ML091760764

Phase 3 Potential Loss of RHR Due to Inadequate Cooling of Suction Line During Mode 4 to Mode 3 Transition at Wolf Creek

ML091760764
Person / Time
Site:	Wolf Creek
Issue date:	06/24/2009
From:	Jeffrey Mitman, Runyan M, Antonios Zoulis NRC/NRR/DRA/APOB, Division of Reactor Safety IV
To:
Zoulis, A.M. NRR/DRA/APOB 415-1209
Shared Package
ML091760692	List: ML091760764
References
Download: ML091760764 (90)

Text

Phase 3 Potential Loss of RHR Due to Inadequate Cooling of Suction Line During Mode 4 to Mode 3 Transition at Wolf Creek Probabilistic Risk Assessment (PRA) Analyst: Antonios Zoulis, Reliability and Risk Analyst, NRR/DRA/APOB Probabilistic Risk Assessment (PRA) Analyst: Jeff Mitman, Senior Reliability and Risk Analyst, NRR/DRA/APOB Probabilistic Risk Assessment (PRA) Analyst: Michael Runyan Senior Reactor Analyst, R-IV/DRS Peer Reviewer: Gareth Parry, Senior Level Advisor NRR/DRA

1.0 Introduction On October 3, 2008, Wolf Creek reported a condition which affected the Residual Heat Removal System (RHR). The condition existed from at least 1990 to May 2008. This condition would have prevented the RHR system from performing its function due to system piping being saturated during heat up or cool down between Mode 3 and Mode 4.

Prior to identifying this condition, Wolf Creek Generating Station during plant startups would have one or both of the RHR trains lined up to the Reactor Coolant System (RCS) for shutdown cooling (SDC) and they would secure them prior to entering Mode 3 from Mode 4 (Mode 3 starts when RCS temperature exceeds 350 oF). A simplified RHR piping schematic is shown in Figure 1. System procedures require the RHR system to be cooled down using the mini-flow recirculation line, following alignment for Emergency Core Cooling System (ECCS) injection mode. The physical location at which the mini-flow piping connects to the suction of the RHR system prevented approximately 140 feet of RHR suction line between the RCS hot leg isolation valve and the mini-flow line location from being cooled, this piping would remain above 198 oF for approximately 29 hours3.356481e-4 days <br />0.00806 hours <br />4.794974e-5 weeks <br />1.10345e-5 months <br />. Licensee analysis indicates that if an RHR pump were switched to injection mode (either manually or from a Safety Injection System (SIS) signal) with water temperature above 198 oF water in the suction piping would flash to steam with the potential consequence of pump steam binding and/or piping water hammer. This would occur because a lowering of system pressure at the pump suction would flash the water into steam, depending upon the initial water temperature. As long as the saturation pressure in the RCS hot leg is higher than the static pressure from the Refueling Water Storage Tank (RWST), the check valve located in the supply line from the RWST will not open and no injection will occur. As the RHR pump is started, the pressure in the RCS hot leg will decrease which will cause the hot pressurized water to flash, before the pressure is low enough to open the check valve. The steam void could extend to the pump suction and steam bind the pump or water hammer could ensue failing the pumps. Likewise, if a Mode 4 Loss of Inventory (LOI), with water temperature between 198 oF and 350 oF, were to occur the operators would align the RHR system for injection and make the pumps susceptible to the failures discussed above.

In both Mode 3 and 4, if a loss of coolant accident (LOCA) or LOI inside containment were to occur, the operators are directed to establish long term cooling via internal recirculation. For low pressure recirculation, the RHR system takes suction from the containment sump and supplies cool water to the RCS. For high pressure recirculation, cases where the pressure is above the shutoff head of the RHR pumps, the RHR system is aligned to take suction from the containment sump and discharges to either the charging system or high pressure injection system. This is referred to as high pressure piggyback operation. During any Safety Injection from the RWST, when RWST level reaches 36%, per Wolf Creek design, auto-swapover from the RWST to the containment sump occurs. Opening of the RHR suction valves from the sump would cause a water hammer once the hot piping, exposed to the containment sump atmospheric conditions, flashes. Based on current licensee analysis (the licensee is currently performing more detailed analysis to determine if this assumption is correct) the water hammer would fail the RHR systems ability to provide long-term cooling.

Page 1

Figure 1 Simplified RHR Schematic Drawing Showing Affected Piping Page 2

In situations where auto-injection was not initiated such as Mode 4 and Mode 3 prior to 1935 psig or when establishing internal recirculation, the pumps would be manually started and the operators have an opportunity to stop the pumps prior to failure 2.0 Discussion of the Performance Deficiency The licensees failure to provide adequate procedures for changing modes of operation of the RHR system was a performance deficiency. System procedures require the RHR system to be cooled down using the mini-flow recirculation line, following alignment for Emergency Core Cooling System (ECCS) injection mode from SDC. The physical location at which the mini-flow piping connects to the suction of the RHR system prevented approximately 140 feet of RHR suction line between the RCS hot leg isolation valve and the mini-flow line location from being adequately cooled. This resulted in water temperatures as high as 350 oF in the RHR suction line. If the RHR system was started with this elevated suction temperature, the potential existed for steam binding and/or water hammer damaging the pumps.

3.0 Applicable Plant Modes During Condition The condition was applicable during transition from Mode 4 to Mode 3 when the RCS temperature exceeded approximately 198 oF. Since the condition spanned many years of plant operation, the 12 month period with the longest duration in this configuration was used for the analysis. Based on licensee review, in 2002 the site conducted a refueling outage and a forced outage. The RHR system was vulnerable to steam binding and/or water hammer for a total duration of 143.68 hours7.87037e-4 days <br />0.0189 hours <br />1.124339e-4 weeks <br />2.5874e-5 months <br />.

4.0 Licensee Event Mitigation Capability The site transition from Mode 4 to Mode 3 requires most equipment to be operable or available. Accumulators were not available until RCS pressure exceeded approximately 1000 psig and the Turbine Driven Auxiliary Feed pump was not available since secondary side steam pressure never exceeded 900 psig during the analyzed duration for this condition.

5.0 Significance Determination Process (SDP) Phase 2 Summary Since this concern only exists while the plant was shutdown, the inspectors evaluated this finding in accordance with NRC Inspection Manual Chapter 0609 Appendix G, "Shutdown Operations Significant Determination Process (SDP)," February 28, 2005.

Specifically, Appendix G, Attachment 2: "Phase 2 Significance Determination Process Template for PWR during Shutdown" was used. As part of the SDP, the inspectors assess conditions or events that represent a loss of control. The inspectors used the loss of RHR worksheets. Using a duration of 3-30 days and evaluating all LOCA initiators and SGTR, the finding was found to be greater than green and per Appendix G the analysis was submitted to Headquarters for evaluation.

6.0 Initiation of a Phase 3 SDP Risk Assessment The Shutdown SDP proceduralized in IMC 0609, Appendix G, is a tool used to screen shutdown findings for potential significance. This finding could not be screened as Page 1

having very low significance using the Phase 2 analysis. Therefore, a Phase 3 SDP risk assessment was performed by the Office of Nuclear Reactor Regulation (NRR).

The analysts used the following references in preparing the risk assessment:

• NUREG/CR-6883, The SPAR-H Human Analysis Method. August 2005

• NUREG-1842, Good Practices for Implementing Human Reliability Analysis. April 2005

• NUREG/CR-6595 Revision 1, An Approach for Estimating the Frequencies of Various Containment Failure Modes and Bypass Events. October 2004 7.0 Development of the Model No Low Power/Shutdown (LP/SD) or Transitional Power SPAR model exists for the Wolf Creek site. Therefore, the at-power Wolf Creek SPAR model was modified to allow analysis of the potential loss of RHR condition. Since the condition transitions between Mode 4 and Mode 3, potential initiators for both modes were evaluated. In addition, each mode was divided into specific plant operating states (POS) to account for changing plant conditions, equipment availability, and plant response. Figures 2 and 3 delineate the two modes and plant response during the analyzed condition for Wolf Creek Refueling Outage 12 (RF12) and Forced Outage 2002 respectively.

New event trees (ET) were created to analyze the condition for Small LOCA (SLOCA) and Medium LOCA (MLOCA) in Mode 3 and Loss of Inventory (LOI) inside and outside containment in Mode 4.

These ETs are shown in Appendix A. The ETs were linked to existing at-power fault trees (FT) and/or new FTs as required. The existing FTs were modified as necessary to appropriately describe system dependencies during applicable conditions and the different success criterion.

8.0 Model Assumptions The major assumptions for the analysis are as follows:

• For all initiators in modes 3 and 4, the RHR pumps are assumed to fail either due to the steam binding or water hammer which occurs on auto-swapover from the RWST to the containment sump. This is a conservative assumption which the licensee is currently evaluating.

• For all initiators in modes 3 and mode 4, the licensee has determined that the temperature necessary to prevent RHR damage is 198 oF. The original value cited in their root cause analysis was 250 oF. This lower temperature increases the duration of this condition but is a conservative value and the licensee is performing a calculation to obtain a more accurate value.

• For all initiators in modes 3 and 4, at-power maintenance terms were not quantified since they are not representative of transitional mode maintenance activities

• For MLOCA and SLOCA initiator frequencies in Mode 3, the analysis used the Wolf Creek at-power SPAR Model frequencies.

• LOI inside and outside containment for Mode 4, the initiating event frequency used is from EPRI TR-1003113 Analysis of Loss of Decay Heat Removal Trends & Initiating Event Frequencies (1989 - 2000). This frequency may be conservative since it Page 2

Figure 2 Wolf Creek RF12 Press Temp Curve 350 oF 600.0 2,500.0 POS 4 POS 3a POS 3b POS 3c Mode 4 500.0 Both Trains of 2,000.0 RHR in SDC 400.0 ECCS Auto Initiation 1930 psig, Low 1,500.0 Temperature pressurizer Pressure pressure 300.0 Accumulators Available 1000 ECCS Auto psig 1,000.0 Initiation Containment Hi 200.0 pressure > 4.5 Mode 3 psig (MLOCA) Both Trains of RHR in LPI 500.0 100.0 6

1 5

1 0

0 45 30 15 0

0 5

4 0

3 5

1 00 45 13 17 21 0: 4: 8: 12 15 19 23 3: 6:

2 2 2 2 2 02 02 02 /0 /0 /0 02 02 02 02 /0 /0 24 24 24 25 25 25 25 25 25 25 26 26 4/ / 4/ / 4/ / 4/ 4/ 4/ 4/ / 4/ / 4/ / 4/ / 4/ 4/

Time Thot (BBU0013) Press (BBP0403)

Page 3

Temperature 5/

18

/

5/ 02 18 17 -

/ 100.0 200.0 300.0 400.0 500.0 600.0 5/ 02 :52 18 18

/

5/ 02 :33 18 19

/

5/ 02 :23 18 20 Mode 4

/

5/ 02 :13 18 21

/ Both Trains of POS 4 5/ 02 :03 18 21

/

5/ 02 :53 RHR in SDC 18 22

/0 :4 5/ 2 2 3 19 3 :

/ 3 5/ 02 3 o 350 F 19 0:

/ 2 5/ 02 3 19 1:

/ 1 5/ 02 3 POS 3a 19 2:

/ 0 5 / 02 3 19 2:

/ 5 5/ 02 3 19 3:

/ 4 5 / 02 3 19 4:

/ 3 5/ 02 3 19 5:

1 Accumulators

/

5/ 02 3 19 6: Available

/ 0 POS 3b Thot (BBU0013) 5/ 02 3 Page 4 Time 19 6:

/ 5 1000 psig 5/ 02 3 19 7:

/ 4 5/ 02 3 19 8:

5/ /02 3 3 19

/ 9 5 / 0 2 :2 3 19 10

/

5/ 02 :13 19 11 Press (BBP0403)

/

5/ 02 :03 19 11

/ ECCS Auto 5/ 02 :53 Mode 3 19 12

/ Initiation 5/ 02 :43 19 13 Containment Hi

/ Both Trains of pressure > 4.5 ECCS Auto Figure 3 Wolf Creek 2002 Forced Outage Press Temp Curve 5/ 02 :33 POS 3c 19 14

/ psig (MLOCA) Initiation 1930 5/ 02 :23 RHR in LPI 19 15 psig, Low

/ pressurizer 5/ 02 :13 19 16 pressure

/

5/ 02 :03 19 16

/0 :5 2 3 17

4 3

500.0 1,000.0 1,500.0 2,000.0 2,500.0 Pressure

incorporates loss of inventory events in mode 4, 5, and 6 of PWR shutdown operation.

• The duration for cool down where this condition was applicable was approximately 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />. For a condition of this short duration to contribute significantly to the overall risk, the CDF would have to exceed 5E-4 per year. There is no indication that CDF would approach this value. Therefore, these short durations during cooling down were not evaluated separately in this analysis but the cooldown exposure was added to the overall exposure of 143.68 hours7.87037e-4 days <br />0.0189 hours <br />1.124339e-4 weeks <br />2.5874e-5 months <br />.

• SGTR initiator was not analyzed due the ability of the plant to equalize pressure and terminate the tube leak before RHR injection would be required. In addition, the leak size is very small and within the capacity of the charging system to maintain level 9.0 HRA Analysis Mode 4 operation is highly dependent on operator actions as most of the required actions are manual (e.g., initiating feed of the RCS). Additional analysis was conducted to properly characterize the required manual actions. The HEPs were calculated using the Low Power Shutdown SPAR-H worksheets from NUREG/CR-6883. Consideration was given to the available time to perform the action, the stress levels of the crew during the event, complexity of the action, crew experience and applicable and relevant training, quality and thoroughness of procedures, ergonomics, fitness of duty issues, and the available work processes.

The Mode 3 HEPs utilized the at-power model human actions. These values can be conservative since the available times may be longer since the plant is still below normal operating temperature and pressure for most of the duration of this condition and the decay heat levels are significantly lower than for events initiating at power. Table 1 shows a summary of the HEPs, a detailed discussion of the HRA is given in Appendix B.

In addition to the calculation of specific HEPs for this condition, sequences or cutsets which involved multiple operator actions were examined for human action dependency in all modes. Such dependency can occur due to a common cue or short/limited time separation between different cues. The method of identifying dependent operator actions involved reviewing the cutsets that were generated following quantification of the accident sequences. Once those HFEs that were dependent on previously occurring HFEs were identified, SPAR-H was used to perform the initial dependency analysis to calculate the dependent HEP values. Those dependent HEPs and their corresponding values are reported in Table 2. A more detailed description of the dependency analysis is given in Appendix B.

Page 5

Table 1 Summary of HRA Results Mean Mean Total Operator Time Human Error Event Description Shifts Diagnos Action Mean Available is HEP HEP HEP Mode 4 Human Failure Events Operator fails to diagnose small LOI outside of containment before loss SD-SLOI-DIAG-XHE One 70 min. 1.0E-3 0 1.0E-3 of SDC SD-SLOI-FEED-XHE Operator fails to initiate feed before loss of SDC One 70 min. 2.0E-3 2.00E-03 4.0E-3 SD-SLOI-FEED-LT-XHE Operator Fails to Initiate feed after loss of SDC, before core damage One 90 min. 2.0E-3 1.00E-03 3.0E-3 SD-SLOI-ISOL-AFD-XHE Operator fail to terminate SLOI leak before RWST is depleted Two ~25 hrs. 0 1.0E-5 1.0E-5 SD-SLOI-ISOL-BRF-XHE Operator fails to terminate SLOI leak before SDC fails One 60 min. 0 2.0E-3 2.0E-3 SD-SLOI-LTR1-XHE Operators fail to Refill BWST as Part of Long Term Recovery Two ~25 hrs. 1.0E-2 2.0E-3 1.2E-2 Operators fail to Restart LPI in SDC Mode as Part of Long Term SD-SLOI-LTR2-XHE Two ~25 hrs. 0 2.0E-3 2.0E-3 Recovery Mode 3 Human Failure Events Operators fail to Refill RWST as Part of Long Term Recovery when M3-DHC-REC-LATE One ~5hrs 1.0E-1 4.0E-04 1.0E-1 Pressure is Below 1000psig Operators fail to Refill RWST as Part of Long Term Recovery when M3a-DHC-REC-LATE One ~5hrs 1.0E-2 4.0E-04 1.0E-2 Pressure is Above 1000psig Notes: Estimated TTB = 120 minutes Estimated TTCD is 90 minutes if drain down continues to midloop Success criteria > 100 gpm Page 6

Table 2 Summary of Dependent HEP Results SPAR-H Applicable Operator Independent Dependent HEP Name Description Action Failures Dependent HEP HEP Operator fails to diagnose LOI before loss SD_SLOI_DIAG_XHE

• SD-SLOI-FEED-LT-XHE-D1 SD_SLOI_FEED_LT_XHE 3.0E-03 5.3E-02 of SDC and feed RCS late before CD Operator fails to feed before loss of SDC, SD-SLOI-FEED-XHE

• SD-SLOI-ISOL-BRF-XHE

• SD-SLOI-ISOL-BRF-XHE-D2 isolate LOI before loss of SDC, and feed 2.0E-03 5.2E-02 SD-SLOI-FEED-LT-XHE after loss of SDC Operator fails to feed before loss of SDC, SD-SLOI-FEED-XHE

• SD-SLOI-ISOL-BRF-XHE

• SD-SLOI-FEED-LT-XHE-D2 isolate LOI before loss of SDC, and feed 3.0E-03 1.5E-01 SD-SLOI-FEED-LT-XHE after loss of SDC Operator fails to isolate LOI and feed after SD-SLOI-ISOL-BRF-XHE SD-SLOI-FEED-LT-XHE-D3

• SD-SLOI-FEED-LT-XHE 3.0E-03 5.3E-02 loss of SDC Operatory fails to feed before loss of SDC SD-SLOI-FEED-XHE

• SD-SLOI-FEED-LT-XHE-D4 SD-SLOI-FEED-LT-XHE 3.0E-03 5.3E-02 and feed after loss of SDC Operator fails to feed early and fails to SD-SLOI-FEED-XHE

• SD-SLOI-ISOL-BRF-XHE-D6 SD-SLOI-ISOL-BRF-XHE 2.0E-03 5.2E-02 isolate before loss of SDC SD-SLOI-ISOL-AFD-XHE Operator fails to isolate LOI and makeup SD-SLOI-LTR1-XHE-D7

• SD-SLOI-LTR1-XHE 1.2E-02 1.2E-02 to BWST Page 7

10.0 Conditional Core Damage Probability (CCDP) Assessment Results A detailed Phase 3 Significance Determination Process risk analysis was performed.

NRC Inspection Manual Chapter (IMC) 0609 Appendix G Attachment 2 supplies guidance for performing Phase 2 analysis during modes 4, 5, & 6. Section 4.4 of this procedure directs the analyst to access the significance of shutdown events by calculating an incremental conditional core damage probability (ICCDP). NRC Inspection Manual Chapter (IMC) 0609 Appendix A applies to at-power conditions. The inspection manual chapters do not address transition modes between hot shutdown and at-power. The analyst analyzed this condition by calculation the ICCDP. The above described SPAR model was evaluated using the SAPHIRE code version 7.27.

As stated above, the condition in question was applicable for Mode 3 and 4 when the RHR suction temperature exceeded approximately 198 oF. This impacted the ability of the station to utilize RHR for injection, recirculation, and long-term cooling. The initiators evaluated consisted of MLOCA and SLOCA for Mode 3 and LOI inside and outside containment in Mode 4. During 2002, Wolf Creek conducted a refueling outage and a force outage. Both outages were analyzed for this condition.

Each Mode was divided into specific POSs which accounted for different initial plant conditions. It is important to note that this analysis assumes failure of the RHR pumps with no credit for recovery. The POS was evaluated separately for its base case CDF and its conditional CDF. The delta CDF was then multiplied by the duration to calculate the CCDP. The duration for each POS was initially developed by the licensee and verified by the analyst using plant pressure temperature data. In the Plant Operating State Evaluation section is a description of each POS and its applicable assumptions.

Tables 3a and 3b, which follows, describe the outages, modes, POSs, initial conditions, durations, base case CDF, conditional CDF, and the final CCDP. The result of the CCDP analysis is 2.84E-7. Based on these results the finding is of low safety significance, and the color is green.

The analysis included POSs in hot shutdown and hot standby. In hot shutdown, the analyst determined that shutdown initiators should be used. These include LOI, loss of off-site power (LOOP), and loss of shutdown cooling (LOSDC). After reviewing the applicable event trees, the analyst determined that the plant response to LOOP and LOSDC would not impacted by the unavailability of RHR. Since this condition renders the RHR unavailable during injection, a loss of RHR would not result in a substantial delta CDF from the base case LOSDC. Likewise, during a LOOP, the initiator does not postulate a LOCA which would require the RHR to be used for injection and thus does not contribute to the delta CDF for this analysis. Therefore, these initiators were not analyzed.

In hot standby, the internal event initiators for the at-power SPAR model were reviewed.

These are shown in the below table:

At-power Internal Initiating Events Loss of DC Bus NK01 Initiating Event Loss of DC Bus NK04 Initiating Event LARGE LOSS OF COOLANT ACCIDENT INITIATING EVENT ISLOCA IE 2-CKV HPI interface LOSS OF SERVICE WATER COOLING INITIATING EVENT LOSS OF CONDENSER HEAT SINK Page 8

At-power Internal Initiating Events LOSS OF MAIN FEEDWATER ISLOCA IE 2-CKV LPI interface REACTOR VESSEL RUPTURE INITIATING EVENT Loss of Component Cooling Water Initiating Event TRANSIENT SMALL LOCA VERY SMALL LOCA SMALL LOCA - M3 MEDIUM LOCA LOSS OF OFFSITE POWER STEAM GENERATOR TUBE RUPTURE Bounding sensitivity analyses were performed by conservatively assuming the RHR pumps were failed. Without applying recovery, the delta CDF was quantified from the base case CDF and the conditional CDF. From these bounding sensitivity analyses, the only initiating events that are applicable or contribute to the risk in this analysis are the small and medium LOCA initiating events. Therefore, these were the only two that were analyzed.

External events for this analysis were not analyzed since the probability of those events coupled with the loss of inventory or LOCA would be very low and not contribute significantly to the overall CCDP.

Plant Operating State Evaluation Mode 4 (Applicable to RF12 and Forced Outage 2002)

POS-4a and LOI Outside Containment In this POS, the plant is heating up and transition from Mode 4 to Mode 3. The transition point to Mode 3 is 350 oF. At the time of this condition, the RHR pumps ran in shutdown cooling until approximately 350 oF. If a LOI outside containment were to occur, the operators would attempt to isolate the leak, monitor level, and initiate feed as required.

The RHR pumps, if required, would be aligned to inject into the RCS. If feed is successful the operators have more time to isolate the leak and recover from the event.

The operators have procedural guidance to refill the RWST and provided cool water to the RCS to prevent core damage in the event RHR is lost.

In this condition the analyst assumed the pumps would steam bind or water hammer preventing the RHR systems from providing injection and long-term cooling.

Page 9

POS-4b and LOI Inside Containment In this POS, the plant is heating up and transitioning from Mode 4 to Mode 3. The transition point to Mode 3 is 350 oF. At the time of this condition, the RHR pumps ran in shutdown cooling until approximately 350 oF. If a LOI inside containment were to occur, the operators would attempt to isolate the leak, monitor level, and initiate feed as required. The RHR pumps, if required, would be aligned to inject into the RCS. If feed is successful the operators have more time to isolate the leak and recover from the event. The operators have procedural guidance to refill the RWST and provided cool water to the RCS to prevent core damage in the event RHR is lost.

In this condition the analyst assumed the pumps would steam bind or water hammer preventing the RHR systems from providing injection and long-term cooling.

POS-3a1 and MLOCA (No Accumulators)

In this POS, the plant is in MODE 3, below 1000 psig, continuing to heat-up to normal operating temperature and pressure when a medium LOCA occurs. The accumulators are not available as the plant RCS pressure is below 1000 psig. If containment pressure exceeds 4.5 psig an auto-ECCS will occur, pressure will decrease rapidly and the RHR pumps will begin injecting immediately from the RWST. When the RHR pumps start the suction piping will flash to steam rending the RHR pumps unavailable for injection or recirculation. The operators can maintain injection with other sources but require a long-term cooling success path via refilling the RWST or restoration of a RHR train. The operators have procedural guidance to refill the RWST and provided cool water to the RCS to prevent core damage in the event RHR is lost.

POS-3b1 and MLOCA In this POS, the plant is in MODE 3, above 1000 psig, continuing to heat-up to normal operating temperature and pressure when a medium LOCA occurs. The accumulators are available as the plant is above 1000 psig and inject (technical specification requires accumulator operable before exceeding this pressure). If containment pressure exceeds 4.5 psig an auto-ECCS will occur pressure will decrease rapidly and the RHR pumps will begin injecting immediately from the RWST. When the RHR pumps start, the suction piping will flash to steam rending the RHR pumps unavailable for injection or recirculation. The operators can maintain injection with other sources but require a long-term cooling success path via refilling the RWST or restoration of a RHR train. The operators have procedural guidance to refill the RWST and provided cool water to the RCS to prevent core damage in the event RHR is lost.

POS-3c1 and MLOCA (Auto-ECCS)

POS is similar to POS-3b1 except the Wolf Creek P-7 interlock is cleared once the RCS pressure exceeds 1935 psig. P-7 disables the auto-ECCS due to low pressurizer pressure when the plant is performing a controlled plant shutdown. With RCS pressure above 1935 psig an auto-ECCS will result when either containment pressure exceeding 4.5 psig or pressurizer pressure falls below 1935 psig.

POS-3a2 and SLOCA (No Accumulators)

In this POS, the plant is in MODE 3, below 1000 psig, continuing to heat-up to normal operating temperature and pressure when a small LOCA occurs. The accumulators are Page 10

not available as the plant RCS pressure is below 1000 psig. Auto-ECCS will not initiate on containment pressure as pressure will not exceed 4.5 psig, and the low pressurizer pressure interlock (P7) has not been cleared. The plant can mitigate the SLOCA using its charging system, high pressure injection system, or low pressure injection system.

Secondary cooling is available via the auxiliary feedwater or main feedwater start-up pumps. The most probable sequences involve successful injection and the necessity to establish long-term cooling. If the operators begin to establish internal recirculation from the containment sump, the suction piping will flash to steam and the subsequent water hammer will render the RHR pumps unavailable for injection or recirculation. The operators can maintain injection with other sources such as high pressure injection and charging until the RWST is depleted and therefore, require a long-term cooling success path via refilling the RWST. The operators have some procedural guidance to refill the RWST and provided cool water to the RCS to prevent core damage in the event RHR is lost.

POS-3b2 and SLOCA In this POS, the plant is in MODE 3, above 1000 psig, continuing to heat-up to normal operating temperature and pressure when a small LOCA occurs. The accumulators are available as the plant is above 1000 psig. Auto-ECCS will not initiate on containment pressure as pressure will not exceed 4.5 psig, and the low pressurizer pressure interlock (P7) has not been cleared. The plant can mitigate the SLOCA using its charging system, high pressure injection system, or low pressure injection system. Secondary cooling is available via the auxiliary feedwater or main feedwater start-up pumps. The most probable sequences involve successful injection and the necessity to establish long-term cooling. If the operators begin to establish internal recirculation from the containment sump, the suction piping will flash to steam and the subsequent water hammer will render the RHR pumps unavailable for injection or recirculation. The operators can maintain injection with other sources until the RWST is depleted and therefore, require a long-term cooling success path via refilling the RWST. The operators have procedural guidance to refill the RWST and provided cool water to the RCS to prevent core damage in the event RHR is lost.

POS-3c2 and SLOCA (Auto-ECCS)

This POS is similar to POS-3b2 except the Wolf Creek P-7 block is cleared once RCS pressure exceeds 1935 psig. P-7 disables the auto-ECCS due to low pressurizer pressure when the plant is in a controlled shutdown. Therefore, an auto-ECCS will result due to low pressurizer pressure below 1935 psig. The safety injection signal will start the charging system, high pressure injection system, and low pressure injection system as well as other systems. Secondary cooling is available via the auxiliary feedwater and main feedwater start-up pump. The RHR pumps will start but not inject as pressure in the RCS will remain above the pump shutoff head of approximately 300 psig. Wolf Creek procedures direct the operators to monitor level and reduce injection flow rate as necessary. The most probable sequences involve successful injection and the necessity to establish long-term cooling. When the operators begin to establish internal recirculation from the RWST, the suction piping will flash to steam and the subsequent water hammer will render the RHR pumps unavailable for injection or recirculation. The operators can maintain injection with other sources until the RWST is depleted and therefore, require a long-term cooling success path via refilling the RWST.

The operators have procedural guidance to refill the RWST and provided cool water to the RCS to prevent core damage in the event RHR is lost.

Page 11

Table 3a Wolf Creek 2002 RF12 Power Ascension T ime Windows Duration Base Case Conditional Mode POS Initial Conditions (Hrs) Initiator CDF/yr CDF/yr ICCDP 4a IE-LOI-OC 1.48E-05 1.73E-05 5.65E-09 Mode 4 Both RHR Trains aligned for shutdown cooling 19.5 4b IE-LOI-IC 1.47E-05 1.73E-05 5.70E-09 Both RH R Trains aligned for LPI, Accumulators not available, Mode 3 3a1 IE-MLOC A 1.49E-07 2.42E-05 7.53E-09 Auto ECCS, TD AFW not available

(<1000 2.75 Both RH R Trains aligned for LPI, Accumulators not available, psig) 3a2 IE-SLOC A 3.43E-07 7.23E-05 2.26E-08 Manual ECCS, TD AFW not available 2002 RF12 Both RHR Trains aligned for LPI, Accumulators available, Auto 3b1 IE-MLOC A 1.48E-07 6.57E-06 1.41E-08 ECC S, TD AFW not available Mode 3 19.25 Both RHR Trains aligned for LPI, Accumulators available, Manual 3b2 IE-SLOC A 3.43E-07 1.95E-05 4.20E-08 ECCs Initiation, TD AFW not available 3c1 Both RHR Trains aligned for LPI, Accumulators available, Auto IE-MLOC A 1.48E-07 6.57E-06 2.71E-08 Mode 3 37.00 3c2 ECCS Initiation, TD AFW not available IE-SLOC A 3.43E-07 7.48E-06 3.01E-08 78.5 1.55E-07 Table 3b Wolf C reek 2002 Force Outage Power Ascension Time Windows Duration Base Case Conditional Mode POS Description (Hrs) IE CDF/yr CDF/yr ICCDP 4a IE-LOI-OC 1.48E-05 1.73E-05 1.79E-09 Mode 4 Both RHR Trains aligned for shutdown cooling 6.18 4b IE-LOI-IC 1.47E-05 1.73E-05 1.81E-09 Both RH R Trains aligned for LPI, Accumulators not available, Mode 3 3a1 IE-MLOC A 1.49E-07 2.42E-05 9.12E-09 Auto ECCS, TD AFW not available

(<1000 3.33 Both RH R Trains aligned for LPI, Accumulators not available, psig) 3a2 IE-SLOC A 3.43E-07 7.23E-05 2.73E-08 2002 Forced Manual ECCS, TD AFW not available Outage Both RHR Trains aligned for LPI, Accumulators available, Auto 3b1 IE-MLOC A 1.48E-07 6.57E-06 1.76E-09 ECC S, TD AFW not available Mode 3 2.4 Both RHR Trains aligned for LPI, Accumulators available, Manual 3b2 IE-SLOC A 3.43E-07 1.95E-05 5.24E-09 ECCs Initiation, TD AFW not available 3c1 Both RHR Trains aligned for LPI, Accumulators available, Auto IE-MLOC A 1.48E-07 6.57E-06 3.90E-08 Mode 3 53.27 3c2 ECCS Initiation, TD AFW not available IE-SLOC A 3.43E-07 7.48E-06 4.34E-08 65.18 1.29E-07 Total CCDP 2.84E-07 Page 12

11.0 Conditional Large Early Release Probability (CLERP) Assessment The figure of merit for this analysis is incremental conditional large early release probability (ICLERP). This ICLERP analysis is based on the method for shutdown described in NUREG/CR-6595 Revision 1, An Approach for Estimating the Frequencies of Various Containment Failure Modes and Bypass Events, dated 10/2004. This report supplies simplified containment event trees (CET) to determine if the core damage sequence contributes to LERF. NUREG/CR-6595 presents its analysis in terms of LERF, which is interpreted here as ICLERP.

NUREG/CR-6595 defines LERF as the frequency of those accidents leading to significant, unmitigated releases from containment in a time frame prior to effective evacuation of the close-in population such that there is a potential for early health effects. This is identical to the definition of LERF in IMC 0609 Appendix H. Figure 4.1 (PWR Large Dry Containment Event Tree) from NUREG/CR-6595 is applicable to the Wolf Creek condition.

The analysis can be divided into containment bypass events and non-containment bypass events. The only containment bypass events were LOI outside containment events. For the non-containment bypass events the CCDP is 2.77E-7 by subtracting the bypass sequences from the total CDF. Therefore, the review of the LERF event tree yields a worst case containment failure probability for the Wolf Creek containment of 1E-

2. With a CCDP of 2.77E-7 this yields a CLERP of 2.72E-9 which is a green.

The LOI outside containment CCDP is 7.45E-9 which bypasses containment. Assuming a LERF factor of 1.0, the CLERP for those sequences is less than 1E-07 which is green.

12.0 Sensitivity Analysis Several sensitivity cases were conducted to further understand the event. The cases are described below.

Case 1: Assume Operator Action to Refill RWST Fails This sensitivity case assumed that the refill of the RWST failed for all initiators. It was calculated by setting all RWST operator action to True (1.0). The calculated CCDP was 1.20E-05.

Case 2: Assume Operator Action to Refill RWST is Successful This sensitivity case assumed that the refill of the RWST succeeded for all initiators. It was calculated by setting all RWST operator action to False (0.0). The calculated CCDP was 8.31E-08.

Page 13

Case 3: Assume value for Operator Action to Refill RWST which results in CCDP of 1E-06.

This sensitivity case calculated the probability of refill of the RWST which would result in a CCDP of 1.00E-06. The M3-DHC-REC-LATE and M3a-DHC-REC-LATE probability would be 1E-01. Given the applicable procedures and level of training of the operators an HEP value of this magnitude is not realistic.

Case 2: Assume no credit for Operator Action to Refill RWST below 1000psig in Mode 3 and Mode 4.

This sensitivity case assumed that the refill of the RWST failed for all initiators when pressure is below 1000psig for mode 3 and mode 4. The calculated CCDP was 2E-06.

This illustrates the importance of the operator actions during shutdown and is a potential area for improvement. The plant should evaluate revising the applicable mode 3 and mode 4 procedures.

Page 14

Appendix A: Model Figures Page 15

Figure A-1: Mode 4 - Loss of Inventory Outside Containment Event Tree SLOI Outside of Containment Operators Diagnose Operators initiate Operators Operators initiate feed Long term recovery Occurs -M4 SLOI Event RCS FEED terminate SLOI after RHR failure; before in SLOI before loss of RHR core damage IE-M4-SLOI-OC SD-SLOI-DIAG SD-SLOI-FEED-FT SD-SLOI-ISOL-FT SD-SLOI-FEED-LT-FT SD-SLOI-LTR-FT # END-STATE 1 OK 2 OK SD-SLOI-ISOL-AFD-FT SD-SLOI-LTR-FT1 3 CD-SD 4 OK 5 OK SD-SLOI-LTR-FT2 6 CD-SD SD-SLOI-ISOL-BRF-FT 7 CD-SD 8 OK SD-SLOI-LTR-FT2 9 CD-SD 10 CD-SD M4-SLOI-OC - Small Loss of Inventory Event Occurs in M4 - Inside Containment 2009/06/23 Page 16

Figure A-2: Mode 4 - Loss of Inventory Inside Containment Event Tree SLOI Inside of Containment Operators Diagnose Operators initiate Operators Operators initiate feed Long term recovery Occurs -M4 SLOI Event RCS FEED terminate SLOI after RHR failure; before in SLOI before loss of RHR core damage IE-M4-SLOI-IC SD-SLOI-DIAG SD-SLOI-FEED-FT SD-SLOI-ISOL-FT SD-SLOI-FEED-LT-FT SD-SLOI-LTR-FT # END-STATE 1 OK 2 OK SD-SLOI-ISOL-AFD-FT SD-SLOI-LTR-FT1 3 CD-SD 4 OK 5 OK SD-SLOI-LTR-FT1 6 CD-SD SD-SLOI-ISOL-BRF-FT 7 CD-SD 8 OK SD-SLOI-LTR-FT2 9 CD-SD 10 CD-SD M4-SLOI-IC - Small Loss of Inventory Event Occurs in M4 - Inside Containment 2009/06/23 Page 17

Figure A-3: Mode 3 - Medium LOCA Event Tree MEDIUM LOCA - M3 HIGH ACCUMULATOR AUXILIARY COOLDOWN LOW LOW HIGH Decay heat cooling PRESSURE 3-OF-3 FEEDWATER (PRIMARY AND PRESSURE PRESSURE PRESSURE recovery in mode 3 INJECTION SECONDARY) INJECTION RECIRC RECIRC IE-M3-MLOCA HPI-M3 ACC AFW-A-M3 SSC-M3 LPI-M3 LPR-M3 HPR-M3 M3-DHC-RECOV # END-STATE 1 OK 2 OK 3 OK Success Path 4 CD 5 OK 6 CD 7 OK 8 CD 9 OK 10 CD 11 CD SSC1 12 CD 13 CD 14 CD M3-MLOCA - Medium LOCA Event Occurs During M3 2009/05/20 Page 18

Figure A-4: Mode 3 - Small LOCA Event Tree SMALL LOCA - M3 FEEDWATER HIGH FEED COOLDOWN LOW RESIDUAL HIGH LOW decay heat cooling AVAILABLE PRESSURE AND (PRIMARY AND PRESSURE HEAT PRESSURE PRESSURE recovery in mode 3 MFW or AFW INJECTION BLEED SECONDARY) INJECTION REMOVAL RECIRC RECIRC IE-M3-SLOCA FW-M3 HPI-M3 FAB-M3 SSC-M3 LPI-M3 RHR-M3 HPR-M3 LPR-M3 M3-DHC-RECO # END-STATE 1 OK 2 OK Success Path 3 OK 4 OK 5 CD 6 OK 7 CD 8 OK 9 OK 10 CD 11 CD SSC1 12 CD 13 OK 14 CD 15 CD M3-SLOCA - Small LOCA Event Occurs During M3 2009/05/13 Page 19

Figure A-5: Mode 4 - Operators Diagnose LOI Event Before Loss of RHR Fault Tree Operators Diagnose Small LOI Outside of Containment Event SD-SLOI-DIAG Operators fail to diagnose small LOI outside of containment before loss of SDC 1.000E-3 SD-SLOI-DIAG-XHE SD-SLOI-DIAG - Operators Diagnose SLOI Event before loss of RHR 2008/09/01 Page 280 Page 20

Figure A-6: Mode 4 - Operators initiate RCS FEED Fault Tree Operators initiate RCS makeup for SLOI outside containment event SD-SLOI-FEED-FT RCS Injection Methods Operator fails to initiate Equipment feed before loss of SDC 4.000E-3 SD-SLOI-INJ SD-SLOI-FEED-XHE HIGH PRESSURE WOLF CREEK CHARGING LOW PRESSURE INJECTION SYSTEM INJECTION 133 69 189 HPI CVC LPI SD-SLOI-FEED-FT - Operators initiate RCS FEED 2009/05/07 Page 281 Page 21

Figure A-7: Mode 4 - Operators terminate LOI After Feed Initiates Fault Tree Operators terminate SLOI after feed initiates SD-SLOI-ISOL-AFD-FT FAILURES OF EQUIPMENT Operators fail to TO ISOLATE terminate SLOI leak before RWST is depleted 1.000E-6 1.000E-5 SD-ISOL-EQP-FAILURES SD-SLOI-ISOL-AFD-XHE SD-SLOI-ISOL-AFD-FT - Operators terminate SLOI after feed initiates 2009/05/07 Page 299 Page 22

Figure A-8: Mode 4 - Operators terminate LOI Before Loss of RHR Fault Tree Operators terminate SLOI before SDC fails (RCS level drops below midloop)

SD-SLOI-ISOL-BRF-FT Operator fail to terminate FAILURES OF EQUIPMENT SLOI leak before SDC TO ISOLATE fails 2.000E-3 1.000E-6 SD-SLOI-ISOL-BRF-XHE SD-ISOL-EQP-FAILURES SD-SLOI-ISOL-BRF-FT - Operators terminate SLOI before SDC fails (RCS level drops below midloop) 2009/06/04 Page 301 Page 23

Figure A-9 Mode 4 - Operators initiate feed after RHR failure; before core damage Fault Tree Operators initiate RCS makeup for SLOI outside containment event 3 before CD SD-SLOI-FEED-LT-FT Injection Methods Operators fail to initiate feed after loss of SDC; before core damage 3.000E-3 SD-SLOI-FEED-LT-FT2 SD-SLOI-FEED-LT-XHE HIGH PRESSURE LOW PRESSURE WOLF CREEK CHARGING INJECTION INJECTION SYSTEM 133 189 69 HPI LPI CVC SD-SLOI-FEED-LT-FT - Operators initiate feed after RHR failure; before core damage 2009/05/07 Page 283 Page 24

Figure A-10 Mode 4 - Late Recovery and Refill of RWST Fault Tree Long Term Recovery in LOI SD-SLOI-LTR-FT1 Makeup to RWST LOW PRESSURE RECIRC HIGH PRESSURE RECIRC 194 140 SD-SLOI-LTR2-FT3 LPR HPR GATE TURNS ON OR Operators fail to Refill OFF FOR RWST RWST as Part of Long MAKEUP Term Recovery 1.200E-2 GCSS-CSS-FLAG SD-SLOI-LTR1-XHE FAILURE OF RWST FLAG TURNS ON OR MAKEUP INJECTION OFF MAKEUP FOR RWST TRUE GRWST-MAKEUP-INJ-M4A GCSS-FLAG FIRE PROTECTION FAILURE OF REACTOR FAILURE OF SYSTEN UNAVAILABLE WATER MAKEUP CONTAINMENT SPRAY SYSTEM TO REFILL RWST 129 309 FPS GRWS-MAKEUP GSD-RWST-REFILL CONTAINMENT SPRAY CSS FLOW PATH PUMPS FAIL FAILS TO THE RWST GCSS-PUMPS GCSS-FLOW-PATH CSS PUMPS FAIL 1A & CCF OF CONTAIMENT CSS MANUAL VALVE CSS MANUAL VALVE CSS ISOLATION VALVE 1B FAIL TO START OR PUMPS TO START FAILS TO OPEN FAILS TO OPEN FAILS TO OPEN RUN AND RUN 7.430E-4 7.430E-4 1.000E-3 GCSS-PUMPS-START-RUN GCSS-CCF CSS-XVM-CC-V0001 CSS-XVM-CC-V0024 CSS-AOV-CC-HV001 CSS PUMPS FAIL TO RUN CSS PUMP 1B FAILS CSS PUMPS FAIL FROM CSS PUMPS FAIL FROM TO START OR RUN COMMON CAUSE TO RUN COMMON CAUSE TO START 1.043E-5 6.270E-5 GCSS-PUMPS-RUN GCSS-PUMP-1B CSS-MDP-CF-RUN CSS-MDP-CF-START CSS-PUMP P1A FAILS TO CSS PUMP P1A FAILS CSS PUMP P1B FAILS TO CSS PUMP P1B FAILS RUN TO START RUN TO START 5.379E-4 1.500E-3 5.379E-4 1.500E-3 CSS-MDP-FR-P1A CSS-MDP-FS-P1A CSS-MDP-FR-P1B CSS-MDP-FS-P1B SD-SLOI-LTR-FT1 - Long Term Recovery in LOI 2009/05/20 Page 304 Page 25

Figure A11- Mode 3 - Auxiliary Feed Water Fault Tree FEEDWATER AVAILABLE MFW or AFW FW-M3 Both MFW and FW auto and AFW fail manual actuation in mode 3 fails FW-AFW-FAIL FW-M3-ACTUATION AFW IS UNAVAILABLE MAIN FEEDWATER MAIN FEEDWATER Automatic actuation of manual actuation IS UNAVAILABLE ECCS in mode 3 of FW in mode 3

24 198 308 1.000E-3 1.000E-2 AFW MFW MFW-STARTUP ECCS-AUTO-ACT-M3 FW-XHE-ACT-M3 FW-M3 - FEEDWATER AVAILABLE MFW or AFW 2009/05/12 Page 285 Page 26

Figure A12- Mode 3 - Late Recovery and Refill RWST Long Term Recovery (RWST MU)

SD-LTR-RWST-RHR Operators fail to Refill FAILURE OF RWST RWST as Part of Long INJECTIONS SOURCES Term Recovery 1.000E-2 M3-DHC-REC-LATE GRWST-REFILL-INJ GATE TURNS ON OR FIRE PROTECTION FAILURE OF REACTOR OFF CSS FOR RWST SYSTEN UNAVAILABLE WATER MAKEUP MAKEUP SYSTEM 129 309 GCSS-CSS-FLAG FPS GRWS-MAKEUP FAILURE OF FLAG TURNS ON OR CONTAINMENT SPRAY OFF CSS FOR RWST TO REFILL RWST MAKEUP TRUE GSD-RWST-REFILL GCSS-FLAG CONTAINMENT SPRAY CSS FLOW PATH PUMPS FAIL FAILS TO THE RWST GCSS-PUMPS GCSS-FLOW-PATH CSS PUMPS FAIL 1A & CCF OF CONTAIMENT CSS MANUAL VALVE CSS MANUAL VALVE CSS ISOLATION VALVE 1B FAIL TO START OR PUMPS TO START FAILS TO OPEN FAILS TO OPEN FAILS TO OPEN RUN AND RUN 7.430E-4 7.430E-4 1.000E-3 GCSS-PUMPS-START-RUN GCSS-CCF CSS-XVM-CC-V0001 CSS-XVM-CC-V0024 CSS-AOV-CC-HV001 CSS PUMPS FAIL TO RUN CSS PUMP 1B FAILS CSS PUMPS FAIL FROM CSS PUMPS FAIL FROM TO START OR RUN COMMON CAUSE TO RUN COMMON CAUSE TO START 1.043E-5 6.270E-5 GCSS-PUMPS-RUN GCSS-PUMP-1B CSS-MDP-CF-RUN CSS-MDP-CF-START CSS-PUMP P1A FAILS TO CSS PUMP P1A FAILS CSS PUMP P1B FAILS TO CSS PUMP P1B FAILS RUN TO START RUN TO START 5.379E-4 1.500E-3 5.379E-4 1.500E-3 CSS-MDP-FR-P1A CSS-MDP-FS-P1A CSS-MDP-FR-P1B CSS-MDP-FS-P1B SD-LTR-RWST-RHR - Long Term Recovery (RWST MU and SDC) 2009/05/20 Page 306 Page 27

Appendix B: HRA Analysis Page 28

Human Error Probabilities A high level discussion of the Human Reliability Analysis (HRA) is presented above in Section 7 on Model Development. Also included above is a summary of the HRA results. The following discusses the Human Failure Events (HFE), the derivation of the in individual Human Error Probabilities (HEP) and the analysis of the dependency between these HEPs. This HRA analysis was done consistent with the guidance of NUREG/CR-6883, The SPAR-H Human Reliability Analysis Method, dated August 2005.

The Human Error Probabilities (HEPs) for this analysis were calculated using the Low Power Shutdown SPAR-H worksheets from NUREG/CR-6883. Consideration was given to the available time to perform the action, the stress levels of the crew during the event, complexity of the action, crew experience and applicable and relevant training, quality and thoroughness of procedures, ergonomics, fitness of duty issues, and the available work processes.

The HEPs for this analysis are shown in Table 1 above. The detail description of each HEP is discuss below. Tables B1-B9c contains the diagnosis and/or action worksheets from SPAR-H used to develop the above HEPs.

B1 HFE ID: SD-SLOI-DIAG-XHE HFE Definition This HFE represents the failure of the diagnosis step that requires the operating crew to recognize that an event has occurred, determine what type of event it is and determine which procedure(s) need to be used to address the event.

Description and Context Associated with Event Operators are transitioning in Mode 3 when LOI event occurs. RHR is aligned to shutdown cooling.

Operator Action Success Criteria The operator must recognize the abnormal event and start implementation of procedure OFN-BB-31 Shutdown LOCA. The operator needs to perform this action before RCS level drops to the middle of the hotleg at which time the LPI/SDC pumps will begin to cavitate. There are about 70 minutes to diagnose this event and correct the situation, see timing section below for more details.

Cues The control room receives no annunciators on the decreasing RCS level.

Decreasing level on control room indicators and associated computer displays feed from the level transmitters.

Page 29

Procedure and Relevant Steps OFN-BB-31 Loss of Decay Heat Removal is the controlling procedure for this event.

It supplies the appropriate entry conditions.

MCR or Local Action This is a main control room cognitive event. The level indication is indicated in the control room. The reactor operator is responsible for monitoring the appropriate RCS parameters and the shift supervisor (SRO) is responsible for decision making.

Diagnosis (with or w/o recovery) / Execution (with or w/o recovery) / Diagnosis +

Execution This is a purely diagnostic event. If the operator fails to recognize that an event is occurring or fails to recognize that this is a loss of inventory event, there will be additional cues when the RCS level decreases sufficiently to perturb the SDC pumps.

However, this second scenario will be evaluated with a second HFE. Therefore, there is no recovery analyzed in this event.

Time Windows / Nominal / mean /median actions times For diagnosis 30 of the total available 70 minutes is allocated to perform this function.

Relevant Performance Shaping Factors Only those PSF which are or might be impacted are discussed here: others are nominal.

• Complexity: Obvious Diagnosis Define Subtasks / failure modes / assign BE id(s)

• Subtasks: There are none.

• Failure modes:

Operator fails to recognize RCS level is decreasing.

Operators recognize that level is decreasing but fail to enter the correct procedure.

• BE Id: SD-SLOI-DIAG- XHE B2 HFE ID: SD-SLOI-FEED-XHE HFE Definition This HFE represents the failure of the operator to inject into the RCS to maintain or increase RCS level after recognizing that a LOI is in progress.

Page 30

Description and the Context Associated with the Event Operators are transitioning in Mode 3 when LOI event occurs. RHR is aligned to shutdown cooling.

Operator Action Success Criteria Injection must be established before RCS level drops to midloop to prevent loss of SDC due to cavitation of the LPI pumps. The flow rate must exceed the rate of loss of inventory. Methods available to inject include HPI, Charging, and LPCI.

Cues The major portion of the diagnoses and therefore, the associated cues are addressed in the previously occurring HFE (SD-SLOI-DIAG-XHE). However, the following additional cues were prompted by associated procedures:

o Decreasing RCS level Procedure + Relevant Steps OFN-BB-31 rev 10, Loss of Decay Heat Removal supplies guidance on injection by the following priority: Charging, HPI, and LPCI.

MCR or Local Action The actions when transitioning from Mode 4 to 3 are in the main control room.

Diagnosis (with or w/o recovery) / Execution (with or w/o recovery) / Diagnosis +

Execution This HFE is primarily action but does contain some cognitive (diagnosis) effort in the decision making.

Time Windows / Nominal / mean /median actions times Time available for diagnosis and subsequent operator actions is approximately 70 minutes. Thirty minutes was allocated to perform the previous diagnoses and is handled by HFE SD-SLOI-DIAG-XHE.

A portion of the 70 minutes must be allocated to the event diagnosis action. The remaining time is left to perform this HFE. For HFE SD-SLOI-DIAG-XHE 30 minutes of the total was allocated for diagnosis, this leaves the remaining 40 minutes to perform this action.

Page 31

Relevant Performance Shaping Factors Only those PSF which are or might be impacted are discussed here: all other PSFs remained at their nominal value.

o Stress: With a LOI event occurring stress was elevated.

o Complexity:

o Additional cues result in obvious diagnose.

Define Subtasks / failure modes / assign BE id(s)

• Failure modes:

o MCR operator fails to direct the equipment operator to manipulate the correct valves or pump.

o BE Id: SD-SLOI-FEED-XHE B3 HFE ID: SD-SLOI-FEED-LT-XHE HFE Definition This HFE represents the failure of the operator to feed the RCS with one or more injections methods after the RCS level has decreased to midloop. Level reaching midloop requires securing the LPI pumps from SDC. The operator must diagnose the cavitation of the running LPI/SDC pumps by recognizing the loss of inventory. Then secure the running LPI pumps. Finally, the operator is required to inject into the RCS via one of several methods to increase RCS level. The potentially available methods to inject are:

o Forced injection with a charging pump o Forced injection with a HPI pump o Forced injection with a LPI pump Description and Context Associated with Event Previous to this HFE, RCS water level has continued to decrease unabated until midloop and the running LPI/SDC pumps have begun to cavitate. The operators have not isolated the leak nor injected into the RCS. Because the leak path is from purification system via LPI and the hotleg the loss of additional inventory ceases when level reaches the bottom of the hotleg. However, without SDC in-service boiling will result.

This condition causes two additional sets of annunciators to alarm in the MCR. They are the low flow and low differential pressure.

The LPI pumps are available to perform forced injection. However, two of these pumps were previously running in SDC and had to be secured due to air entrainment and subsequent cavitation. These pumps would need to be filled and vented before they could be placed in injection mode. OFN-BB-31 supplies guidance on how to fill and vent the pumps.

Page 32

Operator Action Success Criteria Injection must be established before RCS level drops to the top of active fuel with subsequent core damage.

Time to boil from the bottom of the hotleg is about 50 minutes. Time to core uncovery is about 90 minutes.

To prevent core damage, the inject flow rate must exceed the mass loss rate from boiling. This value is estimated at 100 gpm. To re-flood the RCS and restart LPI/SDC a higher flow rate is required. This value is estimated at 200 gpm. Methods available to inject include the charging, HPI, and realignment of LPI from SDC to injection from the RWST only.

Cues o Low indicated RCS level on LT.

o Low Pressure Decay Heat Loop A (or B) Flow Low annunciator o Low Pressure Injection Pump A (or B) Differential Pressure Low annunciator Procedure and Relevant Steps The Alarm Response Guides for the above cues discussed above direct the operator to OFN-BB-31.

MCR or Local Action The diagnosis and action is performed in the MCR.

Diagnosis (with or w/o recovery) / Execution (with or w/o recovery) / Diagnosis +

Execution This HFE is a combination of action and diagnosis. It contains some cognitive (diagnosis) effort to recognize the loss of SDC due to cavitation.

Time Windows / Nominal / mean /median actions times Cavitation of the LPI/SDC pumps will occur approximately 70 minutes after the LOI starts. If no actions to inject water into the RCS are successful, core damage will occur approximately 90 minutes after loss of SDC.

Time is allocated as follows: 30 minutes to diagnose the event (the cues for this event are fully annunciated) and enter the appropriate OFN-BB-31 steps. The remaining 60 minutes are allocated to start one of the three injection methods. sixty minutes is sufficient time to perform injection.

Page 33

Relevant Performance Shaping Factors Only those PSF which are or might be impacted are discussed here other PSFs remain at their nominal value.

o Complexity:

o Cues for diagnosis are very clear and unambiguous, obvious diagnosis.

Define Subtasks / failure modes / assign BE id(s) o Subtasks:

o Failure modes:

o MCR operator fails to direct the equipment operator to manipulate the correct valves or pump.

o MCR operator fails to manipulate the correct valves or pump in the appropriate manner.

o BE Id: SD-SLOI-FEED-LT-XHE B4 HFE ID: SD-SLOI-ISOL-AFD-XHE HFE Definition This HFE represents the failure of the operator to isolate the LOI. This is after the operator has succeeded in initiating feed into the RCS at a rate that prevents further decrease in RCS level.

Description and Context Associated with Event Previous to this HFE, the operator has correctly diagnosed the LOI, and initiated makeup to the RCS at a rate greater than the rate of loss. The operator must work through the correct procedure (OFN-BB-31) and perform the appropriate steps to isolate.

Operator Action Success Criteria Identify and isolate the LOI. Because feed to the RCS has already been accomplished, this action needs to be completed before the RWST is depleted.

Cues The major portion of the diagnoses and therefore, the associated cues are addressed in the previously occurring HFE (SD-SLOI-DIAG-XHE). However, the following cues are present:

o Decreasing RWST level Procedure and Relevant Steps OFN-BB-31 "Shutdown LOCA" Page 34

MCR or Local Action All actions occur in the main control room.

Diagnosis (with or w/o recovery) / Execution (with or w/o recovery) / Diagnosis +

Execution Action without recovery Time Windows / Nominal / mean /median actions times Because feed to the RCS has already been accomplished, this action needs to be completed before the RWST is depleted. On average there are approximately 360,000 gallons of water in the RWST of which 316800 are useable. At an assumed injection rate of 200 gpm, the RWST would last approximately 25 hours2.893519e-4 days <br />0.00694 hours <br />4.133598e-5 weeks <br />9.5125e-6 months <br /> before it will be depleted.

Relevant Performance Shaping Factors Only those PSF which are or might be impacted are discussed here other PSFs remain at their nominal value.

o Time: Expanded time is available Define Subtasks / failure modes / assign BE id(s) o Isolate LOI.

o Failure modes:

o MCR operator fails to direct the equipment operator to manipulate the correct valves or pump.

o Equipment operator fails to manipulate the correct valves or pump in the appropriate manner.

o BE Id: SD-SLOI-ISOL-AFD-XHE B5 HFE ID: SD-SLOI-ISOL-BRF-XHE HFE Definition This HFE represents the failure of the operator to isolate the LOI before RCS water level reaches the midloop. This is after the operator has failed to initiate feed into the RCS at a rate that prevents further decrease in RCS level.

Description and Context Associated with Event Previous to this HFE, the operator has correctly diagnosed the LOI, and but has failed to initiated makeup to the RCS at a rate greater than the rate of loss. The operator Page 35

must work through the correct procedure (OFN-BB-31) and perform the appropriate steps to isolate RCS.

Operator Action Success Criteria Isolate LOI before level drops to midloop conditions and the running LPI/SDC pumps need to be secured due to cavitation.

Cues The major portion of the diagnoses and therefore, the associated cues are addressed in the previously occurring HFE (SD-SLOI-DIAG-XHE). However, the following cues are present:

o Decreasing RCS level Procedure and Relevant Steps OFN-BB-31 Shutdown LOCA supplies guidance to the operators.

MCR or Local Action Actions will be in the MCR but isolating the LOI may be a local action.

Diagnosis (with or w/o recovery) / Execution (with or w/o recovery) / Diagnosis +

Execution Action without recovery Time Windows / Nominal / mean /median actions times Because the operator has failed to initially to feed the RCS level continues to decrease. This action must be completed prior to level reaching midloop at which point LPI/SDC will need to be secured. Shortly after reaching a level of 0, the running DHR pumps will need to be secured to prevent damage to them. Thus the time available for diagnosis and subsequent operator actions is approximately 90 minutes.

The previous diagnosis, however, is handled by HFE SD-SLOI-DIAG-XHE.

A portion of the 90 minutes must be allocated to the event diagnosis HFE. The remaining time is left to perform this HFE. For HFE SD-SLOI-DIAG-XHE 30 minutes of the total was allocated for diagnosis this leaves the remaining 60 minutes to perform this action.

Relevant Performance Shaping Factors Only those PSF which are or might be impacted are discussed here other PSFs remain at their nominal value.

o Stress: With a LOI event occurring stress was elevated.

Page 36

Define Subtasks / failure modes / assign BE id(s) o Failure modes:

o MCR operator fails to direct the equipment operator to manipulate the correct valves or pump.

o Equipment operator fails to manipulate the correct valves or pump in the appropriate manner.

o BE Id: SD-SLOI-ISOL-BRF-XHE B6 HFE ID: SD-SLOI-LTR1-XHE (RWST Makeup)

HFE Definition This HFE represents the failure to makeup to the RWST. Operators have succeeded in initiating feed into the RCS in excess of the leakage rate from the LOI but have not been successful in terminating the leak. If the leak is not terminated, the RWST will eventually be depleted. Therefore, makeup to the RWST is required.

Description and Context Associated with Event Prior to this action, the operators have successfully diagnosed the original LOI, they have succeeded in establishing flow into the RCS in excess of the inventory being lost through the leak, and thus SDC remains in service. However, they have not been successful in isolating the leak. Because of the relative low required injection rate, and the high inventory in the RWST a significant amount of time is available to perform this action.

Operator Action Success Criteria Makeup to the RWST before it is depleted at a rate greater than the rate which water is being feed into the RCS Cues o Decreasing level in the RWST o Indicated level of 6% in RWST Procedure and Relevant Steps OFN-EJ-40 CL RECIRC during Mode 3, With Accumulators Isolated, and Mode 4, 5 or 6 directs the operators to perform recirculation but does not provide guidance to refill the RWST.

MCR or Local Action It is anticipated that most actions are local.

Page 37

Diagnosis (with or w/o recovery) / Execution (with or w/o recovery) / Diagnosis +

Execution Diagnosis and action without recovery Time Windows / Nominal / mean /median actions times RWST will be depleted in approximately 25 hours2.893519e-4 days <br />0.00694 hours <br />4.133598e-5 weeks <br />9.5125e-6 months <br /> after injection is initiated.

Relevant Performance Shaping Factors Only those PSF which are or might be impacted are discussed here other PSFs remain at their nominal value.

o Complexity: Moderately complex Define Subtasks / failure modes / assign BE id(s) o Subtasks:

o Failure modes: MCR operator fails to direct the equipment operator to manipulate the correct valves or pump.

o Equipment operator fails to manipulate the correct valves or pump in the appropriate manner.

o BE Id: SD-SLOI-LTR1-XHE B7 HFE ID: SD-SLOI-LTR2-XHE (Restart LPI/SDC)

HFE Definition This HFE represents failure to restore LPI in SDC mode of operations. Operators initially were not successful in initiating feed into the RCS but have recovered and subsequently started feed in excess of the leakage rate from the LOI. However, they have not been successful in terminating the leak. LPI/SDC is not running but RCS level has been raised above the minimum level required for LPI/SDC operation. This action restarts LPI/SDC.

Description and Context Associated with Event Prior to this action, the operators have successfully diagnosed the original LOI; they have succeeded in recovering RCS level after an initial failure. However, they have not been successful in isolating the leak. SDC is not in-service. Because of the relative low required injection rate, and the high inventory in the RWST a significant amount of time is available to perform this action.

Operator Action Success Criteria Operators restore SDC to operation.

Page 38

Cues o Knowledge that the running LPI/SDC pumps had been secured due to low RCS level and cavitation.

Procedure and Relevant Steps OFN-BB-31 supplies guidance on realigning LPI for SDC mode.

MCR or Local Action Actions are a combination of MCR and local.

Diagnosis (with or w/o recovery) / Execution (with or w/o recovery) / Diagnosis +

Execution Action without recovery Time Windows / Nominal / mean /median actions times As RCS makeup in excess of the loss rate has been established, a long time is available to restore LPI/SDC. It is assumed that at least 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> are available.

Relevant Performance Shaping Factors Only those PSF which are or might be impacted are discussed here other PSFs remain at their nominal value.

o Complexity: complex but routinely performed Define Subtasks / failure modes / assign BE id(s) o Subtasks: Unknown o Failure modes: MCR operator fails to direct the equipment operator to manipulate the correct valves or pump.

o Equipment operator fails to manipulate the correct valves or pump in the appropriate manner.

o BE Id: SD-SLOI-LTR2-XHE B8 HFE ID: M3-DHC-REC-LATE (RWST Makeup RCS<1000psig)

HFE Definition This HFE represents the failure to makeup to the RWST. Operators have succeeded in initiating feed into the RCS in excess of the leakage or boil-off rate of the RCS but are not able to terminate the leak. Injection is supplied by either high pressure injection or the charging system. However, the RWST will eventually be depleted.

Therefore, makeup to the RWST is required.

Page 39

Description and Context Associated with Event Prior to this action, the operators have successfully diagnosed the LOCA they have succeeded in establishing flow into the RCS. However, they cannot isolate the leak.

Because of the relative low required injection rate, and the high inventory in the RWST a significant amount of time is available to perform this action.

Operator Action Success Criteria Makeup to the RWST before it is depleted at a rate greater than the rate which water is being feed into the RCS Cues o Decreasing level in the RWST o RWST low level alarm(s)

Procedure and Relevant Steps OFN-EJ-40 CL RECIRC During Mode 3, With Accumulators Isolated, Mode 4, 5 OR 6 directs the operators to perform recirculation but does not provide guidance to refill the RWST.

MCR or Local Action Most actions are local.

Diagnosis (with or w/o recovery) / Execution (with or w/o recovery) / Diagnosis +

Execution Diagnosis and action without recovery Time Windows / Nominal / mean /median actions times RWST will be depleted in approximately 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> after injection is initiated.

Relevant Performance Shaping Factors Only those PSF which are or might be impacted are discussed here other PSFs remain at their nominal value.

o Timing: Extra time, operators have 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> to diagnose issue and begin makeup o Stress: With a LOCA event occurring stress will be elevated o Complexity: Moderately complex to perform but Obvious Diagnosis o Procedures: Incomplete, procedures are infrequently used and must be adapted to this condition o

Page 40

Define Subtasks / failure modes / assign BE id(s) o Subtasks:

o Failure modes: MCR operator fails to direct the equipment operator to manipulate the correct valves or pump.

o Equipment operator fails to manipulate the correct valves or pump in the appropriate manner.

o BE Id: M3-DHC-REC-LATE B9 HFE ID: M3-DHC-REC-LATE (RWST Makeup RCS>1000psig)

HFE Definition This HFE represents the failure to makeup to the RWST. Operators have succeeded in initiating feed into the RCS in excess of the leakage or boil-off rate of the RCS but are not able to terminate the leak. Injection is supplied by either high pressure injection or the charging system. However, the RWST will eventually be depleted.

Therefore, makeup to the RWST is required.

Description and Context Associated with Event Prior to this action, the operators have successfully diagnosed the LOCA they have succeeded in establishing flow into the RCS. However, they cannot isolate the leak.

Because of the relative low required injection rate, and the high inventory in the RWST a significant amount of time is available to perform this action.

Operator Action Success Criteria Makeup to the RWST before it is depleted at a rate greater than the rate which water is being feed into the RCS Cues o Decreasing level in the RWST o RWST low level alarm(s)

Procedure and Relevant Steps EMG C-11 Loss of Emergency Coolant Recirculation directs the operators to refill the RWST. Step 3 directs the operators to check level and begin makeup to the RWST.

MCR or Local Action It is anticipated that most actions are local.

Diagnosis (with or w/o recovery) / Execution (with or w/o recovery) / Diagnosis +

Execution Diagnosis and action without recovery Page 41

Time Windows / Nominal / mean /median actions times RWST will be depleted in approximately 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> after injection is initiated.

Relevant Performance Shaping Factors Only those PSF which are or might be impacted are discussed here other PSFs remain at their nominal value.

o Timing: Extra time, operators have 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> to diagnose issue and begin makeup o Stress: With a LOCA event occurring stress will be elevated o Complexity: Moderately complex to perform but Obvious Diagnosis Define Subtasks / failure modes / assign BE id(s) o Subtasks:

o Failure modes: MCR operator fails to direct the equipment operator to manipulate the correct valves or pump.

o Equipment operator fails to manipulate the correct valves or pump in the appropriate manner.

o BE Id: M3a-DHC-REC-LATE Page 42

Table B1 HRA Worksheets for LPSD SPAR HUMAN ERROR WORKSHEET Plant: Oconee Initiating Event: Basic Event: SD-SLOI-DIAG-XHE Basic Event

Description:

Operator fails to Diagnose Loss of Inventory before loss of DHR Part I. DIAGNOSIS WORKSHEET PSFs PSF Levels Multiplier for Selected Please note specific reasons for Diagnosis PSF PSF level selection in this column.

Available Time Inadequate time P(failure) = 1.0 Barely adequate time (? 2/3 Nominal) 10 Nominal time 1 X Extra time (between 1 and 2 x nominal and > than 30 min) 0.1 Expansive time (> 2 x nominal and > 30 min) 0.01 Insufficient information 1 Stress Extreme 5 High 2 Nominal 1 X Insufficient information 1 Complexity Highly 5 Moderately Complex 2 Nominal 1 Diagnoses requires monitoring simple Obvious diagnosis 0.1 X display. Site is ramping up in power Insufficient information 1 activities minimal during this period.

Experience/ Low 10 Training Nominal 1 X High 0.5 Insufficient information 1 Procedures Not available 50 Incomplete 1 Available, but poor 5 Nominal 1 X Diagnostic/symptom oriented 0.5 Insufficient information 1 Ergonomics/HMMissing/Misleading 50 Poor 10 Nominal 1 X Good 0.5 Insufficient information 1 Fitness for Duty Unfit P(failure) = 1.0 Degraded Fitness 5 Nominal 1 X Insufficient information 1 Work Processes Poor 2 Nominal 1 X Good 0.8 Insufficient information 1 NHEP = 1.00E-3 Negative NA PSFs adjustment

( >3 Diagnosis Final 1.00E-03 HEP Page 43

Table B2a HRA Worksheets for LPSD SPAR HUMAN ERROR WORKSHEET Plant: Wolf Creek Initiation of Feed during SD Basic Event: SD-SLOI-FEED-XHE Basic Event

Description:

Operator Fails to Initiate Feed during Shutdow n before loss of LPI/DHR Part I. DIAGNOSIS WORKSHEET PSFs PSF Levels Multiplier for Selected Please note specific reasons for Diagnosis PSF PSF level selection in this column.

Available Inadequate time P(failure) = 1.0 Time Barely adequate time (? 2/3 N ominal) 10 Nominal time 1 X Extra time (between 1 and 2 x nominal and > than 30 min) 0.1 Expansive time (> 2 x nominal and > 30 min) 0.01 Insufficient information 1 Stress Extreme 5 LOI caused elevated stress.

High 2 X Nominal 1 Insufficient information 1 Complexity Highly 5 Additional ques result in obvious Moderately Complex 2 diagnosis.

Nominal 1 Obvious diagnosis 0.1 X Insufficient information 1 Experience/ Low 10 Training Nominal 1 X High 0.5 Insufficient information 1 Procedures Not available 50 Incomplete 20 Available, but poor 5 Nominal 1 X Diagnostic/symptom oriented 0.5 Insufficient information 1 Ergonomics/ Missing/Misleading 50 HMI Poor 10 Nominal 1 X Good 0.5 Insufficient information 1 Fitness for Unfit P(failure) = 1.0 Duty Degraded Fitness 5 Nominal 1 X Insufficient information 1 Work ProcessesPoor 2 Nominal 1 X Good 0.8 Insufficient information 1 NHEP = 2.00E-3 Negative NA PSFs adjustment

( >3 Diagnosis Final 2.00E-03 HEP Page 44

Table B2b HRA Worksheets for LPSD SPAR HUMAN ERROR WORKSHEET Plant: Wolf Creek Initiation of Feed during SD Basic Event: SD-SLOI-FEED-XHE Basic Event

Description:

Operator Fails to Initiate Fee d during Shutdow n before loss of LPI/DHR Part II. ACTION WORKSHEET PSFs PSF Levels Multiplier for Selected PSF Please note specific reasons for Action PSF level selection in this column.

Available Time Inadequate time P(failure) = 1.0 Time Available is ? the time required 10 Nominal time 1 X Time available is ? 5x the time required 0.1 Time available is ? 50x the time required 0.01 Insufficient information 1 Stress Extreme 5 LOI caused elevated stress.

High 2 X Nominal 1 Insufficient information 1 Complexity Highly 5 Moderately 2 Nominal 1 X Insufficient information 1 Experience/ Low 3 Training Nominal 1 X High 0.5 Insufficient information 1 Procedures Not available 50 Incomplete 20 Available but poor 5 Nominal 1 X Insufficient information 1 Ergonomics/ Missing/Misleading 50 HMI Poor 10 Nominal 1 X Good 0.5 Insufficient information 1 Fitness for Duty Unfit P(failure) = 1.0 Degraded Fitness 5 Nominal 1 X Insufficient information 1 Work Processes Poor 5 Nominal 1 X Good 0.5 Insufficient information 1 NHEP = 2.00E-3 Negative NA PSFs adjustment

( >3 negative Final Action HEP 2.00E-03 Page 45

Table B2c HRA Worksheets for LPSD Plant: Wolf Creek Initiation of Feed during SD Basic Event: SD-SLOI-FEED-XHE Part III - CALCULATE TASK FAILURE PROBABILITY WITHOUT FORMAL DEPENDENCY Diagnosis

+ Action HEP = Pw/od HEP 2.00E-03 + 2.00E-03 = 4.00E-03 Page 46

Table 3a HRA Worksheets for LPSD SPAR HUMAN ERROR WORKSHEET Plant: Wolf Creek Initiation of Feed during SD Basic Event: SD-SLOI-FEED-LT-XHE Basic Event

Description:

Operator Fails to Initiate Fee d during Shutdown before core damage after SDC failure Part I. DIAGNOSIS WORKSHEET PSFs PSF Levels Multiplier for Selected PSF Please note specific reasons for PSF level Diagnosis selection in this column.

Available Time Inadequate time P(failure) = 1.0 Barely adequate time (? 2/3 Nominal) 10 Nominal time 1 X Extra time (between 1 and 2 x nominal and > than 30 min) 0.1 Expansive time (> 2 x nominal and > 30 min) 0.01 Insufficient information 1 Stress Extreme 5 LOI caused elevated stress.

High 2 X Nominal 1 Insufficient information 1 Complexity Highly 5 M oderately Complex 2 Nominal 1 Obvious diagnosis 0.1 X Insufficient information 1 Experience/ Low 10 Training Nominal 1 X High 0.5 Insufficient information 1 Procedures Not available 50 Incomplete 20 Available, but poor 5 Nominal 1 X Diagnostic/symptom oriented 0.5 Insufficient information 1 Ergonomics/ M issing/Misleading 50 HMI Poor 10 Nominal 1 X Good 0.5 Insufficient information 1 Fitness for Duty Unfit P(failure) = 1.0 Degraded Fitness 5 Nominal 1 X Insufficient information 1 Work Processes Poor 2 Nominal 1 X Good 0.8 Insufficient information 1 NHEP = 2.00E-3 Negative NA PSFs adjustment

( >3 Diagnosis Final negative 2.00E-03 HEP Page 47

Table 3b HRA Worksheets for LPSD SPAR HUMAN ERROR WORKSHEET Plant: Wolf Creek Initiation of Feed during SD Basic Event: SD-SLOI-FEED-LT-XHE Basic Event

Description:

Operator Fails to Initiate Feed during Shutdown before core damage after SDC failure Part II. ACTION WORKSHEET PSFs PSF Levels Multiplier for Selected PSF Please note specific reasons for PSF level Action selection in this column.

Available Time Inadequate time P(failure) = 1.0 Time Available is ? the time required 10 Nominal time 1 X Time available is ? 5x the time required 0.1 Time available is ? 50x the time required 0.01 Insufficient information 1 Stress Extreme 5 High 2 Nominal 1 X Insufficient information 1 Complexity Highly 5 Moderately 2 Nominal 1 X Insufficient information 1 Experience/ Low 3 Training Nominal 1 X High 0.5 Insufficient information 1 Procedures Not available 50 Incomplete 20 Available but poor 5 Nominal 1 X Insufficient information 1 Ergonomics/ Missing/Misleading 50 HMI Poor 10 Nominal 1 X Good 0.5 Insufficient information 1 Fitness for Unfit P(failure) = 1.0 Duty Degraded Fitness 5 Nominal 1 X Insufficient information 1 Work Processes Poor 5 Nominal 1 X Good 0.5 Insufficient information 1 NHEP = 1.00E-3 Negative NA PSFs adjustment

( >3 negative Final Action HEP 1.00E-03 Page 48

Table 3c HRA Worksheets for LPSD Plant: Wolf Creek Initiation of Feed during SD Basic Event: SD-SLOI-FEED-LT-XHE Part III - CALCULATE TASK FAILURE PROBABILITY WITHOUT FORMAL DEPENDENCY Diagnosis Action

+ = Pw/od HEP HEP 2.00E-03 + 1.00E-03 = 3.00E-03 Page 49

Table 4a HRA Worksheets for LPSD SPAR HUMAN ERROR WORKSHEET Plant: Wolf C reek Initiating Event: Basic Event: SD-SLOI-ISOL-AFD-XHE Basic Event

Description:

Operator fails to Isolate Loss of Inventory before core damage Part II. ACTION WORKSHEET PSFs PSF Levels Multiplier for Selected PSF Please note specific reasons for PSF Action level selection in this column.

Available Time Inadequate time P(failure) = 1.0 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br /> is availalble to perform this Time Available is ? the time required 10 function. Takes about 15 minutes to Nominal time 1 perform.

Time available is ? 5x the time required 0.1 Time available is ? 50x the time required 0.01 X Insufficient information 1 Stress Extreme 5 High 2 Nominal 1 X Insufficient information 1 Complexity Highly 5 Moderately 2 Nominal 1 X Insufficient information 1 Experience/ Low 3 Training Nominal 1 X High 0.5 Insufficient information 1 Procedures Not available 50 This is simple task.

Incomplete 20 Available but poor 5 Nominal 1 X Insufficient information 1 Ergonomics/ Missing/Misleading 50 HMI Poor 10 Nominal 1 X Good 0.5 Insufficient information 1 Fitness for Unfit P(failure) = 1.0 Duty Degrade d Fitness 5 Nominal 1 X Insufficient information 1 Work Poor 5 Processes Nominal 1 X Good 0.5 Insufficient information 1 NHEP = 1.00E-5 Negative NA PSFs adjustment

( >3 Final Action 1.00E-05 HEP Page 50

Table 5a HRA Worksheets for LPSD SPAR HUMAN ERROR WORKSHEET Plant: Wolf Creek Initiating Event: Basic Event: SD-SLOI-ISOL-BRF-XHE Basic Event

Description:

Operator fails to Isolate Loss of Inventory before Loss of LPI/SDC Part II. ACTION WORKSHEET PSFs PSF Levels Multiplier for Selected PSF Please note specific reasons for PSF Action level selection in this column.

Available Time Inadequate time P(failure) = 1.0 40 minutes is availalble to perform this T ime Available is ? the time required 10 function. Takes about 15 minutes to Nominal time 1 X perform.

T ime available is ? 5x the time required 0.1 T ime available is ? 50x the time required 0.01 Insufficient information 1 Stress Extreme 5 LOI caused elevated stress.

High 2 X Nominal 1 Insufficient information 1 Complexity Highly 5 M oderately 2 Nominal 1 X Insufficient information 1 Experience/ Low 3 Training Nominal 1 X High 0.5 Insufficient information 1 Procedures Not available 50 This is simple task.

Incomplete 20 Available but poor 5 Nominal 1 X Insufficient information 1 Ergonomics /HMI M issing/Misleading 50 Poor 10 Nominal 1 X Good 0.5 Insufficient information 1 Fitness for Duty Unfit P(failure) = 1.0 Degraded Fitness 5 Nominal 1 X Insufficient information 1 Work Processes Poor 5 Nominal 1 X Good 0.5 Insufficient information 1 NHEP = 2.00E-3 Negative NA PSFs adjustment

( >3 negative Final Action HEP 2.00E-03 Page 51

Table 6a HRA Worksheets for LPSD SPAR HUMAN ERROR WORKSHEET Plant: Wolf C reek Initiating Event: Basic Event: SD-SLOI-ISOL-BRF-XHE Basic Event

Description:

Operator fails to Isolate Loss of Inventory before Loss of LPI/SDC Part I. DIAGNOSIS WORKSHEET PSFs PSF Levels Multiplier for Diagnosis Selected Please note specific PSF reasons for PSF level selection in this column.

Available Time Inadequate time P(failure) = 1.0 Barely adequate time (? 2/3 N ominal) 10 Nominal time 1 X Extra time (between 1 and 2 x nominal and > than 30 min) 0.1 Expansive time (> 2 x nominal and > 30 min) 0.01 Insufficient information 1 Stress Extreme 5 High 2 Nominal 1 X Insufficient information 1 Complexity Highly 5 Moderately Complex 2 Nominal 1 X Obvious diagnosis 0.1 Insufficient information 1 Experience/Training Low 10 Nominal 1 X High 0.5 Insufficient information 1 Procedures Not available 50 Incomplete 20 Available, but poor 5 Nominal 1 X Diagnostic/symptom oriented 0.5 Insufficient information 1 Ergonomics/HMI Missing/Misleading 50 Poor 10 Nominal 1 X Good 0.5 Insufficient information 1 Fitness for Duty Unfit P(failure) = 1.0 Degraded Fitness 5 Nominal 1 X Insufficient information 1 Work Processes Poor 2 Nominal 1 X Good 0.8 Insufficient information 1 NHEP = 1.00E-2 Negative PSFs NA adjustment ( >3 negative PSFs)

Final Diagnosis HEP 1.00E-02 Page 52

Table 6b HRA Worksheets for LPSD SPAR HUMAN ERROR WORKSHEET Plant: Wolf Creek Initiating Event: Basic Event: SD-SLOI-ISOL-BRF-XHE Basic Event

Description:

Operator fails to Isolate Loss of Inventory before Loss of LPI/SDC Part II. ACTION WORKSHEET PSFs PSF Levels Multiplier for Selected PSF Please note specific reasons for PSF Action level selection in this column.

Available Time Inadequate time P(failure) = 1.0 40 minutes is availalble to perform this T ime Available is ? the time required 10 function. Takes about 15 minutes to Nominal time 1 X perform.

T ime available is ? 5x the time required 0.1 T ime available is ? 50x the time required 0.01 Insufficient information 1 Stress Extreme 5 LOI caused elevated stress.

High 2 X Nominal 1 Insufficient information 1 Complexity Highly 5 M oderately 2 Nominal 1 X Insufficient information 1 Experience/ Low 3 Training Nominal 1 X High 0.5 Insufficient information 1 Procedures Not available 50 This is simple task.

Incomplete 20 Available but poor 5 Nominal 1 X Insufficient information 1 Ergonomics /HMI M issing/Misleading 50 Poor 10 Nominal 1 X Good 0.5 Insufficient information 1 Fitness for Duty Unfit P(failure) = 1.0 Degraded Fitness 5 Nominal 1 X Insufficient information 1 Work Processes Poor 5 Nominal 1 X Good 0.5 Insufficient information 1 NHEP = 2.00E-3 Negative NA PSFs adjustment

( >3 negative Final Action HEP 2.00E-03 Page 53

Table 6c HRA Worksheets for LPSD Plant: Wolf Creek Initiating Event: Basic Event: SD-SLOI-ISOL-BRF-XHE Basic Event

Description:

Operator fails to Isolate Loss of Inventory before Loss of LPI/SDC Part III - CALCULATE TASK FAILURE PROBABILITY WITHOUT FORMAL DEPENDENCY Diagnosis

+ Action HEP = Pw/od HEP 1.00E-02 + 2.00E-03 = 1.20E-02 Page 54

Table 7a HRA Worksheets for LPSD SPAR HUMAN ERROR WORKSHEET Plant: Wolf Creek Initiating Event: Basic Event: SD-SLOI-LTR2-XHE Basic Event

Description:

Operator fails to recover LPI in SDC mode.

Part II. ACTION WORKSHEET PSFs PSF Levels Multiplier for Selected PSF Please note specific reasons for Action PSF level selection in this column.

Available Time Inadequate time P(failure) = 1.0 Time Available is ? the time required 10 Nominal time 1 X Time available is ? 5x the time required 0.1 Time available is ? 50x the time required 0.01 Insufficient information 1 Stress Extreme 5 High 2 Nominal 1 X Insufficient information 1 Complexity Highly 5 This task is complex.

Moderately 2 X Nominal 1 Insufficient information 1 Experience/ Low 3 Training Nominal 1 X High 0.5 Insufficient information 1 Procedures Not available 50 Incomplete 20 Available but poor 5 Nominal 1 X Insufficient information 1 Ergonomics/ Missing/Mislea ding 50 HMI Poor 10 Nominal 1 X Good 0.5 Insufficient information 1 Fitness for Duty Unfit P(failure) = 1.0 Degraded Fitne ss 5 Nominal 1 X Insufficient information 1 Work Processes Poor 5 Nominal 1 X Good 0.5 Insufficient information 1 NHEP = 2.00E-3 Negative NA PSFs adjustment

( >3 negative Final Action HEP 2.00E-03 Page 55

Table 8a Mode 3 RCS<1000psig HRA Worksheets for LPSD SPAR HUMAN ERROR WORKSHEET Plant: Wolf Creek Initiating Event: Basic Event: M3-DHR-REC-LATE Basic Event

Description:

Operator fails to Diagnose Loss of Inventory before loss of DHR Part I. DIAGNOSIS WORKSHEET PSFs PSF Levels Multiplier for Selected Please note specific reasons for Diagnosis PSF PSF level selection in this column.

Available Time Inadequate time P(failure) = 1.0 Operators will have extra time to Barely adequate time (? 2/3 Nominal) 10 evaluate plant conditions and determine Nominal time 1 appropriated success path.

Extra time (between 1 and 2 x nominal and > than 30 min) 0.1 X Expansive time (> 2 x nominal and > 30 min) 0.01 Insufficient information 1 Stress Extreme 5 Operators will be under high stress High 2 X conditions.

Nominal 1 Insufficient information 1 Complexity Highly 5 Moderately Complex 2 Nominal 1 X Obvious diagnosis 0.1 Insufficient information 1 Experience/ Low 10 Training Nominal 1 X High 0.5 Insufficient information 1 Procedures Not available 50 X Procedures have no guidance to refill the Available, but poor 5 RWST .

Nominal 1 Diagnostic/symptom oriented 0.5 Insufficient information 1 Ergonomics/HMMissing/Misleading 50 Poor 10 Nominal 1 X Good 0.5 Insufficient information 1 Fitness for Duty Unfit P(failure) = 1.0 Degraded Fitness 5 Nominal 1 X Insufficient information 1 Work Processes Poor 2 Nominal 1 X Good 0.8 Insufficient information 1 NHEP = 1.00E-1 Negative NA PSFs adjustment (Final

>3 Diagnosis 1.00E-01 HEP Page 56

Table 8b Mode 3 RCS<1000psig HRA Worksheets for LPSD SPAR HUMAN ERROR WORKSHEET Plant: Wolf Creek Initiating Event: Basic Event: M3-DHR-REC-LATE Basic Event

Description:

Operator fails to Diagnose Loss of Inventory before loss of DHR Part II. ACTION WORKSHEET PSFs PSF Levels Multiplier for Action Selected PSF Please note specific reasons for PSF level selection in this column.

Available Time Inadequate time P(failure) = 1.0 Operators have approximately 5 Time Available is ? the time required 10 hours before RWST is depleted Nominal time 1 at the auto-swa pover setpoint and Time available is ? 5x the time required 0.1 X additional time before time to Time available is ? 50x the time required 0.01 boil and core damage.

Insufficient information 1 Stress Extreme 5 Operators will be under high High 2 X stress conditions.

Nominal 1 Insufficient information 1 Complexity Highly 5 May require to interpret other Moderately 2 X procedures and apply them to this Nominal 1 condition.

Insufficient information 1 Experience/Training Low 3 Nominal 1 X High 0.5 Insufficient information 1 Procedures Not available 50 Incomplete 20 Available but poor 5 Nominal 1 X Insufficient information 1 Ergonomics/HMI Missing/Misleading 50 Poor 10 Nominal 1 X Good 0.5 Insufficient information 1 Fitness for Duty Unfit P(failure) = 1.0 Degraded Fitness 5 Nominal 1 X Insufficient information 1 Work Processes Poor 5 Nominal 1 X Good 0.5 Insufficient information 1 NHEP = 4.00E-4 Negative PSFs NA adjustment ( >3 negative PSFs)

Final Action HEP 4.00E-04 Page 57

Table 8c Mode 3 RCS<1000psig HRA Worksheets for LPSD Plant: Wolf Creek Initiating Event: Basic Event: M3-DHR-REC-LATE Basic Event

Description:

Operator fails to Diagnose Loss of Inventory before loss of DHR Part III - CALCULATE TASK FAILURE PROBABILITY WITHOUT FORMAL DEPENDENCY Diagnosis

+ Action HEP = Pw/od HEP 1.00E-01 + 4.00E-04 = 1.00E-01 Page 58

Table 9a Mode 3 RCS>1000psig HRA Worksheets for LPSD SPAR HUMAN ERROR WORKSHEET Plant: Wolf Creek Initiating Event: Basic Event: M3a-DHR-REC-LATE Basic Event

Description:

Operator fails to Diagnose Loss of Inventory before loss of DHR Part I. DIAGNOSIS WORKSHEET PSFs PSF Levels Multiplier for Selected Please note specific reasons for Diagnosis PSF PSF level selection in this column.

Available Time Inadequate time P(failure) = 1.0 Operators will have extra time to Barely adequate time (? 2/3 Nominal) 10 evaluate plant conditions and determine Nominal time 1 appropriated success path.

Extra time (between 1 and 2 x nominal and > than 30 min) 0.1 X Expansive time (> 2 x nominal and > 30 min) 0.01 Insufficient information 1 Stress Extreme 5 Operators will be under high stress High 2 X conditions.

Nominal 1 Insufficient information 1 Complexity Highly 5 Moderately Complex 2 Nominal 1 X Obvious diagnosis 0.1 Insufficient information 1 Experience/ Low 10 Training Nominal 1 X High 0.5 Insufficient information 1 Procedures Not available 50 Available, but poor 5 x Nominal 1 Diagnostic/symptom oriented 0.5 Insufficient information 1 Ergonomics/HMMissing/Misleading 50 Poor 10 Nominal 1 X Good 0.5 Insufficient information 1 Fitness for Duty Unfit P(failure) = 1.0 Degraded Fitness 5 Nominal 1 X Insufficient information 1 Work Processes Poor 2 Nominal 1 X Good 0.8 Insufficient information 1 NHEP = 1.00E-2 Negative NA PSFs adjustment (Final

>3 Diagnosis 1.00E-02 HEP Page 59

Table 9b Mode 3 RCS>1000psig HRA Worksheets for LPSD SPAR HUMAN ERROR WORKSHEET Plant: Wolf Creek Initiating Event: Basic Event: M3a-DHR-REC-LATE Basic Event

Description:

Operator fails to Diagnose Loss of Inventory before loss of DHR Part II. ACTION WORKSHEET PSFs PSF Levels Multiplier for Action Selected PSF Please note specific reasons for PSF level selection in this column.

Available Time Inadequate time P(failure) = 1.0 Operators have approximately 5 Time Available is ? the time required 10 hours before RWST is depleted Nominal time 1 at the auto-swa pover setpoint and Time available is ? 5x the time required 0.1 X additional time before time to Time available is ? 50x the time required 0.01 boil and core damage.

Insufficient information 1 Stress Extreme 5 Operators will be under high High 2 X stress conditions.

Nominal 1 Insufficient information 1 Complexity Highly 5 May require to interpret other Moderately 2 X procedures and apply them to this Nominal 1 condition.

Insufficient information 1 Experience/Training Low 3 Nominal 1 X High 0.5 Insufficient information 1 Procedures Not available 50 Incomplete 20 Available but poor 5 Nominal 1 X Insufficient information 1 Ergonomics/HMI Missing/Misleading 50 Poor 10 Nominal 1 X Good 0.5 Insufficient information 1 Fitness for Duty Unfit P(failure) = 1.0 Degraded Fitness 5 Nominal 1 X Insufficient information 1 Work Processes Poor 5 Nominal 1 X Good 0.5 Insufficient information 1 NHEP = 4.00E-4 Negative PSFs NA adjustment ( >3 negative PSFs)

Final Action HEP 4.00E-04 Page 60

Table 9c Mode 3 RCS>1000psig HRA Worksheets for LPSD Plant: Wolf Creek Initiating Event: Basic Event: M3a-DHR-REC-LATE Basic Event

Description:

Operator fails to Diagnose Loss of Inventory before loss of DHR Part III - CALCULATE TASK FAILURE PROBABILITY WITHOUT FORMAL DEPENDENCY Diagnosis

+ Action HEP = Pw/od HEP 1.00E-02 + 4.00E-04 = 1.04E-02 Page 61

Analysis of Dependency between HEP The initial dependency between multiple operator actions was also performed using NUREG/CR-6883. The approach used to resolve these dependencies follows the method proscribed in the SPAR-H guidance. The analyst deviated from the SPAR-H methodology when events that contained intervening successes between failed human actions were encountered. Under these situations zero dependency was assigned. The results are summarized in Table 2 above and follow the dependency model used in the SPAR-H method.

The 2003 version of the ASME PRA Standard requires that the total combined probability of all the HEPs in the same accident sequence or cutset should not be less than a justified value. The 2005 version of this standard removes this requirement. However, NUREG-1792, Good Practices for Implementing Human Reliability Analysis, Section 5.3.3.6, recommends a minimum cutoff value of 1E-5. As a starting point the analyst used this value. Because the final results are dominated by a single sequence involving a value above the cutoff, applying a cutoff will not materially impact the results. Therefore no further cutoff analysis were applied to this SDP at this time.

The equations that were used to calculate the dependency were as following:

• Complete Dependence the probability of failure = 1.0

• High Dependence the probability of failure = (1 + P)/2

• Moderate Dependence the probability of failure = (1 +6P)/7

• Low Dependence the probability of failure = (1 + 19P)/20 SAPHIRE rules were then created to search for the cutset results for the various combinations of HEPs and the cutsets were modified appropriately.

Tables B8 to B14 contains the dependency event trees for these dependent HEPs as determined by the SPAR-H methodology. However, as discussed above, where deemed appropriate, the analyst deviated from the SPAR-H rules and imposed a lower value for the dependencies. This is discussed in the individual dependency analysis below.

B8 SD-SLOI-FEED-LT-XHE-D1 This modified HEP accounts for the dependence between the diagnoses of the initial event and the subsequent action to perform injection once level reaches the midloop level requiring the shutdown of the running LPI/SDC pumps. The dependency analysis is shown in Table B8. Both actions are performed by the same crew; however, they are separated by approximately 70 minutes. The actions are performed on different panels in the main control room (MCR). Additional cues are received when midloop level is reached as the running SDC pumps begin to cavitate. There are no intervening successes. The SPAR-H methodology determines this to be a low dependence.

Page 62

B9 SD-SLOI-ISOL-BRF-XHE-D2 This modified HEP accounts for the dependence between the HFE representing the initial injection into the RCS prior to loss of SDC and the additional action to isolate the leak. This step accounts for the dependency between the first pair of HFEs in Sequence 7 which under some conditions can contain three HFEs. The dependency analysis is shown in Table B9. Both actions occur simultaneously and are performed by different members of the same crew. Both actions are direct by the MCR operator but are performed by different equipment operators. It is important to note that both actions are ultimately dependent on proper analysis of the situation and use of OFN-BB-31 performed by the shift supervisor; if this were not the case the actions would be independent.

Additional cues are received by different portions of OFN-BB-31. There are no intervening successes. The SPAR-H methodology determines this to be a low dependence.

B10 SD-SLOI-FEED-LT-XHE-D2 This modified HEP accounts for the dependence between the HFE representing the action to isolate the leak and the subsequent action to inject late into the RCS. This step accounts for the dependency between the second pair of HFEs in a sequence containing three HFEs. The initial pair is analyzed in Section B10 above. The HFE pair is shown in Table B10. It should be recognized that prior to attempting to perform the late injection (the second of these two HFEs) the operator has failed to perform an early injection. The consequence of this earlier failure is that water level has dropped to midloop necessitating the shutdown of the operating SDC pumps. The first action occurs early while the second action occurs 70 minutes into the event and is assumed to be performed by the same crew. Both actions are direct by the MCR operator but are performed by different equipment operators. Additional cues are received when level reaches midloop as the SDC pumps begin to cavitate. There are no intervening successes. The SPAR-H methodology determines this to be a moderate dependence.

B11 SD-SLOI-FEED-LT-XHE-D3 This modified HEP accounts for the dependence between the HFE representing the action to isolate the leak and the subsequent action to inject late into the RCS. In contrast to the previous HFE pair discussed in Section B11 above, this pair has is not preceded by an earlier HFE. This HFE pair is shown in Table B4. Prior to the second of these actions, water level has dropped to midloop necessitating the shutdown of the operating SDC pumps. The first action occurs early while the second action occurs 70 minutes into the event and is assumed to be performed by the same crew.

Both actions are direct by the MCR operator but are performed by different equipment operators.

Additional cues are received when level reaches midloop as the SDC pumps begin to cavitate. There are no intervening successes. The SPAR-H methodology determines this to be a low dependence.

Page 63

B12 SD-SLOI-FEED-LT-XHE-D4 This modified HEP accounts for the dependence between the HFE representing the action to perform an early injection (early meaning before level drops to midloop requiring securing the running SDC pumps) and the subsequent action to inject late into the RCS. This HFE pair is shown in Table B12.

Prior to the second of these actions, water level has dropped to midloop necessitating the shutdown of the operating SDC pumps. The first action occurs early while the second action occurs 70 minutes into the event, both events are assumed to be performed by the same crew. Both actions are direct by the MCR operator but are performed by different equipment operators. Additional cues are received when level reaches midloop as the SDC pumps begin to cavitate. There is an intervening success which is isolation of the leak. The SPAR-H methodology determines this to be a low dependence.

B13 SD-SLOI-ISOL-BRF-XHE-D6 This modified HEP accounts for the dependence between the HFE representing the initial injection into the RCS prior to loss of SDC and the additional action to isolate the leak. The dependency analysis is shown in Table B13. Both actions occur simultaneously and are performed by different members of the same crew. Both actions are direct by the MCR operator but are performed by different equipment operators. It is important to note that both actions are ultimately dependent on proper analysis of the situation and use of OFN-BB-31 performed by the shift supervisor; if this were not the case the actions would be independent. Additional cues are received by different portions of OFN-BB-31. There are no intervening successes. The SPAR-H methodology determines this to be a low dependence.

B14 SD-SLOI-LTR1-XHE-D7 This modified HEP accounts for the dependence between the HFE representing the action to isolate the leak and the subsequent action to makeup to the BWST prior to its depletion. It should be noted that this occurs after an initial success to establish feed of the RCS from the BWST. This HFE pair is shown in Table B14. The first failed action occurs relatively early while the second action occurs very late. The second action is not required until approximately 25 hours2.893519e-4 days <br />0.00694 hours <br />4.133598e-5 weeks <br />9.5125e-6 months <br /> after event initiation. Because of the late time of this event it is assumed to be performed by a different crew. Both actions are direct by the MCR operator but are performed by different equipment operators. Additional cues are received when BWST level decreases to point requiring refill. There are no intervening successes. The SPAR-H methodology determines this to be a zero dependence based on the performance by different crews.

Page 64

Table B8: SD-SLOI-FEED-LT-XHE-D1 1st Action 2nd Action 3rd Action 4th Action Multiple Time Between Same or Same or Additional Intervening Human Events Close or Different SD-SLOI-DIAG-XHE SD-SLOI-FEED-LT-XHE Different Crew Cues? Success?

Errors Not Close Location Same N/A N/A C omplete Complete Complete Close in time N/A N/A High Complete Complete Different Yes (related)

Low Moderate High No Yes (not related)

Moderate High Complete Same No High Complete Complete Same Yes (related)

Zero Low Moderate Yes (not related)

Low Moderate High Yes No Moderate High Complete N/A Not close in time Yes (related)

Zero Low Moderate No Yes (not related)

Low Moderate High No Moderate High Complete Different Yes (related)

Zero Low Moderate Yes (not related)

Zero Low Moderate Yes No Low Moderate High Zero Low Moderate Different Comment: Independent 1.00E-03 3.00E-03 HEP Dependence Level LD Conditional HEP = 5.3E-02 Total Un-conditional Joint HEP = 3.0E-06 Total Conditional Joint HEP = 5.3E-05 Page 65

Table B9: SD-SLOI-BRF-XHE-D2 1st Action 2nd Action 3rd Action 4th Action Multiple Time Between Same or Same or Additional Intervening Human Events Close or Different SD-SLOI-FEED -XHE SD-SLOI-ISOL-BRF-XHE Different Crew Cues? Success?

Errors N ot Close Location Same N/A N/A Complete Complete Complete Close in time N/A N/A High Complete Complete Different Yes (related)

Low Moderate High No Yes (not related)

Moderate High Complete Same No High Complete Complete Same Yes (related)

Zero Low Moderate Yes (not related)

Low Moderate High Yes No Moderate High Complete N/A Not close in time Yes (related)

Zero Low Moderate No Yes (not related)

Low Moderate High No Moderate High Complete Different Yes (related)

Zero Low Moderate Yes (not related)

Zero Low Moderate Yes No Low Moderate High Zero Low Moderate Different Comment: Independent 4.00E-03 2.00E-03 HEP Dependence Level LD Conditional HEP = 5.2E-02 Total Un-conditional Joint HEP = 8.0E-06 Total Conditional Joint HEP = 2.1E-04 Page 66

Table B10: SD-SLOI-FEED-LT-XHE-D2 1st Action 2nd Action 3rd Action 4th Action Multiple Time Between Same or Same or Additional Intervening Human Events Close or Different SD-SLOI-FEED-XHE SD-SLOI-ISOL-BRF-XH E SD-SLOI-FEED-LT-XHE Different C rew Cues? Success?

Errors N ot Close Location Same N /A N/A Complete Complete Complete Close in time N /A N/A High Complete Complete Different Yes (related)

Low Moderate High No Yes (not related)

Moderate High Complete Same No High Complete Complete Same Yes (related)

Zero Low Moderate Yes (not related)

Low Moderate High Yes No Moderate High Complete N /A Not close in time Yes (related)

Zero Low Moderate No Yes (not related)

Low Moderate High No Moderate High Complete Different Yes (related)

Zero Low Moderate Yes (not related)

Zero Low Moderate Yes No Low Moderate High Zero Low Moderate D ifferent Comment: Independent 4.00E-03 2.00E-03 3.00E-03 HEP Dependence Level LD MD 5.2E-02 1.5E-01 1.0E+00 Conditional HEP = 1.5E-01 Total U n-conditional Joint HEP = 2.4E-08 Total Conditional Joint HEP = 3.1E-05 Page 67

Table B11: SD-SLOI-FEED-LT-XHE-D3 1st Action 2nd Action 3rd Action 4th Action Multiple Time Between Same or Same or Additional Intervening Human Events Close or Different SD-SLOI-ISOL-BRF-XHE SD-SLOI-FEED-LT-XHE Different Crew Cues? Success?

Errors N ot Close Location Same N/A N/A Complete Complete Complete Close in time N/A N/A H igh Complete Complete Different Yes (related)

Low Moderate High No Yes (not related)

Moderate High Complete Same No H igh Complete Complete Same Yes (related)

Zero Low Moderate Yes (not related)

Low Moderate High Yes No Moderate High Complete N/A Not close in time Yes (related)

Zero Low Moderate No Yes (not related)

Low Moderate High No Moderate High Complete Different Yes (related)

Zero Low Moderate Yes (not related)

Zero Low Moderate Yes No Low Moderate High Zero Low Moderate Different Comment: Independent 2.00E-03 3.00E-03 HEP Dependence Level LD Conditional HEP = 5.3E-02 Total Un-conditional Joint HEP = 6.0E-06 Total Conditional Joint HEP = 1.1E-04 Page 68

Table B12: SD-SLOI-FEED-LT-XHE-D4 1st Action 2nd Action 3rd Action 4th Action Multiple Time Between Same or Same or Additional Intervening Human Events Close or Different SD-SLOI-FEED-XHE SD-SLOI-FEED-LT-XHE Different C rew Cues? Success?

Errors N ot Close Location Same N/A N/A Complete Complete Complete Close in time N/A N/A High Complete Complete Different Yes (related)

Low Moderate High No Yes (not related)

Moderate H igh Complete Same No High Complete Complete Same Yes (related)

Zero Low Moderate Yes (not related)

Low Moderate High Yes No Moderate H igh Complete N/A Not close in time Yes (related)

Zero Low Moderate No Yes (not related)

Low Moderate High No Moderate H igh Complete Different Yes (related)

Zero Low Moderate Yes (not related)

Zero Low Moderate Yes No Low Moderate High Zero Low Moderate Different Comment: Independent 4.00E-03 3.00E-03 HEP Dependence Level LD Conditional H EP = 5.3E-02 Total Un-conditional Joint H EP = 1.2E-05 T otal Conditional Joint H EP = 2.1E-04 Page 69

Table B13: SD-SLOI-BRF-XHE-D6 1st Action 2nd Action 3rd Action 4th Action Multiple Time Between Same or Same or Additional Intervening Human Events Close or Different SD-SLOI-FEED-XHE SD-SLOI-ISOL-BRF-XH E Different C rew Cues? Success?

Errors N ot Close Location Same N/A N/A Complete Complete Complete Close in time N/A N/A High Complete Complete Different Yes (related)

Low Moderate High No Yes (not related)

Moderate H igh Complete Same No High Complete Complete Same Yes (related)

Zero Low Moderate Yes (not related)

Low Moderate High Yes No Moderate H igh Complete N/A Not close in time Yes (related)

Zero Low Moderate No Yes (not related)

Low Moderate High No Moderate H igh Complete Different Yes (related)

Zero Low Moderate Yes (not related)

Zero Low Moderate Yes No Low Moderate High Zero Low Moderate Different Comment: Independent 4.00E-03 2.00E-03 HEP Dependence Level LD Conditional H EP = 5.2E-02 Total Un-conditional Joint H EP = 8.0E-06 T otal Conditional Joint H EP = 2.1E-04 Page 70

Table B14: SD-SLOI-LTR1-XHE-D7 1st Action 2nd Action 3rd Action 4th Action Multiple Time Between Same or Same or Additional Intervening Human Events Close or Different SD-SLOI-ISOL-AFD-XHE SD-SLOI-LTR1-XHE Different C rew Cues? Success?

Errors Not Close Location Same N/A N/A Complete Complete Complete Close in time N/A N/A H igh Complete Complete Different Yes (related)

Low Moderate High No Yes (not related)

Moderate High Complete Same No H igh Complete Complete Same Yes (related)

Zero Low Moderate Yes (not related)

Low Moderate High Yes No Moderate High Complete N/A Not close in time Yes (related)

Zero Low Moderate No Yes (not related)

Low Moderate High No Moderate High Complete Different Yes (related)

Zero Low Moderate Yes (not related)

Zero Low Moderate Yes No Low Moderate High Zero Low Moderate D ifferent Comment: Independent 1.00E-05 1.20E-02 HEP Dependence Level ZD 1.2E-02 1.0E+00 1.0E+00 Conditional HEP = 1.2E-02 Total Un-conditional Joint HEP = 1.2E-07 Total C onditional Joint HEP = 1.2E-07 Page 71

Appendix C Initiator Cutsets Page 72

Table C1 Mode 3 POS 3a1 Medium LOCA (Accumulators Unavailable below 1000psig)

Cut % Total  % Cut Prob./Frequen Basic Event Description Event Prob.

No. Set cy 1 82.81 82.81 2.000E-005 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 M3-DHC-REC-LATE Operators fail to Refill RWST as Part of Long 1.000E-001 Term Recovery 2 86.12 3.31 8.000E-007 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 OPR-XHE-XM-DEPRCSM OPERATOR FAILS TO DEPRESSURIZE RCS/ 4.000E-003 SECONDARY SIDE (MLOCA) 3 88.26 2.14 5.177E-007 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 AFW-ACX-FR-SGF02A AFW MDP A ROOM COOLER FAILS TO RUN 2.589E-003 4 90.40 2.14 5.177E-007 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 AFW-ACX-FR-SGF02B AFW MDP B ROOM COOLER FAILS TO RUN 2.589E-003 5 92.47 2.07 5.000E-007 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 AFW-ACX-TM-SGF02A AFW MDP A ROOM COOLER UNAVAILABLE 2.500E-003 DUE TO T&M 6 94.54 2.07 5.000E-007 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 AFW-ACX-TM-SGF02B AFW MDP B ROOM COOLER UNAVAILABLE 2.500E-003 DUE TO T&M 7 95.78 1.24 3.000E-007 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 AFW-MDP-FS-PAL01A AFW MOTOR-DRIVEN PUMP 1A FAILS TO 1.500E-003 START 8 97.02 1.24 3.000E-007 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 AFW-MDP-FS-PAL01B AFW MOTOR-DRIVEN PUMP 1B FAILS TO 1.500E-003 START 9 97.85 0.83 2.000E-007 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 AFW-XHE-XR-SGF02A OP FAILS TO RESTORE AFW MDP A ROOM 1.000E-003 COOLER AFTER T&M 10 98.68 0.83 2.000E-007 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 AFW-XHE-XR-SGF02B OP FAILS TO RESTORE AFW MDP B ROOM 1.000E-003 COOLER AFTER T&M 11 99.34 0.66 1.600E-007 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 AFW-ACX-FS-SGF02A AFW MDP A ROOM COOLER FAILS TO 8.000E-004 START 12 100.00 0.66 1.600E-007 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 AFW-ACX-FS-SGF02B AFW MDP B ROOM COOLER FAILS TO 8.000E-004 START 13 100.00 0.45 1.076E-007 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 AFW-MDP-FR-PAL01A AFW MOTOR-DRIVEN PUMP FAILS TO RUN 5.379E-004 14 100.00 0.45 1.076E-007 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 AFW-MDP-FR-PAL01B AFW MOTOR-DRIVEN PUMP FAILS TO RUN 5.379E-004 15 100.00 0.36 8.800E-008 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 HPI-SYS-FC-RWSTLLO FAILURE OF RWST LEVEL LO 2/4 4.400E-004 INSTRUMENTATION (SA) 16 100.00 0.07 1.650E-008 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 AFW-MDP-CF-START CCF OF AFW MDPS TO START 8.250E-005 17 100.00 0.06 1.455E-008 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 AFW-ACX-CF-GF02ABR CCF OF AFW MDP ROOM COOLERS TO RUN 7.274E-005 18 100.00 0.06 1.440E-008 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 AFW-FCV-FC-HV05 SG D CONTROL AOV HV05 FROM MDP 7.200E-005 FAILS 19 100.00 0.06 1.440E-008 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 AFW-FCV-FC-HV07 SG A CONTROL AOV HV07 FROM MDP FAILS 7.200E-005 20 100.00 0.06 1.440E-008 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 AFW-FCV-FC-HV09 SG B CONTROL AOV HV09 FROM MDP FAILS 7.200E-005 Page 73

Table C2 Mode 3 POS 3b1 & 3c1 Medium LOCA Cut %  % Prob./Freque Basic Event Description Event Prob.

No. Total Cut ncy Set 1 30.45 30.45 2.000E-006 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 M3-DHC-REC-LATE Operators fail to Refill RWST as Part of Long Term Recovery 1.000E-002 2 42.63 12.18 8.000E-007 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 OPR-XHE-XM-DEPRCSM OPERATOR FAILS TO DEPRESSURIZE RCS/ SECONDARY 4.000E-003 SIDE (MLOCA) 3 50.51 7.88 5.177E-007 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 AFW-ACX-FR-SGF02A AFW MDP A ROOM COOLER FAILS TO RUN 2.589E-003 4 58.39 7.88 5.177E-007 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 AFW-ACX-FR-SGF02B AFW MDP B ROOM COOLER FAILS TO RUN 2.589E-003 5 66.00 7.61 5.000E-007 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 AFW-ACX-TM-SGF02A AFW MDP A ROOM COOLER UNAVAILABLE DUE TO T&M 2.500E-003 6 73.61 7.61 5.000E-007 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 AFW-ACX-TM-SGF02B AFW MDP B ROOM COOLER UNAVAILABLE DUE TO T&M 2.500E-003 7 78.18 4.57 3.000E-007 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 AFW-MDP-FS-PAL01A AFW MOTOR-DRIVEN PUMP 1A FAILS TO START 1.500E-003 8 82.75 4.57 3.000E-007 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 AFW-MDP-FS-PAL01B AFW MOTOR-DRIVEN PUMP 1B FAILS TO START 1.500E-003 9 85.80 3.05 2.000E-007 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 AFW-XHE-XR-SGF02A OP FAILS TO RESTORE AFW MDP A ROOM COOLER 1.000E-003 AFTER T&M 10 88.85 3.05 2.000E-007 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 AFW-XHE-XR-SGF02B OP FAILS TO RESTORE AFW MDP B ROOM COOLER 1.000E-003 AFTER T&M 11 91.29 2.44 1.600E-007 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 AFW-ACX-FS-SGF02A AFW MDP A ROOM COOLER FAILS TO START 8.000E-004 12 93.73 2.44 1.600E-007 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 AFW-ACX-FS-SGF02B AFW MDP B ROOM COOLER FAILS TO START 8.000E-004 13 95.37 1.64 1.076E-007 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 AFW-MDP-FR-PAL01A AFW MOTOR-DRIVEN PUMP FAILS TO RUN 5.379E-004 14 97.01 1.64 1.076E-007 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 AFW-MDP-FR-PAL01B AFW MOTOR-DRIVEN PUMP FAILS TO RUN 5.379E-004 15 98.35 1.34 8.800E-008 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 HPI-SYS-FC-RWSTLLO FAILURE OF RWST LEVEL LO 2/4 INSTRUMENTATION (SA) 4.400E-004 16 98.60 0.25 1.650E-008 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 AFW-MDP-CF-START CCF OF AFW MDPS TO START 8.250E-005 17 98.82 0.22 1.455E-008 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 AFW-ACX-CF-GF02ABR CCF OF AFW MDP ROOM COOLERS TO RUN 7.274E-005 18 99.04 0.22 1.440E-008 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 AFW-FCV-FC-HV05 SG D CONTROL AOV HV05 FROM MDP FAILS 7.200E-005 19 99.26 0.22 1.440E-008 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 AFW-FCV-FC-HV07 SG A CONTROL AOV HV07 FROM MDP FAILS 7.200E-005 20 99.48 0.22 1.440E-008 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 AFW-FCV-FC-HV09 SG B CONTROL AOV HV09 FROM MDP FAILS 7.200E-005 Page 74

Table C3 Mode 3 POS 3a2 Small LOCA (No Auto-ECCS below 1000psig)

Cut % Total % Prob./Frequen Basic Event Description Event Prob.

No. Cut cy Set 1 83.05 83.05 6.000E-005 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 M3-DHC-REC-LATE Operators fail to Refill RWST as Part of Long Term 1.000E-001 Recovery 2 91.36 8.31 6.000E-006 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 FW-XHE-ACT-M3 manual actuation of FW in mode 3 1.000E-002 3 99.67 8.31 6.000E-006 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 HPI-XHE-ACT-M3 manual actuation of ECCS in mode 3 fails 1.000E-002 4 100.00 1.66 1.200E-006 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 OPR-XHE-XM-DEPRCS OPERATOR FAILS TO DEPRESSURIZE RCS/ 2.000E-003 SECONDARY SIDE 5 100.00 0.37 2.640E-007 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 HPI-SYS-FC-RWSTLLO FAILURE OF RWST LEVEL LO 2/4 4.400E-004 INSTRUMENTATION (SA) 6 100.00 0.17 1.200E-007 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 FW-XHE-ACT-M3 manual actuation of FW in mode 3 1.000E-002 HPI-XHE-XM-FB OPERATOR FAILS TO INITIATE FEED AND 2.000E-002 BLEED COOLING 7 100.00 0.06 4.200E-008 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 FW-XHE-ACT-M3 manual actuation of FW in mode 3 1.000E-002 PPR-SRV-CC-456A PORV 456A FAILS TO OPEN ON DEMAND 7.000E-003 8 100.00 0.06 4.200E-008 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 FW-XHE-ACT-M3 manual actuation of FW in mode 3 1.000E-002 PPR-SRV-CC-455A PORV455A FAILS TO OPEN ON DEMAND 7.000E-003 9 100.00 0.02 1.200E-008 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 HPI-XHE-ACT-M3 manual actuation of ECCS in mode 3 fails 1.000E-002 OPR-XHE-XM-DEPRCS OPERATOR FAILS TO DEPRESSURIZE RCS/ 2.000E-003 SECONDARY SIDE 10 100.00 0.01 5.562E-009 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 HPI-PMP-FC-GASBIND COMMON CAUSE GAS INTRUSTION FAILURE 9.270E-006 ALL 4 HP ECCS PUMPS (PSA) 11 100.00 0.00 3.270E-009 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 IAS-MDC-FR-CKA01C Instrument Air Compressor CkA01C Fails to Run 5.887E-002 MSS-ARV-CF-SGPORVS CCF OF SG ARVs FOR SEC SIDE COOLDOWN 9.257E-005 12 100.00 0.00 2.640E-009 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 FW-XHE-ACT-M3 manual actuation of FW in mode 3 1.000E-002 HPI-SYS-FC-RWSTLLO FAILURE OF RWST LEVEL LO 2/4 4.400E-004 INSTRUMENTATION (SA) 13 100.00 0.00 2.537E-009 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 FW-XHE-ACT-M3 manual actuation of FW in mode 3 1.000E-002 PPR-SRV-CF-PORVS CCF OF PORVs TO OPEN 4.228E-004 14 100.00 0.00 6.665E-010 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 IAS-MDC-FS-CKA01C Instrument Air Compressor CKA01C Fails to Start 1.200E-002 MSS-ARV-CF-SGPORVS CCF OF SG ARVs FOR SEC SIDE COOLDOWN 9.257E-005 15 100.00 0.00 5.554E-010 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 CWS-SYS-FC-IAS Central Chilled Water System Unavailable (PSA) 1.000E-002 MSS-ARV-CF-SGPORVS CCF OF SG ARVs FOR SEC SIDE COOLDOWN 9.257E-005 16 100.00 0.00 5.280E-010 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 HPI-SYS-FC-RWSTLLO FAILURE OF RWST LEVEL LO 2/4 4.400E-004 INSTRUMENTATION (SA)

OPR-XHE-XM-DEPRCS OPERATOR FAILS TO DEPRESSURIZE RCS/ 2.000E-003 SECONDARY SIDE 17 100.00 0.00 3.044E-010 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 PPR-SRV-CF-PORVS CCF OF PORVs TO OPEN 4.228E-004 RCS-AOV-CC-455B NORMAL SPRAY VALVE 455B FAILS TO OPEN 1.200E-003 18 100.00 0.00 3.044E-010 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 Page 75

Cut % Total % Prob./Frequen Basic Event Description Event Prob.

No. Cut cy Set PPR-SRV-CF-PORVS CCF OF PORVs TO OPEN 4.228E-004 RCS-AOV-CC-455C NORMAL SPRAY VALVE 455C FAILS TO OPEN 1.200E-003 19 100.00 0.00 1.389E-010 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 ACP-CRB-CC-PA0101 CIRCUIT BREAKER PA0101 FAILS TO OPEN ON 2.500E-003 DEMAND MSS-ARV-CF-SGPORVS CCF OF SG ARVs FOR SEC SIDE COOLDOWN 9.257E-005 20 100.00 0.00 1.389E-010 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 ACP-CRB-OO-PA0110 CIRCUIT BREAKER PA0110 FAILS TO CLOSE ON 2.500E-003 DEMAND MSS-ARV-CF-SGPORVS CCF OF SG ARVs FOR SEC SIDE COOLDOWN 9.257E-005 Page 76

Table C3 Mode 4 POS 3b2 Small LOCA (No Auto-ECCS above 1000psig)

Cut %  % Prob./Freque Basic Event Description Event Prob.

No. Total Cut ncy Set 1 30.82 30.82 6.000E-006 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 M3-DHC-REC-LATE Operators fail to Refill RWST as Part of Long Term Recovery 1.000E-002 2 61.64 30.82 6.000E-006 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 FW-XHE-ACT-M3 manual actuation of FW in mode 3 1.000E-002 3 92.46 30.82 6.000E-006 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 HPI-XHE-ACT-M3 manual actuation of ECCS in mode 3 fails 1.000E-002 4 98.62 6.16 1.200E-006 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 OPR-XHE-XM-DEPRCS OPERATOR FAILS TO DEPRESSURIZE RCS/ 2.000E-003 SECONDARY SIDE 5 99.98 1.36 2.640E-007 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 HPI-SYS-FC-RWSTLLO FAILURE OF RWST LEVEL LO 2/4 INSTRUMENTATION 4.400E-004 (SA) 6 100.0 0.62 1.200E-007 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 0

FW-XHE-ACT-M3 manual actuation of FW in mode 3 1.000E-002 HPI-XHE-XM-FB OPERATOR FAILS TO INITIATE FEED AND BLEED 2.000E-002 COOLING 7 100.0 0.22 4.200E-008 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 0

FW-XHE-ACT-M3 manual actuation of FW in mode 3 1.000E-002 PPR-SRV-CC-456A PORV 456A FAILS TO OPEN ON DEMAND 7.000E-003 8 100.0 0.22 4.200E-008 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 0

FW-XHE-ACT-M3 manual actuation of FW in mode 3 1.000E-002 PPR-SRV-CC-455A PORV455A FAILS TO OPEN ON DEMAND 7.000E-003 9 100.0 0.06 1.200E-008 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 0

HPI-XHE-ACT-M3 manual actuation of ECCS in mode 3 fails 1.000E-002 OPR-XHE-XM-DEPRCS OPERATOR FAILS TO DEPRESSURIZE RCS/ 2.000E-003 SECONDARY SIDE 10 100.0 0.03 5.562E-009 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 0

HPI-PMP-FC-GASBIND COMMON CAUSE GAS INTRUSTION FAILURE ALL 4 HP 9.270E-006 ECCS PUMPS (PSA) 11 100.0 0.02 3.270E-009 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 0

IAS-MDC-FR-CKA01C Instrument Air Compressor CkA01C Fails to Run 5.887E-002 MSS-ARV-CF-SGPORVS CCF OF SG ARVs FOR SEC SIDE COOLDOWN 9.257E-005 12 100.0 0.01 2.640E-009 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 0

FW-XHE-ACT-M3 manual actuation of FW in mode 3 1.000E-002 HPI-SYS-FC-RWSTLLO FAILURE OF RWST LEVEL LO 2/4 INSTRUMENTATION 4.400E-004 (SA) 13 100.0 0.01 2.537E-009 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 0

FW-XHE-ACT-M3 manual actuation of FW in mode 3 1.000E-002 PPR-SRV-CF-PORVS CCF OF PORVs TO OPEN 4.228E-004 14 100.0 0.00 6.665E-010 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 0

IAS-MDC-FS-CKA01C Instrument Air Compressor CKA01C Fails to Start 1.200E-002 MSS-ARV-CF-SGPORVS CCF OF SG ARVs FOR SEC SIDE COOLDOWN 9.257E-005 15 100.0 0.00 5.554E-010 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 0

CWS-SYS-FC-IAS Central Chilled Water System Unavailable (PSA) 1.000E-002 MSS-ARV-CF-SGPORVS CCF OF SG ARVs FOR SEC SIDE COOLDOWN 9.257E-005 16 100.0 0.00 5.280E-010 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 0

HPI-SYS-FC-RWSTLLO FAILURE OF RWST LEVEL LO 2/4 INSTRUMENTATION 4.400E-004 (SA)

OPR-XHE-XM-DEPRCS OPERATOR FAILS TO DEPRESSURIZE RCS/ 2.000E-003 SECONDARY SIDE 17 100.0 0.00 3.044E-010 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 0

Page 77

Cut %  % Prob./Freque Basic Event Description Event Prob.

No. Total Cut ncy Set PPR-SRV-CF-PORVS CCF OF PORVs TO OPEN 4.228E-004 RCS-AOV-CC-455B NORMAL SPRAY VALVE 455B FAILS TO OPEN 1.200E-003 18 100.0 0.00 3.044E-010 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 0

PPR-SRV-CF-PORVS CCF OF PORVs TO OPEN 4.228E-004 RCS-AOV-CC-455C NORMAL SPRAY VALVE 455C FAILS TO OPEN 1.200E-003 19 100.0 0.00 1.389E-010 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 0

ACP-CRB-CC-PA0101 CIRCUIT BREAKER PA0101 FAILS TO OPEN ON DEMAND 2.500E-003 MSS-ARV-CF-SGPORVS CCF OF SG ARVs FOR SEC SIDE COOLDOWN 9.257E-005 20 100.0 0.00 1.389E-010 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 0

ACP-CRB-OO-PA0110 CIRCUIT BREAKER PA0110 FAILS TO CLOSE ON 2.500E-003 DEMAND MSS-ARV-CF-SGPORVS CCF OF SG ARVs FOR SEC SIDE COOLDOWN 9.257E-005 Page 78

Table C5 Mode 3 POS 3c2 Small LOCA (Auto-ECCS)

Cut %  % Prob./Frequen Basic Event Description Event Prob.

No. Total Cut cy Set 1 80.26 80.26 6.000E-006 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 M3-DHC-REC-LATE Operators fail to Refill RWST as Part of Long Term 1.000E-002 Recovery 2 96.31 16.05 1.200E-006 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 OPR-XHE-XM-DEPRCS OPERATOR FAILS TO DEPRESSURIZE RCS/ 2.000E-003 SECONDARY SIDE 3 99.84 3.53 2.640E-007 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 HPI-SYS-FC-RWSTLLO FAILURE OF RWST LEVEL LO 2/4 INSTRUMENTATION 4.400E-004 (SA) 4 99.92 0.08 6.000E-009 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 ECCS-AUTO-ACT-M3 Automatic actuation of ECCS in mode 3 1.000E-003 HPI-XHE-ACT-M3 manual actuation of ECCS in mode 3 fails 1.000E-002 5 100.0 0.08 6.000E-009 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 0

ECCS-AUTO-ACT-M3 Automatic actuation of ECCS in mode 3 1.000E-003 FW-XHE-ACT-M3 manual actuation of FW in mode 3 1.000E-002 6 100.0 0.07 5.562E-009 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 0

HPI-PMP-FC-GASBIND COMMON CAUSE GAS INTRUSTION FAILURE ALL 4 HP 9.270E-006 ECCS PUMPS (PSA) 7 100.0 0.04 3.270E-009 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 0

IAS-MDC-FR-CKA01C Instrument Air Compressor CkA01C Fails to Run 5.887E-002 MSS-ARV-CF-SGPORVS CCF OF SG ARVs FOR SEC SIDE COOLDOWN 9.257E-005 8 100.0 0.01 6.665E-010 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 0

IAS-MDC-FS-CKA01C Instrument Air Compressor CKA01C Fails to Start 1.200E-002 MSS-ARV-CF-SGPORVS CCF OF SG ARVs FOR SEC SIDE COOLDOWN 9.257E-005 9 100.0 0.01 5.554E-010 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 0

CWS-SYS-FC-IAS Central Chilled Water System Unavailable (PSA) 1.000E-002 MSS-ARV-CF-SGPORVS CCF OF SG ARVs FOR SEC SIDE COOLDOWN 9.257E-005 10 100.0 0.01 5.280E-010 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 0

HPI-SYS-FC-RWSTLLO FAILURE OF RWST LEVEL LO 2/4 INSTRUMENTATION 4.400E-004 (SA)

OPR-XHE-XM-DEPRCS OPERATOR FAILS TO DEPRESSURIZE RCS/ 2.000E-003 SECONDARY SIDE 11 100.0 0.00 3.044E-010 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 0

PPR-SRV-CF-PORVS CCF OF PORVs TO OPEN 4.228E-004 RCS-AOV-CC-455B NORMAL SPRAY VALVE 455B FAILS TO OPEN 1.200E-003 12 100.0 0.00 3.044E-010 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 0

PPR-SRV-CF-PORVS CCF OF PORVs TO OPEN 4.228E-004 RCS-AOV-CC-455C NORMAL SPRAY VALVE 455C FAILS TO OPEN 1.200E-003 13 100.0 0.00 1.389E-010 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 0

ACP-CRB-CC-PA0101 CIRCUIT BREAKER PA0101 FAILS TO OPEN ON 2.500E-003 DEMAND MSS-ARV-CF-SGPORVS CCF OF SG ARVs FOR SEC SIDE COOLDOWN 9.257E-005 14 100.0 0.00 1.389E-010 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 0

ACP-CRB-OO-PA0110 CIRCUIT BREAKER PA0110 FAILS TO CLOSE ON 2.500E-003 DEMAND MSS-ARV-CF-SGPORVS CCF OF SG ARVs FOR SEC SIDE COOLDOWN 9.257E-005 15 100.0 0.00 1.238E-010 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 0

ACP-CRB-CC-PA0101 CIRCUIT BREAKER PA0101 FAILS TO OPEN ON 2.500E-003 DEMAND AFW-MDP-CF-START CCF OF AFW MDPS TO START 8.250E-005 16 100.0 0.00 1.238E-010 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 0

ACP-CRB-OO-PA0110 CIRCUIT BREAKER PA0110 FAILS TO CLOSE ON 2.500E-003 Page 79

Cut %  % Prob./Frequen Basic Event Description Event Prob.

No. Total Cut cy Set DEMAND AFW-MDP-CF-START CCF OF AFW MDPS TO START 8.250E-005 17 100.0 0.00 1.200E-010 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 0

ECCS-AUTO-ACT-M3 Automatic actuation of ECCS in mode 3 1.000E-003 FW-XHE-ACT-M3 manual actuation of FW in mode 3 1.000E-002 HPI-XHE-XM-FB OPERATOR FAILS TO INITIATE FEED AND BLEED 2.000E-002 COOLING 18 100.0 0.00 1.091E-010 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 0

ACP-CRB-CC-PA0101 CIRCUIT BREAKER PA0101 FAILS TO OPEN ON 2.500E-003 DEMAND AFW-ACX-CF-GF02ABR CCF OF AFW MDP ROOM COOLERS TO RUN 7.274E-005 19 100.0 0.00 1.091E-010 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 0

ACP-CRB-OO-PA0110 CIRCUIT BREAKER PA0110 FAILS TO CLOSE ON 2.500E-003 DEMAND AFW-ACX-CF-GF02ABR CCF OF AFW MDP ROOM COOLERS TO RUN 7.274E-005 20 100.0 0.00 9.900E-011 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 0

AFW-MDP-CF-START CCF OF AFW MDPS TO START 8.250E-005 MFW-MDP-FS-AE02 STARTUP FEEDWATER PUMP FAILS TO START 2.000E-003 Page 80

Table C6 Mode 4 POS 4a Loss of Inventory Outside Containment Cut %  % Prob./ Basic Event Description Event No. Total Cut Frequency Prob.

Set 1 53.63 53.63 9.275E-006 IE-M4-SLOI-OC SLOI Outside of Containment Occurs -M4 1.750E-001 SD-SLOI-DIAG-XHE Operators fail to diagnose small LOI outside of containment before 1.000E-003 loss of SDC SD-SLOI-FEED-LT-XHE-D1 Operators fail to initiate feed after loss of SDC; before core damage 5.300E-002 2 85.20 31.57 5.460E-006 IE-M4-SLOI-OC SLOI Outside of Containment Occurs -M4 1.750E-001 SD-SLOI-FEED-LT-XHE-D2 Operators fail to initiate feed after loss of SDC; before core damage 1.500E-001 SD-SLOI-FEED-XHE Operator fails to initiate feed before loss of SDC 4.000E-003 SD-SLOI-ISOL-BRF-XHE-D2 Operator fail to terminate SLOI leak before SDC fails 5.200E-002 3 97.34 12.14 2.100E-006 IE-M4-SLOI-OC SLOI Outside of Containment Occurs -M4 1.750E-001 SD-SLOI-DIAG-XHE Operators fail to diagnose small LOI outside of containment before 1.000E-003 loss of SDC SD-SLOI-LTR1-XHE Operators fail to Refill RWST as Part of Long Term Recovery 1.200E-002 4 99.87 2.53 4.368E-007 IE-M4-SLOI-OC SLOI Outside of Containment Occurs -M4 1.750E-001 SD-SLOI-FEED-XHE Operator fails to initiate feed before loss of SDC 4.000E-003 SD-SLOI-ISOL-BRF-XHE-D6 Operator fail to terminate SLOI leak before SDC fails 5.200E-002 SD-SLOI-LTR1-XHE Operators fail to Refill RWST as Part of Long Term Recovery 1.200E-002 5 99.99 0.12 2.100E-008 IE-M4-SLOI-OC SLOI Outside of Containment Occurs -M4 1.750E-001 SD-SLOI-ISOL-AFD-XHE Operators fail to terminate SLOI leak before RWST is depleted 1.000E-005 SD-SLOI-LTR1-XHE-D7 Operators fail to Refill BWST as Part of Long Term Recovery 1.200E-002 6 100.00 0.01 2.100E-009 IE-M4-SLOI-OC SLOI Outside of Containment Occurs -M4 1.750E-001 SD-ISOL-EQP-FAILURES FAILURES OF EQUIPMENT TO ISOLATE 1.000E-006 SD-SLOI-LTR1-XHE Operators fail to Refill RWST as Part of Long Term Recovery 1.200E-002 7 100.00 0.00 3.710E-011 IE-M4-SLOI-OC SLOI Outside of Containment Occurs -M4 1.750E-001 SD-ISOL-EQP-FAILURES FAILURES OF EQUIPMENT TO ISOLATE 1.000E-006 SD-SLOI-FEED-LT-XHE-D4 Operators fail to initiate feed after loss of SDC; before core damage 5.300E-002 SD-SLOI-FEED-XHE Operator fails to initiate feed before loss of SDC 4.000E-003 8 100.00 0.00 1.887E-011 IE-M4-SLOI-OC SLOI Outside of Containment Occurs -M4 1.750E-001 CCW-HTX-CF-ALL COMMON CAUSE FAILURE OF CCW HEAT EXCHANGERS 1.348E-006 OPR-XHE-XM-ALTCOOL OPERATOR FAILS TO ALIGN FIRE WATER COOLING TO 4.000E-002 CCP/SI PUMPS SD-SLOI-ISOL-BRF-XHE Operator fail to terminate SLOI leak before SDC fails 2.000E-003 9 100.00 0.00 1.680E-011 IE-M4-SLOI-OC SLOI Outside of Containment Occurs -M4 1.750E-001 HPI-TNK-FC-RWST RWST IS UNAVAILABLE 4.800E-008 SD-SLOI-ISOL-BRF-XHE Operator fail to terminate SLOI leak before SDC fails 2.000E-003 10 100.00 0.00 1.367E-011 IE-M4-SLOI-OC SLOI Outside of Containment Occurs -M4 1.750E-001 CVC-ACX-CF-GL12ABS CCF OFCCP MDP ROOM COOLERS TO START 8.875E-005 HPI-SYS-FC-RWSTLLO FAILURE OF RWST LEVEL LO 2/4 INSTRUMENTATION (SA) 4.400E-004 SD-SLOI-ISOL-BRF-XHE Operator fail to terminate SLOI leak before SDC fails 2.000E-003 11 100.00 0.00 9.656E-012 IE-M4-SLOI-OC SLOI Outside of Containment Occurs -M4 1.750E-001 CVC-MDP-CF-START CHARGING PUMPS FAIL FROM COMMON CAUSE TO START 6.270E-005 HPI-SYS-FC-RWSTLLO FAILURE OF RWST LEVEL LO 2/4 INSTRUMENTATION (SA) 4.400E-004 SD-SLOI-ISOL-BRF-XHE Operator fail to terminate SLOI leak before SDC fails 2.000E-003 12 100.00 0.00 9.435E-012 IE-M4-SLOI-OC SLOI Outside of Containment Occurs -M4 1.750E-001 CCW-HTX-CF-ALL COMMON CAUSE FAILURE OF CCW HEAT EXCHANGERS 1.348E-006 OPR-XHE-XM-ALTCOOL OPERATOR FAILS TO ALIGN FIRE WATER COOLING TO 4.000E-002 CCP/SI PUMPS SD-SLOI-DIAG-XHE Operators fail to diagnose small LOI outside of containment before 1.000E-003 loss of SDC 13 100.00 0.00 8.400E-012 IE-M4-SLOI-OC SLOI Outside of Containment Occurs -M4 1.750E-001 SD-ISOL-EQP-FAILURES FAILURES OF EQUIPMENT TO ISOLATE 1.000E-006 SD-SLOI-FEED-XHE Operator fails to initiate feed before loss of SDC 4.000E-003 SD-SLOI-LTR1-XHE Operators fail to Refill RWST as Part of Long Term Recovery 1.200E-002 14 100.00 0.00 8.400E-012 IE-M4-SLOI-OC SLOI Outside of Containment Occurs -M4 1.750E-001 HPI-TNK-FC-RWST RWST IS UNAVAILABLE 4.800E-008 SD-SLOI-DIAG-XHE Operators fail to diagnose small LOI outside of containment before 1.000E-003 Page 81

Cut %  % Prob./ Basic Event Description Event No. Total Cut Frequency Prob.

Set loss of SDC 15 100.00 0.00 6.834E-012 IE-M4-SLOI-OC SLOI Outside of Containment Occurs -M4 1.750E-001 CVC-ACX-CF-GL12ABS CCF OFCCP MDP ROOM COOLERS TO START 8.875E-005 HPI-SYS-FC-RWSTLLO FAILURE OF RWST LEVEL LO 2/4 INSTRUMENTATION (SA) 4.400E-004 SD-SLOI-DIAG-XHE Operators fail to diagnose small LOI outside of containment before 1.000E-003 loss of SDC 16 100.00 0.00 4.828E-012 IE-M4-SLOI-OC SLOI Outside of Containment Occurs -M4 1.750E-001 CVC-MDP-CF-START CHARGING PUMPS FAIL FROM COMMON CAUSE TO START 6.270E-005 HPI-SYS-FC-RWSTLLO FAILURE OF RWST LEVEL LO 2/4 INSTRUMENTATION (SA) 4.400E-004 SD-SLOI-DIAG-XHE Operators fail to diagnose small LOI outside of containment before 1.000E-003 loss of SDC 17 100.00 0.00 4.168E-012 IE-M4-SLOI-OC SLOI Outside of Containment Occurs -M4 1.750E-001 CCW-MDP-CF-RUN CCW PUMPS FAIL FROM COMMON CAUSE TO RUN 2.977E-007 OPR-XHE-XM-ALTCOOL OPERATOR FAILS TO ALIGN FIRE WATER COOLING TO 4.000E-002 CCP/SI PUMPS SD-SLOI-ISOL-BRF-XHE Operator fail to terminate SLOI leak before SDC fails 2.000E-003 18 100.00 0.00 3.511E-012 IE-M4-SLOI-OC SLOI Outside of Containment Occurs -M4 1.750E-001 CVC-MOV-CF-112DE CCF OF CVC SUCTION MOVs CV112D/E 2.280E-005 HPI-SYS-FC-RWSTLLO FAILURE OF RWST LEVEL LO 2/4 INSTRUMENTATION (SA) 4.400E-004 SD-SLOI-ISOL-BRF-XHE Operator fail to terminate SLOI leak before SDC fails 2.000E-003 19 100.00 0.00 3.511E-012 IE-M4-SLOI-OC SLOI Outside of Containment Occurs -M4 1.750E-001 CVC-MOV-CF-8803AB CCF OF DISCHARGE MOVs 8803A & B TO OPEN 2.280E-005 HPI-SYS-FC-RWSTLLO FAILURE OF RWST LEVEL LO 2/4 INSTRUMENTATION (SA) 4.400E-004 SD-SLOI-ISOL-BRF-XHE Operator fail to terminate SLOI leak before SDC fails 2.000E-003 20 100.00 0.00 3.511E-012 IE-M4-SLOI-OC SLOI Outside of Containment Occurs -M4 1.750E-001 CVC-MOV-CF-8801AB COMMON CAUSE FAILURE OF DISCHARGE MOVs 8801A & B 2.280E-005 HPI-SYS-FC-RWSTLLO FAILURE OF RWST LEVEL LO 2/4 INSTRUMENTATION (SA) 4.400E-004 SD-SLOI-ISOL-BRF-XHE Operator fail to terminate SLOI leak before SDC fails 2.000E-003 Page 82

Table C7 Mode 4 POS 4b Loss of Inventory Inside Containment Cut %  % Prob./ Basic Event Description Event No. Total Cut Frequency Prob.

Set 1 53.63 53.63 9.275E-006 IE-M4-SLOI-IC SLOI Inside of Containment Occurs -M4 1.750E-001 SD-SLOI-DIAG-XHE Operators fail to diagnose small LOI outside of containment 1.000E-003 before loss of SDC SD-SLOI-FEED-LT-XHE-D1 Operators fail to initiate feed after loss of SDC; before core 5.300E-002 damage 2 85.20 31.57 5.460E-006 IE-M4-SLOI-IC SLOI Inside of Containment Occurs -M4 1.750E-001 SD-SLOI-FEED-LT-XHE-D2 Operators fail to initiate feed after loss of SDC; before core 1.500E-001 damage SD-SLOI-FEED-XHE Operator fails to initiate feed before loss of SDC 4.000E-003 SD-SLOI-ISOL-BRF-XHE-D2 Operator fail to terminate SLOI leak before SDC fails 5.200E-002 3 97.34 12.14 2.100E-006 IE-M4-SLOI-IC SLOI Inside of Containment Occurs -M4 1.750E-001 SD-SLOI-DIAG-XHE Operators fail to diagnose small LOI outside of containment 1.000E-003 before loss of SDC SD-SLOI-LTR1-XHE Operators fail to Refill RWST as Part of Long Term 1.200E-002 Recovery 4 99.87 2.53 4.368E-007 IE-M4-SLOI-IC SLOI Inside of Containment Occurs -M4 1.750E-001 SD-SLOI-FEED-XHE Operator fails to initiate feed before loss of SDC 4.000E-003 SD-SLOI-ISOL-BRF-XHE-D6 Operator fail to terminate SLOI leak before SDC fails 5.200E-002 SD-SLOI-LTR1-XHE Operators fail to Refill RWST as Part of Long Term 1.200E-002 Recovery 5 99.99 0.12 2.100E-008 IE-M4-SLOI-IC SLOI Inside of Containment Occurs -M4 1.750E-001 SD-SLOI-ISOL-AFD-XHE Operators fail to terminate SLOI leak before RWST is 1.000E-005 depleted SD-SLOI-LTR1-XHE-D7 Operators fail to Refill BWST as Part of Long Term 1.200E-002 Recovery 6 100.00 0.01 2.100E-009 IE-M4-SLOI-IC SLOI Inside of Containment Occurs -M4 1.750E-001 SD-ISOL-EQP-FAILURES FAILURES OF EQUIPMENT TO ISOLATE 1.000E-006 SD-SLOI-LTR1-XHE Operators fail to Refill RWST as Part of Long Term 1.200E-002 Recovery 7 100.00 0.00 3.710E-011 IE-M4-SLOI-IC SLOI Inside of Containment Occurs -M4 1.750E-001 SD-ISOL-EQP-FAILURES FAILURES OF EQUIPMENT TO ISOLATE 1.000E-006 SD-SLOI-FEED-LT-XHE-D4 Operators fail to initiate feed after loss of SDC; before core 5.300E-002 damage SD-SLOI-FEED-XHE Operator fails to initiate feed before loss of SDC 4.000E-003 8 100.00 0.00 1.887E-011 IE-M4-SLOI-IC SLOI Inside of Containment Occurs -M4 1.750E-001 CCW-HTX-CF-ALL COMMON CAUSE FAILURE OF CCW HEAT 1.348E-006 EXCHANGERS OPR-XHE-XM-ALTCOOL OPERATOR FAILS TO ALIGN FIRE WATER COOLING 4.000E-002 TO CCP/SI PUMPS SD-SLOI-ISOL-BRF-XHE Operator fail to terminate SLOI leak before SDC fails 2.000E-003 9 100.00 0.00 1.680E-011 IE-M4-SLOI-IC SLOI Inside of Containment Occurs -M4 1.750E-001 HPI-TNK-FC-RWST RWST IS UNAVAILABLE 4.800E-008 SD-SLOI-ISOL-BRF-XHE Operator fail to terminate SLOI leak before SDC fails 2.000E-003 10 100.00 0.00 1.367E-011 IE-M4-SLOI-IC SLOI Inside of Containment Occurs -M4 1.750E-001 CVC-ACX-CF-GL12ABS CCF OFCCP MDP ROOM COOLERS TO START 8.875E-005 HPI-SYS-FC-RWSTLLO FAILURE OF RWST LEVEL LO 2/4 INSTRUMENTATION 4.400E-004 (SA)

SD-SLOI-ISOL-BRF-XHE Operator fail to terminate SLOI leak before SDC fails 2.000E-003 11 100.00 0.00 9.656E-012 IE-M4-SLOI-IC SLOI Inside of Containment Occurs -M4 1.750E-001 CVC-MDP-CF-START CHARGING PUMPS FAIL FROM COMMON CAUSE TO 6.270E-005 START HPI-SYS-FC-RWSTLLO FAILURE OF RWST LEVEL LO 2/4 INSTRUMENTATION 4.400E-004 (SA)

SD-SLOI-ISOL-BRF-XHE Operator fail to terminate SLOI leak before SDC fails 2.000E-003 12 100.00 0.00 9.435E-012 IE-M4-SLOI-IC SLOI Inside of Containment Occurs -M4 1.750E-001 CCW-HTX-CF-ALL COMMON CAUSE FAILURE OF CCW HEAT 1.348E-006 EXCHANGERS OPR-XHE-XM-ALTCOOL OPERATOR FAILS TO ALIGN FIRE WATER COOLING 4.000E-002 TO CCP/SI PUMPS SD-SLOI-DIAG-XHE Operators fail to diagnose small LOI outside of containment 1.000E-003 before loss of SDC 13 100.00 0.00 8.400E-012 IE-M4-SLOI-IC SLOI Inside of Containment Occurs -M4 1.750E-001 Page 83

Cut %  % Prob./ Basic Event Description Event No. Total Cut Frequency Prob.

Set SD-ISOL-EQP-FAILURES FAILURES OF EQUIPMENT TO ISOLATE 1.000E-006 SD-SLOI-FEED-XHE Operator fails to initiate feed before loss of SDC 4.000E-003 SD-SLOI-LTR1-XHE Operators fail to Refill RWST as Part of Long Term 1.200E-002 Recovery 14 100.00 0.00 8.400E-012 IE-M4-SLOI-IC SLOI Inside of Containment Occurs -M4 1.750E-001 HPI-TNK-FC-RWST RWST IS UNAVAILABLE 4.800E-008 SD-SLOI-DIAG-XHE Operators fail to diagnose small LOI outside of containment 1.000E-003 before loss of SDC 15 100.00 0.00 6.834E-012 IE-M4-SLOI-IC SLOI Inside of Containment Occurs -M4 1.750E-001 CVC-ACX-CF-GL12ABS CCF OFCCP MDP ROOM COOLERS TO START 8.875E-005 HPI-SYS-FC-RWSTLLO FAILURE OF RWST LEVEL LO 2/4 INSTRUMENTATION 4.400E-004 (SA)

SD-SLOI-DIAG-XHE Operators fail to diagnose small LOI outside of containment 1.000E-003 before loss of SDC 16 100.00 0.00 4.828E-012 IE-M4-SLOI-IC SLOI Inside of Containment Occurs -M4 1.750E-001 CVC-MDP-CF-START CHARGING PUMPS FAIL FROM COMMON CAUSE TO 6.270E-005 START HPI-SYS-FC-RWSTLLO FAILURE OF RWST LEVEL LO 2/4 INSTRUMENTATION 4.400E-004 (SA)

SD-SLOI-DIAG-XHE Operators fail to diagnose small LOI outside of containment 1.000E-003 before loss of SDC 17 100.00 0.00 4.168E-012 IE-M4-SLOI-IC SLOI Inside of Containment Occurs -M4 1.750E-001 CCW-MDP-CF-RUN CCW PUMPS FAIL FROM COMMON CAUSE TO RUN 2.977E-007 OPR-XHE-XM-ALTCOOL OPERATOR FAILS TO ALIGN FIRE WATER COOLING 4.000E-002 TO CCP/SI PUMPS SD-SLOI-ISOL-BRF-XHE Operator fail to terminate SLOI leak before SDC fails 2.000E-003 18 100.00 0.00 3.511E-012 IE-M4-SLOI-IC SLOI Inside of Containment Occurs -M4 1.750E-001 CVC-MOV-CF-112DE CCF OF CVC SUCTION MOVs CV112D/E 2.280E-005 HPI-SYS-FC-RWSTLLO FAILURE OF RWST LEVEL LO 2/4 INSTRUMENTATION 4.400E-004 (SA)

SD-SLOI-ISOL-BRF-XHE Operator fail to terminate SLOI leak before SDC fails 2.000E-003 19 100.00 0.00 3.511E-012 IE-M4-SLOI-IC SLOI Inside of Containment Occurs -M4 1.750E-001 CVC-MOV-CF-8803AB CCF OF DISCHARGE MOVs 8803A & B TO OPEN 2.280E-005 HPI-SYS-FC-RWSTLLO FAILURE OF RWST LEVEL LO 2/4 INSTRUMENTATION 4.400E-004 (SA)

SD-SLOI-ISOL-BRF-XHE Operator fail to terminate SLOI leak before SDC fails 2.000E-003 20 100.00 0.00 3.511E-012 IE-M4-SLOI-IC SLOI Inside of Containment Occurs -M4 1.750E-001 CVC-MOV-CF-8801AB COMMON CAUSE FAILURE OF DISCHARGE MOVs 2.280E-005 8801A & B HPI-SYS-FC-RWSTLLO FAILURE OF RWST LEVEL LO 2/4 INSTRUMENTATION 4.400E-004 (SA)

SD-SLOI-ISOL-BRF-XHE Operator fail to terminate SLOI leak before SDC fails 2.000E-003 Page 84