ML032740009

Results of the Robinson SDP Phase 2 Notebook Benchmarking Visit, During June 2003

ML032740009
Person / Time
Site:	Robinson
Issue date:	09/30/2003
From:	Reinhart F NRC/NRR/DSSA/SPSB
To:	O'Reilly P, Richards S NRC/NRR/DIPM/IIPB, NRC/RES/DRAA/OERAB
Franovich M, NRR/DSSA/SPSB, 415-3361
References
Download: ML032740009 (28)

Text

September 30, 2003 MEMORANDUM TO: Stuart Richards, Chief Inspection Program Branch Division of Inspection Program Management Office of Nuclear Reactor Regulation Patrick D. OReilly Operating Experience Risk Applications Branch Division of Risk Analysis and Applications Office of Nuclear Regulatory Research FROM: Mark F. Reinhart, Chief /RA/

Licensing Section Probabilistic Safety Assessment Branch Division of Systems Safety and Analysis Office of Nuclear Reactor Regulation

SUBJECT:

RESULTS OF THE ROBINSON SDP PHASE 2 NOTEBOOK BENCHMARKING VISIT During June 2003, NRC staff and contractors visited the Progress Energy corporate offices in Raleigh, North Carolina to compare the H.B. Robinson Nuclear Power Plant Significance Determination Process (SDP) Phase 2 notebook and licensees risk model results to ensure that the SDP notebook was generally conservative. The current plant probabilistic risk assessments (PRAs) internal event core damage frequency was 4.075E-5/year excluding internal flood events and inter-system loss of coolant accidents. The Robinson PRA did not include an integrated PRA model with external initiating events (e.g. fire, seismic initiators).

Therefore sensitivity studies were not performed to determine any impact of external events on SDP color determinations. In addition, the results from analyses using the NRCs draft Revision 3i Standard Plant Analysis Risk (SPAR) model for Robinson were also compared with the licensees risk model. The results of the SPAR model benchmarking effort will be documented in the next revision of the SPAR (revision 3) model documentation.

In the review of the Robinson SDP notebook for the benchmark efforts, the team determined that some changes to the SDP notebook were needed to reflect how the Robinson Plant is currently designed and operated. Thirty three hypothetical inspection findings were processed through the SDP notebook and compared with the licensees related importance measures.

Using the Revision 0 SDP notebook, the team determined that 15.2 percent of the cases were less conservative, 54.5 percent of the cases were more conservative, and 30.3 percent of the cases were consistent with the licensees results. Of the conservative cases, 11 cases were two or more colors greater than the results obtained using the licensees model. Consequently, 68 changes were made to the SDP notebook.

CONTACT: Mike Franovich, SPSB/DSSA/NRR 415-3361

S. Richards 2 P. OReilly Using the Revision 1 SDP notebook, the team determined that 12.1 percent of the cases were less conservative, 45.5 percent of the cases were more conservative, and 42.4 percent of the cases were consistent with the licensees results. Of the conservative cases, all but 3 cases were one order of magnitude greater than the results obtained with the licensees model and as such were generally consistent with the expectation that the notebooks should be slightly conservative when compared with the licensees model.

The licensees PRA staff had substantial knowledge of both the Robinson PRA model and conduct of plant operations. The licensees comments greatly improved the quality and content of the SDP notebook.

Attachment A describes the process and specific results of the comparison of the Robinson SDP Phase 2 Notebook and the licensees PRA.

Attachment:

As stated

S. Richards 2 P. OReilly Using the Revision 1 SDP notebook, the team determined that 12.1 percent of the cases were less conservative, 45.5 percent of the cases were more conservative, and 42.4 percent of the cases were consistent with the licensees results. Of the conservative cases, all but 3 cases were one order of magnitude greater than the results obtained with the licensees model and as such were generally consistent with the expectation that the notebooks should be slightly conservative when compared with the licensees model.

The licensees PRA staff had substantial knowledge of both the Robinson PRA model and conduct of plant operations. The licensees comments greatly improved the quality and content of the SDP notebook.

Attachment A describes the process and specific results of the comparison of the Robinson SDP Phase 2 Notebook and the licensees PRA.

Attachment:

As stated Distribution: SPSB: r/f

• See previous concurrence Accession #

C:\ORPCheckout\FileNET\ML032740009.wpd NRR-096 OFFICE SPSB SPSB:SC Region II NAME MFranovich:nxh2 MReinhart *WRogers DATE 09/30/03 09/ 30 /03 09/19/03 OFFICIAL RECORD COPY

SUMMARY

REPORT ON BENCHMARKING TRIP TO H. B. ROBINSON STEAM ELECTRIC PLANT UNIT 2 G. Martinez-Guridi Brookhaven National Laboratory (BNL)

Energy Sciences and Technology Department Upton, NY 11973 ATTACHMENT A

Table of Contents Page

1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

2. Summary Results From Benchmarking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2

3. Proposed Revisions to the Rev. 0 SDP Notebook . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 3.1 Specific Changes to the Rev. 0 SDP Notebook for the H. B. Robinson Steam Electric Plant Unit 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 3.2 Generic Change in IMC 0609 for Guidance to NRC Inspectors . . . . . . . . . . . . 20 3.3 Generic Change to the SDP Notebook . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

4. Discussion on External Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

5. List of Participants . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 List of Tables Page Table 1. Summary of Benchmarking Results for H. B. Robinson Steam Electric Plant Unit 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Table 2. Comparative Summary of the Benchmarking Results - H. B. Robinson Steam Electric Plant Unit 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

-ii-

1. INTRODUCTION A benchmarking of the H. B. Robinson Steam Electric Plant Unit 2 Significance Determination Process (SDP) Risk-Informed Inspection Notebook was conducted during a visit to the Progress Energy corporate offices on June 23-25, 2003. Mike Franovich, Rudolph Bernhard and Walt Rogers (NRC), supported by Gerardo Martinez-Guridi (BNL), participated in this benchmarking exercise.

In preparation for the plant site visit, BNL staff reviewed the Rev. 0 Robinson SDP notebook and evaluated a set of hypothetical inspection findings using the Rev. 0 SDP notebook, plant system diagrams and information in the licensees updated PRA.

The major activities performed during this plant site visit were:

1. Discussed licensees comments on the Rev. 0 SDP notebook.

2. Obtained listings of the Risk Achievement Worth (RAW) values for basic events of the internal events PRA model.

3. Identified a target set of basic events (hypothetical inspection findings) for the benchmarking exercise.

4. Performed benchmarking of the Rev. 0 SDP notebook considering the licensees proposed modifications to this notebook.

5. Identified underestimates and overestimates and reviewed the licensees PRA model to determine the underlying reasons. Additional changes to the SDP notebook were made, as appropriate.

Chapter 2 presents a summary of the results obtained during benchmarking, Chapter 3 discusses the proposed revisions to the Rev. 0 SDP notebook, and Chapter 4 discusses the results from both internal and external events. Finally, Attachment 1 shows a list of the participants in the benchmarking activities.

2.

SUMMARY

RESULTS FROM BENCHMARKING Summary of Benchmarking Results Benchmarking of the SDP Notebook for the H. B. Robinson Steam Electric Plant Unit 2 was conducted comparing the risk significance of the inspection findings obtained using the notebook with that obtained using the plant PRA. The benchmarking identified the hypothetical inspection findings for which the results of the evaluation using the notebook were under or overestimations compared to the plant PRA.

Forty cases of hypothetical findings were evaluated. Seven of these cases were not modeled by the licensee, so the results of these cases from the Rev.1 SDP notebook could not be compared with the results from the licensees PRA. For the remaining 33 cases, a summary of the results of the risk characterization of hypothetical inspection findings is as follows:

12.1% (4 of 33 cases) Non-conservative; underestimation of risk significance (by one order of magnitude) 9.1% (3 of 33 cases) Conservative; overestimation of risk significance (by two orders of magnitude) 36.4% (12 of 33 cases) Conservative; overestimation of risk significance (by one order of magnitude) 42.4% (14 of 33 cases) Consistent risk significance Detailed results of Benchmarking are summarized in Table 1. This table consists of eight columns:

in the first two columns, the out-of-service components, including human errors, are identified for the case analyses. The colors assigned for significance characterization from using the Rev. 0 SDP notebook before incorporation of the licensees comments are shown in the third column. The licensees basic event or component for which the RAW was found, representing the hypothetical finding, is presented in the fourth column. The fifth and sixth columns show the RAW values and the associated colors, respectively, based on the licensees latest PRA model. The colors assigned for significance characterization from using the SDP notebook after incorporation of the licensees comments and the outcome of comparing the results between the SDP Rev. 1 notebook and the plant PRA are shown in the seventh column. Finally, the eighth column presents some comments about the evaluations.

A comparative summary of the benchmarking results is provided in Table 2. This table shows the number of cases where the SDP was more or less conservative or the SDP matched the outcome from the licensees PRA model. The percentages associated with these cases also are shown on this Table. The revised SDP notebook was consistent (same color) in 42.4% of the inspection findings, 45.5% of overestimates, and 12.1% of underestimates by one color.

In comparing the Rev. 0 notebook with the Rev. 1 notebook, a significant improvement was achieved with the updated notebook. The underestimates by one color were reduced from 15.2%

to 12.1%. The overestimates by three colors were eliminated, and the total number of overestimates was reduced from 54.5% to 45.5%, and the number of matches was increased from 30.3% to 42.4%. In addition, the Rev. 1 SDP notebook was improved from the Rev. 0 SDP notebook because it now incorporates plant-specific features of Robinson.

Observations on the Licensees PRA Two of the LOCA sizes have frequencies that are lower than those generic frequencies used in the SDP notebook. The PRAs medium LOCA (3"-13") frequency is 3.2E-6/year, and the PRAs small (class 2) LOCA (1.5"-3") frequency is 3.5E-5/year.

There were seven hypothetical findings evaluated by the SDP notebook that were not modeled by the licensees PRA: battery charger A of bus A fails, one boric acid transfer pump fails, one MSIV fails to close, one condensate pump fails, one primary water pump fails, one SG safety valve fails to open, and operator fails to trip the RCPs after loss of cooling. These seven findings are included in Table 1, but they are not included in Table 2 because no comparison of results could be done.

Discussion of Non-conservative Results by the Notebook The Rev. 1 notebook yielded 4 underestimates out of the 33 hypothetical findings evaluated: DS Diesel generator, one primary safety valve fails to open, ECCS piggyback valve SI-863A fails to open, and operator fails to align alternate cooling to charging pumps on LCCW/LSW. They are discussed next.

DS Diesel generator. The licensees PRA obtained yellow, and the Rev. 1 notebook yielded white.

The licensee considers that there is between 60 and 90 minutes to use the DS DG to restore cooling and power (for LOOP events) to the charging pumps to provide RCP seal cooling and assumes old style RCP seal, not qualified for high temperature exposure. The licensees model assumes seal failure will occur without cooling. On the other hand, the SDP notebook models new style, high temperature seals and the treatment of RCP seal LOCA follows the NRCs current position on this issue based on the NRCs staff review of the WOG-2000 model. According to this position, there is a probability of about 0.2 that a RCP seal LOCA will occur as soon as 15 minutes (from hydraulic instability in the seal package) after the onset of loss of cooling, so the SDP notebook does not credit the DS DG to prevent this LOCA. Therefore, the DS Diesel generator plays a more important role in the licensees PRA than in the SDP notebook.

One primary safety valve fails to open. The licensees PRA obtained yellow, and the Rev. 1 notebook yielded white. The licensees PRA has sequences with several transients, such as turbine trip, triggering an ATWS with a frequency of about 1E-5/year. The notebook uses a generic frequency for ATWS of 1E-6/year. Hence, the reason for this difference in colors between the licensees PRA and the Rev. 1 notebook is that the notebook gives a lower credit to the frequency of ATWS than the licensees PRA does.

ECCS piggyback valve SI-863A fails to open. The licensees PRA obtained yellow, and the Rev.

1 notebook yielded white. On failure of piggyback valve SI-863A, the notebook assigns a credit of 2 (1 train) to HPR. The licensees model has a failure probability of 4.8E-2 for a single valve to fail the other train of HPR. In addition, the notebooks credit for LOOP is 2, while the licensees frequency is 3.62E-2. Hence, the reason for this difference in colors between the licensees PRA and the Rev. 1 notebook is that the notebook gives a lower credit than the licensees PRA does to two items: 1) the credit to a single train of HPR (licensee = 4.8E-2, and notebook = 1E-2), and 2) the frequency of LOOP (licensee = 3.62E-2, and notebook = 1E-2).

Operator fails to align alternate cooling to charging pumps on LCCW/LSW. The licensees PRA obtained red (3), and the Rev. 1 notebook yielded red (4). An examination of the licensees cutsets revealed that the licensee considers that core damage follows after 1) a loss of either Component Cooling Water or Service Water, and 2) operators failing to establish alternate cooling to the charging pumps. On the other hand, as mentioned above, the SDP notebook follows the NRCs current position on this issue based on the NRCs staff review of the WOG-2000 model. According to this position, there is a probability of about 0.2 (a credit = 1) that a RCP seal LOCA will occur.

This underestimate is due to this additional credit of 1 given by the SDP notebook.

Discussion of Conservative Results by the Notebook The Rev. 1 notebook produced 16 overestimates, 3 by two orders of magnitude, and 13 overestimates by one order of magnitude. The 3 overestimates by two orders of magnitude are:

battery of bus A fails, one running pump of CCW fails, and operator fails to switchover to cold leg recirculation (HPR/LPR) in SLOCA. They are discussed next.

Battery of bus A fails. The licensees PRA obtained yellow, and the Rev. 1 notebook yielded red (3). The licensees PRA model considers that the battery charger can carry the SI loads. However, during the benchmarking meeting the licensee did not have documentation available to support this claim. Therefore, the SDP notebooks evaluation considered that the battery charger cannot carry the SI loads. The difference in colors is the result of these different assumptions.

One running pump of CCW fails. The licensees PRA obtained white, and the Rev. 1 notebook yielded red (4). On loss of CCW, it is necessary to provide alternative cooling to the charging pumps to prevent RCP seal LOCA. The licensee assessed a HEP = 5E-3, while the notebook estimated a credit of 1 for this action because it has to be completed shortly after the onset of loss of RCP seal cooling. Hence, the reason for this difference in colors between the licensees PRA and the Rev. 1 notebook is that the notebook gives a higher credit to alternative cooling to the charging pumps (1E-1) than the licensees PRA does (5E-3).

Operator fails to switchover to cold leg recirculation (HPR/LPR) in SLOCA. The licensees PRA obtained yellow, and the Rev. 1 notebook yielded red (3). For SLOCA, the notebook uses HPR and LPR; on the other hand, the licensees small LOCA (S1) model uses shutdown cooling (SDC).

On failure of SDC, the licensees model uses cold-leg recirculation. Therefore, recirculation is less important in the licensees model because it is used on failure of SDC.

The 13 overestimates by one order of magnitude are: emergency AC bus E1 fails, emergency AC bus E2 fails, Vital 125 VDC bus A fails, Vital 125 VDC bus B fails, one MDAFW pump fails, TDAFW pump fails, one charging pump fails, one deepwell pump fails, one HHSI pump fails, one primary PORV fails to open, one running SW pump fails, operator fails to depressurize RCS using SGs to less than setpoint of relief valves of SG after SGTR, and operator fails to refill the RWST after SGTR.

The reasons causing the overestimates by one color were not further investigated per the benchmarking process for this kind of estimate. However, two factors that may be contributing to the overestimates are:

1. As mentioned above, two of the LOCA sizes in the licensees PRA have frequencies that are lower than those generic frequencies used in the SDP notebook.

2. The licensee estimated the frequency of loss of instrument air = 3.18E-3/year. However, in the worksheet for Loss of Instrument Air (LIA), the team used the generic credit of 2.

Changes Incorporated Following Benchmarking Resulting in Updating of Benchmarking Results Following benchmarking, the team incorporated some additional changes to the Rev. 1 notebook resulting in updating of benchmarking results. They are:

1. Loss of Offsite Power (LOOP). Modified event tree and worksheet to include the sequences after success of the function Emergency AC Power (EAC). To this end, the function Motor-driven AFW pumps (MDAFW) was added to the event tree and worksheet.

2. Loss of Service Water (LSW). Modified event tree and worksheet to include a new function RCP Seal LOCA (SEAL) with a credit = 1. The event tree was modified to include sequences after success and failure of this function. Modified the sequences in the worksheet accordingly. Added footnote indicating that the treatment of RCP seal LOCA follows the NRCs current position on this issue based on the NRCs staff review of the WOG-2000 model.

3. Loss of Component Cooling Water (LCCW). Modified event tree and worksheet to include a new function RCP Seal LOCA (SEAL) with a credit = 1. The event tree was modified to include sequences after success and failure of this function. Modified the sequences in the worksheet accordingly. Added footnote indicating that the treatment of RCP seal LOCA follows the NRCs current position on this issue based on the NRCs staff review of the WOG-2000 model.

4. Transients (Reactor Trip) (TRANS), Loss of Emergency AC Bus E2 (LACE2), and Loss of DC Bus B (LDCB) worksheets. Changed the credit of the function Power Conversion System (PCS) to operator action = 2 because the licensee estimated a human error probability of about 1E-2 for recovering PCS.

Table 1 Summary of Benchmarking Results for H. B. Robinson Steam Electric Plant Unit 2 Internal Events CDF is 4.075E-5/year (no flood, no ISLOCA)

RAW Thresholds are White = 1.025, Yellow = 1.25, Red (4) = 3.46, and Red (3) = 25.55 No. Component Out SDP Basic Event Name Internal Plant SDP Comments of Service or Worksheet RAW CDF Worksheet Failed Operator Results (Highest) Color (2) Results Action (Before) (1) (After) (1)

Component 1 Emergency AC Red (2) %T12A 1.24 White Yellow Only IE bus E1 fails (over by 3) (over by 1) 2 Diesel generator Yellow PTMDGEDG-A 2.18 Yellow Yellow A fails (match) (match) 3 Emergency AC Red (2) %T12B 2.04 Yellow Red (4) Only IE bus E2 fails (over by 3) (over by 1) 4 Diesel generator Yellow PTMDGEDG-B 2.63 Yellow Yellow B fails (match) (match) 5 DS Diesel White UTMDGDSSDG 1.93 Yellow White generator (under by (under by 1) 1) 6 Vital 125 VDC Red (2) DPA%DPPAFN 6.8 Red (4) Red (4) Only IE contribution MCC (bus) A (over by 2) (match) fails 7 Battery of MCC Red (2) D%BATA 3.11 Yellow Red (3)

(bus) A fails (over by 3) (over by 2) 8 Battery charger Red (2) Not modeled Red (3)

A of MCC (bus) (not (not A fails modeled) modeled) 9 Vital 125 VDC Red (2) DPA%DPPBFN 11.3 Red (4) Red (3) IE and mitigating MCC (bus) B (over by 2) (over by 1) contribution fails 10 One MDAFW Red (3) FTMPMPTRAM 1.92 Yellow Red (4) pump fails (over by 2) (over by 1) 11 TDAFW pump Red (4) FTMSDPTRXM 2.76 Yellow Red (4) fails (over by 1) (over by 1) 12 Running pump Red (3) KPMCCWPBKR 1.22 White Red (4) of CCW fails (over by 3) (over by 2)

No. Component Out SDP Basic Event Name Internal Plant SDP Comments of Service or Worksheet RAW CDF Worksheet Failed Operator Results (Highest) Color (2) Results Action (Before) (1) (After) (1) 13 One charging Red (4) JTMCHGPMPA 1.23 White Yellow pump fails (over by 2) (over by 1) 14 One boric acid White (not Not modeled White transfer pump modeled) (not fails modeled) 15 One deepwell Red (4) YTMDWPUMPB 1.18 White Yellow pump fails (over by 2) (over by 1) 16 One fire pump Red (4) VTMMOTPUMP 1.4 Yellow Yellow fails (over by 1) (match) 17 One HHSI pump Yellow HPMSIPMCHS 1.07 White Yellow fails (over by 1) (over by 1) 18 One air Green ACP%%PACFN 1 Green Green compressor of (match) (match)

IA fails 19 One MSIV fails Yellow (not Not modeled Yellow to close modeled) (not modeled) 20 One Yellow Licensee did a run 1.36 Yellow Yellow accumulator (match) (match) fails 21 One Main Green MPMMFWPANN 1.05 White White Feedwater pump (under by (match) fails 1) 22 One condensate Green (not Not modeled White pump fails modeled) (not modeled) 23 One primary White (not Not modeled White water pump fails modeled) (not modeled) 24 One primary Red (4) RPVCV456NN 1.18 White Yellow PORV fails to (over by 2) (over by 1) open

No. Component Out SDP Basic Event Name Internal Plant SDP Comments of Service or Worksheet RAW CDF Worksheet Failed Operator Results (Highest) Color (2) Results Action (Before) (1) (After) (1) 25 One primary Yellow RPVCV456FF 2.41 Yellow Yellow PORV fails to (match) (match) close 26 One primary White RBVRC535FF 1.06 White White block valve fails (match) (match) to close 27 One primary White RRSC551AFF 1.39 Yellow White safety valve fails (under by (under by 1) to open 1) 28 One RHR pump Yellow LPMSIPAILS 1.35 Yellow Yellow fails (match) (match) 29 One SG PORV White QPVRV1-1NN 2.21 Yellow Yellow fails to open (under by (match) 1)

30 One SG safety Green (not Not modeled White valve fails to modeled) (not open modeled) 31 One running SW Red (4) WTMSWPD 2.03 Yellow Red (4) pump fails (over by 1) (over by 1) 32 ECCS piggyback White LMVS863ARH 1.51 Yellow White valve SI-863A (under by (under by 1) fails to open 1)

Operator Actions 33 Operator fails to Yellow OPER-3 1.67 Yellow Yellow conduct (match) (match)

Feed/Bleed 34 Operator fails to Red (4) X-OS-0001 3.01 Yellow Red (3) switchover to (over by 1) (over by 2) cold leg recirculation (HPR/LPR) in SLOCA

No. Component Out SDP Basic Event Name Internal Plant SDP Comments of Service or Worksheet RAW CDF Worksheet Failed Operator Results (Highest) Color (2) Results Action (Before) (1) (After) (1) 35 Operator fails to Red (3) X-OA-0001 1.52 Yellow Yellow switchover to (over by 2) (match)

LPR in LLOCA 36 Operator fails to Red (4) X-OR-0006 1.27 Yellow Red (4) OPER-DE depressurize (over by 1) (over by 1)

RCS using SGs to less than setpoint of relief valves of SG after SGTR 37 Operator fails to Yellow X-OR-0002 1.19 White Yellow OPER-80 refill the RWST (over by 1) (over by 1) after SGTR 38 Operator fails to White X-OT-43 1.05 White White conduct (match) (match) emergency boration after ATWS 39 Operator fails to Red (3) Not modeled Red (3) (not trip the RCPs (not modeled) after loss of modeled) cooling 40 Operator fails to Red (3) X-OQ-0002 48.62 Red (3) Red (4) align alternate (match) (under by 1) cooling to charging pumps on LCCW/LSW Notes:

1. When the color of the result of the SDP notebook is red, the number in parenthesis after the word Red is the order of magnitude yielded by the SDP notebook.

2. When the color corresponding to the plants CDF is red, the number in parenthesis after the word Red is the order of magnitude of the delta CDF (updated CDF - base-case CDF). For example, if the delta CDF is of the order of 1E-3, then the color is characterized as Red (3).

Table 2: Comparative Summary of the Benchmarking Results - H. B. Robinson Steam Electric Plant Unit 2 SDP Notebook SDP Notebook SDP Notebook is... Before (Rev. 0) After (Rev. 1)

Number of Percentage Number of Percentage Cases Cases Less conservative 5 15.2 4 12.1 by one color More conservative 7 21.2 12 36.4 by one color More conservative 7 21.2 3 9.1 by two colors More conservative 4 12.1 0 0.0 by three colors Matched 10 30.3 14 42.4 Total 33 100.0 33 100.0

3. PROPOSED REVISIONS TO THE REV. 0 SDP NOTEBOOK Based on insights gained from the plant site visit, a set of revisions are proposed for the Rev. 0 SDP notebook. The proposed revisions are based on the licensees comments on the Rev. 0 SDP notebook, better understanding of the current plant design features, consideration of additional recovery actions, use of revised Human Error Probabilities (HEPs) and initiator frequencies, and the results of benchmarking.

3.1 Specific Changes to the Rev. 0 SDP Notebook for the H. B. Robinson Steam Electric Plant Unit 2 The NRC staff participating in the benchmarking and the licensee provided several comments on the Rev. 0 SDP Notebook. In addition, several major revisions that directly impacted the color assignments by the SDP evaluation were discussed with the licensee and their resolutions were identified in the meeting. Several significant changes that had an impact on the evaluation of the notebook were incorporated during the visit, including revised HEPs and initiator frequencies. The proposed revisions are discussed below:

1. Table 1. Added footnote indicating that the licensee models stuck-open PORV in those scenarios that require opening of PORVs. Accordingly, the licensee does not have a separate event tree for SORV.

2. Table 2. Modified footnote indicating that the Robinson level 1 PRA addresses internal events. It does not address external events such as fires, earthquakes, hurricanes and external flooding. The plants CDF due to internal events (not including internal flooding and ISLOCAs) = 4.075E-5/year with a truncation frequency of 4E-9/year. The total CDF (including internal flooding and ISLOCAs) = 4.32E-5/year with the same truncation frequency.

The name of the PRA model is 721_2000.

3. Table 2. Added footnote indicating that the EDG day tank capacity is 270 gallons. It is maintained at least half full, which is enough for approximately 35 minutes of full load operation. There is one fuel oil transfer pump per EDG.

4. Table 2. Changed name from SBO DG to Dedicated Shutdown (DS) DG to be consistent with the plants nomenclature.

5. Table 2. Removed DC and SW from the list of support systems of DS DG because this DG does not require these systems to operate.

6. Table 2. Added row for ATWS Mitigating System Actuation Circuitry (AMSAC), including the columns for Major Components, Support Systems and Initiating Event Scenarios.

7. Table 2. Added SW and Deepwell pumps to the support systems of TDAFW because the normal suction source of AFW is the condensate storage tank, containing 134,000 gal. This water source is not adequate to maintain cooling for the mission time and one of the following alternative sources (in order of preference) is necessary: deepwell pump connection to the CST, SW connection to the AFW suction lines, or firewater system connected to the AFW header. The current PRA model does not credit the firewater system connected to the AFW header.

8. Table 2. Modified footnote indicating that on loss of DC bus A, manual action is required to control the TDP of AFW using instrumentation from the dedicated shutdown DC supply, or DC bus B.

9. Table 2. Added note indicating that the Component Cooling Water system (CCW) is cross-tied.

10. Table 2. Added note indicating that the charging pumps are positive displacement charging pumps (PDPs).

11. Table 2. Added footnote indicating that each PDP has a design flow rate of 77 gpm.

12. Table 2. Added footnote indicating that PDP A is powered from 480 VAC DS bus, PDP B is powered from 480 VAC bus E-1, and PDP C is powered from 480 VAC bus E-2.

13. Table 2. Added footnote indicating that there are two battery chargers per DC train. One is operating continuously to supply power to the DC MCCs from the AC power system. The other is a spare that is energized, but that requires manual alignment by an operator to place it in service. The licensees PRA model considers that the battery charger capacity is adequate to carry the SI loads. However, during the benchmarking meeting on June 23-25, 2003, the licensee did not have documentation available to support this claim. Therefore, it is considered that the battery charger capacity is not adequate to carry the SI loads.

Accordingly, inspection findings on the batteries should be treated similar to loss of the associated DC bus.

14. Table 2. Modified support system of Deepwell pumps from AC to Non-safety AC.

15. Table 2. Modified one of the fire pumps from One engine-driven pump to One diesel-driven pump. Modified footnote indicating that the diesel-driven fire pump has 2 dedicated batteries. The charging system of the batteries is normally supplied with AC power.

16. Table 2. Added footnote indicating that there are three HHSI pumps. One of them is an installed spare, not credited in the licensees PRA.

17. Table 2. Added footnote indicating that CCW is a support system for the HHSI pumps only for recirculation.

18. Table 2. Added DC dependency for MSIVs. Split the row of MSIVs to indicate that MSIV A depends on train A of DC, and MSIVs B and C depend on train B of DC.

19. Table 2. Added footnote indicating that the block valves of the primary PORVs are normally open.

20. Table 2. Added footnote indicating that 2 of the 3 RCPs have high-temperature o-seals.

21. Table 2. Split the row of Instrument Air (IA) into three rows for the Primary Air Compressor (PAC) (normally running), "A" & "B" compressors, and "D" compressor (alternates with PAC to supply the IA). Added the support systems for each of these compressors.

22. Table 2. Added footnote indicating that the PAC and the "D" compressor do not require cooling.

23. Table 2. Added note indicating that the steam-generator PORVs are powered by DC bus A.

Added footnote indicating that these PORVs can be manually operated. This operator action is credited in the licensees PRA.

24. Table 2. Added footnote indicating that the switchover from injection to recirculation is manual.

25. Table 2. Added footnote for Service Water System indicating that the SW pumps A and B are associated with bus E1, pumps C and D with bus E2, and pump D can be connected to the dedicated shutdown bus.

26. Table 2. Updated the column Initiating Event Scenarios for each system (row) in Table 2 according to the changes incorporated in the worksheets and to other changes incorporated in Table 2.

27. Table 2. Added footnote indicating that the Rev. 1 notebook yielded 4 underestimates out of the 33 hypothetical findings evaluated during benchmarking on June 23-25, 2003: DS Diesel generator, one primary safety valve fails to open, ECCS piggyback valve SI-863A fails to open, and operator fails to align alternate cooling to charging pumps on LCCW/LSW.

28. Table 2. Added footnote indicating that during benchmarking on June 23-25, 2003, the Rev.

1 notebook produced 16 overestimates, 3 by two orders of magnitude, and 13 overestimates by one order of magnitude. The 3 overestimates by two orders of magnitude are: battery of bus A fails, one running pump of CCW fails, and operator fails to switchover to cold leg recirculation (HPR/LPR) in SLOCA. The 13 overestimates by one order of magnitude are:

emergency AC bus E1 fails, emergency AC bus E2 fails, Vital 125 VDC bus A fails, Vital 125 VDC bus B fails, one MDAFW pump fails, TDAFW pump fails, one charging pump fails, one deepwell pump fails, one HHSI pump fails, one primary PORV fails to open, one running SW pump fails, operator fails to depressurize RCS using SGs to less than setpoint of relief valves of SG after SGTR, and operator fails to refill the RWST after SGTR.

29. Small LOCA (SLOCA) worksheet. Changed the success criteria of the function Primary Heat Removal, Feed/Bleed (FB) from 2/2 PORVs to 1/2 PORVs.

30. Added event tree for Stuck-open PORV (SORV).

31. Large LOCA (LLOCA) worksheet and event tree. Changed the function High Pressure Recirculation (HPR) to Low Pressure Recirculation (LPR) because the latter type of recirculation is used in a LLOCA.

32. Loss of Offsite Power (LOOP). Modified event tree and worksheet to include a new function RCP Seal LOCA (SEAL) with a credit = 1. The event tree and worksheet were modified to include sequences after success and failure of this function. Added footnote indicating that the treatment of RCP seal LOCA follows the NRCs current position on this issue based on the NRCs staff review of the WOG-2000 model.

33. Loss of Offsite Power (LOOP) worksheet. Modified footnote indicating that the licensee has a Dedicated Shutdown (DS) DG that powers DC bus A, and one CCW pump, SW pump, and charging pump. It also powers one RHR pump, but using this pump requires human action, and it is not credited in the licensees PRA in this scenario. The TDP of AFW can be controlled with power from DC bus A.

34. Loss of Offsite Power (LOOP) worksheet. Modified footnote indicating that the licensee estimated a HEP = 5.1E-3 for the similar action Operator fails to control AFW steam-driven pump flow during station blackout given dedicated shutdown diesel operability. Hence, this is an operator action, limited by hardware failure.

35. Loss of Offsite Power (LOOP) worksheet. Modified part of the success criteria of the function Turbine-driven AFW Pump (TDAFW) to ...aligning 1/1 service water pump to provide a suction source to AFW for long-term secondary heat removal... Modified footnote indicating that the operator has to align an additional suction source to AFW for long-term secondary heat removal. This action is represented by event Operator fails to use service water to supply AFW directly (OPER-18B, HEP = 4.0E-3), so it is an operator action, limited by hardware failure. The deepwell pumps are not powered from an onsite emergency power source, so they are not available in a LOOP scenario. In a SBO scenario, only the SW pump D, normally powered by the AC bus E2, can be powered by the DS DG. In scenarios where AC power has been recovered, the 4 SW pumps can be powered by the emergency AC buses E1 and E2.

36. Steam Generator Tube Rupture (SGTR) worksheet. Modified the success criteria of the function Primary/Secondary Pressure Equalization (EQ) from Operator depressurizes RCS using 2/2 remaining SG PORVs or 2/2 pressurizer PORVs to less than setpoint of relief valves of SG to Operator depressurizes RCS using (2/3 SG PORVs or 1/2 pressurizer PORVs) to less than setpoint of relief valves of SG. Modified footnote indicating that the licensee credits the affected SG, if its operation is necessary.

37. Steam Generator Tube Rupture (SGTR) worksheet. Modified the credit of the function Long-Term Makeup Water Source (LTMS2) from operator action = 1 to operator action = 2 because the licensee estimated a HEP = 3.5E-2.

38. Steam Generator Tube Rupture (SGTR) worksheet. Added footnote indicating that a credit to LTMS1 = 1 is given in the sequence SGTR - EQ - LTMS1 because LTMS1 is expected to have a dependency with EQ.

39. Steam Generator Tube Rupture (SGTR) worksheet. Modified the success criteria of the function Primary Heat Removal, Feed/Bleed (FB) from 2/2 PORVs to 1/2 PORVs because the licensees analysis indicated that only one PORV is required for FB in a SGTR.

40. Anticipated Transients Without Scram (ATWS) worksheet. Modified the success criteria of the function Turbine Trip (TTP) from Operator trips the turbine to AMSAC trips the turbine because the licensee credits the automatic operation of AMSAC.

41. Anticipated Transients Without Scram (ATWS) worksheet. Modified the success criteria and credit of the function Secondary Heat Removal (AFW) from 2/2 MDPs of AFW with 1/1 TDP of AFW and with operator aligning an additional suction source to AFW for long-term secondary heat removal (1 train) to [2/2 MDAFW trains with 1/1 TDAFW train (1 ASD train)]

to (2/3 steam generators with 4/4 SG safety valves open on each SG) and with operator aligning an additional suction source to AFW for long-term secondary heat removal. Added footnote indicating that the licensee assumes that secondary-side steam removal is available due to the low probability of failure and the low ATWS initiating event frequency, so the licensee does not model this steam removal. The team used a generic success criteria for this steam removal.

42. Main Steam Line Break Outside Containment (MSLB) worksheet. Added the steam relief paths from the SGs (1/1 SG PORV or 1/4 SG SRVs per SG) to the function Secondary Heat Removal (AFW).

43. Loss of Service Water (LSW) worksheet. Modified the success criteria of the function Alternate CCP Cooling (CLCH) to Operator establishes alternate cooling to 1/3 charging pumps using 1/2 Fire protection pumps.

44. Loss of Service Water (LSW) worksheet. Modified the success criteria of the function Secondary Heat Removal (MAFW) to Operator establishes alternate cooling for 1/2 MDAFW pumps using 1/2 Fire protection pumps...

45. Loss of Service Water (LSW) worksheet. Modified the success criteria of the function Long-Term Secondary Heat Removal (LAFW) from Operator uses 1/2 deepwell pumps to supply AFW directly for long-term secondary heat removal to Operator uses 2/3 deepwell pumps to supply AFW directly for long-term secondary heat removal.

46. Loss of Service Water (LSW) worksheet. Added the steam relief paths from the SGs (1/1 SG PORV or 1/4 SG SRVs per SG) to the functions Secondary Heat Removal (TAFW) and Secondary Heat Removal (MAFW).

47. Loss of Service Water (LSW) worksheet. Modified footnote indicating that the frequency of loss of Service Water is 2.25E-4/year.

48. Loss of Component Cooling Water (LCCW) worksheet. Modified the success criteria of the function Alternate CCP Cooling (CLCH) to Operator establishes alternate cooling to 1/3 charging pumps using 1/2 Fire protection pumps.

49. Loss of Component Cooling Water (LCCW) worksheet. Modified footnote indicating that the frequency of loss of Component Cooling Water is 1.70E-3/year.

50. Loss of Emergency AC Bus E1 (LACE1) worksheet and event tree. Since the licensee clarified that the Power Conversion System (PCS) is available after this loss, the event tree used for this transient is TRANS, and the worksheet was modified accordingly. Modified footnote indicating that a loss of emergency AC bus E1 causes the following: loss of HHSI train A, loss of RHR/LHSI train A, loss of MDAFW train A, loss of charging pump B, loss of power to block valve of PORV 456, loss of SG PORVs, loss of DC power train A (after associated battery is depleted), loss of two instrument buses, loss of two SW pumps, and loss of CCW pump A. Feed and bleed is still available because the DS DG can power the 480 VAC MCC5 (normally fed from E1) which can be used to power a primary PORV. The loss of power to two service water pumps is sufficient to result in a plant trip due to the need to isolate the turbine building loads. The frequency of loss of emergency AC bus E1 is 1.6E-2/year.

51. Loss of Emergency AC Bus E1 (LACE1) worksheet. Credit was given to the TDP of AFW in the function Secondary Heat Removal (AFW) because it can be operated manually. A footnote with this information was included.

52. Loss of Emergency AC Bus E1 (LACE1) worksheet. Modified the success criteria of the function Primary Heat Removal, Feed/Bleed (FB) from 2/2 PORVs (operator action = 2) to 2/2 PORVs with operator switching power source of one of them to the DS bus (operator action = 2). Added footnote indicating that one of the primary PORVs is powered by 125 VDC bus A which is powered by 480 VAC MCC5, which in turn is normally fed from emergency bus E1. On loss of bus E1, the operators can power MCC5 by switching to the DS bus which is normally supplied with power from non-safety 4KV bus 3 via station service transformer 2C.

53. Loss of Emergency AC Bus E1 (LACE1) worksheet. Modified footnote indicating that the use of the TDP of AFW requires local manual action to open the steam supply valves to the TDP of AFW, and manually controlling the flow of this pump. The licensee estimated a HEP =

5.1E-3 for the similar action Operator fails to control AFW steam-driven pump flow during station blackout given dedicated shutdown diesel operability. Hence, this is an operator action, limited by hardware failure.

54. Loss of Emergency AC Bus E1 (LACE1) worksheet. Added footnote indicating that the licensee estimated a HEP for the operator switching power source of one primary PORV to the DS bus = 1.0E-2. Hence, this action has a credit = 2.

55. Loss of Emergency AC Bus E2 (LACE2) worksheet and event tree. Since the licensee clarified that the Power Conversion System (PCS) is available after this loss, the associated event tree and the worksheet were modified accordingly. Modified footnote indicating that a loss of emergency AC bus E2 causes the following: loss of HHSI train B, loss of RHR/LHSI train B, loss of MDAFW train B, loss of charging pump C, loss of power to block valve of PORV 455C, loss of DC power train B (after associated battery is depleted), loss of two instrument buses, loss of two SW pumps, and loss of CCW pump B. Feed and bleed is failed because of the 2/2 PORV success criterion and PORV dependence on DC power. The loss of power to two service water pumps is sufficient to result in a plant trip due to the need to isolate the turbine building loads. The frequency of loss of emergency AC bus E2 is 1.6E-2/year. The event tree for loss of emergency AC bus E2 has the initiating event LBUS.

56. Loss of Emergency AC Bus E2 (LACE2) worksheet. Credit was given to the TDP of AFW in the function Secondary Heat Removal (AFW) because this pump is not affected by this loss.

57. Loss of DC Bus A (LDCA) worksheet and event tree. Since the licensee clarified that the Power Conversion System (PCS) is available after this loss, the associated event tree and the worksheet were modified accordingly. Modified footnote indicating that the loss of vital DC power bus A will result in a reactor trip and a loss of all control power to train A safety equipment and breakers associated with the 4160 volt bus 2 and the 480 volt bus E1.

Without power for breaker transfer, bus 2 will not transfer to the startup transformer which will cause buses 1, 2, and E1 to be de-energized. Power will be available on buses 3, 4, and E2. EDG E1 will start but will not function due to a DC dependence. Additionally, without DC power, breaker 52/17B (diesel generator output breaker) will not close. Therefore, the plant will be left with only one train of safety equipment. The equipment impacted by a loss of vital DC power bus A is presented in the worksheet for loss of emergency AC bus E1; operation of the SG PORVs from the control room is unavailable. The loss of this DC bus will generate a SI signal, which will isolate the MFW. MFW can be recovered by operator action (opening bypass valves). The frequency of loss of DC bus A is 3.76E-3/year. The event tree for loss of DC bus A has the initiating event LBUS.

58. Loss of DC Bus A (LDCA) worksheet. Modified footnote indicating that the use of the TDP of AFW requires local manual action to open the steam supply valves to the TDP of AFW, and manually controlling the flow of this pump using instrumentation from the dedicated shutdown (DS) DC supply (feeding 480 VAC MCC5), or DC bus B. MCC5 is normally fed from emergency bus E1 which is lost after a loss of DC bus A. On loss of bus E1, the operators can power MCC5 by switching to the DS bus which is normally supplied with power from non-safety 4KV bus 3 via station service transformer 2C. The licensee estimated a HEP = 1.0E-2 for the similar action Operator fails to switch source to DS bus. Hence, this is an operator action, limited by hardware failure.

59. Loss of DC Bus A (LDCA) worksheet. Added footnote indicating that the loss of this DC bus will generate a SI signal, which will isolate the MFW. MFW can be recovered by operator action (opening bypass valves). The licensee estimated a HEP for this action = 1E-2.

However, since this is an action that has to be carried out after MFW is isolated, and before SG dryout, the team assigned a credit = 1.

60. Loss of DC Bus B (LDCB) worksheet and event tree. Since the licensee clarified that the Power Conversion System (PCS) is available after this loss, the associated event tree and the worksheet were modified accordingly. Modified footnote indicating that the loss of DC bus B will result in a reactor trip. Train A AC power loads will be transferred from the units auxiliary transformer to the startup transformer along with buses 3 and E2. Thus, AC power will be retained on both emergency buses and the event will result in a loss of control power to the train B loads. The train B loads that are unavailable are presented in the worksheet for loss of emergency AC bus E2. Feed and bleed is not available because of the 2/2 PORV success criterion and PORV dependence on DC power. The frequency of loss of DC bus B is 3.76E-3/year. The event tree for loss of DC bus B has the initiating event LBUS.

61. Loss of DC Bus B (LDCB) worksheet. Credit was given to the TDP of AFW in the function Secondary Heat Removal (AFW) because this pump is not affected by this loss.

62. Removed the worksheet of LOOP with Loss of Emergency AC Bus E1 (LEAC1) because both primary block valves are fed from MCC 6 which is fed from emergency bus E2 of AC power.

63. LOOP with Loss of Emergency AC Bus E2 (LEAC). Removed the function Operator Re-closes Battery Charger Breakers (OPBR) from the worksheet and event tree because this function is already considered in the LOOP event tree.

64. LOOP with Loss of Emergency AC Bus E2 (LEAC) worksheet. Changed the success criteria of the function RCS Cooldown/Depressurization (DEP) to Operator depressurizes RCS using 1/3 steam generator PORVs to be consistent with the success criteria used in a similar depressurization after a small LOCA.

65. LOOP with Loss of Emergency AC Bus E2 (LEAC) worksheet. Added 1/1 SG PORV per SG to the success criteria of the function Secondary Heat Removal (AFW).

66. LOOP with Loss of Emergency AC Bus E2 (LEAC) worksheet. Modified footnote indicating that the reader should see the worksheet for Loss of Emergency AC Bus E2 for information on the impact on the plant. Both primary block valves are fed from MCC 6 which is fed from bus E2 of AC power. Hence, when emergency AC Bus E2 is lost, there is no motive power available to close the block valve of a stuck-open PORV.

67. LOOP with Loss of Emergency AC Bus E2 (LEAC) worksheet. Modified footnote indicating that the operator has to align an additional suction source to AFW for long-term secondary heat removal. SW pumps A and B are powered by bus E1 and can be used for this purpose.

This action is represented by event Operator fails to use service water to supply AFW directly (OPER-18B, HEP = 4.0E-3), and it is limited by hardware failure. The deepwell pumps are not powered from an onsite emergency power source, so they are not available in a LOOP scenario.

68. Loss of Instrument Air (LIA) worksheet. Modified footnote indicating that the licensee estimated the frequency of loss of instrument air = 3.18E-3/year. However, in this worksheet the team used the generic credit of 2.

3.2 Generic Change in IMC 0609 for Guidance to NRC Inspectors No recommendation for improving 0609 was identified.

3.3 Generic Change to the SDP Notebook No generic change to the SDP notebook was identified.

4. DISCUSSION ON EXTERNAL EVENTS The Robinson level 1 PRA addresses internal events. It does not address external events such as fires, earthquakes, hurricanes and external flooding. The plants CDF due to internal events (not including internal flooding and ISLOCAs) = 4.075E-5/year with a truncation frequency of 4E-9/year.

The total CDF (including internal flooding and ISLOCAs) = 4.32E-5/year with the same truncation frequency. The name of the PRA model is 721_2000.

5. LIST OF PARTICIPANTS Mike Franovich Nuclear Regulatory Commission/Office of Nuclear Reactor Regulation Rudolph Bernhard Nuclear Regulatory Commission/Region II Walt Rogers Nuclear Regulatory Commission/Region II Brad W. Dolan Progress Energy Steven L. Mabe Progress Energy Scott Brinkman Progress Energy John Poloski Idaho National Engineering and Environmental Laboratory Gerardo Martinez-Guridi Brookhaven National Laboratory