ML18064A854

Provides Addl Info Re Palisades Individual Plant Examination

ML18064A854
Person / Time
Site:	Palisades
Issue date:	07/28/1995
From:	Haas K CONSUMERS ENERGY CO. (FORMERLY CONSUMERS POWER CO.)
To:	NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM)
References
TAC-M74444, NUDOCS 9508090019
Download: ML18064A854 (23)

Text

consumers Power KurtM. Haas Plant Safety and Licensing Director l'OWERIN&

MICHl&AN"S l'IUl&RESS Palisades Nuclear Plant: 27780 Blue Star Memorial Highway, Covert, Ml 49043 fjtiiY.i-~28' 1995 U S Nuclear Regulatory Commission Document Control Desk Washington, DC 20555 DOCKET 50-255 - LICENSE DPR PALISADES PLANT INDIVIDUAL PLANT EXAMINATION (IPE) - ADDITIONAL INFORMATION (TAC NO. 74444)

Consumers Power Company provided the Palisades Individual Plant Evaluation (IPE) results to the NRC in a submittal dated January 29, 1993. The NRC reviewed our submittal and, in a letter dated April 22, 1994, requested additional information related to the internal event analysis and the containment performance improvement program for the Palisades Plant. This information was provided in our July 22, 1994 letter to the NRC. As a result of continuing NRC reviews, including the staff's diagnostic evaluation team (DET) report, the NRC's October 19, 1994 letter requested additional information be submitted concerning the Palisades IPE results. This information was provided in our December 5, 1994 letter to the NRC.

On April 26, 1995, a conference call was held with the NRC and their contractor to discuss other analysis aspects of the Palisades IPE program. In later discussions, it was decided that the review efforts being completed by the NRC contractor would be enhanced if we could furnish the NRC with examples of how some of the analyses were completed. Attachment 1 to this letter contains copies of the analyses supporting the Palisades IPE.

SUMMARY

OF COMMITMENTS This letter contains no new commitments and no revisions to existing commitments.

I

. Kurt MHaas Plant Safety and Licensing Director CC Administrator, Region III, USNRC NRR Project Manager, USNRC NRC Resident Inspector - Palisades Attachment

(~~~9~5~~:-:::-::--=----=::::-:-:~~~~-,...-,---~

f 00090019 950728 PDR ADOCK 05000255 Ii

.1 l

• . .P .. *

• PDR I uouu.:;J ,.,

A CMS' ENERGY COMPANY

ATTACHMENT 1 CONSUMERS POWER COMPANY PALISADES PLANT DOCKET 50-255 JNQJVIDUAL PLANT EXAMINATION (JPE) - ADDITIONAL INFORMATION ANALYSES SUPPORTING PALISADES IPE 21 Pages

ANALYSES SUPPORTING PALISADES IPE Enclosed are copies of examples of human reliability analyses that were used to support the Palisades IPE quantification. Four examples of Human Error Probability (HEP) quantifications using the Technique for Human Error Rate Prediction (THERP) methodology are provided. The attached HEPs are; Failure to Align a System, Failure to Manually Close/Isolate an Atmospheric Dump Valve, Failure to Align a Faulted SIS Component, Failure to Perform a Function Upon a System Malfunction.

Specific information was requested for human errors concerning failure to initiate recirculation, failure to initiate steam generator depressurization, and failure to initiate feed and bleed. Two Accident Sequence Evaluation Program (ASEP) quantifications are attached to demonstrate how this was addressed as part of the IPE.

SRECIRCOX - Failure to verify switchover injection pump suction from SIRW tank to containment sump.

RPORVOA - Operator fails to open the PORVs and their block valves for Feed and Bleed cooling of PCS.

Failure to initiate Once Through Cooling (Feed and Bleed of PCS) is included in the quantification of. RPORVOA. Information regarding the development of the human error for failure to actuate recirculation given automatic transfer fails (SERClRCOX) was also requested. The value used in the IPE quantification was l.OE-02 (purely a screening value). An ASEP value was.

quantified for SRECIRCOX as part of the verification process. The value calculated with ASEP was 2.BE-02. .The impact of the ASEP value would be to increase the core damage frequency from 5.145E-05 to 5.147E-05. Failure to depressurize a steam generator for feed and bl~ed of the steam generator used a stock {generic) THERP for failure to PE;!rform a function upon a system malfunction {failure to open the Atmospheric Dump Valves given AFW system Failure). {See THERP quantifications above.)

• FAILURE TO ALIGN A SYSTEM Failure of an operator to align a system (e.g., shutdown cooling system or high pressure safety injection) can be classed as a failure of the operator to omit an item in the alignment outlined as an attachment to the fault tree, since further refinement of the HEP may be necessary at a later date.

Due to the assumptions made below, the HEP generated may be overly conservative for systems in which alignment must be completed within a short time frame (e.g., the shutdown cooling system). Systems for which alignment is not constrained by time allow recovery for operator errors to be made.

In order to simplify construction and quantification of the THERP tree, the following assumptions regarding the alignment procedure were made:

• The omission of any component in alignment of the system constitutes a failure .

.* One operator is responsible'for aligning the system, and no credit is taken for checking performed by the second operator. *

• Errors in manipulation of controls are considered negligible.

• The operator is functioning irt an optimal stress state.

THERP TREE QUANTIFICATION A-- Failure to use written control room procedure:

A basic HEP for failure to use written control room procedures is used.

HEP = 0.01 [Table 20-23]

B -- Error of omission in use of written procedure:

The lower bound of the HEP for an error of omission in the use of a long list of written procedures without a checkoff provision is used'.

HEP = 0.001 [Table 20-21-]

HEP 5-1

C -- Error of omission without use of written procedure:

The HEP for an error of omission in aligning a system without using the written procedure is conservatively estimated to be 0. 1.

HEP = 0.1 a A c

B c A- Failure to use written procedure - .01 B - Error of omission with procedure - .001 C - Error of omission without procedure - .1 F1 = 0.99 (.001) = 9.9 x 104 F2 = 0.01 (.1) = 1.0 x 10*3 1.99 x 10*3 HEP 5-2

FAILURE TO MANUALLY CLOSE AN OPEN ADV ON INT ACT STEAM GENERATOR

• l'f'°vv-..y Should a cycling atmospheric dump valve (ADV) fail to close automatically, the operator has several avenues of manually preventing flow through the ADV. As a first attempt, the operator can close the ADV from the control room. If the hand indicating controller should fail to work, the operator can isolate the ADV by closing the manual isolation valve located on the roof of the turbine building. If this effort should fail, the operator may close the manual air isolation valve to the ADV, which is also located on the roof of the turbine building.

In each of the*above cases, the operator has no written procedure to rely upon, rather he must resort to his knowledge of the plant. It is assumed that each of the two operators in the control room have an adequate knowledge of the plant and there is a moderate dependence between them.

Each of the avenues available to close an open AbV is considered as an operator action (i.e.,

three separate HEPs have been generated). This has been done to accomodate the construction of the fault tree.

In order to ease construction and quantification of the THERP trees for these* manual actions,

• several simplifying assumptions were made:

.* Written procedures do not exist which help the operators to identify the cause of low pressure in the intact steam generator.

• All manual actions needed to close or isolate the failed ADV must be initiated by the operators based on their knowledge of the plant.

• All of the participants are experiencing a moderately high state of stress.

• There is a moderate dependence between the two operators. *

• If the operator(s) should fail to attempt to close the open ADV from the control room, then he (they) will not close the manual isolation valve. This relationship also exists between failure to close the manual isolation valve and the failure to close the air isolation valve to the ADV.

• The steam generator low pressure annunciator is reset, if it was sounded at the beginning-of the accident. *

• The probability of failure of the hand indicating controllers and the manual isolation valve is treated in the fault tree. For the determination of the overall failure to isolate flow through the ADV, both of these failures are assumed to occur.

HEP 7A-1

. TIIERP TREE QUANTIFICATION A -- Operators fail to acknowledge annunciator:

A basic HEP of 5E-04 will be used as failure of one operator to respond to a single alarm while functioning in a moderately high stress situation.

HEJ> = 5E-04 * ((1 + 6*5E-04)/7) = 7.5E-05 [Table 20-4] .

8 -- Failure in reading annunciator:

8.oth operators may inadvertantly read another lighted annunciator once the alarm has been acknowledged .. The basic HEP for failure to correctly read an annunciator is used, modified to account for a moderately high stress level and moderate dependence between the operators.

HEP = 0.005 * ((1 + 6*0.005)/7) = 7.35E-04 [Table 20-3]

C -- Operators fail to detect an ADV is open:

• Since there are no written procedures to guide the operators, they will need to base their diagnosis of the problem by scanning the control panel. It is extremely likely that the operators will initially believe the steam generator blowdown is caused by a failed MSIV, an open ADV, or ..

a premature opening relief valve.

Considering the moderately high stress the operators are functioning under, the HEP for failure to detect an open ADV is assigned a value of 0.05.

• HEP = 0.05 * ((1 + 6*0.05)/7) . = 9.5E-03 D -- Operators fail to close ADV from control room:

• Failure to close an ADV from the control room encompasses two highly dependent actions by the operator--he must place IDC-0780A in manual mode and use either IDC-07808 or me,.

• 07818 to close both ADVs on the intact steam generator.

• Since the operator knows that an ADV is open, the basic HEP for selecting the frong control from a functionally grouped set of controls is used, modified to account for the moderately high stress state.

HEP = 0.005 [Table 20-13]

E -- Operator fails to close manual ADV isolation valve:

HEP 7A-2

Should the hand indicating controller fail, the operators must rely on their knowledge of the plant to close the ADV isolation valve located on the roof of the turbine building. The existence

• of these valves should be known by the operators, since they have been used on previous occassions when a leaking ADV needed to be isolated during plant operation.

At this point.however, both automatic '}nd manual control of the ADV has failed. The stress level at this point would still be moderately high, but the operators may be in a state of disbelief that the ADV is still open. It seems logical to assume that if the operators believe the IBC to be showing the ADV open when it is actually closed they will request someone to go out to the turbine roof to verify that it is still open.

Since the isolation valve handwheels are located in sight of the ADV s and are placed beneath them, the basic HEP for failure to close the isolation valve is judged to be 0. 1. This judgement reflects the fact that an auxiliary operator will be sent out to check the ADV. This HEP includes failure of the two operators to issue the instruction to an auxiliary operator.

HEP= 0.1 F -- Operator fails to close.manual air isolation .valve to ADV:

The air isolation valve is located within a box located near the manual isolation valves. Based upon engineering judgement the HEP for failure to close the manual air isolation valve to the open ADV is 0.25. .

HEP = 0.25.

HEP 7A-3.

., . * -  :::t~L

'-f.~s-a ~A

~

b B F4 c c D d A - Failure to acknowledge alarm - 7.5 . x 10-s B - Failure in reading annunciator - 7.35 x 10-4 C., Failure to detect ADV is open - 9.5 x 10-s D.- Failure to close ADV from Control Room - 5.0 x 10-s F1 = (l-7.5x10" )(1-7.35xl0-4)(1-9.5x10-3)(5.0xl0-3) 5

= 5.31x10-6 F2 == (1-7. 5x10-s)(l-7.35x10-4)(1-9.5xl0-3) = 5.31x10-6 F3 = (1-7.5x10-s)(7.35x10-4) = 5.31 x 10-6 F4 = 7.5x10-s = 5.31x10-6 Control Room 1.52 x 10*2 HEP 7A-4

a' e

A- Failure to close ADV from Control Room - .0152 B - Failure to close block isolation valve - .1 Fi. = (.9848)(.1) = 9.85 x 10*2 F2 = (.0152) = 1.52 x 10*2 Block Isolation Valve l.14x 10*1 a" ~"

f F F2 F1 .

A - Failure to close ADV from Control Room/block isolatfon valve - .114

• B - Failure to close air isolation valve - .25 F1 = (.886)(.25) = .2215 F2 =.114 = .114 Air Isolation Valve 0.336 HEP 7A-5

FAILURE TO ALIGN A FAULTED SIS COMPONENT _(-+o.~sc.\ _

Upon a safety injection actuation signal (SIAS) various equipment is required to change state.

Verification of proper status of all SIS equipment provides the operator the ability to detect and correct malfunction of any component.

In order to simplify the quantification of the THERP tree for this operator action, the following assumptions were made:

• All participants are functioning under a moderately high state of stress.

• In order to deal with the transient, the control operators will use emergency operating procedure EOP-1.

• Whenever two operators perform the same task, a moderate level of dependence between them is assumed. -

• No credit is taken for recovery actions generated because the* operator ( s) find the pressurizer level is low.

• The probability of using the checklist attached to the EOP if the step which calls for verification of SIS operation is not omitted is assumed to be 1.

• The probability of using the checklist in response to the ci.larm is not assumed to be 1, since the checklist is not attached directly to SOP 40 (SOP 40 lists the appropriate operator response to various annunciators).

• The probability of the operator using the local hand switch for any component if the control room switch fails is considered to be 1. *

• The probability of both operators incorrectly reading the annunciatqr once the alarm is acknowledge is assumed to be negligible, since the annunciator light is red. This will distinguish it from various other annunciators occurring at the outset of the transient.

THERP TREE QUANTIFICATION A -- Failure to verify SIS operation:

Failure of the operator to verify SIS operation is simply an error of omission in use of the written emergency operating procedures. The lower bound of the basic HEP is used, modified to account for the stress level. The lower bound was deemed appropriate since the operators are extensively trained to respond to plant transients using EOP 1. Also, the operators through their training realize the importance of SIS in various accident situations.

HEP = 0.005" [Table 20-21]

• HEP 3-1

'B -- Failure to correctly use a checklist:

~

Once the checklist is being used, the operator may improperly use the checklist by checking the status of inany components and checking them off This defeats the purpose of the checkoff provision and increases the opportunity to omit an item on the checklist. ,

HEP = 0.5 [Table 20-23]

C -- Error of omission in using checklist properly:

The lower bound of the basic HEP for an error of omission in the use of a checklist is used, modified to account for the moderately high stress level. The use of the lower bound is deemed appropriate due to operator training and the importance of the safety injection system.

HEP = 0.0008*5 = .004 [Table 20-21]

D -- Error of omission in using checklist improperly:

The lower bound of the basic HEP for iln error of omission in the use of a checklist without a

• checkoff provision is used, modified to account for the m<;>derately high stress level. Again the lower bound was deemed appropriate due to operator training and the importance of the safety injection system.

HEP = 0.001 *5 = .005 . [Table 20-21]

E --Failure to acknowledge SIS actuation alarm.:

The data presented in NUREG/CR-1278 concerning failure to acknowledge an alarm contains data for response to a single alarm given the number of alarms which. occur in a short period of time. Conservatively, a value for failing to a~knowledge an alarm when between 21 and 40 have occurred is used. This value was not modified to take into account the stress level, since the data for occurrence of that many alarms must include the stress that is placed upon the operators due to the increase activity in the control room.

HEP = 0.20 * ((1 + 6~0.20)/7) = 0.063. [Table 20-4]

F -- Failure to use checklist:

Should the operators acknowledge the SIS actuation alarm, the immediate operator action is to use a checklist to verify SIS operation. A moderate dependence between the operators.

HEP = 0.25 * ((1 + 6*0.25)/7) = 0.089 [Table 14-3)

HEP 3-2

G -- Failure to align component which did not change state:

-t: .o::;:: $ (._.

~

~ 1fib.

. ..!c-i The operator upon identifying ~he status of the equipment which did not change state on a SIAS will attempt to change the state of the component from the control room (or locally if the control room control fails). Still functioning under a moderately high stress state, the probability of error of selecting another switch is considered negligible, since the switch was identified by noting the status indicating lamp. It is further assumed that the switch does not Violate a populational stereotype.

HEP = 0.0005 *5 = 2.5E-03 [Table 20-13]

HEP 3-3

F f B FS

• • ~*( r F6 B b

g

~ D c d c

~ F2 F F7 G

~

4 G F9 g G

F10 F8 A - Failure to verify SIS -- Error of omission in use of written procedures .005 B - Failure to correctly use checklist - .5

• . C - Error of omission on using checklist properly - .004 D - Error of omission in using checklist improperly - .005 E - Failure to acknowledge alarm - .063 .

F - Failure to use checklist - .089 G - Failure to align component - 2.5E-3 F 1 = 0.995 (.5)(.996)(2.5Xl0"3) = 1.24 *x 10*3 .

F2 = 0.995 (.5)(004) = 1.99 x 10*3 F3 = 0.995 (.5)(.005) = 2:49 x 10*3 F4 = 0.995 (.5)(.995)(2.5Xl0"3) = 1.24 x 10*3 F5 = 0.005 (6.3Xl0~2 ) * = 3.15 x 10-4 F6 = 0.005 (0.937)(8.9Xl0" )2

= 4.17 x 10-4 F7 = 0.005 (0.937)(0.911)(.5)(.004) = 8.54 x 10-6 F8 = 0.005 (0.937)(0.91 l)(.5)(.996)(2.5X10"3) = 5.31 x 10-6 F9 = 0.005 (0.937)(0.911)(.5)(.005) = 1.07 x 10*5 F 10 = 0.005 (0.937)(0.91 l)(.5)(.995)(2.5Xl0"3) = 5.31 x 10-6 7.72 x 10*3 HEP 3-4

. FAILURE TO PERFORM A FUNCTION UPON A SYSTEM MALFUNCTION (CHANGE POSITION OF A VALVE, START A PillAP, ETC.)

f!P~)

During system operation a component malfunction will require the operator to make a timely diagnosis and institUte corrective action. A system malfunction (e.g., failure of a motor operated valve) will not lead to system failure before an annunciator in the control room sounds.

The following assumptions were made to simplify construction of the THERP tree:

• The response to the annunciator should be the use of a checklist if the malfunction is a system component such as a motor operated valve.

• The operators are functioning at a moderately high stress level.

• The appropriate response to the annunciator is to use a checklist to verify the status of the component within the system.

• There is a moderate degree of dependence between the two control room operators.

• THERP TREE QUANTIFICATION A -- Failure to acknowledge annunciator:

Two operators will be in the control room to respond to the alarm A basic HEP of 5E-04 will be used as failure of one operator to respond to a single alarm while functioning in a moderately high stress situation.

HEP = 5E-04 * ((1 + 6*SE-04)/7) = 7.5E-05 [Table 20-4]

B -- Failure in reading annunciator:

Both operators may inadvertantly read another lighted annunciator once the alarm has. been acknowledged. The basic HEP for failure to correctly read *an annunciator is used, modified to account for the stress level and dependence between the operators.

HEP = 0.005 * ((1 + 6*0.005)/7) = 7.35E-04 [Table 20-3]

C -- Failure to use checklist:

Should the operators acknowledge and respond to the annunciator, the immediate operator action is used to use a checklist. Since the operators are functioning under a moderately high stress* rate, a basic HEP of 0.1 will be used iil failure to use a checklist.

• HEP = 0.1 * ((1 + 6*0.1)/7) = 0.023 [Table 14-3]

HEP 17-1.

D -- Misuse of a checklist:

A Basic HEP of 0.5 is used.

HEP = 0.5 [Table 20-71)

E -- Error of omission in use of a short checklist correctly:

A basic HEP for_ an error of omission in use of a checklist, modified to account for the stress state is used. No credit is taken for the second operator.

HEP = 0.005 [Table 20-21]

F -- Error of omission in use of a short checklist improperly:

A basic HEP for an error of omission in a short list without checkoff proVisions is utilized, modified for the stress state.

HEP = 0.015 [Table 20-21]

HEP 17-2

b F

4 c

c d

F D 3

F e f E

F .

1 A - Failure to acknowledge annunciator - 7.5 x 10-s B - Failure in reading annunciator - 7.35 x 10-4 C - Failure to use checklist - 0.023 D - Misuse of checklist - 0.5 E - Error of ommision using checklist properly - 0.005 F - Error of ommision using checklist improperly - 0.015 F 1 = (1-7 .5xl0- 5)(1-7.35xl0-4)(.977)(.5)(.005) = 2.44 x 10*3 F2 = (1-7. 5xl0"5)(1-7.35xl0-4)(.977)(.5)(.015) = 7.32 x 10-3 F~ = (1-7.5x10- 5)(1-7.35x10-4)(.023) = 2.30 x 10*2 F 4 = (1~7.5xl0- 5 )(7.35x10-4). = 7.35 x 10-4 F5 = 7.5x10-s = 7.50 x 10-s 3.36x 10-2 HEP 17-3

Palisades Human Error Analysis (NUREG-4772)

Continued HUMAN ERROR EVENT: SRECIRCOX - Verify switchover of safety injection pump suction from SIRWT to containment sump.

Governing Procedures: EOP 4.0, steps 48 loss of coolant aecident recovery EOP 9.0, HR-3, steps 60-68 Com/Jelling Signal: + SIRWT level approaching 2%

+ recirculation acutation signal (RAS) annunciator Instrumentation Needed to + SIRWT level Diagnose: + EK-13, annunciator 57 Initial Conditions! + 2 high pressure safety injection pumps operating Assumptions: + 0 containment spray pumps operating *

+ initial SIRWT inventory of 250,000 gallons EVENT TIMING:

TIMING TIME VALUE BASIS THRESHOLD . (min.)

Time coinpelling signal

• 500 minutes RAS control room annunciator Se>unds.

received (T,.)

Latest time event can 520 minutes Time that the inventory of the SIRWT be completed (T,..) is depleted.

Time required to 2 minutes Time to verify/perform HPSI suction comolete action (T..) switchover to containment sump.

Time available for 18 minutes Td =Tm-T-T o a diaanosis (T,.)

• 20-

l Palisades Human Error Analysis (NUREG-4772)

Continued SEQUENCE OF EVENTS:

1'. SGTR or small-break LOCA transient initiator.

2. HPSI provides 500 gpm primary makeup to replenish PCS.break losses.

3. SIRWT reaches-2% level and HPSI suction switched to containment sump.

SEQUENCE SPECIFIC FACTORS: None.

TASK BREAKDOWN: Action covered in procedures.

HEP EVALUATION:

Diagnosis HEP: 1. Procedures available.

2. Figure 8-1 yields HEP of2.8E-02 for 18 minutes.

. 3. No basis for using lower bound HEP .

Post-Diagnosis HEP:

The action of the operator and CR personnel is covered in the table below using Table 8-5 as a reference.

l (1) "A" operator fails.to acknow- .02 Table 8-5, #3 ledge RAS alarm and verify suction switchover. * *

(2) SS fails to notice alarm and .2 Table 8-5, #6.

request verification of switchover.

(3) "B" operator fails to -monitor .2 Table 8-5, #6 SIRWT level and verify HPSI

• suction switchover.

Palisades Human Error Analysis (NUREG-4772)

Continued Post-diagnosis from the table above is the product of Tasks 1through3.

HEP = .02 I .l I .l = 8.0E-04

• TOTAL HEP:

Sum of adjusted diagnosis and post-diagnosis.

Total HEP= l.8E-02 + 8.0E-04 = 2.8E-02 ISSUES: None.

-22*

Palisades H~man Error Analysis (NUREG-4772)

Continued HUMAN ERROR EVENT: RPORVOA - Operator opens the PORV s and their motor-operated block isolation valves to establish once through cooling.

Governing Procedures: EOP 9.0, HR-4, step 2 - functional recovery guideline Compelling Signal: + AFAS signal with failure of auxiliary feedwater Instrumentation Needed to + auxiliary feedwater flow Diagnose: + steam generator level Initial Conditions/ + emergency procedures directs operator to open Assumptions: PORV isolation valves if auxiliary feedwater fails.

EVENT TIMING:

TIMING TIME VALUE BASIS THRESHOLD (min.)

Time compelling signal 15 minutes With failure of auxiliary feedwater, the received (T0 ) EOPs direct the operator to open the PORV block isolation valves to prepare for OTC.

Latest time event can 54 minutes Time at which primary system has be completed (T..) heated* up to 668 °F, which corre-sponds to the saturation temperature for the code safety valves.

Time required to 1 minute Operator opens PORVs and their complete action (TJ associated motor-operated isolation valves per step 2 of HR-1.

Time available for 38 minutes T4 =Tm-T-To a diagnosis (Td)

. -37*

Palisades Human Error Analysis (NUREG-4772)

Continued SEQUENCE OF EVENTS:

1. Transient initiator.

2.

• Auxiliary feedwater fails.

2. *Low pressure feed cannot be established.

3. Operator initiates OTC by opening PORVs.

SEQUENCE SPECIFIC FACTORS: None.

TASK BREAKDOWN: Operator actions outlined in emergency procedures.

HEPEVALUATION:.

Diagnosis HEP: 1. Operator action guided by procedures.

2. Figure 8-l yields HEP of7.6E-04 for 38 minutes.

3. Simulator exercises and operator training emphasize accident recovery using OTC, so use of lower bound is appropriate.

4. Lower bound HEP is 7.6E-05.

Post-Diagnosis HEP:

The action of the operator and CR personnel is covered in the table below using Table 8-5 as a

.reference.

.::*:*:*:*.:*-::::.;:::::.:.:::;:::~:{:::~:: ::;:;:;:;:;:::::;:;:::::::::;~:;:;*::::;:;:::.::::::::::*

jl§l!I (1) "A" operator fails to respond .02 Table 8-5, #3 to auxiliary feedwater system failure the EOPS.

(2) SS fails to request status of .OS Table 8-5, #4

• secondary cooling per EOP (EOPs require safety safety function status check- function status check sheet r uirement. eve 15 minutes (3) "B" operator fails to identify .2 Table 8-5, #6 lack of secondary feed flow and take action to intiate OTC.

• 38-

Palisades Human Error Analysis (NUREG-4772)

Continued (4) Operators fail to take action in .05 Table 8-5, #5 response to primary system oressure/temoerature trends. *

(5) TSC fails to noted lack of .5 Table 8-5, #7 secondary cooling and direct operators to initiate OTC.

Post-diagnosis from the table above is the product of Tasks 1 through 5.

HEP = .Ol x .05 x .l x .05 x .5 = 5.0E-06 TOTAL HEP:

Sum of adjusted diagnosis and post-diagnosis.

. Total HEP= 7.6E-05 + 5.0E-06 = 8.lE-05 ISSUES: None.