ML090390019
| ML090390019 | |
| Person / Time | |
|---|---|
| Site: | Prairie Island  |
| Issue date: | 01/23/2009 |
| From: | - No Known Affiliation |
| To: | Office of Nuclear Reactor Regulation |
| References | |
| Download: ML090390019 (90) | |
Text
1 PrairieIslandNPEm Resource From:
Travers, Greg [Greg.Travers@xenuclear.com]
Sent:
Friday, January 23, 2009 10:22 AM To:
Richard.Plasse@nrc.gov; Nathan.Goodman@nrc.gov; Stuart.Sheldon@nrc.gov Cc:
Eckholt, Gene F.; Davis, Marlys E.; Holthaus, James J.
Subject:
PINGP Letter Responding to NRC RAIs Dated 12-24-08 Attachments:
20090123 Response to RAI Letter dtd 12-24-08.doc; 20090123 Response to RAI Letter dtd 12-24-08.pdf
<<20090123 Response to RAI Letter dtd 12-24-08.doc>> At <<20090123 Response to RAI Letter dtd 12 08.pdf>> tached are pdf and WORD versions of the NSPM letter responding to the SAMA Follow Up RAIs dated 12-24-08.
Let me know if you have any problems with the files.
Greg Travers License Renewal Project 651-388-1121 X7262
Hearing Identifier:
Prairie_Island_NonPublic Email Number:
589 Mail Envelope Properties (9FA1D9F2F220C04F95D9394E3CF02DABF68FD8)
Subject:
PINGP Letter Responding to NRC RAIs Dated 12-24-08 Sent Date:
1/23/2009 10:21:51 AM Received Date:
1/23/2009 10:22:04 AM From:
Travers, Greg Created By:
Greg.Travers@xenuclear.com Recipients:
"Eckholt, Gene F." <Gene.Eckholt@xenuclear.com>
Tracking Status: None "Davis, Marlys E." <Marlys.Davis@xenuclear.com>
Tracking Status: None "Holthaus, James J." <James.Holthaus@xenuclear.com>
Tracking Status: None "Richard.Plasse@nrc.gov" <'Richard.Plasse@nrc.gov'>
Tracking Status: None "Nathan.Goodman@nrc.gov" <'Nathan.Goodman@nrc.gov'>
Tracking Status: None "Stuart.Sheldon@nrc.gov" <'Stuart.Sheldon@nrc.gov'>
Tracking Status: None Post Office:
enex02.ft.nmcco.net Files Size Date & Time MESSAGE 336 1/23/2009 10:22:04 AM 20090123 Response to RAI Letter dtd 12-24-08.doc 955456 20090123 Response to RAI Letter dtd 12-24-08.pdf 715277 Options Priority:
Standard Return Notification:
No Reply Requested:
No Sensitivity:
Normal Expiration Date:
Recipients Received:
1717 Wakonade Drive East
- Welch, Minnesota 55089-9642 Telephone: 651.388.1121 January 23, 2009 L-PI-09-007 10 CFR 54 U S Nuclear Regulatory Commission ATTN: Document Control Desk Washington, DC 20555-0001 Prairie Island Nuclear Generating Plant Units 1 and 2 Dockets 50-282 and 50-306 License Nos. DPR-42 and DPR-60 Responses to NRC Requests for Additional Information Dated December 24, 2008 Regarding Application for Renewed Operating Licenses By letter dated April 11, 2008, Northern States Power Company, a Minnesota Corporation, (NSPM) submitted an Application for Renewed Operating Licenses (LRA) for the Prairie Island Nuclear Generating Plant (PINGP) Units 1 and 2. In a letter dated October 23, 2008, the NRC transmitted Requests for Additional Information (RAIs) regarding the Severe Accident Management Alternatives analysis provided as part of the Environmental Report included in the LRA. NSPM responded to those RAIs in a letter dated November 21, 2008. On December 24, 2008, the NRC transmitted follow up RAIs related to the NSPM responses. This letter provides responses to those follow up RAIs.
provides the text of each follow up RAI followed by the NSPM response.
Enclosures 2 and 3 provide detailed information about two operator actions discussed in the response to SAMA follow up RAI 5a.
If there are any questions or if additional information is needed, please contact Mr. Eugene Eckholt, License Renewal Project Manager.
Summary of Commitments This letter contains no new commitments or changes to existing commitments.
I declare under penalty of perjury that the foregoing is true and correct.
Executed on January 23, 2009.
/S/ Michael D. Wadley Michael D. Wadley Site Vice President, Prairie Island Nuclear Generating Plant Units 1 and 2 Northern States Power Company - Minnesota
Document Control Desk Page 2 Enclosures (3) cc:
Administrator, Region III, USNRC License Renewal Project Manager, Prairie Island, USNRC Resident Inspector, Prairie Island, USNRC Prairie Island Indian Community ATTN: Phil Mahowald Minnesota Department of Commerce NSPM Responses to NRC Requests for Additional Information Dated December 24, 2008 1
SAMA Follow Up RAI 1e The response (p. 10) noted a probabilistic risk assessment (PRA) maintenance and an updated fact and observation (F&O) had been identified and resolved. Describe the F&O and its resolution. In addition, describe the scope and personnel qualifications of the three reviews identified as being part of the self-assessment process (p. 11).
NSPM Response to SAMA Follow Up RAI 1e PRA Program Maintenance & Update F&O A description of the PRA Program Maintenance and Update Fact & Observation from the Westinghouse Owners Group Prairie Island PRA Peer Review of September 2000 is provided below with a summary of its resolution.
==
Description:==
A PRA group procedure requires evaluation of PRA results when the model is updated. The procedure indicates that the evaluation must include a review of the top cutsets and basic event importance measures to ensure that dominant contributors to risk are modeled accurately and that dependant operator actions are treated appropriately. The procedure also requires a focus on understanding and addressing risk significant issues that have resulted from the latest requantification.
For a full PRA update, consideration should also be given to reviewing more than just dominant contributors and top cutsets, depending on the extent of the modeling change. For example, any updated model revision may produce results that will require a deeper review than an examination of top cutsets, top risk importance contributors, and overall CDF/LERF values.
Resolution:
Two procedures were developed to address the maintenance and update process of the PRA model.
- 1. A fleet procedure was created in order to provide a PRA guideline for model maintenance and update. The purpose of this guideline is to identify requirements for maintaining and upgrading the PRA model to ensure that its representation of the as-built, as-operated plant is sufficient to support applications for which it is being used.
- 2. A site procedure was created in order to provide a guideline to perform a PRA model quantification. The purpose of this guideline is to provide instructions on how to structure the Quantification of the PRA model following a periodic or maintenance update of the PRA model. The PRA Quantification is designed to examine the models result and to confirm that it reflects the design, operation, and maintenance of the plant. The PRA Model Quantification Guideline NSPM Responses to NRC Requests for Additional Information Dated December 24, 2008 2
prescribes reviews on cutsets, recovery actions, mutually exclusive events, circular logic, asymmetries, initiating event distributions, and important operator actions, just to name a few. It was created to meet the High Level requirements for the model Quantification Element as stated in the ASME Standard for PRA.
Self Assessments Descriptions of the scope and personnel qualifications for three self-assessments are provided below:
PRA Program Snapshot Evaluation (April 2007)
Topic:
PINGP PRA benchmark against Regulatory Guide 1.200, Revision 1, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities.
Scope:
Evaluate the following with respect to impact on conformance with industry standards and expectations:
- Open PRA Model Review items
- Potential for MSPI margin improvement Standards:
Regulatory Guide 1.200, Revision 1, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities
- ASME RA-S-2005, Standard for Probabilistic Risk Assessment for Nuclear Power Applications
- NEI 00-02, Self-Assessment Process for Addressing ASME PRA Standard RA-SB-2005, as Endorsed by NRC Regulatory Guide 1.200 Objectives:
- Perform a complete review of selected PRA Technical Elements as defined by Regulatory Guide 1.200, Revision 1 and ASME RA-S-2005 capability category II.
- Determine if there are any PRA model issues for the MSPI systems that could improve MSPI margin if corrected or implemented.
Team Resources:
The review team consisted of several members who had extensive knowledge in PRA methods. There were four team members with 18 years or greater experience in PRA. One team member had 9 years of PRA experience and two members had 3 years or less. The total number of years of PRA experience for the team was approximately 90 years. This does not include the number of years of experience in other areas of the nuclear industry.
NSPM Responses to NRC Requests for Additional Information Dated December 24, 2008 3
PRA Program Focused Self-Assessment (May 2004)
Topic:
Assess the PI PRA Program against the Nuclear Management Company (NMC)
Fleet PRA Standard and industry best practices. This was the first self-assessment of the PI PRA program and helped maintain the program health status in the Assessment category green.
Scope:
The assessment consisted of a combination of document reviews, interviews, and field observations. Data included, but was not limited to:
- Procedure and document reviews
- Personal observations or interviews
- CAP and/or other database reviews
- Industry best practices Standards:
- NMC Fleet Probabilistic Risk Assessment Standard
- PI Procedure for the Program Health Process
- PI Procedure for the Action Request System Objectives:
- Has the facility established and is it implementing and maintaining the PRA program consistent with the requirements of the above listed Standards?
- Are the Program related outputs consistent with the related standard (Program Health, Gap Analysis, Program Notebook, spreadsheets, goals, etc.)
Team Resources:
The review team consisted of several members who had extensive knowledge in PRA methods. There were three team members with 14 years or greater experience in PRA. The other team member had 6 years of PRA experience.
The total number of years of PRA experience for the team was approximately 51 years. This does not include the number of years of experience in other areas of the nuclear industry.
Nuclear Oversight Observation Report (June 2003)
Topic:
PINGP PRA Risk Assessment Program reviewed against NUMARC 93-01, Industry Guideline for Monitoring the Effectiveness of Maintenance Activities at Nuclear Power Plants.
NSPM Responses to NRC Requests for Additional Information Dated December 24, 2008 4
Scope:
The assessment consisted of a combination of document reviews, interviews, and observed performance and review of results. Data included, but was not limited to:
- Procedure and document reviews
- Personal observations or interviews
- CAP and/or other database reviews Documents Reviewed:
- NUMARC 93-01, Industry Guideline for Monitoring the Effectiveness of Maintenance Activities at Nuclear power Plants, Rev 3, July 2000.
- NMC Fleet Probabilistic Risk Assessment Standard
- PI Procedure for On-Line Scheduling Process
- PI Procedure for Engineering Support Personnel Training Plan
- Regulatory Guide 1.182, Assessing and Managing Risk Before Maintenance Activities at Nuclear Power Plants, May 2000.
- PI Procedure for the Assessment and Management of Risk Associated with Maintenance Activities
Objectives:
- Perform a review of site procedures related to the assessment and management of risk associated with maintenance activities against NUMARC 93-01 guidance.
- Interview and/or observe Work Week Schedulers and Operation personnel on the performance of Maintenance Rule (a)(4) risk assessments.
Team Resources:
The review team consisted of one Nuclear Oversight (NOS) Senior Assessor.
The NOS Senior Assessor had 16 years of nuclear experience. This included 2 years experience in NOS and 14 years experience in the Engineering and Chemistry departments.
SAMA Follow Up RAI 1f The Prairie Island Nuclear Generating Plant (PINGP) PRA uses a Westinghouse reactor coolant pump seal loss-of-coolant accident (LOCA) model (WCAP-10541, 1986), that pre-dates the Westinghouse Owners Group (WOG) 2000 model approved by the NRC in 2003 for plants using high-temperature O-rings. The peer review of the PINGP PRA occurred prior to the approval of the WOG 2000 model, and as such would not have NSPM Responses to NRC Requests for Additional Information Dated December 24, 2008 5
identified this as an issue. Provide an assessment of the impact on the severe accident mitigation alternative (SAMA) identification and screening if the PINGP PRA utilized the WOG 2000 model.
NSPM Response to SAMA Follow Up RAI 1f All four of Prairie Islands installed RCPs have been upgraded with high temperature O-rings. High temperature O-rings and hard seal parts manufactured by Areva have been evaluated and accepted as interchangeable with the same parts manufactured by Westinghouse. Westinghouse and Areva O-rings and hard seal parts are installed in various combinations in all four of Prairie Islands installed pumps.
However, application of the WOG 2000 seal LOCA model is reserved for Westinghouse-supplied packages with high temperature O-ring seals. In its SER endorsing the WOG 2000 model (WCAP-15603 Rev. 1A), the NRC stated:
WCAP-15603, Revision 1, was published to provide a consensus RCP seal leakage model for those plants that utilize the Westinghouse seal packages with high-temperature O-rings. The WOG 2000 model does not address the Westinghouse seal packages utilizing old O-rings. The staff expectation is that the Rhodes model will be used to model the Westinghouse seal packages that use old O-rings.
The Areva O-ring seals have been qualified by Jeumont for the same high temperature service as the Westinghouse O-rings and there is no difference in design basis performance characteristics. However, there may be a difference in the beyond design basis ultimate failure pressure characteristics. At this point in time, this difference has not been resolved. Therefore, for the purposes of responding to this question, a sensitivity analysis involving a modification to the PRA RCP seal leakage models to conservatively incorporate the Rhodes model (as presented in WCAP-16141, Section 5.0) was developed. In this model, four potential leakage scenarios are postulated:
Table 1f-1 RCP Seal Leakage Scenarios for the Unqualified Seal Material Timing After Loss of All RCP Seal Cooling Probability 0-13 minutes 13 minutes - 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />
> 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> gpm/pump gpm/pump gpm/pump 21 21 300 0.78 21 76 300 0.02 21 182 300 0.195 21 480 480 0.005
Reference:
WCAP-16141, Table 5-1 These leakage scenarios are referred to as 21/300, 76/300, 182/300, and 480 in the WCAP SBO event tree for a typical plant with unqualified RCP seals.
NSPM Responses to NRC Requests for Additional Information Dated December 24, 2008 6
Figure 1f-1 below is a reproduction of Figure 5-1 from WCAP-16141:
Figure 1f-1 SBO Event Tree Addressing RCP Seal Leakage for Unqualified Seal Material NSPM Responses to NRC Requests for Additional Information Dated December 24, 2008 7
Since the IPE, the PINGP seal LOCA model has relied on the results of thermal hydraulic analysis cases run using MAAP code 3.0b. This version of the MAAP code is known to be significantly conservative with respect to the timing of core uncovery and core damage following initiation of RCP seal LOCA events. PINGP is currently in the process of updating its MAAP thermal hydraulic analyses to new cases run using Revision 4.0.6 of the MAAP4 computer code. Currently only a limited set of SBO cases have been run and the available case results are considered preliminary. Therefore, a set of generic thermal hydraulic analysis cases using MAAP4 was used as a check of the preliminary, plant-specific results. WCAP-16141, Appendix A provides generic core uncovery times for Westinghouse reactor classes, including 2-loop plants such as Prairie Island. The document states:
Since the NRC SE item # 7 requires plant-specific analyses for core uncovery times, the value of this appendix can be seen as follows:
- 1. It provides the minimum factors to be considered in MAAP analyses for specific scenarios for core uncovery.
- 2. It reports generic core uncovery times that can be compared against plant-specific calculations as a sanity check.
Thus, the contents of this appendix could assist in obtaining uniformity of calculation models and results throughout the industry.
Moreover, it is not expected that plant-specific analyses will yield substantially different core uncovery times than those reported in this appendix.
The seal LOCA analysis results for 2-loop plants from WCAP-16141, Appendix A (specifically Table 3) were used as a check on the reasonableness of the timing of core uncovery and core damage provided by the preliminary plant-specific MAAP cases.
NSPM Responses to NRC Requests for Additional Information Dated December 24, 2008 8
Table 1f-2 below provides a summary of the available MAAP case runs and results and a comparison with the generic case results:
Table 1f-2 Summary of Available Plant-Specific and Generic MAAP Cases for RCP Seal LOCA Pump Seal Leakage Rate (1)
(gpm)
Secondary Side Heat Sink (2)
RCS Cooldown and Depress-urization Time of AC Recovery (hrs)
(4)
Time of Core Uncovery (hrs)
(5)
Time to Core Damage (hrs)
(6)
PINGP-Specific WCAP-16141 PINGP-Specific WCAP-16141 PINGP-Specific WCAP-16141 PINGP-Specific WCAP-16141 0 / 21 21 / 21 Yes Yes(3a) 6 No (no CU) 32.2 (no CD) 33.8 0 / 480 21 / 480 Yes Yes(3) 6 No 5.3 6.2 (no CD) 7.5 0 / 480 21 / 480 Yes No 5 (7)
No 1.8 1.9 2.3 2.4 0 / 480 21 / 480 No No 1
No N/A (8) 1.8 N/A (8) 2.2 (1) Presented in WCAP-16141, Appendix A, Table 3 format (initial seal leakage rate/leakage rate after X minutes; X=13 for PINGP, X=30 for WCAP)
(2) TDAFWP runs until DC control power is lost (2 hrs assumed for PINGP)
(3) Cooldown/Depressurization assumed started at t=30 minutes (3a) Cooldown/Depressurization assumed started at t=420 minutes (One hour after AC Power Restored)
(4) AC power restored for initiation of RCS makeup to prevent core uncovery; WCAP-16141 cases did not model this as purpose was to determine time required (5) PINGP runs assume injection systems restored after AC recovery; WCAP-16141 does not credit AC recovery (6) Defined as hottest core node Temperature > 1800 oF or hottest core exit Temperature >
1200 F for 30 minutes (PINGP); core exit thermocouples > 1200 oF (WCAP-16141)
(7) Although AC is restored in MAAP case, it occurs too late to prevent core damage (8) No available MAAP cases for PINGP for these conditions; assumed core damage if TDAFWP fails and AC not recovered within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> The preliminary results for the available plant-specific MAAP cases were found to be reasonably close to the WCAP generic 2-loop plant results. In cases where AC is not recovered in time, core uncovery and core damage occur slightly earlier in these scenarios for the PINGP MAAP cases than for the generic cases. Key contributors to this difference are the assumptions of a higher initial core power level (1683 MWt vs.
1518 MWt) and a lower AFW capacity (200 gpm vs. 400 gpm) for PINGP than for the generic case. The plant-specific case runs ended between t=12 hours to t=24 hours (depending on the scenario), whereas the WCAP generic runs were allowed to run for a longer period.
Based on these results, a SBO event tree model for PINGP based on the Rhodes model presented in WCAP-16141, Section 5.0, was developed, except that only those event tree branches corresponding to the largest seal leakage assumption (480 gpm/pump) were included, as there are no available plant-specific or generic MAAP cases that model the Rhodes assumption of a 300 gpm leak occurring at 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. This treatment provides a very conservative, bounding model for SBO; however, the results are NSPM Responses to NRC Requests for Additional Information Dated December 24, 2008 9
responsive to the RAI question. Figure 1f-2 below provides a graphical representation of the event tree model that was used for this sensitivity case:
LTI Long Term Inventory STI Short Term Inventory ACR AC Power Recovery (to initiate HPI prior to core uncovery)
RLO RCP Seal Leakage Scenarios ASSU ME 480 G PM CASE ASSU ME 480 G PM CASE ASSU ME 480 G PM CASE OA7 Operator Action:
Cooldown and Depress. RCS AFT TD AFW Pump Runs for 2 hrs INITIATOR Station Blackout Class Name O K SBO -RAI-1 Core Damage SBO -RAI-2 Core Damage SBO -RAI-3 Core Damage SBO -RAI-4 O K SBO -RAI-5 Core Damage SBO -RAI-6 Core Damage SBO -RAI-7 Core Damage SBO -RAI-8 O K SBO -RAI-9 Core Damage SBO -RAI-10 Core Damage SBO -RAI-11 Core Damage SBO -RAI-12 Figure 1f-2 SBO Event Tree for Sensitivity Analysis (Bounding 480 GPM/Pump Leakage Case Assumption)
Note that the four potential leakage scenarios modeled in WCAP-16141 Figure 5-1 (21/300, 76/300, 182/300, and 480) have been conservatively reduced to only one, the 480 gpm case, based on a lack of available plant-specific MAAP analyses for the other cases. This treatment effectively assumes that, on any SBO event, a 480-gpm per pump leakage event occurs at t=13 minutes with a probability of 1.0. Only the RLO (assumed leakage scenario) and ACR (AC Power Recovery) event tree headings represent changes to the existing SBO event tree logic in the PRA model; all of the failure logic associated with the other event tree headings already exist in the PRA model and were not changed for this sensitivity analysis. Required power recovery times were chosen based on the results of the (preliminary) plant-specific MAAP analyses for the 480 gpm per pump leakage case (see Table 1f-2). It was assumed that power must be restored within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> in order for the operator to successfully start and align injection systems to prevent core damage in the event that the turbine-driven AFW pump successfully operates for 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />, and operator action to cool down and depressurize the RCS at 30 minutes is successful. It was assumed that power must be restored within the first hour in the cases where either AFW fails to operate or cooldown and depressurization is NSPM Responses to NRC Requests for Additional Information Dated December 24, 2008 10 unsuccessful. Failure of power recovery results in core damage regardless of the leakage scenario.
Table 1f-3 provides the results of the sensitivity analysis (SBO contribution) compared to the original PRA SBO contribution as presented in the response to SAMA RAI 1b in the NSPM letter dated November 21, 2008:
Table 1f-3 Change in SBO CDF Contribution Over Baseline Model SBO CDF Contribution (per rx-yr)
Comment Sensitivity Case 1.04E-06 Sensitivity case assumes 480 gpm/pump leakage for all SBO events; core uncovery/damage timing is based on MAAP 4.0 TH analysis Baseline (Rev. 2.2 SAMA) 8.52E-07 Baseline assumes WCAP-10541 leakage and seal failure probabilities; core uncovery/damage timing is based on MAAP 3.0b TH analysis Change:
1.90E-07
= (22% increase over baseline)
The results of the sensitivity analysis show that when the impact of moving to the more accurate RCP seal LOCA thermal hydraulic calculations of MAAP 4.0 is taken into consideration, the contribution of SBO remains small even when assuming much higher seal leakage rates very early in the event. As shown in Table 1f-1 above, the probability that an RCP seal leakage event scenario will be less severe than 480 gpm (even for unqualified seals) is over 99%. Therefore, when sufficient plant-specific MAAP analysis case runs are available to allow modeling of the lower leakage rates specified in the Rhodes model (similar to that shown in Figure 1f-1 above), it is anticipated that the SBO contribution to the overall CDF will actually be significantly lower than it was calculated to be in the Rev. 2.2 SAMA version.
Based on the results of the sensitivity analysis presented above, NSPM believes that there would have been no impact on the SAMA identification and screening presented in the ER had an RCP seal leakage model consistent with more currently acceptable methodologies been utilized in the PINGP PRA model.
SAMA Follow Up RAI 1h Based on the description provided, the dominant internal flooding sequence (involving cooling water header rupture) would result in core damage at both units. The benefits of any related SAMAs should therefore be doubled. Identify all sequences resulting in core damage at both units. Confirm that the benefits for related SAMAs were appropriately assessed, i.e., doubled where appropriate. (Also see RAI 5.b)
NSPM Responses to NRC Requests for Additional Information Dated December 24, 2008 11 NSPM Response to SAMA Follow Up RAI 1h The PINGP PRA model is a linked fault tree model that quantifies Unit 1 and Unit 2 core damage risk independently. The impact of loss of equipment that is shared, such as the Cooling Water system, is modeled explicitly in the failure logic for both units and is reflected separately in the risk metrics for each unit. Similarly, equipment that exists on one unit but that can be cross-tied or otherwise put into service to support the other unit is modeled explicitly. This allows the model to account for the fact that, on a dual-unit initiating event, equipment on one unit that would otherwise be available to provide a support function for the opposite unit, may not be available. All SAMAs were evaluated with attention to the potential decrease in risk to each unit individually. Therefore, there is no need to double the core damage risk benefit for any of the SAMAs evaluated.
Also, a number of SAMAs were developed that have a positive risk benefit to both units (generally these SAMAs involve enhancements to equipment that is either shared by both units or that is crosstie-able between units). Typically these SAMAs are implemented by a single modification that provides benefits to both units. As previously discussed, the costs associated with these modifications were evenly apportioned between the units (this is appropriate since the risk-reduction benefit to each unit is determined separately). This process ensures that the benefits for these SAMAs were appropriately assessed.
SAMA Follow Up RAI 2b The last paragraph of the RAI response provides a qualitative comparison of the conditional probabilities of the steam generator tube rupture (SGTR) under specific primary and secondary side conditions, but does not include a characterization of the PINGP-specific results for induced SGTR. Provide the frequency-weighted conditional probability of temperature induced-SGTR (over all sequences involving high primary side and low secondary side pressure, and a dry secondary side) for PINGP. Provide an assessment of the impact on the SAMA identification and screening if a conditional probability of 0.25 (similar to NUREG-1570) is assumed for these sequences.
NSPM Response to SAMA Follow Up RAI 2b NSPM understands this question to be asking for the impact to the SAMA results given the assumption that containment bypass due to induced SGTR from any cause (not only TI-SGTR as identified in the question) occurs with a probability of 0.25 following any core damage sequence involving high primary side and low secondary side steam generator pressure, and a dry steam generator secondary side. This is consistent with the NUREG-1570 induced SGTR baseline case results for Surry presented in NUREG-1570 Table 5.8 and described in NUREG-1570 Section 6.1. As discussed during the December 9, 2008, conference call with the NRC staff, NSPM could not identify any NUREG-1570 results showing a 0.25 conditional probability of TI-SGTR alone.
NSPM Responses to NRC Requests for Additional Information Dated December 24, 2008 12 Tables 2b-1 and 2b-2 below show the Unit 1 and Unit 2 95th percentile cost-benefit results, respectively, as modified by the NSPM responses to SAMA RAI questions 6.b and 6.g in the NSPM letter of November 21, 2008. Note that the positive net values (indicated by bold italics) for SAMAs 9 and 22 on both units, and SAMA 19a on Unit 2, indicates that they were found to be cost beneficial on those units. In the tables below, the increased cost of implementation of SAMA 2 described in the response to SAMA RAI 6.b has been reflected in the tables, as has the corresponding increase in the cost of implementation for SAMA 12 (SAMA 12 assumes the modifications associated have also been installed). In addition, the cost associated with SAMA 20 has been modified as described in the response to SAMA Follow-Up RAI 6c below.
Table 2b-1 Unit 1 95th Percentile Results per SAMA Uncertainty SAMA ID Cost of Implementation Ratio of 95th to SAMA CDF Unit 1 Averted Cost-Risk Net Value SAMA 1
$4,250,000 2.89
$775,079
-$3,474,921 SAMA 2
$1,200,000 2.69
$332,481
-$867,519 SAMA 3
$250,000 2.75
$205,793
-$44,207 SAMA 5
$1,500,000 2.86
$216,922
-$1,283,078 SAMA 9
$62,500 2.87
$180,002
$117,502 SAMA 10
$2,866,000 2.84
$132,985
-$2,733,015 SAMA 12
$1,800,000 2.79
$519,433
-$1,280,567 SAMA 15
$130,000 2.90
$0
-$130,000 SAMA 17
$2,362,000 2.89
$254,417
-$2,107,583 SAMA 19
$700,000 2.86
$172,754
-$527,246 SAMA 19a
$1,935,000 2.77
$914,173
-$1,020,827 SAMA 20
$244,00 2.85
$153,784
--$90.216 SAMA 21
$3,000,000 2.91
$32,882
-$2,967,118 SAMA 22
$39,000 2.89
$44,386
$5,386 Table 2b-2 Unit 2 95th Percentile Results per SAMA Uncertainty SAMA ID Cost of Implementation Ratio of 95th to SAMA CDF Unit 2 Averted Cost-Risk Net Value SAMA 1
$4,250,000 2.82
$763,219
-$3,486,781 SAMA 2
$1,200,000 2.79
$343,506
-$856,494 SAMA 3
$250,000 2.71
$207,943
-$42,057 SAMA 5
$1,500,000 2.89
$642,520
-$857,480 SAMA 9
$62,500 2.75
$173,012
$110,512 SAMA 10
$2,866,000 2.86
$138,918
-$2,727,082 SAMA 12
$1,800,000 2.92
$881,438
-$918,562 SAMA 15
$130,000 2.84
$54,901
-$75,099 SAMA 17
$2,362,000 2.86
$1,397,133
-$964,867 SAMA 19
$700,000 2.87
$173,931
-$526,069 SAMA 19a
$1,935,000 2.74
$2,542,917
$607,917 SAMA 20
$244,000 2.85
$155,678
-$88,322 SAMA 21
$3,000,000 2.76
$34,610
-$2,965,390 SAMA 22
$39,000 2.84
$192,028
$153,028 NSPM Responses to NRC Requests for Additional Information Dated December 24, 2008 13 Tables 2b-3 and 2b-4 provide the same information for each unit, but the averted cost-risk values include the increased value due to the assumption that ISGTR occurs with a conditional probability of 0.25 following a High-Dry core damage event.
Table 2b-3 Unit 1 95th Percentile Results per SAMA Uncertainty SAMA ID Cost of Implementation Ratio of 95th to SAMA CDF Unit 1 Averted Cost-Risk Net Value SAMA 1
$4,250,000 2.89
$1,868,573
-$2,381,427 SAMA 2
$1,200,000 2.69
$578,252
-$621,748 SAMA 3
$250,000 2.75
$386,974
$136,974 SAMA 5
$1,500,000 2.86
$114,588
-$1,385,412 SAMA 9
$62,500 2.87
$340,502
$278,002 SAMA 10
$2,866,000 2.84
$204,758
-$2,661,242 SAMA 12
$1,800,000 2.79
$794,683
-$1,005,317 SAMA 15
$130,000 2.90
$0
-$130,000 SAMA 17
$2,362,000 2.89
$265,104
-$2,096,896 SAMA 19
$700,000 2.86
$172,668
-$527,332 SAMA 19a
$1,935,000 2.77
$1,756,854
-$178,146 SAMA 20
$244,000 2.85
$153,784
-$90,216 SAMA 21
$3,000,000 2.91
$222,090
-$2,777,910 SAMA 22
$39,000 2.89
$152,585
$113,585 Table 2b-4 Unit 2 95th Percentile Results per SAMA Uncertainty SAMA ID Cost of Implementation Ratio of 95th to SAMA CDF Unit 2 Averted Cost-Risk Net Value SAMA 1
$4,250,000 2.82
$2,034,256
-$2,215,744 SAMA 2
$1,200,000 2.79
$646,787
-$553,213 SAMA 3
$250,000 2.71
$422,548
$172,548 SAMA 5
$1,500,000 2.89
$520,978
-$979,022 SAMA 9
$62,500 2.75
$355,554
$293,054 SAMA 10
$2,866,000 2.86
$224,331
-$2,641,669 SAMA 12
$1,800,000 2.92
$1,236,665
-$563,335 SAMA 15
$130,000 2.84
$117,199
-$12,801 SAMA 17
$2,362,000 2.86
$1,429,419
-$932,581 SAMA 19
$700,000 2.87
$172,989
-$527,011 SAMA 19a
$1,935,000 2.74
$3,534,505
$1,599,505 SAMA 20
$244,000 2.85
$156,367
-87,633 SAMA 21
$3,000,000 2.76
$263,556
-$2,736,444 SAMA 22
$39,000 2.84
$356,733
$317,733 Note that, under the hypothetical assumption that 25% of High-Dry core damage sequences lead to ISGTR, SAMA 3 (Provide Alternate Flow Path from RWST to Charging Pump Suction) becomes cost-beneficial on both units.
However, this assumption is based on results generated in NUREG-1570, which used the Surry plant (3-loop PWR) as the baseline plant. As described in the response to NSPM Responses to NRC Requests for Additional Information Dated December 24, 2008 14 SAMA RAI 2.b in the NSPM letter of November 21, 2008, the ISGTR analysis incorporated in the Rev. 2.2 SAMA PRA model is based on a methodology developed specifically for Westinghouse 2-loop plants (WCAP-16341-P). This methodology was developed with the knowledge of NUREG-1570 and other more recent analyses of the potential for ISGTR. Therefore, NSPM does not feel that the assumption that 25% of High-Dry core damage sequences lead to ISGTR is valid for Prairie Island. Further, as described in the response to RAI question 8.i, NSPM has already agreed to further assess the cost benefit of a proposed steam generator safety valve gagging device that could significantly reduce the risk associated with ISGTR. Therefore, NSPM does not plan to further assess the potential for implementation of SAMA 3.
During the validation of this response a discrepancy was identified in the baseline ISGTR sequence quantification in the Rev. 2.2 SAMA model. Specifically, a Small LOCA core damage sequence that did not involve dry SG conditions was included in the ISGTR quantification, while another Small LOCA core damage sequence which did involve dry SG conditions was not included. The sequence that was included has a much higher frequency than does the sequence that was not included, and there are no subsequent failure events included in the ISGTR models that would be negatively impacted had the correct sequence been used; therefore, use of the model without dry SG conditions provides conservative results for the ISGTR quantification. All of the results presented thus far (in the ER and in the RAI responses, including this one) include the conservative treatment. Therefore, the set of SAMAs that has been identified as cost beneficial to date represents an upper bound relative to ISGTR (i.e., correction of the discrepancy may show that SAMA 3 is not cost-beneficial). This discrepancy is being entered into the Corrective Action Program for resolution.
SAMA Follow Up RAI 3a and 3b In order to support the assumption that the fire core damage frequency (CDF) is comparable to the internal events CDF (9.79E-6 for Unit 1 and 1.21E-5 for Unit 2), it should be shown, preferably through sensitivity analysis or other quantitative arguments, that the individual plant examination of external events (IPEEE) fire CDF value (4.9E-5) is conservative by a factor of 4 to 5 (for Units 2 and 1, respectively). The information provided in the RAI response is general and qualitative in nature, and does not sufficiently demonstrate that such a large reduction in the fire CDF is appropriate (For example, the discussion of control room fires [65% contributor] states that partitioning of a cabinet within a panel zone was not credited. What is not stated is that the main control panel is a contiguous arrangement of panel sections without barriers or boundaries. The IPEEE used partitioning process of overlapping zones [25 zones] to subdivide the panel based on consideration of nominal panel fire heat rate, nominal heat value of the cable bundle, available fire suppression time of 15 minutes and the general vertical propagation tendency of fire in open back panels. Therefore, the zones are subdivided panel sections. In addition, the statement that manual suppression credit was only applied to cutsets representing <13% of the internal fires CDF appears to be misleading.
The IPEEE indicates that manual suppression was applied to all control room fires with a 10 minute fire suppression failure probability of 1.6E-2.). However, the 46 percent NSPM Responses to NRC Requests for Additional Information Dated December 24, 2008 15 reduction in the conditional core damage probability (CCDP) since the IPEEE cited in the response (p. 23) would suggest that a factor of 2 reduction in CDF might be justified.
Provide additional information on how the CCDP was computed, and on how the events on which it is based relate to the dominant fire events. Clarify whether the CCDP value includes station blackout events.
NSPM Response to SAMA Follow Up RAI 3a and 3b A complete update to the fire PRA models provided in the Fire IPEEE is not yet available. In its response to SAMA RAI 3b of November 21, 2008, NSPM provided as much quantitative evidence that the risk due to internal fires is lower than calculated in the IPEEE as was reasonably available.
The fire IPEEE stated clearly that the control room panels are subdivided panel sections.
This fact is not relevant to the point made in the response. Further subdivision of panel zones for refinement of the analysis was not performed in the IPEEE. The linear length of each analysis zone was taken to be 10 feet, and each zone overlapped with the zones adjacent to it such that damage to components located within any main control board area was assumed to result from a fire initiated within either of two panel zones.
Also, the assumption that any fire (regardless of intensity, location or other factors) that initiates within a panel zone damages all equipment within the panel zone is very conservative. Current control room analysis methodologies would allow further refinement to credit the potential for self-extinguishment given separation between combustibles within panel zones and cable and component materials used within the panels.
The statement in the RAI response that manual suppression credit was only applied to cutsets representing <13% of the internal fires CDF is correct. The statement in the follow-up question, "The IPEEE indicates that manual suppression was applied to all control room fires with a 10 minute fire suppression failure probability of 1.6E-2, is incorrect. This value was used in the control room fire closeout strategy scenario document, attached to the IPEEE report as Appendix B, Attachment 2 (ERIN Engineering Calculation 130-98-01, Fire Area Scenario for FA 13, p. 7 and p. A-13).
This document provides the initial development of the control room analysis, but the quantitative portions of this document were used only for initial screening of the control room (Fire Area 13). The control room did not screen out, and the analysis was further refined for the final IPEEE quantification. Page A-13 of the scenario document provides the event tree used in the initial screening quantification, and shows the 1.6E-2 manual suppression failure probability value. However, the diagram also shows that credit for manual suppression was only applied to fires that were large enough to propagate beyond the boundaries of the initiating panel zone. As shown on the diagram, only 8.3%
of fires were assumed to be fires of this magnitude (this event tree and severity factor were carried through the final analysis quantification). In the final, overall fire IPEEE quantification results (including control room fires and fires in all other fire areas), credit for the potential for successful fire suppression was only applied to cutsets representing
<13% of the internal fires CDF.
NSPM Responses to NRC Requests for Additional Information Dated December 24, 2008 16 Note that the final probability value for failure of manual suppression of control room fires used in the final IPEEE quantification (4.0E-2) was higher than that shown on the diagram on page A-13 of the control room scenario document, while the probability of failure of the operators to successfully shut the plant down from outside the control room (given failure of manual suppression) was lower (6.4E-2). However, in the final quantification for the IPEEE, the overall sequence CCDP (given a fire initiating in the control room) was actually higher by over 60% than that shown on page A-13 of the scenario document (see Table 3ab-1 below).
Table 3ab-1 Control room abandonment sequence CCDP:
Change from scenario document to that used in final IPEEE fire PRA results Fire Severity
(% that are Large fires)
Manual Suppression (failure of)
Shutdown from Outside CRM (failure of)
Sequence CCDP FA 13 Scenario document 8.30E-02 1.60E-02 1.00E-01 1.33E-04 Final IPEEE parameters 8.33E-02 4.00E-02 6.40E-02 2.13E-04 Sequence CCDP increase over scenario document assumptions =
61%
The 46 percent reduction in the conditional core damage probability (CCDP) since the IPEEE, cited in the response, applies to normal (or general) plant transient-initiated events. This value was computed by comparing the CCDP of the I-TR1 (normal transient) initiating event from the Level 1, Rev. 1 internal events model results, to the CCDP for the corresponding initiating event (I-1-TR1) in the Rev. 2.2 SAMA model (The Fire IPEEE PRA model was built upon the Level 1, Rev. 1 Unit 1-only internal events PRA model). The TR1 initiating event CCDP is relevant to fires that result in a unit shutdown (with appropriate accounting for fire-induced equipment damage) but that do not result in a fire-induced LOCA or other more complicated transients such as loss of main feedwater or SBO. This is generally considered to be the most likely transient to occur following an initiating fire event at PINGP.
However, as described in the NSPM response to SAMA RAI 3b, the IPEEE results showed that the dominant fire initiating events are fires in control room panel zones 5 and 6, which together account for approximately 40% of the total fire-induced CDF.
These events are assumed to involve loss of main feedwater (MFW) and auxiliary feedwater (AFW). The reduction in CCDP associated with loss of MFW events (the I-TR4 initiating event in the Level 1, Rev. 1, model compared to the I-1-TR4 initiating event from the Rev. 2.2 SAMA model) is 31.7%. This CCDP reduction also applies to the most risk-significant fires from Fire Area 32 (Auxiliary Feedwater Pump/Instrument Air Compressor Room), which also involve loss of MFW, and other initiating events that were not screened out of the IPEEE analysis.
Also, as described in the NSPM response to SAMA RAI 3b, the IPEEE results showed that fires in control room panels leading to LOOP/SBO account for approximately 11% of NSPM Responses to NRC Requests for Additional Information Dated December 24, 2008 17 the total fire-induced CDF. Although the SBO contribution to core damage was not directly quantified for the Level 1, Rev. 1, internal events model update, the loss of offsite power (LOOP) initiating event contribution was quantified. The reduction in CCDP associated with LOOP events (the I-LOOP initiating event in the Level 1, Rev. 1, model compared to the I-LOOP initiating event from the Rev. 2.2 SAMA model) is 80.6%.
LOOP events in which onsite AC power from the emergency diesel generators is available following an accident progression are similar to a loss of MFW initiating event (see discussion regarding reduction of the CCDP associated with loss of MFW in the preceding paragraph). As shown in Table 1f -3 above, the CDF contribution associated with SBO events was calculated to be 8.52E-7/rx-yr for the Rev. 2.2 SAMA model.
However, as described in the response to SAMA Follow Up RAI 1f above, when sufficient plant-specific MAAP analysis case runs are available to allow modeling of the lower leakage rates specified in the Rhodes model, it is anticipated that the SBO contribution to the overall CDF will actually be significantly lower than it was calculated to be in the Rev. 2.2 SAMA version.
An upgrade to the internal fires PRA is currently being developed as part of the fire protection program transition to one meeting the risk-informed, performance-based fire protection rule, 10CFR50.48c, which endorses National Fire Protection Association (NFPA) Standard 805 (NFPA-805). A number of tasks have been preliminarily completed for this upgrade, including a revision to the most risk-significant internal fires initiating event frequencies from the IPEEE. This analysis is based on the methodology of NUREG/CR-6850. The preliminary results of this analysis show that the fire initiating event frequencies for the most risk significant fire areas for the IPEEE, (i.e. fires in Fire Areas 13 and 32, Control Room and AFW/Instrument Air Compressor Room), are lower than calculated for the IPEEE, as shown in Table 3ab-2 below:
Table 3ab-2 PINGP Fire Initiating Event Frequency Comparison:
IPEEE vs. Preliminary FPRA Upgrade Calculated Values IPEEE Dominant Fire Area Description IPEEE Fire CDF Contribution IPEEE IE Frequency (per year)
(1)
Preliminary FPRA Upgrade IE Frequency (per year)
Change 13 Control Room 65.3%
2.04E-02 1.20E-02
-41%
32 "B" Train Hot Shutdown Panel/AFW/IA Compressor Room 16.7%
4.48E-03 2.60E-03
-42%
(1) From PINGP IPEEE Table B.2.6.3.
SAMA Follow Up RAI 5a It is understood from the response that improved training will not provide any additional benefit. However, the failure probabilities of 1.9E-02 and 5.3E-02 appear to have room for improvement. Explain the characteristics of these actions (and the calculator used to NSPM Responses to NRC Requests for Additional Information Dated December 24, 2008 18 determine its value) that prevents lower calculated values given excellent training and emergency operating plan-driven direction.
NSPM Response to SAMA Follow Up RAI 5a As discussed in the original RAI response, the two operator actions of concern are:
0SLOCAXXCDY: Operator Fails To Perform RCS Cooldown and Depressurization on Small LOCA (Failure probability of 1.92E-02) 0HRECIRCC2Y: Operator Fails To Initiate High Head Recirculation Conditional on Failure of RCS Cooldown and Depressurization (Failure Probability of 5.3E-02)
The human reliability analysis (HRA) was performed using Version 3.0 Beta of the EPRI HRA calculator. This calculator uses the Caused-Base Decision Tree Methodology (CBDTM) together with tables from NUREG/CR-1278 (USNRC Technique for Human Error Rate Prediction (THERP)). This is consistent with the EPRI HRA Users Group HRA Methodology and consistent with the state-of-the-art in the industry. The impact of timing, experience/training and procedures were factored into the analysis.
In general, EOP direction and training is assumed for using the CBDT method. In addition, the CBDT method credits general and specific training in scenarios where there could be problems with the operator information or operator-procedure interfaces. Thus, for relatively standard EOP scenarios, which implicitly assume procedural direction and training, one can not drive the numbers lower by crediting better training. Had there been no EOP direction or training, the CBDT method could not be used, and the Human Error Probability (HEP) numbers would be in the order of 1E-01. The THERP tables used in the analysis also assume Rule Based Actions are being modeled.
Other factors may also influence the HRA calculation. Further review was conducted on the two operator actions listed above to determine how other factors, such as timing and dependencies, impact the HEP analysis.
0SLOCAXXCDY Assessment:
Review of 0SLOCAXXCDY determined that the dominant contributor to the overall Human Error Probability (HEP) was the execution probability. The execution probability is approximately 84% of the overall total HEP. The execution probability was determined to be 1.6E-02. There were 19 critical operator steps identified from the EOP for this action.
The timing analysis was also reviewed. For operator action 0SLOCAXXCDY, the timing analysis plays a critical role in the ability to credit recovery for the execution portion.
Due to the limited time available for recovery (approximately 5 minutes) no recovery credit was applied to the execution probability; this resulted in a relatively high HEP value of 1.9E-02. The time available for recovery is brief since it would take approximately 2.6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> to perform the required actions (cooldown and depressurize the NSPM Responses to NRC Requests for Additional Information Dated December 24, 2008 19 Reactor Coolant System and lineup Residual Heat Removal (RHR) system for shutdown cooling). This is almost the same time it would take the Refueling Water Storage Tank (RWST) to reach its low level alarm (~2.7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br />). This operator action is discussed in detail in Enclosure 2.
0HRECIRCC2Y Assessment:
Operator action 0HRECIRCC2Y (Operator Fails To Initiate High Head Recirculation Conditional on Failure of RCS Cooldown and Depressurization) involves the failure of the operator to initiate high head recirculation following a small LOCA conditional of failure of the operator to perform RCS cooldown and depressurization for a small LOCA event (0SLOCAXXCDY).
Since these two operator actions (0SLOCAXXCDY and 0HRECIRCC2Y) appear in the same SLOCA initiating cutset, 0HRECIRCC2Y is a conditional operator action based on 0HRECIRCSMY which is discussed in Enclosure 3. 0HRECIRCSMY was calculated using Version 3.0 Beta of the EPRI HRA calculator and used the Caused-Base Decision Tree Methodology (CBDTM) together with the THERP methodology. The total HEP calculated for 0HRECIRCSMY is 3.6E-03.
The conditional probability of operator action 0HRECIRCC2Y, which is derived from 0HRECIRCSMY, is quantified by determining the level of dependence. Many factors may influence the level of dependence such as timing, location, and the relationship between persons performing the actions.
An evaluation of the timing associated with this particular core damage sequence (SLOCA initiating event with successful SI Pump injection) shows that there is adequate time between performance of operator action 0SLOCAXXCDY and 0HRECIRCC2Y (greater than 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />). This is based on the ability to maintain core cooling for several hours (~2.7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br />) with the SI pump injecting RWST water before the low level alarm is reached and transfer to recirculation is required.
In addition, other factors can be evaluated to determine dependency, such as: same crew, cognition (cues/procedures), resources, location and stress. For the 0HRECIRCC2Y dependency analysis, the same crew is used (since the time delay is less than the shift length of 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />), different procedures and cues are used for each action, operator actions do not occur at the same time and adequate resources are available since the two operator actions (0SLOCAXXCDY and 0HRECIRCC2Y) are not simultaneous. Also, the stress level associated with the operator action 0HRECIRCSMY is Moderate.
After reviewing the dependency factors, the most significant being the timing and the stress level, a Low Dependency (LD) was assigned. Based on USNRC Technique for Human Error Rate Prediction (THERP), the conditional probability equation used to determine the HEP value for 0HRECIRCC2Y is:
0HRECIRCC2Y (Low Dependence) = (1 + 19N)/20 Where: N = 3.6E-03 (HEP value for 0HRECIRCSMY)
NSPM Responses to NRC Requests for Additional Information Dated December 24, 2008 20 0HRECIRCC2Y = 5.3E-02 Note that using the THERP dependency formula approach to determine dependency analysis can be seen as very conservative. However, the THERP approach is standard industry practice.
SAMA Follow Up RAI 5b Three candidate SAMAs (6, 6a, and 13) and 2 IPE-identified enhancements related to internal flooding were dismissed on the basis of a cooling water header piping modification in 1992, and deterministic considerations described in a 1995 engineering calculation/white paper. However, the IPE and 7 subsequent PRA updates (up to and including the current PRA) continue to model the rupture of the cooling water header.
Justify why the piping modification should be credited (for eliminating cooling water header ruptures) in the SAMA evaluation, in view of the fact that the IPE and subsequent PRA updates continue to model these pipe breaks, and that the American Society of Mechanical Engineers PRA standard would call for treatment of such flood sources.
Provide a quantitative evaluation of the costs and benefits of each of the aforementioned SAMAs / enhancements based on the current PRA treatment of cooling water header pipe breaks.
NSPM Response to SAMA Follow Up RAI 5b The current PRA model still includes initiating events modeling all of the internal flooding initiating events included in the IPE model (expanded now to include their impacts to both units). The CL header piping modifications and considerations contained in the engineering calculation referred to in the question were used in a previous model update to attempt to model the frequency of flooding events in each class that have a more realistic set of consequences. Previously the consequences associated with the worst case (and lowest frequency) piping rupture were applied to the entire frequency of potential piping rupture events in each area (most of which are higher frequency, lower consequence events). This was felt to be skewing the results of the PRA in an overly-conservative manner. It is now understood that this method is not consistent with the PRA standard and will be corrected in a future PRA update; however, this treatment was included in the version of the PRA used for the SAMA analysis. No SAMAs were excluded from consideration based on either the piping modification or the engineering calculation.
SAMA Follow Up RAI 5d and 5e A review of Table F.5-3 finds that several screened Phase I candidates (i.e., SAMAs 6, 6a, 7, 8, 13, 14 and 16) do not appear to meet the environmental report (ER) Section 4.17.1 screening criteria. In addition, the discussion for the basis for screening SAMA 14 does not appear to address the benefit of improved operator training for power-operated relief valve failure to re-seat. Its screening appears to be based on model limitations as NSPM Responses to NRC Requests for Additional Information Dated December 24, 2008 21 opposed to actual benefit. As such, the ER Section F.5.2 criteria do not appear to be consistent with the ER Section 4.17.1 criteria. Confirm that both sets of screening criteria are used. Explicitly identify the ER Section F.5.2 and the ER Section 4.17.1 screening criterion used for each screened SAMA.
NSPM Response to SAMA Follow Up RAI 5d and 5e The table below identifies the Phase 1 screening criteria used for SAMAs 6, 6a, 7, 8, 13, 14, and 16. As applied in the ER, this particular screening process was used to identify those SAMAs that were readily observed as not being cost beneficial, and thus not being applicable to the Phase 2 quantification of averted cost-risk. The process involved cutset reviews and the CDF contribution of those targeted accident sequences for which the SAMAs were developed. The applicable screening criteria from both Sections 4.17.1 and F.5.2 are listed to emphasize that the screening criteria cited in these sections address the same intent.
SAMA ID and Description Description of Disposition Specific Criteria from Section 4.17.1 Specific Criteria from Section F.5.2 6
Consider installing waterproof (EQ) equipment (valves/level sensors) capable of automatically isolating the flooding source.
For either unit, Auxiliary Building Zone 7 flooding initiating events account for only about 2% of the CDF and only about 1% of the LERF.
The cost and complexity of implementing this SAMA would be significant, involving system modifications that would entail extensive engineering support, specialized hardware and instrumentation, and regulatory analyses to support modifications to the facility. In order to minimize the cost of the modification, the existing ring header isolation MOVs would have to be used (those that currently split the ring header into two safeguards headers on an S-signal on either unit) in order to prevent a dual-unit outage to install new isolation valves.
Under this design, however, isolation of an entire train of safeguards equipment (those supplied by CL) to stop the flooding event would leave both units susceptible to a single failure for important safety functions. (Sect.
F.5.2.1)
Candidates with no significant benefit in PWRs such as PINGP.
Engineering Judgment: Using extensive plant knowledge and sound engineering judgment, potential SAMAs are evaluated based on their expected maximum cost and dose benefits; those that are deemed not beneficial are screened from further analysis.
NSPM Responses to NRC Requests for Additional Information Dated December 24, 2008 22 SAMA ID and Description Description of Disposition Specific Criteria from Section 4.17.1 Specific Criteria from Section F.5.2 6a Consider segregating this zone into 2 compartments to reduce the impact of a flood on both trains of SI and RHR.
The maximum risk benefit for this SAMA is low (see SAMA 6 discussion above). The cost of implementing this SAMA is estimated to be significantly greater than that of SAMA
- 6. Furthermore, this SAMA relies on operator action to identify and isolate the header with the break (the current, pre-SAMA implementation situation). With the higher likelihood of isolation failure due to operator vs. automatic action, a large portion of the risk benefit from this SAMA would not be realized.
(Sect. F.5.2.2)
Candidates whose estimated implementation costs exceed the maximum averted cost-risk and/or candidates with no significant benefit in PWRs such as PINGP.
Engineering Judgment: Using extensive plant knowledge and sound engineering
- judgment, potential SAMAs are evaluated based on their expected maximum cost and dose benefits; those that are deemed not beneficial are screened from further analysis.
7 The ability to use non-safety related diesel generators D3 and D4 would provide a backup source of power in addition to the existing four safety related diesels D1, D2, D5, and D6.
SBO is already a small contributor - <8% of CDF, <1% of LERF, <0.02% of early CF. Top SBO-related release categories involve sequences in which containment and/or vessel does not fail. Also, significant costs would be incurred to upgrade D3 and D4 to safety-related status, which would ultimately cost more than the benefit gained from a 2%
improvement in CDF. (Table F.5-3)
Candidates whose estimated implementation costs exceed the maximum averted cost-risk and/or candidates with no significant benefit in PWRs such as PINGP.
Engineering Judgment: Using extensive plant knowledge and sound engineering
- judgment, potential SAMAs are evaluated based on their expected maximum cost and dose benefits; those that are deemed not beneficial are screened from further analysis.
8 Installation of a swing or SBO diesel would provide increased defense in depth and could be considered for LOOP conditions.
SBO is a significant contributor to CDF for both units (provides about 8% of the total CDF). However, it contributes <1% to the LERF, and <0.02% to the frequency of all early containment failure sequences. All of the top SBO-related release categories involve sequences in which the containment and/or reactor vessel does not fail. The risk benefit of this SAMA is further reduced by the need for operator action (including local actions) for implementation. (Sect. F.5.2.3)
Candidates whose estimated implementation costs exceed the maximum averted cost-risk.
Engineering Judgment: Using extensive plant knowledge and sound engineering
- judgment, potential SAMAs are evaluated based on their expected maximum cost and dose benefits; those that are deemed not beneficial are screened from further analysis.
NSPM Responses to NRC Requests for Additional Information Dated December 24, 2008 23 SAMA ID and Description Description of Disposition Specific Criteria from Section 4.17.1 Specific Criteria from Section F.5.2 13 This initiator represents an internal flooding scenario that disables various safety-related components.
Mitigation of this event can be accomplished via an automatic sump pump system to remove water if the operator fails to isolate Zone 7 of the Aux. Bldg.
The maximum risk benefit for this SAMA is low (see SAMA 6 discussion above). The cost of implementing this SAMA would be about the same, or slightly less, than the cost of SAMA 6, however, as with SAMA 6a, this SAMA relies on operator action to identify and isolate the header with the break (the current, pre-SAMA implementation situation).
Therefore, a large portion of the risk benefit from this SAMA would not be realized. Also, even with successful operator action, the result is the loss of at least one train of safeguards equipment. (Sect. F.5.2.4)
Candidates with no significant benefit in PWRs such as PINGP.
Engineering Judgment: Using extensive plant knowledge and sound engineering
- judgment, potential SAMAs are evaluated based on their expected maximum cost and dose benefits; those that are deemed not beneficial are screened from further analysis.
14 Reinforce operator training to isolate PORVs when symptoms reveal valves have failed to re-seat.
This reduces the amount of radioactivity released to the environment.
Consider replacing with more reliable or robust valves to better isolate following lifting.
Existing model considers that failure to close and failure to open lead to the same accident class, GLH (assuming failure of operator to Cooldown/Depressurize per ECA 3.1/3.2, which leads to SGTR source term).
Therefore, quantification of this SAMA modification would produce no difference in the calculated frequency of offsite release or its magnitude. (Table F.5-3)
Candidates with no significant benefit in PWRs such as PINGP.
Engineering Judgment: Using extensive plant knowledge and sound engineering
- judgment, potential SAMAs are evaluated based on their expected maximum cost and dose benefits; those that are deemed not beneficial are screened from further analysis.
NSPM Responses to NRC Requests for Additional Information Dated December 24, 2008 24 SAMA ID and Description Description of Disposition Specific Criteria from Section 4.17.1 Specific Criteria from Section F.5.2 16 Failure of MV-32169 to open disables RHR Loop B return.
Proper operation of this valve is most likely tracked via the MR. Consider replacing this MOV with a FC air-operated valve for improved reliability. This would eliminate CCF for inboard MOVs that currently exist on this flow path.
Failure of this valve to open results in failure of shutdown cooling initiation (there is no CCF for inboard MOVs that currently exist for the flow path involved in these sequences). This may not have any positive impact on CDF (FC air-operated valve inside containment may be less reliable than a MOV due to reliance on containment instrument air supply) and would have little, if any, impact on LERF. (Table F.5-3)
Candidates whose estimated implementation costs exceed the maximum averted cost-risk and/or candidates with no significant benefit in PWRs such as PINGP.
Engineering Judgment: Using extensive plant knowledge and sound engineering
- judgment, potential SAMAs are evaluated based on their expected maximum cost and dose benefits; those that are deemed not beneficial are screened from further analysis.
As described in Section 5.1.1 of the ER, Phase 1 SAMAs were, in part, identified through a review of the importance measures associated with the Rev. 2.2 SAMA model PRA CDF calculation for each unit. SAMA 14 was identified as a potential Phase 1 candidate SAMA due to the importance measures associated with Unit 2 basic events 2SGTRRLFFTC and 2SGTRRLFSUC. These two events, both having a probability of 0.5, are split fractions that represent failure of a secondary relief valve to close given SG overfill following a SGTR event and successful closure of all relief valves, respectively.
Both events have the same probability (0.5) and in the baseline PRA quantification, success or failure of this event tree top event heading leads to an identical accident progression (operator action to depressurize the plant to the point at which RHR shutdown cooling can be placed in service is required to prevent core damage). This treatment essentially gives no credit for the fact that the valves may successfully reclose; the existence of this event tree top event heading is only for sensitivity purposes and does not otherwise play a role in the PRA.
Note that in the response to SAMA RAI 8(i) in the letter of November 21, 2008, NSPM stated that it had entered the proposed SAMA (SG relief valve gagging device) into the Corrective Action Program for a more detailed examination of viability and implementation cost. This proposed plant modification, if proven to be cost beneficial and implemented, would effectively reduce the offsite dose risk associated with stuck open safety relief valves on SGTR events.
NSPM Responses to NRC Requests for Additional Information Dated December 24, 2008 25 SAMA Follow Up RAI 5g Based on the description provided, the dominant internal flooding sequence (involving cooling water header rupture) would result in core damage at both units. Provide an evaluation of a less extensive, alternative SAMA that would limit water damage to the systems, structures, and components for a single unit (so that core damage would be limited to one unit). Provide the costs and benefits for this alternative.
NSPM Response to SAMA Follow Up RAI 5g The dominant internal flooding sequence involves a CL header rupture in the Component Cooling heat exchanger room in the Auxiliary Building. This room is located in the basement of the Auxiliary Building, near the center of the building between the two units.
However, the equipment in the room is not separated by unit; rather, it is separated by train. The Train A CC heat exchangers and pumps are located on the Unit 1 side of the room, while the Train B CC heat exchangers and pumps are located on the Unit 2 side of the room. The PRA model assumes that, due to the potentially high flow rate out the break and water spray potential, both pumps on the break side of the room are affected.
In order to stop the flow out the break, the operators would have to isolate the ruptured CL header. Therefore, a wall or other flood-limiting barrier down the middle of the room would leave one CC pump and heat exchanger operable in the non-isolated train on the side of the room without the break. If that one remaining pump failed to function, or happened to be out of service for maintenance (for example) when the event occurred, all CC would be lost to both units, even though the CL header break was successfully isolated. An attempt to construct barriers to protect both CC trains for one unit would have a similar problem; on any CL piping rupture at least one train of CC would still be lost on both units. Any of a number of single failures in the opposite train would lead to loss of all CC on the unit with the flood protection installed. Therefore, it is not practical to design a flood barrier that can protect one unit at the expense of the other. This also goes against the design philosophy of the plant which is to design and install safety measures that will protect both units.
SAMA Follow Up RAI 6c The life-cycle cost is identified as $100K. However, SAMA 20 changes a normally open motor-operated valve to normally-closed. Demonstrate that this change will add $100K additional life-cycle cost to an existing valve. In addition, the noted design cost reduction of 30% does not yield the reduced second unit cost. Address this apparent discrepancy.
NSPM Response to SAMA Follow Up RAI 6c Plant operation with these valves normally closed would require that the valves automatically open following a LOCA event to supply flow to the reactor vessel. Failure of these valves to open would contribute to loss of low head injection capability during LOCA events. To ensure valve operability, periodic cycling of valves and general maintenance will be required at a cost of $100,000 per unit. Additional reviews of these NSPM Responses to NRC Requests for Additional Information Dated December 24, 2008 26 life-cycle costs revealed these costs would be inherent to maintaining these valves whether the valves are open or closed. Therefore, the $100,000 per unit life cycle costs were removed from the cost estimate for SAMA 20 as indicated below. Although this lowered the cost estimate for SAMA 20, the analysis demonstrated that implementation would not be cost beneficial.
Order-of Magnitude Cost Estimate for SAMA 20 SAMA ID No.: 20
Title:
Close Low Head Injection MOVs to Prevent RCS Backflow to SI System
==
Description:==
Change the safety-related motor-operated low head reactor vessel injection valves (one valve in each Emergency Core Cooling System train) from normally open to normally closed. Valves would need modifying by drilling a hole in the upstream disk in order to eliminate any pressure locking concern.
Assumptions:
Each valve will be placed in the closed position (or verified closed) by the control room operator prior to entering the appropriate Tech Spec MODE and each valve will receive, as it does presently, an S (safety injection) signaltherefore, in order to implement this alternative, procedure and drawing changes are required.
The design requirements for the valve and its motor operator which were in effect at the time the valve was a normally closed valve are still valid.
The current valve design will support the modification to eliminate any pressure locking concern.
The valve MEDP (maximum expected differential pressure) and actuator will not be changed by this modification. Minor changes in the wedge friction factor may occur, but will not change the valve actuator or its settings.
PHASE ITEM RESOURCE FUNCTIONAL AREA ESTIMATE UNIT 1 ESTIMATE UNIT 2 Study/Analyses 1
Contract Labor Engineering Design Studies
$40,000
$40,000 2
PINGP Support Engr / Ops / Lic
$12,000
$12,000 Design 3
Contract Labor Engr Design - Mech /
Civil
$60,000
$42,000 4
Contract Labor Engr Design - Elec / I&C
$60,000
$42,000 5
PINGP Support Engr / Ops / Maint
$40,000
$28,000 Implement 6
Labor Main / Cont
$50,000
$50,000 7
Contract Labor Engineering
$2,000
$2,000 8
Materials Material & Material Mgmt
$1,000
$1,000 9
PINGP Support Engr / Ops / Lic
$3,000
$3,000 Life Cycle 10 Labor Ops / Maint for 20 years 0
0 GRAND TOTAL
$268,000
$220,000 Note:
The cost estimate for the second unit reflects a saving of approximately 30% on the Design Phase.
NSPM Responses to NRC Requests for Additional Information Dated December 24, 2008 27 SAMA Follow Up RAI 6.g The corrected treatment of uncertainties shows SAMA 19a as potentially cost beneficial.
Discuss Nuclear Management Companys plans for further evaluation or implementation of this SAMA.
NSPM Response to SAMA Follow Up RAI 6g Since the results of the corrected treatment of uncertainties show SAMA 19a as potentially cost beneficial, the benefits for replenishing RWST from a large water source should be considered further. Other engineering reviews are necessary to determine ultimate implementation. SAMA 19a has been entered into the PINGP Corrective Action Program for further evaluation.
0SLOCAXXCDY, Operator Fails To Perform RCS Cooldown And Depressurization 1
Cognitive Method Date Analyst CBDTM/THERP 04/23/05 J. F. Grobbelaar, SCIENTECH HEP Summary Pcog Pexe Total HEP Error Factor Without Recovery 3.0e-03 1.6e-02 With Recovery 3.0e-03 1.6e-02 1.9e-02 5
HFE Scenario Description
- 1. Initial Conditions: Steady state, full power operation.
- 2. Initiating Event: Small LOCA
- 3. Accident sequence (preceding functional failures and successes):
Reactor trip (reactor trip and bypass breakers are open).
Turbine trip (both turbine stop valves are closed).
Both safeguards buses are energized.
SI is actuated and required.
AFW flow greater than 200 gpm.
PORVs closed RCS pressure > 1250 PSIG
- 4. Preceding operator error or success in sequence:
Entered 1E-0.
Transferred to 1E-1 from 1E-0 step 12.
Stopped RCPs
- 5. Operator action success criterion: Cooldown and depressurize the RCS to Mode 5, Cold Shutdown conditions following a loss of reactor coolant inventory.
- 6. Consequence of failure: High head recirculation would be required.
- 7. Key assumptions: RCPs not running Cues and Indications Cue/s RCS pressure - GREATER THAN 250 PSIG [550 PSIG)
Degree of Clarity Very Good Procedures and Training Cognitive Procedure 1E-1 Cognitive Step Number 20.b Cognitive Instruction Go to 1ES-1.1, POST LOCA COOLDOWN AND DEPRESSURIZATION, Step 1 Execution Procedure 1ES-1.1 0SLOCAXXCDY, Operator Fails To Perform RCS Cooldown And Depressurization 2
Other Procedure 1C15 Job Performance Measure RH-5S Classroom Training Frequency:.5 per year Simulator Training Frequency:,5 per year Notes The most critical steps in 1ES-1.1 are to start the cooldown (step 6) and to depressurize (step 9).
The depressurization will not work (pressurizer level and subcooling) without cooldown, so failure to cooldown will be "recovered" by depressurization. There are numerous steps in the procedure checking pressurizer level and subcooling, hence recovering depressurization and therefore cooldown.
Timing Analysis Tsw 42 Minutes Tdelay 15 Minutes T1/2 0 Minutes TM 22 Minutes Time available for recovery 5 Minutes SPAR-H Available time (cognitive) 5 Minutes SPAR-H Available time (execution) ratio 1 Minutes Minimum level of dependence for recovery HD Notes The time to reach recirculation switchover (33% RWST level) for Small LOCA is 2.7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> (162 minutes) from calculation file V.SPA.93.004, "PI SLOCA W/AFW, 2 SI, 2 Accum, 1 FCU, No Recirc". RHR can be put in service when the RCS hot leg temperature is less than 350 F. Time to cool down from 547 F to 350 F at 100 F/hr would take about 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> = 120 minutes. The system time window is taken as the time to reach recirculation switchover reduced by the actual time that it would take to cooldown and depressurize, which is 162 - 120 = 42 minutes. This is conservative as it does not take the effect of the cooldown on flow rate into account, and it does not take the stopping of 1SI pump into account.
Per the operator interviews, it takes 15 minutes to navigate to ES-1.1, so Td = 15 minutes.
Per JPM RH-5S, the time for completion to put RHR in shutdown cooling is 12 minutes. The manipulation time from 1ES-1.1 step 10 onwards is included in the 120 minutes for cooling down, so it does not have to be accounted for in Tm. The important manipulations are to start the cooldown (step 6) and depressurization (step 9). The first 9 steps are estimated to take less than 10 minutes, so the total manipulation time to be accounted for is Tm = 22 (12 + 10) minutes.
Dependencies (Related Human Interactions)
N/A 0SLOCAXXCDY, Operator Fails To Perform RCS Cooldown And Depressurization 3
Cognitive Analysis Pc Failure Mechanism Branch HEP Pca: Availability of Information a
neg.
Pcb: Failure of Attention a
neg.
Pcc: Misread/miscommunicate data a
neg.
Pcd: Information misleading a
neg.
Pce: Skip a step in procedure c
3.0e-03 Pcf: Misinterpret Instructions a
neg.
Pcg: Misinterpret decision logic l
neg.
Pch: Deliberate violation a
neg.
Initial Pc(without recovery credited) 3.0e-03 Notes Cognitive Complexity Simple Equipment Accessibility Main Control Room: Accessible Cognitive Recovery Initial HEP Self Review Extra Crew STA Review Shift Change ERF Review Recovery Matrix Depende ncy Level Multiply HEP By Override Value Final Value Pca neg.
NC 1.0 Pcb neg.
NC 1.0 Pcc neg.
NC 1.0 Pcd neg.
NC 1.0 Pce 3.0e-03 NC 1.0 3.0e-03 Pcf neg.
NC 1.0 Pcg neg.
NC 1.0 Pch neg.
NC 1.0 Final Pc (with recovery credited) 3.0e-03 Notes No cognitive recovery credited.
Execution Performance Shaping Factors Environment Lighting Normal Heat Normal Radiation
Background
Atmosphere Normal Equipment Accessibility Main Control Room Accessible Stress Low Notes Stress is low, as all equipment is available and all safety functions are satisfied. Cooldown, depressurization and placing RHR in service are routine actions performed for every cold shutdown. In this scenario, the only difference is that SI is running, which is stopped during the evolution.
Execution Complexity Simple 0SLOCAXXCDY, Operator Fails To Perform RCS Cooldown And Depressurization 4
Execution Unrecovered Procedure: 1ES-1.1, Error Type THERP HEP Stress Factor Over Ride Total HEP Step No.
Instruction Table Item 5
Place All PRZR Heaters In Off Position Comments:
EOM 20-7b 1
1.7e-03 1
1.7e-03 EOC 20-12 3
1.3E-3 6.c RNO Start one condensate pump Comments: Recovered by step 9 EOM 20-7b 1
0.0e+0 0
1 0
0.0e+
00 EOC 20-12 3
1.3E-3 6,d Dump steam to condenser from intact SGs Comments: Recovered by step 9 EOM 20-7b 2
0.0e+0 0
1 0
0.0e+
00 EOC 20-12 5
1.3E-3 9.a RNO Depressurize RCS To Refill PRZR: Use one PORV Comments: This step is performed immediately before starting an RCP. Transitions from other steps when PRZR level is low are also possible. For all possible entries, the RCS should be subcooled prior to RCS depressurization. Since this prior subcooling requirement ensures a small break, subcooling should be restored with continued cooldown if subcooling is lost during the depressurization. Pressurizer level (and pressure) will increase after the operator stops the depressurization until injection flow balances break flow and loss due to cooldown shrink. This step is a recovery step for cooldown, as depressurization can not commence without sufficient subcooling margin which is obtained by cooldown.
EOM 20-7b 2
2.6e-03 1
2.6e-03 EOC 20-12 3
1.3E-3 10.c PRZR level - GREATER THAN 21% [41%]
Comments: Potential recovery step EOM 20-7b 2
0.0e+0 0
1 0
0.0e+
00 EOC 20-11 4
3.8E-3 12.d RNO Start 11 RHR pump.
Comments:
EOM 20-7b 2
2.6e-03 1
2.6e-03 EOC 20-12 3
1.3E-3 12.e Stop last SI pump Comments:
EOM 20-7b 2
0.0e+0 0
1 0
0.0e+
00 EOC 20-12 3
1.3E-3 15.a RNO Depressurize RCS To Minimize Subcooling: Use one PORV Comments:
EOM 20-7b 2
2.6e-03 1
2.6e-03 EOC 20-12 3
1.3E-3 18.d Close accumulator isolation valves:
Comments:.. MV-32071
.. MV-32072 EOM 20-7b 2
2.6e-03 1
2.6e-03 EOC 20-12 3
1.3E-3 25.a Check RCS hot leg temperature - LESS THAN 350 F Comments: If not, operators are directed to go to step 26 and will be EOM 20-7b 2
0.0e+0 0
1 0
0.0e+
00 0SLOCAXXCDY, Operator Fails To Perform RCS Cooldown And Depressurization 5
Execution Unrecovered Procedure: 1ES-1.1, Error Type THERP HEP Stress Factor Over Ride Total HEP Step No.
Instruction Table Item directed in step 27 to return to step 2 if RCS temperature is not less than 200 F. This is a potential recovery step for the getting the initial cooldown and depressurization going.
EOC 20-11 4
3.8E-3 25.d Align RHR for shutdown cooling per Attachment D Comments:
EOM 20-7b 2
1.3e-03 1
1.3e-03 D.10 OPEN RHR Suction Isolation valves from the RCS:
Comments:.. MV-32164, LOOP A HOT LEG TO RHR, using CS-46226
.. MV-32165, LOOP A HOT LEG TO RHR, using CS-46228
.. MV-32230, LOOP B HOT LEG TO RHR, using CS-46227
.. MV-32231, LOOP B HOT LEG TO RHR, using CS-46229 Recovered by D.18 EOM 20-7b 2
0.0e+0 0
1 0
0.0e+
00 EOC 20-12 3
1.3E-3 D.11 Throttle CV-31236, 12 RHR HX RC OUTLET FLOW (1HC-625),
Comments: Recovered by D.18 EOM 20-7b 2
0.0e+0 0
1 0
0.0e+
00 EOC 20-12 3
1.3E-3 D.12 Throttle OPEN CV-31237, 11/12 RHR HX BYPASS FLOW (1HC-626A), to approximately 30%.
Comments: Recovered by D.18 EOM 20-7b 2
0.0e+0 0
1 0
0.0e+
00 EOC 20-12 3
1.3E-3 D.13 Start 12 RHR Pump using CS-46185.
Comments: Recovered by D.18 EOM 20-7b 2
0.0e+0 0
1 0
0.0e+
00 EOC 20-12 3
1.3E-3 D.14 OPEN MV-32066, RHR TO RC LOOP B COLD LEG, using CS-46225.
Comments: Recovered by D.18 EOM 20-7b 2
0.0e+0 0
1 0
0.0e+
00 EOC 20-12 3
1.3E-3 D.16 Place CV-31237, 11/12 RHR HX BYPASS FLOW (1HC-626A), in "AUTO".
Comments: Recovered by D.18 EOM 20-7b 2
0.0e+0 0
1 0
0.0e+
00 EOC 20-12 3
1.3E-3 D.18 Adjust CV-31236, 12 RHR HX RC OUTLET FLOW (1HC-625), to obtain desired cooldown rate.
Comments:
EOM 20-7b 2
2.6e-03 1
2.6e-03 EOC 20-12 3
1.3E-3 27 Check RCS Temperatures LESS THAN 200 (If not, return to step 2)
Comments:
EOM 20-7b 2
0.0e+0 0
1 0
0.0e+
00 EOC 20-11 4
3.8E-3 0SLOCAXXCDY, Operator Fails To Perform RCS Cooldown And Depressurization 6
Execution Recovered Critical Step No.
Recovery Step No.
Action HEP (Crit)
HEP (Rec)
Dep.
Cond. HEP (Rec)
Total for Step 5
Place All PRZR Heaters In Off Position 1.7e-03 1.7e-03 6.c RNO Start one condensate pump 0.0e+00 0.0e+00 6,d Dump steam to condenser from intact SGs 0.0e+00 0.0e+00 9.a RNO Depressurize RCS To Refill PRZR: Use one PORV 2.6e-03 2.6e-03 10.c PRZR level - GREATER THAN 21%
[41%]
0.0e+00 0.0e+00 12.d RNO Start 11 RHR pump.
2.6e-03 2.6e-03 12.e Stop last SI pump 0.0e+00 0.0e+00 15.a RNO Depressurize RCS To Minimize Subcooling: Use one PORV 2.6e-03 2.6e-03 18.d Close accumulator isolation valves:
2.6e-03 2.6e-03 25.a Check RCS hot leg temperature - LESS THAN 350 F 0.0e+00 0.0e+00 25.d Align RHR for shutdown cooling per Attachment D 1.3e-03 1.3e-03 D.10 OPEN RHR Suction Isolation valves from the RCS:
0.0e+00 0.0e+00 D.11 Throttle CV-31236, 12 RHR HX RC OUTLET FLOW (1HC-625),
0.0e+00 0.0e+00 D.12 Throttle OPEN CV-31237, 11/12 RHR HX BYPASS FLOW (1HC-626A), to approximately 30%.
0.0e+00 0.0e+00 D.13 Start 12 RHR Pump using CS-46185.
0.0e+00 0.0e+00 D.14 OPEN MV-32066, RHR TO RC LOOP B COLD LEG, using CS-46225.
0.0e+00 0.0e+00 D.16 Place CV-31237, 11/12 RHR HX BYPASS FLOW (1HC-626A), in "AUTO".
0.0e+00 0.0e+00 D.18 Adjust CV-31236, 12 RHR HX RC OUTLET FLOW (1HC-625), to obtain desired cooldown rate.
2.6e-03 2.6e-03 0SLOCAXXCDY, Operator Fails To Perform RCS Cooldown And Depressurization 7
Execution Recovered Critical Step No.
Recovery Step No.
Action HEP (Crit)
HEP (Rec)
Dep.
Cond. HEP (Rec)
Total for Step 27 Check RCS Temperatures LESS THAN 200 (If not, return to step 2) 0.0e+00 0.0e+00 Total Unrecovered:
1.6e-02 Total Recovered:
1.6e-02 0HRECIRCSMY, Operator Fails To Initiate High Head Recirc. For A Small LOCA 1
Cognitive Method Date Analyst CBDTM/THERP 04/23/05 J. F. Grobbelaar, SCIENTECH HEP Summary Pcog Pexe Total HEP Error Factor Without Recovery 3.2e-03 6.0e-02 With Recovery 1.7e-04 3.4e-03 3.6e-03 5
HFE Scenario Description
- 1. Initial Conditions: Steady state, full power operation.
- 2. Initiating Event: Small LOCA (2" break)
- 3. Accident sequence (preceding functional failures and successes):
Reactor trip (reactor trip and bypass breakers are open).
Turbine trip (both turbine stop valves are closed).
Both safeguards buses are energized.
SI is actuated and required.
AFW flow greater than 200 gpm.
- 4. Preceding operator error or success in sequence:
Entered 1E-0.
Transferred to 1E-1 Transferred to 1ES-1.1
- 5. Operator action success criterion: Diagnose need for recirculation switchover and switch over to recirculation
- 6. Consequence of failure: Core damage.
Cues and Indications Cue/s RWST level - LESS THAN 33%
Degree of Clarity Very Good Procedures and Training Cognitive Procedure 1ES-1.1 Cognitive Step Number Information Page #7 Cognitive Instruction Go to 1ES-1.2, TRANSFER TO RECIRCULATION, Step 1.
if RWST level decreases to less than 33%.
Execution Procedure 1ES-1.2 Other Procedure Job Performance Measure SI-11S Classroom Training Frequency:.5 per year 0HRECIRCSMY, Operator Fails To Initiate High Head Recirc. For A Small LOCA 2
Simulator Training Frequency:.5 per year Notes Timing Analysis Tsw 618 Minutes Tdelay 162 Minutes T1/2 0 Minutes TM 30 Minutes Time available for recovery 426 Minutes SPAR-H Available time (cognitive) 426 Minutes SPAR-H Available time (execution) ratio 17 Minutes Minimum level of dependence for recovery ZD Notes Tsw = 10.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />.= 618 minutes Td = 2.7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> = 162 minutes Tm = 30 minutes (15 minutes for local actions (JPM SI-3) and 15 minutes for MCR actions (JPM-S-11S)).
The timing for the small LOCA (2" break) comes from calculation file V.SPA.93.004, "PI SLOCA W/AFW, 2 SI, 2 Accum, 1 FCU, No Recirc." The time to 33% level is 2.7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> and the time from 33% RWST level until core damage is 7.6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.
Dependencies (Related Human Interactions)
Cognitive Analysis Pc Failure Mechanism Branch HEP Pca: Availability of Information a
neg.
Pcb: Failure of Attention d
1.5e-04 Pcc: Misread/miscommunicate data a
neg.
Pcd: Information misleading a
neg.
Pce: Skip a step in procedure c
3.0e-03 Pcf: Misinterpret Instructions a
neg.
Pcg: Misinterpret decision logic k
neg.
Pch: Deliberate violation a
neg.
Initial Pc(without recovery credited) 3.2e-03 Notes Cognitive Complexity Complex Equipment Accessibility Main Control Room: Accessible 0HRECIRCSMY, Operator Fails To Initiate High Head Recirc. For A Small LOCA 3
Cognitive Recovery Initial HEP Self Review Extra Crew STA Review Shift Change ERF Review Recovery Matrix Depende ncy Level Multiply HEP By Override Value Final Value Pca neg.
NC 1.0 Pcb 1.5e-04 X
1.0e-01 LD 5.0e-02 7.5e-06 Pcc neg.
NC 1.0 Pcd neg.
NC 1.0 Pce 3.0e-03 X
1.0e-01 LD 5.3e-02 1.6e-04 Pcf neg.
NC 1.0 Pcg neg.
NC 1.0 Pch neg.
NC 1.0 Final Pc (with recovery credited) 1.7e-04 Notes Self review is credited as the RWST level is continuously monitored.
Execution Performance Shaping Factors Special Requirements Tools Required Adequate Available Environment Lighting Normal Heat Normal Radiation
Background
Atmosphere Normal Equipment Accessibility Auxiliary Building Accessible Stress Moderate Notes Execution Complexity Complex 0HRECIRCSMY, Operator Fails To Initiate High Head Recirc. For A Small LOCA 4
Execution Unrecovered Procedure: 1ES-1.2, Error Type THERP HEP Stress Factor Over Ride Total HEP Step No.
Instruction Table Item K.1 Vent the bonnets of Sump B to RHR MVs by OPENING AND THEN CLOSING the following valves (Located in CS pump room):
Comments: Regarded as a single perceptual unit:
.. SI-32-3, CNTMT SUMP B TO 11 RHR PMP MV-32077 BONNET VENT
.. SI-32-4, CNTMT SUMP B TO 12 RHR PMP MV-32078 BONNET VENT EOM 20-7b 1
3.5e-03 2
3.5e-03 EOC 20-13 1
1.3E-3 K.7 Align RHR sump pump discharge valves (located above RHR Pits):
Comments: Regarded as single perceptual unit:
.. Position WL-87-1, RHR PIT SUMP #11 DISCHARGE, to "ANNULUS SUMP"
.. Position WL-87-2, RHR PIT SUMP #12 DISCHARGE, to "ANNULUS SUMP" EOM 20-7b 1
0.0e+0 0
2 0
0.0e+
00 EOC 20-13 1
1.3E-3 K.8 Unlock and place the following 480V breakers to "ON":
Comments: Regarded as single perceptual unit:
.. MCC 1K1-E2 (BKR 111J-19), 11 RHR HX TO 11 SI PMP MV-32206 (Located North of RHR pits) (Key #28)
.. MCC 1KA2-D1 (BKR 121B-34), 12 RHR HX TO 12 SI PUMP MV-32207 (Located East of Aux Operator Shack) (Key #29)
EOM 20-7b 1
8.5e-03 2
8.5e-03 EOC 20-12 12 3.8E-3 K.9 Remove cotter key AND travel stop for the following valves:
Comments: Regarded as single perceptual unit:
.. CV-31381, 11 CC HX CLG WTR OUTLET CV
.. CV-31411, 12 CC HX CLG WTR OUTLET CV A 1 7/16" socket and a 1 7/16" open-end wrench are needed EOM 20-7b 1
3.5e-03 2
3.5e-03 EOC 20-13 1
1.3E-3 K.10 Position WL-86-1, SAMPLE SINK TO CHEM DRAIN/RHR SUMP, to "CLOSED, Sample Sink Drains to 12 RHR Pit Sump".
Comments: Located halfway up the stairs by the Aux Bldg Operator shack EOM 20-7b 2
0.0e+0 0
2 0
0.0e+
00 EOC 20-13 1
1.3E-3 0HRECIRCSMY, Operator Fails To Initiate High Head Recirc. For A Small LOCA 5
Execution Unrecovered Procedure: 1ES-1.2, Error Type THERP HEP Stress Factor Over Ride Total HEP Step No.
Instruction Table Item 2
Reset SI Comments: Non-critical, recovered by step 5 EOM 20-7b 1
0.0e+0 0
2 0
0.0e+
00 EOC 20-12 1a neg.
3 Reset Containment Spray Comments: Non critical - recovered by step 5 EOM 20-7b 1
0.0e+0 0
2 0
0.0e+
00 EOC 20-12 1a neg.
4 Check Both Trains Of Safeguards Pumps Available For Recirculation Comments:
EOM 20-7b 1
2.6e-03 2
2.6e-03 EOC 20-9 3
1.3E-3 5
Stop One Train Of Safeguards Pumps Comments:.. RHR pump
.. SI pump
.. CS pump Recovered by subsequent steps that refer to valve alignments of "idle" pump.
EOM 20-7 1
0.0e+0 0
2 0
0.0e+
00 EOC 20-12 3
1.3E-3 6
Close RWST To RHR Isolation Valve For Idle RHR Pump:
Comments: MV-32084 OR MV-32085 EOM 20-7b 1
3.5e-03 2
3.5e-03 EOC 20-12 3
1.3E-3 7
Close SI Test Line To RWST Valves Comments:
EOM 20-7b 2
5.2e-03 2
5.2e-03 EOC 20-12 3
1.3E-3 8
Verify RHR To Reactor Vessel Injection Valve Alignment:
Comments:.. MV-32064 - OPEN
.. MV-32065 - OPEN EOM 20-7b 2
0.0e+0 0
2 0
0.0e+
00 10 Check Containment Level - GREATER THAN 1.75 FEET Comments:
EOM 20-7b 2
7.6e-03 2
7.6e-03 EOC 20-11 4
3.8E-3 11.a Verify RWST to RHR isolation valve for idle RHR pump - CLOSED:
Comments: MV-32084 MV-32085 EOM 20-7b 2
2.6e-03 2
2.6e-03 EOC 20-11 8
neg.
11.b Check Sump B to RHR MV bonnets vented per ATTACHMENT K Comments:
EOM 20-7b 2
2.6e-03 2
2.6e-03 0HRECIRCSMY, Operator Fails To Initiate High Head Recirc. For A Small LOCA 6
Execution Unrecovered Procedure: 1ES-1.2, Error Type THERP HEP Stress Factor Over Ride Total HEP Step No.
Instruction Table Item 11.c Open Sump B to RHR isolation valves for idle RHR pump:
Comments:.. MV-32075 AND MV-32077
-OR-
.. MV-32076 AND MV-32078 EOM 20-7b 2
5.2e-03 2
5.2e-03 EOC 20-12 3
1.3E-3 13.a Verify Sump B to RHR isolation valves are full open Comments: MV-32075 and MV-32077 OR MV-32076 and MV-32078 EOM 20-7b 2
2.6e-03 2
2.6e-03 EOC 20-11 8
neg.
13.b Start idle RHR pump Comments:
EOM 20-7b 2
5.2e-03 2
5.2e-03 EOC 20-12 3
1.3E-3 14.a Close SI pump suction isolation valve for idle SI pump Comments: MV-32162
-OR-MV-32163 EOM 20-7b 2
5.2e-03 2
5.2e-03 EOC 20-12 3
1.3E-3 14.b Open RHR supply to idle SI pump Comments:
EOM 20-7b 2
5.2e-03 2
5.2e-03 EOC 20-12 3
1.3E-3 14.c Start idle SI pump Comments:
EOM 20-7b 2
5.2e-03 2
5.2e-03 EOC 20-12 3
1.3E-3 14.d Check SI flow - FLOW INCREASE (1FI-925)
Comments: recovers crm actions, LD EOM 20-7b 2
1.0e-02 2
1.0e-02 EOC 20-11 4
3.8E-3 0HRECIRCSMY, Operator Fails To Initiate High Head Recirc. For A Small LOCA 7
Execution Recovered Critical Step No.
Recovery Step No.
Action HEP (Crit)
HEP (Rec)
Dep.
Cond. HEP (Rec)
Total for Step K.1 Vent the bonnets of Sump B to RHR MVs by OPENING AND THEN CLOSING the following valves (Located in CS pump room):
3.5e-03 1.8e-04 11.b Check Sump B to RHR MV bonnets vented per ATTACHMENT K 2.6e-03 LD 5.2e-02 K.8 Unlock and place the following 480V breakers to "ON":
8.5e-03 4.5e-04 11.b Check Sump B to RHR MV bonnets vented per ATTACHMENT K 2.6e-03 LD 5.2e-02 K.9 Remove cotter key AND travel stop for the following valves:
3.5e-03 1.8e-04 11.b Check Sump B to RHR MV bonnets vented per ATTACHMENT K 2.6e-03 LD 5.2e-02 4
Check Both Trains Of Safeguards Pumps Available For Recirculation 2.6e-03 1.5e-04 14.d Check SI flow - FLOW INCREASE (1FI-925) 1.0e-02 LD 6.0e-02 6
Close RWST To RHR Isolation Valve For Idle RHR Pump:
3.5e-03 1.8e-04 11.a Verify RWST to RHR isolation valve for idle RHR pump - CLOSED:
2.6e-03 LD 5.2e-02 7
Close SI Test Line To RWST Valves 5.2e-03 3.1e-04 14.d Check SI flow - FLOW INCREASE (1FI-925) 1.0e-02 LD 6.0e-02 10 Check Containment Level - GREATER THAN 1.75 FEET 7.6e-03 4.5e-04 14.d Check SI flow - FLOW INCREASE (1FI-925) 1.0e-02 LD 6.0e-02 11.c Open Sump B to RHR isolation valves for idle RHR pump:
5.2e-03 2.7e-04 13.a Verify Sump B to RHR isolation valves are full open 2.6e-03 LD 5.2e-02 0HRECIRCSMY, Operator Fails To Initiate High Head Recirc. For A Small LOCA 8
Execution Recovered Critical Step No.
Recovery Step No.
Action HEP (Crit)
HEP (Rec)
Dep.
Cond. HEP (Rec)
Total for Step 13.b Start idle RHR pump 5.2e-03 3.1e-04 14.d Check SI flow - FLOW INCREASE (1FI-925) 1.0e-02 LD 6.0e-02 14.a Close SI pump suction isolation valve for idle SI pump 5.2e-03 3.1e-04 14.d Check SI flow - FLOW INCREASE (1FI-925) 1.0e-02 LD 6.0e-02 14.b Open RHR supply to idle SI pump 5.2e-03 3.1e-04 14.d Check SI flow - FLOW INCREASE (1FI-925) 1.0e-02 LD 6.0e-02 14.c Start idle SI pump 5.2e-03 3.1e-04 14.d Check SI flow - FLOW INCREASE (1FI-925) 1.0e-02 LD 6.0e-02 Total Unrecovered:
6.0e-02 Total Recovered:
3.4e-03
Document Control Desk Page 2 Enclosures (3) cc:
Administrator, Region III, USNRC License Renewal Project Manager, Prairie Island, USNRC Resident Inspector, Prairie Island, USNRC Prairie Island Indian Community ATTN: Phil Mahowald Minnesota Department of Commerce NSPM Responses to NRC Requests for Additional Information Dated December 24, 2008 1
SAMA Follow Up RAI 1e The response (p. 10) noted a probabilistic risk assessment (PRA) maintenance and an updated fact and observation (F&O) had been identified and resolved. Describe the F&O and its resolution. In addition, describe the scope and personnel qualifications of the three reviews identified as being part of the self-assessment process (p. 11).
NSPM Response to SAMA Follow Up RAI 1e PRA Program Maintenance & Update F&O A description of the PRA Program Maintenance and Update Fact & Observation from the Westinghouse Owners Group Prairie Island PRA Peer Review of September 2000 is provided below with a summary of its resolution.
==
Description:==
A PRA group procedure requires evaluation of PRA results when the model is updated. The procedure indicates that the evaluation must include a review of the top cutsets and basic event importance measures to ensure that dominant contributors to risk are modeled accurately and that dependant operator actions are treated appropriately. The procedure also requires a focus on understanding and addressing risk significant issues that have resulted from the latest requantification.
For a full PRA update, consideration should also be given to reviewing more than just dominant contributors and top cutsets, depending on the extent of the modeling change. For example, any updated model revision may produce results that will require a deeper review than an examination of top cutsets, top risk importance contributors, and overall CDF/LERF values.
Resolution:
Two procedures were developed to address the maintenance and update process of the PRA model.
- 1. A fleet procedure was created in order to provide a PRA guideline for model maintenance and update. The purpose of this guideline is to identify requirements for maintaining and upgrading the PRA model to ensure that its representation of the as-built, as-operated plant is sufficient to support applications for which it is being used.
- 2. A site procedure was created in order to provide a guideline to perform a PRA model quantification. The purpose of this guideline is to provide instructions on how to structure the Quantification of the PRA model following a periodic or maintenance update of the PRA model. The PRA Quantification is designed to examine the models result and to confirm that it reflects the design, operation, and maintenance of the plant. The PRA Model Quantification Guideline NSPM Responses to NRC Requests for Additional Information Dated December 24, 2008 2
prescribes reviews on cutsets, recovery actions, mutually exclusive events, circular logic, asymmetries, initiating event distributions, important operator actions, just to name a few. It was created to meet the High Level requirements for the model Quantification Element as stated in the ASME Standard for PRA.
Self Assessments Descriptions of the scope and personnel qualifications for three self-assessments are provided below:
PRA Program Snapshot Evaluation (April 2007)
Topic:
PINGP PRA benchmark against Regulatory Guide 1.200, Revision 1, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities.
Scope:
Evaluate the following with respect to impact on conformance with industry standards and expectations:
x PINGP PRA model against selected PRA elements.
x Open PRA Model Review items.
x Potential for MSPI margin improvement Standards:
x Regulatory Guide 1.200, Revision 1, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities; x ASME RA-S-2005, Standard for Probabilistic Risk Assessment for Nuclear Power Applications; x NEI 00-02, Self-Assessment Process for Addressing ASME PRA Standard RA-SB-2005, as Endorsed by NRC Regulatory Guide 1.200.
Objectives:
x Perform a complete review of selected PRA technical Elements as defined by Regulatory Guide 1.200, Revision 1 and ASME RA-S-2005 capability category II.
x Determine if there are any PRA model issues for the MSPI systems that could improve MSPI margin if corrected or implemented.
Team Resources:
The review team consisted of members, several of which had extensive knowledge in PRA methods. There were four team members with 18 years or greater experience in PRA. One team member had 9 years of PRA experience and two members had 3 years or less. The total number of years of PRA experience for the team was approximately 90 years. This does not include the number of years of experience in other areas of the nuclear industry.
NSPM Responses to NRC Requests for Additional Information Dated December 24, 2008 3
PRA Program Focused Self-Assessment (May 2004)
Topic:
Assess the PI PRA Program against the Nuclear Management Company (NMC)
Fleet PRA Standard and industry best practices. This will be the first self-assessment of the PI PRA program and will maintain the program health status in the Assessment category green.
Scope:
The assessment consists of a combination of document reviews, interviews, and field observations. Data should include, but is not limited to:
x Procedure and document reviews x Personal observations or interviews x CAP and/or other database reviews x Compliance with NMC Fleet PRA Standard x Industry best practices Standards:
x NMC Fleet Probabilistic Risk Assessment Standard x PI Procedure for the Program Health Process x PI Procedure for the Action Request System Objectives:
x Has the facility established and is it implementing and maintaining the PRA program consistent with the requirements of the above listed Standards?
x Are the Program related outputs consistent with the related standard (Program Health, Gap Analysis, Program Notebook, spreadsheets, goals, etc?)
Team Resources:
The review team consisted of four members, several of which had extensive knowledge in PRA methods. There were three team members with 14 years or greater experience in PRA. The other team member had 6 years of PRA experience. The total number of years of PRA experience for the team was approximately 51 years. This does not include the number of years of experience in other areas of the nuclear industry.
Nuclear Oversight Observation Report (June 2003)
Topic:
PINGP PRA Risk Assessment Program reviewed against NUMARC 93-01, Industry Guideline for monitoring the Effectiveness of Maintenance Activities at Nuclear Power Plants.
NSPM Responses to NRC Requests for Additional Information Dated December 24, 2008 4
Scope:
The assessment consists of a combination of document reviews, interviews, and observed performance and review of results. Data should include, but is not limited to:
x Procedure and document reviews x Personal observations or interviews x CAP and/or other database reviews Documents Reviewed:
x NUMARC 93-01, Industry Guideline for monitoring the Effectiveness of Maintenance Activities at Nuclear power Plants, Rev 3, July 2000.
x 10CFR50.65 x NMC Fleet Probabilistic Risk Assessment Standard x NMC Fleet Procedure for PRA Guideline for Peer Review F&O Assessment x PI Procedure for MR(a)(4) PRA Risk Assessment Preparation x PI Procedure for On-Line Scheduling Process x PI Procedure for Engineering Support Personnel Training Plan x Regulatory Guide 1.182, Assessing and Managing Risk Before Maintenance Activities at Nuclear Power Plants, May 2000.
x PI Procedure for the Assessment and Management of Risk Associated with Maintenance Activities x NMC PRA Gap Analysis/PRA Improvement Plan (4/8/03)
Objectives:
x Perform a review of site procedures related to the assessment and management of risk associated with maintenance activities against NUMARC 93-01 guidance.
x Review gap analysis summary for PI PRA Program and compared to NMC Fleet PRA Standard.
Interview and/or observe Work Week Schedulers and Operation personnel on the performance of Maintenance Rule (a)(4) risk assessments.
Team Resources:
The review team consisted of one Nuclear Oversight (NOS) Senior Assessor.
The NOS Senior Assessor had 16 years of nuclear experience. This included 2 years experience in NOS and 14 years experience in the Engineering and Chemistry departments.
SAMA Follow Up RAI 1f The Prairie Island Nuclear Generating Plant (PINGP) PRA uses a Westinghouse reactor coolant pump seal loss-of-coolant accident (LOCA) model (WCAP-10541, 1986), that pre-dates the Westinghouse Owners Group (WOG) 2000 model approved by the NRC in 2003 for plants using high-temperature O-rings. The peer review of the PINGP PRA occurred prior to the approval of the WOG 2000 model, and as such would not have NSPM Responses to NRC Requests for Additional Information Dated December 24, 2008 5
identified this as an issue. Provide an assessment of the impact on the severe accident mitigation alternative (SAMA) identification and screening if the PINGP PRA utilized the WOG 2000 model.
NSPM Response to SAMA Follow Up RAI 1f All four of Prairie Islands installed RCPs have been upgraded with high temperature O-rings. High temperature O-rings and hard seal parts manufactured by Areva have been evaluated and accepted as interchangeable with the same parts manufactured by Westinghouse. Westinghouse and Areva O-rings and hard seal parts are installed in various combinations in all four of Prairie Islands installed pumps.
However, application of the WOG 2000 seal LOCA model is reserved for Westinghouse-supplied packages with high temperature O-ring seals. In its SER endorsing the WOG 2000 model (WCAP-15603 Rev. 1A), the NRC stated:
WCAP-15603, Revision 1, was published to provide a consensus RCP seal leakage model for those plants that utilize the Westinghouse seal packages with high-temperature O-rings. The WOG 2000 model does not address the Westinghouse seal packages utilizing old O-rings. The staff expectation is that the Rhodes model will be used to model the Westinghouse seal packages that use old O-rings.
The Areva O-ring seals have been qualified by Jeumont for the same high temperature service as the Westinghouse O-rings and there is no difference in design basis performance characteristics. However, there may be a difference in the beyond design basis ultimate failure pressure characteristics. At this point in time, this difference has not been resolved. Therefore, for the purposes of responding to this question, a sensitivity analysis involving a modification to the PRA RCP seal leakage models to conservatively incorporate the Rhodes model (as presented in WCAP-16141, Section 5.0) was developed. In this model, four potential leakage scenarios are postulated:
Table 1f-1 RCP Seal Leakage Scenarios for the Unqualified Seal Material Timing After Loss of All RCP Seal Cooling Probability 0-13 minutes 13 minutes - 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />
> 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> gpm/pump gpm/pump gpm/pump 21 21 300 0.78 21 76 300 0.02 21 182 300 0.195 21 480 480 0.005
Reference:
WCAP-16141, Table 5-1 These leakage scenarios are referred to as 21/300, 76/300, 182/300, and 480 in the WCAP SBO event tree for a typical plant with unqualified RCP seals.
NSPM Responses to NRC Requests for Additional Information Dated December 24, 2008 6
Figure 1f-1 below is a reproduction of Figure 5-1 from WCAP-16141:
Figure 1f-1 SBO Event Tree Addressing RCP Seal Leakage for Unqualified Seal Material NSPM Responses to NRC Requests for Additional Information Dated December 24, 2008 7
Since the IPE, the PINGP seal LOCA model has relied on the results of thermal hydraulic analysis cases run using MAAP code 3.0b. This version of the MAAP code is known to be significantly conservative with respect to the timing of core uncovery and core damage following initiation of RCP seal LOCA events. PINGP is currently in the process of updating its MAAP thermal hydraulic analyses to new cases run using Revision 4.0.6 of the MAAP4 computer code. Currently only a limited set of SBO cases have been run and the available case results are considered preliminary. Therefore, a set of generic thermal hydraulic analysis cases using MAAP4 was used as a check of the preliminary, plant-specific results. WCAP-16141, Appendix A provides generic core uncovery times for Westinghouse reactor classes, including 2-loop plants such as Prairie Island. The document states:
Since the NRC SE item # 7 requires plant-specific analyses for core uncovery times, the value of this appendix can be seen as follows:
- 1. It provides the minimum factors to be considered in MAAP analyses for specific scenarios for core uncovery.
- 2. It reports generic core uncovery times that can be compared against plant-specific calculations as a sanity check.
Thus, the contents of this appendix could assist in obtaining uniformity of calculation models and results throughout the industry.
Moreover, it is not expected that plant-specific analyses will yield substantially different core uncovery times than those reported in this appendix.
The seal LOCA analysis results for 2-loop plants from WCAP-16141, Appendix A (specifically Table 3) were used as a check on the reasonableness of the timing of core uncovery and core damage provided by the preliminary plant-specific MAAP cases.
NSPM Responses to NRC Requests for Additional Information Dated December 24, 2008 8
Table 1f-2 below provides a summary of the available MAAP case runs and results and a comparison with the generic case results:
Table 1f-2 Summary of Available Plant-Specific and Generic MAAP Cases for RCP Seal LOCA Pump Seal Leakage Rate (1)
(gpm)
Secondary Side Heat Sink (2)
RCS Cooldown and Depress-urization Time of AC Recovery (hrs)
(4)
Time of Core Uncovery (hrs)
(5)
Time to Core Damage (hrs)
(6)
PINGP-Specific WCAP-16141 PINGP-Specific WCAP-16141 PINGP-Specific WCAP-16141 PINGP-Specific WCAP-16141 0 / 21 21 / 21 Yes Yes(3a) 6 No (no CU) 32.2 (no CD) 33.8 0 / 480 21 / 480 Yes Yes(3) 6 No 5.3 6.2 (no CD) 7.5 0 / 480 21 / 480 Yes No 5 (7)
No 1.8 1.9 2.3 2.4 0 / 480 21 / 480 No No 1
No N/A (8) 1.8 N/A (8) 2.2 (1) Presented in WCAP-16141, Appendix A, Table 3 format (initial seal leakage rate/leakage rate after X minutes; X=13 for PINGP, X=30 for WCAP)
(2) TDAFWP runs until DC control power is lost (2 hrs assumed for PINGP)
(3) Cooldown/Depressurization assumed started at t=30 minutes (3a) Cooldown/Depressurization assumed started at t=420 minutes (One hour after AC Power Restored)
(4) AC power restored for initiation of RCS makeup to prevent core uncovery; WCAP-16141 cases did not model this as purpose was to determine time required (5) PINGP runs assume injection systems restored after AC recovery; WCAP-16141 does not credit AC recovery (6) Defined as hottest core node Temperature > 1800 F or hottest core exit Temperature >
1200 F for 30 minutes (PINGP); core exit thermocouples > 1200 F (WCAP-16141)
(7) Although AC is restored in MAAP case, it occurs too late to prevent core damage (8) No available MAAP cases for PINGP for these conditions; assumed core damage if TDAFWP fails and AC not recovered within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> The preliminary results for the available plant-specific MAAP cases were found to be reasonably close to the WCAP generic 2-loop plant results. In cases where AC is not recovered in time, core uncovery and core damage occur slightly earlier in these scenarios for the PINGP MAAP cases than for the generic cases. Key contributors to this difference are the assumptions of a higher initial core power level (1683 MWt vs.
1518 MWt) and a lower AFW capacity (200 gpm vs. 400 gpm) for PINGP than for the generic case. The plant-specific case runs ended between t=12 hours to t=24 hours (depending on the scenario), whereas the WCAP generic runs were allowed to run for a longer period.
Based on these results, a SBO event tree model for PINGP based on the Rhodes model presented in WCAP-16141, Section 5.0, was developed, except that only those event tree branches corresponding to the largest seal leakage assumption (480 gpm/pump) were included, as there are no available plant-specific or generic MAAP cases that model the Rhodes assumption of a 300 gpm leak occurring at 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. This treatment provides a very conservative, bounding model for SBO; however, the results are NSPM Responses to NRC Requests for Additional Information Dated December 24, 2008 9
responsive to the RAI question. Figure 1f-2 below provides a graphical representation of the event tree model that was used for this sensitivity case:
LTI Long Term Inventory STI Short Term Inventory ACR AC Power Recovery (to initiate HPI prior to core uncovery)
RLO RCP Seal Leakage Scenarios ASSU ME 480 G PM CASE ASSU ME 480 G PM CASE ASSU ME 480 G PM CASE OA7 Operator Action:
Cooldown and Depress. RCS AFT TD AFW Pump Runs for 2 hrs INITIATOR Station Blackout Class Name O K SBO -RAI-1 Core Damage SBO -RAI-2 Core Damage SBO -RAI-3 Core Damage SBO -RAI-4 O K SBO -RAI-5 Core Damage SBO -RAI-6 Core Damage SBO -RAI-7 Core Damage SBO -RAI-8 O K SBO -RAI-9 Core Damage SBO -RAI-10 Core Damage SBO -RAI-11 Core Damage SBO -RAI-12 Figure 1f-2 SBO Event Tree for Sensitivity Analysis (Bounding 480 GPM/Pump Leakage Case Assumption)
Note that the four potential leakage scenarios modeled in WCAP-16141 Figure 5-1 (21/300, 76/300, 182/300, and 480) have been conservatively reduced to only one, the 480 gpm case, based on a lack of available plant-specific MAAP analyses for the other cases. This treatment effectively assumes that, on any SBO event, a 480-gpm per pump leakage event occurs at t=13 minutes with a probability of 1.0. Only the RLO (assumed leakage scenario) and ACR (AC Power Recovery) event tree headings represent changes to the existing SBO event tree logic in the PRA model; all of the failure logic associated with the other event tree headings already exist in the PRA model and were not changed for this sensitivity analysis. Required power recovery times were chosen based on the results of the (preliminary) plant-specific MAAP analyses for the 480 gpm per pump leakage case (see Table 1f-2). It was assumed that power must be restored within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> in order for the operator to successfully start and align injection systems to prevent core damage in the event that the turbine-driven AFW pump successfully operates for 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />, and operator action to cool down and depressurize the RCS at 30 minutes is successful. It was assumed that power must be restored within the first hour in the cases where either AFW fails to operate or cooldown and depressurization is NSPM Responses to NRC Requests for Additional Information Dated December 24, 2008 10 unsuccessful. Failure of power recovery results in core damage regardless of the leakage scenario.
Table 1f-3 provides the results of the sensitivity analysis (SBO contribution) compared to the original PRA SBO contribution as presented in the response to SAMA RAI 1b in the NSPM letter dated November 21, 2008:
Table 1f-3 Change in SBO CDF Contribution Over Baseline Model SBO CDF Contribution (per rx-yr)
Comment Sensitivity Case 1.04E-06 Sensitivity case assumes 480 gpm/pump leakage for all SBO events; core uncovery/damage timing is based on MAAP 4.0 TH analysis Baseline (Rev. 2.2 SAMA) 8.52E-07 Baseline assumes WCAP-10541 leakage and seal failure probabilities; core uncovery/damage timing is based on MAAP 3.0b TH analysis Change:
1.90E-07
= (22% increase over baseline)
The results of the sensitivity analysis show that when the impact of moving to the more accurate RCP seal LOCA thermal hydraulic calculations of MAAP 4.0 is taken into consideration, the contribution of SBO remains small even when assuming much higher seal leakage rates very early in the event. As shown in Table 1f-1 above, the probability that an RCP seal leakage event scenario will be less severe than 480 gpm (even for unqualified seals) is over 99%. Therefore, when sufficient plant-specific MAAP analysis case runs are available to allow modeling of the lower leakage rates specified in the Rhodes model (similar to that shown in Figure 1f-1 above), it is anticipated that the SBO contribution to the overall CDF will actually be significantly lower than it was calculated to be in the Rev. 2.2 SAMA version.
Based on the results of the sensitivity analysis presented above, NSPM believes that there would have been no impact on the SAMA identification and screening presented in the ER had an RCP seal leakage model consistent with more currently acceptable methodologies been utilized in the PINGP PRA model.
SAMA Follow Up RAI 1h Based on the description provided, the dominant internal flooding sequence (involving cooling water header rupture) would result in core damage at both units. The benefits of any related SAMAs should therefore be doubled. Identify all sequences resulting in core damage at both units. Confirm that the benefits for related SAMAs were appropriately assessed, i.e., doubled where appropriate. (Also see RAI 5.b)
NSPM Responses to NRC Requests for Additional Information Dated December 24, 2008 11 NSPM Response to SAMA Follow Up RAI 1h The PINGP PRA model is a linked fault tree model that quantifies Unit 1 and Unit 2 core damage risk independently. The impact of loss of equipment that is shared, such as the Cooling Water system, is modeled explicitly in the failure logic for both units and is reflected separately in the risk metrics for each unit. Similarly, equipment that exists on one unit but that can be cross-tied or otherwise put into service to support the other unit is modeled explicitly. This allows the model to account for the fact that, on a dual-unit initiating event, equipment on one unit that would otherwise be available to provide a support function for the opposite unit, may not be available. All SAMAs were evaluated with attention to the potential decrease in risk to each unit individually. Therefore, there is no need to double the core damage risk benefit for any of the SAMAs evaluated.
Also, a number of SAMAs were developed that have a positive risk benefit to both units (generally these SAMAs involve enhancements to equipment that is either shared by both units or that is crosstie-able between units). Typically these SAMAs are implemented by a single modification that provides benefits to both units. As previously discussed, the costs associated with these modifications were evenly apportioned between the units (this is appropriate since the risk-reduction benefit to each unit is determined separately). This process ensures that the benefits for these SAMAs were appropriately assessed.
SAMA Follow Up RAI 2b The last paragraph of the RAI response provides a qualitative comparison of the conditional probabilities of the steam generator tube rupture (SGTR) under specific primary and secondary side conditions, but does not include a characterization of the PINGP-specific results for induced SGTR. Provide the frequency-weighted conditional probability of temperature induced-SGTR (over all sequences involving high primary side and low secondary side pressure, and a dry secondary side) for PINGP. Provide an assessment of the impact on the SAMA identification and screening if a conditional probability of 0.25 (similar to NUREG-1570) is assumed for these sequences.
NSPM Response to SAMA Follow Up RAI 2b NSPM understands this question to be asking for the impact to the SAMA results given the assumption that containment bypass due to induced SGTR from any cause (not only TI-SGTR as identified in the question) occurs with a probability of 0.25 following any core damage sequence involving high primary side and low secondary side steam generator pressure, and a dry steam generator secondary side. This is consistent with the NUREG-1570 induced SGTR baseline case results for Surry presented in NUREG-1570 Table 5.8 and described in NUREG-1570 Section 6.1. As discussed during the December 9, 2008, conference call with the NRC staff, NSPM could not identify any NUREG-1570 results showing a 0.25 conditional probability of TI-SGTR alone.
NSPM Responses to NRC Requests for Additional Information Dated December 24, 2008 12 Tables 2b-1 and 2b-2 below show the Unit 1 and Unit 2 95th percentile cost-benefit results, respectively, as modified by the NSPM responses to SAMA RAI questions 6.b and 6.g in the NSPM letter of November 21, 2008. Note that the positive net values (indicated by bold italics) for SAMAs 9 and 22 on both units, and SAMA 19a on Unit 2, indicates that they were found to be cost beneficial on those units. In the tables below, the increased cost of implementation of SAMA 2 described in the response to SAMA RAI 6.b has been reflected in the tables, as has the corresponding increase in the cost of implementation for SAMA 12 (SAMA 12 assumes the modifications associated have also been installed). In addition, the cost associated with SAMA 20 has been modified as described in the response to SAMA Follow-Up RAI 6c below.
Table 2b-1 Unit 1 95th Percentile Results per SAMA Uncertainty SAMA ID Cost of Implementation Ratio of 95th to SAMA CDF Unit 1 Averted Cost-Risk Net Value SAMA 1
$4,250,000 2.89
$775,079
-$3,474,921 SAMA 2
$1,200,000 2.69
$332,481
-$867,519 SAMA 3
$250,000 2.75
$205,793
-$44,207 SAMA 5
$1,500,000 2.86
$216,922
-$1,283,078 SAMA 9
$62,500 2.87
$180,002
$117,502 SAMA 10
$2,866,000 2.84
$132,985
-$2,733,015 SAMA 12
$1,800,000 2.79
$519,433
-$1,280,567 SAMA 15
$130,000 2.90
$0
-$130,000 SAMA 17
$2,362,000 2.89
$254,417
-$2,107,583 SAMA 19
$700,000 2.86
$172,754
-$527,246 SAMA 19a
$1,935,000 2.77
$914,173
-$1,020,827 SAMA 20
$244,00 2.85
$153,784
--$90.216 SAMA 21
$3,000,000 2.91
$32,882
-$2,967,118 SAMA 22
$39,000 2.89
$44,386
$5,386 Table 2b-2 Unit 2 95th Percentile Results per SAMA Uncertainty SAMA ID Cost of Implementation Ratio of 95th to SAMA CDF Unit 2 Averted Cost-Risk Net Value SAMA 1
$4,250,000 2.82
$763,219
-$3,486,781 SAMA 2
$1,200,000 2.79
$343,506
-$856,494 SAMA 3
$250,000 2.71
$207,943
-$42,057 SAMA 5
$1,500,000 2.89
$642,520
-$857,480 SAMA 9
$62,500 2.75
$173,012
$110,512 SAMA 10
$2,866,000 2.86
$138,918
-$2,727,082 SAMA 12
$1,800,000 2.92
$881,438
-$918,562 SAMA 15
$130,000 2.84
$54,901
-$75,099 SAMA 17
$2,362,000 2.86
$1,397,133
-$964,867 SAMA 19
$700,000 2.87
$173,931
-$526,069 SAMA 19a
$1,935,000 2.74
$2,542,917
$607,917 SAMA 20
$244,000 2.85
$155,678
-$88,322 SAMA 21
$3,000,000 2.76
$34,610
-$2,965,390 SAMA 22
$39,000 2.84
$192,028
$153,028 NSPM Responses to NRC Requests for Additional Information Dated December 24, 2008 13 Tables 2b-3 and 2b-4 provide the same information for each unit, but the averted cost-risk values include the increased value due to the assumption that ISGTR occurs with a conditional probability of 0.25 following a High-Dry core damage event.
Table 2b-3 Unit 1 95th Percentile Results per SAMA Uncertainty SAMA ID Cost of Implementation Ratio of 95th to SAMA CDF Unit 1 Averted Cost-Risk Net Value SAMA 1
$4,250,000 2.89
$1,868,573
-$2,381,427 SAMA 2
$1,200,000 2.69
$578,252
-$621,748 SAMA 3
$250,000 2.75
$386,974
$136,974 SAMA 5
$1,500,000 2.86
$114,588
-$1,385,412 SAMA 9
$62,500 2.87
$340,502
$278,002 SAMA 10
$2,866,000 2.84
$204,758
-$2,661,242 SAMA 12
$1,800,000 2.79
$794,683
-$1,005,317 SAMA 15
$130,000 2.90
$0
-$130,000 SAMA 17
$2,362,000 2.89
$265,104
-$2,096,896 SAMA 19
$700,000 2.86
$172,668
-$527,332 SAMA 19a
$1,935,000 2.77
$1,756,854
-$178,146 SAMA 20
$244,000 2.85
$153,784
-$90,216 SAMA 21
$3,000,000 2.91
$222,090
-$2,777,910 SAMA 22
$39,000 2.89
$152,585
$113,585 Table 2b-4 Unit 2 95th Percentile Results per SAMA Uncertainty SAMA ID Cost of Implementation Ratio of 95th to SAMA CDF Unit 2 Averted Cost-Risk Net Value SAMA 1
$4,250,000 2.82
$2,034,256
-$2,215,744 SAMA 2
$1,200,000 2.79
$646,787
-$553,213 SAMA 3
$250,000 2.71
$422,548
$172,548 SAMA 5
$1,500,000 2.89
$520,978
-$979,022 SAMA 9
$62,500 2.75
$355,554
$293,054 SAMA 10
$2,866,000 2.86
$224,331
-$2,641,669 SAMA 12
$1,800,000 2.92
$1,236,665
-$563,335 SAMA 15
$130,000 2.84
$117,199
-$12,801 SAMA 17
$2,362,000 2.86
$1,429,419
-$932,581 SAMA 19
$700,000 2.87
$172,989
-$527,011 SAMA 19a
$1,935,000 2.74
$3,534,505
$1,599,505 SAMA 20
$244,000 2.85
$156,367
-87,633 SAMA 21
$3,000,000 2.76
$263,556
-$2,736,444 SAMA 22
$39,000 2.84
$356,733
$317,733 Note that, under the hypothetical assumption that 25% of High-Dry core damage sequences lead to ISGTR, SAMA 3 (Provide Alternate Flow Path from RWST to Charging Pump Suction) becomes cost-beneficial on both units.
However, this assumption is based on results generated in NUREG-1570, which used the Surry plant (3-loop PWR) as the baseline plant. As described in the response to NSPM Responses to NRC Requests for Additional Information Dated December 24, 2008 14 SAMA RAI 2.b in the NSPM letter of November 21, 2008, the ISGTR analysis incorporated in the Rev. 2.2 SAMA PRA model is based on a methodology developed specifically for Westinghouse 2-loop plants (WCAP-16341-P). This methodology was developed with the knowledge of NUREG-1570 and other more recent analyses of the potential for ISGTR. Therefore, NSPM does not feel that the assumption that 25% of High-Dry core damage sequences lead to ISGTR is valid for Prairie Island. Further, as described in the response to RAI question 8.i, NSPM has already agreed to further assess the cost benefit of a proposed steam generator safety valve gagging device that could significantly reduce the risk associated with ISGTR. Therefore, NSPM does not plan to further assess the potential for implementation of SAMA 3.
During the validation of this response a discrepancy was identified in the baseline ISGTR sequence quantification in the Rev. 2.2 SAMA model. Specifically, a Small LOCA core damage sequence that did not involve dry SG conditions was included in the ISGTR quantification, while another Small LOCA core damage sequence which did involve dry SG conditions was not included. The sequence that was included has a much higher frequency than does the sequence that was not included, and there are no subsequent failure events included in the ISGTR models that would be negatively impacted had the correct sequence been used; therefore, use of the model without dry SG conditions provides conservative results for the ISGTR quantification. All of the results presented thus far (in the ER and in the RAI responses, including this one) include the conservative treatment. Therefore, the set of SAMAs that has been identified as cost beneficial to date represents an upper bound relative to ISGTR (i.e., correction of the discrepancy may show that SAMA 3 is not cost-beneficial). This discrepancy is being entered into the Corrective Action Program for resolution.
SAMA Follow Up RAI 3a and 3b In order to support the assumption that the fire core damage frequency (CDF) is comparable to the internal events CDF (9.79E-6 for Unit 1 and 1.21E-5 for Unit 2), it should be shown, preferably through sensitivity analysis or other quantitative arguments, that the individual plant examination of external events (IPEEE) fire CDF value (4.9E-5) is conservative by a factor of 4 to 5 (for Units 2 and 1, respectively). The information provided in the RAI response is general and qualitative in nature, and does not sufficiently demonstrate that such a large reduction in the fire CDF is appropriate (For example, the discussion of control room fires [65% contributor] states that partitioning of a cabinet within a panel zone was not credited. What is not stated is that the main control panel is a contiguous arrangement of panel sections without barriers or boundaries. The IPEEE used partitioning process of overlapping zones [25 zones] to subdivide the panel based on consideration of nominal panel fire heat rate, nominal heat value of the cable bundle, available fire suppression time of 15 minutes and the general vertical propagation tendency of fire in open back panels. Therefore, the zones are subdivided panel sections. In addition, the statement that manual suppression credit was only applied to cutsets representing <13% of the internal fires CDF appears to be misleading.
The IPEEE indicates that manual suppression was applied to all control room fires with a 10 minute fire suppression failure probability of 1.6E-2.). However, the 46 percent NSPM Responses to NRC Requests for Additional Information Dated December 24, 2008 15 reduction in the conditional core damage probability (CCDP) since the IPEEE cited in the response (p. 23) would suggest that a factor of 2 reduction in CDF might be justified.
Provide additional information on how the CCDP was computed, and on how the events on which it is based relate to the dominant fire events. Clarify whether the CCDP value includes station blackout events.
NSPM Response to SAMA Follow Up RAI 3a and 3b A complete update to the fire PRA models provided in the Fire IPEEE is not yet available. In its response to SAMA RAI 3b of November 21, 2008, NSPM provided as much quantitative evidence that the risk due to internal fires is lower than calculated in the IPEEE as was reasonably available.
The fire IPEEE stated clearly that the control room panels are subdivided panel sections.
This fact is not relevant to the point made in the response. Further subdivision of panel zones for refinement of the analysis was not performed in the IPEEE. The linear length of each analysis zone was taken to be 10 feet, and each zone overlapped with the zones adjacent to it such that damage to components located within any main control board area was assumed to result from a fire initiated within either of two panel zones.
Also, the assumption that any fire (regardless of intensity, location or other factors) that initiates within a panel zone damages all equipment within the panel zone is very conservative. Current control room analysis methodologies would allow further refinement to credit the potential for self-extinguishment given separation between combustibles within panel zones and cable and component materials used within the panels.
The statement in the RAI response that manual suppression credit was only applied to cutsets representing <13% of the internal fires CDF is correct. The statement in the follow-up question, "The IPEEE indicates that manual suppression was applied to all control room fires with a 10 minute fire suppression failure probability of 1.6E-2, is incorrect. This value was used in the control room fire closeout strategy scenario document, attached to the IPEEE report as Appendix B, Attachment 2 (ERIN Engineering Calculation 130-98-01, Fire Area Scenario for FA 13, p. 7 and p. A-13).
This document provides the initial development of the control room analysis, but the quantitative portions of this document were used only for initial screening of the control room (Fire Area 13). The control room did not screen out, and the analysis was further refined for the final IPEEE quantification. Page A-13 of the scenario document provides the event tree used in the initial screening quantification, and shows the 1.6E-2 manual suppression failure probability value. However, the diagram also shows that credit for manual suppression was only applied to fires that were large enough to propagate beyond the boundaries of the initiating panel zone. As shown on the diagram, only 8.3%
of fires were assumed to be fires of this magnitude (this event tree and severity factor were carried through the final analysis quantification). In the final, overall fire IPEEE quantification results (including control room fires and fires in all other fire areas), credit for the potential for successful fire suppression was only applied to cutsets representing
<13% of the internal fires CDF.
NSPM Responses to NRC Requests for Additional Information Dated December 24, 2008 16 Note that the final probability value for failure of manual suppression of control room fires used in the final IPEEE quantification (4.0E-2) was higher than that shown on the diagram on page A-13 of the control room scenario document, while the probability of failure of the operators to successfully shut the plant down from outside the control room (given failure of manual suppression) was lower (6.4E-2). However, in the final quantification for the IPEEE, the overall sequence CCDP (given a fire initiating in the control room) was actually higher by over 60% than that shown on page A-13 of the scenario document (see Table 3ab-1 below).
Table 3ab-1 Control room abandonment sequence CCDP:
Change from scenario document to that used in final IPEEE fire PRA results Fire Severity
(% that are Large fires)
Manual Suppression (failure of)
Shutdown from Outside CRM (failure of)
Sequence CCDP FA 13 Scenario document 8.30E-02 1.60E-02 1.00E-01 1.33E-04 Final IPEEE parameters 8.33E-02 4.00E-02 6.40E-02 2.13E-04 Sequence CCDP increase over scenario document assumptions =
61%
The 46 percent reduction in the conditional core damage probability (CCDP) since the IPEEE, cited in the response, applies to normal (or general) plant transient-initiated events. This value was computed by comparing the CCDP of the I-TR1 (normal transient) initiating event from the Level 1, Rev. 1 internal events model results, to the CCDP for the corresponding initiating event (I-1-TR1) in the Rev. 2.2 SAMA model (The Fire IPEEE PRA model was built upon the Level 1, Rev. 1 Unit 1-only internal events PRA model). The TR1 initiating event CCDP is relevant to fires that result in a unit shutdown (with appropriate accounting for fire-induced equipment damage) but that do not result in a fire-induced LOCA or other more complicated transients such as loss of main feedwater or SBO. This is generally considered to be the most likely transient to occur following an initiating fire event at PINGP.
However, as described in the NSPM response to SAMA RAI 3b, the IPEEE results showed that the dominant fire initiating events are fires in control room panel zones 5 and 6, which together account for approximately 40% of the total fire-induced CDF.
These events are assumed to involve loss of main feedwater (MFW) and auxiliary feedwater (AFW). The reduction in CCDP associated with loss of MFW events (the I-TR4 initiating event in the Level 1, Rev. 1, model compared to the I-1-TR4 initiating event from the Rev. 2.2 SAMA model) is 31.7%. This CCDP reduction also applies to the most risk-significant fires from Fire Area 32 (Auxiliary Feedwater Pump/Instrument Air Compressor Room), which also involve loss of MFW, and other initiating events that were not screened out of the IPEEE analysis.
Also, as described in the NSPM response to SAMA RAI 3b the IPEEE results showed that fires in control room panels leading to LOOP/SBO account for approximately 11% of NSPM Responses to NRC Requests for Additional Information Dated December 24, 2008 17 the total fire-induced CDF. Although the SBO contribution to core damage was not directly quantified for the Level 1, Rev. 1, internal events model update, the loss of offsite power (LOOP) initiating event contribution was quantified. The reduction in CCDP associated with LOOP events (the I-LOOP initiating event in the Level 1, Rev. 1, model compared to the I-LOOP initiating event from the Rev. 2.2 SAMA model) is 80.6%.
LOOP events in which onsite AC power from the emergency diesel generators is available following an accident progression similar to a loss of MFW initiating event (see discussion regarding reduction of the CCDP associated with loss of MFW in the preceding paragraph). As shown in Table 1f -3 above, the CDF contribution associated with SBO events was calculated to be 8.52E-7/rx-yr for the Rev. 2.2 SAMA model.
However, as described in the response to SAMA Follow Up RAI 1f above, when sufficient plant-specific MAAP analysis case runs are available to allow modeling of the lower leakage rates specified in the Rhodes model, it is anticipated that the SBO contribution to the overall CDF will actually be significantly lower than it was calculated to be in the Rev. 2.2 SAMA version.
An upgrade to the internal fires PRA is currently being developed as part of the fire protection program transition to one meeting the risk-informed, performance-based fire protection rule, 10CFR50.48c, which endorses National Fire Protection Association (NFPA) Standard 805 (NFPA-805). A number of tasks have been preliminarily completed for this upgrade, including a revision to the most risk-significant internal fires initiating event frequencies from the IPEEE. This analysis is based on the methodology of NUREG/CR-6850. The preliminary results of this analysis show that the fire initiating event frequencies for the most risk significant fire areas for the IPEEE, i.e. fires in Fire Areas 13 and 32 (Control Room and AFW/Instrument Air Compressor Room), are lower than calculated for the IPEEE, as shown in Table 3ab-2 below:
Table 3ab-2 PINGP Fire Initiating Event Frequency Comparison:
IPEEE vs. Preliminary FPRA Upgrade Calculated Values IPEEE Dominant Fire Area Description IPEEE Fire CDF Contribution IPEEE IE Frequency (per year)
(1)
Preliminary FPRA Upgrade IE Frequency (per year)
Change 13 Control Room 65.3%
2.04E-02 1.20E-02
-41%
32 "B" Train Hot Shutdown Panel/AFW/IA Compressor Room 16.7%
4.48E-03 2.60E-03
-42%
(1) From PINGP IPEEE Table B.2.6.3.
SAMA Follow Up RAI 5a It is understood from the response that improved training will not provide any additional benefit. However, the failure probabilities of 1.9E-02 and 5.3E-02 appear to have room for improvement. Explain the characteristics of these actions (and the calculator used to NSPM Responses to NRC Requests for Additional Information Dated December 24, 2008 18 determine its value) that prevents lower calculated values given excellent training and emergency operating plan-driven direction.
NSPM Response to SAMA Follow Up RAI 5a As discussed in the original RAI response, the two operator actions of concern are:
0SLOCAXXCDY: Operator Fails To Perform RCS Cooldown and Depressurization on Small LOCA. (Failure probability of 1.92E-02) 0HRECIRCC2Y: Operator Fails To Initiate High Head Recirculation Conditional on Failure of RCS Cooldown and Depressurization (Failure Probability of 5.3E-02)
The human reliability analysis (HRA) was performed using Version 3.0 Beta of the EPRI HRA calculator. This calculator uses the Caused-Base Decision Tree Methodology (CBDTM) together with tables from NUREG/CR-1278 (USNRC Technique for Human Error Rate Prediction (THERP)). This is consistent with the EPRI HRA Users Group HRA Methodology and consistent with the state-of-the-art in the industry. The impact of timing, experience/training and procedures were factored into the analysis.
In general, EOP direction and training is assumed for using the CBDT method. In addition, the CBDT method credits general and specific training in scenarios where there could be problems with the operator information or operator-procedure interfaces. Thus, for relatively standard EOP scenarios, which implicitly assume procedural direction and training, one can not drive the numbers lower by crediting better training. Had there been no EOP direction or training, the CBDT method could not be used, and the Human Error Probability (HEP) numbers would be in the order of 1E-01. The THERP tables used in the analysis also assume Rule Based Actions are being modeled.
Other factors may also influence the HRA calculation. Further review was conducted on the two operator actions listed above to determine how other factors, such as timing and dependencies, impact the HEP analysis.
0SLOCAXXCDY Assessment:
Review of 0SLOCAXXCDY determined that the dominant contributor to the overall Human Error Probability (HEP) was the execution probability. The execution probability is approximately 84% of the overall total HEP. The execution probability was determined to be 1.6E-02. There were 19 critical operator steps identified from the EOP for this action.
The timing analysis was also reviewed. For operator action 0SLOCAXXCDY, the timing analysis plays a critical role in the ability to credit recovery for the execution portion.
Due to the limited time available for recovery (approximately 5 minutes) no recovery credit was applied to the execution probability; this resulted in a relatively high HEP value of 1.9E-02. The time available for recovery is brief since it would take approximately 2.6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> to perform the required actions (cooldown and depressurize the NSPM Responses to NRC Requests for Additional Information Dated December 24, 2008 19 Reactor Coolant System and lineup Residual Heat Removal (RHR) system for shutdown cooling). This is almost the same time it would take the Refueling Water Storage Tank (RWST) to reach its low level alarm (~2.7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br />). This operator action is discussed in detail in Enclosure 2.
0HRECIRCC2Y Assessment:
Operator action 0HRECIRCC2Y (Operator Fails To Initiate High Head Recirculation Conditional on Failure of RCS Cooldown and Depressurization) involves the failure of the operator to initiate high head recirculation following a small LOCA conditional of failure of the operator to perform RCS cooldown and depressurization for a small LOCA event (0SLOCAXXCDY).
Since these two operator actions (0SLOCAXXCDY and 0HRECIRCC2Y) appear in the same SLOCA initiating cutset, 0HRECIRCC2Y is a conditional operator action based on 0HRECIRCSMY which is discussed in Enclosure 3. 0HRECIRCSMY was calculated using Version 3.0 Beta of the EPRI HRA calculator and used the Caused-Base Decision Tree Methodology (CBDTM) together with the THERP methodology. The total HEP calculated for 0HRECIRCSMY is 3.6E-03.
The conditional probability of operator action 0HRECIRCC2Y, which is derived from 0HRECIRCSMY, is quantified by determining the level of dependence. Many factors may influence the level of dependence such as timing, location, and the relationship between persons performing the actions.
An evaluation of the timing associated with this particular core damage sequence (SLOCA initiating event with successful SI Pump injection) shows that there is adequate time between performance of operator action 0SLOCAXXCDY and 0HRECIRCC2Y (greater than 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />). This is based on the ability to maintain core cooling for several hours (~2.7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br />) with the SI pump injecting RWST water before the low level alarm is reached and transfer to recirculation is required.
In addition, other factors can be evaluated to determine dependency. Such as: same crew, cognition (cues/procedures), resources, location and stress. For the 0HRECIRCC2Y dependency analysis, the same crew is used (since the time delay is less than the shift length of 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />), different procedures and cues are used for each action, operator actions do not occur at the same time and adequate resources are available since the two operator actions (0SLOCAXXCDY and 0HRECIRCC2Y) are not simultaneous. Also, the stress level associated with the operator action 0HRECIRCSMY is Moderate.
After reviewing the dependency factors, the most significant being the timing and the stress level, a Low Dependency (LD) was assigned. Based on USNRC Technique for Human Error Rate Prediction (THERP), the conditional probability equation used to determine the HEP value for 0HRECIRCC2Y is:
0HRECIRCC2Y (Low Dependence) = (1 + 19N)/20 Where: N = 3.6E-03 (HEP value for 0HRECIRCSMY)
NSPM Responses to NRC Requests for Additional Information Dated December 24, 2008 20 0HRECIRCC2Y = 5.3E-02 Note that using the THERP dependency formula approach to determine dependency analysis can be seen as very conservative. However, the THERP approach is standard industry practice.
SAMA Follow Up RAI 5b Three candidate SAMAs (6, 6a, and 13) and 2 IPE-identified enhancements related to internal flooding were dismissed on the basis of a cooling water header piping modification in 1992, and deterministic considerations described in a 1995 engineering calculation/white paper. However, the IPE and 7 subsequent PRA updates (up to and including the current PRA) continue to model the rupture of the cooling water header.
Justify why the piping modification should be credited (for eliminating cooling water header ruptures) in the SAMA evaluation, in view of the fact that the IPE and subsequent PRA updates continue to model these pipe breaks, and that the American Society of Mechanical Engineers PRA standard would call for treatment of such flood sources.
Provide a quantitative evaluation of the costs and benefits of each of the aforementioned SAMAs / enhancements based on the current PRA treatment of cooling water header pipe breaks.
NSPM Response to SAMA Follow Up RAI 5b The current PRA model still includes initiating events modeling all of the internal flooding initiating events included in the IPE model (expanded now to include their impacts to both units). The CL header piping modifications and considerations contained in the engineering calculation referred to in the question were used in a previous model update to attempt to model the frequency of flooding events in each class that have a more realistic set of consequences. Previously the consequences associated with the worst case (and lowest frequency) piping rupture were applied to the entire frequency of potential piping rupture events in each area (most of which are higher frequency, lower consequence events). This was felt to be skewing the results of the PRA in an overly-conservative manner. It is now understood that this method is not consistent with the PRA standard and will be corrected in a future PRA update; however, this treatment was included in the version of the PRA used for the SAMA analysis. No SAMAs were excluded from consideration based on either the piping modification or the engineering calculation.
SAMA Follow Up RAI 5d and 5e A review of Table F.5-3 finds that several screened Phase I candidates (i.e., SAMAs 6, 6a, 7, 8, 13, 14 and 16) do not appear to meet the environmental report (ER) Section 4.17.1 screening criteria. In addition, the discussion for the basis for screening SAMA 14 does not appear to address the benefit of improved operator training for power-operated relief valve failure to re-seat. Its screening appears to be based on model limitations as NSPM Responses to NRC Requests for Additional Information Dated December 24, 2008 21 opposed to actual benefit. As such, the ER Section F.5.2 criteria do not appear to be consistent with the ER Section 4.17.1 criteria. Confirm that both sets of screening criteria are used. Explicitly identify the ER Section F.5.2 and the ER Section 4.17.1 screening criterion used for each screened SAMA.
NSPM Response to SAMA Follow Up RAI 5d and 5e The table below identifies the Phase 1 screening criteria used for SAMAs 6, 6a, 7, 8, 13, 14, and 16. As applied in the ER, this particular screening process was used to identify those SAMAs that were readily observed as not being cost beneficial, and thus not being applicable to the Phase 2 quantification of averted cost-risk. The process involved cutset reviews and the CDF contribution of those targeted accident sequences for which the SAMAs were developed. The applicable screening criteria from both Sections 4.17.1 and F.5.2 are listed to emphasize that the screening criteria cited in these sections address the same intent.
SAMA ID and Description Description of Disposition Specific Criteria from Section 4.17.1 Specific Criteria from Section F.5.2 6
Consider installing waterproof (EQ) equipment (valves/level sensors) capable of automatically isolating the flooding source.
For either unit, Auxiliary Building Zone 7 flooding initiating events account for only about 2% of the CDF and only about 1% of the LERF.
The cost and complexity of implementing this SAMA would be significantinvolving system modifications that would entail extensive engineering support, specialized hardware and instrumentation, and regulatory analyses to support modifications to the facility. In order to minimize the cost of the modification, the existing ring header isolation MOVs would have to be used (those that currently split the ring header into two safeguards headers on an S-signal on either unit) in order to prevent a dual-unit outage to install new isolation valves.
Under this design, however, isolation of an entire train of safeguards equipment (those supplied by CL) to stop the flooding event would leave both units susceptible to a single failure for important safety functions. (Sect.
F.5.2.1)
Candidates with no significant benefit in PWRs such as PINGP.
Engineering Judgment: Using extensive plant knowledge and sound engineering judgment, potential SAMAs are evaluated based on their expected maximum cost and dose benefits; those that are deemed not beneficial are screened from further analysis.
NSPM Responses to NRC Requests for Additional Information Dated December 24, 2008 22 SAMA ID and Description Description of Disposition Specific Criteria from Section 4.17.1 Specific Criteria from Section F.5.2 6a Consider segregating this zone into 2 compartments to reduce the impact of a flood on both trains of SI and RHR.
The maximum risk benefit for this SAMA is low (see SAMA 6 discussion above). The cost of implementing this SAMA is estimated to be significantly greater than that of SAMA
- 6. Furthermore, this SAMA relies on operator action to identify and isolate the header with the break (the current, pre-SAMA implementation situation). With the higher likelihood of isolation failure due to operator vs. automatic action, a large portion of the risk benefit from this SAMA would not be realized.
(Sect. F.5.2.2)
Candidates whose estimated implementation costs exceed the maximum averted cost-risk and/or candidates with no significant benefit in PWRs such as PINGP.
Engineering Judgment: Using extensive plant knowledge and sound engineering
- judgment, potential SAMAs are evaluated based on their expected maximum cost and dose benefits; those that are deemed not beneficial are screened from further analysis.
7 The ability to use non-safety related diesel generators D3 and D4 would provide a backup source of power in addition to the existing four safety related diesels D1, D2, D5, and D6.
SBO is already a small contributor - <8% of CDF, <1% of LERF, <0.02% of early CF. Top SBO-related release categories involve sequences in which containment and/or vessel does not fail. Also, significant costs would be incurred to upgrade D3 and D4 to safety-related status, which would ultimately cost more than the benefit gained from a 2%
improvement in CDF. (Table F.5-3)
Candidates whose estimated implementation costs exceed the maximum averted cost-risk and/or candidates with no significant benefit in PWRs such as PINGP.
Engineering Judgment: Using extensive plant knowledge and sound engineering
- judgment, potential SAMAs are evaluated based on their expected maximum cost and dose benefits; those that are deemed not beneficial are screened from further analysis.
8 Installation of a swing or SBO diesel would provide increased defense in depth and could be considered for LOOP conditions.
SBO is a significant contributor to CDF for both units (provides about 8% of the total CDF). However, it contributes <1% to the LERF, and <0.02% to the frequency of all early containment failure sequences. All of the top SBO-related release categories involve sequences in which the containment and/or reactor vessel does not fail. The risk benefit of this SAMA is further reduced by the need for operator action (including local actions) for implementation. (Sect. F.5.2.3)
Candidates whose estimated implementation costs exceed the maximum averted cost-risk.
Engineering Judgment: Using extensive plant knowledge and sound engineering
- judgment, potential SAMAs are evaluated based on their expected maximum cost and dose benefits; those that are deemed not beneficial are screened from further analysis.
NSPM Responses to NRC Requests for Additional Information Dated December 24, 2008 23 SAMA ID and Description Description of Disposition Specific Criteria from Section 4.17.1 Specific Criteria from Section F.5.2 13 This initiator represents an internal flooding scenario that disables various safety-related components.
Mitigation of this event can be accomplished via an automatic sump pump system to remove water if the operator fails to isolate Zone 7 of the Aux. Bldg.
The maximum risk benefit for this SAMA is low (see SAMA 6 discussion above). The cost of implementing this SAMA would be about the same, or slightly less, than the cost of SAMA 6, however, as with SAMA 6a, this SAMA relies on operator action to identify and isolate the header with the break (the current, pre-SAMA implementation situation).
Therefore, a large portion of the risk benefit from this SAMA would not be realized. Also, even with successful operator action, the result is the loss of at least one train of safeguards equipment. (Sect. F.5.2.4)
Candidates with no significant benefit in PWRs such as PINGP.
Engineering Judgment: Using extensive plant knowledge and sound engineering
- judgment, potential SAMAs are evaluated based on their expected maximum cost and dose benefits; those that are deemed not beneficial are screened from further analysis.
14 Reinforce operator training to isolate PORVs when symptoms reveal valves have failed to re-seat.
This reduces the amount of radioactivity released to the environment.
Consider replacing with more reliable or robust valves to better isolate following lifting.
Existing model considers that failure to close and failure to open lead to the same accident class, GLH (assuming failure of operator to Cooldown/Depressurize per ECA 3.1/3.2, which leads to SGTR source term).
Therefore, quantification of this SAMA modification would produce no difference in the calculated frequency of offsite release or its magnitude. (Table F.5-3)
Candidates with no significant benefit in PWRs such as PINGP.
Engineering Judgment: Using extensive plant knowledge and sound engineering
- judgment, potential SAMAs are evaluated based on their expected maximum cost and dose benefits; those that are deemed not beneficial are screened from further analysis.
NSPM Responses to NRC Requests for Additional Information Dated December 24, 2008 24 SAMA ID and Description Description of Disposition Specific Criteria from Section 4.17.1 Specific Criteria from Section F.5.2 16 Failure of MV-32169 to open disables RHR Loop B return.
Proper operation of this valve is most likely tracked via the MR. Consider replacing this MOV with a FC air-operated valve for improved reliability. This would eliminate CCF for inboard MOVs that currently exist on this flow path.
Failure of this valve to open results in failure of shutdown cooling initiation (there is no CCF for inboard MOVs that currently exist for the flow path involved in these sequences). This may not have any positive impact on CDF (FC air-operated valve inside containment may be less reliable than a MOV due to reliance on containment instrument air supply) and would have little, if any, impact on LERF. (Table F.5-3)
Candidates whose estimated implementation costs exceed the maximum averted cost-risk and/or candidates with no significant benefit in PWRs such as PINGP.
Engineering Judgment: Using extensive plant knowledge and sound engineering
- judgment, potential SAMAs are evaluated based on their expected maximum cost and dose benefits; those that are deemed not beneficial are screened from further analysis.
As described in Section 5.1.1 of the ER, Phase 1 SAMAs were, in part, identified through a review of the importance measures associated with the Rev. 2.2 SAMA model PRA CDF calculation for each unit. SAMA 14 was identified as a potential Phase 1 candidate SAMA due to the importance measures associated with Unit 2 basic events 2SGTRRLFFTC and 2SGTRRLFSUC. These two events, both having a probability of 0.5, are split fractions that represent failure of a secondary relief valve to close given SG overfill following a SGTR event and successful closure of all relief valves, respectively.
Both events have the same probability (0.5) and in the baseline PRA quantification, success or failure of this event tree top event heading leads to an identical accident progression (operator action to depressurize the plant to the point at which RHR shutdown cooling can be placed in service is required to prevent core damage). This treatment essentially gives no credit for the fact that the valves may successfully reclose; the existence of this event tree top event heading is only for sensitivity purposes and does not otherwise play a role in the PRA.
Note that in the response to SAMA RAI 8(i) in the letter of November 21, 2008, NSPM stated that it had entered the proposed SAMA (SG relief valve gagging device) into the Corrective Action Program for a more detailed examination of viability and implementation cost. This proposed plant modification, if proven to be cost beneficial and implemented, would effectively reduce the offsite dose risk associated with stuck open safety relief valves on SGTR events.
NSPM Responses to NRC Requests for Additional Information Dated December 24, 2008 25 SAMA Follow Up RAI 5g Based on the description provided, the dominant internal flooding sequence (involving cooling water header rupture) would result in core damage at both units. Provide an evaluation of a less extensive, alternative SAMA that would limit water damage to the systems, structures, and components for a single unit (so that core damage would be limited to one unit). Provide the costs and benefits for this alternative.
NSPM Response to SAMA Follow Up RAI 5g The dominant internal flooding sequence involves a CL header rupture in the Component Cooling heat exchanger room in the Auxiliary Building. This room is located in the basement of the Auxiliary Building, near the center of the building between the two units.
However, the equipment in the room is not separated by unit; rather, it is separated by train. The Train A CC heat exchangers and pumps are located on the Unit 1 side of the room, while the Train B CC heat exchangers and pumps are located on the Unit 2 side of the room. The PRA model assumes that, due to the potentially high flow rate out the break and water spray potential, both pumps on the break side of the room are affected.
In order to stop the flow out the break, the operators would have to isolate the ruptured CL header. Therefore, a wall or other flood-limiting barrier down the middle of the room would leave one CC pump and heat exchanger operable in the non-isolated train on the side of the room without the break. If that one remaining pump failed to function, or happened to be out of service for maintenance (for example) when the event occurred, all CC would be lost to both units, even though the CL header break was successfully isolated. An attempt to construct barriers to protect both CC trains for one unit would have a similar problem; on any CL piping rupture at least one train of CC would still be lost on both units. Any of a number of single failures in the opposite train would lead to loss of all CC on the unit with the flood protection installed. Therefore, it is not practical to design a flood barrier that can protect one unit at the expense of the other. This also goes against the design philosophy of the plant which is to design and install safety measures that will protect both units.
SAMA Follow Up RAI 6c The life-cycle cost is identified as $100K. However, SAMA 20 changes a normally open motor-operated valve to normally-closed. Demonstrate that this change will add $100K additional life-cycle cost to an existing valve. In addition, the noted design cost reduction of 30% does not yield the reduced second unit cost. Address this apparent discrepancy.
NSPM Response to SAMA Follow Up RAI 6c Plant operation with these valves normally closed would require that the valves automatically open following a LOCA event to supply flow to the reactor vessel. Failure of these valves to open would contribute to loss of low head injection capability during LOCA events. To ensure valve operability, periodic cycling of valves and general maintenance will be required at a cost of $100,000 per unit. Additional reviews of these NSPM Responses to NRC Requests for Additional Information Dated December 24, 2008 26 life-cycle costs revealed these costs would be inherent to maintaining these valves whether the valves are open or closed. Therefore, the $100,000 per unit life cycle costs were removed from the cost estimate for SAMA 20 as indicated below. Although this lowered the cost estimate for SAMA 20, the analysis demonstrated that implementation would not be cost beneficial.
Order-of Magnitude Cost Estimate for SAMA 20 SAMA ID No.: 20
Title:
Close Low Head Injection MOVs to Prevent RCS Backflow to SI System
==
Description:==
Change the safety-related motor-operated low head reactor vessel injection valves (one valve in each Emergency Core Cooling System train) from normally open to normally closed. Valves would need modifying by drilling a hole in the upstream disk in order to eliminate any pressure locking concern.
Assumptions:
x Each valve will be placed in the closed position (or verified closed) by the control room operator prior to entering the appropriate Tech Spec MODE and each valve will receive, as it does presently, an S (safety injection) signaltherefore, in order to implement this alternative, procedure and drawing changes are required.
x The design requirements for the valve and its motor operator which were in effect at the time the valve was a normally closed valve are still valid.
x The current valve design will support the modification to eliminate any pressure locking concern.
x The valve MEDP (maximum expected differential pressure) and actuator will not be changed by this modification. Minor changes in the wedge friction factor may occur, but will not change the valve actuator or its settings.
PHASE ITEM RESOURCE FUNCTIONAL AREA ESTIMATE UNIT 1 ESTIMATE UNIT 2 Study/Analyses 1
Contract Labor Engineering Design Studies
$40,000
$40,000 2
PINGP Support Engr / Ops / Lic
$12,000
$12,000 Design 3
Contract Labor Engr Design - Mech /
Civil
$60,000
$42,000 4
Contract Labor Engr Design - Elec / I&C
$60,000
$42,000 5
PINGP Support Engr / Ops / Maint
$40,000
$28,000 Implement 6
Labor Main / Cont
$50,000
$50,000 7
Contract Labor Engineering
$2,000
$2,000 8
Materials Material & Material Mgmt
$1,000
$1,000 9
PINGP Support Engr / Ops / Lic
$3,000
$3,000 Life Cycle 10 Labor Ops / Maint for 20 years 0
0 GRAND TOTAL
$268,000
$220,000 Note:
The cost estimate for the second unit reflects a saving of approximately 30% on the Design Phase.
NSPM Responses to NRC Requests for Additional Information Dated December 24, 2008 27 SAMA Follow Up RAI 6.g The corrected treatment of uncertainties shows SAMA 19a as potentially cost beneficial.
Discuss Nuclear Management Companys plans for further evaluation or implementation of this SAMA.
NSPM Response to SAMA Follow Up RAI 6g Since the results of the corrected treatment of uncertainties show SAMA 19a as potentially cost beneficial, the benefits for replenishing RWST from a large water source should be considered further. Other engineering reviews are necessary to determine ultimate implementation. SAMA 19a has been entered into the PINGP Corrective Action Program for further evaluation.
0SLOCAXXCDY, Operator Fails To Perform RCS Cooldown And Depressurization 1
Cognitive Method Date Analyst CBDTM/THERP 04/23/05 J. F. Grobbelaar, SCIENTECH HEP Summary Pcog Pexe Total HEP Error Factor Without Recovery 3.0e-03 1.6e-02 With Recovery 3.0e-03 1.6e-02 1.9e-02 5
HFE Scenario Description
- 1. Initial Conditions: Steady state, full power operation.
- 2. Initiating Event: Small LOCA
- 3. Accident sequence (preceding functional failures and successes):
Reactor trip (reactor trip and bypass breakers are open).
Turbine trip (both turbine stop valves are closed).
Both safeguards buses are energized.
SI is actuated and required.
AFW flow greater than 200 gpm.
PORVs closed RCS pressure > 1250 PSIG
- 4. Preceding operator error or success in sequence:
Entered 1E-0.
Transferred to 1E-1 from 1E-0 step 12.
Stopped RCPs
- 5. Operator action success criterion: Cooldown and depressurize the RCS to Mode 5, Cold Shutdown conditions following a loss of reactor coolant inventory.
- 6. Consequence of failure: High head recirculation would be required.
- 7. Key assumptions: RCPs not running Cues and Indications Cue/s RCS pressure - GREATER THAN 250 PSIG [550 PSIG)
Degree of Clarity Very Good Procedures and Training Cognitive Procedure 1E-1 Cognitive Step Number 20.b Cognitive Instruction Go to 1ES-1.1, POST LOCA COOLDOWN AND DEPRESSURIZATION, Step 1 Execution Procedure 1ES-1.1 0SLOCAXXCDY, Operator Fails To Perform RCS Cooldown And Depressurization 2
Other Procedure 1C15 Job Performance Measure RH-5S Classroom Training Frequency:.5 per year Simulator Training Frequency:,5 per year Notes The most critical steps in 1ES-1.1 are to start the cooldown (step 6) and to depressurize (step 9).
The depressurization will not work (pressurizer level and subcooling) without cooldown, so failure to cooldown will be "recovered" by depressurization. There are numerous steps in the procedure checking pressurizer level and subcooling, hence recovering depressurization and therefore cooldown.
Timing Analysis Tsw 42 Minutes Tdelay 15 Minutes T1/2 0 Minutes TM 22 Minutes Time available for recovery 5 Minutes SPAR-H Available time (cognitive) 5 Minutes SPAR-H Available time (execution) ratio 1 Minutes Minimum level of dependence for recovery HD Notes The time to reach recirculation switchover (33% RWST level) for Small LOCA is 2.7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> (162 minutes) from calculation file V.SPA.93.004, "PI SLOCA W/AFW, 2 SI, 2 Accum, 1 FCU, No Recirc". RHR can be put in service when the RCS hot leg temperature is less than 350 F. Time to cool down from 547 F to 350 F at 100 F/hr would take about 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> = 120 minutes. The system time window is taken as the time to reach recirculation switchover reduced by the actual time that it would take to cooldown and depressurize, which is 162 - 120 = 42 minutes. This is conservative as it does not take the effect of the cooldown on flow rate into account, and it does not take the stopping of 1SI pump into account.
Per the operator interviews, it takes 15 minutes to navigate to ES-1.1, so Td = 15 minutes.
Per JPM RH-5S, the time for completion to put RHR in shutdown cooling is 12 minutes. The manipulation time from 1ES-1.1 step 10 onwards is included in the 120 minutes for cooling down, so it does not have to be accounted for in Tm. The important manipulations are to start the cooldown (step 6) and depressurization (step 9). The first 9 steps are estimated to take less than 10 minutes, so the total manipulation time to be accounted for is Tm = 22 (12 + 10) minutes.
Dependencies (Related Human Interactions)
N/A 0SLOCAXXCDY, Operator Fails To Perform RCS Cooldown And Depressurization 3
Cognitive Analysis Pc Failure Mechanism Branch HEP Pca: Availability of Information a
neg.
Pcb: Failure of Attention a
neg.
Pcc: Misread/miscommunicate data a
neg.
Pcd: Information misleading a
neg.
Pce: Skip a step in procedure c
3.0e-03 Pcf: Misinterpret Instructions a
neg.
Pcg: Misinterpret decision logic l
neg.
Pch: Deliberate violation a
neg.
Initial Pc(without recovery credited) 3.0e-03 Notes Cognitive Complexity Simple Equipment Accessibility Main Control Room: Accessible Cognitive Recovery Initial HEP Self Review Extra Crew STA Review Shift Change ERF Review Recovery Matrix Depende ncy Level Multiply HEP By Override Value Final Value Pca neg.
NC 1.0 Pcb neg.
NC 1.0 Pcc neg.
NC 1.0 Pcd neg.
NC 1.0 Pce 3.0e-03 NC 1.0 3.0e-03 Pcf neg.
NC 1.0 Pcg neg.
NC 1.0 Pch neg.
NC 1.0 Final Pc (with recovery credited) 3.0e-03 Notes No cognitive recovery credited.
Execution Performance Shaping Factors Environment Lighting Normal Heat Normal Radiation
Background
Atmosphere Normal Equipment Accessibility Main Control Room Accessible Stress Low Notes Stress is low, as all equipment is available and all safety functions are satisfied. Cooldown, depressurization and placing RHR in service are routine actions performed for every cold shutdown. In this scenario, the only difference is that SI is running, which is stopped during the evolution.
Execution Complexity Simple 0SLOCAXXCDY, Operator Fails To Perform RCS Cooldown And Depressurization 4
Execution Unrecovered Procedure: 1ES-1.1, THERP Step No.
Instruction Error Type Table Item HEP Stress Factor Over Ride Total HEP EOM 20-7b 1
1.7e-03 5
Place All PRZR Heaters In Off Position Comments:
EOC 20-12 3
1.3E-3 1
1.7e-03 EOM 20-7b 1
0.0e+0 0
6.c RNO Start one condensate pump Comments: Recovered by step 9 EOC 20-12 3
1.3E-3 1
0 0.0e+
00 EOM 20-7b 2
0.0e+0 0
6,d Dump steam to condenser from intact SGs Comments: Recovered by step 9 EOC 20-12 5
1.3E-3 1
0 0.0e+
00 EOM 20-7b 2
2.6e-03 9.a RNO Depressurize RCS To Refill PRZR: Use one PORV Comments: This step is performed immediately before starting an RCP. Transitions from other steps when PRZR level is low are also possible. For all possible entries, the RCS should be subcooled prior to RCS depressurization. Since this prior subcooling requirement ensures a small break, subcooling should be restored with continued cooldown if subcooling is lost during the depressurization. Pressurizer level (and pressure) will increase after the operator stops the depressurization until injection flow balances break flow and loss due to cooldown shrink. This step is a recovery step for cooldown, as depressurization can not commence without sufficient subcooling margin which is obtained by cooldown.
EOC 20-12 3
1.3E-3 1
2.6e-03 EOM 20-7b 2
0.0e+0 0
10.c PRZR level - GREATER THAN 21% [41%]
Comments: Potential recovery step EOC 20-11 4
3.8E-3 1
0 0.0e+
00 EOM 20-7b 2
2.6e-03 12.d RNO Start 11 RHR pump.
Comments:
EOC 20-12 3
1.3E-3 1
2.6e-03 EOM 20-7b 2
0.0e+0 0
12.e Stop last SI pump Comments:
EOC 20-12 3
1.3E-3 1
0 0.0e+
00 EOM 20-7b 2
2.6e-03 15.a RNO Depressurize RCS To Minimize Subcooling: Use one PORV Comments:
EOC 20-12 3
1.3E-3 1
2.6e-03 EOM 20-7b 2
2.6e-03 18.d Close accumulator isolation valves:
Comments:.. MV-32071
.. MV-32072 EOC 20-12 3
1.3E-3 1
2.6e-03 25.a Check RCS hot leg temperature - LESS THAN 350 F Comments: If not, operators are directed to go to step 26 and will be EOM 20-7b 2
0.0e+0 0
1 0
0.0e+
00 0SLOCAXXCDY, Operator Fails To Perform RCS Cooldown And Depressurization 5
Execution Unrecovered Procedure: 1ES-1.1, THERP Step No.
Instruction Error Type Table Item HEP Stress Factor Over Ride Total HEP directed in step 27 to return to step 2 if RCS temperature is not less than 200 F. This is a potential recovery step for the getting the initial cooldown and depressurization going.
EOC 20-11 4
3.8E-3 25.d Align RHR for shutdown cooling per Attachment D Comments:
EOM 20-7b 2
1.3e-03 1
1.3e-03 EOM 20-7b 2
0.0e+0 0
D.10 OPEN RHR Suction Isolation valves from the RCS:
Comments:.. MV-32164, LOOP A HOT LEG TO RHR, using CS-46226
.. MV-32165, LOOP A HOT LEG TO RHR, using CS-46228
.. MV-32230, LOOP B HOT LEG TO RHR, using CS-46227
.. MV-32231, LOOP B HOT LEG TO RHR, using CS-46229 Recovered by D.18 EOC 20-12 3
1.3E-3 1
0 0.0e+
00 EOM 20-7b 2
0.0e+0 0
D.11 Throttle CV-31236, 12 RHR HX RC OUTLET FLOW (1HC-625),
Comments: Recovered by D.18 EOC 20-12 3
1.3E-3 1
0 0.0e+
00 EOM 20-7b 2
0.0e+0 0
D.12 Throttle OPEN CV-31237, 11/12 RHR HX BYPASS FLOW (1HC-626A), to approximately 30%.
Comments: Recovered by D.18 EOC 20-12 3
1.3E-3 1
0 0.0e+
00 EOM 20-7b 2
0.0e+0 0
D.13 Start 12 RHR Pump using CS-46185.
Comments: Recovered by D.18 EOC 20-12 3
1.3E-3 1
0 0.0e+
00 EOM 20-7b 2
0.0e+0 0
D.14 OPEN MV-32066, RHR TO RC LOOP B COLD LEG, using CS-46225.
Comments: Recovered by D.18 EOC 20-12 3
1.3E-3 1
0 0.0e+
00 EOM 20-7b 2
0.0e+0 0
D.16 Place CV-31237, 11/12 RHR HX BYPASS FLOW (1HC-626A), in "AUTO".
Comments: Recovered by D.18 EOC 20-12 3
1.3E-3 1
0 0.0e+
00 EOM 20-7b 2
2.6e-03 D.18 Adjust CV-31236, 12 RHR HX RC OUTLET FLOW (1HC-625), to obtain desired cooldown rate.
Comments:
EOC 20-12 3
1.3E-3 1
2.6e-03 EOM 20-7b 2
0.0e+0 0
27 Check RCS Temperatures LESS THAN 200 (If not, return to step 2)
Comments:
EOC 20-11 4
3.8E-3 1
0 0.0e+
00 0SLOCAXXCDY, Operator Fails To Perform RCS Cooldown And Depressurization 6
Execution Recovered Critical Step No.
Recovery Step No.
Action HEP (Crit)
HEP (Rec)
Dep.
Cond. HEP (Rec)
Total for Step 5
Place All PRZR Heaters In Off Position 1.7e-03 1.7e-03 6.c RNO Start one condensate pump 0.0e+00 0.0e+00 6,d Dump steam to condenser from intact SGs 0.0e+00 0.0e+00 9.a RNO Depressurize RCS To Refill PRZR: Use one PORV 2.6e-03 2.6e-03 10.c PRZR level - GREATER THAN 21%
[41%]
0.0e+00 0.0e+00 12.d RNO Start 11 RHR pump.
2.6e-03 2.6e-03 12.e Stop last SI pump 0.0e+00 0.0e+00 15.a RNO Depressurize RCS To Minimize Subcooling: Use one PORV 2.6e-03 2.6e-03 18.d Close accumulator isolation valves:
2.6e-03 2.6e-03 25.a Check RCS hot leg temperature - LESS THAN 350 F 0.0e+00 0.0e+00 25.d Align RHR for shutdown cooling per Attachment D 1.3e-03 1.3e-03 D.10 OPEN RHR Suction Isolation valves from the RCS:
0.0e+00 0.0e+00 D.11 Throttle CV-31236, 12 RHR HX RC OUTLET FLOW (1HC-625),
0.0e+00 0.0e+00 D.12 Throttle OPEN CV-31237, 11/12 RHR HX BYPASS FLOW (1HC-626A), to approximately 30%.
0.0e+00 0.0e+00 D.13 Start 12 RHR Pump using CS-46185.
0.0e+00 0.0e+00 D.14 OPEN MV-32066, RHR TO RC LOOP B COLD LEG, using CS-46225.
0.0e+00 0.0e+00 D.16 Place CV-31237, 11/12 RHR HX BYPASS FLOW (1HC-626A), in "AUTO".
0.0e+00 0.0e+00 D.18 Adjust CV-31236, 12 RHR HX RC OUTLET FLOW (1HC-625), to obtain desired cooldown rate.
2.6e-03 2.6e-03 0SLOCAXXCDY, Operator Fails To Perform RCS Cooldown And Depressurization 7
Execution Recovered Critical Step No.
Recovery Step No.
Action HEP (Crit)
HEP (Rec)
Dep.
Cond. HEP (Rec)
Total for Step 27 Check RCS Temperatures LESS THAN 200 (If not, return to step 2) 0.0e+00 0.0e+00 Total Unrecovered:
1.6e-02 Total Recovered:
1.6e-02 0HRECIRCSMY, Operator Fails To Initiate High Head Recirc. For A Small LOCA 1
Cognitive Method Date Analyst CBDTM/THERP 04/23/05 J. F. Grobbelaar, SCIENTECH HEP Summary Pcog Pexe Total HEP Error Factor Without Recovery 3.2e-03 6.0e-02 With Recovery 1.7e-04 3.4e-03 3.6e-03 5
HFE Scenario Description
- 1. Initial Conditions: Steady state, full power operation.
- 2. Initiating Event: Small LOCA (2" break)
- 3. Accident sequence (preceding functional failures and successes):
Reactor trip (reactor trip and bypass breakers are open).
Turbine trip (both turbine stop valves are closed).
Both safeguards buses are energized.
SI is actuated and required.
AFW flow greater than 200 gpm.
- 4. Preceding operator error or success in sequence:
Entered 1E-0.
Transferred to 1E-1 Transferred to 1ES-1.1
- 5. Operator action success criterion: Diagnose need for recirculation switchover and switch over to recirculation
- 6. Consequence of failure: Core damage.
Cues and Indications Cue/s RWST level - LESS THAN 33%
Degree of Clarity Very Good Procedures and Training Cognitive Procedure 1ES-1.1 Cognitive Step Number Information Page #7 Cognitive Instruction Go to 1ES-1.2, TRANSFER TO RECIRCULATION, Step 1.
if RWST level decreases to less than 33%.
Execution Procedure 1ES-1.2 Other Procedure Job Performance Measure SI-11S Classroom Training Frequency:.5 per year 0HRECIRCSMY, Operator Fails To Initiate High Head Recirc. For A Small LOCA 2
Simulator Training Frequency:.5 per year Notes Timing Analysis Tsw 618 Minutes Tdelay 162 Minutes T1/2 0 Minutes TM 30 Minutes Time available for recovery 426 Minutes SPAR-H Available time (cognitive) 426 Minutes SPAR-H Available time (execution) ratio 17 Minutes Minimum level of dependence for recovery ZD Notes Tsw = 10.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />.= 618 minutes Td = 2.7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> = 162 minutes Tm = 30 minutes (15 minutes for local actions (JPM SI-3) and 15 minutes for MCR actions (JPM-S-11S)).
The timing for the small LOCA (2" break) comes from calculation file V.SPA.93.004, "PI SLOCA W/AFW, 2 SI, 2 Accum, 1 FCU, No Recirc." The time to 33% level is 2.7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> and the time from 33% RWST level until core damage is 7.6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.
Dependencies (Related Human Interactions)
Cognitive Analysis Pc Failure Mechanism Branch HEP Pca: Availability of Information a
neg.
Pcb: Failure of Attention d
1.5e-04 Pcc: Misread/miscommunicate data a
neg.
Pcd: Information misleading a
neg.
Pce: Skip a step in procedure c
3.0e-03 Pcf: Misinterpret Instructions a
neg.
Pcg: Misinterpret decision logic k
neg.
Pch: Deliberate violation a
neg.
Initial Pc(without recovery credited) 3.2e-03 Notes Cognitive Complexity Complex Equipment Accessibility Main Control Room: Accessible 0HRECIRCSMY, Operator Fails To Initiate High Head Recirc. For A Small LOCA 3
Cognitive Recovery Initial HEP Self Review Extra Crew STA Review Shift Change ERF Review Recovery Matrix Depende ncy Level Multiply HEP By Override Value Final Value Pca neg.
NC 1.0 Pcb 1.5e-04 X
1.0e-01 LD 5.0e-02 7.5e-06 Pcc neg.
NC 1.0 Pcd neg.
NC 1.0 Pce 3.0e-03 X
1.0e-01 LD 5.3e-02 1.6e-04 Pcf neg.
NC 1.0 Pcg neg.
NC 1.0 Pch neg.
NC 1.0 Final Pc (with recovery credited) 1.7e-04 Notes Self review is credited as the RWST level is continuously monitored.
Execution Performance Shaping Factors Special Requirements Tools Required Adequate Available Environment Lighting Normal Heat Normal Radiation
Background
Atmosphere Normal Equipment Accessibility Auxiliary Building Accessible Stress Moderate Notes Execution Complexity Complex 0HRECIRCSMY, Operator Fails To Initiate High Head Recirc. For A Small LOCA 4
Execution Unrecovered Procedure: 1ES-1.2, THERP Step No.
Instruction Error Type Table Item HEP Stress Factor Over Ride Total HEP EOM 20-7b 1
3.5e-03 K.1 Vent the bonnets of Sump B to RHR MVs by OPENING AND THEN CLOSING the following valves (Located in CS pump room):
Comments: Regarded as a single perceptual unit:
.. SI-32-3, CNTMT SUMP B TO 11 RHR PMP MV-32077 BONNET VENT
.. SI-32-4, CNTMT SUMP B TO 12 RHR PMP MV-32078 BONNET VENT EOC 20-13 1
1.3E-3 2
3.5e-03 EOM 20-7b 1
0.0e+0 0
K.7 Align RHR sump pump discharge valves (located above RHR Pits):
Comments: Regarded as single perceptual unit:
.. Position WL-87-1, RHR PIT SUMP #11 DISCHARGE, to "ANNULUS SUMP"
.. Position WL-87-2, RHR PIT SUMP #12 DISCHARGE, to "ANNULUS SUMP" EOC 20-13 1
1.3E-3 2
0 0.0e+
00 EOM 20-7b 1
8.5e-03 K.8 Unlock and place the following 480V breakers to "ON":
Comments: Regarded as single perceptual unit:
.. MCC 1K1-E2 (BKR 111J-19), 11 RHR HX TO 11 SI PMP MV-32206 (Located North of RHR pits) (Key #28)
.. MCC 1KA2-D1 (BKR 121B-34), 12 RHR HX TO 12 SI PUMP MV-32207 (Located East of Aux Operator Shack) (Key #29)
EOC 20-12 12 3.8E-3 2
8.5e-03 EOM 20-7b 1
3.5e-03 K.9 Remove cotter key AND travel stop for the following valves:
Comments: Regarded as single perceptual unit:
.. CV-31381, 11 CC HX CLG WTR OUTLET CV
.. CV-31411, 12 CC HX CLG WTR OUTLET CV A 1 7/16" socket and a 1 7/16" open-end wrench are needed EOC 20-13 1
1.3E-3 2
3.5e-03 EOM 20-7b 2
0.0e+0 0
K.10 Position WL-86-1, SAMPLE SINK TO CHEM DRAIN/RHR SUMP, to "CLOSED, Sample Sink Drains to 12 RHR Pit Sump".
Comments: Located halfway up the stairs by the Aux Bldg Operator shack EOC 20-13 1
1.3E-3 2
0 0.0e+
00 0HRECIRCSMY, Operator Fails To Initiate High Head Recirc. For A Small LOCA 5
Execution Unrecovered Procedure: 1ES-1.2, THERP Step No.
Instruction Error Type Table Item HEP Stress Factor Over Ride Total HEP EOM 20-7b 1
0.0e+0 0
2 Reset SI Comments: Non-critical, recovered by step 5 EOC 20-12 1a neg.
2 0
0.0e+
00 EOM 20-7b 1
0.0e+0 0
3 Reset Containment Spray Comments: Non critical - recovered by step 5 EOC 20-12 1a neg.
2 0
0.0e+
00 EOM 20-7b 1
2.6e-03 4
Check Both Trains Of Safeguards Pumps Available For Recirculation Comments:
EOC 20-9 3
1.3E-3 2
2.6e-03 EOM 20-7 1
0.0e+0 0
5 Stop One Train Of Safeguards Pumps Comments:.. RHR pump
.. SI pump
.. CS pump Recovered by subsequent steps that refer to valve alignments of "idle" pump.
EOC 20-12 3
1.3E-3 2
0 0.0e+
00 EOM 20-7b 1
3.5e-03 6
Close RWST To RHR Isolation Valve For Idle RHR Pump:
Comments: MV-32084 OR MV-32085 EOC 20-12 3
1.3E-3 2
3.5e-03 EOM 20-7b 2
5.2e-03 7
Close SI Test Line To RWST Valves Comments:
EOC 20-12 3
1.3E-3 2
5.2e-03 8
Verify RHR To Reactor Vessel Injection Valve Alignment:
Comments:.. MV-32064 - OPEN
.. MV-32065 - OPEN EOM 20-7b 2
0.0e+0 0
2 0
0.0e+
00 EOM 20-7b 2
7.6e-03 10 Check Containment Level - GREATER THAN 1.75 FEET Comments:
EOC 20-11 4
3.8E-3 2
7.6e-03 EOM 20-7b 2
2.6e-03 11.a Verify RWST to RHR isolation valve for idle RHR pump - CLOSED:
Comments: MV-32084 MV-32085 EOC 20-11 8
neg.
2 2.6e-03 11.b Check Sump B to RHR MV bonnets vented per ATTACHMENT K Comments:
EOM 20-7b 2
2.6e-03 2
2.6e-03 0HRECIRCSMY, Operator Fails To Initiate High Head Recirc. For A Small LOCA 6
Execution Unrecovered Procedure: 1ES-1.2, THERP Step No.
Instruction Error Type Table Item HEP Stress Factor Over Ride Total HEP EOM 20-7b 2
5.2e-03 11.c Open Sump B to RHR isolation valves for idle RHR pump:
Comments:.. MV-32075 AND MV-32077
-OR-
.. MV-32076 AND MV-32078 EOC 20-12 3
1.3E-3 2
5.2e-03 EOM 20-7b 2
2.6e-03 13.a Verify Sump B to RHR isolation valves are full open Comments: MV-32075 and MV-32077 OR MV-32076 and MV-32078 EOC 20-11 8
neg.
2 2.6e-03 EOM 20-7b 2
5.2e-03 13.b Start idle RHR pump Comments:
EOC 20-12 3
1.3E-3 2
5.2e-03 EOM 20-7b 2
5.2e-03 14.a Close SI pump suction isolation valve for idle SI pump Comments: MV-32162
-OR-MV-32163 EOC 20-12 3
1.3E-3 2
5.2e-03 EOM 20-7b 2
5.2e-03 14.b Open RHR supply to idle SI pump Comments:
EOC 20-12 3
1.3E-3 2
5.2e-03 EOM 20-7b 2
5.2e-03 14.c Start idle SI pump Comments:
EOC 20-12 3
1.3E-3 2
5.2e-03 EOM 20-7b 2
1.0e-02 14.d Check SI flow - FLOW INCREASE (1FI-925)
Comments: recovers crm actions, LD EOC 20-11 4
3.8E-3 2
1.0e-02 0HRECIRCSMY, Operator Fails To Initiate High Head Recirc. For A Small LOCA 7
Execution Recovered Critical Step No.
Recovery Step No.
Action HEP (Crit)
HEP (Rec)
Dep.
Cond. HEP (Rec)
Total for Step K.1 Vent the bonnets of Sump B to RHR MVs by OPENING AND THEN CLOSING the following valves (Located in CS pump room):
3.5e-03 1.8e-04 11.b Check Sump B to RHR MV bonnets vented per ATTACHMENT K 2.6e-03 LD 5.2e-02 K.8 Unlock and place the following 480V breakers to "ON":
8.5e-03 4.5e-04 11.b Check Sump B to RHR MV bonnets vented per ATTACHMENT K 2.6e-03 LD 5.2e-02 K.9 Remove cotter key AND travel stop for the following valves:
3.5e-03 1.8e-04 11.b Check Sump B to RHR MV bonnets vented per ATTACHMENT K 2.6e-03 LD 5.2e-02 4
Check Both Trains Of Safeguards Pumps Available For Recirculation 2.6e-03 1.5e-04 14.d Check SI flow - FLOW INCREASE (1FI-925) 1.0e-02 LD 6.0e-02 6
Close RWST To RHR Isolation Valve For Idle RHR Pump:
3.5e-03 1.8e-04 11.a Verify RWST to RHR isolation valve for idle RHR pump - CLOSED:
2.6e-03 LD 5.2e-02 7
Close SI Test Line To RWST Valves 5.2e-03 3.1e-04 14.d Check SI flow - FLOW INCREASE (1FI-925) 1.0e-02 LD 6.0e-02 10 Check Containment Level - GREATER THAN 1.75 FEET 7.6e-03 4.5e-04 14.d Check SI flow - FLOW INCREASE (1FI-925) 1.0e-02 LD 6.0e-02 11.c Open Sump B to RHR isolation valves for idle RHR pump:
5.2e-03 2.7e-04 13.a Verify Sump B to RHR isolation valves are full open 2.6e-03 LD 5.2e-02 0HRECIRCSMY, Operator Fails To Initiate High Head Recirc. For A Small LOCA 8
Execution Recovered Critical Step No.
Recovery Step No.
Action HEP (Crit)
HEP (Rec)
Dep.
Cond. HEP (Rec)
Total for Step 13.b Start idle RHR pump 5.2e-03 3.1e-04 14.d Check SI flow - FLOW INCREASE (1FI-925) 1.0e-02 LD 6.0e-02 14.a Close SI pump suction isolation valve for idle SI pump 5.2e-03 3.1e-04 14.d Check SI flow - FLOW INCREASE (1FI-925) 1.0e-02 LD 6.0e-02 14.b Open RHR supply to idle SI pump 5.2e-03 3.1e-04 14.d Check SI flow - FLOW INCREASE (1FI-925) 1.0e-02 LD 6.0e-02 14.c Start idle SI pump 5.2e-03 3.1e-04 14.d Check SI flow - FLOW INCREASE (1FI-925) 1.0e-02 LD 6.0e-02 Total Unrecovered:
6.0e-02 Total Recovered:
3.4e-03