Text

SDP Assessment of DC Panel D-11-2 Fault Palisades
	ML12006A071
Person / Time
Site:	Palisades
Issue date:	01/05/2012
From:	; Entergy Nuclear Operations
To:	; NRC/RGN-III
References
	EA-11-243, Meeting Notice - ML11350655, D-11-2 EA-PSA-SDP-D11-2-11-07, Rev. 1
	Download: ML12006A071 (152)
	v • d • e

EA-PSA-SDP-D11-2-11-07 Revision: 1 Date: 01/05/2012 Number of Pages: 152

Title:

SDP Assessment of DC Panel D11-2 Fault Approval: See signature page.

Purpose This engineering analysis assesses the significance of the dc panel fault and subsequent plant trip that occurred on 09/25/2011. Inadequate maintenance work instructions led to a short within dc panel ED 2. Contrary to intended design, the fuse between ED-11-2 and dc bus ED-10L/ED-10R failed to provide adequate protection and did not isolate the panel from the bus. This resulted in the loss of ED-10L/ED-10R and subsequent plant trip.

Conclusion Based on reviews of the event timeline, plant design and response, operator responses, plant-specific thermal-hydraulic analyses, potential human errors and logic model quantification, the following conclusions were reached:

Plant risk during the event increased. The increase in the conditional core damage probability given the dc panel ED-11-2 fault and subsequent plant trip is evaluated to be 4.3E-6, and is considered WHITE.

The risk increase is driven by scenarios in which the lost train of dc power is not recovered. When combined with other failures, this could result in a loss of secondary side cooling via the steam generators, failure to refill the condensate storage tank to provide long term cooling, failure to cool down and transition to shutdown cooling, and the failure of once-through-cooling as a last resort for decay heat removal, and ultimately core damage.

The risk increase is also comprised of scenarios in which charging pumps are not isolated in time to prevent a challenge to pressurizer safety relief valves, resulting in a potential loss of coolant accident if one or more relief valves sticks open. Failures to mitigate this consequential event can then lead to core damage.

A stuck open pressurizer safety relief valve is classified as an above core, vapor space LOCA.

For these scenarios, as long as secondary side cooling is available for decay heat removal the transient does not necessarily require high pressure safety injection to preclude core damage. If auxiliary feedwater remains available, the core survives the initial blowdown and inventory

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Page 2 of 36 makeup from charging is sufficient to maintain primary coolant system inventory and preclude core damage. Long term heat removal via the steam generators (or transition to shutdown cooling) then becomes a success path, even when a SRV sticks open - provided a nominal level of inventory makeup is available (e.g., via charging with SIRWT inventory conserved by terminating sprays, or via HPSI in recirculation mode once SIRWT inventory is depleted).

Realistic and justifiable human error probabilities were used for fault-related recoveries. Use of conservative human error probabilities increases the conditional core damage probability. The increase in delta conditional core damage probability is 6.0E-06 for the event, and is still considered WHITE.

Steam generator overfill was precluded during this event by isolating steam to the turbine driven auxiliary feedwater pump and limiting flow from AFW pump P-8C via flow control valves. Failure to do so could have resulted in steam generator overfill and the loss of the turbine driven auxiliary feedwater pump. The failure to restore the pump if needed was considered and did not contribute significantly to the risk.

Note: This engineering analysis is not a 10 CFR §50.2 design basis analysis and the results and conclusions of this analysis do not supersede those of any design basis analyses of record. The biases and degree of conservatism embodied in the methods, inputs and assumptions of this analysis may not be appropriate to support all plant activities. An appropriate level of engineering rigor commensurate with the safety significance of the topic under consideration is ensured in this analysis by conformance with all applicable Entergy procedures.

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Page 3 of 36 Table of Contents 1.0 PURPOSE .......................................................................................................................................... 4

2.0 CONCLUSION

................................................................................................................................... 4

3.0 BACKGROUND

................................................................................................................................. 5 3.1 Event Summary .............................................................................................................................. 5 3.2 Maintenance Initiating Event Summary .......................................................................................... 5 3.3 Latent Coordination Issue Summary .............................................................................................. 6 3.4 Evaluation Context.......................................................................................................................... 6 3.5 Key Factors Impacting Plant Response ......................................................................................... 7 4.0 INPUT ................................................................................................................................................. 9 4.1 PRA Tools and Models Input .......................................................................................................... 9 4.2 Plant Configuration Input .............................................................................................................. 11 4.3 Plant Design and Operation Event-Specific Input ........................................................................ 11 5.0 ASSUMPTIONS ............................................................................................................................... 15 5.1 Major Assumptions ....................................................................................................................... 15 5.2 Minor Assumptions ....................................................................................................................... 17 6.0 METHODOLOGY ............................................................................................................................. 18 6.1 Thermal-Hydraulic Model ............................................................................................................. 18 6.2 Logic Model .................................................................................................................................. 18 6.3 Human Error Probabilities ............................................................................................................ 20 6.4 Pressurizer Safety Relief Valve Failure Probability ...................................................................... 27 6.5 Significance Determination Color Criteria .................................................................................... 28 7.0 ANALYSIS ....................................................................................................................................... 29 7.1 Evaluation of Increased Plant Risk ............................................................................................... 29 7.2 Sensitivity Studies......................................................................................................................... 33

8.0 REFERENCES

................................................................................................................................. 35 9.0 ATTACHMENTS .............................................................................................................................. 36

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Page 4 of 36 1.0 PURPOSE This engineering analysis assesses the significance of the dc panel fault and subsequent plant trip that occurred on 09/25/2011. Inadequate maintenance work instructions led to a short within dc panel ED 2. Contrary to intended design, the fuse between ED-11-2 and dc bus ED-10L/ED-10R failed to provide adequate protection and did not isolate the panel from the bus. This resulted in the loss of ED-10L/ED-10R and subsequent plant trip.

Specifically, this analysis evaluates the conditional core damage probability given the fault event, fault propagation, impacted components, and potential recoveries. The conditional core damage probability includes consideration of additional random component failures and recovery actions that might have been unsuccessful. This analysis addresses the dc panel ED-11-2 fault. Only the single (internal) initiating event under the conditions that occurred is evaluated. This analysis does not address accident initiators from other internal events, internal flooding, or external events (high winds, tornadoes, internal fires, etc).

2.0 CONCLUSION

Based on reviews of the event timeline, plant design and response, operator responses, plant-specific thermal-hydraulic analyses, potential human errors and logic model quantification, the following conclusions were reached:

Plant risk during the event increased. The increase in the conditional core damage probability given the dc panel ED-11-2 fault and subsequent plant trip is evaluated to be 4.3E-6, and is considered WHITE.

The risk increase is driven by scenarios in which the lost train of dc power is not recovered. When combined with other failures, this could result in a loss of secondary side cooling via the steam generators, failure to refill the condensate storage tank to provide long term cooling, failure to cool down and transition to shutdown cooling, and the failure of once-through-cooling as a last resort for decay heat removal, and ultimately core damage.

The risk increase is also comprised of scenarios in which charging pumps are not isolated in time to prevent a challenge to pressurizer safety relief valves, resulting in a potential loss of coolant accident if one or more relief valves sticks open. Failures to mitigate this consequential event can then lead to core damage.

A stuck open pressurizer safety relief valve is classified as an above core, vapor space LOCA.

For these scenarios, as long as secondary side cooling is available for decay heat removal the transient does not necessarily require high pressure safety injection to preclude core damage. If auxiliary feedwater remains available, the core survives the initial blowdown and inventory makeup from charging is sufficient to maintain primary coolant system inventory and preclude core damage. Long term heat removal via the steam generators (or transition to shutdown cooling) then becomes a success path, even when a SRV sticks open - provided a nominal level of inventory makeup is available (e.g., via charging with SIRWT inventory conserved by terminating sprays, or via HPSI in recirculation mode once SIRWT inventory is depleted).

Realistic and justifiable human error probabilities were used for fault-related recoveries. Use of conservative human error probabilities increases the conditional core damage probability. The increase in delta conditional core damage probability is 6.0E-06 for the event, and is still considered WHITE.

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Page 5 of 36 Steam generator overfill was precluded during this event by isolating steam to the turbine driven auxiliary feedwater pump and limiting flow from AFW pump P-8C via flow control valves. Failure to do so could have resulted in steam generator overfill and the loss of the turbine driven auxiliary feedwater pump. The failure to restore the pump if needed was considered and did not contribute significantly to the risk.

3.0 BACKGROUND

3.1 Event Summary On 09/25/2011, Palisades experienced an automatic reactor trip due to loss of power to 2 of 4 reactor protection system channels due to loss of power to preferred ac buses EY-10 and EY-30. Loss of power to dc bus ED-10L/ED-10R and consequently preferred ac buses EY-10 and EY-30 was the result of maintenance activities in dc panel ED-11-2. The maintenance activities caused a short in ED-11-2 and actuation of shunt trip breaker 72-01 on over-current protection. The consequence of these events was loss of power to dc buses ED-10L and ED-10R and loss of power from preferred ac buses EY-10 and EY-30.

No actual safety consequences resulted from this event. System response was as expected given a loss of one train of dc power. Right channel safety injection initiated immediately. Left channel safety injection initiated when EY-30 was placed on the bypass regulator. High and low pressure safety injection operated but did not inject since primary coolant system pressure remained above shutoff head. The opposite train of dc power remained available throughout the event.

The significant grounding event on dc panel ED-11-2 disclosed a latent coordination issue: the shunt trip breaker 72-01 opened, disconnecting the battery from the dc bus. The event also caused an internal fault in in-service #1 charger ED-15. The combination of events de-energized the dc bus resulting in loss of power to dc panels ED-11-1, ED-11-2, #1 inverter ED-06 and #3 inverter ED-08. Loss of power to the inverters resulted in loss of power to two preferred ac panels (EY-10 and EY-30). Opening of breaker 72-01 was not expected as the design for this breaker required that breaker operation only be available via remote push button.

See Attachment 01 for a detailed event time line.

3.2 Maintenance Initiating Event Summary Breaker 72-120 was the first breaker removed from panel ED-11-2. Upon removal, a small air gap between the positive bus tie stab and the line side positive connection on breaker 72-119 was noted. An initial attempt was made to tighten the connection and close the identified air gap. The termination screw was found to be tight. The air gap was a result of a cross threaded screw, preventing the termination to be made tight. Following the removal of breakers 72-119, 72-121, and 72-123 the decision was made to remove the positive and negative copper connection stabs used to connect breakers 72-119 and 72-120 to the vertical bus; and to re-tap the damaged threads located on the copper connection stab as a result of the cross threaded screw.

As the positive copper connection stab was being removed, the repairman perceived a small arc which startled him resulting in a loss of control to the positive copper connection stand stab. The positive copper connection stab rotated downward and contacted the negative copper connection stab creating a direct short of the positive and negative dc bus within the ED-11-2 panel. Subsequently the reactor tripped following a loss of power to ED-11-2 panel.

Figures 3-1 and 3-2 below show the configuration of dc panel ED-11-2 just prior to and following the event.

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Page 6 of 36 Since the event was the result of a maintenance activity, personnel qualified to determine the extent of condition with respect to the fault and electrical component failures were present to carry out the recovery actions. Buses ED-10L and ED-10R were re-energized from station battery ED-01 within about 50 minutes.

Figure 3-1: DC Panel ED-11 Just Prior to Event Figure 3-1: DC Panel ED-11 After Fault Event 3.3 Latent Coordination Issue Summary See Attachment 02 for a discussion of expected and actual dc breaker and fuse coordination.

3.4 Evaluation Context The 09/25/2011 event revealed two performance deficiencies: (1) inadequate work instructions that led to a maintenance-induced dc panel fault, and (2) inadequate breaker/fuse coordination between a dc panel and bus that led to propagation of the dc panel fault to the dc bus.

A human performance deficiency (inadequate work instructions) caused a fault of sufficient magnitude to expose the latent breaker coordination deficiency. The short circuit current at the dc panel was sufficient to actuate dc breaker 72-01 internal trip function. The breaker actuation is a coordination issue since the fuse from dc panel ED-11-2 should have isolated the fault condition from dc bus ED-10L/D10-R.

Actuation of breaker 72-01 removed the battery as one source of power to dc bus ED-10L/ED-10R and contributed to the total loss of power to the bus.

This analysis evaluates the risk incurred during the post-event response. The human performance deficiency created a condition in which breaker 72-01 opened. Therefore this analysis models breaker 72-01 as open (unless successfully restored). The evaluation models the reactor trip event as a direct consequence of the human performance event, by setting the transient event frequency to unity.

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Page 7 of 36 The consequence of the human performance deficiency alone (without the breaker coordination deficiency) would have been isolation of the dc panel from the dc bus with the bus and the remaining loads continuing to be energized. However, the active (latent) trip mechanism in breaker 72-01 resulted in disruption of the existing coordination.

Breaker 72-01 opened prior to fuse FUZ/D11-2 resulting in disconnection of battery ED-01 from bus ED-10R. Subsequently an internal fault in the in-service #1 battery charger ED-15 actuated to disconnect the panel fault from ac power supply MCC #1. Additionally the panel fault also caused at least one breaker to open: breaker 72-37 to #1 inverter ED-06 supplying preferred ac bus EY-10.

Recovery from this event required identification of the fault condition (obvious in this case) and removal of the fault and or isolation of the fault from the dc bus. Once the fault was isolated individual components (battery chargers and inverters) were assessed for operability to allow restoration of power to the dc bus.

Initially, preferred ac bus EY-30 was restored by aligning power to it from the bypass regulator (redundant to the inverter and supplied by instrument ac panel EY-01). Next, buses ED-10R & ED-10L were declared operable and re-energized from the battery by closing breaker 72-01. Once the dc bus was energized, power to preferred ac bus EY-30 was transferred back to #3 inverter ED-08 being supplied by the dc bus and power was restored to preferred ac bus EY-10 by aligning it to the bypass regulator. At this point the dc bus and both preferred ac buses were re-energized with portions of dc panel ED-11-2 not available.

3.5 Key Factors Impacting Plant Response Based on the plant response to the ED-11-2 fault event, a review of the following factors represents an opportunity for improved operations and engineering training. The plant response and sensitivities discussed below are considered to be within the knowledge base of operations and engineering.

However, the degree of sensitivity and the operational implications are worth noting here.

Identification of these factors was an indirect result of the risk assessment. Presentation here is for background purposes only. These factors underscore the complexity of the loss of dc event and provide a context for the successful operator actions during the event.

Note: all temperatures, pressures, levels and percentages are considered approximate in the discussions below.

3.5.1 Sensitivity of PZR level to PCS temperature changes PCS temperature changes significantly impact pressurizer level.

For example, based on a PCS volume of 81,500 gallons (10,900 ft3, FSAR Table 4-1) and the density change in water from 525°F to 544°F at 2060 psia (47.1 lbm/ft3 to 48.3 lbm/ft3), PCS volume changes by 109 gallons/°F. Based on volumes of 809 ft3 and 593.7 ft3 at levels of 57%

and 42%, respectively [1], there are 107 gallons/%. This results in 1.02%/°F.

During this event from 16:03 to 16:15, PCS temperature increased from 529°F to 544°F. Even with charging and letdown isolated (charging was isolated at 15:57, with pressurizer level at

~80%; controlled bleedoff at 5 gpm), pressurizer level increased from 85% to 101.5% due to thermal expansion (see Attachment 01).

The observed increase agrees reasonably well with a prediction based the rates calculated above (i.e., 1.02%/°F and 107 gallons/%):

85% + (544°F - 529°F) * (1.02%/°F) - 5 gpm

12 min / 107gal/% = 100%.

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Page 8 of 36 3.5.2 Sensitivity of PCS level and SG level to relatively cold makeup water Heatup of makeup water after entering PCS increases the effective volumetric makeup rate.

For example, 73 gpm at 110°F charged into the system is 95 gpm when heated to 535°F, based on the density change in water from 110°F to 535°F at 2060 psia (62.2 lbm/ft3 to 47.7 lbm/ft3). A similar sensitivity is present for AFW pumped to the SGs. For example, 330 gpm indicated flow is effectively 435 gpm, based on the density change in water from 110°F to 535°F at 1000 psia (62.0 lbm/ft3 to 47.0 lbm/ft3).

3.5.3 Sensitivity of AFW flow split to differences in SG pressure Relatively small differences in SG pressure lead to significant differences in AFW flow to each SG when flow control valves are not available to regulate flow.

For example, with P-8B in service with CV-0727 and CV-0749 full open, and with E-50A pressure at 948 psig and E-50B pressure at 945 psig, the flow split is 179 gpm to E-50A and 187 gpm to E-50B.

However, with E-50A pressure at 860 psig and E-50B pressure at 958 psig, the flow split is 379 gpm to E-50A and 0 gpm to E-50B (see Attachment 10). Steam generator pressure differences are attributable to differences in main steam safety valve characteristics and the P-8B steam supply source (from E-50A).

3.5.4 Sensitivity of PCS temperature to relatively cold AFW makeup to SGs when ADVs not available When ADVs are not available to control PCS temperature, excess AFW significantly decreases PCS temperature. For example during this event, PCS temperature lowered from 540°F to 527°F primarily due to excess AFW addition (700 gpm total).

3.5.5 MSSV operation during relatively benign SG overpressure events Depending on heat input to the steam generators, MSSVs can provide a throttling action and produce a system response similar to ADV operation.

MSSVs initially open to ~70% when the setpoint is reached. If pressure continues to rise, MSSVs gradually open further and open fully when pressure reaches ~2.5% above set pressure. As pressure is reduced, MSSVs remain open but close to ~25% when pressure lowers to ~2.8%

below set pressure, and close fully when pressure lowers to ~3% below set pressure.

For example, the first set of MSSVs open to ~70% at 985 psig. As pressure is reduced, MSSVs close to ~25% when pressure lowers to 957 psig and fully close when pressure lowers to 955 psig. This precludes the severe saw-tooth steam generator pressure response that may be familiar from FSAR Chapter 14 analyses (e.g., loss of normal feedwater).

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Page 9 of 36 4.0 INPUT Inputs are grouped into three categories:

(1) PRA software tools, existing PRA models and evaluations (2) Plant configuration just prior to the event (3) Plant design and operational inputs from the event PRA tools and models input generally define the starting point of the logic model analysis.

Plant configuration inputs define the relevant equipment configuration just prior to and during the maintenance activity that led to the event.

Plant design and operation inputs describe several key design aspects and operation of the plant in response to the event. This is not intended to be an exhaustive description of the plant response (see 1 for a detailed timeline.

4.1 PRA Tools and Models Input 4.1.1 The SAPHIRE software application is used for PRA model quantification. Table 4-1 lists the file specifics.

Table 4-1: SAPHIRE Application (Ref. [2])

Filename Date Time Size SAPHIRE-7-27-852878059.exe 6/24/2008 11:48a 18,303 KB 4.1.2 The CAFTA software application is used for creating and viewing PRA model logic. The baseline CAFTA model serves as the starting point of the core damage fault tree model evaluated in this analysis. Table 4-2 below lists the baseline CAFTA files.

Table 4-2: CAFTA Model (Ref. [3])

Filename Description Date Time Size - KB PSAR2c.be PSAR2c CAFTA Basic Event File 6/26/2006 1:42p 1,248 PSAR2c.caf PSAR2c CAFTA Fault Tree File 6/26/2006 1:36p 449 PSAR2c.gt PSAR2c CAFTA Gate Type File 6/24/2006 1:31p 1,024 PSAR2c.tc PSAR2c CAFTA Type Code File 5/27/2004 9:03a 30 PSAR2c CAFTA Files.zip PSAR2c CAFTA zip file 6/29/2006 8:47a 289

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Page 10 of 36 4.1.3 The SAPHIRE project model is used for PRA model quantification. Table 4-3 lists the PSAR2c SAPHIRE project file used as the initial data set for this analysis.

Table 4-3: SAPHIRE Quantification (Ref. [3])

Filename Date Time Size - KB Description Caf2Sap PSAR2c.txt 6/29/2006 8:59a 11 Text rules file used by caf2sap.exe to create MAR-D files.

caf2sap.exe 3/24/2003 8:16a 28 Visual basic application for creating SAPHIRE MAR-D fault tree files.

Creation of Rules File 6/26/2006 2:42p 2,162 EXCEL spreadsheet that creates the *.txt rules file PSAR2c.xls for SAPHIRE MAR-D fault tree assembly.

PSAR2c FTree Logic.ftl 6/29/2006 9:16a 3,421 MAR-D fault tree file created from the PSAR2c CAFTA master fault tree.

SAPHIRE v7.26 PSAR2c 6/29/2006 9:43a 1,099 Above listed supporting files.

Ftree Files.zip 4.1.4 Table 4-4 defines the house event configuration used in both the base case and maintenance configuration case for this engineering analysis:

Table 4-4: House Event Configuration House Event House Event A-HSE-CST-MAKEUP F I-HSE-M2LEFT-INS T C-HSE-P-52A-STBY T I-HSE-M2RGHT-INS F C-HSE-P-52B-STBY T M-HSE-P-2A-TRIP T C-HSE-P-52C-STBY F M-HSE-P-2B-TRIP F D-HSE-CHGR1-INS T M-HSE-SJAE1-INS T D-HSE-CHGR2-INS T M-HSE-SJAE2-INS F D-HSE-CHGR3-INS T U-HSE-P-7A-STBY T D-HSE-CHGR4-INS F U-HSE-P-7B-STBY F E-HSE-AIR-GT-75F T U-HSE-P-7C-STBY F E-HSE-AIR-LT-75F F X-HSE-2SG-BLDN 1 E-HSE-BYPASS-REG T X-HSE-2SG-BLDN-A 1 E-HSE-EDG11-DEM T X-HSE-2SG-BLDN-B 1 E-HSE-EDG11-RUN T X-HSE-SGA-BLDN 1 E-HSE-EDG12-DEM T X-HSE-SGB-BLDN 1 E-HSE-EDG12-RUN T Y-HSE-LOOP1A-BRK T I-HSE-C-2AC-INS T Y-HSE-LOOP1B-BRK F I-HSE-C-2B-INS F Y-HSE-LOOP2A-BRK F I-HSE-F-12A-INS T Y-HSE-LOOP2B-BRK F I-HSE-F-12B-INS F Y-HSE-RAS-POST F I-HSE-F-5A-INS T Y-HSE-RAS-PRE F I-HSE-F-5B-INS F X-HSE-DOOR-167B T X-HSE-DOOR-167 T Note: D-HSE-CHRGR3-INS is set to True to allow faults on ED-11-2, 72-01 and battery chargers #1 and

3 to fail ED-10L and ED-10R. Charger #3 is not faulted, but is initially set to True to create the loss of dc to the bus and allow consideration of recovery of power to the bus as it was the standby charger.

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Page 11 of 36 4.2 Plant Configuration Input 4.2.1 Start-up power to bus 1F EA-23 breaker 252-302 out of service.

At the time of the loss of dc event, breaker 252-302 was out of service and cooling tower pump P-39A was powered from breaker 252-301 via station power transformer 1-3 EX-05. As a result, breaker 252-302 is modeled as out of service in this analysis. In the logic model, since the event results in a loss of condenser vacuum and cooling tower pumps support only maintaining condenser vacuum, there is little risk increase associated with this pre-existing condition.

4.2.2 Feedwater purity air compressors C-903A and C-903B aligned to plant instrument air.

At the time of the loss of dc event, feedwater purity air compressors C-903A and C-903B were cross-tied to instrument air via CV-1221. This alignment was a contingency. Work planning recognized instrument air compressor standby start may not work if dc power was lost due to the maintenance activity.

C-903A and C-903B are powered from MCC #91 by bus 1E. The loss of dc event resulted in a safety injection signal, subsequent bus 1E load shed and loss of power to C-903A and C-903B.

This may have contributed to the transient in instrument air header pressure. Instrument air was not lost during the event (ONP-7.1 was entered for low header pressure). Since instrument air was not lost as a result of the event, instrument air failures are not modeled as an initial condition for the event. Normal instrument air out of service events are included (see Assumption 5.1.5).

Note: Feedwater purity air is not credited as a backup to instrument air in the logic model.

4.3 Plant Design and Operation Event-Specific Input Event-specific consequential failures and impacts are discussed below. Section 6.3 provides additional information regarding credited recoveries and Attachment 07 provides modeling detail. Events listed in 7 that are intentionally failed because of the event, are annotated with (event consequential failure) and those failed but recovered are annotated with (event consequential failure - surrogate for recovery HEP).

4.3.1 Logic Model Consequential Failures Event-related consequential failures described in Section 3.1 are captured in the logic model with the following basic events.

Table 4.3-1: Logic Model Event Consequential Failures Impacted Components Associated Basic Event Comment Manual isolation of steam supply renders P-8B unavailable without TD AFW pump P-8B A-PMME-P-8B additional operator action.

1 battery charger ED-15 D-BCMT-ED-15 Charger damaged and not recovered during event.

Alternate charger used to supply #1 battery ED-01 and dc buses

3 battery charger ED-17 D-BCMT-ED-17 ED-10L and ED-10R.

Modeled components are breakers 72-119, 72-129 and 72-136. 72-119 never restored, treated as unrecovered. 72-129 and 72-136 dc panel ED-11-2 D-CBMC-72-119 recovered as a result of restoration of power to ED-10L/ED-10R without any additional actions.

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Page 12 of 36 Table 4.3-1: Logic Model Event Consequential Failures Impacted Components Associated Basic Event Comment House flag to allow crediting of alignment of alternate battery

(#3 battery charger ED-17) D-HSE-CHGR3-INS charger.

Restores ED-10L and ED-10R and allows charging of #1 battery shunt trip breaker 72-01 D-HSMC-HS-72-01 ED-01.

(charging pumps) G-PMOA-TRIP-PUMP Operator action event added to model challenge to PZR SRVs.

2400 v ac bus 1E P-B1MK-EA-13 Captures loss of bus 1E due to loadshed on safety injection signal.

preferred ac bus EY-10 P-PAMK-EY-10 Captures loss of preferred ac bus restore EY-10.

preferred ac bus EY-30 P-PAMK-EY-30 Captures loss of preferred ac bus restore EY-30.

Not required to be failed or restored, since EY-10 modeled as

1 inverter ED-06 n/a powered from bypass regulator only.

4.3.2 Operation of the atmospheric dump valves (ADVs) via quick open and manual control is unavailable until power is restored to preferred ac bus EY-10.

The loss of dc event resulted in loss of power to the inverter that supplies preferred ac bus EY-10.

Power can be restored by restoring power to the dc bus and re-energizing the inverter or aligning the bypass regulator to re-energize the preferred ac bus. EY-10 was placed on bypass regulator at 16:46, one hour forty minutes into the event.

4.3.3 Automatic start of auxiliary feedwater pump P-8A is unavailable until power is restored to dc panel ED-11-1. However, P-8A remained available for manual start from the control room or locally. After restoration of power to ED-11-1, P-8A is capable of automatic start on auxiliary feedwater actuation signal. If dc panel ED-11-1 power is restored prior to restoration of preferred ac panel EY-10 or EY-30 with P-8A running a spurious low suction pressure trip would occur.

The loss of dc event resulted in loss of power to EY-10, EY-30 and ED-11-1. Loss of EY-10 and EY-30 brings in the AFW pump low suction pressure trip. However, loss of power to ED-11-1 prevents relaying this signal to the P-8A start circuit. Since ED-11A remained available, P-8A remained available on manual start from control room or locally under this condition.

Restoring power to either preferred ac bus clears the low suction pressure trip signal: the power supplies are redundant and either provides appropriate power to the low suction pressure trip logic.

4.3.4 Auxiliary feedwater pump P-8B starts and runs (mechanical governor maintains normal turbine/pump speed) on loss of left channel dc until manual isolation or control is restored on recovery of left channel dc power. AFW P-8A/B flow control valves open fully on loss of preferred ac buses EY-10 and EY-30.

The loss of dc event de-energized left channel dc power and preferred ac power buses EY-10 and EY-30. Loss of left channel dc power starts P-8B. Loss of preferred ac power buses EY-10 and EY-30 opens flow control valves full open. Steam supply to P-8B was manually isolated at 16:03. P-8B flows to each steam generator are given in Attachment 10. Attachment 04 provides an accounting of AFW delivered to the steam generators during the event.

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Page 13 of 36 4.3.5 Auxiliary feedwater pump P-8C starts on auxiliary feedwater actuation signal given P-8A failure to deliver required flow (due to loss of left channel dc). Flow control valves set to 165 gpm to each steam generator since right channel dc available.

The loss of dc event de-energized left channel dc power. Right channel dc power remained available and started P-8C, with flow control valves controlling to 165 gpm to each steam generator. P-8C flow to E-50A was isolated due to overfill concerns at 15:44. P-8C flow to E-50B was isolated at 16:09 due to adequate E-50B level.

P-8C flows to each steam generator are given in Attachment 10. Attachment 04 provides an accounting of AFW delivered to the steam generators during the event.

4.3.6 Power from bus 1E is lost on a safety injection signal and is not available until re-energized by operators.

The loss of dc event de-energized preferred ac power buses EY-10 and EY-30. This combination of failures is sufficient to generate a spurious right channel safety injection signal. The safety injection signal results in load shed of bus 1E. This is a design feature of the plant and is addressed by both operator training and procedural guidance.

Loss of bus 1E results in loss of feedwater purity air compressors, which were aligned to instrument air prior to the event. See Input 4.2.2.

Power was restored to bus 1E at 15:49, about ~45 minutes into the event. On restoration of power to preferred ac bus EY-30 a second (left channel) safety injection signal occurred that again resulted in load shed of bus 1E at 15:57 and was promptly restored at 16:02.

4.3.7 Initial charging flow was 93 gpm. About 30 minutes into the event charging flow was reduced to 73 gpm.

The loss of dc event resulted in failure of the in-service channel A pressurizer level, heater and pressure control circuits. With no power to level control channel A the control program defaulted to maximum flow from the operating pumps (93 gpm: P-55A - 53 gpm; P-55B - 40 gpm).

At approximately 30 minutes into the event operators switched pressurizer pressure control to channel B to enable pressurizer spray. Operators also switched pressurizer level control to channel B. With channel B in service charging flow reduced to the minimum flow from operating pumps (73 gpm: P-55A - 33 gpm; P-55B - 40 gpm).

Had channel B level control been in service at the time of the event, automatic level control of charging flow would have remained available. In service charging pump flow would have been reduced to minimum flow at time zero (73 gpm: P-55A - 33 gpm; P-55B - 40 gpm). No credit for this configuration is taken in the analysis.

4.3.8 Absent additional electrical failures, loss of any two preferred ac buses de-energizes all control rod clutch power supplies. If there are no mechanical failures, all control rods insert.

The loss of dc event de-energized preferred ac power buses EY-10 and EY-30. Loss of EY-30 de-energized control rod clutch power supplies #1 and #2. Loss of EY-10 and EY-30 resulted in multiple 2 out of 4 RPS channel signals (e.g., low steam generator water level, low steam generator pressure) that de-energized clutch power supplies #3 and #4. Therefore, all control rod clutch power supplies de-energized. All control rods inserted.

All other combinations of loss of two preferred ac buses result in either direct loss of clutch power

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Page 14 of 36 supply, generation of multiple 2 out of 4 RPS channel signals, or combinations of these. As a result, loss of any two preferred ac buses interrupts all control rod clutch power supplies.

Given the loss of one dc channel de-energizes all clutch power supplies, many types of electrical RPS failures are eliminated (i.e., have no consequence). This reduces probability of electrical RPS failures (ATWS events).

This analysis leaves the ATWS event tree and RPS electrical failure probability unchanged, which represents a conservatism with respect the evaluation of the loss of dc event. This conservatism is eliminated if baseline risk (CCDP with no event-induced faults) is subtracted from the event risk (CCDP with event-induced faults and recoveries).

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Page 15 of 36 5.0 ASSUMPTIONS Assumptions in this engineering analysis are classified as major or minor. Major assumptions are those that may (but not necessarily) impact results by a factor of 2 or more. Minor assumptions are those that impact results by a factor of less than 2. These assumptions are specific to this engineering analysis.

Assumptions of other risk evaluations (e.g., full power internal events, etc.) are unchanged unless specifically noted.

5.1 Major Assumptions 5.1.1 The logic model does not credit transition to shutdown cooling following a stuck open pressurizer safety relief valve.

Basis: The transfer event tree for sequences with potential stuck open pressurizer safety relief valves (XFR-SBLOCA-SRV) includes a heading for successful transition to shutdown cooling (SD). To conservatively envelope sequences in which successful transition is not likely, sequences involving transition to shutdown cooling following a stuck open PZR SRV are not credited.

Bias: This assumption is considered conservative as sequences with a stuck open PZR SRV that could reach shutdown cooling are quantified as unsuccessful.

5.1.2 The logic model does not credit charging pumps for mitigation of a stuck open pressurizer safety relief valve LOCA as it is not considered in the current success criteria.

Basis: A stuck open SRV results in a containment high pressure signal and start of containment spray pumps. If spray pumps are tripped in a reasonable amount of time, safety injection and refueling water tank (SIRWT) inventory is sufficient for charging makeup to last the entire 24 mission time. Availability of AFW is necessary for crediting charging makeup to meet the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months mission time (see Attachment 05).

Bias: This assumption is considered conservative since sequences in which tripping spray pumps could avoid the need for HPSI are not credited.

5.1.3 The logic model considers dc panel ED-11-2 breaker 72-119 unavailable throughout the event.

Basis: Portions of ED-11-2 loads were restored at 15:57 by restoration of power to ED-10L/ED-10R. However, maintenance activities on several breakers within the panel were ongoing for an extended period of time. Three ED-11-2 breakers are modeled in the PRA: 72-119 (instrument air compressor control circuits), 72-126 (service water valves to containment control circuits) and 72-136 (EDG 1-1 control circuits). Restoration of power to ED-11-2 restored power to breakers 72-129 and 72-136. However breaker 72-119 remained unavailable throughout the event.

Bias: This assumption is considered neutral since it reflects actual plant configuration during the event.

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Page 16 of 36 5.1.4 The logic model requires two out of three service water pumps to support containment heat removal for sequences in which pressurizer safety relief valves function normally and reseat after a demand.

Basis: The logic model considers containment heat removal can be accomplished by operation of containment air coolers or containment sprays. Successful operation of containment air coolers requires one of three air coolers to maintain containment pressure below capacity. Successful operation of containment sprays requires one of three containment spray pumps and one of two shutdown cooling heat exchangers. Service water is required to remove heat from heat exchangers via the component cooling water system to the ultimate heat sink (Lake Michigan).

Two of three service water pumps are required for containment air coolers, since a single pump cannot support containment and shutdown cooling heat removal requirements. However, containment heat removal requirements are based on a double steam generator blowdown in containment and shutdown cooling heat removal requirements are based on decay heat requirements.

For success branches with non-stuck open relief valves and with continuous charging and secondary side heat removal, PZR SRVs are chattering and relieving excess makeup.

Containment heat removal is required to maintain containment pressure less than design.

If containment high pressure occurs due to the chattering relief valve, SIRWT inventory is depleted, charging suction source is unavailable and the LOCA is terminated (since relief valves are not failed in these success branches). In these sequences, containment heat removal is retained to demonstrate safe and stable (decreasing) containment pressure and temperature trends at 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

For all of these sequences, containment heat loads are lower than for a double steam generator blowdown such that a single service water pump would likely meet heat loads.

Bias: This assumption is considered conservative. Two of three service water pumps are modeled as required for containment heat removal when a single pump is likely adequate. An examination of cutsets for the affected sequence (21-02) indicates this assumption increases the CCDP by as much as 1.0E-07.

5.1.5 The logic model considers normal equipment maintenance unavailabilities.

Basis: It is known that certain equipment was not out of service due to maintenance at the start of the event. However, it is possible that under other circumstances this equipment may have been out of service for maintenance. For equipment known to be in-service (i.e., not tagged out for maintenance), basic events representing average maintenance unavailability were left in the model.

Bias: This assumption is considered conservative because inclusion of maintenance unavailability events for components known to be not tagged out for maintenance may increase the risk result. For example, events representing P-8C out of service due to maintenance may be included in the cutset solution despite P-8C not having been out for maintenance at the start of the actual event.

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Page 17 of 36 5.2 Minor Assumptions 5.2.1 The logic model initial condition is a loss of main condenser with a concurrent loss of dc power on buses ED-10L and ED-10R.

Basis: The initial plant response was consistent with a loss of main condenser event. Loss of power to the dc buses replicates the event given the lack of coordination between protective devices. Loss of EY-10 and EY-30 result in 2 of 4 SG pressure sensors reading low. Given EY-40 and ED-21 remain available, a right channel main steam isolation signal occurs. SV-0502 and SV-0513 energize to isolate air supply to, and SV-0514 and SV-0508 energize to vent air from, main steam isolation valves CV-0501 and CV-0510, respectively. Main steam isolation valves close.

Bias: This assumption is considered neutral since it represents a reasonable and appropriate initial condition for the logic models.

5.2.2 The logic model considers power to the dc bus from pre-event in-service #1 battery charger ED-06 unavailable throughout the event.

Basis: Full power to the dc bus from the in-service battery charger #1 failed at the time of the event due to an internal fault. The fault occurred because the charger output breaker remained closed. This is consistent with the actual event.

As a result of the fault condition, the in-service battery charger was isolated from the dc bus and not restored during the event response for an extended period of time. The alternate battery charger was placed in service to restore battery capacity. Whether fuses or internal breakers opened does not alter the consequence of the charger isolation.

Bias: This assumption is considered neutral since it represents the actual #1 battery charger condition over the event time period of interest.

5.2.3 The logic model considers turbine-driven auxiliary feedwater pump P-8B unavailable due to steam supply isolation at time zero, requiring operator action to restore it to service.

Basis: Pump P-8B initially operated as designed and was successful in conjunction with auxiliary feedwater pump P-8C in restoring and maintaining steam generator levels. During the event response with both auxiliary feedwater pumps in operation, steam generator E-50A level increased >90%. Given continued successful operation of pump P-8C and steam generator E-50B level > 60%, operators elected to isolate the steam supply to pump P-8B. Once isolated, operator action would have been required to restore P-8B to service if P-8C subsequently failed or pump P-8A failed after manual start or restoration of dc power.

While the direction to isolate P-8B was given at 15:31, actual isolation occurred at 16:03 - about 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months in to the event. Palisades MAAP runs [3] indicate one hour of P-8B operation extends to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months the time required for resumption of decay heat removal to prevent core damage.

Bias: This assumption is considered neutral. P-8B operated successfully and was subsequently isolated. By assuming P-8B is unavailable due to steam supply isolation, the logic model includes time-zero failures requiring restoration in the cutset solution despite successful operation of P-8B at time-zero. This is consistent with the failure memory approach.

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Page 18 of 36 5.2.4 Timeline event times and plant parameters in Attachment 01 and referenced throughout this analysis are approximate and reflect the best known information at this time.

Basis: The PRA group Ops representative developed and independently verified the event timeline and associated plant parameters. The PRA group Ops representative is a former Palisades SRO and has served as a Palisades Shift Manager and Operations Superintendent.

The timeline was developed using process information (PI) data, plant process computer data (PPC), operator logs (eSOMS), and control room recorder instrumentation. The timeline was verified by extensive on-shift crew interviews/discussions, the Ops reconstruction meeting, and crew peer check of indicated event times, parameters, and crew motivation/awareness.

Given loss of instrumentation during the event, uncertainties in the PI data, and necessary interpretation of operator log event times, the exact timing of some events may never be definitively known. Wherever specific times are used or discussed, the analysis considers that the times are approximate and may have been different.

Bias: This assumption is considered neutral since it represents the best known information at this time. This assumption is considered minor since timeline uncertainty has been considered in the analysis and bounded where necessary.

6.0 METHODOLOGY 6.1 Thermal-Hydraulic Model See Attachment 05 for the MAAP thermal-hydraulic methods and analyses.

6.2 Logic Model 6.2.1 Transient with Loss of Main Condenser Event Tree The transient induced by a loss of one train of dc power follows closely a transient with main condenser unavailable with the additional components lost due to the event set as failed (primarily ED-10L and ED-10R). Loss of EY-10 and EY-30 results in (spurious) 2 of 4 low steam generator pressure signals and (with EY-40 available) generates a right channel main steam isolation signal. This closes both main steam isolation valves, isolating the condenser. Therefore, the transient with loss of main condenser (LOMC) event tree was selected as the starting point for this analysis.

Given the event, the initiating event frequency IE_LOMC is set to unity - casting the results from core damage frequency to conditional core damage probability. Equipment out of service prior to the event (breaker 252-302) is set to failed (True). Equipment impacted by the dc fault event is set to failed (True or recovery HEP). Normal maintenance unavailabilities are used. The HEP for alignment of the bypass regulator to a preferred instrument ac bus is corrected to be consistent with the human reliability analysis.

See Attachment 07 for a listing of event-specific change sets used in this analysis.

A significant aspect of this event involved the potential challenge to the pressurizer safety relief valves. A transfer event tree representing a loss of coolant accident due to a stuck open relief valve is added to capture the risk due to failures to mitigate this consequential event. See Attachment 06 for a schematic representation of the event trees.

The event tree for transient with loss of main condenser (TR-MCND) is modified to address the challenge to pressurizer safety relief valves. Heading RXC is not changed and represents failure of reactor trip and the model of record ATWS sequences. Heading CONS-LOCA-FT represents the transfer to the pressurizer safety relief valve LOCA event tree (XFR-SBLOCA-SRV). All sequences in which the operator

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Page 19 of 36 fails to trip charging pumps prior to challenging the SRVs are transferred. Therefore the entry condition for XFR-SBLOCA-SRV is that PZR SRVs have been lifted. The remaining non-transferred sequences represent the model of record sequences for the transient with loss of main condenser tree.

6.2.2 Transfer ATWS Event Tree Heading RXC and ATWS transfer event tree (XFR-ATWS) have not been changed. These sequences represent the model of record ATWS sequences. Given the loss of one channel of dc interrupts all clutch power supplies, many electrical RPS failures are eliminated. Leaving the ATWS event tree unchanged represents a conservatism with respect to the evaluation of the loss of dc event. See Input 4.3.8. This conservatism is eliminated if baseline risk (CCDP with no event-induced faults) is subtracted from the event risk (CCDP with event-induced faults and recoveries).

6.2.3 Transfer PZR SRV LOCA Event Tree The transfer event tree for pressurizer safety relief valve LOCA (XFR-SBLOCA-SRV) is structured consistent with the model of record success criteria for PZR SRV LOCAs. Heading 2HP asks if secondary cooling is available via the steam generators. If so, high pressure safety injection is not required for decay heat removal if long term secondary side cooling is available and the PZR SRVs do not stick open. If not, the transient progresses as a loss of secondary heat sink and once-through-cooling is required.

If secondary cooling is available, it is important to determine if an actual LOCA has occurred, versus successful opening and closing of the SRVs. Safety relief valve failures are captured by headings PZR-SAFETIES-FTC.

Success branches on PZR-SAFETIES-FTC represent normal functioning safety relief valves - opening when required and closing when required. In these sequences, successful long term makeup to the condensate storage tank precludes core damage. No inventory makeup is required since relief valves are only relieving excess charging (if charging is never tripped). If long term cooling is not successful, once-through-cooling is required.

For success branches on PZR-SAFETIES-FTC (non-stuck open relief valves) with continuous charging, SRVs are chattering and relieving excess makeup. Containment heat removal is required to maintain containment pressure less than design.

For success branches on PZR-SAFETIES-FTC (non-stuck open relief valves), if containment high pressure occurs due to the relief valve discharge, SIRWT inventory is depleted, the charging suction source is unavailable and the LOCA is terminated (since relief valves are not failed in these success branches). In this case, containment heat removal is still retained to demonstrate safe and stable (decreasing) containment pressure and temperature trends at 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . See Assumption 5.1.4.

For some plants, failure to re-close after several cycles of steam relief is considered to be less probable than failure to re-close after water relief. However, Palisades safety relief valves have been tested/qualified for water relief so the failure probabilities remain the same (See Section 6.4).

Failure branches in PZR-SAFETIES-FTC represent above-core, vapor space LOCAs requiring either secondary side heat removal and HPSI for makeup or once-through-cooling.

For failure branches on PZR-SAFETIES-FTC (stuck open relief valves), if charging is successful for inventory control, core damage is precluded provided secondary heat removal remains available (AFW and long term makeup to the condensate storage tank). This presumes containment sprays are secured such that SIRWT inventory remains available for the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months mission. Recall Assumption 5.1.2 states that this success path is conservatively ignored. Therefore charging and HPSI recirculation are required for success.

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Page 20 of 36 If charging fails (or is not credited, as is the case), HPSI can prevent core damage with or without secondary side heat removal, with either:

successful shutdown cooling (also not credited), or AFW and long term makeup to the condensate storage tank.

With secondary side heat removal, HPSI is successful by providing inventory makeup only - PORVs are not required for decay heat removal since secondary side heat removal is available.

Without secondary side heat removal, HPSI is successful by supporting once-through-cooling (i.e., with PORVs).

If HPSI is not successful, core damage results since either or both inventory make-up and decay heat removal capabilities are lost.

Again on all success paths with stuck open relief valves, the LOCA results in the need for HPSI, since the SIRWT may be depleted before either reaching shutdown cooling or before depleting condensate storage tank T-2. HPSI injection and recirculation (HPSI-SI and HPSI-REC) and containment heat removal are therefore required for both inventory makeup and containment cooling.

Above-core, vapor-space LOCA analyses that credit charging are described in Attachment 05. These are performed to demonstrate margin only, and are not used as new success criteria.

Event tree features of note include:

Shutdown Cooling Transition to shutdown cooling following a stuck open pressurizer safety relief valve is not credited.

Event tree XFR-SBLOCA-SRV includes a heading for successful transition to shutdown cooling (SD). No sequences involving transition to shutdown cooling following a stuck open PZR SRV are credited in this analysis. See Assumption 5.1.1.

Charging Pumps Utilization of charging pumps to avoid the need for high pressure safety injection is not credited.

A stuck open SRV results in a containment high pressure signal and start of containment spray pumps. If spray pumps are tripped in a reasonable amount of time, safety injection and refueling water tank (SIRWT) inventory is sufficient for makeup to last the entire 24 mission time. Since all sequences that involve a stuck open PZR SRV are modeled as requiring recirculation mode HPSI for inventory makeup, tripping spray pumps is not credited in this analysis. See Assumption 5.1.2.

6.3 Human Error Probabilities Table 6.1-1 summarizes human error probabilities used in this analysis. The following discussion provides the basis for chosen values. See Attachment 12 for HRA calculator output.

Procedure guidance and training exists and was utilized for recovery and restoration of impacted components. The use of screening values does not imply lack of adequate training or procedural guidance. The actions would occur as expected based on available procedures and training.

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Page 21 of 36 The context, system windows and performance shaping factors are considered to ensure values are appropriate and consistent with site HRA practices. The HEPs were reviewed to:

1) Evaluate if currently developed HEPs require adjustment for the specific event (higher probabilities by assigning higher stress, complexity of action, etc).

2) Evaluate screening HEPs to assure values assigned are appropriate.

Table 6.3-1: Recovery Human Error Probabilities Estimated Actual Impacted Components Recovery HEP Recovery Time (1)

TD AFW pump P-8B restore isolated steam supply 3 hrs 46 min (1852) 1.0E-02

1 battery charger ED-15 restore normal charger longer term not recovered

3 battery charger ED-17 restore alternate charger 4 hrs 27 min (1933) 1.0E-01 shunt trip breaker 72-01 restore battery ED-01 51 min (1557) 1.0E-01 trip charging pumps -

charging pumps 51 min (1557) 6.8E-03 prevent challenge to SRVs 2400 v ac bus 1E restore bus 1E 43 min (1549) 2.6E-03 restore EY-10 via preferred ac bus EY-10 1 hr 40 min (1646) 3.3E-02

- bypass regulator restore EY-30 via 51 min (1557) preferred ac bus EY-30 - bypass regulator 1.0E-01 1 hr 40 min (1646)

- #3 inverter ED-08 (2) 50 hr 27 min

1 inverter ED-06 restore EY-10 normal supply not recovered (1733 9/27/11)

(1)

P-8B restored to full operability at 1852. P-8B remained available via manual operation prior to 1852.

(2)

EY-10 restored via alignment to bypass regulator. ED-06 not required with EY-10 on bypass regulator.

Turbine Driven AFW Pump P-8B Restoration of AFW pump P-8B uses a screening value of 1.0E-02.

Recovery is governed by ONP-2.3 and EOP Supplement 19 or SOP-12. Training is addressed in licensed operator qualification training on a two year periodicity. P-8B operated as designed and was successful in conjunction with auxiliary feedwater pump P-8C in restoring and maintaining steam generator levels.

During the event response with both auxiliary feedwater pumps in operation the level in steam generator E-50A increased to high levels (>90%). Given continued successful operation of pump P-8C and steam generator E-50B level greater than 60%, operators elected to isolate the steam supply to pump P-8B, to maintain P-8B restorable if needed (by avoiding steam generator E-50A overfill). Once isolated, local operator action would have been required to restore P-8B to service should the operating pump (P-8C) fail or pump P-8A fail. While the direction to isolate P-8B was given at 1531 the actual isolation occurred at 1603. See Assumption 5.2.3.

This screening value reflects the considerable time available, extensive training and detailed procedural guidance for restoration of P-8B steam supply. The value is considered conservative since manually opening P-8B steam supply valve CV-0522B was the only action required. EOP Supplement 19 steps to isolate the operator for manual control had already been performed as part of isolation of P-8B. The EOP

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Page 22 of 36 Supplement 19 actions are not needed to restore P-8B steam supply under manual control.

The model includes an HEP (1.5E-3) for failure to control flow to steam generator E-50A when P-8B is the source. This logic is included as a failure of pump P-8B due to steam generator overfill. Also, note P-8A remained available throughout the event from the control room and locally. See Section 4.3.3.

Note: To implement this recovery, the screening value of 1.0E-02 was logically ORd with the random pump failure probability of 5.8E-02 resulting in a value of 6.8E-02 used for the surrogate event. See 7.

1 Battery Charger ED-15 Recovery of #1 battery charger ED-15 is not credited.

ED-15 was not fully restored for several days following the event.

3 Battery Charger ED-17 Alignment of #3 battery charger ED-17 uses a screening value of 1.0E-01.

Recovery is governed by ONP 2.3 and SOP-30. Training is addressed in licensed operator qualification training on a two year periodicity. The baseline HEP development results in a value of 4.6E-04. The analysis credits a system window of four hours (battery capacity), with time delay of 35 minutes and an execution time of 35 minutes.

This higher screening value reflects potential dependencies in cues and restoration activities, increased stress, etc.

Shunt Trip Breaker 72-01 Recovery of shut trip breaker 72-01 uses a screening value of 1.0E-01.

This higher screening value reflects potential dependencies in cues and restoration activities, increased stress, etc.

Trip Charging Pumps Prior to PZR SRV Challenge The HEP for tripping charging pumps prior to challenging pressurizer safety relief valves is 6.8E-03.

Recovery is governed by the in use EOP and ARP-4. Training is addressed in licensed operator qualification training on a two year periodicity. The baseline HEP development results in a value of 2.6E-

03. The development is based on spurious charging and letdown failures that result in a challenge to the pressurizer safeties.

In response to rising pressurizer level and high level alarms (EK-0761 annunciator alarms at 62.75%

level; EK-0769 alarms at 75% level), operators are cued to trip all operating charging pumps. The action is not completed until other critical safety functions are verified (e.g., boration for reactivity control) and other conditions are met (e.g., throttling criteria for safety injection).

The baseline HEP development considers two charging pumps operating (actual condition) and the safeties opening at 100% pressurizer level (i.e., ignores the additional volume of the pressurizer head).

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Page 23 of 36 The baseline HEP development considers a 30 minute system window (Tsw) to determine the action is necessary and to complete it; a 2 minute delay time (Tdelay) before the cue is received, and a 2 minute manipulation time (TM) to complete the trip. Note the median response time (T1/2) is not used in the baseline HEP development methodology (CBDTM/THERP).

The baseline HEP development time line is:

Figure 6.3-1: Charging Pump Trip Baseline HEP Development The actual event system window was 62 minutes, based on event initiation at 15:06 and predicted time to the irreversible damage state at 16:08 leading to lifting pressurizer safety relief valves at 16:15. The delay time was 22 minutes (15:28), based on available indication in the control room of pressurizer level greater than or equal to 62.8%. Manipulation time is not changed at 2 minutes. Median response time is based on the actual response time of 29 minutes: action completed at 15:57 - initial cue at 15:28. Combination method CBDTM/ASEP is used in order to incorporate a time correlation method for execution. See Attachments 01, 03 and 12.

This event-specific timeline is:

Figure 6.3-2: Charging Pump Trip Event Timeline In the actual event, predicted time to challenge pressurizer safeties (62 minutes) was much longer than in the baseline HEP development (30 minutes). In the actual event 40 minutes (62 minutes - 22 minutes) were available to detect the cue, diagnose the situation, recover from error and complete the action to trip

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Page 24 of 36 running charging pumps.

The critical safety function for adequate PCS boration (which requires charging flow) competed with charging pump trip. Once operators determined boration requirements were met, safety injection throttling criteria allowed termination of all charging flow. The competing priorities impact the median response time to take the action. A median (actual) response time of 29 minutes following receipt of the high pressurizer level cue was considered.

The baseline HEP development uses COMPLEX versus SIMPLE for cognitive response. The cognitive element is approximately a factor of 10 lower than the calculated execution error. Execution shaping factors are treated as SIMPLE. This is a control room action and only requires the manipulation of hand switches. The baseline HEP development assigns LOW stress to execution and low work load.

For this analysis, it is appropriate to consider a high work load which equates to moderate stress. This increases the HEP to 6.8E-03.

2400 V AC Bus 1E The HEP for restoration of bus 1E is 2.6E-03.

Recovery is governed by EOP Supplement 5 and SOP-30. Training is addressed in licensed operator qualification training on a two year periodicity. Loss of and restoration of bus 1E is an expected condition based on the event progression (safety injection signal), emphasized in training and well understood by the operators. The principal risk impact is the restoration of water to the condensate storage tank to support continued operation of the operating auxiliary feedwater pump. Should makeup to the condensate storage tank fail, other sources (service water and fire protection) can be connected to the auxiliary feedwater pump suction.

The baseline HEP development considers a system window (Tsw) of 1.6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months (based on maintaining CST level greater than 50% full given 71% initial level), a 30 minute delay time (Tdelay) to get to the point in procedures that directs the action, and a 5 minute manipulation (TM) time to complete the alignment.

In the actual plant response power was restored to bus 1E within ~45 minutes. The actual time of completion was well within the time considered available to complete it. In addition, on restoration of power to preferred ac bus EY-30 a second (left channel) safety injection signal occurred that again resulted in load shed of bus 1E at 15:57 and was promptly restored at 16:02.

Preferred AC Bus EY-10 The HEP for recovery of preferred ac bus EY-10 via the bypass regulator is 3.3E-02.

Recovery is governed by ONP 24.1 and SOP-30. Training is addressed in licensed operator qualification training on a two year periodicity. A specific operator training Job Performance Measure has historically existed for this action. The baseline HEP development for powering a preferred ac bus via the bypass regulator is 1.7E-02, based the station black-out coping time.

The baseline HEP development considers a system window (Tsw) of 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months (based on the 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months battery depletion time in the context of battery supplying dc bus under SBO), a 60 minute delay time (Tdelay) to get to the point in procedures that directs the action, and a 30 minute manipulation (TM) time to complete the alignment. Note the median response time (T1/2) is not used in the baseline HEP development methodology (CBDTM/THERP).

The baseline HEP development time line is:

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Page 25 of 36 Figure 6.3-3: Align Bypass Regulator Baseline HEP Development Bus EY-10 was energized from the bypass regulator ~100 minutes into the event. The earlier actual completion time is the result of operators entering the event response via a loss of preferred ac power on more than one bus, therefore beginning the event response with this knowledge in mind.

The actual event system window is much longer and therefore bounded by the baseline HEP development timeline, since station black-out conditions did not exist and since right channel dc remained available throughout the event.

The baseline HEP development considered execution shaping factor SIMPLE versus COMPLEX and LOW stress. This analysis considers the execution as COMPLEX. Given the high workload condition, a HIGH stressor is applied, increasing the HEP to 3.3E-02.

Preferred AC Bus EY-30 Recovery of preferred ac bus EY-30 via normal power supply uses a screening value of 1.0E-01.

Recovery is governed by ONP 24.3 and SOP-30. Training is addressed in licensed operator qualification training on a two year periodicity. The baseline HEP development for powering a preferred ac bus via the bypass regulator is 1.7E-02, based the station black-out coping time.

Bus EY-30 was energized from the bypass regulator ~50 minutes into the event and from #3 inverter ED-08 ~100 minutes into the event. The earlier actual completion times are the result of operators entering the event response via a loss of preferred ac power on more than one bus, therefore beginning the event response with this knowledge in mind.

The actual event system window is much longer and therefore bounded by the baseline HEP development timeline, since station black-out conditions did not exist and since right channel dc remained available throughout the event.

This higher screening value reflects potential dependencies in cues and restoration activities, increased stress, etc.

Note: Use of the screening HEP is conservative for cutsets that involve restoration of EY-30 only, since in these cutsets the HEP is independent. A cutset review indicates the contribution of cutsets involving restoration of only EY-30 is small. Therefore, a reduction of the screening HEP value for cutsets in which no dependency exists was not performed.

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Page 26 of 36

1 Inverter ED-06 Recovery of #1 inverter ED-06 is not credited.

ED-06 was not fully restored for several days following the event. Since restoration of EY-10 is via the bypass regulator, unavailability of ED-06 does not impact EY-10 or the results.

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Page 27 of 36 6.4 Pressurizer Safety Relief Valve Failure Probability The logic model considers the probability of pressurizer safety relief valve failure to re-close after passing steam or water to be represented by the current analysis of record fault tree PZR-SAFETIES-FTC. This captured in the logic model in event tree heading PZR-SRV-FTC-STM.

The model of record fault tree PZR-SAFETIES-FTC and basic event probabilities are given below.

Table 6.4-1: Pressurizer Safety Relief Valve Failure Probabilities Basic Event Probability W-RVCC-RV-2OF3 1.340E-004 W-RVCC-RV-3OF3 9.520E-005 W-RVMB-RV-1039 3.690E-003 W-RVMB-RV-1040 3.690E-003 W-RVMB-RV-1041 3.690E-003 NUREG/CR-6928 [4] gives a value of 1.0E-01 for safety relief valve fail to close after passing liquid (SVV FTCL). However, this failure mode is not supported by EPIX data. The value was obtained by reviewing the fail to close data in the Westinghouse Savannah River Company database [5]. To approximate fail to close after passing liquid, the highest 95th percentiles for fail to close were identified from that source.

The highest values were approximately 1.0E-01. This value would be considered reasonable in the absence of any additional information.

Palisades safety relief valves are Dresser safety valve model 31739A. The valves are totally enclosed pop-open-type valves, spring-loaded, self-actuating, and have backpressure compensation.

The valves are designed to prevent the reactor coolant system pressure from exceeding the design pressure by more than 10%. This meets the requirements of the ASME Boiler and Pressure Code,Section III. As-left lift pressure setpoints are: RV-1039 2565 psig (range: 2542 to 2588 psig), RV-1040 2525 psig (range: 2503 to 2547 psig), RV-1041 2485 psig (range 2463 to 2507 psig).

The valves are mounted on short vertical inlet pipes welded to the pressurizer safety valve nozzles, sitting almost directly on the pressurizer top head.

Dresser model 31739A valves have been qualified for steam, transition and water relief as part of TMI Action Plan item NUREG-0737 II.D.1A [6]. A total of 31 full scale tests were performed at nominal set pressure of 2515 psia. The valves were tested under four general conditions: steam, steam-to-water

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Page 28 of 36 transition, water, and water seal conditions at pressures up to 2750 psia. Test conditions were based on consideration of PWR FSAR and extended high pressure liquid injection events.

Under steam, steam-to-water transition and water conditions, valve performance tested stable and satisfactory operation was observed. In all cases, the valve closed in response to system depressurization.

The model for PZR SRV failure is considered conservative. NUREG/CR-6928 gives a mean value SVV FTC of 7.0E-05 per demand; NUREG/CR-7037 [7] gives a mean value SVV FTC of 3.39E-4 per demand.

6.5 Significance Determination Color Criteria NRC Inspection Manual, Manual Chapter 0609, Significance Determination Process indicates the breakpoints for CDF and LERF. Informed by these, the following presents the breakpoints considered in this analysis:

Table 6.5-1: Risk Guidelines Risk Result Color

-4 CCDP > 10 RED

-5 -4 10 < CCDP < 10 YELOW

-6 -5 10 < CCDP < 10 WHITE

-6 CCDP < 10 GREEN

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Page 29 of 36 7.0 ANALYSIS The base analysis is given in Section 7.1; sensitivity studies are given in Section 7.2.

7.1 Evaluation of Increased Plant Risk Validation of Current Model of Record (PSAR2C)

The baseline results with nominal system alignment (at 1E-09 truncation) for the current model of record (Ref. [3]) are:

MCUB Type CDF # Cutsets Sequence MCUB 2.611E-05 (non-subsumed) 2362 End State MCUB 2.489E-05 (subsumed) 1708 Validation of the model was completed by quantification with nominal maintenance unavailabilities to confirm that the stated results were duplicated. The results were correctly replicated.

DC Panel ED-11-2 Fault Event Results Results are given below.

Table 7.1-1: Results Condition CCDP Description Baseline Risk 2.2E-06 Reactor trip with loss of main condenser and ATWS sequences considered. Pressurizer safety valve demand sequences not included (not part of PSAR2c TR-LOMC). Baseline maintenance unavailabilities used, with equipment out of service just prior to event taken OOS (252-302). Failure to trip charging pump HEP set to 0.

Risk Following ED-11-2 Fault Event 6.5E-06 See Section 6.3 for ED-11-2 fault related recoveries credited.

Risk Increase 4.3E-06 CCDP Cutset Review The top 100 cutsets are given in Attachment 08.

Cutsets 1 and 2 comprise 25% of the risk and represent scenarios from the baseline solution involving random failures only, i.e., not related to the dc fault event. Cutsets 1 and 2 are ATWS sequences that involve failure to initiate charging, unfavorable moderator temperature coefficient window, and/or failures of pressurizer safeties to open or close. These cutsets represent failures of primary coolant system overpressure protection, heat removal, and/or long term reactivity control. These cutsets are not expected to result from a loss of dc.

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Page 30 of 36 Cutset 3 comprises 2% of the risk and is dc fault related. Cutset 3 involves failure of secondary side cooling and failure of once-through cooling. High pressure feed fails from a common cause failure to start of all three AFW pumps. Low pressure feed fails as a result of the loss of EY-10 and subsequent loss of the ADVs, preventing timely depressurization. Once-through-cooling fails on operator failure to initiate OTC.

Cutset 4 comprises 1% of the risk and is not related to the dc fault event. Cutsets 4 is an ATWS sequence that involves mechanical failure of control rods to insert and failure of the operator to initiate charging flow for boration. Turbine trip is successful, pressurizer safeties open and close and moderator temperature coefficient is negative with respect to the criterion.

Cutset 5 comprises 1% of the risk and is similar to cutset 3. Cutset 5 involves failure of secondary side cooling and failure of once-through cooling. High pressure feed fails from operator failure to control AFW flow given instrument mis-calibration. Low pressure feed fails as a result of the loss of EY-10 and subsequent loss of the ADVs, preventing timely depressurization. Once-through-cooling fails on operator failure to initiate OTC, given the failure to control AFW flow and instrument mis-calibration.

Cutset 6 (and remaining cutsets) comprises less than 1% of the risk and is not related to the dc fault event. Cutsets 6 is an ATWS sequence that involves failure of primary coolant system overpressure protection (pressurizer safeties opened but failed to close).

Cutset 7 is dc fault related and is similar to cutsets 3 and 5. Cutset 7 involves failure of secondary side cooling and failure of once-through cooling. High pressure feed fails from a common cause failure to start of all three AFW pumps. Low pressure feed fails as a result of the loss of EY-10 and subsequent loss of the ADVs, preventing timely depressurization. Once-through-cooling fails on operator failure to initiate OTC, given the failure to manually isolate ADVs.

Cutsets 8 and 9 are dc fault related and represent excess steam demand events. These cutsets involve failure of secondary side cooling and failure of once-through cooling. High pressure feed fails from a combination of loss of ADVs, resulting in lifting and sticking open a MSSV and causing an excess steam demand event. Loss of dc power and operator failure to start and air compressor prevents AFW to the unaffected generator. Low pressure feed fails as a result of the loss of EY-10 and subsequent loss of the ADVs, preventing timely depressurization. Once-through-cooling fails due failure to open one PORV due to random failure and the other due the loss of dc control power.

Cutset 10 is dc fault related and is similar to cutsets 3, 5 and 7. Cutset 10 involves failure of secondary side cooling and failure of once-through cooling. High pressure feed fails from a common cause failure to start of all three AFW pumps. Low pressure feed fails as a result of the loss of EY-10 and subsequent loss of the ADVs, preventing timely depressurization. Once-through-cooling fails from a common cause failure of both PORVs to open.

Cutset 11 is dc fault related and represents a challenge to the pressurizer safety relief valves.

This cutsets represent a challenge to the PZR SRVs with successful long term secondary side cooling but does not result in a stuck open relief valve LOCAs. Operators fail to trip charging pumps in time to prevent lifting PZR SRVs, but the valves perform as designed and do not stick open. The cutset involves failure of containment heat removal due to loss of service water. Loss of service water results in failure of CCW cooling to containment spray pumps and loss of cooling for containment air coolers. In this sequence, loss of service water is caused by common cause failure (plugging) of all three service water pump discharge basket strainers.

Cutset 12 is dc fault related and is similar to cutset 3. Cutset 12 involves failure of secondary side

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Page 31 of 36 cooling and failure of once-through cooling. High pressure feed fails from a common cause failure all three AFW pump discharge check valves. Low pressure feed fails as a result of the loss of EY-10 and subsequent loss of the ADVs, preventing timely depressurization. Once-through-cooling fails on operator failure to initiate OTC.

Cutset 13 is dc fault related. Cutset 13 involves failure of secondary side cooling and failure of once-through cooling. High pressure feed fails from loss of all three AFW pumps: P-8A fails to start due to a consequential low suction pressure trip, P-8B fails to run (random), P-8C fails on common cause failure to start with high pressure injection pumps P-66A&B. Low pressure feed fails as a result of the loss of EY-10 and subsequent loss of the ADVs, preventing timely depressurization. Once-through-cooling fails due to failure of both HPSI pumps due to common cause.

Cutsets 14 and 15 are dc fault related and are similar to cutset 3. These cutsets involve failure of secondary side cooling and failure of once-through cooling. High pressure feed fails from a common cause failure to start of all three AFW pumps. Low pressure feed fails as a result of the loss of EY-10 and subsequent loss of the ADVs, preventing timely depressurization. Once-through-cooling fails on operator failure to initiate OTC, given the failure to control AFW flow and/or instrument mis-calibration.

Cutset 16 is dc fault related and is similar to cutset 3. Cutset 16 involves failure of secondary side cooling and failure of once-through cooling. High pressure feed fails from a common cause failure of all four AFW pump injection check valves. Low pressure feed fails as a result of the loss of EY-10 and subsequent loss of the ADVs, preventing timely depressurization. Once-through-cooling fails on operator failure to initiate OTC.

Cutset 17 is dc fault related and is similar to cutset 5. Cutset 17 involves failure of secondary side cooling and failure of once-through cooling. High pressure feed fails from operator failure to control AFW flow given instrument mis-calibration. Low pressure feed fails as a result of the loss of EY-10 and subsequent loss of the ADVs, preventing timely depressurization. Once-through-cooling fails on operator failure to initiate OTC, given the failure to control AFW flow, instrument mis-calibration, and failure to initiate low pressure feed.

Cutsets 18 and 19 are dc fault related and are similar to cutset 3. These cutsets involve failure of secondary side cooling and failure of once-through cooling. High pressure feed fails from a common cause failure to start of all three AFW pumps. Low pressure feed fails as a result of the loss of EY-10 and subsequent loss of the ADVs, preventing timely depressurization. Once-through-cooling fails on HPSI injection due to HPSI recirculation valve failing to remain open.

Cutset 20 represents failure of all four AFW flow control valves due to common cause failure and the human error for failure to initiate once through cooling. This is a base case cutset.

Cutset 21 represents failure of the turbine-driven AFW pump to run, failure of P-8A and P-8C to run due to mis-calibration of low suction pressure trip switches and the human error for failure to align once through cooling. This is a base case cutset.

Cutsets 22 and 23 represent an excessive steam demand event on one steam generator combined with failure of a once through cooling due to a PORV block valve failure to operate on one train and failure of the other PORV train due to loss of dc power and failure to manually start an instrument air (IA) compressor on low IA header pressure. In addition, loss of dc power prevents the operator from terminating AFW flow to the generator with excessive steam demand event.

Cutset 24 represents a long term failure to makeup to the condensate storage tank, initiate once-

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Page 32 of 36 through-cooling. The cutset is a base case cutset (not part of the delta CCDP) that is dominated by a human error dependency contribution related to alignment of a long replenishment of the condensate storage tank and failure to align once through cooling.

Cutsets 25 & 26 represent an excessive cooldown on one steam generator with failure of the operator to adjust flow to the steam generators to preferentially use the steam generator without the excessive cooldown combined with an inability to operate the atmospheric steam dump valves on the other generator due to dc power failures. In addition, the cutsets include a human error dependency contribution for failure to adjust AFW flow as discussed above and manually isolate ADVs and initiate once through cooling.

Cutsets directly related to the dc fault event comprise about 48% of CCDP. That is, about 52% of CCDP is part of the baseline risk and is independent of the dc fault event.

Sequence Review Sequence results are given in Attachment 09.

Non-LOCA, non-ATWS sequences represent about 64% of the CCDP. ATWS sequences represent about 28% of CCDP and consequential pressurizer safety relief valve LOCAs represent about 8% of CCDP.

The dominant two sequences are failure of secondary side cooling due loss of high and low pressure feed, and subsequent failure of once-through cooling.

The next dominant sequences are ATWS sequences not related to the dc fault event. These sequences are not part of the CCDP result.

Files used in the analysis are:

Table 7.1-2: IO File Configuration Control Filename Date Time Size Description (KB)

Rev 1 - 2012-01 SAPHIRE v7.27 PSAR2c (D11-2).zip 1/5/2012 9:54 AM 15,267 SAPHIRE Project

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Page 33 of 36 7.2 Sensitivity Studies 7.2.1 Impact of HEP screening values for select recovery HEPs Realistic and justifiable values were used for the fault-related recovery HEPs. The use of more conservative values can provide insight into the dependency of the results on the recovery HEPs.

The following recovery related HEPs are evaluated:

Table 7.2-1: Sensitivity Study Human Error Probabilities for Recovery Realistic or Sensitivity Impacted Components Recovery Screening HEP HEP TD AFW pump P-8B restore isolated steam supply 1.0E-02 1.0E-01

1 battery charger ED-15 restore normal charger not recovered not recovered

3 battery charger ED-17 restore alternate charger 1.3E-03 1.0E-01 dc panel ED-11-2 breaker 72-119 not recovered not recovered shunt trip breaker 72-01 restore battery ED-01 1.0E-01 1.0E-01 trip charging pumps charging pumps 6.8E-03 6.8E-03

- prevent challenge to SRVs 2400 v ac bus 1E restore bus 1E 2.6E-03 2.6E-03 restore EY-10 via preferred ac bus EY-10 3.3E-02 1.0E-01

- bypass regulator restore EY-30 via preferred ac bus EY-30 - bypass regulator 1.0E-01 1.0E-01

- #3 inverter ED-08 (1)

1 inverter ED-06 restore EY-10 normal supply not recovered not recovered (1)

Note: EY-10 restored via alignment to bypass regulator. ED-06 not required with EY-10 on bypass regulator.

The HEPs for restoration of bus 1E and failure to trip charging pumps were not increased in the sensitivity study. The basis for the HEPs are well founded in procedures and training, and are an expected response for any event resulting in a safety injection signal.

The HEP for restoration of the shunt trip breaker 72-01 and restoration of preferred ac bus EY-30 were not increased in the sensitivity study. The screening values used in the baseline analysis are considered to bound realistic HEP values.

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Page 34 of 36 Results are given below.

Table 7.2-2: Sensitivity Results Applying Sensitivity HEP Data from Table 7.2-1 Condition CCDP Description Baseline Risk 2.2E-06 Reactor trip with loss of main condenser and ATWS sequences considered. Pressurizer safety valve demand sequences not included (not part of PSAR2c TR-LOMC). Baseline maintenance unavailabilities used, with equipment out of service just prior to event taken OOS (252-302). Failure to trip charging pump HEP set to 0.

Risk Following ED-11-2 Fault Event 8.2E-06 See above for ED-11-2 fault related recoveries credited.

Risk Increase 6.0E-06 CCDP This result confirms the recovery HEPs are risk drivers for this assessment. However, with conservative recovery HEPs, the risk characterization remains WHITE.

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Page 35 of 36

8.0 REFERENCES

[1] EA-DDC-93-001, Revision 0, Pressurizer Liquid Level as a Function of Indicated Level to Support Loss of Load Initial Conditions, September 2005.

[2] EA-PSA-SAPHIRE-09-08, Revision 0, SAPHIRE v7.27 Testing and Software Quality Assurance Plan, December 2009.

[3] EA-PSA-PSAR2c-06-10, Revision 0, Update of Palisades CDF Model - PSAR2b to PSAR2c, June 2006.

[4] NUREG/CR-6928, Industry-Average Performance for Components and Initiating Events at U.S.

Commercial Nuclear Power Plants, INL/EXT-06-11119, February 2007.

[5] WSRC-TR-93-262, Savannah River Site Generic Data Base Development (U), Westinghouse Savannah River Company, C.H. Blanton and S.A. Eide, June 1993.

[6] NP-2770-LD, EPRI/C-E PWR Safety Valve Test Report, Volume 1: Summary, Research Project V102-2, January 1983.

[7] NUREG/CR-7037, Industry Performance of Relief Valves at U.S. Commercial Nuclear Power Plants through 2007, INL/EXT-10-17932, March 2011.

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Page 36 of 36 9.0 ATTACHMENTS 1: Event Timeline 2: Shunt Trip Breaker Coordination 3: Pressurizer Level and Challenge to Pressurizer Safety Relief Valves 4: Steam Generator Level and Challenge to Steam Generator Overfill/Loss of Turbine Driven Auxiliary Feedwater Pump 5: Thermal-Hydraulic Analyses 6: Event Trees 7 Change Sets 8: Cutsets 9: Sequences 0: Auxiliary Feedwater Flow Rate to Steam Generators E-50A and E-50B Following the Failure of Bus ED-11-2 on September 25, 2011 1: Review of NRC Timeline and Impacted Equipment List 2: HRA Calculator Output for Developed HEPs 3: Procedure Use Evaluation for DC Panel ED-11-2 Fault Event

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 01 - Page 1 of 13 1: Event Timeline Chart and Narrative This attachment contains the following:

Event timeline in chart format (Table A01-1)

Event timeline in narrative format Annotated plots of PCS and SG post trip behavior (Appendix I)

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 01 - Page 2 of 13 Table A01-1: Event Timeline Chart Saturday 9/24 Sunday 9/25 Sunday 9/25 Friday 9/23 1607 Sunday 9/25 1506 Sunday 9/25 1506 Sunday 9/25 1506 Sunday 9/25 1506 Sunday 9/25 1506 2218 1109 1500 Electrical maintenance Battery chargers Temp mod Electrical While removing bus bar, MSIS (2/4 logic low SG Right channel SIAS (2/4 AFAS (2/4 logic low S/G Right channel CIS/CHR restoring breaker 72- #1 ED-15 and 31973 Installed. maintenance short occurred in dc panel pressure) due to loss of logic low PZR pressure) level) due to loss of (2/4 logic, RIAX-123 (Emergency #2 ED-16 (Temp power for removed 4 dc ED-11-2 preferred ac buses EY-10 due to loss of preferred ac preferred ac buses EY-10 1805/RIAX-1807) due to Airlock ED-123) initially in- breaker 72-121 panel ED-11-2 and EY-30 buses EY-10 and EY-30 and EY-30 loss of preferred ac buses service (generator breakers (72- EY-10 and EY-30. Left exciter field 119,72-120,72- channel containment breaker control) 121,72-123) isolation valves closed from 72-127 due to loss of power (test cabinets))

Control room alarm: FWP air Shunt trip breaker 72-01 MSIVs CV-0510 and CV- IE bus EA-13 de- Turbine driven AFW pump PCP controlled bleedoff EK-0316 GEN FIELD compressor C- opened de-energizing dc 0501 and E-50B MFRV energized, no power to C- P-8B starts (CV-0522B valves CV-2083 and CV-FORCING/OVER 903B cross-tied buses ED-10R and ED- CV-0703 closed on MSIS, 903B FWP air failed open due to loss of 2099 close due to EXCITATION cycling supplying plant 10L and E-50A MFRV CV- compressor (was cross- ED-11-1). AFW flow CHR/loss of power, on/off air system 0701 closed due to loss of tied supplying plant air). control valves CV-0727 directing flow to primary power to EY-10 and EY- Closed MV-CA320 to and CV-0749 fail full- system drain tank T-74 in 30 isolate FWP from open. Flow imbalance containment (5 gpm) instrument air. C-2A develops between SGs instrument air compressor due to differential in dome was in "sleep" mode and pressures (no flow started indication available)

Multiple containment Dc panels ED-11-1 and All ADVs CV-0779, CV- In service PZR level AFW pump P-8C starts PCS unidentified leakage isolation valves position ED-11-2, and preferred ac 0780, CV-0781, and CV- control channel A fails, (AFAS) supplying 165 > 1 gpm for PCP indication lost buses EY-10 and EY-30 0782 fail charging pumps P-55A gpm to each SG. controlled bleedoff de-energized closed/inoperable (quick and P-55B in service (93 Loss of EY-10 and EY-30 isolation (LCO 3.4.13.A.1, open and normal gpm), and letdown orifices causes loss of Left B.1, B.2) operation) due to loss of CV-2003, CV-2004,CV- channel AFAS actuation preferred ac panel EY-10 2005 close (0 (P-8A does not start)

(LCO 3.7.4) letdown),PZR heaters de-energize Entered ONP-7.1 (72- Preferred ac panel EY-10 MSSVs lift on both SGs In service PZR pressure Inverter #1 ED-06 input Right channel CHP alarm 119 failure caused loss inoperable LCO 3.8.9.B control channel A fails, breaker to EY-10, 72-37 (2/4 logic,PSX-1801/PSX-of service air and CV- (LCO 3.0.3) spray valves CV-1057 tripped (LCO 3.8.7.A) 1803) due to loss of EY-1221 FWP building Preferred ac panel EY-30 and CV-1059 fail closed, 10 and EY-30 panels, no cross-tie to fail open) inoperable LCO 3.8.9.B no spray available actuation (actuation logic (LCO 3.0.3) requirements not met)

Reactor trip (2/4 logic Turbine trip (from reactor Operators enter EOP-1.0 Battery charger #1 ED-15, Dc bus ED-10R RPS) due to loss of trip), generator breakers Standard Post-Trip output breaker closed but inoperable (LCO 3.8.9.6) preferred ac buses EY-10 do not open due to loss of Actions charger not operating Dc bus ED-10L and EY-30 dc panel D-11-1 inoperable (LCO 3.8.9.6)

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 01 - Page 3 of 13 Table A01-1: Event Timeline Chart Sunday 9/25 1515 Sunday 9/25 1517 Sunday 9/25 1527 Sunday 9/25 1531 Sunday 9/25 1537 Sunday 9/25 1542 Sunday 9/25 1544 Sunday 9/25 1549 Sunday 9/25 1555 MSSVs open and then Operator jumpered Enter EOP-9.0 Operator observed Per EOP-9.0, enter Isolated RV-2006 NCO closed P-8C Restored 1E bus EA- Observed PZR level operate relay 487u (Y-phase) Functional Recovery high E-50A level ONP-24.1 and ONP- letdown relief by AFW flow control valve 13 (lost on SIAS at >62.8% (LCO 3.4.9.A).

(throttle/close/open) to to open generator Procedure (due to <3 (90%). Order given to 24.3 due to loss of placing letdown orifice CV-0737A to isolate 1506) and reenergized Actual PZR level 78%

maintain SG pressure output breakers 25F7 out of 4 preferred ac isolate CV-0522B preferred ac buses stop valves CV-2003, flow to E-50A, associated PZR PCS Tave 544F and 25H9 buses available) (steam to AFW pump EY-10 and EY-30 CV-2004, and CV- continue supplying heaters P-8B) per EOP 2005 to close 165 gpm to E-50B via Supplement 19 CV-0736A (LCO 3.7.5) 1A bus EA-21 de- PZR level 62% ~1530 Entered ONP- PZR pressure peaks Charging 73 gpm, 0 energized. 2.3 Loss of DC Power high 2200 psig. gpm letdown, 5 gpm Primary coolant (time not verified) PZR level 71% PCP controlled pumps P-50A and P- bleedoff to primary 50C stop, P-50B and system drain tank T-74 P-50D remain in service Realigned PZR pressure control to B channel to enable spray, pressure begins lowering Realigned PZR level control and heater control select switch to B channel. Letdown orifices open and RV-2006 (letdown heat exchanger inlet safety relief) lifts due to CV-2009 (letdown containment isolation) being closed on CHR/loss of power. 1D bus EA-12 PZR backup heaters reenergize Charging pumps P-55A and P-55B in service (73 gpm charging,108 gpm letdown relieving to quench tank) 5 gpm PCP controlled bleedoff to PSDT

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 01 - Page 4 of 13 Table A01-1: Event Timeline Chart Sunday 9/25 1557 Sunday 9/25 1602 Sunday 9/25 1603 Sunday 9/25 1609 Sunday 9/25 1615 Sunday 9/25 1621 Sunday 9/25 1630 Sunday 9/25 1639 Sunday 9/25 1646 Electricians report no Charging pump P-55B Steam to P-8B turbine CV-0736A closed to SG E-50A MSSVs lift, Entered ONP-7.1 Charging pump P-55B Restored AFW to E- Preferred ac bus EY-faults on dc buses ED- suction relief RV-2096 isolated by closing CV- isolate flow from AFW E-50B MSSVs throttle Loss of Instrument Air suction and discharge 50B from P-8C 150 30 realigned from 10L and ED-10R. lifting to the equipment 0522B. 0 AFW flow to pump P-8C to E-50B, open. MSSVs then (due to loss of all valves closed to gpm bypass regulator to #3 Reenergized ED-10L drain tank T-80. The E-50A. Still supplying no AFW flow to either operate instrument air isolate suction relief inverter ED-08 supply and ED-10R by tank overfilled causing 165 gpm to E-50B via SG at this time (throttle/close/open) to compressors at 1557) RV-2096 leak closing breaker 72-01 floor drains to backup P-8C and flow control maintain SG pressure (ED-10L and ED-10R on the 590' Auxiliary valve CV-0736A Tave 544F now operable) Bldg (order sent to isolate P-55B)

Generator field Restored power to 1E PCS Tave 529F. PZR PZR level peaks high Preferred ac bus EY-breaker 341 opened bus EA-13 and level 85% 101.5% 10 placed on bypass when ED-11-2 reenergized regulator. EY-10 reenergized associated pressurizer operable heaters Preferred ac bus EY- ADVs CV-0779, CV-30 powered via 0780, CV-0781, and bypass regulator (EY- CV-0782 operable due 30 now operable) to EY-10 restored Left channel safety (HIC-0780A now injection actuated powered), started when EY-30 controlling heat reenergized, resulting removal using ADVs.

in loss of 1E bus EA- MSSVs close 13 Tave 540F Throttled safety injection. Stopped charging pumps P-55A and P-55B. Charging flow 0, letdown flow 0, 5 gpm PCP controlled bleedoff to PSDT.

PZR level 80%

When dc restored, instrument air compressor C-2A tripped due to trip circuit being reenergized Control room manually started instrument air compressors C-2B and C-2C

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 01 - Page 5 of 13 Table A01-1: Event Timeline Chart Sunday 9/25 1720 Sunday 9/25 1746 Sunday 9/25 1818 Sunday 9/25 1852 Sunday 9/25 1909 Sunday 9/25 1911 Sunday 9/25 1923 Sunday 9/25 1933 Sunday 9/25 2100 Entered ONP-4.1, Exited EOP-9 and Reset SIAS Restored P-8B steam Exited ONP-24.1, Loss Exited ONP-24.3, Loss ED-01, main station #3 battery charger ED- P-910 (main Containment Spurious entered GOP-8, Power supply CV-0522B to of Y-10 of Y-30 battery left channel, 17 in service supplying condenser vacuum Isolation, reset CHR Reduction and Plant AUTO (LCO 3.7.5) inoperable per 3.8.4.B ED-01 (battery pump) in-service Shutdown to Mode 2 (no connected battery chargers #2 and #3 or Mode 3 > 525oF(All charger and now in service) 4 preferred ac buses surveillance in service) requirement 3.8.4.1 not met)

1 battery charger ED-15 inoperable per LCO 3.8.4.A.2 Table A01-1: Event Timeline Chart Sunday 9/25 2330 Sunday 9/25 2348 Monday 9/26 0156 Monday 9/26 0311 Monday 9/26 0441 Tuesday 9/27 1733 Test started PZR level <62.8% Restored P-55B Placed #4 battery Main station battery #1 inverter ED-06 instrument air (LCO 3.4.9) charging pump to charger ED-18 in- ED-01 left channel operable, supplying compressor C-2A service (available) service and removed operable preferred ac bus EY-satisfactorily, and then #2 battery charger 10 (LCO 3.8.7) placed in AUTO (C-2B ED-16 from service, still in-service, C-2C in #3 battery charger ED-SLEEP mode) 17 and #4 battery charger ED-18 now in service

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 01 - Page 6 of 13 Event Timeline Narrative I. Initial Conditions (prior to event) 100% reactor power normal single charging and letdown lineup o Charging pump P-55A in service o Letdown orifice stop valve CV-2003 open o Primary coolant pump CBO returning to volume control tank T-54 pressurizer T-72 pressure and level control channel A in service auxiliary feedwater system in normal standby lineup

1 battery charger ED-15 and #2 battery charger ED-16 in service feedwater purity air system cross-tied with and supplying the plant compressed air system II. Electrical Equipment Conditions Concurrent with the Reactor Trip at 1506 dc buses ED-10L and ED-10R de-energized o shunt trip breaker 72-01 opened o #1 battery charger de-energized dc distribution panels ED-11-1 and ED-11-2 de-energized

1 battery charger ED-15 failed, not supplying associated buses ED-10L and ED-10R

1 inverter ED-06 and #3 inverter ED-08 de-energized (ED-06 internal breaker also tripped) preferred ac buses EY-10 and EY-30 de-energized 2400v 1E bus EA-13 de-energized III. Conditions Resulting from Loss of Power to Preferred AC Buses EY-10 and EY-30 Reactor Trip / Turbine Trip: main generator breakers 25F7 and 25H9 did not open due to loss of ED-11-2.

Main Steam Isolation Signal: both main steam isolation valves CV-0501 and CV-0510 closed and both main feedwater regulating valves CV-0701 and CV-0703 closed. CV-0701 closed as result of loss of EY-10 and EY-30; CV-0703 closed due to MSIS.

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 01 - Page 7 of 13 Auxiliary Feedwater Actuation Signal: P-8A did not receive a start signal due to loss of EY-10 and EY-30 and ED-11-1. P-8A was available to be operated from the control room or locally. P-8C started and supplied 165 gpm to each steam generator (E-50A and E-50B). Steam driven AFW pump P-8B started due to loss of panel ED-11-2 and AFW flow control valves CV-0749 (E-50A) and CV-0727 (E-50B) failed full open. P-8B flow indication was not available. Flow distribution was dependent on SG pressures. E-50A is the steam source for P-8B, resulting in initially lower pressure, while E-50B had no steam removal path other than MSSVs.

Safety Injection Actuation Signal: Right channel SIAS only - resulted in de-energizing (load shedding) 2400V 1E bus EA-13, isolating non-critical service water header isolation valve CV-1359 and starting associated equipment including charging pump P-55B.

Containment High Radiation: Right channel CHR only - resulted in containment isolation valves closing, including letdown isolation valve CV-2009 and PCP controlled bleedoff valve C-2099. Left channel containment isolation valves also closed due to the loss of dc to their control circuits.

Containment High Pressure: Logic inputs were not sufficient for system actuation, i.e. no initiation signal was generated, alarm only.

Pressurizer Pressure Control: In service pressurizer pressure controller PIC-0101(channel A) de-energized - resulted in pressurizer spray valves CV-1057 and CV-1059 failing closed, and all available heaters energizing.

Pressurizer Level Control: In service pressurizer level controller LIC-0101(channel A) de-energized -

resulted in letdown orifices closing, charging pump P-55A running at maximum speed (53 gpm) and all pressurizer heaters de-energizing. P-55C did not start due to loss of breaker control power (ED-11-1).

2400V 1E Bus EA-13: de-energized - resulted in unavailability of associated PZR heaters and FWP air compressors. Plant air compressor C-2A automatically started to restore pressure.

Atmospheric Steam Dump Valves: all ASDVs CV-0779, CV-0780, CV-0781 and CV-0782 failed closed (both normal and quick open) due to loss of power to controller HIC-0780A (EY-10).

Generator Output Breakers: breakers 25F7 and 25H9 failed closed and all switchyard breaker indication lost due to loss of ED-11-1. 1A bus EA-21 and 1F bus EA-23 did not transfer to startup power on turbine trip due to loss of ED-11-2. 1A bus EA-21 remained powered from #1-1 station power transformer EX-01 until operators opened the generator breakers using a jumper on relay 487u (Y phase) in control room panel EC-04. 1F bus EA-23 remained powered from #1-3 station power transformer until the generator breakers opened.

IV. Plant / Equipment Conditions and Operator Actions Following Event Initiation Notes:

Due to the high activity level and unavailability of some plant computer data during this event, times recorded in the Operator Log are generally correct, but may not exactly match information from other sources.

Effects of conditions/actions described below are depicted in Appendix 1 - PCS and SG Post-Trip Behavior.

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 01 - Page 8 of 13 1506: Conditions noted in III above.

Main steam safety valves (MSSVs) on both steam generator headers opened and operated (throttled/closed/opened) to maintain SG pressures and lower PCS temperature and pressure. (MSSVs opened due to ASDVs failing closed and MSIVs closing on MSIS.)

Operators entered EOP-1.0 Standard Post-Trip Actions.

1515: Due to there being no steaming path available, PCS temperature rose to 544°F resulting in MSSVs opening further and PCS temperature, pressure and level lowering. PCS temperature continued lowering primarily due to relatively cold (87°F) AFW being supplied to the steam generators (690 gpm total).

AFW pump P-8B flow control valves CV-0727 and CV-0749 failed full open. The flow delivered to each SG was dependent on piping losses and SG pressure differences. SG pressures were initially both ~930 psig. However, E-50As pressure lowered more than E-50Bs (possibly due to E-50A supplying P-8B steam and varying MSSV characteristics), resulting in significantly more cool AFW flow to E-50A, which further lowered its pressure. By 1530 total AFW flows (P-8B +P-8C) to the SGs were 502 gpm to E-50A and 195 gpm to E-50B. This flow imbalance contributed to over-filling E-50A.

1517: Power Control verified main generator breakers 25F7 and 25H9 were closed (failed to open on turbine trip). Operators installed a jumper on relay 487u (Y phase) in control room panel EC-04 to open the breakers per EOP-1.0. Opening the generator breakers de-energized 4160v 1A bus EA-21, stopping primary coolant pumps P-50A and P-50C. PCPs P-50B and P-50D remained in service, maintaining forced circulation with one operating pump in each PCS/SG loop.

1527: Operators entered EOP-9.0 Functional Recovery Procedure due to less than 3 preferred AC buses being available. (Pressurizer level 62%)

1531: Operator observed high SG E-50A water level (90%) and an NPO was directed to isolate steam to P-8B per EOP Supplement 19 Alternate Auxiliary Feedwater Methods, i.e. manually closing steam supply valve CV-0522B. Both SG levels had been observed approximately equal (35% - 40%) during EOP-1.0 verbal verifications (1515). Operators entered ONP-2.3 Loss of DC Power.

1537: Operators first addressed safety function MVAE-DC-1 due to it being jeopardized (acceptance criteria not being met). Per MVAE-DC-1 operators entered ONP 24.1 Loss of Preferred AC Bus Y-10 and ONP-24.3 Loss of Preferred AC Bus Y-30 to recover the buses.

Operator observed high PCS pressure (2200 psia) due to loss of power to pressurizer pressure controller channel A which failed spray valves CV-1057 and CV-1059 closed. Operator placed pressurizer pressure control channel B in service, lowered pressure in manual mode and then placed the controller in auto mode. PZR spray valves then remained available for pressure control.

Operator also noted loss of power to pressurizer level controller channel A and placed channel B and pressurizer heater select channel B in service. This resulted in letdown orifice stop valves CV-2003, CV-2004 and CV-2005 opening and charging pump P-55A speed lowering from 53 gpm to 33 gpm, and restored bus 1D pressurizer heater availability. Opening the letdown orifice valves resulted in letdown relief valve RV-2006 opening, due to CV-2009 having closed on CHR. RV-2006 directed letdown flow (108 gpm, 560 gal total) to quench tank T-73 in containment, and resulted in relief valve 2006 discharge high temperature annunciator EK-0702 alarming. (Pressurizer level 71%)

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 01 - Page 9 of 13 1542: Operator closed letdown orifice stop valves CV-2003, CV-2004 and CV-2005 to isolate letdown flow per ARP-4 Annunciator Response Procedure Primary System Volume Level Pressure Scheme EK-07 (C-12).

At this time charging flow was 73 gpm with 0 letdown and 5 gpm PCP bleedoff flow, resulting in 68 gpm PCS net inventory addition. When the density change from charging temperature to PCS temperature is considered this gives a 90 gpm effective charging rate or 1.36%/minute pressurizer level rise rate (90 gpm / 66.16 g/% = 1.36%/m). (Pressurizer volume gal / % indicated level = 66.16 g/% per surveillance procedure DWO-1 Operators Daily/Weekly Items Modes 1, 2, 3, and 4 Rev 80.)

1544: Operator closed CV-0737A, isolating P-8C AFW flow to steam generator E-50A. P-8C flow to E-50B continued at 165 gpm, and P-8B flow continued at 380 gpm to E-50A and 0 gpm to E-50B.

1549: Operators restored power to 2400v 1E bus EA-13 per SOP-30 Station Power and reenergized associated pressurizer heaters.

1555: Operator logged pressurizer level high (>62.8%) (actual level 78%). Due to PCS temperature continuing to lower, the observed level rate of rise was less than would be observed if temperature was stable. Changing PCS temperature one degree has the effect of changing PCS water volume 74.43 gallons (per DWO-1). (Note: Per PZR pressure/level recorder LPIR-0101B, pressurizer level exceeded 62.8% at 1528.)

1557: Operator aligned preferred ac bus EY-30 to be supplied from instrument ac bus EY-01 via the bypass regulator. Energizing EY-30 resulted in Left channel safety injection actuation which de-energized (load shed) 2400V 1E bus EA-13 and started associated equipment. P-55C did not start due to panel ED-11-1 being de-energized.

Operators verified SI throttling criteria met and stopped both operating charging pumps P-55A and P-55B to stop PCS inventory addition. Charging and letdown flows = 0, 5 gpm PCP bleedoff to primary system drain tank T-74 continues. (Pressurizer level 80%)

Electricians reported buses ED-10L and ED-10R fault free. Operator closed shunt trip breaker 72-01 reenergizing Left channel dc buses ED-10L, ED-10R, ED-11-1, ED-11-2 from battery ED-01. Generator field breaker 341 automatically opened when ED-11-2 was reenergized. Instrument air compressor C-2A tripped due to its trip circuit being reenergized when dc power was restored. Operator manually started compressors C-2B and C-2C. The brief loss of air compressor had no noticeable effect.

1602: NPO reported charging pump P-55B suction relief valve RV-2096 lifting and not reseating, equipment drain tank T-80 full and floor drains backing up on the auxiliary building 590 elevation. Control room directed closing pump suction and discharge valves to isolate P-55B and its suction relief. Water discharged from the relief was from concentrated boric acid tanks T-53A and T-53B.

Operators restored power to 1E bus EA-13 and reenergized associated pressurizer heaters.

1603: Auxiliary operator reported steam supply valve to P-8B turbine CV-0522B manually closed per EOP Supplement 19. AFW flow to and steam flow from E-50A = 0. AFW flow to E-50B continued at 165 gpm and steam flow from E-50B was controlled by associated MSSVs. PCS heat removal rate was reduced and PCS temperature stopped lowering and started rising. The PCS heatup rate was 1°F/m, resulting in PZR level rising 1.125%/m. (Tave 529°F, PZR level 85%)

1609: Operator closed CV-0736A, isolating AFW flow to E-50B, slightly raising the PCS heatup rate.

There was no AFW to either SG at this time and steam was only being removed from E-50B via MSSVs throttling.

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 01 - Page 10 of 13 1615: MSSVs on both steam generator headers opened due to PCS temperature rising to 544°F. PZR level peaked at 101.5% and then lowered as PCS temperature lowered. (Note: There was no PCS inventory addition since 1557. The PZR level rise was entirely due to PCS heatup from 529°F to 544°F.)

After opening, the MSSVs remained partially open, effectively controlling PCS Tave 540°F until the ASDVs were placed in service.

1621: Operators logged entering ONP-7.1 Loss of Instrument Air due to compressor C-2A tripping at 1557 as previously noted.

1630: Charging pump P-55B suction and discharge valves reported closed, isolating suction relief valve leakage.

1639: Operator restored 150 gpm AFW flow to E-50B using P-8C.

1646: After confirming no faults on preferred ac bus EY-10, #3 inverter ED-08 was aligned to supply EY-30 and EY-10 was powered from instrument ac bus EY-01 via the bypass regulator. All preferred ac buses were now available.

All 4 ADVs were available when EY-10 was restored, and operators began using them for PCS temperature control. MSSVs fully closed. (Tave 539°F) 1720: Operators entered ONP-4.1 Containment Spurious Isolation and operator reset CHR.

1746: Operators exited EOP-9.0 and entered GOP-8 Power Reduction and Plant Shutdown to Mode 2 or Mode 3 > 525°F.

1818: Operators reset SIAS and restored non-critical service water per SOP-15 Service Water System.

1852: Operators restored AFW pump P-8B steam supply CV-0522B to AUTO per EOP Supplement 19.

1933: Placed #3 battery charger ED-17 in service supplying station battery ED-01. #2 and #3 battery chargers ED-16 and ED-17 in service.

2348: Pressurizer level lowered to 62% and continued lowering due to PCP bleedoff.

09/26/11, 0311: Placed #4 battery charger ED-18 in service supplying station battery ED-02. Battery chargers #3 ED-17 and #4 ED-18 in service.

09/27/11, 1733: Placed #1 inverter ED-06 in service supplying #1 preferred ac bus EY-10.

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 01 - Page 11 of 13 Acronyms AFAS Auxiliary Feedwater Actuation Signal AFW Auxiliary Feedwater ASDV Atmospheric Steam Dump Valve CAS Compressed Air System CBO Controlled Bleedoff CHP Containment High Pressure CHR Containment High Radiation CIS Containment Isolation Signal CVCS Chemical and Volume Control System FWP Feedwater Purity MFRV Main Feedwater Regulating Valve MSIS Main Steam Isolation Signal MSIV Main Steam Isolation Valve MSSV Main Steam Safety Valve NCO Nuclear Control Operator NPO Nuclear Plant Operator PCP Primary Coolant Pump PCS Primary Coolant System PSDT Primary System Drain Tank PZR Pressurizer RPS Reactor Protective System SG Steam Generator SI Safety Injection SIS Safety Injection Actuation Signal VCT Volume Control Tank

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 01 - Page 12 of 13 Appendix I - PCS and SG Post-Trip Behavior PCS Post Trip Plot SG Post Trip Plot Figure A01-1: PCS Post-Trip Plot Figure A01-2: SG Post-Trip Plot Table A01-2: PCS Post-Trip Plot Key Elap. T (ave) PZR PZR PT Time Level Press.

Time ID NOTES (min) (°F) (%) (psia) 1 1506 0 559.5 57 2069 Reactor trip, MSSVs open and then throttle/close 2 1515 11 544 52 2033 MSSVs open and then throttle/close 3 1536 31 536 71 2184 E-50B MSSVs open and throttle maintaining SG pressure Operator places PZR pressure and level channel B controls in 4 1537 32 536 71 2206 service 5 1542 36 530 66 1980 Operator closes letdown orifice valves to isolate letdown 6 1544 38 530 68 2016 Operator closes CV-0737A to isolate P-8C flow to E-50A 7 1557 51 528 80 2068 Operator throttles SI by stopping P-55A and P-55B Steam supply CV-0522B closed to isolate P-8B flow to SGs, also 8 *1600 54 527 80 2050 isolates steam flow from E-50A 9 1615 69 544 101.5 2069 MSSVs open and then throttle maintaining PCS temp ~540 °F Operator restores 150 gpm AFW to E-50B and throttles to 10 1639 90 540 97 1865 maintain level Power restored to ADV controls, Operator begins using ADVs for 11 1646 100 541 97 1867 PCS heat removal, MSSVs close Tave stable, PZR level slowly lowering due to PCP bleedoff, PZR 12 1730 144 539 90 2087 pressure is controlled

Time does not match time recorded in Operator Log (1603).

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 01 - Page 13 of 13 Table A01-3: PCS Post-Trip Plot Regions REGION NOTES ID PZR pressure rising in this region is due mainly to PZR level rising and spray valves failing closed due to loss of power to the A

Channel A pressure controller.

With exception of the 2 step changes in this region, PCS temperature lowering is mainly due to AFW addition to the SGs.

B Temperature lowering in this area is masking inventory addition to the PCS, i.e. the PCS inventory rate of rise is > than indicated.

Temperature rising in this region is mainly due to having isolated all AFW flow to E-50A without establishing another heat C removal path. E-50A MSSVs are closed PZR level rising in this region is due solely to PCS heatup. Charging flow = 0 gpm.

D PCS temperature is being maintained in this region by the MSSVs.

E PZR level lowering in this region is due mainly to PCP controlled bleedoff.

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 02 - Page 1 of 2 2: Shunt Trip Breaker Coordination Issue Shunt trip breakers 72-01 and 72-02 are designed to operate by remote signal only, and not to operate/isolate on experiencing fault current.

Breakers 72-01 and 72-02 contain both thermal and instantaneous protective elements. Therefore, the shunt trip breakers may actuate on a fault current before downstream protective devices actuate, resulting in isolation of station batteries from dc loads.

Conclusions No identified mechanism would cause a fault in one dc division to propagate to the other division.

Initial investigation suggests proper coordination of breakers 72-01 and 72-02 with associated downstream devices exist for fault currents up to 3,000 amps.

The condition will be addressed in a separate analysis, as needed.

Evaluation Shunt trip breaker 72-01 isolates #1 battery ED-01 from the balance of the left channel dc circuit, leaving only dc panel ED-11A connected to ED-01. Shunt trip breaker 72-02 isolates #2 battery ED-02 from the balance of the right channel dc circuit, leaving only dc panel ED-21A connected to ED-02. The shunt trip breakers are used for a fire in the cable spreading room.

Circuit breakers 72-01 and 72-02 contain both thermal and instantaneous protective elements. This does not comply with statements in the FSAR and from a design basis perspective constitutes a non-conforming condition per EN-OP-104, Revision 5, Attachment 9.1, Table 1.

The shunt breakers may actuate on a fault current before downstream protective devices actuate, resulting in isolation of station batteries from dc loads.

See Figure A02-1 for fault currents expected to result in shut trip breaker 72-01 actuation.

72-01, 72-18 &

D11-2 Fuse Coordinat Figure A02-1: 72-01, 72-18, FUZ/D11-2 Coordination Curve There is currently no identified mechanism that would cause a fault in one dc division to propagate to the other division. The coordination of breakers 72-01 and 72-02 with other breakers in the dc system has not been evaluated for this analysis.

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 02 - Page 2 of 2 References

[1] Operability Evaluation attached to CR-PLP-2011-4835.

[2] J:\Engineering\ACTION PLANS\9-23-11 DC 11-2 Problem\operability evaluation - coordination

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 03 - Page 1 of 2 3: Pressurizer Level and Challenge to Pressurizer Safety Relief Valves Issue The 09/25/2011 dc panel ED-11-2 fault isolated letdown flow and increased charging flow. This resulted in rising pressurizer level and represented a potential challenge to pressurizer safety relief valves. Steam and/or water release from pressurizer safety relief valves could result in a stuck open relief valve and pressurizer vapor space loss of coolant accident.

This evaluation summarizes post trip inventory behavior and estimates the additional time to pressurizer safety relief operation had no mitigating actions been taken.

Conclusions With letdown isolated, the pressurizer would have gone solid had charging not been secured within ~11 minutes of the actual time of 15:57 (i.e., by ~16:08).

Pressurizer safety relief valves expected to lift prior to 16:15 had charging not been tripped by 16:08.

Evaluation See event timeline and narrative discussion [1].

With respect to pressurizer level, key aspects of the event are:

Loss of ADVs and start of P-8B with loss of flow control valves (full open) results in overcooling PCS due to excessive AFW addition.

SIS starts additional charging pump and loss of level control results in letdown isolation and maximum charging.

Cooldown partially masks inventory addition. Subsequent heatup results in PCS inventory expansion and potential challenge to PZR safety relief valves.

Hemispherical space exists above the upper level tap, such that volume in excess of 100% is needed to completely fill the pressurizer (see SOP-1B Attachment 8 [2]).

As documented in the event timeline, indicated pressurizer level peaks at 101.5% at 16:15. Note:

Data from LPIR-0101B (available hot calibrated pressurizer level indicator) indicates pressurizer level peaked at 101.5% at ~16:15.

This value implies pressurize level is at or near (but not above) 100% level, i.e., at or near the upper level tap.

If actual pressurizer level exceeded elevation of upper level tap, the trendline for both hot and cold calibrated levels would flatline at the point of tap submergence. Level trendlines from the event do not appear to flatline.

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 03 - Page 2 of 2

Indicated level greater than 100% is due to pressurizer pressure and/or temperature deviations from nominal, reference wet leg temperature deviation from nominal, and/or instrument loop inaccuracies.

Based on 1,000 gallons of additional volume between 100% pressurizer level and the solid condition [2], it is estimated an additional 11 minutes of charging flow @ 73 gpm would have resulted in a solid PCS condition upon heatup to 544°F:

1,000 gallons / 1.3 density correction from 82°F to 544°F / (73 gpm charging - 5 gpm PCP bleedoff) =

~11 minutes With respect to the timeline, charging pumps were secured at 15:57. Therefore, charging needed to be secured prior to 16:08 to avoid a PCS solid condition. The solid condition would have occurred just before MSSV lift at 16:15 if charging was secured at 16:08.

References

[1] EA-PSA-SDP-D11-2-11-07, Revision 0, Attachment 1.

[2] SOP-1B, Revision 11, Primary Coolant System - Cooldown.

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 04 - Page 1 of 7 4: Steam Generator Level and Challenge to Steam Generator Overfill/Loss of Turbine Driven Auxiliary Feedwater Pump Issue Various data sources [1],[2] indicate post-trip steam generator inventory asymmetry following the 09/25/2011 plant trip. The significance is three-fold: (1) E-50A high level resulted in manual isolation of steam to AFW pump P-8B requiring manual recovery if the remaining AFW supply failed, (2) failure to isolate P-8B in time to prevent steam generator overfill may have damaged P-8B, and (3) additional post-trip SG inventory extends time available to restore AFW or initiate once-through-cooling if required.

This evaluation summarizes expected post trip inventory behavior, estimates the additional time to E-50A overfill had no mitigating actions been taken and provides a reasonableness check on actual post-trip inventory.

Conclusions Asymmetry in post-trip SG level is expected based on plant design given loss of left channel dc.

Steam generator E-50A overfill (full to top of steam dome) may have occurred within 33 minutes from the time all E-50A level indication was restored 15:57, i.e., at 16:30.

Evaluation Without operation of turbine driven auxiliary feedwater pump P-8B, post-trip steam generator water levels on both steam generators are expected to behave similarly: shrink to approximately 23% while increasing due to inventory addition by motor-driven auxiliary feedwater pump(s) and potential main feedwater pump coastdown. Operation of P-8B with flow control valves full open and not controlled, with atmospheric steam dump valves inoperable and closed, results in a steam generator pressure asymmetry. Since steam generator E-50A supplies the P-8B turbine, pressures tend to be lower in E-50A, resulting in increased flow to and higher levels in E-50A. However, variations in MSSV lift setpoints and operating characteristics can result in variations in steam generator pressure that can also impact flows.

Following an uncomplicated plant trip, the main feedwater pumps normally ramp down to minimum speed and the main feedwater regulating valves are closed over a period of 3-4 minutes. Feed reg valves lock in position at the time of the trip and are closed by operator manual action per EOP-1.0.

A coastdown flow rate function was developed based on data collected from the PI data archive for three Palisades plant trips and is credited in the MAAP analysis [3] for events that dont result in containment high pressure or MSIV closure (these events result in automatic fast closure of the feed reg valves). The additional coastdown flow provides significant inventory in short period of time, resulting in higher steam generator levels shortly after trip than would otherwise occur for feed reg valve fast closure events.

For the plant trip on 09/25/2011, PI data indicates that feedwater control valve CV-0703 to steam generator E-50B closed very quickly in 1-2 seconds and the steam generator level trend reflects this fact.

This is expected based on a loss of EY-10 and EY-30, which generates a 2/4 low steam generator pressure and a close signal to CV-0703.

PI data for CV-0701 valve position indication was lost on loss of EY-10. CV-0701 is also expected to close very quickly based on a loss of EY-10 and EY-30, which results in a loss of current to E/P-0701 and

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 04 - Page 2 of 7 the equivalent of a close signal to CV-0701. Observed levels during EOP-1.0 (~1515) were 40% and 35%

for E-50A and E-50B respectively, indicating they started out about the same and the E-50A high level was not due to MFW pump coastdown addition.

When power was restored to the E-50A level indication at 15:57 (PI time), the water level had increased to 94.5%. E-50B level indication was not lost, and the PI archive data shows its level initially lowered to 23% and was gradually restored to 60.8% via the auxiliary feedwater system.

Given uncertainty in P-8B steam supply isolation timing, AFW flow split to E-50A/B [6] and integrated steam releases, an exact accounting of steam generator inventory is not possible. However, arbitrarily assuming about 1/2 of the nominal decay and pump heat over the time period was removed by steaming (note P-8B steam load is neglected), with an arbitrary split between E-50A and E-50B, suggest steam generator levels can be explained.

See Appendices 1-3 for additional details.

Given: 7,812 ft3 total steam volume [5]

5,845 ft3 of water at 100% level (0% power) [5]

4,861 ft3 of water at 77.3% level (0% power) [5]

16,487 gallons of inventory above 94.5% (see Appendix 3).

Given 380 gpm auxiliary feedwater addition [6] and neglecting inventory lost due to decay heat removal, steam generator overfill could have occurred within 33 minutes of the time SG level indication was restored at 15:57 (16,487 gallons / 1.325 density ratio 87°F to 535°F / 380 gpm = 33 minutes).

Given 380 gpm auxiliary feedwater addition [6] and assuming 1/2 of decay heat is removed via E-50A, steam generator overfill could have occurred within 47 minutes of the time SG level indication was restored at 15:57.

References

[1] PI data, file 09252011 Loss of DC Event - Post Trip SG Inventory.xls

[2] Plant Personnel Statements per ADMIN 4.08, Attachment 2 (pdf), page 13 of 18 At 1602, reported that B CCP suction relief valve lifting. Isolated. racked out breaker. S/G levels still (A @ 90%) so manually isolated CV-0522B.; page 15 of 18 S/G levels were high due to P-8B feeding both S/G and TBV/ADV closed..

[3] PLP0247-07-0004.01 Rev. 2, Palisades Nuclear Plant Thermal Hydraulic MAAP Calculations

[4] EOP-1, Standard Post-Trip Actions, pdf of procedure used during 09/25/2011 trip.

[5] 82688-ST-602 Rev. 1, Steam Generator Secondary Inventory

[6] EA-PSA-SDP-D11-2-11-07, Revision 0, Attachment 10.

Appendices Appendix 1: Design Summary Appendix 2: Steam Generator Water Volumes Appendix 3: Potential Steam Generator Inventory Accounting

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 04 - Page 3 of 7 Appendix 1: Design Summary MSIV CV-0510 (E-50A)

CV-0501 (E-50B)

Isolate on CHP, MSIS (2/4 low SG pressure), loss of dc power (each SG has one de-energize to open (vent) solenoid isolation valve off each dc train)

Expected event response: Both MSIVs close on loss of ED-10L & ED-10R MSIV bypass MO-0510 (E-50A)

MO-0501 (E-50A)

No automatic actuation Expected event response: both MSIV bypass valves remain closed SG blowdowns CV-0767, CV-0771 (E-50A)

CV-0768, CV-0770 (E-50B)

Isolate on CHP or CHR Isolate on loss of dc power to associated energize to open solenoid valve Each SG has one isolation valve off each dc train Expected event response: both SG blowdowns isolate ADVs CV-0781, CV-0782 (E-50A)

CV-0779, CV-0780 (E-50B)

Quick open function (Tave and TT inputs) to prevent MSSV relief Expected event response: quick open not functional, manual remote control not available, ADVs remain closed on loss of ED-10L & ED-10R, remain unavailable until EY-10 restored MSSV RV-0703 thru RV-0706, RV-0713 thru RV-0718, RV-0723, RV-0724 (E-50A)

RV-0701, RV-0702, RV-0707 thru RV-0712, RV-0719 thru RV-0722 (E-50B) st nd rd 1 set pressure 985 psig; 2 set pressure 1005 psig; 3 set pressure 1025 psig 3% blowdown Expected event response: given ADV quick open not available, 1st set of MSSVs expected to lift on both SGs MFRV CV-0701 (E-50A)

CV-0703 (E-50B)

Close on CHP, MSIS (2/4 low SG pressure), loss of dc power (loss of signal to E/P)

Expected event response: Both MFRV close on loss of ED-10L & ED-10R: CV-0701 closes on loss of signal to E/P-0701, CV-0703 closes on 2/4 low SG pressure signal to E/P-0703

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 04 - Page 4 of 7 MFRV bypass CV-0735 (E-50A)

CV-0734 (E-50B)

Close on CHP, MSIS (2/4 low SG pressure), open on loss of dc if in auto Expected event response: Both values are in manual during normal operation and should remain closed AFW P-8A starts on left channel AFAS and DBA P-8B starts on loss of left channel dc power and AFAS CV-0749 (E-50A) fails open on loss of EY-10 and EY-30 or air CV-0727 (E-50B) fails open on loss of EY-10 and EY-30 or air P-8C starts on right channel AFAS and DBA (if insufficient flow)

CV-0737A (E-50A) fails open on loss of EY-20 and EY-40 or air CV-0736A (E-50B) fails open on loss of EY-20 and EY-40 or air Expected event response:

P-8A does not start due to loss of EY-10, EY-30 and ED-11-1 P-8B starts on loss of dc bus ED-10L/ED-10R P-8C starts on low flow from P-8A Flow control valves on P-8A/B go full open on loss of EY-10 and EY-30 Flow control valves on P-8C throttle to provide ~ 165 gpm to each SG

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 04 - Page 5 of 7 Appendix 2: Steam Generator Water Volumes Table A4-1: Water Volume vs. Level at 0% Power [5]

Water Level State Volume

(%)

(gallons)

SG water volume at 100% 43723 100.0 SG water volume at 77.3% 36359 77.3 SG water volume at nominal (assume 65%) 32365 63.9 SG water volume at 23.7% (nominal post-trip) 19607 23.7 Water Volume (gallons) vs. Level (%)

50,000 45,000 40,000 35,000 30,000 25,000 20,000 15,000 10,000 5,000 0

20 40 60 80 100 Figure A4-1: Water Volume vs. Level at 0% Power

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 04 - Page 6 of 7 Appendix 3: Potential Steam Generator Inventory Accounting Table A03-1: Potential Post-Trip Steam Generator Accounting PPC trip time 15:03 (based on invalid data entries indicating loss of Y10/Y30)

PPC EY-10/EY-30 restoration time (based on data indicated return of A SG level indication) 15:57 Initial E-50A Level 64.7 %

Initial E-50B Level 62.3 %

~10 min post trip E-50A Level (from EOP-1 in-use 40 %

procedure)

~10 min post trip E-50B Level (from EOP-1 in-use PI data indicates 35% level in E-50B at 35 %

procedure) 15:14 E-50A Level at 15:57 94.5 %

E-50B Level at 15:57 60.8 %

P-8C flow to E-50A 5847 gallons P-8C flow to E-50B 8750 gallons P-8B max flow rate 372 gpm P-8B operation to 15:57 57 min after 1531 and on or before 1603 Total P-8B flow 21204 gallons P-8B flow split -fraction to E-50A 0.81 P-8B flow to E-50A 17175 gallons P-8B flow to E-50B 4029 gallons Density correction from 87F to 535F 1.325 Volume of E-50A at 94.5% at 15:57 41939 gallons Volume of E-50B at 60.8% at 15:57 31068 gallons At 0% power:

SG water volume - total 58438 gallons SG water volume at 100% 43723 gallons 100.0 %

SG water volume at 77.3% 36359 gallons 77.3 %

SG water volume at normal level (63.9%) 32365 gallons 63.9 %

SG water volume (E-50A post-trip)? 21194 gallons 28.7 %

SG water volume at 23.7% (nominal post-trip) 19607 gallons 23.7 %

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 04 - Page 7 of 7 Table A03-1: Potential Post-Trip Steam Generator Accounting Nominal water volume "lost" at trip 12758 gallons Decay, Pump and Sensible Heat Steaming from E-50A 9770 gallons Decay, Pump and Sensible Heat Steaming from E-50B 5167 gallons Net post-trip volume added to E-50A 20729 gallons Net post-trip volume added to E-50B 11762 gallons Post-trip 15:57 volume of E-50A 41923 gallons 94.5 %

Post-trip 15:57 volume of E-50B 31369 gallons 60.8 %

Unaccounted for volume to E-50A 16 gallons

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 05 - Page 1 of 20 5: Thermal-Hydraulic Analyses 1.0 PURPOSE .......................................................................................................................................... 2

2.0 CONCLUSION

................................................................................................................................... 2 3.0 INPUT ................................................................................................................................................. 2 3.1 MAAP 4.0.6 Model .......................................................................................................................... 2 3.2 Event-Specific Plant Data ............................................................................................................... 2 3.3 Condensate Storage Tank.............................................................................................................. 4 3.4 Atmospheric Dump Valves (ADVs)................................................................................................. 4 3.5 Auxiliary Feedwater ........................................................................................................................ 4 3.6 Charging ......................................................................................................................................... 5 4.0 ASSUMPTIONS ................................................................................................................................. 6 4.1 Major Assumptions ......................................................................................................................... 6 4.2 Minor Assumptions ......................................................................................................................... 7 5.0 ANALYSIS ......................................................................................................................................... 7 5.1 D11-2 SDP Case7 .......................................................................................................................... 7 5.2 D11-2 SDP Case11 ...................................................................................................................... 10 5.3 D11-2 SDP Case17 ...................................................................................................................... 16 6.0 WATER

SUMMARY

......................................................................................................................... 19

7.0 REFERENCES

................................................................................................................................. 20 8.0 APPENDICES .................................................................................................................................. 20

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 05 - Page 2 of 20 1.0 PURPOSE The 09/25/2011 dc panel ED-11-2 fault isolated letdown flow and increased charging flow. This resulted in rising pressurizer level and represented a potential challenge to pressurizer safety relief valves. Steam and/or water release from pressurizer safety relief valves could result in a stuck open relief valve and subsequent above-core, vapor-space loss of coolant accident.

This evaluation investigates the integrated plant response to a stuck open safety relief valve within the context of the loss of dc event. Theis attachment evaluation is a margin evaluation of employing the charging pumps as a makeup source. The results are provided as information, only.

The current event tree success criteria require HPSI as the makeup source. No changes to this criterion have been made.provides a basis for the event tree structure and success criteria used in the logic model.

This evaluation uses the Modular Accident Analysis Program (MAAP) model for Palisades.

2.0 CONCLUSION

Thermal-hydraulic analysis in this evaluation demonstrates the success criteria for above-core, vapor-space LOCAs can be satisfied with two charging pumps providing makeup..

As long as secondary side cooling is available for decay heat removal, the transient does not require high pressure safety injection to preclude core damage, apart from additional failures that once-through-cooling would be required to mitigate the event.

Long term heat removal via the steam generators or transition to shutdown cooling could then become a success path, even when a SRV sticks open - provided inventory makeup is available. For example, charging with safety injection refueling water tank (SIRWT) inventory, conserved by terminating sprays, or via HPSI in recirculation mode would maintain adequate core cooling.

3.0 INPUT 3.1 MAAP 4.0.6 Model The baseline model is developed and documented in the MAAP 4.0.6 model parameter file [1] and thermal hydraulic analyses [2]. The baseline model is used as the starting point for this evaluation.

MAAP is a computer code that simulates the response of light water reactor power plants during severe accidents. Given a set of initiating events and operator actions, MAAP predicts plant response as a function of time. Plant response under severe accident scenarios is complex and is best evaluated in an integrated manner. The primary system and containment responses are sensitive to the calculated pressures, temperatures, flows, and event timings. These parameters also affect operator action timings, the radionuclide release timings, and the mitigating system performance assessments. Proper plant-specific characterization of the severe accident progression is important to the realistic representation of the plant and highly desirable for a PRA assessment.

3.2 Event-Specific Plant Data The timeline in Attachment 01 considered the best available information, including PI data, PPC data, control room recorder data, operator logs, procedures filled-out during the event, and interviews and discussions with operations.

Inputs to this evaluation are based on and consistent with the results of the timeline construction, to the greatest extent possible. Specific data sources are given below.

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 05 - Page 3 of 20 3.2.1 Process Information (PI) Data Event-specific plant data for various plant parameters are obtained from the PI data archive. PI is software quality assurance (SQA) category C (important to business) per Entergy SQA procedure EN-IT-104. The plant process computer (PPC) provides data to the PI system. PPC is SQA category B (regulatory commitments). Most PPC points are calibrated via technical specification surveillance procedure or by preventive maintenance and controlled calibration sheets.

Part of the PI server system runs on the PPC. This portion monitors selected points every second to test against the exception threshold change value. If the change value is exceeded, the data is passed to the PI server and recorded. The PI server also compares the new value against previous values to see if it still fits on a line within the compression limit. If yes, the data is discarded, otherwise it is added to the archive. For pump starts, the compression limit is simply a change in state (on-off or start-stopped), if 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months have passed without an archive update, one is made regardless. PI provides generally accurate long term values and greater amounts of data when events are changing rapidly.

Since the event resulted in the loss of two preferred ac buses, various PPC/PI data points were unavailable and not recorded in the PPC/PI systems.

This evaluation uses PI data both directly and in support of other data sources for:

steam generator level steam generator pressure auxiliary feedwater flow pressurizer level pressurizer pressure charging flow primary coolant system average temperature 3.2.2 Control Room Recorder Data Event-specific plant data for various plant parameters are obtained from control room recorder data.

Certain Yokagawa-type control room indicators have the ability to record and store data. Plant instrumentation and control engineers collected post-event data from these recorders and provided both display screen shots and data to the PRA group.

This evaluation uses Yokagawa recorder data both directly and in support of other data sources for:

pressurizer level pressurizer pressure charging flow primary coolant system average and loop temperatures main feewater turbine steam flow main feedwater turbine steam pressure

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 05 - Page 4 of 20 3.2.3 Operator Logs Event-specific plant data for various parameters and events are obtained from electronic operator round (eSOMS) logs.

This evaluation uses eSOMS logs mainly in support of other data sources.

3.3 Condensate Storage Tank The condensate storage tank (T-2) was 87F as recorded in the electronic operator rounds (eSOMS) at 0752 on 9-25-2011.

3.4 Atmospheric Dump Valves (ADVs)

Operation of the atmospheric dump valves (CV-0779, CV-0780, CV-0781, and CV-0782) via quick open and manual control is unavailable until power is restored to preferred ac bus EY-10.

The loss of dc event resulted in loss of power to the inverter that supplies preferred ac bus EY-10. Power can be restored by restoring power to the dc bus and re-energizing the inverter or aligning the bypass regulator to re-energize the preferred ac bus. EY-10 was placed on bypass regulator at 16:46, one hour forty minutes into the event.

For cases where ADVs are restored, valve operation to achieve decay heat removal and plant cooldown in accordance with technical specification limits on cooldown rate is used.

In nearly all the MAAP cases reported herein, the ADVs are modeled as failed closed.

3.5 Auxiliary Feedwater Auxiliary feedwater pump P-8A does not start on auxiliary feedwater actuation signal due to loss of preferred ac buses EY-10 and EY-30. However, P-8A remains available to be started from the control room or locally. After restoration of power to ED-11-1 and EY-10 or EY-30, P-8A is capable of automatic start should steam generator levels fall to the auxiliary feedwater actuation signal setpoint.

The loss of dc event de-energized left channel dc power. This results in automatic start of P-8B (mechanical governor maintains normal turbine/pump speed) with flow control valves wide open. Steam supply to P-8B was manually isolated at 16:03. P-8B flows to each steam generator are given in 0. Attachment 04 provides an accounting of AFW delivered to the steam generators during the event.

Right channel dc power remained available. Auxiliary feedwater pump P-8C starts on auxiliary feedwater actuation signal given P-8A failure to deliver required flow (due to loss of EY-10, EY-30 and loss of left channel dc). Flow control valves set to 165 gpm to each steam generator. P-8C flow to E-50A was isolated due to overfill concerns at 15:44. P-8C flow to E-50B was isolated at 16:09 due to adequate E-50B level.

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 05 - Page 5 of 20 For cases demonstrating event thermal-hydraulics, the following AFW data is used:

Table 3.5-1: Total AFW Flow Time Time Time Flow to E-50A Flow to E-50B Flow to E-50A Flow to E-50B (event time) (hours) (minutes) (gpm) (gpm) (lbm/hr) (lbm/hr) time 0 (1506) 0 0 342 350 1.697E+05 1.737E+05 1520.0 0.2333 14.0 342 350 1.697E+05 1.737E+05 1520.1 0.2350 14.1 419 273 2.080E+05 1.355E+05 1530.0 0.4000 24.0 419 273 2.080E+05 1.355E+05 1530.1 0.4017 24.1 495 185 2.457E+05 9.182E+04 1540.0 0.5667 34.0 495 185 2.457E+05 9.182E+04 1540.1 0.5683 34.1 379 163 1.881E+05 8.090E+04 1603.0 1.6167 97.0 379 163 1.881E+05 8.090E+04 1603.1 1.6183 97.1 0 156 0 7.743E+04 1609.0 1.7167 103.0 0 0 0 0 1636.0 2.1667 130.0 0 0 0 0 1636.1 2.1683 130.1 0 129 0 6.403E+04 1730.0 3.7333 224.0 0 129 0 6.403E+04 1730.1 3.7350 224.1 56 96 2.779E+04 4.765E+04 end of 24.0000 1440.0 56 96 2.779E+04 4.765E+04 problem 3.6 Charging Initial charging flow was 93 gpm. At approximately 36 minutes into the event, charging flow was reduced to 73 gpm.

The loss of dc event resulted in failure of the in-service channel A pressurizer level and heater control circuit. With no power to channel A the control program defaulted to maximum flow from the operating pumps (93 gpm: P-55A - 53 gpm; P-55B - 40 gpm).

At approximately 31 minutes into the event operators switched pressurizer level control to channel B to enable pressurizer spray. With channel B in service charging flow reduced to the minimum flow from operating pumps (73 gpm: P-55A - 33 gpm; P-55B - 40 gpm).

Had channel B been in service at the time of the event, charging flow rate would have been at minimum flow from the operating pumps from time zero.

For cases demonstrating event thermal-hydraulics, the following charging data is used:

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 05 - Page 6 of 20 Table 3.6-1: Total Charging Flow Time Time Time Flow to PCS Flow to PCS (event time) (hours) (minutes) (gpm) (lbm/hr) time 0 (1506) 0 0 93 1542.0 0.6000 36 73 1557.0 0.8500 51 0 0 end of 24.0000 1440.0 0 0 problem 4.0 ASSUMPTIONS 4.1 Major Assumptions 4.1.1 AFW flow delivery is under predicted.

Basis: AFW flow is limited based on S/G level control. Therefore, the Table 3.5-1 data is automatically throttled to match decay heat.

Bias: Conservative, as the calculated primary system pressure is greater.

4.1.2 MAAP S/G Modeling Limited Basis: The Palisades MAAP model runs hotter than the RELAP Version 3 Mod 2 model. Comparisons

[3] between MAAP and RELAP have shown that for station blackout sequences with subsequent once-through-cooling (OTC), that the comparative behavior between the codes for the most part, is very similar.

The single biggest difference is the more rapid steam generator dryout calculated by MAAP. This is considered due to the MAAP S/G modeling limitations. Below, the MAAP hot core node temperature peaks at about 1200°K. No peak is exhibited from the RELAP results.

Bias: Conservative, as the MAAP results produce higher pressures and temperatures for above core breaks.

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 05 - Page 7 of 20 4.2 Minor Assumptions 4.2.1 The onset of core damage has been defined as the time when peak core temperature reaches 1800°F.

Basis: The onset of core damage should be developed consistent with the desire to be as realistic as possible and consistent with current best practice. If the MAAP code is used to predict core response, it is recommended that core damage be defined as the time when peak core temperature reaches 1800°F.

This is based on the characteristics of the MAAP code and the guidance provided in the MAAP4 applications guide. A peak core temperature of 1800°F is also consistent with the general guidelines for the definition of core damage provided in the EPRI Probabilistic Safety Assessment (PSA) Applications Guide [4].

Bias: This is considered conservative per Assumption 4.1.2 and given that the fuel design limit is 2200°F.

4.2.2 Quench Tank Model Disabled Basis: The PORV discharge model to the quench tank was disabled, to improve code execution time.

Bias: This is considered neutral as it results in a slightly higher early containment heat load and somewhat slows the PCS blowdown transient.

5.0 ANALYSIS Illustrative and/or important MAAP cases are described below. Not all MAAP cases are explicitly discussed. The case name (prefix of the input file name) indentifies the specific MAAP run. The purpose, description and conclusion of each run are provided; selected plots follow.

Two basic types of cases are analyzed:

Cases utilizing event-specific timing and/or plant response Cases utilizing bounding timing and/or plant response.

The first set of cases is meant to envelope the actual event to ensure the actual plant response is bounded by the second set of cases. No cases have been performed to precisely match actual event plant response in all respects. Various model conservatisms add margin to the bounding case results.

Following each case the selected plot results are presented following by the specific MAAP input file is listed.

5.1 D11-2 SDP Case7 5.1.1 D11-2 SDP Case7 Purpose The purpose of this case is to evaluate the 9/25/11 baseline event incorporating time line data, operating plant equipment, etc. in order to determine the time to refill T-2. In this case, with charging secured in 51 minutes core heat is removed by AFW with steaming through the safeties. Table 5.1.1 provides an overview of the case inputs and boundary conditions. Appendix A includes the specific input file.

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 05 - Page 8 of 20 Table 5.1.1 MAAP CASE

SUMMARY

Purpose:

Determine the time to Refill T-2.

- AFW initially operable for ~97 minutes. Tripped for ~27 minutes restored

Description:

in ~2.17 hours1.967593e-4 days 0.00472 hours 2.810847e-5 weeks 6.4685e-6 months . See Table 3.5-1.

- ADVs assumed disabled (locked closed) for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

- P-55A and P-55B available for 51 minutes and secured. See Table 3.5-2

- T-2 refill not credited.

Other:

- No PCS Break(s)

D11-2 SDP Case7 - HPSI Tripped (t=0)

- LPSI Tripped (t=0)

- PCPs tripped in 11 minutes

- Fans/Coolers Tripped (t=0)

- Containment Sprays Tripped (t=0)

- PZR Sprays Tripped (t=0)

- PZR Heaters Tripped (t=0)

- Main Feedwater Isolated (t=0)

- MSIVs Forced Closed (t=0)

Conclusion:

If T-2 can be refilled within 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months , core damage will be averted.

Figure 5.1.1-1

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 05 - Page 9 of 20 Figure 5.1.1-2 Figure 5.1.1-3

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 05 - Page 10 of 20 5.1.2 D11-2 SDP Case7 Results Figure 5.1.1-1 indicates the rise in the peak core node temperature begins in about 16 hours1.851852e-4 days 0.00444 hours 2.645503e-5 weeks 6.088e-6 months . Figure 5.1.1-2 show the condensate storage tank (T-2) emptying in approximately 11 hours1.273148e-4 days 0.00306 hours 1.818783e-5 weeks 4.1855e-6 months , and Figure 5.1.1-3 presents charging flow termination.

5.2 D11-2 SDP Case11 5.2.1 D11-2 SDP Case11 Purpose The purpose of this case is to evaluate the 9/25/11 baseline event incorporating time line data, operating plant equipment, etc. This case reports on the water inventory given a stuck open PZR valve, and unsecured charging flow for a 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months period. Table 5.2.1 provides an overview of the case inputs and boundary conditions. Appendix A includes the specific input file.

Table 5.2.1 MAAP CASE

SUMMARY

To evaluate the 9/25/11 baseline event incorporating time line data,

Purpose:

operating plant equipment, etc. Charging, 80 gpm flow, unsecured (t=0) with a Stuck Open PZR Safety (t=1.15 hrs). 1 CAC operable.

- AFW initially operable for ~97 minutes. Tripped for ~27 minutes restored

Description:

in ~2.17 hours1.967593e-4 days 0.00472 hours 2.810847e-5 weeks 6.4685e-6 months . See Table 3.5-1.

- ADVs assumed disabled (locked closed) for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

- T-2 refill not credited.

- 1 Containment Air Cooler credited.

- Problem run time 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months .

Other:

- Forced PCS Break Simulating Stuck Open PZR Safety (1.15 hrs)

D11-2 SDP Case11 - HPSI Tripped (t=0)

- LPSI Tripped (t=0)

- PCPs tripped in 11 minutes

- Containment Sprays Tripped (t=0)

- PZR Sprays Tripped (t=0)

- PZR Heaters Tripped (t=0)

- Main Feedwater Isolated (t=0)

- MSIVs Forced Closed (t=0)

In case 11, the PZR safeties begin to pass water in ~1.15 hours1.736111e-4 days 0.00417 hours 2.480159e-5 weeks 5.7075e-6 months at which time a stuck open PZR safety is modeled. Assuming containment sprays

Conclusion:

are promptly secured, safety injection refueling water tank inventory (T-

58) and condensate storage tank (T-2) water will last 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . Moreover, 1 CAC alone can remove containment heat.

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 05 - Page 11 of 20 Figure 5.2.1-1 Figure 5.2.1-2

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 05 - Page 12 of 20 Figure 5.2.1-3 Figure 5.2.1-4

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 05 - Page 13 of 20 Figure 5.2.1-5 Figure 5.2.1-6

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 05 - Page 14 of 20 Figure 5.2.1-7 Figure 5.2.1-8

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 05 - Page 15 of 20 Figure 5.2.1-9 Figure 5.2.1-10

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 05 - Page 16 of 20 5.2.2 D11-2 SDP Case11 Results Figure 5.2-1 shows the rise in the peak core node temperature given a stuck open pressurizer safety valve at approximately 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . The peak temperature of 1650oF remained less than the success criteria limit of 1800oF. Figure 5.2.1-2 displays the primary coolant system pressure (PCS). Figure 5.2.1-3 presents the unsecured charging flow dropping from 93 gpm to 73 gpm at 36 minutes into the event.

Figure 5.2.1-4 shows the safety injection refueling water storage tank (SIRWT) dropping about 8 feet during the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months period. Figure 5.2.1-5 demonstrates that 1 containment air cooler (CAC) is sufficient to keep containment pressure less than the 55 psig design value. Figure 5.2.1-6 indicates that the condensate storage tank (T-2) dropped from about 72 feet to 26 feet during the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months duration. Figures 5.2.1-7 and 5.2.1-8 present displays the E-50A and E-50B steam generator levels, and similarly Figures 5.2.1-9 and 5.2.1-10 report the AFW flow to each generator.

In summary, Case 11 results show that if 2 charging pumps, SIRWT water and AFW are available then HPSI injection is not required. However, the logic model as described in Section 6.2 conservatively requires HPSI for success in all RAS sequences, to achieve a safe and stable state for the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months mission.

5.3 D11-2 SDP Case17 5.3.1 D11-2 SDP Case17 Purpose The purpose of this case is to evaluate the 9/25/11 baseline event incorporating time line data, operating plant equipment, etc. This case presents the minimum time to empty the SIRWT. A failed open PZR valve modeled at 1.15 hours1.736111e-4 days 0.00417 hours 2.480159e-5 weeks 5.7075e-6 months with all three spray pumps running is considered. The time to emptying the pressuizer may be used as an operator recovery action.

Table 5.3.1 MAAP CASE

SUMMARY

To evaluate the 9/25/11 baseline event incorporating time line data, operating plant equipment, etc. 80 gpm charging flow with a Stuck Open

Purpose:

PZR Safety (t=1.15 hrs). All 3 containment spray pumps are operating to determine the time to SIRWT depletion.

Description:

- No AFW.

- ADVs assumed disabled (locked closed) for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

- T-2 refill not credited.

- Problem run time 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months .

Other:

- Forced PCS Break Simulating Stuck Open PZR Safety (1.15 hrs)

D11-2 SDP Case17 - HPSI Tripped (t=0)

- LPSI Tripped (t=0)

- PCPs tripped in 11 minutes

- PZR Sprays Tripped (t=0)

- PZR Heaters Tripped (t=0)

- Main Feedwater Isolated (t=0)

- MSIVs Forced Closed (t=0)

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 05 - Page 17 of 20 In case 17, the PZR safeties begin to pass water in ~1.15 hours1.736111e-4 days 0.00417 hours 2.480159e-5 weeks 5.7075e-6 months and a

==

Conclusion:==

stuck open PZR safety is modeled. Assuming containment sprays are not secured, the SIRWT runs out of water in a little over two hours.

Figure 5.3.1-1 Figure 5.3.1-2

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 05 - Page 18 of 20 Figure 5.3.1-3 5.3.2 D11-2 SDP Case17 Results Figure 5.3.1-1 shows the time when the SIRWT would empty, given that containment spray pumps are not secured and charging is providing makeup. Figure 5.3.1-2 plots the containment spray delivery curve.

Figure 5.3.1-3 presents the water flow rate through the pressurizer safety valve starting at approximately 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 05 - Page 19 of 20 6.0 WATER

SUMMARY

Water summary results are listed below in Table 6.

Table 6 Case Water Makeup Requirements Containment Case Charging Water Source Refill Time ADV's AFW PZR Safeties Heat Comments

Flow Removal Condensate Table 7 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months Closed closed Table 3.5-2 Assuming Table 3.5-1 delivery rates.

Storage Tank 3.5-1 Failed open per PCS high pressure demand at Table 11 SIRWT Empty > 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Closed Failed Open 80 gpm 1 CAC 1.15 hours1.736111e-4 days 0.00417 hours 2.480159e-5 weeks 5.7075e-6 months . Assumes containment sprays initially 3.5-1 secured.

Failed open per PCS high pressure demand at Condensate Table 11 > 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Closed Failed Open 80 gpm 1 CAC 1.15 hours1.736111e-4 days 0.00417 hours 2.480159e-5 weeks 5.7075e-6 months . Assumes containment sprays initially Storage Tank 3.5-1 secured.

PZR Safeties failed open at 0.2 hrs, chosen to 3 Spray 17 SIRWT Empty ~ 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Closed none Failed Open 80 gpm bound the results. Three containment spray Pumps pumps are modeled.

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 05 - Page 20 of 20

7.0 REFERENCES

[1] PLP0247-07-0004.02R1, Revision 1, Palisades Nuclear Plant MAAP 4.0.6 Parameter Files Notebook, Volumes 1-8, August 2009.

[2] PLP0247-07-0004.01R2, Revision 2, Palisades Nuclear Plant Thermal Hydraulic MAAP Calculations, October 2009.

[3] Letter from Jeff R. Gabor to Brian Brogan, MAAP4/RELAP5 Comparison Final Report, PP0495050004-2613, March, 2006.

[4] Palisades PSA Notebook NB-PSA-ETSC Rev. 2, Event Trees and Success Criteria.

8.0 APPENDICES Appendix A - MAAP Input Files Appendix A - MAAP Input Files Appendix B - MAAP Attach & Plot Files Appendix B - MAAP Attach & Plot Files.pd

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 06 - Page 1 of 1 6 Event Trees TR-MCND Figure A06-1: Transient with Loss of Main Condenser (TR-MCND)

XFR-SBLOCA-SRV Figure A06-2: Transfer to Loss of Coolant Accident via Pressurizer Safety Relief Valve(s) (XFR-SBLOCA-SRV)

XFR-ATWS Figure A06-3: Transfer to Anticipated Transient Without SCRAM (XFR-ATWS)

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 07 - Page 1 of 4 Attachment 07: Change Sets Table A07-1: Change Sets for SAPHIRE Project: PSAR2C(D11-2)

Calc.

Change/Flag Set Event Prob/Freq Description Type 0_BASE SET TRIP CHARGING PUMP HEP TO 0 FOR CONSISTENCY WITH PSAR2C G-PMOA-TRIP-PUMP 1 0.00E+00 OPERATOR FAILS TO TRIP CHARGING PUMP(S) PRIOR TO CHALLENGING PZR SRVS 0_BYPASS_REG_FIX SET P-CBOB-BYREG HEP TO 1.7E-2 VICE 0.5 FOR CONSISTENCY WITH HRA P-CBOB-BYREG 1 1.70E-02 WHEN "TRUE" OP RECOVERY OF THE BYPASS REG IS CREDITED 0_D11-2_EVENT_REC0 09/25/2011 D11-2 FAULT EVENT WITH RECOVERIES APPLIED A-PMME-P-8B 1 1.53E-02 AFW TURBINE PUMP P-8B FAILS TO START (EVENT CONSEQUENTIAL FAILURE - SURROGATE FOR RECOVERY HEP)

D-BCMT-ED-15 1 1.00E+00 BATTERY CHARGER #1 FAILS TO FUNCTION (EVENT CONSEQUENTIAL FAILURE)

D-BCMT-ED-17 1 1.00E-01 BATTERY CHARGER #3 FAILS TO FUNCTION (EVENT CONSEQUENTIAL FAILURE - SURROGATE FOR RECOVERY HEP)

D-CBMC-72-119 1 1.00E+00 72-119 DC BREAKER FAILS TO REMAIN CLOSED (EVENT CONSEQUENTIAL FAILURE)

D-HSE-CHGR3-INS T SET TO 'T' - CHARGER #3 IN SERVICE D-HSMC-HS-72-01 1 1.00E-01 HAND SWITCH 72-01 FAILS TO REMAIN CLOSED (EVENT CONSEQUENTIAL FAILURE - SURROGATE FOR RECOVERY HEP)

G-PMOA-TRIP-PUMP 1 6.80E-03 OPERATOR FAILS TO TRIP CHARGING PUMP(S) PRIOR TO CHALLENGING PZR SRVS M-OOOT-LPF-INIT T 1.00E+00 OP FAILS TO SUPPLY CONDENSATE TO DEPRESSURIZED S/G (LP FEED)

(EVENT CONSEQUENTIAL FAILURE - SURROGATE FOR RECOVERY HEP - NO RECOVERY)

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 07 - Page 2 of 4 Table A07-1: Change Sets for SAPHIRE Project: PSAR2C(D11-2)

Calc.

Change/Flag Set Event Prob/Freq Description Type P-B1MK-EA-13 1 2.60E-03 FAULT ON BUS 1E (EVENT CONSEQUENTIAL FAILURE - SURROGATE FOR RECOVERY HEP)

P-PAMK-EY-10 1 3.30E-02 FAULT ON 120V PREFERRED AC BUS Y10 (EVENT CONSEQUENTIAL FAILURE - SURROGATE FOR RECOVERY HEP)

P-PAMK-EY-30 1 1.00E-01 FAULT ON 120V PREFERRED AC BUS Y30 (EVENT CONSEQUENTIAL FAILURE - SURROGATE FOR RECOVERY HEP) 0_D11-2_EVENT_REC1 09/25/2011 D11-2 FAULT EVENT WITH RECOVERIES APPLIED A-PMME-P-8B 1 1.05E-01 AFW TURBINE PUMP P-8B FAILS TO START (EVENT CONSEQUENTIAL FAILURE - SURROGATE FOR RECOVERY HEP)

D-BCMT-ED-15 1 1.00E+00 BATTERY CHARGER #1 FAILS TO FUNCTION (EVENT CONSEQUENTIAL FAILURE)

D-BCMT-ED-17 1 1.00E-01 BATTERY CHARGER #3 FAILS TO FUNCTION (EVENT CONSEQUENTIAL FAILURE - SURROGATE FOR RECOVERY HEP)

D-CBMC-72-119 1 1.00E+00 72-119 DC BREAKER FAILS TO REMAIN CLOSED (EVENT CONSEQUENTIAL FAILURE)

D-HSE-CHGR3-INS T SET TO 'T' - CHARGER #3 IN SERVICE D-HSMC-HS-72-01 1 1.00E-01 HAND SWITCH 72-01 FAILS TO REMAIN CLOSED (EVENT CONSEQUENTIAL FAILURE - SURROGATE FOR RECOVERY HEP)

G-PMOA-TRIP-PUMP 1 6.80E-03 OPERATOR FAILS TO TRIP CHARGING PUMP(S) PRIOR TO CHALLENGING PZR SRVS M-OOOT-LPF-INIT T 1.00E+00 OP FAILS TO SUPPLY CONDENSATE TO DEPRESSURIZED S/G (LP FEED)

(EVENT CONSEQUENTIAL FAILURE - SURROGATE FOR RECOVERY HEP - NO RECOVERY)

P-B1MK-EA-13 1 2.60E-03 FAULT ON BUS 1E (EVENT CONSEQUENTIAL FAILURE - SURROGATE FOR RECOVERY HEP)

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 07 - Page 3 of 4 Table A07-1: Change Sets for SAPHIRE Project: PSAR2C(D11-2)

Calc.

Change/Flag Set Event Prob/Freq Description Type P-PAMK-EY-10 1 1.00E-01 FAULT ON 120V PREFERRED AC BUS Y10 (EVENT CONSEQUENTIAL FAILURE - SURROGATE FOR RECOVERY HEP)

P-PAMK-EY-30 1 1.00E-01 FAULT ON 120V PREFERRED AC BUS Y30 (EVENT CONSEQUENTIAL FAILURE - SURROGATE FOR RECOVERY HEP) 0_IE_SET SET IE_LOMC (LOSS OF MAIN CONDENSER) TO 1 IE_LOMC 1 1.00E+00 (EVENT CONSEQUENTIAL FAILURE) 0_PRE-EVENT_EOOS 09/25/2011 PRE- D11-2 FAULT EVENT EQUIPMENT OUT OF SERVICES P-CBMB-252-302 T CIRCUIT BREAKER 252-302 FAILS TO CLOSE (OUT OF SERVICE PRIOR TO EVENT)

P-CBMC-252-302 T CIRCUIT BREAKER 252-302 FAILS TO REMAIN CLOSED (OUT OF SERVICE PRIOR TO EVENT)

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 07 - Page 4 of 4 Table A07-2: Change Sets Applied to Each Endstate Endstate: 0_LOMC_BASE 0_LOMC_D11-2_REC0 0_LOMC_D11-2_REC1 Change Sets: HEVENTS(LGCLS-NRML-CNF) HEVENTS(LGCLS-NRML-CNF) HEVENTS(LGCLS-NRML-CNF) 0_BYPASS_REG_FIX 0_BYPASS_REG_FIX 0_BYPASS_REG_FIX 0_PRE-EVENT_EOOS 0_PRE-EVENT_EOOS 0_PRE-EVENT_EOOS 0_IE_SET 0_IE_SET 0_IE_SET 0_BASE 0_D11-2_EVENT_REC0 0_D11-2_EVENT_REC1

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 08 - Page 1 of 28 8: Cutsets Note: Entire table is changed from Revision 0 - revision bars omitted for editorial reasons.

Top 100 cut sets Project : PSAR2C(D11-2)

End State: 0_LOMC_D11-2_REC0 Min Cut Upper Bound: 6.445E-006 This Partition: 3.426E-006 Table A08-1: Top 100 Cutsets Cut No. % Total % Cut Set Prob. Basic Event Description Event Prob.

1 17.15 17.15 1.11E-06 IE_LOMC 1.00E+00 PERCENTAGE OF TIME W/MTC NOT SUFFICIENTLY MTC2 2.30E-01 POSITIVE

/RVO Pressurizer Safeties Open 9.99E-01 RXC-ELEC-FAULTS Electrical Scram Signal Faults 4.81E-06 2 25.28 8.13 5.24E-07 IE_LOMC 1.00E+00 G-PMOE-P-55ABC OPERATOR FAILS TO INITIATE CHARGING FLOW 1.10E-01

/RVC Pressurizer Safeties Closed 9.91E-01

/RVO Pressurizer Safeties Open 9.99E-01 RXC-ELEC-FAULTS Electrical Scram Signal Faults 4.81E-06 3 27.73 2.45 1.58E-07 IE_LOMC 1.00E+00 COMMON CAUSE FAILURE OF ALL 3 AFW PUMPS P-8A/B/C A-PMCC-P8ABC-ME 5.45E-05 TO START

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 08 - Page 2 of 28 Table A08-1: Top 100 Cutsets Cut No. % Total % Cut Set Prob. Basic Event Description Event Prob.

H-ZZOA-OTC-INIT OPERATOR FAILS TO INITIATE ONCE THROUGH COOLING 2.90E-03 4 29.14 1.41 9.06E-08 IE_LOMC 1.00E+00 G-PMOE-P-55ABC OPERATOR FAILS TO INITIATE CHARGING FLOW 1.10E-01

/RVC Pressurizer Safeties Closed 9.91E-01

/RVO Pressurizer Safeties Open 9.99E-01

/RXC-ELEC-FAULTS Electrical Scram Signal Faults 1.00E+00 RXC-MECH-FAULTS Mechanical Scram Faults 8.40E-07

/TTF Turbine Trip 9.90E-01 5 30.21 1.07 6.90E-08 IE_LOMC 1.00E+00 OPERATOR FAILS TO ADJUST AFW FLOW GIVEN FLOW A-AVOA-MISCALADJ 1.45E-03 INSTRUMENT MISC MISCALIBRATION OF ALL FLOW INSTRUMENTS ON ALL A-ISOH-AFW-HDR3 1.30E-04 HEADERS COND HEP: A-AVOA-AFWFLADJ

B-XVOB-ADVS-MAN

H-H-ZZOA-OTC-CDTNL-HEP-2 3.66E-01 ZZOA-OTC-INIT 6 30.85 0.64 4.14E-08 IE_LOMC 1.00E+00 RVC Pressurizer Safeties Closed 8.61E-03

/RVO Pressurizer Safeties Open 9.99E-01 RXC-ELEC-FAULTS Electrical Scram Signal Faults 4.81E-06 7 31.48 0.63 4.06E-08 IE_LOMC 1.00E+00 COMMON CAUSE FAILURE OF ALL 3 AFW PUMPS P-8A/B/C A-PMCC-P8ABC-ME 5.45E-05 TO START OPERATOR FAILS TO CLOSE MANUAL VALVES TO CLOSE B-XVOB-ADVS-MAN 4.03E-02 ADV H-ZZOA-OTC-CDTNL-HEP-4 COND HEP: B-XVOB-ADVS-MAN

H-ZZOA-OTC-INIT 1.85E-02 8 32.01 0.53 3.43E-08 IE_LOMC 1.00E+00 B-RVMB-SRV-SGB ONE SAFETY RELIEF VALVE ON SG B FTC 3.69E-03

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 08 - Page 3 of 28 Table A08-1: Top 100 Cutsets Cut No. % Total % Cut Set Prob. Basic Event Description Event Prob.

D-BCMT-ED-15 BATTERY CHARGER #1 FAILS TO FUNCTION 1.00E+00 D-BCMT-ED-17 BATTERY CHARGER #3 FAILS TO FUNCTION 1.00E-01 D-HSMC-HS-72-01 HAND SWITCH 72-01 FAILS TO REMAIN CLOSED 1.00E-01 OPERATOR FAILS TO START A COMPRESSOR (SCREENING I-CMOE-IA-COMPS 1.00E-01 VALUE)

PRV-1043B POWER OPERATED RELIEF VALVE FAILS TO O-RVMA-PRV-1043B 9.29E-03 OPEN X-HSE-SGB-BLDN SET TO 'T' - ESDE ON SG E-50B (House Event) 1.00E+00 9 32.54 0.53 3.43E-08 IE_LOMC 1.00E+00 B-RVMB-SRV-SGA ONE SAFETY RELIEF VALVE ON SG A FTC 3.69E-03 D-BCMT-ED-15 BATTERY CHARGER #1 FAILS TO FUNCTION 1.00E+00 D-BCMT-ED-17 BATTERY CHARGER #3 FAILS TO FUNCTION 1.00E-01 D-HSMC-HS-72-01 HAND SWITCH 72-01 FAILS TO REMAIN CLOSED 1.00E-01 OPERATOR FAILS TO START A COMPRESSOR (SCREENING I-CMOE-IA-COMPS 1.00E-01 VALUE)

PRV-1043B POWER OPERATED RELIEF VALVE FAILS TO O-RVMA-PRV-1043B 9.29E-03 OPEN X-HSE-SGA-BLDN SET TO 'T' - ESDE ON SG E-50A (House Event) 1.00E+00 10 33.04 0.5 3.24E-08 IE_LOMC 1.00E+00 COMMON CAUSE FAILURE OF ALL 3 AFW PUMPS P-8A/B/C A-PMCC-P8ABC-ME 5.45E-05 TO START O-RVCC-PORVS-MA COMMON CAUSE FAILURE OF BOTH PORVS TO NOT OPEN 5.95E-04 11 33.53 0.49 3.17E-08 IE_LOMC 1.00E+00 Operator fails to trip charging pump(s) prior to challenging PZR G-PMOA-TRIP-PUMP 6.80E-03 SRVs CCFAIL OF SWS DISCHARGE BASKET STRAINERS 1318 &

U-FLCC-BS-1318&19&20-PLU 4.66E-06 1319 & 1320 PLUGGING 12 34.01 0.48 3.09E-08 IE_LOMC 1.00E+00

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 08 - Page 4 of 28 Table A08-1: Top 100 Cutsets Cut No. % Total % Cut Set Prob. Basic Event Description Event Prob.

A-CVCC-AFWPP3-MA ALL 3 AFW PP CK VALVES CK-FW726 1.07E-05 H-ZZOA-OTC-INIT OPERATOR FAILS TO INITIATE ONCE THROUGH COOLING 2.90E-03 13 34.47 0.46 2.97E-08 IE_LOMC 1.00E+00 A-PMMG-P-8B AFW TURBINE PUMP P-8B FAILS TO RUN 5.82E-02 D-BCMT-ED-15 BATTERY CHARGER #1 FAILS TO FUNCTION 1.00E+00 D-BCMT-ED-17 BATTERY CHARGER #3 FAILS TO FUNCTION 1.00E-01 D-HSMC-HS-72-01 HAND SWITCH 72-01 FAILS TO REMAIN CLOSED 1.00E-01 Y-PMCC-P8C66ABME COMMON CAUSE FAILURE OF P-8C 5.10E-05 14 34.92 0.45 2.89E-08 IE_LOMC 1.00E+00 OPERATOR FAILS TO ADJUST AFW FLOW GIVEN FLOW A-AVOA-MISCALADJ 1.45E-03 INSTRUMENT MISC COMMON CAUSE FAILURE OF ALL 3 AFW PUMPS P-8A/B/C A-PMCC-P8ABC-ME 5.45E-05 TO START COND HEP: A-AVOA-AFWFLADJ

B-XVOB-ADVS-MAN

H-H-ZZOA-OTC-CDTNL-HEP-2 3.66E-01 ZZOA-OTC-INIT 15 35.37 0.45 2.89E-08 IE_LOMC 1.00E+00 OPERATOR FAILS TO ADJUST AFW FLOW GIVEN FAILURE A-AVOA-AFWFLADJ 1.45E-03 OF ONE HDR COMMON CAUSE FAILURE OF ALL 3 AFW PUMPS P-8A/B/C A-PMCC-P8ABC-ME 5.45E-05 TO START COND HEP: A-AVOA-AFWFLADJ

B-XVOB-ADVS-MAN

H-H-ZZOA-OTC-CDTNL-HEP-2 3.66E-01 ZZOA-OTC-INIT 16 35.76 0.39 2.51E-08 IE_LOMC 1.00E+00 ALL 4 AFW INJ CHECK VALVES FTO DUE TO COMMON A-CVCC-AFWINJ-MA 8.65E-06 CAUSE H-ZZOA-OTC-INIT OPERATOR FAILS TO INITIATE ONCE THROUGH COOLING 2.90E-03 17 36.14 0.38 2.45E-08 IE_LOMC 1.00E+00 OPERATOR FAILS TO ADJUST AFW FLOW GIVEN FLOW A-AVOA-MISCALADJ 1.45E-03 INSTRUMENT MISC

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 08 - Page 5 of 28 Table A08-1: Top 100 Cutsets Cut No. % Total % Cut Set Prob. Basic Event Description Event Prob.

MISCALIBRATION OF ALL FLOW INSTRUMENTS ON ALL A-ISOH-AFW-HDR3 1.30E-04 HEADERS COND HEP: A-AVOA-MISCALADJ

M-OOOT-LPF-INIT

H-H-ZZOA-OTC-CDTNL-HEP-3 5.44E-01 ZZOA-OTC-INIT COND HEP: A-AVOA-MISCALADJ

M-OOOT-LPF-INIT

H-M-OOOT-LPF-CDTNL-HEP-1 2.39E-01 AVOA-HPISUBCLG 18 36.52 0.38 2.42E-08 IE_LOMC 1.00E+00 COMMON CAUSE FAILURE OF ALL 3 AFW PUMPS P-8A/B/C A-PMCC-P8ABC-ME 5.45E-05 TO START Y-AVMD-CV-3056 AIR OPERATED VALVE CV-3056 FAILS TO REMAIN OPEN 4.44E-04 19 36.9 0.38 2.42E-08 IE_LOMC 1.00E+00 COMMON CAUSE FAILURE OF ALL 3 AFW PUMPS P-8A/B/C A-PMCC-P8ABC-ME 5.45E-05 TO START Y-AVMD-CV-3027 AIR OPERATED VALVE CV-3027 FAILS TO REMAIN OPEN 4.44E-04 20 37.26 0.36 2.34E-08 IE_LOMC 1.00E+00 ALL 4 AFW AOV'S CCAUSE FTO CV-0727/CV-0736/CV-A-AVCC-AFW-4-MA 8.06E-06 0736A/CV-0749 H-ZZOA-OTC-INIT OPERATOR FAILS TO INITIATE ONCE THROUGH COOLING 2.90E-03 21 37.6 0.34 2.20E-08 IE_LOMC 1.00E+00 A-PMMG-P-8B AFW TURBINE PUMP P-8B FAILS TO RUN 5.82E-02 MISCALIBRATION OF ALL AFW LOW SUCTION PRESSURE A-PSOH-AFWLOSUC 1.30E-04 SWITCHES H-ZZOA-OTC-INIT OPERATOR FAILS TO INITIATE ONCE THROUGH COOLING 2.90E-03 22 37.93 0.33 2.16E-08 IE_LOMC 1.00E+00 B-RVMB-SRV-SGB ONE SAFETY RELIEF VALVE ON SG B FTC 3.69E-03 D-BCMT-ED-15 BATTERY CHARGER #1 FAILS TO FUNCTION 1.00E+00 D-BCMT-ED-17 BATTERY CHARGER #3 FAILS TO FUNCTION 1.00E-01 D-HSMC-HS-72-01 HAND SWITCH 72-01 FAILS TO REMAIN CLOSED 1.00E-01

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 08 - Page 6 of 28 Table A08-1: Top 100 Cutsets Cut No. % Total % Cut Set Prob. Basic Event Description Event Prob.

OPERATOR FAILS TO START A COMPRESSOR (SCREENING I-CMOE-IA-COMPS 1.00E-01 VALUE)

O-MVMA-MO-1043A MOTOR OPERATED VALVE MO-1043A FAILS TO OPEN 5.85E-03 X-HSE-SGB-BLDN SET TO 'T' - ESDE ON SG E-50B (House Event) 1.00E+00 23 38.26 0.33 2.16E-08 IE_LOMC 1.00E+00 B-RVMB-SRV-SGA ONE SAFETY RELIEF VALVE ON SG A FTC 3.69E-03 D-BCMT-ED-15 BATTERY CHARGER #1 FAILS TO FUNCTION 1.00E+00 D-BCMT-ED-17 BATTERY CHARGER #3 FAILS TO FUNCTION 1.00E-01 D-HSMC-HS-72-01 HAND SWITCH 72-01 FAILS TO REMAIN CLOSED 1.00E-01 OPERATOR FAILS TO START A COMPRESSOR (SCREENING I-CMOE-IA-COMPS 1.00E-01 VALUE)

O-MVMA-MO-1043A MOTOR OPERATED VALVE MO-1043A FAILS TO OPEN 5.85E-03 X-HSE-SGA-BLDN SET TO 'T' - ESDE ON SG E-50A (House Event) 1.00E+00 24 38.59 0.33 2.12E-08 IE_LOMC 1.00E+00 COND HEP: L-ZZOA-SDC-INIT

A-OOOT-CSTMKUP

P-A-OOOT-CSTMK-CDTNL-HEP-2 1.43E-01 CBOB-BUS1E A-PMME-P-936 P-936 FAILS TO START 3.29E-03 H-ZZOA-OTC-INIT OPERATOR FAILS TO INITIATE ONCE THROUGH COOLING 2.90E-03 L-ZZOA-SDC-INIT OPERATOR FAILS TO INITIATE SDC 1.55E-02 25 38.89 0.3 1.96E-08 IE_LOMC 1.00E+00 OPERATOR FAILS TO ADJUST AFW FLOW GIVEN FAILURE A-AVOA-AFWFLADJ 1.45E-03 OF ONE HDR B-RVMB-SRV-SGA ONE SAFETY RELIEF VALVE ON SG A FTC 3.69E-03 D-BCMT-ED-15 BATTERY CHARGER #1 FAILS TO FUNCTION 1.00E+00 D-BCMT-ED-17 BATTERY CHARGER #3 FAILS TO FUNCTION 1.00E-01 D-HSMC-HS-72-01 HAND SWITCH 72-01 FAILS TO REMAIN CLOSED 1.00E-01

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 08 - Page 7 of 28 Table A08-1: Top 100 Cutsets Cut No. % Total % Cut Set Prob. Basic Event Description Event Prob.

COND HEP: A-AVOA-AFWFLADJ

B-XVOB-ADVS-MAN

H-H-ZZOA-OTC-CDTNL-HEP-2 3.66E-01 ZZOA-OTC-INIT X-HSE-SGA-BLDN SET TO 'T' - ESDE ON SG E-50A (House Event) 1.00E+00 26 39.19 0.3 1.96E-08 IE_LOMC 1.00E+00 OPERATOR FAILS TO ADJUST AFW FLOW GIVEN FAILURE A-AVOA-AFWFLADJ 1.45E-03 OF ONE HDR B-RVMB-SRV-SGB ONE SAFETY RELIEF VALVE ON SG B FTC 3.69E-03 D-BCMT-ED-15 BATTERY CHARGER #1 FAILS TO FUNCTION 1.00E+00 D-BCMT-ED-17 BATTERY CHARGER #3 FAILS TO FUNCTION 1.00E-01 D-HSMC-HS-72-01 HAND SWITCH 72-01 FAILS TO REMAIN CLOSED 1.00E-01 COND HEP: A-AVOA-AFWFLADJ

B-XVOB-ADVS-MAN

H-H-ZZOA-OTC-CDTNL-HEP-2 3.66E-01 ZZOA-OTC-INIT X-HSE-SGB-BLDN SET TO 'T' - ESDE ON SG E-50B (House Event) 1.00E+00 27 39.48 0.29 1.89E-08 IE_LOMC 1.00E+00 COMMON CAUSE FAILURE OF ALL 3 AFW PUMPS P-8A/B/C A-PMCC-P8ABC-MG 6.53E-06 TO RUN H-ZZOA-OTC-INIT OPERATOR FAILS TO INITIATE ONCE THROUGH COOLING 2.90E-03 28 39.77 0.29 1.87E-08 IE_LOMC 1.00E+00 Operator fails to trip charging pump(s) prior to challenging PZR G-PMOA-TRIP-PUMP 6.80E-03 SRVs U-FLCC-TRAV-SCRN COMMON CAUSE FAILURE OF TRAVELING SCREENS 2.75E-06 29 40.05 0.28 1.81E-08 IE_LOMC 1.00E+00 A-PMMG-P-8B AFW TURBINE PUMP P-8B FAILS TO RUN 5.82E-02 A-PMOO-P-8C AFW PUMP P-8C OUT OF SERVICE 3.35E-03 D-BCMT-ED-15 BATTERY CHARGER #1 FAILS TO FUNCTION 1.00E+00 D-BCMT-ED-17 BATTERY CHARGER #3 FAILS TO FUNCTION 1.00E-01 D-HSMC-HS-72-01 HAND SWITCH 72-01 FAILS TO REMAIN CLOSED 1.00E-01

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 08 - Page 8 of 28 Table A08-1: Top 100 Cutsets Cut No. % Total % Cut Set Prob. Basic Event Description Event Prob.

PRV-1043B POWER OPERATED RELIEF VALVE FAILS TO O-RVMA-PRV-1043B 9.29E-03 OPEN 30 40.33 0.28 1.78E-08 IE_LOMC 1.00E+00 Operator fails to trip charging pump(s) prior to challenging PZR G-PMOA-TRIP-PUMP 6.80E-03 SRVs U-PMCC-P-7ABC-MG P-7A & P-7B & P-7C FAIL TO RUN DUE TO COMMON CAUSE 2.61E-06 31 40.59 0.26 1.67E-08 IE_LOMC 1.00E+00 COND HEP: L-ZZOA-SDC-INIT

A-OOOT-CSTMKUP

P-A-OOOT-CSTMK-CDTNL-HEP-2 1.43E-01 CBOB-BUS1E H-ZZOA-OTC-INIT OPERATOR FAILS TO INITIATE ONCE THROUGH COOLING 2.90E-03 L-ZZOA-SDC-INIT OPERATOR FAILS TO INITIATE SDC 1.55E-02 P-B1MK-EA-13 FAULT ON BUS 1E 2.60E-03 32 40.85 0.26 1.66E-08 IE_LOMC 1.00E+00 PERCENTAGE OF TIME W/MTC NOT SUFFICIENTLY MTC1 2.00E-02 POSITIVE

/RVO Pressurizer Safeties Open 9.99E-01

/RXC-ELEC-FAULTS Electrical Scram Signal Faults 1.00E+00 RXC-MECH-FAULTS Mechanical Scram Faults 8.40E-07

/TTF Turbine Trip 9.90E-01 33 41.1 0.25 1.64E-08 IE_LOMC 1.00E+00 Operator fails to trip charging pump(s) prior to challenging PZR G-PMOA-TRIP-PUMP 6.80E-03 SRVs P-PAMK-EY-30 FAULT ON 120V PREFERRED AC BUS Y30 1.00E-01 R-REMD-TX-4 RELAY TX-4 FAILS TO REMAIN DE-ENERGIZED 6.52E-03 PZR SAFETY VALVE RV-1039 FTC (GIVEN SPURIOUS W-RVMB-RV-1039 3.69E-03 DEMAND) 34 41.35 0.25 1.64E-08 IE_LOMC 1.00E+00 G-PMOA-TRIP-PUMP Operator fails to trip charging pump(s) prior to challenging PZR 6.80E-03

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 08 - Page 9 of 28 Table A08-1: Top 100 Cutsets Cut No. % Total % Cut Set Prob. Basic Event Description Event Prob.

SRVs P-PAMK-EY-30 FAULT ON 120V PREFERRED AC BUS Y30 1.00E-01 R-REMD-TVX-4 RELAY TVX-4 FAILS TO REMAIN DE-ENERGIZED 6.52E-03 PZR SAFETY VALVE RV-1039 FTC (GIVEN SPURIOUS W-RVMB-RV-1039 3.69E-03 DEMAND) 35 41.6 0.25 1.64E-08 IE_LOMC 1.00E+00 Operator fails to trip charging pump(s) prior to challenging PZR G-PMOA-TRIP-PUMP 6.80E-03 SRVs P-PAMK-EY-30 FAULT ON 120V PREFERRED AC BUS Y30 1.00E-01 R-REMD-TX-4 RELAY TX-4 FAILS TO REMAIN DE-ENERGIZED 6.52E-03 PZR SAFETY VALVE RV-1040 FTC (GIVEN SPURIOUS W-RVMB-RV-1040 3.69E-03 DEMAND) 36 41.85 0.25 1.64E-08 IE_LOMC 1.00E+00 Operator fails to trip charging pump(s) prior to challenging PZR G-PMOA-TRIP-PUMP 6.80E-03 SRVs P-PAMK-EY-30 FAULT ON 120V PREFERRED AC BUS Y30 1.00E-01 R-REMD-TVX-4 RELAY TVX-4 FAILS TO REMAIN DE-ENERGIZED 6.52E-03 PZR SAFETY VALVE RV-1040 FTC (GIVEN SPURIOUS W-RVMB-RV-1040 3.69E-03 DEMAND) 37 42.1 0.25 1.64E-08 IE_LOMC 1.00E+00 Operator fails to trip charging pump(s) prior to challenging PZR G-PMOA-TRIP-PUMP 6.80E-03 SRVs P-PAMK-EY-30 FAULT ON 120V PREFERRED AC BUS Y30 1.00E-01 R-REMD-TX-4 RELAY TX-4 FAILS TO REMAIN DE-ENERGIZED 6.52E-03 PZR SAFETY VALVE RV-1041 FTC (GIVEN SPURIOUS W-RVMB-RV-1041 3.69E-03 DEMAND) 38 42.35 0.25 1.64E-08 IE_LOMC 1.00E+00 Operator fails to trip charging pump(s) prior to challenging PZR G-PMOA-TRIP-PUMP 6.80E-03 SRVs

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 08 - Page 10 of 28 Table A08-1: Top 100 Cutsets Cut No. % Total % Cut Set Prob. Basic Event Description Event Prob.

P-PAMK-EY-30 FAULT ON 120V PREFERRED AC BUS Y30 1.00E-01 R-REMD-TVX-4 RELAY TVX-4 FAILS TO REMAIN DE-ENERGIZED 6.52E-03 PZR SAFETY VALVE RV-1041 FTC (GIVEN SPURIOUS W-RVMB-RV-1041 3.69E-03 DEMAND) 39 42.6 0.25 1.63E-08 IE_LOMC 1.00E+00 B-RVMB-SRV-SGB ONE SAFETY RELIEF VALVE ON SG B FTC 3.69E-03 D-BCMT-ED-15 BATTERY CHARGER #1 FAILS TO FUNCTION 1.00E+00 D-BCMT-ED-17 BATTERY CHARGER #3 FAILS TO FUNCTION 1.00E-01 D-HSMC-HS-72-01 HAND SWITCH 72-01 FAILS TO REMAIN CLOSED 1.00E-01 OPERATOR FAILS TO START A COMPRESSOR (SCREENING I-CMOE-IA-COMPS 1.00E-01 VALUE)

X-HSE-SGB-BLDN SET TO 'T' - ESDE ON SG E-50B (House Event) 1.00E+00 Y-AVMB-CV-3056 SIRWT RECIRC VALVE CV-3056 FTC 4.42E-03 40 42.85 0.25 1.63E-08 IE_LOMC 1.00E+00 B-RVMB-SRV-SGA ONE SAFETY RELIEF VALVE ON SG A FTC 3.69E-03 D-BCMT-ED-15 BATTERY CHARGER #1 FAILS TO FUNCTION 1.00E+00 D-BCMT-ED-17 BATTERY CHARGER #3 FAILS TO FUNCTION 1.00E-01 D-HSMC-HS-72-01 HAND SWITCH 72-01 FAILS TO REMAIN CLOSED 1.00E-01 OPERATOR FAILS TO START A COMPRESSOR (SCREENING I-CMOE-IA-COMPS 1.00E-01 VALUE)

X-HSE-SGA-BLDN SET TO 'T' - ESDE ON SG E-50A (House Event) 1.00E+00 Y-AVMB-CV-3056 SIRWT RECIRC VALVE CV-3056 FTC 4.42E-03 41 43.07 0.22 1.45E-08 IE_LOMC 1.00E+00 B-RVMB-SRV-SGA ONE SAFETY RELIEF VALVE ON SG A FTC 3.69E-03 D-BCMT-ED-15 BATTERY CHARGER #1 FAILS TO FUNCTION 1.00E+00

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 08 - Page 11 of 28 Table A08-1: Top 100 Cutsets Cut No. % Total % Cut Set Prob. Basic Event Description Event Prob.

D-BCMT-ED-17 BATTERY CHARGER #3 FAILS TO FUNCTION 1.00E-01 D-HSMC-HS-72-01 HAND SWITCH 72-01 FAILS TO REMAIN CLOSED 1.00E-01 OPERATOR FAILS TO START A COMPRESSOR (SCREENING I-CMOE-IA-COMPS 1.00E-01 VALUE)

X-HSE-SGA-BLDN SET TO 'T' - ESDE ON SG E-50A (House Event) 1.00E+00 Y-KVMB-SV-3056B SIRWT RECIRC VALVE SOLENOID SV-3056B FTE 3.93E-03 42 43.29 0.22 1.45E-08 IE_LOMC 1.00E+00 B-RVMB-SRV-SGB ONE SAFETY RELIEF VALVE ON SG B FTC 3.69E-03 D-BCMT-ED-15 BATTERY CHARGER #1 FAILS TO FUNCTION 1.00E+00 D-BCMT-ED-17 BATTERY CHARGER #3 FAILS TO FUNCTION 1.00E-01 D-HSMC-HS-72-01 HAND SWITCH 72-01 FAILS TO REMAIN CLOSED 1.00E-01 OPERATOR FAILS TO START A COMPRESSOR (SCREENING I-CMOE-IA-COMPS 1.00E-01 VALUE)

X-HSE-SGB-BLDN SET TO 'T' - ESDE ON SG E-50B (House Event) 1.00E+00 Y-KVMB-SV-3056B SIRWT RECIRC VALVE SOLENOID SV-3056B FTE 3.93E-03 43 43.51 0.22 1.45E-08 IE_LOMC 1.00E+00 B-RVMB-SRV-SGA ONE SAFETY RELIEF VALVE ON SG A FTC 3.69E-03 D-BCMT-ED-15 BATTERY CHARGER #1 FAILS TO FUNCTION 1.00E+00 D-BCMT-ED-17 BATTERY CHARGER #3 FAILS TO FUNCTION 1.00E-01 D-HSMC-HS-72-01 HAND SWITCH 72-01 FAILS TO REMAIN CLOSED 1.00E-01 OPERATOR FAILS TO START A COMPRESSOR (SCREENING I-CMOE-IA-COMPS 1.00E-01 VALUE)

X-HSE-SGA-BLDN SET TO 'T' - ESDE ON SG E-50A (House Event) 1.00E+00 Z-KVMB-SV-3029A SUMP TO EAST ESS AIR SUPPLY SV-3029A FTE 3.93E-03 44 43.73 0.22 1.45E-08 IE_LOMC 1.00E+00

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 08 - Page 12 of 28 Table A08-1: Top 100 Cutsets Cut No. % Total % Cut Set Prob. Basic Event Description Event Prob.

B-RVMB-SRV-SGB ONE SAFETY RELIEF VALVE ON SG B FTC 3.69E-03 D-BCMT-ED-15 BATTERY CHARGER #1 FAILS TO FUNCTION 1.00E+00 D-BCMT-ED-17 BATTERY CHARGER #3 FAILS TO FUNCTION 1.00E-01 D-HSMC-HS-72-01 HAND SWITCH 72-01 FAILS TO REMAIN CLOSED 1.00E-01 OPERATOR FAILS TO START A COMPRESSOR (SCREENING I-CMOE-IA-COMPS 1.00E-01 VALUE)

X-HSE-SGB-BLDN SET TO 'T' - ESDE ON SG E-50B (House Event) 1.00E+00 Z-KVMB-SV-3029B SUMP TO EAST ESS AIR SUPPLY SV-3029B FTE 3.93E-03 45 43.95 0.22 1.45E-08 IE_LOMC 1.00E+00 B-RVMB-SRV-SGA ONE SAFETY RELIEF VALVE ON SG A FTC 3.69E-03 D-BCMT-ED-15 BATTERY CHARGER #1 FAILS TO FUNCTION 1.00E+00 D-BCMT-ED-17 BATTERY CHARGER #3 FAILS TO FUNCTION 1.00E-01 D-HSMC-HS-72-01 HAND SWITCH 72-01 FAILS TO REMAIN CLOSED 1.00E-01 OPERATOR FAILS TO START A COMPRESSOR (SCREENING I-CMOE-IA-COMPS 1.00E-01 VALUE)

X-HSE-SGA-BLDN SET TO 'T' - ESDE ON SG E-50A (House Event) 1.00E+00 Z-KVMB-SV-3029B SUMP TO EAST ESS AIR SUPPLY SV-3029B FTE 3.93E-03 46 44.17 0.22 1.45E-08 IE_LOMC 1.00E+00 B-RVMB-SRV-SGB ONE SAFETY RELIEF VALVE ON SG B FTC 3.69E-03 D-BCMT-ED-15 BATTERY CHARGER #1 FAILS TO FUNCTION 1.00E+00 D-BCMT-ED-17 BATTERY CHARGER #3 FAILS TO FUNCTION 1.00E-01 D-HSMC-HS-72-01 HAND SWITCH 72-01 FAILS TO REMAIN CLOSED 1.00E-01 OPERATOR FAILS TO START A COMPRESSOR (SCREENING I-CMOE-IA-COMPS 1.00E-01 VALUE)

X-HSE-SGB-BLDN SET TO 'T' - ESDE ON SG E-50B (House Event) 1.00E+00

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 08 - Page 13 of 28 Table A08-1: Top 100 Cutsets Cut No. % Total % Cut Set Prob. Basic Event Description Event Prob.

Z-KVMB-SV-3029A SUMP TO EAST ESS AIR SUPPLY SV-3029A FTE 3.93E-03 47 44.39 0.22 1.45E-08 IE_LOMC 1.00E+00 B-RVMB-SRV-SGB ONE SAFETY RELIEF VALVE ON SG B FTC 3.69E-03 D-BCMT-ED-15 BATTERY CHARGER #1 FAILS TO FUNCTION 1.00E+00 D-BCMT-ED-17 BATTERY CHARGER #3 FAILS TO FUNCTION 1.00E-01 D-HSMC-HS-72-01 HAND SWITCH 72-01 FAILS TO REMAIN CLOSED 1.00E-01 OPERATOR FAILS TO START A COMPRESSOR (SCREENING I-CMOE-IA-COMPS 1.00E-01 VALUE)

X-HSE-SGB-BLDN SET TO 'T' - ESDE ON SG E-50B (House Event) 1.00E+00 Y-KVMB-SV-3056A SIRWT RECIRC VALVE SOLENOID SV-3056A FTE 3.93E-03 48 44.61 0.22 1.45E-08 IE_LOMC 1.00E+00 B-RVMB-SRV-SGA ONE SAFETY RELIEF VALVE ON SG A FTC 3.69E-03 D-BCMT-ED-15 BATTERY CHARGER #1 FAILS TO FUNCTION 1.00E+00 D-BCMT-ED-17 BATTERY CHARGER #3 FAILS TO FUNCTION 1.00E-01 D-HSMC-HS-72-01 HAND SWITCH 72-01 FAILS TO REMAIN CLOSED 1.00E-01 OPERATOR FAILS TO START A COMPRESSOR (SCREENING I-CMOE-IA-COMPS 1.00E-01 VALUE)

X-HSE-SGA-BLDN SET TO 'T' - ESDE ON SG E-50A (House Event) 1.00E+00 Y-KVMB-SV-3056A SIRWT RECIRC VALVE SOLENOID SV-3056A FTE 3.93E-03 49 44.83 0.22 1.42E-08 IE_LOMC 1.00E+00 COMMON CAUSE FAILURE OF ALL 3 AFW PUMPS P-8A/B/C A-PMCC-P8ABC-ME 5.45E-05 TO START OPERATOR FAILS TO ENABLE ESS RECIRC VALVES TO Y-AVOB-RAS-VLVS 2.60E-04 CLOSE ON RAS 50 45.05 0.22 1.40E-08 IE_LOMC 1.00E+00 A-PMMG-P-8B AFW TURBINE PUMP P-8B FAILS TO RUN 5.82E-02

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 08 - Page 14 of 28 Table A08-1: Top 100 Cutsets Cut No. % Total % Cut Set Prob. Basic Event Description Event Prob.

D-BCMT-ED-15 BATTERY CHARGER #1 FAILS TO FUNCTION 1.00E+00 D-HSMC-HS-72-01 HAND SWITCH 72-01 FAILS TO REMAIN CLOSED 1.00E-01 P-B1MK-EA-12 FAULT ON BUS 1D 2.40E-06 51 45.27 0.22 1.40E-08 IE_LOMC 1.00E+00 A-PMMG-P-8B AFW TURBINE PUMP P-8B FAILS TO RUN 5.82E-02 D-BCMT-ED-15 BATTERY CHARGER #1 FAILS TO FUNCTION 1.00E+00 D-BCMT-ED-17 BATTERY CHARGER #3 FAILS TO FUNCTION 1.00E-01 D-HSMC-HS-72-01 HAND SWITCH 72-01 FAILS TO REMAIN CLOSED 1.00E-01 P-REMD-127-8-X1 RELAY 127-8-X1 FAILS TO REMAIN DE-ENERGIZED 2.40E-05 52 45.49 0.22 1.40E-08 IE_LOMC 1.00E+00 A-PMMG-P-8B AFW TURBINE PUMP P-8B FAILS TO RUN 5.82E-02 D-BCMT-ED-15 BATTERY CHARGER #1 FAILS TO FUNCTION 1.00E+00 D-BCMT-ED-17 BATTERY CHARGER #3 FAILS TO FUNCTION 1.00E-01 D-HSMC-HS-72-01 HAND SWITCH 72-01 FAILS TO REMAIN CLOSED 1.00E-01 P-REMD-127-2-X2 RELAY 127-2-X2 FAILS TO REMAIN DE-ENERIZED 2.40E-05 53 45.71 0.22 1.40E-08 IE_LOMC 1.00E+00 A-PMMG-P-8B AFW TURBINE PUMP P-8B FAILS TO RUN 5.82E-02 D-BCMT-ED-15 BATTERY CHARGER #1 FAILS TO FUNCTION 1.00E+00 D-BCMT-ED-17 BATTERY CHARGER #3 FAILS TO FUNCTION 1.00E-01 D-HSMC-HS-72-01 HAND SWITCH 72-01 FAILS TO REMAIN CLOSED 1.00E-01 P-REMD-162-154 RELAY 162-154 FAILS TO REMAIN DE-ENERGIZED 2.40E-05 54 45.93 0.22 1.40E-08 IE_LOMC 1.00E+00 A-PMMG-P-8B AFW TURBINE PUMP P-8B FAILS TO RUN 5.82E-02

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 08 - Page 15 of 28 Table A08-1: Top 100 Cutsets Cut No. % Total % Cut Set Prob. Basic Event Description Event Prob.

D-BCMT-ED-15 BATTERY CHARGER #1 FAILS TO FUNCTION 1.00E+00 D-BCMT-ED-17 BATTERY CHARGER #3 FAILS TO FUNCTION 1.00E-01 D-HSMC-HS-72-01 HAND SWITCH 72-01 FAILS TO REMAIN CLOSED 1.00E-01 P-REMD-162-154X1 RELAY 162-154-X1 FAILS TO REMAIN DE-ENERGIZED 2.40E-05 55 46.15 0.22 1.40E-08 IE_LOMC 1.00E+00 A-PMMG-P-8B AFW TURBINE PUMP P-8B FAILS TO RUN 5.82E-02 D-BCMT-ED-15 BATTERY CHARGER #1 FAILS TO FUNCTION 1.00E+00 D-BCMT-ED-17 BATTERY CHARGER #3 FAILS TO FUNCTION 1.00E-01 D-HSMC-HS-72-01 HAND SWITCH 72-01 FAILS TO REMAIN CLOSED 1.00E-01 R-REMD-194-211 LOAD SHED RELAY 194-211 FTRD 2.40E-05 56 46.36 0.21 1.34E-08 IE_LOMC 1.00E+00 A-PMMG-P-8B AFW TURBINE PUMP P-8B FAILS TO RUN 5.82E-02 A-PMOO-P-8A AFW PUMP P-8A OUT OF SERVICE 4.52E-03 Y-PMCC-P8C66ABME COMMON CAUSE FAILURE OF P-8C 5.10E-05 57 46.56 0.2 1.29E-08 IE_LOMC 1.00E+00 A-PMMG-P-8B AFW TURBINE PUMP P-8B FAILS TO RUN 5.82E-02 D-BCMT-ED-15 BATTERY CHARGER #1 FAILS TO FUNCTION 1.00E+00 D-BCMT-ED-17 BATTERY CHARGER #3 FAILS TO FUNCTION 1.00E-01 D-FUMK-D028-1 FUSE (FUZ/D028-1) TO PANEL D21A FAILED OPEN 2.21E-05 D-HSMC-HS-72-01 HAND SWITCH 72-01 FAILS TO REMAIN CLOSED 1.00E-01 58 46.75 0.19 1.23E-08 IE_LOMC 1.00E+00 A-REMA-SSX-3P8AB AFW A/B INJECTION VALVES OPEN RELAY SSX-3/P8A/B FTD 2.41E-04 Y-PMCC-P8C66ABME COMMON CAUSE FAILURE OF P-8C 5.10E-05

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 08 - Page 16 of 28 Table A08-1: Top 100 Cutsets Cut No. % Total % Cut Set Prob. Basic Event Description Event Prob.

59 46.94 0.19 1.20E-08 IE_LOMC 1.00E+00 OPERATOR FAILS TO OPEN CV-2010 FOR T-939 MAKEUP TO A-AVOA-CV-2010 2.59E-03 CST COND HEP: A-AVOA-CV-2010

A-OOOT-CSTMKUP

Y-AVOB-A-OOOT-CSTMK-CDTNL-HEP-1 4.99E-01 RAS-VLVS D-BCMT-ED-15 BATTERY CHARGER #1 FAILS TO FUNCTION 1.00E+00 D-BCMT-ED-17 BATTERY CHARGER #3 FAILS TO FUNCTION 1.00E-01 D-HSMC-HS-72-01 HAND SWITCH 72-01 FAILS TO REMAIN CLOSED 1.00E-01 OPERATOR FAILS TO START A COMPRESSOR (SCREENING I-CMOE-IA-COMPS 1.00E-01 VALUE)

PRV-1043B POWER OPERATED RELIEF VALVE FAILS TO O-RVMA-PRV-1043B 9.29E-03 OPEN 60 47.12 0.18 1.17E-08 IE_LOMC 1.00E+00 B-RVMB-SRV-SGB ONE SAFETY RELIEF VALVE ON SG B FTC 3.69E-03 D-BCMT-ED-15 BATTERY CHARGER #1 FAILS TO FUNCTION 1.00E+00 D-BCMT-ED-17 BATTERY CHARGER #3 FAILS TO FUNCTION 1.00E-01 D-HSMC-HS-72-01 HAND SWITCH 72-01 FAILS TO REMAIN CLOSED 1.00E-01 OPERATOR FAILS TO START A COMPRESSOR (SCREENING I-CMOE-IA-COMPS 1.00E-01 VALUE)

O-LMMC-HS-1043A LIMIT SWITCH POS-L FAILS TO REMAIN CLOSED 3.17E-03 X-HSE-SGB-BLDN SET TO 'T' - ESDE ON SG E-50B (House Event) 1.00E+00 61 47.3 0.18 1.17E-08 IE_LOMC 1.00E+00 B-RVMB-SRV-SGA ONE SAFETY RELIEF VALVE ON SG A FTC 3.69E-03 D-BCMT-ED-15 BATTERY CHARGER #1 FAILS TO FUNCTION 1.00E+00 D-BCMT-ED-17 BATTERY CHARGER #3 FAILS TO FUNCTION 1.00E-01 D-HSMC-HS-72-01 HAND SWITCH 72-01 FAILS TO REMAIN CLOSED 1.00E-01 OPERATOR FAILS TO START A COMPRESSOR (SCREENING I-CMOE-IA-COMPS 1.00E-01 VALUE)

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 08 - Page 17 of 28 Table A08-1: Top 100 Cutsets Cut No. % Total % Cut Set Prob. Basic Event Description Event Prob.

O-LMMC-HS-1043A LIMIT SWITCH POS-L FAILS TO REMAIN CLOSED 3.17E-03 X-HSE-SGA-BLDN SET TO 'T' - ESDE ON SG E-50A (House Event) 1.00E+00 62 47.48 0.18 1.14E-08 IE_LOMC 1.00E+00 A-PMMG-P-8B AFW TURBINE PUMP P-8B FAILS TO RUN 5.82E-02 A-PMOO-P-8C AFW PUMP P-8C OUT OF SERVICE 3.35E-03 D-BCMT-ED-15 BATTERY CHARGER #1 FAILS TO FUNCTION 1.00E+00 D-BCMT-ED-17 BATTERY CHARGER #3 FAILS TO FUNCTION 1.00E-01 D-HSMC-HS-72-01 HAND SWITCH 72-01 FAILS TO REMAIN CLOSED 1.00E-01 O-MVMA-MO-1043A MOTOR OPERATED VALVE MO-1043A FAILS TO OPEN 5.85E-03 63 47.65 0.17 1.13E-08 IE_LOMC 1.00E+00 A-FLMK-F-P936 P-936 SUCTION STRAINER PLUGS 1.76E-03 COND HEP: L-ZZOA-SDC-INIT

A-OOOT-CSTMKUP

P-A-OOOT-CSTMK-CDTNL-HEP-2 1.43E-01 CBOB-BUS1E H-ZZOA-OTC-INIT OPERATOR FAILS TO INITIATE ONCE THROUGH COOLING 2.90E-03 L-ZZOA-SDC-INIT OPERATOR FAILS TO INITIATE SDC 1.55E-02 64 47.82 0.17 1.11E-08 IE_LOMC 1.00E+00 Operator fails to trip charging pump(s) prior to challenging PZR G-PMOA-TRIP-PUMP 6.80E-03 SRVs PZR SAFETY VALVE RV-1041 FTC (GIVEN SPURIOUS W-RVMB-RV-1041 3.69E-03 DEMAND)

Y-AVMD-CV-3056 AIR OPERATED VALVE CV-3056 FAILS TO REMAIN OPEN 4.44E-04 65 47.99 0.17 1.11E-08 IE_LOMC 1.00E+00 Operator fails to trip charging pump(s) prior to challenging PZR G-PMOA-TRIP-PUMP 6.80E-03 SRVs PZR SAFETY VALVE RV-1040 FTC (GIVEN SPURIOUS W-RVMB-RV-1040 3.69E-03 DEMAND)

Y-AVMD-CV-3056 AIR OPERATED VALVE CV-3056 FAILS TO REMAIN OPEN 4.44E-04

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 08 - Page 18 of 28 Table A08-1: Top 100 Cutsets Cut No. % Total % Cut Set Prob. Basic Event Description Event Prob.

66 48.16 0.17 1.11E-08 IE_LOMC 1.00E+00 Operator fails to trip charging pump(s) prior to challenging PZR G-PMOA-TRIP-PUMP 6.80E-03 SRVs PZR SAFETY VALVE RV-1039 FTC (GIVEN SPURIOUS W-RVMB-RV-1039 3.69E-03 DEMAND)

Y-AVMD-CV-3056 AIR OPERATED VALVE CV-3056 FAILS TO REMAIN OPEN 4.44E-04 67 48.33 0.17 1.11E-08 IE_LOMC 1.00E+00 Operator fails to trip charging pump(s) prior to challenging PZR G-PMOA-TRIP-PUMP 6.80E-03 SRVs PZR SAFETY VALVE RV-1041 FTC (GIVEN SPURIOUS W-RVMB-RV-1041 3.69E-03 DEMAND)

Y-AVMD-CV-3027 AIR OPERATED VALVE CV-3027 FAILS TO REMAIN OPEN 4.44E-04 68 48.5 0.17 1.11E-08 IE_LOMC 1.00E+00 Operator fails to trip charging pump(s) prior to challenging PZR G-PMOA-TRIP-PUMP 6.80E-03 SRVs PZR SAFETY VALVE RV-1040 FTC (GIVEN SPURIOUS W-RVMB-RV-1040 3.69E-03 DEMAND)

Y-AVMD-CV-3027 AIR OPERATED VALVE CV-3027 FAILS TO REMAIN OPEN 4.44E-04 69 48.67 0.17 1.11E-08 IE_LOMC 1.00E+00 Operator fails to trip charging pump(s) prior to challenging PZR G-PMOA-TRIP-PUMP 6.80E-03 SRVs PZR SAFETY VALVE RV-1039 FTC (GIVEN SPURIOUS W-RVMB-RV-1039 3.69E-03 DEMAND)

Y-AVMD-CV-3027 AIR OPERATED VALVE CV-3027 FAILS TO REMAIN OPEN 4.44E-04 70 48.84 0.17 1.11E-08 IE_LOMC 1.00E+00 B-RVMB-SRV-SGB ONE SAFETY RELIEF VALVE ON SG B FTC 3.69E-03 D-BCMT-ED-15 BATTERY CHARGER #1 FAILS TO FUNCTION 1.00E+00 D-BCMT-ED-17 BATTERY CHARGER #3 FAILS TO FUNCTION 1.00E-01 D-HSMC-HS-72-01 HAND SWITCH 72-01 FAILS TO REMAIN CLOSED 1.00E-01

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 08 - Page 19 of 28 Table A08-1: Top 100 Cutsets Cut No. % Total % Cut Set Prob. Basic Event Description Event Prob.

OPERATOR FAILS TO START A COMPRESSOR (SCREENING I-CMOE-IA-COMPS 1.00E-01 VALUE)

O-OLMK-49-2625 THERMAL FUSE 49-2625 FAILS OPEN 3.01E-03 X-HSE-SGB-BLDN SET TO 'T' - ESDE ON SG E-50B (House Event) 1.00E+00 71 49.01 0.17 1.11E-08 IE_LOMC 1.00E+00 B-RVMB-SRV-SGA ONE SAFETY RELIEF VALVE ON SG A FTC 3.69E-03 D-BCMT-ED-15 BATTERY CHARGER #1 FAILS TO FUNCTION 1.00E+00 D-BCMT-ED-17 BATTERY CHARGER #3 FAILS TO FUNCTION 1.00E-01 D-HSMC-HS-72-01 HAND SWITCH 72-01 FAILS TO REMAIN CLOSED 1.00E-01 OPERATOR FAILS TO START A COMPRESSOR (SCREENING I-CMOE-IA-COMPS 1.00E-01 VALUE)

O-OLMK-49-2625 THERMAL FUSE 49-2625 FAILS OPEN 3.01E-03 X-HSE-SGA-BLDN SET TO 'T' - ESDE ON SG E-50A (House Event) 1.00E+00 72 49.18 0.17 1.10E-08 IE_LOMC 1.00E+00 B-RVMB-SRV-SGA ONE SAFETY RELIEF VALVE ON SG A FTC 3.69E-03 D-BCMT-ED-15 BATTERY CHARGER #1 FAILS TO FUNCTION 1.00E+00 D-BCMT-ED-17 BATTERY CHARGER #3 FAILS TO FUNCTION 1.00E-01 D-HSMC-HS-72-01 HAND SWITCH 72-01 FAILS TO REMAIN CLOSED 1.00E-01 OPERATOR FAILS TO START A COMPRESSOR (SCREENING I-CMOE-IA-COMPS 1.00E-01 VALUE)

X-HSE-SGA-BLDN SET TO 'T' - ESDE ON SG E-50A (House Event) 1.00E+00 Z-AVMA-CV-3029 CV-3029 AIR VALVE FAILS TO OPEN 2.99E-03 73 49.35 0.17 1.10E-08 IE_LOMC 1.00E+00 B-RVMB-SRV-SGB ONE SAFETY RELIEF VALVE ON SG B FTC 3.69E-03 D-BCMT-ED-15 BATTERY CHARGER #1 FAILS TO FUNCTION 1.00E+00

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 08 - Page 20 of 28 Table A08-1: Top 100 Cutsets Cut No. % Total % Cut Set Prob. Basic Event Description Event Prob.

D-BCMT-ED-17 BATTERY CHARGER #3 FAILS TO FUNCTION 1.00E-01 D-HSMC-HS-72-01 HAND SWITCH 72-01 FAILS TO REMAIN CLOSED 1.00E-01 OPERATOR FAILS TO START A COMPRESSOR (SCREENING I-CMOE-IA-COMPS 1.00E-01 VALUE)

X-HSE-SGB-BLDN SET TO 'T' - ESDE ON SG E-50B (House Event) 1.00E+00 Z-AVMA-CV-3029 CV-3029 AIR VALVE FAILS TO OPEN 2.99E-03 74 49.52 0.17 1.07E-08 IE_LOMC 1.00E+00 B-RVMB-SRV-SGB ONE SAFETY RELIEF VALVE ON SG B FTC 3.69E-03 D-BCMT-ED-15 BATTERY CHARGER #1 FAILS TO FUNCTION 1.00E+00 D-BCMT-ED-17 BATTERY CHARGER #3 FAILS TO FUNCTION 1.00E-01 D-HSMC-HS-72-01 HAND SWITCH 72-01 FAILS TO REMAIN CLOSED 1.00E-01 H-ZZOA-OTC-INIT OPERATOR FAILS TO INITIATE ONCE THROUGH COOLING 2.90E-03 OPERATOR FAILS TO START A COMPRESSOR (SCREENING I-CMOE-IA-COMPS 1.00E-01 VALUE)

X-HSE-SGB-BLDN SET TO 'T' - ESDE ON SG E-50B (House Event) 1.00E+00 75 49.69 0.17 1.07E-08 IE_LOMC 1.00E+00 B-RVMB-SRV-SGA ONE SAFETY RELIEF VALVE ON SG A FTC 3.69E-03 D-BCMT-ED-15 BATTERY CHARGER #1 FAILS TO FUNCTION 1.00E+00 D-BCMT-ED-17 BATTERY CHARGER #3 FAILS TO FUNCTION 1.00E-01 D-HSMC-HS-72-01 HAND SWITCH 72-01 FAILS TO REMAIN CLOSED 1.00E-01 H-ZZOA-OTC-INIT OPERATOR FAILS TO INITIATE ONCE THROUGH COOLING 2.90E-03 OPERATOR FAILS TO START A COMPRESSOR (SCREENING I-CMOE-IA-COMPS 1.00E-01 VALUE)

X-HSE-SGA-BLDN SET TO 'T' - ESDE ON SG E-50A (House Event) 1.00E+00 76 49.85 0.16 1.05E-08 IE_LOMC 1.00E+00

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 08 - Page 21 of 28 Table A08-1: Top 100 Cutsets Cut No. % Total % Cut Set Prob. Basic Event Description Event Prob.

A-PMMG-P-8B AFW TURBINE PUMP P-8B FAILS TO RUN 5.82E-02 D-BCMT-ED-15 BATTERY CHARGER #1 FAILS TO FUNCTION 1.00E+00 D-BCMT-ED-17 BATTERY CHARGER #3 FAILS TO FUNCTION 1.00E-01 D-HSMC-HS-72-01 HAND SWITCH 72-01 FAILS TO REMAIN CLOSED 1.00E-01 Y-PMCC-P8C66A-ME COMMON CAUSE FAILURE OF P-8C AND P-66A TO START 1.81E-05 77 50.01 0.16 1.03E-08 IE_LOMC 1.00E+00 OPERATOR FAILS TO ADJUST AFW FLOW GIVEN FLOW A-AVOA-MISCALADJ 1.45E-03 INSTRUMENT MISC COMMON CAUSE FAILURE OF ALL 3 AFW PUMPS P-8A/B/C A-PMCC-P8ABC-ME 5.45E-05 TO START COND HEP: A-AVOA-MISCALADJ

M-OOOT-LPF-INIT

H-H-ZZOA-OTC-CDTNL-HEP-3 5.44E-01 ZZOA-OTC-INIT COND HEP: A-AVOA-MISCALADJ

M-OOOT-LPF-INIT

H-M-OOOT-LPF-CDTNL-HEP-1 2.39E-01 AVOA-HPISUBCLG 78 50.17 0.16 9.99E-09 IE_LOMC 1.00E+00 B-RVMB-SRV-SGB ONE SAFETY RELIEF VALVE ON SG B FTC 3.69E-03 D-BCMT-ED-15 BATTERY CHARGER #1 FAILS TO FUNCTION 1.00E+00 D-BCMT-ED-17 BATTERY CHARGER #3 FAILS TO FUNCTION 1.00E-01 D-HSMC-HS-72-01 HAND SWITCH 72-01 FAILS TO REMAIN CLOSED 1.00E-01 OPERATOR FAILS TO START A COMPRESSOR (SCREENING I-CMOE-IA-COMPS 1.00E-01 VALUE)

CIRCUIT BREAKER 52-2625 (480V) FAILS TO REMAIN O-C2MC-52-2625 2.71E-03 CLOSED X-HSE-SGB-BLDN SET TO 'T' - ESDE ON SG E-50B (House Event) 1.00E+00 79 50.33 0.16 9.99E-09 IE_LOMC 1.00E+00 B-RVMB-SRV-SGA ONE SAFETY RELIEF VALVE ON SG A FTC 3.69E-03 D-BCMT-ED-15 BATTERY CHARGER #1 FAILS TO FUNCTION 1.00E+00 D-BCMT-ED-17 BATTERY CHARGER #3 FAILS TO FUNCTION 1.00E-01

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 08 - Page 22 of 28 Table A08-1: Top 100 Cutsets Cut No. % Total % Cut Set Prob. Basic Event Description Event Prob.

D-HSMC-HS-72-01 HAND SWITCH 72-01 FAILS TO REMAIN CLOSED 1.00E-01 OPERATOR FAILS TO START A COMPRESSOR (SCREENING I-CMOE-IA-COMPS 1.00E-01 VALUE)

CIRCUIT BREAKER 52-2625 (480V) FAILS TO REMAIN O-C2MC-52-2625 2.71E-03 CLOSED X-HSE-SGA-BLDN SET TO 'T' - ESDE ON SG E-50A (House Event) 1.00E+00 80 50.48 0.15 9.79E-09 IE_LOMC 1.00E+00 A-PMMG-P-8B AFW TURBINE PUMP P-8B FAILS TO RUN 5.82E-02 P-PAMK-EY-10 FAULT ON 120V PREFERRED AC BUS Y10 3.30E-02 P-PAMK-EY-30 FAULT ON 120V PREFERRED AC BUS Y30 1.00E-01 Y-PMCC-P8C66ABME COMMON CAUSE FAILURE OF P-8C 5.10E-05 81 50.63 0.15 9.69E-09 IE_LOMC 1.00E+00 B-RVMB-SRV-SGB ONE SAFETY RELIEF VALVE ON SG B FTC 3.69E-03 D-BCMT-ED-15 BATTERY CHARGER #1 FAILS TO FUNCTION 1.00E+00 D-BCMT-ED-17 BATTERY CHARGER #3 FAILS TO FUNCTION 1.00E-01 D-HSMC-HS-72-01 HAND SWITCH 72-01 FAILS TO REMAIN CLOSED 1.00E-01 H-PMOO-P-66A HPSI PUMP P-66A OUT OF SERVICE FOR MAINTENANCE 2.63E-03 OPERATOR FAILS TO START A COMPRESSOR (SCREENING I-CMOE-IA-COMPS 1.00E-01 VALUE)

X-HSE-SGB-BLDN SET TO 'T' - ESDE ON SG E-50B (House Event) 1.00E+00 82 50.78 0.15 9.69E-09 IE_LOMC 1.00E+00 B-RVMB-SRV-SGA ONE SAFETY RELIEF VALVE ON SG A FTC 3.69E-03 D-BCMT-ED-15 BATTERY CHARGER #1 FAILS TO FUNCTION 1.00E+00 D-BCMT-ED-17 BATTERY CHARGER #3 FAILS TO FUNCTION 1.00E-01 D-HSMC-HS-72-01 HAND SWITCH 72-01 FAILS TO REMAIN CLOSED 1.00E-01

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 08 - Page 23 of 28 Table A08-1: Top 100 Cutsets Cut No. % Total % Cut Set Prob. Basic Event Description Event Prob.

H-PMOO-P-66A HPSI PUMP P-66A OUT OF SERVICE FOR MAINTENANCE 2.63E-03 OPERATOR FAILS TO START A COMPRESSOR (SCREENING I-CMOE-IA-COMPS 1.00E-01 VALUE)

X-HSE-SGA-BLDN SET TO 'T' - ESDE ON SG E-50A (House Event) 1.00E+00 83 50.92 0.14 9.27E-09 IE_LOMC 1.00E+00 COMMON CAUSE FAILURE OF ALL 3 AFW PUMPS P-8A/B/C A-PMCC-P8ABC-ME 5.45E-05 TO START COMMON CAUSE FAILURE OF BOTH ISOLATION VALVES TO O-MVCC-BLKVLV-MA 1.70E-04 OPEN 84 51.06 0.14 9.05E-09 IE_LOMC 1.00E+00 A-PMME-P-936 P-936 FAILS TO START 3.29E-03 U-FLCC-TRAV-SCRN COMMON CAUSE FAILURE OF TRAVELING SCREENS 2.75E-06 85 51.2 0.14 8.98E-09 IE_LOMC 1.00E+00 A-PMMG-P-8B AFW TURBINE PUMP P-8B FAILS TO RUN 5.82E-02 EDG1-1 EDG1-2 AND NSR COMMON CAUSE FAILURE TO E-DGCC-K-6A&B&NSR-MG 3.44E-04 RUN SET TO 'T' -EDG11 RUN FAILURES ARE MODELED (House E-HSE-EDG11-RUN 1.00E+00 Event)

SET TO 'T' -EDG12 RUN FAILURES ARE MODELED (House E-HSE-EDG12-RUN 1.00E+00 Event)

LOOP COINCIDENT WITH ANOTHER IEVENT (24 HR P-LOOP-24HR 4.48E-04 MISSION TIME) 86 51.34 0.14 8.93E-09 IE_LOMC 1.00E+00 A-PMME-P-8C AFW PUMP P-8C FAILS TO START 1.65E-03 A-PMMG-P-8B AFW TURBINE PUMP P-8B FAILS TO RUN 5.82E-02 D-BCMT-ED-15 BATTERY CHARGER #1 FAILS TO FUNCTION 1.00E+00 D-BCMT-ED-17 BATTERY CHARGER #3 FAILS TO FUNCTION 1.00E-01 D-HSMC-HS-72-01 HAND SWITCH 72-01 FAILS TO REMAIN CLOSED 1.00E-01

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 08 - Page 24 of 28 Table A08-1: Top 100 Cutsets Cut No. % Total % Cut Set Prob. Basic Event Description Event Prob.

PRV-1043B POWER OPERATED RELIEF VALVE FAILS TO O-RVMA-PRV-1043B 9.29E-03 OPEN 87 51.48 0.14 8.71E-09 IE_LOMC 1.00E+00 AFW PUMP P-8C CIRCUIT BREAKER 152-209 FAILS TO A-C2MB-152-209 1.61E-03 CLOSE A-PMMG-P-8B AFW TURBINE PUMP P-8B FAILS TO RUN 5.82E-02 D-BCMT-ED-15 BATTERY CHARGER #1 FAILS TO FUNCTION 1.00E+00 D-BCMT-ED-17 BATTERY CHARGER #3 FAILS TO FUNCTION 1.00E-01 D-HSMC-HS-72-01 HAND SWITCH 72-01 FAILS TO REMAIN CLOSED 1.00E-01 PRV-1043B POWER OPERATED RELIEF VALVE FAILS TO O-RVMA-PRV-1043B 9.29E-03 OPEN 88 51.61 0.13 8.67E-09 IE_LOMC 1.00E+00 A-PMMG-P-8B AFW TURBINE PUMP P-8B FAILS TO RUN 5.82E-02 D-BCMT-ED-15 BATTERY CHARGER #1 FAILS TO FUNCTION 1.00E+00 D-BCMT-ED-17 BATTERY CHARGER #3 FAILS TO FUNCTION 1.00E-01 D-CBMC-72-403 DC CIRCUIT BREAKER 72-403 FAILS TO REMAIN CLOSED 1.49E-05 D-HSMC-HS-72-01 HAND SWITCH 72-01 FAILS TO REMAIN CLOSED 1.00E-01 89 51.74 0.13 8.63E-09 IE_LOMC 1.00E+00 A-PMMG-P-8B AFW TURBINE PUMP P-8B FAILS TO RUN 5.82E-02 A-PMOO-P-8C AFW PUMP P-8C OUT OF SERVICE 3.35E-03 D-BCMT-ED-15 BATTERY CHARGER #1 FAILS TO FUNCTION 1.00E+00 D-BCMT-ED-17 BATTERY CHARGER #3 FAILS TO FUNCTION 1.00E-01 D-HSMC-HS-72-01 HAND SWITCH 72-01 FAILS TO REMAIN CLOSED 1.00E-01 Y-AVMB-CV-3056 SIRWT RECIRC VALVE CV-3056 FTC 4.42E-03 90 51.87 0.13 8.47E-09 IE_LOMC 1.00E+00

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 08 - Page 25 of 28 Table A08-1: Top 100 Cutsets Cut No. % Total % Cut Set Prob. Basic Event Description Event Prob.

B-HCMA-HIC-0780A SDCR CONTROLLER HIC-0780A FAILS TO DE-ENERGIZE 1.14E-02 OPERATOR FAILS TO CLOSE MANUAL VALVES TO CLOSE B-XVOB-ADVS-MAN 4.03E-02 ADV D-BCMT-ED-15 BATTERY CHARGER #1 FAILS TO FUNCTION 1.00E+00 D-BCMT-ED-17 BATTERY CHARGER #3 FAILS TO FUNCTION 1.00E-01 D-HSMC-HS-72-01 HAND SWITCH 72-01 FAILS TO REMAIN CLOSED 1.00E-01 H-ZZOA-OTC-CDTNL-HEP-4 COND HEP: B-XVOB-ADVS-MAN

H-ZZOA-OTC-INIT 1.85E-02 OPERATOR FAILS TO START A COMPRESSOR (SCREENING I-CMOE-IA-COMPS 1.00E-01 VALUE)

X-HSE-SGB-BLDN SET TO 'T' - ESDE ON SG E-50B (House Event) 1.00E+00 91 52 0.13 8.47E-09 IE_LOMC 1.00E+00 B-HCMA-HIC-0780A SDCR CONTROLLER HIC-0780A FAILS TO DE-ENERGIZE 1.14E-02 OPERATOR FAILS TO CLOSE MANUAL VALVES TO CLOSE B-XVOB-ADVS-MAN 4.03E-02 ADV D-BCMT-ED-15 BATTERY CHARGER #1 FAILS TO FUNCTION 1.00E+00 D-BCMT-ED-17 BATTERY CHARGER #3 FAILS TO FUNCTION 1.00E-01 D-HSMC-HS-72-01 HAND SWITCH 72-01 FAILS TO REMAIN CLOSED 1.00E-01 H-ZZOA-OTC-CDTNL-HEP-4 COND HEP: B-XVOB-ADVS-MAN

H-ZZOA-OTC-INIT 1.85E-02 OPERATOR FAILS TO START A COMPRESSOR (SCREENING I-CMOE-IA-COMPS 1.00E-01 VALUE)

X-HSE-SGA-BLDN SET TO 'T' - ESDE ON SG E-50A (House Event) 1.00E+00 92 52.12 0.12 7.95E-09 IE_LOMC 1.00E+00 A-CVCC-AFWPP3-MA ALL 3 AFW PP CK VALVES CK-FW726 1.07E-05 OPERATOR FAILS TO CLOSE MANUAL VALVES TO CLOSE B-XVOB-ADVS-MAN 4.03E-02 ADV H-ZZOA-OTC-CDTNL-HEP-4 COND HEP: B-XVOB-ADVS-MAN

H-ZZOA-OTC-INIT 1.85E-02 93 52.24 0.12 7.81E-09 IE_LOMC 1.00E+00

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 08 - Page 26 of 28 Table A08-1: Top 100 Cutsets Cut No. % Total % Cut Set Prob. Basic Event Description Event Prob.

A-PMME-P-8B AFW TURBINE PUMP P-8B FAILS TO START 1.53E-02 D-BCMT-ED-15 BATTERY CHARGER #1 FAILS TO FUNCTION 1.00E+00 D-BCMT-ED-17 BATTERY CHARGER #3 FAILS TO FUNCTION 1.00E-01 D-HSMC-HS-72-01 HAND SWITCH 72-01 FAILS TO REMAIN CLOSED 1.00E-01 Y-PMCC-P8C66ABME COMMON CAUSE FAILURE OF P-8C 5.10E-05 94 52.36 0.12 7.68E-09 IE_LOMC 1.00E+00 B-RVMB-SRV-SGB ONE SAFETY RELIEF VALVE ON SG B FTC 3.69E-03 D-BCMT-ED-15 BATTERY CHARGER #1 FAILS TO FUNCTION 1.00E+00 D-BCMT-ED-17 BATTERY CHARGER #3 FAILS TO FUNCTION 1.00E-01 D-HSMC-HS-72-01 HAND SWITCH 72-01 FAILS TO REMAIN CLOSED 1.00E-01 OPERATOR FAILS TO START A COMPRESSOR (SCREENING I-CMOE-IA-COMPS 1.00E-01 VALUE)

Q-FVMD-FCV-3029B FLOW CONTROL VLV FCV-3029B FAILS TO REMAIN OPEN 2.08E-03 X-HSE-SGB-BLDN SET TO 'T' - ESDE ON SG E-50B (House Event) 1.00E+00 95 52.48 0.12 7.68E-09 IE_LOMC 1.00E+00 B-RVMB-SRV-SGA ONE SAFETY RELIEF VALVE ON SG A FTC 3.69E-03 D-BCMT-ED-15 BATTERY CHARGER #1 FAILS TO FUNCTION 1.00E+00 D-BCMT-ED-17 BATTERY CHARGER #3 FAILS TO FUNCTION 1.00E-01 D-HSMC-HS-72-01 HAND SWITCH 72-01 FAILS TO REMAIN CLOSED 1.00E-01 OPERATOR FAILS TO START A COMPRESSOR (SCREENING I-CMOE-IA-COMPS 1.00E-01 VALUE)

Q-FVMD-FCV-3029B FLOW CONTROL VLV FCV-3029B FAILS TO REMAIN OPEN 2.08E-03 X-HSE-SGA-BLDN SET TO 'T' - ESDE ON SG E-50A (House Event) 1.00E+00 96 52.6 0.12 7.67E-09 IE_LOMC 1.00E+00 A-PMMG-P-8B AFW TURBINE PUMP P-8B FAILS TO RUN 5.82E-02

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 08 - Page 27 of 28 Table A08-1: Top 100 Cutsets Cut No. % Total % Cut Set Prob. Basic Event Description Event Prob.

A-PMOO-P-8C AFW PUMP P-8C OUT OF SERVICE 3.35E-03 D-BCMT-ED-15 BATTERY CHARGER #1 FAILS TO FUNCTION 1.00E+00 D-BCMT-ED-17 BATTERY CHARGER #3 FAILS TO FUNCTION 1.00E-01 D-HSMC-HS-72-01 HAND SWITCH 72-01 FAILS TO REMAIN CLOSED 1.00E-01 Z-KVMB-SV-3029A SUMP TO EAST ESS AIR SUPPLY SV-3029A FTE 3.93E-03 97 52.72 0.12 7.67E-09 IE_LOMC 1.00E+00 A-PMMG-P-8B AFW TURBINE PUMP P-8B FAILS TO RUN 5.82E-02 A-PMOO-P-8C AFW PUMP P-8C OUT OF SERVICE 3.35E-03 D-BCMT-ED-15 BATTERY CHARGER #1 FAILS TO FUNCTION 1.00E+00 D-BCMT-ED-17 BATTERY CHARGER #3 FAILS TO FUNCTION 1.00E-01 D-HSMC-HS-72-01 HAND SWITCH 72-01 FAILS TO REMAIN CLOSED 1.00E-01 Z-KVMB-SV-3029B SUMP TO EAST ESS AIR SUPPLY SV-3029B FTE 3.93E-03 98 52.84 0.12 7.67E-09 IE_LOMC 1.00E+00 A-PMMG-P-8B AFW TURBINE PUMP P-8B FAILS TO RUN 5.82E-02 A-PMOO-P-8C AFW PUMP P-8C OUT OF SERVICE 3.35E-03 D-BCMT-ED-15 BATTERY CHARGER #1 FAILS TO FUNCTION 1.00E+00 D-BCMT-ED-17 BATTERY CHARGER #3 FAILS TO FUNCTION 1.00E-01 D-HSMC-HS-72-01 HAND SWITCH 72-01 FAILS TO REMAIN CLOSED 1.00E-01 Y-KVMB-SV-3056B SIRWT RECIRC VALVE SOLENOID SV-3056B FTE 3.93E-03 99 52.96 0.12 7.67E-09 IE_LOMC 1.00E+00 A-PMMG-P-8B AFW TURBINE PUMP P-8B FAILS TO RUN 5.82E-02 A-PMOO-P-8C AFW PUMP P-8C OUT OF SERVICE 3.35E-03 D-BCMT-ED-15 BATTERY CHARGER #1 FAILS TO FUNCTION 1.00E+00

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 08 - Page 28 of 28 Table A08-1: Top 100 Cutsets Cut No. % Total % Cut Set Prob. Basic Event Description Event Prob.

D-BCMT-ED-17 BATTERY CHARGER #3 FAILS TO FUNCTION 1.00E-01 D-HSMC-HS-72-01 HAND SWITCH 72-01 FAILS TO REMAIN CLOSED 1.00E-01 Y-KVMB-SV-3056A SIRWT RECIRC VALVE SOLENOID SV-3056A FTE 3.93E-03 100 53.08 0.12 7.61E-09 IE_LOMC 1.00E+00 COMMON CAUSE FAILURE OF ALL 3 AFW PUMPS P-8A/B/C A-PMCC-P8ABC-ME 5.45E-05 TO START BOTH SIRWT RECIRC VALVES CV-3027 & CV-3056 COMMON Y-AVCC-3027-56MB 1.40E-04 CAUSE FTC

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 09 - Page 1 of 2 9 Sequences Note: Entire table is changed from Revision 0 - revision bars omitted for editorial reasons.

Table A09-1: Sequence Results Event tree Sequence CCDP Count End State TR-MCND 20 1.95E-06 2126 CORE-DAMAGE TR-MCND 18 1.30E-06 1913 CORE-DAMAGE TR-MCND 22-15 1.11E-06 1 CORE-DAMAGE TR-MCND 22-13 5.26E-07 6 CORE-DAMAGE TR-MCND 19 3.44E-07 397 CORE-DAMAGE TR-MCND 8 3.35E-07 669 CORE-DAMAGE TR-MCND 21-09 1.46E-07 76 CORE-DAMAGE TR-MCND 21-02 1.42E-07 156 CORE-DAMAGE TR-MCND 6 1.26E-07 291 CORE-DAMAGE TR-MCND 21-10 1.21E-07 262 CORE-DAMAGE TR-MCND 21-15 1.05E-07 77 CORE-DAMAGE TR-MCND 22-03 9.09E-08 3 CORE-DAMAGE TR-MCND 7 4.63E-08 119 CORE-DAMAGE TR-MCND 22-14 4.14E-08 1 CORE-DAMAGE TR-MCND 5 4.10E-08 72 CORE-DAMAGE TR-MCND 22-05 1.66E-08 1 CORE-DAMAGE TR-MCND 22-04 7.15E-09 1 CORE-DAMAGE TR-MCND 22-16 4.73E-09 1 CORE-DAMAGE TR-MCND 21-20 3.99E-09 16 CORE-DAMAGE TR-MCND 22-10 1.93E-09 1 CORE-DAMAGE TR-MCND 21-19 1.10E-09 6 CORE-DAMAGE TR-MCND 22-08 9.15E-10 1 CORE-DAMAGE TR-MCND 22-06 8.18E-10 1 CORE-DAMAGE TR-MCND 17 6.75E-10 5 CORE-DAMAGE TR-MCND 21-07 6.67E-10 5 CORE-DAMAGE TR-MCND 21-18 2.22E-10 2 CORE-DAMAGE

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 09 - Page 2 of 2 Sequence Key:

XX Transient with Loss of Main Condenser (TR-MCND) 21-XX LOCA via Pressurizer Safety Relief Valve(s) (XFR-SBLOCA-SRV) 22-XX Anticipated Transient Without SCRAM (XFR-ATWS)

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 10 - Page 1 of 5 Attachment 10: Auxiliary Feedwater Flow Rate to Steam Generators E-50A and E-50B Following the Failure of Panel ED-11-2 on September 25, 2011 1.0 PURPOSE Flow rate indication from the P-8A and P-8B auxiliary feedwater (AFW) pump train was lost for a period of time following the failure of dc panel ED-11-2 on September 25, 2011. It was known that the P-8C pump train was providing relatively equal flow to both steam generators and its associated flow control valves were functioning normally. Pump P-8B started automatically due to the loss of dc power, which also caused its flow control valves to fully open. The P-8B flow rate to the steam generators for this configuration was not known, and the reason for steam generator E-50A level increasing (40% to 90%)

significantly more than E-50B (35% to 60%) was not understood. (Note: E-50A and E-50B levels were observed at 40% and 35% during EOP-1.0 (~1515).)

This evaluation utilizes the AFW system Pipe-Flo hydraulic model to establish AFW flow rates to the steam generators as a function of time and dome pressure for input to the Modular Accident Analysis Program (MAAP) model.

2.0 INPUT 2.1 Hydraulic Model The Pipe-Flo Professional 2007 base-deck hydraulic model of the Auxiliary Feedwater system, as developed in EA-PSA-PIPEFLO-AFW-08-06 [1], was used for the evaluation. Pipe-Flo is classified level A (safety related software) in accordance with EN-IT-104. The software quality assurance plan is found in [1].

2.2 Condensate Storage Tank Temperature The condensate storage tank (T-2) temperature was 87F as recorded in the electronic operator rounds (eSOMS) at 0752 on 9-25-2011.

2.3 Steam Generator Pressure and P-8C Flow Rate Data Steam generator pressures were obtained from the PI data archive. PI is classified as SQA category C (important to business) in accordance with Entergy procedure EN-IT-104. The plant process computer (PPC) is classified as SQA category B system (regulatory commitments). The PPC is the PI data source. Most PPC points are calibrated via technical specification surveillance procedure or preventive maintenance and controlled calibration sheets.

Part of the PI server system runs on the PPC. This portion monitors selected points every second to test against the exception threshold change value. If the change value is exceeded, the data is passed to the PI server and recorded. The PI server also compares the new value against previous values to see if it still fits on a line within the compression limit. If yes, the data is discarded, otherwise it is added to the archive. For pump starts, the compression limit is simply a change in state (on-off or start-stopped).If 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months have passed without an archive update, one is made regardless. PI generally provides accurate long term values and greater amounts of data when events are changing rapidly.

For this analysis, PI server tags PT0751B (Steam Generator E-50A Pressure), PT0752B (Steam Generator E-50B Pressure), FT0737 (AFW Flow to Steam Generator E-50A) and FT0736 (AFW Flow to

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 10 - Page 2 of 5 Steam Generator E-50B) were used to extract sampled data from the PI archive for the period in which P-8B AFW pump was in service on 9-25-2011 (Per Attachment 01 of this analysis P-8C was in service from 15:06 - 15:44). Values shown in Table 2.3-1 are averages over each time period.

Table 2.3-1: PI Archive Average Steam Generator Pressure and P-8C Flow Rate Data 15:06 - 15:20 15:21 - 15:29 15:30-15:39 15:40-16:03 P-8C P-8C P-8C P-8C Pressure Pressure Pressure Pressure Flow Rate Flow Rate Flow Rate Flow Rate (psig) (psig) (psig) (psig)

(gpm) (gpm) (gpm) (gpm)

E-50A 948.3 163.4 923.4 164.8 896.9 152.1 859.9 0 E-50B 945.0 162.5 955.7 159.8 969.4 161.7 958.2 163.4 3.0 ASSUMPTIONS 3.1 Major Assumptions 3.1.1 Auxiliary feedwater system flow control valves CV-0727 and CV-0749 are fully open from event initiation at 15:06 until steam was isolated to the P-8B steam turbine at an estimated time of 16:03.

Basis: A review of electrical schematics by system experts and operations staff found the flow control valves fail in the fully open position on loss of dc power. Steam isolation to the P-8B turbine driver occurred at approximately 16:03 based on a review of operator logs and interviews. See Attachment 01 for the event time line.

Bias: This assumption is neutral as it represents a realistic event based on the best available information.

3.2 Minor Assumptions 3.2.1 For the purpose of establishing the pump suction pressure and recirculation boundary conditions, condensate storage tank (T-2) level is assumed to remain at 82% level. This equates to a level of 274 above the tank bottom [2] (approximately 9.9 psig at the 590 elevation). With respect to the modeled P-8B recirculation node, this would equate to 13.8 psig as its elevation is at 581 feet. The P-8C recirculation node is at 583 feet, so its boundary pressure is 12.9 psig.

Basis: This level was recorded in the electronic operator rounds (SOMS) database at 10:41 on the day of the event. During the event, level indication was lost.

Bias: This assumption is neutral and has a negligible impact on calculated flow rates. Pump flow rate is normally set by the flow control valves, but it is primarily a function of steam generator pressure when the flow control valves are fully open.

3.2.2 All pump curves used in the model are assumed to be nominal (e.g. the pumps have no performance degradation from typical surveillance test results). Pipe-Flo model pump curve data points were obtained from [1].

Basis: Palisades pump in-service test (IST) data has consistently demonstrated that all pumps in the AFW system perform slightly below manufacturers factory test data. This can be demonstrated by a review of EA-EC82841-02 Rev. 0, Auxiliary Feedwater System Capacity, Appendix A. The pump curve data plotted in this analysis illustrates consistent pump performance over several years. Although

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 10 - Page 3 of 5 some degradation of the pumps is allowed by the IST procedure, which is accounted for in design basis analyses, the actual pump performance has been consistently nominal.

Bias: This assumption is neutral as it results in a realistic evaluation of the pump condition.

3.2.3 Dynamic head loss from the steam generator dome to the main steam safety valves is neglected.

Basis: Reference [4] calculates the dynamic head loss between the steam dome and the main steam safety valves to be 19.9 psid. This analysis accounts for safety valve accumulation and piping losses based on a steam flow rate shortly after a plant trip. Application of this additional pressure to the steam generator boundary condition is deemed overly conservative as it considers the main steam safety valves are fully open for the duration of the event and applies a constant decay heat value for steaming.

Realistically, the safety valves are only open for short periods of time, or in an intermediate throttle position for longer periods, and decay heat decreases over time.

Bias: This assumption is neutral. Applying the dynamic head loss value would be overly conservative and unrealistically reduce the P-8B flow rate to the steam generators.

4.0 ANALYSIS 4.1 Pipe-Flo Model Balancing to Test Data with Fully Open Flow Control Valves Typically, the AFW system is operated by setting the flow control valves to a specific flow rate. To account for line losses and the pressure drop through the flow control valves in the wide open position, flow elements based on Special Test T-202 [3] were developed here.

The T-202 test was performed to determine the system flow rate to a single steam generator with a flow control valve in the full open position and flow to the other steam generator isolated. Although the test was performed using only P-8A, the P-8A/P-8B pump train share common discharge piping and flow control valves. The pumps are also adjacent to each other in the AFW pump room; therefore, any variations in line losses between the two are negligible.

To determine system the pressure drop under the test conditions, simulated flow control valves were inserted into the Pipe-Flo model [1] at pipelines 180 and 210 and set at the test measured flow rate.

Table 4.1-1: Special Test T-202 Test Results Flow Rate to E-50A E-50A Dome Flow Rate to E-50B E-50B Dome T-2 T-2 Level (ft)

(gpm) Pressure (psia) (gpm) Pressure (psia) Temperature (F) 418.6 889.7 427.3 856.3 608.14 85 With the Pipe-Flo model aligned per the test configuration and boundary conditions established as shown in Table 4.0-1, the modeled flow control valves calculated a pressure drop of 68.89 psid in line 210 (flow to E-50A) and 83.73 psid in line 180 (flow to E-50B) would be required to establish the measured flow rate [1].

Using the calculated differential pressure and measured flow rate from T-202, reference [1] calculated fixed loss coefficients (K) in the pipelines as shown in Table 4.0-2.

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 10 - Page 4 of 5 Table 4.0-2: Pipe-Flo Model Flow Elements Based on T-202 Data Loss Coefficient CV-0749 Inserted in Pipeline 210 Loss Coefficient CV-0727 Inserted in Pipeline 180 Differential Pressure (psid) Equivalent K Differential Pressure (psid) Equivalent K 83.7 87.4 68.9 75.1 This approach allows the model to calculate the head loss through the open flow control valve component for flow rates other than those measured in the test.

4.2 Auxiliary Feedwater Pump P-8C Flow Control Valve Modeling Flow rate data was recorded from the P-8C AFW pump to both E-50A and E-50B for the duration of the event as shown in Table 2.3-1. To model these flow rates, Pipe-Flo flow control valves were inserted in the model at node 34 (CV-0737A) and node 29 (CV-0736A). The Pipe-Flo flow control valves establish a differential pressure in the model pipeline to match the user entered flow rate.

5.0 CONCLUSION

Using the inputs and boundary conditions presented above, four Pipe-Flo model cases were developed.

Each case represents a time segment from event initiation to the estimated time steam to the P-8B turbine was isolated. Boundary conditions and Pipe-Flo analysis results are presented in Table 5.0-1. The Pipe-Flo calculated values are for flow rates from P-8B and total flow to each steam generator.

Table 5.0-1: AFW System Flow Rates Following D11-2 Failure Event T-2 P-8B P-8B P-8C P-8C Total Total T-2 (system) E-50A E-50B Flow Flow Flow Flow Flow Flow Time Pressure Pressure Pressure Rate to Rate to Rate to Rate to Rate to Rate to Temp.

(psig) (psig) (psig) E-50A E-50B E-50A E-50B E-50A E-50B (F) (gpm) (gpm) (gpm) (gpm) (gpm) (gpm) 15:06-9.9 87 948.3 945 178.7 187.2 163.4 162.5 342.1 349.7 15:20 15:21-9.9 87 923.4 955.7 254.3 113.5 164.8 159.8 419.1 273.3 15:29 15:30-9.9 87 896.9 969.4 342.7 23.4 152.1 161.7 494.8 185.1 15:39 15:40-9.9 87 859.9 958.2 379.4 0 0 163.4 379.4 163.4 16:03

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 10 - Page 5 of 5

6.0 REFERENCES

[1] EA-PSA-PIPEFLO-AFW-08-06 Rev. 0, Pipe-Flo Professional 2007a Hydraulic Model of the Auxiliary Feedwater System and Software Quality Assurance Documentation.

[2] M-398 Sh. 20, Level Setting Diagram Condensate Storage Tank T-2.

[3] Test Report, Palisades Special Test T-202, Auxiliary Feedwater P-8A and P-8C System Flow Characteristics, Test Performed on December 2, 1986, report dated 3/5/87 (7613/2206).

[4] EA-EC82841-02, Revision 0, Auxiliary Feedwater System Capacity.

7.0 APPENDICES Att. 10 - App. A.pdf

[A] Pipe-Flo Lineup Report and Flo-Sheet for Case 15:06 - 15:20 (7 pages)

Att. 10 - App. B.pdf

[B] Pipe-Flo Lineup Report and Flo-Sheet for Case 15:21 - 15:29 (7 pages)

Att. 10 - App. C.pdf

[C] Pipe-Flo Lineup Report and Flo-Sheet for Case 15:30 - 15:39 (7 pages)

Att. 10 - App. D.pdf

[D] Pipe-Flo Lineup Report and Flo-Sheet for Case 15:40 - 16:03 (7 pages)

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 11 - Page 1 of 2 1 Review of NRC Timeline and Affected Equipment List By letter dated November 29 [1], the NRC published an event timeline and a list of major affected equipment for the 09/25/2011 dc panel ED-11-2 fault event.

The timeline and effected equipment list are reviewed against the current best available information in the annotated documents appended below.

Review Process The review was performed by the PRA group Ops representative, who also developed and independently verified the event timeline and associated plant parameters. The PRA group Ops representative is a former Palisades SRO and has served as a Palisades Shift Manager and Operations Superintendent.

The timeline was developed using process information (PI) data, plant process computer data (PPC),

operator logs (eSOMS), and control room recorder instrumentation. The timeline was verified by extensive on-shift crew interviews/discussions, the Ops reconstruction meeting, and crew peer check of indicated event times, parameters, and crew motivation/awareness.

Review Findings The human error analysis for controlling pressurizer level has a significant impact on the overall risk result. Gaining control of pressurizer level soon enough avoids challenging pressurizer safety relief valves. This eliminates the potential for a stuck open relief valve LOCA.

An important input to the NRC analysis is the belief that the time available to complete the action was equal to the time actually taken to complete action. This limits the analysis to one attempt to complete the action and results in no margin for error recovery.

Our analysis shows much more time was available. The action in our analysis is throttling (terminating) charging flow. This action takes several minutes (2 minutes). Timeline analysis shows the time available to complete the action was 40 minutes. This provides sufficient time to take the action, assess the success/failure of the action and still recover if unsuccessful.

The NRC belief may have been based on the assumption charging was providing 133 gpm to the PCS for an extended period of time - up to the point of challenging the pressurizer safeties. This may be artifact of erroneous or out-of-context information that was collected in the initial event response evaluation: early in the event investigation all three charging pumps were thought to be running.

Our evaluation of the event response and timeline determined only charging pumps P-55A and P-55B were operating during the event. Pump P-55C never ran during the event response. Charging was never higher than 93 gpm (P-55A and P-55B at maximum flow) and reduced to 73 gpm (P-55A and P-55B at minimum flow) at 15:37 when channel B pressurizer level control was placed in service. Charging was reduced to 0 gpm when charging pumps were tripped at 15:57.

In addition, NRC believes the condition diagnosis and action execution to be moderately complex, based on the NRC discussion of factors influencing the human error analysis. However, operators were aware of the condition early in the event and the diagnosis of what to do given indicated high pressurizer level is not complex. In addition, the action to trip charging pumps is simple, straightforward and not complex.

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 11 - Page 2 of 2 Palisades Event Timeline (NRC Att. 3)

Appendix 11-1: Annotated NRC Event Timeline Major Affected Equip. (NRC Att. 7)

Appendix 11-2: Annotated NRC List of Affected Major Equipment.

References

[1] Letter from U.S. NRC (Steven West) to Entergy Nuclear Operations, Inc. (Anthony Vitale),

Subject:

Palisades Nuclear Plant - NRC Special Inspection Team (SIT) Report 05000255/2011014 Preliminary Yellow Finding, Dated: November 29, 2011.

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 12 - Page 1 of 26 2 HRA Calculator Output for Developed HEPs This attachment contains the EPRI HRA Calculator output for the failure to trip charging pump HEP, and failure to align EY-10 to the bypass regulator, and failure to align an alternate charger, as discussed in Section 6.3.

References

[1] EPRI HRA Calculator', Version 4.0, Electric Power Software Center, 9625 Research Drive, Charlotte, NC 28262.

EPRI HRA Calculator 4.0 1/5/20121/5/2012 CVC-PMOA-P55-TRIP-S, OP FAILS TO STOP CHARGING PUMP OPERATION (HEP)

Cognitive Method Date Analyst - Reviewer CBDTM/ASEP/THERP 12/07/11 FJY - BAB Analysis File File Date File Size (Bytes)

Pal_Post_HEPs_r3 1-5-11.HRA 12/07/11 5935104 Table 1: CVC-PMOA-P55-TRIP-S

SUMMARY

Analysis Method: CBDTM/ASEP Combination (Sum)

Analysis Database: Pal_Post_HEPs_r3 1-5-11.HRA (12/07/11, 5935104 Bytes)

Analysis Results: without Recovery with Recovery Pcog-CBDTM 6.8e-03 3.1e-04 Pcog-ASEP 1.9e-03 1.9e-03 Pexe 2.0e-02 4.6e-03 Total HEP 6.8e-03 Error Factor 5 Identification and Definition This HEP is modified from the base case to replicate the conditions of the 9/25/2011 loss of dc event. As a result of the loss of dc and preferred ac power in this event an additional charging pump started on a right channel safety injection signal. Letdown was isolated when CV-2009 closed due a right channel containment high radiation signal. Consequently the event results in a charging letdown flow mismatch which results in a continuous rise in pressurizer level. This condition requires the operator action to control charging to regain control of pressurizer level prior to challenging a pressurizer safety. The timing regarding this action is provided under the time window description. This action is the same as the base case action under different conditions with the same indications and alternate timing as described in the 'Time Window' discussion.

In response to annunciator LETDOWN HT EX TUBE INLET HI-LO PRESS, EK-0704 operators would observe charging and letdown flow and place all 3 orifice valve control switches to CLOSE per ARP-4. The ARP then directs restoring charging and letdown when desired per SOP-2A. If P-55A is not stopped, PZR level will continue rising.

a. SOP-2A Section 7.3.9 TO RESTORE LETDOWN provides direction for restoring letdown flow. There is no stated procedural link between the ARPs and SOP-2A Section 7.3.8 ISOLATE LETDOWN AT RATED CONDITIONS. However, this section does provide direction to successfully mitigate this condition and may be referred to as the title describes the existing condition.

b. In the event action is not taken to manually control charging flow, PZR level will continue rising and the PRESSURIZER LEVEL HI-LO, EK-0761 annunciator will alarm at 62.75% level, and then annunciator PRESSURIZER HIGH LEVEL, EK-0769 will alarm at 75% level. ARP response for these annunciators directs the operator to SHIFT level level control to the channel not in service. Additionally direction is provided that manual control may be necessary.

On reactor trip the operators enter EOP-1.0 STANDARD POST-TRIP ACTIONS. Immediate Actions Step 5 directs the operator to manually control charging and letdown to maintain PZR level between 42% and 57%, at which time they take manual control of the charging pumps.

1. Initial Conditions: Steady state, full power operations Analysis File: Pal_Post_HEPs_r3 1-5-11.HRA (12/07/11, 5935104 Bytes) 2

EPRI HRA Calculator 4.0 1/5/20121/5/2012

2. Initiating Event: Malfunction occurs spuriously isolating letdown.

3. Accident Sequence (preceding functional failures and successes):

LETDOWN HT EX TUBE OUTLET HI-LO PRESS EK-0704 annunciators alarms.

ARP-4 provides guidance that the operator may have to to manually control pressure and RESTORE Charging and Letdown in a controlled manner per SOP-2A.

In this scenario, failure to trip charging pump(s) would challenge pressurizer safeties.

4. Preceding operator errors or successes in sequence: No operator errors or additional successes noted.

5. Operator action success criterion: Success is tripping charging pumps P-55B, C and/or A as necessary to restore level to the normal operating band .

6. Consequences of failure: SORV, LOCA, and potential for core damage.

Assigned Basic Events Cues and Indications Initial Cue EK-0704, LETDOWN HT EX TUBE OUTLET HI-LO PRESS Recovery Cue Pump breaker status indicating lights on panel EC-02.

Charging flow indication FIC-0202 on panel EC-02.

Pressurizer level indication LIC-0101A/B (narrow range on EC-02), LI-0103A (wide range, on EC-02) and LIA-0102A (wide range on panel EC-12).

Cue/s In response to annunciator LETDOWN HT EX TUBE INLET HI-LO PRESS, EK-0704 operators would observe charging and letdown flow and place all 3 orifice valve control switches to CLOSE per ARP-4. The ARP then directs restoring charging and letdown when desired per SOP-2A.

If P-55A is not stopped, PZR level will continue rising.

In the event action is not taken to manually control charging flow, PZR level will continue rising and the PRESSURIZER LEVEL HI-LO, EK-0761 annunciator will alarm at 62.75%

level, and then annunciator PRESSURIZER HIGH LEVEL, EK-0769 will alarm at 75% level.

Additional indication available:

LI-0103B on panel EC-33 in the Auxiliary Building 590 elevation LI-0102B on panel EC-150 in the Turbine Building 607 elevation Degree of Clarity Very Good Analysis File: Pal_Post_HEPs_r3 1-5-11.HRA (12/07/11, 5935104 Bytes) 3

EPRI HRA Calculator 4.0 1/5/20121/5/2012 Procedures and Training Cognitive Procedure ARP-4 TILE 4 (Revision: 58)

Cognitive Step Number OPERATOR ACTION Cognitive Instruction CHECK Charging flow and Letdown flow matched.

Execution Procedure ARP-4 TILE 4 (Revision: 58)

Other Procedure SOP-2A (Revision: 69)

Job Performance Measure PL-OPS-CVC-005J Classroom Training Frequency: 0.5 per year Simulator Training Frequency: 0.5 per year Notes Procedures applicable to this action EOP-1.0 STANDARD POST-TRIP ACTIONS REV 12 ARP-4 PRIMARY COOLANT PUMP STEAM GENERATOR AND ROD DRIVES SCHEME EK-07 (EC-12) REV 58 SOP-2A CHEMICAL AND VOLUME CONTROL SYSTEM REV 70 In response to annunciator LETDOWN HT EX TUBE INLET HI-LO PRESS, EK-0704 operators would observe charging and letdown flow and place all 3 orifice valve control switches to CLOSE per ARP-4. The ARP then directs restoring charging and letdown when desired per SOP-2A. If P-55A is not stopped, PZR level will continue rising.

TRAINING:

Initial training and is included in 2 year training plan.

JPM PL-OPS-CVC-005J, MANUALLY LOWER CHARGING AND LETDOWN FLOW includes an action to manually stop P-55B or P-55C when desired to reduce letdown flow. Stopping P-55A would be a similar action.

Manpower Requirements Default Actual Operations: Shift Manager 1 0 Shift Supervisor 1 1 STA 1 0 Reactor Operators 2 1 Plant Operators 4 0 Maintenance Mechanics 0 0 Electricians 0 0 I&C Technicians 0 0 Health Physics Technicians 1 0 Chemistry: Technicians 1 0 Analysis File: Pal_Post_HEPs_r3 1-5-11.HRA (12/07/11, 5935104 Bytes) 4

EPRI HRA Calculator 4.0 1/5/20121/5/2012 Dependencies (Related Human Interactions)

CVC-AVOB-CV-2001 OP FAILS TO CLOSE CV-2001 ON HIGH TEMP AT LETDOWN HX E-58 (HEP)

CVC-AVOA-CV-2003 OPERATOR FAILS TO CLOSE LETDOWN ORIFICE STOP VALVE CV-2003 (HEP)

CVC-AVOA-CV-2122 OP FAILS TO OPEN LETDOWN INTERMEDIATE PRESSURE CONTROL (HEP)

CVC-PMOA-P55-TRIP OP FAILS TO STOP CHARGING PUMP OPERATION (HEP)

CVC-PMOE-P-55-2 OP FAILS TO START ADDITIONAL CHARGING PUMPS FOR 2 IN SERVICE CVC-MVOA-SUCT-SRCE OP FAILS TO TRANSITION SUCTION SOURCE TO SIRWT (HEP)

Key Assumptions Operator Interview Insights Timing Analysis Timing Analysis Tsw 62.00 Minutes Tdelay 22.00 Minutes T1/2 29.00 Minutes TM 2.00 Minutes Time available for recovery 9.00 Minutes SPAR-H Available time 38.00 Minutes (cognitive)

SPAR-H Available time 5.50 (execution) ratio Minimum level of dependence HD for recovery Analysis File: Pal_Post_HEPs_r3 1-5-11.HRA (12/07/11, 5935104 Bytes) 5

EPRI HRA Calculator 4.0 1/5/20121/5/2012 Notes Regarding Tsw : The time for Tsw is based on the 9/25/2011 loss of dc event that led to increasing pressurizer level. The rising pressurizer level was consequence the loss dc power that caused isolation of letdown flow and a right channel safety injection signal. The right channel safety injection signal resulted in the start of an additional charging pump. The excess charging flow with no letdown flow caused the rise in pressurizer level and pressure. Based on the event timeline and additional information provided in the EA-PSA-SDP-D11-2-11-07, the time to the consequential condition that pressurizer safety would be challenged without operator intervention was determined to be 62 minutes. Additional details regarding the event response are discussed in the EA.

The time to the indication of high pressurizer pressure and increasing level was 22 minutes. The median (actual) response time was 29 minutes. The response time was a result of operator action to verify boration requirements were met prior throttling injection flow.

The base version of the HEP assumed a bounding condition and was based on three charging pumps operating with nominal letdown and assumed the consequential failure occurs when 100%

level is reached and ignored the volume above 100%. The base version with three charging pumps operating predicted the time to consequential failure to be 30 minutes. The base version with only two charging pumps operating operating predicts consequential failure at 64 minutes similar to the Tsw for 9/25/2011 event.

The execution time is unchanged as the actions in this version are the same actions used in the base case.

Per P-IOAQ (RMassa, 12/21/2010):

Tm: It would take ~2 minutes to complete the action once the need is identified.

NOTE: Currently, actions to open the additional letdown valves are not credited as part of this action.

Analysis File: Pal_Post_HEPs_r3 1-5-11.HRA (12/07/11, 5935104 Bytes) 6

EPRI HRA Calculator 4.0 1/5/20121/5/2012 Cognitive Analysis Pc Failure Mechanism Branch HEP Pca: Availability of Information a neg.

Notes: Indicators available, accurate. Crew trained.

Pcb: Failure of Attention l 7.5e-04 Notes: Workload expected to be high (multiple alarms). Operators monitor pressurizer conditions, using instruments located on a front panel. Indicators are alarmed.

Pcc: Misread/miscommunicate data a neg.

Notes: The applicable indications are easy to locate and they do not have human engineering deficiencies. The Palisades operators use formal communications.

Pcd: Information misleading a neg.

Notes: Cues as stated.

Pce: Skip a step in procedure g 6.0e-03 Notes: The steps concerning pressurizer control and leak isolation are not hidden in any way although they are not graphically distinct. The operators are in multiple procedures. The ONPs and the ARPs are Continuous Use procedures and the operators are required to mark off steps as they are completed via the circle/slash method of placekeeping.

Pcf: Misinterpret Instructions a neg.

Notes: The procedure steps involving pressurizer control use standard wording and the operators have all the information they need to complete this action.

Pcg: Misinterpret decision logic l neg.

Notes: There are no NOT, AND or OR statements in the decision logic for pressurizer control. The operators have practiced pressurizer control, however, the scenarios postulated for this action are do not clearly link the symptoms to the action of controlling the charging pumps.

Pch: Deliberate violation a neg.

Notes: The operators believe that the instructions contained in their procedures are accurate and adequate.

Initial Pc(without recovery credited) 6.8e-03 Notes Cognitive Complexity Complex Equipment Accessibility Control Room (Panel C-12): Accessible Indicators available, accurate. Crew trained.

Analysis File: Pal_Post_HEPs_r3 1-5-11.HRA (12/07/11, 5935104 Bytes) 7

EPRI HRA Calculator 4.0 1/5/20121/5/2012 Workload expected to be high (multiple alarms). Operators monitor pressurizer conditions, using instruments located on a front panel. Indicators are alarmed.

The applicable indications are easy to locate and they do not have human engineering deficiencies. The Palisades operators use formal communications.

Analysis File: Pal_Post_HEPs_r3 1-5-11.HRA (12/07/11, 5935104 Bytes) 8

EPRI HRA Calculator 4.0 1/5/20121/5/2012 Cues as stated.

The steps concerning pressurizer control and leak isolation are not hidden in any way although they are not graphically distinct. The operators are in multiple procedures. The ONPs and the ARPs are Continuous Use procedures and the operators are required to mark off steps as they are completed via the circle/slash method of placekeeping.

The procedure steps involving pressurizer control use standard wording and the operators have all the information they need to complete this action.

Analysis File: Pal_Post_HEPs_r3 1-5-11.HRA (12/07/11, 5935104 Bytes) 9

EPRI HRA Calculator 4.0 1/5/20121/5/2012 There are no NOT, AND or OR statements in the decision logic for pressurizer control. The operators have practiced pressurizer control, however, the scenarios postulated for this action are do not clearly link the symptoms to the action of controlling the charging pumps.

The operators believe that the instructions contained in their procedures are accurate and adequate.

Analysis File: Pal_Post_HEPs_r3 1-5-11.HRA (12/07/11, 5935104 Bytes) 10

EPRI HRA Calculator 4.0 1/5/20121/5/2012 Cognitive Recovery Recovery Depende Multiply Override Self Review Initial Extra Crew Final STA Review ncy HEP HEP By Value Matrix Value Shift Change ERF Review Level Pca neg. - - - - - N/A - 1.0e+00 Pcb 7.5e-04 X - X - - N/A - 1.0e-02 7.5e-06 Pcc neg. - - - - - N/A - 1.0e+00 Pcd neg. - - - - - N/A - 1.0e+00 Pce 6.0e-03 X X - - - N/A - 5.0e-02 3.0e-04 Pcf neg. - - - - - N/A - 1.0e+00 Pcg neg. - - - - - N/A - 1.0e+00 Pch neg. - - - - - N/A - 1.0e+00 Final Pc (with recovery credited) 3.1e-04 Notes Pc uses "extra crew" as a surrogate for shift supervisor credit (Control Room Supervisor).

Control room actions would be peer checked as they are performed by the other Reactor Operator, Shift Engineer or Control Room Supervisor.

Pc ASEP Nominal Diagnosis Model In order to compensate for possible non-conservative estimates produced by the cause-based method for short term actions (Time available for recovery <1 hour), the cognitive failure probability for short term actions is taken to be the sum of the cause-based and ASEP results; longer term actions do not include the ASEP component.

Use Nominal HEP because the event is not a "well-recognized classic", but it is trained on.

Actual Time Error Factor Median HEP Mean Upper Bound Lower Bound 29.0 minutes 10 4.6e-04 1.9e-03 6.7e-03 3.1e-05 Execution Performance Shaping Factors Environment Lighting Normal Heat Normal Radiation Background Atmosphere Normal Equipment Accessibility Control Room (Panel Accessible EC-02)

Stress Moderate Plant Response As Yes Expected:

Workload: High Performance Shaping Optimal Factors:

Notes Following recognition of the need for the action (Pcognitive), the operator workload is assessed as high due to the number actions required as a consequence of the event. The PSFs are not negative for this action which is executed in the control room.

Execution Complexity Simple Analysis File: Pal_Post_HEPs_r3 1-5-11.HRA (12/07/11, 5935104 Bytes) 11

EPRI HRA Calculator 4.0 1/5/20121/5/2012 Execution Unrecovered Procedure: ARP-4 TILE 4, PRIMARY SYSTEM VOLUME LEVEL PRESSURE SCHEME EK-07 (C-12) Comment Stress Over Error THERP Factor Ride Step No. Instruction/Comment HEP Type Table Item IF PLCS does NOT respond, THEN RESTORE AND MAINTAIN PZR level between 42% and 57%: a. OPERATE PZR Level Control System (PLCS).

EOP-1 Step -- EOM 20-7b 2 1.3E-3 2 5.1 a EOC 20-12 2 3.8E-3 Total Step HEP 1.0e-02 IF PLCS does NOT respond, THEN RESTORE AND MAINTAIN PZR level between 42% and 57%:b. MANUALLY OPERATE Charging and Letdown EOP-1 Step -- EOM 20-7b 2 1.3E-3 2 5.1 b EOC 20-12 2 3.8E-3 Total Step HEP 1.0e-02 Execution recovery provided by independent personnel See Section 4.3 of the HRA Notebook for further information. This execution recovery factor is applied to the individual execution steps with a dependence factor based on the time EXEC RECOV 2 0.1 available for recovery. Note that the

- ICR execution stress factors applied to the execution subtasks are not applied to the execution recovery factor. The EOM does not apply.

Total Step HEP 1.0e-01 12

EPRI HRA Calculator 4.0 1/5/20121/5/2012 Execution Recovered Critical Recovery Action HEP (Crit) HEP (Rec) Dep. Cond. HEP (Rec) Total for Step Step No. Step No.

EOP-1 IF PLCS does NOT respond, THEN RESTORE 1.0e-02 2.3e-03 Step 5.1 AND MAINTAIN PZR level between 42% and 57%:

a a. OPERATE PZR Level Control System (PLCS).

EXEC Execution recovery provided by independent 1.0e-01 MD 2.3e-01 RECOV - ICR personnel EOP-1 IF PLCS does NOT respond, THEN RESTORE 1.0e-02 2.3e-03 Step 5.1 AND MAINTAIN PZR level between 42% and b 57%:b. MANUALLY OPERATE Charging and Letdown EXEC Execution recovery provided by independent 1.0e-01 MD 2.3e-01 RECOV - ICR personnel Total Unrecovered: 2.0e-02 Total Recovered: 4.6e-03 13

EPRI HRA Calculator 4.0 1/5/20121/5/2012 ACP-CBOB-BYREG-2, OPERATOR FAILS TO ALIGN BUS Y-01 THROUGH BYPASS REGULATOR TO SUPPLY A DE-ENERGIZED PFAC BUS (HEP)

Analyst: FJY Rev. Date: 12/08/11 Reviewer: BAB Cognitive Method: CBDTM/THERP Analysis Database: Pal_Post_HEPs_r3 1-5-11.HRA (12/08/11, 5967872 Bytes)

Table 2: ACP-CBOB-BYREG-2

SUMMARY

Analysis Results: without Recovery with Recovery Pcog 1.2e-02 6.0e-04 Pexe 6.5e-02 3.3e-02 Total HEP 3.3e-02 Error Factor 5 Assigned Basic Events:

Related Human Interactions:

Although Y20 is modeled in this calculation, the analysis applies equally to the alignment of any of the remaining preferred AC busses.

Initial Cue:

Loss of Preferred AC Bus Y10, Y20, Y30, or Y40 Recovery Cue:

Cue:

Multiple procedures (as listed in the "Procedures" section) direct the operators to verify that AC busses are energized. For the preferred AC busses, the contingency action directs OPS to:

ONP-24.1, LOSS OF PREFERRED AC BUS Y10 ONP-24.2, LOSS OF PREFERRED AC BUS Y20 ONP-24.3, LOSS OF PREFERRED AC BUS Y30 ONP-24.4, LOSS OF PREFERRED AC BUS Y40 Degree of Clarity of Cues & Indications:

Very Good Procedures:

Cognitive: ONP-24.2 (LOSS OF PREFERRED BUS Y20) Revision: 23 Execution: SOP-30 (STATION POWER) Revision: 53 Other: EOP-9.0 (FUNCTIONAL RECOVERY PROCEDURE) Revision: 19 14

EPRI HRA Calculator 4.0 1/5/20121/5/2012 Cognitive Procedure:

Step: 4.17 Instruction: IF a fault does NOT exist on Y20, THEN REFER TO SOP-30 AND PLACE Y20 on the Bypass Regulator.

Procedure Notes:

EOP-1.0, STANDARD POST-TRIP ACTIONS step 4.4.6) states: VERIFY 3 of 4 Preferred AC buses are energized.

EOP-2.0, REACTOR TRIP RECOVERY, step 4.9 directs the operators to verify that the given AC buses are energized. The contingency action for the preferred AC busses directs the operators to ONP-24.1 through ONP-24.4, LOSS OF PREFERRED AC BUS Y10 / Y20 / Y30 / Y40.

The following procedures contain this action:

EOP-2.0 REACTOR TRIP RECOVERY EOP-9.0 FUNCTIONAL RECOVERY PROCEDURE MV-AE-DC-1 ONP-2.3 LOSS OF DC POWER ONP-24.1, 24.2, 24.3, 24.4 LOSS OF PREFERRED BUS Y-10, Y-20, Y-30, Y-40 ARP-3 WINDOWS 34, 44, 45, 46 PREFERRED AC BUS NO. 1, 2, 3, 4 TROUBLE ARP-3 WINDOW 48 125V DC BUS UNDERVOLTAGE/TROUBLE SOP-30, STATION POWER, Section 7.6.2, To Supply a Preferred AC Bus With the Bypass Regulator This is an Auxiliary Operator action, and the following JPMs are available:

(Licensed Operators) JPMPL-OPS-EPS-001(PLACE PREFERRED AC BUS, Y-20 ON BYPASS REGULATOR)

Training:

Simulator, Frequency: 0.5 per year JPM Procedure:

JPM ISBA-JPM-04 (PLACE PREFERRED AC BUS, Y-20 ON BYPASS REGULATOR) Revision:

6 Identification and Definition:

This action aligns power from bus Y-01 via the bypass regulator to a preferred AC power bus (Y-10, Y-20, Y-30 or Y-40) which has failed due to a failure of its power source, i.e. MCC-1 or MCC-

2. As stated earlier, although Y20 is modeled here, the analysis applies to the alignment of any of the remaining preferred AC busses.

1. Initial Conditions: Steady state, full power operations

2. Initiating Event: LODC (bus ED-10)

3. Accident Sequence (preceding functional failures and successes):

Loss of DC power to DC bus ED10-R and ED10-L.

Reactor Trip 15

EPRI HRA Calculator 4.0 1/5/20121/5/2012 Turbine Trip OPS enters EOP-1.0 and performs the standard post-trip actions.

The operators would continue in EOP-1.0 and enter ONP-24.1 and ONP-24.3 For post trip actions and indications of loss of preferred ac panels EY-10 and EY-30.

ARP-3, alarm response refers the operators to ONP-24.1 and ONP-24.3 for alternatives to power the preferred AC panel loads.

EOP-1.0 event diagnostic directs the operator to EOP 9.0 if 3 of 4 preferred AC busses are not energized. Given the safety function criteria (SF) are not met (2 or more preferred AC busses NOT energized), then the operators would transition to EOP-9.0 Functional Recovery Procedure and start working through success path MV-AE-DC-1 since it is the only "jeopardized" SF. MV-AE-DC-1 step 6 directs operators to verify at least 3 preferred AC busses are energized. If less than 3 are available, step 6.1 directs operators to ENERGIZE ALL available preferred AC Buses per ONP-24.1, 2, 3, 4 as applicable.

ONP-24.2 step 4.17 directs: IF a fault does NOT exist on Y20, THEN REFER TO SOP-30 AND PLACE Y20 on the Bypass Regulator.

SOP-30, STATION POWER, Section 7.6.2, To Supply a Preferred AC Bus With the Bypass Regulator.

4. Preceding operator errors or successes in sequence: No operator errors or additional successes noted.

5. Operator action success criterion: Success is restoring Y20 prior to battery depletion.

6. Consequences of failure: Loss of TD AF pump and AF valve control Key Assumptions:

Current modeling assumes only Y-20 can be backed up by the bypass regulator. Any single preferred AC bus can be backed up.

Operator Interview Insights:

EOP-2.0, REACTOR TRIP RECOVERY, would only be entered if the scenario was an "uncomplicated" trip. If a LOOP is in progress, the operators would transition from EOP-1.0 to EOP-8.0 LOSS OF OFFSITE POWER/NATURAL CIRCULATION RECOVERY. EOP-8.0 safety function status checks require 3 of 4 preferred AC busses to be energized. So if only one is not energized, the function is met and NO corrective action is directed.

If the safety function criteria (SF) are not met (2 or more preferred AC busses NOT energized),

then the operators would transition to EOP-9.0, Functional Recovery Procedure, and start working through success path MV-AE-DC-1 since it is the only "jeopardized" SF. MV-AE-DC-1 step 6 directs operators to verify at least 3 preferred AC busses are energized. If less than 3 are available, step 6.1 directs operators to ENERGIZE ALL available preferred AC Buses per ONP-24.1, 2, 3, or 4 as applicable.

In summary, for loss of 1 preferred bus with any other single event in progress procedures do not direct any action being taken with exception of annunciator response procedure ARP-3.

16

EPRI HRA Calculator 4.0 1/5/20121/5/2012 Manpower Requirements:

Operations: Shift Manager 1 0 Shift Supervisor: 1 1 STA: 1 1 Reactor operators: 2 1 Plant operators: 4 2 Maintenance: Mechanics: 0 0 Electricians: 0 0 I&C Technicians: 0 0 Health Physics: Technicians: 1 0 Chemistry: Technicians: 1 0 Execution Performance Shaping Factors:

Environment: Lighting Normal Heat/Humidity Normal Radiation Background Atmosphere Normal Special Requirements:

Complexity of Response: Cognitive Simple Execution Complex Equipment Accessibility: Control Room Accessible Cable Spreading Room (AB Accessible 607')

Stress: Moderate Plant Response As Expected: Yes Workload: Low Performance Shaping Factors: Negative Performance Shaping Factor Notes:

Because of the relatively long system window, the workload is not high. While the PSFs could be assigned as "negative" due to the emergency lighting in service for a LOOP case, operator interviews conducted in August 2009 confirmed that there is sufficient emergency lighting available for both access and execution. The PSFs are therefore not assessed as negative.

Additionally, a second AO would do peer checking on a "not to delay basis." However, there is more than sufficient time to complete this action as the SPAR execution ratio is 6.

17

EPRI HRA Calculator 4.0 1/5/20121/5/2012 Timing:

Timing Analysis:

The system window is based on battery depletion time. As given in the EOP-3.0 basis document (rev 11) [47], the battery depletion time is 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months per DBD Chapter 4.01, Section 3.2.2, and FSAR Chapter 8.

According to an OPS estimate, it will take the operators 20 minutes to complete EOP-1.0. For a LOOP event, the crew will then transition to EOP-8.0 LOSS OF OFFSITE POWER/NATURAL CIRCULATION RECOVERY. EOP-8.0 safety function status checks require 3 of 4 preferred AC busses to be energized. If the safety function criteria (SF) are not met (2 or more preferred AC busses NOT energized), then the operators would transition to EOP-9.0 Functional Recovery Procedure and start working through success path MV-AE-DC-1 since it is the only "jeopardized" SF. MV-AE-DC-1 step 6 directs operators to verify at least 3 preferred AC busses are energized.

If less than 3 are available, contingency action step 6.1 directs operators to ENERGIZE ALL available preferred AC Buses per ONP-24.1, 2, 3, 4 as applicable. Reaching this step is expected to take another 40 minutes per OPS estimates (08/26/09). Therefore, the time to reach the direction for this action is expected to take a total of 60 minutes. (Tdelay)

The manipulation time estimate for this action is 30 minutes. (OPS estimate 08/26/09)

Time available for recovery: 150.00 Minutes SPAR-H Available time (cognitive): 150.00 Minutes SPAR-H Available time (execution) ratio: 6.00 Minimum level of dependence for recovery: ZD 18

EPRI HRA Calculator 4.0 1/5/20121/5/2012 Cognitive Unrecovered ACP-CBOB-BYREG-2 Table 3: ACP-CBOB-BYREG-2 COGNITIVE UNRECOVERED Pc Failure Mechanism Branch HEP Pca: Availability of Information a neg.

Pcb: Failure of Attention a neg.

Pcc: Misread/miscommunicate data a neg.

Pcd: Information misleading a neg.

Pce: Skip a step in procedure g 6.0e-03 Pcf: Misinterpret instruction a neg.

Pcg: Misinterpret decision logic c 6.0e-03 Pch: Deliberate violation a neg.

Sum of Pca through Pch = Initial Pc = 1.2e-02 19

EPRI HRA Calculator 4.0 1/5/20121/5/2012 Preferred AC bus indications are available in the CR and they are accurate. The operators have been trained on all CR indications.

The operator workload would not be high in view of the long system window. The operator would only need to check preferred AC bus status, located on a front panel, to recognize the need for this action.

20

EPRI HRA Calculator 4.0 1/5/20121/5/2012 The AC bus indications are easy to locate and they do not have human engineering deficiencies.

The Palisades operators use formal communications.

All cues are as stated.

The applicable procedure steps are not hidden in any way although they are not graphically distinct. The operators are potentially in multiple procedures. The EOPs have placekeeping aids and the Palisades operators use the circle/slash method of placekeeping for the SOPs.

21

EPRI HRA Calculator 4.0 1/5/20121/5/2012 The applicable procedure steps use standard wording and the operators have all the information they need to complete this action.

There are implied NOT and AND statements in the decision logic for this action. There are no OR statements. The operators have practiced loss of preferred AC bus restoration actions in the simulator.

The Palisades operators believe in the adequacy of their instruction.

22

EPRI HRA Calculator 4.0 1/5/20121/5/2012 Cognitive Recovery ACP-CBOB-BYREG-2 Table 4: ACP-CBOB-BYREG-2 COGNITIVE RECOVERY Self- Extra STA Shift ERF Multiply Override Final Initial HEP DF Review Crew Review Change Review HEP By Value Value Pca: neg. - - - - - - 1.0e+00 Pcb: neg. - - - - - - 1.0e+00 Pcc: neg. - - - - - - 1.0e+00 Pcd: neg. - - - - - - 1.0e+00 Pce: 6.0e-03 X X - - - - 5.0e-02 3.0e-04 Pcf: neg. - - - - - - 1.0e+00 Pcg: 6.0e-03 - X X - - - 5.0e-02 3.0e-04 Pch: neg. - - - - - - 1.0e+00 Sum of Pca through Pch = Initial Pc = 6.0e-04 Notes:

"Extra crew" is used as a surrogate for "Shift Supervisor" (Control Room Supervisor) credit.

23

EPRI HRA Calculator 4.0 1/5/20121/5/2012 Execution Unrecovered ACP-CBOB-BYREG-2 Table 5: ACP-CBOB-BYREG-2 EXECUTION UNRECOVERED Procedure: SOP-30, STATION POWER Comment Stress Over Ride Step No. Instruction/Comment Error THERP HEP Factor Type Table Item CHECK for fault per Note located prior to step 4.17 in ONP-24.2 NOTE located prior to step 4.17 in ONP-24.2:

NOTE: If the loss of the preferred AC bus is due to the Inverter DC input breaker opening and the Inverter AC output breaker did NOT trip, it is unlikely 2 ONP-24.2 NOTE that there is a fault on the preferred AC bus itself.

-- EOM 20-7b 2 1.3E-3 EOC 20-9 2 1.3E-3 EOC 20-11 7 neg.

Total Step HEP 5.2e-03 IF the Preferred AC Bus is to be restored on the Bypass Regulator following an Inverter failure, THEN PLACE the Manual Bypass Switch in the BYPASS SOURCE position.

2 SOP 7.6.2.c -- EOM 20-7b 2 1.3E-3 EOC 20-12 4 1.3E-3 EOC 20-12 8a 2.7E-4 Total Step HEP 5.8e-03 CLOSE (ON) Breaker 41 on Instrument AC Bus Y01

-- EOM 20-7b 2 1.3E-3 2

SOP 7.6.2.d EOC 20-12 12 3.8E-3 EOC 20-12 8a 2.7E-4 Total Step HEP 1.1e-02 PLACE the Kirk interlock key (SS key #234) into the breaker lock for selection error is negligible Preferred AC Bus to be transferred. (Located in Bypass Regulator) 2 SOP 7.6.2.e -- EOM 20-7b 2 1.3E-3 used as a surrogate EOC 20-12 8a 2.7E-4 Total Step HEP 3.1e-03 PLACE the breaker lock to OPEN position (this allows permissive closing of associated breaker).

-- EOM 20-7b 2 1.3E-3 2 SOP 30 - 7.6.2.f EOC 20-12 3 1.3E-3 EOC 20-12 8a 2.7E-4 Total Step HEP 5.8e-03 24

EPRI HRA Calculator 4.0 1/5/20121/5/2012 CLOSE (ON) the Bypass Regulator Breaker to the Inverter to be spared.

-- EOM 20-7b 2 1.3E-3 2

SOP 30 - 7.6.2.g EOC 20-12 4 1.3E-3 EOC 20-12 8a 2.7E-4 Total Step HEP 5.8e-03 PERFORM the following to transfer loads from the Inverter to the Bypass Regulator

-- EOM 20-7b 2 1.3E-3 selection error - CLOSE Bypass Source AC Input Breaker. EOC 20-12 4 1.3E-3 manipulation error - CLOSE Bypass Source AC Input Breaker. EOC 20-12 8a 2.7E-4 VERIFY In Sync light is ON. EOC 20-9 1 neg.

VERIFY In Sync light is ON. EOC 20-11 7 neg.

PUSH "Bypass Source To Load" pushbutton. EOC 20-12 4 1.3E-3 PUSH "Bypass Source To Load" pushbutton. EOC 20-12 8a 2.7E-4 VERIFY "Bypass Source Supplying Load" light is ON. EOC 20-9 2 1.3E-3 2

SOP 30 - 7.6.2.h. VERIFY "Bypass Source Supplying Load" light is ON. EOC 20-11 7 neg.

ENSURE Manual Bypass Switch in BYPASS SOURCE position. EOC 20-9 2 1.3E-3 ENSURE Manual Bypass Switch in BYPASS SOURCE position. Used as EOC 20-11 7 neg.

a surrogate.

OPEN Inverter Output breaker. EOC 20-12 4 1.3E-3 OPEN Inverter Output breaker. EOC 20-12 8a 2.7E-4 OPEN Bypass Source AC Input breaker. EOC 20-12 4 1.3E-3 OPEN Bypass Source AC Input breaker. EOC 20-12 8a 2.7E-4 DEPRESS ALARM RESET to clear Inverter alarms. EOC 20-12 3 1.3E-3 DEPRESS ALARM RESET to clear Inverter alarms. EOC 20-12 8a 2.7E-4 Total Step HEP 2.3e-02 OPEN Inverter Output breaker. SHOULD I ADD THE STEPS OMITTED? If not -

change to short list

-- EOM 20-7b 2 1.3E-3 2 SOP 30 - 7.6.2.6 EOC 20-12 4 1.3E-3 EOC 20-12 8a 2.7E-4 Total Step HEP 5.8e-03 Execution recovery provided by independent personnel See Section 4.3 of the HRA Notebook for further 2 0.5 information. This execution recovery factor is applied to the individual execution steps with a dependence factor based on the time available for recovery. Note that the execution stress factors applied to the EXEC RECOV -

execution subtasks are not applied to the execution OCR recovery factor. The EOM does not apply. Although the execution occurs in both the control room and in the cable spreading room, the "outside control room" execution recovery factor is applied.

Total Step HEP 5.0e-01 25

EPRI HRA Calculator 4.0 1/5/20121/5/2012 Execution Recovery ACP-CBOB-BYREG-2 Table 6: ACP-CBOB-BYREG-2 EXECUTION RECOVERY Cond. HEP Total for Critical Step No. Recovery Step No. Action HEP (Crit) HEP (Rec) Dep.

(Rec) Step ONP-24.2 NOTE CHECK for fault per Note located prior to step 4.17 in ONP-24.2 5.2e-03 2.6e-03 EXEC RECOV - Execution recovery provided by independent personnel 5.0e-01 ZD 5.0e-01 OCR SOP 7.6.2.c IF the Preferred AC Bus is to be restored on the Bypass Regulator following an Inverter failure, THEN PLACE the 5.8e-03 2.9e-03 Manual Bypass Switch in the BYPASS SOURCE position.

EXEC RECOV - Execution recovery provided by independent personnel 5.0e-01 ZD 5.0e-01 OCR SOP 7.6.2.d CLOSE (ON) Breaker 41 on Instrument AC Bus Y01 1.1e-02 5.5e-03 EXEC RECOV - Execution recovery provided by independent personnel 5.0e-01 ZD 5.0e-01 OCR SOP 7.6.2.e PLACE the Kirk interlock key (SS key #234) into the breaker lock for Preferred AC Bus to be transferred. (Located in 3.1e-03 1.6e-03 Bypass Regulator)

EXEC RECOV - Execution recovery provided by independent personnel 5.0e-01 ZD 5.0e-01 OCR SOP 30 - 7.6.2.f PLACE the breaker lock to OPEN position (this allows 5.8e-03 2.9e-03 permissive closing of associated breaker).

EXEC RECOV - Execution recovery provided by independent personnel 5.0e-01 ZD 5.0e-01 OCR SOP 30 - 7.6.2.g CLOSE (ON) the Bypass Regulator Breaker to the Inverter to 5.8e-03 2.9e-03 be spared.

EXEC RECOV - Execution recovery provided by independent personnel 5.0e-01 ZD 5.0e-01 OCR SOP 30 - 7.6.2.h. PERFORM the following to transfer loads from the Inverter to 2.3e-02 1.2e-02 the Bypass Regulator EXEC RECOV - Execution recovery provided by independent personnel 5.0e-01 ZD 5.0e-01 OCR SOP 30 - 7.6.2.6 OPEN Inverter Output breaker. 5.8e-03 2.9e-03 EXEC RECOV - Execution recovery provided by independent personnel 5.0e-01 ZD 5.0e-01 OCR Total Unrecovered: 6.5e-02 Total Recovered: 3.3e-02 26

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 13 - Page 1 of 4 3 Procedure Use Evaluation for DC Panel ED-11-2 Fault Event This attachment contains the following:

Event procedure use in narrative format Event procedure use in flow chart format (Figure A13-1)

Note: the narrative and flow chart provide an overview of procedure usage during the ED-11-2 event.

They are not all inclusive, i.e. they do not include all procedures referenced/used during the event.

Procedure Use Narrative I. Procedure Use Expectations During the ED-11-2 event multiple procedures were concurrently in use, including Emergency Operating Procedures (EOPs), Off Normal Procedures (ONPs), Annunciator Response Procedures (ARPs), General Operating Procedures (GOPs) and System Operating Procedures (SOPs). EOP and ONP procedure steps are written in the order the writer expects the plant to respond. Since the plant may not respond exactly as predicted, performance of steps out of sequence may be necessary. To avoid masking event symptoms and complicating diagnosis, additional actions to those stated in the EOP-1.0 Immediate Actions are not permitted until EOP-1.0 event diagnosis completion, except as directed as an immediate action of an applicable ONP, or are otherwise immediately essential for personnel safety, plant safety, equipment protection or safety of the public.

II. EOP-1.0 Standard Post-Trip Actions Operators enter EOP-1.0 Standard Post-Trip Actions and perform Immediate and Operator Actions. The loss of dc and preferred ac buses precluded verification of some required conditions. For example, main generator breaker, atmospheric steam dump valve, and auxiliary feedwater pump P-8B and associated flow control valve indications were not available. Operators performed contingency action 2.b.1 to open the main generator breakers after verifying their status with International Transmission Control (ITC). The loss of dc panels ED-11-1 and ED-11-2 and preferred ac buses EY-10 and EY-30 were identified.

EOP-1.0 Operator Actions include performing GOP-10 Balance of Plant Actions Following A Reactor Trip and event diagnosis using the diagnostic flow chart. Due to not having at least 3 preferred ac buses energized, the operators were directed to EOP-9.0 Functional Recovery Procedure. GOP-10 checklist GCL-10.1 Post Trip Checklist Inside Control Room directs review of control panel annunciators and referencing associated ARPs. The unavailability of ED-11-1 and ED-11-2 noted previously and annunciator EK-0548 125V DC UNDERVOLTAGE ARP-3 Electrical Auxiliaries and Diesel Generator Scheme EK-05 (EC-11) direction provided cues for ONP-2.3 Loss of DC Power entry. Operators entered both EOP-9.0 and ONP-2.3.

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 13 - Page 2 of 4 III. EOP-9.0 Functional Recovery Procedure Operators enter EOP-9.0 and perform Operator Actions including referring to Site Emergency Plan (SEP)

EI-1, verifying emergency boration in progress and identifying in use safety function success paths. It was determined that SEP implementation was not required.

The following safety function success paths were selected based on EOP-9.0 Resource Assessment Tree conditions criteria:

1. Reactivity Control: RC-3 Boration Using SIS (due to SIAS activated)

2. Maintenance of Vital Auxiliaries Electric DC: MVAE-DC-1 Battery Chargers/Station Batteries

3. Maintenance of Vital Auxiliaries Electric AC: MVAE-AC-1 Offsite Power

4. Inventory Control: IC-2 Safety Injection (due to SIAS activated)

5. Pressure Control: PC-3 Saturated Pressure Control (due to SIAS activated)

6. Heat Removal: HR-2 S/G with SI Operating (due to SIAS activated)

7. Containment Integrity: CI-1 Automatic/Manual Isolation

8. Containment Atmosphere Control: CA-1 Containment Air coolers (Normal Mode*)

9. Maintenance of Vital Auxiliaries Water: MVAW-1 Service Water and CCW

10. Maintenance of Vital Auxiliaries Air: MVAA-1 Instrument Air Compressors

Note: Although containment air coolers were operating in the Emergency Mode, CA-1 was selected based on meeting plant conditions criteria, i.e. containment temperature < 125oF and containment pressure < 0.85 psig.

Operators identified MVAE-DC-1 as the only jeopardized safety function and proceeded completing appropriate actions while monitoring other safety functions by performing periodic safety function status checks (SFSCs).

The MVAE-DC-1 instruction column Step 6 condition requiring at least 3 preferred ac buses energized was not met. This required operators to perform the contingency action (ENERGIZE ALL available Preferred AC Buses), referring to applicable ONPs (ONP-24.1 Loss of Preferred AC Bus Y-10 and ONP-24.3 Loss of Preferred AC Bus Y-30). After verification of bus EY-30 being fault-free, operators energized EY-30 from the bypass regulator per ONP-24.3 and SOP-30 Station Power Section 7.6.2.

Pressurizer (PZR) pressure and level controllers and the heater select switch were placed in channel B during performance of ONP-24.3. This action enabled the PZR spray valves (lowered PCS pressure),

reduced P-55A charging pump speed from 53 gpm to 33 gpm and opened the letdown orifice isolation valves. Opening the orifice valves resulted in RV-2006 lifting and annunciator EK-0702 RELIEF VALVE 2006 RELIEF VALVE DISCH HI TEMP alarming. Operators isolated flow to RV-2006 by placing the orifice valve handswitches to close per ARP-4 Primary System Volume Level Pressure Scheme EK-07 (C-12).

Due to observed high PZR level, in use success paths Inventory Control IC-2 and Heat Removal HR-2 were referenced for direction to stop PCS inventory addition. Emergency boration requirements were verified per HR-2 Step 6 and safety injection throttling criteria verified per IC-2 Step 10. Operators then throttled safety injection, including stopping both operating charging pumps.

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 13 - Page 3 of 4 IV. ONP-2.3 Loss of DC Power Due to observed steam generator E-50A high level, operators identified the need to stop AFW pump P-8B. ONP-2.3 Step 2.b directs stopping P-8B by closing steam supply valve CV-0522B per SOP-12 Feedwater System Section 7.2.3 and Attachment 9. Operators dispatched a plant operator to close CV-0522B using EOP Supplement 19 Alternate Auxiliary Feedwater Methods Section 4 Steps 2.a and 2.b, which is equivalent to SOP-12 for the necessary actions.

After verifying dc buses ED-10L and ED-10R fault free, operators energized them from station battery ED-01 per ONP-2.3 Step 11 and placed #3 battery charger ED-17 in service per SOP-30 Step 7.8.2. After verifying bus EY-10 fault-free, and due to its normal power supply (inverter ED-06) not being available (dc input breaker tripped open), operators energized EY-30 from its normal power supply (inverter ED-08) per SOP-30 Step 7.6.3 and energized EY-10 from the bypass regulator per SOP-30 Step 7.6.2.

Reenergizing panel ED-11-1 resulted in instrument air compressor C-2A tripping and annunciator EK-1104 AIR COMPRESSORS C2A, C2B, C2C TRIP alarming. Per ARP-7 Auxiliary Systems Scheme EK-11 (C-13) operators manually started C-2B and C-2C and referred to ONP-7.1 Loss of Instrument Air.

(Compressors C-2B and C-2C did not automatically start due to breaker 72-119 not being available.)

Procedure Use Flow Chart Procedure Use Flow Chart Figure A13-1: Procedure Use Flow Chart

Entergy PSA EA-PSA-SDP-D11-2-11-07 Rev. 1 Engineering Analysis Attachment 13 - Page 4 of 4 References

[1] Admin 4.06, Revision 20, Emergency Operating Procedure Development and Implementation

[2] Admin 4.16, Revision 3, Off Normal Procedure Development and Implementation

[3] ARP-3, Revision 70, Electrical Auxiliaries and Diesel Generator Scheme EK-05 (EC-11)

[4] ARP-4, Revision 58, Primary System Volume Level Pressure Scheme EK-07 (C-12)

[5] ARP-7, Revision 79, Auxiliary Systems Scheme EK-11 (C-13)

[6] EI-1, Revision 54, Emergency Classification and Actions

[7] EOP Supplement 19, Revision 10, Alternate Auxiliary Feedwater Methods

[8] EOP-1.0, Revision 13, Standard Post-Trip Actions

[9] EOP-9.0, Revision 21, Functional Recovery Procedure

[10] EOP-9.0 HR-2, Revision 22, Heat Removal-2

[11] EOP-9.0 IC-2, Revision 22, Inventory Control-2

[12] EOP-9.0 MVAE-DC-1, Revision 20, Maintenance of Vital Auxiliaries Electric-DC-1

[13] GOP-10, Revision 21, Balance of Plant Actions Following A Reactor Trip

[14] ONP-2.3, Revision 16, Loss of DC Power

[15] ONP-7.1, Revision 13, Loss of Instrument Air

[16] ONP-24.1, Revision 24, Loss of Preferred AC Bus Y10

[17] ONP-24.3, Revision 24, Loss of Preferred AC Bus Y30

[18] SOP-12, Revision 60, Feedwater System

[19] SOP-30, Revision 63, Station Power

ML12006A071

Text

Title:

2.0 CONCLUSION

3.0 BACKGROUND

8.0 REFERENCES

2.0 CONCLUSION

3.0 BACKGROUND

8.0 REFERENCES

2.0 CONCLUSION

SUMMARY

7.0 REFERENCES

2.0 CONCLUSION

SUMMARY

Purpose:

Description:

Conclusion:

SUMMARY

Purpose:

Description:

Conclusion:

SUMMARY

Purpose:

Description:

SUMMARY

7.0 REFERENCES

5.0 CONCLUSION

6.0 REFERENCES

Subject:

SUMMARY

SUMMARY

Navigation menu

Search