L-PI-05-076, Prairie Lsland Nuclear Generating Plant Units 1 and 2, Response to Request for Additional Information Regarding the Relief Request to Implement Risk-Informed Lnservice Lnspection (ISI) Scheduling for the Fourth 10-Year Lnspection Interva

Prairie Lsland Nuclear Generating Plant Units 1 and 2, Response to Request for Additional Information Regarding the Relief Request to Implement Risk-Informed Lnservice Lnspection (ISI) Scheduling for the Fourth 10-Year Lnspection Interval

ML052430399
Person / Time
Site:	Prairie Island
Issue date:	08/30/2005
From:	Thomas J. Palmisano Nuclear Management Co
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
L-PI-05-076
Download: ML052430399 (27)

Text

N Commt ited to Nucl Prairie lsland Nuclear Generating Plant Operated by Nuclear Management Company, LLC AUG 3 0 2005 U S Nuclear Regulatory Commission ATTN: Document Control Desk Washington, DC 20555-0001 Prairie lsland Nuclear Generating Plant Units 1 and 2 Dockets 50-282 and 50-306 License Nos. DPR-42 and DPR-60 Response to Request for Additional Information Regarding the "Relief Request to Implement Risk-Informed lnservice lnspection (ISI) Scheduling for the Fourth 10-Year lns~ectionInterval for Prairie lsland Units 1 and 2"

Reference:

Letter from Nuclear Management Company, LLC (NMC) to Nuclear Regulatory Commission (NRC), "Relief Request to Implement Risk-Informed lnservice lnspection (ISI) Scheduling for the Fourth 10-Year lnspection Interval for Prairie lsland Units 1 and 2" dated December 29,2004.

Prairie lsland submitted a Relief Request to implement Risk-Informed IS1 Scheduling for the Fourth 10-Year lnspection Interval in a letter dated December 29, 2004 (Reference).

By electronic mail, dated June 3, 2005, the NRC requested additional information regarding the relief request. The enclosure to this letter contains the response to that request.

Summarv of Commitments This letter contains no new commitments and no revisions to existing commitments.

Thomas J. Palmisano Site Vice President, Prairie lsland Nuclear Generating Plant Nuclear Management Company, LLC Enclosure cc: Administrator, Region Ill, USNRC Project Manager, Prairie Island, USNRC Resident Inspector, Prairie Island, USNRC 1717 Wakonade Drive East Welch, Minnesota 55089-9642 Telephone: 651.388.1121

ENCLOSURE Response to Request for Additional Information Regarding the "Relief Request to Implement Risk-Informed lnservice lnspection (ISI) Scheduling for the Fourth I O -

Year lnspection Interval for Prairie Island Units 1 and 2" Response to Request for Additional Information, 4 pages plus List of Acronyms, 1 page Attachment I , 17 pages Attachment 2,4 pages Page 1 of 4

Enclosure Response to Request for Additional Information The NRC questions are in bold type face. The NMC responses are in plain type face.

Did you exclude Class 2 pipe or welds that are exempt from American Society of Mechanical Engineers (ASME) inspection requirements from the population of welds evaluated in your RI-IS1 program? Both Regulatory Guide 1.I78 and EPRl TR-112657 simply discuss Class 2 welds and do not differentiate between welds exempted from ASME inspection requirements and welds not exempted from these requirements. If you did exclude these Class 2 pipe welds from your RI-IS1 program, please identify the guidance you relied upon to exclude welds from your RI-IS1 program scope based on them being exempt from ASME inspection requirements.

There are two areas wherein exemption is taken for Class 2 welds. IWC-1220 provides exemption from ASME Section XI entirely (meaning that these welds are not included in Section XI scope). Table IWC-2500-1 includes an exemption from NDE if the thickness of the associated piping < 318" for piping > NPS4 or 5 115" for piping 1 NPS2 and 5 NPS4, however these exempted welds must be included in the total population.

Per a phone conversation with the Staff, NMC understands that the question is dealing with the exemption cited under IWC-1220(a) specifically. IWC-1220 exempts components from the volumetric and surface examination requirement of IWC-2500. NMC did not include those Class 2 piping welds that are exempt under IWC-1220.

The reason for NOT including the piping welds under IWC-1220 is that under a normal IS1 Program meeting the requirements of ASME Section XI these welds would not require volumetric examination nor would these welds be included in the total population of which the 7.5% is taken. The Risk-Informed Inservice Inspection Program (RI-ISI) is an alternative to the ASME Section XI Code requirements. And as stated in the NRC SER for the EPRl Topical Report, TR-112657 Rev. B-A, "The staff concludes that the proposed RI-IS1 program as described in EPRl TR-112657, Revision B, is a sound technical approach and will provide an acceptable level of quality and safety pursuant to 10CFR50.55a for the proposed alternative to the piping IS1 requirements with regard to the number of locations, locations of inspections, and methods of inspection". Since the welds exempted by IWC-1220 would not have been classified as Category C-F-I of C-F-2, there are no Section XI non-destructive examination (NDE) requirements and therefore no alternative is specified in the RI-IS1 Program for these welds.

2. On page 5 of your submittal, you describe the Westinghouse Owners Group probabilistic risk assessment (PRA) Peer Certification Review that was performed on the 1999 update PRA model. Per Regulatory Guide 1.178 dated September 2003, please list all Level A and B "Facts and Page 2 of 4

Enclosure Response to Request for Additional Information Observations" from the review and how they have been addressed in the Revision 1.2 model. If some of the Level A and B "Facts and Observations" have not been addressed, please state why they are not expected to result in model changes that could significantly affect the overall results or conclusions of the RI-IS1 consequence evaluation.

All closed Level A and B "Facts and Observations" are listed in Attachment 1, including the manner in which they have been addressed.

Attachment 2 lists the open Level B "Facts and Observations." For each item, the status is provided and there is either a discussion of potential impacts on RI-IS1 consequence evaluation or a statement that future PRA model updates will be evaluated for impact.

3. The Unit 1 and Unit 2 Reactor Coolant System in Tables 5-1-1 and 5-1-2 identify welds in the examination category B-F. Please specify if the welds in this examination category are piping welds or reactor vessel welds since the 1989 Edition of the ASME Code,Section XI, identifies dissimilar metal welds in B-F examination category to either the piping or the vessel welds.

It is noted also that the risk-informed inservice inspection program in accordance with EPRl TR-112657, Revision B-A is applicable to the examination category B-F for piping welds.

Based on the conference call held with the staff, the inclusion of Category B-F welds that are associated with the vessel should not be included. The conversation focused on the nozzle-to-safe end welds that contain Alloy 600 material that is highly susceptible to Primary Water Stress Corrosion Cracking (PWSCC).

The plant has the following breakdown concerning Category B-F welds:

There are six ltem Number B5.10 welds (Reactor Vessel Nozzle-to-Safe End Butt Welds)

There are five ltem Number B5.40 welds (Pressurizer Nozzle-to-Safe End Butt Welds)

There are four ltem Number B5.70 welds (Steam Generator Nozzle-to-Safe End Butt welds)

These are all Nozzle-to-Safe End Butt Welds that are associated with vessels.

However, between the two units, there is only one weld that includes material considered susceptible to PWSCC. This weld is off of the bottom of the Unit 2 pressurizer. This weld was selected for examination.

The NRC Safety Evaluation for the EPRl TR-112657 states "The staff concludes that the inclusion of B-F welds in a RI-IS1 Program is a plant-specific issue and that individual licensees should determine the safety significance of B-F welds and perform the examinations commensurate with the associated risk."

Page 3 of 4

Enclosure Response to Request for Additional Information Since the weld containing material susceptible to PWSCC has been selected for examination, NMC believes that the Safety Evaluation intent has been met.

Page 4 of 4

List of Acronyms AF Auxiliary feedwater AFW Auxiliary feedwater AOP Abnormal operating procedure ATW S Anticipated transient without scram CCDP conditional core damage probability CCF Common cause frequency CDF Core damage frequency CLERP Conditional large early release probability CM Corrective maintenance cvcs Chemical and volume control system DG Diesel generator ECCS Emergency core cooling system EF Error factor EOP Emergency operating procedure EPRl Electric Power Research Institute ET Event tree F&O Facts and observations HEP Human error probability HRA Human reliability analysis INEL Idaho National Engineering and Environmental Laboratory INSTAIR Loss of instrument air IPE Individual plant examination LER License event report LOCA Loss of coolant accident LOCL Loss of cooling water LOlA Loss of instrument air LOOP Loss of offsite power LOSP Loss of offsite power MAAP Modular accident analysis program MFW Main feedwater MS-FLB Main steam / main feedwater line break MSlV Main steam isolation valve NMC Nuclear Management Company PlNGP Prairie Island Nuclear Generating Plant PM Preventive maintenance PORV Power-operated relief valve PRA Probabilistic risk assessment RCP Reactor coolant pump RCS Reactor coolant system RHR Residual heat removal RI-IS1 Risk Informed - Inservice Inspection SBO Station blackout SG Steam generator SGTR Steam generator tube rupture SI Safety injection SLOCA Small loss of coolant accident T&H Thermal hydraulic VAC Volts, alternating current WOG Westinghouse Owners' Group

PRAIRIE ISLAND CLOSED FACTS & OBSERVATIONS (F&09s)FROM THE WESTINGHOUSE OWNERS GROUP (WOG) PEER REVIEW PROCESS Item F&O Observation Level of Status & Resolution Impact on RI IS1 Significance 1 IE-I>sub- Several items were identified relative to initiating event B CLOSED - No Impact.

element identification and grouping. The PRA Model Revision 1.2 includes many significant changes to fix problems with the LOCA sizes and inputs This F&O has been

( I ) The basis for excluding from the model challenges to the into the SLOCA tree. The LOCA sizes have been changed resolved and PORVs post reactor trip is not adequately explained. This to reflect industry standards. The SLOCA includes breaks incorporated into the affects the initiating event grouping for Events 2, 8, 10, 16, 18, from 318 to 2 inches. The MLOCA includes breaks from 2 Prairie Island PRA

19. Additionally, the model does not appear to directly consider to 6 inches. The LLOCA includes breaks greater than 6 model used to perform the consequences of a stuck open PORV (no actual transfer to inches. RI-IS1 consequence the Small LOCA ET). Though the plant has not actually analysis.

experienced a PORV opening following a transient, this does For the issue dealing with event of a PORV lifting during a not provide a sufficient basis for concluding that PORVs will transient and failing to completely reclose, a separate not open for all initiators in this class. Appendix D writeup PORV LOCA gate has been added under the SLOCA tree.

(D.12) shows that the PORV-related event frequency The PORV LOCA gate includes the scenario of a PORV contribution is small (4.17E-5) and encompassed by the lifting during a normal transient and during a steam line contributions from other Small LOCAs. However, the new break. The normal transient captures all transients that can (Rev 2) LOCA frequency for S2 is 6E-5, so Stuck Open PORVs challenge a PORV.

are no longer small contributors to this class.

(2) Random RCP seal failure (i.e., a random failure resulting in For the issue dealing with the random RCP seal LOCA, a RCP seal leakage greater than normal makeup capability) was separate initiating event has been added under the RCP not included in the IE frequency for small LOCA. Such SEAL LOCA event tree, which is transferred to the potential random RCP seal failures have been assessed at SLOCA tree. A random seal LOCA initiating frequency frequency in range 1E-3 to 5E-3 by various sources. This event was determined by reviewing NUREGICR-5750 data.

has been neglected in the IE selection. The updated PI PRA frequency for SI due to other than random RCP seal LOCA is The third issue with the T2 initiator comes from the 5E-3. This is comparable to frequency of random RCP seal proposed model and documentation (by a contractor). We LOCA, so the event should be considered. are not using that information in the updated model. All (3) The T2 initiator (without a stuck open PORV) does not initiators used in the original model (I-TRI, I-TR2, I-TR3 appear to be an input into the transient event tree sequences. and I-TR4) are inputs into the transient event tree.

The issues presented in this F&O have been resolved and implemented in the Rev 1.2 model update as described above. (Same assumptions were used in the Rev 2.0 model.)

1E-4, sub- The dual-unit LOSP initiator frequency calculation in file A CLOSED - No Impact.

element l 3 V.SMD.96.005 (Recalculation of LOSP Initiator) appears to be The LOSP initiating event frequency was re-calculated in error. The calculation divides LOSP into PLC (plant accounting for two dual-unit LOSP events over the history This F&O has been centered), Weather (WRL) and Grid Loss (GRL) events, which of the plant. The LOOP frequency was calculated to be resolved and is correct. Prairie Island has had 2 dual unit LOSP events in it's 7.5E-2lyr. This does not include Bayesian updating. incorporated into the 21 year history (as of 1996 when file was made). In calculating Prairie Island PRA the exposure time, the calc assumes 42 plant years for PI, The new calculated LOOP frequency was incorporated into model used to perform Attachment 1 Page 1 of 17

PRAIRIE ISLAND CLOSED FACTS & OBSERVATIONS (F&O's) FROM THE WESTINGHOUSE OWNERS GROUP (WOG) PEER REVIEW PROCESS Item F&O Observation Level of Status & Resolution Impact on RI IS1 Significance because it counts unit 1 and unit 2 separately (to be consistent the Rev 1.2 model. This change will have a significant RI-IS1 consequence with the generic LOSP data). The resulting Bayesian updated affect on the CDF. However, with the addition of Off-site analysis.

dual-unit LOSP frequency is 0.03 16. But if the units are Power Recovery in the model and other recommended counted individually, then it must be considered that a dual unit changes, the contribution that LOOP makes to CDF LOSP at unit 2 affects unit 1, as opposed to the way it was decreases in the new model. (from 35% to approx. 24%).

calculated, which effectively assumes unit 1 and unit 2 are two different sites. Therefore, the WRL and GRL frequencies must The issues presented in this F&O have been resolved and be doubled because a dual unit LOSP at unit 2 affects unit 1. implemented in the Rev 1.2 model update as described Alternatively, the PI site could be considered as a single unit above. (Same assumptions used in the Rev 2.0 model.)

and there would be 2 failures in 20 site-years. This would be in conflict the generic data and would require modification of the generic exposure time.

1E-6, sub- Bayesian update was used for LOSP frequency. The Bayesian B CLOSED - No Impact.

l6 update algorithm used is very sensitive to the error factor The initiating event data referenced in this F&O was not chosen for the generic data. The mean value for the generic incorporated into the Rev 1.2 (or Rev 2.0) model. This F&O has been prior distribution for LOSP was 0.01 8 1 with an EF of 1.4. The resolved and plant specific data shows that 2 LOSP events have occurred in In the Rev 1.2 model, LOOP frequency was calculated by incorporated into the 25.7 site years (corresponding to a plant-specific point estimate dividing the number of dual unit events (2 per unit) by the Prairie Island PRA of 0.0788lyr). However, the updated mean calculated using the number of commercial operating years. The LOOP model used to perform Bayesian code and these values is .0187 - which hardly moves frequency was determined to be 7.5E-21yr. This does not RI-IS1 consequence the prior mean at all. If the EF on the prior were changed to 5, include a Bayesian update. This is a conservative analysis.

then the updated mean would be .044/yr, apparently more approach.

reflective of the plant experience.

The issues presented in this F&O have been resolved and The reviewers believe that several calculational mistakes were implemented in the Rev 1.2 model (and Rev 2.0) update as made in this analysis. described above.

I) the EF of the prior is calculated assuming that a chi-squared distribution represents the generic data, based on 43 events.

This produces a very low EF, since this process ignores the site to site variability.

2) the Bayesian update algorithm used is sensitive to the choice of EF.

3) if the EF on the prior actually was 1.4, then uncertainty bounds of prior and plant specific data would not overlap and it could be said that the prior is not from the same data base as the plant specific.

The latest LOSP report from INEL (NUREGICR-5496) provides a generic mean across the country of .05lyr. The PRA should be able to defend the derivation of a value significantly less than this.

Attachment 1 Page 2 of 17

PRAIRIE ISLAND CLOSED FACTS & OBSERVATIONS (F&07s)FROM THE WESTINGHOUSE OWNERS GROUP (WOG) PEER REVIEW PROCESS Item F&O Observation Level of Status & Resolution Impact on RI IS1 Significance 1E-8, sub- This comment was generated by a review of the failure database B CLOSED - No Impact.

element being developed for PRA Rev 2. The initiating event data referenced in this F&O was not incorporated into the Rev 1.2 model or the Rev 2.0 model. This F&O has been The reviewers identified several concerns with the data resolved and reduction for LOSP. The LOSP frequency as calculated by this In the Rev 1.2 model, LOOP frequency was calculated by incorporated into the work is 0.0181. The LOSP as calculated by INEL in dividing the number of dual unit events (2 per unit) by the Prairie Island PRA NUREGICR-5496 is 0.05. This discrepancy is large considering number of commercial operating years. The LOOP model used to perform the importance of the event to the overall PRA results. In frequency was determined to be 7.5E-21yr. This does not RI-IS1 consequence addition: include a Bayesian update. This is a conservative analysis.

1) More than 75% of the events in the EPRI database (EPRI- approach.

TR-106306) have been screened out as not being applicable.

The reviewers checked the screening assessments for several The issues presented in this F&O have been resolved and events. In several cases the screening criteria seemed optimistic appropriate changes were incorporated into the Rev 1.2 and used the clause that "power could have been restored if model (and Rev 2.0 model) as described above.

necessary", or "if this event happened at power, OSP [offsite power] would have been restored. Other times it was stated that an error occurred at shutdown that could not occur at power. The screening of events appears to have been too optimistic about events at shutdown that were assumed to not be possible at power.

2) The data base screens out all but 56 events. However, the LOSP frequency is calculated as 43 events12347 yrs. There is no explanation of the difference between 56 events and 43 events.

3) The basis for the exposure time of 2347 reactor-years is unclear. In the RIF component database the accumulated operating time is listed as 2546 licensed years, 2472 critical years and 2402 comrnerical years. If there have been 2402 commercial years of operation, at an average availability factor of 80%, there should be 1920 full power years of operation, not 2347. The "2347 reactor years" used for the LOSP calculation obviously includes the time spent at shutdown. If all refueling LOSP events are removed from the failure list, then the time spent at shutdown should also be removed from the exposure time.

AS-6, sub- The reviewers did not find a discussion of dual unit initiators B CLOSED - No Impact.

element and subsequent station response, although at least one such A two-unit model has been created which captures the dual initiator (dual-unit loss of offsite power) is identified and an unit initiators in Rev 2.0 model. The effects and impacts This F&O has been associated frequency is included among the initiating events. that the dual unit initiators (I-LOOP, I-INSTAIR, I-LOCL) resolved and have on Unit 1 and Unit 2 are included in the Two-Unit incorporated into the After the review, Prairie Island PRA personnel clarified that model. Dependencies and success criteria are factored Prairie Island PRA three potential dual-unit initiating events were identified: Loss into the initiating event system fault trees. The dual unit model used to perform of Offsite Power, Loss of Instrument Air, and Loss of Cooling Attachment 1 Page 3 of 17

PRAIRIE ISLAND CLOSED FACTS & OBSERVATIONS (F&O's) FROM THE WESTINGHOUSE OWNERS GROUP (WOG) PEER REVIEW PROCESS Item F&O Observation Level of Status & Resolution Impact on RI IS1 Significance Water. Of these, only loss of offsite power is modeled as a initiator effects on the Unit 112 results can be found by RI-IS1 consequence dual-unit event affecting unit 1 (i.e., an event for which the reviewing the PRA Quantification notebooks. analysis.

status of the opposite unit is considered in the accident sequences with respect to availability of opposite unit equipment). The others are not so treated, because their baseline CDF contribution (when considered as single-unit events) is relatively small.

AS-8, Given the dependence of primary and secondary pressure relief B CLOSED - No Impact.

element on instrument air, the loss of instrument air event should be During the Revision 1.2 PRA model update, an initiating discussed, and possibly modeled, independently of other event fault tree was created for the Loss of Instrument Air. This F&O has been transient events. The primary PORVs or possibly the The new initiating event fault tree provides a more resolved and primarylsecondary safety valves may lift to provide pressure accurate calculation of the risk involved with removing air incorporated into the relief in this scenario (loss of IA). This may be a unique compressors from service. In addition, a review of past Prairie Island PRA enough plant response to warrant special treatment. In addition, LOIA events at PI was performed. The sequence of events model used to perform challenging these valves results in an increase in the S2 LOCA involved with a LOIA showed a slow decrease in air RI-IS1 consequence or steam line break initiating event frequency. pressure such that a reactor trip occurred without analysis.

challenging the pressurizer PORVs (LER 96-02-00) or the operators had enough time to prevent a reactor trip (February 1996 event). These two events were initiated by a failure of the air dryer exhaust purge valve to close following a dryer operation. This line has been modified per design change 96SAO 1, which installed an automatic isolation valve in the exhaust lines of 121 and 122 air dryer. Based on the above discussion and the fact that there is a low contribution of the LOIA to overall CDF results - this issue can be considered closed.

In addition, during the Revision 1.2 model update, credit was given for the pressurizer PORV air accumulator and therefore the dependence of primary pressure relief on instrument air has decreased.

7 AS-11, The General Transient event tree (Figure 4.2 in the Accident B CLOSED - No Impact.

sub- Sequence notebook) shows that if a consequential PORV The PRA Model Revision 1.2 was changed significantly to LOCA occurs, a transfer is made to the S1 LOCA event tree. fix problems with the LOCA sizes and inputs into the This F&O has been The S I LOCA size range has been defined as 318" to 1" - SLOCA tree. The LOCA sizes have been changed to reflect industry standards. The SLOCA includes breaks resolved and incorporated into the (actually 718"). However, the equivalent flow area for a primary PORV is expected to be larger than this, and should from 318 to 2 inches. The MLOCA includes breaks from 2 Prairie Island PRA probably be considered in the S2 LOCA category. to 6 inches. The LLOCA includes breaks greater than 6 model used to perform inches. RI-IS1 consequence Additionally, the transfer for the MSLB scenario is not included analysis.

in the Rev. 1.1 model. For the issue dealing with event of a PORV lifting during a transient and failing to completely reclose, a separate PORV LOCA gate has been added under the SLOCA tree.

Attachment 1 Page4of 17

PRAIRIE ISLAND CLOSED FACTS & OBSERVATIONS (F&O's) FROM THE WESTINGHOUSE OWNERS GROUP (WOG) PEER REVIEW PROCESS Item F&O Observation Level of Status & Resolution Impact on RI IS1 Significance The PORV LOCA gate includes the scenario of a PORV lifting during a normal transient and during a steam line break. The normal transient captures all transients that can challenge a PORV.

The issues presented in this F&O have been resolved and implemented in the Rev 1.2 model update as described above. (The same modeling was used in the Rev 2.0 model.)

8 AS-12, Consequential steam generator tube rupture (i.e., SGTR B CLOSED - No Impact.

sub- resulting from a transient that causes a large pressure The steam generators at Prairie Island are designed such element differential across the steam generator tubes, such as steamline that the tubes can withstand full system dp across the tubes This F&O has been rupture or inadvertently opened and stuck secondary side relief from the primary or secondary sides without sustaining any resolved for the Prairie or safety valve) is not modeled in the accident sequences. consequential tube ruptures. Because of this, the Island PRA model used consequential tube rupture event following a primary or to perform RI-IS1 The possibility of this consequential event should be addressed secondary depressurization was not modeled. consequence analysis.

in the PRA.

9 AS-14, The success criteria for AF are incomplete for Steam Line B CLOSED - No Impact.

sub- Break Events. Specifically, they do not include the requirement Changes have been incorporated into the Rev 1.2 model to element l 7 to isolate flow to the faulted SG. account for the issue stated in this F&O. The initiating This F&O has been event for a Steam Line Break Upstream of the MSIV has resolved and been added under the gate for the respective steam incorporated into the generator. In addition, the initiating event for a Steam Prairie Island PRA Line Break Downstream of the MSIV and the failure of the model used to perform respective SG MSIV to close has been added under both RI-IS1 consequence steam generator gates. Therefore, the steam generator that analysis.

has a steam line break upstream of the MSIV OR has a MSIV that fails to close on a steam line break downstream of the MSIV will be failed. The AFW flow will be isolated to the faulted SG.

The issues presented in this F&O have been resolved and implemented in the Rev 1.2 model update as described above. (The same modeling was used in the Rev 2.0 model.)

10 AS-15, These observations relate to the Revision 2. Event Tree C (items 1- CLOSED - No impact.

sub- Notebook provided in the peer review package. 5) Although this finding is related to documentation that was element 3 B (items 6- not incorporated into the current PRA model, the event tree This F&O has been Documentation detail is limited in some areas, and should be notebook documentation was updated. More details are

12) resolved and expanded. Actually, some of these details already exist in the provided in the event tree notebooks on initiating event incorporated into the previous layer of notebooks; it would be useful to capture this Attachment 1 Page 5 of 17

PRAIRIE ISLAND CLOSED FACTS & OBSERVATIONS (F&O's) FROM THE WESTINGHOUSE OWNERS GROUP (WOG) PEER REVIEW PROCESS item F&O Observation Level of Status & Resolution Impact on RI IS1 Significance information in one ET notebook to assure completeness and groupings, accident sequence progression, event tree Prairie Island PRA consistency is obtained and maintained for the future updates. structure, event tree headings, and event tree accident model used to perform Specific observations noted are as follows (some references are sequence analysis. RI-IS1 consequence specifically to the SGTR event tree discussion, but may also be analysis.

applicable to other initiating events):

1. Event progress is not described in detail (ESDs do not have much more information content than ETs; they do not make up for the lack of detailed description of the event, nodes, operator actions, EOPs involved, etc.).

2. Top event descriptions are not detailed (SG isolation appears to be consisting of MSIV closure only. What about operator actions, termination of AFW flow in to the faulted SG etc).

3. Top events with operator actions are not clearly delineated and the dependence among top events is not indicated.

4. References to EOPs are not complete (in which EOP(s) and by what means does the operator identify and isolate a faulted SG?)

5. There should be a one-to-one correspondence between the items listed in section 4.10 and Appendix D. A summary table may do it.

6. Why is there no SGTR-W branching when SGTR-ST1 fails in the SGTR event tree (there is one in the ESD) ?

7. Give guidance on what happens to sequences that branch into other ETs and end successfully there: for example SGTR has a transfer into ATWS and is successful; is it a success, or simply truncated because it is low frequency?

What is the criteria for terminating event tree to event tree looping?

8. MS-FLB events need to be discussed; they have an additional event tree node of "failure to isolate faulted SG", which makes the event tree different from the transient ET. SBO event tree needs to be discussed.

9. Where are the "qualitatively assessed" items in ESDs?

10. What is the process that transfers the system success criteria and operator action definition/success/dependence information from Section 4 and Appendix D to the system analysts and HRA analysts? A couple of summary tables may be used to organize the "work orders" generated for Attachment 1 Page6of 17

PRAIRIE ISLAND CLOSED FACTS & OBSERVATIONS (F&O's) FROM THE WESTINGHOUSE OWNERS GROUP (WOG) PEER REVIEW PROCESS Item F&O Observation Level of Status & Resolution Impact on RI IS1 Significance the system and HRA analysts.

11. What about stuck open pressurizer PORV after a LOSP event? (maybe after a loss of MFW event also?!)

Generic T&H analyses show that the PORVs are challenged after a LOSP event.

12. What happens to the events with RCS break flows that are less than makeup capacity; how long does the CVCS have to run; what happens if CVCS fails; What is the underlying assumption in not modeling them with an event tree (small frequency?) ?

11 AS-18, Two steam generator tube rupture modeling items were noted: A CLOSED - No Impact.

sub- The updated model (Rev 1.2) has been modified to address The dependency between having a faulted SG following a this issue. The initiating event for Steam Generator Tube This F&O has been element 10 SGTR with overfill and a stuck open relief valve and the top Rupture has been added under the respective steam resolved and gates for depressurization and AF are not considered in the generator gate and SG PORV gate. Therefore, the fault incorporated into the SGTR development. The AF top logic credits feed to both SGs. tree logic was modified as to fail the ability to feed and Prairie Island PRA Though acceptable for most cases, if there is a stuck open relief depressurize the ruptured SG. model used to perform valve on the ruptured generators, operators are directed to RI-IS1 consequence isolate that generator (including AF). This reduces the ability to The issues presented in this F&O have been resolved and analysis.

depressurize with the 1 SG and AF to the faulted generator implemented in the Rev 1.2 model update as described being isolated. above. (The same modeling was used in the Rev 2.0 In SGTR, the AFW success criteria require AFW to 1 of 2 SG. model.)

Feeding of the ruptured SG is allowed (as directed by the EOP's). The success path at function AFW therefore allows feeding of the bad SG. Subsequent event tree headings ask for isolation of the ruptured generator. The fault tree development only asks about closing of the MSIV on the ruptured generator.

In reality, if the good generator could not be fed, the ruptured generator could not be isolated. If the bad generator is being fed, the sequence needs to transfer on the failure path at "isolation" and go into ECA3.113.2. The fault bee logic for "isolation" needs to include logic that "failure" to isolate the ruptured generator can be caused by failure of the good generator to be fed. If the ruptured generator is being fed, it will not be isolated.

l2 TH-lt sub- Two items were noted regarding derivation of success criteria A CLOSED - No Impact.

element for accumulators using MAAP 3b calculations. The PRA Model Revision 1.2 was changed significantly to fix problems with the LOCA sizes and inputs into the This F&O has been A MAAP calculation was used to determine that accumulators SLOCA tree. The LOCA sizes have been changed to resolved and are only necessary for design-basis LOCAs. The MAAP PWR reflect industry standards. The SLOCA includes breaks incorporated into the Application Guidelines specifically state that MAAP is not an from 318 to 2 inches. The MLOCA includes breaks from 2 Prairie Island PRA appropriate code for use in analyzing rapid-depressurization to 6 inches. The LLOCA includes breaks greater than 6 model used to perform events such as larger LOCAs.

Attachment 1 Page 7 of 17

PRAIRIE ISLAND CLOSED FACTS & OBSERVATIONS (F&O's) FROM THE WESTINGHOUSE OWNERS GROUP (WOG) PEER REVIEW PROCESS Item F&O Observation Level of Status & Resolution Impact on RI IS1 Significance No basis was found for not including accumulators in Small inches. RI-IS1 consequence LOCA event trees in cases when high pressure injection fails. A analysis.

MAAP calculation without accumulators was available, but this In addition to this change, the accumulator is required in case showed core damage. the success criteria of the LLOCA injection phase (111 accumulator and 112 RHR pump). One accumulator is failed due to a break in the RCS cold leg.

The SLOCA and MLOCA event trees were changed to require accumulator injection with the RHR pump injection (111 accumulator and 112 RHR pump). One accumulator is failed due to a break in the RCS cold leg.

The issues presented in this F&O have been resolved and implemented in the Rev 1.2 model update as described above. Same assumptions were used in the Rev 2.0 model.

13 TH-4, The timing for switchover to recirculation in an analysis B CLOSED - No Impact.

subelement proposed for PRA Rev. 2 seems very conservative. First, it is This F&O relates to an analysis performed by a contractor.

4 assumed that containment spray initiates even for small LOCAs, This was a proposed analysis that is not used in the current This F&O has been thereby reducing the time to drain the RWST. Second, a model and will not be used in the updated model (Rev. 1.2 resolved and calculation assuming low pressure injection is used for the or Rev 2.0). The current timing for switchover that is incorporated into the timing of both high- and low-pressure recirculation. If high used for the new SLOCA size was calculated using a plant- Prairie Island PRA pressure recirculation is needed, RCS pressure must be above specific MAAP run. This run indicates that containment model used to perform the shutoff head of the RHR pumps so that no low pressure spray does not actuate for a small LOCA. RI-IS1 consequence injection flow has occurred, greatly increasing the time before analysis.

reciruclation is required. This could be important because the lineup for high pressure recirculation is the only local critical step in the recirculation procedure. This local step is the reason that timing is so critical.

l4 TH-99 sub- The LOCA break size definitions for the PINGP PRA are based B CLOSED - No Impact.

element on different criteria than those for most other PRAs. This Because of the many questions related to this issue, Prairie would be acceptable if the underlying analyses provided Island has changed the LOCA sizes in the Rev 1.2 model This F&O has been sufficient basis for the definitions, but it appeared that the to the standardized definition of LOCA breaks. The new resolved and available analyses do not adequately support the selected break sizes are SLOCA (318 - 2 inches), MLOCA (2-6 incorporated into the definitions. inches) and LLOCA (> 6 inches). Prairie Island PRA model used to perform The following is a comparison of the definitions and their bases, MAAP runs were reviewed to support the success criteria RI-IS1 consequence with focus on the injection phase, as discerned from the Event for the new break sizes. In addition, the new LLOCA analysis.

Tree Success Criteria notebook: modeling requires accumulator injection during short-term PINGP PRA S 1 (Small LOCA category 1) = breaks that are too injection, which is included in the typical plant PRA large to be accommodated by the normal charging system and LLOCA.

too small to provide adequate decay heat removal through the Attachment 1 Page 8 of I f

PRAIRIE ISLAND CLOSED FACTS & OBSERVATIONS (F&09s)FROM THE WESTINGHOUSE OWNERS GROUP (WOG) PEER REVIEW PROCESS Item F&O Observation Level of Status & Resolution Impact on RI IS1 Significance break; range defined as 318" to 1" diameter breaks. The initiating frequencies for the new LOCA sizes were PINGP PRA S2 (Small LOCA category 2) = breaks that do not calculated from NUREGICR-5750.

depressurize to within the low head injection system capability but are within the capability of the high head injection system, The issues presented in this F&O have been resolved and and that are sufficiently large to provide decay heat removal via implemented in the Rev 1.2 model update as described the break; range defined as - 1" to 5" diameter breaks. above. Same assumptions were used in the Rev 2.0 model.

TYPICAL PRA Small LOCA = breaks that are too large to be accommodated by the normal charging system and too small to depressurize to the high head injection setpoint sufficiently rapidly to avoid the need for decay heat removal; typically 318" to 2" diameter breaks.

PINGP Medium LOCA = breaks that are sufficiently large to depressurize to the shutoff head of the RHR pumps but small enough to be within the capability of the high head injection system, with decay heat removal via the break; range defined as 5" to 12" diameter breaks.

TYPICAL Medium LOCA = breaks that are sufficiently large to depressurize to the high head injection setpoint but for which pressure remains above the RHR pump shutoff head, with decay heat removal via the break; typically 2" to 6" diameter breaks.

PINGP Large LOCA = breaks beyond the capability of the high head injection system but which do not require accumulator injection, with decay heat removal via the break and shutdown reactivity insertion via borated injection; range defined as 12" and greater but less than the design basis LOCA break size.

PINGP DBA Large LOCA = break size for which accumulator injection is required in addition to low head injection; range defined as the design basis break size.

TYPICAL Large LOCA = breaks that are sufficiently large to depressurize to the RHR pump shutoff head, with decay heat removal via the break and shutdown reactivity insertion via borated injection; typically > 6" diameter breaks.

Among the implications of the above are the following:

The PINGP PRA S1 SLOCA plant response and modeling should be similar to the SLOCA response and modeling for typical plant PRAs.

The PINGP PRA S2 SLOCA plant response and modeling should be similar to the MLOCA response and modeling for

- typical plant PRAs.

Attachment 1 Page 9 of 17

PRAIRIE ISLAND CLOSED FACTS & OBSERVATIONS (F&O's) FROM THE WESTINGHOUSE OWNERS GROUP (WOG) PEER REVIEW PROCESS Item F&O Observation Level of Status & Resolution Impact on RI IS1 Significance The PINGP PRA MLOCA assumes that a single train of high head injection can mitigate what is equivalent to the low end of the large LOCA size range for typical plants, for which high head injection is normally not credited.

The PINGP PRA LLOCA (non-DBA) plant response and modeling differs from the LLOCA response and modeling for typical plant PRAs in that it does not include a requirement for accumulator injection; the LLOCA DBA plant response and modeling is equivalent to that for typical PRAs.

15 TH-13, The Success Criteria notebook provides some perspective on B CLOSED - No Impact.

sub- the rationale for what was done. However, the guidance Although not explicitly stated in the calculation folders, element reviewed does not explicitly state the approach to be used for there was a methodology for determining when a MAAP This F&O has been determining the need for and types of thermal/hydraulic case should be used in determining success criteria. Some resolved for the Prairie calculations necessary to support the PRA success criteria. of the criteria used in this determination include: Island PRA model used Several instances have been noted (in other F&Os) for which to perform RI-IS1 detailed analyses have been required, and the MAAP code was 1) If timings were needed for important operator consequence analysis.

used without sufficient justification or check for applicability. actions.

2) The amount of time it took to draindown tanks (i.e.

RWST)

3) To relax the USAR success criteria for certain accidents.

Although no guidance is written down on when to apply the MAAP code, the use of the MAAP code to support the current model, does not present a questionable analysis or inaccurate results. The results and conclusions from the current model are not significantly affected by this finding.

16 TH-16, As described in the Safeguards Ventilation System Notebook, B CLOSED - No Impact.

sub- room cooling requirements have been addressed for the As part of the system notebook upgrade project, the element equipment modeled in the PRA. This notebook presents a Safeguards Ventilation Notebook has been revised to This F&O has been address issues related to crediting operator actions to resolved for the Prairie discussion, with references to engineering calcs, regarding the need for cooling for each such room. However, in some cases, restore room cooling for the Control Room, Relay Room Island PRA model used it is not clear that the rationale provided for not modeling room and Battery Room. A sensitivity study was performed for to perform RI-IS1 cooling is sufficient. For example, for the Relay Room, it is each room to determine the significant of modeling room consequence analysis.

stated that analyses have shown that it is necessary to maintain cooling for the specified rooms. The analysis showed that the temperature below 120 deg F, but that room heatup analysis modeling the room cooling contributes very little to the showed that the temperature would reach 120 deg F at 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br />. overall CDF value and was of low safety significance. The Then the statement is made that "This provides sufficient time documentation is more clear and complete.

for the operator to perform the corrective actions per C37.9 AOP2." While there may indeed be sufficient time to perform corrective actions, there is no guarantee that the actions will be performed. Since the temperature exceeds the allowable Attachment 1 Page 10 of 17

PRAIRIE ISLAND CLOSED FACTS & OBSERVATIONS (F&09s)FROM THE WESTINGHOUSE OWNERS GROUP (WOG) PEER REVIEW PROCESS Item F&O Observation Level of Status & Resolution Impact on RI IS1 Significance equipment temperature well within the PRA mission time, there is a dependency on room cooling for this room that should either be modeled or more carefully analyzed.

17 TH-17, The fault tree model, for large, medium, and some small S2 B CLOSED - No Impact.

sub- LOCAs, credits ECCS flow to the faulted loop. Unless thermal- The Rev 1.2 model includes the necessary logic to remove element hydraulic analyses exist to provide a basis for this, it would be the faulted loop as a possible flow path during LOCAs. This F&O has been expected that the injection path associated with the faulted loop Loop specific LOCA initiating events have been added to resolved and is unavailable, and only the remaining path would be available the model, which will fail the appropriate RCS injection incorporated into the for success. The success criterion should be 1 of 2 pumps to the loop. This results in success criteria of 1 out of 2 pumps to Prairie Island PRA single intact RCS loop. the single intact RCS loop. In addition, the accumulator on model used to perform the faulted loop is also failed in the logic and is not RI-IS1 consequence available for injection. analysis.

The issues presented in this F&O have been resolved and implemented in the Rev 1.2 model update as described above. (Same assumptions were used in the Rev 2.0 model.)

SY-2, sub- The corrective maintenance unavailability basic event for the B CLOSED - No Impact.

element 120VAC IP Inverters is modeled incorrectly in the Fault Tree. For the Rev 1.2 model, the 120V AC Instrument Power As modeled, with an inverter out of service, the fault tree still fault tree was changed so that the CM event was moved This F&O has been allows power to be supplied from the alternate AC source higher in the tree so that if it fails all power supplies that resolved and through the inverter to the instrument panel. The same comment feed the bus through the inverter. This change was incorporated into the may also apply to other inverter (and output breaker) failure performed for the following: Prairie Island PRA models in the PRA. 11 (2 1) Inverter model used to perform 12 (22) Inverter RI-IS1 consequence 13 (23) Inverter analysis.

14 (24) Inverter 17 (27) Inverter 18 (28) Inverter The issues presented in this F&O have been resolved and implemented in the Rev 1.2 model update as described above. Same assumptions were used in the Rev 2.0 model.

l9 SY-7, sub- As described in the Safeguards Ventilation System Notebook, B CLOSED - No Impact.

element mom cooling requirements have been addressed for the AS part of the system notebook upgrade project, the equipment modeled in the PRA. This notebook presents a Safeguards Ventilation Notebook has been revised to This F&O has been discussion, with references to engineering calcs, regarding the address issues related to crediting operator actions to resolved for the Prairie need for cooling for each such room. However, in some cases, restore room cooling for the Control Room, Relay Room Island PRA model used it is not clear that the rationale provided for not modeling room and Battery Room. A sensitivity study was performed for to perform RI-IS1 cooling is sufficient. each room to determine the significant of modeling room consequence analysis.

cooling for the specified rooms. The analysis showed that For example, for the Relay Room, it is stated that analyses have Attachment 1 Page 11 of 17

PRAIRIE ISLAND CLOSED FACTS & OBSERVATIONS (F&O's) FROM THE WESTINGHOUSE OWNERS GROUP (WOG) PEER REVIEW PROCESS Item F&O Observation Level of Status & Resolution Impact on RI IS1 Significance shown that it is necessary to maintain the temperature below modeling the room cooling contributes very little to the 120 deg F, but that room heatup analysis showed that the overall CDF value and was of low safety significance. The temperature would reach 120 deg F at l l hours. Then the documentation is more clear and complete. As far as the statement is made that "This provides sufficient time for the SI pump room issue, the SI System Notebook was also operator to perform the corrective actions per C37.9 AOP2." updated and the assumptions on room cooling are more While there may indeed be sufficient time to perform corrective detailed and clear. Room cooling is not required for the SI actions, there is no guarantee that the actions will be performed. pump room during injection or recirculation phase per Since the temperature exceeds the allowable equipment Safety Evaluation 375.

temperature well within the PRA mission time, there is a dependency on room cooling for this room that should either be modeled or more carefully analyzed.

As another example, for the rooms housing 120VAC Instrument Power equipment, there is no discussion of ventilation requirements in the notebook. The equipment survivability discussion notes that room cooling is required, and that 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> are available following loss of ventilation to re-establish ventilation. However, actions to open doors or re-establish cooling are not modeled in the fault tree.

One editorial problem also pertains to the ventilation modeling.

Assumption 5 in the SI system notebook states that room cooling is not required for SI in injection mode, but the assumption does not address recirculation mode. The room heatup calculation actually assumed sump recirculation mode, and that should be noted in the notebook.

20 SY-17, The PORV Fault Tree for Feed & Bleed is applied in sequences B CLOSED - No Impact.

sub- involving initiators that would cause containment isolation on The PORV accumulator has been added to the model. This l3 an S signal. The fault tree takes no credit for the PORV will provide a source of air to the PORVs for Feed and This F&O has been accumulators to allow the PORVs to be used after isolation of Bleed operation when air is isolated to containment. The resolved and the air supply, and also takes no credit for operator action to re- Rev 1.2 model will take credit for the pressurizer PORV incorporated into the establish air to the containment. As a result, the model assumes accumulator if instrument air is not available. This is Prairie Island PRA failure of both PORVs when air is isolated to containment. based on the following: model used to perform A) Procedures instruct the operators that the RI-IS1 consequence As a result of the assumption that the PORV accumulators are accumulators are available for operating the PORV if analysis.

not sufficient for Feed and Bleed in scenarios involving an S instrument air is not available.

signal, the model appears to be overly pessimistic regarding B) Operators are trained in the use of these procedures.

credit for feed & bleed. FR.H. I Step 1 1 provides direction to C) The model will conservatively assume a high failure the operators to re-establish air to containment, so consideration probability for the accumulator (approximately 0.5) should be given to modeling this action, along with associated valve failure probabilities. The issues presented in this F&O have been resolved and implemented in the Rev 1.2 model update as described above. The same assumptions were used in the Rev 2.0 model.

Attachment 1 Page 12 of 17

PRAIRIE ISLAND CLOSED FACTS & OBSERVATIONS (F&O's) FROM THE WESTINGHOUSE OWNERS GROUP F O G ) PEER REVIEW PROCESS Item F&O Observation Level of Status & Resolution Impact on R I IS1 Significance 21 DA-39 sub- The operating hours for the D5 and D6 diesels were not B CLOSED - No Impact.

element calculated correctly. In file V.SMD.95.007, the exposure time For the Rev 1.2 model the exposure times for DS/D6 were re-evaluated and new unavailabilities were re-calculated This F&O has been for the planned maintenance (PM) and corrective maintenance based on the new values. The exposure time for the PM resolved and (CM) unvailablilites is stated as 175,344 hours0.00398 days <br />0.0956 hours <br />5.687831e-4 weeks <br />1.30892e-4 months <br />. This is the same and CM for D5D6 was 2 1864 hours0.0216 days <br />0.518 hours <br />0.00308 weeks <br />7.09252e-4 months <br />. incorporated into the exposure time as for D1D2, and appears to be the full 11 years Prairie Island PRA of operation in the database. D5 and D6 were not installed until 1993. The exposure time the CM and PM for D5 and D6 should The issues presented in this F&O have been resolved and model used to perform be about 24,000 hr. This increases the PM and CM implemented in the Rev 1.2 model update as described RI-IS1 consequence above. (The same data was used in the Rev 2.0 model.) analysis.

unavailabilities by a factor of 4.

(The exposure time for fail to start and fail to run is calculated correctly.)

22 DA-87 sub- Notebook V.SMN.92.028 states that 4kv breakers are included B CLOSED - No Impact.

element l o in the fault tree models but are not common caused together The NRC issued this same question during the initial review of the IPE. A specific Request For Information This F&O has been because the the components supplied by the breakers already include any breaker common cause failures that have occurred. question was issued by the NRC related to the omission of resolved for the Prairie the CCF modeling of circuit breakers and electrical Island PRA model used The component boundaries for all components fed by these switchgear. The PI PRA group response follows: to perform RI-IS1 breakers (pumps, buses) should be consistent so that breaker consequence analysis.

failure rates and CCF rates can be consistently applied.

"Common cause failures of circuit breakers and switchgear There are also no CCF events for bus feeder breakers. were not explicitly modeled, but common cause failures of Most PRAs treat 4kv breakers separately from served loads supplied through the breakers, such as pumps, valves components, and include separate CCF events for the important and other components that can be attributable to common sets of breakers. cause mechanisms were modeled. This implicitly captures circuit breaker common cause failures that are associated with these components. As with circuit breakers, common switchgear (in terms of function and the effects of failures) are implicitly analyzed with other failures, such as emergency diesel generator common cause failures."

The NRC approved the IPE, including this modeling assumption.

23 DA-I O, In Rev 1, when the plant specific data was 0 failures in T B CLOSED - No Impact.

Sub- exposure time, the failure rate was calculated by assuming 0.5 The approach using 0.3 failures in the exposure time was element l 7 failures in T exposure time. This is mathematically equivalent not incorporated into the Rev 1.2 or Rev 2.0 models. This F&O has been resolved for the Prairie to using a Bayesian update with a Jeffrey's prior. There is no way of knowing if this estimate is reasonable or not. A more If Bayesian updating process is used in future model Island PRA model used revisions, the recommendations from this F&O will be to perform RI-IS1 technically sound approach is to use a generic prior for Bayesian update. In Rev2, the data development has changed to incorporated. consequence analysis.

use 0.3 failures in the exposure time. There is no basis for this practice, expecially when the Rev 2 data makes significant use of Bayesian process.

Attachment 1 Page 13 of 17

PRAIRIE ISLAND CLOSED FACTS & OBSERVATIONS (F&O9s)FROM THE WESTINGHOUSE OWNERS GROUP (WOG) PEER REVIEW PROCESS Item F&O Observation Level of Status & Resolution Impact on RI IS1 Significance 24 DA-l I, The number of plant specific failures for CVCS pumps in Rev B CLOSED - No Impact.

sub- 2.0 seems high - about 60-80. There is no reason to use The CVCS data in question was not incorporated into the element Bayesian update techniques when there are such a large number Rev 1.2 model or the Rev 2.0 model. This F&O has been of plant specific failures. In fact, since the plant specific failure resolved for the Prairie rate is relatively high compared to generic sources, it could The current failure rates for the CVCS pumps are based on Island PRA model used likely be shown that the PI CVCS pumps are not in the same plant specific data without a Bayesian update. to perform RI-IS1 population as generic pumps and a Bayesian update process consequence analysis.

should not be used. If a Bayesian Process will be used to update the data information, the recommendations from this F&O will be considered.

25 HR-6, sub- The HRA documentation indicates that operator interviews B CLOSED - No Impact.

element l o were conducted when determining the execution time of The HEP that were determined by this method have been procedure steps, but the values used appear to be generic. re-calculated. A new HEP screening criteria was used. This F&O has been The majority of the HEPs increase using this value resolved and Further, a "generic" value of 45 minutes is identified as the resulting in a more conservative approach. This F&O can incorporated into the shortest time to core damage for any accident. This value is be considered closed out. The new values have been Prairie Island PRA then used in the screening analysis for several operator actions incorporated into the Rev 1.2 model and the Rev 2.0 model used to perform where the time to core damage is being estimated. There model. RI-IS1 consequence doesn't appear to be a basis for the 45 minute value. analysis.

Furthermore, it not clear that this value is applicable to the actions modeled.

26 HR-7, sub- Two of the ten most important operator actions, ABUS27RESY A CLOSED - No Impact.

element and N12 1DRYXXY (sorted by FV), are quantified using ABUS27RESY was removed from the model, as this is an screening values. This is contrary to the PINGP PRA action that would not be performed during accident This F&O has been groundrules and industry guidance. conditions. A recent plant modification was added to the resolved and instrument air system fault tree which caused the incorporated into the importance of operator action N 121DRYXXY to decrease Prairie Island PRA such that its Fussel-Vesely is -lE-04 which is well below model used to perform the NMC criteria for use of detailed human error modeling. RI-IS1 consequence These modifications were incorporated into rev 1.2 of the analysis.

model. Following these modifications and others, a new screening was performed which identified two new operator actions that were above the screening criteria and were quantified with screening values. An ASEP analysis was performed on both of these events so that now there are not any important operator actions that were quantified with screening values.

The issues presented in this F&O have been resolved and implemented in the Rev 1.2 model update as described above. (Same assumptions were used in the Rev 2.0 model.)

Attachment 1 Page 14 of 17

PRAIRIE ISLAND CLOSED FACTS & OBSERVATIONS (F&O's) FROM THE WESTINGHOUSE OWNERS GROUP (WOG) PEER REVIEW PROCESS Item F&O Observation Level of Status & Resolution Impact on RI IS1 Significance 27 HR-11, Based on the operator action sensitivity study performed, there A CLOSED - No Impact.

sub- are several scenarios involving multiple human error events. A new rev 1.2 model has been created that has element 27 Some of the dependencies appear to have been recognized, but incorporated many of the peer review team comments. This F&O has been it was not intuitively obvious how they were factored into the Among them is the explicit modeling within the one top resolved and quantification of conditional HEPs (e.g., FDBLDOPATY). fault tree of the dependant operator actions. The model was incorporated into the Several scenarios involve more than 4 HEPs, and this raises a solved by setting all of the operator actions to 1.O. The top Prairie Island PRA question regarding how the operator actions are being placed 100 accident sequences, which contributed over 95% of the model used to perform within the model. The product of some of these multiple HEP core damage, were analyzed for dependant actions. The RI-IS1 consequence scenarios result in total crew failure probabilities less than 1E- HEPs in these sequences were ordered as to when they analysis.

06, which appears to be optimistic. would be performed in time and new conditional HEPs were calculated using NUREGICR-1278. The new conditional HEPs were then modeled in the one top fault tree and the mutually exclusive file was used to remove any illogical cutsets.

The issues presented in this F&O have been resolved and implemented in the Rev 1.2 model update as described above. (The same assumptions were used in the Rev 2.0 model.)

28 HR-15, The local actions in the switchover to containment sump B CLOSED - No Impact.

sub- recirculation are modeled as 4 actions that are easy to recall. In The three operator actions in question (HRECIRCSMY, l7 actuality there are 13 distinct actions and only 4 are given as HRECIRCXXY and RECIRCXXY) which all involve This F&O has been critical. No justification is given for the non-critical steps. Even switchover to recirculation were revised to incorporate the resolved and accepting that the other 9 actions are not critical, they would fact that the local operator must perform all local actions incorporated into the certainly affect the operator's ability to remember the steps. In up to the point in which the critical actions required for Prairie Island PRA general there doesn't appear to be any evidence for the non- success are performed. The local operator now has a model used to perform criticality of tasks or that the added complexity they introduce procedure to perform these actions such that they do not RI-IS1 consequence has been considered. need to be performed from memory. The revised HEPs analysis.

were incorporated in the updated rev 1.2 model.

The issues presented in this F&O have been resolved and implemented in the Rev 1.2 model update as described above. (Same values were used in the Rev 2.0 model.)

29 QU-l3 sub- This F&O relates to both guidance and documentation sub- B CLOSED - No Impact.

elements of QU. A Quantification Notebook was created detailing the Rev 1.2 and Rev 2.0 PRA model results. The notebook This F&O has been A quantification notebook describing the following items needs contains sufficient guidance for performing the process and resolved and to be created: sufficient detail to document the inputs and outputs of the incorporated into the how the one-top CDF model is constructed (guidance); process. Prairie Island PRA how any technical adjustments are made to the top of the model used to perform FT or in the systems below (beyond what is documented in The issues presented in this F&O have been resolved and RI-IS1 consequence the system and event tree notebooks) to allow implemented in the Rev 1.2 model (and Rev 2.0 model) analysis.

update as described above.

Attachment 1 Page 150f 17

PRAIRIE ISLAND CLOSED FACTS & OBSERVATIONS (F&09s)FROM THE WESTINGHOUSE OWNERS GROUP (WOG) PEER REVIEW PROCESS Item F&O Observation Level of Status & Resolution Impact on RI IS1 Significance quantification; any special logic introduced to model sequences (flags, etc.);

supporting files (such as MUTEX, RECOVERY, .BE, .TC, etch summary inputloutput files; results summary files and conclusions (See QU-5 also);

computer run parameters; type of computer and operating system, list and version of executable codes used; limitations of the code; references to supporting model notebooks (ET, system, HRA, data) etc.

Modifications performed in the one-top fault tree, such as creation of the AFW-T fault tree from the full AFW tree, must be documented either in the quantification or system notebooks.

30 QU-3, sub- The contribution of LOOP sequences that lead to loss of cooling B CLOSED - No Impact.

element 8 water and instrument air could be greatly reduced if credit could For the Rev 1.2 model, recovery of offsite power was be given to recovery of offsite power within the calculated time credited for the LOOP sequences. This F&O has been to core uncovery of 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />. resolved and The issues presented in this F&O have been resolved and incorporated into the implemented in the Rev 1.2 model (and rev 2.0 model) Prairie Island PRA update as described above. model used to perform RI-IS1 consequence analysis.

sub- PRA group procedure 3.001 A requires evaluation of PRA B CLOSED - No Impact.

results when the model is updated, and documentation in An extensive review of the Rev 1.2 and Rev 2.0 model accordance with PRA group procedure 1.002A. The procedure results (top cutsets, dominant accident sequences, initiating This F&O has been indicates that the evaluation must include a review of top events review, importance measures, model asymmetries, resolved for the Prairie cutsets and basic event importance measures to ensure that operator actions) has been performed and is documented in Island PRA model used dominant contributors to risk are modeled accurately and that the Quantification Notebook. to perform RI-IS1 dependent operator actions are treated appropriately, with focus consequence analysis.

on understanding and addressing risk significant issues that As with all the PRA calculation folders, a senior PRA have resulted from the latest requantification. person has reviewed the results.

For a full PRA update, consideration should also be given to Fleet PRA procedures have also been developed and reviewing more than just dominant contributors and top cutsets, implemented which address the PRA model maintenance depending on the extent of modeling change. For example, the issues.

in-progress Rev 2 model upgrade may produce results that will Attachment 1 . Page 16 of 17

PRAIRIE ISLAND CLOSED FACTS & OBSERVATIONS (F&O's) FROM THE WESTINGHOUSE OWNERS GROUP (WOG) PEER REVIEW PROCESS Item F&O Observation Level of Status & Resolution Impact on RI IS1

- Significance require a deeper review than an examination of top cutsets, top risk importance contributors, and overall CDFILERF values.

Attachment 1 Page 17 of 17

PRAIRIE ISLAND OPEN FACTS & OBSERVATIONS (F&O's) FROM THE WESTINGHOUSE OWNERS GROUP (WOG) PEER REVIEW PROCESS Item F&O Observation Level of Status & Resolution Impact on R I IS1 Significance SY-4, sub- The I20 VAC Model does not include failures of B OPEN - No impact.

element the 120 VAC Panel (bus faults). These are Due to the low probability of the Instrument Panel fault, normally modeled in most PRAs. this modeling error is not expected to have a significant A sensitivity analysis was performed impact on the results. to determine the impact of including this failure in the 120 VAC fault A sensitivity analysis was performed to determine the tree. The sensitivity study showed risk significance of including the Instrument Panel fault that the CCDP and CLERP values in the PRA model. Appropriate basic events were added associated with small, medium, and to the 120 VAC panel logic (Panels 11l(21 I), 112(212), large LOCAs did not change from 113(213), and 114(214)). those provided in Prairie Island's RI-IS1 submittal. The results of the Results from the Rev 2.0 model showed no increase in sensitivity analysis determined that CDF or LERF with this modeling change. the resolution of this F&O has no impact on the results or conclusions The next revision to the model will include failures of of the Prairie Island RI-IS1 the 120 VAC Panel (bus faults). submittal.

DA-5, sub- The common cause failure modeling was based B OPEN - In our opinion, data from on methods and data in NUREGICR-4780. While it is true that NUREGICR-6268 and it's NUREGICR-4780 is applicable and Although the methods in this document are still associated database represent a more current database can still be used.

valid, the CCF factors (numerical values) are for the analysis of common cause failures (CCF), until a based on plant experience and judgment prior to plant specific analysis has been performed using this It is our intent to update the CCF 1988. NUREGICR-6268 (INEL) is a more database, it cannot be determined that the CCF factors numbers using a more current current source of common cause data and should that are used in the Rev 2.0 model are too high. A database as part of the data update be used in the next update. There are several beta current version of the CCF database will be utilized to project.

factors in the current model that are 0.1 to 0.4 in analyze the CCF factors during the continuing update value. (RHR, Containment Sprays, Fan coolers). process. Any changes in the PRA results due In light of the more recent data in NUREGICR- to this modeling revision will be 6268, these beta values are high and should be We recognize the need to update the CCF numbers and evaluated to determine the impact on revised. have a schedule and plan to update the data. However, the RI-IS1 results as part of the the data is applicable and can still be used. "living" aspect of the RI-IS1 program.

A data update project has been started which will address this F&O. -

DA-6y sub- Plant specific data used to support PRA Rev. 1 B OPEN - It is our intent to update the plant was collected for the IPE in 1988. Generic We recognize the need to update the plant specific data specific data using more current failure rates were used extensively in the IPE. In and have a schedule and plan to update the data. information as part of the data 1995, an updated data collection was performed However, the "old" data is applicable and can still be update project.

for AFW pumps, DG's, Air compressors, used.

Cooling water pumps, SI pumps, and RHR Any changes in the PRA results due Attachment 2 Page 1 of 4

PRAIRIE ISLAND OPEN FACTS & OBSERVATIONS (F&O's) FROM THE WESTINGHOUSE OWNERS GROUP (WOG) PEER REVIEW PROCESS Item F&O Observation Level of Status & Resolution Impact on RI IS1 Significance pumps, which were selected on the basis of risk- A data update project has been started which will to this modeling revision will be significance to the PRA results. A larger data address this F&O. evaluated to determine the impact on development effort is underway for Rev 2, but the RI-IS1 results as part of the this still limits the plant specific data period to "living" aspect of the RI-IS1 1995. program.

The observed status of the use of plant-specific data, given the above, is the following:

(a) 6 components in the Rev. 1 PRA have failure rates based on plant-specific data through 1995; (b) a limited number of other components in Rev. 1 have failure rates based on plant-specific data through 1988; (c) most of the failure rates in Rev. 1 are generic; (d) after the Rev. 2 update, data will only be current through 1995.

The reviewers believe the PRA relies too heavily on plant data that is not sufficiently current with the as-operated plant.

4 HR-4, sub- B OPEN - The HRA analysis update to meet element 6 The methodology used to calculate the pre-initiator the new standards has been The equation used to quantify latent errors is not Human Error Probability (HEP) is adequate. However, completed and will be incorporated intuitive, and appears to be incorrect. the PRA group recognizes the need to use an improved into the next model update.

The equation presented in the HRA notebook methodology to perform the calculation. The HEP suggests that there is a time period in which a analysis needs to be updated to new standards. Any changes in the PRA results due component can be considered available after to this modeling revision will be corrective maintenance (CM) but prior to retest A Human Reliability Analysis (HRA) update to meet the evaluated to determine the impact on (assumed to be 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />). Conversely, the new standards has been completed and will be the RI-IS1 results as part of the equation implies that no retest is performed incorporated into the next model revision. "living" aspect of the RI-IS1 following preventive maintenance (PM). This program.

most likely does not reflect maintenance practices. Furthermore, the peer review guidance suggests that latent errors may be screened when a post maintenance test is performed.

The summation of the PM, test (T), and random failure (RF) frequencies does not have any Attachment 2 Page 2 of 4

PRAIRIE ISLAND OPEN FACTS & OBSERVATIONS (F&09s)FROM THE WESTINGHOUSE OWNERS GROUP F O G ) PEER REVIEW PROCESS Item F&O Observation Level of Status & Resolution Impact on RI IS1 Significance physical meaning, as the terms appear to be mutually exclusive. In addition, for components only exposed to latent error on a refueling outage frequency, the approach mentions that the operators would most likely find a latent error prior to startup. For these cases, a TI value of 4 is assumed which is very similar to the CM cases. However, in practice, at-power surveillance test intervals are being substituted for TI values applied to components exposed to latent error only during refueling (e.g.,

CTRAINAXXZ, CVHCSI IXXZ). Lastly, it seems that the refueling frequency value of 8.55E-05hr is artificially reducing the HEP in these cases.

5 QU-5, sub- The Peer Review supplemental guidance (draft B OPEN - No impact.

subtier criteria) states that, for a category 3 A Quantification Notebook was created detailing the classification for this sub-element, one must Rev 1.2 PRA model results. The notebook contains a In our opinion, documenting and fulfill the following: thorough evaluation of the quantification results evaluating a cross comparison including review of top cutsets, dominant accident between similar plants is not "The accident sequence results by sequence, sequences, initiating events, importance measures, expected to have a significant sequence types, and total should be reviewed and model asymmetries, and operator actions. impact on the results or conclusion compared to similar plants to assure provided in the Prairie Island RI-IS1 reasonableness and to identify any exceptions. However, a comparison of our results to similar plants submittal.

A detailed description of the Top 10 to 100 was not performed. As part of the Mitigating System accident cutsets should be provided because they Performance Index (MSPI) project, a WOG Comparison are important in ensuring that the model results report will be completed on PWRs. The significant are well understood and that modeling systems (Safety Injection, Residual Heat Removal, assumption impacts are likewise well known. Auxiliary Feedwater, Component Cooling, Emergency Similarly, the dominant accident sequences or Diesel Generators, and Cooling Water) will be functional failure groups should also be compared.

discussed. These functional failure groups should be based on a scheme similar to that Results from the Westinghouse MSPI Cross Comparison identified by NEI in NEI 91-04, Appendix B." document related to Prairie Island will be addressed as part of the MSPI Project by December 2005. Once this A summary of top sequences by initiating event is completed this F&O will be considered closed.

was provided, as was a listing of risk-important systems and operator actions. Detailed descriptions of cutsets were not provided, nor was a comparison of results to similar plants.

Attachment 2 Page 3 of 4

PRAIRIE ISLAND OPEN FACTS & OBSERVATIONS (F&O's) FROM THE WESTINGHOUSE OWNERS GROUP (WOG) PEER REVIEW PROCESS Item F&O Observation Level of Status & Resolution Impact on RI IS1 Significance QU-6, sub- Neither a quantitative uncertainty analysis nor a B OPEN - No Impact.

27 qualitative evaluation of significant sources of A data update project has been started which will uncertainty are addressed. address this F&O. In our opinion, the RI-IS1 application is unaffected by the results from an uncertainty analysis since the RI-IS1 program is based on the results from propagating point estimates through the model.

Attachment 2 Page 4 of 4