ML20072E122

Plant Ipe,Submittal Human Reliability Analysis Final Rept

ML20072E122
Person / Time
Site:	Browns Ferry
Issue date:	03/31/1994
From:	Bovell C, Haas P, Swanson P SCIENCE & ENGINEERING ASSOCIATES, INC.
To:	NRC
Shared Package
ML18038A932	List: ML20072E054 ML20072E104 ML20072E122
References
CON-NRC-04-91-069, CON-NRC-4-91-69 CA-TR-93-019-11, CA-TR-93-19-11, NUDOCS 9408220115
Download: ML20072E122 (34)

Text

..

CA/TR-93-019-11

.~

l

~

BROWNS FERRY NUCLEAR PLANT UNIT 2 TECIINICAL EVALUATION REPORT OF THE IPE SUBMITTAL IIUMAN RELIABILITY ANALYSIS FINAL REPORT C. R. Bovell P.J. Swanson P. M. Haas .

Prepared for U.S. Nuclear Regulatory Commission Office of Nuclear Regulatory Research Division of Safety Issue Resolution Draft Submitted January,1993 Final Report March,1994 CONCORD ASSOCIATES. INC.

Systems Performance Engineers 725 Pellissippi Parkway Knoxville, TN 37932 i

l Contract No. NRC-04-91-069 I Task Order No. I1

Table of Contents I

1.0 INTRODUCTION

1 1.1 Do.cument-only HRA Review Approach . . . . .

3 1.2 The Brownc Ferry IPE HRA Approach . . .. . . .. .

.. . 4 2.0 CONTRACTOR REVIEW FINDINGS ..... .

............ ............ 4 2.1 Work Requirement 1.1 ..... .

4 2.1.1 WR 1.1.1 . .............. . . ...... ...........

10 2.1.2 W R 1.1.2 ...... . .. ... .. ... ...... .. .

15 2.1.3 W R 1.1.3 . . . ......... ... . ... ... .... .

16 2.1.4 WR 1.1.4 .. . ...... . .. .. . ......... . .. .

16 2.1.5 WR 1.1.5 ....... ......... . . ...... .

.. 17 2.2 Work Requirement 1.2 . .. . . . ..

17 2.2.1 WR I.2.1 .. . .. ...

17 2.2.2 WR i.2.2 .

I8 2.3 Work Requirement 1.3 .. .. . . .. ... .. . .

I8 2.3.1 WR 1.3.1 19 2.3.2 WR 1.3.2 . . . . . . . . .

19 2.3.3 WR 1.3.3 . .. .

. 21 2.3.4 WR 1.3.4 . . . ... . ..

.... 21 Work Requirement 1.4 2.4 . . .. . .

. . 21 2.4.1. WR 1.4.1 . . . . . . . .. ..

.... 21 2.4.2 WR 1.4.2 .. .. .. . . .. . .. .

.. . .. . ... . .. 22 3.0 OVERALL EVALUATION AND CONCLUSIONS .

. ........ ... 23 4.0 IPE EVALUATION AND DATA

SUMMARY

SHEETS .

. . .... . . . . ... . 26 REFERENCES .. .. . .. .

f

)

i l

1.0 INTRODUCTION

\

\

This technical evaluation report (TER) is a summary of the documentation-only review of the l Human Reliability Analysis (HRA) portion of the Browns Ferry Nuclear Plant Unit 2 Individual I Plant Examination (IPE) submittal to the U.S. Nuclear Regulatory Commission (NRC). The body of the report consists of four sections, per the instructions of the Task Order: (1) this i Introduction which pro cides a brief summary of the approach to this document-only review and of the Browns Ferry IPE HRA approach; (2) Contractor Review Findings, a detailed documentation of findings for each work requirement specified in the Task Order; (3) Overall l Evaluation and Conclusions, which summarizes the important findings and results from the review, and (4) the NRC sununary data sheets. l t

1.1 Document-Only HRA Review Approach  !

l The document-only review approach for the Browns Ferry IPE HRA involves the following six j

steps illustrated in Figure 1. These steps, especially steps 2 through 4, are interactive and iteratise, but follow this general progression .

l Read summary sections. j (1) Scoping Review - an overview of the entire IPE submittal.

plant descriptions, the major HRA-pertment section(s), and result sections. Skim / scan the entire submittal, including appendices and detailed front-end and back-end analyses.

1 Identify the basic approach used for the HRA and the organiation of the HRA documentation, including any obvious major omissions. Identify notable features of the l j

plant, the overall IPE approach, or the HRA approach that deserve special attention. j Identify and obtain references that may need to be reviewed or checked, and obvious Review descriptions of l points of interface with front-end and back-end analysis. f IPE/HRA team qualifications.

(

l (2) Detailed Review of HRA Sections - a detailed review and assessment of the primary HRA section(s) of the submittal. This involves first a thorough (re) reading of descriptions l of methodology noting assumptions, data sources, and other important aspects of the l analysis, and annotating any questions, potential problem areas, missing information, or  !

j issues for further investigation. Second, it involves a comparison of information and documentation found in the submittal about the overall HRA methodology / approach to l the information/ documentation " requirements" identified in accepted HRA approaches used l in other PSAs. For example, Browns Ferry analysts used an adaptation of the SLIM 1 methodology developed by Brookhaven National Laboratory for NRC (Reference 1). l l

Therefore, Reference I was used for comparison with the Browns Ferry methodology.

Finally, the detailed review involves an attempt to " track" the complete assessment of a l j

few key operator actions through the HRA process described in the submittal. By '

tracking, we mean identifying that the submittal contains sufficient information to clearly delineate methodology, major assumptions, important parameters such as performance l shaping factors, data sources, references, etc., for the qualitative and quantitative assessment of human actions. There is no attempt to reproduce quantitative analysis. l' I

1 i

f

, ,, - , ---------n.,

a 4 - - -- _.

I I

I l

J e

e I

e l

l I

i l

B I

i t

6 L

t j

s 4

t i

I t

ll 9

J 4

C O

l t

l t

t I

i p

I I

i i

I i

i h

b E

I

. . . _ - _ , _ _.__m. _ . . . _ _ _ . .

i j

(3) Response to Work Requirements - as.,essment of specific issues identified in the Task

.j Order work requirements. This is an item-by-item assessment responding to each work j

requirement. The focus is identification of strengths and weaknesses of the HRA portions '

of the submittal .and insights regarding important results or potential areas of l

improvempnt. Any questions that require additional input from the licensee are identified.

This step includes completion of the NRC data sheets, which is Work Requirement 2 in {

the Task Order.  ;

l (4) Interface with Front-End and Back-End Reviewers - two-way exchange ofinformation and discussion ofissues. The focus is on HRA aspects of front-end or back-end analysis, but the interaction includes a general exchange of information and findings. The lt interaction takes place informally throughout the review, but primarily after completion of the overview in Step 1 above, and again after completion of Steps 2 and 3 as writing of the TER begins. Additional interaction occurs during the closing meeting of NRC staff l

and IPE review contractors in Step 6.  :

(5) Prepare the TER - develop and write this technical evaluation report. This involves:  ?

preparation of a draft report documenting all work accomplished, findings,and conclusions; internal technical review verifying findings and conclusions and compliance with Task Order Requirements; editorial review; and printing.

(6) NRC Staff and Contractor Meeting - held after submittal of the TERs from the contractors to review findings and conclusions and finalize questions for the licensee (if (

any).

1.2 The Browns Ferry IPE HRA Approach The Browns Ferry IPE is a Level 2 Probabilistic Risk Assessment that includes the accident f

sequences developed to define a set of radioactive material release categories and a definition of l

the source terms for radioactive release. The HRA portion of the Browns Ferry IPE was Application of this performed using the Success Likelihood Index Methodology (SLIM).

analytical approach was performed using three groups of operators to rate the degree of difficulty (

of an action by rating seven performance shaping factors. Ratings obtained from the three groups j

were merged, and the final Human Error Rates (HERs) were calculated.

l 3  !

l i

l l

l

l 2.0 CONTRACTOR REVIEW FINDINGS i The subsections-below address explicitly, item by item, each of the work requirements sp For each item, there is an attempt to identify notable points about the in the Task Order. ,

submittal, both strengths and weaknesses, and insights as to how the submittal might be I

~

with regard to the specific work requirement and the overall intent of Generic Lette Those final report incorporates results of discussions between NRC staff and the licensee.

discussions included resolution of questions raised in the draft report.

2.1 General Overview of the RRA Process (Work Requirement 1.1). '

2.1.1 Completeness and level of detail.

Table 2-1 lists the major items identified in NUREG-1335 (Reference 2) pertinent to HRA were checked. Findings with regard to each major item in Table 2-1 were as follows: y (1) General Methodoloev. The general methodology for accident sequence selectio r sequence development, system modeling, HRA, and accident sequence quan in Section 2 of the submittal. A set of dependency matrices were developed to define p '

systems and the dependencies and interactions of the fr l release category end state. The Browns Ferry approach is scenario-based. The s for analysis were identified by systematically examining plant design and operating fej deselop a set of initiating events, linked event trees, dependency matrices, and Variations of scenarios were defined by l tools that define the progression of accidents.  !

consideration of frontline system operation and possible failures, operation of supp possible failures of these support systems, and the operator actions that wi) scenario. Human errors were quantified, and incorporated into the plant model ini ways. The incorporation of the error data into the plant model depends on the ,

action on other events in a sequence and how it impacts the quantification of other eventl Routine (pre-initiator) errors that affect system availability are incorporated into the syste!

Dynamic actions (procedural post-initiator actions) are incorporated into the event trees  !

The PRA process began by gathering information on the plant, and [

(2) Information Assembiv.  !

plant safety analyses of plant with similar design. Plant documents which wl the Updated Final Safety Analysis Report be essential for performing the analysis includes:  !

(UFSAR), design basis calculations, design criteria, flow diagrams, systeml drawings, logic diagrams, emergency operating procedures, abnormal operatin surveillance instructions, maintenance instructions, operator training materials, and l

b 1

4 i

I i

INFORMATION PERTINENT TO HRA NUREG-1334-REFERENCE 2.1.1 General Methodology Concise description of HRA effort and how it is integrated with the IPE tasks / analysis. l 2.1.2.2 List of reference PRAs, insights regarding ,

2.1.2 Information Assembly HRA, human performance.

i 2.1.2.3 Concise description of plant documentation i

used for HRA information; concise discussion of the  !

process used to con 6rm that the HRA represents conditions in the as-built, as-operated plant.

i 2.1.2.4 Description of the walkthrough activity, l

including HRA specialist participation.

2.1.3 Accident Sequence Description of process for assuring human actions l

are appropriately considered in initiating events and Delineation i accident sequence delineation. HRA specialist input.  ;

Description of process for assuring that the impacts l 2.1.4 System Analysis i of human actions are appropriately included in j

systems analysis; process for integrating HRA. i 2.1.5.1 HRA in common cause analysis.

2.1.5 Quanti 6 cation Process  ;

2.1.5.3 Types of human failures considered in the i

IPE: a categorization and concise desenption exist. l 2.1.5.4 List of human reliability data and time available for recovery actions; data sources clearly identined; if screened, a list of errors considered, criteria for screening, and results of screening. l 2.1.5.5 List of HRA data obtained from plant experience and method / process for obtaining data; l list of generic data. ,

4 2.1.5.6 Concise description of' method by which HEPs are quantined, including break down such as task analysis, and techniques for combining l probabilities, assessing dependencies, etc. l l

l, h

5 i

Table 2-1 NUREG-1335 HRA Items Checked - WR 1.1.1 NUREG-1335 REFERENCE INFORMATION PERTINENT TO HRA Human contributions to important sequences are 2.1.6 Front-End Results and Screening Process clearly identified. A concise definition of vulnerabilities is provided, along with a discussion of criteria used to identify vulnerabilities. A listing of vulnerabilities is provided, with clear definition of those related to human performance. Underlying causes of human related vulnerabilities are identified.

2.1.6.6 Sequences that, were it not for low human error rates in recovery actions, would have been above the applicable core damage frequency screening criteria are identified and discussed.

2.1.6.7 Any human performance issues pertinent to USIs or GSis are identified and discussed as appropriate.

2.2 Back-End Submittal Impacts of operator action on containment response are identified. Actions assumed to be accomplished by operators can reasonably expected to be accomplished under the severe accident conditions expected; equipment accessibility, survivability, information availability, etc have been considered.

Critical human actions have been identified and included in the event trees and quantitative HRA assessments.

2.3 Specific Safety Features Any human performance related aspects of unique and Potential Improvements and/or important safety features are discussed, including any that resulted in significantly lowering typically high frequency core melt sequences.

Human related potential improvements - procedures, training, etc.- in response to vulnerabilities are clearly identified and discussed.

IPE Utility Team and The submittal describes the utility staff participation 2.4 Internal Review and involvement in the HRA. An independent in-house review of the HRA was conducted.

6

crew surveys. In addition, a generic PRA database was supplied by a contractor performing much of the PRA.

' Information asse bly also involved review of probabilistic safety analyses (PSAs) of plant of similar design. Fo.r the analysis of core damage frequency, the volumes of NUREG/CR-4450 Other PSAs perforrned by the

' covering the Peach Bottom plant were major references.

contractor, Pickard, Lowe and Garrick (PLG, Inc.), were also used for reference. South Texas, Seabrook, Diablo Canyon, and Hatch were all mentioned in the submittal as sources of dat methodology.

Several walk-through activities were included in the information assembly process. The PRA team visited the site to discuss plant operations with operating crews and site engineers. A report of a containment walk-through performed by Oak Ridge National Laboratory in 1982 was u This information was supplemented with drawing rather than actually entering containment.

reviews and photographs taken by plant personnel. Engineers from the plant were assign provide support to the PRA team, and operations personnel were assigned for the of the project to provide knowledge of plant layout, system design, operations, and main practices.

(3) Accident Seauence Delineation. Selection of initiating events for analysis in the P was performed by determining which events are appreciable contributors to risk. Even identified by using previous PRA studies, failure modes and effects analysis of plant systems, review of plant abnormal operating procedures, a review of the FSAR, and discussion operators on specific postulated events. Events were categorized according to i of initiating events was then compared with the lists of initiating events for PRAs perfo other General Electric Boiling Water Reactors, including the Browns Ferry Unit I list of event Four broad categories of initiating events were identified: loss of reactor coolant accidents, transients, loss of support system events, and internal flooding. A list of the events, alon Success criteria for plant event frequencies, is provided in the submittal in Table 3.1.1-1.

functions were defined for each of the initiating events as part of the development of the syste and event sequence models. The functions that were modeled include: reactor critical reactor coolant system overpressure protection, core heat removal, and containment overpressure protection. Operator actions essential for success of these functions are identified for quantification by the HRA analysts for incorporation into the model.

Detailed system analysis is contained in a set of system notebooks (4) Svstems Analvsis. The objective of the system analysis is to determine the compiled by the PRA analysts.

unavailability of certain top events as part of the Level 1 PRA. The system notebook detailed system information, reference material, and quantitative results of the syst System operation under both normal and off-normal conditions is also included The system analysts reviewed maintenance and surveillance procedures to identify hum that could have an impact on system availability.

7

i (5) Ouanti6 cation Process. The quanti 5 cation process is described in Section 3.3 of the submittal. Event frequencies are calculated for the PRA based on the Bayesian interpretation of probability andte concept of" probability of frequency" for component failures. A proprietary database developed by PLG was expanded using the Browns Ferry system analysis for the quanti 0 cation process.

Included in the database are human error rate distributions used in the quantification process.

Three general types of human actions were included in the database: routine actions, dynamic human actions, recovery actions. Routine actions (pre-initiators) are the actions performed by  ;

plant personnel during maintenance and testing. Errors that prevent systems or components from performing their intended function during an accident are included in the database. Such errors include failure to realign a system flowpath following maintenance or test. The probability of routine errors is reduced by performing functional tests of systems following maintenance.

Certain types of human errors that occur during maintenance and testing were also included in the common cause failure data for systems.

Dynamic human actions (post-initiators) are those performed by operators in responding to an event per procedures or for recovery of failed equipment. Thermal-hydraulic data is used to calculate the time constraints on operator actions under certain accident conditions. Detailed discussion of the quantification process for routine and dynamic errors is presented later in this TER.

Recosery actions are those actions that are intended to recover failed systems or components during an accident. These actions may be in written procedures, or they may be actions that the operator takes based on operating philosophy and knowledge of plant systems.

Quantification of routine actions was performed using a method based on the methodology described in NUREG/CR-1278, the " Handbook of Human Reliability Analysis with Emphasis on Nuclear Power Plant .\pplications," hereafter referred to as "The Handbook" (Reference 2).

Quantification of dynamic actions and recovery actions was performed using a PLG, Inc.

adaptation of the Success Likelihood Index Methodology (SLIM) which is based on the expert judgement of operators. Data collected from three groups of operators on seven performance shaping factors is used to derive a failure likelihood index (FLI), which is then used to calculate human error rate estimates.

(6) Front-End Results and Screenine Process. Results of the front-end analysis and the screening of the results are reported in Section 3.4 of the submittal. Included in this discussion is the Browns Ferry definition of vulnerabilities. Vulnerabilities will be discussed in Section 2.4.1 of this TER. Results are reported for both core damage frequency and the frequency of plant damage states. Frequencies for thirty plant damage states were calculated, with the nine PDS with at least 0.1% of the total CDF.

The screening criteria used for reporting event frequencies and core damage frequency was taken from NUREG-1335. The most significant initiator identified by the screening criteria is the loss 8

1 l

1 of offsite power initiator, which represents 69% of the total CDF. The following six screening criteria were used (quoted directly from submittal):

1. Any systematic, sequence that contributes IE-07 or more per reactor year to core damag,e. Fifty-two events are reported in this category.

2. All sequences that are within the upper 95% of the total core damage frequency.

Over 3,000 sequences are within the upper 95% of the total CDF, with only the top 100 sequences are listed.

4. Systemic sequences within the upper 95% of the total primary containment failure frequency.

4. Systemic sequences that contribute to a primary containment bypass frequency in excess of IE-08 per reactor-year. Four sequences involving containment bypass with frequencies of greater than IE-08 per year were identified. None of these sequences are in the top 100 events.

6. Any other systemic sequences that the utility determines to be important to CDF or to poor primary containment performance. No sequences were identified by the utility in this category.

(7) Back-End Submittal. Containment analysis is reported in Section 4 of the submittal.

Information from the Level 1 model was used as an input into the development of the containment event trees (CET). Therefore. some human actions are implicitly accounted for in the back-end analysis, although there is no detailed input discussed in the analysis. The Level 2 analysis evaluates the progression of the accident sequence from a particular plant damage state This is to a specific release category through the use of a Browns Ferry-specific CET.

accomplished by following the progression of an accident from in-vessel core degradation through containment failure and release.

(8) Specific Safetv Features and Potential improvements. Safety features unique to Browns Ferry Unit 2 are described in Section 6 of the submittal. The symptom-based emergency operating procedures are listed as a beneficial human related feature. These procedures were developed based on the latest version of the BWR Owners Group Emergency Procedure Guidelines. The submittal states that the procedures remove the burden of diagnosis from the operators, and provide the operators with guidance for using alternate injection sources. In addition, improved guidance for response ATWS is included. One specific operator action is discussed in the submittal as exceptionally beneficial. The procedures provide instructions for the operator to use a single flow path for injection of RHR and containment cooling when only one RHR pump is available. The procedures provide instructions for establishing " feed and bleed" from the suppression pool to the reactor, and then back to the suppression pool using the relief valves.

9

i t

To identify potential plant improvements, the results of the analysis were screened to determ  !

if a single initiator, component failure, or operator error exceeded 5E-05 per year. Also, l contribution torore damage frequency is from a single system division, then plant improvements  !

would be considered. The licensee states in the submittal that no potential plant improvements are necessary, since no failures met the screening criteria.

(9) IPE Utilitv Team and Internal Review. The Tennessee Valley Authority Risk Assessment The PRA team Staff (RAS) was responsible for development of the Browns Ferry PRA. f consisted of a project manager; lead analysts for Level 1, Level 2, and data; an electrical sy ,

analyst; and system analysts. A licensed Senior Reactor Operator (SRO) served with  ;

to ensure accident models reflected actual operating practices, and to provide site input into t '

PRA. The analysis was supported by outside contractors; principally PLG, Inc.  !

Review of the IPE was coordinated between the RAS and Browns Ferry site engineering, l

technical support, operations, licensing, and maintenance organizations. The site organizl were trained on PRA, then given the responsibility for the review. No major findings were 7 identified by the review. However, a number of comments were made by the site orgal and resolved by the PRA team. Some minor model improvement resulted from the revie comments. 'l k

2.1.2 Clarity of HRA methodology and justification for selection. i The HRA methodology is described in detail in Appendix B of the submittal. Human actions; were classified as either routine actions, dynamic human actions, or recovery actions. Rou:

actions are the actions performed during maintenance and testing activities that can have an ';

aserse affect on system availability. Dynamic human actions are those that are performed  ;

sollowing the initiation of an accident as directed by procedures. Recovery actions ar taken to recover of failed systems or components. Different analysis methodologies werel ~

for these two broad categories of human actions. Routine actions were analyzed using th methodology outlined in The Handbook. Dynamic human actions and recovery This actions w; analyzed using a modification of the Success Likelihood Index Methodology (SLIM). :

methodology uses structured evaluation forms to quantify expert judgement on the difficulty of the actions. .

i Justification for using SLIM was not specified in the submittal. However, the changes t ,

were discussed in Appendix B. In the Browns Ferry analysis, the potential of success isi by the experts, but rather the degree of difficulty is rated using a set of seven perfot shaping factors (PSFs). A failure likelihood index (FLI) is then derived rather than a sui likelihood. The submittal states that an advantage of this approach is that the cause of operaj difficulty is highlighted when a high score with high weight produces a comparative l

(1) Oualitative analysis. For routine actions the qualitative analysis consisted of a rel procedures to identify the following activities:  !

10 t

I l

)

l 1

Realignment of components or flow paths to normal following test, maintenance, an inspection.  ;

Removal of jumpers or other temporary system alterations to restore it back to servili l

Calibratioh and alignment of sensing equipment to ensure proper automatic response to emergency actuation conditions. ,

Routine actions were identified that could have a significant impact on system or component unavailability in safety-related systems. System analysts were responsible for identif '

actions. Quantification of an action was not performed if (from Appendix B of the submitti

• The alignment of the system has not been changed by the test.

j The test brings the system into closer alignment with its active safety function i configuration than its standby alignment.  !

The alignment of the system is a displayed parameter in the control room subjectfl monitoring by the operators.

Equipment configuration during periods of plant shutdown that are subject to l:

of alignment during startup. Verifications contained in change of mode checkli:

this category. Exceptions to this guideline are made when the human error is ju be the primary contributor to the top event availability. i Errors not meeting at least one of the above screening criteria were quantified.

I l

[ Post-initiator errorr] - Dynamic actions were qualitatively evaluated, on a sce!

basis, to:

Identify dynamic operator actions to include in the event sequence evaluation.

i Ensure that the impact of the success or failure of those actions are properly mode  !

l Develop descriptions of those actions in a form that will facilitate operator evl f

Operating procedures were used to identify those actions that operators will:

plant to a safe shutdown following an initiating event. Actions that are takl cooling systems, backup automatic actions, and response to failures of active  !

identified. Action boundary conditions, success criteria, and event scenario timing is identified to recording on the operator response form. Timing of actions is determ:

of the:modynamic calculations and engineering judgement. [

11 i

a

- +

_ _ _ _ _ _ _ _ . _ _ _ _ _ _ _ _ _ _ _ _ . - . r - - - v -

r T

Plant-human and human-human dependencies are described on the operator resp human dependency accounts for the impact of the plant instrumentation and oth indications on the ability of the operators to accomplish the action. Human human involves the increased potential for making a series of errors once the Erst error Completed operat,or response forms are reviewed by the plant operations s any comments, the completed data is incorporated into the plant model. A between the operator response form and the plant event sequence model is ex operator evaluation team.

(2) afterOuantitative Analvsis.

the qualitative screening [ Pre-initiator is performed errorr) using generic - Quantificatio error rates from Tabl submittal. This table lists the pre-initiator error rates for misalignment of compon a test. The reference listed as the source for Table B-1 is a letter from PLG, Inc.

submittal states that this table was developed using methods documented in Th Comparison of the error probabilities in Table B-1 of the submittal and The 16-1) for use of test or calibration procedures (HEP =0.05), use of maintenan (HEP =0.3), and use of a checklist (HEP =0.5) indicate at least an order of ma in the error probabilities. In response to a request for additional information i t that the nominal HEPs from NUREG/CR-1278 were adjusted to account for perform factors associated with control room and in-plant actions. The licensee stated from 17 to 28 individual opportunities for error were identined,ERand the error ra based together to obtain an overall value. One check was permitted to lower the ove upon THERP error rate for checking another persons' operations. This all BFNP restoration procedures.

Surveillance instruction type procedures which create opportunity for miscalibra errors were screened to be unlikely based on the following:

- Independent and/or second-person veri 6 cation of readings during the instrument calibration was performed.

- The reading on the test indicator was veri 6ed proper for existing plant conditio After the calibration task, a second person was required to verify the correc the instrument valves and place lead seals on the valves.

- A third person who was not directly involved with the task verified that the ins valves returned to their normal positions and had lead seals installed on them.

- The daily instrument checks and observations would also have detected any i channel miscalibration.

{ Post-iritiator errors:] - Quantification of dynamic operator errors and reco performed using a PLG, Inc. methodology based on SLIM. Expert judgeme 12

of operators was used to obtain the error rates for dynamic errors. A single group of operators was used for the recovery errors. As outlined in the submittal. the approach is base on the following assumptions:

- The likelibood of an operator error in a particular situation depends on the combined effects of a relatively small set of performance shaping factors (PSF) that influence the operator's ability to accomplish the action successfully.

- Evaluators can address each PSF independently so that the overall evaluation can be expressed as the sum of the results of each PSF to form a numerical likelihood index.

- The actual quantitative error rate is related to the numerical likelihood index by a logarithmic relationship.

- The logarithmic relationship can be calibrated on a situational basis by use of appropriately selected calibration tasks having generally accepted error rates.

Seven PSFs were listed in the submittal that were incorporated into a set of evaluation forms.

The evaluation forms ask the expert to judge the degree difficulty of a each performance shaping factor on a scale of 0 to 10. The PSF that were incorporated into the evaluation form are (from the submittal):

- Conditions of the work setting under which the action must be accomplished. The PSFs are as follows:

- Significant Preceding and Concurrent Actions Plant Interface and Indications

- Adequacy of Time To Accomplish the Action

- Requirements of the task itself. The PSFs are as follows:

Procedural Guidance

- Complexity of the Task Relative to Resources, Coordination, and Location

- Psychological and cognitive condition of the operators. The PSFs are as follows:

- Training and Experience Relative to the Action

- Stress due to the Situation and Environmental Conditions The PSFs are in rated against two criteria:

- A score relates the degree to which the conditions of PSF help or hinder the operator to perform the action.

13 l

i

)

- A weight relates the relative influence of each PSF on the likelihood of the success of the action.

~

The operator evaluation of the degree of difficulty of the PSFs is used to produce a failure likelihood index (FLI). -A high likelihood of failure is obtained when a PSF receives a high score and a high weight. To normalize the weights, a group average of the weights is calculated for each action evaluated. The FLI is calculated using the following formula:

FLI=Ew,s, where i = PSF that has an influence on the error rate of the action.

w, = weight of the PSF,, normalized so that Ew,=1 s, = degree of difficulty score for PSF,, from 0 to 10.

PSFs for each action were sorted according to weight. The actions were then sorted in order cf precedence, starting with the highest average weight. Cut points were established between groups where the pattern of weight changes appear to shift the most. A difference in weights between groups of 5% to 10% is used as a rule of thumb. Grouping stops when the difference between Minor adjustments and the top and bottom weight within the sorted PSFs is less than 0.12.

consolidations can be made after sorting based on consistency reviews and the availability of the calibration tasks needed for quantification. Each group of actions is quantified using the following formula:

Logarithm (Human error rate) = A + B(FLI)

The coefficients are obtained using the least squares fit of the FLI of calibration actions that have reasonable or generally accepted error rates. Calibration actions for each group are selected to match the actions in the group using similarity of PSF weights as the selection criteria. The calibration actions and error probabilities are obtained by review of other PRAs and other statistical or analytical evidence of failure frequencies for these actions. The proprietary database developed by the licensee's contractor is given as the source of this data, no details provided, which is said to agree with the concepts presented in the basic references on the SLI methodology contained in NUREG/CR-3518, NUREG/CR-2986 and NUREG/CR-4016 (references B-3 to B-5 of the IPE).

Uncertainty distributions between the three groups are developed using range factors (error factors) taken from Table 7.2 of The Handbook. For nonroutine tasks (items 4 Handbook table) the range factor is 5 if the estimated error rate is greater than 0.001, or 10 if the estimated error rate is less than 0.001. A computer code is used to merge the distributions of all three operator groups to obtain the final error rates.

)

14 1

1 l

i i

Recovery actions were quantified using the same methodology by which dynamic action i quantified. However, only one of the evaluation groups was used to quantify the r!

rather than the three used for dynamic action quantification. To account for single group bia uncertainties were assigned to the resulting human error rates with values taken or derived f THERP table 7-2, used for the quantification of the same uncertai_nty distribution reference.

dynamic operator errors by the three groups of operators with an additional rating Per NUREG-1335 (Appendix C, Section 9, pg. C-19), the recovery actions for which th takes credit should have written procedures. The BFNP Unit 2 IPE modeled some

" nonprocedural guided actions". Additional information regarding effect of these total risk reduction and measures to assure consistency with guidance and training wa '

from the licensee. No response was forthcoming for total risk reduction effect. Three act which fell under the classification of nonprocedural-guided recovery actions were identifi Action HOSPROI is a local action to manually open a valve that failed to open when ac ,

from the control room. A procedure calls for opening this valve, and although no procedur speciGcally addresses opening of the valve locally, sufficient time is considered hours) to comply with the intent of the procedure which calls for opening the valve. The ,

two recovery actions (HOVS1 and HOVS2) deal with actions to tenninate an interfacing sy LOCA, both of which must be accomplished within two minutes. HOVS1 deals with the clo of a valve just opened during surveillance testing, when the failure of an additional in isolation valve results in a high/ low pressure leak. Given the location and number ofid indication available to the operators, as well as the immediacy of the leak to the actio performed, it appears reasonable to conclude recovery by closing of the valve w minute time frame. On the other hand, HOVS2 is not directly associated with an activ progress which would be immediately recognized by the operator. Credit wa based upon subjective analysis of performance shaping factors associated with th subjective evaluation indicated there is ample indication available in the control complexity of the task is low. The level of detail of information provided in the sub not sufficient for us to agree or disagree with the licensee's subjective analysis.

2.1.3 WR 1.1.3 Identification and Listing of Most Important Human Actions and Errors. P Routine errors were identified by review of maintenance and test procedures during t development of the system trees for frontline and support systems. Identification o was the responsibility of the system analyst. Errors that have the potential for cont significantly to system unavailability are selected for analysis.

Dynamic operator actions were identified during the development of event trees. Th analysts was assisted in identifying the important actions to be incorporated into the by site operations department personnel assigned to the PRA effort. Worki to ensure the analysts have gained a sufficient understanding of progression of the actions the operators take. Actions were identified by examination of the Emerge Instructions (EOls) and Abnormal Operating Instructions (AOls) in the context of th t 15

[

Actions that are included in the event trees are selected based on the need for success of plant i functions. The operator actions that are incorporated into the event trees include:

- Manual actions required in emergency procedures to bring the plant to a safe shutdown following an initiating event.

r

- Control of preferred cooling systems.

. Backup of automatically actuated and controlled systems.

- Immediate response to failures of active systems.

Scenarios with significant core damage frequency were reviewed by the event analysts working with operations personnel to identify potential recovery actions. " Procedural-guided" and

" nonprocedural-guided" actions are considered. Nonprocedural actions were identified by presenting the scenarios to operators with the analysts indicating when the procedures no longer apply in the scenario. Actions identified by this practice are described in terms of boundary conditions, success criteria, and timing. After review by plant operations staff, the actions are .

incorporated into the model. Recovery actions are listed in Table 3.3.3-7, along with the HERs for the actions.

The methodology described above appears capable of identifying important human actions and errors. Examining the actions in the context of the scenarios is a strength of this approach, since any particular action can have different error rates in different scenarios. A strength of the methodology for identifying important actions is that operations personnel were heavily involved in identifying the dynamic and recovery actions.

2.1.4 Viability of Process to Confirm That the IPE Represents the As-built, As-operated Plant.

The submittal stated the IPE is based on the plant design as of December 1991. The licensee l

cites ongoing programs, including the Design Basis Verification Program and a procedures l

upgrade program, as providing confirmation that the IPE represents the as-built, as-operated 2.1.5 HRA Peer-Review.

The discussion of the review process in Section 5 provides no details of a HRA peer-review. '

Level 1 PRA data and results were reviewed internally and independently. Since the Level 1 review includes the HRA, it is assumed that some review was performed. It is stated the Level I review includes the HRA, it is assumed that some review was performed. It is stated in the licensee response to additional information requested that the Risk Assessment Staff (RAS)  ;

RAS members received training on the Modified Success Likelihood Index Methodology.

participated in the identification of human actions and interviews of operations personnel. ,

1 16

was represented on the final IPE review team and participated in the HRA review cond l the contractors offices.  !

2.2 Most Likely Sequences (Work Requirement 1.2) 2.2.1 Consistency of Human Actions Identified with Other Accepted PSAs.  ;

l Accident sequences selected are generally consistent with the events reported for the Pe l

Bottom risk assessment of NUREG-ll50. A comparison of the routine errors between Browns Ferry and the HRA portion of the Grand Gulf PRA indicate a marked difference in thel considered. This can be attributed to the qualitative screening of actions performed by the BFNP analysts. Error associated with most safety systems, e.g. standby liquid control, high andl pressure coolant injection, core spray, etc., tend to be eliminated on the basis of valvl lineup verification, control room displays, etc. (see Section 2.1.2 of this TER for screenl criteria). The BFNP errors associated with safety systems dealt primarily with instrument test ;

that left the instruments in the test state rather than returning them to operational mode. There were also a few cases analyzed where system valve lineups were not returned to normal followi l

functional or operability testing. i The list of dynamic operator actions analyzed for BFNP, in many respects, is quite similar fl list of post-accident actions listed in the Grand Gulf PRA (Reference 4). The BFNP IPE were more closely related to emergency procedure guidelines developed by the BWR Owners l l

Group than the list of Grand Gulf actions. Operator actions for initiation of safety systems, l injection using feedwater, initiation of suppression pool cooling, etc. were included in Grand Gulf and BFNP analyses. l l

2.2.2 Accident Sequences Screened Out Because of Humsn Error. l The submittal did not specifically list the sequences treened ot:t due to low human error.

Section 3.4.3.2 of the submittal describes the sensitivity analysis performed on the PRA results.

To perform the sensitivity analysis the accident sequences, the HERs were raised to If the HER was 0.1 or greater, the error l and the core damage frequency was recalculated. '

probabilities were not changed. Table 3.4-9 of the submittal is a summary and coml the operator action sensitivity with the IPE results. This table reports the percentage !

six initiating event categories with and without operator action. The event sequences whe operator action was responsi* fer tha greatest reduction in CDF fall into the followingl ,

catego6es:

i j

- Events initiated by flooding in the turbine building

- Events initiated by a loss of off site power f

• Turbine trip 17

. . _ = - - -. _.

- Inadvertent scram at power .

- Inadvenent opening of three or more safety relief valves or medium LOCA For all other events, ther'e is no change in core damage frequency. Reporting of events by -

category, as they are documented in the submittal, cannot be adequately evaluated. ,

The licensee was asked by NRC to provide additional detail on how the BFNP Unit 2 IPE '

screened core damage sequences that include human actions, especially sequences that include more than one human action. The licensee responded that the top 50 sequences indicated that ,

all of the sequences involve at least one action that can be accomplished over a long period of time (more than one hour). Consequently, the dependencies that would normally drive a second j l

action to guaranteed failure, given the first action failed, were screened out based on that these dependencies would be compensated for by the ability of the crew to review the situation and by the arrival of additional personnel who can bring a fresh perspective to the situation. .

Dependencies are discussed further in Section 2.3.3.3 of this TER.

2.3 Quantitative Nature of the IPE (Work Requirement 1.3).

2.3.1 Reasonability of HEP Screening.

No quantitative screening of human errors was performed. Instead, both routine and dynamic actions were subjected to " qualitative analysis." Routine errors, as discussed earlier in this TER '

were identified by the system analysts through review of surveillance procedures. Maintenance procedures were evaluated only if the operability of the system is not verified by a surveillance pwcedure at the conclusion of the maintenance or repair activity. The following criteria were med to determine if an error due to testing did not require quantineation:

- The alignment of the system has not been changed by the test.

- The test brings the system into closer alignment with its active safety function configuration than its standby alignment.

l

- The alignment of the system is a displayed parameter in the control room subject to active l monitoring by the operators.

- Equipment reconfiguration during periods of plant shutdown that are subject to verification of alignment during startup. Verifications contained in change of mode ,

checklists fall into this category. Exceptions to this guideline are made when the human error is judged to be the primary contributor to the top event availability.

i The qualitative screening employed is sufficiently conservative, similar to the screening process ,

found in other PSAs, and appears capable of screening in important pre-initiator errors. l l

I i

18 l s

As discussed earlier, the dynamic operator acticas were selected by a review of EOls and AOls.

No screening was performed on dynamic operator actions, other than the qualitative review of '

procedures. Operator actions identified in the review were verified by plant operations pe Since no quantitative screening was performed. the possibility that important human actions wl l

screened out was reducbd. ,

2.3.2 Development of HEPs for Significant Human Actions.

Table B-2 lists the routine human errors that were included in the system analysis. However, no HERs or screening values are included in this table. Table B-1 lists the error probabilities for the routine human errors. Error rates for the actions listed in Table B-2 are found by using the variable name next to the task of interest, and then finding the corresponding variable name in  ;

Table B-1.

Human Error Rates (HERs) for dynamic human actions are listed in Table 3.3.3-3 cf the submittal. This table indicates where the actions were incorporated into the event trees (event and variable), a brief definition of the action, and time constraints.

Table B-9 provides descriptions of each of the dynamic human actions that were quantified.

Each action is described in terms of the seven performance shaping factors. The descriptions the actions is adequate for understanding each action in the context of the scenarios. The result [

of operator evaluation of the PSFs are presented in Table B-10 through B-14. Error prob calculation data is presented in Table B-15 and B-16. Using the tables, the error rate calculation ,

appear reasonable.

~

2.3.3 Data Sources and Selection of Performance Shaping Factors.

i Routine Actions.

Routine actions were quantified using generic error rates for 2.3.3.1

" misalignment after test" listed in Table B-1 of the submittal. The error rates listed in this ta!

were derived from The Handbook. However, the derivation of these error rates is reported in l

an unpublished letter between PLG, Inc. and TVA. This letter was not part of the IPE su ~

and was not reviewed.

i 2.3.3.2 Dvnamic/ Recovery Actions. Generic error rates were not used for quantification of The SLIM-based methodology develops plant-specific data.

dynamic or recovery actions.

Operators evaluating the actions were asked to rate, on a scale of 0 to 10, the following specific performance shaping factors:

- Task Complexity - Measures the multiple requirements on task success, including  !

coordination, multiple locations, remote operations, variety of tasks, communication )

requirements, and availability of resources.  ;

l 19 i

_ _ _ __ i

Plant hian-hf achine Interface and Indications of Conditions - Measures the imp man-machine interface on the likelihood of success; includes the degree of instrumentation, alarms, and control available.

• Adequacy.of Tinie to Accomplish Action - Measures the time required to a with the time available and the effect on success; reflects the operator's confidenc the task can be accomplished in time to avert a change to a failed state.

- Significant Preceding and Concurrent Actions - Measures the affect prece on creating conditions under which the action will be taken. Such actions can affect of diverting the operator's attention away from the action ofinterest.

Procedural Guidance - Accounts for the extent to which plant procedures enhan operator's ability to perform the action.

• Training and Experience - Measures the effect of the familiarity and confide operators have about their actions.

Stress - Accounts for the impact of adverse environmental conditions and situ may endanger the operator or damage or contaminate either the plant or t Stress can be beneficial when it provides incentives for performance, or act of attention that increases the likelihood of failure.

This list of seven PSFs above is similar to the list of six PSFs in S Treatment of dependencies among multiple human actions in a given 2.3.3.3 Denendencies.

accident sequence (i.e., multiple human action top events inInan event tree) lc general, effect on the overall estimated impact of human performance for that sequence. l success or failure on a preceding action affects the error probability of succei The submittal discussion , supplemented by subsequent interaction betweel subsequent action.

NRC staff and the licensee, indicated that the implementation of the SLIM p expert evaluators with scenario-specific informatio The licensee also noted that in the large-event-tree small-fault-tree included in event trees.

methodology employed for the BFNP IPE, the human actions of most im overall quantitative impact on plant risk) are typically addressed as h the top tree. The impact of dependencies among those top event actions, which w licensee, is likely to be significantly more important than the dependencies actions in the fault trees. The licensee's treatment of dependencies for po  ;

appears to be reasonable.

i l

l 1

20 l

J

2.3.4 Recovery Actions.

Two types of te.coveries were discussed in the submittal: recovery of routine errors and accident recovery actions. For routine actions, an error in system alignment can be detected Imr during rounds inspections. The reduction in system unavailability is calculated on the probtaility that a fraction of the' misalignment errors well be discovered and corrected.

For accident recovery, the recovery actions can be either procedural-guided or nonp.ocedural-guided. For nonprocedural errors that conform to the established operating philosophy of the plant were included in the analysis. The list of recovery actions of Table B-17 appears appropriate. Descriptions of the recovery actions, in terms of the seven PSFs, are presented in Table B-18. The methodology for identifying recovery actions appears adequate, and the list of actions appears reasonable. However, several error probability estimates for the recovery actions appear optimistic. Two of the actions in particular, HOVS1 (HER=0.0016) and HOVS2 (HER=0.00423), appear to have low values for nonprocedural actions, especially since these actions must be performed within two minutes. Comparison of the HERs with estimates from other PRAs and nominal error rates from tables in the Handbook show that estimated error probabilities for non-procedural recovery actions typically are one or two orders of magnitude greater than these values.

2.4 The IPE Approach to Reducing Probability of Core Damage or Fission Product Release (Work Requirement 1.4).

2.4.1. Vulnerabilities.

The submittal states that a vulnerability "may" exist if the mean core damage frequency exceeds 5E-04 per reactor-year or if the mean large, early release freque..cy exceeds 5E-04 per reactor year. Section 3.4.3 discusses how events are screened to determine if a vulnerability exist.

Operator action importance was included in the screening process. Eleven operator actions were listed as having significent impact on core damage frequency. The submittal states that no vulnerabilities exist.

2.4.2 Human-related Plant Improvements and/or Modifications.

The submittal states that, since there were no vulnerabilities identified, no plant improvements or enhancements were required. However, in Section 6.3, which discusses enhancements, one

" operational feature" was identified concerning the operator inhibit of Automatic Depressurization System (ADS). Operators routinely inhibit ADS on low level only to allow for recovery of high pressure injection. However, the submittal is unclear on whether this action is a candidate for procedure enhancement, a desirable feature, or an existing feature. In response to a request for clarification, the licensee stated that the ADS inhibit is an existing feature directed by Emergency Operating Instructions, and the discussion in Section 6.3 of the submittal will be clarified in the next update of the BFNP PRA.

21

l l

/

3.0 OVERALL EVALUATION AND CONCLUSIONS  !

i The HRA portion of the Browns Ferry IPE demonstrates a reasonable process for meeting the l intent of Generic Letter 88-20. The submittal is essentially complete and for the most part

)

presents documentation at the appropriate level of detail. I Quantification of human errors was performed on pre-initiator (routine) human actions, post-initiator (dynamic) human actions, and recovery actions. Routine actions were quantified u' a method developed based on the Handbook. Dynamic actions and recovery actions were boj quantified using an adaptation of SLIM. The methodology is well documented, excep use of a proprietary database used in the calibration process. The process for identifica .

important human actions is adequate, and ensures that most important human action in the analysis.

Assurance that the IPE represents the as-built, as-operated plant was provided by ongoing l programs at BNFP, such as the Design Basis Verification Program and a procedur program. Additional review of documentation for the IPE provided further assurance. ,

The submittal did not specifically list sequences screened out due to low human error estimates. '

However, a sensitivity study was performed in which all HEPs were raised to at least 0.1. Eve sequences in which operator action had significant impact on CDF were discussed.

No operator actions were eliminated by numerical screening. All post-initiator action in the qualitative analysis process were quantified. Pre-initiator actions were subjecte qualitative screening.

l rre-initiator actions were quantified using generic error probabilities derived by the HRA r contractor based on methodology from the Handbook. Performance shaping factors The SLIM methodology wer extensively in the quantification of dynamic and recovery actions.

employed for dynamic actions used three groups of operators to rate the complexity!

actions by scoring seven PSFs. The set of PSFs used for this purpose was similar to found in references on the SLIM methodology.

The IPE defined vulnerability in terms of core damage frequency and early release frequenc ,

from the containment. Using the definition in the submittal, no vulnerabilities nor enhancem were identified. One item, operators inhibiting Automatic Depressurization for non-ATWS  ;

scenarios, was identified in the IPE as a beneficial operational feature.  !

I i

P i

h 22 i

4.0 IPE EVALUATION AND DATA SUM 31ARY SHEETS

. IPE DATA

SUMMARY

SHEETS

~

(HUMAN RELIABILITY)

Plant Name: Browns Ferry Unit 2 Information Assembly

- List of plants, PSAs or other analyses known to have employed similar HRA methodology.

The submittal discusses the use of Peach Bottom data from NUREG-4450, Volume 4 for comparable data on events and event frequency.

Other PSAs listed in the submittal include Seabrook, Diablo Canyon, South Texas, Beaver Valley, and Hatch.

- Ex-control room actions treated? List.

No specific mention of ex-control room actions could be found in the submittal.

Human Failure Data (Generic and Plant Specific)

- Analytic method used, e.g., Expert Judgement, THERP, SLIM-MAUD, HCR, TRC A modification of the SLIM methodology was used. Three groups of operators were used to rate seven Performance Shaping Factors (PSFs) for each event.

- Were the following human errors considered:

(1) Pre-initiator, e.g., maintenance error including testing, equipment calibration, a restoration?

errors were identified, screened, and quantified for Pre-initiator human ,

incorporation into the system fault trees. These are referred to as routine errors in the submittal. I (2) Post initiator procedural?

i Post initiator procedural actions were identified using emergency operating instructions and abnormal operating instructions. The actions were incorporated into the event trees. These were referred to as dynamic human actions in the submittal.

23

.. . -_ = .=. . . . _ . .

t (3) Post-initiator recovery? -

Post-initiator recovery actions were identified by the event analysts working with operations personnel. Both procedural and nonprocedural recovery actions were incorporated into the event trees.

t

- Control Room The list of recovery actions of Table 3.3.3-7 of the submittal includes control room actions.

- Ex-Control The list of recovery actions of Table 3.3.3-7 of the submittal includes ex-control room actions.

- Types of human errors considered, e.g. omission, commission.

Routine (pre-initiator), dynamic, and recovery actions analyzed were all errors of omission. No errors of commission were analyzed.

i

- Source of human reliability data, i Generic Data?

Routine actions were quantified using a method developed by Swain and Guttman in  :

The Handbook. .

Simulator Data?

Simulator data was not used. .

Expert Judgement?

The SLIM method is based on expert judgement. Three groups of operators' were used to rate a set of seven performance shaping factors for each event.

1

- Most significant operator actions.

The most significant operator actions were identified as those in events initiated by l turbine building flooding. The critical actions included: ,

9 24 i

- Alignment of suppression pool cooling

- Alignment of shutdown cooling

- Control of reactor water level using HPCI/RCIC a Human error contribution to core damage frequency (if known).

Table 3.4-6 of the submittal lists eleven operator actions that are important for core damage frequency. This table also gives the Operator Action Failure Rate Mean Values for these eleven actions, and the importance to CDF

- Vulnerabilities associated with human error.

The licensee's definition of vulnerability states "A vulnerability may exist if the mean core damage frequency exceeds 5E-04 per reactor year or if the mean large, early release frequency exceeds SE-05 per reactor-year." Using this definition, no plant vulnerabilities were identified.

PLANT IMPROVEMENTS AND UNIQUE SAFETY FEATURES a improvement insights stemming from HRA.

Since no vulnerabilities were identified, no improvement insights were gained from the HRA portion of the IPE.

a implemented human factor improvements or enhancements stemming from HRA.

No human factor improvements or enhancements wew implemented.

- Human factors improvements or enhancements ur. der consideration.

No human factors improvements or enhancements are under consideration.

25

References i l

1. Embref7 D.E., et al., "SLlhi-MAUD: An Approach to Assessing Human Error l Probabilities Using Structured Expert Judgement," NUREG/CR-3518, N1 arch 1984. l

2. U.S. Nublear Regulatog Commission, " Individual Plant Examination: Submittal l Guidance." NUREG-1335, Agust 1989.

3.

Swain and Guttman," Handbook of Human Reliability Analysis with Emphads on Nucli Power Plant Applications," NUREG/CR-1278, August 1983.

i 4.

USNRC, " Analysis of Core Damage Frenuencies from Internal Events: Grand Gulf NUREG/CR-4550Nol. 6, Rev.1. l t

i f

[

a k

?

i 3

l-26 r

i

w. - - _. - - - - - - - - - - - - - - w m -

, -- - - . - - , . , , - , - ,. -