ML030840341

Ti 2515/149, Mitigating Systems Performance Index Pilot Verification

ML030840341
Person / Time
Site:	Millstone, Palo Verde, Watts Bar, Hope Creek, Braidwood, Prairie Island, Surry, Limerick, South Texas, San Onofre
Issue date:	03/25/2003
From:	Office of Nuclear Reactor Regulation
To:
Wrona D J, NRR/DIPM/IIPB, 415-1924
References
TI 2515/149
Download: ML030840341 (45)

Text

TI 2515/149, Mitigating Systems Performance Index Pilot Verification Limerick Units 1 and 2 Inspection Requirements The inspectors performed Temporary Instruction (TI) 2515/149, Mitigating Systems Performance Index (MSPI) Pilot Verification, at Limerick on November 18 through 22, 2002.

The inspectors verified the MSPIs for the reactor core isolation cooling (RCIC) system and the cooling water support systems on Unit 1 and the emergency AC power system and the cooling water support systems on Unit 2. The results were as follows (paragraph numbers correspond to the inspection requirements sections of TI 2515/149).

03.02 Risk Significant Functions Exelon correctly identified the risk significant functions for the selected systems. However, the MSPI basis documentation did not include all of these functions. The inspectors noted the following specific examples.

The basis document only included the RCIC inventory control function. It did not include the decay heat removal function as required by the MSPI guidance.

The basis document for the cooling water support systems specified that the function of the emergency service water (ESW) system included cooling the residual heat removal (RHR) unit coolers and only applied to the A and B RHR pumps contrary to the MSPI guidance. Specifically, unit coolers are not within the scope of the MSPI. ESW is needed to cool the C and D RHR pumps, which are MSPI monitored components.

03.03 Success Criteria Exelon had not identified a complete list of parameter-based success criteria for the monitored systems. The inspectors noted the following specific examples.

For the emergency AC power system, the success criterion was to start and load. The parameter success criteria that would be used to determine whether or not the start and load were successful (e.g., voltage, frequency, KW loading, response time, etc.) had not been identified.

For the RCIC system, parameter success criteria had not been identified for the condensate storage tank level, and valve stroke times, etc.

In addition, some of the parameter success criteria that Exelon had identified were apparently incorrect. The inspectors noted the following specific examples.

For the ESW system, the flow rate needed to cool an emergency diesel generator (EDG) was 450 gallons per minute; however, the flow rate needed to cool an EDG could be as high as 610 gallons per minute. Therefore, a higher ESW flowrate for each EDG should have been used.

For the RCIC system, the mission time was identified as eight hours; however, the licensees probabilistic risk assessment (PRA) assumed that the RCIC system was needed for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> in some accident scenarios. Therefore, the mission time used for the MSPI should have been 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

The RCIC flow success criterion was 295 gallons per minute. This flow was based on the flow needed to mitigate a small break Loss of Coolant Accident. However, Exelon was unable to demonstrate that this was the limiting scenario for which RCIC was credited. Therefore, the flow required to mitigate other initiating events where RCIC was credited (e.g., inadvertent opening of a relief valve or an anticipated transient without scram, etc.) may be larger.

The MSPI guidance states that mission times of less than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> can be used provided that they are justified by analysis and are modeled in the PRA. The Exelon assumed a mission time of six hours for the emergency AC power system. The six-hour mission time was selected using engineering judgement accounting for competing factors, the running failure rate of the EDGs and the recovery of AC power. While there is no specified methodology for determining mission times, the American Society of Mechanical Engineers (ASME) Standard RA-S-2002, Standard for Probabilistic Risk Assessment for Nuclear Power Plant Applications, states, in part, that mission times for individual systems, structures, and components (SSCs) that function during accident sequences may be less than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> as long as an appropriate set of SSCs and operator actions are modeled to support full sequence mission time. Because there are losses of offsite power accident sequences that rely solely on the EDGs for up to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> (e.g., weather related loss of offsite power events), this standard implies that a 24-hour mission time should be used for the emergency AC power system.

There were differences between the functional success criteria for the MSPI, Exelons PRA, the NRCs Standardized Plant Analysis Risk (SPAR) model, and the NRCs significance determination process (SDP) notebook. The inspectors noted the following specific examples.

Exelons PRA did not explicitly specify functional success criteria for the emergency AC power system. Both the SPAR model and the SDP notebook assumed success given any one of four EDGs per unit performed their function. However, this did not correctly account for asymmetries in the electrical distribution system. Apparently, the emergency AC power system is successful if either the A or B EDG is available or the C or D EDG is available and the operators successfully crosstie required loads.

Exelons PRA has a dependency for successful RCIC/high pressure coolant injection (HPCI) operation on subsequent low pressure injection in an inadvertent opening of a relief valve event to fulfill the inventory control function for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. The SDP notebook logic assumed that RCIC alone would fulfill the inventory control function for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

Exelons PRA credited RCIC in some but not all anticipated transient without scram (ATWS) events; however, the SDP notebook credited RCIC in all ATWS events.

03.04 Boundary Definitions Exelon did not include all required active components for the monitored train or system in the MSPI calculation. The inspectors noted the following specific examples.

The RCIC suction valves from the condensate storage tank (CST) and the suppression pool were not included as active components. These valves should have been included because the auto-transfer from the CST to the suppression pool was needed to fulfill the RCIC function.

The RCIC minimum flow valve was not included as an active component; however, the valve opened upon the start of the pump and closed once pump discharge flow exceeded 150 gallons per minute. In the event that the valve did not close, the RCIC system would have not been able to fulfill its function. Therefore, it should have been treated as an active component. In addition, Exelons PRA did not model the RCIC minimum flow valve; consequently, Exelon did not have a Fussell-Vesely (F-V) importance measure for the valve to be used in the MSPI calculation.

The spray pond inlet valves (HV-012-032A/B/C/D) were not included as active components in the cooling water support system performance indicator; however, these valves should have been included because they were required to reposition open upon the start of the ESW or residual heat removal service water (RHRSW) systems.

Exelon incorrectly included the RHR heat exchanger RHRSW inlet and outlet isolation valves in the cooling water support system performance indicator instead of the RHR performance indicator. The MSPI guidance specifies that the last valve which connects the cooling water support system (RHRSW) to the other monitored system (RHR) is included in the other monitored system (RHR).

03.05 Train/Segment Unavailability Boundary Definition No discrepancies were noted.

03.06 Entry of Baseline Data - Planned Unavailability No discrepancies were noted.

03.07 Entry of Baseline Data - Unplanned Unavailability No discrepancies were noted.

03.08 Entry of Baseline Data - Unreliability No discrepancies were noted.

03.09 Entry of Performance Data - Unavailability Exelon made some minor data entry errors. For example, the MSPI quarterly critical hours data differed slightly from the critical hours reported in the Scrams per 7000 Critical Hours PI.

Also, the unavailability baseline data for the cooling water support system (RHRSW) was not correctly entered into the spreadsheet due to some recent changes in Exelons accounting for system unavailability.

03.10 Entry of Performance Data - Unreliability No discrepancies were noted.

03.11 MSPI Calculation The MSPI F-V coefficients were not able to be verified against Exelons PRA that was qualified for use by the staff because Exelon had not identified all of the F-V coefficients and the staff had not qualified Exelons PRA.

Incorrect F-V values were used for several components (e.g., B and D ESW pumps and B ESW loop unavailability).

Exelon did not include all of the failure modes of the super components (e.g., RCIC turbine-driven pump) in the evaluation to determine the limiting F-V/UR ratio for the super component.

For example, the RCIC pump cooling water valve (MOV-046) was included within the boundary of the RCIC turbine-driven pump. However, the valve was treated as an independent component within Exelons PRA. In accordance with the MSPI guidance, the F-V/UR ratio that is used in the MSPI calculation is the maximum F-V/UR ratio for each of the basic events that fail the train. In this particular case, the F-V/UR ratio for the valve was greater than the ratios of the basic events that had been evaluated.

The F-V coefficients for the A loop ESW pump trains were zero because of Exelons PRA truncation value, whereas the F-V coefficients for the B loop pump trains were greater than zero. This was attributable to inconsistencies with Exelons modeling of the ESW loops within their PRA.

General Comments The MSPI for the emergency AC power system required approximately 50 failures over the three-year period covered by the indicator before the Green/White threshold would have been crossed. This result was not consistent with the MSPI being capable of discerning significant departures from expected performance that warranted additional attention.

The resident inspector and the Region I Senior Reactor Analyst performed the TI 2515/149 MSPI pilot verification inspection during the week of November 18, 2002. MSPI data for the following systems were reviewed.

Unit 1:

Heat Removal System (Reactor Core Isolation Cooling System)

Cooling Water Support Systems Unit 2:

Emergency AC Power System Cooling Water Support Systems The inspectors identified a number of inconsistencies as a result of this pilot verification activity.

These items were discussed with Exelon staff and are listed below as observations per the TI 2515/149 guidance.

General The emergency AC power system MSPI currently requires approximately 50 failures over the three year period covered by the indicator before the Green/White threshold would be crossed.

This result is not consistent with the MSPI being capable of discerning significant departures from expected performance that warrant additional attention.

Risk Significant Functions The licensee correctly identified the risk significant functions for the selected systems.

However, the MSPI basis documentation did not include all of these functions. For example:

The basis document only included the reactor core isolation cooling (RCIC) inventory control function. It did not include the decay heat removal function as required by the MSPI guidance.

The basis document for the cooling water support systems specified that the function of the emergency service water (ESW) system included cooling the residual heat removal (RHR) unit coolers and only applied to the A and B RHR pumps contrary to the MSPI guidance. Specifically, unit coolers are not within the scope of the MSPI; and, ESW is needed to cool the C and D RHR pumps which are MSPI monitored components.

Success Criteria The licensee had not identified a complete list of parameter based success criteria for the monitored systems. Some specific examples included:

For the emergency AC power system, the success criteria was to start and load. The parameter success criteria that would be used to determine whether or not the start and load was successful (e.g., voltage, frequency, KW loading, response time, etc) had not been identified.

For the RCIC system, parameter success criteria had not been identified for the condensate storage tank level, and valve stroke times, etc.

In addition, some of the parameter success criteria that the licensee had identified were apparently incorrect. Some specific examples included:

For the ESW system, the flow rate needed to cool an EDG was 450 gallons per minute; however, the flow rate needed to cool an EDG could be as high as 610 gallons per minute. Therefore, a higher ESW flowrate for each EDG should have been used.

For the RCIC system, the mission time was identified as being eight hours; however, the PRA assumed that the RCIC system was needed for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> in some accident scenarios. Therefore, the mission time used for the MSPI should have been 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

The RCIC flow success criteria was 295 gallons per minute. This flow was based on the flow needed to mitigate a small break loss of coolant accident. However, the licensee was unable to demonstrate that this was the limiting scenario for which RCIC was credited. Therefore, the flow required to mitigate other initiating events where RCIC was credited (e.g., inadvertent opening of a relief valve or an anticipated transient without scram, etc,) may be larger.

The MSPI guidance states that mission times of less than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> can be used provided that they are justified by analysis and are modeled in the PRA. The licensee assumed a mission time of 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> for the emergency AC power system. The 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> mission time was selected using engineering judgement accounting for competing factors, the running failure rate of the EDGs and the recovery of AC power. While there is no specified methodology for determining mission times, the American Society of Mechanical Engineers (ASME) Standard RA-S-2002, Standard for Probabilistic Risk Assessment for Nuclear Power Plant Applications, states, in part, that mission times for individual systems, structures, and components (SSCs) that function during accident sequences may be less than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> as long as an appropriate set of SSCs and operator actions are modeled to support full sequence mission time. Because there are loss of offsite power accident sequences that rely solely on the EDGs for up to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> (e.g., weather related loss of offsite power events), this standard implies that a 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> mission time should be used for the emergency AC power system.

There were differences between the functional success criteria for the MSPI, the licensees PRA, the SPAR model, and the SDP notebook. Some specific examples included:

The licensees PRA did not explicitly specify functional success criteria for the emergency AC power system. Both the SPAR model and the SDP notebook assumed success given any one of four EDGs per unit performed their function. However, this did not correctly account for asymmetries in the electrical distribution system.

Apparently, the emergency AC power system is successful if either the A or B EDG is available or the C or D EDG is available and the operators successfully cross-tie required loads.

The licensees PRA has a dependency for successful RCIC/HPCI operation on subsequent low pressure injection in an inadvertent opening of a relief valve event to fulfill the inventory control function for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. The SDP notebook logic assumed that RCIC alone would fulfill the inventory control function for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

The licensees PRA credited RCIC in some but not all anticipated transient without scram (ATWS) events; however, the SDP notebook credited RCIC in all ATWS events.

Unreliability Boundary Definitions The licensee did not include all required active components for the monitored train or system in the MSPI calculation. Specific examples included:

The RCIC suction valves from the condensate storage tank (CST) and the suppression pool were not included as active components. These valves should have been included because the auto-transfer from the CST to the suppression pool was needed to fulfill the RCIC function.

The RCIC minimum flow valve was not included as an active component; however, the valve opened upon start of the pump and closed once pump discharge flow exceeded 150 gallons per minute. In the event that the valve did not close, the RCIC system would have not been able to fulfill its function. Therefore, it should have been treated as an active component. In addition, the licensees PRA did not model the RCIC minimum flow valve; consequently, the licensee did not have a Fussell-Vesely (F-V) importance measure for the valve to be used in the MSPI calculation.

The spray pond inlet valves (HV-012-032A/B/C/D) were not included as active components in the cooling water support system performance indicator; however, these valves should have been included because they are required to reposition open upon start of the ESW or residual heat removal service water (RHRSW) systems.

The licensee incorrectly included the RHR heat exchanger RHRSW inlet and outlet isolation valves in the cooling water support system performance indicator instead of the RHR performance indicator. The MSPI guidance specifies that the last valve which connects the cooling water support system (RHRSW) to the other monitored system (RHR) is included in the other monitored system (RHR).

Data Exelon made some minor data entry errors. For example, the MSPI quarterly critical hours data differed slightly from the critical hours reported in the Scrams per 7000 Critical Hours PI. Also, the unavailability baseline data for the cooling water support system (RHRSW) was not correctly entered into the spreadsheet due to some recent changes in Exelons accounting for system unavailability.

MSPI Calculation The MSPI F-V coefficients were not able to be verified against the licensees PRA that was qualified for use by the staff because the licensee had not identified all of the F-V coefficients and the staff had not qualified the licensees PRA.

Incorrect F-V values were used for several components (e.g., B and D ESW pumps and B ESW loop unavailability).

The licensee did not include all of the failure modes of the super components (e.g., RCIC turbine-driven pump) in the evaluation to determine the limiting F-V/UR ratio for the super component. For example, the RCIC pump cooling water valve (MOV-046) was included within the boundary of the RCIC turbine-driven pump. However, the valve was treated as an independent component within the licensees PRA. In accordance with the MSPI guidance, the F-V/UR ratio that is used in the MSPI calculation is the maximum F-V/UR ratio for each of the basic events that fail the train. In this particular case, the F-V/UR ratio for the valve was greater than the ratios of the basic events that had been evaluated.

The F-V coefficients for the A loop ESW pump trains were 0 because of the licensees PRA truncation value, whereas the F-V coefficients for the B loop pump trains were greater than 0.

This was attributable to inconsistencies with the licensees modeling of the ESW loops within their PRA.

TI 2515/149, Mitigating Systems Performance Index Pilot Verification Hope Creek Inspection Requirements The inspectors performed Temporary Instruction (TI) 2515/149, Mitigating Systems Performance Index (MSPI) Pilot Verification, at Hope Creek on November 26 through 27 and December 19, 2002. The inspectors verified the MSPIs for the high pressure coolant injection (HPCI) system and the cooling water support systems. The results were as follows (paragraph numbers correspond to the inspection requirements sections of TI 2515/149).

03.02 Risk Significant Functions No discrepancies were noted. Public Service Electric & Gas (PSEG) correctly identified the risk significant functions for the selected systems.

03.03 Success Criteria PSEG had not identified a complete list of parameter-based success criteria for the monitored systems. In the cases where PSEG had not identified success criteria, PSEG informed the inspectors that they defaulted to the design basis criteria. However, PSEG was unable to identify the design basis parameters and values during the inspection. Some examples included:

Condensate storage tank (CST) and suppression pool level and temperature bands to support successful operation of HPCI; HPCI, station service water (SSW), and safety auxiliary cooling system (SACS) valve actuation times; and SACS pump flow rates.

In addition, differences were identified among PSEGs functional success criteria for the MSPI, PSEGs probabilistic risk assessment (PRA), NRCs Standardized Plant Analysis Risk (SPAR) model, and NRCs significance determination process (SDP) notebook. The inspectors noted the following specific examples.

PSEGs PRA contained an inconsistency on the need for low pressure injection following successful HPCI operation for events that involve a stuck open relief valve.

The PRA documentation indicated that low pressure injection was needed following successful HPCI operation to satisfy the inventory control function. However, the event trees for the initiating events that involved a stuck open relief valve did not consistently require low pressure injection following successful HPCI operation. PSEG was unable to explain the inconsistent treatment of HPCI success during the inspection.

PSEGs PRA credits HPCI for level control and high pressure inventory control for anticipated transients without scram (ATWS) events, whereas the SPAR model does not.

The SPAR model specifies that in a station blackout condition, fire water injection is needed for inventory control following successful HPCI injection to extend the time available to recover AC power beyond four hours to the station battery depletion time.

However, PSEG credits HPCI as being capable of inventory control until battery depletion time without the need for fire water injection.

The HPCI discharge valve to core spray, 1BJHV-F006, and the HPCI discharge valve to main feedwater, 1BJHV-8278, are not included in the SPAR model. These valves open on an HPCI actuation signal and are active components in the HPCI MSPI. These valves are not redundant.

For successful operation of the SACS system, PSEGs PRA specifies two pumps and two heat exchangers in one loop, or one pump and two heat exchangers in one loop, and one pump and one heat exchanger in the other loop. However, the SPAR model assumes successful SACS operation with one pump and one heat exchanger in both loops.

For successful operation of the SSW system, PSEGs PRA specifies one of two pump trains in each loop. However, the SPAR model specifies two of two pump trains per loop if the loop cross-tie is closed or three of four pump trains if the cross-tie is open.

03.04 Boundary Definitions PSEG did not include all necessary active components for the monitored train or system in the MSPI calculation and incorrectly included a component in a system boundary. The inspectors noted the following specific examples.

The HPCI suction valve from the CST, 1BJHV-F004, was not included as an active component. PSEG recognized that the valve should have been an active component, but because the valve was not modeled within their PRA, they were unable to include it within the MSPI calculation. The inspectors noted that the three valve failures in this system were associated with this valve.

The HPCI minimum flow valve was not included as an active component. In the event that the valve does not close following an HPCI actuation, the HPCI system would not be able to fulfill its function. (The valve opens upon start of the pump and closes when pump discharge flow exceeds 560 gallons per minute.) Therefore, it should have been treated as an active component. In addition, PSEGs PRA did not model the HPCI minimum flow valve; consequently, PSEG did not have a Fussell-Vesely (F-V) importance measure for the valve to be used in the MSPI calculation.

PSEG incorrectly included the RHR heat exchanger SACS discharge valves, HV2512A and HV2512B, in the cooling water support system performance indicator instead of the RHR performance indicator. The MSPI guidance specifies that the last valve, which connects the cooling water support system (SACS) to the other monitored system (RHR) is included in the other monitored system (RHR).

03.05 Train/Segment Unavailability Boundary Definition PSEG did not identify the boundaries of the monitored systems in accordance with the guidance contained in Appendix A of TI 2525/149, particularly those boundaries (mechanical and electrical) associated with the MSPI active components (motor-driven pumps, turbine-driven pumps, etc... ).

03.06 Entry of Baseline Data - Planned Unavailability No discrepancies were noted.

03.07 Entry of Baseline Data - Unplanned Unavailability No discrepancies were noted.

03.08 Entry of Baseline Data - Unreliability PSEG was pooling the data (e.g., failures and demands) for like components and entering the pooled data for each individual component, thereby double counting the failures and demands.

In addition, the valve demands used in the MSPI calculation were incorrect. The original valve demand estimate was based on the number of active valves multiplied by the total number of pump demands. However, the number of valve demands was not equivalent to the number of pump demands, because each valve was not demanded every time that the pump was demanded for testing. Also, several of the active components were not included within the EPIX database. At the end of the inspection, PSEG was in the process of determining an appropriate estimate for the number of demands for the active components.

03.09 Entry of Performance Data - Unavailability No discrepancies were noted.

03.10 Entry of Performance Data - Unreliability Please refer to section 03.08 for details.

03.11 MSPI Calculation The MSPI F-V coefficients were not able to be verified against PSEGs PRA that was qualified for use by the NRC staff, because PSEG had not identified all of the F-V coefficients for the active components and the staff had not qualified the PRA.

PSEG did not include all of the failure modes of the active components (e.g., HPCI turbine-driven pump) in the evaluation to determine the limiting F-V/UR ratio for an active component.

For example, PSEG considered the HPCI turbine stop valve part of the HPCI turbine-driven pump. However, the valve was treated as an independent component that would fail the HPCI train within their PRA. In accordance with the MSPI guidance, the F-V/UR ratio that is used in the MSPI calculation should be the maximum ratio of the F-V/UR ratios for each of the basic events that fail the train. Consequently, the F-V/UR ratio for the HPCI pump used in the MSPI calculation may not have been correct.

PSEGs PRA assumed a mission time of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> for the HPCI system. However, the HPCI pumps failure-to-run basic event in the PRA model was based on a 4-hour mission time. The basic event failure probability would have been approximately a factor of six larger if it had been based upon a 24-hour mission time which would have, in turn, changed the importance measures for the HPCI pump. Consequently, the F-V/UR ratio for the HPCI pump used in the MSPI calculation may not have been correct.

PSEGs PRA model assumed that the A and B SSW pumps and the A and B SACS pumps were normally operating. Consequently, the PRA model did not contain basic events for these pump trains being unavailable or for the failure of these pumps to start in the event that the C and D pumps were operating. Also, because the model assumed that the A and B pumps were operating, the model did not contain basic events for the failure of the pump discharge valves to open. In each of these cases, PSEG used the importance measures associated with the C train as a surrogate for the A and B trains.

The inspectors noted the following minor errors in the calculations of the F-V/UA and F-V/UR ratios.

The F-V/UA ratio for the HPCI train contained a rounding error. The ratio entered into the MSPI calculation should have been 11.97 instead of 11.91.

The F-V/UR ratio for the HPCI injection valves (1BJHV-F006 and 1BJHV-8278) contained a rounding error. The ratio entered into the MSPI calculation should have been 5.22E-3 instead of 5.23E-3.

The F-V/UA ratio for the D service water pump train unavailability should have been 4.46E-1 instead of 4.53E-1.

The F-V/UA ratio for the D SACS pump train unavailability should have been 9.13E-2 instead of 9.84E-2.

PSEG used the F-V coefficients associated with the initiating event contribution for the cooling water support system pumps failing to run (e.g., SWS-MDP-FR-IA502/IB502/IC502/ID502 and SAC-MDP-FR-IA210/IB210/IC210/ID210). However, PSEG did not use the associated basic event failure probability when determining the F-V/UR ratio. Consequently, the F-V/UR ratio for these pumps used in the MSPI calculation may not have been correct.

The F-V importance value for several basic events associated with active components were below the truncation value of 1.0E-5. In these cases, PSEG used a default value of 1.0E-5.

General Observations While conducting the TI, the inspectors made the following general observations.

The MSPI for the HPCI and reactor core isolation cooling (RCIC) systems were invalid (one failure would result in the MSPI crossing a threshold, i.e., a false positive indication).

The emergency AC power system, the residual heat removal (RHR) system, and the cooling water support system MSPIs needed a large number of failures for the indexes to cross the Green/White threshold. For example, approximately 20 failures of the diesel generators to start or 10 failures to run, would be necessary over the three-year period covered by the indicator before the Green/White threshold would be crossed. In addition, a large number of unavailability hours would be necessary before the indexes would cross the Green/White threshold. For example, if an additional 2200 hours0.0255 days <br />0.611 hours <br />0.00364 weeks <br />8.371e-4 months <br /> of unavailability per diesel generator were added to the emergency AC power MSPI, the Green/White threshold would still not have been crossed for this indicator. These results did not appear to be consistent with the MSPI being capable of discerning significant adverse departures from expected performance (i.e., false negative indications).

The inspectors noted that the frequency of false positive and false negative indications will be evaluated following completion of the MSPI pilot.

TI 2515/149, Mitigating Systems Performance Index Pilot Verification Millstone 2/3 Inspection Requirements The inspectors performed Temporary Instruction (TI) 2515/149, Mitigating Systems Performance Index (MSPI) Pilot Verification, at Millstone on November 4 through 8, 2002. The inspectors verified the MSPIs for the residual heat removal (RHR) system and the cooling water support systems on Unit 1 and the high pressure safety injection (HPSI) system and the cooling water support systems on Unit 2. The results were as follows (paragraph numbers correspond to the inspection requirements sections of TI 2515/149).

03.02 Risk Significant Functions The licensee did not include all of the functions modeled in their probabilistic risk assessment (PRA) in the appropriate MSPI. The inspectors noted the following specific examples.

(Unit 2) The licensee credited low pressure safety injection, long term heat removal using shutdown cooling, boron precipitation control, and containment heat removal functions for accomplishing the inventory control and decay heat removal functions within their PRA. However, they only included the containment heat removal function and the associated active components within the scope of the MSPI. Consequently, the system boundary and the list of active components was incomplete.

(Unit 3) The licensee credited high pressure injection, high pressure recirculation, reactor coolant pump seal injection, and emergency boration functions within their PRA.

However, they did not include the high pressure recirculation and reactor coolant pump seal injection functions within the scope of the MSPI. The inspectors concluded that the rationale for including the emergency boration function and not the reactor coolant pump seal injection function was inconsistent.

03.03 Success Criteria The licensee identified functional-based success criteria versus parameter-based success criteria for the active components as specified in Attachment A to TI 2515/149. Some of the functional success criteria identified for the MSPI were inconsistent with the licensees PRA.

The inspectors noted the following specific examples.

(Unit 2) The reactor building component cooling water MSPI criteria did not include the isolation of the spent fuel pool heat exchangers and the 2RB210 degassifier, consistent with the PRA.

(Unit 3) The MSPI criteria for the high pressure injection function of the high pressure injection system specified 1 of 2 high pressure safety injection pumps taking suction from the RWST and injecting into 3 of 3 intact cold legs. However, the PRA specifies that 2 of 4 safety injection/charging pumps injecting from the RWST to 3 of 3 intact cold legs were needed to fulfill this function.

There were differences between the functional success criteria for the MSPI, the licensees PRA, the NRCs Standardized Plant Analysis Risk (SPAR) model and the NRCs significance determination process (SDP) notebook. The inspectors noted the following specific examples.

(Unit 3) The SPAR model did not model the charging pump cooling (CCE) and the safety injection cooling (CCI) closed cooling water systems. The SPAR model incorrectly shows the charging systems and safety injection systems as being directly cooled by the service water systems.

(Unit 2) The SDP notebook did not model low pressure injection for all of the initiating events for which it was credited in the SPAR model and the licensee PRA.

(Unit 2) The SDP notebook did not model using shutdown cooling for long term heat removal.

03.04 Boundary Definitions The licensee identified components as being active contrary to the guidance in Attachment A of TI 2515/149. This resulted in monitoring system components that were not required to function to meet the monitored system safety function. The inspectors noted the following specific examples.

(Unit 3) Containment isolation valves for reactor coolant pump seal injection and chemical and volume control letdown were included as active components even though these components did not affect the HPSI functions.

(Unit 3) Charging pump recirculation valves were included as active components even though these valves appeared to meet the redundancy guidance in Attachment B (p. F-9) of TI 2515/149.

(Unit 3) Active components in the boric acid storage tank flow path were included in the HPSI boundary but not in the NEI data sheets. It was not clear why this flow path was included given the HPSI injection/recirculation function. If it was included for a boron injection function for reactivity control (e.g., anticipated transient without scram), then the components were not included in the NEI data sheets. If the flow path did not belong because it did not contribute to the injection or recirculation function, then it should not have been identified in the HPSI boundary.

(Unit 3) Reactor plant component cooling water (RPCCW) CCE valves (AOV 30A/B and AOV 26A/B) were included as active components even though these valves appeared to meet the redundancy guidance in Attachment B (p. F-9) of TI 2515/149.

(Unit 3) Valves (MOV-54A/B/C/D) to containment recirculation coolers were included in the service water boundary as active components. However, Attachment A of TI 2515/149 states, The function of the cooling water support system is to provide direct cooling of the components in the other monitored systems. It does not include indirect cooling provided by room coolers or other HVAC features. It was not clear how isolation valves to containment recirculation coolers affected any of the functions for the monitored systems.

The licensee did not include all active components identified for the monitored train or system in the site-specific NEI spreadsheet. The inspectors noted the following specific examples.

(Unit 2) Containment sump isolation valves were included in the boundary but not included on the NEI spreadsheet.

(Unit 3) The RPCCW CCP system boundary description was incomplete. Only the component cooling pumps were included as active components. Valves that must close to isolate non-safety related components to ensure sufficient cooling to the monitored components were not addressed.

(Unit 3) HPSI recirculation valves from RHR (8804A, 8804B, 8907A, 8907B) were not included as active components. However, Attachment A of TI 2515/149 states, For plants where the high pressure injection pump takes suction from the residual heat removal pumps, the residual heat removal pump discharge header isolation valve to the HPSI pump suction is included in the scope of the HPSI system.

(Unit 3) Service water heat exchangers (CCE HX and CCI HX) were not included in the identified service water boundary. However, Attachment A to TI 2515/149, states, Pumps, valves, heat exchangers, and line segments that are necessary to provide cooling to the other monitored systems are included in the system scope up to, but not including, the last valve that connects the cooling water support system to the other monitored systems. This last valve is included in the other monitored system boundary.

The licensee still had outstanding questions on inclusion of active components within the boundary. The inspectors noted the following specific examples.

(Unit 2) Reactor building component cooling water valves 2-RB-30.1A/B and 2-RB-37.1A/B were left unresolved as active components. This is an open item left over from the MSPI seminar held in Chicago.

(Unit 3) Service water valves MOV 115A/B were listed on the boundary drawing as an outstanding question on whether they should be included as active components. Their disposition had not been completed, yet they were listed on the NEI spreadsheets.

03.05 Train/Segment Unavailability Boundary Definition Not all boundaries were consistent with the guidance found in Attachment A of TI 2515/149.

The inspectors noted the following specific examples.

(Unit 2 and Unit 3) Attachment A to TI 2515/149, states, Pumps, valves, heat exchangers, and line segments that are necessary to provide cooling to the other monitored systems are included in the system scope up to, but not including, the last valve that connects the cooling water support system to the other monitored systems.

This last valve is included in the other monitored system boundary. Therefore, service water to emergency diesel generator (EDG) cooling jacket isolation valves should have been monitored under the EDG system versus the service water system. Examples included 2-SW-231A/B and 2-SW-891A/B for Unit 2 and AOV-39A/B for Unit 3.

03.06 Entry of Baseline Data - Planned Unavailability The inspectors identified the following issues with the entry of baseline planned unavailability data.

Incomplete boundaries precluded validation of NEI data sheets.

Errors in NEI data sheets precluded validation of data reported to the NRC.

(Unit 2) Critical Hours were not included on the Service Water NEI spreadsheet.

03.07 Entry of Baseline Data - Unplanned Unavailability The inspectors identified the following issues with the entry of baseline unplanned unavailability data.

Incomplete boundaries precluded validation of NEI data sheets.

Errors in NEI data sheets precluded validation of data reported to the NRC.

03.08 Entry of Baseline Data - Unreliability The inspectors identified the following issues with the entry of baseline unreliability data.

Incomplete boundaries precluded validation of NEI data sheets.

Errors in NEI data sheets precluded validation of data reported to the NRC.

03.09 Entry of Performance Data - Unavailability The inspectors identified the following issues with the entry of unavailability performance data.

Incomplete boundaries precluded validation of NEI data sheets.

Errors in NEI data sheets precluded validation of data reported to the NRC.

03.10 Entry of Performance Data - Unreliability The inspectors identified the following issues with the entry of unreliability performance data.

Incomplete boundaries precluded validation of NEI data sheets.

Errors in NEI data sheets precluded validation of data reported to the NRC.

03.11 MSPI Calculation The inspectors identified issues with functions not being included, the list of active components being incomplete, and data errors that resulted in the MSPI calculations being incorrect.

The MSPI Fussell-Vesely (F-V) coefficients were not able to be verified against the licensees PRA that was qualified for use by the staff because licensee had not identified all of the F-V coefficients and the staff had not qualified the licensees PRA for use.

The licensee was not able to reproduce the F-V values for train unavailability. Apparently, incorrect F-V values for train unavailability were used. In addition, the FV/UA ratios were not calculated correctly.

Incorrect F-V values for unreliability for several components were used (e.g., 2-CS-16.1A and 2-CS-16.1B, etc.). In addition, the FV/UA ratios were not calculated correctly.

General Observations While conducting the TI, the inspectors made the following general observations.

The licensee had not verified the MSPI data submitted to the NRC prior to the submittal in October 2002. At the end of the inspection, numerous errors had been found and the licensee was in the process of verifying the data.

The licensee had not identified which indicators were invalid; and they were unable to identify which indicators were invalid before the completion of the inspection.

TI 2515/149, Mitigating Systems Performance Index Pilot Verification Braidwood Units 1/2 The inspectors completed the requirements of TI 2515/149, Mitigating Systems Performance Index (MSPI) Pilot Verification, at Braidwood on December 17, 2002. The inspectors determined that the licensee made a reasonable best effort to provide accurate and complete data for this voluntary pilot program. Most data errors were small and most other problems were because the guidance for the MSPI program was still under development.

The following discrepancies/issues were noted: (Paragraph numbers correspond to the inspection requirements sections of TI 2515/149.)

03.02 Risk-Significant Functions No discrepancies were noted. Functions were consistent with the Significance Determination Process (SDP) and (Standardized Plant Analysis Risk) SPAR model assumptions.

03.03 Success Criteria The licensee generally used the design basis for success criteria, but did not identify which criteria were exceptions to the design and what they were based on.

03.04 Unreliability Boundary Definition Several active components were not modeled in the licensees Probabilistic Risk Analysis (PRA) and therefore had a Fussell-Vesely (F-V) of zero assigned in the MSPI spreadsheet.

Thus any unavailability or unreliability of the components were not included in the MSPI calculation. Examples included:

Centrifugal charging (CV) pump mini-flow isolations valves, CV8114/8116. The licensees PRA model assumes that operators will provide a backup should the valves fail to close. As a result, the valves were not modeled nor were the operator action of redundant valves.

Safety injection (SI) system to hot legs (A, B, C, D) isolation valves, SI8802A/B.

SI accumulator (A, B, C, D) discharge isolation valves, SI8808A/B/C/D. The model does not consider the impact of inadvertent nitrogen addition if the valves do not close following a large break loss of coolant accident.

SI pump cold leg isolation valves, SI 8835.

Auxiliary feedwater (AF) pump essential service water (SX) recirculation valves, AF024.

The model assumes that the valves is not a flow diversion path and not modeled.

Residual heat removal (RHR) pump A/B mini-flow valves, RH610/RH611. The model has an incorrect normal valve position. As a result, the valves were not modeled.

RHR to cold leg A/D isolation valves, SI8809A/B.

RHR to hot leg A/C isolation valves, SI8840. The model assumes that the hot leg injection/recirculation is not required.

SX from the component cooling water (CC) heat exchanger valve SX007 is only modeled as a spurious closure. It does not model the required operator action or failure of the valves to open when the CC system is used to provide heat removal.

The PRA model assumes that condensate storage tank refill will occur (but it is not modeled). As a result, the SX supply to AF is only challenged following a rupture of the CST. This can underestimate the F-V for the SX pumps and AF valves.

03.05 Train/Segment Unavailability Boundary Definition The licensee did not specify electrical boundaries. MSPI guidance stated that the last breaker or relay for electrical power and controls should be in the boundaries for pumps and valves.

03.06 Entry of Baseline Data - Planned Unavailability The licensee used data previously submitted for the performance indicator program. However, the licensee was unable to access the original computerized spreadsheets from which the data was developed. Thus the inspectors were unable to verify that the data was correct. Samples of this data was previously verified to be correct during performance indicator verification inspections using Inspection Procedure 71151.

03.07 Entry of Baseline Data - Unplanned Unavailability No discrepancies were noted. Correct table values were used.

03.08 Entry of Base line Data - Unreliability No discrepancies were noted. Correct table values were used.

03.09 Entry of Performance Data - Unavailability The inspectors sampled data reported for the 2nd quarter 2002 for AF and the 3rd quarter 2002 for CC and SX for the current performance index.

The inspectors identified an inconsistency with whether the licensee counted the diesel-driven AF pump as being unavailable during weekly confidence runs using the normal operating procedure that were done in addition to the normal surveillance tests.

Sometimes they counted them, sometimes they didnt. During the inspection, licensee engineers determined that they should not have been counted as unavailable and intended to add the operating procedures to the list of activities that would not make the pumps unavailable.

The inspectors identified that the licensee was not always consistent in not counting unavailable times of less than 15 minutes. Also the licensee was not consistent in whether to count as unavailable time the period when the SX pumps were in pull-to-lock for oil samples. That evolution was not listed as an exempt activity for unavailability.

03.10 Entry of Performance Data - Unreliability The inspectors sampled data from the 2nd quarter 2002 for AF, CC and SX and the 3rd quarter 2002 for CC and SX for the current performance index.

The inspectors identified that the run hours the licensee reported for SX pumps for the 2nd and 3rd quarter of 2002 had been significantly overstated (by approximately 300 hours0.00347 days <br />0.0833 hours <br />4.960317e-4 weeks <br />1.1415e-4 months <br /> per pump per quarter). During the inspection, licensee engineers found the source of the problem and stated that the data would be corrected in the December 2002 data submittal.

The inspectors identified that the licensee under reported the number of start demands on the 2A AF pump for the 2nd quarter 2002. The licensee reported 14 starts and there were actually 15. During the inspection, licensee engineers confirmed the errors and stated that the data would be corrected in the December 2002 data submittal.

The inspectors identified small errors in the run time of both the 2A and 2B AF pumps for the 2nd quarter of 2002. During the inspection, licensee engineers confirmed that a run period of about 1.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> had been assigned to the 2B pump when actually the 2A pump was running. The engineers stated that the data would be corrected in the December 2002 data submittal.

The inspectors identified that the licensee under reported the number of stroke demands for AF valves 2AF006A and B and 2AF017A and B for the 2nd quarter of 2002.

The licensee estimated one stroke for each valve based on quarterly surveillance schedules but missed that the once-per-18 month surveillance was completed during that quarter which added an additional stoke for each valve. The licensee engineers stated that the data would be corrected in the December 2002 data submittal.

The licensee generally did not screen pump start demands to eliminate those for post maintenance tests. The MSPI guidance documents state that generally those starts should not be counted as demands.

03.11 MSPI Calculation Some of the MSPI F-V coefficients were not verified because the licensee had not identified all of the F-V coefficients due to certain components being not modeled in their PRA (as noted in section 03.04) or the F-V coefficient was truncated out at a 1E-10 value. Specific components with no F-V value due to truncation include:

CV pump 1B (assumed to be in standby in model)

AF pump SX suction valves, AF006A/B

AF pump SX suction valves, AF017A/B

SX pump 2A/2B (opposite unit) 1B/2B assumed running in PRA model

0' CC pump

CC pump 2A/2B (opposite unit)

Opposite unit SX from CC heat exchanger outlet valves, SX007

TI 2515/149, Mitigating Systems Performance Index Pilot Verification Prairie Island 1/2 The inspectors completed the requirements of TI 2515/149, Mitigating Systems Performance Index (MSPI) Pilot Verification, at Prairie Island on December 20, 2002. The inspectors determined that the licensee made a reasonable best effort to provide accurate and complete data for this voluntary pilot program. Most data errors were small and most other problems were because the guidance for the MSPI program was still under development.

The following discrepancies/issues were noted: (Paragraph numbers correspond to the inspection requirements sections of TI 2515/149.)

03.02 Risk-Significant Functions

The licensee did not originally specify which Maintenance Rule risk-significant functions were to be counted as MSPI functions. All Maintenance Rule functions were listed.

Licensee engineers revised the list of functions during the inspection.

The licensee originally listed the auxiliary feedwater (AFW) system function as To provide water to the steam generators... Since the success criteria is met by only supplying flow to one steam generator, the function should have been stated as To provide water to at least one steam generator... to be consistent with Nuclear Energy Institute (NEI) 99-02, draft Attachment A. Licensee engineers corrected the function description during the inspection.

The licensee did not include the electrical cross-ties from other units safeguards busses as a risk-significant function of emergency AC power (EAC) system although it is modeled in its probabilistic risk assessment (PRA) and is a significant factor in calculating the Fussell-Vesley (F-V) value. (See additional comments under 03.04.)

03.03 Success Criteria

The licensees MSPI and Maintenance Rule success criteria for AFW included providing 200 gpm to at least one steam generator within one minute at 1300 psia. The licensees design basis documentation (DBD) stated success is 200 gpm to at least one steam generator within one minute at 1142.6 psig. Licensee engineers revised the MSPI success criteria to match the design basis of 1142.6 psig during the inspection.

The licensees MSPI success criteria did not indicate where the parameters specified came from (DBD, Updated Safety Analysis Report (USAR), PRA, etc.). The licensee was informed that this information should be available for inspection.

One of the success criteria for the component cooling water (CC) system was listed as 200 degrees. This was a piping design limit but obviously the system could not meet its function of cooling front line systems if it was that hot. The licensee was informed that this criteria should be revised.

03.04 Unreliability Boundary Definition

For AFW, the licensee did not document why the valves in the safety-related backup water supply from the cooling water system were not included as active components.

The licensee did not document why AFW steam generator isolation valves MV-32242, etc. are not considered active components like they did for the throttle valves MV-32238, etc.

For AFW, the licensee included the recirculation valves (CV-31153, CV-31154, CV-31418, and CV-31419) as active components but they have no F-V because they are not modeled in the PRA. There was a statement in the licensees MSPI documentation that the valves will be modified to be normally open, but that is not be true anymore.

Since the valves have no F-V values, unreliability data submitted for these valves does not get counted in the MSPI calculation.

For the cooling water (CL) system, the licensee did not document why dump to grade valves MV-32329, 32322, and 32036 were not included as active components.

For CC, the licensee included MV-32120 etc. as active components but they had zero F-V values assigned. The licensee documented a qualitative discussion as to why the F-Vs would be negligible, but did not provide any quantitative evaluation to support it.

The licensee stated that the valves were modeled in the PRA and that they would provide the quantitative importance values. Since the valves have such low F-V values, their unreliability data does not contribute to the MSPI calculation.

For CL, the heat exchanger throttle valves (CV-31381, CV-31411, CV-31383, and CV-31384) are included as active components but are not modeled in the PRA and have F-V values of zero. Therefore, unreliability data reported for these valves does not get counted in the MSPI calculation.

Emergency Operating Procedure E-0, Step 8, has an action to close MV-32115, Component Cooling Water Supply to the Spent Fuel Pool Heat Exchanger. The USAR indicates that a component cooling train could fail due to excessive flow if the valve is not closed. The licensee did not include this valve as an active component but agreed during the inspection that it should be included.

For EAC, the cross-tie breakers from the other unit are modeled in the PRA and have a large effect on the F-V values for the emergency diesel generators. However, the licensee did not include the cross-tie breakers as active components. According to NEI 99-02, the breakers should be included as active components since they are in the PRA.

Licensee engineers stated during the inspection that they intend to add the breakers as active components. However, NEI 99-02, Draft Appendix F, Table 2 doesnt have industry priors for breakers, and they are not listed as one of the component types to choose from in the MSPI spreadsheet. In order to add these active components, the NEI spreadsheet will have to be revised.

The licensee did not document why the safety injection accumulator discharge valves were not included as active components although the Emergency Operating Procedures direct that they be closed during certain accidents.

For the high pressure safety injection (SI) system, valves MV-32202, etc. were included as active components but are not in the PRA. F-V values were assigned that the licensee PRA engineers say are conservative, but they did not make similar assignments for other valves without F-V values. The licensee should justify why number is conservative, and possibly apply the same technique to other valves like CV-31381 discussed above. During the inspection, the licensee stated that they will consider assigning conservative F-V values to all active components not modeled in the PRA.

The licensees PRA model assumed the A train CC pump and both non-safety CL pumps were continuously running. Since the model assumed they were running, there was no unavailability F-V importance factor for them. Thus any unavailability data for those pumps does not get counted in the MSPI calculation. However, the licensee reported unavailability hours for those pumps. Unavailability hours for the pumps assumed to be running in the PRA should be assigned to the pumps assumed to be in standby so that they get counted in the MSPI calculation, or appropriate unavailability F-V values should be assigned to the pumps. The licensees PRA engineer stated that this issue would be reviewed.

03.05 Train/Segment Unavailability Boundary Definition

The licensee did not specify electrical boundaries. NEI 00-02 guidance stated that the last breaker or relay for electrical power and controls should be in the boundaries for pumps and valves.

03.06 Entry of Baseline Data - Planned Unavailability

The licensees calculation for subtracting unplanned unavailability from total unavailability to get just the planned hours had a discrepancy in that some cascading unplanned unavailability hours were more than the total unplanned unavailability hours for the train. This resulted in errors in the baseline planned unavailability. Licensee engineers found the source of the error during the inspection.

03.07 Entry of Baseline Data - Unplanned Unavailability

No discrepancies were noted. Correct table values were used.

03.08 Entry of Base line Data - Unreliability

No discrepancies were noted. Correct table values were used.

03.09 Entry of Performance Data - Unavailability

The inspectors sampled data reported for the 2nd quarter 2002 for CC and CL and the 3rd quarter 2002 for AFW for the current performance index and also sampled data for the 3rd quarter 2000 for AFW and 4th quarter 2000 for CC and CL for verification of historic values.

No discrepancies were identified in AFW unavailability data for the 3rd quarter 2002.

The licensee made a small error in the reported unavailable time for the 22 CC train when there was a problem with the 22 CC heat exchanger temperature control valve, CV-31384, on May 5-6, 2002. Licensee engineers found the source of the error during the inspection.

No discrepancies were noted in the CL unavailability for the 2nd quarter 2002.

The inspectors identified errors in the reported for unavailability of AFW for the 3rd quarter 2000 for all except the 12 AFW pump. Licensee engineers later identified that some unavailable time had been double counted.

03.10 Entry of Performance Data - Unreliability The inspectors sampled data from the 2nd quarter 2002 for CC and CL and the 3rd quarter 2002 for AFW for current performance and also sampled data for the 3rd quarter 2000 for AFW and 4th quarter 2000 for CC and CL for verification of historic values. The inspectors also performed a very limited sampling of data for other systems.

For the AFW, SI, and RHR systems, the licensee estimated pump start demands, run times, and valve stroke demands based on normal surveillance schedules. The licensee did not provide auditable records of how those estimated were obtained.

The inspectors noted that the licensee reported one start demand for each RHR pump during the 2nd quarter 2002. According to the electronic control room log and process book, there were two demands on the 22 RHR pump. This was one example of an error due to estimating start demands and run times based only on the number of surveillance tests that are typically done.

The licensee reported the correct number of start demands for the 11 and 12 CC pumps for the 2nd quarter 2002. However, the inspectors identified that one of the starts on each of the pumps was a post maintenance test (PMT). In general, the licensee did not eliminate PMTs from reported start demands for most systems.

The inspectors identified that the run hours reported for the 11 CC pump were 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> short for the 2nd quarter 2002. Licensee engineers found the source of the error during the inspection.

The licensee reported seven starts for each of the 21 and 22 CC pumps in the 2nd quarter 2002. However, the inspectors determined that one of the starts on the 21 CC and two of the starts on the 22 CC were PMTs and should not have been counted.

The inspectors identified that the licensee did not report the May 2, 2002, trip of the 22 CL pump as a start demand failure (it was running less than an hour). The trip was due to a spurious overspeed trip due to radio interference. The trip happened during a surveillance test but took more than a trivial amount of time to diagnose. The inspectors determined that the trip should have been considered a start demand failure. During the inspection, the licensee agreed to count it as a failure.

The licensee reported six start demands on the 22 CL pump during the 3rd quarter 2002.

The inspectors could only identify four. During the inspection, the licensee found the source of the error.

03.11 MSPI Calculation

Some of the MSPI F-V coefficients were not verified because the licensee had not identified all of the F-V coefficients due to certain components being not modeled in their PRA (as noted in Section 03.04) or the F-V coefficient was truncated out at a 1E-10 value. Specific components with no F-V value due to truncation include:

Unit 1 and 2 CC heat exchanger outlet valves, MV-32120, MV-32121, MV-32122, and MV-32123; Unit 1 and 2 Turbine Building Loop A/B Cooling Water Header Valves, MV-32031 and MV-32033; Unit 1 and 2 SI pump suction valves, MV-32163 and MV-32191; Unit 1 and 2 SI test to refueling water storage tank isolation valves, MV-32202, MV-32203, MV-32204, and MV-32205; Unit 1 and 2 Bus 15 to Bus 25 tie breaker, 15-8; and Unit 1 and 2 Bus 25 to Bus 15 tie breaker, 25-17.

The NRC staff has not qualified the licensees PRA.

TI 2515/149, Mitigating Systems Performance Index Pilot Verification South Texas Project Units 1/2 The inspectors reviewed the licensees treatment of the following systems covered by this pilot:

Standby Diesel Generators Essential Cooling Water System Component Cooling Water System The inspectors reviewed system drawings, spreadsheets, design basis documents, Graded Qaulity Assurance system assessment notebooks, and equipment history. The inspectors also reviewed the licensees MSPI Basis Document, which provided a description of the boundaries and active components.

The inspectors confirmed that the licensee correctly identified risk significant functions for trains within these systems. The licensee selected the risk significant functions using the Graded Quality Assurance risk ranking process in accordance with their risk-informed exemption to special treatment requirements. All functions determined to have "high" or "medium" risk significance were included. Each of the above functions had an appropriate success criteria at the train level (none of the reviewed systems had a separable segment below the train level) which were consistent with the licensees PRA analysis, Technical Specifications, and design basis documentation.

The inspectors confirmed that the licensees definition of the system/train boundaries and the identification of active components was in accordance with the NEI guidance, with one exception: the NEI guidance specified that diesels should include the starting air receivers, whereas the licensee specified that only one was required. The licensee planned to change this to conform to the guidance. The inspectors also confirmed that the active components were accounted for in the site-specific NEI spreadsheet, and that the spreadsheet used industry reliability values in accordance with the guidance, with one exception: the licensee used the higher unreliability values from Table 2 under HPSI for their RHR function. This was done because these values more closely approximated the sites reliability history. The inspectors noted that this would have the effect of establishing a baseline which was higher than actual and industry averages, so a more unreliable performance would be permitted. The licensee agreed that using a different value than explicitly intended in the guidance should be done only after getting approval; the licensee intended to submit a Frequently Asked Question on this topic.

The inspectors reviewed the site-specific NEI spreadsheet and determined that most historical data was properly entered. However, the quality of the licensees data reviews was questionable since the inspectors noted a number of data entry errors. In particular, this included some entries which were double the actual value, and some entries which were correct but the original data source had to be corrected. The inspectors also identified that the licensee had reported site specific unavailability data which included both planned and unplanned time, contrary to the guidance. The guidance specified that site-specific planned unavailability and generic industry unplanned unavailability was to be used. The licensee did this because the process of separating the data into the two categories was too time consuming to meet the initial reporting deadline, but expected that the data reported would conservatively overestimate unavailability. The inspectors noted that this would have the effect of establishing a baseline which was higher than actual, which allows a non-conservative bias in future unavailability.

During the inspection the licensee removed the unplanned unavailability time and planned to revise the data when the November data was submitted.

The inspectors noted that the licensee had tentatively concluded that they had a number of invalid indicators, according to the definitions in the guidance.

TI 2515/149, Mitigating Systems Performance Index Pilot Verification Palo Verde Units 1/2/3 a.

Inspection Scope The inspectors verified that the licensee had correctly implemented the MSPI pilot guidance for reporting unavailability and unreliability of the monitored safety systems. The inspectors audited the development of the MSPIs for the high pressure safety injection system, essential cooling water system, and essential spray pond system. For those systems, the inspectors confirmed that success criteria had been correctly identified, active components were properly scoped, unavailability boundaries were properly defined, and planned unavailability was consistent with information contained in operating logs, maintenance rule reports, monthly operating reports, and CRDRs. The inspectors also verified that pertinent information, such as Fussell-Vesely coefficients, was properly transferred to the appropriate informational spreadsheets.

No findings of significance were identified.

TI 2515/149, Mitigating Systems Performance Index Pilot Verification SONGS Units 2/3 4OA5 Other

.1 Temporary Instruction 2515/149: Mitigating Systems Performance Index (MSPI) Pilot Verification a.

Inspection Scope The inspectors verified that the licensee had correctly implemented the MSPI pilot guidance for reporting unavailability and unreliability of the monitored safety systems. The inspectors audited the development of the MSPIs for the saltwater cooling, component cooling, and auxiliary feedwater systems. For those systems, the inspectors confirmed that success criteria had been correctly identified, active components were properly scoped, unavailability boundaries were properly defined, and planned unavailability was consistent with information contained in operating logs and facility action requests. The inspectors also verified that pertinent information, such as Fussell-Vesely coefficients, was properly transferred to the appropriate informational spreadsheets.

b.

Findings No findings of significance were identified.

TI 2515/149, Mitigating Systems Performance Index Pilot Verification SURRY Units 1/2 Risk Significant Functions - For the audited systems (Service Water (SW), Charging Pump Cooling Water (CPCW), Auxiliary Feedwater (AFW)) the inspector reviewed the Maintenance Rule output document describing the risk significant functions. Through a review of importance measures the inspector ascertained what basic events met the definition for risk significant in the licensees current Probabilistic Risk Analysis (PRA) model. The Maintenance Rule risk significant functions were compared to these risk significant basic events. The inspection determined that:

Due to the truncation selected by the licensee (which was consistent with current industry guidance), for the Maintenance Rule an AFW system risk significant function was excluded from the risk significant functions. This function was AFW Makeup from Tank 1-CN-TK-2.

Consequently, the tank makeup was not identified as within scope of the Mitigating Systems Performance Index (MSPI). This propagated through the rest of the program such as the lack of any success criteria for makeup or that portion of the system being highlighted in the boundary drawings.

No difference between the Maintenance Rule output document and the importance measures were identified for the SW and CPCW systems.

Success Criteria - The inspector reviewed the licensees MSPI system level success criteria for the Service Water, Charging Pump Cooling Water, Auxiliary Feedwater systems and compared them to the licensees Probabilistic Risk Analysis fault trees.

Also, the success criteria was compared to those used in the NRCs Standardized Plant Analysis Risk (SPAR) Model for Surry Units 1 and 2, Revision 3.01, issued October 2002 and the Revision 1 draft of the RISK-INFORMED INSPECTION NOTEBOOK FOR SURRY POWER STATION UNITS 1 AND 2" (SDP). The inspection determined:

The MSPI success criteria description for all the systems reviewed was incomplete. Examples included:

The MSPI success criteria for Charging Pump Cooling Water did not indicate how many charging pump seal heat exchangers or intermediate seal coolers were needed. Also, there was no discussion of the surge tank or the minimum level needed in the surge tank.

The MSPI success criteria documented was for one AFW train. In the licensees PRA for some initiating events with the failure of High Head Safety Injection the AFW success criteria became two trains. Also, in certain initiating events AFW supply from the other unit was not credited in the licensees PRA. In the MSPI success criteria this distinction was not made.

The MSPI success criteria for Service Water did not include the Emergency Service Water (ESW) pumps. However, the common cause failure basic event for the ESW pumps met the criteria for risk significant and was mentioned as risk significant under the Maintenance Rule.

The MSPI success criteria for Charging Pump Cooling Service Water did not include the number of intermediate seal coolers or Charging Pump lubricating oil coolers needed.

There were success criteria differences when comparing the licensees PRA, SPAR and SDP.

These were highlighted in the accompanying tables.

AFW INITIATING EVENT FULL SCOPE MODEL SPAR SDP GENERAL TRANSIENT 1 out of 3 auxiliary feedwater pump trains taking suction from the condensate storage tank and supplying 1 of 3 steam generators OR AFW supply from the other unit via the redundant cross-connect motor-operated valves using the same success criteria as above OR 2 of 3 auxiliary feedwater pump trains if High Head Injection failed 1 out of 3 auxiliary feedwater pump trains taking suction from the condensate storage tank and supplying 1 of 3 steam generators

[cross connect capability not included]

1 out of 3 auxiliary feedwater pump trains supplying 1 of 3 steam generators Use of 1/3 opposite units AFW trains via crosstie is possible.

The crosstie function can be considered as a possible recovery action for a deficiency in the units AFW system.

ATWS 2 out of 2 motor driven pump trains or 1 out of 1 turbine driven pump trains 2 out of 2 motor driven pump trains or 1 out of 1 turbine driven pump trains taking suction from the condensate storage tank and supplying 2 of 3 steam generators 2 out of 3 trains SGTR 1 out of 3 auxiliary feedwater pump trains taking suction from the condensate storage tank and supplying 1 of 2 intact steam generators OR AFW supply from the other unit via the redundant cross-connect motor-operated valves using the same success criteria as above OR 2 of 3 auxiliary feedwater pump trains if High Head Injection failed and non unit cross connection credited 1 out of 3 auxiliary feedwater pump trains taking suction from the condensate storage tank and supplying 1 of 2 intact steam generators

[cross connect not mentioned]

[no difference in success criteria whether HHSI is available or not]

1 out of 3 auxiliary feedwater pump trains supplying 1 of 2 intact steam generators OR IF NO HPI -2/3 AFW trains feeding 2/2 intact SGs cross connect not mentioned SBLOCA 1 out of 3 auxiliary feedwater pump trains taking suction from the condensate storage tank and supplying 1 of 3 steam generators or 2 of 3 auxiliary feedwater pump trains if High Head Injection failed 1 out of 3 auxiliary feedwater pump trains taking suction from the condensate storage tank and supplying 1 of 3 steam generators 1 out of 3 auxiliary feedwater pump trains supplying 1 of 3 intact steam generators MBLOCA 1 out of 3 auxiliary feedwater pump trains taking suction from the condensate storage tank and supplying 1 of 3 steam generators OR 2 of 3 auxiliary feedwater pump trains if High Head Injection failed not modeled 1 out of 3 auxiliary feedwater pump trains supplying 1 of 2 intact steam generators COOLING WATER SYSTEMS FULL SCOPE SPAR SDP ESW variable anywhere from 1of 3 pumps to 3 of 3 pumps depending upon initiating event and failures within canal isolation (see detailed discussion below)*

3 of 3 pumps 1 of 3 pumps under the loss of Circulating Water SERVICE WATER CHARGING PUMP COOLING WATER 1 of 2 trains with unit cross tie capability 1 of 2 trains with cross tie capability system mentioned in the System Dependency Table but cross tie not mentioned -

consistent with SDP development there was no explicit success criteria for this system CANAL ISOLATION dual unit function not indicated as a dual unit function not indicated as a dual unit function in the Initiators and System Dependency Table CHARGING PUMP COOLING WATER 1 of 2 trains not modeled not indicated in the Initiators and System Dependency Table

• The success criteria on the ESW pumps was different between the SPAR model and the licensees full scope model. The SPAR model used a single success criteria of 3 of 3 pumps only to mitigate a Component Cooling Water (CCW) isolation valve failing to provide isolation in support of Recirculation Spray and Service Water Charging Cooling Water. Whereas, the licensees full scope model used a success criteria of 1 of 3 pumps for the Recirculation Spray function. Also, there was the capability to mitigate a condenser water box not isolating by having success with 1 of 3 ESW pumps for the Service Water Charging Cooling Water function, provided there was CCW isolation. In addition, with the lack of water box isolation and CCW isolation 3 of 3 ESW pumps could mitigate this and support the Service Water Charging Cooling Water function.

Unreliability Boundary Definition - The inspector independently determined the active components in the Service Water, Charging Pump Cooling Water, Auxiliary Feedwater systems by applying the guidance contained in Appendix A of the Temporary Instruction while observing the P&IDs, sketches in the licensees Individual Plant Examination submittal and sketches in the SPAR model. In addition the inspector performed a review of the licensees full scope model fault trees, the SPAR fault trees (when modeled) and the functions described in the SDP notebook to ascertain that the active components were incorporated into these documents. The collective information was compared to the Nuclear Energy Institute (NEI) spreadsheet listing the active components. This spreadsheet is the document by which the MSPI Index is calculated. The inspection determined that:

The active components for the six AFW trains were properly designated.

The active components for both Charging Pump Cooling Water trains in both units were properly designated.

The active components for Service Water included Service Water Charging Pump heat exchangers temperature control valves (108A,B,C on Unit 1 and 208A,B,C on Unit 2).

However, these valves did not meet the criteria for active components. Also, if they were included in an unreliability boundary, the pilot program guidance indicated these valves should be in the Charging Pump Cooling Water system.

Due to modeling differences, numerous active components in the AFW, CPCW and SW systems were not included in the SPAR model that were defined as active components under the MSPI.

Although components are not specifically captured in an SDP notebook, the functions involving the active components under MSPI were present in the notebook for the AFW system. The dual unit function necessary for Canal Isolation, a sub-system for SW, was not captured in the SDP notebook. Therefore, those active components of Unit 2 necessary to support Unit 1 and vica-versa were not captured. Also, the Charging Pump Cooling Water function was not specifically captured in the SDP notebook.

Unavailability Boundary Definition - The inspector reviewed highlighted drawings used by the licensee to define the scope of the trains being monitored for unavailability for the Service Water, Charging Pump Cooling Water, Auxiliary Feedwater systems. These highlighted portions of the drawings were compared to the trains indicated on the NEI spreadsheet to ascertain if they encompassed all the active components associated with these systems. The inspection determined that:

Boundary drawings only included P&IDs. No electrical drawings indicated breaker or relay/contacts within the boundary of the monitored systems. Licensee personnel indicated that electrical demarcations were established by review of industry guidance contained in Draft NEI 99-02, Mitigating System Performance Index, and using the sketches contained in this document.

Due to the failure to identify the makeup to Tank CN-TK-2 for the AFW system as risk significant, the boundary drawings were not annotated to include the makeup as part of the AFW boundary.

The temperature control valves on the service water outlet of the Charging Pump Cooling heat exchangers were not marked as a part of the Charging Pump Cooling Water system. Instead, they were included in the Charging Pump Cooling Service Water system.

The Charging Pump Cooling Surge Tank was not annotated as part of the train boundary. The NEI guidance/Temporary Instruction indicated that the tank was not an active component (did not contribute to unreliability) but, insufficient inventory contributed to unavailability. This placed the tank within the train boundary. However, by including inadequate tank inventory within the unavailability index, a common cause failure was being considered under the MSPI even though the purpose section of the NEI guidance/Temporary Instruction stated that common cause failures were excluded from the program.

The annotated drawings included the output of the Canal Isolation actuation system, a subsystem of the Service Water system. Canal Isolation included the Circulating Water inlet and outlet valves for both units, Bearing Cooling Water isolation valves for both units, non-essential Component Cooling Water isolation valves for both units. However, Canal Isolation could not be segmented into trains or segments. Therefore, these valves were monitored for reliability without tying them an availability portion of the monitored Service Water system trains.

Planned Unavailability Baseline Data Entry (one of two inputs to UABLt)- An inspector reviewed the Performance Indicator information previously submitted for AFW and calculated the rest of the unplanned unavailability from the NEI spreadsheet inputs.

Through record review the inspector determined whether the AFW trains out of service inputs for 1999 - 2001 on the spreadsheet were valid. The inspector reviewed that the Charging Pump Cooling Water and Service Water Charging Pump Cooling Water train NEI spreadsheet inputs (3rd quarter 1999 - 2001) had been calculated properly and were used in the 2nd and 3rd quarters of 2002 to attain a unavailability baseline. Through operating log review the inspector evaluated whether an appropriate out of service time had been selected for the Charging Pump Cooling Water trains, Emergency Service Water and Service Water Charging Pump Cooling Water trains. The inspection determined:

For all AFW trains supplying Unit 1 or 2, the unavailability baseline data was consistent with the Performance Indicator information previously submitted for the 1st and 2nd quarters of 1999 and the quarterly inputs of unavailability on the NEI spreadsheet for 3rd quarter 1999 through 2001.

The operating logs indicated that Unit 2 Charging Pump Cooling Water train 2B was taken out of service for over 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> (0508 6/16/00 - 1325 6/16/00). The NEI spreadsheet entry (UATQ) for the 2nd quarter 2000 was zero unavailability hours. Therefore, there was an omission in the out of service hours and in the numerator for calculating UABLt for Unit 2 train B.

The operating logs indicated that Unit 2 Charging Pump Cooling Water train 2B was taken out of service for 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> (1723 7/30/01 - 2223 7/30/01). The NEI spreadsheet entry (UATQ) for the 3rd quarter 2001 was zero unavailability hours. The critical hours input to the NEI spreadsheet indicated that the unit was critical during the entire quarter. Therefore, there was an omission in the out of service hours and in the numerator for calculating UABLt for Unit 2 train B.

The operating logs indicated that Unit 2 Charging Pump Cooling Water train 2A was taken out of service for over 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> (0117 8/2/01 - 1150 8/2/01). The NEI spreadsheet entry (UATQ) for the 3rd quarter 2001 was zero unavailability hours. The critical hours input to the NEI spreadsheet indicated that the unit was critical during the entire quarter. Therefore, there was an omission in the out of service hours and in the numerator for calculating UABLt for Unit 2 train A.

The operating logs indicated that Unit 1 Charging Pump Cooling Water train 2A was taken out of service for approximately 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> (1900 7/31/01 - 2205 7/31/01) and train 2B for approximately 7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> (0424 8/3/01 - 1134 8/3/01). The NEI spreadsheet entries (UATQ) for the 3rd quarter 2001 were zero unavailability hours. The critical hours input to the NEI spreadsheet indicated that the unit was critical during the entire quarter. Therefore, there was an omission in the out of service hours and in the numerator for calculating UABLt for Unit 1 train A and B.

The operating logs indicated that during the 3rd quarter 2001 that train A of Service Water Charging Pump Cooling Water on Unit 2 was out of service for approximately 15 hours1.736111e-4 days <br />0.00417 hours <br />2.480159e-5 weeks <br />5.7075e-6 months <br /> (7/31/01 0303 - 1813) and train B was out of service for approximately 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> (8/1/01 0305 - 1534).

The data input on the NEI spreadsheet was zero hours for both trains. This affected the numerator portion of the UABLt term for each train.

The operating logs indicated that during the 4th quarter 2000 that train A of Service Water Charging Pump Cooling Water on Unit 1 was out of service for approximately 61 hours7.060185e-4 days <br />0.0169 hours <br />1.008598e-4 weeks <br />2.32105e-5 months <br /> (0402 10/18/00 - 1720 10/19/00, 0450 11/28/00 - 1947 11/28/00, 0451 12/12/00 - 1325 12/12/00).

The data input on the NEI spreadsheet was 45.92 hours0.00106 days <br />0.0256 hours <br />1.521164e-4 weeks <br />3.5006e-5 months <br />. This affected the numerator portion of the UABLt term for this train.

The data inputs to the numerator portion of the UABLt term for the ESW trains supporting Unit 1 and 2 had errors. There were numerous discrepancies between the operating log information and the inputs recorded on the NEI spreadsheet for the ESW trains supporting Unit 1 in the 4th quarter 2000 ESW trains B & C, 2nd quarter 2001 ESW train C, 3rd quarter 2001 ESW trains B &

C and 4th quarter 2001 ESW trains A & C. Since these same trains support Unit 2, these same discrepancies existed on the NEI spreadsheet for the ESW trains supporting Unit 2 in the 4th quarter 2000 ESW trains B & C, 2nd quarter 2001 ESW train C and 4rd quarter 2001 ESW trains A & C.

There was a data omission in that no out of service time was recorded against any of the ESW trains for the 3th quarter 2001 for Unit 2. The operating logs indicated out of service times of approximately 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br />, 17 hours1.967593e-4 days <br />0.00472 hours <br />2.810847e-5 weeks <br />6.4685e-6 months <br /> and 83 hours9.606481e-4 days <br />0.0231 hours <br />1.372354e-4 weeks <br />3.15815e-5 months <br /> respectively associated with trains A, B and C.

This affected the numerator portion of the UABLt term.

The baseline unavailability probability as captured on the NEI spreadsheet for the ESW trains was four magnitudes higher than that used in the licensees PRA model. The spreadsheet indicated an unavailability of 2E-2. The model indicated 1E-6 (1SWDDP-TM-SWP1A or B or C). Theoretically, as the failure probability increases, the Fussell Vesely term would also increase. Therefore, the coefficient would remain constant. However, there will be variations due to the truncation of the cutsets prior to calculating the F-V importance measure.

Unplanned Unavailability Baseline Data Entry (second input to UABLt)- The inspector reviewed the applicable NEI spreadsheet entries and compared them to the information provided in Table 1, Appendix A of the Temporary Instruction. The inspection determined that:

Consistent with the draft NEI guidance, no unplanned unavailability component was used in establishing the UABLt term for Charging Pump Cooling Water trains, Service Water Charging Pump Cooling Water trains or Emergency Service Water trains for both units.

The appropriate values from the NEI guidance was used for all AFW trains supplying both units.

Unreliability Baseline Data Entry (URBLc) - The inspector reviewed the applicable NEI spreadsheet entries and compared them to the information provided in Table 2, Appendix A of the Temporary Instruction. The inspection determined that:

Unit 1 & 2's AFW pump and valve unreliability baselines were properly calculated and inserted on the NEI spreadsheet.

Unit 1 & 2's Charging Pump Cooling Water pump unreliability baseline data was properly calculated and inserted into the NEI spreadsheet The unreliability baseline values for the ESW pumps, SW Charging pumps and Canal Isolation valves for both units were properly calculated and inserted into the NEI spreadsheet.

Performance Data Unavailability Entry (UAt = 12 quarters out of service / 12 quarters critical hours) - The inspector reviewed operating logs to ascertain if the NEI spreadsheet entries were consistent for each quarter. Then the out of service hours summed for 12 quarters, starting with the 2nd quarter 2002, was calculated from the operating log information and compared to the NEI spreadsheet results. The inspection determined that:

When an Unavailability Index (UAI) began to be calculated in 2nd quarter 2002 for the AFW trains, the UAt term used in the calculation was consistent with the spreadsheet inputs.

When an UAI began to be calculated in 2nd quarter 2002 for the Charging Pump Cooling Water trains, the UAt term used in the calculation was consistent with the spreadsheet inputs.

However, since the UAt term is determined by 12 rolling quarters of out of service time, any errors in determining unavailability during the 11 previous quarters (2nd quarter 1999 thru 1 quarter 2002) affected the validity of this input into the UAI equation for 2nd quarter 2002 and so on. As previously discussed under the UABLt input, Unit 1 and Unit 2 Charging Pump Cooling Water trains A and train B did not include all the unavailability hours in the previous 11 quarters (3rd quarter 2001 for Unit 1 trains A & B, 2nd quarter 2000 for Unit 2 train B and 3rd quarter 2001 for Unit 2 train A and B). Therefore, the UAt input into the UAI calculation was not correct for both trains of Charging Pump Cooling Water for Unit 1 and Unit 2 in the 2nd and 3rd quarters of 2002.

The UAt term for the ESW and Service Water Charging Pump Cooling Water trains was calculated consistent with the spreadsheet inputs. However, since the UAt term uses the summation of out of service hours over a rolling 12 quarter period, errors in determining the unavailability hours in the previous 11 quarters affected the UAt term. As previously discussed under the UABLt input, unavailability hours for Unit 1 Service Water Charging Pump Cooling Water train A, Unit 2 Service Water Charging Pump Cooling Water train A and B, and all three ESW trains for both Units contained omissions when compared to the operating logs.

Therefore, the UAt input into the UAI calculation was not correct for both trains of Charging Pump Cooling Water for Unit 1 and Unit 2 in the 2nd quarter and 3rd quarter 2002. Therefore, the UAt input into the UAI calculation was not correct for these trains in the 2nd and 3rd quarters of 2002.

Performance Data Unreliability Entry (URBc) - Through operating log review the number of Charging Pump Cooling Water, Service Water Charging Pump Cooling Water and ESW pump demands was evaluated and compared to that recorded on the NEI spreadsheet.

Also, an independent calculation, using the URBc inputs from the active components of the AFW, CPCW and SW systems recorded on the NEI spreadsheet, was performed and compared to the results recorded in the 2nd and 3rd quarters of 2002. The inspection results were:

The AFW pump unreliability calculations for URBC for the 2nd and 3rd quarters of 2002 were consistent with the data inputted into the spreadsheet.

Based upon the summation of previous quarters (the DQ type term) of the NEI spreadsheet, the 3rd quarter 2002 input for the 12 quarter sum of demands (ND12) on the Unit 1 Charging Pump Cooling Water pump (1-CC-P-2B) was incorrectly inserted into the NEI spreadsheet as 177 demands when the correct number was 195.

Based upon the summation of previous quarters (the DQ type term) of the NEI spreadsheet, the 3rd quarter 2002 input for the 12 quarter sum of demands (ND12) on the Unit 2 Charging Pump Cooling Water pump (1-CC-P-2B) was incorrectly inserted into the NEI spreadsheet as 176 demands when the correct number was 192.

The number of demands documented in the operating logs for the Unit 1 and 2 Charging Pump Cooling Water pumps from 1999 through 1st quarter 2002 were consistently less than what was inserted into the NEI spreadsheet (DQ). This was due to an assumption that more pump stop and starts would be involved in the surveillance test/pump rotation schedule. Also, once an Unreliability Index (URI) began to be calculated in the 2nd quarter of 2002, an assumed number of starts was inserted into the NEI spreadsheet instead of the actual starts. Therefore, a over reporting of pump starts continued. This altered the portion of the PD term in the URBC input into calculating the URI.

During any quarter one Charging Pump Cooling Water pump was always in service or a plant shutdown was required. Therefore, the combined run times of the two pumps involved, 1-CCP-2A and 1-CCP-2B, should at least equal the number of critical hours. This combined pump runtime over a running 12 quarters is used in the denominator of the portion of the URBC input into calculating the Unreliability Index. From the NEI spreadsheet the 12 quarter run time (TR12) for Unit 2 during the 2nd quarter of 2002 was 26200 hours at 2180 hour0.0252 days <br />0.606 hours <br />0.0036 weeks <br />8.2949e-4 months <br />s/quarter

(91 days). However, five of the quarterly inputs were actually less than the critical hours for that respective quarter. This was in the 4th quarter 1999, 1st quarter 2000, 2nd quarter 2000, 3rd quarter 2000, 3rd quarter 2001.

The 3rd quarter run time hours for the Unit 2 Charging Pump Cooling Water Charging system (TRQ Type on the NEI spreadsheet) was 2184 hours0.0253 days <br />0.607 hours <br />0.00361 weeks <br />8.31012e-4 months <br /> whereas the critical hours listed was 2208. Therefore, the run hours imputed into the 12 quarter run time (TR12) were at least 24 too few. This same run time under-estimation also happened on Unit 1.

The Unit 1 Charging Pump Cooling Water pump As reliability was not based upon the actual run time hours, even though the licensee attempted to use actual run time hours. The licensee assumed that each train would be operated 1/2 the time during the quarter or 1092 hours0.0126 days <br />0.303 hours <br />0.00181 weeks <br />4.15506e-4 months <br />. A review of historical data indicated that the licensees assumption was valid. However, when there was out of service time against that train during the quarter, that time was subtracted from 1092 without adding that time to the other train. Since a Charging Pump Cooling Water train was always in service, this should have been done. This same situation was repeated for the other Unit 1's pump and the two Unit 2 pumps. Consequently, an invalid denominator was used when calculating the URBc for these pumps.

As with the Charging Pump Cooling Water pumps, the number of demands per quarter for the Service Water Charging Pump Cooling Water pumps were routinely over-estimated. The number of demands documented in the operating logs for the Unit 1 and 2 pumps from 1999 through 1st quarter 2002 were consistently less than what was inserted into the NEI spreadsheet (DQ). This was due to an assumption that more pump stop and starts would be involved in the surveillance test/pump rotation schedule. This altered the portion of the PD term in the URBC input into calculating the URI.

As with the Charging Pump Cooling Water pumps, the run times for the quarter on the Service Water Charging Pump Cooling Water pumps were based upon 1/2 of 2184 hours0.0253 days <br />0.607 hours <br />0.00361 weeks <br />8.31012e-4 months <br />. When there was out of service time against a particular pump, the time was subtracted from 1092 hours0.0126 days <br />0.303 hours <br />0.00181 weeks <br />4.15506e-4 months <br /> without adding that time to the other pump. Since a pump was always in service, the number of run hours imputing to the denominator of, the Tr input for URBc, was not accurate.

Upon calculating the 12 quarter sum of the number of demands for the Service Water motor operated valves (DQ type, D12) beginning in 2nd quarter 2002, an incorrect value was recorded on the NEI spreadsheet for the Unit 2 valves supporting Unit 1 canal isolation (2-CW-MOV-200A -D, 2-CW-206A-D, 2-SW-MOV-201A & B, 2-SW-MOV-202A & B) and the Unit 1 valves supporting Unit 2 canal isolation. The single quarter input was used instead of a 12 quarter sum or 68 versus 964. The 12 quarter demand sum recorded in the 3rd quarter (D12) was only the 2nd and 3rd quarter 2002 demands. These errors altered the D input in the denominator of the PD portion of the URBc term. Once identified to the licensee, their review identified that the problem predicating this error was an improper computerized calculation for the summation of all components from column V to the end of the NEI spreadsheet. This affected all summation type entries for failures and demands (ND12, D12, NL12, L12, NR12, TR12). The licensee also identified that this same computerized error existed in the Charging Pump Cooling Water spreadsheet. However, the number of components in that system were not sufficient to use column V. After dialogue with NEI the licensee indicated that this was a generic error in the computerized spreadsheet.

Based upon licensee interview, the computerized calculation for summation of equipment types within the NEI spreadsheet did not allow for the adjustment of differing types of motor operated valves. For the Service Water valves this did not cause a problem since all the valves had a number of similar operating characteristics. However, if this were not the case, some modification of the type summation for failures and number of demands would be needed.

MSPI Calculation - The inspector reviewed how the licensee derived an unavailability and unreliability Fussell-Vesely (F-V) importance coefficient and from what source. The inspector determined whether the designated importance coefficients were inserted at the proper location on the NEI spreadsheet. The inspector re-calculated the unavailability and unreliability index for representative trains/components and compared numerical results during the second and third quarter of 2002. These results were compared to the intermediate steps and final results on the NEI spreadsheet. The inspection determined that:

For all the UAI and URI calculations a core damage frequency (CDF) of 2.98E-5 was used.

This CDF included the external event of flooding within the plant (from pipe breaks or maintenance activities breaching piping boundaries). The F-V coefficients used were based upon a PRA model that included this external event initiator. This particular initiator made up approximately 2/3s of the CDF. Therefore, using this PRA model provided a result significantly different from that directed by the Temporary Instruction/draft NEI guidance. Also, the risk significant functions were determined from importance measures that excluded the external event of flooding within the plant.

Using the failure of either the Emergency Condensate Storage Tank (1 or 2-CN-TK-1) or the Condensate Storage Tank (1 or 2-CN-TK-2) as a surrogate for insufficient water inventory, the a F-V unavailability coefficient was 2.5. This coefficient was magnitudes higher than those associated with train specific basic events. As stated in the draft NEI guidance... periods of insufficient water inventory contribute to UAI... However, such a situation is a common cause failure for all trains taking suction from these sources. This same situation existed for the Charging Pump Cooling Water Surge Tank. Therefore, if this coefficient was selected versus the test and maintenance basic event for an AFW pump for the train unavailability coefficient a significantly different UAI would be calculated.

For 5 of the 6 AFW trains supplying Unit 1, the wrong F-V unreliability coefficient was inserted on the NEI spreadsheet (FVURC/URPCmax).

The Unit 1 MDAFW pump 3As coefficient was inserted into the Unit 1 TDAFW pumps location on the spreadsheet.

The Unit 1 MDAFW pump 3Bs coefficient was not selected from 3Bs coefficients.

Instead a MDAFW pump 3As coefficient of 0.1506 was used. The largest pump 3B coefficient was 0.215. Consequently, the coefficient used was not consistent with the guidance.

For the Unit 1 turbine driven pump supplying Unit 1, the an incorrect coefficient was selected from those available. The Fail to Run for 12 Hours coefficient (0.02515) was used instead of the Fail to Start (0.1108) coefficient.

The incorrect Unit 1 turbine driven pump supplying Unit 1's coefficient was inserted into the Unit 1 MDAFW pump 3Bs location on the spreadsheet.

The Unit 2 MDAFW pump 3A supplying Unit 1 coefficient was inserted into the Unit 2 TDAFW pump supplying Unit 1's location on the spreadsheet.

The Unit 2 MDAFW pump 3Bs coefficient was inserted into the Unit 2 MDAFW 3A supplying Unit 1's location on the spreadsheet.

The Unit 2 TDAFW pumps coefficient was inserted into the Unit 2 MDAFW 3B supplying Unit 1's location on the spreadsheet.

For 5 of the 6 AFW trains supplying Unit 2, the wrong F-V unreliability coefficient was inserted on the NEI spreadsheet (FVURC/URPCmax).

For the Unit 2 turbine driven train supplying Unit 2, an incorrect coefficient was selected from those available. The Fail to Run for 12 Hours coefficient (0.02515) was used instead of the Fail to Start coefficient (0.1108).

The Unit 2 MDAFW pump 3As coefficient was inserted into the Unit 2 TDAFW pumps location on the spreadsheet.

The Unit 2 MDAFW pump 3Bs coefficient was not selected from 3Bs coefficients.

Instead a MDAFW pump 3As coefficient of 0.1506 was used. The largest pump 3B coefficient was 0.215. Consequently, the coefficient used was not consistent with the guidance.

The incorrect Unit 2 turbine driven pump supplying Unit 2's coefficient was inserted into the Unit 2 MDAFW pump 3Bs location on the spreadsheet.

The Unit 1 MDAFW pump 3A supplying Unit 2 coefficient was inserted into the Unit 1 TDAFW pump supplying Unit 2's location on the spreadsheet.

The Unit 1 MDAFW pump 3Bs coefficient was inserted into the Unit 1 MDAFW 3A supplying Unit 2's location on the spreadsheet.

The Unit 1 TDAFW pumps coefficient was inserted into the Unit 1 MDAFW 3B supplying Unit 2's location on the spreadsheet.

A number of these errors in placing the F-V unreliability coefficient in the wrong column was partially contributed to by the layout of the NEI spreadsheet. The spreadsheets train level unavailability information is inserted into the first rows, then component specific reliability information is inserted in the next 8 rows followed by 5 rows of calculating train level unavailability and then 26 rows of calculating component unreliability. The transitions back and forth cause confusion. In the licensees case the train unavailability columns and the pump specific reliability columns differed. Therefore, the first row was the Unit 1 A motor driven pump train under the unavailability section but the first row in the unreliability section (right below train A) was the Unit 1 turbine driven pump. Therefore, the A motor driven pumps F-V unreliability coefficient was inserted into the turbine driven pumps slot.

Given the model used (including the external event of plant flooding) and inserting the correct F-V unreliability coefficients into calculating URI, 32 motor driven AFW failures and 20 turbine driven AFW failures would be needed to cross the 1E-6 threshold.

Given the model used, the F-V unreliability coefficients for the AFW valves supporting both units were properly determined and inserted into the spreadsheet. The valve input to the URI was properly calculated. However, no matter how many valve failures occur, the affect on the URI (exclusively due to valves) would not be sufficient to cross the action threshold.

The F-V unavailability coefficients for all AFW trains for both units were properly determined, given the model used and assuming the surrogate for insufficient tank inventory was not to be used.

Given the model used, the correct Charging Pump Cooling Water F-V unavailability coefficient was selected and imputed on the NEI spreadsheet, assuming a surrogate for insufficient surge tank inventory was not to be used.

Given the model used, the correct F-V unreliability coefficient for the Charging Pump Cooling Water pumps was selected and imputed on the NEI spreadsheet.

Based upon the UAI methodology, (not actually possible and operate in accordance with the operating license) if both trains of Charging Pump Cooling Water for a particular unit were taken out of service for an entire 12 quarters, the MSPI would be remain below the 1E-6 threshold.

The largest F-V unavailability coefficient for the Service Water Charging Pump Cooling Water trains and the ESW trains was not selected. The coefficient from basic event 1SWPAT-TM-SWP10B of 0.137 was more appropriate than the 0.09088 value used.

The TI, section 03.11 instructed that the SRA confirm that each monitored train or component has an associated F-V coefficients derived from the licensees updated PRA that was qualified for use by the staff prior to start of the MSPI pilot. However, none of F-V coefficients have been qualified for use by the staff. Consequently, prior to the inspection the NRC program office was contacted on how to proceed. The NRC program office response via correspondence, was to compare the Revision 3i October SPAR model F-V coefficients to the licensee where comparable basic events could be identified. The inspection determined:

Even though there were cases where comparable basic events could be identified, comparison between the licensees F-V coefficients were not credible because the SPAR model did not include the external event CDF contributor of flooding from pipe breaks within the facility. The licensees F-V coefficients were derived with this external event CDF contributor included.

Therefore, comparing F-V values would be equivalent of comparing the basic event contributions to the whole CDF versus the basic event contribution to 1/3 of the CDF. Clearly, an invalid comparison.

Even if the external event had been eliminated from the licensees F-V coefficients a credible comparison could not have been made because:

The SPAR model did not include the capability to provide AFW from Unit 2 to Unit 1.

Therefore, only three of the six licensee full scope model trains are reflected in the SPAR model. This compromised comparing any AFW F-V values.

The Charging Pump Cooling Water System was not modeled in SPAR. Therefore, there were no basic events or F-V values.

The SPAR model fault trees for Canal isolation to support Service Water System operation did not include the Unit 2 condenser isolation valves necessary to function to support Unit 1 operation. Also, the Unit 2 bearing cooling isolation valve needing to isolate to support Unit 1 operation was not included in the SPAR model. Therefore, due to modeling omissions, no Unit 2 isolation valves had basic events or F-V values. The Unit 1 bearing cooling isolation valves modeled in SPAR indicated that both valves,101A and 101B, must close for canal isolation. Actual plant operation was with one of the two valves always closed. Therefore, the basic event probability for one of the valves should be for fails open rather than fail to close.

The success criteria between the SPAR model and the licensees full scope model for the ESW pumps were significantly different which compromised a valid comparison of F-V values.

The success of Canal Isolation, including operation of waterbox vacuum breakers which were in the full scope model and not included in SPAR, to support Service Water Charging Pump Cooling Water trains were significantly different between SPAR and the licensees full scope model which compromised a valid comparison of F-V values.