L-PI-09-007, Responses to NRC Requests for Additional Information Dated December 24, 2008 Regarding Application for Renewed Operating Licenses

Responses to NRC Requests for Additional Information Dated December 24, 2008 Regarding Application for Renewed Operating Licenses

ML090260290
Person / Time
Site:	Prairie Island
Issue date:	01/23/2009
From:	Wadley M Northern States Power Co, Xcel Energy
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
L-PI-09-007
Download: ML090260290 (44)

Text

@, Xcel Energyw January 23,2009 L-PI-09-007 10 CFR 54 U S Nuclear Regulatory Commission ATTN: Document Control Desk Washington, DC 20555-0001 Prairie Island Nuclear Generating Plant Units 1 and 2 Dockets 50-282 and 50-306 License Nos. DPR-42 and DPR-60 R ~ S D O ~toSNRC ~ S Requests for Additional lnformation Dated December 24,2008 Reaardina A ~ ~ l i c a t i ofor n Renewed O~eratinaLicenses By letter dated April 11, 2008, Northern States Power Company, a Minnesota Corporation, (NSPM) submitted an Application for Renewed Operating Licenses (LRA) for the Prairie Island Nuclear Generating Plant (PINGP) Units 1 and 2. In a letter dated October 23, 2008, the NRC transmitted Requests for Additional lnformation (RAls) regarding the Severe Accident Management Alternatives analysis provided as part of the Environmental Report included in the LRA. NSPM responded to those RAls in a letter dated November 21,2008. On December 24,2008, the NRC transmitted follow up RAls related to the NSPM responses. This letter provides responses to those follow up RAls. provides the text of each follow up RAI followed by the NSPM response.

Enclosures 2 and 3 provide detailed information about two operator actions discussed in the response to SAMA follow up RAI 5a.

If there are any questions or if additional information is needed, please contact Mr. Eugene Eckholt, License Renewal Project Manager.

Summarv of Commitments This letter contains no new commitments or changes to existing commitments.

I declare under penalty of perjury that the foregoing is true and correct.

Executed on January 23, 2009.

Michael D. Wadley u

Site Vice President, Prairie Island Nuclear Generating Plant Units 1 and 2 Northern States Power Company - Minnesota 1717 Wakonade Drive East Welch, Minnesota 55089-9642 Telephone: 651.388.1121

Document Control Desk Page 2 Enclosures (3) cc:

Administrator, Region Ill, USNRC License Renewal Project Manager, Prairie Island, USNRC Resident Inspector, Prairie Island, USNRC Prairie Island Indian Community ATTN: Phil Mahowald Minnesota Department of Commerce

Enclosure 1 NSPM Responses to NRC Requests for Additional Information Dated December 24,2008 SAMA Follow Up RAI 1e The response (p. 10) noted a probabilistic risk assessment (PRA) maintenance and an updated fact and observation (F&O) had been identified and resolved. Describe the F&O and its resolution. In addition, describe the scope and personnel qualifications of the three reviews identified as being part of the self-assessment process (p. 11).

NSPM Response to SAMA Follow Up RAI l e PRA Proqram Maintenance & Update F&O A description of the PRA Program Maintenance and Update Fact & Observation from the Westinghouse Owners Group Prairie Island PRA Peer Review of September 2000 is provided below with a summary of its resolution.

Description:

A PRA group procedure requires evaluation of PRA results when the model is updated. The procedure indicates that the evaluation must include a review of the top cutsets and basic event importance measures to ensure that dominant contributors to risk are modeled accurately and that dependant operator actions are treated appropriately. The procedure also requires a focus on understanding and addressing risk significant issues that have resulted from the latest requantification.

For a full PRA update, consideration should also be given to reviewing more than just dominant contributors and top cutsets, depending on the extent of the modeling change. For example, any updated model revision may produce results that will require a deeper review than an examination of top cutsets, top risk importance contributors, and overall CDFILERF values.

Resolution:

Two procedures were developed to address the maintenance and update process of the PRA model.

1. A fleet procedure was created in order to provide a PRA guideline for model maintenance and update. The purpose of this guideline is to identify requirements for maintaining and upgrading the PRA model to ensure that its representation of the as-built, as-operated plant is sufficient to support applications for which it is being used.

2. A site procedure was created in order to provide a guideline to perform a PRA model quantification. The purpose of this guideline is to provide instructions on how to structure the Quantification of the PRA model following a periodic or maintenance update of the PRA model. The PRA Quantification is designed to examine the model's result and to confirm that it reflects the design, operation, and maintenance of the plant. The PRA Model Quantification Guideline

Enclosure 1 NSPM Responses to NRC Requests for Additional Information Dated December 24,2008 prescribes reviews on cutsets, recovery actions, mutually exclusive events, circular logic, asymmetries, initiating event distributions, and important operator actions, just to name a few. It was created to meet the High Level requirements for the model Quantification Element as stated in the ASME Standard for PRA.

Self Assessments Descriptions of the scope and personnel qualifications for three self-assessments are provided below:

PRA Program Snapshot Evaluation (April 2007)

Topic:

PlNGP PRA benchmark against Regulatory Guide 1.200, Revision 1, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities.

Scope:

Evaluate the following with respect to impact on conformance with industry standards and expectations:

PlNGP PRA model against selected PRA elements Open PRA Model Review items Potential for MSPl margin improvement Standards:

Regulatory Guide 1.200, Revision 1, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities ASME RA-S-2005, Standard for Probabilistic Risk Assessment for Nuclear Power Applications NEI 00-02, Self-Assessment Process for Addressing ASME PRA Standard RA-SB-2005, as Endorsed by NRC Regulatory Guide 1.ZOO Objectives:

Perform a complete review of selected PRA Technical Elements as defined by Regulatory Guide 1.200, Revision 1 and ASME RA-S-2005 capability category II.

Determine if there are any PRA model issues for the MSPl systems that could improve MSPl margin if corrected or implemented.

Team Resources:

The review team consisted of several members who had extensive knowledge in PRA methods. There were four team members with 18 years or greater experience in PRA. One team member had 9 years of PRA experience and two members had 3 years or less. The total number of years of PRA experience for the team was approximately 90 years. This does not include the number of years of experience in other areas of the nuclear industry.

Enclosure 1 NSPM Responses to NRC Requests for Additional Information Dated December 24,2008 PRA Proaram Focused Self-Assessment (Mav 2004)

Topic:

Assess the PI PRA Program against the Nuclear Management Company (NMC)

Fleet PRA Standard and industry best practices. This was the first self-assessment of the PI PRA program and helped maintain the program health status in the "Assessment" category green.

Scope:

The assessment consisted of a combination of document reviews, interviews, and field observations. Data included, but was not limited to:

Procedure and document reviews Personal observations or interviews CAP and/or other database reviews Compliance with NMC Fleet PRA Standard Industry best practices Standards:

NMC Fleet Probabilistic Risk Assessment Standard PI Procedure for the Program Health Process PI Procedure for the Action Request System Objectives:

Has the facility established and is it implementing and maintaining the PRA program consistent with the requirements of the above listed Standards?

Are the Program related outputs consistent with the related standard (Program Health, Gap Analysis, Program Notebook, spreadsheets, goals, etc.)

Team Resources:

The review team consisted of several members who had extensive knowledge in PRA methods. There were three team members with 14 years or greater experience in PRA. The other team member had 6 years of PRA experience.

The total number of years of PRA experience for the team was approximately 51 years. This does not include the number of years of experience in other areas of the nuclear industry.

Nuclear Oversiqht Observation Re~0r-t(June 2003)

Topic:

PlNGP PRA Risk Assessment Program reviewed against NUMARC 93-01, Industry Guideline for Monitoring the Effectiveness of Maintenance Activities at Nuclear Power Plants.

Enclosure 1 NSPM Responses to NRC Requests for Additional Information Dated December 24,2008 Scope:

The assessment consisted of a combination of document reviews, interviews, and observed performance and review of results. Data included, but was not limited to:

Procedure and document reviews Personal observations or interviews CAP and/or other database reviews Documents Reviewed:

NUMARC 93-01, Industry Guideline for Monitoring the Effectiveness of Maintenance Activities at Nuclear power Plants, Rev 3 , July 2000.

10CFR50.65 NMC Fleet Probabilistic Risk Assessment Standard NMC Fleet Procedure for PRA Guideline for Peer Review F&O Assessment PI Procedure for MR(a)(4) PRA Risk Assessment Preparation PI Procedure for On-Line Scheduling Process PI Procedure for Engineering Support Personnel Training Plan Regulatory Guide 1.182, Assessing and Managing Risk Before Maintenance Activities at Nuclear Power Plants, May 2000.

PI Procedure for the Assessment and Management of Risk Associated with Maintenance Activities NMC PRA Gap Analysis/PRA Improvement Plan (418103)

Objectives:

Perform a review of site procedures related to the assessment and management of risk associated with maintenance activities against NUMARC 93-01 guidance.

Review gap analysis summary for PI PRA Program and compare to NMC Fleet PRA Standard.

Interview and/or observe Work Week Schedulers and Operation personnel on the performance of Maintenance Rule (a)(4) risk assessments.

Team Resources:

The review team consisted of one Nuclear Oversight (NOS) Senior Assessor.

The NOS Senior Assessor had 16 years of nuclear experience. This included 2 years experience in NOS and 14 years experience in the Engineering and Chemistry departments.

SAMA Follow Up RAI I f The Prairie Island Nuclear Generating Plant (PINGP) PRA uses a Westinghouse reactor coolant pump seal loss-of-coolant accident (LOCA) model (WCAP-10541, 1986), that pre-dates the Westinghouse Owners Group (WOG) 2000 model approved by the NRC in 2003 for plants using high-temperature O-rings. The peer review of the PINGP PRA occurred prior to the approval of the WOG 2000 model, and as such would not have

Enclosure 1 NSPM Responses to NRC Requests for Additional Information Dated December 24,2008 identified this as an issue. Provide an assessment of the impact on the severe accident mitigation alternative (SAMA) identification and screening if the PINGP PRA utilized the WOG 2000 model.

NSPM Response to SAMA Follow Up RAI I f All four of Prairie Island's installed RCPs have been upgraded with high temperature O-rings. High temperature O-rings and hard seal parts manufactured by Areva have been evaluated and accepted as interchangeable with the same parts manufactured by Westinghouse. Westinghouse and Areva O-rings and hard seal parts are installed in various combinations in all four of Prairie Island's installed pumps.

However, application of the WOG 2000 seal LOCA model is reserved for Westinghouse-supplied packages with high temperature O-ring seals. In its SER endorsing the WOG 2000 model (WCAP-15603 Rev. 1A), the NRC stated:

WCAP-15603, Revision 1, was published to provide a consensus RCP seal leakage model for those plants that utilize the Westinghouse seal packages with high-temperature O-rings. The WOG 2000 model does not address the Westinghouse seal packages utilizing old O-rings. The staff expectation is that the Rhodes model will be used to model the Westinghouse seal packages that use old O-rings.

The Areva O-ring seals have been qualified by Jeumont for the same high temperature service as the Westinghouse O-rings and there is no difference in design basis performance characteristics. However, there may be a difference in the beyond design basis ultimate failure pressure characteristics. At this point in time, this difference has not been resolved. Therefore, for the purposes of responding to this question, a sensitivity analysis involving a modification to the PRA RCP seal leakage models to conservatively incorporate the Rhodes model (as presented in WCAP-16141, Section 5.0) was developed. In this model, four potential leakage scenarios are postulated:

Table If-1 RCP Seal Leakage Scenarios for the Unqualified Seal Material Timing After Loss of All RCP Seal Cooling I Probability I 1 0-13 minutes 1 13 minutes - 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> I > 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> I I gpmlpump gpmlpump gpmlpump 21 21 300 0.78 21 76 300 0.02 21 182 300 0.195 21 480 480 0.005

Reference:

WCAP-16141, Table 5-1 These leakage scenarios are referred to as "21/300", "76/300", "182/3001',and "480" in the WCAP SBO event tree for a "typical" plant with unqualified RCP seals.

Enclosure 1 NSPM Responses to NRC Requests for Additional Information Dated December 24,2008 Figure If-1 below is a reproduction of Figure 5-1 from WCAP-16141:

L OSP RPS OGS AFW OPA RLO ACR 2 or 1 EDGs InT11 rnm 21;300 Fak Core lkrcovery In T21 rnm 76,300 In Tt F A Mn 1821300

- In T31 mtn Fsk Core Uncovery Rx Tn~Pea hT41 mm 480 IDP Fsk I Core Ihcorery h Tl? mm 2l~r00 Fak 1 Core chcovery iff E 2 rnm 7&~.300 LOSP F*  !!

Oocurs Fak LF; in T32 rnm Nan+ t 82bM1 Core lkr-IF T42 rnln Fak Core Lhcovery T1D TDP Fak Fak 0 Core Uncowry Al'eS'S

'&CAF-1614' Figure If-1 SBO Event Tree Addressing RCP Seal Leakage for Unqualified Seal Material

Enclosure 1 NSPM Responses to NRC Requests for Additional Information Dated December 24,2008 Since the IPE, the PlNGP seal LOCA model has relied on the results of thermal hydraulic analysis cases run using MAAP code 3.0b. This version of the MAAP code is known to be significantly conservative with respect to the timing of core uncovery and core damage following initiation of RCP seal LOCA events. PlNGP is currently in the process of updating its MAAP thermal hydraulic analyses to new cases run using Revision 4.0.6 of the MAAP4 computer code. Currently only a limited set of Sf30 cases have been run and the available case results are considered preliminary. Therefore, a set of generic thermal hydraulic analysis cases using MAAP4 was used as a check of the preliminary, plant-specific results. WCAP-16141, Appendix A provides generic core uncovery times for Westinghouse reactor classes, including 2-loop plants such as Prairie Island. The document states:

Since the NRC SE item # 7 requires plant-specific analyses for core uncovery times, the value of this appendix can be seen as follows:

1. It provides the minimum factors to be considered in MAAP analyses for specific scenarios for core uncovery.

2. It reports generic core uncovery times that can be compared against plant-specific calculations as a sanity check.

Thus, the contents of this appendix could assist in obtaining uniformity of calculation models and results throughout the industry.

Moreover, it is not expected that plant-specific analyses will yield substantially different core uncovery times than those reported in this appendix.

The seal LOCA analysis results for 2-loop plants from WCAP-16141, Appendix A (specifically Table 3) were used as a check on the reasonableness of the timing of core uncovery and core damage provided by the preliminary plant-specific MAAP cases.

Enclosure 1 NSPM Responses to NRC Requests for Additional Information Dated December 24,2008 Table lf-2 below provides a summary of the available MAAP case runs and results and a comparison with the generic case results:

Table lf-2 Summary of Available Plant-Specific and Generic MAAP Cases for RCP Seal LOCA RCS Cooldown Pump Seal Secondary and Time of AC Time of Core Time to Core Leakage Rate (1) Side Heat Depress- Recovery (hrs) Uncovery (hrs) Damage (hrs)

(gpm) Sink (2) urization (4) (5) (6)

PINGP- WCAP- PINGP- WCAP- PINGP- WCAP- PINGP- WCAP Specific 16141 Specific 16141 Specific 16141 Specific 16141 0121 21121 Yes 6 No (no CU) 32.2 (no CD) 33.8 0 1480 21 1480 Yes 6 No 5.3 6.2 (no CD) 7.5 01480 211480 Yes No 5 (7) No 1.8 1.9 2.3 2.4 01480 21 1480 No No 1 No N/A(8) 1.8 NlA(8) 2.2 (1) Presented in WCAP-16141, Appendix A, Table 3 format (initial seal leakage ratelleakage rate after X minutes; X=13 for PINGP, X=30 for WCAP)

(2) TDAFWP runs until DC control power is lost (2 hrs assumed for PINGP)

(3) CooldownIDepressurizationassumed started at t=30 minutes (3a) Cooldown/Depressurizationassumed started at t=420 minutes (One hour after AC Power Restored)

(4) AC power restored for initiation of RCS makeup to prevent core uncovery; WCAP-16141 cases did not model this as purpose was to determine time required (5) PINGP runs assume injection systems restored after AC recovery; WCAP-16141 does not credit AC recovery (6) Defined as hottest core node Temperature > 1800 OF or hottest core exit Temperature >

1200 F for 30 minutes (PINGP); core exit thermocouples > 1200 O F (WCAP-16141)

(7) Although AC is restored in MAAP case, it occurs too late to prevent core damage (8) No available MAAP cases for PINGP for these conditions; assumed core damage if TDAFWP fails and AC not recovered within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> The preliminary results for the available plant-specific MAAP cases were found to be reasonably close to the WCAP generic 2-loop plant results. In cases where AC is not recovered in time, core uncovery and core damage occur slightly earlier in these scenarios for the PINGP MAAP cases than for the generic cases. Key contributors to this difference are the assumptions of a higher initial core power level (1683 MWt vs.

1518 MWt) and a lower ANV capacity (200 gpm vs. 400 gpm) for PINGP than for the generic case. The plant-specific case runs ended between t=12 hours to t=24 hours (depending on the scenario), whereas the WCAP generic runs were allowed to run for a longer period.

Based on these results, a SBO event tree model for PINGP based on the Rhodes model presented in WCAP-16141, Section 5.0, was developed, except that only those event tree branches corresponding to the largest seal leakage assumption (480 gpmlpump) were included, as there are no available plant-specific or generic MAAP cases that model the Rhodes assumption of a 300 gpm leak occurring at 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. This treatment provides a very conservative, bounding model for SBO; however, the results are

Enclosure 1 NSPM Responses to NRC Requests for Additional Information Dated December 24,2008 responsive to the RAI question. Figure l f - 2 below provides a graphical representation of the event tree model that was used for this sensitivity case:

/ INITIATOR I AFT I OA7 I RLO Statlcn TD A F W Punp Operator RCP Seal Blacked Rum f a 2 hrs Leakage R w v r y (to Invmtay lnvmtay n t t l t e HPI Depffis ACS pror to core 01 so*, 1 IbW -

0 so*, 2

<Dm -

0 S O W 3 row l,.rng mm14 OK ¶OW5 (Il*D.MZ 'BOW6 0nD.w 'BOW-7

<hnD a m g 'BOW8 OK ¶O+W9 C D Domqc

~ SOW-LO Ibwo.mg 'BOW-,,

(be DIl"apc S O W 12 Figure lf-2 SBO Event Tree for Sensitivity Analysis (Bounding 480 GPMIPump Leakage Case Assumption)

Note that the four potential leakage scenarios modeled in WCAP-16141 Figure 5-1 (211300, 761300, 1821300, and 480) have been conservatively reduced to only one, the 480 gpm case, based on a lack of available plant-specific MAAP analyses for the other cases. This treatment effectively assumes that, on any SBO event, a 480-gpm per pump leakage event occurs at t=13 minutes with a probability of 1.O. Only the RLO (assumed leakage scenario) and ACR (AC Power Recovery) event tree headings represent changes to the existing SBO event tree logic in the PRA model; all of the failure logic associated with the other event tree headings already exist in the PRA model and were not changed for this sensitivity analysis. Required power recovery times were chosen based on the results of the (preliminary) plant-specific MAAP analyses for the 480 gpm per pump leakage case (see Table lf-2). It was assumed that power must be restored within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> in order for the operator to successfully start and align injection systems to prevent core damage in the event that the turbine-driven AFW pump successfully operates for 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />, and operator action to cool down and depressurize the RCS at 30 minutes is successful. It was assumed that power must be restored within the first hour in the cases where either AFW fails to operate or cooldown and depressurization is

Enclosure 1 NSPM Responses to NRC Requests for Additional Information Dated December 24,2008 unsuccessful. Failure of power recovery results in core damage regardless of the leakage scenario.

Table l f - 3 provides the results of the sensitivity analysis (SBO contribution) compared to the original PRA SBO contribution as presented in the response to SAMA RAI 1b in the NSPM letter dated November 21, 2008:

Table lf-3 Change in SBO CDF Contribution Over Baseline I SBOCDF I Contribution I Model (per rx-yr) Comment Sensitivity case assumes 480 gpmlpump leakage for all SBO events; core uncoveryldamage timing is based on MAAP 4.0 TH Sensitivity Case 1.04E-06 analysis Baseline assumes WCAP-10541 leakage and seal failure probabilities; Baseline (Rev. 2.2 core uncoveryldamage timing is SAMA) 8.52E-07 based on MAAP 3.0b TH analysis Change: 1.90E-07 = (22% increase over baseline)

The results of the sensitivity analysis show that when the impact of moving to the more accurate RCP seal LOCA thermal hydraulic calculations of MAAP 4.0 is taken into consideration, the contribution of SBO remains small even when assuming much higher seal leakage rates very early in the event. As shown in Table I f - 1 above, the probability that an RCP seal leakage event scenario will be less severe than 480 gpm (even for unqualified seals) is over 99%. Therefore, when sufficient plant-specific MAAP analysis case runs are available to allow modeling of the lower leakage rates specified in the Rhodes model (similar to that shown in Figure If-1 above), it is anticipated that the SBO contribution to the overall CDF will actually be significantly lower than it was calculated to be in the Rev. 2.2 SAMA version.

Based on the results of the sensitivity analysis presented above, NSPM believes that there would have been no impact on the SAMA identification and screening presented in the ER had an RCP seal leakage model consistent with more currently acceptable methodologies been utilized in the PlNGP PRA model.

SAMA Follow Up RAI Ih Based on the description provided, the dominant internal flooding sequence (involving cooling water header rupture) would result in core damage at both units. The benefits of any related SAMAs should therefore be doubled. Identify all sequences resulting in core damage at both units. Confirm that the benefits for related SAMAs were appropriately assessed, i.e., doubled where appropriate. (Also see RAI 5.b)

Enclosure 1 NSPM Responses to NRC Requests for Additional Information Dated December 24,2008 NSPM Response to SAMA Follow Up RAI 1h The PINGP PRA model is a linked fault tree model that quantifies Unit 1 and Unit 2 core damage risk independently. The impact of loss of equipment that is shared, such as the Cooling Water system, is modeled explicitly in the failure logic for both units and is reflected separately in the risk metrics for each unit. Similarly, equipment that exists on one unit but that can be cross-tied or otherwise put into service to support the other unit is modeled explicitly. This allows the model to account for the fact that, on a dual-unit initiating event, equipment on one unit that would otherwise be available to provide a support function for the opposite unit, may not be available. All SAMAs were evaluated with attention to the potential decrease in risk to each unit individually. Therefore, there is no need to "double" the core damage risk benefit for any of the SAMAs evaluated.

Also, a number of SAMAs were developed that have a positive risk benefit to both units (generally these SAMAs involve enhancements to equipment that is either shared by both units or that is crosstie-able between units). Typically these SAMAs are implemented by a single modification that provides benefits to both units. As previously discussed, the costs associated with these modifications were evenly apportioned between the units (this is appropriate since the risk-reduction benefit to each unit is determined separately). This process ensures that the benefits for these SAMAs were appropriately assessed.

SAMA Follow Up RAI 2b The last paragraph of the RAI response provides a qualitative comparison of the conditional probabilities of the steam generator tube rupture (SGTR) under specific primary and secondary side conditions, but does not include a characterization of the PINGP-specific results for induced SGTR. Provide the frequency-weighted conditional probability of temperature induced-SGTR (over all sequences involving high primary side and low secondary side pressure, and a dry secondary side) for PINGP. Provide an assessment of the impact on the SAMA identification and screening if a conditional probability of 0.25 (similar to NUREG-1570) is assumed for these sequences.

NSPM Response to SAMA Follow Up RAI 2b NSPM understands this question to be asking for the impact to the SAMA results given the assumption that containment bypass due to induced SGTR from any cause (not only TI-SGTR as identified in the question) occurs with a probability of 0.25 following any core damage sequence involving high primary side and low secondary side steam generator pressure, and a dry steam generator secondary side. This is consistent with the NUREG-1570 induced SGTR baseline case results for Surry presented in NUREG-1570 Table 5.8 and described in NUREG-1570 Section 6.1. As discussed during the December 9, 2008, conference call with the NRC staff, NSPM could not identify any NUREG-1570 results showing a 0.25 conditional probability of TI-SGTR alone.

Enclosure 1 NSPM Responses to NRC Requests for Additional Information Dated December 24,2008 Tables 2b-1 and 2b-2 below show the Unit 1 and Unit 2 95thpercentile cost-benefit results, respectively, as modified by the NSPM responses to SAMA RAI questions 6.b and 6.g in the NSPM letter of November 21, 2008. Note that the positive net values (indicated by bold italics) for SAMAs 9 and 22 on both units, and SAMA 19a on Unit 2, indicates that they were found to be cost beneficial on those units. In the tables below, the increased cost of implementation of SAMA 2 described in the response to SAMA RAI 6.b has been reflected in the tables, as has the corresponding increase in the cost of implementation for SAMA 12 (SAMA 12 assumes the modifications associated have also been installed). In addition, the cost associated with SAMA 20 has been modified as described in the response to SAMA Follow-Up RAI 6c below.

Table 2b-1 Table 2b-2

Enclosure 1 NSPM Responses to NRC Requests for Additional Information Dated December 24,2008 Tables 2b-3 and 2b-4 provide the same information for each unit, but the averted cost-risk values include the increased value due to the assumption that ISGTR occurs with a conditional probability of 0.25 following a High-Dry core damage event.

Table 2b-3 Unit 1 95th Percentile Results per SAMA Uncertainty SAMA ID Cost of Ratio of 95th Unit 1 Averted Net Value Implementation to SAMA CDF Cost-Risk SAMA 1 $4,250,000 2.89 $1,868,573 -$2,381,427 SAMA 2 $1,200,000 2.69 $578,252 -$621,748 SAMA 3 $250,000 2.75 $386,974 $136,974 SAMA 5 $1,500,000 2.86 $1 14,588 -$1,385,412 SAMA 9 $62,500 2.87 $340,502 $2 78,002 SAMA 10 $2,866,000 2.84 $204,758 -$2,661,242 SAMA 12 $1,800,000 2.79 $794,683 -$1,005,317 SAMA 15 $130,000 2.90 $0 -$130,000 SAMA 17 $2,362,000 2.89 $265,104 -$2,096,896 SAMA 19 $700,000 2.86 $172,668 -$527,332 SAMA 19a $1,935,000 2.77 $1,756,854 -$178,146 SAMA 20 $244,000 2.85 $153,784 -$90,216 SAMA 21 $3,000,000 2.91 $222,090 -$2,777,910 SAMA 22 $39,000 2.89 $152,585 $1 13,585 Table 2b-4 Unit 2 95th Percentile Results per SAMA Uncertainty I

/ ID I

1 Cost of 1 I

Ratio of 95th Implementation to SAMA CDF 1

I Unit 2 Averted Cost-Risk 1

I Net Value 1 I

SAMA 1 $4,250,000 2.82 $2,034,256 -$2,215,744 SAMA 2 $1,200,000 2.79 $646,787 -$553,213 SAMA 3 $250,000 2.71 $422,548 $172,548 ,

SAMA 5 $1,500,000 2.89 $520,978 -$979,022 SAMA 9 $62,500 2.75 $355,554 $293,054 SAMA 10 $2,866,000 2.86 $224,331 -$2,641,669 SAMA 12 $1,800,000 2.92 $1,236,665 -$563,335 SAMA 15 $130,000 2.84 $117,199 -$12,801 SAMA 17 $2,362,000 2.86 $1,429,419 -$932,581 SAMA 19 $700,000 2.87 $172,989 -$527,011 SAMA 19a $1,935,000 2.74 $3,534,505 $1,599,505 SAMA 20 $244,000 2.85 $156,367 -87,633 SAMA 21

- $3,000,000 2.76 $263,556 -$2,736,444 SAMA 22 $39,000 2.84 $356,733 $3 17,733 Note that, under the hypothetical assumption that 25% of High-Dry core damage sequences lead to ISGTR, SAMA 3 (Provide Alternate Flow Path from RWST to Charging Pump Suction) becomes cost-beneficial on both units.

However, this assumption is based on results generated in NUREG-1570, which used the Surry plant (3-loop PWR) as the baseline plant. As described in the response to

Enclosure 1 NSPM Responses to NRC Requests for Additional Information Dated December 24,2008 SAMA RAI 2.b in the NSPM letter of November 21, 2008, the ISGTR analysis incorporated in the Rev. 2.2 SAMA PRA model is based on a methodology developed specifically for Westinghouse 2-loop plants (WCAP-16341-P). This methodology was developed with the knowledge of NUREG-1570 and other more recent analyses of the potential for ISGTR. Therefore, NSPM does not feel that the assumption that 25% of High-Dry core damage sequences lead to ISGTR is valid for Prairie Island. Further, as described in the response to RAI question 8.i, NSPM has already agreed to further assess the cost benefit of a proposed steam generator safety valve gagging device that could significantly reduce the risk associated with ISGTR. Therefore, NSPM does not plan to further assess the potential for implementation of SAMA 3.

During the validation of this response a discrepancy was identified in the baseline ISGTR sequence quantification in the Rev. 2.2 SAMA model. Specifically, a Small LOCA core damage sequence that did not involve dry SG conditions was included in the ISGTR quantification, while another Small LOCA core damage sequence which did involve dry SG conditions was not included. The sequence that was included has a much higher frequency than does the sequence that was not included, and there are no subsequent failure events included in the ISGTR models that would be negatively impacted had the correct sequence been used; therefore, use of the model without dry SG conditions provides conservative results for the ISGTR quantification. All of the results presented thus far (in the ER and in the RAI responses, including this one) include the conservative treatment. Therefore, the set of SAMAs that has been identified as cost beneficial to date represents an upper bound relative to ISGTR (i.e., correction of the discrepancy may show that SAMA 3 is not cost-beneficial). This discrepancy is being entered into the Corrective Action Program for resolution.

SAMA Follow Up RAI 3a and 3b In order to support the assumption that the fire core damage frequency (CDF) is comparable to the internal events CDF (9.79E-6 for Unit 1 and 1.21E-5 for Unit 2), it should be shown, preferably through sensitivity analysis or other quantitative arguments, that the individual plant examination of external events (IPEEE) fire CDF value (4.9E-5) is conservative by a factor of 4 to 5 (for Units 2 and 1, respectively). The information provided in the RAI response is general and qualitative in nature, and does not sufficiently demonstrate that such a large reduction in the fire CDF is appropriate (For example, the discussion of control room fires [65% contributor] states that partitioning of a cabinet within a panel zone was not credited. What is not stated is that the main control panel is a contiguous arrangement of panel sections without barriers or boundaries. The IPEEE used partitioning process of overlapping zones [25 zones] to subdivide the panel based on consideration of nominal panel fire heat rate, nominal heat value of the cable bundle, available fire suppression time of 15 minutes and the general vertical propagation tendency of fire in open back panels. Therefore, the zones are subdivided panel sections. In addition, the statement that manual suppression credit was only applied to cutsets representing 4 3 % of the internal fires CDF appears to be misleading.

The IPEEE indicates that manual suppression was applied to all control room fires with a 10 minute fire suppression failure probability of 1.6E-2.). However, the 46 percent

Enclosure 1 NSPM Responses to NRC Requests for Additional Information Dated December 24,2008 reduction in the conditional core damage probability (CCDP) since the IPEEE cited in the response (p. 23) would suggest that a factor of 2 reduction in CDF might be justified.

Provide additional information on how the CCDP was computed, and on how the events on which it is based relate to the dominant fire events. Clarify whether the CCDP value includes station blackout events.

NSPM Response to SAMA Follow Up RAI 3a and 3b A complete update to the fire PRA models provided in the Fire IPEEE is not yet available. In its response to SAMA RAI 3b of November 21, 2008, NSPM provided as much quantitative evidence that the risk due to internal fires is lower than calculated in the IPEEE as was reasonably available.

The fire IPEEE stated clearly that the control room panels are subdivided panel sections.

This fact is not relevant to the point made in the response. Further subdivision of panel zones for refinement of the analysis was not performed in the IPEEE. The linear length of each analysis "zone" was taken to be 10 feet, and each zone overlapped with the zones adjacent to it such that damage to components located within any main control board area was assumed to result from a fire initiated within either of two panel zones.

Also, the assumption that any fire (regardless of intensity, location or other factors) that initiates within a panel zone damages all equipment within the panel zone is very conservative. Current control room analysis methodologies would allow further refinement to credit the potential for self-extinguishment given separation between combustibles within panel zones and cable and component materials used within the panels.

The statement in the RAI response that manual suppression credit was only applied to cutsets representing e l 3% of the internal fires CDF is correct. The statement in the follow-up question, "The IPEEE indicates that manual suppression was applied to all control room fires with a 10 minute fire suppression failure probability of 1.6E-2," is incorrect. This value was used in the control room fire closeout strategy scenario document, attached to the IPEEE report as Appendix B, Attachment 2 (ERIN Engineering Calculation 130-98-01, Fire Area Scenario for FA 13, p. 7 and p. A-13).

This document provides the initial development of the control room analysis, but the quantitative portions of this document were used only for initial screening of the control room (Fire Area 13). The control room did not screen out, and the analysis was further refined for the final IPEEE quantification. Page A-13 of the scenario document provides the event tree used in the initial screening quantification, and shows the 1.6E-2 manual suppression failure probability value. However, the diagram also shows that credit for manual suppression was only applied to fires that were large enough to propagate beyond the boundaries of the initiating panel zone. As shown on the diagram, only 8.3%

of fires were assumed to be fires of this magnitude (this event tree and severity factor were carried through the final analysis quantification). In the final, overall fire IPEEE quantification results (including control room fires and fires in ail other fire areas), credit for the potential for successful fire suppression was only applied to cutsets representing

<13% of the internal fires CDF.

Enclosure 1 NSPM Responses to NRC Requests for Additional Information Dated December 24,2008 Note that the final probability value for failure of manual suppression of control room fires used in the final IPEEE quantification (4.OE-2) was higher than that shown on the diagram on page A-13 of the control room scenario document, while the probability of failure of the operators to successfully shut the plant down from outside the control room (given failure of manual suppression) was lower (6.4E-2). However, in the final quantification for the IPEEE, the overall sequence CCDP (given a fire initiating in the control room) was actually higher by over 60% than that shown on page A-13 of the scenario document (see Table 3ab-1 below).

Table 3ab-1 Control room abandonment sequence CCDP:

Change from scenario document to that used in final IPEEE fire PRA results Fire Severity Manual Shutdown from

(% that are Suppression Outside CRM Sequence Large fires) (failure of) (failure of) CCDP FA 13 Scenario document 8.30E-02 1.60E-02 1.00E-01 1.33E-04 Final IPEEE parameters 8.33E-02 4.00E-02 6.40E-02 2.13E-04 Sequence CCDP increase over scenario document assumptions = 61%

The 46 percent reduction in the conditional core damage probability (CCDP) since the IPEEE, cited in the response, applies to normal (or general) plant transient-initiated events. This value was computed by comparing the CCDP of the I-TR1 (normal transient) initiating event from the Level 1, Rev. 1 internal events model results, to the CCDP for the corresponding initiating event (1-1-TR1) in the Rev. 2.2 SAMA model (The Fire IPEEE PRA model was built upon the Level 1, Rev. 1 Unit 1-only internal events PRA model). The TR1 initiating event CCDP is relevant to fires that result in a unit shutdown (with appropriate accounting for fire-induced equipment damage) but that do not result in a fire-induced LOCA or other more complicated transients such as loss of main feedwater or SBO. This is generally considered to be the most likely transient to occur following an initiating fire event at PINGP.

However, as described in the NSPM response to SAMA RAI 3b, the IPEEE results showed that the dominant fire initiating events are fires in control room panel zones 5 and 6, which together account for approximately 40% of the total fire-induced CDF.

These events are assumed to involve loss of main feedwater (MFW) and auxiliary feedwater (AFW). The reduction in CCDP associated with loss of MFW events (the I-TR4 initiating event in the Level 1, Rev. 1, model compared to the 1-1-TR4 initiating event from the Rev. 2.2 SAMA model) is 31.7%. This CCDP reduction also applies to the most risk-significant fires from Fire Area 32 (Auxiliary Feedwater Pump/lnstrument Air Compressor Room), which also involve loss of MFW, and other initiating events that were not screened out of the IPEEE analysis.

Also, as described in the NSPM response to SAMA RAI 3b, the IPEEE results showed that fires in control room panels leading to LOOPISBO account for approximately 11% of

Enclosure 1 NSPM Responses to NRC Requests for Additional Information Dated December 24,2008 the total fire-induced CDF. Although the SBO contribution to core damage was not directly quantified for the Level 1, Rev. 1, internal events model update, the loss of offsite power (LOOP) initiating event contribution was quantified. The reduction in CCDP associated with LOOP events (the I-LOOP initiating event in the Level 1, Rev. 1, model compared to the I-LOOP initiating event from the Rev. 2.2 SAMA model) is 80.6%.

LOOP events in which onsite AC power from the emergency diesel generators is available following an accident progression are similar to a loss of MRN initiating event (see discussion regarding reduction of the CCDP associated with loss of MFW in the preceding paragraph). As shown in Table I f -3 above, the CDF contribution associated with SBO events was calculated to be 8.52E-7/rx-yr for the Rev. 2.2 SAMA model.

However, as described in the response to SAMA Follow Up RAI I f above, when sufficient plant-specific MAAP analysis case runs are available to allow modeling of the lower leakage rates specified in the Rhodes model, it is anticipated that the SBO contribution to the overall CDF will actually be significantly lower than it was calculated to be in the Rev. 2.2 SAMA version.

An upgrade to the internal fires PRA is currently being developed as part of the fire protection program transition to one meeting the risk-informed, performance-basedfire protection rule, 10CFR50.48~~ which endorses National Fire Protection Association (NFPA) Standard 805 (NFPA-805). A number of tasks have been preliminarily completed for this upgrade, including a revision to the most risk-significant internal fires initiating event frequencies from the IPEEE. This analysis is based on the methodology of NUREG/CR-6850. The preliminary results of this analysis show that the fire initiating event frequencies for the most risk significant fire areas for the IPEEE, (i.e. fires in Fire Areas 13 and 32, Control Room and ARN/lnstrument Air Compressor Room), are lower than calculated for the IPEEE, as shown in Table 3ab-2 below:

Table 3ab-2 PlNGP Fire initiating Event Frequency Comparison:

.-- IPEEE vs. Preliminary FPRA Upgrade Calculated Values Preliminary IPEEE IE FPRA IPEEE IPEEE Fire Frequency Upgrade IE Dominant CDF (per year) Frequency Fire Area Description Contribution (1) (per year) Change 13 Control Room 65.3% 2.04E-02 1.20E-02 -41%

"B" Train Hot Shutdown PanelIAFWlIA 32 Compressor Room 16.7% 4.48E-03 2.60E-03 -42%

(1) From PlNGP IPEEE Table B.2.6.3 SAMA Follow Up RAI 5a It is understood from the response that improved training will not provide any additional benefit. However, the failure probabilities of 1.9E-02 and 5.3E-02 appear to have room for improvement. Explain the characteristics of these actions (and the calculator used to

Enclosure 1 NSPM Responses to NRC Requests for Additional Information Dated December 24,2008 determine its value) that prevents lower calculated values given excellent training and emergency operating plan-driven direction.

NSPM Response to SAMA Follow Up RAI 5a As discussed in the original RAI response, the two operator actions of concern are:

OSLOCAXXCDY: Operator Fails To Perform RCS Cooldown and Depressurization on Small LOCA (Failure probability of 1.92E-02)

OHRECIRCC2Y: Operator Fails To Initiate High Head Recirculation Conditional on Failure of RCS Cooldown and Depressurization (Failure Probability of 5.3E-02)

The human reliability analysis (HRA) was performed using Version 3.0 Beta of the EPRl HRA calculator. This calculator uses the Caused-Base Decision Tree Methodology (CBDTM) together with tables from NUREGICR-1278 (USNRC Technique for Human Error Rate Prediction (THERP)). This is consistent with the EPRl HRA Users Group HRA Methodology and consistent with the state-of-the-art in the industry. The impact of timing, experienceltraining and procedures were factored into the analysis.

In general, EOP direction and training is assumed for using the CBDT method. In addition, the CBDT method credits general and specific training in scenarios where there could be problems with the operator information or operator-procedure interfaces. Thus, for relatively standard EOP scenarios, which implicitly assume procedural direction and training, one can not drive the numbers lower by crediting "better" training. Had there been no EOP direction or training, the CBDT method could not be used, and the Human Error Probability (HEP) numbers would be in the order of 1E-01. The THERP tables used in the analysis also assume Rule Based Actions are being modeled.

Other factors may also influence the HRA calculation. Further review was conducted on the two operator actions listed above to determine how other factors, such as timing and dependencies, impact the HEP analysis.

OSLOCAXXCDY Assessment:

Review of OSLOCAXXCDY determined that the dominant contributor to the overall Human Error Probability (HEP) was the execution probability. The execution probability is approximately 84% of the overall total HEP. The execution probability was determined to be 1.6E-02. There were 19 critical operator steps identified from the EOP for this action.

The timing analysis was also reviewed. For operator action OSLOCAXXCDY, the timing analysis plays a critical role in the ability to credit recovery for the execution portion.

Due to the limited time available for recovery (approximately 5 minutes) no recovery credit was applied to the execution probability; this resulted in a relatively high HEP value of 1.9E-02. The time available for recovery is brief since it would take approximately 2.6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> to perform the required actions (cooldown and depressurize the

Enclosure 1 NSPM Responses to NRC Requests for Additional Information Dated December 24,2008 Reactor Coolant System and lineup Residual Heat Removal (RHR) system for shutdown cooling). This is almost the same time it would take the Refueling Water Storage Tank (RWST) to reach its low level alarm (-2.7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br />). This operator action is discussed in detail in Enclosure 2.

OHRECIRCC2Y Assessment:

Operator action OHRECIRCC2Y (Operator Fails To Initiate High Head Recirculation Conditional on Failure of RCS Cooldown and Depressurization) involves the failure of the operator to initiate high head recirculation following a small LOCA conditional of failure of the operator to perform RCS cooldown and depressurization for a small LOCA event (OSLOCAXXCDY).

Since these two operator actions (OSLOCAXXCDY and OHRECIRCC2Y) appear in the same SLOCA initiating cutset, OHRECIRCC2Y is a conditional operator action based on OHRECIRCSMY which is discussed in Enclosure 3. OHRECIRCSMY was calculated using Version 3.0 Beta of the EPRl HRA calculator and used the Caused-Base Decision Tree Methodology (CBDTM) together with the THERP methodology. The total HEP calculated for OHRECIRCSMY is 3.6E-03.

The conditional probability of operator action OHRECIRCC2Y, which is derived from OHRECIRCSMY, is quantified by determining the level of dependence. Many factors may influence the level of dependence such as timing, location, and the relationship between persons performing the actions.

An evaluation of the timing associated with this particular core damage sequence (SLOCA initiating event with successful SI Pump injection) shows that there is adequate time between performance of operator action OSLOCAXXCDY and OHRECIRCC2Y (greater than 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />). This is based on the ability to maintain core cooling for several hours (-2.7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br />) with the SI pump injecting RWST water before the low level alarm is reached and transfer to recirculation is required.

In addition, other factors can be evaluated to determine dependency, such as: same crew, cognition (cues/procedures), resources, location and stress. For the OHRECIRCC2Y dependency analysis, the same crew is used (since the time delay is less than the shift length of 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />), different procedures and cues are used for each action, operator actions do not occur at the same time and adequate resources are available since the two operator actions (OSLOCAXXCDY and OHRECIRCC2Y) are not simultaneous. Also, the stress level associated with the operator action OHRECIRCSMY is Moderate.

After reviewing the dependency factors, the most significant being the timing and the stress level, a Low Dependency (LD) was assigned. Based on USNRC Technique for Human Error Rate Prediction (THERP), the conditional probability equation used to determine the HEP value for OHRECIRCC2Y is:

OHRECIRCC2Y (Low Dependence) = (1 + 19N)/20 Where: N = 3.6E-03 (HEP value for OHRECIRCSMY)

Enclosure 1 NSPM Responses to NRC Requests for Additional Information Dated December 24,2008 Note that using the THERP dependency formula approach to determine dependency analysis can be seen as very conservative. However, the THERP approach is standard industry practice.

SAMA Follow Up RAI 5b Three candidate SAMAs (6, 6a, and 13) and 2 IPE-identified enhancements related to internal flooding were dismissed on the basis of a cooling water header piping modification in 1992, and deterministic considerations described in a 1995 engineering calculationlwhite paper. However, the IPE and 7 subsequent PRA updates (up to and including the current PRA) continue to model the rupture of the cooling water header.

Justify why the piping modification should be credited (for eliminating cooling water header ruptures) in the SAMA evaluation, in view of the fact that the IPE and subsequent PRA updates continue to model these pipe breaks, and that the American Society of Mechanical Engineers PRA standard would call for treatment of such flood sources.

Provide a quantitative evaluation of the costs and benefits of each of the aforementioned SAMAs Ienhancements based on the current PRA treatment of cooling water header pipe breaks.

NSPM Response to SAMA Follow Up RAI 5b The current PRA model still includes initiating events modeling all of the internal flooding initiating events included in the IPE model (expanded now to include their impacts to both units). The CL header piping modifications and considerations contained in the engineering calculation referred to in the question were used in a previous model update to attempt to model the frequency of flooding events in each class that have a more realistic set of consequences. Previously the consequences associated with the worst case (and lowest frequency) piping rupture were applied to the entire frequency of potential piping rupture events in each area (most of which are higher frequency, lower consequence events). This was felt to be skewing the results of the PRA in an overly-conservative manner. It is now understood that this method is not consistent with the PRA standard and will be corrected in a future PRA update; however, this treatment was included in the version of the PRA used for the SAMA analysis. No SAMAs were excluded from consideration based on either the piping modification or the engineering calculation.

SAMA Follow Up RAI 5d and 5e A review of Table F.5-3 finds that several screened Phase I candidates (i.e., SAMAs 6, 6a, 7, 8, 13, 14 and 16) do not appear to meet the environmental report (ER) Section 4.1 7.1 screening criteria. In addition, the discussion for the basis for screening SAMA 14 does not appear to address the benefit of improved operator training for power-operated relief valve failure to re-seat. Its screening appears to be based on model limitations as

Enclosure 1 NSPM Responses to NRC Requests for Additional Information Dated December 24,2008 opposed to actual benefit. As such, the ER Section F.5.2 criteria do not appear to be consistent with the ER Section 4.17.1 criteria. Confirm that both sets of screening criteria are used. Explicitly identify the ER Section F.5.2 and the ER Section 4.17.1 screening criterion used for each screened SAMA.

NSPM Response to SAMA Follow Up RAI 5d and 5e The table below identifies the Phase 1 screening criteria used for SAMAs 6, 6a, 7, 8, 13, 14, and 16. As applied in the ER, this particular screening process was used to identify those SAMAs that were readily observed as not being cost beneficial, and thus not being applicable to the Phase 2 quantification of averted cost-risk. The process involved cutset reviews and the CDF contribution of those targeted accident sequences for which the SAMAs were developed. The applicable screening criteria from both Sections 4.1 7.1 and F.5.2 are listed to emphasize that the screening criteria cited in these sections address the same intent.

SAMA ID and Description of Disposition Specific Criteria Specific Criteria Description from Section from Section

- 4.17.1 F.5.2 6 For either unit, Auxiliary Building Zone 7 Candidates with Engineering Consider flooding initiating events account for only about no sianificant Judgment: Using installing 2% of the CDF and only about 1% of the LERF. benefit in PWRs extensive plant waterproof The cost and complexity of implementing this such as PINGP. knowledge and equipment SAMA would be significant, involving system sound engineering (valves,level modifications that would entail extensive judgment, potential sensors) engineering support, specialized hardware and SAMAs are capable of instrumentation, and regulatory analyses to evaluated based on automatically support modifications to the facility. In order to their expected isolating the minimize the cost of the modification, the maximum cost and flooding source. existing ring header isolation MOVs would have dose benefits; to be used (those that currently split the ring those that are header into two safeguards headers on an S- deemed not signal on either unit) in order to prevent a dual- beneficial are unit outage to install new isolation valves. screened from Under this design, however, isolation of an further analysis.

entire train of safeguards equipment (those supplied by CL) to stop the flooding event would leave both units susceptible to a single failure for im~ortantsafetv functions. (Sect.

Enclosure 1 NSPM Responses to NRC Requests for Additional Information Dated December 24,2008 SAMA ID and Description of Disposition Specific Criteria Specific Criteria Description from Section from Section

-.-- 4.17.1 F.5.2 6a The maximum risk benefit for this SAMA is Candidates Engineering Consider low (see SAMA 6 discussion above). The whose estimated Judgment: Using segregating this Cost of implementing this SAMA is estimated implementation extensive plant zone into 2 to be significantly greater than that of SAMA costs exceed the knowledge and compartments to 6. Furthermore, this SAMA relies on operator maximum sound engineering reduce the action to identify and isolate the header with averted cost-risk judgment, impact of a flood the break (the current, pre-SAMA and/or potential SAMAs on both trains of implementation situation). With the higher candidates with are evaluated SI and RHR, likelihood of isolation failure due to operator no sianificant based on their vs. automatic action, a large portion of the risk benefit in PWRs expected benefit from this SAMA would not be realized. such as PINGP. maximum cost (Sect. F.5.2.2) and dose benefits; those that are deemed not beneficial are screened from

--- further analysis.

7 SBO is already a small contributor - <8% of Candidates Engineering The ability to use CDF, <1% of LERF, <0.02% of early CF. Top whose estimated Judgment: Using non-safety SBO-related release categories involve implementation extensive plant related diesel sequences in which containment and/or costs exceed the knowledge and generators ~3 vessel does not fail. Also, significant costs maximum sound engineering and ~4 would would be incurred to upgrade D3 and D4 to averted cost-risk judgment, provide a safety-related status, which would ultimately and/or potential SAMAs backup source cost more than the benefit gained from a 2% candidates with are evaluated of power in improvement in CDF. (Table F.5-3) no sianificant based on their addition to the benefit in PWRs expected existing four such as PINGP. maximum cost safety related and dose benefits; diesels D l , D2, those that are D5, and D6. deemed not beneficial are screened from further analysis.

8 SBO is a significant contributor to CDF for Candidates Engineering installation of a both units (provides about 8% of the total whose estimated Judgment: Using swing or SBO CDF). However, it contributes 4 % to the implementation extensive plant diesel would LERF, and <0.02% to the frequency of all costs exceed the knowledge and provide early containment failure sequences. All of maximum sound engineering increased the top SBO-related release categories averted cost-risk. judgment, defense in depth involve sequences in which the containment potential SAMAS and could be andlor reactor vessel does not fail. The risk are evaluated considered for benefit of this SAMA is further reduced by the based on their LOOP need for operator action (including local expected conditions. actions) for implementation. (Sect. F.5.2.3) maximum cost and dose benefits; those that are deemed not beneficial are screened from

-. further analysis.

Enclosure 1 NSPM Responses to NRC Requests for Additional Information Dated December 24,2008 SAMA ID and Description of Disposition Specific Criteria Specific Criteria Description from Section from Section 4.1 7.1 F.5.2 13 The maximum risk benefit for this SAMA is Candidates with Engineering This initiator low (see SAMA 6 discussion above). The no sianificant Judgment: Using represents an cost of implementing this SAMA would be benefit in PWRs extensive plant internal flooding about the same, or slightly less, than the cost such as PINGP. knowledge and scenario that of SAMA 6, however, as with SAMA 6a, this sound engineering disables various SAMA relies on operator action to identify and judgment, safety-relate-j isolate the header with the break (the current, potential SAMAs components, pre-SAMA implementation situation). are evaluated Mitigation of this Therefore, a large portion of the risk benefit based on their event can be from this SAMA would not be realized. Also, expected accomplished even with successful operator action, the maximum cost via an automatic result is the loss of at least one train of and dose benefits; sump pump safeguards equipment. (Sect. F.5.2.4) those that are system to deemed not remove water if beneficial are the operator fails screened from to isolate Zone 7 further analysis.

of the Aux. Bldg.

14 Existing model considers that failure to close Candidates with Engineering Reinforce and failure to open lead to the same accident no sianificant Judgment: Using operator training class, GLH (assuming failure of operator to benefit in PWRs extensive plant to isolate CooldownIDepressurize per ECA 3.113.2, such as PINGP. knowledge and PORVS when which leads to SGTR source term). sound engineering symptoms reveal Therefore, quantification of this SAMA judgment, valves have modification would produce no difference in potential SAMAs failed to re-seat. the calculated frequency of offsite release or are evaluated This reduces the its magnitude. (Table F.5-3) based on their amount of expected radioactivity maximum cost released to the and dose benefits; environment. those that are Consider deemed not replacing with beneficial are more reliable or screened from robust valves to further analysis.

better isolate following

- lifting.

Enclosure 1 NSPM Responses to NRC Requests for Additional Information Dated December 24,2008 SAMA ID and Description of Disposition Specific Criteria Specific Criteria Description from Section from Section 4.17.1 F.5.2 16 Failure of this valve to open results in failure Candidates Engineering Failure of MV- of shutdown cooling initiation (there is no CCF whose estimated Judgment: Using 32169 to open ' for inboard MOVs that currently exist for the implementation extensive plant disables RHR flow path involved in these sequences). This costs exceed the knowledge and Loop B return. may not have any positive impact on CDF (FC maximum sound engineering Proper operation air-operated valve inside containment may be averted cost-risk judgment, of this valve is less reliable than a MOV due to reliance on and/or potential SAMAs most likely containment instrument air supply) and would candidates with are evaluated tracked via the have little, if any, impact on LERF. (Table no sianificant based on their MR. Consider F.5-3) benefit in PWRs expected replacing this such as PINGP. maximum cost MOV with a FC and dose benefits; air-operated those that are valve for deemed not improved beneficial are reliability. This screened from would eliminate further analysis.

CCF for inboard MOVs that currently exist on this flow path.

As described in Section 5.1 . I of the ER, Phase 1 SAMAs were, in part, identified through a review of the importance measures associated with the Rev. 2.2 SAMA model PRA CDF calculation for each unit. SAMA 14 was identified as a potential Phase 1 candidate SAMA due to the importance measures associated with Unit 2 basic events 2SGTRRLFFTC and 2SGTRRLFSUC. These two events, both having a probability of 0.5, are split fractions that represent failure of a secondary relief valve to close given SG overfill following a SGTR event and successful closure of all relief valves, respectively.

Both events have the same probability (0.5) and in the baseline PRA quantification, success or failure of this event tree top event heading leads to an identical accident progression (operator action to depressurize the plant to the point at which RHR shutdown cooling can be placed in service is required to prevent core damage). This treatment essentially gives no credit for the fact that the valves may successfully reclose; the existence of this event tree top event heading is only for sensitivity purposes and does not otherwise play a role in the PRA.

Note that in the response to SAMA RAI 8(i) in the letter of November 21, 2008, NSPM stated that it had entered the proposed SAMA (SG relief valve gagging device) into the Corrective Action Program for a more detailed examination of viability and implementation cost. This proposed plant modification, if proven to be cost beneficial and implemented, would effectively reduce the offsite dose risk associated with stuck open safety relief valves on SGTR events.

Enclosure 1 NSPM Responses to NRC Requests for Additional Information Dated December 24,2008 SAMA Follow Up RAI 59 Based on the description provided, the dominant internal flooding sequence (involving cooling water header rupture) would result in core damage at both units. Provide an evaluation of a less extensive, alternative SAMA that would limit water damage to the systems, structures, and components for a single unit (so that core damage would be limited to one unit). Provide the costs and benefits for this alternative.

NSPM Response to SAMA Follow Up RAI 59 The dominant internal flooding sequence involves a CL header rupture in the Component Cooling heat exchanger room in the Auxiliary Building. This room is located in the basement of the Auxiliary Building, near the center of the building between the two units.

However, the equipment in the room is not separated by unit; rather, it is separated by train. The Train A CC heat exchangers and pumps are located on the "Unit 1" side of the room, while the Train B CC heat exchangers and pumps are located on the "Unit 2" side of the room. The PRA model assumes that, due to the potentially high flow rate out the break and water spray potential, both pumps on the break side of the room are affected.

In order to stop the flow out the break, the operators would have to isolate the ruptured CL header. Therefore, a wall or other flood-limiting barrier down the middle of the room would leave one CC pump and heat exchanger operable in the non-isolated train on the side of the room without the break. If that one remaining pump failed to function, or happened to be out of service for maintenance (for example) when the event occurred, all CC would be lost to both units, even though the CL header break was successfully isolated. An attempt to construct barriers to protect both CC trains for one unit would have a similar problem; on any CL piping rupture at least one train of CC would still be lost on both units. Any of a number of single failures in the opposite train would lead to loss of all CC on the unit with the flood protection installed. Therefore, it is not practical to design a flood barrier that can protect one unit at the expense of the other. This also goes against the design philosophy of the plant which is to design and install safety measures that will protect both units.

SAMA Follow Up RAI 6c The life-cycle cost is identified as $100K. However, SAMA 20 changes a normally open motor-operated valve to normally-closed. Demonstrate that this change will add $100K additional life-cycle cost to an existing valve. In addition, the noted design cost reduction of 30% does not yield the reduced second unit cost. Address this apparent discrepancy.

NSPM Response to SAMA Follow Up RAI 6c Plant operation with these valves normally closed would require that the valves automatically open following a LOCA event to supply flow to the reactor vessel. Failure of these valves to open would contribute to loss of low head injection capability during LOCA events. To ensure valve operability, periodic cycling of valves and general maintenance will be required at a cost of $100,000 per unit. Additional reviews of these

Enclosure 1 NSPM Responses to NRC Requests for Additional Information Dated December 24,2008 life-cycle costs revealed these costs would be inherent to maintaining these valves whether the valves are open or closed. Therefore, the $100,000 per unit life cycle costs were removed from the cost estimate for SAMA 20 as indicated below. Although this lowered the cost estimate for SAMA 20, the analysis demonstrated that implementation would not be cost beneficial.

Order-of Magnitude Cost Estimate for SAMA 20 SAMA ID No.: 20

Title:

Close Low Head Injection MOVs to Prevent RCS Backflow to SI System

Description:

Change the safety-related motor-operated low head reactor vessel injection valves (one valve in each Emergency Core Cooling System train) from normally open to normally closed. Valves would need modifying by drilling a hole in the upstream disk in order to eliminate any pressure locking concern.

Assumptions:

Each valve will be placed in the closed position (or verified closed) by the control room operator prior to entering the appropriate Tech Spec MODE and each valve will receive, as it does presently, an "S" (safety injection) signal-therefore, in order to implement this alternative, procedure and drawing changes are required.

The design requirements for the valve and its motor operator which were in effect at the time the valve was a normally closed valve are still valid.

The current valve design will support the modification to eliminate any pressure locking concern.

The valve MEDP (maximum expected differential pressure) and actuator will not be changed by this modification. Minor changes in the wedge friction factor may occur, but will not change the valve actuator or its settinas.

PHASE ITEM RESOURCE FUNCTIONAL AREA ESTIMATE ESTIMATE UNIT 1 UNIT 2 StudyIAnalyses 1 Contract Engineering Design $40,000 $40,000

- Labor Studies 2 PlNGP Engr / Ops / Lic $1 2,000 $12,000 Support Design 3 Contract Engr Design - Mech 1 $60,000 $42,000

- Labor Civil 4 Contract Engr Design - Elec / i&C $60,000 $42,000

-- -- - -- Labor 5 PlNGP Engr / Ops / Maint $40,000 $28,000

. Support I

Implement 16 Labor Main / Cont $50,000 $50,000 17 Contract Engineering $2,000 $2,000

- Labor 8 Materials Material & Material Mgmt $1,000 $1,000 9 PlNGP Engr / Ops / Lic $3,000 $3,000 SUDDO~~

Life Cycle 10 Labor Ops / Maint for 20 years 0 0 GRANDTOTAL I 1 $268,000 1 $220,000 Note: The cost estimate for the second unit reflects a saving of approximately 30% on the Design Phase.

Enclosure 1 NSPM Responses to NRC Requests for Additional Information Dated December 24,2008 SAMA Follow Up RAI 6.9 The corrected treatment of uncertainties shows SAMA 19a as potentially cost beneficial.

Discuss Nuclear Management Company's plans for further evaluation or implementation of this SAMA.

NSPM Response to SAMA Follow Up RAI 69 Since the results of the corrected treatment of uncertainties show SAMA 19a as potentially cost beneficial, the benefits for replenishing RWST from a large water source should be considered further. Other engineering reviews are necessary to determine ultimate implementation. SAMA 19a has been entered into the PlNGP Corrective Action Program for further evaluation.

Enclosure 2 OSLOCAXXCDY, Operator Fails To Perform RCS Cooldown And Depressurization CBDTMrrHERP 04/23/05 J. F. Grobbelaar, SClENTECH I

1 Initial Conditions: Steady state, full power operation.

2. Initiating Event: Small LOCA

3. Accident sequence (preceding functional failures and successes):

Reactor trip (reactor trip and bypass breakers are open).

Turbine trip (both turbine stop valves are closed).

Both safeguards buses are energized.

SI is actuated and required.

AFW flow greater than 200 gpm.

PORVs closed RCS pressure > 1250 PSlG

4. Preceding operator error or success in sequence:

Entered 1E-0.

Transferred to 1E-1 from 1E-0 step 12.

Stopped RCPs

5. Operator action success criterion: Cooldown and depressurize the RCS to Mode 5, Cold Shutdown conditions following a loss of reactor coolant inventory.

6. Consequence of failure: High head recirculation would be required.

7. Key assumptions: RCPs not running

Enclosure 2 OSLOCAXXCDY, Operator Fails To Perform RCS Cooldown And Depressurization Other Procedure 1C15 Job Performance Measure RH-5s Classroom Training Frequency: .5 per year The most critical steps in 1ES-1.1 are to start the cooldown (step 6) and to depressurize (step 9).

The depressurization will not work (pressurizer level and subcooling) without cooldown, so failure to cooldown will be "recovered" by depressurization. There are numerous steps in the procedure checking pressurizer level and subcooling, hence recovering depressurization and therefore cooldown.

TW 1 42 Minutes Tdelav 1 15 Minutes Ti12 0 Minutes TM 22 Minutes Time available for recovery 5 Minutes SPAR-H Available time 5 Minutes (cognitive)

SPAR-H Available time I 1 Minutes The time to reach recirculation switchover (33% RWST level) for Small LOCA is 2.7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> (162 minutes) from calculation file V.SPA.93.004, "PI SLOCA WIARN, 2 SI, 2 Accum, 1 FCU, No Recirc". RHR can be put in service when the RCS hot leg temperature is less than 350 F. Time to cool down from 547 F to 350 F at 100 F/hr would take about 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> = 120 minutes. The system time window is taken as the time to reach recirculation switchover reduced by the actual time that it would take to cooldown and depressurize, which is 162 - 120 = 42 minutes. This is conservative as it does not take the effect of the cooldown on flow rate into account, and it does not take the stopping of 1SI pump into account.

Per the operator interviews, it takes 15 minutes to navigate to ES-1 . l , so Td = 15 minutes.

Per JPM RH-5S, the time for completion to put RHR in shutdown cooling is 12 minutes. The manipulation time from 1ES-1.1 step 10 onwards is included in the 120 minutes for cooling down, so it does not have to be accounted for in Tm. The important manipulations are to start the cooldown (step 6) and depressurization (step 9). The first 9 steps are estimated to take less than 10 minutes, so the total manipulation time to be accounted for is Tm = 22 (12 + 10) minutes.

Enclosure 2 OSLOCAXXCDY, Operator Fails To Perform RCS Cooldown And Depressurization Pcd:Information misleading a neg.

PC,: Skip a step in procedure 3.0e-03 P,+: Misinter~retInstructions nea.

PC,: Misinterpret decision logic I neg.

Pch:Deliberate violation a neg.

initial P,(without recovery credited) 3.0e-03 Notes Cognitive Complexity I Simple Equipment Accessibility I Main Control Room: Accessible P C ~I neg. I 1.0 Final PC (with recoverv credited) I 3.0e-03 Notes No cognitive recovery credited.

Environment Lighting Normal Heat Normal

. Radiation Background Atmosphere Normal Equipment Accessibility Main Control Room Accessible Stress 1-nw Notes Stress is low, as all equipment is available and all safety functions are satisfied. Cooldown, depressurization and placing RHR in service are routine actions performed for every cold shutdown. In this scenario, the only difference is that SI is running, which is stopped during the evolution.

Execution Complexity I Simple

Enclosure 2 OSLOCAXXCDY, Operator Fails To Perform RCS Cooldown And Depressurization ExbcutCon Unrecovered Procedure: 1ES-1. I , Error 1 THERP Stress Over Total Step No. Instruction Type Table Item I Factor Ride HEP I Place All PRZR Heaters In Off Pos~t~on EOM 20-7b 1 1.7e-03 1.7e-5 Comments: EOC 20-12 3 1.3E-3 03 Start one condensate pump O.Oe+O EOM 20-7b 1 O.Oe+

6.c RNO Comments: Recovered by step 9 0 1 0 00 EOC 20-12 3 1.3E-3 Dump steam to condenser from intact SGs O.Oe+O EOM 20-7b 2 O.Oe+

6,d Comments: Recovered by step 9 0 1 0 00 EOC 20-12 5 1.3E-3 Depressurize RCS To Refill PRZR: Use one PORV EOM 20-7b 2 2.6e-03 Comments: This step is performed immediately before startlng an I RCP. Transitions from other steps when PRZR level is low are also possible. For all possible entries, the RCS should be subcooled prior to RCS depressurization. Since this prior subcooling requirement ensures a small break, subcooling should be restored with continued 2.6e-RNo 1 cooldown if subcooling is lost during the depressurization. Pressurizer EOC 20-12 3 1.3E-3 03 level (and pressure) will increase after the operator stops the depressurization until injection flow balances break flow and loss due to cooldown shrink. This step is a recovery step for cooldown, as depressurization can not commence without sufficient subcooling margin which is obtained by cooldown. -

PRZR level - GREATER THAN 21% [41%] O.Oe+O EOM 20-7b 2 O.Oe+

1O.c Comments: Potential recovery step 0 1 0 00 EOC 20-1 1 4 3.8E-3 Start 11 RHR pump. EOM 20-7b 2 2.6e-03 2.6e-2.d RNo 03 Comments: EOC 20-12 3 1.3E-3 Stop last SI pump O.Oe+O EOM 20-7b 2 O.Oe+

12.e Comments: 0 1 0 00 EOC 20-12 3 1.3E-3 Depressurize RCS To Minimize Subcooling: Use one PORV EOM 20-7b 2 2.6e-03 2.6e-5'a RNo 20-12 3 1.3E-3 03 Comments: EOC Close accumulator isolation valves: EOM 20-7b 2 2.6e-03 2.6e-18.d Comments: .. MV-32071 1 EOC 20-12 3 1.3E-3 03

.. MV-32072 Check RCS hot leg temperature - LESS THAN 350 F O.Oe+O O.Oe+

EOM 20-7b 2 0 Comments: If not, operators are directed to go to step 26 and will be 0 00

Enclosure 2 OSLOCAXXCDY, Operator Fails To Perform RCS Cooldown And Depressurization b u t i o n Urtrecovered Procedure: 1ES-1.l, Error THERP Stress Over Total Step No. Instruction - Type Table Item Factor Ride HEP 1 d~rectedIn step 27 to return to step 2 rf RCS temperature IS not less than 200 F. This is a potential recovery step for the getting the initial EOC 20-1 1 4 3.8E-3 cooldown and depressurization going.

Align RHR for shutdown cooling per Attachment D 1.3e-25.d EOM 20-7b 2 1.3e-03 1 Comments: 03 OPEN RHR Suction Isolation valves from the RCS: O.Oe+O Comments: .. MV-32164, LOOP A HOT LEG TO RHR, using CS- EOM 20-7b 2 0

46226 D'lo

.. MV-32165, LOOP A HOT LEG TO RHR, using CS-46228

.. MV-32230, LOOP B HOT LEG TO RHR, using CS-46227

.. MV-32231, LOOP B HOT LEG TO RHR, using CS-46229 EOC Recovered by D.18 Throttle CV-31236, 12 RHR HX RC OUTLET FLOW (1HC-625), O.Oe+O D.ll EOM 20-7b 2 O.Oe+

Comments: Recovered by D.18 0 1 O 00 EOC 20-12 3 1.3E-3 Throttle OPEN CV-31237, 11112 RHR HX BYPASS FLOW (1HC- O.Oe+O D.12 EOM 20-7b 2 O.Oe+

626A), to approximately 30%. 0 1 O Comments: Recovered by D.18 00 EOC 20-12 3 1.3E-3 Start 12 RHR Pump using CS-46185. O.Oe+O D.13 EOM 20-7b 2 O.Oe+

Comments: Recovered by D.18 0 1 O 00 EOC 20-12 3 1.3E-3 OPEN MV-32066, RHR TO RC LOOP B COLD LEG, using CS- O.Oe+O EOM 20-7b 2 O.Oe+

D.14 46225. 0 1 O Comments: Recovered by D.18 00 EOC 20-12 3 1.3E-3 Place CV-31237, 11112 RHR HX BYPASS FLOW (1 HC-626A), in O.Oe+O EOM 20-7b 2 O.Oe+

D.16 "AUTO". 0 1 O 00 Comments: Recovered by 0.18 EOC 20-12 3 1.3E-3 Adjust CV-31236, 12 RHR HX RC OUTLET FLOW (1HC-625), to EOM 20-7b 2 2.6e-03 2.6e-D.18 obtain desired cooldown rate. 1 EOC 20-12 3 1.3E-3 03 Comments:

Check RCS Temperatures LESS THAN 200 (If not, return to step 2) O.Oe+O EOM 20-7b O.Oe+

27 Comments: 0 1 O 00 EOC 20-11 4 3.8E-3

Enclosure 2 OSLOCAXXCDY, Operator Fails To Perform RCS Cooldown And Depressurization vw BkecutfonRecovered Recovery Action HEP (Crit) HEP (Rec) Dep.

Cond. HEP Total for ~

I I

Step No.

-- 1 I

Step NO.

I e c Step  ;

I 5 1 Place All PRZR Heaters In Off Pos~t~on 1.7e-03 1.7e-03 1 6.c 1 Start one condensate pump 0.0e+00 0.0e+00 RNO 6,d 1 Dump steam to condenser from intact 0.0e+00 1 0.0e+00 SGs 9.a Depressurize RCS To Refill PRZR: Use 2.6e-03 2.6e-03 RNO one PORV 10.c PRZR level - GREATER THAN 21% 0.0e+00 O.Oe+OO

[41%]

12.d Start 11 RHR pump. 2.6e-03 2.6e-03 RNO 12.e Stop last SI pump O.Oe+OO O.Oe+OO 15.a Depressurize RCS To Minimize 2.6e-03 2.6e-03 RNO subcooling: Use one PORV 18.d Close accumulator isolation valves: 2.6e-03 2.6e-03 25.a Check RCS hot leg - temperature - LESS 0.0e+00 0.0e+00 THAN 350 F 25.d Align RHR for shutdown cooling per 1.3e-03 1.3e-03 Attachment D D.10 OPEN RHR Suction Isolation valves O.Oe+OO 0.0e+00 from the RCS:

D.ll Throttle CV-31236, 12 RHR HX RC O.Oe+OO O.Oe+OO I OUTLET FLOW (1HC-625),

0.12 I Throttle OPEN CV-31237, 11112 RHR 0.0e+00 I O.Oe+OO I 1 HX BYPASS FLOW (1HC-626A)., . to 1 1 1 1 1 1 approximately 30%.

0.13 Start 12 RHR Pump using CS-46185. O.Oe+OO 0.0e+00 D.14 OPEN MV-32066, RHR TO RC LOOP 6 O.Oe+OO 0 .Oe+00 I COLD LEG, using CS-46225.

D.16 1 Place CV-31237, 11112 RHR HX 0.0e+00 1 1 O.Oe+OO BYPASS FLOW (1HC-626A), in "AUTO".

D.18 Adjust CV-31236, 12 RHR HX RC 2.6e-03 2.6e-03 OUTLET FLOW (1HC-625), to obtain desired cooldown rate.

I

Enclosure 2 OSLOCAXXCDY, Operator Fails To Perform RCS Cooldown And Depressurization

Enclosure 3:

OHRECIRCSMY, Operator Fails To Initiate Hiqh Head Recirc. For A Small LOCA 04/23/05 J. F. Grobbelaar, SCIENTECH Total HEP I Error Factor _I Without Recovery I 3.2e-03 6.0e-02 With Recovery 1.7e-04 3.4e-03 3.6e-03 5

1. Initial Conditions: Steady state, full power operation.

2. Initiating Event: Small LOCA (2" break)

3. Accident sequence (preceding functional failures and successes):

Reactor trip (reactor trip and bypass breakers are open).

Turbine trip (both turbine stop valves are closed).

Both safeguards buses are energized.

SI is actuated and required.

AFW flow greater than 200 gpm.

4. Preceding operator error or success in sequence:

Entered 1E-0.

Transferred to 1E-1 Transferred to 1ES-1.1

5. Operator action success criterion: Diagnose need for recirculation switchover and switch over to recirculation 6 . Consequence of failure: Core damage.

Enclosure 3:

OHRECIRCSMY, Operator Fails To Initiate High Head Recirc. For A Small LOCA Tsw = 10.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />.= 618 minutes Td = 2.7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> = 162 minutes The timing for the small LOCA (2" break) comes from calculation file V.SPA.93.004, "PI SLOCA W I A W , 2 SI, 2 Accum, 1 FCU, No Recirc." The time to 33% level is 2.7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> and the time from 33% RWST level until core damage is 7.6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.

Cognitive Complexity ( Complex Equipment Accessibility I Main Control Room: Accessible

Enclosure 3:

OHRECIRCSMY, Operator Fails To Initiate Hiqh Head Recirc. For A Small LOCA Notes Self review is credited as the RWST level is continuously monitored.

Special Requirements 1 Tools I Required 1 Adequate Available Environment Lighting Normal

--- Heat Normal

-- Radiation Background Atmosphere Normal Equipment Accessibility Auxiliary Building Accessible Stress Moderate Notes Execution Complexity I Complex

Enclosure 3:

OHRECIRCSMY, Operator Fails To Initiate Hiqh Head Recirc. For A Small LOCA Exkutkn Unrecovered Procedure: 1ES-1.2, Error THERP Stress Over Total ,

Step No. Instruction Type Table Item Factor Ride HEP Vent the bonnets of Sump 6 to RHR MVs by OPENING AND THEN EOM 20-7b 1 3.5e-03 CLOSING the following valves (Located in CS pump room):

Comments: Regarded as a single perceptual unit:

K'l

.. Sl-32-3, CNTMT SUMP B TO 11 RHR PMP MV-32077 BONNET VENT 1 EOC 2 0 - 1 3 1 1.3E-3 1I

/ .. 9-32-4, CNTMT SUMP B TO 12 RHR PMP MV-32078 BONNET I I I I 1 VENT Align RHR sump pump discharge valves (located above RHR Pits): O.Oe+O EOM 20-7b Comments: Regarded as single perceptual unit: 0 K.7 .. Position WL-87-1, RHR PIT SUMP # I 1 DISCHARGE, to "ANNULUS SUMP"

.. Position WL-87-2, RHR PIT SUMP #12 DISCHARGE, to "ANNULUS SUMP" Unlock and place the following 480V breakers to "ON": EOM 20-7b 1 8.5e-03 I Comments: Regarded as single perceptual unit: I 1

I I

K.8 .. MCC 1K1-E2 (BKR 111J-19), 11 RHR HX TO 11 SI PMP MV- EOC 20-12 12 3.8E-3 2

32206 (Located North of RHR pits) (Key #28)

.. MCC 1KA2-Dl (BKR 1218-34), 12 RHR HXTO 12 SI PUMP MV-32207 (Located ~ a soft Aux operator Shack) (Key #29)

Remove cotter key AND travel stop for the following valves: EOM 20-7b 1 3.5e-03 Comments: Regarded as single perceptual unit:

I I K.9 .. CV-31381,ll CC HX CLG WTR OUTLET CV

.. CV-31411,12 CC HX CLG WTR OUTLET CV A 1 7116" socket and a 1 7116" open-end wrench are needed Position WL-86-1, SAMPLE SINK TO CHEM DRAINIRHR SUMP, to O.Oe+O E~~ 20-7b "CLOSED, Sample Sink Drains to 12 RHR Pit Sump". 0 2 K.10 Comments: Located halfway up the stairs by the Aux Bldg Operator 20-1 ,3E-3 EOC shack

Enclosure 3:

OHRECIRCSMY, Operator Fails To Initiate Hiqh Head Recirc. For A Small LOCA I'

I Procedure: 1ES-1.2, E%ecutlonUnrecovered THERP I

Error Stress Over Step No. Instruction Type Table Item Factor Ride Reset S1 O.Oe+O EOM 20-7b 1 O.Oe+

2 Comments: Non-critical, recovered by step 5 0 2 0 00 EOC 20-12 la neg.

Reset Containment Spray O.Oe+O EOM 20-7b 1 O.Oe+

3 Comments: Non critical - recovered by step 5 0 2 0 00 EOC 20-12 la neg.

Check Both Trains Of Safeguards Pumps Available For Recirculation EOM 20-7b 1 2.6e-03 2.6e-4 Comments: EOC 20-9 3 1.3E-3 03 Stop One Train Of Safeguards Pumps O.Oe+O EOM 20-7 1 Comments: .. RHR pump 0

.. SI pump O.Oe+

5 .. CS pump 2 0 00 EOC 20-12 3 1.3E-3 Recovered by subsequent steps that refer to valve alignments of "idle" pump.

Close RWST To RHR Isolation Valve For Idle RHR Pump: EOM I 20-7b 1 / 3.5e-03 Comments: MV-32084 3.5e-6 2 OR EOC 20-12 3 1.3E-3 03 MV-32085 Close SI Test Line To RWST Valves EOM 20-7b 2 5.2e-03 5.2e-7 Comments: EOC 20-12 3 1.3E-3 03 Verify RHR To Reactor Vessel Injection Valve Alignment: O.Oe+

O.Oe+O 8 Comments: .. MV-32064 - OPEN EOM 20-7b 2 0 00 0

.. MV-32065 - OPEN Check Containment Level - GREATER THAN 1.75 FEET EOM 20-7b 2 7.6e-03 7.6e-10 03 Comments: EOC 20-1 1 4 3.8E-3 Verify RWST to RHR isolation valve for idle RHR pump - CLOSED: EOM 20-7b 2 2.6e-03 2.6e-ll.a Comments: MV-32084 2 EOC 20-11 8 neg. 03 MV-32085 2.6e-11.'

Check Sump B to RHR MV bonnets vented per ATTACHMENT K Ienmmnn+r.

EOM 20-7b 2 / 2.6e-03 2 03

Enclosure 3:

OHRECIRCSMY, Operator Fails To Initiate Hiqh Head Recirc. For A Small LOCA w '

Wecutlon Unrecovered I Procedure: 1ES-1.2, Error THERP Stress Over Total Step No. Instruction Type Table Item Factor Ride HEP Open Sump B to RHR sola at ion valves for ~dleRHR pump: EOM 20-7b 2 5.2e-03 1l.c Comments: .. MV-32075 AND MV-32077 5.2e-2

-0R- EOC 20-12 3 1.3E-3 03

.. MV-32076 AND MV-32078 13.a Verify Sump B to RHR isolation valves are full open EOM 20-7b 2 2.6e-03 2.6e-Comments: MV-32075 and MV-32077 OR MV-32076 and MV-32078 EOC 20-1 1 8 neg. 03 Start idle RHR pump EOM 20-7b 2 5.2e-03 5.2e-3'b Comments: EOC 20-12 3 1.3E-3 03 Close SI pump suction isolation valve for idle SI pump EOM 20-7b 2 5.2e-03 Comments: MV-32162 5.2e-14.a 2

-0R- EOC 20-12 3 1.3E-3 03 MV-32163 Open RHR supply to idle SI pump EOM 20-7b 2 5.2e-03 5.2e-4'b Comments: EOC 20-12 3 1.3E-3 03 Start idle SI pump EOM 20-7b 2 5.2e-03 5.2e-4'c Comments: EOC 20-12 3 1.3E-3 03 Check SI flow - FLOW INCREASE (1 Fl-925) EOM 20-7b 2 1.0e-02 1.0e-4'd Comments: recovers crm actions. LD EOC 20-1 1 4 3.8E-3 02

Enclosure 3:

OHRECIRCSMY, Operator Fails To Initiate Hiqh Head Recirc. For A Small LOCA w mcomlid "p Recovery Cond. HEP Total for Step Step NO. Action HEP (Crit) HEP (Rec) Dep.

No. (Rec) Step K. 1 Vent the bonnets of Sump B to RHR 3.5e-03 1.8e-04 MVs by OPENING AND THEN CLOSING the following valves (Located in CS pump room):

1l.b Check Sump B to RHR MV bonnets 2.6e-03 LD 5.2e-02 vented per ATTACHMENT K K.8 Unlock and place the following 480V 8.5e-03 4.5e-04 breakers to "ON":

1l.b Check Sump B to RHR MV bonnets 2.6e-03 LD 5.2e-02 vented per ATTACHMENT K K.9 Remove cotter key AND travel stop for 3.5e-03 1.8e-04 the following valves:

1l.b Check Sump B to RHR MV bonnets 2.6e-03 LD 5.2e-02 vented per ATTACHMENT K 4 Check Both Trains Of Safeguards 2.6e-03 1.5e-04 Pumps Available For Recirculation 14.d Check SI flow - FLOW INCREASE (1 FI- 1.0e-02 LD 6.0e-02

/ 925) 6 I Close RWST To RHR Isolation Valve For I 3.5e-03 1.8e-04 Idle RHR Pump:

I 1.a Verify RWST to RHR isolation valve for 2.6e-03 LD 5.2e-02 idle RHR pump - CLOSED:

7 Close S1 Test Line To RWST Valves 5.2e-03 3.1e-04 14.d Check SI flow - FLOW INCREASE (1 FI- 1.0e-02 LD 6.0e-02 1 925) 10 / Check Containment Level - GREATER I 7.6e-03 4.5e-04 1 THAN 1.75 FEET I 14.d I Check SI flow - FLOW INCREASE (1FI- / 1.0e-02 LD 6.0e-02 925)

I 1 .c Open Sump B to RHR isolation valves 5.2e-03 2.7e-04 for idle RHR pump:

13.a Verify Sump B to RHR isolation valves 2.6e-03 LD 5.2e-02 are full open

Enclosure 3:

OHRECIRCSMY, Operator Fails To Initiate High Head Recirc. For A Small LOCA

/ 925) 14.a I Close SI pump

. . suction isolation valve for I 5.2e-03 3.1e-04 I idle SI pump I 14.d I Check SI flow - FLOW INCREASE (1 FI- I 1.0e-02 LD 6.0e-02 925) 14.b Open RHR supply to idle SI pump 5.2e-03 3.1 e-04 14.d Check SI flow - FLOW INCREASE (1FI- 1.0e-02 LD 6.0e-02 925) 14.c Start idle SI pump 5.2e-03 3.1e-04 14.d Check SI flow - FLOW INCREASE (1 FI- 1.0e-02 LD 6.0e-02 I 1 925) 1 Total Unrecovered: 6.0e-02 Total Recovered: 3.4e-03