ML050960041

Final Precursor Analysis - IP-2 Grid Loop

ML050960041
Person / Time
Site:	Indian Point
Issue date:	12/17/2004
From:	Christopher Hunter NRC/RES/DRAA/OERAB
To:
Shared Package
ML060030075	List: ML050950555 ML050950565 ML050960036 ML050960041 ML050960051 ML050960242 ML050960252 ML050960263 ML060030080
References
LER 03-005
Download: ML050960041 (13)

Text

Enclosure Final Precursor Analysis Accident Sequence Precursor Program --- Office of Nuclear Regulatory Research Indian Point 2 Automatic Reactor Trip and Loss of Offsite Power Due to the August 14, 2003, Transmission Grid Blackout Event Date 8/14/2003 LER: 247/03-005 CCDP1 = 6x10-6 December 17, 2004 Event Summary At 1611 hours0.0186 days <br />0.448 hours <br />0.00266 weeks <br />6.129855e-4 months <br /> on August 14, 2003, Indian Point 2 experienced grid instability, a reactor coolant pump trip on underfrequency, and a subsequent reactor trip while operating at 100% power. Plant emergency diesel generators (EDGs) started and supplied power to safety-related plant loads until offsite power was restored. Attachment A is a timeline of significant events (References 1 and 2).

Cause. The reactor trip and loss of offsite power (LOOP) were caused by grid instability associated with the regional transmission system blackout that occurred on August 14, 2003.

Other conditions, failures, and unavailable equipment. No other significant conditions, failures, or unavailable equipment occurred during the event.

Recovery opportunities. Con Edison System Operators informed the control room that power was restored to the 138kV Buchanan yard feeder at 1749 hours0.0202 days <br />0.486 hours <br />0.00289 weeks <br />6.654945e-4 months <br />. Offsite power was restored to the first emergency bus at 1945 hours0.0225 days <br />0.54 hours <br />0.00322 weeks <br />7.400725e-4 months <br />, to the second emergency bus at 2002 hours0.0232 days <br />0.556 hours <br />0.00331 weeks <br />7.61761e-4 months <br />, and to the third emergency bus at 2021 hours0.0234 days <br />0.561 hours <br />0.00334 weeks <br />7.689905e-4 months <br />. (Reference 2).

Analysis Results

! Conditional Core Damage Probability (CCDP)

The CCDP for this event is 6x10-6. The acceptance threshold for the Accident Sequence Precursor Program is a CCDP of 1x10-6. This event is a precursor.

Mean 5% 95%

Best estimate 6x10-6 2x10-7 2x10-5

! Dominant Sequences The dominant core damage sequence for this assessment is LOOP sequence 17 (75.4%

of the total CCDP). The LOOP event tree is shown in Figure 1.

1 For the initiating event assessment, the parameter of interest is the measure of the CCDP. This is the value obtained when calculating the probability of core damage for an initiating event with subsequent failure of one or more components following the initiating event. The reported value is the estimated mean CCDP.

1

LER 247/03-005 The events and important component failures in LOOP sequence 17 are:

S loss of offsite power occurs, S reactor shutdown succeeds, S emergency power is available, S auxiliary feedwater is unavailable, and S feed and bleed fails.

! Results Tables S The CCDP value for the dominant sequence is shown in Table 1.

S The event tree sequence logic for the dominant sequence is presented in Table 2a.

S Table 2b defines the nomenclature used in Table 2a.

S The most important cut sets for the dominant sequence are listed in Table 3.

S Table 4 presents names, definitions, and probabilities of (1) basic events whose probabilities were changed to update the referenced SPAR model, (2) basic events whose probabilities were changed to model this event, and (3) basic events that are important to the CCDP result.

Modeling Assumptions

! Assessment Summary This event was modeled as a loss of offsite power initiating event. Rev. 3.10 (SAPHIRE

7) of the Indian Point 2 SPAR model (Ref. 3) was used for this assessment. The specific model version used as a starting point for this analysis is dated December 10, 2004.

Since this event involves a LOOP of significant duration (potentially longer than the battery depletion time), probabilities of nonrecovery of offsite power at different times following the LOOP are important factors in the estimation of the CCDP.

Best estimate: Offsite power to the plants switchyard is assumed to be stable and useable when reported as such to plant operators by load dispatchers. This occurred at 1749 hours0.0202 days <br />0.486 hours <br />0.00289 weeks <br />6.654945e-4 months <br />, about 1.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> following LOOP, in this event. Failure to recover offsite power to plant safety-related loads (if needed because EDGs fail to supply the loads), given recovery of power to the switchyard, could result from (1) operators failing to restore proper breaker line-ups, (2) breakers failing to close on demand, or (3) a combination of operator and breaker failures. The dominant contributor to failure to recover offsite power to plant safety-related loads in this situation is operators failing to restore proper breaker line-ups.

This analysis assumed that at least 30 minutes are necessary to restore power to an emergency bus given that offsite power is available in the switchyard.2 The time available for operators to restore proper breaker line-ups to prevent core damage is dependent on specific accident sequences and is modeled as such using the SPAR human reliability model (Ref. 4). Assumptions described below, combined with the assumption of offsite power restoration described above, form the bases for the LOOP nonrecovery probabilities.

! Important Assumptions 2

Sensitivity analysis has shown that the difference between 30 and 60 minutes restoration time has minimal effect on the results.

2

LER 247/03-005 Important assumptions regarding power recovery modeling include the following:

S No opportunity for the recovery of offsite power to safety-related loads is considered for any time prior to power being available in the switchyard.

S At least 30 minutes are required to restore power to emergency loads after power is available in the switchyard.

S SPAR models do not credit offsite power recovery following battery depletion.

The GEM program used to determine the CCDP for this analysis can be used to calculate probabilities of recovering offsite power at various time points of importance to the analysis based on historical data for grid-related LOOPs. In this analysis, this feature was overridden; offsite power recovery probabilities were based on (1) known information about when power was restored to the switchyard and (2) use of the SPAR human error model to estimate probabilities of failing to realign power to emergency buses for times after power was restored to the switchyard.

Attachment B is a general description of analysis of LOOP events in the Accident Sequence Precursor Program. It includes a description of the approach to estimating offsite power recovery probabilities.

! Basic Event Probability Changes Table 4 includes basic events whose probabilities were changed to reflect the event being analyzed. The bases for these changes are as follows:

S Probability of failure to recover offsite power in 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> (OEP-XHE-XL-NR01H).

During the event, offsite power was not available in the switchyard until 1.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> after the LOOP. Therefore, there was no opportunity to recover offsite power in 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> and OEP-XHE-XL-NR01H was set to TRUE.

S Probability of failure to recover offsite power in 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> (OEP-XHE-XL-NR02H). During the event, offsite power was not available in the switchyard until 1.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> after the LOOP. Therefore, the operators had 0.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> to recover offsite power to the vital safety buses. Using the SPAR human error model to determine the value (see Attachment C), OEP-XHE-XL-NR02H was set to 1.0x10-1.

S Probability of failure to recover offsite power in 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> (OEP-XHE-XL-NR03H). During the event, offsite power was available in the switchyard 1.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> after the LOOP. Therefore, the operators had 1.5 additional hours to recover offsite power to the vital safety buses. Using the SPAR human error model to determine the value (see Attachment C), OEP-XHE-XL-NR03H was set to 1.0x10-2.

S Probability of failure to recover offsite power in 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> (OEP-XHE-XL-NR06H). During the event, offsite power was available in the switchyard 1.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> after the LOOP. Therefore, the operators had 4.5 additional hours to recover offsite power to the vital safety buses. Using the SPAR human error model to determine the value (see Attachment C), OEP-XHE-XL-NR06H was set to 1.0x10-3.

S Probability of diesel generators failing to run (ZT-DGN-FR-L). The default diesel generator mission times were changed to reflect the actual time offsite power 3

LER 247/03-005 was restored to the first vital bus (approximately 3.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />). Since the overall fail-to-run is made up of two separate factors, the mission times for the factors were set to the following: ZT-DGN-FR-E = 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> (base case value) and ZT-DGN-FR-L = 2.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />.

S Probability of auxiliary feedwater turbine-driven pump failing to run (ZT-TDP-FR-L). Since the AFW TDP is the only ac-power-independent pump in the AFW system, the AFW TDP mission time was set to the actual time that offsite power was restored to the second vital bus (approximately 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />). Since the overall fail-to-run is made up of two separate factors, the mission times for the factors were set to the following: ZT-TDP-FR-E = 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> (base case value) and ZT-TDP-FR-L = 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />.

References

1. Licensee Event Report 247/03-005, Revision 0, Automatic Reactor Trip due to Reactor Coolant Pump Trip on Under-Frequency Caused by a Degraded Off-Site Grid, event date August 14, 2003 (ADAMS Accession No. ML0328902230).

2. NRC Region 1 Grid Special Report, October 15, 2003 (ADAMS Accession No. ML0324102160).

3. R. F. Buell and J. K. Knudsen, Standardized Plant Analysis Risk Model for Indian Point 2 (ASP PWR B), Revision 3.10, December 2004.

4. D. Gertman, et al., SPAR-H Method, INEEL/EXT-02-10307, Draft for Comment, November 2002 (ADAMS Accession No. ML0315400840).

4

LER 247/03-005 Table 1. Conditional probabilities associated with the highest probability sequences.

Conditional core damage Percentage Event tree Sequence no. probability (CCDP)1 contribution name LOOP 17 4.3x10-6 75.4%

2 -6 Total (all sequences) 5.7x10

1. Values are point estimates. (File name: GEM 247-03-005 12-13-2004.wpd)

2. Total CCDP includes all sequences (including those not shown in this table).

Table 2a. Event tree sequence logic for the dominant sequences.

Event tree Sequence Logic name no. (/ denotes success; see Table 2b for top event names)

LOOP 18 /RPS, /EPS, AFW-L, FAB-L Table 2b. Definitions of fault trees listed in Table 2a.

AFW-L AUXILIARY FEEDWATER FAILS DURING LOOP EPs EMERGENCY POWER SYSTEM FAILS FAB-L FEED AND BLEED FAILS DURING LOOP RPS REACTOR FAILS TO TRIP Table 3. Conditional cut sets for dominant sequences.

Percent CCDP1 contribution Minimal cut sets2 Event Tree: LOOP, Sequence 17 2.7x10-7 6.3 AFW-TDP-FS-22 EPS-DGN-FR-22 EPS-DGN-TM-23 2.7x10-7 6.3 AFW-TDP-FS-22 EPS-DGN-TM-22 EPS-DGN-FR-23 2.2x10-7 5.1 AFW-TDP-FS-22 EPS-DGN-TM-22 EPS-DGN-FS-23 2.2x10-7 5.1 AFW-TDP-FS-22 EPS-DGN-FS-22 EPS-DGN-TM-23 4.3x10-6 Total (all cut sets)3

1. Values are point estimates.

2. See Table 4 for definitions and probabilities for the basic events.

3. Totals include all cut sets (including those not shown in this table).

5

LER 247/03-005 Table 4. Definitions and probabilities for modified or dominant basic events.

Probability/

Event name Description frequency Modified AFW-TDP-FS-22 AFW TDP FAILS TO START 6.8x10-3 No

-3 EPS-DGN-FR-22 EDG 22 FAILS TO RUN 5.0x10 No

-3 EPS-DGN-FS-22 EDG 22 FAILS TO START 4.0x10 No EDG 22 IS UNAVAILABLE DUE TO TEST AND EPS-DGN-TM-22 9.0x10-3 No MAINTENANCE EPS-DGN-FR-23 EDG 23 FAILS TO RUN 5.0 x 10-3 No

-3 EPS-DGN-FS-23 EDG 23 FAILS TO START 4.0 x 10 No EDG 23 IS UNAVAILABLE DUE TO TEST AND EPS-DGN-TM-23 9.0x10-3 No MAINTENANCE LOSS OF OFFSITE POWER INITIATING IE-LOOP 1.0 Yes1 EVENT OPERATOR FAILS TO RECOVER OFFSITE OEP-XHE-XL-NR01H TRUE Yes2 POWER IN 1 HOUR OPERATOR FAILS TO RECOVER OFFSITE OEP-XHE-XL-NR02H 1.0x10-1 Yes2 POWER IN 2 HOURS OPERATOR FAILS TO RECOVER OFFSITE OEP-XHE-XL-NR03H 1.0x10-2 Yes2 POWER IN 3 HOURS OPERATOR FAILS TO RECOVER OFFSITE OEP-XHE-XL-NR06H 1.0x10-3 Yes2 POWER IN 6 HOURS ZT-DGN-FR-L DIESEL GENERATOR FAILS TO RUN (LATE) 2.0x10-3 Yes3 TURBINE-DRIVEN PUMP FAILS TO RUN ZT-TDP-FR-L 1.5x10-4 Yes3 (LATE)

1. Initiating event assessment- all other initiating event frequencies set zero.

2. Evaluated per the SPAR-H method (Ref. 4). See report and Attachment C for further details.

3. Changed mission times to correspond to the time offsite power was restored to the first and second vital busses. See report and Basic Event Probability Changes for further details.

6

LER 247/03-005 Attachment A Event Timeline Table A.1 Timeline of significant events.

Time1 Event 1611 Reactor trips due to grid instability 1731 Started CTG 1749 Offsite power is restored to the switchyard 1945 Offsite power is restored to the first emergency bus (5A) 2002 Offsite power is restored to the second emergency bus (6A) 2021 Offsite power is restored to the third emergency bus (2A/3A)

1. All times are on August 14, 2003.

7

LER 247/03-005 Attachment B LOOP Analysis Procedure This procedure is not intended to stand alone; instead it is intended to augment ASP Guideline A:

Detailed Analysis3. LOOP event analyses are a type of initiating event assessment as described in ASP Guideline A. Specific analysis steps that are unique to ASP analysis of LOOP events are included here.

1. Determine significant facts associated with the event.

1.1 Determine when the LOOP occurred.

1.2 Determine when stable offsite power was first available in the switchyard.

1.3 Determine when offsite power was first restored to an emergency bus.

1.4 Determine when offsite power was fully restored (all emergency buses powered from offsite, EDGs secured).

1.5 Identify any other significant conditions, failures, or unavailabilities that coincided with the LOOP.

2. Model power recovery factors associated with the best estimate case and any defined sensitivity cases.

2.1 For the best estimate case, the LOOP duration is the time between the occurrence of the LOOP and the time when stable power was available in the switchyard plus the assumed time required to restore power from the switchyard to emergency buses. Attachment C documents the probabilistic analysis of power recovery factors for the best estimate case analysis.

2.2 If EDGs successfully start and supply emergency loads, plant operators do not typically rush to restore offsite power to emergency buses, preferring to wait until grid stability is more certain. Therefore, a typical upper bound sensitivity case considers the LOOP duration as the time between the occurrence of the LOOP and the time when offsite power was first restored to an emergency bus. Attachment C documents the probabilistic analysis of power recovery factors for the sensitivity case analysis.

3. Model event-specific mission durations for critical equipment for the best estimate case and any defined sensitivity cases. (For most equipment, SPAR model failure probabilities are not functions of defined mission durations and are therefore not affected by this analysis step. Notable exceptions include EDGs and, for PWRs, turbine-driven auxiliary feedwater pumps.)

3.1 For the best estimate case, mission durations are set equal to the assumed LOOP duration as defined in Step 2.1 above.

3.2 For a typical upper bound sensitivity case, mission durations are set equal to the time between the occurrence of the LOOP and the time when offsite power was fully restored to all emergency buses. (Note these mission durations are longer than the assumed LOOP duration defined in Step 2.2 above; they are intended to represent the longest possible mission duration for any critical equipment item.)

3 ASP Guideline A: Detailed Analysis, U.S. Nuclear Regulatory Commission.

8

LER 247/03-005 Attachment C Power Recovery Modeling

! Background The time required to restore offsite power to plant emergency equipment is a significant factor in modeling the CCDP given a LOOP. SPAR LOOP/SBO models include various sequence-specific ac power recovery factors that are based on the time available to recover power to prevent core damage. For a sequence involving failure of all of the cooling sources, only about 30 minutes would be available to recover power to help avoid core damage. On the other hand, sequences involving successful early inventory control and decay heat removal, but failure of long-term decay heat removal, would accommodate several hours to recover ac power prior to core damage.

In this analysis, offsite power recovery probabilities are based on (1) known information about when power was restored to the switchyard and (2) estimated probabilities of failing to realign power to emergency buses for times after offsite power was restored to the switchyard. Power restoration times were reported by the licensee in the LER and in response to the questionnaire that was conducted by the NRC Regional Office. The time used is the time at which the grid operator informed the plant that power was available to the switchyard (with a load limit). Although the load limit was adequate to energize plant equipment and, if necessary, prevent the occurrence of an SBO sequence, plant operators did not immediately load safety buses onto the grid. This ASP analysis does not consider the possibility that grid power would have been unreliable if that power were immediately used.

Failure to recover offsite power to plant safety-related loads (if needed because EDGs fail to supply the loads), given recovery of power to the switchyard, could result from (1) operators failing to restore proper breaker line-ups, (2) breakers failing to close on demand, or (3) a combination of operator and breaker failures. The dominant contributor to failure to recover offsite power to plant safety-related loads in this situation is operators failing to restore proper breaker line-ups. The SPAR human error model (ref.) was used to estimate nonrecovery probabilities as a function of time following restoration of offsite power to the switchyard. The best estimate analysis assumes that at least 30 minutes are necessary to restore offsite power to emergency buses given offsite power is available in the switchyard.

! Human Error Modeling The SPAR human error model generally considers the following three factors:

S Probability of failure to diagnose the need for action S Probability of failure to successfully perform the desired action S Dependency on other operator actions involved in the specific sequence of interest This analysis assumes no probability of failure to diagnose the need to recover ac power and no dependency between operator performance of the power recovery task and any other task the operators may need to perform. Thus, each estimated ac power nonrecovery probability is based solely on the probability of failure to successfully perform the desired action.

9

LER 247/03-005 The probability of failure to perform an action is the product of a nominal failure probability (1.0x10-3) and the following eight performance shaping factors (PSFs):

S Available time S Stress S Complexity S Experience/training S Procedures S Ergonomics S Fitness for duty S Work processes For each ac power nonrecovery probability, the PSF for available time is assigned a value of 10 if the time available to perform the action is approximately equal to the time required to perform the action, 1.0 if the time available is between 2 and 5 times the time required, and 0.1 if the time available is greater than 5 times the time required. If the time available is inadequate (i.e., less than the time to restoration of power to the switchyard plus 30 minutes for the best estimate), the ac power nonrecovery probability is 1.0 (TRUE).

The PSF for stress is assigned a value of 5 (corresponding to extreme stress) for all ac power nonrecovery probabilities. Factors considered in assigning this PSF include the sudden onset of the LOOP initiating event, the duration of the event, the existence of compounding equipment failures (ac power recovery is needed only if one or more emergency buses are not powered by EDGs), and the existence of a direct threat to the plant.

For all of the ac power nonrecovery probabilities, the PSF for complexity is assigned a value of 2 (corresponding to moderately complex) based on the need for multiple breaker alignments and verifications.

For all of the ac power nonrecovery probabilities, the PSFs for experience/training, procedures, ergonomics, fitness for duty, and work processes are assumed to be nominal (i.e., are assigned values of 1.0).

! Results Table C.1 presents the calculated values for the ac power nonrecovery probabilities used in the best estimate analysis.

Table C.1 AC Power Nonrecovery Probabilities PSF Nominal Time Product of Nonrecovery Nonrecovery Factor Value Available All Others Probability OEP-XHE-XL-NR01H 1.0x10-3 Inadequate -- TRUE OEP-XHE-XL-NR02H 1.0x10-3 10 10 1.0x10-1 OEP-XHE-XL-NR03H 1.0x10-3 1 10 1.0x10-2 OEP-XHE-XL-NR06H 1.0x10-3 0.1 10 1.0x10-3 10

LER 247/03-005 Attachment D Response to Comments Comments were provided by the licensee (Ref. 1).

1. Comment from Licensee - Maintenance unavailability The analysis includes cutsets that include equipment in maintenance. Moreover, many of the cutsets involve having more than one major component in maintenance simultaneously.

The normal work planning process at IP2 would not schedule maintenance on these components during the same workweek.

A more specific comments with respect to maintenance unavailability regards the inclusion of basic events representing service water pump maintenance. A significant number of the cutsets in the dominant sequence contain such events. The cooling of the emergency diesel generators (EDGs) is not unitized to the service water pumps. That is, failure (or maintenance) of a specific service water pump (in these cases SWS Pump 26) does not fail the EDG that powers it. Thus, for example, in the cutest in Table 3 that contains AFW-TDP-TM-22, EPS-DGN-FR-22 and SWS-MDP-TM-26, emergency diesel generator EDG 23 (and EDG 21) would continue to receive cooling water and therefore motor driven AFW Pump 23 (which is powered from EDG 23) will continue to be powered.

In addition, test and maintenance activities are not normally done on service water pumps when they are aligned to the essential service water header. When pumps on the essential header require maintenance, the normal process is to re-align them to the nonessential header and then perform the maintenance. As a result, it is in appropriate to assign an average maintenance unavailability value to a cutest where the service water pump is intended to represent a pump aligned to the essential header. If any unavailability is assigned to service water pumps when they are aligned to the essential header it would only be for the brief period when a failure has occurred prior to realigning the headers. This would be at least an order of magnitude lower. (Service water system pump unavailability in the ASP is higher than the current plant specific unavailability for any of the service water pumps.)

Response: ABS Consulting changed the project rules to remove combinations of maintenance of the AFW turbine-driven pump and maintenance on either of the EDGs (22 and 23) that provide emergency power for the motor-driven AFW pumps. If you send INEEL your mutually exclusive maintenance list, they will factor all of it into future updates to the SPAR model.

Since the preliminary precursor analysis was performed, INEEL has issued an updated model for Indian Point 3. One of the main changes in this new model is a more accurate treatment of the service water system. While this particular issue was not addressed, INEEL has been made aware of the problem, and will address it in future updates.

Meanwhile, for the revised analysis of this LER, the two remaining service water pump maintenance events were set to FALSE so they make no contribution to the quantitative result.

2. Comment from Licensee - EDG mission time for feed and bleed 11

LER 247/03-005 In a number of the cutsets, it appears that the bleed and feed failure is a result of an emergency diesel generator that powers one of the block valves failing to run. Since the block valve will receive an open signal on rising primary system pressure almost immediately after the LOOP event, the mission time for the EDGs for those cutsets should be very short (no more than a few minutes). If such a mission time were applied, the frequency associated with those cutsets would be much lower.

Response: There is no certainty that the primary system pressure will rise to the set point at which the PORV block valve would receive an open signal until steam generator level is lost. In scenarios involving loss of AFW caused in part by an EDG failing to run, the EDG would fail to run before the PORV block valve would get a signal to open.

3. Comment from Licensee - EDG maintenance unavailability Emergency diesel generator maintenance unavailability is high by a factor of two compared to recent plant-specific information.

Response: The value EDG unavailability due to test and maintenance, along with other basic event probabilities, has been updated in the revised SAPHIRE 7 SPAR models.

4. Comment from Licensee - Offsite power recovery following battery depletion The assumption that AC power must be recovered before battery depletion, in lieu of continued operation of the turbine-driven AFW pump and no RCP seal LOCA, also seems overly conservative. While the restoration of offsite power without DC power is more difficult, it is not improbable. In addition, procedures exist for manually closing breakers in the event of a loss of DC power.

Response: All SPAR station blackout models are built with the assumption that AC power must be recovered before battery depletion. The NRC and INEEL are aware of the concern that this is overly conservative, and are evaluating their position on this issue. For a later recovery to be credited would require 1) the existence of a procedure for the recovery, 2) training on the recovery operations, and 3) demonstration that the required actions could be performed under the stated conditions (i.e., no DC power).

In the particular case of this analysis, allowing more time for recovery would not necessarily change the quantitative result. Without crediting extraordinary measures to continue operation of the turbine-driven auxiliary feedwater pump, core damage would occur about 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> after battery depletion. In this case the offsite power nonrecovery probability estimated using the SPAR Human Error model would be the same as it is at battery depletion.

References:

1. Entergy Nuclear Operations, Inc. Comments on Preliminary Accident Sequence Precursor Analysis of August 14, 2003 Operational Event, Letter from Michael R. Kansler to U.S.

Nuclear Regulatory Commission, May 17, 2004 (ML041460505).

12

LER 247/03-005 LOSS OF REACTOR EMERGENCY AUXILIARY PORVs RCP SEAL HIGH FEED OFFSITE OFFSITE SECONDARY RCS RESIDUAL HIGH OFFSITE SHUTDOWN POWER FEEDWATER ARE COOLING PRESSURE AND POWER POWER SIDE DEPRESS HEAT PRESSURE POWER CLOSED MAINTAINED INJECTION BLEED RECOVERY RECOVERY COOLDOWN FOR LPI/RHR REMOVAL RECIRC IN 2 HRS IN 6 HRS IE-LOOP RPS EPS AFW PORV LOSC HPI FAB OPR-02H OPR-06H SSC PZR RHR HPR # END-STATE FREQUENCY 1 OK LOSC-L T2 LOOP-1 3 OK 4 OK 5 CD 6 OK 7 CD 8 OK 13 9 CD 10 OK PORV-L HPR-L 11 CD HPI-L 12 CD 13 OK 14 CD 15 OK AFW-L HPR-L 16 CD FAB-L 17 CD T18 SBO T19 ATWS Figure 1: Indian Point 2 LOOP event tree with dominant sequence highlighted.