Text

Request for Enforcement Discretion from Technical Specification 3.7.8 Required Action A.1, Per Telcon on 10/01/2009
	ML092810226
Person / Time
Site:	Palisades
Issue date:	10/05/2009
From:	Schwarz C; Entergy Nuclear Operations
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
References
	RIS-05-001
	Download: ML092810226 (108)
	v • d • e

Entergy Nuclear Operations, Inc.

",-9-7 t

Palisades Nuclear Plant 27780 Blue Star Memorial Highway Covert, MI 49043 Tel 269 764 2000 Christopher J. Schwarz Site Vice President October 5, 2009 U. S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, DC 20555-0001

SUBJECT:

Request for Enforcement Discretion - Technical Specification 3.7.8 Required Action A.1 Palisades Nuclear Plant Docket 50-255 License No. DPR-20

Dear Sir or Madam:

The letter confirms the results of the teleconference that was conducted between Entergy Nuclear Operations, Inc. (ENO) and the Nuclear Regulatory Commission (NRC) at 1500 EDT, on October 1,2009, in which ENO requested the NRC to exercise enforcement discretion from compliance with the requirements of Technical Specification (TS) 3.7.8 Required Action A.1 for Palisades Nuclear Plant (PNP).

TS 3.7.8, "Service Water System (SWS)," Limiting Condition for Operation 3.7.8 requires two operable SWS trains. TS 3.7.8 Required Action A.1 requires that, with one or more SWS trains inoperable, restore the inoperable trains to operable status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . TS 3.7.8, Required Actions B.1 and B.2 require that, if the required action and associated completion time of Condition A is not met, be in Mode 3 within six hours and in Mode 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months .

At the time of the teleconference on October 1, 2009, PNP was operating at approximately 100% power. On September 29, 2009, at approximately 0908 EDT, three control room alarms unexpectedly annunciated, indicating that standby service water pump P-7B had started, and the critical and non-critical service water header pressures were low. Service water pump P-7C was operating with abnormally low amperage and exhibiting signs of duress, with the pump shaft visibly vibrating and no pump discharge pressure. The pump was immediately secured and PNP entered Technical Specification 3.7.8 Condition A.

-Aoo(

Document Control Desk Page 2 ENO requested enforcement discretion for a period not to exceed 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to complete repairs and post-maintenance testing of service water pump P-7C. The approval of the requested enforcement discretion was effective at 0908 EDT on October 2, 2009, and would expire at 0908 EDT on October 3, 2009.

This request was verbally transmitted to. members of the NRC staff on October 1, 2009, at 1500 EDT. The NRC verbally granted the request on October 1, 2009, at 1900 EDT.

Subsequently, at 0822 EDT on October 2, 2009, service water pump P-7C maintenance activities were completed and the pump was declared operable. PNP exited Required Action A.2 in TS 3.7.8, and the enforcement discretion was no longer needed. provides information documenting ENO's verbal request for enforcement discretion. It provides the information specified in NRC Regulatory Issue Summary 2005-01, "Changes to Notice of Enforcement Discretion (NOED) Process and Staff Guidance," dated February 7, 2005. Attachment 2 provides a risk evaluation of the requested enforcement discretion.

This letter contains no revisions to existing commitments and makes one new commitment:

Ensure risk management actions provided in section four of Attachment 1 are continued for the duration of this enforcement discretion.

A copy of this request has been provided to the designated representative of the State of Michigan.

Sincerely, cJs/jse Attachment(s):

1. Request for Enforcement Discretion

2. Risk Evaluation of Service Water Pump LCO Extension CC Administrator, Region III, USNRC Project Manager, Palisades, USNRC Resident Inspector, Palisades USNRC

ATTACHMENT 1 REQUEST FOR ENFORCEMENT DISCRETION

1.

TECHNICAL SPECIFICATION OR OTHER LICENSE CONDITIONS THAT WILL BE VIOLATED Palisades Nuclear Plant (PNP) Technical Specification (TS) 3.7.8, "Service Water System (SWS)," Limiting Condition for Operation 3.7.8 requires two operable SWS trains.

TS 3.7.8 Required Action A.1 requires that, with one or more SWS trains inoperable, restore the inoperable trains to operable status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

TS 3.7.8, Required Actions B.1 and B.2 require that, if the required action and associated completion time of Condition A is not met, be in Mode 3 within six hours and in Mode 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months .

2.

CIRCUMSTANCES SURROUNDING THE SITUATION, INCLUDING LIKELY CAUSES, THE NEED FOR PROMPT ACTION, ACTION TAKEN IN AN ATTEMPT TO AVOID THE NEED FOR A NOTICE OF ENFORCEMENT DISCRETION (NOED), AND RELEVANT HISTORICAL EVENTS Circumstances Surrounding the Situation At 0908 hours0.0105 days 0.252 hours 0.0015 weeks 3.45494e-4 months on September 29, 2009, with PNP operating at approximately 100%

power and service water pumps P-7A and P-7C in service, the Control Room received alarms for low service water pressure and standby service water pump auto start. An Auxiliary Operator (AO) was dispatched to investigate. The AO found all three service water pumps running, the discharge pressure of P-7C at 0 psig, and significant vibration of the packing shaft of P-7C. The AO recommended that Control Room operators stop P-7C, and the pump was immediately secured. Three operable service water pumps are required per TS 3.7.8. TS 3.7.8 Condition A was entered at 0908 hours0.0105 days 0.252 hours 0.0015 weeks 3.45494e-4 months on September 29, 2009.

Likely Causes Immediately after service water pump P-7C was stopped, the pump was visually inspected. This inspection included all shafts, couplings, pump casings, spiders, bearing areas, suction bell and rotating elements. It was found that the packing gland nuts were not in place on the studs for the packing gland follower and there appeared to be damage to the packing shaft above the packing follower. The upper impeller was inspected with a boroscope with no damage or signs of failure observed. The pump was able to rotate freely. No other damage or signs of failure were immediately apparent.

A plan was developed for disassembly of the P-7C motor and pump for failure determination and repairs. Upon disassembly, the coupling between the packing shaft and Page 1 of 17

the top line shaft was found broken into two pieces. The material of the coupling is 416 stainless steel heat treated to a specified 28-32 Rc (Rockwell Hardness). The failed coupling was sent to an independent metallurgy laboratory for analysis. Per the metallurgists at the laboratory, the fracture surfaces were consistent with brittle fracture due to overload. Per ASTM Standard A582/A 582M - 95b "Standard Specification for Free-Machining Stainless Steel Bars," the hardness of material should be between 24 and 32 Rc (248 to 302 HB (Brinell Hardness)) for an intermediate temper condition. The laboratory found the hardness to be 37 Rc throughout the material. The material was also cut longitudinally and examined under an electron microscope. This examination found precipitates at the grain boundaries, which is not expected for this material. The hardness testing results and the precipitates are indicative of a problem in the heat treat process which caused the material to be susceptible to brittle failure. A review of the Certified Material Test Reports from the pump supplier, Hydro-Aire, shows that the final hardness of the couplings delivered with the pump were within specification. This conflicts with the results from the laboratory.

The catastrophic failure of the coupling was most likely due to brittle fracture in an overload condition. The overload was most likely caused by the stopping and starting of the pump to clear the basket strainers. Approximately 1-1/2 hours before the failure of the pump, service water pump P-7C was stopped and re-started, as were the other two pumps.

All couplings on service water pump P-7C will be replaced to address the material issues. Additionally, the pump packing shaft and motor shaft will be replaced due to excessive runout that was caused by the event.

An inspection of the service water bay was completed and no significant debris was observed that could cause failure of the pump.

The service water pump P-7C check valve was determined to not be a cause of the pump failure based on review by the check valve program engineer. The P-7C check valve is monitored quarterly and check valve operation was found acceptable on its most recent test date of July 23, 2009.

Packing gland bolts on service water pumps P-7A and B were inspected and found to be in satisfactory condition and fully engaged.

Service water pump P-7A is identical to P-7C. Service water pump P-7A was refurbished during the 2009 refueling outage. The P-7A refurbishment included the same stainless steel shafting, coupling, and impeller components as P-7C. The couplings in service water pump P-7A were fabricated in April 2008, thirteen months prior to those fabricated for P-7C. The heat numbers for the two batches of manufactured couplings are different; therefore, it is not credible that the heat treatment problem that caused the failure of the P-7C coupling is related to the couplings installed in P-7A. Service water pump P-7A has operated since May 2009. Service water pump Page 2 of 17

P-7C was refurbished in June 2009. Therefore, P-7A has more operating time than P-7C and has not exhibited any signs of degraded performance.

Service water pump P-7B is a pump of a different vendor than that of P-7A and P-7C. It has similar shafting and coupling dimensional arrangements as P-7A and P-7B, however the shafting and coupling material is carbon steel. P-7B was refurbished in September 2007 during the refueling outage. This refurbishment used carbon steel shafting and couplings (P-7B has not yet been refurbished with the stainless steel.

components that have been implemented in P-7A and P-7C). Therefore, the couplings for P-7B are not subject to the same failure mode as the P-7C pump coupling. P-7B has been operating since the end of the September 2007 refueling outage and has not exhibited any signs of degraded performance.

Need for Prompt Action If operability of service water pump P-7C cannot be restored by 0908 on October 2, 2009, PNP is required to shut down. The expected duration of the outage based on the current schedule, will restore service water pump P-7C within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months of the required completion time for TS 3.7.8 Action A.1. Time is needed to manufacture, transport, and install new couplings. Pump reassembly and post-maintenance testing are also required. The motor was sent to the vendor test facility to verify that it is not damaged.

New couplings are being independently tested prior to installation.

Action Taken in an Attempt to Avoid the Need for an NOED Service water pump P-7C was declared inoperable on September 29, 2009, at 0908 EDT. PNP entered into augmented, around the clock staffing for multiple departments to establish and execute an expedited repair schedule. Work activities were initiated promptly to determine the cause of the problem, extent of condition, and required repairs. Visual inspections of pump components were performed, which included inspections of shafts, couplings, pump casings, spiders, bearing areas, suction bell and rotating elements. Actions were taken to identify parts and other contingencies. PNP is working with vendors to secure parts and to restore the pump. Discrepancies discovered in the hardness of the material of the failed coupling has resulted in independent verification of hardness testing or replacement couplings. Management is stationed at the vendor facility overseeing part fabrication. Pump reassembly has started and will be completed upon receipt of parts from the vendor. The remaining work activities have been identified and scheduled. The PNP event response includes frequent alignment meetings to ensure the actions are progressing as planned and that additional support is provided when needed. Management oversight ensures proper priorities are established and resources are provided. Management is providing around the clock oversight of maintenance activities. These actions ensure the pump will be restored expeditiously.

Page 3 of 17

Relevant Historical Events At Indian Point, on August 10, 1993, and on August 9, 1993, a shaft coupling sheared due to impact from a foreign object; the coupling material was ASTM A276 Type 410 SST. At Indian Point, on September 22, 1993, a shaft coupling sheared due to high loads during start caused by a leaking discharge check valve; the coupling material was ASTM A276 Type 410 SST. Both Indian Point events involved pumps from a different vendor.

Service water pump P-7A was replaced in April 2009 during a refueling outage as routine, periodic replacement. Service water pump P-7C was replaced on-line in June 2009 due to degraded performance as a result of ingested foreign material. Neither of these pumps replacements involved failed couplings. During the replacements, the pumps were inspected in accordance with plant procedures.

3.

INFORMATION TO SHOW THAT CAUSE AND PROPOSED PATH TO RESOLVE THE SITUATION ARE UNDERSTOOD, SUCH THAT THERE IS A HIGH LIKELIHOOD THAT PLANNED ACTIONS TO RESOLVE THE SITUATION CAN BE COMPLETED WITHIN THE PROPOSED NOED TIME FRAME The hardness testing results and the precipitates are indicative of a problem in the heat treat process which caused the material to be susceptible to brittle failure.

The likely cause of improper heat treatment causing the coupling material to be susceptible to brittle failure was determined by a failure modes and effects evaluation.

PNP is confident that the cause is understood based on on-site visual inspections of the pump and metallurgy laboratory examinations and analyses of the failed coupling.

The planned repairs to the pump are limited and consistent with normal work practices.

The repairs are expected to resolve the situation because the identified deficiencies will be corrected during the reinstallation. Management is stationed at the vendor facility overseeing part fabrication. Additional supervisory oversight of the reinstallation will provide greater assurance that the repairs are performed correctly. The schedule for repairs and subsequent post-maintenance testing was established based on previous experience with similar repairs. The replacement of the damaged coupling can be completed with normal work practices and parts. New couplings are being independently tested prior to installation. Pump shafts and other components 'are being inspected as well. The motor was sent to the motor vendor test facility to verify that is not damaged.

Based on the information above, the proposed NOED time frame of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months provides sufficient time to complete the planned actions.

Page 4 of 17

4.

SAFETY BASIS FOR THE REQUEST, INCLUDING AN EVALUATION OF THE SAFETY SIGNIFICANCE AND POTENTIAL CONSEQUENCES OF THE PROPOSED COURSE OF ACTION

a. Risk Assessment Using the Zero Maintenance Model PNP has evaluated the request for enforcement discretion from a probabilistic risk standpoint (Attachment 2). This assessment considered the expected plant configuration during the period of enforcement discretion and determined that it does not involve an unacceptable increase in risk. The risk of continued PNP operation with an inoperable service water pump during a 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months period of noncompliance beyond the TS 72-hour completion time, as measured by the incremental conditional core damage probability (ICCDP) is 8.16E-8 for a plant internal event. This is below the guidance threshold of less than or equal to 5E-07 identified in NRC Inspection Manual Part 9900. The ICCDP for seismic, fire, and flood external events is bounded by the ICCDP for internal events, and, therefore, also meets the guidance threshold. The results bound the proposed 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months period of noncompliance.

At PNP, core damage sequences involving a large, early release generally are those that bypass containment (i.e., those that involve steam generator tube rupture (SGTR) and intersystem loss-of-coolant accident initiating events). The incremental conditional large early release probability (ICLERP) was determined to be 7.7E-12.

This is below the guidance threshold of less than or equal to 5E-08 identified in NRC Inspection Manual Part 9900.

b. Discussion of the Dominant Risk Contributors A review of the change to the cutsets contributing to core damage as a result of the changes made to represent the removal of service water pump P-7C from service determined that there were no changes to the top 100 cutsets. A review of the changed cutsets contributing to core damage as a result of the changes made to the initiating event frequency for a loss of service water initiating event are discussed below.

The top 100 cutsets represent approximately 83% of the increased core damage probability. Thirteen cutsets showing an increased contribution to core damage are described below. The top 100 cutsets are listed in Attachment 1. Eighty seven out of one hundred of the listed cutsets did not change.

Cutset 1 Loss of Service Water (Sequence 22-2)

Cutset 1 is the same cutset as the baseline (0 maintenance) case with an increased contribution to core damage as it is the result of a loss of service water initiating event. The cutset represents a loss of primary coolant pump seal cooling and the failure to trip the primary coolant pump(s) in time to prevent seal failure that results Page 5 of 17

in a loss of coolant accident. The loss of service water fails injection pumps due to loss of cooling and containment heat removal.

Cutset 4 Loss of Service Water (Sequence 21-5)

This cutset represents a loss of service water. The loss of service water results a in loss of primary coolant pump seal cooling, and a consequential seal LOCA due to failure to trip the primary coolant pumps. The loss of service water fails injection pumps due to loss of cooling and containment heat removal.

Cutset 9 Loss of Service Water (Sequence 17)

This cutset represents a loss of service water event with a failure of secondary heat removal via the steam generator, successful initiation of once through cooling and failure of the containment heat removal, failure of main feedwater and low pressure feed (feeding steam generators with condensate pumps) due to loss of condenser vacuum, and failure of containment sprays and containment air coolers as a result of the loss of service water cooling to remove heat from the systems.

Cutset 19 Loss of Service Water (Sequence 17)

This cutset is similar to cutset 9 above, with the difference being the failure of auxiliary feedwater due to common cause failure of all the pump discharge check valves. The remainder of the cutset is the same as cutset 9.

Cutset 21 Loss of Service Water (Sequence 5)

Cutset 21 is also similar to cutsets 9 and 19. The difference in this cutset is that the failure of auxiliary feedwater is a long term failure to provide an alternate suction source to the auxiliary feedwater pumps. Failure of normal makeup to the condensate storage tank (T-2) is due to failure of the demineralized water transfer pump (P-936) to provide makeup from demineralized water storage tank (T-939).

Operators would be aware of the failure of normal makeup when a low level alarm occurs at 73% level in the condensate storage tank. The operator would then have several hours to align an alternate source to the auxiliary feedwater pumps. This cutset includes failure of an operator action to align service water to pumps to auxiliary feedwater P-8A or P-8B OR fire protection water to auxiliary feedwater pump P-8C. This cutset does not credit the availability of water from primary system makeup storage tank (T-81) via pumped or gravity feed, which would provide additional time to align other water sources.

Cutset 23 Loss of Service Water (Sequence 17)

This cutset is similar to cutsets 9 and 19 above, with the difference being the failure of auxiliary feedwater due to common cause failure of all the check valves in the Page 6 of 17

flow headers from the pump trains to the steam generators. The remainder of the cutset is the same as cutsets 9 and 19.

Cutset 28 Loss of Service Water (Sequence 17)

This cutset is similar to cutsets 9 and 19 above, with the difference being the failure of auxiliary feedwater due to common cause failure of all four flow control valves in the flow headers from the pump trains to the steam generators. The remainder of the cutset is the same as cutsets 9 and 19.

Cutset 35 Loss of Service Water (Sequence 17)

This cutset is similar to cutsets 9 and 19 above, with the difference being the failure of auxiliary feedwater due to spurious low suction trips of auxiliary feedwater pumps P-8A and P-8C, and failure of the turbine-driven auxiliary feedwater pump P-8B.

The remainder of the cutset is the same as cutsets 9 and 19.

Cutset 36 Loss of Service Water (Sequence 5)

Cutset 36 is similar to cutset 21 above. Loss of normal makeup from the demineralized water storage tank (T-939) is due to failure of the demineralized water transfer pump (P-936). The difference between this cutset and cutset 21, is that the long term failure is the failure of another operator action related to the alignment of an alternate suction source to the auxiliary feedwater pumps after the contents of the condensate storage tank (T-2) have been depleted.

Cutset 37 Loss of Service Water (Sequence 17)

This cutset is similar to cutsets 9 and 19 above, with the difference being the failure of auxiliary feedwater due to common cause failure of all three auxiliary feedwater pumps to run for the mission time (24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ). The remainder of the cutset is the same as cutsets 9 and 19.

Cutset 49 Loss of Service Water (Sequence 5)

Cutset 49 is similar to cutsets 21 and 36 above. Loss of normal makeup from the demineralized water storage tank (T-939) is due to failure of the condensate storage tank makeup CV-2010 to automatically open, and loss of flow from the demineralized water storage tank (T-939) to the condensate storage tank (T-2).

Additionally, the cutset includes failure of the operator to align an alternate suction source to the operating auxiliary feedwater pump.

Cutset 60 Loss of Service Water (Sequence 5)

Cutset 60 is also similar to cutsets 21 and 36 above. In this cutset, the loss of normal makeup from the demineralized water storage tank (T-939) is due to loss of Page 7 of 17

the air supply (filter plugging) to the condensate storage tank makeup valve CV-2010. The cutset includes the failure of the operator to align an alternate suction source to the operating auxiliary feedwater pump.

Cutset 62 Loss of Service Water (Sequence 5)

Cutset 62 is also similar to cutsets 21 and 36 above. In this cutset, the loss of normal makeup from the demineralized water storage tank (T-939) is due to failure of the transfer pump (P-936). The cutset includes the failure of the operator to align an alternate suction source to the operating auxiliary feedwater pump.

Cutset 69 Loss of Service Water (Sequence 5)

Cutset 69 is also similar to cutsets 21 and 36 above. In this cutset the loss of normal makeup from the demineralized water storage tank (T-939) is due to failure of the transfer pump (P-936). The long term failure of the alignment of service water or fire protection water to the auxiliary feedwater pump suction is due to failure of one of the manual valves MV-FW775 required to align fire protection water to pump P-8C (service water to pumps P-8A and P-8B is failed by the initiator).

Cutset 70 Loss of Service Water (Sequence 5)

Cutset 70 is also similar to cutsets 21 and 36 above. In this cutset, the loss of normal makeup from the demineralized water storage tank (T-939) is due to failure of the transfer pump (P-936). The long term failure of the alignment of service water or fire protection water to the auxiliary feedwater pump suction is due to failure of one of the manual valves (MV-FW774) required to align fire protection water to pump P-8C (service water to pumps P-8A and P-8B is failed by the initiator).

Cutset 75 Loss of Service Water (Sequence 5)

Cutset 75 is also similar to cutset 21 and 36 (see above). In this cutset, the loss of normal makeup from the demineralized water storage tank (T-939) is due to loss of the air supply (filter plugging) to the control valve (CV-2010). The cutset includes the failure of the operator to align an alternate suction source to the operating auxiliary feedwater pump.

c. Discussion of the Compensatory Measures Implemented to Address the Dominant Risk Factors In order to minimize risk during the period of noncompliance, PNP has identified additional controls to increase operator awareness of critical equipment, provide assurance that assumptions in the risk model are maintained, and minimize the Page 8 of 17

likelihood of a plant transient. PNP proposes the following actions during the period of enforcement discretion to manage risk:

1) No non-essential work will be allowed that could potentially jeopardize stable plant operation.

2) PNP has designated the following equipment as "Protected Equipment" and control the protected equipment in accordance with the applicable procedure during the extended TS action completion time:

service water pump P-7A

service water pump P-7B a electric fire water pump P-9A

diesel fire water pump P-9B

diesel fire water pump P-41 containment spray pumps P-54B and C

emergency diesel generator 1-1

component cooling water pump P-52A

component cooling water pump P-52B 2400 VAC safeguards bus 1C auxiliary feedwater pumps P-8A and B

screen wash pump P-4 traveling screens F-4B and C traveling screens control panel supplemental emergency diesel generator 1-3 Safeguards bus room traveling screen F-4C breaker 52-563 traveling screen F-4B breaker 52-561 screen wash pump P-4 breaker 52-1406 switchyard

3) PNP is conducting hourly monitoring of critical service water header pressure, service water pump amperage, and lake (ultimate heat sink) temperature.

4) PNP is monitoring the following components every two hours:

a. service water pump P-7A and B

b. traveling screens F-4B and C

c. screen wash pump P-4

d. fire water pumps P-9A and B

e. diesel fire water pump P-41

f. service water pumps P-7A and B basket strainer differential pressure

5) The plant operations crews have been briefed on these risk management measures.

Page 9 of 17

6) Guidance was developed for cycling service water pump P-7A and B in the event of increasing basket strainer differential pressure to reduce this pressure.

7) Operators have been briefed on a loss of service water (Off Normal Procedure 6.1, "Loss of Service Water").

8) Operators have been briefed on service water leak and increased flow scenarios.

9) Fire tours have been established in the screen house and the 1C switchgear room.

d.

Demonstration of how the Proposed Compensatory Measures are Accounted for in the PRA The benefit of the compensatory actions in general is in protecting equipment and not allowing test and maintenance activities on those components during the period of enforcement discretion. Since the process requires that the analyses be completed using a zero maintenance condition for the baseline risk, the benefits of protecting equipment is not quantifiable. A separate analysis was conducted of the change in risk for the cases analyzed to support the NOED using the normal maintenance baseline of the model. Using this baseline for risk and changing the events in the model for out of service conditions for protected components to zero (FALSE) demonstrated that, for the case of removing pump P-7C from service, the risk was returned to nominal baseline risk. That is, implementation of the contingencies offset the risk increase of the pump out of service. For the case of increasing the initiating event frequency for a loss of service water event, it was assumed that the compensatory measures would result in a smaller increase in the initiating event frequency. An increase of a factor of two versus the order of magnitude increase was used. This resulted in an overall reduction of the change in risk by approximately 53% (changed from 8.OE-08 to 4.24E-08) for an extension of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . The same factor would be applicable to any extended period.

e.

Extent of Condition Subsequent sensitivity analyses were performed to assess the potential for an increase in the probability of failure of the service water pump P-7A or B as a result of a potential common cause contributor. The sensitivity analysis was completed by increasing the probability of the common cause failure of the operating service water pumps by a factor ten. The results of the sensitivity analysis indicated that increasing the probability of failure of the pump resulted in no significant change to core damage frequency calculated for any of the cases analyzed. The incremental core damage probability increased from 8.OE-08 to 8.16E-08. The event contribution of the increased common cause term is 0.04%. The contribution of the Page 10 of 17

increased initiating event frequency for loss of service water increased to 87.8%.

Clearly, the increased loss of service water initiator dominates the risk increase.

f.

External Event Risk Seismic Events In the PNP IPEEE (Individual Plant Examination of External Events) (References 2.2.17 and 2.2.18) a seismic risk assessment was used to assess risks due to seismic events. The risk assessment was a hybrid of the conventional PSA and seismic margins analysis.

The service water system modeling used in the external events analysis is the same model used for internal events analysis. The same system success criteria Were also used. The component random failure rates that were used in the IPE (Individual Plant Examination of Internal Events) (Reference 2.2.16) were also used in the SPRA (Seismic Probabilistic Risk Assessment). No adjustments to these probabilities were made. The seismic impact on these components was assessed by including seismic basic events and fragilities. The component fragilities that were identified in Section 3.5.2 of the IPEEE reports were used in the SPRA. The fragilities were input as a median capacity with a lognormal standard deviation (beta), which defined a lognormal fragility curve.

In addition to the seismic basic events, the seismic fault trees were modified to include seismically induced initiating events. The four seismic event tree headings that are seismically induced initiating events are: TBFR (Turbine Building Fire);

TBFL (Turbine Building Flood); LOOP (Loss of Offsite Power); and SBL (Small Break Loss of Coolant Accident). All events that are affected by a turbine building fire have an associated basic event of TBFR. All basic events that are affected-by a turbine building flood have an associated basic event of TBFL. The affected off site power related equipment received an associated basic event of LOOP. The initiating event SBLOCA (Small Break Loss of Coolant Accident) was given to all sequences that were quantified by the SBLOCA event tree and was not included in the fault tree as a basic event.

The seismic analysis has not been updated since originally developed for the Individual Plant Examination of External Events (IPEEE) submittal. A review of the results of the IPEEE submittal indicated that the core damage frequency was 8.88E-06 with a high confidence low probability of failure (HCLPF) of 0.217g PGA (peak ground acceleration). There were no specific seismic events identified as dominant contributors to the core damage frequency. Important seismic induced failures identified were: the fire protection system, main steam isolation valves, diesel generator fuel oil supply, and an undervoltage relay for 2400 volt ac Bus 1 D.

Several important random failures were identified in the report as important because of their contribution in combination with seismically induced failures. The important random failures (not seismically induced) identified in the report were: emergency Page 11 of 17

diesel generator 1-2, auxiliary feedwater (AFW) pump P-8C, and the atmospheric dump valves.

The service water system was determined to be seismically rugged and there were no significant contributions of the service water system to core damage resulting from seismically induced failures. Random failures of the service water system were identified as important contributors as a consequence of seismically induced failure of other system components as discussed below.

As noted, the fire protection system is an important contributor to seismic analysis due to the probability of seismically induced failure of fire protection system components and the condensate storage tank (CST). Seismically induced failure of the CST results in an earlier need for alignment of an alternate suction source for the operating AFW pump. The fire protection system provides an alternate suction source to AFW pumps P-8A and P-8B. The seismically induced failures of the fire protection system result in long term failure of AFW pumps P-8A and P-8B due to the unavailability of a suction source. These failures result in an increased importance of the random failures of the pump P-8C train to provide successful heat removal after depletion of the CST inventory. The same conditions result in an increased importance of the random probability of failure of the service water system to support operation of pump P-8C.

Auxiliary feedwater pump P-8C is important to long term makeup to the steam generators should the fire system become unavailable following a seismic event (as discussed in the results for Accident Classes IA & IB, Section 3.6.5.3.1 of the IPEEE report). The fire protection system has a low fragility and is a significant contributor to seismic risk once the contents of the condensate storage tank (T-2) are depleted and a long term suction source is required for continued operation of the AFW pumps. The seismically induced failure of the fire protection system represents a higher probability of failure of the long term suction to motor-driven AFW pump P-8A and turbine-driven AFW pump P-8B after the depletion of the available tank T-2 inventory. This increased probability of failure of heat removal via the AFW P-8A and P-8B pump trains results in an increased importance of motor-driven auxiliary feedwater pump P-8C. The importance of pump P-8C is a consequence of the fact that service water (a much more seismically rugged system) is more likely to remnain available as a long term suction source to pump P-8C.

Auxiliary feedwater flow requirements in the PRA are 165 gpm to either steam generator. These flow requirements are a small fraction (<2%) of the total flow (8000 gpm) from a single service water pump. At the time of condensate storage tank depletion, the flow requirements will be lower. Therefore, the PRA model assumes no additional service water pumps are required to be placed in service to provide a suction source for the AFW pumps.

Page 12 of 17

For the condition stated, either service water flow to the non-critical header or service water flow to the critical loads in containment not isolated and providing AFW suction, two SW pumps would be required.

The contribution to core damage from seismic events determined in the IPEEE was 8.88E-06. This represents approximately 13% of the total core damage frequency from the current internal events analysis (2.49E-05), fire (3.3.1 E-05), flooding

(-<2E-07) and seismic (8.88E-06). Therefore the expected seismic contribution is bounded by the internal events core damage assessment.

Fire Events The PNP fire analysis used an approach that combined the deterministic evaluation techniques from the Electric Power Research Institute' (EPRI) Fire-Induced Vulnerability Evaluation (FIVE) methodology with classical PRA techniques. The FIVE methodology was used to establish fire boundaries and to evaluate the probability and the timing of damage to components located in a fire area/zone involved in a fire. Based on the results from implementing the FIVE methodology, PRA techniques were then employed to determine the probability of core damage associated with fires within the identified fire areas/zones. Fire areas identified by the fire protection program were used as the basis of the fire areas evaluated by the fire risk analysis. These fire areas were evaluated for further division based on combustible loading and fire-spread potential to identify fire zones within fire areas.

The fire areas/zones identified were evaluated and quantified using the fault trees and transient event tree from the IPE. The fault and event trees were modified to accurately reflect the fire analysis.

The core damage frequency contribution from internal fires for PNP is 3.31 E-05/yr. The dominant contribution to the fire CDF (>89%) is related to five fire areas: cable spreading room (33.5%); main control room (24.4%); 1 D switchgear room (14.7%); turbine building (9.3%); and 1C switchgear room (7.6%).

The principle finding of the fire analysis was that there is no area in the plant in which a fire would lead directly to the inability to cool the core. Without additional random equipment failures (unrelated to damage caused by the fire) or human errors, core damage will not occur. As a result, the study concluded that there are no major vulnerabilities due to fire events at PNP. This is primarily due to the fact that the damage in the important fire areas was to support systems (e.g. ac power or dc power) that resulted in the loss of one division of equipment with adequate equipment unaffected on the other division. During the service water pump P-7C repair, an operable service water pump will remain available on each division.

Flooding and Other Events Other external events (high winds, external floods, transportation, etc.) were screened by demonstrating conformance to the 1975 Standard Review Plan using Page 13 of 17

prior evaluations completed during the Systematic Evaluation Program (SEP) or demonstrating low hazard frequency for aircraft hazards. There were no significant contributors to core damage frequency from other external events (other than seismic and fire) identified.

g. Forecasted Weather Conditions Based on information obtained by operations there were no significant adverse weather conditions forecasted for the proposed period of this NOED. Therefore, there were no plant vulnerabilities indentified related to weather conditions.

Compensatory measures identified to protect equipment during the period of the NOED are considered adequate based on the anticipated weather conditions.

Based on the risk analysis and the proposed compensatory measures, PNP concludes there is no increase in radiological risk to the public.

5.

JUSTIFICATION FOR THE DURATION OF THE NONCOMPLIANCE PNP requests that the NRC exercise discretion to not enforce compliance with TS 3.7.8, Required Action A.1, to allow for restoration of the service water pump P-7C to operable status. The duration of the noncompliance is limited to the time required to complete the necessary restoration activities. The restoration activities include:

Manufacturing of replacement couplings and transportation of couplings to PLP.

Completing maintenance activities to place service water pump P-7C back in service.

Performing post-maintenance testing.

Completing the operability review.

The enforcement discretion would be in effect until service water pump P-7C is restored to operable status or the 24-hour noncompliance period ends, whichever occurs first.

Page 14 of 17

6.

CONDITION AND OPERATIONS STATUS OF THE PLANT, INCLUDING SAFETY-RELATED EQUIPMENT THAT IS OUT OF SERVICE OR OTHERWISE INOPERABLE PNP is currently at 100% power. Equipment out of service includes:

service water pump P-7C o RIA-2320 steam generator vent monitor E/U-294 ultra-violet smoke detector The service water pump is safety-related. The other equipment is not safety-related.

The information presented in section four reflects the unavailability of service water pump P-7C.

7.

STATUS AND POTENTIAL CHALLENGES TO OFF-SITE AND ON-SITE POWER SOURCES Diesel generators 1-1 and 1-2 are operable and available to the safeguards busses and two qualified circuits between the offsite network and the onsite Class 1 -E AC electrical power distribution system are operable. Supplemental emergency diesel generator 1-3 is operable and available.

Electrical system stability was verified by the following: the 345 kV bus voltages are normal and stable; system frequency is normal and stable; and all 345 kV system line currents are normal. This will continue to be monitored.

8.

BASIS FOR DETERMINING THAT THE NONCOMPLIANCE WILL NOT BE OF POTENTIAL DETRIMENT TO THE PUBLIC HEALTH AND SAFETY The proposed period of noncompliance will not be detrimental to public health and safety. PNP has evaluated the risk and determined it is sufficiently low. A summary of the evaluation is provided as part of item four, above. To further protect health and safety of the public, a number of risk management actions have been taken to increase operator awareness of critical equipment, to provide assurance that assumptions in the risk model are maintained, and to minimize the likelihood of a transient for the duration of the noncompliance.

9.

BASIS FOR CONCLUDING THAT THE NONCOMPLIANCE WILL NOT INVOLVE ADVERSE CONSEQUENCES TO THE ENVIRONMENT Although the proposed action involves noncompliance with a requirement of the TS,

1. There is no significant change in the types or significant increase in the amounts of any effluent that may be released offsite. The proposed action does not affect the Page 15 of 17

generation of any radioactive effluent, nor does it affect any of the permitted release paths; and

2. There is no significant increase in individual or cumulative occupational radiation exposure. The proposed action would not significantly affect plant radiation levels, and, therefore, would not significantly affect dose rates and occupational exposure; and

3. There are no significant nonradiological environmental consequences.

Therefore, PNP has concluded that the proposed action will not involve adverse consequences to the environment.

10. ONSITE SAFETY COMMITTEE REVIEW COMMITTEE REVIEW APPROVAL This request was approved by the onsite safety review committee.

11.

WHICH NOED CRITERION FOR APPROPRIATE PLANT CONDITIONS IS SATISFIED AND HOW IT IS SATISFIED PNP has evaluated the requested enforcement discretion against the criteria specified in section B of NRC Inspection Manual, Part 9900: "Operations - Notices of Enforcement Discretion [NOED]," issued February 7, 2005, and in NRC Regulatory Issue Summary 2005-01, "Changes to Notice of Enforcement Discretion (NOED)

Process and Staff Guidance," also dated February 7, 2005.

Section B of NRC Inspection Manual, Part 9900, states, "for an operating plant, the NOED is intended to (a) avoid unnecessary transients as a result of compliance with the license condition and, thus, minimize the potential safety consequences and operational risks, or (b) avoid testing, inspection, or system realignment that is inappropriate for the particular plant conditions."

The NOED criteria in section 2.1.1(a) for an operating plant are satisfied. PNP is operating at approximately 100% power. Compliance with TS 3.7.8 would. initiate an unnecessary transient by requiring the plant to initiate a shutdown on October 2, 2009. The proposed action would allow continued plant operation to perform the required repair and testing. Granting the NOED will preclude the operational risk associated with a transient during the shutdown. No corresponding health and safety benefit is gained by requiring a plant shutdown. Based on the above, the criteria are satisfied.

Page 16 of 17

12. FOLLOW-UP LICENSE AMENDMENT A follow-up license amendment will not be submitted.

13. SEVERE WEATHER OR OTHER NATURAL PHENOMENA The proposed enforcement discretion does not involve severe weather or other natural events.

14. OTHER INFORMATION The service water system (SWS) provides a heat sink for the removal of process and operating heat from safety related components during a design basis accident (DBA) or transient. During normal operation or a normal shutdown, the SWS also provides this function for various safety related and non-safety related components.

PNP has three service water pumps, which are designated as P-7A, P-7B and P-7C.

The service water pumps are 50-percent capacity, electric motor driven pumps, connected in parallel. The service water pumps take suction from a common intake structure supplied by Lake Michigan. The motors for P-7A and P-7C are connected to one 2.4 kV bus and the motor for P-7B is connected to a separate 2.4 kV bus. The discharge of the pumps flows into a common header before splitting into three headers, two critical headers for safety-related equipment and one non-critical header for non-safety related equipment.

There are two SWS trains, each associated with a safeguards electrical train. The SWS train associated with the left safeguards train consists of one service water pump, P-7B, associated piping, valves, and controls for the equipment to perform their safety function. The SWS train associated with the right safeguards train consists of two service water pumps, P-7A and P-7C, associated piping, valves, and controls for the equipment to perform its safety function.

Page 17 of 17

ATTACHMENT 2 RISK EVALUATION OF SERVICE WATER PUMP LCO EXTENSION 88 Pages Follow

LTR-PSA-09-04 October 1, 2009 Rev 1 To: Bob VanWagner

Subject:

Evaluatio e.f SeryiVaterP.Pn p (P-7C) LCO Extension Request Prepared By:

r k Ya rogan Reviewed By: Brian Brogan V2ý'-,-

l)

,9//0,9.

INTRODUCTION/OBJECTIVE The purpose of this assessment is to evaluate the safety significance of extending the service water pump P-7C Allowed Outage Time (AOT). As noted in the Palisades Technical Specifications (TS) the limiting condition for operation (LCO) for P-7C is 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . Revision 1 of this evaluation addresses a common cause sensitivity analysis between P-7A and P-71.

The objective of the PRA analysis is to provide the safety basis for an NOED request, which includes an evaluation of the safety significance and potential consequences of the proposed course of action. The results from this evaluation are an input to an NOED which is prepared by the site's Regulatory Affairs department.

Pg 1 of 23

LTR-PSA-09-04 October 1, 2009 Rev 1 TABLE OF CONTENTS

1.0 BACKGROUND

3 1.1 CONDITION REPORT (CR-PLP-2009-04519) 3

1.2 INTRODUCTION

/OBJECTIVE 3

2.0 ANALYSIS INPUT/REFERENCES 3

2.1 INPUT 3

2.2 REFERENCES

5 3.0 DEFINITIONS/ACRONYMNS 5

4.0 ASSUMPTIONS 7

4.1 MAJOR ASSUMPTIONS 7

4.2 MINOR ASSUMPTIONS 7

5.0 METHODOLOGY 8

6.0 ANALYSIS 8

6.1 VALIDATION OF THE CURRENT MODEL OF RECORD (PSAR2c) 8 6.2 MAINTENANCE CONDITION 8

6.3 LOSS OF OFFSITE POWER, PLANT AND SWITCHYARD CENTERED MAINTENANCE 9

CONSIDERATIONS 6.4 INTERNAL EVENT CUTSET REVIEW 9

6.5 LARGE EARLY RELEASE FREQUENCY (LERF) 12 7.0 RESULTS 13 7.1 INTERNAL EVENT INCREMENTAL CONDITION CORE DAMAGE PROBABILITY 13 (ICCDP) 7.2 INTERNAL EVENT INCREMENTAL CONDITION LARGE EARLY RELEASE 15 PROBABILITY (ICLERP) 7.3 EXTERNAL EVENTS - SEISMIC 18 7.4 EXTERNAL EVENTS - FIRE 18 7.5 EXTERNAL EVENTS - FLOODING AND OTHER 18 7.6 UNCERTAINTY EVALUATION 19 7.7 REG GUIDE 1.200 GAP ANALSIS 20

8.0 CONCLUSION

S 22 Attachment A - SAPHIRE CDF Change Set Data and Results Attachment B - Top 100 Cutsets Attachment C - SAPHIRE LERF Change Set Data and Results Attachment D - Uncertainty Evaluation Pg,2 of 23

LTR-PSA-09-04 October 1, 2009 Rev 1

1.0 BACKGROUND

1.1 CONDITION REPORT (CR-PLP-2009-04519)

At 09:08 hours on 09/29/2009 (all times local) the following alarms annunciated in the control room.

EK-1 149, SERVICE WATER PUMPS STANDBY PUMP RUNNING, EK-1163, CRITICAL SERV WATER HEADER 'B' LO PRESSURE, EK-1 164, CRITICAL SERV WATER HEADER 'A' LO PRESSURE, and EK-1 165, NONCRITICAL SERVICE WATER LOW PRESSURE.

Service water pump P-7B started in Standby. Service water pump P-7C was operating with 31 amps (normally greater than 80) and local indication of duress (shaft visibly vibrating with no discharge pressure). Pump P-7C was secured. At the beginning of shift, service water pumps P-7A and P-7C were in service with basket strainer differential pressures at 6 psid and 5 psid respectively. The operating crew rotated the operating service water pumps leaving pumps P-7A and P-7C in-service. Final basket strainer differential pressures were: P-7A at 4 psid, P-7B at 3.5 psid and P-7C at 3.5 psid.

Service Water Header Pressure rose 2.3 psi.

The operating crew entered ONP-6.1, "Loss of Service Water" and Technical Specification LCO 3.7.8 (72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months ). There was no Emergency Plan impact and the event was not reportable.

1.2 Introduction/OBJECTIVE The purpose of this assessment is to evaluate the safety significance of extending the service water pump P-7C Allowed Outage Time (AOT). As noted in the Palisades Technical Specifications (TS) the limiting condition for operation (LCO) for service water pump P-7C is 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

The objective of this PRA analysis is to provide the safety basis for an NOED request, which includes an evaluation of the safety significance and potential consequences of the proposed course of action. The results from this evaluation are an input to an NOED which is prepared by the site's Regulatory Affairs department.

2.0 ANALYSIS INPUT/REFERENCES 2.1 INPUT 2.1.1 SAPHIRE Codes - executables (*.exe files) can be found in the "J:\\Engineering\\Engprgm\\RelEng\\PSA\\SAPHIRE" folder on the Palisades intranet.

Table 2.1-1 lists the file specifics.

Table 2.1.1 (Reference 2.2.5)

Filename Date Time Size SAPHIRE-7-26-866621894.exe 10/24/2005 3:45p 14,079 KB 2.1.2 Table 2.1.2 below lists the baseline CAFTA files. This baseline CAFTA model (Reference 2.2.1) serves as the starting point of the core damage fault tree model update documented in this analysis.

Pg 3 of 23

LTR-PSA-09-04 October 1, 2009 Rev 1 Table 2.1.2 Filename Description Date Time Size - KB PSAR2c.be PSAR2c CAFTA Basic Event File 6/26/2006 1:42p 1,248 PSAR2c.caf PSAR2c CAFTA Fault Tree File 6/26/2006 1:36p 449 PSAR2c.gt PSAR2c CAFTA Gate Type File 6/24/2006 1:31 p 1,024 PSAR2c.tc PSAR2c CAFTA Type Code File 5/27/2004 9:03a 30 PSAR2c CAFTA Files.zip PSAR2c CAFTA zip file 6/29/2006 8:47a 289 2.1.3 Table 2.1.3 lists the PSAR2c SAPHIRE project file (Reference 2.2.1) used as the initial data set for this analysis.

Table 2.1.3 Filename Date Time Size - KB Description Caf2Sap PSAR2c.txt 6/29/2006 8:59a 11 Text rules file used by caf2sap.exe to create MAR-D files.

caf2sap.exe 3/24/2003 8:16a 28 Visual basic application for creating SAPHIRE MAR-D fault tree files.

Creation of Rules File PSAR2c.xls 6/26/2006 2:42p 2,162 EXCEL spreadsheet that creates the

.txt rules file for SAPHIRE MAR-D fault tree assembly.

PSAR2c F-Tree Logic.ftl 6/29/2006 9:16a 3,421 MAR-D fault tree file created from the PSAR2c CAFTA master fault tree.

SAPHIRE v7.26 PSAR2c Ftree 6/29/2006 9:43a 1,099 Above listed supporting files.

Files.zip 2.1.4 Table 2.1.4 defines the House Event configuration used in this evaluation:

Table 2.1.4 House Event House Event A-HSE-CST-MAKEUP F I-HSE-M2LEFT-INS T

C-HSE-P-52A-STBY T I-HSE-M2RGHT-INS F

C-HSE-P-52B-STBY T M-HSE-P-2A-TRIP T

C-HSE-P-52C-STBY F M-HSE-P-2B-TRIP F

D-HSE-CHGRI-INS T M-HSE-SJAE1-INS T

D-HSE-CHGR2-1NS T M-HSE-SJAE2-1NS F

D-HSE-CHGR3-1NS F U-HSE-P-7A-STBY F

D-HSE-CHGR4-1NS F U-HSE-P-7B-STBY F

E-HSE-AIR-GT-75F T U-HSE-P-7C-STBY T

E-HSE-AIR-LT-75F F X-HSE-2SG-BLDN 1

E-HSE-BYPASS-REG T X-HSE-2SG-BLDN-A 1

E-HSE-EDG11-DEM T X-HSE-2SG-BLDN-B 1

E-HSE-EDG11-RUN T X-HSE-SGA-BLDN 1

E-HSE-EDG12-DEM T X-HSE-SGB-BLDN 1

E-HSE-EDG12-RUN T Y-HSE-LOOP1A-BRK T

I-HSE-C-2AC-INS T Y-HSE-LOOP1B-BRK F

I-HSE-C-2B-INS F Y-HSE-LOOP2A-BRK F

I-HSE-F-12A-INS T Y-HSE-LOOP2B-BRK F

I-HSE-F-12B-INS F Y-HSE-RAS-POST F

I-HSE-F-5A-INS T Y-HSE-RAS-PRE F

i-HSE-F-5B-INS F X-HSE-DOOR-167B T

X-HSE-DOOR-167 T1 Pg 4 of 23

LTR-PSA-09-04 October 1, 2009 Rev 1 NOTE: The configuration for service water pumps in service was change to match the current plant configuration.

2.2 REFERENCES

2.2.1 EA-PSA-PSAR2c-06-10 rO, "Update of Palisades CDF Model - PSAR2b to PSAR2c".

2.2.2 EA-PSA-SAPHIRE-05-16 rO, "SAPHIRE v7.26 Validation and Verification".

2.2.3 SAPHIRE REFERENCE MANUAL, "SYSTEMS ANALYSIS PROGRAMS FOR HANDS ON INTEGRATED RELIABILITY EVALUATIONS (SAPHIRE) VERSION 6.0", Idaho National Engineering Laboratory, 1998.

2.2.4 SAPHIRE TECHNICAL REFERENCE, "Systems Analysis Program for Hands-on Integrated Reliability Evaluations (SAPHIRE) Version 6.0", Idaho National Engineering Laboratory, 1998.

2.2.5 EA-PSA-SAPHIRE-05-16 rO, "SAPHIRE v7.26 Validation and Verification". NUREG/CR-2300 volume 1, "PRA Procedures Guide".

2.2.6 NUREG-0492, "Fault Tree Handbook", 1981.

2.2.7 EA-PSA-CET-R1-04-21 rO, "Conversion of IPE CET Models from CAFTA to SAPHIRE".

2.2.8 Nuclear Regulatory Commission (NRC) Inspection Manual, Part 9900: Technical Guidance, "Operations - Notices of Enforcement Discretion", February 7, 2005.

2.2.9 NUREG/CR-6850 (EPRI 1011989), "EPRI/NRC-RES Fire PRA Methodology for Nuclear Power Facilities, Volume2: Detailed Methodology".

2.2.10 Design Basis Document (DBD-7.08), "Plant Protection against Flooding", revision 5, 12/15/2004.

2.2.11 EA-PSA-PSAR2-04-02 rO, "Update of Palisades CDF Model - PSAR1 B Modified w/HELB to PSAR2".

2.2.12 CPCo to NRC Letter, January 29, 1993, Palisades Plant Individual Plant Examination for Severe Accident Vulnerabilities (IPE), [F341/1523].

2.2.13 CPCo Letter to NRC, dated 6/30/95, Response to Generic Letter 88-20, Supplement 4, Individual Plant Examination of External Events for Severe Accident Vulnerabilities (IPEEE), Final Report (G326/2290).

2.2.14 Palisades Letter for Submittal of the Revised Fire Analysis, dated May 31, 1996 (G700/0629).

2.2.15 EA-PSA-LERF-99-0020, "Re-Creation of Palisades IPE LERF Model".

2.2.16 Applicant's Environmental Report - Operating License Renewal Stage Palisades Nuclear Plant Nuclear Management Company, Docket No. 50-255, License No. DPR-20, March 2005.

2.2.17 Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessments, EPRI, Palo Alto, CA: 2008. 1016737.

2.2.18 ASME/American Nuclear Society, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, ASME/ANS RA-Sa-2 2009, March 2009.

2.2.19 U.S. Regulatory Commission, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making, NUREG-1855, Volume 1, Main Report, March 2009.

2.2.20 U.S. Nuclear Regulatory Commission, "CCF Parameter Estimations, 2007 Update",

http://nrcoe.inl.gov/results/CCF/ParamEst2007/ccfparamest.htm, September 2008.

3.0 DEFINITIONS/ACRONYMNS 3.1 AOT-allowed outage time as defined in the Technical Specifications.

3.2 CCDP - conditional core damage probability, the core damage probability for a given plant initiating event for all potential accident initiating events in the PSA.

3.3 containment bridge tree (CBT) - containment system event tree that includes containment system fault trees such as containment air coolers, sprays, etc. The end states of the Pg 5 of 23

LTR-PSA-09-04 October 1, 2009 Rev 1 containment bridge tree describe the state of various containment functions from the availability of sprays to the status of different PCS injection systems.

3.4 containment event tree (CET) - the non-system challenges or phenomenological threats to the containment are characterized in the containment event tree logic. This logic represents various issues from steam explosions to direct containment heating and the likelihood of such events challenging the containment structurally integrity. The plant damage state frequencies are input to the CET's.

3.5 CDF - core damage frequency, the calculated probability of a core damage event for any given year for all potential accident initiating events in the PSA.

3.6 CDP - core damage probability, the core damage probability for a specified time (i.e., 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months or 3 months) for all potential accident initiating events in the PSA, equal to the CDF times the specified length of time.

3.7 CLERP - conditional large early release probability, the large early release probability for a given plant initiating event for all potential accident initiating events in the PSA.

3.8 LERF - large early release frequency, the calculated probability of a significant radiological release to the public prior to completing emergency plan evacuation procedures following a core damage event for any given year for all potential accident initiating events in the PSA.

3.9 LERP - large early release probability, the large early release probability for a specified time (i.e., 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months or 3 months) for all potential accident initiating events in the PSA, equal to the LERF times the specified length of time.

3.10 Level / (1) - PSA studies that deterministically evaluate internal events and only core damage.

3.11 Level // (2) - PSA studies that deterministically evaluate internal events and core damage as well as the containment response that includes the probability of containment failure.

3.12 model - an approximate mathematical representation that simulates the behavior of a process, item, or concept (such as failure rate). For example, the probability of a system is synthesized using models that relate system failures to component failures and human errors.

3.13 Notice of Enforcement Discretion (NOED) - Is a document issued by Nuclear Regulatory Commission (NRC) to exercise enforcement discretion with regard to limiting condition for operation (LCO) in power reactor Technical Specifications (TS) or other license conditions.

3.14 plant damage state - it is not practical to perform detailed analysis of each core damage sequence. Therefore, the core damage sequences are grouped into bins that pose similar containment system challenges and result in like fission product releases. These product or bins are referred to as plant damage states. The plant damage state frequencies are input to the containment event tree.

3.15 probabilistic risk assessment (PRA) or probabilistic safety analysis (PSA) - a quantitative assessment of the risk associated with plant operation and maintenance. Risk is measured in terms of the frequency of occurrence of different events, including core damage. In general the scope of a PRA is divided into three categories: Level 1,2, and 3.

A Level 1 maps from initiating events to plant damage states (PDSs), including their aggregate, core damage. Level 2 includes Level 1 mapping from initiating events to release categories. Level 3 includes Level 2 and uses the release categories of Level 2 to quantify consequences, the most common of which are health effects and property damage in terms of cost. Full scope PRA includes internal and external events.

3.16 Safety Basis - Information typically provided by PRA personnel to justify that a requested NOED has no significant increase in radiological risk to the public.

3.17 truncation limits - the cutoff value of probability or frequency of individual accident sequences below which they are no longer retained in quantitative PRA model results. A truncation value is primarily used for the purpose of managing the size of the analysis results.

Pg 6 of 23

LTR-PSA-09-04 October 1, 2009 Rev 1 4.0 ASSUMPTIONS 4.1 MAJOR ASSUMPTIONS 4.1.1 The plant is assumed to be in either mode's 1, 2 or 3 as the initial condition prior to an event.

4.1.2 Use the zero maintenance PRA model to establish the plant's baseline risk and the estimated risk increase associated with the period of enforcement discretion (Reference 2.2.8). For the plant-specific configuration the plant intends to operate in during the period of enforcement discretion, the incremental conditional core damage probability (ICCDP) and incremental conditional large early release probability (ICLERP) will be quantified and compared with guidance thresholds of less than or equal to an ICCDP of 5E-7 and an ICLERP of 5E-8. These:numerical guidance values are not pass-fail criteria.

4.1.3 It is considered a common cause stressor does not exist between P-7A and P-7C (with respect to the 9/29/09 experienced failure mode) beyond the existing common cause contribution in the model, given that this failure occurred subsequent to the replacement of P-7C in June of 2009 and that such a failure has never been experienced during the life of the plant. Moreover, validation that the shaft heat treatment procedure is different than the coupling heat treatment process (i.e., different vendor, different oven, different procedures, different personnel, different location etc.) has been demonstrated.

Nevertheless, the common cause failure probability of P-7A and P-7B to run was increased by a factor of ten to 2.132E-05. The current analysis of record applies a value of 2.132E-06. To provide a perspective regarding the current baseline value of 2.132E-06, the data employing the latest MGL data is presented below:

SWS pump Fail to Run CCCG Size of 2 13 Table 2.1.8.1 (Reference 2.2.20) 1.17E-02 2 Group Common cause probabilities Pf

P CCF factor 1.17E-02 CCF failure probability 1.11E-06 This information shows that the current baseline analysis (2.2.1) service water pump "pair" failure probability is about a factor of "2" greater than the latest NRC data.

Moreover, applying a factor of ten increase, the new 'pair' failure to run probability value is about a factor of 20 greater than the latest NRC data. This value is used in a sensitivity analysis described later in this evaluation.

4.2 MINOR ASSUMPTIONS 4.2.1 The Level 1 analysis applied a 1E-10 truncation limit. The Level II analysis applied a 1 E-09 truncation limit.

The Palisades Level II analysis is a detailed assessment of containment performance.

It is considerably more rigorous than the Owners Group simplified LERF methodology.

Consequently to solve some 60,000 plant damage state sequences, a truncation limit of 1 E-09 is employed. This is considered appropriate given the detail in the Palisades Pg 7 of 23

LTR-PSA-09-04 October 1, 2009 Rev 1 plant damage state and containment event tree models. Moreover, the plant damage states are not subsumed resulting in a conservative aggregated result.

Basis: The Palisades Level II sequences analysis results (methods described in References 2.2.7, 2.2.15, 2.2.12, 2.2.15 and 2.2.16) do not subsume the correlated containment bridge tree sequences to the assigned sequence endstates. This is because the interface between the Level 1 andthe Level 2 analyses is controlled by the Plant Damage State (PDS) Containment Bridge Tree (CBT). The core damage event tree sequences are binned according to the available six distinct containment safeguard system states. The result of combining the internal event initiators to the six containment safeguard categories results in some 181 plant damage states. The 181 endstates are then mapped to 23 containment event trees. Given the unique identification of these bins, Boolean subsuming cannot occur. The outcome is a conservative answer as the resultant release categories are overestimated on the order of 20 to 40%, typically.

5.0 METHODOLOGY The methods employed to address the impact of extending service water pump (P-7C) allowed outage time (AOT) are described and include the SAPHIRE software and users manual (References 2.2.3 and 2.2.4) as well as the Nuclear Regulatory Commission (NRC) Inspection Manual, Part 9900 (Reference 2.2.8).

6.0 ANALYSIS This section describes the specific analysis performed to analyze the safety significance and potential consequences of extending the P-7C LCO period.

6.1 VALIDATION OF THE CURRENT MODEL OF RECORD (PSAR2C)

The baseline results for the current model of record are; Baseline results with current system alignment (at 1E-09 truncation):

CDF

Cutsets Sequence 2.611E-05 (non subsumed) 2362 End State Gather 2.489E-05 (subsumed) 1708 Validation of the model was completed by quantification with nominal maintenance unavailabilities to confirm that the stated results were duplicated. The results were correctly replicated.

6.2 MAINTENANCE CONDITION The NOED guidance (Reference 2.2.8) requires the assessment to be performed based on a zero maintenance condition (all values assigned for the probability of equipment being removed from service set to 0). This condition is established by using the existing SAPHIRE change set (MAINTUNVAIL(0)) which resets the indicated probabilities to zero (Attachment A). In order to assure adequate representation of the transformer out-of-service condition this calculation and the remaining risk calculations were conducted with a truncation value of 1.OE-10.

Baseline results with Maintenance Probabilities reset to zero:

Pg 8 of 23

LTR-PSA-09-04 October 1, 2009 Rev 1 CDF

Cutsets Sequence 2.727E-05 (non subsumed) 9823 End State Gather 2.591E-05 (subsumed) 7745 The model includes a change set file for the configuration of equipment assumed to be in-service or standby at the time of an event. The assumed conditions represent an arbitrary choice of system/train alignments expected to be in place for the normal at-power condition. None of the alignments made with this SAPHIRE change set impact the assessment of the service water pump P-7C out-of-service configuration. The change set was modified to represent the current condition in which service water pumps P-7A and P-7B are the in-service pumps and P-7C is the standby pump.

The model includes the service water pumps as the primary source of cooling to components on the critical and non-critical service water distribution headers. In addition, service water to the containment air coolers from the critical service water header is also explicitly modeled. For events with reduced service water capacity (one or more service water pumps unavailable, service water to the non-critical header or to the containment air coolers can be isolated by the operators to reduce service water loads. For events which would result in the generation of a safety injection signal (SIS) or containment high pressure (CHP) the non-critical header would automatically be isolated via closure of the service water control valve to the non-critical header (CV-1359).

The analysis includes an operator action to perform the isolation of service water to containment. Modeling of isolation of the non-critical header only includes the automatic signal to close the valve. Operator action to close the valve is possible but not included in the current model.

The zero maintenance case was re-quantified with the service water pump (P-7C) out-of-service. The results of this case are shown in the following table.

Zero maintenance conditions with service water pump (P-7C) OOS:

CDF

Cutsets Sequence 2.732E-05 (non subsumed) 10010 End State Gather 2.596E-05 (subsumed) 7859 6.3 INITIATING EVENT FREQUENCY CONSIDERATION The current PRA model includes a Loss of Service Water initiating event frequency of 1.22E-03.

In the current condition the plant is more susceptible to perturbations in the operation of the service water system. Consequently the initiating event frequency for loss of the service water system would be increased during the period.

An additional analysis was completed with the loss of service water initiating event frequency increased by an order of magnitude.

Zero maintenance conditions with service water pump (P-7C) OOS and increased initiating event frequency (IELOSWS):

CDF

Cutsets Sequence 5.729E-05 (non subsumed) 10932 End State Gather 5.555E-05 (subsumed) 8477 Pg 9 of 23

LTR-PSA-09-04 October 1, 2009 Rev 1 6.4 INTERNAL EVENT CUTSET REVIEW A review of the change to the cutsets contributing to core damage as a result of the changes made to represent the removal of service water pump (P-7C) from service determined that there were no changes to the top 100 cutsets. A review of the changed cutsets contributing to core damage as a result of the changes made to the initiating event frequency for a loss of service water initiating event are discussed below.

The top 100 cutsets represent - 83% of the increased core damage probability. Thirteen cutsets showing an increased contribution to core damage are described below. The top 100 cutsets are listed in Attachment A. Eighty seven out of one hundred of the listed cutsets did not change.

Cutset 1 Loss of Service Water (Sequence 22-2)

Cutset 1 is the same cutset as the baseline (0 maintenance) case with an increased contribution to core damage as it is the result of a loss of service water initiating event.

The cutset represents a loss of primary coolant pump seal cooling and the failure to trip the primary coolant pump(s) in time to prevent seal failure that results in a loss of coolant accident. The loss of service water fails injection pumps due to loss of cooling and containment heat removal.

Cutset 4 Loss of Service Water (Sequence 21-5)

This cutset represents a loss of service water, the loss of service water results in loss of primary coolant pump seal cooling and a consequential seal LOCA due to failure to trip the primary coolant pumps. The loss of service water fails injection pumps due to loss of cooling and containment heat removal Cutset 9 Loss of Service Water (Sequence 17)

This cutset represents a loss of service water event with failure secondary heat removal via the steam generator, successful initiation of once through cooling (OTC) and failure of the containment heat removal, failure of main feedwater and low pressure feed (feeding steam generators with condensate pumps) due to loss of condenser vacuum, and failure of containment sprays and containment air coolers as a results of the loss of service water cooling to remove heat from the systems. The failure of the auxiliary feedwater system is due to common cause failure of all three pumps to start.

Cutset 19 Loss of Service Water (Sequence 17)

This cutset is similar to cutset 9 above with the difference being the failure of auxiliary feedwater is due to common cause failure of all the pump discharge check valves. The remainder of the cutset is the same as cutset 9:

Cutset 21 Loss of Service Water (Sequence 5)

Cutset 21 is also similar to cutsets 9 and 19. The difference in this cutset is that the failure of auxiliary feedwater is a long term failure to provide an alternate suction source to the auxiliary feedwater pumps. Failure of normal makeup to the condensate storage tank (T-2) is due to failure of the demineralized water transfer pump (P-936) to provide makeup from demineralized water storage tank (T-939). Operators would be aware of the failure of normal makeup when a low level alarm occurs at 73% level in the condensate storage tank. The operator would then have several hours to align an alternate source to the auxiliary feedwater pumps. This cutset includes failure of an operator action to align Pg 10 of 23

LTR-PSA-09-04 October 1, 2009 Rev 1 service water to pumps to auxiliary feedwater P-8A or P-8B OR fire protection water to auxiliary feedwater pump P-8C. This cutset does not credit the availability of water from primary system makeup storage tank (T-81) via pumped or gravity feed which would provide additional time to align other water sources.

Cutset 23 Loss of Service Water (Sequence 17)

This cutset is similar to cutsets 9 and 19 above with the difference being the failure of auxiliary feedwater is due to common cause failure of all the check valves in the flow headers from the pump trains to the steam generators. The remainder of the cutset is the same as cutsets 9 and 19.

Cutset 28 Loss of Service Water (Sequence 17)

This cutset is similar to cutsets 9 and 19 above with the difference being the failure of auxiliary feedwater is due to common cause failure of all four flow control valves in the flow headers from the pump trains to the steam generators. The remainder of the cutset is the same as cutsets 9 and 19.

Cutset 35 Loss of Service Water (Sequence 17)

This cutset is similar to cutsets 9 and 19 above with the difference being the failure of auxiliary feedwater is due to spurious low suction trips of auxiliary feedwater pumps P-8A and P-8C and failure of the turbine-driven auxiliary feedwater pump P-8B. The remainder of the cutset is the same as cutsets 9 and 19.

Cutset 36 Loss of Service Water (Sequence 5)

Cutset 36 is similar to cutset 21 (see above). Loss of normal makeup from the demineralized water storage tank (T-939) is due to failure of demineralized water transfer pump (P-936). The difference between this cutset and cutset 21 is that the long term failure is the failure of another operator action related to the alignment of an alternate suction source to the auxiliary feedwater pumps after the contents of the condensate storage tank (T-2) have been depleted.

Cutset 37 Loss of Service Water (Sequence 17)

This cutset is similar to cutsets 9 and 19 above with the difference being the failure of auxiliary feedwater is due to common cause failure of all three auxiliary feedwater pumps to run for the mission time (24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ). The remainder of the cutset is the same as cutsets 9 and 19.

Cutset 49 Loss of Service Water (Sequence 5)

Cutset 49 is similar to cutset 21 and 36 (see above). Loss of normal makeup from the demineralized water storage tank (T-939) is due to failure of the control valve (CV-201 0) to automatically open and all flow from the demineralized water storage tank (T-939) to the condensate storage tank (T-2). Additionally the cutset includes failure of the operator to align, an alternate suction source to the operating auxiliary feedwater pump.

Cutset 60 Loss of Service Water (Sequence 5)

Cutset 60 is also similar to cutset 21 and 36 (see above). In this cutset the loss of normal makeup from the demineralized water storage tank (T-939) is due to loss of the air supply (filter plugging) to the control valve (CV-2010). The cutset includes the failure of the Pg 11 of 23

LTR-PSA-09-04 October 1, 2009 Rev 1 operator to align an alternate suction source to the operating auxiliary feedwater pump.

Cutset 62 Loss of Service Water (Sequence 5)

Cutset 62 is also similar to cutset 21 and 36 (see above). In this cutset the loss of normal makeup from the demineralized water storage tank (T-939) is due to failure of the transfer pump (P-936). The cutset includes the failure of the operator to align an alternate suction source to the operating auxiliary feedwater pump.

Cutset 69 Loss of Service Water (Sequence 5)

Cutset 69 is also similar to cutset 21 and 36 (see above). In this cutset the loss of normal makeup from the demineralized water storage tank (T-939) is due to failure of the transfer pump (P-936). The long term failure of the alignment of service water or fire protection water to the auxiliary feedwater pump suction is due to failure of one of the manual valves (MV-FW775) required to align fire protection water to pump P8C (service water to pumps P-8A and P-8B is failed by the initiator).

Cutset 70 Loss of Service Water (Sequence 5)

Cutset 70 is also similar to cutset 21 and 36 (see above). In this cutset the loss of normal makeup from the demineralized water storage tank (T-939) is due to failure of the transfer pump (P-936). The long term failure of the alignment of service water or fire protection water to the auxiliary feedwater pump suction is due to failure of one of the manual valves (MV-FW774) required to align fire protection water to pump P8C (service water to pumps P-8A and P-8B is failed by the initiator).

Cutset 75 Loss of Service Water (Sequence 5)

Cutset 75 is also similar to cutset 21 and 36 (see above). In this cutset the loss of normal makeup from the demineralized water storage tank (T-939) is due to loss of the air supply (filter plugging) to the control valve (CV-2010). The cutset includes the failure of the operator to align an alternate suction source to the operating auxiliary feedwater pump.

6.5 LARGE EARLY RELEASE FREQUENCY (LERF)

The Palisades Level II assessment included re-evaluating the containment plant damage states assuming no maintenance unavailability, similar to core damage evaluation above.

Next, the zero maintenance case was quantified with service water pump P-7C out-of-service. The resulting set of endstate frequencies were mapped to 23 containment event trees (CET). The CETs represent the non-system challenges or phenomenological threats to the containment. This logic represents various issues from steam explosions to direct containment heating and the likelihood of such events challenging the containment.

The outputs of the CETs are mapped to endstates that characterize the timing of the release (Timing Bins) and the magnitude (Release Magnitude Bins). The LERF results are considered bounding for the external events results (seismic and fire) as well as the internal events analysis.

Timing Bins Three timing classifications are used, as follows:

1. Early (E) - less than 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months from accident initiation Pg 12 of 23

LTR-PSA-09-04 October 1, 2009 Rev 1

2. Intermediate (I) - greater than or equal to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months , but less than 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months

3. Late (L) - greater than or equal to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

The definition of the categories is based upon past experience with offsite responses:

0-4 hours is based on a Palisades plant specific analysis discussed in the following section.

4-24 hours is a time frame in which most of the offsite nuclear plant protective measures can be accomplished.

>24 hours are times at which the offsite measures can be assumed to be fully effective.

Release Magnitude Bins The four severity classifications associated with volatile or particulate releases are defined as follows:

High (H) - A radionuclide release of sufficient magnitude to cause near-term health effects.

Moderate (M) - A radionuclide release with the potential for latent health effects.

Low (L) - A radionudide release with the potential for minor health effects.

Low-Low (LL) - A radionuclide release that is less than or equal to the containment design base leakage resulting in no health effects.

A LERF release category equates to a Palisades CET E-H release category.

7.0 RESULTS This section reports the quantitative and qualitative results.

7.1 INTERNAL EVENT INCREMENTAL CONDITIONAL CORE DAMAGE PROBABILITY (ICCDP)

The zero maintenance case was quantified with service water pump P-7C out-of-service (refer to Attachment A for the SAPHIRE change set information). The results of the quantification under these conditions are shown in the following table.

CDF

Cutsets Sequence 2.73E-05 (non subsumed) 9823 End State Gather 2.59E-05 (subsumed) 7745 Results with service water pump P-7C out of service are shown below:

CDF

Cutsets Sequence 2.73E-05 (non subsumed) 10010 End State Gather 2.60E-05 (subsumed) 7859 Results with service water pump P-7C out of service and increasing the initiating event frequency for a loss of service water event are shown below:

CDF

Cutsets Pg 13 of 23

LTR-PSA-09-04 October 1, 2009 Rev 1 Sequence 5.73E-05 (non subsumed) 10932 End State Gather 5.56E-05 (subsumed) 8477 Removing service water pump P-7C from service results in an increase in CDF of 5.0E-08/yr or 5.71E-12/hr.

(2.60E 2.59E-05)

(5.00E-08/yr/(365days/yr*24hrs/day))

The current allowed outage time (72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months ) represents a Core Damage Probability (CDP) of 4.11 E-1 0 for 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

5.71 E-1 2/hr*3days*24hrs/day The CDP associated with an extension of the current allowed outage time is 9.59E-10 for 7 days (168 hours0.00194 days 0.0467 hours 2.777778e-4 weeks 6.3924e-5 months ).

5.71 E-1 2/hr*7days*24hrs/day This results in an Incremental Conditional Core Damage Probability (ICCDP) of 5.48E-10 (9.59E 4.1 1E-10) for the extension to a 7 day period.

Removing service water pump P-7C from service and considering impacts of an increase in the loss of offsite power initiating event frequency results in an increase in CDF of 2.96E-05/yr or 3.38E-09/hr.

(5.56E 2.59E-05) 2.96E-05/yr/(365days/yr*24hrs/day)

The current allowed outage time (72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months ) represents a Core Damage Probability (CDP) of 2.44E-07 for 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

3.38E-09/hr*3days*24hrs!day The CDP associated with an extension of the current allowed outage time is 5.68E-07 for 7 days (168 hours0.00194 days 0.0467 hours 2.777778e-4 weeks 6.3924e-5 months ).

3.38E-09/hr*7days*24hrs/day This results in an Incremental Conditional Core Damage Probability (ICCDP) of 3.25E-07 (5.68E 2.44E-07) for the extension to a 7 day period.

Removing service water pump P-7C from service, considering impacts of an increase in the loss of offsite power initiating event frequency and an increase in the common cause failure of the operating service water pumps to fail to continue to run results (Major Assumption 4.1.3 - 2.132E-05) in an increase in CDF of 2.96E-05/yr or 3.39E-09/hr.

(5.56E 2.59E-05) 2.97E-05/yr/(365days/yr*24hrs/day)

Pg 14 of 23

LTR-PSA-09-04 October 1, 2009 Rev 1 The current allowed outage time (72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months ) represents a Core Damage Probability (CDP) of 2.44E-07 for 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

3.39E-09/hr*3days*24hrs/day The CDP associated with an extension of the current allowed outage time is 3.26E-07 for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

3.39E-09/hr*4days*24hrs/day This results in an Incremental Conditional Core Damage Probability (ICCDP) of 8.16E-08 (3.26E 2.44E-07) for the extension to a 7 day period.

7.2 INTERNAL EVENTS INCREMENTAL CONDITIONAL LARGE EARLY RELEASE PROBABILITY (ICLERP)

As was the case above, for the core damage analysis, the baseline plant damage analysis was first evaluated by quantifying the plant damage states and then mapping the results to the 23 CETs. For example, for the failed P-7C analysis the following CET frequencies were determined:

CET Frequency

%Contribution

/yr CET-DEJP 7.61 E-06 23.5%

CET-ZEGP 5.37E-06 16.6%

CET-DEJS 4.41E-06 13.6%

CET-BEGP 4.04E-06 12.5%

CET-A2EGR 3.00E-06 9.3%

CET-BEGR 2.56E-06 7.9%

CET-TEJW 1.42E-06 4.4%

CET-BEGV 1.36E-06 4.2%

CET-TEJP 8.21 E-07 2.5%

CET-TEJS 4.44E-07 1.4%

CET-TEJQ 4.55E-07 1.4%

CET-BEGS 3.95E-07 1.2%

CET-A2EGP 3.68E-07 1.1%

CET-TEJR 3.60E-08 0.1%

CET-DEJR 7.20E-08 0.2%

CET-MEJW 6.13E-09 0.0%

CET-A1EGR 5.15E-09 0.0%

CET-TEJV 2.38E-09 0.0%

CET-MEJP 0.00E+00 0.0%

CET-MEJV 0.OOE+00 0.0%

CET-MEJR 0.OOE+00 0.0%

CET-MEJS 0.OOE+00 0.0%

CET-MEJQ 0.OOE+00 0.0%

3.24E-05 100.0%

These frequencies are then input to the containment phenomenological event trees resulting in the following releases:

Pg 15 of 23

LTR-PSA-09-04 October 1, 2009 Rev 1 E-H (LERF)

E-M 1-H I-M L-L L-LL Plant Damage State E-H (ERE)

E-M

-H ISummary

/yr

/

y 2.70E-07 5.70E-06 4.05E-06 8.22E-06 6.80E-07 1.00E-05 2.89E-05 And similarly, the case was quantified with service water pump P-7C out-of-service.

Again, the results of the 181 plant damage bins were mapped to the 23 CETs resulting in the following set of release frequencies:

E-H (LERF)

E-M I-H I-M L-L L-LL Plant Damage State

/yr

/yr I

Iyr

/yr Summary

/yr

/yr/yr 2.73E-07 5.73E-06 4.05E-06 8.48E-06 7.58E-07 1.01E-05 2.94E-05 The % change in different release categories is shown in the following table:

Endstate I Increase (%)

E-H 1.0%

E-M 0.6%

I-H 0.0%

I-M 3.2%

L-L 11.5%

L-LL 0.8%

Removing service water pump P-7C from service results in an increase in LERF of 2.80E-09/yr or 3.20E-13/hr.

(2.73E 2.70E-07) 2.80E-08/yr/(365days/yr*24hrs/day)

The current allowed outage time (72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months ) represents a Core Damage Probability (LERP) of 2.3E-1 1 for 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

3.2E-13/hr*3days*24hrs/day The LERP associated with an extension of the current allowed outage time is 5.37E-1 1 for 7 days (168 hours0.00194 days 0.0467 hours 2.777778e-4 weeks 6.3924e-5 months ).

3.2E-13/hr*7days*24hrs/day This results in an Incremental Conditional Large Early Release Probability (ICLERP) of 3.07E-1 1 (5.37E-1 1 - 2.3E-1 1) for the extension to a 7 day period. It is considered that the experienced small change in the internal events ICLERP value apply to the external events evaluations as well.

Attachment C provides the SAPHIRE Change Sets for both the plant damage state analysis and the CET evaluation.

7.3 EXTERNAL EVENTS - SEISMIC In the Palisades IPEEE (Individual Plant Examination of External Events) (References 2.2.17 and 2.2.18) a seismic risk assessment was used to assess risks due to seismic events. The risk assessment was a hybrid of the conventional PSA and seismic margins analysis.

The service water system modeling used in the external events analysis is the same Pg 16 of 23

LTR-PSA-09-04 October 1, 2009 Rev 1 model used for internal events analysis. The same system success criteria were also used. The component random failures rates that were used in the IPE (Individual Plant Examination of Internal Events) (Reference 2.2.16) were also used in the SPRA (Seismic Probabilistic Risk Assessment). No adjustments to these probabilities were made. The seismic impact onthese components was assessed by including seismic basic events and fragilities. The component fragilities that were identified in Section 3.5.2 of the IPEEE reports were used in the SPRA. The fragilities were input as a median capacity with a lognormal standard deviation (beta), which defined a lognormal fragility curve.

In addition to the seismic basic events, the seismic fault trees were modified to include seismically induced initiating events. The four seismic event tree headings that are seismically induced initiating events are: TBFR (Turbine Building Fire); TBFL (Turbine Building Flood); LOOP (Loss of Offsite Power); and SBL (Small Break Loss of Coolant Accident). All events that are affected by a turbine building fire have an associated basic event of TBFR. All basic events that are affected by a turbine building flood have an associated basic event of TBFL. The affected off-site power related equipment received an associated basic event of LOOP. The initiating event SBLOCA (Small Break Loss of Coolant Accident) was given to all sequences that were quantified by the SBLOCA event tree and was not included in the fault tree as a basic event.

The seismic analysis has not been updated since originally developed for the Individual Plant Examination of External Events (IPEEE) submittal. A review of the results of the IPEEE submittal indicated that the core damage frequency was 8.88E-06 with a high confidence low probability of failure (HCLPF) of 0.217g PGA (peak ground acceleration).

There were no specific seismic events identified as dominant contributors to the core damage frequency. Important seismic induced failures identified were; the Fire Protection System, Main Steam Isolation Valves, Diesel Generator Fuel Oil Supply, and an under voltage relay for 2400 volt ac Bus 1D. Several important random failures were identified in the report as important because of their contribution in combination with seismically induced failures. The important random failures (not seismically induced) identified in the report were: diesel generator 1-2, auxiliary feedwater (AFW) pump P-8C, and atmospheric dump valves.

The service water system was determined to be seismically rugged and there were no significant contributions of the service water system to core damage resulting from seismically induced failures. Random failures of the service water system were identified as important contributors as a consequence of seismically induced failure of other system components as discussed below.

As noted, the fire protection system is an important contributor to seismic analysis due to the probability of seismically induced failure of fire protection system components and the condensate storage tank (CST). Seismically induced failure of the condensate storage tank results in an earlier need for alignment of an alternate suction source for the operating auxiliary feedwater pump. The fire protection system provides an alternate suction source to AFW pumps P-8A and P-8B. The seismically induced failures of the fire protection system result in long term failure of auxiliary feedwater pumps P-8A and P-8B due to the unavailability of a suction source. Auxiliary feedwater pump P-8C is important to long term makeup to the steam generators should the fire system become unavailable following a seismic event (as discussed in the results for Accident Classes IA

& IB, Section 3.6.5.3.1 of the IPEEE report). The fire protection system has a low fragility and is a significant contributor to seismic risk once the contents of the condensate storage tank (T-2) are depleted and a long term suction source is required for continued operation of the AFW pumps. The seismically induced failure of the fire protection system represents a higher probability of failure of the long term suction to motor-driven auxiliary feedwater pump P-8A and turbine-driven auxiliary feedwater pump P-8B after Pg 17 of 23

LTR-PSA-09-04 October 1, 2009 Rev 1 the depletion of the available tank T-2 inventory. This increased probability of failure of heat removal via the A and B pump trains results in an increased importance of motor-driven auxiliary feedwater pump P-8C. The importance of pump P-8C is a consequence of the fact that service water (a much more seismically rugged system) is more likely to remain available as a long term suction source to pump P-8C.

Auxiliary Feedwater (AFW) flow requirements in the PRA are 165 gpm to either steam generator. These flow requirements are a small fraction (<2%) of the total flow (8000 gpm) from a single service water pump. At the time of condensate storage tank depletion the flow requirements will be lower. Therefore the PRA model assumes no additional service water pumps are required to be placed in service to provide a suction source for the AFW pumps.

The contribution to core damage from seismic events determined in the IPEEE was 8.88E-06. This represents approximately 13% of the total core damage frequency from the current internal events analysis (2.49E-05), fire (3.3.1E-05), flooding (-<2E-07) and seismic (8.88E-06). Therefore the expected seismic contribution is bounded by the internal events core damage assessment described in this letter.

7.4 EXTERNAL EVENTS - FIRE The Palisades fire analysis used an approach that combined the deterministic evaluation techniques from the Electric Power Research Institute (EPRI) Fire-Induced Vulnerability Evaluation (FIVE) methodology with classical PRA techniques. The FIVE methodology was used to establish fire boundaries and to evaluate the probability and the timing of damage to components located in a fire area/zone involved in a fire. Based on the results from implementing the FIVE methodology PRA techniques were then employed to determine the probability of core damage associated with fires within the identified fire areas/zones. Fire areas identified by the Fire Protection Program were used as the basis of the fire areas evaluated by the fire risk analysis. These fire areas were evaluated for further division based on combustible loading and fire-spread potential to identify fire zones within fire areas. The fire areas/zones identified were evaluated and quantified using the fault trees and transient event tree from the IPE. The fault and event trees were modified to accurately reflect the fire analysis.

The core damage frequency contribution from internal fires for Palisades is 3.31 E-05/yr.

The dominant contribution to the fire CDF (>89%) is related to five fire areas: cable spreading room (33.5%); main control room (24.4%); 1D switchgear room (14.7%);

turbine building (9.3%); and 1C switchgear room (7.6%).

The principle finding of the fire analysis was that there is no area in the plant in which a fire would lead directly to the inability to cool the core. Without additional random equipment failures (unrelated to damage caused by the fire) or human errors, core damage will not occur. As a result, the study concluded that there are no major vulnerabilities due to fire events at the Palisades Nuclear Power Plant. This is primarily due to the fact that the damage in the important fire areas was to support systems (e.g.

ac power or dc power) that resulted in the loss of one division of equipment with adequate equipment unaffected on the other division. During the pump P-7C repair an operable Service Water pump will remain available on each division.

7.5 EXTERNAL EVENTS - FLOODING AND OTHER Other external events (high winds, external floods, transportation, etc.) were screened by demonstrating conformance to the 1975 Standard Review Plan using prior evaluations completed during the Systematic Evaluation Program (SEP) or demonstrating low hazard frequency for aircraft hazards. There were no significant contributors to core damage Pg 18 of 23

LTR-PSA-09-04 October 1, 2009 Rev 1 frequency from other external events (other than seismic and fire) identified.

7.6 UNCERTAINTY EVALUATION EPRI 1016737, Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessments [2.2.17] was employed to characterize the uncertainty in the current analysis of record. The results of this assessment are correlated to the associated supporting requirements as provided in ASME/ANS PRA Standard [2.2.18] and to assess potential key sources of model uncertainty relevant to specific applications as described in NUREG-1855 [2.2.19].

Definitions The following definitions have been provided in EPRI 1016737 and NUREG-1855.

An assumption is a decision or judgment that is made in the development of the PRA model. An assumption is either related to a source of model uncertainty or is related to scope or level of detail.

An assumption related to a model uncertainty is made with the knowledge that a different reasonable alternative assumption exists. A reasonable alternative assumption is one that has broad acceptance within the technical community and for which the technical basis for consideration is at least as sound as that of the assumption being made. It should be noted that "reasonable alternative assumptions" related to sources of model uncertainty can lead to increases or decreases in the calculated risk metrics.

An assumption related to scope or level of detail is one that is made for modeling convenience.

A consensus model, in the most general sense, [is] a model that has a publicly available published basis and has been peer reviewed and widely adopted by an appropriate stakeholder group. In addition, widely accepted PRA practices may be regarded as consensus models. Examples of the latter include the use of the constant probability of failure on demand model for standby components and the Poisson model for initiating events. For risk-informed regulatory decisions, the consensus model approach is one that the NRC has utilized or accepted for the specific risk-informed application for which it is proposed.

A source of model uncertainty is one that is related to an issue in which there is no consensus approach or model and where the choice of approach or model is known to have an effect on the PRA model (e.g. introduction of a new basic event, changes to basic event probabilities, changes in success criterion, introduction of a new initiating event).

A source of model uncertainty is labeled key when it could impact the PRA results that are being used in a decision, and consequently, may influence the decision being made.

Therefore, a key source of modeling uncertainty is identified in the context of an application. This impact would need to be significant enough that it changes the degree to which the risk acceptance [guidelines] are met, and therefore, could potentially influence the decision. For example, for an application for a licensing base change using the acceptance [guidelines] of RG 1.174, a source of model uncertainty or related assumption could be considered "key" if it results in uncertainty regarding whether the results lie in Region II or Region I, or if it results in uncertainty regarding whether the result becomes close to the region boundary or not.

Pg 19 of 23

LTR-PSA-09-04 October 1, 2009 Rev 1 These definitions delineate those sources of model uncertainty (and related assumptions) that should be the focus for meeting the QU supporting requirements in the standard as modified by RG-1.200, Revision 1 clarifications, including:

QU-E1: IDENTIFY sources of model uncertainty.

QU-E2: IDENTIFY assumptions made in the development of the PRA model.

QU-E4: For each source of model uncertainty and related assumption identified in QU-E1 and QU-E2, respectively, IDENTIFY how the PRA model is affected (e.g., introduction of a new basic event, changes to basic event probabilities, change in success criterion, introduction of a new initiating event).

QU-F4: DOCUMENT the characterization of the sources of model uncertainty and related assumptions (as identified in QU-E4).

Other related supporting requirements that are addressed by this appendix include:

LE-F3: IDENTIFY and CHARACTERIZE the LERF sources of model uncertainty and related assumptions, consistent with the requirements of Tables 2.2.7-2(d) and 2.2.7-2(e).

IE-D3, AS-C3, SC-C3, SY-C3, HR-13, DA-E3, LE-G4, IFPP-B3, IFSO-B3, IFSN-B3, IFEV-B3, and IFQU-B3: DOCUMENT the sources of model uncertainty and related assumptions (as identified in QU-E1 and QU-E2 [or LE F3]) associated with... [each element].

Attachment D, Table D-1 summarizes the findings from the implementation of the process for characterizing the sources of model uncertainty for the current Palisades analysis of record.

7.7 REG GUIDE 1.200 GAP ANALYSIS At the behest of the NRC, the industry undertook a task to develop a consensus standard on the technical adequacy of PRAs for regulatory applications. This effort resulted in publication of ASME RA-S-2002. Concurrently, under the direction of the Nuclear Energy Institute (NEI) and the Owners Groups for each major reactor provider, peer reviews of PRAs were conducted using the guidance in NEI 00-02. The NRC was also concurrently developing guidance for determining the adequacy of risk analyses for use in regulatory applications. The first draft of this guidance was published as Draft Guide 1122 (DG 1122) in September 2002. Following interactions with industry in subsequent years as the ASME Standard was being modified, the NRC recently published DG 1161 in September 2006. This draft version of Regulatory Guide 1.200 (RG 1.200) provides guidance on self assessments to determine the adequacy of PRAs.

Subsequent to the industry peer review of the Palisades PRA; a self assessment (Gap Analysis) was performed. This analysis reviewed the peer review facts against the guidance in DG 1122 and produced a list of recommended actions to address "gaps" between the results of the peer review and the guidance in DG 1122. Palisades has subsequently addressed all A and B level facts and observations (F&Os) from the peer review certification report. DG 1122 allowed for two mechanisms for conducting a self assessment. One was a direct comparison of the PRA against the Standard with additional considerations cited by the NRC to address areas where the NRC did not agree with the Standard (Table A-1 of DG 1122). The other method was to take advantage of the peer review findings and perform additional reviews against the Standard in areas where the NRC found that the peer review process needed additional effort to address NRC concerns with the Standard. The NRC issues were documented in Table B-4 of DG 1122. This was the method used in the Palisades Gap Analysis.

Pg 20 of 23

LTR-PSA-09-04 October 1, 2009 Rev 1 In general, the additional recommendations addressed issues of documentation and/or justification for technical analyses in the PRA. Slightly less than half of the additional recommendations are likely to result in a change to the actual model. Only three additional recommendations were considered likely to result in a noticeable change in the CDF or LERF. These included the removal of EDG repair from the model, the inclusion of additional flow diversion paths for key systems, and the inclusion of potential concurrent unavailabilities (such as train wise maintenance schedules where one train in multiple systems is taken out of service at the same time. The risk impact of the latter issue is bounded by the risk evaluations done to adhere to the a(4) requirements of the Maintenance Rule (10CFR50.69), but may be more significant in the baseline CDF evaluations.

EDG Repair Model Removal of the EDG repair model does not affect the conclusions of this analysis given the available of the non-safety related diesel.

Flow Diversion The flow diversion analysis performed to support the PRA update from the current analysis of record (2.2.1) used a combination of qualitative evaluation and detailed hydraulic analyses to identify possible flow diversions in the following systems:

Service Water (SWS)

Low Pressure Safety Injection I Shutdown Cooling (LPSI)

Chemical and Volume Control System (CVCS)

Component Cooling (CCW)

Containment Spray (CSS)

High Pressure Safety Injection (HPSI)

Auxiliary Feed water (AFW)

The result of the analysis is a series of annotated P&ID's which illustrate the flow diversions that were considered with accompanying documentation describing the evaluations performed for each (345 possible flow diversions were documented) assessed path. Analyses considered both single and multiple failures of equipment under various system configurations and transient events. In cases where a qualitative evaluation was indeterminate, detailed analyses were performed using Pipe-Flo Professional 2007a and GOTHIC.

The results of this evaluation do not affect the conclusions of this study regarding P-7C.

Coincident Unavailabilities Coincident unavailability is associated with maintenance for redundant equipment, both intra-system and inter-system. Coincident unavailability is a result of a planned, repetitive activity and can arise for systems with installed spares.

To evaluate coincident unavailability, all the unavailability data was compiled, and coincident events were marked for each train. In addition to reviewing the maintenance rule unavailability data for coincident unavailability, the risk management work week reviews from the LAN were also downloaded and reviewed.

Pg 21 of 23

LTR-PSA-09-04 October 1, 2009 Rev 1 The following identifies the equipment associated with each train:

Train A equipment: C-2A & C-2C, C-6B, ED-15 & ED-17, K-6A, P-52C, P-54B &

P-54C, P-55C, P-56A, P-66B, P-67B, P-7B, P-8A & P-8B, and PRV-1042.

Train B equipment: C-2B, C-6A, ED-16 & ED-18, K-6B, P-52B, P-54A, P-55A &

P-55B, P-56B, P-66A, P-67A, P-7A & 7C, P-8C and PRV-1043.

Plant experience showed that in most cases only one piece of equipment from a train is removed from service at a time. A review of the three plus years of unavailability data showed that there was limited, repetitive coincident unavailability; most cases involved only two components, and occurred only once in the three year data window.

There were, however, a few cases in which plant experience showed that two components from the same train were recurrently removed from service at the same time. In these cases, coincident unavailability was modeled; the following identifies the combinations of equipment for coincident unavailability:

1..

P-54B and P-66B;

2.

P-54B and P-67B;

3.

P-54C and P-67B;

4.

P-8A and P-8B;

5.

P-54A and P-66A; and

6.

P-54A and P-67A.

Coincident unavailability included only the time that both components were simultaneously unavailable. If one component was unavailable for an extra hour, the hour was used in the individual unavailability. This analysis is included in the planned update to the current analysis of record (2.2.1). The results of this assessment do not.

affect the conclusions of the P-7C analyses.

Summary The resolution of these issues as well as other model updates including HRA, component data, initiating event data, common cause logic and data, logic model changes to support NFPA-805, simplified LERF analyses, additional uncertainty analysis, updated internal event flooding etc. are being incorporated into the soon-to-be released model update. It is considered that these changes do not affect the conclusions of this analysis.

8.0 CONCLUSION

S The internal events core damage analysis calculated an Incremental Conditional Core Damage Probability (ICCDP) of 3.25E-07 (5.68E 2.44E-07) for allowed outage time extension to a 7 day period for service water pump P-7C when consideration of a increase in the loss of service water initiating event frequency is included. Without the increase in initiating event frequency the internal events core damage analysis calculated an Incremental Conditional Core Damage Probability (ICCDP) of 5.48E-10 allowed outage time extension to a 7 day period for service water pump P-7C. The internal events analysis is considered bounding for the evaluated external events including fire, Pg 22 of 23

LTR-PSA-09-04 October 1, 2009 Rev 1 flood and seismic. Moreover, the calculated ICLERP was conservatively estimated to be 3.07E-1 1.

Therefore extending the present LCO duration for an additional 4 days, results in a change in risk that is less than the prescribed limit in the Nuclear Regulatory Commission (NRC) Inspection Manual, Part 9900 guidance thresholds of less an ICCDP of 5E-7 and an ICLERP of 5E-8.

Completing the rebuild of the pump within an additional 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months beyond the current 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months limit versus and addition 4 days results in an Incremental Conditional Core Damage Probability (ICCDP) of 8.16E-08 when considering an order of magnitude increase in the loss of service water initiating event frequency and a factor of 10 increase (relative to the current analysis of record) in the common cause failure of P-7A and P-7B to run or 1.37E-10 when only the pump out of service condition is considered. The Incremental Conditional Large Early Release Probability (ICLERP) would be reduced to 7.7E-12 for an additional 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months period.

Pg 23 of 23

LTR-PSA-09-04 October 1, 2009 Attachment A SAPHIRE CDF Change Set Data and Results Table of Contents SAPHIRE Zero Maintenance Unavailabilities A-2 Change Set SAPHIRE w/P-7C Out of Service Change Set A-3 A-1

LTR-PSA-09-04 October 1, 2009 Attachment A SAPHIRE CDF Change Set Data and Results SAPHIRE Zero Maintenance Unavailabilities Change Set

PROBABILITY HEADER

Name

, CalcType,

UncType, Prob, Lambda,

Tau, UncValue,

UncCorr, MissionT, Flag, UncValue2

CLASS HEADER

Name,

Group, CompType,

CompId, System, Location, FailMode,

Train, Init, Attl,..,Attl6

CLASS PROBABILITY HEADER

CalcType,

UncType, Prob, Lambda, Tau,

UncValue, UncCorr, MissionT, Flag, UncValue2

PSAR2C, MAINTUNAVAIL(0)

^PROBABILITY A-PMOO-P-8A 1,

O.OOOE+000O,,,,

A-PMOO-P-8B 1,

.0E+000

.O.O..O.O..

A-PMOO-P-8C 1,

O.OOOE+000.,,,,,,,

C-PMOO-P-52A 1,

0.00E+000..

O..+/-...

C-PMOO-P-52B 1,

O.OOOE+000.......

C-PMOO-P-52C 1,

O.OOOE+000O,,,,,,

D-BCOO-ED-15 1,

O.OOOE+000.

D-BCOO-ED-16 1,

O.OOOE+000.,,,,,,,

D-BCOO-ED-17 1,

.00E+000..

O..+/-.O..

D-BCOO-ED-18 1,

O.OOOE+000.......

E-DGOO-K-6A 1,

O.OOOE+000, E-DGOO-K-6B 1,

0.00E+000...

+/-

E-PMOO-P-18A 1,

O.OOOE+000.O.....

F-PMOO-P-41 1,

.00E+000.O.....O..

F-PMOO-P-9A 1,

.0E+000.O...O.+/-...

F-PMOO-P-9B 1,

O.OOOE+000.......

G-PMOO-P-55A 1,

0.OOE+000.,,

G-PMOO-P-55B 1,

0.OOOE+000.O.....

G-PMOO-P-55C 1,

O.OOE+000, G-PMOO-P-56A 1,

O.OOE+000.......

G-PMOO-P-56B 1,

O.OOE+000.,,

H-PMOO-P-66A 1,

O.OOE+000.......

H-PMOO-P-66B 1,

0.OOE+000.......

I-ADOO-M-2 1,

O.OOE+000.......

I-ADOO-M-2-1 1,

O.00E+000.O.O.....

I-ADOO-M-2-2 1,

O.OOOE+000.......

I-CMOO-C-2A 1,

O.OOE+000.......

I-CMOO-C-2B 1,

O.OOOE+000.....

t,

I-CMOO-C-2C 1,

O.O0E+000.,

L-PMOO-P-67A 1,

O.OOOE+000+/-O,,,

L-PMOO-P-67B 1,

O.OOE+000.O....,

P-BSOO-F-BUS 1,

O.OOOE+000.,,.....

P-BSOO-R-BUS 1,

.000E+000.D.....

P-CBOO-ABB25R8 1,

O.OOOE+000.,,.....

P-CBOO-ABB27F7 1,

0.OOE+000.......

P-CBOO-ABB27H9 1,

0.OOOE+000.,,

P-CBOO-ABB27R8 1,

O.OOOE+000.,,,,,,,

P-CBOO-ABB29F7 1,

O.OOOE+000O,,,,,,

P-CBOO-ABB29H9 1,

.0E+000

.O.O..+/-.O..

P-CBOO-ABB29R8 1,

0.OOE+000.. O....

P-CBOO-ABB3lF7 1,

O.OOOE+000.......

P-CBOO-ABB31H9 1,

O.OOOE+000.......

Q-CMOO-C-6A 1,

.00E+000...

O..+/-...

Q-CMOO-C-6B 1,

O.OOOE+000, Q-CMOO-C-6C 1,

0.OOOE+000.......

S-PMOO-P-54A 1,

0.OOE+000, S-PMOO-P-54B 1,

0.OOOE+000O, S-PMOO-P-54C 1,

O.OOE+000.,,

U-PMOO-P-7A 1,

O.OOOE+000.......

U-PMOO-P-7B 1,

0.000E+000, U-PMOO-P-7C 1,

O.OOOE+000, V-FNOO-V-lA 1,

O.OOE+000, V-FNOO-V-2A 1,

.0E+000.O....E.O..

V-FNOO-V-3A 1,

0.OOE+000.......

^CLASS

^EOS A-2

LTR-PSA-09-04 October 1, 2009 Attachment A SAPHIRE CDF Change Set Data and Results SAPHIRE Change Set for P-7C Out of Service

PROBABILITY HEADER

Name

, CalcType,

UncType, Prob, Lambda, Tau,

UncValue, UncCorr, MissionT, Flag, UncValue2 CLASS HEADER

Name,

Group, CompType,

CompId, System, Location, FailMode, Train, Init, Attl,..,Attl6

CLASS PROBABILITY HEADER

CalcType,

UncType, Prob,

Lambda, Tau,

UncValue, UncCorr, MissionT, Flag, UncValue2

PSAR2C, P-7C-OOS

^PROBABILITY U-PMME-P-7C T,

U-PMMG-P-7C T,

U-PMOO-P-7C T,...

U-HSE-P-7A-STBY F,...

U-HSE-P-7B-STBY F,

U-HSE-P-7C-STBY F,

U-PMCC-P-7AB-MG 1,

, 2.132E-005.

^CLASS AEOSSAPHIRE Chan-qe Set for Loss of Service Water Initiating Event Frequency Increased by an Order of Magnitude

PROBABILITY HEADER

Name

, CalcType,

UncType, Prob, Lambda,

Tau, UncValue, UncCorr, MissionT, Flag,- UncValue2 CLASS HEADER

Name,

Group, CompType,

CompId, System, Location, FailMode, Train, Init, Attl,..,Attl6

CLASS PROBABILITY HEADER

CalcType,

UncType, Prob, Lambda,

Tau, UncValue, UncCorr, MissionT, Flag, UncValue2

PSAR2C, IE LOSWS

^PROBABILITY IE LOSWS 1,, 1.220E-002..

^CLASS

"^EOS A-3

LTR-PSA-09-04 October 1, 2009 Attachment B SAPHIRE CDF Top 100 Cutsets Table B-I: PSAR2c Zero Maintenance, P-7C Out of Service (Top 100 Cutsets)

Cut No.

% Total Prob./Frequency Basic Event Description Event Prob.

1 11.04 2.87E-06 IELOSWS LOSS OF SERVICE WATER SYSTEM (IE FREQ) 1.22E-03 PP-PMMT-CCW-MBLOCA PRIMARY COOLANT PUMP SEAL FAILURE GIVEN A SBO AND CONSEQUENTIAL 2.35E-03 MEDIUM BREAK LOCA 2

21.38 2.69E-06 IECNTRLSD CONTROLLED MANUAL SHUTDOWN (IE FREQ) 2.43E+00 MTC2 PERCENTAGE OF TIME W/MTC NOT SUFFICIENTLY POSITIVE 2.30E-01

/RVO Pressurizer Safeties Open 9.99E-01 RXC-ELEC-FAULTS Electrical Scram Signal Faults 4.81E-06 3

26.28 1.27E-06 IECNTRLSD CONTROLLED MANUAL SHUTDOWN (IE FREQ) 2.43E+00 G-PMOE-P-55ABC OPERATOR FAILS TO INITIATE CHARGING FLOW 1.10E-01

/RVC Pressurizer Safeties Closed 9.91E-01

/RVO Pressurizer Safeties Open 9.99E-01 RXC-ELEC-FAULTS Electrical Scram Signal Faults 4.81E-06 4

30.15 1.00E-06 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <2'1 (IE FREQ) 2.26E-03 Y-AVMD-CV-3027 AIR OPERATED VALVE CV-3027 FAILS TO REMAIN OPEN 4.44E-04 5

34.02 1.OOE-06 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <2"] (IE FREQ) 2.26E-03 Y-AVMD-CV-3056 AIR OPERATED VALVE CV-3056 FAILS TO REMAIN OPEN 4.44E-04 6

37.1 7.99E-07 IESGTR STEAM GENERATOR TUBE RUPTURE (IE FREQ) 3.01E-03 A-AVOA-AFWFLADJ OPERATOR FAILS TO ADJUST AFW FLOW GIVEN FAILURE OF ONE HDR 1.45E-03 H-ZZOA-OTC-CDTNL-HEP-2 COND HEP: A-AVOA-AFWFLADJ

B-XVOB-ADVS-MAN

H-ZZOA-OTC-INIT 3.66E-01 SGTRA FT TOP: STEAM GENERATOR TUBE RUPTURE ON SG A (developed event) 5.OOE-01 7

40.18 7.99E-07 IESGTR STEAM GENERATOR TUBE RUPTURE (IE FREQ) 3.01E-03 A-AVOA-AFWFLADJ OPERATOR FAILS TO ADJUST AFW FLOW GIVEN FAILURE OF ONE HDR 1.45E-03 H-ZZOA-OTC-CDTNL-HEP-2 COND HEP: A-AVOA-AFWFLADJ

B-XVOB-ADVS-MAN

H-ZZOA-OTC-INIT 3.66E-01 SGTRB FT TOP: STEAM GENERATOR TUBE RUPTURE ON SG B (developed event) 5.00E-01 8

42.49 5.99E-07 IESGTR STEAM GENERATOR TUBE RUPTURE (IE FREQ) 3.01E-03 B-1

LTR-PSA-09-04 October 1, 2009 Attachment B SAPHIRE CDF Top 100 Cutsets Table B-I: PSAR2c Zero Maintenance, P-7C Out of Service (Top 100 Cutsets)

Cut No.

% Total Prob./Frequency Basic Event Description Event Prob.

L-ZZOA-SDC-CDTNL-HEP-1 CONDITIONAL HEP: W-AVOA-PZR-SPRAY

L-ZZOA-SDC-INIT 1.53E-01 W-AVOA-PZR-SPRAY OPERATOR FAILS TO DEPRESSURIZE PCS WITH PZR SPRAY/AUX SPRAY 1.30E-03 9

44.75 5.88E-07 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <2"] (IE FREQ) 2.26E-03 Y-AVOB-RAS-VLVS OPERATOR FAILS TO ENABLE ESS RECIRC VALVES TO CLOSE ON RAS 2.60E-04 10 45.97 3.16E-07 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <2"] (IE FREQ) 2.26E-03 Y-AVCC-3027-56MB BOTH SIRWT RECIRC VALVES CV-3027 & CV-3056 COMMON CAUSE FTC 1.40E-04 11 47.1 2.94E-07 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <2"] (IE FREQ) 2.26E-03 Z-LSOH-SIRW-HI SIRW TANK LEVEL SWITCHES MISCALIBRATED HIGH 1.30E-04 12 48.23 2.94E-07 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <2"] (IE FREQ) 2.26E-03 Z-LSOH-SIRW-LOW SIRW TANK LEVEL SWITCHES MISCALIBRATED LOW 1.30E-04 13 49.15 2.39E-07 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <2"] (IE FREQ) 2.26E-03 Y-AVCC-SUMP-MA COMMON CAUSE FAILURE OF CV-3029 & CV-3030 TO OPEN 1.06E-04 14 50 2.20E-07 IECNTRLSD CONTROLLED MANUAL SHUTDOWN (IE FREQ) 2.43E+00 G-PMOE-P-55ABC OPERATOR FAILS TO INITIATE CHARGING FLOW 1.10E-01

/RVC Pressurizer Safeties Closed 9.91E-01

/RVO Pressurizer Safeties Open 9.99E-01

/RXC-ELEC-FAULTS Electrical Scram Signal Faults 1.OOE+00 RXC-MECH-FAULTS Mechanical Scram Faults 8.40E-07 ITTF Turbine Trip 9.90E-01 15 50.84 2.18E-07 IETRANS-WC TRANSIENT WITH THE MAIN CONDENSER AVAILABLE (IE FREQ) 1.97E-01 MTC2 PERCENTAGE OF TIME W/MTC NOT SUFFICIENTLY POSITIVE 2.30E-01

/RVO Pressurizer Safeties Open 9.99E-01 RXC-ELEC-FAULTS Electrical Scram Signal Faults 4.81E-06 16 51.55 1.84E-07 IELOOP Loss of Offsite Power 1.11E-02 E-DG-ENGINE-REC-4HR EDG ENGINE RECOVERY IN 4 HOURS 4.30E-01 E-DGCC-K-6A&B&NSR-MG EDG1-1 EDG1-2 AND NSR COMMON CAUSE FAILURE TO RUN 3.44E-04 B-2

LTR-PSA-09-04 October 1, 2009 Attachment B SAPHIRE CDF Top 100 Cutsets Table B-I: PSAR2c Zero Maintenance, P-7C Out of Service (Top 100 Cutsets)

Cut No.

%Total Prob,/Frequency Basic Event Description Event Prob.

P-LOOP-REC-CORR-4HR OFFSITE POWER CORRECTION FACTOR FOR EDG 24 HR RUN TIME-4 HR 3.27E-01 REC-30MIN Recovery of Offsite Power in 30 min (prior to S/G dryout) 7.30E-01 REC-4HR Recovery of Offsite Power in 4 Hours (prior to battery depletion) 4.70E-01 17 52.04 1.27E-07 IE LOSWS LOSS OF SERVICE WATER SYSTEM (IE FREQ) 1.22E-03 PP-PMMT-CCW-SBLOCA PRIMARY COOLANT PUMP SEAL FAILURE GIVEN A SBO AND CONSEQUENTIAL 1.04E-04 SMALL BREAK LOCA 18 52.48 1.15E-07 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <2"] (IE FREQ) 2.26E-03 Y-PMCC-P8C66ABME COMMON CAUSE FAILURE OF P-8C 5.1 OE-05 19 52.89 1.06E-07 IELOOP Loss of Offsite Power 1.11E-02 E-DGCC-K-6A&B&NSR-ME EDG1-1 EDG1-2 AND NSR COMMON CAUSE FAIL TO START 2.78E-05 REC-30MIN Recovery of Offsite Power in 30 min (prior to S/G dryout) 7.30E-01 REC-4HR Recovery of Offsite Power in 4 Hours (prior to battery depletion) 4.70E-01 20 53.29 1.03E-07 IETRANS-WC TRANSIENT WITH THE MAIN CONDENSER AVAILABLE (IE FREQ) 1.97E-01 G-PMOE-P-55ABC OPERATOR FAILS TO INITIATE CHARGING FLOW 1.10E-01

/RVC Pressurizer Safeties Closed 9.91 E-01

/RVO Pressurizer Safeties Open 9.99E-01 RXC-ELEC-FAULTS Electrical Scram Signal Faults 4.81 E-06 21 53.68 1.01E-07 IECNTRLSD CONTROLLED MANUAL SHUTDOWN (IE FREQ) 2.43E+00 RVC Pressurizer Safeties Closed 8.61 E-03

/RVO Pressurizer Safeties Open 9.99E-01 RXC-ELEC-FAULTS Electrical Scram Signal Faults 4.81 E-06 22 54.06 9.99E-08 IESGTR STEAM GENERATOR TUBE RUPTURE (IE FREQ) 3.01 E-03 B-HCMA-HIC-0780A SDCR CONTROLLER HIC-0780A FAILS TO DE-ENERGIZE 1.14E-02 B-XVOB-ADVS-MAN OPERATOR FAILS TO CLOSE MANUAL VALVES TO CLOSE ADV 4.03E-02 L-ZZOA-SDC-CDTNL-HEP-2 CONDITIONAL HEP: B-XVOB-ADVS-MAN

L-ZZOA-SDC-INIT 1.45E-01 SGTRA FT TOP: STEAM GENERATOR TUBE RUPTURE ON SG A (developed event) 5.OOE-01 23 54.44 9.99E-08 IESGTR STEAM GENERATOR TUBE RUPTURE (IE FREQ) 3.01E-03 B-3

LTR-PSA-09-04 October 1, 2009 Attachment B SAPHIRE CDF Top 100 Cutsets Table B-1: PSAR2c Zero Maintenance, P-7C Out of Service (Top 100 Cutsets)

Cut No.

% Total Prob./Frequency Basic Event Description Event Prob.

B-HCMA-HIC-0780A SDCR CONTROLLER HIC-0780A FAILS TO DE-ENERGIZE 1.14E-02 B-XVOB-ADVS-MAN OPERATOR FAILS TO CLOSE MANUAL VALVES TO CLOSE ADV 4.03E-02 L-ZZOA-SDC-CDTNL-HEP-2 CONDITIONAL HEP: B-XVOB-ADVS-MAN

L-ZZOA-SDC-INIT 1.45E-01 SGTRB FT TOP: STEAM GENERATOR TUBE RUPTURE ON SG B (developed event) 5.OOE-01 24 54.81 9.61E-08 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <2"] (IE FREQ) 2.26E-03 R-REMD-TVX-3 RELAY TVX-3 FAILS TO REMAIN DE-ENERGIZED 6.52E-03 R-REMD-TVX-4 RELAY TVX-4 FAILS TO REMAIN DE-ENERGIZED 6.52E-03 25 55.18 9.61E-08 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <2'] (IE FREQ) 2.26E-03 R-REMD-TVX-3 RELAY TVX-3 FAILS TO REMAIN DE-ENERGIZED 6.52E-03 R-REMD-TX-4 RELAY TX-4 FAILS TO REMAIN DE-ENERGIZED 6.52E-03 26 55.55 9.61E-08 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <2"] (IE FREQ) 2.26E-03 R-REMD-TX-3 RELAY TX-3 FAILS TO REMAIN DE-ENERGIZED 6.52E-03 R-REMD-TX-4 RELAY TX-4 FAILS TO REMAIN DE-ENERGIZED 6.52E-03 27 55.92 9.61E-08 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <2"] (IE FREQ) 2.26E-03 R-REMD-TVX-4 RELAY TVX-4 FAILS TO REMAIN DE-ENERGIZED 6.52E-03 R-REMD-TX-3 RELAY TX-3 FAILS TO REMAIN DE-ENERGIZED 6.52E-03 28 56.29 9.58E-08 IESGTR STEAM GENERATOR TUBE RUPTURE (IE FREQ) 3.0 1E-03 L-TPMT-PT-0104A PRESSURE TRANSMITTER PT-0104A FAILS TO FUNCTION 2.45E-02 W-AVOA-PZR-SPRAY OPERATOR FAILS TO DEPRESSURIZE PCS WITH PZR SPRAY/AUX SPRAY 1.30E-03 29 56.66 9.58E-08 IESGTR STEAM GENERATOR TUBE RUPTURE (IE FREQ) 3.01E-03 L-TPMT-PT-0104B PRESSURE TRANSMITTER PT-0104B FAILS TO FUNCTION 2.45E-02 W-AVOA-PZR-SPRAY OPERATOR FAILS TO DEPRESSURIZE PCS WITH PZR SPRAY/AUX SPRAY 1.30E-03 30 56.96 7.90E-08 IESGTR STEAM GENERATOR TUBE RUPTURE (IE FREQ) 3.01E-03 L-TFMT-FT-0306 SDC INJECTION LINE FLOW TRANSMITTER FT-0306 FAILURE 2.02E-02 W-AVOA-PZR-SPRAY OPERATOR FAILS TO DEPRESSURIZE PCS WITH PZR SPRAY/AUX SPRAY 1.30E-03 31 57.26 7.81E-08 IELOMF-TRA LOSS OF FEEDWATER TRAIN A (IE FREQ) 7.07E-02 B-4

LTR-PSA-09-04 October 1, 2009 Attachment B SAPHIRE CDF Top 100 Cutsets Table B-1: PSAR2c Zero Maintenance, P-7C Out of Service (Top 100 Cutsets)

Cut No.

% Total Prob./Frequency Basic Event Description Event Prob.

MTC2 PERCENTAGE OF TIME W/MTC NOT SUFFICIENTLY POSITIVE 2.30E-01

/RVO, Pressurizer Safeties Open 9.99E-01 RXC-ELEC-FAULTS Electrical Scram Signal Faults 4.81E-06 32 57.56 7.81E-08 IELOMF-TRB LOSS OF FEEDWATER TRAIN B (IE FREQ) 7.07E-02 MTC2 PERCENTAGE OF TIME W/MTC NOT SUFFICIENTLY POSITIVE 2.30E-01

/RVO Pressurizer Safeties Open 9.99E-01 RXC-ELEC-FAULTS Electrical Scram Signal Faults 4.81E-06 33 57.84 7.22E-08 IECNTRLSD CONTROLLED MANUAL SHUTDOWN (IE FREQ) 2.43E+00 A-PMMG-P-8B AFW TURBINE PUMP P-8B FAILS TO RUN 5.82E-02 P-CBOB-BYREG WHEN TRUE" OP RECOVERY OF THE BYPASS REG IS CREDITED 5.00E-01 P-IVCC-INVALL-MT COMMON CAUSE FAILURE OF FOUR INVERTERS TO CONTINUE TO OPERAT 1.02E-06 34 58.1 6.64E-08 IE_LOSWS LOSS OF SERVICE WATER SYSTEM (IE FREQ) 1.22E-03 A-PMCC-P8ABC-ME COMMON CAUSE FAILURE OF ALL 3 AFW PUMPS P-8AIB/C TO START 5.45E-05 35 58.36 6.64E-08 IE SGTR STEAM GENERATOR TUBE RUPTURE (IE FREQ) 3.01E-03 L-HCMT-HIC-0306 SDC HX BYPASS VALVE HIC-0306B FAILS TO FUNCTION 1.70E-02 W-AVOA-PZR-SPRAY OPERATOR FAILS TO DEPRESSURIZE PCS WITH PZR SPRAY/AUX SPRAY 1.30E-03 36 58.62 6.64E-08 IESGTR STEAM GENERATOR TUBE RUPTURE (IE FREQ) 3.01E-03 L-HCMT-HIC-3025A SDC HX DISCHRG VALVE HAND INDIC CONTROLLER HIC-3025A FAIL 1.70E-02 W-AVOA-PZR-SPRAY OPERATOR FAILS TO DEPRESSURIZE PCS WITH PZR SPRAY/AUX SPRAY 1.30E-03 37 58.88 6.64E-08 IESGTR STEAM GENERATOR TUBE RUPTURE (IE FREQ) 3.01E-03 L-HCMT-HIC-3025B SDC HX DISCHRG VALVE HAND INDIC CONTROLLER HIC-3025B FAIL 1.70E-02 W-AVOA-PZR-SPRAY OPERATOR FAILS TO DEPRESSURIZE PCS WITH PZR SPRAY/AUX SPRAY 1.30E-03 38 59.14 6.64E-08 IESGTR STEAM GENERATOR TUBE RUPTURE (IE FREQ)'

3.01E-03 L-CEPO-POC-0306 SDC HX BYPASS POSITION CONTROLLER POC-0306 FAILS 1.70E-02 W-AVOA-PZR-SPRAY OPERATOR FAILS TO DEPRESSURIZE PCS WITH PZR SPRAY/AUX SPRAY 1.30E-03 39 59.4 6.64E-08 IESGTR STEAM GENERATOR TUBE RUPTURE (IE FREQ) 3.01E-03 B-5

LTR-PSA-09-04 October 1, 2009 Attachment B SAPHIRE CDF Top 100 Cutsets Table B-I: PSAR2c Zero Maintenance, P-7C Out of Service (Top 100 Cutsets)

Cut No.

% Total Prob./Frequency Basic Event Description Event Prob.

L-CEPO-POC-3025 SDC HX DISCHARGE POSITION CONTROLLER POC-3025 FAILS 1.70E-02 W-AVOA-PZR-SPRAY OPERATOR FAILS TO DEPRESSURIZE PCS WITH PZR SPRAY/AUX SPRAY 1.30E-03 40 59.66 6.63E-08 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <2"] (IE FREQ) 2.26E-03 Y-MVCC-ESS-ALL12 COMMON CAUSE FTO OF ALL 8 HPSI MOVS AND ALL 4 LPSI MOVS 2.94E-05 41 59.92 6.63E-08 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <2"] (IE FREQ) 2.26E-03 H-MVCC-ESS-ALL8 COMMON CAUSE FTO OF ALL 8 HPSI MOVS 2.94E-05 42 60.16 6.19E-08 IESGTR STEAM GENERATOR TUBE RUPTURE (IE FREQ) 3.01E-03 I-FLMK-F-28 CV-3025 LOCAL IA SUPPLY FILTER F28 PLUGGED 1.58E-02 W-AVOA-PZR-SPRAY OPERATOR FAILS TO DEPRESSURIZE PCS WITH PZR SPRAY/AUX SPRAY 1.30E-03 43 60.4 6.19E-08 IESGTR STEAM GENERATOR TUBE RUPTURE (IE FREQ) 3.01E-03 Q-FLMK-F-310 SDC HX INLET VALVE HPA SUPPLY FILTER F-310 PLUGGED 1.58E-02 W-AVOA-PZR-SPRAY OPERATOR FAILS TO DEPRESSURIZE PCS WITH PZR SPRAY/AUX SPRAY 1.30E-03 44 60.64 6.17E-08 IEMLBLOCA LOSS OF COOLANT ACCIDENT - MED LRGE BRK [>6" and <18"] (IE FREQ) 3.43E-05 H-AVOT-HL-INJ OPERATOR FAILS TO ALIGN HOT LEG INJECTION 1.80E-03 45 60.87 6.04E-08 IEISLOCA INTERFACING SYSTEMS LOCA (IE FREQ) 1.00E+00 L-MVMJ-MO-3015 MOTOR OPERATED VALVE 3015 LEAKS (IE EVENT) 4.85E-03 L-MVMJ-MO-3016 MOTOR OPERATED VALVE 3016 LEAKS 1.33E-05 L-PIPE-GC-14 PIPE FAILS DUE TO PRIMARY CYCLE PRESSURE (GC 14 INCH) 9.37E-01

.46 61.1 6.03E-08 IEMBLOCA LOSS OF COOLANT ACCIDENT - MEDIUM BREAK [>ý2" and <6"] (IE FREQ) 3.35E-05 H-AVOT-HL-INJ OPERATOR FAILS TO ALIGN HOT LEG INJECTION 1.80E-03 47 61.32 5.80E-08 IELOMC LOSS OF MAIN CONDENSER VACUUM (IE FREQ) 5.25E-02 MTC2 PERCENTAGE OF TIME W/MTC NOT SUFFICIENTLY POSITIVE 2.30E-01

/RVO Pressurizer Safeties Open 9.99E-01 RXC-ELEC-FAULTS Electrical Scram Signal Faults 4.81E-06 48 61.54 5.79E-08 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <2"] (IE FREQ) 2.26E-03 R-REMD-TVX-4 RELAY TVX-4 FAILS TO REMAIN DE-ENERGIZED 6.52E-03 B-6

LTR-PSA-09-04 October 1, 2009 Attachment B SAPHIRE CDF Top 100 Cutsets Table B-I: PSAR2c Zero Maintenance, P-7C Out of Service (Top 100 Cutsets)

Cut No.

% Total Prob./Frequency Basic Event Description Event Prob.

U-KVMA-SV-0821 SV-0821 FAILS TO DE-ENERGIZE 3.93E-03 49 61.76 5.79E-08 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <2"] (IE FREQ) 2.26E-03 R-REMD-TX-4 RELAY TX-4 FAILS TO REMAIN DE-ENERGIZED 6.52E-03 U-KVMA-SV-0821 SV-0821 FAILS TO DE-ENERGIZE 3.93E-03 50 61.98 5.79E-08 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <2"] (IE FREQ) 2.26E-03 R-REMD-TVX-4 RELAY TVX-4 FAILS TO REMAIN DE-ENERGIZED 6.52E-03 Y-KVMA-SV-0938 CCW TO SDC HX AIR SUPPLY SV-0938 FTD 3.93E-03 51 62.2 5.79E-08 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <2"] (IE FREQ) 2.26E-03 R-REMD-TX-4 RELAY TX-4 FAILS TO REMAIN DE-ENERGIZED 6.52E-03 Y-KVMA-SV-0938 CCW TO SDC HX AIR SUPPLY SV-0938 FTD 3.93E-03 52 62.4 5.21E-08 IELOOP Loss of Offsite Power 1.11E-02 A-OOOT-CSTMK-CDTNL-HEP-2 COND HEP: L-ZZOA-SDC-INIT

A-OOOT-CSTMKUP

P-CBOB-BUS1 E 1.43E-01 H-ZZOA-OTC-INIT OPERATOR FAILS TO INITIATE ONCE THROUGH COOLING 2.90E-03 L-ZZOA-SDC-INIT OPERATOR FAILS TO INITIATE SDC 1.55E-02 REC-30MIN Recovery of Offsite Power in 30 min (prior to S/G dryout) 7.30E-01 53 62.59 4.99E-08 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <2"] (IE FREQ) 2.26E-03 Y-CVCC-SIRWT-MA BOTH SIRWT SUPPLY CK VALVES CK-ES3239 & CK-ES3240 CCAUSE FTO 2.21 E-05 54 62.78 4.99E-08 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <2"] (IE FREQ) 2.26E-03 Y-CVCC-SUMP-MA BOTH SUMP SUPPLY CK VALVES CK-ES3166 & CK-ES3181 CCAUSE FTO 2.21E-05 55 62.97 4.97E-08 IECNTRLSD CONTROLLED MANUAL SHUTDOWN (IE FREQ) 2.43E+00 A-PMMG-P-8B AFW TURBINE PUMP P-8B FAILS TO RUN 5.82E-02 P-CBOB-BYREG WHEN 'TRUE" OP RECOVERY OF THE BYPASS REG IS CREDITED 5.OOE-01 P-IVCC-INV-123MT COMMON CAUSE FAILURE OF THREE INVERTERS #1 7.03E-07 56 63.16 4.96E-08 IE LOMSIV SPURIOUS MSIV CLOSURE (IE FREQ) 4.49E-02 MTC2 PERCENTAGE OF TIME W/MTC NOT SUFFICIENTLY POSITIVE 2.30E-01

/RVO Pressurizer Safeties Open 9.99E-01 B-7

LTR-PSA-09-04 October 1, 2009 Attachment B SAPHIRE CDF Top 100 Cutsets Table B-I: PSAR2c Zero Maintenance, P-7C Out of Service (Top 100 Cutsets)

Cut No.

% Total Prob./Frequency Basic Event Description Event Prob.

RXC-ELEC-FAULTS Electrical Scram Signal Faults 4.81E-06 57 63.35 4.96E-08 IESGTR STEAM GENERATOR TUBE RUPTURE (IE FREQ) 3.01E-03 B-HCMB-HIC-0780A SDCR CONTROLLER HIC-0780A FAILS TO ENERGIZE 1.14E-02 H-ZZOA-OTC-INIT OPERATOR FAILS TO INITIATE ONCE THROUGH COOLING 2.90E-03 SGTRA FT TOP: STEAM GENERATOR TUBE RUPTURE ON SG A (developed event) 5.00E-01 58 63.54 4.96E-08 IESGTR STEAM GENERATOR TUBE RUPTURE (IE FREQ) 3.01E-03 B-HCMB-HIC-0780A SDCR CONTROLLER HIC-0780A FAILS TO ENERGIZE 1.14E-02 H-ZZOA-OTC-INIT OPERATOR FAILS TO INITIATE ONCE THROUGH COOLING 2.90E-03 SGTRB FT TOP: STEAM GENERATOR TUBE RUPTURE ON SG B (developed event) 5.00E-01 59 63.73 4.84E-08 IE SBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <2'1 (IE FREQ) 2.26E-03 H-CVCC-HPSIPP-MA BOTH HPSI PUMP DICHARGE CK VLVES CK-ES3177 & 3186 CCAUSE FTO 2.14E-05 60 63.92 4.84E-08 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <2'] (IE FREQ) 2.26E-03 H-CVCC-RECIRC-MA BOTH HPSI PUMP RECIRC CK VLVS TO SIRWT COMMON CAUSE FTO 2.14E-05 61 64.11 4.84E-08 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <2"] (IE FREQ) 2.26E-03 H-CVCC-SUCT-MA BOTH HPSI PUMP SUMP SUCTION CK VLVS COMMON CAUSE FTO 2.14E-05 62 64.29 4.76E-08 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <2"] (IE FREQ) 2.26E-03 Y-CVCC-RECIRC-MA BOTH SIRWT RECIRC CK VALVES CK-ES3331 & ES3332 CCAUSE FTO 2.11 E-05 63 64.46 4.42E-08 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <2"1 (IE FREQ) 2.26E-03 Y-AVMB-CV-3027 SIRWT RECIRC VALVE CV-3027 FTC 4.42E-03 Y-AVMB-CV-3056 SIRWT RECIRC VALVE CV-3056 FTC 4.42E-03 64 64.62 4.08E-08 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <2"] (IE FREQ) 2.26E-03 Y-PMCC-P66AB-ME COMMON CAUSE FAILURE OF P-66A AND P-66B TO START 1.81 E-05 65 64.78 4.04E-08 IECNTRLSD CONTROLLED MANUAL SHUTDOWN (IE FREQ) 2.43E+00 MTC1 PERCENTAGE OF TIME W/MTC NOT SUFFICIENTLY POSITIVE 2.00E-02

/RVO Pressurizer Safeties Open 9.99E-01

/RXC-ELEC-FAULTS Electrical Scram Signal Faults 1.00E+00 B-8

LTR-PSA-09-04 October 1, 2009 Attachment B SAPHIRE CDF Top 100 Cutsets Table B-I: PSAR2c Zero Maintenance, P-7C Out of Service (Top 100 Cutsets)

Cut No.

% Total Prob./Frequency Basic Event Description Event Prob.

RXC-MECH-FAULTS Mechanical Scram Faults 8.40E-07

/TTF Turbine Trip 9.90E-01 66 64.93 3.93E-08 IE SBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <2"] (IE FREQ) 2.26E-03 Y-AVMB-CV-3027 SIRWT RECIRC VALVE CV-3027 FTC 4.42E-03 Y-KVMB-SV-3056B SIRWT RECIRC VALVE SOLENOID SV-3056B FTE 3.93E-03 67 65.08 3.93E-08 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <2"] (IE FREQ) 2.26E-03 Y-AVMB-CV-3056 SIRWT RECIRC VALVE CV-3056 FTC 4.42E-03 Y-KVMB-SV-3027B SIRWT RECIRC VALVE SOLENOID SV-3027B FTE 3.93E-03 68 65.23 3.93E-08 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <2"] (IE FREQ) 2.26E-03 Y-AVMB-CV-3027 SIRWT RECIRC VALVE CV-3027 FTC 4.42E-03 Y-KVMB-SV-3056A SIRWT RECIRC VALVE SOLENOID SV-3056A FTE 3.93E-03 69 65.38 3.93E-08 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <2"] (IE FREQ) 2.26E-03 Y-AVMB-CV-3056 SIRWT RECIRC VALVE CV-3056 FTC 4.42E-03 Y-KVMB-SV-3027A SIRWT RECIRC VALVE SOLENOID SV-3027A FTE 3.93E-03 70 65.52 3.71E-08 IE LOMF-TRA LOSS OF FEEDWATER TRAIN A (IE FREQ) 7.07E-02 G-PMOE-P-55ABC OPERATOR FAILS TO INITIATE CHARGING FLOW 1.10E-01

/RVC Pressurizer Safeties Closed 9.91E-01

/RVO Pressurizer Safeties Open 9.99E-01 RXC-ELEC-FAULTS Electrical Scram Signal Faults 4.81E-06 71 65.66 3.71E-08 IELOMF-TRB LOSS OF FEEDWATER TRAIN B (IE FREQ) 7.07E-02 G-PMOE-P-55ABC OPERATOR FAILS TO INITIATE CHARGING FLOW 1.10E-01

/RVC Pressurizer Safeties Closed 9.91E-01

/RVO Pressurizer Safeties Open 9.99E-01 RXC-ELEC-FAULTS Electrical Scram Signal Faults 4.81E-06 72 65.79 3.49E-08 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <2"] (IE FREQ) 2.26E-03 Y-KVMB-SV-3027A SIRWT RECIRC VALVE SOLENOID SV-3027A FTE 3.93E-03 B-9

LTR-PSA-09-04 October 1, 2009 Attachment B SAPHIRE CDF Top 100 Cutsets Table B-I: PSAR2c Zero Maintenance, P-7C Out of Service (Top 100 Cutsets)

Cut No.

% Total Prob./Frequency Basic Event Description Event Prob.

Y-KVMB-SV-3056B SIRWT RECIRC VALVE SOLENOID SV-3056B FTE 3.93E-03 73 65.92 3.49E-08 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <2"] (IE FREQ) 2.26E-03 Y-KVMB-SV-3027B SIRWT RECIRC VALVE SOLENOID SV-3027B FTE 3.93E-03 Y-KVMB-SV-3056B SIRWT RECIRC VALVE SOLENOID SV-3056B FTE 3.93E-03 74 66.05 3.49E-08 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <2"] (IE FREQ) 2.26E-03 Z-KVMB-SV-3029A SUMP TO EAST ESS AIR SUPPLY SV-3029A FTE 3.93E-03 Z-KVMB-SV-3030B SUMP TO WEST ESS AIR SUPPLY SV-3030B FTE 3.93E-03 75 66.18 3.49E-08 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <2"] (IE FREQ) 2.26E-03 Z-KVMB-SV-3029B SUMP TO EAST ESS AIR SUPPLY SV-3029B FTE 3.93E-03 Z-KVMB-SV-3030B SUMP TO WEST ESS AIR SUPPLY SV-3030B FTE 3.93E-03 76 66.31 3.49E-08 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <2"] (IE FREQ) 2.26E-03 Z-KVMB-SV-3029A SUMP TO EAST ESS AIR SUPPLY SV-3029A FTE 3.93E-03 Z-KVMB-SV-3030A SUMP TO WEST ESS AIR SUPPLY SV-3030A FTE 3.93E-03 77 66.44 3.49E-08 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <2"] (IE FREQ) 2.26E-03 Z-KVMB-SV-3029B SUMP TO EAST ESS AIR SUPPLY SV-3029B FTE 3.93E-03 Z-KVMB-SV-3030A SUMP TO WEST ESS AIR SUPPLY SV-3030A FTE 3.93E-03 78 66.57 3.49E-08 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <2"] (IE FREQ) 2.26E-03 Y-KVMB-SV-3027A SIRWT RECIRC VALVE SOLENOID SV-3027A FTE 3.93E-03 Y-KVMB-SV-3056A SIRWT RECIRC VALVE SOLENOID SV-3056A FTE 3.93E-03 79 66.7 3.49E-08 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <2"] (IE FREQ) 2.26E-03 Y-KVMB-SV-3027B SIRWT RECIRC VALVE SOLENOID SV-3027B FTE 3.93E-03 Y-KVMB-SV-3056A SIRWT RECIRC VALVE SOLENOID SV-3056A FTE 3.93E-03

80.

66.83 3.46E-08 IESGTR STEAM GENERATOR TUBE RUPTURE (IE FREQ) 3.01E-03 B-KVMA-SV-0782B ADV CV-0782 AIR SUPPLY SV-0782B FTD 3.93E-03 B-XVOB-ADVS-MAN OPERATOR FAILS TO CLOSE MANUAL VALVES TO CLOSE ADV 4.03E-02 L-ZZOA-SDC-CDTNL-HEP-2 CONDITIONAL HEP: B-XVOB-ADVS-MAN

L-ZZOA-SDC-INIT 1.45E-01 B-1 0

LTR-PSA-09-04 October 1, 2009 Attachment B SAPHIRE CDF Top 100 Cutsets Table B-I: PSAR2c Zero Maintenance, P-7C Out of Service (Top 100 Cutsets)

Cut No.

% Total Prob./Frequency Basic Event Description Event Prob.

SGTRA FT TOP: STEAM GENERATOR TUBE RUPTURE ON SG A (developed event) 5.00E-01 81 66.96 3.46E-08 IESGTR STEAM GENERATOR TUBE RUPTURE (IE FREQ) 3.01E-03 B-KVMA-SV-0781C ADV CV-0781 AIR SUPPLY SV-0781C FTD 3.93E-03 B-XVOB-ADVS-MAN OPERATOR FAILS TO CLOSE MANUAL VALVES TO CLOSE ADV 4.03E-02 L-ZZOA-SDC-CDTNL-HEP-2 CONDITIONAL HEP: B-XVOB-ADVS-MAN

L-ZZOA-SDC-INIT 1.45E-01 SGTRA FT TOP: STEAM GENERATOR TUBE RUPTURE ON SG A (developed event) 5.OOE-01 82 67.09 3.46E-08 IESGTR STEAM GENERATOR TUBE RUPTURE (IE FREQ) 3.01 E-03 B-KVMA-SV-0781B ADV CV-0781 AIR SUPPLY SV-0781B FTD 3.93E-03 B-XVOB-ADVS-MAN OPERATOR FAILS TO CLOSE MANUAL VALVES TO CLOSE ADV 4.03E-02 L-ZZOA-SDC-CDTNL-HEP-2 CONDITIONAL HEP: B-XVOB-ADVS-MAN

L-ZZOA-SDC-INIT 1.45E-01 SGTRA FT TOP : STEAM GENERATOR TUBE RUPTURE ON SG A (developed event) 5.OOE-01 83 67.22 3.46E-08 IESGTR STEAM GENERATOR TUBE RUPTURE (IE FREQ) 3.01E-03 B-KVMA-SV-0780C ADV CV-0780 AIR SUPPLY SV-0780C FTD 3.93E-03 B-XVOB-ADVS-MAN OPERATOR FAILS TO CLOSE MANUAL VALVES TO CLOSE ADV 4.03E-02 L-ZZOA-SDC-CDTNL-HEP-2 CONDITIONAL HEP: B-XVOB-ADVS-MAN

L-ZZOA-SDC-INIT 1.45E-01 SGTRB FT TOP: STEAM GENERATOR TUBE RUPTURE ON SG B (developed event) 5.O0E-01 84 67.35 3.46E-08 IESGTR STEAM GENERATOR TUBE RUPTURE (IE FREQ) 3.01E-03 B-KVMA-SV-0782C ADV CV-0782 AIR SUPPLY SV-0782C FTD 3.93E-03 B-XVOB-ADVS-MAN OPERATOR FAILS TO CLOSE MANUAL VALVES TO CLOSE ADV 4.03E-02 L-ZZOA-SDC-CDTNL-HEP-2 CONDITIONAL HEP: B-XVOB-ADVS-MAN

L-ZZOA-SDC-INIT 1.45E-01 SGTRA FT TOP: STEAM GENERATOR TUBE RUPTURE ON SG A(developed event) 5.OOE-01 85 67.48 3.46E-08 IESGTR STEAM GENERATOR TUBE RUPTURE (IE FREQ) 3.01E-03 B-KVMA-SV-0779B ADV CV-0779 AIR SUPPLY SV-0779B FTD 3.93E-03 B-XVOB-ADVS-MAN OPERATOR FAILS TO CLOSE MANUAL VALVES TO CLOSE ADV 4.03E-02 L-ZZOA-SDC-CDTNL-HEP-2 CONDITIONAL HEP: B-XVOB-ADVS-MAN

L-ZZOA-SDC-INIT 1.45E-01 SGTRB FT TOP : STEAM GENERATOR TUBE RUPTURE ON SG B (developed event) 5.OOE-01 B-11

LTR-PSA-09-04 October 1, 2009 Attachment B SAPHIRE CDF Top 100 Cutsets Table B-I: PSAR2c Zero Maintenance, P-7C Out of Service (Top 100 Cutsets)

Cut No.

% Total Prob./Frequency Basic Event Description Event Prob.

86 67.61 3.46E-08 IESGTR STEAM GENERATOR TUBE RUPTURE (IE FREQ) 3.01E-03 B-KVMA-SV-0779C ADV CV-0779 AIR SUPPLY SV-0779C FTD 3.93E-03 B-XVOB-ADVS-MAN OPERATOR FAILS TO CLOSE MANUAL VALVES TO CLOSE ADV 4.03E-02 L-ZZOA-SDC-CDTNL-HEP-2 CONDITIONAL HEP: B-XVOB-ADVS-MAN

L-ZZOA-SDC-INIT 1.45E-01 SGTRB FT TOP : STEAM GENERATOR TUBE RUPTURE ON SG B (developed event) 5.OOE-01 87 67.74 3.46E-08 IESGTR STEAM GENERATOR TUBE RUPTURE (IE FREQ) 3.01E-03 B-KVMA-SV-0780B ADV CV-0780 AIR SUPPLY SV-0780B FTD 3.93E-03 B-XVOB-ADVS-MAN OPERATOR FAILS TO CLOSE MANUAL VALVES TO CLOSE ADV 4.03E-02 L-ZZOA-SDC-CDTNL-HEP-2 CONDITIONAL HEP: B-XVOB-ADVS-MAN

L-ZZOA-SDC-INIT 1.45E-01 SGTRB FT TOP: STEAM GENERATOR TUBE RUPTURE ON SG B (developed event) 5.OOE-01 88 67.87 3.46E-08 IESGTR STEAM GENERATOR TUBE RUPTURE (IE FREQ) 3.01E-03 B-KVMA-SV-0782C ADV CV-0782 AIR SUPPLY SV-0782C FTD 3.93E-03 B-XVOB-ADVS-MAN OPERATOR FAILS TO CLOSE MANUAL VALVES TO CLOSE ADV 4.03E-02 L-ZZOA-SDC-CDTNL-HEP-2 CONDITIONAL HEP: B-XVOB-ADVS-MAN

L-ZZOA-SDC-INIT 1.45E-01 SGTRB FT TOP: STEAM GENERATOR TUBE RUPTURE ON SG B (developed event) 5.OOE-01 X-HSE-SGA-BLDN SET TO 'T' - ESDE ON SG E-50A (House Event) 1.00E+00 89 68 3.46E-08 IESGTR STEAM GENERATOR TUBE RUPTURE (IE FREQ) 3.01E-03 B-KVMA-SV-0781 B ADV CV-0781 AIR SUPPLY SV-0781 B FTD 3.93E-03 B-XVOB-ADVS-MAN OPERATOR FAILS TO CLOSE MANUAL VALVES TO CLOSE ADV 4.03E-02 L-ZZOA-SDC-CDTNL-HEP-2 CONDITIONAL HEP: B-XVOB-ADVS-MAN

L-ZZOA-SDC-INIT 1.45E-01 SGTRB FT TOP: STEAM GENERATOR TUBE RUPTURE ON SG B (developed event) 5.OOE-01 X-HSE-SGA-BLDN SET TO 'T' - ESDE ON SG E-50A (House Event) 1.OOE+00 90 68.13 3.46E-08 IESGTR STEAM GENERATOR TUBE RUPTURE (IE FREQ) 3.01E-03 B-KVMA-SV-0781C ADV CV-0781 AIR SUPPLY SV-0781C FTD 3.93E-03 B-XVOB-ADVS-MAN OPERATOR FAILS TO CLOSE MANUAL VALVES TO CLOSE ADV 4.03E-02 L-ZZOA-SDC-CDTNL-HEP-2 CONDITIONAL HEP: B-XVOB-ADVS-MAN

L-ZZOA-SDC-INIT 1.45E-01 B-12

LTR-PSA-09-04 October 1, 2009 Attachment B SAPHIRE CDF Top 100 Cutsets Table B-I: PSAR2c Zero Maintenance, P-7C Out of Service (Top 100 Cutsets)

Cut No.

% Total Prob./Frequency Basic Event Description Event Prob.

SGTRB FT TOP: STEAM GENERATOR TUBE RUPTURE ON SG B (developed event) 5.O0E-01 X-HSE-SGA-BLDN SET TO 'T' - ESDE ON SG E-50A (House Event) 1.OOE+00 91 68.26 3.46E-08 IESGTR STEAM GENERATOR TUBE RUPTURE (IE FREQ) 3.01E-03 B-KVMA-SV-0782B ADV CV-0782 AIR SUPPLY SV-0782B FTD 3.93E-03 B-XVOB-ADVS-MAN OPERATOR FAILS TO CLOSE MANUAL VALVES TO CLOSE ADV 4.03E-02 L-7ZOA-SDC-CDTNL-HEP-2 CONDITIONAL HEP: B-XVOB-ADVS-MAN

L-ZZOA-SDC-INIT 1.45E-01 SGTRB FT TOP: STEAM GENERATOR TUBE RUPTURE ON SG B (developed event) 5.OOE-01 X-HSE-SGA-BLDN SET TO 'T' - ESDE ON SG E-50A (House Event) 1.00E+00 92 68.39 3.46E-08 IESGTR STEAM GENERATOR TUBE RUPTURE (IE FREQ) 3.01E-03 B-KVMA-SV-0780C ADV CV-0780 AIR SUPPLY SV-0780C FTD 3.93E-03 B-XVOB-ADVS-MAN OPERATOR FAILS TO CLOSE MANUAL VALVES TO CLOSE ADV 4.03E-02 L-ZZOA-SDC-CDTNL-HEP-2.

CONDITIONAL HEP: B-XVOB-ADVS-MAN

L-ZZOA-SDC-INIT 1.45E-01 SGTRA FT TOP: STEAM GENERATOR TUBE RUPTURE ON SG A (developed event) 5.OOE-01 X-HSE-SGB-BLDN SET TO 'T' - ESDE ON SG E-50B (House Event) 1.OOE+00 93 68.52 3.46E-08 IESGTR STEAM GENERATOR TUBE RUPTURE (IE FREQ) 3.01E-03 B-KVMA-SV-0780B ADV CV-0780 AIR SUPPLY SV-0780B FTD 3.93E-03 B-XVOB-ADVS-MAN OPERATOR FAILS TO CLOSE MANUAL VALVES TO CLOSE ADV 4.03E-02 L-ZZOA-SDC-CDTNL-HEP-2 CONDITIONAL HEP: B-XVOB-ADVS-MAN

L-ZZOA-SDC-INIT 1.45E-01 SGTRA FT TOP: STEAM GENERATOR TUBE RUPTURE ON SG A (developed event) 5.OOE-01 X-HSE-SGB-BLDN SET TO'T' - ESDE ON SG E-50B (House Event) 1.OOE+00 94 68.65 3.46E-08 IESGTR STEAM GENERATOR TUBE RUPTURE (IE FREQ) 3.01E-03 B-KVMA-SV-0779C ADV CV-0779 AIR SUPPLY SV-0779C FTD 3.93E-03 B-XVOB-ADVS-MAN OPERATOR FAILS TO CLOSE MANUAL VALVES TO CLOSE ADV 4.03E-02 L-ZZOA-SDC-CDTNL-HEP-2 CONDITIONAL HEP: B-XVOB-ADVS-MAN

L-ZZOA-SDC-INIT 1.45E-01 SGTRA FT TOP: STEAM GENERATOR TUBE RUPTURE ON SG A (developed event) 5.OOE-01 X-HSE-SGB-BLDN SET TO 'T' - ESDE ON SG E-50B (House Event) 1.OOE+00 B-13

LTR-PSA-09-04 October 1, 2009 Attachment B SAPHIRE CDF Top 100 Cutsets Table B-1: PSAR2c Zero Maintenance, P-7C Out of Service (Top 100 Cutsets)

Cut No.

% Total Prob./Frequency Basic Event Description Event Prob.

95 68.78 3.46E-08 IESGTR STEAM GENERATOR TUBE RUPTURE (IE FREQ) 3.01E-03 B-KVMA-SV-0779B ADV CV-0779 AIR SUPPLY SV-0779B FTD 3.93E-03 B-XVOB-ADVS-MAN OPERATOR FAILS TO CLOSE MANUAL VALVES TO CLOSE ADV 4.03E-02 L-ZZOA-SDC-CDTNL-HEP-2 CONDITIONAL HEP: B-XVOB-ADVS-MAN

L-ZZOA-SDC-INIT 1.45E-01 SGTRA FT TOP: STEAM GENERATOR TUBE RUPTURE ON SG A (developed event) 5.OOE-01 X-HSE-SGB-BLDN SET TO 'T' - ESDE ON SG E-50B (House Event) 1.00E+00 96 68.9 3.08E-08 IELOOP Loss of Offsite Power 1.11E-02 E-DG-ENGINE-REC-4HR EDG ENGINE RECOVERY IN 4 HOURS 4.30E-01 E-DGMG-K-6A DIESEL GENERATOR 1-1 FAILS TO RUN 3.86E-02 E-DGMG-K-6B DIESEL GENERATOR 1-2 FAILS TO RUN 3.86E-02 E-DGMG-K-NSR NSR DIESEL GENERATOR FAILS TO RUN 3.86E-02 P-LOOP-REC-CORR-4HR OFFSITE POWER CORRECTION FACTOR FOR EDG 24 HR RUN TIME-4 HR 3.27E-01 REC-30MIN Recovery of Offsite Power in 30 min (prior to S/G dryout) 7.30E-01 REC-4HR Recovery of Offsite Power in 4 Hours (prior to battery depletion) 4.70E-01 97 69.02 3.01E-08 IELOMF LOSS OF MAIN FEEDWATER (IE FREQ) 2.72E-02 MTC2 PERCENTAGE OF TIME W/MTC NOT SUFFICIENTLY POSITIVE 2.30E-01

/RVO Pressurizer Safeties Open 9.99E-01 RXC-ELEC-FAULTS Electrical Scram Signal Faults 4.81E-06 98 69.13 2.94E-08 IESGTR STEAM GENERATOR TUBE RUPTURE (IE FREQ) 3.01E-03 B-AVMB-CV-0782.

ADV ON SG A CV-0782 FAILS TO CLOSE 3.34E-03 B-XVOB-ADVS-MAN OPERATOR FAILS TO CLOSE MANUAL VALVES TO CLOSE ADV 4.03E-02 L-ZZOA-SDC-CDTNL-HEP-2 CONDITIONAL HEP: B-XVOB-ADVS-MAN

L-ZZOA-SDC-INIT 1.45E-01 SGTRA FT TOP: STEAM GENERATOR TUBE RUPTURE ON SG A (developed event) 5.00E-01 99 69.24 2.94E-08 IESGTR STEAM GENERATOR TUBE RUPTURE (IE FREQ) 3.01E-03 B-AVMB-CV-0781 ADV ON SG A CV-0781 FAILS TO CLOSE 3.34E-03 B-XVOB-ADVS-MAN OPERATOR FAILS TO CLOSE MANUAL VALVES TO CLOSE ADV 4.03E-02 B-14

LTR-PSA-09-04 October 1, 2009 Attachment B SAPHIRE CDF Top 100 Cutsets Table B-I: PSAR2c Zero Maintenance, P-7C Out of Service (Top 100 Cutsets)

Cut No.

% Total Prob./Frequency Basic Event Description Event Prob.

L-ZZOA-SDC-CDTNL-HEP-2 CONDITIONAL HEP: B-XVOB-ADVS-MAN

L-ZZOA-SDC-INIT 1.45E-01 SGTRA FT TOP: STEAM GENERATOR TUBE RUPTURE ON SG A (developed event) 5.OOE-01 100 69.35 2.94E-08 IE_SGTR STEAM GENERATOR TUBE RUPTURE (IE FREQ) 3.01E-03 B-AVMB-CV-0779 ADV ON SG B CV-0779 FAILS TO CLOSE 3.34E-03 B-XVOB-ADVS-MAN OPERATOR FAILS TO CLOSE MANUAL VALVES TO CLOSE ADV 4.03E-02 L-ZZOA-SDC-CDTNL-HEP-2 CONDITIONAL HEP: B-XVOB-ADVS-MAN

L-ZZOA-SDC-INIT 1.45E-01 SGTRB FT TOP: STEAM GENERATOR TUBE RUPTURE ON SG B (developed event) 5.O0E-01 B-1 5

LTR-PSA-09-04 October 1, 2009 Attachment B SAPHIRE CDF Top 100 Cutsets Table B-2: PSAR2c Zero Maintenance, P-7C Out of Service, & Loss of Service Water Initiating Event Frequency Increase (Top 100 Cutsets)

Cut No.

% Total ProbJFrequency Basic Event Description Event Prob.

1 51.61 2.87E-05 IELOSWS LOSS OF SERVICE WATER SYSTEM (E FREQ)

PP-PMMT-CCW-MBLOCA PRIMARY COOLANT PUMP SEAL FAILURE GIVEN ASSO AND 2.35E-03 CONSEQUENTIAL MEDIUM BREAK LOCA 2

56.44 2.69E-06 IECNTRLSD CONTROLLED MANUAL SHUTDOWN (IE FREQ) 2.43E+00 MTC2 PERCENTAGE OF TIME W/MTC NOT SUFFICIENTLY POSITIVE 2.30E-01

/RVO Pressurizer Safeties Open 9.99E-01 RXC-ELEC-FAULTS Electrical Scram Signal Faults 4.81E-06 3

58.73 1.27E-06 IECNTRLSD CONTROLLED MANUAL SHUTDOWN (IE FREQ) 2.43E+00 G-PMOE-P-55ABC OPERATOR FAILS TO INITIATE CHARGING FLOW 1.10E-01

/RVC Pressurizer Safeties Closed 9.91E-01

/RVO Pressurizer Safeties Open 9.99E-01 RXC-ELEC-FAULTS Electrical Scram Signal Faults 4.81 E-06 4

61.01 127E-06 IELOSWS LOSS OF SERVICE WATER SYSTEM (IE FREQ) 1.22E-02 PP-PMMT-CCW-SBLOCA PRIMARY COOLANT PUMP SEAL FAILURE GIVEN A AND-04

_CONSEQUENTIAL SMALL BREAK LOCA 5

62.82 1.OOE-06 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4-and <21 (IE FREQ) 2.26E-03 Y-AVMD-CV-3027 AIR OPERATED VALVE CV-3027 FAILS TO REMAIN OPEN 4.44E-04 6

64.63 1.OOE-06 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <21 (IE FREQ) 2.26E-03 Y-AVMD-CV-3056 AIR OPERATED VALVE CV-3056 FAILS TO REMAIN OPEN 4.44E-04 7

66.07 7.99E-07 IESGTR STEAM GENERATOR TUBE RUPTURE (IE FREQ) 3.01E-03 A-AVOA-AFWFLADJ OPERATOR FAILS TO ADJUST AFW FLOW GIVEN FAILURE OF ONE HDR 1.45E-03 H-ZZOA-OTC-CDTNL-HEP-2 COND HEP: A-AVOA-AFWFLADJ

B-XVOB-ADVS-MAN

H-ZZOA-OTC-INIT 3.66E-01 SGTRA FT TOP : STEAM GENERATOR TUBE RUPTURE ON SG A (developed event) 5.OOE-01 8

67.51 7.99E-07 IESGTR STEAM GENERATOR TUBE RUPTURE (IE FREQ) 3.01E-03 A-AVOA-AFWFLADJ OPERATOR FAILS TO ADJUST AFW FLOW GIVEN FAILURE OF ONE HDR 1.45E-03 H-ZZOA-OTC-CDTNL-HEP-2 COND HEP: A-AVOA-AFWFLADJ

B-XVOB-ADVS-MAN

H-ZZOA-OTC-INIT 3.66E-01 SGTRB FT TOP: STEAM GENERATOR TUBE RUPTURE ON SG B (developed event) 5.OOE-01 B-16

LTR-PSA-09-04 October 1, 2009 Attachment B SAPHIRE CDF Top 100 Cutsets Table B-2: PSAR2c Zero Maintenance, P-7C Out of Service, & Loss of Service Water Initiating Event Frequency Increase (Top 100 Cutsets)

Cut No.

% Total ProbiFrequency Basic Event Description Event Prob.

9 68.71 6.64E-07 IELOSWS LOSS OF SERVICE WATER SYSTEM (IE FREQ) 1.22E-E2 A-PMCC-P8ABGME COMMON CAUSE FAILURE OF ALL 3 AFW PUMPS P-8A/ICTO START 5.45E-05 10 69.79 5.99E-07 IESGTR STEAM GENERATOR TUBE RUPTURE (IE FREQ) 3.01E-03 L-ZZOA-SDC-CDTNL-HEP-1 CONDITIONAL HEP: W-AVOA-PZR-SPRAY

L-ZZOA-SDC-INIT 1.53E-01 W-AVOA-PZR-SPRAY OPERATOR FAILS TO DEPRESSURIZE PCS WITH PZR SPRAY/AUX SPRAY 1.30E-03 11 70.85 5.88E-07 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <21 (IE FREQ) 2.26E-03 Y-AVOB-RAS-VLVS OPERATOR FAILS TO ENABLE ESS RECIRC VALVES TO CLOSE ON RAS 2.60E-04 12 71.42 3.16E-07 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <21 (IE FREQ) 2.26E-03 Y-AVCC-3027-56MB BOTH SIRWT RECIRC VALVES CV-3027 & CV-3056 COMMON CAUSE FTC 1.40E-04 13 71.95 2.94E-07 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <21 (IE FREQ) 2.26E-03 Z-LSOH-SIRW-HI SIRW TANK LEVEL SWITCHES MISCALIBRATED HIGH 1.30E-04 14 72.48 2.94E-07 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <21 (IE FREQ) 2.26E-03 Z-LSOH-SIRW-LOW SIRW TANK LEVEL SWITCHES MISCALIBRATED LOW 1.30E-04 15 72.91 2.39E-07 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <21 (IE FREQ) 2.26E-03 Y-AVCC-SUMP-MA COMMON CAUSE FAILURE OF CV-3029 & CV-3030 TO OPEN 1.06E-04 16 73.31 2.20E-07 IECNTRLSD CONTROLLED MANUAL SHUTDOWN (IE FREQ) 2.43E+00 G-PMOE-P-55ABC OPERATOR FAILS TO INITIATE CHARGING FLOW 1.10E-01

/RVC Pressurizer Safeties Closed 9.91E-01

/RVO Pressurizer Safeties Open 9.99E-01

/RXC-ELEC-FAULTS Electrical Scram Signal Faults 1.OOE+00 RXC-MECH-FAULTS Mechanical Scram Faults 8.40E-07

/TTF Turbine Trip 9.90E-01 17 73.7 2.18E-07 IETRANS-WC TRANSIENT WITH THE MAIN CONDENSER AVAILABLE (IE FREQ) 1.97E-01 MTC2 PERCENTAGE OF TIME WIMTC NOT SUFFICIENTLY POSITIVE 2.30E-01 IRVO Pressurizer Safeties Open 9.99E-01 RXC-ELEC-FAULTS Electrical Scram Signal Faults 4.81E-06 B-1 7

LTR-PSA-09-04 October 1, 2009 Attachment B SAPHIRE CDF Top 100 Cutsets Table B-2: PSAR2c Zero Maintenance, P-7C Out of Service, & Loss of Service Water Initiating Event Frequency Increase (Top 100 Cutsets)

Cut No.

% Total ProbJFrequency Basic Event Description Event Prob.

18 74.03 1.84E-07 IELOOP Loss of Offsite Power 1.11E-02 E-DG-ENGINE-REC-4HR EDG ENGINE RECOVERY IN 4 HOURS 4.30E-01 E-DGCC-K-6A&B&NSR-MG EDGI-1 EDG1-2 AND NSR COMMON CAUSE FAILURE TO RUN 3.44E-04 P-LOOP-REC-CORR-4HR OFFSITE POWER CORRECTION FACTOR FOR EDG 24 HR RUN TIME-4 HR 3.27E-01 REC-30MIN Recovery of Offslte Power in 30 min (prior to S/G dryout) 7.30E-01 REC-4HR Recovery of Offsite Power in 4 Hours (prior to battery depletion) 4.70E-01 19 74.26 1.30E-07 ELOSWS 1O08 OF SERVICE WATER SYSTEM (IE FREQ) 122E-02 A-CVCG-AFWPPS-MA ALL 3 AFW PP CK VALVES CK-FW726 1.07E-05 20 74.47 1.15E-07 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <2] (IE FREQ) 2.26E-03 Y-PMCC-P8C66ABME COMMON CAUSE FAILURE OF P-8C 5.10E-05 21 74.68 1.07E-07 IELOSWS LOSS OF SERVICE WATER SYSTEM (IE FREQ) 1.22E-02 A-OQOT-CSTMKUP OPERATOR FAILS TO MAKEUP TO CST 2.66E-03 A-PM

-P-936 P-936 FAILS TO START 3.29E-03 22 74.85 1.06E-07 IELOOP Loss of Offsite Power 1.11E-02 E-DGCC-K-6A&B&NSR-ME EDG1-1 EDG1-2 AND NSR COMMON CAUSE FAIL TO START 2.78E-05 REC-30MIN Recovery of Offsite Power in 30 min (prior to S/G dryout) 7.30E-01 REC-4HR Recovery of Offsite Power in 4 Hours (prior to battery depletion) 4.70E-01 23 75M04 1.06E-07 IEJ.OSS LOSS OF SERVICE WATER SYSTEM (IE FREQ) 1.22E-02 A-CVCC-AFWINJ-MA ALL 4 AFW 1W CHECK VALVES FTO DUE TO COMMON CAUSE 8.65E-06 24 75.23 1.03E-07 IETRANS-WC TRANSIENT WITH THE MAIN CONDENSER AVAILABLE (IE FREQ) 1.97E-01 G-PMOE-P-55ABC OPERATOR FAILS TO INITIATE CHARGING FLOW 1.1OE-01

/RVC Pressurizer Safeties Closed 9.91E-01

/RVO Pressurizer Safeties Open 9.99E-01 RXC-ELEC-FAULTS Electrical Scram Signal Faults 4.81E-06 25 75.41 1.01E-07 IECNTRLSD CONTROLLED MANUAL SHUTDOWN (IE FREQ) 2.43E+00 RVC Pressurizer Safeties Closed 8.61 E-03 B-18

LTR-PSA-09-04 October 1, 2009 Attachment B SAPHIRE CDF Top 100 Cutsets Table B-2: PSAR2c Zero Maintenance, P-7C Out of Service, & Loss of Service Water Initiating Event Frequency Increase (Top 100 Cutsets)

Cut No.

% Total ProbJFrequency Basic Event Description Event Prob.

/RVO Pressurizer Safeties Open 9.99E-01 RXC-ELEC-FAULTS Electrical Scram Signal Faults 4.81E-06 26 75.59 9.99E-08 IESGTR STEAM GENERATOR TUBE RUPTURE (IE FREQ) 3.01E-03 B-HCMA-HIC-0780A SDCR CONTROLLER HIC-0780A FAILS TO DE-ENERGIZE 1.14E-02 B-XVOB-ADVS-MAN OPERATOR FAILS TO CLOSE MANUAL VALVES TO CLOSE ADV 4.03E-02 L-ZZOA-SDC-CDTNL-HEP-2 CONDITIONAL HEP: B-XVOB-ADVS-MAN

L-ZZOA-SDC-INIT 1.45E-01 SGTRA FT TOP: STEAM GENERATOR TUBE RUPTURE ON SG A (developed event) 5.OOE-01 27 75.77 9.99E-08 IESGTR STEAM GENERATOR TUBE RUPTURE (IE FREQ) 3.01E-03 B-HCMA-HIC-0780A SDCR CONTROLLER HIC-0780A FAILS TO DE-ENERGIZE 1.14E-02 B-XVOB-ADVS-MAN OPERATOR FAILS TO CLOSE MANUAL VALVES TO CLOSE ADV 4.03E-02 L-ZZOA-SDC-CDTNL-HEP-2 CONDITIONAL HEP: B-XVOB-ADVS-MAN

L-ZZOA-SDC-INIT 1.45E-01 SGTRB FT TOP : STEAM GENERATOR TUBE RUPTURE ON SG B (developed event) 5.OOE-01 28 75.95 9.83E-08 IELOSWS LOSS OF SERVICE WATER SYSTEM (IE FREQ) 1.22E-02 A-AVCC-AFW-4-MA ALL. 4 AFW AOV'S CCAUSE FTO CV-07271CV-0736/CV-0736A/CV-0749 8.06E-06 29 76.12 9.61E-08 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <2'] (IE FREQ) 2.26E-03 R-REMD-TVX-3 RELAY TVX-3 FAILS TO REMAIN DE-ENERGIZED 6.52E-03 R-REMD-TX-4 RELAY TX-4 FAILS TO REMAIN DE-ENERGIZED 6.52E-03 30 76.29 9.61E-08 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <2"] (IE FREQ) 2.26E-03 R-REMD-TX-3 RELAY TX-3 FAILS TO REMAIN DE-ENERGIZED 6.52E-03 R-REMD-TX-4 RELAY TX-4 FAILS TO REMAIN DE-ENERGIZED 6.52E-03 31 76.46 9.61E-08 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <2'] (IE FREQ) 2.26E-03 R-REMD-TVX-4 RELAY TVX-4 FAILS TO REMAIN DE-ENERGIZED 6.52E-03 R-REMD-TX-3 RELAY TX-3 FAILS TO REMAIN DE-ENERGIZED 6.52E-03 32 76.63 9.61E-08 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <2'] (IE FREQ) 2.26E-03 R-REMD-TVX-3 RELAY TVX-3 FAILS TO REMAIN DE-ENERGIZED 6.52E-03 R-REMD-TVX-4 RELAY TVX-4 FAILS TO REMAIN DE-ENERGIZED 6.52E-03 B-1 9

LTR-PSA-09-04 October 1, 2009 Attachment B SAPHIRE CDF Top 100 Cutsets Table B-2: PSAR2c Zero Maintenance, P-7C Out of Service, & Loss of Service Water Initiating Event Frequency Increase (Top 100 Cutsets)

Cut No.

% Total ProbJFrequency Basic Event Description Event Prob.

33 76.8 9.58E-08 IESGTR STEAM GENERATOR TUBE RUPTURE (IE FREQ) 3.01E-03 L-TPMT-PT-0104A PRESSURE TRANSMITTER PT-0104A FAILS TO FUNCTION 2.45E-02 W-AVOA-PZR-SPRAY OPERATOR FAILS TO DEPRESSURIZE PCS WITH PZR SPRAY/AUX SPRAY 1.30E-03 34 76.97 9.58E-08 IESGTR STEAM GENERATOR TUBE RUPTURE (IE FREQ) 3.01E-03 L-TPMT-PT-0104B PRESSURE TRANSMITTER PT-0104B FAILS TO FUNCTION 2.45E-02 W-AVOA-PZR-SPRAY OPERATOR FAILS TO DEPRESSURIZE PCS WITH PZR SPRAYIAUX SPRAY 1.30E-03 35 77.14 IE_LOSWS LOSS OF SERVIC WATER SYSTEM (IE FREQ) 122E-02 A-PMMG-P-SB AFW TURBINE PUM P-81 FAILS TO RUN 5.82E-02 A-PSOt$*WLOSUC MISCAIJBRATION OF ALL AFW LOW SUCTION PRESSURE SWITCHES i.30E-04 36 77.3 8.90E-08 IELOSWS LOSS OF SERVICE WATER SYSTEM (IE FREQ) 1.22E-02 A-OOOT-CSTMK-CDTNL-HEP-2 CON HEP: L-ZZOA*SDC-INT A-OOOT-CSTMKUP

P-CBOB-BUSIE 1.43E-01 A-PMME-P-936 P-936 FAILS TO START 3.29E-03 L-ZZOA-SDC-INIT OPERATOR FAILS TO INITIATE SDC 1.55E-02 37 77.44 7.97E-08 IE.LOSWS LOSS OF SERVICE WATER SYSTEM (IE FREQ) 1.22E-02 A-PMCC-P8ABC-MG COMMON CAUSE FAILURE OF ALL 3 AFW PUMPS P-8A/B/C TO RUN 6.53E-06 38 77.58 7.90E-08 IESGTR STEAM GENERATOR TUBE RUPTURE (IE FREQ) 3.01E-03 L-TFMT-FT-0306 SDC INJECTION LINE FLOW TRANSMITTER FT-0306 FAILURE 2.02E-02 W-AVOA-PZR-SPRAY OPERATOR FAILS TO DEPRESSURIZE PCS WITH PZR SPRAY/AUX SPRAY 1.30E-03 39 77.72 7.81E-08 IELOMF-TRB LOSS OF FEEDWATER TRAIN B (IE FREQ) 7.07E-02 MTC2 PERCENTAGE OF TIME W/MTC NOT SUFFICIENTLY POSITIVE 2.30E-01

/RVO Pressurizer Safeties Open 9.99E-01 RXC-ELEC-FAULTS Electrical Scram Signal Faults 4.81 E-06 40 77.86 7.81E-08 IELOMF-TRA LOSS OF FEEDWATER TRAIN A (IE FREQ) 7.07E-02 MTC2 PERCENTAGE OF TIME WIMTC NOT SUFFICIENTLY POSITIVE 2.30E-01

/RVO Pressurizer Safeties Open 9.99E-01 RXC-ELEC-FAULTS Electrical Scram Signal Faults 4.81E-06 B-20

LTR-PSA-09-04 October 1, 2009 Attachment B SAPHIRE CDF Top 100 Cutsets Table B-2: PSAR2c Zero Maintenance, P-7C Out of Service, & Loss of Service Water Initiating Event Frequency Increase (Top 100 Cutsets)

Cut No.

% Total ProbJFrequency Basic Event Description Event Prob.

41 77.99 7.22E-08 IECNTRLSD CONTROLLED MANUAL SHUTDOWN (IE FREQ) 2.43E+00 A-PMMG-P-8B AFW TURBINE PUMP P-8B FAILS TO RUN 5.82E-02 P-CBOB-BYREG WHEN "TRUE" OP RECOVERY OF THE BYPASS REG IS CREDITED 5.00E-01 P-IVCC-INVALL-MT COMMON CAUSE FAILURE OF FOUR INVERTERS TO CONTINUE TO OPERAT 1.02E-06 42 78.11 6.64E-08 IESGTR STEAM GENERATOR TUBE RUPTURE (IE FREQ) 3.01E-03 L-HCMT-HIC-0306 SDC HX BYPASS VALVE HIC-0306B FAILS TO FUNCTION 1.70E-02 W-AVOA-PZR-SPRAY OPERATOR FAILS TO DEPRESSURIZE PCS WITH PZR SPRAY/AUX SPRAY 1.30E-03 43 78.23 6.64E-08 IESGTR STEAM GENERATOR TUBE RUPTURE (IE FREQ) 3.01E-03 L-HCMT-HIC-3025A SDC HX DISCHRG VALVE HAND INDIC CONTROLLER HIC-3025A FAIL 1.70E-02 W-AVOA-PZR-SPRAY OPERATOR FAILS TO DEPRESSURIZE PCS WITH PZR SPRAY/AUX SPRAY 1.30E-03 44 78.35 6.64E-08 IESGTR STEAM GENERATOR TUBE RUPTURE (IE FREQ) 3.01E-03 L-HCMT-HIC-3025B SDC HX DISCHRG VALVE HAND INDIC CONTROLLER HIC-3025B FAIL 1.70E-02 W-AVOA-PZR-SPRAY OPERATOR FAILS TO DEPRESSURIZE PCS WITH PZR SPRAY/AUX SPRAY 1.30E-03 45 78.47 6.64E-08 IESGTR STEAM GENERATOR TUBE RUPTURE (IE FREQ) 3.01E-03 L-CEPO-POC-0306 SDC HX BYPASS POSITION CONTROLLER POC-0306 FAILS 1.70E-02 W-AVOA-PZR-SPRAY OPERATOR FAILS TO DEPRESSURIZE PCS WITH PZR SPRAY/AUX SPRAY 1.30E-03 46 78.59 6.64E-08 IESGTR STEAM GENERATOR TUBE RUPTURE (IE FREQ) 3.01E-03 L-CEPO-POC-3025 SDC HX DISCHARGE POSITION CONTROLLER POC-3025 FAILS 1.70E-02 W-AVOA-PZR-SPRAY OPERATOR FAILS TO DEPRESSURIZE PCS WITH PZR SPRAY/AUX SPRAY 1.30E-03 47 78.71 6.63E-08 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <2"] (IE FREQ) 2.26E-03 Y-MVCC-ESS-ALL12 COMMON CAUSE FTO OF ALL 8 HPSI MOVS AND ALL 4 LPSI MOVS 2.94E-05 48 78.83 6.63E-08 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <2"] (IE FREQ) 2.26E-03 H-MVCC-ESS-ALL8 COMMON CAUSE FTO OF ALL 8 HPSI MOVS 2.94E-05 49 78.94 620E-S IE _LOSWS LOSS OF SERVICE WATER SYSTEM (IE FREQ) 1.22E-02 A-AVOA-CV-2010 OPERATOR FAILS TO OPEN CV-2010 FOR T-939 MAKEUP TO CST 2.59E-03 A-KVMB-SV-2010 CST MAKEUP CV-2010 SOLENOID SV-2010 FTE 3.93E-03 B-21

LTR-PSA-09-04 October 1, 2009 Attachment B SAPHIRE CDF Top 100 Cutsets Table B-2: PSAR2c Zero Maintenance, P-7C Out of Service, & Loss of Service Water Initiating Event Frequency Increase (Top 100 Cutsets)

Cut No.

% Total ProbiFrequency Basic Event Description Event Prob.

A-OOOT-CSTMK-CDTNL-HEP-1 COND HEP: A-AVOA-CV-2010 A-OOOT-CSTMKUP

Y-AVOB-RAS-VLVS 4.99E-O1 50 79.05 6.19E-08 IESGTR STEAM GENERATOR TUBE RUPTURE (IE FREQ) 3.01E-03 I-FLMK-F-28 CV-3025 LOCAL IA SUPPLY FILTER F28 PLUGGED 1.58E-02 W-AVOA-PZR-SPRAY OPERATOR FAILS TO DEPRESSURIZE PCS WITH PZR SPRAY/AUX SPRAY 1.30E-03 51 79.16 6.19E-08 IESGTR STEAM GENERATOR TUBE RUPTURE (IE FREQ) 3.01E-03 Q-FLMK-F-310 SDC HX INLET VALVE HPA SUPPLY FILTER F-310 PLUGGED 1.58E-02 W-AVOA-PZR-SPRAY OPERATOR FAILS TO DEPRESSURIZE PCS WITH PZR SPRAY/AUX SPRAY 1.30E-03 52 79.27 6.17E-08 IEMLBLOCA LOSS OF COOLANT ACCIDENT - MED LRGE BRK [>6" and <18"] (IE FREQ) 3.43E-05 H-AVOT-HL-INJ OPERATOR FAILS TO ALIGN HOT LEG INJECTION 1.80E-03 53 79.38 6.04E-08 IEISLOCA INTERFACING SYSTEMS LOCA (IE FREQ) 1.00E+00 L-MVMJ-MO-3015 MOTOR OPERATED VALVE 3015 LEAKS (IE EVENT) 4.85E-03 L-MVMJ-MO-3016 MOTOR OPERATED VALVE 3016 LEAKS 1.33E-05 L-PIPE-GC-14 PIPE FAILS DUE TO PRIMARY CYCLE PRESSURE (GC 14 INCH) 9.37E-01 54 79.49 6.03E-08 IEMBLOCA LOSS OF COOLANT ACCIDENT - MEDIUM BREAK [>2" and <6"] (IE FREQ) 3.35E-05 H-AVOT-HL-INJ OPERATOR FAILS TO ALIGN HOT LEG INJECTION 1.80E-03 55 79.59 5.80E-08 IELOMC LOSS OF MAIN CONDENSER VACUUM (IE FREQ) 5.25E-02 MTC2 PERCENTAGE OF TIME W/MTC NOT SUFFICIENTLY POSITIVE 2.30E-01

/RVO Pressurizer Safeties Open 9.99E-01 RXC-ELEC-FAULTS Electrical Scram Signal Faults 4.81 E-06 56 79.69 5.79E-08 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <2"] (IE FREQ) 2.26E-03 R-REMD-TVX-4 RELAY TVX-4 FAILS TO REMAIN DE-ENERGIZED 6.52E-03 U-KVMA-SV-0821 SV-0821 FAILS TO DE-ENERGIZE 3.93E-03 57 79.79 5.79E-08 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <2"] (IE FREQ) 2.26E-03 R-REMD-TX-4 RELAY TX-4 FAILS TO REMAIN DE-ENERGIZED 6.52E-03 U-KVMA-SV-0821 SV-0821 FAILS TO DE-ENERGIZE 3.93E-03 58 79.89 5.79E-08 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <2"] (IE FREQ) 2.26E-03 B-22

LTR-PSA-09-04 October 1, 2009 Attachment B SAPHIRE CDF Top 100 Cutsets Table B-2: PSAR2c Zero Maintenance, P-7C Out of Service, & Loss of Service Water Initiating Event Frequency Increase (Top 100 Cutsets)

Cut No.

% Total ProbJFrequency Basic Event Description Event Prob.

R-REMD-TVX-4 RELAY TVX-4 FAILS TO REMAIN DE-ENERGIZED 6.52E-03 Y-KVMA-SV-0938 CCW TO SDC HX AIR SUPPLY SV-0938 FTD 3.93E-03 59 79.99 5.79E-08 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <2"] (IE FREQ) 2.26E-03 R-REMD-TX-4 RELAY TX-4 FAILS TO REMAIN DE-ENERGIZED 6.52E-03 Y-KVMA-SV-0938 CCW TO SDC HX AIR SUPPLY SV-0938 FTD 3.93E-03 60 80.09 5.69E-08 IELOSWS LOSS OF SERVICE WATER SYSTEM (IE FREQ) 1.22E-02 A-FLMK-F-P936 P-936 SUCTION STRAINER PLUGS 1.76E-03 A-OOOT-CSTMKUP OPERATOR FAILS TO MAKEUP TO CST 2.66E-03 61 80.18 5.21E-08 IELOOP Loss of Offsite Power 1.11E-02 A-OOOT-CSTMK-CDTNL-HEP-2 COND HEP: L-ZZOA-SDC-INIT

A-OOOT-CSTMKUP

P-CBOB-BUSIE 1.43E-01 H-ZZOA-OTC-INIT OPERATOR FAILS TO INITIATE ONCE THROUGH COOLING 2.90E-03 L-ZZOA-SDC-INIT OPERATOR FAILS TO INITIATE SDC 1.55E-02 REC-30MIN Recovery of Offslte Power in 30 min (prior to S/G dryout) 7.30E-01 62 80.27 5.19E-08 IELOSWS LOSS OF SERVICE WATER SYSTEM (ME FREQ) 1.22-02 A-AVOA-CV-2010 OPERATOR FAILS TO OPEN CV-2010 FOR T-939 MAKEUP TO CST 2.59E-03 A-OOOT-CSTMK-CDTNL-HEP-1 CONO HEP: A-AOA-CV4201

A-OOOT-CSTMKUP

Y-AVOB-RAS-VLVS 4.99E-01 A-PMME-P-936 P-93 FAILS TO START 3.29E-03 63 80.36 4.99E-08 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <2"] (IE FREQ) 2.26E-03 Y-CVCC-SIRWT-MA BOTH SIRWT SUPPLY CK VALVES CK-ES3239 & CK-ES3240 CCAUSE FTO 2.21E-05 64 80.45 4.99E-08 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <2"] (IE FREQ) 2.26E-03 Y-CVCC-SUMP-MA BOTH SUMP SUPPLY CK VALVES CK-ES3166 & CK-ES3181 CCAUSE FFO 2.21E-05 65 80.54 4.97E-08 IECNTRLSD CONTROLLED MANUAL SHUTDOWN (IE FREQ) 2.43E+00 A-PMMG-P-8B AFW TURBINE PUMP P-8B FAILS TO RUN 5.82E-02 P-CBOB-BYREG WHEN "TRUE" OP RECOVERY OF THE BYPASS REG IS CREDITED 5.OOE-01 P-IVCC-INV-123MT COMMON CAUSE FAILURE OF THREE INVERTERS #1 7.03E-07 66 80.63 4.96E-08 IELOMSIV SPURIOUS MSIV CLOSURE (IE FREQ) 4.49E-02 B-23

LTR-PSA-09-04 October 1, 2009 Attachment B SAPHIRE CDF Top 100 Cutsets Table B-2: PSAR2c Zero Maintenance, P-7C Out of Service, & Loss of Service Water Initiating Event Frequency Increase (Top 100 Cutsets)

Cut No.

% Total ProbJFrequency Basic Event Description Event Prob.

MTC2 PERCENTAGE OF TIME W/MTC NOT SUFFICIENTLY POSITIVE 2.30E-01

/RVO Pressurizer Safeties Open 9.99E-01 RXC-ELEC-FAULTS Electrical Scram Signal Faults 4.81 E-06 67 80.72 4.96E-08 IESGTR STEAM GENERATOR TUBE RUPTURE (IE FREQ) 3.01E-03 B-HCMB-HIC-0780A SDCR CONTROLLER HIC-0780A FAILS TO ENERGIZE 1.14E-02 H-ZZOA-OTC-INIT OPERATOR FAILS TO INITIATE ONCE THROUGH COOLING 2.90E-03 SGTRA FT TOP: STEAM GENERATOR TUBE RUPTURE ON SG A (developed event) 5.00E-01 68 80.81 4.96E-08 IESGTR STEAM GENERATOR TUBE RUPTURE (IE FREQ) 3.01E-03 B-HCMB-HIC-0780A SDCR CONTROLLER HIC-0780A FAILS TO ENERGIZE 1.14E-02 H-ZZOA-OTC-INIT OPERATOR FAILS TO INITIATE ONCE THROUGH COOLING 2.90E-03 SGTRB FT TOP: STEAM GENERATOR TUBE RUPTURE ON SG B (developed event) 5.00E-01 69 80.9 4.90E-08 ELO$WS LOSS OF SERVICE WATER SYSTEM (IE FREQ) 1.22E-02 A-PMME-P3 P-936 FAILS TO START 3.29E-03 A-XVMA-M-FW775 FPS TO AFW MANUAL VALVE MV-FW775 FAILS TO OPEN 1.22E-03 70 80.99 4.90E-08 IELOSWS LOSS OF SRVICE WATER SYSTEM (IE FREQ) 122E-02 A-PMME-P-936 P936 FAILS TO START 3.29E-03 A-XVMA-MV-FW774 FPS TO AFW MANUAL VALVE MV-FW774 FAILS TO OPEN 1.22E-03 71 81.08 4.84E-08 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <2"] (IE FREQ) 2.26E-03 H-CVCC-HPSIPP-MA BOTH HPSI PUMP DICHARGE CK VLVES CK-ES3177 & 3186 CCAUSE FTO 2.14E-05 72 81.17 4.84E-08 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <2"] (IE FREQ) 2.26E-03 H-CVCC-RECIRC-MA BOTH HPSI PUMP RECIRC CK VLVS TO SIRWT COMMON CAUSE FTO 2.14E-05 73 81.26 4.84E-08 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <2"] (IE FREQ) 2.26E-03 H-CVCC-SUCT-MA BOTH HPSI PUMP SUMP SUCTION CK VLVS COMMON CAUSE FTO 2.14E-05 74 81.35 4.76E-08 IE_SBLOCA LOSS OF COOLANT ACCIDENT -SMALL BRK [>0.4" and <2"] (IE FREQ) 2.26E-03 Y-CVCC-RECIRC-MA BOTH SIRWT RECIRC CK VALVES CK-ES3331 & ES3332 CCAUSE FTO 2.11 E-05 75 81.44 4.75E-08 IELOSWS LOSS OF SERVICE WATER SYSTEM (IE FREQ) 1.22E-02 B-24

LTR-PSA-09-04 October 1, 2009 Attachment B SAPHIRE CDF Top 100 Cutsets Table B-2: PSAR2c Zero Maintenance, P-7C Out of Service, & Loss of Service Water Initiating Event Frequency Increase (Top 100 Cutsets)

Cut No.

% Total ProbJFrequency Basic Event Description Event Prob.

A-FLMK-F-P936 P-936 SUCTION STRAINER PLUGS 1.76E-03 A-OOOT-CSTMK-CDTNL-HEP-2 COND HEP: L-ZZOA-SDC-INIT

A-OOOT-CSTMKUP

P-CBOB-BUS1 E 1.43E-01 L-ZZOA-SDC-INIT OPERATOR FAILS TO INITIATE SDC 1.55E-02 76 81.52 4.42E-08 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <2"] (IE FREQ) 2.26E-03 Y-AVMB-CV-3027 SIRWT RECIRC VALVE CV-3027 FTC 4.42E-03 Y-AVMB-CV-3056 SIRWT RECIRC VALVE CV-3056 FTC 4.42E-03 77 81.59 4.08E-08 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <21 (IE FREQ) 2.26E-03 Y-PMCC-P66AB-ME COMMON CAUSE FAILURE OF P-66A AND P-66B TO START 1.81 E-05 78 81.66 4.04E-08 IECNTRLSD CONTROLLED MANUAL SHUTDOWN (IE FREQ) 2.43E+00 MTC1 PERCENTAGE OF TIME W/MTC NOT SUFFICIENTLY POSITIVE 2.00E-02

/RVO Pressurizer Safeties Open 9.99E-01

/RXC-ELEC-FAULTS Electrical Scram Signal Faults 1.OOE+00 RXC-MECH-FAULTS Mechanical Scram Faults 8.40E-07

/TTF Turbine Trip 9.90E-01 79 81.73 3.93E-08 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <21 (IE FREQ) 2.26E-03 Y-AVMB-CV-3027 SIRWT RECIRC VALVE CV-3027 FTC 4.42E-03 Y-KVMB-SV-3056B SIRWT RECIRC VALVE SOLENOID SV-3056B FTE 3.93E-03 80 81.8 3.93E-08 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <2"] (IE FREQ) 2.26E-03 Y-AVMB-CV-3027 SIRWT RECIRC VALVE CV-3027 FTC 4.42E-03 Y-KVMB-SV-3056A SIRWT RECIRC VALVE SOLENOID SV-3056A FTE 3.93E-03 81 81.87 3.93E-08 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <2"] (IE FREQ) 2.26E-03 Y-AVMB-CV-3056 SIRWT RECIRC VALVE CV-3056 FTC 4.42E-03 Y-KVMB-SV-3027B SIRWT RECIRC VALVE SOLENOID SV-3027B FTE 3.93E-03 82 81.94 3.93E-08 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <2"] (IE FREQ) 2.26E-03 Y-AVMB-CV-3056 SIRWT RECIRC VALVE CV-3056 FTC 4.42E-03 Y-KVMB-SV-3027A SIRWT RECIRC VALVE SOLENOID SV-3027A FTE 3.93E-03 B-25

LTR-PSA-09-04 October 1, 2009 Attachment B SAPHIRE CDF Top 100 Cutsets Table B-2: PSAR2c Zero Maintenance, P-7C Out of Service, & Loss of Service Water Initiating Event Frequency Increase (Top 100 Cutsets)

Cut No.

% Total Prob./Frequency Basic Event Description Event Prob.

83 82.01 3.71E-08 IELOMF-TRA LOSS OF FEEDWATER TRAIN A (IE FREQ) 7.07E-02 G-PMOE-P-55ABC OPERATOR FAILS TO INITIATE CHARGING FLOW 1.10E-01

/RVC Pressurizer Safeties Closed 9.91E-01

/RVO Pressurizer Safeties Open 9.99E-01 RXC-ELEC-FAULTS Electrical Scram Signal Faults 4.81 E-06 84 82.08 3.71E-08 IELOMF-TRB LOSS OF FEEDWATER TRAIN B (IE FREQ) 7.07E-02 G-PMOE-P-55ABC OPERATOR FAILS TO INITIATE CHARGING FLOW 1.10E-01

/RVC Pressurizer Safeties Closed 9.91E-01

/RVO Pressurizer Safeties Open 9.99E-01 RXC-ELEC-FAULTS Electrical Scram Signal Faults 4.81 E-06 85 82.14 3.49E-08 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <2"] (IE FREQ) 2.26E-03 Y-KVMB-SV-3027A SIRWT RECIRC VALVE SOLENOID SV-3027A FTE 3.93E-03 Y-KVMB-SV-3056B SIRWT RECIRC VALVE SOLENOID SV-3056B FTE 3.93E-03 86 82.2 3.49E-08 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <2"] (IE FREQ) 2.26E-03 Y-KVMB-SV-3027B SIRWT RECIRC VALVE SOLENOID SV-3027B FTE 3.93E-03 Y-KVMB-SV-3056B SIRWT RECIRC VALVE SOLENOID SV-3056B FTE 3.93E-03 87 82.26 3.49E-08 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <2'1 (IE FREQ) 2.26E-03 Z-KVMB-SV-3029A SUMP TO EAST ESS AIR SUPPLY SV-3029A FTE 3.93E-03 Z-KVMB-SV-3030B SUMP TO WEST ESS AIR SUPPLY SV-3030B FTE 3.93E-03 88 82.32 3.49E-08 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <2"] (IE FREQ) 2.26E-03 Z-KVMB-SV-3029B SUMP TO EAST ESS AIR SUPPLY SV-3029B FTE 3.93E-03 Z-KVMB-SV-3030B SUMP TO WEST ESS AIR SUPPLY SV-3030B FTE 3.93E-03 89 82.38 3.49E-08 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <2"] (IE FREQ) 2.26E-03 Z-KVMB-SV-3029A SUMP TO EAST ESS AIR SUPPLY SV-3029A FTE 3.93E-03 Z-KVMB-SV-3030A SUMP TO WEST ESS AIR SUPPLY SV-3030A FTE 3.93E-03 90 82.44 3.49E-08 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <2"] (IE FREQ) 2.26E-03 B-26

LTR-PSA-09-04 October 1, 2009 Attachment B SAPH IRE CDF Top 100 Cutsets Table B-2: PSAR2c Zero Maintenance, P-7C Out of Service, & Loss of Service Water Initiating Event Frequency Increase (Top 100 Cutsets)

Cut No.

% Total Prob./Frequency Basic Event Description Event Prob.

Z-KVMB-SV-3029B SUMP TO EAST ESS AIR SUPPLY SV-3029B FTE 3.93E-03 Z-KVMB-SV-3030A SUMP TO WEST ESS AIR SUPPLY SV-3030A FTE 3.93E-03 91 82.5 3.49E-08 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <2"] (IE FREQ) 2.26E-03 Y-KVMB-SV-3027A SIRWT RECIRC VALVE SOLENOID SV-3027A FTE 3.93E-03 Y-KVMB-SV-3056A SIRWT RECIRC VALVE SOLENOID SV-3056A FTE 3.93E-03 92 82.56 3.49E-08 IESBLOCA LOSS OF COOLANT ACCIDENT - SMALL BRK [>0.4" and <2"] (IE FREQ) 2.26E-03 Y-KVMB-SV-3027B SIRWT RECIRC VALVE SOLENOID SV-3027B FTE 3.93E-03 Y-KVMB-SV-3056A SIRWT RECIRC VALVE SOLENOID SV-3056A FTE 3.93E-03 93 82.62 3.46E-08 IESGTR STEAM GENERATOR TUBE RUPTURE (IE FREQ) 3.01E-03 B-KVMA-SV-0782B ADV CV-0782 AIR SUPPLY SV-0782B FTD 3.93E-03 B-XVOB-ADVS-MAN OPERATOR FAILS TO CLOSE MANUAL VALVES TO CLOSE ADV 4.03E-02 L-ZZOA-SDC-CDTNL-HEP-2 CONDITIONAL HEP: B-XVOB-ADVS-MAN

L-ZZOA-SDC-INIT 1.45E-01 SGTRA FT TOP: STEAM GENERATOR TUBE RUPTURE ON SG A (developed event) 5.OOE-01 94 82.68 3.46E-08 IE SGTR STEAM GENERATOR TUBE RUPTURE (IE FREQ) 3.01E-03 B-KVMA-SV-0781C ADV CV-0781 AIR SUPPLY SV-0781C FTD 3.93E-03 B-XVOB-ADVS-MAN OPERATOR FAILS TO CLOSE MANUAL VALVES TO CLOSE ADV 4.03E-02 L-ZZOA-SDC-CDTNL-HEP-2 CONDITIONAL HEP: B-XVOB-ADVS-MAN

L-ZZOA-SDC-INIT 1.45E-01 SGTRA FT TOP: STEAM GENERATOR TUBE RUPTURE ON SG A (developed event) 5.OOE-01 95 82.74 3.46E-08 IESGTR STEAM GENERATOR TUBE RUPTURE (IE FREQ) 3.01E-03 B-KVMA-SV-0781 B ADV CV-0781 AIR SUPPLY SV-0781 B FTD 3.93E-03 B-XVOB-ADVS-MAN OPERATOR FAILS TO CLOSE MANUAL VALVES TO CLOSE ADV 4.03E-02 L-ZZOA-SDC-CDTNL-HEP-2 CONDITIONAL HEP: B-XVOB-ADVS-MAN

L-ZZOA-SDC-INIT 1.45E-01 SGTRA FT TOP: STEAM GENERATOR TUBE RUPTURE ON SG A (developed event) 5.OOE-01 96 82.8 346E-08 IESGTR STEAM GENERATOR TUBE RUPTURE (IE FREQ) 3.01E-03 B-KVMA-SV-0780C ADV CV-0780 AIR SUPPLY SV-0780C FTD 3.93E-03 B-XVOB-ADVS-MAN OPERATOR FAILS TO CLOSE MANUAL VALVES TO CLOSE ADV 4.03E-02 B-27

LTR-PSA-09-04 October 1, 2009 Attachment B SAPHIRE CDF Top 100 Cutsets Table B-2: PSAR2c Zero Maintenance, P-7C Out of Service, & Loss of Service Water Initiating Event Frequency Increase (Top 100 Cutsets)

Cut No.

% Total Prob./Frequency Basic Event Description Event Prob.

L-ZZOA-SDC-CDTNL-HEP-2 CONDITIONAL HEP: B-XVOB-ADVS-MAN

L-ZZOA-SDC-INIT 1.45E-01 SGTRB FT TOP: STEAM GENERATOR TUBE RUPTURE ON SG B (developed event) 5.OOE-01 97 82.86 3.46E-08 IE SGTR STEAM GENERATOR TUBE RUPTURE (IE FREQ) 3.01E-03 B-KVMA-SV-0782C ADV CV-0782 AIR SUPPLY SV-0782C FTD 3.93E-03 B-XVOB-ADVS-MAN OPERATOR FAILS TO CLOSE MANUAL VALVES TO CLOSE ADV 4.03E-02 L-ZZOA-SDC-CDTNL-HEP-2 CONDITIONAL HEP: B-XVOB-ADVS-MAN

L-ZZOA-SDC-INIT 1.45E-01 SGTRA FT TOP: STEAM GENERATOR TUBE RUPTURE ON SG A (developed event) 5.OOE-01 98 82.92 3.46E-08 IESGTR STEAM GENERATOR TUBE RUPTURE (IE FREQ) 3.01E-03 B-KVMA-SV-0779B ADV CV-0779 AIR SUPPLY SV-0779B FTD 3.93E-03 B-XVOB-ADVS-MAN OPERATOR FAILS TO CLOSE MANUAL VALVES TO CLOSE ADV 4.03E-02 L-ZZOA-SDC-CDTNL-HEP-2 CONDITIONAL HEP: B-XVOB-ADVS-MAN

L-ZZOA-SDC-INIT 1.45E-01 SGTRB FT TOP: STEAM GENERATOR TUBE RUPTURE ON SG B (developed event) 5.OOE-01 99 82.98 3.46E-08 IESGTR STEAM GENERATOR TUBE RUPTURE (IE FREQ) 3.01E-03 B-KVMA-SV-0779C ADV CV-0779 AIR SUPPLY SV-0779C FTD 3.93E-03 B-XVOB-ADVS-MAN OPERATOR FAILS TO CLOSE MANUAL VALVES TO CLOSE ADV 4.03E-02 L-ZZOA-SDC-CDTNL-HEP-2 CONDITIONAL HEP: B-XVOB-ADVS-MAN

L-ZZOA-SDC-INIT 1.45E-01 SGTRB FT TOP: STEAM GENERATOR TUBE RUPTURE ON SG B (developed event) 5.OOE-01 100 83.04 3.46E-08 IESGTR STEAM GENERATOR TUBE RUPTURE (IE FREQ) 3.01E-03 B-KVMA-SV-0780B ADV CV-0780 AIR SUPPLY SV-0780B FTD 3.93E-03 B-XVOB-ADVS-MAN OPERATOR FAILS TO CLOSE MANUAL VALVES TO CLOSE ADV 4.03E-02 L-ZZOA-SDC-CDTNL-HEP-2 CONDITIONAL HEP: B-XVOB-ADVS-MAN

L-ZZOA-SDC-INIT 1.45E-01 SGTRB FT TOP: STEAM GENERATOR TUBE RUPTURE ON SG B (developed event) 5.OOE-01 B-28

LTR-PSA-09-04 October 1, 2009 Attachment C SAPHIRE LERF Change Set Data and Results Table of Contents Created Change Set for CET Analysis (baseline)

Created Change Set for CET Analysis (P-7C failure)

C-2 C-3 C-1

LTR-PSA-09-04 October 1, 2009 Attachment C SAPHIRE LERF Change Set Data and Results CET=

CET-QUANT-BASELINE

PROBABILITY HEADER

Name

, CalcType,

UncType, Prob, Lambda,

Tau, UncValue, UncCorr, MissionT, Flag, UncValue2 CLASS HEADER

Name,

Group, CompType,

Compld, System, Location, FailMode, Train,

Init, Attl,..,Attl6 CLASS PROBABILITY HEADER

CalcType, UncType,

Prob, Lambda,

Tau, UncValue, UncCorr, MissionT, Flag, UncValue2 SAMA-CET, CET-QUANT-BASELINE

=

^PROBABILITY CETDEJP

, I 7.605E-6, CE-TP-PORVS, 1,,6.319E-1, CETZEGP

,,5.37E-6 CE-MP-PORVS, 1,,.EO CETDEJS

, I 4.405E-6.

CE-TW-PORVS, 1, 5.366E-l,1 CET BEGP

, I 4.039E-6, CE-MW-PORVS, 1,,1.EO, CET A2EGR I 2.996E-6, CE-TV-PORVS, 1, 1.EO.......

CET BEGR I I 2.556E-6, CE-MV-PORVS, 1,,.EO CET TEJW 1.304E-6, CE-TR-PORVS, 1,,I.EO..

CET BEGV I I 1.073E-6, CE-MR-PORVS, 1,,.EO CET TEJP I I 7.832E-7, CE-TS-PORVS, 1,,I.EO..

CET TEJQ I,

4.175E-7..

CE-MS-PORVS, 1,,.EO CET TEJS I I 4.437E-7.......

CE-TQ-PORVS, 1,,9.87E-1.......

CET BEGS 395E-7.

CE-MQ-PORVS, 1,,.EO CET A2EGP

,3.68E-7 CE-BP-PORVS, 1,,9.986E-l,,,,,,,

CET DEJR I

3.583E-8, CE-BR-PORVS, 1,,9.993E-l,,,,,,,

CET TEJR 3.605E-8, CE-BS-PORVS, 1,,

.EO..

CET MEJW 6.126E-9.

CE-BV-PORVS, 1,,

.EO..

CET A1EGR

,,5.145E-9, CE-DS-PORVS, 1,,9.979E-1.......

CET TEJV

,2.382E-9 CE-DP-PORVS, 1,,5.327E-1.......

CET MEJP

,0.E0, I I I I I I CE-DR-PORVS, 1,, 6.495E-1 CET MEJV

,0.E0, I I I I I I CE-A2P-PORVS, 1,,9.428E-1, CET MEJR

,O.EO, CE-A2R-PORVS, 1,,9.923E-1.......

CET MEJS

.EO.

CE-AlR-PORVS, 1,,.EO CET MEJQ

.EO.

CE-ZP-PORVS, 1,,9.967E-CET CEJW

,7.907E-8,

^CLASS

^EOS C-2

LTR-PSA-09-04 October 1, 2009 Attachment C SAPHIRE LERF Change Set Data and Results CET=

CET-QUANT-P7C-FAIL

PROBABILITY HEADER

Name

, CalcType,

UncType, Prob, Lambda, Tau,

UncValue, UncCorr, MissionT, Flag, UncValue2 CLASS HEADER

Name,

Group, CompType,

CompId, System, Location, FailMode, Train, Init, Attl,..,Attl6

CLASS PROBABILITY HEADER

CalcType,

UncType, Prob,

Lambda, Tau,

UncValue, UncCorr, MissionT, Flag, UncValue2 SAMA-CET, CET-QUANT-P7C-FAIL

=

^PROBABILITY CETDEJP

,7.605E-6 CE-TP-PORVS, 1,,6.487E-1...

CETZEGP

, I 5.37E-6.

CE-MP-PORVS, 1,,.ED, CETDEJS

, I 4.405E-6, CE-TW-PORVS, 1,,5.362E-I, CET BEGP

, I 4.039E-6, CE-MW-PORVS, 1,

CET A2EGR 2.996E-6, CE-TV-PORVS, 1,

1.CO....

CET BEGR 2.556E-6, CE-MV-PORVS, 1,

CET TEJW I I 1.418E-6, CE-TR-PORVS, 1,

CET BEGV I I 1.362E-6, CE-MR-PORVS, 1, 0.EO....

CET TEJP I 8.206E-7, CE-TS-PORVS, 1,

.E CET TEJS I 4.437E-7.

CE-MS-PORVS, 1,0.E.E.D.....

CET TEJQ I 4.545E-7 CE-TQ-PORVS, 1, 9.881E-1.......

CET BEGS

,3.95E-7 CE-MQ-PORVS, 1, 0.EO....

CET A2EGP I

3.68E-7.

CE-BP-PORVS, 1, 9.986E-l CET TEJR

, I 3.605E-8..

CE-BR-PORVS, 1,,9.993E-I, CET DEJR

, I 7.199E-8.

CE-BS-PORVS, 1,,.EO CET MEJW I

6.126E-9, CE-BV-PORVS, 1,,

.EO...

CET AlEGR 5.145E-9, CE-DS-PORVS, 1,,9.979E-1.......

CET TEJV

, I 2.382E-9, CE-DP-PORVS, 1,,5.327E-1....

CET MEJP

,I I

.EO.

CE-DR-PORVS, 1,, 8.256E-1, CET MEJV

,I.EO.

CE-A2P-PORVS, 1,,9.428E-l,,,,,,,

CET MEJR

,0.EO.

CE-A2R-PORVS, 1,,9.923E-,1 CET MEJS

,O.EO.

CE-AlR-PORVS, 1,,

.EO.

CETMEJQ

,0.EO.

CE-ZP-PORVS, 1,,9.967E-1.......

CET CEJW,

, 7.907E-8,

^CLASS

^EOS C-3

LTR-PSA-09-04 October 1, 2009 Attachment D Uncertainty Evaluation Table D-1: Issue Characterization for Sources of Model Uncertainty for Palisades (QU-F4 and LE-F3)

Topic (to meet Discussion of Issue Part of Model Plant-Specific Assumptions Made Impact on Model Characterization QU-EI)

Affected Approach Taken (to meet QU-E2)

(to meet QU-E4)

Assessment Initiating Event Analysis (to support meeting IE-D3)

1. Grid stability Recently the stability of LOOP sequences LOOP events have been

1) Screening of non-applicable

1) The LOOP initiator The overall approach at least some local including minimized at Palisades, in events including events at frequency is included for the LOOP frequency areas of the electric consequential LOOP part due to the installation Palisades is appropriate to best as a unique initiating and fail to recover power grid has been sequences of the safeguards represent the current event in the model.

probabilities utilized is questioned. The transformer in 1990. The configuration at the site.

considered appropriate potential duration and safeguards transformer Additionally, as a result of the to best represent the complexities of provides power to the 2003 Northeast blackout, it was plant-specific features recovery from such safety related 2400V AC considered appropriate to at Palisades.

events are hard to buses 1C and 1D and the increase the likelihood of a site However, alternative dismiss. Three different non-safety related Bus 1 E. LOOP event by 25% given that hypothesis exist from aspects relate to this The safeguards other nuclear power plants NUREG/CR-6890 [D-4]

issue:

transformer is connected tripped in the East Central Area and NUREG/CR-6928 la. LOOP Initiating directly to the F Bus in the Reliability (ECAR) region. The

[D-5] that provide Event Frequency switchyard and does not 0.25 factor was proposed as a generic LOOP lb. Conditional require transferring loads bounding value for the frequencies that are LOOP Frequency upon a plant trip. A loss fractional LOOP. The fractional-about twice as high as of the safeguards LOOP is intended to account that currently used in 1c. Availability of dc transformer or F bus for low grid operating margin the Palisades model, power to perform would lead to a fast more typically found in the and as such, the LOOP restoration transfer to the startup summer months during one-initiating event actions transformer on the R bus.

fourth of the year, i.e., a low frequency is identified As such, the LOOP enough margin that a nuclear as a candidate source initiating event priors power plant was forced to trip.

of model uncertainty.

utilize industry data that have been screened for applicability at Palisades, and a two-stage Bayes update was performed to develop a plant-specific LOOP frequency.

Moreover, a supplemental diesel generator was installed in June 2006.

The non-safety related D-1

LTR-PSA-09-04 October 1, 2009 Attachment D Uncertainty Evaluation Table D-1: Issue Characterization for Sources of Model Uncertainty for Palisades (QU-F4 and LE-F3)

Topic (to meet Discussion of Issue Part of Model Plant-Specific Assumptions Made Impact on Model Characterization QU-E1)

Affected Approach Taken (to meet QU-E2)

(to meet QU-E4) j Assessment diesel generator is physically located inside the protected area, just southeast of start-up transformer and consists of a trailer type diesel generator set with a diesel engine and self contained engine cooling and lubrication systems. The components are pre-assembled and contained in a portable type, mobile, heated, ventilated and lighted, tractor-trailer. The supplemental diesel is designed for local manual start only; no remote control is available.

Protection features for engine shutdown and tripping of generator output circuit breaker include: engine over-speed, over-crank, high water temperature, and low oil pressure. The load profile is limited to performing heat removal via secondary cooling with an auxiliary feedwater pump or once-through cooling (OTC - Feed &

Bleed) via high pressure injection and a PORV and necessary supporting equipment.

In 2008 a blackout procedure was imolemented to continue D-2

LTR-PSA-09-04 October 1, 2009 Attachment D Uncertainty Evaluation Table D-1: Issue Characterization for Sources of Model Uncertainty for Palisades (QU-F4 and LE-F3)

Topic (to meet Discussion of Issue Part of Model Plant-Specific Assumptions Made Impact on Model Characterization QU-E1)

Affected Approach Taken (to meet QU-E2)

(to meet QU-E4)

Assessment feeding a steam generator given loss of dc power.

This procedure provides guidance to the operators on how to provide makeup with the turbine driven feedwater pump without available instrumentation.

+

The industry wide data in NUREG/CR-6890 [D-4]

and EPRI reports through 2008 were screened for applicability at Palisades and failure to recover probabilities were derived for the applicable time frames in the model.

2) The industry-wide recovery data as applicable is appropriate to best estimate the fail to recover probabilities associated with the current configuration at the site.

2) LOOP recovery failures are included for time periods of 30 minutes, 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , and 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months from sequence initiation depending on the accident sequence progression.

The consequential LOOP

3) Given the current off-site

3) Consequential LOOP Given that alternate failure probability is based power configuration at events are possible values of -2E-3 and on the annual frequency Palisades, the use of the from all other Es, but

-2E-2 are available normalized for a 24-hour derived plant-specific data best no credit for off-site from the accepted PRA mission time.

represents the likelihood of a power recovery is industry generic values consequential LOOP given incorporated into the

[D-6] given a reactor some other initiating event, sequence modeling, trip or LOCA, However, no credit for recovery respectively, then the from these consequential consequential LOOP LOOP events is taken.

failure probabilities are identified as a candidate source of model uncertainty.

Offsite power restoration is dictated by procedure.

Restoration is possible via manual breaker control.

4) The specific failure modes of the offsite restoration are implicitly included via the use of the LOOP recovery probabilities that were screened for applicability at Palisades.

4) No additional adjustments or system model changes are incorporated when using the different LOOP recovery probabilities.

Realistic using the best available data for the recovery times and recovery probabilities utilized. This should not be a source of model uncertainty in most applications.

D-3

LTR-PSA-09-04 October 1, 2009 Attachment D Uncertainty Evaluation Table D-1: Issue Characterization for Sources of Model Uncertainty for Palisades (QU-F4 and LE-F3)

Topic (to meet Discussion of Issue Part of Model Plant-Specific Assumptions Made Impact on Model Characterization QU-EI)

I Affected Approach Taken I

(to meet QU-E2)

(to meet QU-E4)

Assessment

2. Support System Initiating Events Increasing use of plant-specific models for support system initiators (e.g. loss of SW, CCW, or IA, and loss of ac or dc buses) have led to inconsistencies in approaches across the industry. A number of challenges exist in modeling of support system initiating events:

2a. Treatment of common cause failures 2b. Potential for recovery Support system event sequences Support System Initiating Events (SSIE) are included for several loss of ac bus and dc bus initiators as well as for loss of SW, loss of CCW, and loss of IA.

All of the support system IE frequencies are based on available generic prior information from NUREG/CR-5750 [25].

1) NUREG/CR-5750 provides an appropriate source of generic prior data for the various support system initiators that are applicable to Palisades.

1) Event sequences are developed for each loss of support system initiator and the given support system is rendered unavailable in the accident sequence development.

The treatment is deemed acceptably representative as dependencies are appropdately captured.

This should not be a source of model uncertainty in most applications.

Potential for common

2) The use of the generic alpha 2) The CCF Initiating The treatment is cause failures within the factors based on industry wide Events for loss of ac deemed acceptable IA, SW, and CCW experience is applicable for the instrument buses with a slight initiators are implicitly ac instrument bus initiators at dominate the overall conservative bias slant included via the use of the site.

contribution to CDF since the alpha factors generic data.

compared to the are known to be high individual loss of bus when utilized in an Additionally, unique initiators, annualized fashion and initiating events for all compared to plant-potential combinations of specific experience.

losses of instrument ac This should not be a buses are included.

source of model uncertainty in most applications.

The support system initiating events are generally used as is with no additional credit for recovery. The exception is that a plant-specific analysis has been developed to determine the likelihood of recovery from a LOSW event based on the types of failures contributing to that initiator

3) The lack of credit for recovery from the support system initiating events will riot significantly impact the CDF and LERF distribution.

3) No basic events included in model for recovery from the loss of support system initiators except for the recovery factor utilized for the loss of service water.

Slight conservative bias because generally no credit is taken for recovery. This should not be a source of model uncertainty in most applications.

However, the recovery value utilized for loss of service water events is identified as a candidate source of D-4

LTR-PSA-09-04 October 1, 2009 Attachment D Uncertainty Evaluation Table D-1 Issue Characterization for Sources of Model Uncertainty for Palisades (QU-F4 and LE-F3)

Topic (to meet Discussion of Issue Part of Model Plant-Specific Assumptions Made Impact on Model Characterization QU-E1)

Affected Approach Taken (to meet QU-E2)

(to meet QU-E4)

Assessment that could be easily model uncertainty.

recovered (e.g. basket strainer clogging).

3. LOCA initiating It is difficult to establish LOCA sequences Although NUREG/CR-

1) The CEOG methodology

1) The LOCA initiating The Small Break LOCA event frequencies values for events that 5750 includes industry-provides an appropriate event frequencies can and Large Break LOCA have never occurred or average baselines for estimate for the LOCA initiating impact risk results frequencies are higher have rarely occurred LOCAs, the Palisades event frequencies for Palisades directly. There are four than the values from with a high level of LOCA IE frequencies are and these values were noted categories utilized in NUREG-1829 [D-10]

confidence. The choice based on the CEOG as acceptable by the NRC the model (i.e., Small, that were derived of available data sets or methodology described in Expert Elicitation committed Medium, Medium-through an expert use of specific EA-PSA-00-0010 [D-9].

during their review of the Large, and Large).

elicitation process. The methodologies in the Palisades PTS evaluation [D-Medium Break LOCA determination of LOCA 26].

frequency is lower than frequencies could that provided in impact base model NUREG-1 829, and no results and some equivalent exists for the applications.

Medium-Large category. As such, the LOCA frequencies are identified as a candidate source of model uncertainty.

D-5

LTR-PSA-09-04 October 1, 2009 Attachment D Uncertainty Evaluation Table D-1: Issue Characterization for Sources of Model Uncertainty for Palisades (QU-F4 and LE-F3)

Topic (to meet Discussion of Issue Part of Model Plant-Specific Assumptions Made Impact on Model Characterization QU-E1)

Affected Approach Taken (to meet QU-E2)

(to meet QU-E4)

Assessment Accident Sequence Analysis (to support meeting AS-C3)

4. Operation of Station Blackout events Credit for continued No credit is taken for

1) Procedurally directed and

1) The event sequence Credit for the viability equipment after are important operation of these continued operation of practiced action is feasible to modeling for SBO of AFW battery depletion contributors to baseline systems in sequences most equipment without execute in SBO conditions, scenarios is set up to continuation/restoration CDF at nearly every US with batteries depleted dc power. However, The standard Palisades HRA avert core damage from is identified as a NPP. In many cases, (e.g. long term SBO credit is taken for AFW methodology utilizing the EPRI occurring with success candidate source of battery depletion may sequences).

restoration/continuation HRA Calculator approach is an of this action, model uncertainty.

be assumed to lead to after battery depletion in appropriate method for loss of all system SBO scenarios as determining the likelihood of capability. Some PRAs instructed by the plant failure of this action.

have credited manual EOP Supplement #19.

operation of systems that normally require dc for successful operation (e.g. turbine driven systems such as RCIC and AFW).

5. RCP seal LOCA The assumed timing Accident sequences Utilize PWROG

1) PWROG consensus model

1) Four different Consensus model treatment - PWRs and magnitude of RCP involving loss of seal consensus model approach is directly applicable probability values approach utilized.

seal LOCAs given a cooling approach for CE plants to Palisades.

representing two Therefore the RCP seal loss of seal cooling can

[D-1 1].

different PCP seal LOCA treatment is not have a substantial break sizes are utilized identified as a influence on the risk in the model for the candidate source of profile.

various accident model uncertainty.

scenarios analyzed.

6. Recirculation Recirculation pump seal Accident sequences N/A N/A N/A N/A pump seal leakage leakage can lead to with long-term use of treatment - BWRs loss of the Isolation isolation condenser w/ Isolation Condenser. While Condensers recirculation pump seal leakage is generally modeled, there is no consensus approach on the likelihood of such leaks.

Success Criteria (to support meeting SC-C3)

D-6

LTR-PSA-09-04 October 1, 2009 Attachment D Uncertainty Evaluation Table D-1: Issue Characterization for Sources of Model Uncertainty for Palisades (QU-F4 and LE-F3)

Topic (to meet Discussion of Issue Part of Model Plant-Specific Assumptions Made Impact on Model Characterization QU-EI)

Affected Approach Taken (to meet QU-E2)

(to meet QU-E4)

Assessment

7. Impact of Many BWR core Loss of containment N/A N/A N/A N/A containment venting cooling systems utilize heat removal on core cooling the suppression pool as scenarios with system NPSH a water source.

containment venting Venting of containment successful.

as a decay heat removal mechanism can substantially reduce NPSH, even lead to flashing of the pool. The treatment of such scenarios varies across BWR PRAs.

8. Core cooling Loss of containment Long term loss of No credit is taken for

1) Loss of NPSH or inventory

1) No injection is No credit for these success following heat removal leading to decay heat removal continued injection in loss issues will eventually lead to credited in total loss of systems in loss of containment failure long-term containment scenarios, of containment heat termination of injection systems containment heat containment heat or venting through over-pressurization and removal scenarios, taking suction from the removal scenarios, removal scenarios may non hard pipe vent failure can be a containment sump. Therefore, represent a slight paths significant contributor in all loss of containment heat conservative bias slant.

some PRAs.

removal scenarios are This should not be a Consideration of the assumed to eventually result in source of model containment failure core damage.

uncertainty in most mode might result in applications.

additional mechanical failures of credited systems. Containment venting through "soft" ducts or containment failure can result in loss of core cooling due to environmental impacts on equipment in the reactor building, loss of NPSH on ECCS pumps, steam binding of ECCS pumps, or damage to injection piping or valves. There is no definitive D-7

LTR-PSA-09-04 October 1, 2009 Attachment D Uncertainty Evaluation Table D-1: Issue Characterization for Sources of Model Uncertainty for Palisades (QU-F4 and LE-F3)

Topic (to meet Discussion of Issue Part of Model Plant-Specific Assumptions Made Impact on Model Characterization QU-E1)

Affected Approach Taken (to meet QU-E2)

(to meet QU-E4)

Assessment reference on the proper treatment of these issues.

D-8

LTR-PSA-09-04 October 1, 2009 Attachment D Uncertainty Evaluation Table D-1: Issue Characterization for Sources of Model Uncertainty for Palisades (QU-F4 and LE-F3)

Topic (to meet Discussion of Issue Part of Model Plant-Specific Assumptions Made Impact on Model Characterization QU-E1)

I I

Affected Approach Taken (to meet QU-E2)

(to meet QU-E4)

Assessment

9. Room heatup calculations Loss of HVAC can result in room temperatures exceeding equipment qualification limits.

Treatment of HVAC requirements varies across the industry and often varies within a PRA. There are two aspects to this issue.

One involves whether the SSCs affected by loss of HVAC are assumed to fail (i.e.

there is uncertainty in the fragility of the components). The other involves how the rate of room heatup is calculated and the assumed timing of the failure.

Dependency on HVAC for system modeling and timing of accident progressions and associated success criteria.

Plant specific calculations are referenced to determine the HVAC requirements in the model.

1) EA-C-PAL-98-1574 [D-121 was performed to analyze the heat up of the engineered safeguards rooms without room ventilation. These rooms house the HPSI, LPSI, containment spray, and auxiliary feedwater pump P-8C.

EA-C-PAL-98-1574 evaluated the temperature profiles in the east and west engineered safeguards rooms following a large break loss of coolant accident concurrent with a loss of offsite power, and a failure of the room coolers. The calculation demonstrates that for the assumed 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months mission time of the PRA, safeguards room components can function without room cooling.

1) There are no room cooling dependencies for the HPCI, LPSI, CSS, and AFW P-8C systems included in the PRA model.

Realistic using the best estimates for expected plant response. This should not be a source of model uncertainty in most applications.

2) EA-GOTHIC-AFW-01 [D-13]

and EA-GOTHIC-AFW-02 [D-14] were preformed to calculate conservative temperature profiles over time in the AFW pump room. The analysis evaluate a room heat-up due to a plant transient with loss of forced ventilation and room heat-up due to a high energy line break in the turbine building.

These analyses demonstrate that forced ventilation is not required for AFW components to function for either a HELB or

2) There are no room cooling dependencies for the HPCI, LPSI, CSS, and AFW P-8C systems included in the PRA model.

D-9

LTR-PSA-09-04 October 1, 2009 Attachment D Uncertainty Evaluation Table D-1: Issue Characterization for Sources of Model Uncertainty for Palisades (QU-F4 and LE-F3)

Topic (to meet Discussion of Issue Part of Model Plant-Specific Assumptions Made Impact on Model Characterization QU-E1)

Affected Approach Taken (to meet QU-E2)

(to meet QU-E4)

Assessment desian basis room heat-up.

3) EA-APR-95-023 [D-1 5]

calculated the room temperature profile under Appendix R boundary conditions for the 1-C and 1 -D switchgear rooms considering loss of forced ventilation.

This calculation demonstrated that Forced ventilation is not required in either the 1-C or 1-D switchgear rooms for equipment functionality.

3) There are no room cooling dependencies for the 1-C and 1-D switchgear rooms included in the PRA model.

Realistic using the best estimates for expected plant response. This should not be a source of model uncertainty in most applications.

4) EA-CA025644-01 [D-16]

evaluated the room heat-up using design basis assumptions and acceptance criteria and EA-CA023959-01

[D-17] performed several sensitivity analyses on various configurations of room ventilation and evaluated temperatures in the voltage regulator cabinet.

The analyses demonstrated that ventilation is required to maintain the design basis bulk room air temperature of 120°F if a diesel generator is in service.

4) Based on these evaluations, DG HVAC requirements are included in the model.

+

4

+

5) LOCA analysis (NAI-1 198-002 [0-18] and HELB analysis (SR-6, Rev. 3A [D-1 9]) were performed to demonstrate that ccw room cooling is not required.

5) There are no HVAC equipment dependences in the component cooling water rooms.

I I________________ 6) EA-APR-95-023 [D-1 5]

16) No specific Realistic using the best D-1 0

LTR-PSA-09-04 October 1, 2009 Attachment D Uncertainty Evaluation Table D-1: Issue Characterization for Sources of Model Uncertainty for Palisades (QU-F4 and LE-F3)

Topic (to meet Discussion of Issue Part of Model Plant-Specific Assumptions Made Impact on Model Characterization QU-E1)

Affected Approach Taken (to meet QU-E2)

(to meet QU-E4)

Assessment conservatively evaluated requirements for CSR estimates for expected heating in the cable spreading HVAC are included in plant response. This room based on maximum the model, should not be a source ambient conditions and room of model uncertainty in heat load. Based on this most applications.

calculation, the CSR will exceed the design basis criteria of 105'F in about 5.7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months without HVAC. However, the CSR temperature is monitored in the control room, and an ARP exists to open doors and initiate portable fans if the CSR temperature reaches 1 00°F.

Given the conservative nature of the 105'F criteria leading to actual component failures and the likelihood of success of enabling the ARP instructions, the Cable Spreading Room ia assumed to not require HVAC for continued operation of the components in the CSR.

7) EA-APR-95-023 [D-1 5] was

7) No specific performed to evaluate the requirements for affects of loss of battery room Battery Room HVAC ventilation on room heat-up.

are included in the This analysis showed that the model.

battery room will exceed its design basis temperature in about 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months without HVAC.

However, since the batteries are only nominally credited for four hours when chargers are unavailable and since the chargers can support all of the dc loads without the batteries then HVAC is assumed to not be required in the battery D-11

LTR-PSA-09-04 October 1, 2009 Attachment D Uncertainty Evaluation Table D-1: Issue Characterization for Sources of Model Uncertainty for Palisades (QU-F4 and LE-F3)

Topic (to meet Discussion of Issue Part of Model Plant-Specific Assumptions Made Impact on Model Characterization QU-E1)

Affected Approach Taken (to meet QU-E2)

(to meet QU-E4)

Assessment rooms.

8) EA-APR-95-023 [D-15]

8) Failure to model The lack of evaluated control room heat-up HVAC control room representation may be during the 72-hour period cooling in the Palisades a form of completeness following a loss of ventilation, internal events PRA is uncertainty, but should The analysis assumed offsite not considered an not be a source of power is available to maximize issue:

model uncertainty in control room heat load, and

Because of the high most applications.

assumed no heat transfer out design temperature of the room through concrete limits of the major walls. A sensitivity study was control room performed to evaluate cases components, with and without the operators setting up portable emergency

the general ventilation, conservative Without emergency ventilation, modeling the temperature reaches the amptons limit for habitability of 1 10°F at employe throughout the approximately 3.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months and

analysis, exceeds the technical specification limit of 120°F in 15 o and the philosophy hours.

of the operators with respect to remaining in the control room during such an event.

Additionally, if emergency ventilation is provided via the proposed Honda Tempest portable exhaust fans using outside (auxiliary building) air at 95°F, the control room temperature quickly decreases, not rising above 101.5°F at the D-12

LTR-PSA-09-04 October 1, 2009 Attachment D Uncertainty Evaluation Table D-l: Issue Characterization for Sources of Model Uncertainty for Palisades (QU-F4 and LE-F3)

Topic (to meet Discussion of Issue Part of Model Plant-Specific Assumptions Made Impact on Model Characterization QU-El)

Affected Approach Taken (to meet QU-E2)

(to meet QU-E4)

Assessment end of the 72-hr transient.

D-13

LTR-PSA-09-04 October 1, 2009 Attachment D Uncertainty Evaluation Table D-1: Issue Characterization for Sources of Model Uncertainty for Palisades (QU-F4 and LE-F3)

Topic (to meet Discussion of Issue Part of Model Plant-Specific Assumptions Made Impact on Model Characterization QU-E1)

Affected Approach Taken (to meet QU-E2)

(to meet QU-E4)

Assessment

10. Battery life Station Blackout events Determination of Design basis calculations

1) Given a plant SBO, battery

1) Depletion of the Realistic with slight calculations are important battery depletion indicate that about 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months depletion is expected to occur batteries results in loss conservative bias slant contributors to baseline time(s) and the of battery life is available in about 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months with or without of control power and introduced by use of CDF at nearly every US associated accident depending on scenario DC load shedding.

failure of most systems design basis NPP. Battery life is an sequence timing and specifics. Credit for 4 which rely on dc power. calculations for the dc important factor in related success hours per division is Continued operation of battery life assessing a plant's

criteria, utilized in the model for AFW is credited, determination. This ability to cope with an scenarios without however, as noted in should not be a source SBO. Many plants only chargers available, topic number 4 above, of model uncertainty in have design basis most applications.

calculations for battery life. Other plants have very plant/condition-specific calculations of battery life. Failing to fully credit battery capability can overstate risks, and mask other potentially contributors

& insights. Realistically assessing battery life can be complex.

11. Number of PWR EOPs direct System logic modeling Plant-specific evaluations

1) One of two PORVs is

1) The system fault tree The representation is PORVs required for opening of all PORVs to representing success using RETRAN confirm required for success of once-model requires one of realistic and should not bleed and feed -

reduce RCS pressure criterion and accident that 1 PORV is sufficient through-cooling, two PORVs for success be a source of model PWRs for initiation of bleed sequence timing for for success of once-of once-through-uncertainty in most and feed cooling, performance of bleed through-cooling,

cooling, applications.

Some plants have and feed and performed plant-specific sequences involving analysis that success or failure of demonstrate that less feed and bleed.

than all PORVs may be sufficient, depending on ECCS characteristics and initiation timing.

12. Containment All PWRs are improving Recirculation from Sump strainer failure is

1) Modifications installed in

1) The sump strainer There is uncertainty sump / strainer ECCS sump sump (PWRs) or from modeled with a common response to GSI-191 are failure rate is based on associated with the performance management practices, the suppression pool cause failure of both considered to have restored industry hourly failure likelihood of the D-14

LTR-PSA-09-04 October 1, 2009 Attachment D Uncertainty Evaluation Table D-1: Issue Characterization for Sources of Model Uncertainty for Palisades (QU-F4 and LE-F3)

Topic (to meet Discussion of Issue Part of Model Plant-Specific Assumptions Made Impact on Model Characterization QU-E1)

Affected Approach Taken (to meet QU-E2)

(to meet QU-E4)

Assessment including installation of (BWRs) system strainer assemblies.

sump performance to the rate data for strainer common cause failure new sump strainers at modeling and original design basis. While plugging for the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months of the strainers. As most plants. There is sequences involving detailed evaluations of debris mission time with a such, this is identified not a consistent method injection from these generation and transport for a standard treatment of as a candidate source for the treatment of sources range of break sizes and common cause.

of model uncertainty, ECCS sump (Note that the locations were performed for but is included as part performance.

modeling should be the GSI-191 efforts, analysis of the identification of All BWRs have relatively and testing was performed to common cause failures improved their straightforward, the demonstrate strainer assembly as a generic source of suppression pool uncertainty is related success under very limiting model uncertainty.

strainers to reduce the to the methods or conditions. Industry sponsored potential for plugging.

references used to analyses and tests were not However, there is not a determine the designed to provide data from consistent method for likelihood of sump which to infer sump strainer the treatment of strainer and common failure rates applicable to suppression pool cause failure of the scenario specific break sizes, strainer performance.

strainers.)

locations and sub-scenario effects (transport, chemical effects, bed formation dynamics, etc).

D-1 5

LTR-PSA-09-04 October 1, 2009 Attachment D Uncertainty Evaluation Table D-1: Issue Characterization for Sources of Model Uncertainty for Palisades (QU-F4 and LE-F3)

Topic (to meet Discussion of Issue Part of Model Plant-Specific Assumptions Made Impact on Model Characterization QU-E1)

Affected Approach Taken (to meet QU-E2)

(to meet QU-E4)

Assessment

13. Impact of failure of pressure relief Certain scenarios can lead to RCS/RPV pressure transients requiring pressure relief. Usually, there is sufficient capacity to accommodate the pressure transient.

However, in some scenarios, failure of adequate pressure relief can be a consideration. Various assumptions can be taken on the impact of inadequate pressure relief.

Success criterion for prevention of RPV overpressure (Note that uncertainty exists in both the determination of the global CCF values that may lead to RPV overpressure and what is done with the subsequent RPV overpressure sequence modeling.)

The heat removal capacity of the steam generators at Palisades is such that a demand on pressurizer SRVs is not expected post reactor trip. This heat removal capability is routinely demonstrated on plant trips without a demand on pressurizer SRVs. Given this demonstrated heat removal capacity, PORV block valves are normally closed during operation.

Demands on pressurizer SRVs would occur only during ATWS conditions, following a steam line break in which re-pressurization of the primary coolant system is allowed to occur, following SG dryout or if pressurizer SRV setpoints were to be set too low or drift down.

1) The PRA assumes no demand on pressurizer SRVs during a transient unless setpoint drift results in a premature actuation.

1) The potential for setpoint drift of SRVs is included in the consequential LOCA heading of the transient event trees. The probability of inadvertent SRV operation is based on generic operating experience for CE plants.

The potential for a premature demand on SRVs during transients is realistic and is based on generic operating experience. This should not be a source of model uncertainty in most applications.

2) A demand on all three pressurizer SRVs is assumed under ATWS conditions.

Failure of any of the SRVs to open is assumed to lead directly to core damage.

2) An SRV heading is included in the ATWS event tree with a success criterion requiring all three SRVs to open (given that the PORV block valves are normally closed).

The treatment that all three pressurizer SRVs are needed following an ATWS is deemed acceptable with a slight conservative bias slant.

This should not be a source of model uncertainty in most applications.

3) Re-pressurization of the primary coolant system and a demand on SRVs is assumed following a steam line break in which the affected steam generator is isolated.

3) The MSLB event tree assumes isolation of the affected SG will lead to re-pressurization of the primary coolant system unless the operators take action to limit the pressure rise. A demand on the pressurizer SRVs can then result in a small LOCA if an SRV sticks open.

Secondary cooling is assumed to be lost to the affected SG with certainty leaving only one SG available following a steam line break. This is a conservative assumption that leads to demands on the pressurizer SRVs unless the operator intervenes. This should not be a source of model uncertainty in most applications.

D-16

LTR-PSA-09-04 October 1, 2009 Attachment D Uncertainty Evaluation Table D-1: Issue Characterization for Sources of Model Uncertainty for Palisades (QU-F4 and LE-F3)

Topic (to meet Discussion of Issue Part of Model Plant-Specific Assumptions Made Impact on Model Characterization QU-E1)

Affected Approach Taken (to meet QU-E2)

(to meet QU-E4)

Assessment

4) SG dryout is assumed to

4) Initiation of OTC is Initiating OTC lead to the need to initiate effectively a manually precludes operation of OTC, which obviates the need initiated demand on the SRVs and is a to consider SRV operation, pressurizer pressure realistic assumption.

control components.

Ignoring the challenge to the pressurizer SRVs on failure to initiate OTC and the potential for one failing open is a conservative assumption from a CDF perspective. As such, this should not be a source of model uncertainty in most applications.

D-1 7

LTR-PSA-09-04 October 1, 2009 Attachment D Uncertainty Evaluation Table D-1: Issue Characterization for Sources of Model Uncertainty for Palisades (QU-F4 and LE-F3)

Topic (to meet Discussion of Issue Part of Model Plant-Specific Assumptions Made Impact on Model Characterization QU-E1)

Affected Approach Taken (to meet QU-E2)

(to meet QU-E4)

Assessment Systems Analysis (to support meeting SY-C3)

14. Operability of Due to the scope of System and accident Credit for operation of

1) EA-APR-95-023 [D-15]

1) No specific Realistic using the best equipment in beyond PRAs, scenarios may sequence modeling of systems beyond there conservatively evaluated requirements for CSR estimates for expected design basis arise where equipment available systems and design-basis environment heating in the cable spreading HVAC are included in plant response. This environments is exposed to beyond required support is typically only taken if room based on maximum the model.

should not be a source design basis systems.

calculations exist to ambient conditions and room of model uncertainty in environments (w/o support their continued heat load. Based on this most applications.

room cooling, w/o use. Exceptions are listed calculation, the CSR will component cooling, w/

in the next column.

exceed the design basis criteria deadheading, in the of 105'F in about 5.7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months presence of an un-without HVAC. However, the isolated LOCA in the CSR temperature is monitored area, etc.).

in the control room, and an ARP exists to open doors and initiate portable fans if the CSR temperature reaches 100°F.

Given the conservative nature of the 105'F criteria leading to actual component failures and the likelihood of success of enabling the ARP instructions, the Cable Spreading Room ia assumed to not require HVAC for continued operation of the components in the CSR.

2) EA-APR-95-023 [D-15]

2) No specific showed that the battery room requirements for will exceed its design basis Battery Room HVAC temperature in about 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months are included in the without HVAC. However, since model.

the batteries are only nominally credited for four hours when chargers are unavailable and since the chargers can support all of the dc loads without the batteries then HVAC is assumed to not be required in the battery rooms.

D-18

LTR-PSA-09-04 October 1, 2009 Attachment D Uncertainty Evaluation Table D-1: Issue Characterization for Sources of Model Uncertainty for Palisades (QU-F4 and LE-F3)

Topic (to meet Discussion of Issue Part of Model Plant-Specific Assumptions Made Impact on Model Characterization QU-E1)

Affected Approach Taken (to meet QU-E2)

(to meet QU-E4)

Assessment Human Reliability Analysis (to support meeting HR-13)

15. Credit For ERO Most PRAs do not give System or accident Generally, credit for

1) For actions in which more

1) Per the EPRI HRA Slight conservative bias much, if any credit, for sequence modeling initiation of actions from than 75 minutes is available for methodology [D-20], the treatment in the ERO initiation of the with incorporation of the ERO is not taken in diagnosis, a recovery factor on cognitive portion of the recovery factor value is Emergency Response HFEs and HEP value the Level 1 and Level 2 the cognitive portion of the HEP can be reduced for typically not utilized.

Organization.(ERO),

determination in both sequence analysis.

HEPs can include credit for HFEs where more than This should not be a including actions the Level 1 and Level ERO (namely, Technical 75 minutes is available source of model included in plant-2 models Support Center) response.

for diagnosis, but the uncertainty in most specific SAMGs and the execution portion of the applications.

new B5b mitigation HEP is not adjusted.

strategies. The However, it should be additional resources noted that the reduction and capabilities brought in the cognitive portion to bear via the ERO can of the HEP also be substantial, considers recovery from especially for long-term other sources (self-

events, check, STA, shift manager and extra crew) such that the ERO reduction factor is typically not utilized.

D-1 9

LTR-PSA-09-04 October 1, 2009 Attachment D Uncertainty Evaluation Table D-1: Issue Characterization for Sources of Model Uncertainty for Palisades (QU-F4 and LE-F3)

Topic (to meet Discussion of Issue Part of Model Plant-Specific Assumptions Made Impact on Model Characterization QU-E1)

Affected Approach Taken (to meet QU-E2)

(to meet QU-E4)

Assessment Internal Flooding (to support meeting IFPP-B3, IFSO-B3, IFSN-B3, IFEV-B3, and IFQU-B3)

16. Piping failure One of the most Likelihood and Potential sources of floods

1) Plant wide flood initiating

1) Multiple initiating Impacts of flooding, mode important, and characterization of (pipes, tanks, etc.) were event frequency is events are defined both in terms of uncertain, inputs to an internal flooding identified from plant walk comprised of pipe-related and quantified, equipment impacted internal flooding sources and internal downs and evaluations of failures and maintenance based on system, and in terms of initiating analysis is the flood event sequences plant drawings. Pipe contribution, diameter, and event frequency, are frequency of floods of diameters and lengths

2) Plant wide flood initiating consequences of judged to be bounding various magnitudes were determined from the event frequency can be flood.

(conservative) due to (e.g., small, large, walk downs and from derived using generic

2) Propagation conservative treatment catastrophic) from isometric drawings.

(industry) data for floods, between rooms of initiating event various sources (e.g.,

One by one, each piping updated with plant-specific occurs because frequency and flood clean water, untreated flood source was experience, flood proceeds progression.

water, salt water, etc.).

assumed to suffer a

3) Maintenance contribution without mitigation, o Guillotine break EPRI has developed catastrophic guillotine is equal to the plant wide flood level rises, assumed some data, but the break (i.e., the maximum frequency minus the pipe and doorways open

Unmitigated flooding NRC has not formally size break). Floods were failure frequencies (derived due to water o Essentially "infinite" endorsed its use.

assumed to proceed using EPRI 1013141 [D-pressure. Thus, source capacity without mitigation, and all 22]).

more equipment

° Multiple diameters of equipment in an area was becomes involved pipes contribute to assumed to be impacted

4) Maintenance contribution (submerged) by flooding (and thus (submerged) by the flood, is comprised of "at power"

flood, add to overall Pipes connected to tanks and "at shutdown" parts -

identified as flood sources only the "at power" part

3) Maintenance frequency) were assumed to rupture contributes to flood contribution (and

= Maintenance in such a way that the frequency for at power thus, overall flood contribution entire inventory of the tank internal flood evaluation, frequency) is separate from and in conservative addition to piping would drain into an area.

5) For flood and major flood because no credit failures Plant specific analyses categories, pipe breaks are for operator

Maintenance is were used to characterize guillotine breaks.

recovery is assumed to occur at the flow rates associated

6) For pipe breaks, flooding

included, power, and is with the guillotine breaks.

continues without

4) Assumption of assumed to involve The flow rates were used mitigation, and with infinite "infinite source steps that could to assign the sources into supply.

capacity" results in actually produce a categories of "spray" -

7)

In general, flooding the inclusion of flood if performed less than 100 gpm, "flood" exceeds capacity of drain initiating events incorrectly

- 100 gpm or greater, up system.

(flood sources, equipment than if to 2000 gpm, and "major flood was flood"- 2000 gpm or

8) All equipment in a given e.g., pipes) that room or flood area is might otherwise be terminated.

D-20

LTR-PSA-09-04 October 1, 2009 Attachment D Uncertainty Evaluation Table D-1: Issue Characterization for Sources of Model Uncertainty for Palisades (QU-F4 and LE-F3)

Topic (to meet Discussion of Issue Part of Model Plant-Specific Assumptions Made Impact on Model Characterization QU-E1)

Affected Approach Taken (to meet QU-E2)

(to meet QU-E4)

Assessment greater.

assumed to be submerged as a result of a flood (or major flood) within the area.

screened.

I.

4 4

When pipe lengths were known for a flood source, pipe failure frequencies were calculated using the EPRI report "Pipe Rupture Frequencies for Internal Flooding PRAs, Revision 1," Technical Report 1013141, Final Report, March 2006 [D-22]. The appropriate frequency for pipe rupture or leak (spray) on a per foot, per year basis was chosen based on system, pipe diameter, and category (flood, major flood, spray).

This was multiplied by number of feet.

When pipe lengths were not known (due to inaccessibility of areas, for example), pipe rupture frequencies were taken from EA-PSA-RI-ISI INDIRECT ANALYSIS, "RI-ISI Indirect Effects Evaluation," Rev. 0, August 12, 2000 [D-23],

for the pipe segment(s) comprising the flood source. (Note - there were very few of these instances.)

9) Spray events have only localized impacts.

10) No maintenance contribution to spray events - maintenance staff is assumed to halt the event immediately upon its occurrence.

11) For maintenance contribution to flooding, no maintenance staff recovery (i.e., action to halt the flood) is credited.

12) Maintenance activity on any component identified as a candidate is assumed to take place, and is assumed to contain steps that could place the component in jeopardy of producing a flood.

13) If a pipe break flood initiating event group is comprised of pipes of a range of diameters, the diameter associated with the highest per foot, per year failure frequency is chosen from EPRI 1013141.

Propagation between rooms results in substantially more equipment being impacted (submerged and failed) than if flood was mitigated or if finite source assumed.

In summary, the frequency of plant wide flooding, pipe rupture, and of maintenance errors resulting in flood at power, are candidate sources of model uncertainty. However, as noted above, the plant specific approach utilized is believed to produce results that bound the uncertainty.

D-21

LTR-PSA-09-04 October 1, 2009 Attachment D Uncertainty Evaluation Table D-1: Issue Characterization for Sources of Model Uncertainty for Palisades (QU-F4 and LE-F3)

Topic (to meet Discussion of Issue Part of Model Plant-Specific Assumptions Made Impact on Model Characterization QU-E1)

Affected Approach Taken (to meet QU-E2)

(to meet QU-E4)

Assessment LERF Analysis (to support meeting LE-G4)

17. Core melt arrest Typically, the treatment Level 2 containment No credit is given for Power recovery during the time Because no credit is Lack of credit for power in-vessel of core melt arrest in-event tree sequences recovery of offsite power window between core damage taken, there is no top recovery is slightly vessel has been limited.

after core damage but and radioactive release is event in the model to conservative.

However, recent NRC before a radioactive

unlikely, account for power Therefore, this should work has indicated that release since the recovery between core not be a source of there may be more likelihood may be small damage and radioactive model uncertainty in potential than and the time window will release.

most applications.

previously credited. An vary for different example is credit for scenarios.

CRD in BWRs.

18. Thermally NRC analytical models Level 2 containment The Palisades Level 2 Conditional probabilities for TI-TI-SGTR can be a Induced steam induced failure of hot and research findings, event tree sequences analysis used in this SGTR are given in Table E-17 contributor to LERF at generator tube ruptures leg/SG tubes -

continue to show that analysis is considered a of the WCAP are assumed to Palisades. Therefore, are a significant issue PWRs TI-SGTR is more much more detailed be applicable. The analysis variations in the for most PWRs, probable than predicted analysis than that uses the average tube likelihood of TI-SGTR including Palisades.

by the industry. There described in the guidance degradation values, will have a direct effect Therefore, the is a need to come to from WCAP-16341-P [D-on the calculation of likelihood of TI-SGTR is agreement with NRC on 21].

LERF. Uncertainties identified as a the thermal hydraulics A Palisades specific are not expected to candidate source of modeling of TI SGTR.

version of MAAP was affect the structure of model uncertainty.

created to address the the model.

integrated effect of the plant-specific features on overall containment performance and fission product release. Some significant modifications and enhancements added to MAAP in development of CPMAAP included:-

-Elevation Head in Accumulator Discharge Model.

-Tellurium (Te) Release During Direct Containment Heating Model.

D-22

LTR-PSA-09-04 October 1, 2009 Attachment D Uncertainty Evaluation Table D-1: Issue Characterization for Sources of Model Uncertainty for Palisades (QU-F4 and LE-F3)1 Topic (to meet

~Discussion of Issuel Part of Model Plant-Specific Assumptions Made IImpact on Model ICharacterization QU-EI)

Affected JApproach Taken j (to meet QU-E2)

(to meet QU-E4)

Assessment

-Non-cladding Hydrogen Source Model.

-Steam Generator Level Correction at Full Power.

-Improved Numeric/Logic for Modeling Solid Steam Generator.

-Dead band Model for Secondary Relief Valves.

-PcS Insulation Melting Model.

-PcS Pressure Boundary Creep Rupture Model - A thermal creep rupture model based on the Larsen-Miller Parameter (LMP) method was added to CPMAAP to evaluate the response of the hot legs, surge line, and steam generator tubes.

-Hydrogen Detonation Cell Width Model.

-Core Debris Flow to the Auxiliary Building Model.

-Palisades Specific ESE Modeling.

These hard-coded modeling changes were implemented some 20 years ago. As a point of comparison the NRC's recently completed STATE-OF-THE-ART REACTOR CONSEQUENCE

____________ANALYSES (SOAR CA)

D-23

LTR-PSA-09-04 October 1, 2009 Attachment D Uncertainty Evaluation Table D-1: Issue Characterization for Sources of Model Uncertainty for Palisades (QU-F4 and LE-F3)

Topic (to meet Discussion of Issue Part of Model Plant-Specific Assumptions Made Impact on Model Characterization QU-E1)

Affected Approach Taken (to meet QU-E2)

(to meet QU-E4)

Assessment just included the Larsen-Miller Parameter (LMP) method in an update to the MELCOR code.

D-24

LTR-PSA-09-04 October 1, 2009 Attachment D Uncertainty Evaluation Table D-1: Issue Characterization for Sources of Model Uncertainty for Palisades (QU-F4 and LE-F3)

Topic (to meet Discussion of Issue Part of Model Plant-Specific Assumptions Made Impact on Model Characterization QU-EI)

Affected Approach Taken (to meet QU-E2) j (to meet QU-E4)

Assessment

19. Vessel failure mode The progression of core melt to the point of vessel failure remains uncertain. Some codes (MELCOR) predict that even vessels with lower head penetrations will remain intact until the water has evaporated from above the relocated core debris.

Other codes (MAAP),

predict that lower head penetrations might fail early. The failure mode of the vessel and associate timing can impact LERF binning, and may influence HPME characteristics (especially for some BWRs and PWR ice condenser plants).

Level 2 containment event tree sequences Four possible causes for early containment failure at the time of reactor vessel breach are addressed in this analysis

- ex-vessel steam explosion, hydrogen burn, direct containment heating, and alpha mode failure (in-vessel steam explosion). While following the general guidance in WCAP-16341-P, this analysis uses a more plant-specific approach to early containment failure.

1) The ex-vessel steam explosion is a greater issue for free-standing reactor cavities (as opposed to excavated cavities). Because Palisades is a free-standing cavity, containment failure due to ex-vessel steam explosions are assigned a likelihood of 0.01.

1) Ex-vessel steam explosions contribute to containment failure for sequences with a wet reactor cavity at the time of vessel failure.

Probability is generally a low contributor and slightly conservative, so should not be a source of model uncertainty in most applications.

4

+

2) Scenarios that lead to hydrogen burns at plants like Palisades are limited to about 50% zirconium oxidation for CFE5-and CFE3H-type scenarios and 40% for CFE1-type scenarios. However, probabilities for containment failure are based on the Palisades detailed analyses that range from 0.01 to 0.0001.

2) Hydrogen bum sequences at 40%

oxidation can be contributors to LERF at Palisades. Therefore, variations in the likelihood of containment failure due to hydrogen burn will have a direct effect on the calculation of LERF.

Hydrogen burn can be a contributor to LERF at Palisades. Therefore, the values utilized for containment failure due to hydrogen burns are identified as a candidate source of model uncertainty.

3) Direct containment heating is 3) DCH is not expected Probability is generally also addressed by the to be a significant a low contributor and Palisades analysis [D-24]. The contributor to LERF.

slightly conservative, so conditional containment failure The value may be should not be a source probabilities due to direct conservative compared of model uncertainty in containment heating is 0.005 to to previous Palisades' most applications.

cover all scenarios analysis, but is used at this point for consistency with the WCAP.

4) Per reference [D-24] the alpha mode failure (due to in-vessel steam explosion) presents a low probability (1.OE-4) of containment failure at low pressures and is negligible at high pressures.

4) Alpha mode failure is not a significant contributor to any sequence.

Probability is now accepted as a very low contributor, so should not be a source of model uncertainty in most applications.

D-25

LTR-PSA-09-04 October 1, 2009 Attachment D Uncertainty Evaluation Table D-1: Issue Characterization for Sources of Model Uncertainty for Palisades (QU-F4 and LE-F3)

Topic (to meet Discussion of Issue Part of Model Plant-Specific Assumptions Made Impact on Model Characterization QU-E1)

Affected Approach Taken (to meet QU-E2)

(to meet QU-E4)

Assessment

20. Ex-vessel The lower vessel head Level 2 containment The Palisades' in-core

1) Success of the cavity

1) Success of the cavity Operation of CSS is cooling of lower of some plants may be event tree sequences instrumentation enters the flooding system at low flooding system is based on system fault head submerged in water reactor vessel through the pressures requires successful modeled to require CSS trees. The likelihood of prior to the relocation of upper head. Therefore, containment spray injection and operation and routing of CFS properly routing core debris to the lower there are no penetrations recirculation along with the water to the cavity water to the cavity is head. This presents in the lower reactor vessel successful operation of the by existing piping.

assumed, but is not a the potential for the head. The lower reactor flooding system to route water key factor. These core debris to be vessel head is also un-to the reactor cavity.

factors should not be a retained in-vessel by insulated. If the outside of source of model ex-vessel cooling. This the lower head is uncertainty in most is a complex analysis submerged in water and applications.

impacted by insulation, the Primary System vessel design and pressure is sufficiently

2) Once water fills the cavity

2) Given a flooded Thermal hydraulic degree of low, calculations and surrounds the lower portion cavity, a probability that uncertainty concerning submergence.

performed for the of the reactor vessel, sufficient adequate thermal-the ability to cool the Palisades indicate that heat transfer from the molten hydraulic conditions lower head and molten sufficient heat can be fuel to the water in the reactor exist (under low core from outside the removed through the cavity must occur. In high pressures) is applied to vessel may be lower head wall to prevent pressure sequences, it is capture significant. Therefore, vessel failure under most assumed that heat transfer is phenomenological the likelihood that the circumstances.

insufficient, uncertainty in the ability debris is not coolable to retain the molten

. when the RPV is at low core in the vessel.

pressure and water is in Under high pressures, the cavity is identified no credit is given, as a candidate source of model uncertainty.

21. Core debris In some plants, core Level 2 containment Direct contact of core

1) The plant modification

1) Sequences leading Based on the plant contact with debris can come in event tree sequences debris with the promotes freezing of a small to this situation are modification, there is containment contact with the containment shell is not mass of the debris, effectively identified as CAB high confidence that containment shell (e.g.,

an issue at Palisades.

plugging the drainpipes. This releases (Core-to-CAB scenarios will not some BWR Mark Is, However, Palisades has a should prevent immediate Auxiliary Building) and lead to LERF.

some PWRs including related, unique issue debris transport to the sump. If are treated as non-Therefore, core debris free-standing steel regarding the design of its the debris cannot be cooled LERF releases.

contact with containments). Molten reactor cavity and within the confines of the containment should not core debris can containment sump. The cavity, it may later melt through be a source of model challenge the integrity ESF sump is located the cavity floor (or the floor uncertainty in most of the containment directly below the reactor could ultimately fail.due the applications.

boundary. Some cavity floor (the floor of the corium weight), but the delay analyses have reactor cavity is the ceiling will greatly extend the time D-26

LTR-PSA-09-04 October 1, 2009 Attachment D Uncertainty Evaluation Table D-1: Issue Characterization for Sources of Model Uncertainty for Palisades (QU-F4 and LE-F3)

Topic (to meet Discussion of Issue Part of Model Plant-Specific Assumptions Made Impact on Model Characterization QU-EI)

Affected Approach Taken (to meet QU-E2)

(to meet QU-E4)

Assessment demonstrated that core of the sump). There are available for evacuation and debris can be cooled by two 1-inch drains, which' other mitigation measures.

overlying water pools.

connect the sump to the reactor cavity through the ceiling of the sump.

During previous analyses, this was identified as a potential LERF path via the Auxiliary Building, and plant modifications were performed to correct the issue. These drains have been filled with ceramic beads to slow the accident progression so that it is no longer an early release path.

D-27

LTR-PSA-09-04 October 1, 2009 Attachment D Uncertainty Evaluation Table D-1: Issue Characterization for Sources of Model Uncertainty for Palisades (QU-F4 and LE-F3)

Topic (to meet Discussion of Issue I Part of Model Plant-Specific Assumptions Made Impact on Model Characterization QU-EI)

I I Affected Approach Taken (to meet QU-E2)

(to meet QU-E4)

Assessment

22. ISLOCA IE Frequency Determination ISLOCA is often a significant contributor to LERF. One key input to the ISLOCA analysis are the assumptions related to common cause rupture of isolation valves between the RCS/RPV and low pressure piping. There is no consensus approach to the data or treatment of this issue. Additionally, given an overpressure condition in low pressure piping, there is uncertainty surrounding the failure mode of the piping.

ISLOCA initiating event sequences High to low pressure interfaces potentially leading to an ISLOCA include LPSI and SDC.

High pressure interfaces considered include HPSI and charging.

1) For LPSI, the check valves between the system and the primary coolant is considered as the initiator and given a year-long mission time. The intervening in series MOVs and check valves are assumed to have a quarterly surveillance interval based on periodic surveillance tests of their operability and integrity.

Consideration is given to the exposure to primary coolant conditions that occurs during stroke testing of ECCS valves.

For SDC, the isolation MOVs are electrically disabled. The inboard valve is given a yearly mission time to determine a rupture probability while the outboard valve is given a 24 hr mission time as there is a relief valve in between that would indicate failure of the inboard valve.

2) On exposure to primary coolant pressure, piping rupture probabilities are based on a statistical best fit that relates hoop stress in the pipe to the probability of failure considering pipe thickness, diameter and a given primary coolant system pressure.

Similar approaches are taken for high pressure interfaces with the primary coolant system including HPSI and charging.

1) The approach taken to assessing the probability of failure of interfacing components is based on the exposure time for interfacing components to primary coolant system conditions and actual operation and surveillance testing.

2) A best fit of hoop stress versus failure probability is used to determine piping failure probability outside containment assuming a 2250 psi primary coolant system pressure whether for high or low pressure piping.

Unique contributions from each flow path are incorporated into the ISLOCA fault tree that is directly integrated into the overall model.

The use of actual exposure times and surveillance intervals provides a realistic estimate of interfacing component failure probabilities.

The use of a correlation between hoop stresses and failure probability for piping outside containment is realistic, but slightly conservative given the primary coolant system pressure assumed in developing the correlation.

The approach for the ISLOCA frequency determination is considered to represent the proper treatment given the current understanding of these issues. This should not be a source of model uncertainty in most applications.

I

.J~ _________________________________________________

I _____________________________________

D-28

LTR-PSA-09-04 October 1, 2009 Attachment D Uncertainty Evaluation Table D-1: Issue Characterization for Sources of Model Uncertainty for Palisades (QU-F4 and LE-F3)

Topic (to meet Discussion of Issue Part of Model Plant-Specific Assumptions Made Impact on Model Characterization QU-EI)

Affected Approach Taken (to meet QU-E2)

(to meet QU-E4)

Assessment

23. Treatment of The amount of Level 2 containment Hydrogen burns can

1) Failure of containment spray

1) Failure of Hydrogen combustion Hydrogen hydrogen burned, the event tree sequences challenge the integrity of that allows a high steam containment due to can be a contributor to combustion in BWR rate at which it is the containment by concentration in containment hydrogen burn is LERF at Palisades.

Mark III and PWR generated and burned, creating high pressure prevents hydrogen combustion, modeled as only Therefore, this is ice condenser plants the pressure reduction excursions. The amount MAAP calculations support possible in conjunction identified as a mitigation credited by of hydrogen released into steam fractions greater than with failure of candidate source of the suppression pool, containment depends 55% during representative containment sprays.

model uncertainty.

structures, etc. can upon the amount of core scenarios, which is sufficient to have a significant damage at the time of prevent hydrogen combustion.

impact on the accident vessel failure. Scenarios sequence progression that lead to hydrogen development, burns at plants like Palisades are limited to about 50% zirconium oxidation, the probability of early containment failure at Palisades ranges from.01 to 0.0001 due to hydrogen burn. Steam inerting that prevents hydrogen combustion due to failure of containment sprays is also considered.

D-29

LTR-PSA-09-04 October 1, 2009 Attachment D Uncertainty Evaluation REFERENCES

[D-1 ]

Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessments, EPRI, Palo Alto, CA: 2008. 1016737.

[D-2]

ASME/American Nuclear Society, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, ASME/ANS RA-Sa-2009, March 2009.

[D-3]

U.S. Regulatory Commission, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making, NUREG-1855, Volume 1, Main Report, March 2009.

[D-4]

Idaho National Laboratory, Reevaluation of Station Blackout Risk at Nuclear Power Plants, Analysis of Loss of Offsite Power Events: 1986-2004, NUREG/CR-6890, INL/EXT-05-00501, November 2005.

[D-5]

Idaho National Laboratory, Industry-Average Performance for Components and Initiating Events at U.S. Commercial Nuclear Power Plants, NUREG/CR-6928, January 2007.

[D-6]

Transmittal of Technical Work to Support Possible Rulemaking on a Risk-Informed Alternative to 10CFR 50.46/GDC 35, Memo to Samuel J. Collins, NRC, from Ashok C.

Thadani, NRC, dated July 31, 2002.

[D-7]

Marshall, F.M., Rasmuson, D. M. and Mosleh, A. for the United States Nuclear Regulatory Commission, Common-Cause Failure Parameter Estimations, NUREG/CR-5497, October 1998.

[D-8]

Mosleh, A., Rasmuson, D. M. and Marshall, F. M. for the United States Nuclear Regulatory Commission, Guidelines on Modeling Common-Cause Failures In Probabilistic Risk Assessments, NUREG/CR-5485, November 1998.

[D-9]

Palisades Nuclear Plant, Engineering Analysis, Calculation of Initiating Event Frequencies in Accordance with CEOG Standards, EA-PSA-IE-00-0010, Rev. 1, December 2002.

[D-10] United States Nuclear Regulatory Commission, Estimating Loss-of-Coolant Accident (LOCA) Frequencies Through the Elicitation Process, NUREG-1829, April 2008.

[D-1 1] Westinghouse PWROG, Guidance for the implementation of the CEOG Model for Failure of RCP Seals Given Loss of Seal Cooling, WCAP-15749-P, Rev. 1, December 2008.

[D-12] Palisades Nuclear Plant, Engineering Analysis, ESF Room Heat up with LOCA/LOOP and Concurrent Failure of the ESF Room Cooling Fans, EA-C-PAL-98-1574 Rev. 0.

[D-13] Palisades Nuclear Plant, Engineering Analysis, Auxiliary Feedwater Pump Room Heat Up Analysis, EA-GOTHIC-AFW-01 Rev. 0.

[D-14] Palisades Nuclear Plant, Engineering Analysis, Auxiliary Feedwater Pump Room Heat Up Due to a High Energy Line Break (HELB) in the Turbine Building, EA-GOTHIC-AFW-02 Rev. 1.

[D-15] Palisades Nuclear Plant, Engineering Analysis, Room Heat-Up After Loss of Ventilation Under Appendix R Scenario in the Control Room (325), Cable Spreading room (224), 1-C D-1

LTR-PSA-09-04 October 1, 2009 Attachment D Uncertainty Evaluation and 1-D Switchgear rooms (116A and 123), Battery rooms (225 and 225A), Diesel Generator rooms (116 and 116B), EA-APR-95-023 Rev. 1.

[D-16] Palisades Nuclear Plant, Engineering Analysis, Evaluation of the Impact of 110%

Emergency Diesel Generator Overload Operating Condition on Ambient Temperature, EA-CA025644-01 Rev. 1.

[D-17] Palisades Nuclear Plant, Engineering Analysis, Acceptance of GOTHIC room Heat-Up Analysis (NAI-1147-001 Rev. 1), EA-CA023959-01 Rev. 0.

[D-18] Palisades Nuclear Plant, Engineering Analysis, Post-LOCA CCW Room Heat Up Analysis, NAI-1198-002 Rev. 0.

[D-19]

CPCo, Palisades Plant, Special Report No 6 (SR-6): Analysis of Postulated High Energy Line Breaks Outside Containment, SR-6 Rev. 3A, June 30, 1975.

[D-20]

SCIENTECH LLC, Software User's Manual, The EPRI Human Reliability Analysis Calculator (HRA Calculator), Version 3.01, Software Manual Product I D #1012902, EPRI, Palo Alto, CA: December 2005.

[D-21]

Westinghouse PWROG, Simplified Level 2 Modeling Guidelines - WOG Project: PA-RMSC-0088, WCAP-16341-P, Rev. 0, November 2005.

[D-22]

Pipe Rupture Frequencies for Internal Flooding PRAs, Revision 1. EPRI, Palo Alto, CA:

2006. 1013141.

[D-23] Palisades Nuclear Plant, Engineering Analysis, RI-ISI Indirect Effects Evaluation, EA-PSA-RI-ISI-00, Rev. 0, August 12, 2000.

[D-24]

CPCo to NRC Letter, January 29, 1993, Palisades Plant Individual Plant Examination for Severe Accident Vulnerabilities (IPE), [F341/1523].

[D-25]

INEEL/EXT-98-00401, "Rates of Initiating Events at U.S. Nuclear Power Plants: 1987-1995", February 1999, U.S. Nuclear Regulatory Commission, Washington D.C.

[D-26] Palisades Pressurized Thermal Shock (PTS) Probabilistic Risk Assessment (PRA),

ADAMS Accession number ML042880473, March 2005.

D-2

v t e Letter Sequence Request
TAC:ME2303, (Open)
Initiation Request Acceptance... Administration Questions Answers Results Approval... Other: ML092810053
MONTHYEAR2009-10-05 [Table View]

ML092810226

Text

SUBJECT:

Dear Sir or Madam:

Subject:

1.0 BACKGROUND

1.2 INTRODUCTION

2.2 REFERENCES

8.0 CONCLUSION

1.0 BACKGROUND

2.2 REFERENCES

8.0 CONCLUSION

Navigation menu

Search