ML032681025

Results of the Virgil C. Summer SDP Phase 2 Notebook Benchmarking Visit

ML032681025
Person / Time
Site:	Summer
Issue date:	09/24/2003
From:	Reinhart F Division of Systems Safety and Analysis
To:	O'Reilly P, Richards S NRC/NRR/DIPM/IIPB, NRC/RES/DRAA/OERAB
Franovich M, NRR/DSSA/SPSB, 415-3361
References
Download: ML032681025 (31)

Text

September 24, 2003 MEMORANDUM TO: Stuart Richards, Chief Inspection Program Branch Division of Inspection Program Management Office of Nuclear Reactor Regulation Patrick D. OReilly Operating Experience Risk Applications Branch Division of Risk Analysis and Applications Office of Nuclear Regulatory Research FROM: Mark F. Reinhart, Chief /RA/ M. Caruso for Licensing Section Probabilistic Safety Assessment Branch Division of Systems Safety and Analysis Office of Nuclear Reactor Regulation

SUBJECT:

RESULTS OF THE VIRGIL C. SUMMER SDP PHASE 2 NOTEBOOK BENCHMARKING VISIT During May 2003, NRC staff and contractors visited the Summer Nuclear Power Plant in Jenkinsville, South Carolina to compare the Summer Significance Determination Process (SDP)

Phase 2 notebook and licensees risk model results to ensure that the SDP notebook was generally conservative. The current plant probabilistic risk assessments (PRAs) internal event core damage frequency was 4.74E-5/year excluding internal flood events. The Summer PRA did not include an integrated PRA model with external initiating events (e.g. fire, seismic initiators). Therefore sensitivity studies were not performed to determine any impact of external events on SDP color determinations. In addition, the results from analyses using the NRCs draft Revision 3i Standard Plant Analysis Risk (SPAR) model for Summer were also compared with the licensees risk model. The results of the SPAR model benchmarking effort will be documented in the next revision of the SPAR (revision 3) model documentation.

In the review of the Summer SDP notebook for the benchmark efforts, the team determined that some changes to the SDP notebook were needed to reflect how the Summer is currently designed and operated. Thirty seven hypothetical inspection findings were processed through the SDP notebook and compared with the licensees related importance measures. Using the Revision 0 SDP notebook, the team determined that 13.5 percent of the cases were less conservative, 48.5 percent of the cases were more conservative, 27 percent of the cases were consistent with the licensees results, and 10.8 percent not modeled in the notebook. Of the conservative cases, 7 cases were two or more colors greater than the results obtained using the licensees model. Consequently, 78 changes were made to the SDP notebook.

CONTACT: Mike Franovich, SPSB/DSSA/NRR 415-3361

S. Richards 2 P. OReilly Using the Revision 1 SDP notebook, the team determined that 0 percent of the cases were less conservative, 54 percent of the cases were more conservative, and 46 percent of the cases were consistent with the licensees results. Of the conservative cases, 9 cases were two or more colors greater than the results obtained using the licensees model.

The team identified several technical issues concerning the Summer PRA model. In some instances, a meaningful comparison between the licensees PRA and the SDP notebook could not be obtained. These technical issues involved modeling differences for initiators such as loss of instrument air, loss of component cooling water, and loss of service water.

Consequently, the team obtained many overestimates by two or more colors than what is typically achieved following benchmarking adjustments to an SDP notebook. The team recommends that the Summer Revision 1 SDP notebook be benchmarked against the licensees revised PRA model subsequent to the licensees evaluation and resolution of the teams comments and industry PRA certification comments.

Attachment A describes the process and specific results of the comparison of the Summer SDP Phase 2 Notebook and the licensees PRA.

Attachment:

As stated

S. Richards 2 P. OReilly Using the Revision 1 SDP notebook, the team determined that 0 percent of the cases were less conservative, 54 percent of the cases were more conservative, and 46 percent of the cases were consistent with the licensees results. Of the conservative cases, 9 cases were two or more colors greater than the results obtained using the licensees model.

The team identified several technical issues concerning the Summer PRA model. In some instances, a meaningful comparison between the licensees PRA and the SDP notebook could not be obtained. These technical issues involved modeling differences for initiators such as loss of instrument air, loss of component cooling water, and loss of service water.

Consequently, the team obtained many overestimates by two or more colors than what is typically achieved following benchmarking adjustments to an SDP notebook. The team recommends that the Summer Revision 1 SDP notebook be benchmarked against the licensees revised PRA model subsequent to the licensees evaluation and resolution of the teams comments and industry PRA certification comments.

Attachment A describes the process and specific results of the comparison of the Summer SDP Phase 2 Notebook and the licensees PRA.

Attachment:

As stated Distribution: SPSB: r/f W. Rogers

• See previous concurrence Accession #ML032681025 C:\ORPCheckout\FileNET\ML032681025.wpd NRR-096 OFFICE SPSB SPSB:SC Region II NAME *MFranovich:nxh2 MReinhart /RA/ M. Caruso for *WRogers DATE 09/22/03 09/24/03 09/19/03 OFFICIAL RECORD COPY

SUMMARY

REPORT ON BENCHMARKING TRIP TO V. C. SUMMER NUCLEAR STATION G. Martinez-Guridi Brookhaven National Laboratory (BNL)

Energy Sciences and Technology Department Upton, NY 11973 ATTACHMENT

Table of Contents Page

1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

2. Summary Results From Benchmarking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2

3. Proposed Revisions to Rev. 0 SDP Notebook . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 3.1 Specific Changes to the Rev. 0 SDP Notebook for the V. C. Summer Nuclear Station . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 3.2 Generic Change in IMC 0609 for Guidance to NRC Inspectors . . . . . . . . . . . . 23 3.3 Generic Change to the SDP Notebook . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23

4. Discussion on External Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 . List of Participants . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 List of Tables Page Table 1. Summary of Benchmarking Results for Summer . . . . . . . . . . . . . . . . . . . . . . . 8 Table 2. Comparative Summary of the Benchmarking Results . . . . . . . . . . . . . . . . . . 14 ii

1. Introduction A benchmarking of the V. C. Summer Nuclear Station Significance Determination Process (SDP)

Risk-Informed Inspection Notebook was conducted during a plant site visit on May 20-22, 2003.

Rudolph Bernhard, Mike Franovich, and Walt Rogers (NRC), supported by Gerardo Martinez-Guridi (BNL), participated in this benchmarking exercise.

In preparation for the plant site visit, BNL staff reviewed the Rev. 0 Summer SDP notebook and evaluated a set of hypothetical inspection findings using the Rev. 0 SDP notebook, plant system diagrams, and information in the licensees updated PRA.

The major activities performed during this plant site visit were:

1. Discussed licensees comments on the Rev. 0 SDP notebook.

2. Obtained listings of the Risk Achievement Worth (RAW) values for basic events of the internal events PRA model.

3. Identified a target set of basic events (hypothetical inspection findings) for the benchmarking exercise.

4. Performed benchmarking of the Rev. 0 SDP notebook with considerations of the licensees proposed modifications to this notebook.

5. Identified overestimates and reviewed the licensees PRA model to determine the underlying reasons. Additional changes to the SDP notebook were proposed, as appropriate.

Chapter 2 presents a summary of the results obtained during benchmarking, Chapter 3 discusses the proposed revisions to the Rev. 0 SDP notebook, and Chapter 4 discusses the results from both internal and external events. Finally, Attachment 1 shows a list of the participants in the benchmarking activities.

1

2. Summary Results From Benchmarking Summary of Benchmarking Results Benchmarking of the SDP Notebook for the V. C. Summer Nuclear Station was conducted comparing the risk significance of the inspection findings obtained using the notebook with that obtained using the plant PRA. The benchmarking identified the hypothetical inspection findings for which the results of the evaluation using the notebook were under or overestimations compared to the plant PRA.

Forty-one (41) cases of hypothetical findings were evaluated. Four (4) of them were not modeled by the licensee, so the results of these cases from the Rev.1 SDP notebook could not be compared with the results from the licensees PRA. For the remaining 37 cases, a summary of the results of the risk characterization of hypothetical inspection findings is as follows:

0.0% (0 of 37 cases) Non-conservative; underestimation of risk significance (by one order of magnitude) 2.7% (1 of 37 cases) Conservative; overestimation of risk significance (by five orders of magnitude) 21.6% (8 of 37 cases)Conservative; overestimation of risk significance (by two orders of magnitude) 29.7% (11 of 37 cases) Conservative; overestimation of risk significance (by one order of magnitude) 45.9% (17 of 37 cases) Consistent risk significance.

Detailed results of benchmarking are summarized in Table 1. This table consists of eight columns:

in the first two columns, the out-of-service components, including human errors, are identified for the case analyses. The colors assigned for significance characterization from using the Rev. 0 SDP notebook before incorporation of the licensees comments are shown in the third column. The licensees basic event or component for which the RAW was found, representing the hypothetical finding, is presented in the fourth column. The fifth and sixth columns show the RAW values and the associated colors, respectively, based on the licensees latest PRA model. The colors assigned for significance characterization from using the SDP notebook after incorporation of the licensees comments and the outcome of comparing the results between the SDP Rev. 1 notebook and the plant PRA are shown in the seventh column. Finally, the eighth column presents some comments about the evaluations.

A comparative summary of the benchmarking results is provided in Table 2. This table shows the number of cases where the SDP was more or less conservative or the SDP matched the outcome from the licensees PRA model. The percentages associated with these cases also are shown on this Table. The revised SDP notebook was consistent (same color) in 45.9% of the inspection findings, 54.1% of overestimates, and 0.0% of underestimates.

In comparing the Rev. 0 notebook with the Rev. 1 notebook, a significant improvement was achieved with the updated notebook. Four components that were not modeled by the Rev. 0 notebook are now modeled by the Rev. 1 notebook. All underestimates were eliminated. The two overestimates by three colors were eliminated. The number of matches was increased from 27.0%

2

to 45.9%. In addition, the Rev. 1 SDP notebook was improved from the Rev. 0 SDP notebook because it now incorporates plant-specific features of Summer.

Observations on the Licensees PRA The NRC team made the following observations on the licensees PRA during the benchmarking visit:

1. The licensees PRA does not credit the recovery of main feedwater. However, given a modification to allow bypass of FW isolation, the plant now has the capability to recover FW. Therefore, this recovery was credited in the worksheet for Transients (Reactor Trip)

(TRANS).

2. A Westinghouse analysis (March 2003) for Summer indicated that a MAAP thermal-hydraulic analysis revealed that core damage will occur after failure of the function Early Inventory, High Pressure Injection (EIHP) for small LOCAs in the range of 1" to 2".

Accordingly, the licensee models core damage after failure of EIHP.

3. Despite this Westinghouse analysis (March 2003), the licensee still credits a success path after SGTR and failure of EIHP. The NRC team considers that a SGTR is similar to a break in the range of 1" to 2", and therefore the SGTR event tree in the SDP notebook models core damage after failure of EIHP.

4. The licensee uses the charging/SI pumps for hot leg recirculation after a large LOCA.

5. The SDP notebook only models accumulators in large LOCA (LLOCA) based on generic review of 3-loop Westinghouse plants. The licensee only models accumulators in medium LOCA (MLOCA). Our understanding is that the licensee will model accumulators in LLOCA in the next PRA update.

6. The licensee does not model the operator refilling the RWST after a SGTR. However, the licensees documentation regarding SGTR indicates that ...Recovery via EOP-4.3 would be used if the RWST were depleted below 55% level or if the ruptured SG is close to being overfilled (level greater than 96%). This recovery procedure would allow the operator to add water to the RWST while cooling down and depressurizing the RCS near saturation...

Therefore, credit to refilling the RWST is given in the SGTR worksheet.

7. The documentation provided by the licensee (document entitled Core Damage Event Trees, DC00300-130, Rev. 0") on SGTR indicates that ...The RCS would also be depressurized (using either normal or auxiliary pressurizer spray or a PORV) to increase inventory and to minimize the break flow to the ruptured SG and the environment...

However, normal or auxiliary pressurizer spray are not modeled in the licensees PRA to implement pressure equalization.

8. Main Steam Line Break Outside Containment (MSLB) event tree and worksheet. The licensee models terminating safety injection after successful isolation (closing at least 2/2 MSIVs), EIHP and EFW. This event represents the operator action to terminate SI prior to pressurizer overfill. Failure implies the operator is unsuccessful in terminating SI, which will 3

require mitigation of a PORV or safety valve LOCA using HPR. This scenario was added to the SDPs event tree and worksheet.

9. Main Steam Line Break Outside Containment (MSLB) event tree. The licensee does not model pressurized thermal shock (PTS) leading directly to core damage in either of the following two scenarios: 1) failure to close at least 2/3 MSIVs, or 2) the sequence of a) failure to close 1/3 MSIVs, b) operators failing to close the FW isolation valves feeding the SG whose MSIV did not close, and c) operators fail to stop high pressure injection.

10. The licensee estimated the frequency of the initiating event Loss of Instrument Air (LOIA) = 9.17E-2/year. This frequency is higher than the generic credit for this initiating event used in the notebooks of other plants of similar design.

11. After a loss of Instrument Air, the operator has to control EFW flow locally and locally gag close SW supply valves to CCW; these actions are proceduralized. The licensee does not include these actions in its PRA model. There are air accumulators providing air for 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> for both EFW flow control valves and SW supply valves to CCW (XVG0967QA and B).

12. Component Cooling Water (CCW) provides cooling to the charging pumps, to the RCPs thermal barrier heat exchangers, to the RCPs motor bearing oil coolers, and to the RHR.

The RCP seals are cooled by either the charging pumps to seal injection or CCW to the thermal barrier heat exchanger. Hence, loss of CCW causes a loss of cooling to the RCP seals, which may cause a RCP seal LOCA. CCW is cooled by Service Water (SW). Loss of Service Water or loss of Component Cooling Water results in loss of cooling to CCW and the equipment cooled by CCW. The following points were noted for the licensees modeling of loss of SW or loss of CCW:

a) As mentioned in point 22, Tripping the RCP on loss of CCW, of section 2.1 of the SDP notebook, Generic Guidelines And Assumptions (PWRs), upon loss of CCW, cooling to the RCPs motor bearing oil coolers will be lost. The operation of RCPs without motor cooling could result in overheating and failure of bearings. Bearing failure, in turn, could cause the shaft to vibrate and thereby result in the potential for seal failure if the RCP is not tripped. In such cases, the operator is instructed to trip the RCPs early in the scenario (from 2 to 10 minutes after detecting the loss of cooling). Failure to perform this action is conservatively assumed to result in seal failure and, potentially, in a LOCA. The licensee does not model the operator tripping the RCPs on loss of cooling to the RCPs motor bearing oil coolers.

b) The licensee models RCP seal LOCA due to loss of cooling to the RCP seals, and calls it a consequential small LOCA. Different leak rates due to RCP seal LOCA are possible. The licensees leak rates are: 21 gallons per minute (gpm) per pump (gpmpp) with probability = 0.843, 57 gpmpp with probability = 0.0437, 76 gpmpp with probability = 0.0332, 183 gpmpp with probability = 0.0513 and 480 gpmpp with probability = 0.0283.

c) Once the RCP seal LOCA due to loss of cooling to the RCP seals has occurred, the licensee models it with an event tree that is the same as a conventional small LOCA.

Since high-pressure injection (HPI) is required to mitigate a small LOCA, the licensee credits the recovery of the operators providing alternative cooling to the HPI pumps (using demineralized water or fire service water pumps) so that the HPI pumps are 4

available to provide makeup to the vessel. If HPI is successful, the sequences of success in the licensees event tree eventually require high-pressure- or low-pressure-recirculation. The issue with this modeling is that the RHR pumps also are unavailable due to the loss of CCW or loss of SW. Hence, recirculation is not available, the RCP seal LOCA cannot be mitigated, and core damage is expected to follow.

The team also noted that the licensees model applies an event called CNU-8 to model seal LOCA. However, CNU-8 is tabulated and involves an AC recovery curve that is not applicable to normal losses of CCW.

d) The SDP notebook credits the recovery of the operators providing alternative cooling to the HPI pumps (using demineralized water or fire service water pumps) so that the HPI pumps are available to provide seal injection to prevent a RCP seal LOCA from occurring. The actions required must be performed outside of the control room, stress is expected to be high, and the time available for the operator to provide alternative cooling to the HPI pumps is short (about fifteen minutes). Therefore, the SDP notebook assigned a credit = 1E-1. The licensee estimated the human error probability (HEP) of operators failing to provide alternative cooling to the HPI pumps is of the order of 1E-3 because it is the product of the operator fails to establish demin water cooling to charging pumps (event OAAC1, HEP = 1E-2) and the conditional failure of operator fails to establish fire system cooling to these pumps (event OAAC2) after failure of OAAC1 (1.6E-1).

e) The licensees frequency of total loss of SW is 2.96E-5/year. The NRC staff pointed out that this value appears to be low compared to the generic frequency presented in NUREG/CR-5750, which is 9.7E-4/year. The comment was also made that fouling of the SW is one of the most likely ways to loose SW, and this mechanism is not taken into account in the licensees evaluation of the frequency of loss of SW. Taking into account external impacts, such as bio-fouling, was also mentioned. The SDP notebook currently uses the licensees frequency of loss of SW.

13. Four (4) out of the 41 hypothetical findings evaluated during the benchmarking visit are not modeled in the licensees PRA. These 4 findings are: one fuel oil transfer pump fails to run, one pressurizer safety valve fails to open, pressurizer spray fails, and operator fails to provide a long-term RCS makeup source (such as refilling the RWST). The outcomes of the SDP evaluations of these 4 findings are included in Table 1, but they are not included in Table 2 because they could not be compared with results from the licensees PRA.

Discussion of Non-conservative Results by the Notebook The Rev. 1 notebook yielded no underestimates.

Discussion of Conservative Results by the Notebook The Rev. 1 notebook produced 20 overestimates, 1 by five orders of magnitude, 8 by two orders of magnitude, and 11 overestimates by one order of magnitude. The overestimate by five orders of magnitude is the (normal) battery charger of Safeguards Power 125 VDC bus A fails. The 5

licensees PRA obtained green, and the notebook yielded red (2). This difference is because of different assumptions in treating this failure by the notebook and the licensee. There is one battery charger in each DC bus and one swing battery charger that can be manually connected. A failure of a battery charger activates an alarm in the control room. Hence, the licensee considers that the failure of the charger would not cause the loss of its associated DC bus because corrective actions can be taken before this loss and therefore a limited exposure period. On the other hand, the current SDP evaluation rules assume that without the battery charger the associated battery will discharge under normal loads and result in a loss of the DC bus, and require that each worksheet specified by Table 2 (of the notebook) for the equipment powered by the affected DC train to be solved considering this equipment unavailable.

The 8 overestimates by two orders of magnitude are: one diesel-driven air compressor fails to start, one SG safety valve fails to open, one SG PORV fails to open, one MSIV fails to close, one pressurizer PORV fails to close, one running SW pump fails to run, diesel-driven fire pump fails to start, and demineralized water pump XPP-71A fails to run. They are discussed next.

One diesel-driven air compressor fails to start. The licensees PRA obtained green, and the notebook yielded yellow (over by 2). This compressor is credited by the notebook to mitigate a loss of Instrument Air (LOIA). However, the licensees current PRA does not credit this compressor to mitigate a LOIA. Therefore, this compressor becomes more important in the SDP notebook.

One SG safety valve fails to open. The licensees PRA obtained green, and the notebook yielded yellow (over by 2). The SG safety valves are used for steam relief from the SGs. Since there is ample redundancy to satisfy this function, the licensees model gives green for the loss of a single SG safety valve. On the other hand, the current SDP evaluation requires counting the base case of every sequence where this valve appears. Thus, while all these sequences are of value 6 or less, the counting rule used by the current SDP evaluation produces a yellow.

One SG PORV fails to open. The licensees PRA obtained green, and the notebook yielded yellow (over by 2). The SG PORVs are used for depressurization and for steam relief from the SGs.

Similar to the case of one SG safety valve, the plant has redundancy to satisfy these functions, so the licensees model gives green for the loss of a single SG PORV. On the other hand, the current SDP evaluation requires, by the usage rules in NRC manual Chapter 0609, counting the base case of every sequence where this valve appears. Thus, while all these sequences are of value 6 or less, the counting rule used by the current SDP evaluation produces a yellow.

One MSIV fails to close. The licensees PRA obtained green, and the notebook yielded yellow (over by 2). The cause of the overestimate by two colors of one MSIV failing to close is that the SDP notebook considers that pressurized thermal shock (PTS) occurs if more than one MSIV fails to close after an MSLB, while the licensees PRA model does not include PTS due to MSIV failures.

One pressurizer PORV fails to close. The licensees PRA obtained green, and the notebook yielded yellow (over by 2). Our evaluation using the SDP notebook considers that this failure causes the initiating event Stuck-open PORV (SORV), resulting in yellow. The licensee informed us during the benchmarking visit that this failure does not cause an initiating event in its PRA. A review of the licensees dominant cutsets indicates that the licensees PRA models one pressurizer PORV failing to close after an ATWS triggered by a transient (such as turbine trip). The most dominant cutset with this scenario has a frequency = 3.0E-11/year. Hence, the difference in resulting colors from the licensees PRA and the notebook is due to this difference in modeling.

6

One running SW pump fails to run. The licensees PRA obtained yellow, and the notebook yielded red (3) (over by 2). As mentioned before, the licensees PRA and the SDP notebook model the recovery of the operators providing alternative cooling to the HPI pumps (using demineralized water or fire service water pumps) so that the HPI pumps are available. The main reason for the difference between the color obtained by the licensees PRA and the one yielded by the notebook is that there is a difference of about two orders of magnitude between the credit given by these two models to this recovery. The SDP notebook assigned a credit = 1E-1, and the licensee estimated a HEP of the order of 1E-3 because it is the product of the operator fails to establish demin water cooling to charging pumps (event OAAC1, HEP = 1E-2) and the conditional failure of operator fails to establish fire system cooling to these pumps (event OAAC2) after failure of OAAC1 (1.6E-1).

Diesel-driven fire pump fails to start. The licensees PRA obtained green, and the notebook yielded yellow (over by 2). This pump is used in scenarios of loss of cooling from the CCW to the thermal barrier of the RCPs and to the charging pumps. In the notebook model, the diesel-driven fire pump can be used to provide alternative cooling to the charging pumps before an RCP seal LOCA occurs. As described above, the main reason for the difference between the color obtained by the licensees PRA and the one yielded by the notebook is that there is a difference of about two orders of magnitude between the credit given by these two models to this recovery. The SDP notebook assigned a credit = 1E-1, and the licensee estimated a HEP of the order of 1E-3.

Demineralized water pump XPP-71A fails to run. The licensees PRA obtained green, and the notebook yielded yellow (over by 2). The reason for this difference is identical to the one for the diesel-driven fire pump fails to start. Please see the explanation above.

The 11 overestimates by one order of magnitude are: Safeguards Power 125 VDC bus A fails, Safeguards Power 125 VDC bus B fails, battery of Safeguards Power 125 VDC bus A fails, running CCW pump fails, MDEFW pump A fails to run, MDEFW pump B fails to run, one pressurizer PORV fails to open, one primary PORV block valve fails to close, spare SW pump C fails to start, operator fails to carry out pressure equalization after SGTR, and operator fails to conduct emergency boration (after ATWS).

The reasons causing the overestimates by one color were not further investigated per the benchmarking process for this kind of estimate. However, some of the issues identified in the section entitled Observations on the Licensees PRA of this report may be contributing to these overestimates.

Changes Incorporated Following Benchmarking Resulting in Updating of Benchmarking Results No changes were incorporated following benchmarking that resulted in updating of benchmarking results.

7

Table 1 Summary of Benchmarking Results for Summer Internal Events CDF is 4.74E-5/year (excluding internal floods), at a truncation limit of 1.0E-11/year.

RAW Thresholds are White = 1.02, Yellow = 1.21, Red (4) = 3.11, and Red (3) = 22.10 No. Component Out of SDP Worksheet Basic Event Name Internal Plant SDP Worksheet Comments Service or Failed Results RAW CDF Results Operator Action (Before) (1) Color (2) (After) (1)

Component 1 Bus A of Red (3) (match) AABS--XSW1DAOP 38.84 Red (3) Red (3) (match)

Safeguards Power 7.2 KV fails 2 Diesel generator A Yellow (under by AADG-----DGAFS 5.36 Red (4) Red (4) (match) fails to start 1) 3 One fuel oil transfer White (not Licensee does not White (not pump fails to run modeled) model in current PRA modeled) 4 Safeguards Power Red (4) (under Run carried out by 38.09 Red (3) Red (2) (over by 125 VDC bus A fails by 1) licensee 1) 5 Safeguards Power Red (4) (match) Run carried out by 13.89 Red (4) Red (3) (over by 125 VDC bus B fails licensee 1) 6 Battery of Red (4) (under Run carried out by 38.09 Red (3) Red (2) (over by The licensee Safeguards Power by 1) licensee 1) indicated that it was 125 VDC bus A fails not sure that a battery charger had the capacity to start (and carry) the emergency loads without the battery on an Safety Injection (SI) signal.

Accordingly, we used the RAW for the DC bus A.

No. Component Out of SDP Worksheet Basic Event Name Internal Plant SDP Worksheet Comments Service or Failed Results RAW CDF Results Operator Action (Before) (1) Color (2) (After) (1) 7 (Normal) battery Red (4) (over by RABCI--XBC1AFA 1.0 Green Red (2) (over by Battery charger charger of 3) 5) XBC1A fails during Safeguards Power operation 125 VDC bus A fails 8 One accumulator Green (under by NACVXVC8956AFO 1.3 Yellow Yellow (match) We used outlet check fails 2) valve fails to open as surrogate.

9 Running CCW Red (4) (over by Run carried out by 2.79 Yellow Red (4) (over by The licensees model pump fails 1) licensee 1) assumes that the A train is running and the B train is in standby. The C CCW pump is aligned to backup the A train so the A pumps RAW is lower than the B train pump.

10 A Charging/SI Red (4) (match) Run carried out by 3.41 Red (4) Red (4) (match) pump Fails to run licensee 11 Swing charging Yellow (under by Run carried out by 3.45 Red (4) Red (4) (match) pump C Fails to 1) licensee run 12 One boric acid White (over by Run carried out by 1.0 Green Green (match) transfer pump fails 1) licensee 13 MDEFW pump A Yellow (match) DAPM--XPP21AFR 1.96 Yellow Red (4) (over by Fails to run 1) 14 MDEFW pump B Yellow (match) DBPM--XPP21BFR 2.47 Yellow Red (4) (over by Fails to run 1) 15 Turbine driven EFW Red (4) (match) DBPT----XPP8FR 3.67 Red (4) Red (4) (match) pump Fails to run

No. Component Out of SDP Worksheet Basic Event Name Internal Plant SDP Worksheet Comments Service or Failed Results RAW CDF Results Operator Action (Before) (1) Color (2) (After) (1) 16 One motor-driven White (match) XCCM---XAC12FS 1.12 White White (match) Compressor XAC-12 air compressor fails fails to start to start 17 One diesel-driven Yellow (over by XDCM--DIESELFS 1.00 Green Yellow (over by This compressor is air compressor fails 2) 2) not credited to to start mitigate LIA in the licensees current model.

18 One SG safety Yellow (over by Run carried out by 1.0 Green Yellow (over by valve fails to open 2) licensee 2) 19 One SG PORV fails Yellow (over by Run carried out by 1.00 Green Yellow (over by to open 2) licensee 2) 20 One MSIV fails to Yellow (over by EAAVXVM2801AFC 1.00 Green Yellow (over by Licensee does not close 2) 2) model PTS.

21 One pressurizer Yellow (over by WAAVPCV445ATFO 1.03 White Yellow (over by Pressurizer PORV PORV fails to open 1) 1) PCV-00445A-RC fails to open due to local fault 22 One pressurizer White (over by WAAVPCV0445AFC 1.00 Green Yellow (over by Pressurizer PORV PORV fails to close 1) 2) PCV-00445A-RC fails to reclose due to local faults (licensee does not model as IE) 23 One primary PORV White (over by Run carried out by 1.00 Green White (over by block valve fails to 1) licensee 1) close 24 One pressurizer White (not Not modeled White (not safety valve fails to modeled) modeled) open

No. Component Out of SDP Worksheet Basic Event Name Internal Plant SDP Worksheet Comments Service or Failed Results RAW CDF Results Operator Action (Before) (1) Color (2) (After) (1) 25 Pressurizer spray White (not Not modeled White (not fails modeled) modeled) 26 One RHR/LHSI Red (4) (over by GBPMXPP0031BFR 2.03 Yellow Yellow (match) pump fails to run 1) 27 One containment Red (4) (over by IAMVXVG8811AFO 2.93 Yellow Yellow (match) sump valve fails to 1) open 28 One piggyback Yellow (match) GAMVXVG8706AFO 1.35 Yellow Yellow (match) valve fails to open 29 One running SW Red (3) (over by Run carried out by 1.30 Yellow Red (3) (over by SW pump XPP-45A pump fails to run 2) licensee 2) fails to run 30 Spare SW pump C Red (4) (over by Run carried out by 2.56 Yellow Red (4) (over by fails to start 1) licensee 1) 31 AMSAC fails to trip Not modeled by AMS_1 1.07 White White (match) turbine SDP notebook 32 RWST Level Red (2) (over by Q-SIRWSTLOLOFA 74.29 Red (3) Red (3) (match)

Transmitters fail 1) high (mis cal) 33 Diesel-driven fire Not modeled by ASDXPP134BFS 1.01 Green Yellow (over by pump fails to start SDP notebook 2) 34 Demineralized Not modeled by ASC--XPP71AFR 1.01 Green Yellow (over by water pump XPP- SDP notebook 2) 71A fails to run Operator Actions 35 Operator fails to Red (4) (over by OAB1HCD 1.0 Green Green (match) carry out 3)

Feed/Bleed during SLOCA and SGTR

No. Component Out of SDP Worksheet Basic Event Name Internal Plant SDP Worksheet Comments Service or Failed Results RAW CDF Results Operator Action (Before) (1) Color (2) (After) (1) 36 Operator fails to Red (4) (match) OAR4 8.57 Red (4) Red (4) (match) switchover for high pressure recirculation 37 Operator fails to Red (3) (match) OAR2 67.11 Red (3) Red (3) (match) non-LLOCA switchover for low pressure recirculation 38 Operator fails to Red (4) (over by OAD_1 2.13 Yellow Red (4) (over by carry out pressure 1) 1) equalization after SGTR 39 Operator fails to Yellow (not Not modeled by Yellow (not provide a long-term modeled) licensee modeled)

RCS makeup source (such as refilling the RWST) 40 Operator fails to White (over by Run carried out by 1.00 Green White (over by conduct emergency 1) licensee (event 1) boration (after OAE_1)

ATWS) 41 Operator fails to Not modeled by OAAC1 and OAAC2 5.71 Red (4) Red (4) (match) align alternative SDP notebook and OAAC_C cooling to a charging pump

Notes:

1. When the color of the result of the SDP notebook is red, the number in parenthesis after the word Red is the order of magnitude yielded by the SDP notebook.

2. When the color corresponding to the plants CDF is red, the number in parenthesis after the word Red is the order of magnitude obtained from the following calculation: (Base-case CDF)

• RAW.

Table 2: Comparative Summary of the Benchmarking Results SDP Notebook SDP Notebook SDP Notebook is... Before (Rev. 0) After (Rev. 1)

Number of Percentage Number of Percentage Cases Cases Not modeled by 4 10.8 0 0.0 notebook Less conservative 1 2.7 0 0.0 by two colors Less conservative 4 10.8 0 0.0 by one color More conservative 11 29.7 11 29.7 by one color More conservative 5 13.5 8 21.6 by two colors More conservative 2 5.4 0 0.0 by three colors More conservative 0 0.0 0 0.0 by four colors More conservative 0 0.0 1 2.7 by five colors Matched 10 27.0 17 45.9 Total 37 99.9 (1) 37 99.9 (1)

Note:

1. The total percentage is not exactly 100.0 due to roundoff error.

14

3. Proposed Revisions to Rev. 0 SDP Notebook Based on insights gained from the plant site visit, a set of revisions are proposed for the Rev. 0 SDP notebook. The proposed revisions are based on the licensees comments on the Rev. 0 SDP notebook, better understanding of the current plant design features, consideration of additional recovery actions, use of revised Human Error Probabilities (HEPs) and initiator frequencies, and the results of benchmarking.

3.1 Specific Changes to the Rev. 0 SDP Notebook for the V. C. Summer Nuclear Station The NRC staff participating in the benchmarking and the licensee provided several comments on the Rev. 0 SDP Notebook. In addition, several major revisions that directly impacted the color assignments by the SDP evaluation were discussed with the licensee and their resolutions were identified in the meeting. Several significant changes that had an impact on the evaluation of the notebook were incorporated during the visit, including revised HEPs and initiator frequencies. The proposed revisions are discussed below:

1. Table 1. Moved Loss of Service Water (LSSW) from row VI to row V because the licensees updated frequency for this loss is 2.96E-5/year.

2. Table 1. Loss of Instrument Air (LOIA) has a frequency = 9.175E-2/reactor-year. It was moved from row II to row I after the benchmarking on May 20-22, 2003.

3. Table 1. Added footnote indicating that the loss of one 125 VDC Vital bus has a frequency of about 8.8E-4/year. Since this frequency is close to the upper end of range IV, it was moved from row IV to row III during the benchmarking on May 20-22, 2003.

4. Table 2. Modified footnote indicating that the Summer PRA is an internal events only PRA.

The internal events (excluding internal flood) core damage frequency (CDF) is 4.74E-5/year at a truncation limit of 1.0E-11/year. Seismic events are not incorporated into the Summer PRA at present. However, the licensee considers that seismic is not a large contributor to risk. A seismic margins analysis was performed for the IPEEE. Also, a Probabilistic Seismic Hazard Evaluation was performed. High winds, external floods and transportation accidents are not incorporated into the Summer IPEEE. The licensee stated that the evaluation performed for Generic Letter 88-20, Supplement 4, shows that the risk posed by these potential initiating events is very small. Fire is not incorporated into the Summer PRA model.

An addendum study was performed for the IPEEE RAI response. The addendum study is the latest fire risk analysis for Summer.

5. Table 2. Added footnote indicating that a loss of a 7.2 KV-AC bus of the Safeguards Power System does not cause a plant trip. Technical Specifications require shutdown in 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />.

6. Table 2. Added row for ATWS Mitigating System Actuation Circuitry (AMSAC), including the columns for Major Components, Support Systems, and Initiating Event Scenarios.

7. Table 2. Added note indicating that the three pumps of CCW are configured in two split loops.

15

8. Table 2. Added footnote indicating that the three CCW booster pumps provide cooling for the RCPs thermal barrier. They are powered by non-safety AC power.

9. Table 2. Added footnote indicating that backup cooling to any of the three charging/SI pumps can be provided by 1) demineralized water, 2) fire service water, and 3) chilled water. The licensee does not give credit in its PRA model to backup cooling provided by chilled water.

10. Table 2. Changed the number of boric acid transfer pumps from 1 to 2.

11. Table 2. Added footnote indicating that the capacity of CST is 500,000 gallons. 180,000 gallons are reserved for EFW.

12. Table 2. Added footnote indicating that the flow control valves of the EFW are powered from 125 VDC.

13. Table 2. Added row for Fire Service Water, including the columns for Major Components, Support Systems, and Initiating Event Scenarios.

14. Table 2. Split the row for Instrument Air (IA) into four rows, one row for each of the two motor-driven air compressors, one row for the motor-driven breathing-air compressor, and one row for the diesel-driven air compressor (Sullair). The specific support systems for each compressor were added.

15. Table 2. Added footnote indicating that the SG PORVs have accumulators as backup and can be manually opened.

16. Table 2. Added footnote indicating that two SG PORVs are powered by DC bus A, and one SG PORV is powered by DC bus B.

17. Table 2. Added footnote indicating that there is one PORV and one atmospheric steam dump valve per SG. The SG PORV is upstream of the MSIV, and the atmospheric steam dump valve is downstream of the MSIV.

18. Table 2. Added Fuel oil transfer pumps as support system of the Onsite Standby Power System. Added footnote indicating that there are two 100% capacity fuel oil transfer pumps for each EDG. The fuel oil day tank capacity is 550 gallons. The day tank will provide 90 minutes of EDG run time at full load.

19. Table 2. Added footnote indicating that the primary PORVs fail closed on loss of air or DC power.

20. Table 2. Added footnote indicating that two primary PORVs are powered by DC bus A, and one primary PORV is powered by DC bus B.

21. Table 2. Modified footnote indicating that the primary PORVs are air-operated and fail closed. Two PORVs (PCV-445A and PCV-444B) have a tank of air as a backup supply that permits up to six valve strokes for each PORV. Feed and bleed can be done by opening the PORVs once, and then keeping them open.

16

22. Table 2. Added footnote indicating that primary block valves A and C are powered from safeguards 7.2 KV-AC bus B, and primary block valve B is powered from safeguards 7.2 KV-AC bus A.

23. Table 2. Added Pressurizer auxiliary spray, including the columns for Support Systems, and Initiating Event Scenarios.

24. Table 2. Added Pressurizer normal spray, including the columns for Support Systems, and Initiating Event Scenarios.

25. Table 2. Added footnote indicating that the licensees current PRA models unqualified (old)

RCP seals.

26. Table 2. Added row for Reactor Makeup Pumps, including the columns for Major Components, Support Systems, and Initiating Event Scenarios.

27. Table 2. Added row for Reactor Water Storage Tank (RWST), including the columns for Major Components, Support Systems, and Initiating Event Scenarios. Added footnote indicating that the useable capacity of the RWST is 450,000 gallons. Technical specification 3.5.4 requires a minimum contained borated water volume of 453,800 gallons. The conservative value for useable water volume can be estimated to be 443,939 gallons.

28. Table 2. Revised the column Initiating Event Scenarios for all systems/components in Table 2 according to the changes to the dependencies and to the worksheets, as described in this section.

29. All worksheets using the function High Pressure Recirculation (HPR). Changed the credit to operator action = 2 because the licensees human error probability (HEP) = 1.5E-2.

Added footnote with this information.

30. Transients (Reactor Trip) (TRANS) worksheet. Added footnote indicating that the licensees PRA does not credit the recovery of main feedwater. However, given a modification to allow bypass of FW isolation, the plant now has the capability to recover FW. Accordingly, this worksheet gives credit to this recovery. We gave a minimum credit of operator action = 1" to this recovery.

31. Transients (Reactor Trip) (TRANS) worksheet. Removed the steam relief path from the steam generators because this worksheet now credits the PCS.

32. Small LOCA (SLOCA) event tree and worksheet. A Westinghouse analysis (March 2003) for Summer indicated that a MAAP thermal-hydraulic analysis revealed that core damage will occur after failure of the function Early Inventory, High Pressure Injection (EIHP) for small LOCAs in the range of 1" to 2". Accordingly, the licensee models core damage after failure of EIHP. Therefore, removed from the event tree the sequences of success after failure of EIHP, and modified the sequences in the worksheet accordingly. Added footnote with this information.

33. Small LOCA (SLOCA) worksheet. Changed the credit for the function RCS Cooldown/Depressurization (DEP) to operator action = 2 because the licensee assessed a HEP = 5.1E-3. Added footnote with this information.

17

34. Small LOCA (SLOCA) worksheet. For the sake of clarity, re-arranged the success criteria of the steam relief from the steam generators as [(1/5 SG safety valves or 1/1 steam generator PORV or 1/1 atmospheric dump valve) per SG or 1/2 condenser dump valves].

35. Stuck-open PORV (SORV) event tree and worksheet. A Westinghouse analysis (March 2003) for Summer indicated that a MAAP thermal-hydraulic analysis revealed that core damage will occur after failure of the function Early Inventory, High Pressure Injection (EIHP) for small LOCAs in the range of 1" to 2". Accordingly, the licensee models core damage after failure of EIHP. Therefore, removed from the event tree the sequences of success after failure of EIHP, and modified the sequences in the worksheet accordingly.

Added footnote with this information.

36. Stuck-open PORV (SORV) worksheet. Changed the credit for the function RCS Cooldown/Depressurization (DEP) to operator action = 2 because the licensee assessed a HEP = 5.1E-3. Added footnote with this information.

37. Stuck-open PORV (SORV) worksheet. For the sake of clarity, re-arranged the success criteria of the steam relief from the steam generators as [(1/5 SG safety valves or 1/1 steam generator PORV or 1/1 atmospheric dump valve) per SG or 1/2 condenser dump valves].

38. Medium LOCA (MLOCA) event tree and worksheet. Modified the tree to require the function RCS Cooldown/Depressurization (DEP) after success of the function Early Inventory, High Pressure Injection (EIHP) to reach the conditions for the function Low Pressure Recirculation (LPR). On failure of DEP after successful EIHP, the function High Pressure Recirculation (HPR) is asked. The sequences in the worksheet were modified accordingly.

39. Medium LOCA (MLOCA) worksheet. Changed the credit for the function RCS Cooldown/Depressurization (DEP) to operator action = 2 because the licensee assessed a HEP = 5.1E-3. Added footnote with this information.

40. Large LOCA (LLOCA) event tree and worksheet. Removed the function Early Inventory, High Pressure Injection (EIHP) from the event tree, and the sequences in the worksheet were modified accordingly.

41. Large LOCA (LLOCA) worksheet. The original function Early Inventory, Low Pressure Injection (LPI) was divided into two functions to give appropriate credit to the accumulators and the RHR trains: Accumulators (ACCUM) with a credit of 2/2 remaining accumulators (1 train) and Low Pressure Injection (LPI) with a credit of 1/2 RHR trains (1 multi-train system).

42. Large LOCA (LLOCA) worksheet. Added footnote indicating that the licensee uses the charging/SI pumps for hot leg recirculation.

43. Loss of Offsite Power (LOOP) worksheet. Added footnote indicating that the licensee assessed a probability of failure to recover AC power within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> = 3.68E-1.

44. Loss of Offsite Power (LOOP) worksheet. Changed the credit for the function Recovery of AC Power in < 5 Hrs (REC5) to operator action = 1 because the licensee assessed a 18

probability of failure to recover AC power within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> = 1.83E-1, conditional on failing to recover AC power within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. Added footnote with this information.

45. Steam Generator Tube Rupture (SGTR) event tree and worksheet. A Westinghouse analysis (March 2003) for Summer indicated that a MAAP thermal-hydraulic analysis revealed that core damage will occur after failure of the function Early Inventory, High Pressure Injection (EIHP) for small LOCAs in the range of 1" to 2". However, the licensee still credits a success path after SGTR and failure of EIHP. The SDP event tree considers that a SGTR is similar to a break in this range. Therefore, removed from the event tree the sequences of success after failure of EIHP, and modified the sequences in the worksheet accordingly. Added footnote with this information.

46. Steam Generator Tube Rupture (SGTR) worksheet. Changed the success criteria of the function Long-Term RCS Makeup Source (LTMS) to Operator refills RWST using 1/2 reactor makeup pumps and 1/2 boric acid transfer pumps. Added footnote indicating that the licensee does not model the operator refilling the RWST. However, the licensees documentation regarding SGTR indicates that ...Recovery via EOP-4.3 would be used if the RWST were depleted below 55% level or if the ruptured SG is close to being overfilled (level greater than 96%). This recovery procedure would allow the operator to add water to the RWST while cooling down and depressurizing the RCS near saturation... Therefore, credit to refilling the RWST is given in this worksheet with a credit = 1.

47. Steam Generator Tube Rupture (SGTR) worksheet. For the sake of clarity, re-arranged the success criteria of the steam relief from the steam generators as [(1/5 associated SG safety valves or 1/1 steam generator PORV or 1/1 atmospheric dump valve) per steam line not connected to damaged SG or 1/2 condenser dump valves].

48. Anticipated Transients Without Scram (ATWS) worksheet. Changed the success criteria of the function Emergency Boration (EMBO) to Operator conducts emergency boration using 1/2 charging pumps trains with 1/2 boric acid transfer pumps.

49. Anticipated Transients Without Scram (ATWS) worksheet. Changed the credit for the function Secondary Heat Removal (EFW) to 1 ASD train because the success criteria for this function is 2/2 MDPs of EFW with 1/1 TDP of EFW. Updated the numerical value of the credit in the sequence that uses the function EFW.

50. Anticipated Transients Without Scram (ATWS) worksheet. Added the steam relief path in the function Secondary Heat Removal (EFW) as 1/5 SG safety valves on 3/3 SGs.

51. Main Steam Line Break Outside Containment (MSLB) event tree and worksheet. The licensee models terminating safety injection after successful isolation (closing at least 2/2 MSIVs), EIHP and EFW. This event represents the operator action to terminate SI prior to pressurizer overfill. Failure implies the operator is unsuccessful in terminating SI, which will require mitigation of a PORV or safety valve LOCA using HPR. This scenario was added to the SDPs event tree and worksheet. Added footnote with his information.

52. Main Steam Line Break Outside Containment (MSLB) worksheet. Changed the credit for the function Stop Injection (STIN) to operator action = 2 because the licensees HEP =

5.2E-3. Added footnote with this information.

19

53. Main Steam Line Break Outside Containment (MSLB) worksheet. For the sake of clarity, re-arranged the success criteria of the steam relief from the steam generators as (1/5 SG safety valves or 1/1 steam generator PORV) per SG.

54. Loss of Instrument Air (LOIA) worksheet. Changed the credit for the function Secondary Heat Removal (EFW) to operator action = 2 because the operator has to control EFW flow locally and locally gag close SW supply valves to CCW; these actions are proceduralized.

The licensee does not include these actions in its PRA model. Since there are air accumulators providing air for 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> for both EFW flow control valves and SW supply valves to CCW (XVG0967QA and B), we consider that these actions have a credit = 2.

Added footnote with this information.

55. Loss of Instrument Air (LOIA) worksheet. Added footnote indicating that the primary PORVs are air-operated and fail closed. Two PORVs (PCV-445A and PCV-444B) have a tank of air as a backup supply that permits up to six valve strokes for each PORV. Feed and bleed can be done by opening the PORVs once, and then keeping them open.

56. Loss of Instrument Air (LOIA) worksheet. Added footnote indicating that the licensees HEP for the function Operator Starts Backup Source of IA (OAA) = 1.0E-2. Hence, this action has a credit = 2.

57. Loss of Instrument Air (LOIA) worksheet. Added footnote indicating that the steam admission valve (IFV2030) of the turbine-driven pump of EFW is an air operated valve with DC solenoids supplied from either DC train. It has a slow opening feature to admit steam slowly to prevent overspeed of this pump. On loss of instrument air or DC it would fail open.

58. Loss of Instrument Air (LOIA) worksheet. Modified footnote indicating that the initiating event Loss of Instrument Air (LOIA) has a frequency = 9.17E-2/year. Since this frequency is close to the upper end of range II of Table 1, it was assigned a credit = 1 during the benchmarking on May 20-22, 2003.

59. Loss of Instrument Air (LOIA) worksheet. For the sake of clarity, re-arranged the success criteria of the steam relief from the steam generators as (1/5 SG safety valves or 1/1 SG PORV) per SG.

60. Loss of Service Water (LSSW) event tree and worksheet. Developed a new event tree with just one successful sequence comprised of three functions: RCP Trip (RCPT), Operator Provides Alternative Cooling (COOL), and Secondary Heat Removal (EFW). Failure of any of these functions causes core damage.

61. Loss of Service Water (LSSW) worksheet. Changed the credit of the initiating event because the licensees updated frequency for this event is 2.96E-5/year. Added footnote indicating that the frequency of total loss of SW is 2.96E-5/year. Service water provides cooling to CCW which, in turn, provides cooling to the charging pumps, to the RCPs thermal barrier heat exchangers, to the RCPs motor bearing oil coolers, and to the RHR. The operators have to trip the RCPs in less than 3 minutes after loss of cooling to the RCPs motor bearing oil coolers to avoid a RCP seal LOCA. If this action fails, it is considered that core damage follows. Backup cooling to any of the three charging/SI pumps can be provided by 1) demineralized water, 2) fire service water, and 3) chilled water. The licensee does not give credit in its PRA model to backup cooling provided by chilled water. Backup cooling to any of the three charging/SI pumps has to be provided within fifteen minutes after loss of RCP 20

seal cooling to prevent a RCP seal LOCA. If backup cooling fails and this LOCA occurs, core damage follows because the RHR system is not available to provide recirculation.

62. Loss of Service Water (LSSW) worksheet. Added footnote indicating that since the actions required to provide alternative cooling to the HPI pumps must be performed outside of the control room, stress is expected to be high, and the time available for the operator to provide alternative cooling to the HPI pumps is short (about fifteen minutes), we assigned a credit = 1.

63. Loss of Service Water (LSSW) worksheet. For the sake of clarity, re-arranged the success criteria of the steam relief from the steam generators as [(1/5 SG safety valves or 1/1 steam generator PORV or 1/1 atmospheric dump valve) per SG or 1/2 condenser dump valves].

64. Loss of Component Cooling Water (LCCW) event tree and worksheet. Developed a new event tree with just one successful sequence comprised of three functions: RCP Trip (RCPT), Operator Provides Alternative Cooling (COOL), and Secondary Heat Removal (EFW). Failure of any of these functions causes core damage.

65. Loss of Component Cooling Water (LCCW) worksheet. Added footnote indicating that the frequency of total loss of CCW is 1.32E-4/year. CCW provides cooling to the charging pumps, to the RCPs thermal barrier heat exchangers, to the RCPs motor bearing oil coolers, and to the RHR. The operators have to trip the RCPs in less than 3 minutes after loss of cooling to the RCPs motor bearing oil coolers to avoid a RCP seal LOCA. If this action fails, it is considered that core damage follows. Backup cooling to any of the three charging/SI pumps can be provided by 1) demineralized water, 2) fire service water, and 3) chilled water.

The licensee does not give credit in its PRA model to backup cooling provided by chilled water. Backup cooling to any of the three charging/SI pumps has to be provided within fifteen minutes after loss of RCP seal cooling to prevent a RCP seal LOCA. If backup cooling fails and this LOCA occurs, core damage follows because the RHR system is not available to provide recirculation.

66. Loss of Component Cooling Water (LCCW) worksheet. Added footnote indicating that since the actions required to provide alternative cooling to the HPI pumps must be performed outside of the control room, stress is expected to be high, and the time available for the operator to provide alternative cooling to the HPI pumps is short (about fifteen minutes), we assigned a credit = 1.

67. Loss of Component Cooling Water (LCCW) worksheet. For the sake of clarity, re-arranged the success criteria of the steam relief from the steam generators as [(1/5 SG safety valves or 1/1 steam generator PORV or 1/1 atmospheric dump valve) per SG or 1/2 condenser dump valves].

68. Split the worksheet for Loss of One 125 VDC Vital Bus (LBDC) into two worksheets for Loss of 125 VDC Vital Bus A (LDCA) and Loss of 125 VDC Vital Bus B (LDCB) because each of these two losses has a different impact on the plant.

69. Loss of 125 VDC Vital Bus A (LDCA) worksheet. Added footnote indicating that the loss of 125 VDC Vital bus A has a frequency = 8.79E-4/year. Since this frequency is close to the upper end of range IV of Table 1, it was assigned a credit = 3 during the benchmarking on May 20-22, 2003. The following conditions result from the loss of bus 1HA:

21

Only the train of safeguards equipment aligned to DC bus 1HB would be operable.

The EFW turbine-driven pump will autostart on a signal from train B.

Steam dump to condenser and atmospheric dump valves are not available (MSIVs are closed).

Two steam generator PORVs lose DC power. The operator can open them using local manual control, but this recovery action is not credited here.

Two pressurizer PORVs are inoperable (fail closed).

Since two pressurizer PORVs are inoperable, feed and bleed cannot be implemented. EFW is the only way to remove decay heat.

70. Loss of 125 VDC Vital Bus A (LDCA) worksheet. Added footnote indicating that the steam admission valve (IFV2030) of the turbine-driven pump of EFW is an air operated valve with DC solenoids supplied from either DC train. It has a slow opening feature to admit steam slowly to prevent overspeed of this pump. On loss of instrument air or DC it would fail open.

There are no other steam valves to (or from) this pump with a DC power dependency.

71. Loss of 125 VDC Vital Bus B (LDCB) worksheet. Added footnote indicating that the loss of 125 VDC Vital bus B has a frequency = 8.80E-4/year. Since this frequency is close to the upper end of range IV of Table 1, it was assigned a credit = 3 during the benchmarking on May 20-22, 2003. The following conditions result from the loss of bus B:

Only the train of safeguards equipment aligned to DC bus A would be operable.

The EFW turbine-driven pump will autostart on a signal from train A.

Steam dump to condenser and atmospheric dump valves are not available (MSIVs are closed).

One steam generator PORV loses DC power. The operator can open it using local manual control, but this recovery action is not credited here.

One pressurizer PORV is inoperable (fails closed).

The event tree for Loss of 125 VDC Vital Bus B (LDCB) is the same as the one for Transients Without PCS (TPCS).

72. Loss of 125 VDC Vital Bus B (LDCB) worksheet. Added footnote indicating that the steam admission valve (IFV2030) of the turbine-driven pump of EFW is an air operated valve with DC solenoids supplied from either DC train. It has a slow opening feature to admit steam slowly to prevent overspeed of this pump. On loss of instrument air or DC it would fail open.

There are no other steam valves to (or from) this pump with a DC power dependency.

73. LOOP with Loss of One Division of AC (LEAC) event tree and worksheet. A Westinghouse analysis (March 2003) for Summer indicated that a MAAP thermal-hydraulic analysis revealed that core damage will occur after failure of the function Early Inventory, High Pressure Injection (EIHP) for small LOCAs in the range of 1" to 2". Accordingly, the licensee models core damage after failure of EIHP. Therefore, removed from the event tree the sequences of success after failure of EIHP, and modified the sequences in the worksheet accordingly.

Added footnote with this information.

74. LOOP With Loss of One Division of AC (LEAC) worksheet. Modified footnote indicating that on Loss of One Division of AC, one train of safeguard equipment is unavailable. The pressurizer PORVs block valves are powered by 480 VAC. Block valves A and C are powered from safeguards 7.2 KV-AC bus B, and block valve B is powered from safeguards 7.2 KV-AC bus A. After a Loss of One Division of AC, at least one of the three block valves cannot be closed to isolate a pressurizer PORV that fails to close.

22

75. LOOP With Loss of One Division of AC (LEAC) worksheet. Added footnote indicating that the LEAC initiator and worksheet apply to loss of either bus A or B. Feed/Bleed (FB) is credited because one PORV is stuck open, initially there is DC power from the batteries to operate the remaining PORVs, and continued operation of one PORV would be sufficient for FB after battery depletion.

76. LOOP With Loss of One Division of AC (LEAC) worksheet. For the sake of clarity, re-arranged the success criteria of the steam relief from the steam generators as (1/5 SG safety valves or 1/1 steam generator PORV or 1/1 atmospheric dump valve) per SG.

77. Interfacing System LOCA (ISLOCA) worksheet. Added to the worksheet the 4 significant plant-specific ISLOCA flow paths identified by the IPEs ISLOCA analysis. Added footnote with this information.

78. Interfacing System LOCA (ISLOCA) worksheet. Added footnote indicating that the suction lines of the Residual Heat Removal System are considered by the licensee to be the pathway with the most severe ISLOCA due to its effect on the long-term heat removal capability of the plant.

3.2 Generic Change in IMC 0609 for Guidance to NRC Inspectors Based on the lessons from this benchmarking, a recommendation for improving 0609 is as follows:

3.3 Generic Change to the SDP Notebook No generic change to the SDP notebook was identified.

23

4. Discussion on External Events The Summer PRA is an internal events only PRA. The internal events (excluding internal flood) core damage frequency (CDF) is 4.74E-5/year at a truncation limit of 1.0E-11/year.

Seismic events are not incorporated into the Summer PRA at present. However, the licensee considers that seismic is not a large contributor to risk. A seismic margins analysis was performed for the IPEEE. Also, a Probabilistic Seismic Hazard Evaluation was performed.

High winds, external floods and transportation accidents are not incorporated into the Summer IPEEE. The licensee stated that the evaluation performed for Generic Letter 88-20, Supplement 4, shows that the risk posed by these potential initiating events is very small.

Fire is not incorporated into the Summer PRA model. An addendum study was performed for the IPEEE RAI response. The addendum study is the latest fire risk analysis for Summer.

24

Attachment 1. List of Participants Rudolph Bernhard Nuclear Regulatory Commission/Region II Mike Franovich Nuclear Regulatory Commission/Office of Nuclear Reactor Regulation Walt Rogers Nuclear Regulatory Commission/Region II Dennis Baker South Carolina Electric and Gas Co.(SCE&G), Operations John Cobb SCE&G, PRA Tyndall Estes SCE&G, PRA Leo J. Kachnik SCE&G, PRA Gerald A. Loignon, Jr. SCE&G, Quality Assurance Robert Buell Idaho National Engineering and Environmental Laboratory Gerardo Martinez-Guridi Brookhaven National Laboratory 25