ML120100552

Regulatory Conference Supporting Documentation for Apparent Violations EA-11-241 and EA-11-243, Attachment 3, Root Cause Evaluation-Plant Trip During Panel ED-11-2 Maintenance, Rev 2, Part 6.4 of 7

ML120100552
Person / Time
Site:	Rensselaer Polytechnic Institute
Issue date:	01/05/2012
From:	Entergy Nuclear Operations
To:	Office of Nuclear Reactor Regulation
Shared Package
ML1200100495	List: ML120100494 ML120100496 ML120100499 ML120100503 ML120100506 ML120100509 ML120100511 ML120100514 ML120100515 ML120100516 ML120100540 ML120100544 ML120100546 ML120100547 ML120100548 ML120100550 ML120100552 ML120100558 ML120100559 ML120100560 ML120100562
References
EA-11-241, EA-11-243, PNP 2012-06 CR-PLP-2011-4822
Download: ML120100552 (56)

Text

• ~Entergy Entergy PSA Engineering Analysis EA-PSA-SDP-D11-2-11-07 Page 8 of 36 Rev. 1 3.5.2 Sensitivity of PCS level and SG level to relatively cold makeup water Heatup of makeup water after entering PCS increases the effective volumetric makeup rate.

For example , 73 gpm at 110°F charged into the system is 95 gpm when heated to 535°F, based on the density change in water from 110°F to 535°F at 2060 psia (62 .2 Ibm/ft3 to 47.7 Ibm/ft3). A similar sensitivity is present for AFW pumped to the SGs. For example , 330 gpm indicated flow is effectively 435 gpm, based on the density change in water from 110°F to 535°F at 1000 psia (62 .0 Ibm/ft3 to 47.0 Ibm/ft3).

3.5.3 Sensitivity of AFW flow split to differences in SG pressure Relatively small differences in SG pressure lead to significant differences in AFW flow to each SG when flow control valves are not available to regulate flow.

For example, with P-8B in service with CV-0727 and CV-0749 full open , and with E-50A pressure at 948 psig and E-50B pressure at 945 psig , the flow split is 179 gpm to E-50A and 187 gpm to E-50B .

However, with E-50A pressure at 860 psig and E-50B pressure at 958 psig , the flow split is 379 gpm to E-50A and 0 gpm to E-50B (see Attachment 10). Steam generator pressure differences are attributable to differences in main steam safety valve characteristics and the P-8B steam supply source (from E-50A).

3.5.4 Sensitivity of PCS temperature to relatively cold AFW makeup to SGs when ADVs not available When ADVs are not available to control PCS temperature, excess AFW significantly decreases PCS temperature. For example during this event, PCS temperature lowered from 540°F to 52rF primarily due to excess AFW addition (700 gpm total).

3.5.5 MSSV operation during relatively benign SG overpressure events Depending on heat input to the steam generators, MSSVs can provide a throttling action and produce a system response similar to ADV operation.

MSSVs initially open to -70% when the setpoint is reached. If pressure continues to rise , MSSVs gradually open further and open fully when pressure reaches -2 .5% above set pressure. As pressure is reduced , MSSVs remain open but close to -25% when pressure lowers to -2 .8%

below set pressure, and close fully when pressure lowers to -3% below set pressure.

For example, the first set of MSSVs open to -70 % at 985 psig. As pressure is reduced , MSSVs close to -25% when pressure lowers to 957 psig and fully close when pressure lowers to 955 psig . This precludes the severe saw-tooth steam generator pressure response that may be familiar from FSAR Chapter 14 analyses (e .g., loss of normal feedwater) .

• ~Entergy Entergy PSA Engineering Analysis EA-PSA-SDP-D11-2-11-07 Page 9 of 36 Rev. 1 4.0 INPUT Inputs are grouped into three categories:

(1) PRA software tools, existing PRA models and evaluations (2) Plant configuration just prior to the event (3) Plant design and operational inputs from the event PRA tools and models input generally define the starting point of the logic model analysis.

Plant configuration inputs define the relevant equipment configuration just prior to and during the maintenance activity that led to the event.

Plant design and operation inputs describe several key design aspects and operation of the plant in response to the event. This is not intended to be an exhaustive description of the plant response (see 1 for a detailed timeline.

4.1 PRA Tools and Models Input 4.1.1 The SAPHIRE software application is used for PRA model quantification. Table 4-1 lists the file specifics.

Table 4-1: SAPHIRE Application (Ref. [2])

Filename 1 Date 1 Time 1 Size SAPHIRE-7-27-852878059.exe 1 6/24/2008 111:48a 1 18,303 KB 4.1 .2 The CAFTA software application is used for creating and viewing PRA model logic. The baseline CAFTA model serves as the starting point of the core damage fault tree model evaluated in this analysis. Table 4-2 below lists the baseline CAFTA files .

Table 4-2: CAFTA Model (Ref. [3])

Filename Description Date Time Size - KB PSAR2c.be PSAR2c CAFTA Basic Event File 6/26/2006 1:42p 1,248 PSAR2c.caf PSAR2c CAFTA Fault Tree File 6/26/2006 1:36p 449 PSAR2c.gt PSAR2c CAFTA Gate Type File 6/24/2006 1:31p 1,024 PSAR2 c. tc PSAR2c CAFTA Type Code File 5/27/2004 9:03a 30 PSAR2c CAFTA Files.zip PSAR2 c CAFTA zip file 6/29/2006 8:47a 289

• ~Entergy Entergy PSA Engineering Analysis EA-PSA-SDP-D11-2-11-07 Page 10 of 36 Rev. 1 4.1.3 The SAPHIRE project model is used for PRA model quantification . Table 4-3 lists the PSAR2c SAPHIRE project file used as the initial data set for this analysis.

Table 4*3: SAPHIRE Quantification (Ref. [3])

Filename Date Time Size* KB Description Caf2Sap PSAR2c.txt 6/29/2006 8:S9a 11 Text rules file used by caf2sap.exe to create MAR-D files.

caf2sap.exe 3/24/2003 8:16a 28 Visual basic application for creating SAPHIRE MAR-D fault tree files .

Creation of Rules File 6/26/2006 2:42p 2,162 EXCEL spreadsheet that creates the *. txt rules file PSAR2c.xls for SAPHIRE MAR-D fault tree assembly.

PSAR2c FTree Logic.ttl 6/29/2 006 9:16a 3,421 MAR-D fault tree file created from the PSAR2c CAFTA master fault tree.

SAPHIRE v7.26 PSAR2c 6/29/2006 9:43a 1,099 Above listed supporting files .

Ftree Files .zip 4.1.4 Table 4-4 defines the house event configuration used in both the base case and maintenance configuration case for this engineering analysis:

Table 4-4: House Event Configuration House Event House Event A-HSE-CST-MAKEUP F I-HSE-M2LEFT-INS T C-HSE-P-S2A-STBY T I-HSE-M2RGHT-INS F C-HSE-P-S2B-STBY T M-HSE-P-2A-TRIP T C-HSE-P-S2C-STBY F M-HSE-P-2B-TRIP F D-HSE-CHGR1-INS T M-HSE-SJAE1-INS T D-HSE-CHGR2-INS T M-HSE-SJAE2-INS F D-HSE-CHGR3-INS T U-HSE-P-7A-STBY T D-HSE-CHGR4-INS F U-HSE-P-7B-STBY F E-HSE-AIR-GT-7SF T U-HSE-P-7C-STBY F E-HSE-AIR-LT-7SF F X-HSE-2SG-BLDN 1 E-HSE-BYPASS-REG T X-HSE-2SG-BLDN-A 1 E-HSE-EDG11 -DEM T X-HSE-2SG-BLDN-B 1 E-HSE-EDG11-RUN T X-HSE-SGA-BLDN 1 E-HSE-EDG12-DEM T X-HSE-SGB-BLDN 1 E-HSE-EDG12-RUN T Y-HSE-LOOP1A-BRK T I-HSE-C-2AC-INS T Y-HSE-LOOP1 B-BRK F I-HSE-C-2B-INS F Y-HSE-LOOP2A-BRK F I-HSE-F-12A-1 NS T Y-HSE-LOOP2B-BRK F I-HSE-F-12B-INS F Y-HSE-RAS-POST F I-HSE-F-SA-INS T Y-HSE-RAS-PRE F I-HSE-F-SB-INS F X-HSE-DOOR-167B T X-HSE-DOOR-167 T Note: O-HSE-CHRGR3-INS is set to True to allow faults on EO-11-2, 72-01 and battery chargers #1 and

1. 3 to fail EO-10L and EO-10R. Charger #3 is not faulted, but is initially set to True to create the loss of dc to the bus and allow consideration of recovery of power to the bus as it was the standby charger.

• ~Entergy Entergy PSA Engineering Analysis EA-PSA-SDP-D11-2-11-07 I Page 11 of 36 Rev. 1 4.2 Plant Configuration Input 4.2.1 Start-up power to bus 1F EA-23 breaker 252-302 out of service.

At the time of the loss of dc event, breaker 252-302 was out of service and cooling tower pump P-39A was powered from breaker 252-301 via station power transformer 1-3 EX-05. As a result, breaker 252-302 is modeled as out of service in this analysis. In the logic model, since the event results in a loss of condenser vacuum and cooling tower pumps support only maintaining condenser vacuum , there is little risk increase associated with this pre-existing condition.

4.2 .2 Feedwater purity air compressors C-903A and C-903B aligned to plant instrument air.

At the time of the loss of dc event, feedwater purity air compressors C-903A and C-903B were cross-tied to instrument air via CV-1221 . This alignment was a contingency. Work planning recognized instrument air compressor standby start may not work if dc power was lost due to the maintenance activity.

C-903A and C-903B are powered from MCC #91 by bus 1E. The loss of dc event resulted in a safety injection signal , subsequent bus 1E load shed and loss of power to C-903A and C-903B.

This may have contributed to the transient in instrument air header pressure. Instrument air was not lost during the event (ONP-7.1 was entered for low header pressure). Since instrument air was not lost as a result of the event, instrument air failures are not modeled as an initial condition for the event. Normal instrument air out of service events are included (see Assumption 5.1.5).

Note: Feedwater purity air is not credited as a backup to instrument air in the logic model.

4.3 Plant Design and Operation Event-Specific Input Event-specific consequential failures and impacts are discussed below. Section 6.3 provides additional information regarding credited recoveries and Attachment 07 provides modeling detail. Events listed in 7 that are intentionally failed because of the event, are annotated with "(event consequential failure)" and those failed but recovered are annotated with "(event consequential failure - surrogate for recovery HEP)".

4.3.1 Logic Model Consequential Failures Event-related consequential failures described in Section 3.1 are captured in the logic model with the following basic events.

Table 4.3-1: Logic Model Event Consequential Failures Impacted Components Associated Basic Event Comment Manual isolation of steam supply renders P-8B unavailable without TO AFW pump P-8B A-PMME-P-8B additional operator action.

1. 1 battery charger EO-15 O-BCMT-EO-15 Charger damaged and not recovered during event.

Alternate charger used to supply #1 battery EO-01 and dc buses

1. 3 battery charger EO-17 O-BCMT-EO-17 EO-10L and EO-10R.

Modeled components are breakers 72-119 , 72-129 and 72-136. 72-119 never restored , treated as unrecovered. 72-129 and 72-136 dc panel EO-11-2 O-CBMC-72-119 recovered as a result of restoration of power to EO-1 OLlEO-1 OR without any additional actions.

• ~Entergy Entergy PSA Engineering Analysis EA-PSA-SDP-D11-2-11-07 I Page 12 of 36 Rev. 1 Table 4.3-1: Logic Model Event Consequential Failures Impacted Components Associated Basic Event Comment House flag to allow crediting of alignment of alternate battery

(#3 battery charger ED-17) D-HSE-CHGR3-1 NS charger.

Restores ED-10L and ED-10R and allows charging of#1 battery shunt trip breaker 72-01 D-HSMC-HS-72-01 ED-01 .

(charging pumps) G-PMOA-TRIP-PUMP Operator action event added to model challenge to PZR SRVs.

2400 v ac bus 1E P-B 1MK-EA-13 Captures loss of bus 1E due to loadshed on safety injection signal.

preferred ac bus EY-10 P-PAMK-EY-10 Captures loss of preferred ac bus restore EY-10.

preferred ac bus EY-30 P-PAMK-EY-30 Captures loss of preferred ac bus restore EY-30.

Not required to be failed or restored , since EY-10 modeled as

1. 1 inverter ED-06 nfa powered from bypass regulator only.

4.3.2 Operation of the atmospheric dump valves (ADVs) via quick open and manual control is unavailable until power is restored to preferred ac bus EY-10.

The loss of dc event resulted in loss of power to the inverter that supplies preferred ac bus EY-10.

Power can be restored by restoring power to the dc bus and re-energizing the inverter or aligning the bypass regulator to re-energize the preferred ac bus. EY-10 was placed on bypass regulator at 16:46, one hour forty minutes into the event.

4.3.3 Automatic start of auxiliary feedwater pump P-8A is unavailable until power is restored to dc panel ED-11-1 . However, P-8A remained available for manual start from the control room or locally. After restoration of power to ED-11-1, P-8A is capable of automatic start on auxiliary feedwater actuation signal. If dc panel ED-11-1 power is restored prior to restoration of preferred ac panel EY-10 or EY-30 with P-8A running a spurious low suction pressure trip would occur.

The loss of dc event resulted in loss of power to EY-1 0, EY-30 and ED-11-1 . Loss of EY-10 and EY-30 brings in the AFW pump low suction pressure trip. However, loss of power to ED-11-1 prevents relaying this signal to the P-8A start circuit. Since ED-11A remained available, P-8A remained available on manual start from control room or locally under this condition .

Restoring power to either preferred ac bus clears the low suction pressure trip signal : the power supplies are redundant and either provides appropriate power to the low suction pressure trip logic.

4.3.4 Auxiliary feedwater pump P-8B starts and runs (mechanical governor maintains normal turbine/pump speed) on loss of left channel dc until manual isolation or control is restored on recovery of left channel dc power. AFW P-8A1B flow control valves open fully on loss of preferred ac buses EY-10 and EY-30.

The loss of dc event de-energized left channel dc power and preferred ac power buses EY-1 0 and EY-30. Loss of left channel dc power starts P-8B. Loss of preferred ac power buses EY-10 and EY-30 opens flow control valves full open . Steam supply to P-8B was manually isolated at 16:03. P-8B flows to each steam generator are given in Attachment 10. Attachment 04 provides an accounting of AFW delivered to the steam generators during the event.

• ~Entergy Entergy PSA Engineering Analysis EA-PSA-SDP-D11-2-11-07 I Page 13 of 36 Rev. 1 4.3.5 Auxiliary feedwater pump p-se starts on auxiliary feedwater actuation signal given P-SA failure to deliver required flow (due to loss of left channel dc). Flow control valves set to 165 gpm to each steam generator since right channel dc available.

The loss of dc event de-energized left channel dc power. Right channel dc power remained available and started p-se, with flow control valves controlling to 165 gpm to each steam generator. p-se flow to E-50A was isolated due to overfill concerns at 15:44. p-se flow to E-50B was isolated at 16:09 due to adequate E-50B level.

p-se flows to each steam generator are given in Attachment 10. Attachment 04 provides an accounting of AFW delivered to the steam generators during the event.

4.3.6 Power from bus 1E is lost on a safety injection signal and is not available until re-energized by operators.

The loss of dc event de-energized preferred ac power buses EY-10 and EY-30. This combination of failures is sufficient to generate a spurious right channel safety injection signal. The safety injection signal results in load shed of bus 1E. This is a design feature of the plant and is addressed by both operator training and procedural guidance.

Loss of bus 1E results in loss of feedwater purity air compressors, which were aligned to instrument air prior to the event. See Input 4.2 .2.

Power was restored to bus 1E at 15:49, about -45 minutes into the event. On restoration of power to preferred ac bus EY-30 a second (left channel) safety injection signal occurred that again resulted in load shed of bus 1E at 15:57 and was promptly restored at 16:02 .

4.3 .7 Initial charging flow was 93 gpm. About 30 minutes into the event charging flow was reduced to 73 gpm.

The loss of dc event resulted in failure of the in-service channel A pressurizer level, heater and pressure control circuits. With no power to level control channel A the control program defaulted to maximum flow from the operating pumps (93 gpm : P-55A - 53 gpm; P-55B - 40 gpm).

At approximately 30 minutes into the event operators switched pressurizer pressure control to channel B to enable pressurizer spray. Operators also switched pressurizer level control to channel B. With channel 'B' in service charging flow reduced to the minimum flow from operating pumps (73 gpm: P-55A - 33 gpm; P-55B - 40 gpm).

Had channel 'B' level control been in service at the time of the event, automatic level control of charging flow would have remained available. In service charging pump flow would have been reduced to minimum flow at time zero (73 gpm: P-55A - 33 gpm; P-55B - 40 gpm). No credit for this configuration is taken in the analysis.

4.3.S Absent additional electrical failures, loss of any two preferred ac buses de-energizes all control rod clutch power supplies. If there are no mechanical failures, all control rods insert.

The loss of dc event de-energized preferred ac power buses EY-10 and EY-30. Loss of EY-30 de-energized control rod clutch power supplies #1 and #2. Loss of EY-10 and EY-30 resulted in multiple 2 out of 4 RPS channel signals (e.g ., low steam generator water level, low steam generator pressure) that de-energized clutch power supplies #3 and #4. Therefore, all control rod clutch power supplies de-energized . All control rods inserted.

All other combinations of loss of two preferred ac buses result in either direct loss of clutch power

~Entergy Entergy PSA Engineering Analysis EA-PSA-SDP-D11-2-11-07 Page 14 of 36 Rev. 1 supply, generation of multiple 2 out of 4 RPS channel signals, or combinations of these . As a result, loss of any two preferred ac buses interrupts all control rod clutch power supplies.

Given the loss of one dc channel de-energizes all clutch power supplies, many types of electrical RPS failures are eliminated (i.e., have no consequence). This reduces probability of electrical RPS failures (ATWS events).

This analysis leaves the ATWS event tree and RPS electrical failure probability unchanged , which represents a conservatism with respect the evaluation of the loss of dc event. This conservatism is eliminated if baseline risk (CCDP with no event-induced faults) is subtracted from the event risk (CCDP with event-induced faults and recoveries).

~Entergy Entergy PSA Engineering Analysis EA-PSA-SDP-D11-2-11-07 Page 15 of 36 Rev. 1 5.0 ASSUMPTIONS Assumptions in this engineering analysis are classified as major or minor. Major assumptions are those that may (but not necessarily) impact results by a factor of 2 or more. Minor assumptions are those that impact results by a factor of less than 2. These assumptions are specific to this engineering analysis.

Assumptions of other risk evaluations (e.g. , full power internal events, etc.) are unchanged unless specifically noted.

5.1 Major Assumptions 5.1.1 The logic model does not credit transition to shutdown cooling following a stuck open pressurizer safety relief valve.

Basis: The transfer event tree for sequences with potential stuck open pressurizer safety relief valves (XFR-SBLOCA-SRV) includes a heading for successful transition to shutdown cooling (SO). To conservatively envelope sequences in which successful transition is not likely, sequences involving transition to shutdown cooling following a stuck open PZR SRV are not credited.

Bias: This assumption is considered conservative as sequences with a stuck open PZR SRV that could reach shutdown cooling are quantified as unsuccessful.

5.1.2 The logic model does not credit charging pumps for mitigation of a stuck open pressurizer safety relief valve LOCA as it is not considered in the current success criteria .

Basis: A stuck open SRV results in a containment high pressure signal and start of containment spray pumps. If spray pumps are tripped in a reasonable amount of time, safety injection and refueling water tank (SIRWT) inventory is sufficient for charging makeup to last the entire 24 mission time. Availability of AFW is necessary for crediting charging makeup to meet the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> mission time (see Attachment 05).

Bias : This assumption is considered conservative since sequences in which tripping spray pumps could avoid the need for HPSI are not credited.

5.1 .3 The logic model considers dc panel EO-11-2 breaker 72-119 unavailable throughout the event.

Basis: Portions of EO-11-2 loads were restored at 15:57 by restoration of power to EO-10LlEO-10R. However, maintenance activities on several breakers within the panel were ongoing for an extended period of time. Three EO-11-2 breakers are modeled in the PRA: 72-119 (instrument air compressor control circuits), 72-126 (service water valves to containment control circuits) and 72-136 (EOG 1-1 control circuits). Restoration of power to EO-11-2 restored power to breakers 72-129 and 72-136. However breaker 72-119 remained unavailable throughout the event.

Bias: This assumption is considered neutral since it reflects actual plant configuration during the event.

• ~Entergy Entergy PSA Engineering Analysis EA-PSA-SDP-D11-2-11-07 Page 16 of 36 Rev. 1 5.1.4 The logic model requires two out of three service water pumps to support containment heat removal for sequences in which pressurizer safety relief valves function normally and reseat after a demand.

Basis: The logic model considers containment heat removal can be accomplished by operation of containment air coolers or containment sprays. Successful operation of containment air coolers requires one of three air coolers to maintain containment pressure below capacity. Successful operation of containment sprays requires one of three containment spray pumps and one of two shutdown cooling heat exchangers. Service water is required to remove heat from heat exchangers via the component cooling water system to the ultimate heat sink (Lake Michigan).

Two of three service water pumps are required for containment air coolers , since a single pump cannot support containment and shutdown cooling heat removal requirements. However, containment heat removal requirements are based on a double steam generator blowdown in containment and shutdown cooling heat removal requirements are based on decay heat requirements.

For success branches with non-stuck open relief valves and with continuous charging and secondary side heat removal , PZR SRVs are chattering and relieving excess makeup.

Containment heat removal is required to maintain containment pressure less than design.

If containment high pressure occurs due to the chattering relief valve , SIRWT inventory is depleted, charging suction source is unavailable and the LOCA is terminated (since relief valves are not failed in these success branches). In these sequences, containment heat removal is retained to demonstrate safe and stable (decreasing) containment pressure and temperature trends at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

For all of these sequences, containment heat loads are lower than for a double steam generator blowdown such that a single service water pump would likely meet heat loads.

Bias: This assumption is considered conservative. Two of three service water pumps are modeled as required for containment heat removal when a single pump is likely adequate. An examination of cutsets for the affected sequence (21-02) indicates this assumption increases the CCDP by as much as 1.0E-07.

5.1.5 The logic model considers normal equipment maintenance unavailabilities.

Basis: It is known that certain equipment was not out of service due to maintenance at the start of the event. However, it is possible that under other circumstances this equipment may have been out of service for maintenance. For equipment known to be in-service (Le., not tagged out for maintenance), basic events representing average maintenance unavailability were left in the model.

Bias: This assumption is considered conservative because inclusion of maintenance unavailability events for components known to be not tagged out for maintenance may increase the risk result. For example, events representing P-8C out of service due to maintenance may be included in the cutset solution despite P-8C not having been out for maintenance at the start of the actual event.

• ~Entergy

. Entergy PSA Engineering Analysis EA-PSA-SDP-D11-2-11-07 I Page 17 of 36 Rev. 1 5.2 Minor Assumptions 5.2.1 The logic model initial condition is a loss of main condenser with a concurrent loss of dc power on buses ED-10L and ED-10R.

Basis: The initial plant response was consistent with a loss of main condenser event. Loss of power to the dc buses replicates the event given the lack of coordination between protective devices. Loss of EY-1 0 and EY-30 result in 2 of 4 SG pressure sensors reading low. Given EY-40 and ED-21 remain available, a right channel main steam isolation signal occurs. SV-0502 and SV-0513 energize to isolate air supply to, and SV-0514 and SV-0508 energize to vent air from, main steam isolation valves CV-0501 and CV-0510, respectively. Main steam isolation valves close .

Bias : This assumption is considered neutral since it represents a reasonable and appropriate initial condition for the logic models.

5.2.2 The logic model considers power to the dc bus from pre-event in-service #1 battery charger ED-06 unavailable throughout the event.

Basis: Full power to the dc bus from the in-service battery charger #1 failed at the time of the event due to an internal fault. The fault occurred because the charger output breaker remained closed . This is consistent with the actual event.

As a result of the fault condition, the in-service battery charger was isolated from the dc bus and not restored during the event response for an extended period of time. The alternate battery charger was placed in service to restore battery capacity. Whether fuses or internal breakers opened does not alter the consequence of the charger isolation .

Bias: This assumption is considered neutral since it represents the actual #1 battery charger condition over the event time period of interest.

5.2.3 The logic model considers turbine-driven auxiliary feedwater pump P-8B unavailable due to steam supply isolation at time zero, requiring operator action to restore it to service.

Basis: Pump P-8B initially operated as designed and was successful in conjunction with auxiliary feedwater pump P-8C in restoring and maintaining steam generator levels. During the event response with both auxiliary feedwater pumps in operation , steam generator E-50A level increased >90%. Given continued successful operation of pump P-8C and steam generator E-50B level> 60%, operators elected to isolate the steam supply to pump P-8B . Once isolated, operator action would have been required to restore P-8B to service if P-8C subsequently failed or pump P-8A failed after manual start or restoration of dc power.

While the direction to isolate P-8B was given at 15:31 , actual isolation occurred at 16:03 - about 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> in to the event. Palisades MAAP runs [3] indicate one hour of P-8B operation extends to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> the time required for resumption of decay heat removal to prevent core damage.

Bias: This assumption is considered neutral. P-8B operated successfully and was subsequently isolated. By assuming P-8B is unavailable due to steam supply isolation, the logic model includes time-zero failures requiring restoration in the cutset solution despite successful operation of P-8B at time-zero . This is consistent with the failure memory approach.

~Entergy Entergy PSA Engineering Analysis EA-PSA-SDP-D11-2-11-07 Page 18 of 36 Rev. 1 5.2.4 Timeline event times and plant parameters in Attachment 01 and referenced throughout this analysis are approximate and reflect the best known information at this time.

Basis: The PRA group Ops representative developed and independently verified the event timeline and associated plant parameters. The PRA group Ops representative is a former Palisades SRO and has served as a Palisades Shift Manager and Operations Superintendent.

The timeline was developed using process information (PI) data , plant process computer data (PPC), operator logs (eSOMS), and control room recorder instrumentation. The timeline was verified by extensive on-shift crew interviews/discussions, the Ops reconstruction meeting, and crew peer check of indicated event times, parameters, and crew motivation/awareness.

Given loss of instrumentation during the event, uncertainties in the PI data, and necessary interpretation of operator log event times, the exact timing of some events may never be definitively known. Wherever specific times are used or discussed , the analysis considers that the times are approximate and may have been different.

Bias: This assumption is considered neutral since it represents the best known information at this time. This assumption is considered minor since timeline uncertainty has been considered in the analysis and bounded where necessary.

6.0 METHODOLOGY 6.1 Thermal-Hydraulic Model See Attachment 05 for the MAAP thermal-hydraulic methods and analyses.

6.2 Logic Model 6.2 .1 Transient with Loss of Main Condenser Event Tree The transient induced by a loss of one train of dc power follows closely a transient with main condenser unavailable with the additional components lost due to the event set as failed (primarily EO-1 OL and EO-10R). Loss of EY-10 and EY-30 results in (spurious) 2 of 4 low steam generator pressure signals and (with EY-40 available) generates a right channel main steam isolation signal. This closes both main steam isolation valves, isolating the condenser. Therefore, the transient with loss of main condenser (LOMC) event tree was selected as the starting point for this analysis.

Given the event, the initiating event frequency IE_LOMC is set to unity - casting the results from core damage frequency to conditional core damage probability. Equipment out of service prior to the event (breaker 252-302) is set to failed (True). Equipment impacted by the dc fault event is set to failed (True or recovery HEP). Normal maintenance unavailabilities are used . The HEP for alignment of the bypass regulator to a preferred instrument ac bus is corrected to be consistent with the human reliability analysis.

See Attachment 07 for a listing of event-specific change sets used in this analysis.

A significant aspect of this event involved the potential challenge to the pressurizer safety relief valves. A transfer event tree representing a loss of coolant accident due to a stuck open relief valve is added to capture the risk due to failures to mitigate this consequential event. See Attachment 06 for a schematic representation of the event trees.

The event tree for transient with loss of main condenser (TR-MCNO) is modified to address the challenge to pressurizer safety relief valves. Heading RXC is not changed and represents failure of reactor trip and the model of record ATWS sequences. Heading CONS-LOCA-FT represents the transfer to the pressurizer safety relief valve LOCA event tree (XFR-SBLOCA-SRV). All sequences in which the operator

• ~Entergy Entergy PSA Engineering Analysis EA-PSA-SDP-D11-2-11-07 Page 19 of 36 Rev. 1 fails to trip charging pumps prior to challenging the SRVs are transferred . Therefore the entry condition for XFR-SBLOCA-SRV is that PZR SRVs have been lifted . The remaining non-transferred sequences represent the model of record sequences for the transient with loss of main condenser tree.

6.2.2 Transfer ATWS Event Tree Heading RXC and ATWS transfer event tree (XFR-ATWS) have not been changed. These sequences represent the model of record ATWS sequences. Given the loss of one channel of dc interrupts all clutch power supplies, many electrical RPS failures are eliminated. Leaving the ATWS event tree unchanged represents a conservatism with respect to the evaluation of the loss of dc event. See Input 4.3.8. This conservatism is eliminated if baseline risk (CCDP with no event-induced faults) is subtracted from the event risk (CCDP with event-induced faults and recoveries) .

6.2 .3 Transfer PZR SRV LOCA Event Tree The transfer event tree for pressurizer safety relief valve LOCA (XFR-SBLOCA-SRV) is structured consistent with the model of record success criteria for PZR SRV LOCAs. Heading 2HP asks if secondary cooling is available via the steam generators. If so, high pressure safety injection is not required for decay heat removal if long term secondary side cool ing is available and the PZR SRVs do not stick open . If not, the transient progresses as a loss of secondary heat sink and once-through-cooling is required.

If secondary cooling is available, it is important to determine if an actual LOCA has occurred , versus successful opening and closing of the SRVs. Safety relief valve failures are captured by headings PZR-SAFETI ES-FTC.

Success branches on PZR-SAFETIES-FTC represent normal functioning safety relief valves - opening when required and closing when required . In these sequences, successful long term makeup to the condensate storage tank precludes core damage. No inventory makeup is required since relief valves are only relieving excess charging (if charging is never tripped). If long term cooling is not successful, once-through-cooling is required .

For success branches on PZR-SAFETIES-FTC (non-stuck open relief valves) with continuous charging ,

SRVs are chattering and relieving excess makeup. Containment heat removal is required to maintain containment pressure less than design .

For success branches on PZR-SAFETIES-FTC (non-stuck open relief valves) , if conta inment high pressure occurs due to the relief valve discharge, SIRWT inventory is depleted , the charging suction source is unavailable and the LOCA is terminated (since relief valves are not failed in these success branches). In this case , containment heat removal is still retained to demonstrate safe and stable (decreasing) containment pressure and temperature trends at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. See Assumption 5.1.4.

For some plants, failure to re-close after several cycles of steam relief is considered to be less probable than failure to re-close after water rel ief. However, Palisades ' safety relief valves have been tested/qualified for water relief so the failure probabilities remain the same (See Section 6.4).

Failure branches in PZR-SAFETIES-FTC represent above-core, vapor space LOCAs requiring either secondary side heat removal and HPSI for makeup or once-through-cooling.

For failure branches on PZR-SAFETIES-FTC (stuck open relief valves) , if charging is successful for inventory control , core damage is precluded provided secondary heat removal remains available (AFW and long term makeup to the condensate storage tank). This presumes conta inment sprays are secured such that SIRWT inventory remains available for the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> mission . Recall Assumption 5.1.2 states that this success path is conservatively ignored . Therefore charging and HPSI recirculation are required for success.

• ~Entergy Entergy PSA Engineering Analysis EA-PSA-SDP-D11-2-11-07 Page 20 of 36 Rev. 1 If charging fails (or is not credited , as is the case), HPSI can prevent core damage with or without secondary side heat removal , with either:

• successful shutdown cooling (also not credited), or

• AFW and long term makeup to the condensate storage tank.

With secondary side heat removal , HPSI is successful by providing inventory makeup only - PORVs are not required for decay heat removal since secondary side heat removal is available.

Without secondary side heat removal , HPSI is successful by supporting once-through-cooling (Le., with PORVs).

If HPSI is not successful , core damage results since either or both inventory make-up and decay heat removal capabilities are lost.

Again on all success paths with stuck open relief valves , the LOCA results in the need for HPSI , since the SIRWT may be depleted before either reaching shutdown cool ing or before depleting condensate storage tank T-2. HPSI injection and recirculation (HPSI-SI and HPSI-REC) and containment heat removal are therefore required for both inventory makeup and containment cooling .

Above-core, vapor-space LOCA analyses that credit charging are described in Attachment 05 . These are performed to demonstrate margin only, and are not used as new success criteria.

Event tree features of note include:

• Shutdown Cooling Transition to shutdown cooling following a stuck open pressurizer safety relief valve is not cred ited .

Event tree XFR-SBLOCA-SRV includes a heading for successful transition to shutdown cooling (SD). No sequences involving transition to shutdown cooling following a stuck open PZR SRV are credited in th is analysis. See Assumption 5.1.1.

• Charging Pumps Utilization of charging pumps to avoid the need for high pressure safety injection is not credited .

A stuck open SRV results in a containment high pressure signal and start of containment spray pumps . If spray pumps are tripped in a reasonable amount of time , safety injection and refueling water tank (SIRWT) inventory is sufficient for makeup to last the entire 24 mission time. Since all sequences that involve a stuck open PZR SRV are modeled as requiring recirculation mode HPSI for inventory makeup, tripping spray pumps is not credited in this analysis. See Assumption 5.1.2 .

6.3 Human Error Probabilities Table 6.1-1 summarizes human error probabilities used in this analysis . The following discussion provides the basis for chosen values. See Attachment 12 for HRA calculator output.

Procedure guidance and training exists and was utilized for recovery and restoration of impacted components. The use of screening values does not imply lack of adequate training or procedural guidance. The actions would occur as expected based on available procedures and training.

• ~Entergy Entergy PSA Engineering Analysis EA-PSA-SDP-D11-2-11-07 Page 21 of 36 Rev. 1 The context, system windows and performance shaping factors are considered to ensure values are appropriate and consistent with site HRA practices. The HEPs were reviewed to:

1) Evaluate if currently developed HEPs require adjustment for the specific event (higher probabilities by assigning higher stress, complexity of action, etc).

2) Evaluate screening HEPs to assure values assigned are appropriate.

Table 6.3*1: Recovery Human Error Probabilities Estimated Actual Impacted Components Recovery HEP Recovery Time TO AFW pump P_8B(1) restore isolated steam supply 3 hrs 46 min (1852) 1.0E-02

1. 1 battery charger EO-15 restore normal charger longer term not recovered

1. 3 battery charger EO-17 restore alternate charger 4 hrs 27 min (1933) 1.0E-01 shunt trip breaker 72-01 restore battery E 0-0 1 51 rnin (1557) 1.0E-01 trip charging pumps -

charging pumps 51 min (1557) 6.8E-03 prevent challenge to SRVs 2400 v ac bus 1E restore bus 1E 43 min (1549) 2.6E-03 restore EY -10 via preferred ac bus EY-10 1 hr 40 rnin (1646) 3.3E-02

- bypass regulator restore EY-30 via 51 rnin (1557) preferred ac bus EY-30 - bypass regulator 1.0E-01 1 hr 40 min (1646)

- #3 inverter EO-08

1. 1 inverter EO-06(2) 50 hr 27 min restore EY-10 normal supply not recovered (17339/27/11 )

(1) P-8B restored to full operability at 1852. P-8B remained available via manual operation prior to 1852.

(2) EY-10 restored via alignment to bypass regulator. EO-06 not required with EY-10 on bypass regulator.

Turbine Driven AFW Pump P-8B Restoration of AFW pump P-8B uses a screening value of 1.0E-02.

Recovery is governed by ONP-2 .3 and EOP Supplement 19 or SOP-12 . Training is addressed in licensed operator qualification training on a two year periodicity. P-8B operated as designed and was successful in conjunction with auxiliary feedwater pump P-8C in restoring and maintaining steam generator levels .

During the event response with both auxiliary feedwater pumps in operation the level in steam generator E-50A increased to high levels (>90%). Given continued successful operation of pump P-8C and steam generator E-50B level greater than 60%, operators elected to isolate the steam supply to pump P-8B, to maintain P-8B restorable if needed (by avoiding steam generator E-50A overfill). Once isolated , local operator action would have been required to restore P-8B to service should the operating pump (P-8C) fail or pump P-8A fail. While the direction to isolate P-8B was given at 1531 the actual isolation occurred at 1603. See Assumption 5.2.3.

This screening value reflects the considerable time available, extensive training and detailed procedural guidance for restoration of P-8B steam supply. The value is considered conservative since manually opening P-8B steam supply valve CV-0522B was the only action required. EOP Supplement 19 steps to isolate the operator for manual control had already been performed as part of isolation of P-8B. The EOP

• ~Entergy Entergy PSA Engineering Analysis EA~PSA-SDP-D11-2-11-07 Page 22 of 36 Rev. 1 Supplement 19 actions are not needed to restore P-BB steam supply under manual control.

The model includes an HEP (1 .5E-3) for failure to control flow to steam generator E-50A when P-BB is the source. This logic is included as a failure of pump P-BB due to steam generator overfill. Also , note P-BA remained available throughout the event from the control room and locally. See Section 4.3.3.

Note: To implement this recovery , the screening value of 1.0E-02 was logically OR'd with the random pump failure probability of 5.BE-02 resulting in a value of 6.BE-02 used for the surrogate event. See 7.

1. 1 Battery Charger ED-15 Recovery of #1 battery charger ED-15 is not credited .

ED-15 was not fully restored for several days following the event.

1. 3 Battery Charger ED-17 Al ignment of #3 battery charger ED-17 uses a screening value of 1.0E-01 .

Recovery is governed by ONP 2.3 and SOP-30 . Training is addressed in licensed operator qualification training on a two year periodicity. The baseline HEP development results in a value of 4.6E-04. The analysis credits a system window of four hours (battery capacity), with time delay of 35 minutes and an execution time of 35 minutes.

This higher screening value reflects potential dependencies in cues and restoration activities , increased stress, etc.

Shunt Trip Breaker 72-01 Recovery of shut trip breaker 72-01 uses a screening value of 1.0E-01.

This higher screening value reflects potential dependencies in cues and restoration activities , increased stress, etc.

Trip Charging Pumps Prior to PZR SRV Challenge The HEP for tripping charg ing pumps prior to challenging pressurizer safety relief valves is 6.8E-03.

Recovery is governed by the in use EOP and ARPA . Training is addressed in licensed operator qualification training on a two year periodicity. The baseline HEP development results in a value of 2.6E-

03. The development is based on spurious charging and letdown failures that result in a challenge to the pressurizer safeties.

In response to rising pressurizer level and high level alarms (EK-0761 annunciator alarms at 62.75%

level ; EK-0769 alarms at 75% level), operators are cued to trip all operating charging pumps. The action is not completed until other critical safety functions are verified (e.g ., boration for reactivity control) and other conditions are met (e.g., throttling criteria for safety injection).

The baseline HEP development considers two charging pumps operating (actual condition) and the safeties opening at 100% pressurizer level (i.e., ignores the additional volume of the pressurizer head).

• ~Entergy Entergy PSA Engineering Analysis EA-PSA-SDP-D11-2-11-07 Page 23 of 36 Rev. 1 The baseline HEP development considers a 30 minute system window (Tsw) to determine the action is necessary and to complete it; a 2 minute delay time (Tdelay) before the cue is received, and a 2 minute manipulation time (T M) to complete the trip. Note the median response time (T y, ) is not used in the baseline HEP development methodology (CBDTMITHERP).

The baseline HEP development time line is:

30.00 Minutes T dela~ 2.00 Minutes J T112 0.00 Minutes J T M 2.00 Minutes "I '1 "I Irreversible oamagjState r r t=D Figure 6.3-1: Charging Pump Trip Baseline HEP Development The actual event system window was 62 minutes, based on event initiation at 15:06 and predicted time to the irreversible damage state at 16:08 leading to lifting pressurizer safety relief valves at 16: 15. The delay time was 22 minutes (15:28), based on available indication in the control room of pressurizer level greater than or equal to 62.8%. Manipulation time is not changed at 2 minutes. Median response time is based on the actual response time of 29 minutes: action completed at 15:57 - initial cue at 15:28 . Combination method CBDTM/ASEP is used in order to incorporate a time correlation method for execution . See Attachments 01 , 03 and 12.

This event-specific timeline is:

62.00 Minutes T dela~ 22.00 Minutes T 1/2 29.00 Minutes TM 2.00 Minu~ls J J" I "I Irreversible D am~State 1 1 t=D Figure 6.3-2: Charging Pump Trip Event Timeline In the actual event, predicted time to challenge pressurizer safeties (62 minutes) was much longer than in the baseline HEP development (30 minutes). In the actual event 40 minutes (62 minutes - 22 minutes) were available to detect the cue , diagnose the situation, recover from error and complete the action to trip

~Entergy Entergy PSA Engineering Analysis EA-PSA-SDP-D11-2-11-07 Page 24 of 36 Rev. 1 running charging pumps.

The critical safety function for adequate PCS boration (which requires charging flow) competed with charging pump trip. Once operators determined boration requirements were met, safety injection throttling criteria allowed termination of all charging flow. The competing priorities impact the median response time to take the action. A median (actual) response time of 29 minutes following receipt of the high pressurizer level cue was considered .

The baseline HEP development uses 'COMPLEX' versus 'SIMPLE' for cognitive response. The cognitive element is approximately a factor of 10 lower than the calculated execution error. Execution shaping factors are treated as 'SIMPLE'. This is a control room action and only requires the manipulation of hand switches. The baseline HEP development assigns 'LOW' stress to execution and low work load.

For this analysis, it is appropriate to consider a high work load which equates to moderate stress. This increases the HEP to 6.8E-03.

2400 V AC Bus 1E The HEP for restoration of bus 1E is 2.6E-03.

Recovery is governed by EOP Supplement 5 and SOP-30 . Training is addressed in licensed operator qualification training on a two year periodicity. Loss of and restoration of bus 1E is an expected condition based on the event progression (safety injection signal), emphasized in training and well understood by the operators. The principal risk impact is the restoration of water to the condensate storage tank to support continued operation of the operating auxiliary feedwater pump. Should makeup to the condensate storage tank fail, other sources (service water and fire protection) can be connected to the auxiliary feedwater pump suction.

The baseline HEP development considers a system window (Tsw) of 1.6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> (based on maintaining CST level greater than 50% full given 71 % initial level), a 30 minute delay time (T delay) to get to the point in procedures that directs the action, and a 5 minute manipulation (T M) time to complete the alignment.

In the actual plant response power was restored to bus 1E within -45 minutes. The actual time of completion was well within the time considered available to complete it. In addition , on restoration of power to preferred ac bus EY-30 a second (left channel) safety injection signal occurred that again resulted in load shed of bus 1E at 15:57 and was promptly restored at 16:02.

Preferred AC Bus EY-10 The HEP for recovery of preferred ac bus EY-10 via the bypass regulator is 3.3E-02.

Recovery is governed by ONP 24.1 and SOP-30. Training is addressed in licensed operator qualification training on a two year periodicity. A specific operator training Job Performance Measure has historically existed for this action . The baseline HEP development for powering a preferred ac bus via the bypass regulator is 1.7E-02 , based the station black-out coping time.

The baseline HEP development considers a system window (Tsw) of 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> (based on the 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> battery depletion time in the context of battery supplying dc bus under SBO), a 60 minute delay time (T delay) to get to the point in procedures that directs the action , and a 30 minute manipulation (T M) time to complete the alignment. Note the median response time (T y, ) is not used in the baseline HEP development methodology (CBDTMITHERP).

The baseline HEP development time line is:

• ~Entergy Entergy PSA Engineering Analysis EA-PSA-SDP-D11-2-11-07 Page 25 of 36 Rev. 1 4.00 Hours T delay 60.00 Minutes T1/2 0.00 Minutes J T M 30.00 MinuJes J" I -I -I Irreversible DamageState

-I 1 1 t=O Figure 6.3-3: Align Bypass Regulator Baseline HEP Development Bus EY-1 0 was energized from the bypass regulator -100 minutes into the event. The earlier actual completion time is the result of operators entering the event response via a loss of preferred ac power on more than one bus, therefore beginning the event response with this knowledge in mind .

The actual event system window is much longer and therefore bounded by the baseline HEP development timeline, since station black-out conditions did not exist and since right channel dc remained available throughout the event.

The baseline HEP development considered execution shaping factor 'SIMPLE' versus 'COMPLEX' and

'LOW' stress. This analysis considers the execution as 'COMPLEX'. Given the high workload condition, a

'HIGH' stressor is applied , increasing the HEP to 3.3E-02.

Preferred AC Bus EY-30 Recovery of preferred ac bus EY-30 via normal power supply uses a screening value of 1.0E-01.

Recovery is governed by ONP 24.3 and SOP-30. Training is addressed in licensed operator qualification training on a two year periodicity. The baseline HEP development for powering a preferred ac bus via the bypass regulator is 1.7E-02, based the station black-out coping time.

Bus EY-30 was energized from the bypass regulator -50 minutes into the event and from #3 inverter EO-08 -100 minutes into the event. The earlier actual completion times are the result of operators entering the event response via a loss of preferred ac power on more than one bus, therefore beginning the event response with this knowledge in mind.

The actual event system window is much longer and therefore bounded by the baseline HEP development timeline, since station black-out conditions did not exist and since right channel dc remained available throughout the event.

This higher screening value reflects potential dependencies in cues and restoration activities, increased stress, etc.

Note: Use of the screening HEP is conservative for cutsets that involve restoration of EY-30 only, since in these cutsets the HEP is independent. A cutset review indicates the contribution of cutsets involving restoration of only EY-30 is small. Therefore, a reduction of the screening HEP value for cutsets in which no dependency exists was not performed .

• ~Entergy Entergy PSA Engineering Analysis EA-PSA-SDP-D11-2-11-07 Page 26 of 36 Rev. 1

1. 1 Inverter EO-06 Recovery of #1 inverter EO-06 is not credited .

EO-06 was not fully restored for several days following the event. Since restoration of EY-10 is via the bypass regulator, unavailability of EO-06 does not impact EY-1 0 or the results .

~Entergy Entergy PSA Engineering Analysis EA-PSA-SDP-D11-2-11-07 Page 27 of 36 Rev. 1 6.4 Pressurizer Safety Relief Valve Failure Probability The logic model considers the probability of pressurizer safety relief valve failure to re-close after passing steam or water to be represented by the current analysis of record fault tree PZR-SAFETIES-FTC. This captured in the logic model in event tree heading PZR-SRV-FTC-STM.

The model of record fault tree PZR-SAFETIES-FTC and basic event probabilities are given below.

I FAL TOa.Ose I I I I I I I Table 6.4-1 : Pressurizer Safety Relief I I Valve Failure Probabilities PRESSLRIZER SAFETY 2fJ PZR SAFETY VALVE RV-1039 FTC VALVE RflIEF Y.*.lVES (GIVEN SP\JOOUS - FTC OI...E TO CCAUSE 1lEMA>(>>) (GMN SPlRIOUS DE ...

Basic Event Probability W-RVCC-RV-20F3 1.340E-004 W-RVCC-RV-30F3 9.S20E-00S

-RVMB-RV-1 041 W-RVMB-RV-1039 3.690E-003 W-RVMB -RV-1040 3.690E-003 PZRSAFETY VAJ.VE RV-1040 fTC (GNEN SPlRIOUS DEMAN>>) W-RVMB-RV-1041 3.690E-003 RYMB-RV-1040 NUREG/CR-6928 [4] gives a value of 1.0E-01 for safety relief valve fail to close after passing liquid (SVV FTCL). However, this failure mode is not supported by EPIX data. The value was obtained by reviewing the fail to close data in the Westinghouse Savannah River Company database [5]. To approximate fail to close after passing liquid, the highest 95th percentiles for fail to close were identified from that source.

The highest values were approximately 1.0E-01. This value would be considered reasonable in the absence of any additional information .

Palisades' safety relief valves are Dresser safety valve model 31739A. The valves are totally enclosed pop-open-type valves, spring-loaded, self-actuating, and have backpressure compensation.

The valves are designed to prevent the reactor coolant system pressure from exceeding the design pressure by more than 10%. This meets the requirements of the ASME Boiler and Pressure Code,Section III. As-left lift pressure setpoints are: RV-1039 2565 psig (range: 2542 to 2588 psig), RV-1040 2525 psig (range: 2503 to 2547 psig), RV-1041 2485 psig (range 2463 to 2507 psig).

The valves are mounted on short vertical inlet pipes welded to the pressurizer safety valve nozzles, sitting almost directly on the pressurizer top head .

Dresser model 31739A valves have been qualified for steam, transition and water relief as part of TMI Action Plan item NUREG-0737 II.D.1A [6] . A total of 31 full scale tests were performed at nominal set pressure of 2515 psia. The valves were tested under four general conditions: steam , steam-to-water

• ~Entergy Entergy PSA Engineering Analysis EA-PSA-SDP-D11-2-11-07 Page 28 of 36 Rev. 1 transition, water, and water seal conditions at pressures up to 2750 psia. Test conditions were based on consideration of PWR FSAR and extended high pressure liquid injection events.

Under steam, steam-to-water transition and water conditions, valve performance tested stable and satisfactory operation was observed . In all cases, the valve closed in response to system depressurization .

The model for PZR SRV failure is considered conservative. NUREG/CR-6928 gives a mean value SW FTC of 7.0E-05 per demand; NUREG/CR-7037 [7] gives a mean value SVV FTC of 3.39E-4 per demand .

6.5 Significance Determination Color Criteria NRC Inspection Manual , Manual Chapter 0609, "Significance Determination Process" indicates the breakpoints for LlCDF and LlLERF. Informed by these , the following presents the breakpoints considered in this analysis:

• ~Entergy Entergy PSA Engineering Analysis EA-PSA-SDP-D11-2-11-07 I Page 29 of 36 Rev. 1 7 .0 ANALYSIS The base analysis is given in Section 7.1; sensitivity studies are given in Section 7.2.

7.1 Evaluation of Increased Plant Risk Validation of Current Model of Record (PSAR2C)

The baseline results with nominal system alignment (at 1E-09 truncation) for the current model of record (Ref. [3]) are:

MCUB Type CDF # Cutsets Sequence MCUB 2.611 E-05 (non-subsumed) 2362 End State MCUB 2.4B9E-05 (subsumed) 170B Validation of the model was completed by quantification with nominal maintenance unavailabilities to confirm that the stated results were duplicated . The results were correctly replicated .

DC Panel ED-11-2 Fault Event Results Results are given below.

Table 7.1-1: Results Condition CCDP Description Baseline Risk 2.2E-06 Reactor trip with loss of main condenser and ATWS sequences considered . Pressurizer safety valve demand sequences not included (not part of PSAR2c TR-LOMC). Baseline maintenance unavailabilities used, with equipment out of service just prior to event taken OOS (252*302). Failure to trip charging pump HEP set to O.

Risk Following ED*11-2 Fault Event 6.5E-06 See Section 6.3 for ED*11-2 fault related recoveries credited .

Risk Increase 4.3E-06 t.CCDP Cutset Review The top 100 cutsets are given in Attachment OB.

Cutsets 1 and 2 comprise 25% of the risk and represent scenarios from the baseline solution involving random failures only, i.e., not related to the dc fault event. Cutsets 1 and 2 are ATWS sequences that involve failure to initiate charging , unfavorable moderator temperature coefficient window, and/or failures of pressurizer safeties to open or close . These cutsets represent failures of primary coolant system overpressure protection, heat removal, and/or long term reactivity control. These cutsets are not expected to result from a loss of dc.

~Entergy Entergy PSA Engineering Analysis EA-PSA-SDP-D11-2-11-07 I Page 30 of 36 Rev. 1 Cutset 3 comprises 2% of the risk and is dc fault related. Cutset 3 involves failure of secondary side cooling and failure of once-through cooling . High pressure feed fails from a common cause failure to start of all three AFW pumps. Low pressure feed fails as a result of the loss of EY-10 and subsequent loss of the ADVs , preventing timely depressurization . Once-through-cooling fails on operator fa ilure to initiate OTC .

Cutset 4 comprises 1% of the risk and is not related to the dc fault event. Cutsets 4 is an A TWS sequence that involves mechanical failure of control rods to insert and failure of the operator to initiate charging flow for boration. Turbine trip is successful, pressurizer safeties open and close and moderator temperature coefficient is negative with respect to the criterion .

Cutset 5 comprises 1% of the risk and is similar to cutset 3. Cutset 5 involves failure of secondary side cooling and failure of once-through cooling . High pressure feed fails from operator failure to control AFW flow given instrument mis-calibration. Low pressure feed fails as a result of the loss of EY-1 0 and subsequent loss of the ADVs , preventing timely depressurization . Once-through-cooling fails on operator failure to initiate OTC, given the failure to control AFW flow and instrument mis-calibration.

Cutset 6 (and remaining cutsets) comprises less than 1% of the risk and is not related to the dc fault event. Cutsets 6 is an ATWS sequence that involves failure of primary coolant system overpressure protection (pressurizer safeties opened but failed to close).

Cutset 7 is dc fault related and is similar to cutsets 3 and 5. Cutset 7 involves failure of secondary side cooling and failure of once-through cooling. High pressure feed fails from a common cause failure to start of all three AFW pumps. Low pressure feed fails as a result of the loss of EY-10 and subsequent loss of the ADVs , preventing timely depressurization . Once-through-cooling fails on operator failure to initiate OTC , given the failure to manually isolate ADVs.

Cutsets 8 and 9 are dc fault related and represent excess steam demand events. These cutsets involve failure of secondary side cooling and failure of once-through cooling. High pressure feed fails from a combination of loss of ADVs , resulting in lifting and sticking open a MSSV and causing an excess steam demand event. Loss of dc power and operator failure to start and air compressor prevents AFW to the unaffected generator. Low pressure feed fails as a result of the loss of EY-1 0 and subsequent loss of the ADVs , preventing timely depressurization . Once-through-cooling fails due failure to open one PORV due to random failure and the other due the loss of dc control power.

Cutset 10 is dc fault related and is similar to cutsets 3, 5 and 7. Cutset 10 involves failure of secondary side cooling and failure of once-through cooling. High pressure feed fails from a common cause failure to start of all three AFW pumps. Low pressure feed fails as a result of the loss of EY-1 0 and subsequent loss of the ADVs , preventing timely depressurization. Once-through-cooling fails from a common cause failure of both PORVs to open.

Cutset 11 is dc fault related and represents a challenge to the pressurizer safety relief valves .

This cutsets represent a challenge to the PZR SRVs with successful long term secondary side cooling but does not result in a stuck open relief valve LOCAs . Operators fail to trip charging pumps in time to prevent lifting PZR SRVs, but the valves perform as designed and do not stick open. The cutset involves failure of containment heat removal due to loss of service water. Loss of service water results in failure of CCW cooling to containment spray pumps and loss of cooling for containment air coolers. In this sequence, loss of service water is caused by common cause failure (plugging) of all three service water pump discharge basket strainers.

Cutset 12 is dc fault related and is similar to cutset 3. Cutset 12 involves failure of secondary side

~Entergy Entergy PSA Engineering Analysis EA-PSA-SDP-D11-2-11-07 Page 31 of 36 Rev. 1 cooling and failure of once-through cooling . High pressure feed fails from a common cause failure all three AFW pump discharge check valves. Low pressure feed fails as a result of the loss of EY-10 and subsequent loss of the ADVs , preventing timely depressurization. Once-through-cooling fails on operator failure to initiate OTC.

Cutset 13 is dc fault related. Cutset 13 involves failure of secondary side cooling and failure of once-through cooling. High pressure feed fails from loss of all three AFW pumps: P-8A fails to start due to a consequential low suction pressure trip, P-8B fails to run (random), P-8C fails on common cause failure to start with high pressure injection pumps P-66A&B. Low pressure feed fails as a result of the loss of EY-10 and subsequent loss of the ADVs , preventing timely depressurization . Once-through-cooling fails due to failure of both HPSI pumps due to common cause .

Cutsets 14 and 15 are dc fault related and are similar to cutset 3. These cutsets involve failure of secondary side cooling and failure of once-through cool ing. High pressure feed fails from a common cause failure to start of all three AFW pumps. Low pressure feed fails as a result of the loss of EY- 10 and subsequent loss of the ADVs , preventing timely depressurization. Once-through-cooling fails on operator failure to initiate OTC, given the failure to control AFW flow and/or instrument mis-calibration .

Cutset 16 is dc fault related and is similar to cutset 3. Cutset 16 involves failure of secondary side cooling and failure of once-through cool ing . High pressure feed fails from a common cause failure of all four AFW pump injection check valves. Low pressure feed fails as a result of the loss of EY-10 and subsequent loss of the ADVs , preventing timely depressurization. Once-through-cooling fails on operator failure to initiate OTC.

Cutset 17 is dc fault related and is similar to cutset 5. Cutset 17 involves failure of secondary side cooling and failure of once-through cooling. High pressure feed fails from operator failure to control AFW flow given instrument mis-calibration. Low pressure feed fails as a result of the loss of EY-1 0 and subsequent loss of the ADVs, preventing timely depressurization . Once-through-cooling fa ils on operator failure to initiate OTC, given the failure to control AFW flow, instrument mis-calibration , and failure to initiate low pressure feed .

Cutsets 18 and 19 are dc fault related and are similar to cutset 3. These cutsets involve failure of secondary side cooling and failure of once-through cooling . High pressure feed fails from a common cause failure to start of all three AFW pumps . Low pressure feed fails as a result of the loss of EY-1 0 and subsequent loss of the ADVs , preventing timely depressurization . Once-through-cooling fails on HPSI injection due to HPSI recirculation valve failing to remain open.

Cutset 20 represents failure of all four AFW flow control valves due to common cause failure and the human error for failure to initiate once through cooling . This is a base case cutset.

Cutset 21 represents failure of the turbine-driven AFW pump to run , failure of P-8A and P-8C to run due to mis-calibration of low suction pressure trip switches and the human error for failure to align once through cooling. This is a base case cutset.

Cutsets 22 and 23 represent an excessive steam demand event on one steam generator combined with failure of a once through cooling due to a PORV block valve failure to operate on one train and failure of the other PORV train due to loss of dc power and failure to manually start an instrument air (lA) compressor on low IA header pressure. In addition , loss of dc power prevents the operator from term inating AFW flow to the generator with excessive steam demand event.

Cutset 24 represents a long term failure to makeup to the condensate storage tank, initiate once-

• ~Entergy Entergy PSA Engineering Analysis EA-PSA-SDP-D11-2-11-07 Page 32 of 36 Rev. 1 through-cooling . The cutset is a base case cutset (not part of the delta CCDP) that is dominated by a human error dependency contribution related to alignment of a long replenishment of the condensate storage tank and failure to align once through cooling .

Cutsets 25 & 26 represent an excessive cooldown on one steam generator with failure of the operator to adjust flow to the steam generators to preferentially use the steam generator without the excessive cooldown combined with an inability to operate the atmospheric steam dump valves on the other generator due to dc power failures. In addition , the cutsets include a human error dependency contribution for failure to adjust AFW flow as discussed above and manually isolate ADVs and initiate once through cooling .

Cutsets directly related to the dc fault event comprise about 48% of CCDP. That is, about 52% of CCDP is part of the baseline risk and is independent of the dc fault event.

Sequence Review Sequence results are given in Attachment 09.

Non-LOCA, non-ATWS sequences represent about 64% of the CCDP. ATWS sequences represent about 28% of CCDP and consequential pressurizer safety relief valve LOCAs represent about 8% of CCDP.

The dominant two sequences are failure of secondary side cooling due loss of high and low pressure feed, and subsequent failure of once-through cooling.

The next dominant sequences are ATWS sequences not related to the dc fault event. These sequences are not part of the LlCCDP result.

Files used in the analysis are:

Table 7.1-2: 10 File Configuration Control Filename Date Time Size Description (KB)

Rev 1 - 2012-01 SAPHIRE v7.27 PSAR2c (D11 -2).zip 1/5/2 01 2 9:54 AM 15,267 SAPHIRE Project

• ~Entergy Entergy PSA Engineering Analysis EA-PSA-SDP-D11-2-11-07 Page 33 of 36 Rev. 1 7.2 Sensitivity Studies 7.2 .1 Impact of HEP screening values for select recovery HEPs Realistic and justifiable values were used for the fault-related recovery HEPs. The use of more conservative values can provide insight into the dependency of the results on the recovery HEPs.

The following recovery related HEPs are evaluated:

Table 7.2-1: Sensitivity Study Human Error Probabilities for Recovery Realistic or Sensitivity Impacted Components Recovery Screening HEP HEP TO AFW pump P-8B restore isolated steam supply 1.0E-02 1.0E-01

1. 1 battery charger ED-15 restore normal charger not recovered not recovered

1. 3 battery charger ED-17 restore altemate charger 1.3E-03 1.0E-01 dc panel ED-11-2 breaker 72-119 not recovered not recovered shunt trip breaker 72-01 restore battery ED-01 1.0E-01 1.0E-01 trip charging pumps charging pumps 6.8E-03 6.8E-03

- prevent challenge to SRVs 2400 v ac bus 1E restore bus 1E 2.6E-03 2.6E-03 restore EY-10 via preferred ac bus EY -10 3.3E-02 1.0E-01

- bypass regulator restore EY-30 via preferred ac bus EY-30 - bypass regulator 1.0E-01 1.0E-01

- #3 inverter ED-08

1. 1 inverter ED-06 (1) restore EY-10 normal supply not recovered not recovered (1) Note: EY-10 restored via alignment to bypass regulator. ED-06 not required with EY-10 on bypass regulator.

The HEPs for restoration of bus 1E and failure to trip charging pumps were not increased in the sensitivity study. The basis for the HEPs are well founded in procedures and training, and are an expected response for any event resulting in a safety injection signal.

The HEP for restoration of the shunt trip breaker 72-01 and restoration of preferred ac bus EY-30 were not increased in the sensitivity study. The screening values used in the baseline analysis are considered to bound realistic HEP values.

~Entergy Entergy PSA Engineering Analysis EA-PSA-SDP-D11-2-11-07 Page 34 of 36 Rev. 1 Results are given below.

Table 7.2-2: Sensitivity Results Applying "Sensitivity HEP" Data from Table 7.2-1 Condition CCDP Description Baseline Risk 2.2E-06 Reactor trip with loss of main condenser and ATWS sequences considered . Pressurizer safety valve demand sequences not included (not part of PSAR2c TR-LOMC). Baseline maintenance unavailabilities used ,

with equipment out of service just prior to event taken OOS (252-302). Failure to trip charging pump HEP set to O.

Risk Following EO-11 -2 Fault Event 8.2E-06 See above for EO-11-2 fault related recoveries credited.

Risk Increase 6.0E-06 l'.CCOP This result confirms the recovery HEPs are risk drivers for this assessment. However, with conservative recovery HEPs, the risk characterization remains WHITE.

~Entergy Entergy PSA Engineering Analysis EA-PSA-SDP-D11-2-11-07 Page 35 of 36 Rev. 1

8.0 REFERENCES

[1] EA-DDC-93-001 , Revision 0, Pressurizer Liquid Level as a Function of Indicated Level to Support Loss of Load Initial Conditions, September 2005.

[2] EA-PSA-SAPHIRE-09-08, Revision 0, SAPHIRE v7.27 Testing and Software Quality Assurance Plan, December 2009.

[3] EA-PSA-PSAR2c-06-10, Revision 0, Update of Palisades CDF Model- PSAR2b to PSAR2c, June 2006.

[4] NUREG/CR-6928, Industry-Average Performance for Components and Initiating Events at U.S.

Commercial Nuclear Power Plants, INLlEXT-06-11119, February 2007.

[5] WSRC-TR-93-262, Savannah River Site Generic Data Base Development (U), Westinghouse Savannah River Company, C.H. Blanton and SA Eide, June 1993.

[6] NP-2770-LD, EPRI/C-E PWR Safety Valve Test Report, Volume 1: Summary, Research Project V102-2, January 1983.

[7] NUREG/CR-7037, Industry Performance of Relief Valves at U.S. Commercial Nuclear Power Plants through 2007, INLlEXT-1 0-17932, March 2011.

• ~Entergy Entergy PSA Engineering Analysis EA-PSA-SDP-D11-2-11-07 Page 36 of 36 Rev. 1 9.0 ATTACHMENTS 1 : Event Timeline 2: Shunt Trip Breaker Coordination 3 : Pressurizer Level and Challenge to Pressurizer Safety Relief Valves 4 : Steam Generator Level and Challenge to Steam Generator Overfill/Loss of Turbine Driven Auxiliary Feedwater Pump 5: Thermal-Hydraulic Analyses 6: Event Trees 7 Change Sets 8: Cutsets 9: Sequences 0: Auxiliary Feedwater Flow Rate to Steam Generators E-50A and E-50B Following the Failure of Bus ED-11-2 on September 25, 2011 1 : Review of NRC Timeline and Impacted Equipment List 2: HRA Calculator Output for Developed HEPs 3: Procedure Use Evaluation for DC Panel ED-11-2 Fault Event

~Entergy Entergy PSA Engineering Analysis EA-PSA-SDP-D11-2-11-07 Rev. 1 Attachment 01 - Page 1 of 13 1 : Event Timeline Chart and Narrative This attachment contains the following :

• Event timeline in chart format (Table A01 -1)

• Event timeline in narrative format

• Annotated plots of pes and SG post trip behavior (Appendix I)

• ~Entergy Entergy PSA Engineering Analysis EA-PSA-SDP-D11-2-11-07 Attachment 01 - Page 2 of 13 Rev. 1 Table A01-1: Event Timeline Chart Saturday 9/24 Sunday 9/25 Sunday 9/25 Friday 9/23 1607 Sunday 9/25 1506 Sunday 9/25 1506 Sunday 9/25 1506 Sunday 9/25 1506 Sunday 9/25 1506 2218 1109 1500 Electrical maintenance Battery chargers Temp mod Electrical While removing bus bar, MSIS (2/4 logic low SG Right channel SIAS (2/4 AFAS (2/4 logic low S/G Right channel CIS/CHR restoring breaker 72- #1 ED-15 and 31973 Installed . maintenance short occurred in dc panel pressu re) due to loss of logic low PZR pressure) level) due to loss of (2/4 logic, RIAX-123 (Emergency #2 ED-16 (Temp power for removed 4 dc ED-11-2 preferred ac buses EY -10 due to loss of preferred ac preferred ac buses EY-10 1805/RIAX-1807) due to Ai rlock ED-123) initially in- breaker 72-121 panel ED-1 1-2 and EY-30 buses EY-10 and EY-30 and EY-30 loss of preferred ac buses service (generator breakers (72- EY-10 and EY-30. Left exciter field 119,72-120,72- chan nel conta inment breaker control) 121 ,72-123) isolation valves closed from 72-127 due to loss of power (test cabinets))

Control room alarm: FWPair Shunt trip breaker 72-0 1 MSIVs CV-0510 and CV- IE bus EA-13 de- Turbine driven AFW pump PCP controlled bleedoff EK-0316 GEN FIELD compressor C- opened de-energizing dc 0501 and E-50B MFRV energized, no power to C- P-BB starts (CV-0522B valves CV-20B3 and CV-FORCING/OVER 903B cross-tied buses ED-10R and ED- CV-0703 closed on MSIS, 903B FWP air failed open due to loss of 2099 close due to EXCITATION cycling supplying pla nt 10L and E-50A MFRV CV- compressor (was cross- ED-11-1). AFW flow CHRIloss of power, on/off air system 0701 closed due to loss of tied supplying plant air). control valves CV-0727 directing fl ow to primary power to EY-10 and EY- Closed MV-CA320 to and CV-0749 fail full- system drain tank T-74 in 30 isolate FWP from open. Flow imbalance contain ment (5 gpm) instrument air. C-2A develops between SGs instrument air compressor due to differential in dome was in "sleep" mode and pressures (no flow started ind ication available)

Multiple containment Dc panels ED-11 -1 and All ADVs CV-0779 , CV- In service PZR level AFW pump P-8C starts PCS unidentified leakage isolation valves position ED-1 1-2, and preferred ac 0780, CV-07B 1, and CV- control channel A fails, (AFAS) supplying 165 > 1 gpm for PCP indication lost buses EY-10 and EY-30 0782 fail chargi ng pumps P-55A gpm to each SG. controlled bleedoff de-energized closedlinoperable (quick and P-55B in service (93 Loss of EY -10 and EY -30 isolation (LCO 3.4. 13.A.1 ,

open and normal gpm), and letdown orifices causes loss of Left B.1, B.2) operation) due to loss of CV-2003 , CV-2004,CV- channel AFAS actuation preferred ac panel EY -10 2005 close (0 (P-BA does not start)

(LCO 3.7.4) letdown), PZR heaters de-energize Entered ONP-7 .1 (72- Preferred ac panel EY -10 MSSVs lift on both SGs In service PZR pressure Inverter #1 ED-06 input Right channel CHP alarm 119 failure ca used loss inoperable LCO 3.8.9 .B control channel A fails, breaker to EY-10, 72-37 (2/410gic,PSX-1B01 /PSX-of service air and CV- (LCO 3.0.3) spray valves CV-1057 tripped (LCO 3.B .7.A) 1803) due to loss of EY-1221 FWP building Preferred ac panel EY-30 and CV-1059 fail closed , 10 and EY-30 panels, no cross-tie to fail open) inoperable LCO 3.B.9.B no spray available actuation (actuation logic (LCO 3.0.3) requirements not met)

Reactor trip (2/4 logic Turbine trip (from reactor Operators enter EOP-1 .0 Battery charger #1 ED-1 5, Dc bus ED-10R RPS) due to loss of trip), generator brea kers Standard Post-Trip output breaker closed but inoperable (LCO 3.8.9 .6) preferred ac buses EY-10 do not open due to loss of Actions charger not operating Dc bus ED-1 OL and EY-30 dc panel 0-11 -1 inoperab le (LCO 3.B .9.6)

• ~Entergy Entergy PSA Engineering Analysis EA-PSA-SDP-D11-2-11-07 Attachment 01 - Page 3 of 13 Rev, 1 Table A01-1: Event Timeline Chart Sunday 9/25 151 5 Sunday 9/25 1517 Sunday 9/251527 Sunday 9/25 1531 Sunday 9/25 1537 Sunday 9/25 1542 Sunday 9/25 1544 Sunday 9/25 1549 Sunday 9/25 1555 MSSVs open and then Operator jumpered Enter EOP-9.0 Operator observed Per EOP-9.0, enter Isolated RV-2006 NCO closed P-8C Restored 1E bus EA- Observed PZR level operate relay 487u (Y-phase) Functional Recovery high E-SOA level ONP-24.1 and ON P- letdown relief by AFW fl ow control valve 13 (lost on SIAS at >62.8% (LCO 3.4.9.A).

(throttle/close/open) to to open generator Procedure (due to <3 (90%). Order given to 24.3 due to loss of placing letdown orifice CV-0737A to isolate 1S06) and reenergized Actual PZR level 78%

maintain SG pressure output breakers 2SF7 out of 4 preferred ac isolate CV-OS22B preferred ac buses stop valves CV-2003, fl ow to E-SOA, associated PZR PCS Tave S44' F and 2SH9 buses avai lable) (steam to AFW pump EY-1 0 and EY-30 CV-2004 , and CV- conti nue supplying heaters P-8B) per EOP 200S to close 16S gpm to E-SOB via Supplement 19 CV-0736A (LCO 3.7.S) 1A bus EA-21 de- PZR level 62% -1S30 Entered ONP- PZR pressure peaks Charging 73 gpm, 0 energized. 2.3 Loss of DC Power high 2200 psig. gpm letdown, S gpm Primary coolant (time not verified) PZR leve l 71 % PCP controlled pumps P-SOA and P- bleedoff to primary SOC stop, P-SOB and system drain tank T-74 P-SOD remain in service Realigned PZR pressu re control to B cha nnel to enable spray, pressure begins lowering Realigned PZR level control and heater control select switch to B channel. Letdown orifices open and RV-2006 (letdown heat exchanger inlet safety relief) lifts due to CV-2009 (letdown containment isolation) being closed on CHRIloss of power. 10 bus EA- 12 PZR backup heaters reenergize Charging pumps P-SSA and P-SSB in service (73 gpm charging, 108 gpm letdown relieving to quench ta nk) 5 gpm PCP controlled bleedoff to PSDT

• ~Entergy Entergy PSA Engineering Analysis EA-PSA-SDP-D11-2-11-07 I

Attachment 01 - Page 4 of 13 Rev. 1 Table A01 *1: Event Timeline Chart Sunday 9/25 1557 Sunday 9/25 1602 Sunday 9/25 1603 Sunday 9/251609 Sunday 9/251615 Sunday 9/25 1621 Sunday 9/25 1630 Sunday 9/25 1639 Sunday 9/25 1646 Electricians report no Charging pu mp P-55B Steam to P-8B turbine CV-0736A closed to SG E-50A MSSVs lift, Entered ONP-7.1 Charging pump P-55B Restored AFW to E- Preferred ac bus EY-faults on dc buses ED- suction relief RV -2096 isolated by closing CV- isolate flow from AFW E-50B MSSVs throttle "Loss of Instrument Air suction and discharge 50B from P-8C 150 30 realigned from 10L and ED-10R. lifting to the equipment 0522B. 0 AFW flow to pump P-8C to E-50B, open. MSSVs then (due to loss of all valves closed to gpm bypass regulator to #3 Reenergized ED-10L drain tank T-80. The E-50A. Still supplying no AFW flow to either operate instrument air isolate suction relief inverter ED-08 supply and ED-10R by tank overfilled causing 165 gpm to E-50B via SG at th is time (throttle/close/open) to compressors at 1557) RV-2096 leak closing breaker 72-01 floor drains to backup P-8C and flow control maintain SG pressure (ED-1 0L and ED-10R on the 590' Auxi liary valve CV-0736A Tave 544' F now operable) Bldg (order sent to isolate P-55B)

Generator field Restored power to 1E PCS Tave 529' F. PZR PZR level peaks high Preferred ac bus EY-breaker 341 opened bus EA-1 3 and level 85% 101.5% 10 placed on bypass when ED-11-2 reenergized regulator. EY-10 reenergized associated pressurizer operable heaters Preferred ac bus EY- ADVs CV-0779, CV-30 powered via 0780, CV-0781 , and bypass regulator (EY- CV-0782 operable due 30 now operable) to EY-10 restored Left channel safety (HI C-0780A now injection actuated powered), started when EY-30 controlling heat reenergized, resulting removal using ADVs.

in loss of 1E bus EA- MSSVs close 13 Tave 540' F Throttled safety injection. Stopped charging pumps P-55A and P-55B. Charging flow 0, letdown flow 0, 5 gpm PCP controlled bleedoff to PSDT.

PZR level 80%

When dc restored, instrument air compressor C-2A tripped due to trip circuit being reenergized Control room manually started instrument air compressors C-2B and C-2C

• ~Entergy Entergy PSA Engineering Analysis EA-PSA-SDP-D11-2-11-07 I Attachment 01 - Page 5 of 13 Rev. 1 Table A01-1 : Event Timeline Chart Sunday 9/25 1720 Sunday 9/251746 Sunday 9/25 1818 Sunday 9/25 1852 Sunday 9/25 1909 Sunday 9/25 1911 Sunday 9/251923 Sunday 9/25 1933 Sunday 9/25 2100 Entered ON P-4.1, Exited EOP-9 and Reset SIAS Restored *P-BB steam Exited ON P-24.1, Loss Exited ON P-24.3, Loss EO-0 1, main station #3 battery charger EO- P-910 (main Contai nment Spurious entered GOP-B, Power supply CV-0522B to ofY-10 ofY-30 battery left channel, 17 in service supplying co ndenser vacuum Isolation, reset CHR Reduction and Plant AUTO (LCO 3.7.5) inoperable per 3.B.4.B EO-01 (battery pump) in-service Shutdown to Mode 2 (no connected battery chargers #2 and #3 or Mode 3 ~ 525°F(AII charger and now in service) 4 preferred ac buses survei llance in service) requirement 3.B.4 .1 not met)

1. 1 battery charger EO-1 5 inoperable per LCO 3.B.4.A.2 Table A01-1 : Event Timeline Chart Sunday 9/25 2330 Sunday 9/25 2348 Monday 9/26 0156 Monday 9/26 0311 Monday 9/26 0441 Tuesday 9/271733 Test started PZR level <62.B% Restored P-55B Placed #4 battery Main station battery #1 inverter EO-06 instrument air (LCO 3.4 .9) charging pu mp to charg er EO-1B in- EO-0 1 left channel operabl e, supplying compressor C-2A service (available) service and removed operable preferred ac bus EY-satisfactorily, and then #2 battery charger 10 (LCO 3.8.7) placed in AUTO (C-2B EO-16 from service, still in-service, C-2C in #3 battery charger EO-SLEEP mode) 17 and #4 battery charger EO-18 now in service - -- -- '- - -

~Entergy Entergy PSA Engineering Analysis EA-PSA-SDP-D11-2-11-07 Rev. 1 Attachment 01 - Page 6 of 13 Event Timeline Narrative I. Initial Conditions (prior to event)

• 100% reactor power

• normal single charging and letdown lineup o Charging pump P-55A in service o Letdown orifice stop valve CV-2003 open o Primary coolant pump CBa returning to volume control tank T-54

• pressurizer T-72 pressure and level control channel A in service

• auxiliary feedwater system in normal standby lineup

• #1 battery charger ED-15 and #2 battery charger ED-16 in service

• feedwater purity air system cross-tied with and supplying the plant compressed air system II. Electrical Equipment Conditions Concurrent with the Reactor Trip at 1506

• dc buses ED-1 OL and ED-1OR de-energized o shunt trip breaker 72-01 opened o #1 battery charger de-energized

• dc distribution panels ED-11-1 and ED-11-2 de-energized

• #1 battery charger ED-15 failed , not supplying associated buses ED-10L and ED-10R

• #1 inverter ED-06 and #3 inverter ED-OB de-energized (ED-06 internal breaker also tripped)

• preferred ac buses EY-10 and EY-30 de-energized

• 2400v 1E bus EA-13 de-energized III. Conditions Resulting from Loss of Power to Preferred AC Buses EY-10 and EY-30 Reactor Trip / Turbine Trip: main generator breakers 25F7 and 25H9 did not open due to loss of ED-11-2.

Main Steam Isolation Signal: both main steam isolation valves CV-0501 and CV-0510 closed and both main feedwater regulating valves CV-0701 and CV-0703 closed . CV-0701 closed as result of loss of EY-10 and EY-30; CV-0703 closed due to MSIS .

• ~Entergy Entergy PSA Engineering Analysis EA-PSA-SDP-D11-2-11-07 Rev. 1 Attachment 01 - Page 7 of 13 Auxiliary Feedwater Actuation Signal : P-BA did not receive a start signal due to loss of EY-1 0 and EY-30 and ED-11-1. P-BA was available to be operated from the control room or locally. P-BC started and supplied 165 gpm to each steam generator (E-50A and E-50B). Steam driven AFW pump P-BB started due to loss of panel ED-11-2 and AFW flow control valves CV-0749 (E-50A) and CV-0727 (E-50B) failed full open . P-BB flow indication was not available. Flow distribution was dependent on SG pressures. E-50A is the steam source for P-BB , resulting in initially lower pressure, while E-50B had no steam removal path other than MSSVs.

Safety Injection Actuation Signal : Right channel SIAS only - resulted in de-energizing (load shedding) 2400V 1E bus EA-13 , isolating non-critical seNice water header isolation valve CV-1359 and starting associated equipment including charging pump P-55B.

Containment High Radiation: Right channel CHR only - resulted in containment isolation valves closing ,

including letdown isolation valve CV-2009 and PCP controlled bleedoff valve C-2099 . Left channel containment isolation valves also closed due to the loss of dc to their control circuits.

Containment High Pressure: Logic inputs were not sufficient for system actuation, i.e. no initiation signal was generated, alarm only.

Pressurizer Pressure Control : In seNice pressurizer pressure controller PIC-0101(channel A) de-energized - resulted in pressurizer spray valves CV-1057 and CV-1059 fail ing closed, and all available heaters energizing.

Pressurizer Level Control: In seNicepressurizer level controller LlC-01 01 (channel A) de-energized -

resulted in letdown orifices closing, charging pump P-55A running at maximum speed (53 gpm) and all pressurizer heaters de-energizing. P-55C did not start due to loss of breaker control power (ED-11 -1).

2400V 1E Bus EA-13 : de-energized - resulted in unavailability of associated PZR heaters and FWP air compressors. Plant air compressor C-2A automatically started to restore pressure.

Atmospheric Steam Dump Valves: all ASDVs CV-0779, CV-07BO, CV-07B1 and CV-07B2 failed closed (both normal and 'quick open ') due to loss of power to controller HIC-07BOA (EY-10) .

Generator Output Breakers: breakers 25F7 and 25H9 failed closed and all switchyard breaker iridication lost due to loss of ED-11-1 . 1A bus EA-21 and 1F bus EA-23 did not transfer to startup power on turbine trip due to loss of ED-11-2. 1A bus EA-21 remained powered from #1-1 station power transformer EX-01 until operators opened the generator breakers using a jumper on relay 4B7u (Y phase) in control room panel EC-04. 1F bus EA-23 remained powered from #1 -3 station power transformer until the generator breakers opened.

IV. Plant / Equipment Conditions and Operator Actions Following Event Initiation Notes:

• Due to the high activity level and unavailability of some plant computer data during th is event, times recorded in the Operator Log are generally correct, but may not exactly match information from other sources.

• Effects of conditions/actions described below are depicted in Appendix 1 - PCS and SG Post-Trip Behavior.

J

• ~Entergy Entergy PSA Engineering Analysis EA-PSA-SDP-D11-2-11-07 Rev. 1 Attachment 01 - Page 8 of 13 1506: Conditions noted in III above.

Main steam safety valves (MSSVs) on both steam generator headers opened and operated (throttled/closed/opened) to maintain SG pressures and lower PCS temperature and pressure. (MSSVs opened due to ASDVs failing closed and MSIVs closing on MSIS .)

Operators entered EOP-1.0 Standard Post-Trip Actions.

1515: Due to there being no steaming path available, PCS temperature rose to 544°F resulting in MSSVs opening further and PCS temperature, pressure and level lowering. PCS temperature continued lowering primarily due to relatively cold (B7"F) AFW being supplied to the steam generators (690 gpm total).

AFW pump P-BB flow control valves CV-0727 and CV-0749 failed full open . The flow delivered to each SG was dependent on piping losses and SG pressure differences. SG pressures were initially both -930 psig . However, E-50A's pressure lowered more than E-50B's (possibly due to E-50A supplying P-BB steam and varying MSSV characteristics), resulting in significantly more cool AFW flow to E-50A, which further lowered its pressure. By 1530 total AFW flows (P-BB +P-BC) to the SGs were 502 gpm to E-50A and 195 gpm to E-50B . This flow imbalance contributed to over-filling E-50A.

1517: Power Control verified main generator breakers 25F7 and 25H9 were closed (failed to open on turbine trip). Operators installed a jumper on relay 4B7u (Y phase) in control room panel EC-04 to open the breakers per EOP-1 .0. Opening the generator breakers de-energized 4160v 1A bus EA-21 , stopping primary coolant pumps P-50A and P-50C. PCPs P-50B and P-50D remained in service, maintaining forced circulation with one operating pump in each PCS/SG loop .

1527: Operators entered EOP-9.0 Functional Recovery Procedure due to less than 3 preferred AC buses being available. (Pressurizer level 62%)

1531 : Operator observed high SG E-50A water level (90%) and an NPO was directed to isolate steam to P-BB per EOP Supplement 19 Alternate Auxiliary Feedwater Methods, i.e. manually closing steam supply valve CV-0522B. Both SG levels had been observed approximately equal (35% - 40%) during EOP-1 .0 verbal verifications (1515). Operators entered ONP-2.3 Loss of DC Power.

1537: Operators first addressed safety function MVAE-DC-1 due to it being jeopardized (acceptance criteria not being met). Per MVAE-DC-1 operators entered ONP 24.1 Loss of Preferred AC Bus Y-10 and ONP-24.3 Loss of Preferred AC Bus Y-30to recover the buses.

Operator observed high PCS pressure (2200 psia) due to loss of power to pressurizer pressure controller channel A which failed spray valves CV-1057 and CV-1059 closed . Operator placed pressurizer pressure control channel B in service, lowered pressure in manual mode and then placed the controller in auto mode. PZR spray valves then remained available for pressure control.

Operator also noted loss of power to pressurizer level controller channel A and placed channel Band pressurizer heater select channel B in service. This resulted in letdown orifice stop valves CV-2003, CV-2004 and CV-2005 opening and charging pump P-55A speed lowering from 53 gpm to 33 gpm, and restored bus 1D pressurizer heater availability. Opening the letdown orifice valves resulted in letdown relief valve RV-2006 opening , due to CV-2009 having closed on CHR. RV-2006 directed letdown flow (10B gpm , 560 gal total) to quench tank T-73 in containment, and resulted in relief valve 2006 discharge high temperature annunciator EK-0702 alarming . (Pressurizer level 71 %)

• ~Entergy Entergy PSA Engineering Analysis EA-PSA-SDP-D11-2-11-07 Rev. 1 Attachment 01 - Page 9 of 13 1542: Operator closed letdown orifice stop valves CV-2003, CV-2004 and CV-2005 to isolate letdown flow per ARP-4 Annunciator Response Procedure Primary System Volume Level Pressure Scheme EK-07 (C-12).

At this time charging flow was 73 gpm with 0 letdown and 5 gpm PCP bleedoff flow, resulting in 68 gpm PCS net inventory addition. When the density change from charging temperature to PCS temperature is considered this gives a 90 gpm effective charging rate or 1.36%/minute pressurizer level rise rate (90 gpm / 66.16 g/% = 1.36%/m). (Pressurizer volume gal / % indicated level = 66.16 g/% per surveillance procedure DWO-1 Operator's Daily/Weekly Items Modes 1, 2, 3, and 4 Rev 80.)

1544: Operator closed CV-0737 A, isolating P-8C AFW flow to steam generator E-50A. P-8C flow to E-50B continued at 165 gpm , and P-8B flow continued at 380 gpm to E-50A and 0 gpm to E-50B.

1549: Operators restored power to 2400v 1E bus EA-13 per SOP-30 Station Power and reenergized associated pressurizer heaters.

1555: Operator logged pressurizer level high (>62 .8%) (actual level 78%). Due to PCS temperature continuing to lower, the observed level rate of rise was less than would be observed if temperature was stable. Changing PCS temperature one degree has the effect of changing PCS water volume 74.43 gallons (per DWO-1). (Note : Per PZR pressure/level recorder LPIR-01 01 B, pressurizer level exceeded 62.8% at 1528.)

1557: Operator aligned preferred ac bus EY-30 to be supplied from instrument ac bus EY-01 via the bypass regulator. Energizing EY-30 resulted in Left channel safety injection actuation which de-energized (load shed) 2400V 1E bus EA-13 and started associated equipment. P-55C did not start due to panel ED-11-1 being de-energized .

Operators verified SI throttling criteria met and stopped both operating charging pumps P-55A and P-55B

=

to stop PCS inventory addition . Charging and letdown flows 0, 5 gpm PCP bleedoff to primary system drain tank T-74 continues. (Pressurizer level 80%)

Electricians reported buses ED-1OL and ED-1 OR fault free. Operator closed shunt trip breaker 72-01 reenergizing Left channel dc buses ED-10L, ED-10R, ED-11-1, ED-11-2 from battery ED-01 . Generator field breaker 341 automatically opened when ED-11-2 was reenergized. Instrument air compressor C-2A tripped due to its trip circuit being reenergized when dc power was restored. Operator manually started compressors C-2B and C-2C . The brief loss of air compressor had no noticeable effect.

1602: NPO reported charging pump P-55B suction relief valve RV-2096 lifting and not reseating, equipment drain tank T-80 full and floor drains backing up on the auxiliary building 590 elevation . Control room directed closing pump suction and discharge valves to isolate P-55B and its suction relief. Water discharged from the relief was from concentrated boric acid tanks T-53A and T-53B .

Operators restored power to 1E bus EA-13 and reenergized associated pressurizer heaters.

1603: Auxiliary operator reported steam supply valve to P-8B turbine CV-0522B manually closed per EOP

=

Supplement 19. AFW flow to and steam flow from E-50A O. AFW flow to E-50B continued at 165 gpm and steam flow from E-50B was controlled by associated MSSVs. PCS heat removal rate was reduced and PCS temperature stopped lowering and started rising . The PCS heatup rate was 1°F/m, resulting in PZR level rising 1.125%/m. (Tave 529°F, PZR level 85%)

1609: Operator closed CV-0736A, isolating AFW flow to E-50B, slightly raising the PCS heatup rate .

There was no AFW to either SG at this time and steam was only being removed from E-50B via MSSVs throttling.

~Entergy Entergy PSA Engineering Analysis EA-PSA-SDP-D11-2-11-07 Rev. 1 Attachment 01 - Page 10 of 13 1615: MSSVs on both steam generator headers opened due to PCS temperature rising to 544°F. PZR level peaked at 101 .5% and then lowered as PCS temperature lowered . (Note: There was no PCS inventory addition since 1557. The PZR level rise was entirely due to PCS heatup from 529°F to 544°F.)

After opening , the MSSVs remained partially open , effectively controlling PCS Tave 540°F until the ASDVs were placed in service.

1621: Operators logged entering ONP-7.1 Loss of Instrument Air due to compressor C-2A tripping at 1557 as previously noted .

1630: Charging pump P-558 suction and discharge valves reported closed, isolating suction relief valve leakage.

1639: Operator restored 150 gpm AFW flow to E-508 using P-8C.

1646: After confirming no faults on preferred ac bus EY-10, #3 inverter ED-08 was aligned to supply EY-30 and EY-10 was powered from instrument ac bus EY-01 via the bypass regulator. All preferred ac buses were now available.

All 4 ADVs were available when EY-10 was restored, and operators began using them for PCS temperature control. MSSVs fully closed. (Tave 539°F) 1720: Operators entered ONP-4.1 Containment Spurious Isolation and operator reset CHR.

1746: Operators exited EOP-9.0 and entered GOP-8 Power Reduction and Plant Shutdown to Mode 2 or Mode 3 ~ 525°F.

1818: Operators reset SIAS and restored non-critical service water per SOP-15 Service Water System .

1852: Operators restored AFW pump P-88 steam supply CV-05228 to AUTO per EOP Supplement 19.

1933: Placed #3 battery charger ED-17 in service supplying station battery ED-01 . #2 and #3 battery chargers ED-16 and ED-17 in service.

2348: Pressurizer level lowered to 62% and continued lowering due to PCP bleedoff.

09/26/11,0311: Placed #4 battery charger ED-18 in service supplying station battery ED-02. 8attery chargers #3 ED-17 and #4 ED-18 in service.

09/27/11, 1733: Placed #1 inverter ED-06 in service supplying #1 preferred ac bus EY-10.

~Entergy Entergy PSA Engineering Analysis EA~PSA-SDP-D11-2-11-07 Rev. 1 Attachment 01 - Page 11 of 13 Acronyms AFAS Auxiliary Feedwater Actuation Signal AFW Auxiliary Feedwater ASDV Atmospheric Steam Dump Valve CAS Compressed Air System CSO Controlled Sleedoff CHP Containment High Pressure CHR Containment High Radiation CIS Containment Isolation Signal CVCS Chemical and Volume Control System FWP Feedwater Purity MFRV Main Feedwater Regulating Valve MSIS Main Steam Isolation Signal MSIV Main Steam Isolation Valve MSSV Main Steam Safety Valve NCO Nuclear Control Operator NPO Nuclear Plant Operator PCP Primary Coolant Pump PCS Primary Coolant System PSDT Primary System Drain Tank PZR Pressurizer RPS Reactor Protective System SG Steam Generator SI Safety Injection SIS Safety Injection Actuation Signal VCT Volume Control Tank

~Entergy Entergy PSA Engineering Analysis EA-PSA-SDP-D11-2-11-07 Attachment 01 - Page 12 of 13 Rev. 1 Appendix I - pes and SG Post-Trip Behavior pes Post Trip Plot ktJ SG Post Trip Plot Figure A01-1: PCS Post-Trip Plot Figure A01-2: SG Post-Trip Plot Table A01-2: PCS Post-Trip Plot Key Elap. T (ave) PZR PZR PT Time Level Press .

Time 10 NOTES (min) (OF) (%) (psi a) 1 1506 0 559.5 57 2069 Reactor trip , MSSVs open and then throttle/close 2 1515 11 544 52 2033 MSSVs open and then throttle/close 3 1536 31 536 71 2184 E-50B MSSVs open and throttle maintaining SG pressure Operator places PZR pressure and level channel B controls in 4 1537 32 536 71 2206 service 5 1542 36 530 66 1980 Operator closes letdown orifice valves to isolate letdown 6 1544 38 530 68 2016 Operator closes eV-0737A to isolate p-8e flow to E-50A 7 1557 51 528 80 2068 Operator throttles SI by stopping P-55A and P-55B Steam supply eV-0522B closed to isolate P-8B flow to SGs, also 8 *1600 54 527 80 2050 isolates steam flow from E-50A 9 1615 69 544 101 .5 2069 MSSVs open and then throttle maintaining pes temp -540 of Operator restores 150 gpm AFW to E-50B and throttles to 10 1639 90 540 97 1865 maintain level Power restored to AOV controls , Operator begins using AOVs for 11 1646 100 541 97 1867 pes heat removal , MSSVs close Tave stable, PZR level slowly lowering due to pep bleedoff, PZR 12 1730 144 539 90 2087 pressure is controlled

• Time

. does not match time recorded In Operator Log (1603).

~Entergy Entergy PSA Engineering Analysis EA-PSA-SDP-D11-2-11-07 I Attachment 01 - Page 13 of 13 Rev. 1 Table A01-3: pes Post-Trip Plot Regions REGION NOTES ID PZR pressure rising in this region is due mainly to PZR leve l rising and spray valves failing closed due to loss of power to the A

Channel A pressure controller.

With exception of the 2 step changes in this region , PCS temperature lowering is mainly due to AFW addition to the SGs.

B Temperature lowering in this area is masking inventory addition to the PCS, i.e. the PCS inventory rate of rise is > than indicated.

Temperature rising in this region is mainly due to having isolated all AFW flow to E-50A without establishing another heat C removal path. E-50A MSSVs are closed PZR level rising in this region is due solely to PCS heatup. Charging flow =0 gpm.

D PCS temperature is being maintained in this region by the MSSVs.

E PZR level lowering in this region is due mainly to PCP controlled bleedoff.

WR PRESS (PS IA) c;; <0 0

N o

o N

<5 N

N o

N 0

N 0

0 0

, 0

, o 1

o 1

o 1

0 0 WR T-Hot (Deg F) WR T-COI 0 (Deg F)

'"N0 ...'"'" ~

'"'"N ~

<0 0 ...'"

0 PZR LEVEL (%)

b ...

0 l:l s 2l 2'1 o ~

15:02 :20 15:06 :20 15:10:20

~

15:14:20  ::u

-l f '" (-,

15:18:20 o, 15:22 :20 o

oco 15:26 :20 <D "T1 15:30:20 r

15:34:20 1538 20 ~ . ~

0 154220 ~ =-_ "U

0 m

(j) 15:46:20 (j) 15:50:20

--:0 (j) 15:54:20

~

15:58:20

~ (Xl 16:02 :20 "U

N 16:06 :20  ;:0 r

m 16:10:20 <

m r

16:14:20 ~ <0 >!!.

o 16:18:20 16:22:20 16:26:20 ~

0 16

30:20 -;-i o I o-l 1

16:34:20 16:38:20 o <t>

i 0

<0 2!

16:42:20 16:46:20 16:50:20 16:54:20 16:58:20 17:02 :20 17:06 :20 17:10:20 17:14:20 17:18:20 m 17:22 :20 17:26:20 17:30:20 17:34:20

~

Ii

>>a

~

~

Steam Generator Level (%) (j) m-Ol

~ N w .f>. (}1 (j) -.j (Xl CD a N w 3 a a a a a a a a a a a a a a Gl

'if? 0~ ~

0 'if? 'if? 'if? 'if? 'if? 'if? 0~ 0~ 'if? 'if? 'if? (1)

J (1) iil Q

-u Steam Generator Pressure (PSIA) o S!l.

(Xl CD CD CD CD a  ::;i

-.j -.j -.j (Xl (Xl (Xl (Xl CD -6"

.f>. (j) (Xl a N .f>. (j) (Xl a N .f>. (j) (Xl a a a a a a a a a a a a a a a -U

§:

15 :03 :00 ~

15:06:00 - ~

l

~~

15 :09:00 15 :12 :00 <~

15 :15:00 N 15:18:00 -~

15 :21:00 V\

"\ I 15 :24:00 15 :27:00 1/

15 :30 :00 m

~

cJ, 15 :33 :00 a 15 :36:00 - .f>. w -U ro 15:39:00 15:42 :00 (}1 Z 7 I

(f)

(f)

-:u (j)

V (j) 15:45:00 15:48 :00 If ~

15 :51:00 J

15:54:00 15 :57 :00 -.j 16:00 :00 16:03:00 (Xl

, r---.....

I

, ~

I J I r;n

(}1 a

OJ 16:06 :00 16:09:00 r-......... .............

\ -U ro (f)

(f) 16:12:00 16:15:00 CD

~ -:u (j)

~

16:18 :00 16:21 :00 ---

16:24 :00 I

/1 "-

16:27 :00

~

m 16:30:00 cJ, a

16:33 :00 >>

r 16:36:00 (1) 16:39 :00 a

~

~

16:42 :00 ~

16:45 :00 ~

t---.

~

16:48 :00

~

I 16:51 :00 16:54:00 16:57:00 17 :00:00 m I

cJ, 17 :03:00 a OJ 17:06:00 r(1) 17 :09:00 ~

17:12:00

~

17:15:00

/1 17:18:00 17 :21:00 17:24:00 17:27 :00 17:30 :00 - N~

17:33:00 I

• ~Entergy Entergy PSA Engineering Analysis EA-PSA-SDP-D11-2-11-07 Rev. 1 Attachment 02 - Page 1 of 2 2: Shunt Trip Breaker Coordination Issue Shunt trip breakers 72-01 and 72-02 are designed to operate by remote signal only, and not to operate/isolate on experiencing fault current.

Breakers 72-01 and 72-02 contain both thermal and instantaneous protective elements. Therefore, the shunt trip breakers may actuate on a fault current before downstream protective devices actuate, resulting in isolation of station batteries from dc loads.

Conclusions No identified mechanism would cause a fault in one dc division to propagate to the other division .

Initial investigation suggests proper coordination of breakers 72-01 and 72-02 with associated downstream devices exist for fault currents up to 3,000 amps.

The condition will be addressed in a separate analysis , as needed .

Evaluation Shunt trip breaker 72-01 isolates #1 battery ED-01 from the balance of the left channel dc circuit, leaving only dc panel ED-11A connected to ED-01. Shunt trip breaker 72-02 isolates #2 battery ED-02 from the balance of the right channel dc circuit, leaving only dc panel ED-21 A connected to ED-02. The shunt trip breakers are used for a fire in the cable spreading room.

Circuit breakers 72-01 and 72-02 contain both thermal and instantaneous protective elements. This does not comply with statements in the FSAR and from a design basis perspective constitutes a non-conforming condition per EN-OP-1 04, Revision 5, Attachment 9.1 , Table 1.

The shunt breakers may actuate on a fault current before downstream protective devices actuate, resulting in isolation of station batteries from dc loads.

See Figure A02-1 for fault currents expected to result in shut trip breaker 72-01 actuation .

72-01,72-18 &

Dll-2 Fuse Caardinal Figure A02-1: 72-01, 72-18, FUZ/D11-2 Coordination Curve There is currently no identified mechanism that would cause a fault in one dc division to propagate to the other division . The coordination of breakers 72-01 and 72-02 with other breakers in the dc system has not been evaluated for this analysis.

~Entergy Entergy PSA Engineering Analysis EA-PSA-SDP-D11-2-11-07 Rev. 1 Attachment 02 - Page 2 of 2 References

[1] Operability Evaluation attached to CR-PLP-2011-4835.

[2] J:\Engineering\ACTION PLANS\9-23-11 DC 11-2 Problem\operability evaluation - coordination

.... I I

\c:)._4'-_~~,...-_ _ _ _ _---,~UZJDI1-2 r

II

~

V>

I

72-01 L) f

72-IS I'

1.) L DIO-R l<' UztDIl-2

.5 10 100 1000 10000 Current in Amperes X 10 125 Volt Phase and Ground Time-Current Characteristic CIlr\'CS 09/30/2011 72-01, 72-18 & FUVDI 1-2 Coordination Curre 01:08:06 Prepared By: Eric C Jones Reviewed B}: Da~id M Kennedy J:\sIlARE\EJONES\72-0I, 72-18 & D11-2 COORDINATION CURVE.MDB

~Entergy Entergy PSA Engineering Analysis EA-PSA-SOP-011-2-11-07 Rev. 1 Attachment 03 - Page 1 of 2 3: Pressurizer Level and Challenge to Pressurizer Safety Relief Valves Issue The 09/25/2011 dc panel ED-11-2 fault isolated letdown flow and increased charging flow. This resulted in rising pressurizer level and represented a potential challenge to pressurizer safety relief valves. Steam and/or water release from pressurizer safety relief valves could result in a stuck open relief valve and pressurizer vapor space loss of coolant accident.

This evaluation summarizes post trip inventory behavior and estimates the additional time to pressurizer safety relief operation had no mitigating actions been taken.

Conclusions With letdown isolated, the pressurizer would have gone solid had charging not been secured within -11 minutes of the actual time of 15:57 (i.e., by -16:08).

Pressurizer safety relief valves expected to lift prior to 16: 15 had charging not been tripped by 16:08.

Evaluation See event timeline and narrative discussion [1] .

With respect to pressurizer level, key aspects of the event are:

Loss of ADVs and start of P-8B with loss of flow control valves (full open) results in overcooling PCS due to excessive AFW addition .

SIS starts additional charging pump and loss of level control results in letdown isolation and maximum charging.

Cooldown partially masks inventory addition . Subsequent heatup results in PCS inventory expansion and potential challenge to PZR safety relief valves.

Hemispherical space exists above the upper level tap, such that volume in excess of 100% is needed to completely fill the pressurizer (see SOP-1 B Attachment 8 [2]).

As documented in the event timeline, indicated pressurizer level peaks at 101 .5% at 16:15. Note:

Data from LPIR-01 01 B (available hot calibrated pressurizer level indicator) indicates pressurizer level peaked at 101 .5% at -16: 15.

This value implies pressurize level is at or near (but not above) 100% level, i.e ., at or near the upper level tap.

If actual pressurizer level exceeded elevation of upper level tap, the trendline for both hot and cold calibrated levels would flatline at the point of tap submergence. Level trendlines from the event do not appear to flatline .

• ~Entergy Entergy PSA Engineering Analysis EA-PSA-SDP-D11-2-11-07 Rev. 1 Attachment 03 - Page 2 of 2 Indicated level greater than 100% is due to pressurizer pressure and/or temperature deviations from nominal , reference wet leg temperature deviation from nominal , and/or instrument loop inaccuracies.

Based on 1,000 gallons of additional volume between 100% pressurizer level and the solid condition [2]. it is estimated an additional 11 minutes of charging flow @ 73 gpm would have resulted in a solid PCS condition upon heatup to 544°F:

1,000 gallons / 1.3 density correction from 82°F to 544°F / (73 gpm charging - 5 gpm PCP bleedoff) =

-11 minutes With respect to the timeline, charging pumps were secured at 15:57. Therefore, charging needed to be secured prior to 16:08 to avoid a PCS solid condition. The solid condition would have occurred just before MSSV lift at 16:15 if charging was secured at 16:08.

References

[1] EA-PSA-SDP-D11 11-07, Revision 0, Attachment 1.

[2] SOP-1 B, Revision 11 , Primary Coolant System - Cooldown.

• ~Entergy Entergy PSA Engineering Analysis EA-PSA-SDP-D11-2-11-07 I Rev. 1 Attachment 04 - Page 1 of 7 4: Steam Generator Level and Challenge to Steam Generator Overfill/Loss of Turbine Driven Auxiliary Feedwater Pump Issue Various data sources [1],[2] indicate post-trip steam generator inventory asymmetry following the 09/25/2011 plant trip. The significance is three-fold : (1) E-50A high level resulted in manual isolation of steam to AFW pump P-88 requiring manual recovery if the remaining AFW supply failed , (2) failure to isolate P-88 in time to prevent steam generator overfill may have damaged P-88, and (3) additional post-trip SG inventory extends time available to restore AFW or initiate once-through-cooling if required.

This evaluation summarizes expected post trip inventory behavior, estimates the additional time to E-50A overfill had no mitigating actions been taken and provides a reasonableness check on actual post-trip inventory.

Conclusions Asymmetry in post-trip SG level is expected based on plant design given loss of left channel dc.

Steam generator E-50A overfill (full to top of steam dome) may have occurred within 33 minutes from the time all E-50A level indication was restored 15:57, i.e., at 16:30.

Evaluation Without operation of turbine driven auxiliary feedwater pump P-88 , post-trip steam generator water levels on both steam generators are expected to behave similarly: shrink to approximately 23% while increasing due to inventory addition by motor-driven auxiliary feedwater pump(s) and potential main feedwater pump coastdown. Operation of P-88 with flow control valves full open and not controlled , with atmospheric steam dump valves inoperable and closed , results in a steam generator pressure asymmetry. Since steam generator E-50A supplies the P-88 turbine , pressures tend to be lower in E-50A, resulting in increased flow to and higher levels in E-50A. However, variations in MSSV lift setpoints and operating characteristics can result in variations in steam generator pressure that can also impact flows .

Following an uncomplicated plant trip, the main feedwater pumps normally ramp down to minimum speed and the main feedwater regulating valves are closed over a period of 3-4 minutes. Feed reg valves lock in position at the time of the trip and are closed by operator manual action per EOP-1.0.

A coastdown flow rate function was developed based on data collected from the PI data archive for three Palisades plant trips and is credited in the MAAP analysis [3] for events that don't result in containment high pressure or MSIV closure (these events result in automatic fast closure of the feed reg valves). The additional coastdown flow provides sign ificant inventory in short period of time , resulting in higher steam generator levels shortly after trip than would otherwise occur for feed reg valve fast closure events.

For the plant trip on 09/25/2011 , PI data indicates that feedwater control valve CV-0703 to steam generator E-508 closed very quickly in 1-2 seconds and the steam generator level trend reflects this fact.

This is expected based on a loss of EY-1 0 and EY-30 , which generates a 2/4 low steam generator pressure and a close signal to CV-0703.

PI data for CV-0701 valve position indication was lost on loss of EY-1 O. CV-0701 is also expected to close very quickly based on a loss of EY-10 and EY-30, which results in a loss of current to E/P-0701 and

• ~Entergy Entergy PSA Engineering Analysis EA-PSA-SDP-D11-2-11-07 Rev. 1 Attachment 04 - Page 2 of 7 the equivalent of a close signal to CV-0701 . Observed levels during EOP-1 .0 (-1515) were 40% and 35%

for E-50A and E-50B respectively , indicating they started out about the same and the E-50A high level was not due to MFW pump coastdown addition .

When power was restored to the E-50A level indication at 15:57 (PI time), the water level had increased to 94.5%. E-50B level indication was not lost, and the PI archive data shows its level initially lowered to 23% and was gradually restored to 60.8% via the auxiliary feedwater system .

Given uncertainty in P-8B steam supply isolation timing , AFW flow split to E-50AlB [6] and integrated steam releases , an exact accounting of steam generator inventory is not possible. However, arbitrarily assuming about % of the nominal decay and pump heat over the time period was removed by steaming (note P-8B steam load is neglected), with an arbitrary split between E-50A and E-50B , suggest steam generator levels can be explained . .

See Appendices 1-3 for additional details.

Given: 7,812 fe total steam volume [5]

5,845 fe of water at 100% level (0% power) [5]

4,861 ft3 of water at 77.3% level (0% power) [5]

¢ 16,487 gallons of inventory above 94 .5% (see Appendix 3).

Given 380 gpm auxiliary feedwater addition [6] and neglecting inventory lost due to decay heat removal ,

steam generator overfill could have occurred within 33 minutes of the time SG level indication was restored at 15:57 (16,487 gallons 1 1.325 density ratio 8rF to 535°F 1 380 gpm = 33 minutes).

Given 380 gpm auxiliary feedwater addition [6] and assuming % of decay heat is removed via E-50A, steam generator overfill could have occurred within 47 minutes of the time SG level indication was restored at 15:57.

References

[1] PI data, file "09252011 Loss of DC Event - Post Trip SG Inventory.xls"

[2] Plant Personnel Statements per ADMIN 4.08 , Attachment 2 (pdf), page 13 of 18 "At 1602, reported that B CCP suction relief valve lifting. Isolated. racked out breaker. S/G levels still i (A @ 90%) so manually isolated CV-0522B."; page 15 of 18 "S/G levels were high due to P-8B feeding both S/G and TBV/ADV closed.".

[3] PLP0247-07-0004.01 Rev. 2, "Palisades Nuclear Plant Thermal Hydraulic MAAP Calculations"

[4] EOP-1 , Standard Post-Trip Actions , pdf of procedure used during 09/25/2011 trip.

[5] 82688-ST-602 Rev. 1, "Steam Generator Secondary Inventory"

[6] EA-PSA-SDP-D11-2-11-07, Revision 0, Attachment 10.

Appendices Appendix 1: Design Summary Appendix 2: Steam Generator Water Volumes Appendix 3: Potential Steam Generator Inventory Accounting

• ~Entergy Entergy PSA Engineering Analysis EA-PSA-SDP-D11-2-11-07 I Rev. 1 Attachment 04 - Page 3 of 7 Appendix 1: Design Summary MSIV CV-0510 (E-50A)

CV-0501 (E-50B)

Isolate on CHP, MSIS (2/4 low SG pressure), loss of dc power (each SG has one de-energize to open (vent) solenoid isolation valve off each dc train)

Expected event response: Both MSIVs close on loss of EO-10L & EO-10R MSIV bypass MO-0510 (E-50A)

MO-0501 (E-50A)

No automatic actuation Expected event response: both MSIV bypass valves remain closed SG blowdowns CV-0767, CV-0771 (E-50A)

CV-0768, CV-0770 (E-50B)

Isolate on CHP or CHR Isolate on loss of dc power to associated energize to open solenoid valve Each SG has one isolation valve off each dc train Expected event response: both SG blowdowns isolate ADVs CV-0781, CV-0782 (E-50A)

CV-0779, CV-0780 (E-50B)

Quick open function (Tave and TT inputs) to prevent MSSV relief Expected event response: quick open not functional, manual remote control not available, AOVs remain closed on loss of EO-10L & EO-10R, remain unavailable until EY-10 restored MSSV RV-0703 thru RV-0706, RV-0713 thru RV-0718, RV-0723, RV-0724 (E-50A)

RV-0701, RV-0702, RV-0707 thru RV-0712, RV-0719 thru RV-0722 (E-50B) 1sl set pressure 985 psig ; 2 nd set pressure 1005 psig; 3rd set pressure 1025 psig 3% blowdown s1 Expected event response : given AOV quick open not available, 1 set of MSSVs expected to lift on both SGs MFRV CV-0701 (E-50A)

CV-0703 (E-50B)

Close on CHP, MSIS (2/4 low SG pressure), loss of dc power (loss of signal to E/P)

Expected event response: Both MFRV close on loss of EO-10L & EO-10R: CV-0701 closes on loss of signal to E/P-0701, CV-0703 closes on 2/4 low SG pressure signal to E/P-0703

• ~Entergy Entergy PSA Engineering Analysis EA-PSA-SDP-D11-2-11-07 Rev. 1 Attachment 04 - Page 4 of 7 MFRV bypass CV-0735 (E-50A)

CV-0734 (E-50B)

Close on CHP, MSIS (2/4 low SG pressure), open on loss of dc if in auto Expected event response : Both values are in manual during normal operation and should remain closed AFW P-8A starts on left channel AFAS and DBA P-8B starts on loss of left channel dc power and AFAS CV-0749 (E-50A) fails open on loss of EY-10 and EY-30 or air CV-0727 (E-50B) fails open on loss of EY-10 and EY-30 or air P-8C starts on right channel AFAS and DBA (if insufficient flow)

CV-0737A (E-50A) fails open on loss of EY-20 and EY-40 or air CV-0736A (E-50B) fails open on loss of EY-20 and EY-40 or air Expected event response:

P-8A does not start due to loss of EY-1 0, EY-30 and ED-11-1 P-8B starts on loss of dc bus ED-1 OLlED-1 OR P-8C starts on low flow from P-8A Flow control valves on P-8A1B go full open on loss of EY-10 and EY-30 Flow control valves on P-8C throttle to provide - 165 gpm to each SG

~Entergy Entergy PSA Engineering Analysis EA-PSA-SDP-D11-2-11-07 Rev. 1 Attachment 04 - Page 5 of 7 Appendix 2: Steam Generator Water Volumes Table A4-1 : Water Volume vs. Level at 0% Power [5]

Water Level State Volume

(%)

(Qallons)

SG water volume at 100% 43723 100.0 SG water volume at 77.3% 36359 77.3 SG water volume at nominal (assume 65%) 32365 63.9 SG water volume at 23.7% (nominal post-trip) 19607 23.7 Water Volume (gallons) vs. Level (%)

50,000 45,000 40,000 /

,/

V 35,000 30,000 ../

~

25,000 /'

20,000 ... ~

15,000 10,000 5,000 o

20 40 60 80 100 Figure A4-1 : Water Volume vs. Level at 0% Power

• ~Entergy Entergy PSA Engineering Analysis EA-PSA-SDP-D11-2-11-07 Attachment 04 - Page 6 of 7 Rev. 1 Appendix 3: Potential Steam Generator Inventory Accounting Table A03*1: Potential Post*Trip Steam Generator Accounting ppe trip time 15:03 (based on invalid data entries indicating loss of Y1 01Y30) ppe EY*10/EY*30 restoration time (based on data indicated return of A SG level indication) 15:57 Initial E-50A Level 64.7  %

Initial E-50B Level 62.3  %

-10 min post trip E-50A Level (from EOP-1 in-use 40  %

procedure)

-10 min post trip E-50B Level (from EOP-1 in-use PI data indicates 35% level in E-50B at 35  %

procedure) 15:14 E-50A Level at 15:57 94.5  %

E-50B Level at 15:57 60.B  %

p-Be flow to E-50A 5B47 gallons p-Be flow to E-50B B750 gallons P-BB max flow rate 372 gpm P-BB operation to 15:57 57 min after 1531 and on or before 1603 Total P-BB flow 21204 gallons P-BB flow split -fraction to E-50A 0.B1 P-BB flow to E-50A 17175 gallons P-BB flow to E-50B 4029 gallons Density correction from B7F to 535F 1.325 Volume of E-50A at 94 .5% at 15:57 41939 gallons Volume of E-50B at 60.B% at 15:57 31068 gallons At 0% power:

SG water volume - total 58438 gallons SG water volume at 100% 43723 gallons 100.0  %

SG water vo lume at 77.3% 36359 gallons 77.3  %

SG water volume at normal level (63.9%) 32365 gallons 63.9  %

SG water volume (E-50A post-trip)? 21194 gallons 28.7  %

SG water volume at 23.7% (nominal post-trip) 19607 gallons 23.7  %

~Entergy Entergy PSA Engineering Analysis EA-PSA-SDP-D11-2-11-07 I Rev. 1 Attachment 04 - Page 7 of 7 Table A03-1: Potential Post-Trip Steam Generator Accounting Nominal water volume "lost" at trip 12758 gallons De cay, Pump and Sensible Heat Steaming from E-50A 9770 gallons Decay, Pump and Sensible Heat Steaming from E-50B 5167 gallons Net post-trip volume added to E-50A 20729 gallons Net post-trip volume added to E-50B 11762 gallons Post-trip 15:57 volume of E-50A 41923 gallons 94.5  %

Post-trip 15:57 volume of E-50B 31369 gallons 60.8  %

Unaccou nted for volume to E-50A 16 gallons