Tunnel All No.-

X-Tie X-Ties X-Tie U2 East "WS sino" North Lake Michigan PAGE 26 CF 28 NTS-2002-023-REP, REV. REV. 00 PAGE 26 OF 28

ESW Pump Flow vs. Crosstie Flow (Ul to U2) Figure 7 4500 .

4000 3500 3000 2500 o When configured with both units' West CCW heat IL Sexchangers in service, a pre-LOOP ESW flow of o 2000 about 5900 gpm on the 1 E/2W ESW header P 1 results in a post-LOOP flow of 2500 gpm through the crosstie when the standby pump starts.

1500 1000 500 0

0 2000 4000 6000 80O0 10000 12000 2-West ESW Pump Flow (gpm)

PAGE 27U1- 2E NTS-2002-023-REP, REV, 00 NTS-2002-023-REP, REV. PAGE 27 OF 28

Figure 8 1.5 in Strainer Outlet ESW Strainer PAGE 28 OF 28 NTS-2002-O23-REP, REV. 0 NTS-2002-023-REP, REV. 0 PAGE 28 OF 28