L-PI-05-076, Prairie Lsland Nuclear Generating Plant Units 1 and 2, Response to Request for Additional Information Regarding the Relief Request to Implement Risk-Informed Inservice Lnspection (ISI) Scheduling for the Fourth 10-Year Lnspection Interva

Prairie Lsland Nuclear Generating Plant Units 1 and 2, Response to Request for Additional Information Regarding the Relief Request to Implement Risk-Informed Inservice Lnspection (ISI) Scheduling for the Fourth 10-Year Lnspection Interval

ML052430399
Person / Time
Site:	Prairie Island
Issue date:	08/30/2005
From:	Thomas J. Palmisano Nuclear Management Co
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
L-PI-05-076
Download: ML052430399 (27)

Text

N Comm t ited to Nucl Prairie lsland Nuclear Generating Plant Operated by Nuclear Management Company, LLC AUG 3 0 2005 U S Nuclear Regulatory Commission ATTN: Document Control Desk Washington, DC 20555-0001 Prairie lsland Nuclear Generating Plant Units 1 and 2 Dockets 50-282 and 50-306 License Nos. DPR-42 and DPR-60 Response to Request for Additional Information Regarding the "Relief Request to Implement Risk-Informed lnservice lnspection (ISI) Scheduling for the Fourth 10-Year lns~ection Interval for Prairie lsland Units 1 and 2"

Reference:

Letter from Nuclear Management Company, LLC (NMC) to Nuclear Regulatory Commission (NRC), "Relief Request to Implement Risk-Informed lnservice lnspection (ISI) Scheduling for the Fourth 10-Year lnspection Interval for Prairie lsland Units 1 and 2" dated December 29,2004.

Prairie lsland submitted a Relief Request to implement Risk-Informed IS1 Scheduling for the Fourth 10-Year lnspection Interval in a letter dated December 29, 2004 (Reference).

By electronic mail, dated June 3, 2005, the NRC requested additional information regarding the relief request. The enclosure to this letter contains the response to that request.

Summarv of Commitments This letter contains no new commitments and no revisions to existing commitments.

Thomas J. Palmisano Site Vice President, Prairie lsland Nuclear Generating Plant Nuclear Management Company, LLC Enclosure cc:

Administrator, Region Ill, USNRC Project Manager, Prairie Island, USNRC Resident Inspector, Prairie Island, USNRC 171 7 Wakonade Drive East Welch, Minnesota 55089-9642 Telephone: 651.388.1 121

ENCLOSURE Response to Request for Additional Information Regarding the "Relief Request to Implement Risk-Informed lnservice lnspection (ISI) Scheduling for the Fourth I O -

Year lnspection Interval for Prairie Island Units 1 and 2" Response to Request for Additional Information, 4 pages plus List of Acronyms, 1 page Attachment I, 17 pages,4 pages Page 1 of 4

Enclosure Response to Request for Additional Information The NRC questions are in bold type face.

The NMC responses are in plain type face.

Did you exclude Class 2 pipe or welds that are exempt from American Society of Mechanical Engineers (ASME) inspection requirements from the population of welds evaluated in your RI-IS1 program? Both Regulatory Guide 1.I78 and EPRl TR-112657 simply discuss Class 2 welds and do not differentiate between welds exempted from ASME inspection requirements and welds not exempted from these requirements. If you did exclude these Class 2 pipe welds from your RI-IS1 program, please identify the guidance you relied upon to exclude welds from your RI-IS1 program scope based on them being exempt from ASME inspection requirements.

There are two areas wherein exemption is taken for Class 2 welds. IWC-1220 provides exemption from ASME Section XI entirely (meaning that these welds are not included in Section XI scope). Table IWC-2500-1 includes an exemption from NDE if the thickness of the associated piping < 318" for piping > NPS4 or 5 115" for piping 1 NPS2 and 5 NPS4, however these exempted welds must be included in the total population.

Per a phone conversation with the Staff, NMC understands that the question is dealing with the exemption cited under IWC-1220(a) specifically. IWC-1220 exempts components from the volumetric and surface examination requirement of IWC-2500. NMC did not include those Class 2 piping welds that are exempt under IWC-1220.

The reason for NOT including the piping welds under IWC-1220 is that under a normal IS1 Program meeting the requirements of ASME Section XI these welds would not require volumetric examination nor would these welds be included in the total population of which the 7.5% is taken. The Risk-Informed Inservice Inspection Program (RI-ISI) is an alternative to the ASME Section XI Code requirements. And as stated in the NRC SER for the EPRl Topical Report, TR-112657 Rev. B-A, "The staff concludes that the proposed RI-IS1 program as described in EPRl TR-112657, Revision B, is a sound technical approach and will provide an acceptable level of quality and safety pursuant to 10CFR50.55a for the proposed alternative to the piping IS1 requirements with regard to the number of locations, locations of inspections, and methods of inspection". Since the welds exempted by IWC-1220 would not have been classified as Category C-F-I of C-F-2, there are no Section XI non-destructive examination (NDE) requirements and therefore no alternative is specified in the RI-IS1 Program for these welds.

2.

On page 5 of your submittal, you describe the Westinghouse Owners Group probabilistic risk assessment (PRA) Peer Certification Review that was performed on the 1999 update PRA model. Per Regulatory Guide 1.178 dated September 2003, please list all Level A and B "Facts and Page 2 of 4

Enclosure Response to Request for Additional Information Observations" from the review and how they have been addressed in the Revision 1.2 model. If some of the Level A and B "Facts and Observations" have not been addressed, please state why they are not expected to result in model changes that could significantly affect the overall results or conclusions of the RI-IS1 consequence evaluation.

All closed Level A and B "Facts and Observations" are listed in Attachment 1, including the manner in which they have been addressed. lists the open Level B "Facts and Observations." For each item, the status is provided and there is either a discussion of potential impacts on RI-IS1 consequence evaluation or a statement that future PRA model updates will be evaluated for impact.

3. The Unit 1 and Unit 2 Reactor Coolant System in Tables 5-1-1 and 5-1-2 identify welds in the examination category B-F. Please specify if the welds in this examination category are piping welds or reactor vessel welds since the 1989 Edition of the ASME Code,Section XI, identifies dissimilar metal welds in B-F examination category to either the piping or the vessel welds.

It is noted also that the risk-informed inservice inspection program in accordance with EPRl TR-112657, Revision B-A is applicable to the examination category B-F for piping welds.

Based on the conference call held with the staff, the inclusion of Category B-F welds that are associated with the vessel should not be included. The conversation focused on the nozzle-to-safe end welds that contain Alloy 600 material that is highly susceptible to Primary Water Stress Corrosion Cracking (PWSCC).

The plant has the following breakdown concerning Category B-F welds:

There are six ltem Number B5.10 welds (Reactor Vessel Nozzle-to-Safe End Butt Welds)

There are five ltem Number B5.40 welds (Pressurizer Nozzle-to-Safe End Butt Welds)

There are four ltem Number B5.70 welds (Steam Generator Nozzle-to-Safe End Butt welds)

These are all Nozzle-to-Safe End Butt Welds that are associated with vessels.

However, between the two units, there is only one weld that includes material considered susceptible to PWSCC. This weld is off of the bottom of the Unit 2 pressurizer. This weld was selected for examination.

The NRC Safety Evaluation for the EPRl TR-112657 states "The staff concludes that the inclusion of B-F welds in a RI-IS1 Program is a plant-specific issue and that individual licensees should determine the safety significance of B-F welds and perform the examinations commensurate with the associated risk."

Page 3 of 4

Enclosure Response to Request for Additional Information Since the weld containing material susceptible to PWSCC has been selected for examination, NMC believes that the Safety Evaluation intent has been met.

Page 4 of 4

List of Acronyms AF AFW AOP ATW S CCDP CCF CDF CLERP CM cvcs DG ECCS EF EOP EPRl ET F&O HEP HRA INEL INSTAI R IPE LER LOCA LOCL LOlA LOOP LOSP M AAP MFW MS-FLB MSlV NMC PlNGP PM PORV PRA RCP RCS RHR RI-IS1 SBO SG SGTR S I SLOCA T&H VAC WOG Auxiliary feedwater Auxiliary feedwater Abnormal operating procedure Anticipated transient without scram conditional core damage probability Common cause frequency Core damage frequency Conditional large early release probability Corrective maintenance Chemical and volume control system Diesel generator Emergency core cooling system Error factor Emergency operating procedure Electric Power Research Institute Event tree Facts and observations Human error probability Human reliability analysis Idaho National Engineering and Environmental Laboratory Loss of instrument air Individual plant examination License event report Loss of coolant accident Loss of cooling water Loss of instrument air Loss of offsite power Loss of offsite power Modular accident analysis program Main feedwater Main steam / main feedwater line break Main steam isolation valve Nuclear Management Company Prairie Island Nuclear Generating Plant Preventive maintenance Power-operated relief valve Probabilistic risk assessment Reactor coolant pump Reactor coolant system Residual heat removal Risk Informed - Inservice Inspection Station blackout Steam generator Steam generator tube rupture Safety injection Small loss of coolant accident Thermal hydraulic Volts, alternating current Westinghouse Owners' Group

PRAIRIE ISLAND CLOSED FACTS & OBSERVATIONS (F&09s) FROM THE WESTINGHOUSE OWNERS GROUP (WOG) PEER REVIEW PROCESS Page 1 of 17 Impact on RI IS1 No Impact.

This F&O has been resolved and incorporated into the Prairie Island PRA model used to perform RI-IS1 consequence analysis.

No Impact.

This F&O has been resolved and incorporated into the Prairie Island PRA model used to perform Level of Significance B

A Observation Several items were identified relative to initiating event identification and grouping.

(I) The basis for excluding from the model challenges to the PORVs post reactor trip is not adequately explained. This affects the initiating event grouping for Events 2, 8, 10, 16, 18,

19. Additionally, the model does not appear to directly consider the consequences of a stuck open PORV (no actual transfer to the Small LOCA ET). Though the plant has not actually experienced a PORV opening following a transient, this does not provide a sufficient basis for concluding that PORVs will not open for all initiators in this class. Appendix D writeup (D.12) shows that the PORV-related event frequency contribution is small (4.17E-5) and encompassed by the contributions from other Small LOCAs. However, the new (Rev 2) LOCA frequency for S2 is 6E-5, so Stuck Open PORVs are no longer small contributors to this class.

(2) Random RCP seal failure (i.e., a random failure resulting in RCP seal leakage greater than normal makeup capability) was not included in the IE frequency for small LOCA. Such potential random RCP seal failures have been assessed at frequency in range 1 E-3 to 5E-3 by various sources. This event has been neglected in the IE selection. The updated PI PRA frequency for SI due to other than random RCP seal LOCA is 5E-3. This is comparable to frequency of random RCP seal LOCA, so the event should be considered.

(3) The T2 initiator (without a stuck open PORV) does not appear to be an input into the transient event tree sequences.

The dual-unit LOSP initiator frequency calculation in file V.SMD.96.005 (Recalculation of LOSP Initiator) appears to be in error. The calculation divides LOSP into PLC (plant centered), Weather (WRL) and Grid Loss (GRL) events, which is correct. Prairie Island has had 2 dual unit LOSP events in it's 21 year history (as of 1996 when file was made). In calculating the exposure time, the calc assumes 42 plant years for PI, Item 1

Status & Resolution CLOSED -

The PRA Model Revision 1.2 includes many significant changes to fix problems with the LOCA sizes and inputs into the SLOCA tree. The LOCA sizes have been changed to reflect industry standards. The SLOCA includes breaks from 318 to 2 inches. The MLOCA includes breaks from 2 to 6 inches. The LLOCA includes breaks greater than 6 inches.

For the issue dealing with event of a PORV lifting during a transient and failing to completely reclose, a separate PORV LOCA gate has been added under the SLOCA tree.

The PORV LOCA gate includes the scenario of a PORV lifting during a normal transient and during a steam line break. The normal transient captures all transients that can challenge a PORV.

For the issue dealing with the random RCP seal LOCA, a separate initiating event has been added under the RCP SEAL LOCA event tree, which is transferred to the SLOCA tree. A random seal LOCA initiating frequency was determined by reviewing NUREGICR-5750 data.

The third issue with the T2 initiator comes from the proposed model and documentation (by a contractor). We are not using that information in the updated model. All initiators used in the original model (I-TRI, I-TR2, I-TR3 and I-TR4) are inputs into the transient event tree.

The issues presented in this F&O have been resolved and implemented in the Rev 1.2 model update as described above. (Same assumptions were used in the Rev 2.0 model.)

CLOSED -

The LOSP initiating event frequency was re-calculated accounting for two dual-unit LOSP events over the history of the plant. The LOOP frequency was calculated to be 7.5E-2lyr. This does not include Bayesian updating.

The new calculated LOOP frequency was incorporated into F&O IE-I> sub-element 1E-4, sub-element l3

PRAIRIE ISLAND CLOSED FACTS & OBSERVATIONS (F&O's) FROM THE WESTINGHOUSE OWNERS GROUP (WOG) PEER REVIEW PROCESS Page 2 of 17 Item Level of Significance B

F&O 1E-6, sub-l6 Status & Resolution the Rev 1.2 model. This change will have a significant affect on the CDF. However, with the addition of Off-site Power Recovery in the model and other recommended changes, the contribution that LOOP makes to CDF decreases in the new model. (from 35% to approx. 24%).

The issues presented in this F&O have been resolved and implemented in the Rev 1.2 model update as described above. (Same assumptions used in the Rev 2.0 model.)

CLOSED -

The initiating event data referenced in this F&O was not incorporated into the Rev 1.2 (or Rev 2.0) model.

In the Rev 1.2 model, LOOP frequency was calculated by dividing the number of dual unit events (2 per unit) by the number of commercial operating years. The LOOP frequency was determined to be 7.5E-21yr. This does not include a Bayesian update. This is a conservative approach.

The issues presented in this F&O have been resolved and implemented in the Rev 1.2 model (and Rev 2.0) update as described above.

Observation because it counts unit 1 and unit 2 separately (to be consistent with the generic LOSP data). The resulting Bayesian updated dual-unit LOSP frequency is 0.03 16. But if the units are counted individually, then it must be considered that a dual unit LOSP at unit 2 affects unit 1, as opposed to the way it was calculated, which effectively assumes unit 1 and unit 2 are two different sites. Therefore, the WRL and GRL frequencies must be doubled because a dual unit LOSP at unit 2 affects unit 1.

Alternatively, the PI site could be considered as a single unit and there would be 2 failures in 20 site-years. This would be in conflict the generic data and would require modification of the generic exposure time.

Bayesian update was used for LOSP frequency. The Bayesian update algorithm used is very sensitive to the error factor chosen for the generic data. The mean value for the generic prior distribution for LOSP was 0.01 8 1 with an EF of 1.4. The plant specific data shows that 2 LOSP events have occurred in 25.7 site years (corresponding to a plant-specific point estimate of 0.0788lyr). However, the updated mean calculated using the Bayesian code and these values is.0187 - which hardly moves the prior mean at all. If the EF on the prior were changed to 5, then the updated mean would be.044/yr, apparently more reflective of the plant experience.

The reviewers believe that several calculational mistakes were made in this analysis.

I) the EF of the prior is calculated assuming that a chi-squared distribution represents the generic data, based on 43 events.

This produces a very low EF, since this process ignores the site to site variability.

2) the Bayesian update algorithm used is sensitive to the choice of EF.

3) if the EF on the prior actually was 1.4, then uncertainty bounds of prior and plant specific data would not overlap and it could be said that the prior is not from the same data base as the plant specific.

The latest LOSP report from INEL (NUREGICR-5496) provides a generic mean across the country of.05lyr. The PRA should be able to defend the derivation of a value significantly less than this.

Impact on RI IS1 RI-IS1 consequence analysis.

No Impact.

This F&O has been resolved and incorporated into the Prairie Island PRA model used to perform RI-IS1 consequence analysis.

PRAIRIE ISLAND CLOSED FACTS & OBSERVATIONS (F&07s) FROM THE WESTINGHOUSE OWNERS GROUP (WOG) PEER REVIEW PROCESS Page 3 of 17 Impact on RI IS1 No Impact.

This F&O has been resolved and incorporated into the Prairie Island PRA model used to perform RI-IS1 consequence analysis.

No Impact.

This F&O has been resolved and incorporated into the Prairie Island PRA model used to perform Level of Significance B

B Observation This comment was generated by a review of the failure database being developed for PRA Rev 2.

The reviewers identified several concerns with the data reduction for LOSP. The LOSP frequency as calculated by this work is 0.0181. The LOSP as calculated by INEL in NUREGICR-5496 is 0.05. This discrepancy is large considering the importance of the event to the overall PRA results. In addition:

1) More than 75% of the events in the EPRI database (EPRI-TR-106306) have been screened out as not being applicable.

The reviewers checked the screening assessments for several events. In several cases the screening criteria seemed optimistic and used the clause that "power could have been restored if necessary", or "if this event happened at power, OSP [offsite power] would have been restored. Other times it was stated that an error occurred at shutdown that could not occur at power. The screening of events appears to have been too optimistic about events at shutdown that were assumed to not be possible at power.

2) The data base screens out all but 56 events. However, the LOSP frequency is calculated as 43 events12347 yrs. There is no explanation of the difference between 56 events and 43 events.

3) The basis for the exposure time of 2347 reactor-years is unclear. In the RIF component database the accumulated operating time is listed as 2546 licensed years, 2472 critical years and 2402 comrnerical years. If there have been 2402 commercial years of operation, at an average availability factor of 80%, there should be 1920 full power years of operation, not 2347. The "2347 reactor years" used for the LOSP calculation obviously includes the time spent at shutdown. If all refueling LOSP events are removed from the failure list, then the time spent at shutdown should also be removed from the exposure time.

The reviewers did not find a discussion of dual unit initiators and subsequent station response, although at least one such initiator (dual-unit loss of offsite power) is identified and an associated frequency is included among the initiating events.

After the review, Prairie Island PRA personnel clarified that three potential dual-unit initiating events were identified: Loss of Offsite Power, Loss of Instrument Air, and Loss of Cooling Item Status & Resolution CLOSED -

The initiating event data referenced in this F&O was not incorporated into the Rev 1.2 model or the Rev 2.0 model.

In the Rev 1.2 model, LOOP frequency was calculated by dividing the number of dual unit events (2 per unit) by the number of commercial operating years. The LOOP frequency was determined to be 7.5E-21yr. This does not include a Bayesian update. This is a conservative approach.

The issues presented in this F&O have been resolved and appropriate changes were incorporated into the Rev 1.2 model (and Rev 2.0 model) as described above.

CLOSED -

A two-unit model has been created which captures the dual unit initiators in Rev 2.0 model. The effects and impacts that the dual unit initiators (I-LOOP, I-INSTAIR, I-LOCL) have on Unit 1 and Unit 2 are included in the Two-Unit model. Dependencies and success criteria are factored into the initiating event system fault trees. The dual unit F&O 1E-8, sub-element AS-6, sub-element

PRAIRIE ISLAND CLOSED FACTS & OBSERVATIONS (F&O's) FROM THE WESTINGHOUSE OWNERS GROUP (WOG) PEER REVIEW PROCESS Page4of 17 Level of Significance B

B Observation Water. Of these, only loss of offsite power is modeled as a dual-unit event affecting unit 1 (i.e., an event for which the status of the opposite unit is considered in the accident sequences with respect to availability of opposite unit equipment). The others are not so treated, because their baseline CDF contribution (when considered as single-unit events) is relatively small.

Given the dependence of primary and secondary pressure relief on instrument air, the loss of instrument air event should be discussed, and possibly modeled, independently of other transient events. The primary PORVs or possibly the primarylsecondary safety valves may lift to provide pressure relief in this scenario (loss of IA). This may be a unique enough plant response to warrant special treatment. In addition, challenging these valves results in an increase in the S2 LOCA or steam line break initiating event frequency.

The General Transient event tree (Figure 4.2 in the Accident Sequence notebook) shows that if a consequential PORV LOCA occurs, a transfer is made to the S1 LOCA event tree.

The S I LOCA size range has been defined as 318" to - 1 "

(actually 718"). However, the equivalent flow area for a primary PORV is expected to be larger than this, and should probably be considered in the S2 LOCA category.

Additionally, the transfer for the MSLB scenario is not included in the Rev. 1.1 model.

Item 7

F&O AS-8, element AS-11, sub-Status & Resolution initiator effects on the Unit 112 results can be found by reviewing the PRA Quantification notebooks.

CLOSED -

During the Revision 1.2 PRA model update, an initiating event fault tree was created for the Loss of Instrument Air.

The new initiating event fault tree provides a more accurate calculation of the risk involved with removing air compressors from service. In addition, a review of past LOIA events at PI was performed. The sequence of events involved with a LOIA showed a slow decrease in air pressure such that a reactor trip occurred without challenging the pressurizer PORVs (LER 96-02-00) or the operators had enough time to prevent a reactor trip (February 1996 event). These two events were initiated by a failure of the air dryer exhaust purge valve to close following a dryer operation. This line has been modified per design change 96SAO 1, which installed an automatic isolation valve in the exhaust lines of 121 and 122 air dryer. Based on the above discussion and the fact that there is a low contribution of the LOIA to overall CDF results - this issue can be considered closed.

In addition, during the Revision 1.2 model update, credit was given for the pressurizer PORV air accumulator and therefore the dependence of primary pressure relief on instrument air has decreased.

CLOSED -

The PRA Model Revision 1.2 was changed significantly to fix problems with the LOCA sizes and inputs into the SLOCA tree. The LOCA sizes have been changed to reflect industry standards. The SLOCA includes breaks from 318 to 2 inches. The MLOCA includes breaks from 2 to 6 inches. The LLOCA includes breaks greater than 6 inches.

For the issue dealing with event of a PORV lifting during a transient and failing to completely reclose, a separate PORV LOCA gate has been added under the SLOCA tree.

Impact on RI IS1 RI-IS1 consequence analysis.

No Impact.

This F&O has been resolved and incorporated into the Prairie Island PRA model used to perform RI-IS1 consequence analysis.

No Impact.

This F&O has been resolved and incorporated into the Prairie Island PRA model used to perform RI-IS1 consequence analysis.

PRAIRIE ISLAND CLOSED FACTS & OBSERVATIONS (F&O's) FROM THE WESTINGHOUSE OWNERS GROUP (WOG) PEER REVIEW PROCESS Page 5 of 17 Item 8

9 10 Observation Consequential steam generator tube rupture (i.e., SGTR resulting from a transient that causes a large pressure differential across the steam generator tubes, such as steamline rupture or inadvertently opened and stuck secondary side relief or safety valve) is not modeled in the accident sequences.

The possibility of this consequential event should be addressed in the PRA.

The success criteria for AF are incomplete for Steam Line Break Events. Specifically, they do not include the requirement to isolate flow to the faulted SG.

These observations relate to the Revision 2. Event Tree Notebook provided in the peer review package.

Documentation detail is limited in some areas, and should be expanded. Actually, some of these details already exist in the previous layer of notebooks; it would be useful to capture this F&O AS-12, sub-element AS-14, sub-element l7 AS-15, sub-element 3 Level of Significance B

B C (items 1-5 )

B (items 6-

12)

Status & Resolution The PORV LOCA gate includes the scenario of a PORV lifting during a normal transient and during a steam line break. The normal transient captures all transients that can challenge a PORV.

The issues presented in this F&O have been resolved and implemented in the Rev 1.2 model update as described above. (The same modeling was used in the Rev 2.0 model.)

CLOSED -

The steam generators at Prairie Island are designed such that the tubes can withstand full system dp across the tubes from the primary or secondary sides without sustaining any consequential tube ruptures. Because of this, the consequential tube rupture event following a primary or secondary depressurization was not modeled.

CLOSED -

Changes have been incorporated into the Rev 1.2 model to account for the issue stated in this F&O. The initiating event for a Steam Line Break Upstream of the MSIV has been added under the gate for the respective steam generator. In addition, the initiating event for a Steam Line Break Downstream of the MSIV and the failure of the respective SG MSIV to close has been added under both steam generator gates. Therefore, the steam generator that has a steam line break upstream of the MSIV OR has a MSIV that fails to close on a steam line break downstream of the MSIV will be failed. The AFW flow will be isolated to the faulted SG.

The issues presented in this F&O have been resolved and implemented in the Rev 1.2 model update as described above. (The same modeling was used in the Rev 2.0 model.)

CLOSED -

Although this finding is related to documentation that was not incorporated into the current PRA model, the event tree notebook documentation was updated. More details are provided in the event tree notebooks on initiating event Impact on RI IS1 No Impact.

This F&O has been resolved for the Prairie Island PRA model used to perform RI-IS1 consequence analysis.

No Impact.

This F&O has been resolved and incorporated into the Prairie Island PRA model used to perform RI-IS1 consequence analysis.

No impact.

This F&O has been resolved and incorporated into the

PRAIRIE ISLAND CLOSED FACTS & OBSERVATIONS (F&O's) FROM THE WESTINGHOUSE OWNERS GROUP (WOG) PEER REVIEW PROCESS Page6of 17 Level of Significance Status & Resolution groupings, accident sequence progression, event tree structure, event tree headings, and event tree accident sequence analysis.

Impact on RI IS1 Prairie Island PRA model used to perform RI-IS1 consequence analysis.

Observation information in one ET notebook to assure completeness and consistency is obtained and maintained for the future updates.

Specific observations noted are as follows (some references are specifically to the SGTR event tree discussion, but may also be applicable to other initiating events):

1.

Event progress is not described in detail (ESDs do not have much more information content than ETs; they do not make up for the lack of detailed description of the event, nodes, operator actions, EOPs involved, etc.).

2.

Top event descriptions are not detailed (SG isolation appears to be consisting of MSIV closure only. What about operator actions, termination of AFW flow in to the faulted SG etc).

3.

Top events with operator actions are not clearly delineated and the dependence among top events is not indicated.

4.

References to EOPs are not complete (in which EOP(s) and by what means does the operator identify and isolate a faulted SG?)

5.

There should be a one-to-one correspondence between the items listed in section 4.10 and Appendix D. A summary table may do it.

6.

Why is there no SGTR-W branching when SGTR-ST1 fails in the SGTR event tree (there is one in the ESD) ?

7.

Give guidance on what happens to sequences that branch into other ETs and end successfully there: for example SGTR has a transfer into ATWS and is successful; is it a success, or simply truncated because it is low frequency?

What is the criteria for terminating event tree to event tree looping?

8.

MS-FLB events need to be discussed; they have an additional event tree node of "failure to isolate faulted SG", which makes the event tree different from the transient ET. SBO event tree needs to be discussed.

9.

Where are the "qualitatively assessed" items in ESDs?

10.

What is the process that transfers the system success criteria and operator action definition/success/dependence information from Section 4 and Appendix D to the system analysts and HRA analysts? A couple of summary tables may be used to organize the "work orders" generated for item F&O

PRAIRIE ISLAND CLOSED FACTS & OBSERVATIONS (F&O's) FROM THE WESTINGHOUSE OWNERS GROUP (WOG) PEER REVIEW PROCESS Page 7 of 17 Impact on RI IS1 No Impact.

This F&O has been resolved and incorporated into the Prairie Island PRA model used to perform RI-IS1 consequence analysis.

No Impact.

This F&O has been resolved and incorporated into the Prairie Island PRA model used to perform Level of Significance A

A Observation the system and HRA analysts.

1 1.

What about stuck open pressurizer PORV after a LOSP event? (maybe after a loss of MFW event also?!)

Generic T&H analyses show that the PORVs are challenged after a LOSP event.

12. What happens to the events with RCS break flows that are less than makeup capacity; how long does the CVCS have to run; what happens if CVCS fails; What is the underlying assumption in not modeling them with an event tree (small frequency?) ?

Two steam generator tube rupture modeling items were noted:

The dependency between having a faulted SG following a SGTR with overfill and a stuck open relief valve and the top gates for depressurization and AF are not considered in the SGTR development. The AF top logic credits feed to both SGs.

Though acceptable for most cases, if there is a stuck open relief valve on the ruptured generators, operators are directed to isolate that generator (including AF). This reduces the ability to depressurize with the 1 SG and AF to the faulted generator being isolated.

In SGTR, the AFW success criteria require AFW to 1 of 2 SG.

Feeding of the ruptured SG is allowed (as directed by the EOP's). The success path at function AFW therefore allows feeding of the bad SG. Subsequent event tree headings ask for isolation of the ruptured generator. The fault tree development only asks about closing of the MSIV on the ruptured generator.

In reality, if the good generator could not be fed, the ruptured generator could not be isolated. If the bad generator is being fed, the sequence needs to transfer on the failure path at "isolation" and go into ECA3.113.2. The fault bee logic for "isolation" needs to include logic that "failure" to isolate the ruptured generator can be caused by failure of the good generator to be fed. If the ruptured generator is being fed, it will not be isolated.

Two items were noted regarding derivation of success criteria for accumulators using MAAP 3b calculations.

A MAAP calculation was used to determine that accumulators are only necessary for design-basis LOCAs. The MAAP PWR Application Guidelines specifically state that MAAP is not an appropriate code for use in analyzing rapid-depressurization events such as larger LOCAs.

Item 11 l2 Status & Resolution CLOSED -

The updated model (Rev 1.2) has been modified to address this issue. The initiating event for Steam Generator Tube Rupture has been added under the respective steam generator gate and SG PORV gate. Therefore, the fault tree logic was modified as to fail the ability to feed and depressurize the ruptured SG.

The issues presented in this F&O have been resolved and implemented in the Rev 1.2 model update as described above. (The same modeling was used in the Rev 2.0 model.)

CLOSED -

The PRA Model Revision 1.2 was changed significantly to fix problems with the LOCA sizes and inputs into the SLOCA tree. The LOCA sizes have been changed to reflect industry standards. The SLOCA includes breaks from 318 to 2 inches. The MLOCA includes breaks from 2 to 6 inches. The LLOCA includes breaks greater than 6 F&O AS-18, sub-element 10 TH-lt sub-element

PRAIRIE ISLAND CLOSED FACTS & OBSERVATIONS (F&O's) FROM THE WESTINGHOUSE OWNERS GROUP (WOG) PEER REVIEW PROCESS Page 8 of I f Level of Significance B

B Observation No basis was found for not including accumulators in Small LOCA event trees in cases when high pressure injection fails. A MAAP calculation without accumulators was available, but this case showed core damage.

The timing for switchover to recirculation in an analysis proposed for PRA Rev. 2 seems very conservative. First, it is assumed that containment spray initiates even for small LOCAs, thereby reducing the time to drain the RWST. Second, a calculation assuming low pressure injection is used for the timing of both high-and low-pressure recirculation. If high pressure recirculation is needed, RCS pressure must be above the shutoff head of the RHR pumps so that no low pressure injection flow has occurred, greatly increasing the time before reciruclation is required. This could be important because the lineup for high pressure recirculation is the only local critical step in the recirculation procedure. This local step is the reason that timing is so critical.

The LOCA break size definitions for the PINGP PRA are based on different criteria than those for most other PRAs. This would be acceptable if the underlying analyses provided sufficient basis for the definitions, but it appeared that the available analyses do not adequately support the selected definitions.

The following is a comparison of the definitions and their bases, with focus on the injection phase, as discerned from the Event Tree Success Criteria notebook:

PINGP PRA S 1 (Small LOCA category 1) = breaks that are too large to be accommodated by the normal charging system and too small to provide adequate decay heat removal through the Item 13 l4 F&O TH-4, subelement 4

TH-99 sub-element Status & Resolution inches.

In addition to this change, the accumulator is required in the success criteria of the LLOCA injection phase (111 accumulator and 112 RHR pump). One accumulator is failed due to a break in the RCS cold leg.

The SLOCA and MLOCA event trees were changed to require accumulator injection with the RHR pump injection (111 accumulator and 112 RHR pump). One accumulator is failed due to a break in the RCS cold leg.

The issues presented in this F&O have been resolved and implemented in the Rev 1.2 model update as described above. Same assumptions were used in the Rev 2.0 model.

CLOSED -

This F&O relates to an analysis performed by a contractor.

This was a proposed analysis that is not used in the current model and will not be used in the updated model (Rev. 1.2 or Rev 2.0). The current timing for switchover that is used for the new SLOCA size was calculated using a plant-specific MAAP run. This run indicates that containment spray does not actuate for a small LOCA.

CLOSED -

Because of the many questions related to this issue, Prairie Island has changed the LOCA sizes in the Rev 1.2 model to the standardized definition of LOCA breaks. The new break sizes are SLOCA (318 - 2 inches), MLOCA (2-6 inches) and LLOCA (> 6 inches).

MAAP runs were reviewed to support the success criteria for the new break sizes. In addition, the new LLOCA modeling requires accumulator injection during short-term injection, which is included in the typical plant PRA LLOCA.

Impact on RI IS1 RI-IS1 consequence analysis.

No Impact.

This F&O has been resolved and incorporated into the Prairie Island PRA model used to perform RI-IS1 consequence analysis.

No Impact.

This F&O has been resolved and incorporated into the Prairie Island PRA model used to perform RI-IS1 consequence analysis.

PRAIRIE ISLAND CLOSED FACTS & OBSERVATIONS (F&09s) FROM THE WESTINGHOUSE OWNERS GROUP (WOG) PEER REVIEW PROCESS Page 9 of 17 Level of Significance Observation break; range defined as 318" to - 1" diameter breaks.

PINGP PRA S2 (Small LOCA category 2) = breaks that do not depressurize to within the low head injection system capability but are within the capability of the high head injection system, and that are sufficiently large to provide decay heat removal via the break; range defined as - 1" to 5" diameter breaks.

TYPICAL PRA Small LOCA = breaks that are too large to be accommodated by the normal charging system and too small to depressurize to the high head injection setpoint sufficiently rapidly to avoid the need for decay heat removal; typically 318" to 2" diameter breaks.

PINGP Medium LOCA = breaks that are sufficiently large to depressurize to the shutoff head of the RHR pumps but small enough to be within the capability of the high head injection system, with decay heat removal via the break; range defined as 5" to 12" diameter breaks.

TYPICAL Medium LOCA = breaks that are sufficiently large to depressurize to the high head injection setpoint but for which pressure remains above the RHR pump shutoff head, with decay heat removal via the break; typically 2" to 6" diameter breaks.

PINGP Large LOCA = breaks beyond the capability of the high head injection system but which do not require accumulator injection, with decay heat removal via the break and shutdown reactivity insertion via borated injection; range defined as 12" and greater but less than the design basis LOCA break size.

PINGP DBA Large LOCA = break size for which accumulator injection is required in addition to low head injection; range defined as the design basis break size.

TYPICAL Large LOCA = breaks that are sufficiently large to depressurize to the RHR pump shutoff head, with decay heat removal via the break and shutdown reactivity insertion via borated injection; typically > 6" diameter breaks.

Among the implications of the above are the following:

The PINGP PRA S1 SLOCA plant response and modeling should be similar to the SLOCA response and modeling for typical plant PRAs.

The PINGP PRA S2 SLOCA plant response and modeling should be similar to the MLOCA response and modeling for typical plant PRAs.

Item F&O Status & Resolution The initiating frequencies for the new LOCA sizes were calculated from NUREGICR-5750.

The issues presented in this F&O have been resolved and implemented in the Rev 1.2 model update as described above. Same assumptions were used in the Rev 2.0 model.

Impact on RI IS1

PRAIRIE ISLAND CLOSED FACTS & OBSERVATIONS (F&O's) FROM THE WESTINGHOUSE OWNERS GROUP (WOG) PEER REVIEW PROCESS Page 10 of 17 Impact on RI IS1 No Impact.

This F&O has been resolved for the Prairie Island PRA model used to perform RI-IS1 consequence analysis.

No Impact.

This F&O has been resolved for the Prairie Island PRA model used to perform RI-IS1 consequence analysis.

Level of Significance B

B Observation The PINGP PRA MLOCA assumes that a single train of high head injection can mitigate what is equivalent to the low end of the large LOCA size range for typical plants, for which high head injection is normally not credited.

The PINGP PRA LLOCA (non-DBA) plant response and modeling differs from the LLOCA response and modeling for typical plant PRAs in that it does not include a requirement for accumulator injection; the LLOCA DBA plant response and modeling is equivalent to that for typical PRAs.

The Success Criteria notebook provides some perspective on the rationale for what was done. However, the guidance reviewed does not explicitly state the approach to be used for determining the need for and types of thermal/hydraulic calculations necessary to support the PRA success criteria.

Several instances have been noted (in other F&Os) for which detailed analyses have been required, and the MAAP code was used without sufficient justification or check for applicability.

As described in the Safeguards Ventilation System Notebook, room cooling requirements have been addressed for the equipment modeled in the PRA. This notebook presents a discussion, with references to engineering calcs, regarding the need for cooling for each such room. However, in some cases, it is not clear that the rationale provided for not modeling room cooling is sufficient. For example, for the Relay Room, it is stated that analyses have shown that it is necessary to maintain the temperature below 120 deg F, but that room heatup analysis showed that the temperature would reach 120 deg F at 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br />.

Then the statement is made that "This provides sufficient time for the operator to perform the corrective actions per C37.9 AOP2." While there may indeed be sufficient time to perform corrective actions, there is no guarantee that the actions will be performed. Since the temperature exceeds the allowable Item 15 16 Status & Resolution CLOSED -

Although not explicitly stated in the calculation folders, there was a methodology for determining when a MAAP case should be used in determining success criteria. Some of the criteria used in this determination include:

1)

If timings were needed for important operator actions.

2)

The amount of time it took to draindown tanks (i.e.

RWST)

3)

To relax the USAR success criteria for certain accidents.

Although no guidance is written down on when to apply the MAAP code, the use of the MAAP code to support the current model, does not present a questionable analysis or inaccurate results. The results and conclusions from the current model are not significantly affected by this finding.

CLOSED -

As part of the system notebook upgrade project, the Safeguards Ventilation Notebook has been revised to address issues related to crediting operator actions to restore room cooling for the Control Room, Relay Room and Battery Room. A sensitivity study was performed for each room to determine the significant of modeling room cooling for the specified rooms. The analysis showed that modeling the room cooling contributes very little to the overall CDF value and was of low safety significance. The documentation is more clear and complete.

F&O TH-13, sub-element TH-16, sub-element

PRAIRIE ISLAND CLOSED FACTS & OBSERVATIONS (F&09s) FROM THE WESTINGHOUSE OWNERS GROUP (WOG) PEER REVIEW PROCESS Page 11 of 17 Level of Significance B

B B

Observation equipment temperature well within the PRA mission time, there is a dependency on room cooling for this room that should either be modeled or more carefully analyzed.

The fault tree model, for large, medium, and some small S2 LOCAs, credits ECCS flow to the faulted loop. Unless thermal-hydraulic analyses exist to provide a basis for this, it would be expected that the injection path associated with the faulted loop is unavailable, and only the remaining path would be available for success. The success criterion should be 1 of 2 pumps to the single intact RCS loop.

The corrective maintenance unavailability basic event for the 120VAC IP Inverters is modeled incorrectly in the Fault Tree.

As modeled, with an inverter out of service, the fault tree still allows power to be supplied from the alternate AC source through the inverter to the instrument panel. The same comment may also apply to other inverter (and output breaker) failure models in the PRA.

As described in the Safeguards Ventilation System Notebook, mom cooling requirements have been addressed for the equipment modeled in the PRA. This notebook presents a discussion, with references to engineering calcs, regarding the need for cooling for each such room. However, in some cases, it is not clear that the rationale provided for not modeling room cooling is sufficient.

For example, for the Relay Room, it is stated that analyses have Item 17 l9 F&O TH-17, sub-element SY-2, sub-element SY-7, sub-element Status & Resolution CLOSED -

The Rev 1.2 model includes the necessary logic to remove the faulted loop as a possible flow path during LOCAs.

Loop specific LOCA initiating events have been added to the model, which will fail the appropriate RCS injection loop. This results in success criteria of 1 out of 2 pumps to the single intact RCS loop. In addition, the accumulator on the faulted loop is also failed in the logic and is not available for injection.

The issues presented in this F&O have been resolved and implemented in the Rev 1.2 model update as described above. (Same assumptions were used in the Rev 2.0 model.)

CLOSED -

For the Rev 1.2 model, the 120V AC Instrument Power fault tree was changed so that the CM event was moved higher in the tree so that if it fails all power supplies that feed the bus through the inverter. This change was performed for the following:

1 1 (2 1) Inverter 12 (22) Inverter 13 (23) Inverter 14 (24) Inverter 17 (27) Inverter 18 (28) Inverter The issues presented in this F&O have been resolved and implemented in the Rev 1.2 model update as described above. Same assumptions were used in the Rev 2.0 model.

CLOSED -

AS part of the system notebook upgrade project, the Safeguards Ventilation Notebook has been revised to address issues related to crediting operator actions to restore room cooling for the Control Room, Relay Room and Battery Room. A sensitivity study was performed for each room to determine the significant of modeling room cooling for the specified rooms. The analysis showed that Impact on RI IS1 No Impact.

This F&O has been resolved and incorporated into the Prairie Island PRA model used to perform RI-IS1 consequence analysis.

No Impact.

This F&O has been resolved and incorporated into the Prairie Island PRA model used to perform RI-IS1 consequence analysis.

No Impact.

This F&O has been resolved for the Prairie Island PRA model used to perform RI-IS1 consequence analysis.

PRAIRIE ISLAND CLOSED FACTS & OBSERVATIONS (F&O's) FROM THE WESTINGHOUSE OWNERS GROUP (WOG) PEER REVIEW PROCESS Page 12 of 17 Impact on RI IS1 No Impact.

This F&O has been resolved and incorporated into the Prairie Island PRA model used to perform RI-IS1 consequence analysis.

Level of Significance B

Observation shown that it is necessary to maintain the temperature below 120 deg F, but that room heatup analysis showed that the temperature would reach 120 deg F at l l hours. Then the statement is made that "This provides sufficient time for the operator to perform the corrective actions per C37.9 AOP2."

While there may indeed be sufficient time to perform corrective actions, there is no guarantee that the actions will be performed.

Since the temperature exceeds the allowable equipment temperature well within the PRA mission time, there is a dependency on room cooling for this room that should either be modeled or more carefully analyzed.

As another example, for the rooms housing 120VAC Instrument Power equipment, there is no discussion of ventilation requirements in the notebook. The equipment survivability discussion notes that room cooling is required, and that 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> are available following loss of ventilation to re-establish ventilation. However, actions to open doors or re-establish cooling are not modeled in the fault tree.

One editorial problem also pertains to the ventilation modeling.

Assumption 5 in the SI system notebook states that room cooling is not required for SI in injection mode, but the assumption does not address recirculation mode. The room heatup calculation actually assumed sump recirculation mode, and that should be noted in the notebook.

The PORV Fault Tree for Feed & Bleed is applied in sequences involving initiators that would cause containment isolation on an S signal. The fault tree takes no credit for the PORV accumulators to allow the PORVs to be used after isolation of the air supply, and also takes no credit for operator action to re-establish air to the containment. As a result, the model assumes failure of both PORVs when air is isolated to containment.

As a result of the assumption that the PORV accumulators are not sufficient for Feed and Bleed in scenarios involving an S signal, the model appears to be overly pessimistic regarding credit for feed & bleed. FR.H. I Step 1 1 provides direction to the operators to re-establish air to containment, so consideration should be given to modeling this action, along with associated valve failure probabilities.

Item 20 Status & Resolution modeling the room cooling contributes very little to the overall CDF value and was of low safety significance. The documentation is more clear and complete. As far as the SI pump room issue, the SI System Notebook was also updated and the assumptions on room cooling are more detailed and clear. Room cooling is not required for the SI pump room during injection or recirculation phase per Safety Evaluation 375.

CLOSED -

The PORV accumulator has been added to the model. This will provide a source of air to the PORVs for Feed and Bleed operation when air is isolated to containment. The Rev 1.2 model will take credit for the pressurizer PORV accumulator if instrument air is not available. This is based on the following:

A) Procedures instruct the operators that the accumulators are available for operating the PORV if instrument air is not available.

B) Operators are trained in the use of these procedures.

C) The model will conservatively assume a high failure probability for the accumulator (approximately 0.5)

The issues presented in this F&O have been resolved and implemented in the Rev 1.2 model update as described above. The same assumptions were used in the Rev 2.0 model.

F&O SY-17, sub-l3

PRAIRIE ISLAND CLOSED FACTS & OBSERVATIONS (F&O's) FROM THE WESTINGHOUSE OWNERS GROUP F O G ) PEER REVIEW PROCESS Page 13 of 17 Impact on R I IS1 No Impact.

This F&O has been resolved and incorporated into the Prairie Island PRA model used to perform RI-IS1 consequence analysis.

No Impact.

This F&O has been resolved for the Prairie Island PRA model used to perform RI-IS1 consequence analysis.

No Impact.

This F&O has been resolved for the Prairie Island PRA model used to perform RI-IS1 consequence analysis.

Level of Significance B

B B

Observation The operating hours for the D5 and D6 diesels were not calculated correctly. In file V.SMD.95.007, the exposure time for the planned maintenance (PM) and corrective maintenance (CM) unvailablilites is stated as 175,344 hours0.00398 days <br />0.0956 hours <br />5.687831e-4 weeks <br />1.30892e-4 months <br />. This is the same exposure time as for D1D2, and appears to be the full 1 1 years of operation in the database. D5 and D6 were not installed until 1993. The exposure time the CM and PM for D5 and D6 should be about 24,000 hr. This increases the PM and CM unavailabilities by a factor of 4.

(The exposure time for fail to start and fail to run is calculated correctly.)

Notebook V.SMN.92.028 states that 4kv breakers are included in the fault tree models but are not common caused together because the the components supplied by the breakers already include any breaker common cause failures that have occurred.

The component boundaries for all components fed by these breakers (pumps, buses) should be consistent so that breaker failure rates and CCF rates can be consistently applied.

There are also no CCF events for bus feeder breakers.

Most PRAs treat 4kv breakers separately from served components, and include separate CCF events for the important sets of breakers.

In Rev 1, when the plant specific data was 0 failures in T exposure time, the failure rate was calculated by assuming 0.5 failures in T exposure time. This is mathematically equivalent to using a Bayesian update with a Jeffrey's prior. There is no way of knowing if this estimate is reasonable or not. A more technically sound approach is to use a generic prior for Bayesian update. In Rev2, the data development has changed to use 0.3 failures in the exposure time. There is no basis for this practice, expecially when the Rev 2 data makes significant use of Bayesian process.

Item 21 22 23 Status & Resolution CLOSED -

For the Rev 1.2 model the exposure times for DS/D6 were re-evaluated and new unavailabilities were re-calculated based on the new values. The exposure time for the PM and CM for D5D6 was 2 1864 hours0.0216 days <br />0.518 hours <br />0.00308 weeks <br />7.09252e-4 months <br />.

The issues presented in this F&O have been resolved and implemented in the Rev 1.2 model update as described above. (The same data was used in the Rev 2.0 model.)

CLOSED -

The NRC issued this same question during the initial review of the IPE. A specific Request For Information question was issued by the NRC related to the omission of the CCF modeling of circuit breakers and electrical switchgear. The PI PRA group response follows:

"Common cause failures of circuit breakers and switchgear were not explicitly modeled, but common cause failures of loads supplied through the breakers, such as pumps, valves and other components that can be attributable to common cause mechanisms were modeled. This implicitly captures circuit breaker common cause failures that are associated with these components. As with circuit breakers, common switchgear (in terms of function and the effects of failures) are implicitly analyzed with other failures, such as emergency diesel generator common cause failures."

The NRC approved the IPE, including this modeling assumption.

CLOSED -

The approach using 0.3 failures in the exposure time was not incorporated into the Rev 1.2 or Rev 2.0 models.

If Bayesian updating process is used in future model revisions, the recommendations from this F&O will be incorporated.

F&O DA-39 sub-element DA-87 sub-element lo DA-I O, Sub-element l7

PRAIRIE ISLAND CLOSED FACTS & OBSERVATIONS (F&O9s) FROM THE WESTINGHOUSE OWNERS GROUP (WOG) PEER REVIEW PROCESS Page 14 of 17 Level of Significance B

B A

Observation The number of plant specific failures for CVCS pumps in Rev 2.0 seems high - about 60-80. There is no reason to use Bayesian update techniques when there are such a large number of plant specific failures. In fact, since the plant specific failure rate is relatively high compared to generic sources, it could likely be shown that the PI CVCS pumps are not in the same population as generic pumps and a Bayesian update process should not be used.

The HRA documentation indicates that operator interviews were conducted when determining the execution time of procedure steps, but the values used appear to be generic.

Further, a "generic" value of 45 minutes is identified as the shortest time to core damage for any accident. This value is then used in the screening analysis for several operator actions where the time to core damage is being estimated. There doesn't appear to be a basis for the 45 minute value.

Furthermore, it not clear that this value is applicable to the actions modeled.

Two of the ten most important operator actions, ABUS27RESY and N12 1 DRYXXY (sorted by FV), are quantified using screening values. This is contrary to the PINGP PRA groundrules and industry guidance.

Item 24 25 26 F&O DA-l I, sub-element HR-6, sub-element lo HR-7, sub-element Status & Resolution CLOSED -

The CVCS data in question was not incorporated into the Rev 1.2 model or the Rev 2.0 model.

The current failure rates for the CVCS pumps are based on plant specific data without a Bayesian update.

If a Bayesian Process will be used to update the data information, the recommendations from this F&O will be considered.

CLOSED -

The HEP that were determined by this method have been re-calculated. A new HEP screening criteria was used.

The majority of the HEPs increase using this value resulting in a more conservative approach. This F&O can be considered closed out. The new values have been incorporated into the Rev 1.2 model and the Rev 2.0 model.

CLOSED -

ABUS27RESY was removed from the model, as this is an action that would not be performed during accident conditions. A recent plant modification was added to the instrument air system fault tree which caused the importance of operator action N 12 1DRYXXY to decrease such that its Fussel-Vesely is -lE-04 which is well below the NMC criteria for use of detailed human error modeling.

These modifications were incorporated into rev 1.2 of the model. Following these modifications and others, a new screening was performed which identified two new operator actions that were above the screening criteria and were quantified with screening values. An ASEP analysis was performed on both of these events so that now there are not any important operator actions that were quantified with screening values.

The issues presented in this F&O have been resolved and implemented in the Rev 1.2 model update as described above. (Same assumptions were used in the Rev 2.0 model.)

Impact on RI IS1 No Impact.

This F&O has been resolved for the Prairie Island PRA model used to perform RI-IS1 consequence analysis.

No Impact.

This F&O has been resolved and incorporated into the Prairie Island PRA model used to perform RI-IS1 consequence analysis.

No Impact.

This F&O has been resolved and incorporated into the Prairie Island PRA model used to perform RI-IS1 consequence analysis.

PRAIRIE ISLAND CLOSED FACTS & OBSERVATIONS (F&O's) FROM THE WESTINGHOUSE OWNERS GROUP (WOG) PEER REVIEW PROCESS Page 150f 17 Item 27 28 29 Observation Based on the operator action sensitivity study performed, there are several scenarios involving multiple human error events.

Some of the dependencies appear to have been recognized, but it was not intuitively obvious how they were factored into the quantification of conditional HEPs (e.g., FDBLDOPATY).

Several scenarios involve more than 4 HEPs, and this raises a question regarding how the operator actions are being placed within the model. The product of some of these multiple HEP scenarios result in total crew failure probabilities less than 1E-06, which appears to be optimistic.

The local actions in the switchover to containment sump recirculation are modeled as 4 actions that are easy to recall. In actuality there are 13 distinct actions and only 4 are given as critical. No justification is given for the non-critical steps. Even accepting that the other 9 actions are not critical, they would certainly affect the operator's ability to remember the steps. In general there doesn't appear to be any evidence for the non-criticality of tasks or that the added complexity they introduce has been considered.

This F&O relates to both guidance and documentation sub-elements of QU.

A quantification notebook describing the following items needs to be created:

how the one-top CDF model is constructed (guidance);

how any technical adjustments are made to the top of the FT or in the systems below (beyond what is documented in the system and event tree notebooks) to allow F&O HR-11, sub-element 27 HR-15, sub-l7 QU-l3 sub-Level of Significance A

B B

Status & Resolution CLOSED -

A new rev 1.2 model has been created that has incorporated many of the peer review team comments.

Among them is the explicit modeling within the one top fault tree of the dependant operator actions. The model was solved by setting all of the operator actions to 1.O. The top 100 accident sequences, which contributed over 95% of the core damage, were analyzed for dependant actions. The HEPs in these sequences were ordered as to when they would be performed in time and new conditional HEPs were calculated using NUREGICR-1278. The new conditional HEPs were then modeled in the one top fault tree and the mutually exclusive file was used to remove any illogical cutsets.

The issues presented in this F&O have been resolved and implemented in the Rev 1.2 model update as described above. (The same assumptions were used in the Rev 2.0 model.)

CLOSED -

The three operator actions in question (HRECIRCSMY, HRECIRCXXY and RECIRCXXY) which all involve switchover to recirculation were revised to incorporate the fact that the local operator must perform all local actions up to the point in which the critical actions required for success are performed. The local operator now has a procedure to perform these actions such that they do not need to be performed from memory. The revised HEPs were incorporated in the updated rev 1.2 model.

The issues presented in this F&O have been resolved and implemented in the Rev 1.2 model update as described above. (Same values were used in the Rev 2.0 model.)

CLOSED -

A Quantification Notebook was created detailing the Rev 1.2 and Rev 2.0 PRA model results. The notebook contains sufficient guidance for performing the process and sufficient detail to document the inputs and outputs of the process.

The issues presented in this F&O have been resolved and implemented in the Rev 1.2 model (and Rev 2.0 model) update as described above.

Impact on RI IS1 No Impact.

This F&O has been resolved and incorporated into the Prairie Island PRA model used to perform RI-IS1 consequence analysis.

No Impact.

This F&O has been resolved and incorporated into the Prairie Island PRA model used to perform RI-IS1 consequence analysis.

No Impact.

This F&O has been resolved and incorporated into the Prairie Island PRA model used to perform RI-IS1 consequence analysis.

PRAIRIE ISLAND CLOSED FACTS & OBSERVATIONS (F&09s) FROM THE WESTINGHOUSE OWNERS GROUP (WOG) PEER REVIEW PROCESS Page 16 of 17 Item 30 Level of Significance B

B F&O QU-3, sub-element 8 sub-Status & Resolution CLOSED -

For the Rev 1.2 model, recovery of offsite power was credited for the LOOP sequences.

The issues presented in this F&O have been resolved and implemented in the Rev 1.2 model (and rev 2.0 model) update as described above.

CLOSED -

An extensive review of the Rev 1.2 and Rev 2.0 model results (top cutsets, dominant accident sequences, initiating events review, importance measures, model asymmetries, operator actions) has been performed and is documented in the Quantification Notebook.

As with all the PRA calculation folders, a senior PRA person has reviewed the results.

Fleet PRA procedures have also been developed and implemented which address the PRA model maintenance issues.

Observation quantification; any special logic introduced to model sequences (flags, etc.);

supporting files (such as MUTEX, RECOVERY,.BE,.TC, etch summary inputloutput files; results summary files and conclusions (See QU-5 also);

computer run parameters; type of computer and operating system, list and version of executable codes used; limitations of the code; references to supporting model notebooks (ET, system, HRA, data) etc.

Modifications performed in the one-top fault tree, such as creation of the AFW-T fault tree from the full AFW tree, must be documented either in the quantification or system notebooks.

The contribution of LOOP sequences that lead to loss of cooling water and instrument air could be greatly reduced if credit could be given to recovery of offsite power within the calculated time to core uncovery of 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />.

PRA group procedure 3.001 A requires evaluation of PRA results when the model is updated, and documentation in accordance with PRA group procedure 1.002A. The procedure indicates that the evaluation must include a review of top cutsets and basic event importance measures to ensure that dominant contributors to risk are modeled accurately and that dependent operator actions are treated appropriately, with focus on understanding and addressing risk significant issues that have resulted from the latest requantification.

For a full PRA update, consideration should also be given to reviewing more than just dominant contributors and top cutsets, depending on the extent of modeling change. For example, the in-progress Rev 2 model upgrade may produce results that will Impact on RI IS1 No Impact.

This F&O has been resolved and incorporated into the Prairie Island PRA model used to perform RI-IS1 consequence analysis.

No Impact.

This F&O has been resolved for the Prairie Island PRA model used to perform RI-IS1 consequence analysis.

PRAIRIE ISLAND CLOSED FACTS & OBSERVATIONS (F&O's) FROM THE WESTINGHOUSE OWNERS GROUP (WOG) PEER REVIEW PROCESS Page 17 of 17 Impact on RI IS1 risk importance contributors, and overall CDFILERF values.

Status & Resolution Level of Significance Observation require a deeper review than an examination of top cutsets, top Item F&O

PRAIRIE ISLAND OPEN FACTS & OBSERVATIONS (F&O's) FROM THE WESTINGHOUSE OWNERS GROUP (WOG) PEER REVIEW PROCESS Item Page 1 of 4 F&O SY-4, sub-element DA-5, sub-DA-6y sub-Observation The I20 VAC Model does not include failures of the 120 VAC Panel (bus faults). These are normally modeled in most PRAs.

The common cause failure modeling was based on methods and data in NUREGICR-4780.

Although the methods in this document are still valid, the CCF factors (numerical values) are based on plant experience and judgment prior to 1988. NUREGICR-6268 (INEL) is a more current source of common cause data and should be used in the next update. There are several beta factors in the current model that are 0.1 to 0.4 in value. (RHR, Containment Sprays, Fan coolers).

In light of the more recent data in NUREGICR-6268, these beta values are high and should be revised.

Plant specific data used to support PRA Rev. 1 was collected for the IPE in 1988. Generic failure rates were used extensively in the IPE. In 1995, an updated data collection was performed for AFW pumps, DG's, Air compressors, Cooling water pumps, SI pumps, and RHR Level of Significance B

B B

Status & Resolution OPEN -

Due to the low probability of the Instrument Panel fault, this modeling error is not expected to have a significant impact on the results.

A sensitivity analysis was performed to determine the risk significance of including the Instrument Panel fault in the PRA model. Appropriate basic events were added to the 120 VAC panel logic (Panels 11 l(21 I), 112(212),

113(213), and 114(214)).

Results from the Rev 2.0 model showed no increase in CDF or LERF with this modeling change.

The next revision to the model will include failures of the 120 VAC Panel (bus faults).

OPEN -

While it is true that NUREGICR-6268 and it's associated database represent a more current database for the analysis of common cause failures (CCF), until a plant specific analysis has been performed using this database, it cannot be determined that the CCF factors that are used in the Rev 2.0 model are too high. A current version of the CCF database will be utilized to analyze the CCF factors during the continuing update process.

We recognize the need to update the CCF numbers and have a schedule and plan to update the data. However, the data is applicable and can still be used.

A data update project has been started which will address this F&O.

OPEN -

We recognize the need to update the plant specific data and have a schedule and plan to update the data.

However, the "old" data is applicable and can still be used.

Impact on R I IS1 No impact.

A sensitivity analysis was performed to determine the impact of including this failure in the 120 VAC fault tree. The sensitivity study showed that the CCDP and CLERP values associated with small, medium, and large LOCAs did not change from those provided in Prairie Island's RI-IS1 submittal. The results of the sensitivity analysis determined that the resolution of this F&O has no impact on the results or conclusions of the Prairie Island RI-IS1 submittal.

In our opinion, data from NUREGICR-4780 is applicable and can still be used.

It is our intent to update the CCF numbers using a more current database as part of the data update project.

Any changes in the PRA results due to this modeling revision will be evaluated to determine the impact on the RI-IS1 results as part of the "living" aspect of the RI-IS1 program.

It is our intent to update the plant specific data using more current information as part of the data update project.

Any changes in the PRA results due

PRAIRIE ISLAND OPEN FACTS & OBSERVATIONS (F&O's) FROM THE WESTINGHOUSE OWNERS GROUP (WOG) PEER REVIEW PROCESS Page 2 of 4 Impact on RI IS1 to this modeling revision will be evaluated to determine the impact on the RI-IS1 results as part of the "living" aspect of the RI-IS1 program.

The HRA analysis update to meet the new standards has been completed and will be incorporated into the next model update.

Any changes in the PRA results due to this modeling revision will be evaluated to determine the impact on the RI-IS1 results as part of the "living" aspect of the RI-IS1 program.

Status & Resolution A data update project has been started which will address this F&O.

OPEN -

The methodology used to calculate the pre-initiator Human Error Probability (HEP) is adequate. However, the PRA group recognizes the need to use an improved methodology to perform the calculation. The HEP analysis needs to be updated to new standards.

A Human Reliability Analysis (HRA) update to meet the new standards has been completed and will be incorporated into the next model revision.

Level of Significance B

Observation pumps, which were selected on the basis of risk-significance to the PRA results. A larger data development effort is underway for Rev 2, but this still limits the plant specific data period to 1995.

The observed status of the use of plant-specific data, given the above, is the following:

(a) 6 components in the Rev. 1 PRA have failure rates based on plant-specific data through 1995; (b) a limited number of other components in Rev. 1 have failure rates based on plant-specific data through 1988; (c) most of the failure rates in Rev. 1 are generic; (d) after the Rev. 2 update, data will only be current through 1995.

The reviewers believe the PRA relies too heavily on plant data that is not sufficiently current with the as-operated plant.

The equation used to quantify latent errors is not intuitive, and appears to be incorrect.

The equation presented in the HRA notebook suggests that there is a time period in which a component can be considered available after corrective maintenance (CM) but prior to retest (assumed to be 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />). Conversely, the equation implies that no retest is performed following preventive maintenance (PM). This most likely does not reflect maintenance practices. Furthermore, the peer review guidance suggests that latent errors may be screened when a post maintenance test is performed.

The summation of the PM, test (T), and random failure (RF) frequencies does not have any Item 4

F&O HR-4, sub-element 6

PRAIRIE ISLAND OPEN FACTS & OBSERVATIONS (F&09s) FROM THE WESTINGHOUSE OWNERS GROUP F O G ) PEER REVIEW PROCESS Page 3 of 4 Impact on RI IS1 No impact.

In our opinion, documenting and evaluating a cross comparison between similar plants is not expected to have a significant impact on the results or conclusion provided in the Prairie Island RI-IS1 submittal.

Status & Resolution OPEN -

A Quantification Notebook was created detailing the Rev 1.2 PRA model results. The notebook contains a thorough evaluation of the quantification results including review of top cutsets, dominant accident sequences, initiating events, importance measures, model asymmetries, and operator actions.

However, a comparison of our results to similar plants was not performed. As part of the Mitigating System Performance Index (MSPI) project, a WOG Comparison report will be completed on PWRs. The significant systems (Safety Injection, Residual Heat Removal, Auxiliary Feedwater, Component Cooling, Emergency Diesel Generators, and Cooling Water) will be compared.

Results from the Westinghouse MSPI Cross Comparison document related to Prairie Island will be addressed as part of the MSPI Project by December 2005. Once this is completed this F&O will be considered closed.

Level of Significance B

Observation physical meaning, as the terms appear to be mutually exclusive. In addition, for components only exposed to latent error on a refueling outage frequency, the approach mentions that the operators would most likely find a latent error prior to startup. For these cases, a TI value of 4 is assumed which is very similar to the CM cases. However, in practice, at-power surveillance test intervals are being substituted for TI values applied to components exposed to latent error only during refueling (e.g.,

CTRAINAXXZ, CVHCSI IXXZ). Lastly, it seems that the refueling frequency value of 8.55E-05hr is artificially reducing the HEP in these cases.

The Peer Review supplemental guidance (draft subtier criteria) states that, for a category 3 classification for this sub-element, one must fulfill the following:

"The accident sequence results by sequence, sequence types, and total should be reviewed and compared to similar plants to assure reasonableness and to identify any exceptions.

A detailed description of the Top 10 to 100 accident cutsets should be provided because they are important in ensuring that the model results are well understood and that modeling assumption impacts are likewise well known.

Similarly, the dominant accident sequences or functional failure groups should also be discussed. These functional failure groups should be based on a scheme similar to that identified by NEI in NEI 91-04, Appendix B."

A summary of top sequences by initiating event was provided, as was a listing of risk-important systems and operator actions. Detailed descriptions of cutsets were not provided, nor was a comparison of results to similar plants.

Item 5

F&O QU-5, sub-

PRAIRIE ISLAND OPEN FACTS & OBSERVATIONS (F&O's) FROM THE WESTINGHOUSE OWNERS GROUP (WOG) PEER REVIEW PROCESS Page 4 of 4 Item Level of Significance B

F&O QU-6, sub-27 Observation Neither a quantitative uncertainty analysis nor a qualitative evaluation of significant sources of uncertainty are addressed.

Status & Resolution OPEN -

A data update project has been started which will address this F&O.

Impact on RI IS1 No Impact.

In our opinion, the RI-IS1 application is unaffected by the results from an uncertainty analysis since the RI-IS1 program is based on the results from propagating point estimates through the model.