ML20097F183

Draft App E, Quantification of Operator Actions by Stahr Methodology, to Pressurized Thermal Shock Evaluation of Calvert Cliffs Unit 1 Nuclear Power Plant

ML20097F183
Person / Time
Site:	Calvert Cliffs
Issue date:	08/24/1984
From:	Embrey D, Humphreys P, Phillips L OAK RIDGE NATIONAL LABORATORY
To:
Shared Package
ML20097F171	List: ML20097F174 ML20097F177 ML20097F183
References
REF-GTECI-A-49, REF-GTECI-RV, TASK-A-49, TASK-OR NUDOCS 8409180415
Download: ML20097F183 (23)

Text

o .a Appendiz E: Quantification of Operator Actions by STARE Nethodology of A PRESSURIZED HERNAL SHOCK EVALUATION OF THE CALVERT CLIFFS UNIT 1 NUCLEAR POWER PLANT written by Lawrence D. Phillips and Patrick Humphreys Decision Analysis Unit London School of Economics and Political Science and David Embrey Human Reliability Associates Lancashire, England and D. L. Selby of The PTS Study Group

. Oak Ridge National Laboratory Date of Draft: August 24, 1984 NOTICE: This document contains information of a preliminary nature. It is subject to revision or correction and therefore de,es not represent a final report.

• Research sponsored by U.S. Nuclear Regulatory Commission under Contract No. DE-AC05-840R21400 with the Martin Marietta Energy Systems, Inc.

with U.S. Department of Energy.

8409100415 840904 -

PDR ADOCK 05000317 P PDR

.. .- 4 g~ ~f

/

A PRESSURIZED 'mRItMAL SHOCK EVALUATION OF THE CALVERT CLIFFS UNIT 1 NUCLEAR POWER PLANT ,

/- '

v s List of Chapters I

Chapter 1 Introdnotion Chapter 2 Description of the Calvert Cliffs Unit 1 Plant Chapter 3 Development of Overcooling Sequences for Calvert Cliffs Unit 1 Nuclear Power Plant Chapter 4 Thermal-Hydraalle Analysis of Potential Overcooling Transients 4

Occurring at Calvert Cliffs Unit 1 Nuclear Power Plant Chapter 5 Probabilistic Fracture-Mechanics Analysis of_Calvert Cliffs Unit 1 Sequences Chapter 6 PTS Integrated Risk for Calvert Cliffs Unit 1 and Potential

., Mitigation Measures Chapter 7 Sensitivity and Uncertainty Analyses of Through-the-Tall i

Crack Frequencies for Calvert Cliffs Unit 1 Chapter 8 Summary and Conclusions -

4 5

l t

1 p

l l

{

l

e - _

E.0. WANTIFICATION OF OPERATOR ACTIONS BY STAHR METHODOLOGY .

E.1. Introdnotion E.2. Practice Session with STAHR Methodology l[J E.3. , Application of STAHR Methodology to Target Events of Table E.1 E.3.1. Operator Controls Repressurization (Operator Actions la-le)

E.3.2 Operator Controls Anzi11ary Feedwater to Maintain Steam Generator Level (Operator Actions 2a-2d)

E.3.3. Operator Isolates PORY that Failed to Close (Operator Actions 3a and 3b)

E.3.4. Operator Isolates Stuok-Open ADY Within 30 Minutes (Operator Action 4)

E.3.5. Operator Stops Forced Main Feed after MFIVs Fall to Close on SGIS Following a Steam-line Break (Operator Action 5)

E.4. Application of STAHR Methodology to a Small-Break LOCA Event l Followed by Loop Flow Stagnation E.5. Application of STAHR Methodology to a Remotor Trip Following

' Loss of Pany Coolant Water Supply E.6. Summary Statement 1

l

- - , . - - . - - - , ,w-- ,,w-- - , - - - - , - - , - , - - , - , - - ., ,.---o--,-~~w - - , - - , , - , - -, . - - + y - , .._n--w m- -. - - , , - - - n- -w-------

t LIST OF TABLES Bof -

1 1

E.1. Initial list of target events (operator actions) to be quantified E.2. Definitions of lowest-level influences in infinance diagram o

e t

e

%e e

5 r

I i ,

l iCC-E.1 i

l APPENDIX E - QUANTIFICATION OF OPERATOR ACTIONS BY STAER NE1BODOLOGY O E.1. Introduction Soon af ter its development, the STAER methodology (a socio-technical approach to assessing human reliability) described in Appendix D v is used to quantify the frequencies of error assoaisted with a set of predetermined operator actions at the Calvert Cliffs Unit i nuclear power plant. A four-day meeting was held at Combustion Engineering

• specifloally for this par-l/[

pose,.and although the composition of the group attending the meeting varied somewhat over the four days, the following roles were represented:

group consultant and facilitator, technical moderator, trainer of reactor operators, thermo-hydraulic engineer and procedures specialist, pressured thermal shock engineer, probabilistic risk analyst, reliability and systems q f//

~

analyst, human reliability spooialist, and reactor operator.i The two /

I reactor operators present were expecting confirmation of their licensing as senior steactor operators.

At the first session of the meeting, a brief description of the role of human judgment in risk assessments was given, with particular emphasis on the view of probability ss an expression of a degree of belief. The condi-tions under which good calibration of probability assessments could be expected were also described. The group was then charged with the respon-sibility of applying the STAHR methodology to the preselected target events (operator actions) during the remainder of the meeting. In preparation for this task, the group toured the Combustion Engineering simulator and

• .u..T.~u .i c .u .i;.. .... .., .. c ..u.... =,, nn .

'fr.4,"*,*:f"*.!?!!!3.!!!:if a; 2:Ji*" I':::!!"!,':!.'"d'"

.. , . ,u.a r.a unnu..u.u n us.... ,,....a.. a......n-

- , , - , . _ . . - . _ + . . _ _ _ _ - . - .

l I

l CC-E.2 engaged in a practice session for one of the target events (which was later DAq reevaluated). This appendiz summarizes the deliberations of the group both  ;

-in the practice session and in subsequent sessions in which the STAER methodology was applied to target events.

4 E.2. Practice Session xith H A R Ms.thodolony 1

/ #

,i.

At the practice session. the group was presented with the list of target '; '

j events to be considered (see Table E.1). It was recognized that in general

all these target events involved determining whether or not an operator would successfully perform some mitigating action. After some discussion.

the group selected operator action 4 from the table as the target event for O the practice session and defined the following initial conditions

• as the "Y

[

" conditioning events":

1 (1) The target event occurred near the end of the core refueling j cycle.

(2) The reactor was at hot 0% power (532'F) (hot standby).

l (3) The atmospheric dump valve (ADV) was open.

i (4) ne main feedwater system was in bypass mode.

i ne target event as defined by the group was as follows:

l l

L g g.. ... ...... a .. ...,. . a : i. ...... s. .,

4

! CC-E.3 l

Table E.1. Initial list of target events (operator actions) to be quantified

- 1. Operator controls repressurization following

a. A LOCA event which is isolated.

b. A large steam-line break from full power.

o. A large steam-line break from hot 0% power.

I

d. A smell steam-line break from fall power.

e. A small steam-line break from hot 0% power.

2 Operator controls auxiliary feedwater to maintain steam generator level following I.

a. A large steam-line break from in11 power.

b. A large steam-line break f rom hot 0% power.-

a. ' A small steam-line break from fall power.

d. A small steam-11ae break from hot 0% power.

3. Operator isolates PORY that has failed to close owing to

a. PORY failure being the initiating event.

i- b. PORY fallare occurring during repressurization following

a separate event.

4. Operator isolates ADV 2fter it has failed to close. ,,

i j 5. Operator stops forced main feed after MFIVs fail to close on SGIS following a steam-line break f

l l

I I

l l

t CC-E.4 4 ._

Operator will recognize that ADY is open and will isolate ~- (,11  !

ADV line within 30 minutes.

To ensure that all members of the group were reasonably familiar with the technical operation of the system, engineers familiar with Calvert Cliffs Unit 1 described the main steam header and also the main feed valve and bypass valve of the main feedwater system. The group was then introduced 4

to influence diagrams and their relationship to event trees. The influence >

diagram described from Appendix D was presented, together with definitions I

of the bottom-level influent:ss. Considerable discussion of the influences j ,]

followed, with the result that the definitions of the influences were

'(-

, J-

~

slightly changed and extended. Table E.2 gives the final definitions as ,]-

they were used throughout the remainder of the week.

i Nost of the practice session was spent in discussions that helped to son-erste the assessments required for the target event. 'It was apparent that the group did not find it particularly easy to make these assessments, and considerable disagreement about the appropriate numbers emerged from the discussions. Eventually, however, consensus judgments emerged, and the l unconditional probability of the operator successfully completing the tar-get action was determined to be 0.937. However, because this was the first l

effort of the group, this figure was not taken very seriously.

l E.3. Annlication d ITAE Methodoloav Ag Iggg31 Eg331g g Igh13,31, l

During the next several sessions, the group applied the STAER methodology to all the target events listed in Table E.1. The approaches used and the

_ _ . _ . _ . _ . . _ . _ _ . _ . _ _ _ _ _ _l

.~ .,

~

,.CC-E.5 Table E.2. Definitions of lowest-level infinences in influence diagram

1. Desian d Contrc1 Bagg

. 22nd Zn92

a. Disolavn Easy to read and understand Hard to read, difficult to and accessible. Interpret, inaccessible.

Make sense, easy to relate Confusing, not directly related to controls. to controls.

Alarms discriminable, Alarms confusing, irrelevant, relevant, coded. not coded.

Nimic display. Non-representational display.

, Displays regarding event Displays regarding event are are present, clear, not present, are unclear or unambignons, ambiguous.

b. Onerator involvement Operators have say in Operators have little modifications. or no say.

Prompt confirmation of action. No confirming information. ,

c. Automation g routine functions Highly automated. Low level of automation.

Operators act as systems Operators perform many routine managers. functions. ,

2. Meaninafulness d Procedures Meaninaful H2.1 meaninaful j a. Realian

Realistics the way things Unrealistics not the way things are done. are done. -

i b. Location Aida I Location sids provided. Few or no location aids provided.

1 j c. Serutability i

Procedures keep operators Procedures do not keep operators in touch with plant. in touch with plant.

d. Onerator involvement Operators involved in Operators not involved in developing procedures. developing procedures.

f e. Dinanostics Allow unambignons determina- Allow inappropriate diagnosis.

tion of event in progress.

l

l a

g

CC-E.6

.n

f. Ensmai ud,1

~

1 Procedures clear, consistent, Procedures confusing,  !

and in easily read format. difficult to read. J

3. Rela si Onorations Denartment Primary Hat nrimarv

s. Accountability All other fanations report Only operations staff report to operations supervisor. to operations sapervisor.

.b. Relationshin 13 maintenance And 4 saham fanations Good relations. Antagonism.

, c. Panerwork About right. Emoessive.

d. Onerator involvement Operators have a say in Operators have no say how the place is run. In how place is run.

4. Effectiveness 31 Igang i

Present Ahasn1

a. Shifta

, Allow teams to stay together. Prohibit team formation.

b. Balan -

Well-definsd accountabilities. Poorly defined accountabilities.  ;

j o. Trainina Teams train together. Team members not trained together.

t

5. Lazg1 si Stress Esinful LAIg1 321 heinini

a. phifts i No jet lag. . Permanent jet lag.

( b. Ilma available Adequate Too little.

c. Onoratina oblectives

( No conflict. Conflict.

l

d. Transient related stress Little or none. Overstressed.

. . - . - - - . , _ . - - - . - - , ~ . - - . . - - . - . - -

i+16 -. ( g t-CC-E.7 .

~

.5 sl

6. Laksi g Morale /Notivation 8[

g.

a. Status d onerators Treated as professionals. Treated as laborers.

b. Career structure Operators can find best Peter Principle operates.

N- level in organization.

c.gPhvalcal/EdR1A12311 beina Oierators physically and Job performance adversely affected aantally capable of performing by physical and/or mental

, Job. ,

impairment.

7. Connetence g Goerators

• Elah Las

a. Trainina Operators generally well Operators poorly trained in f ' trained in emergency emergency procedures.

procedures.

, b. Certification,-

Peer review is used. No peer review is used.

c. Performance feedback Operators given periodic Operators given no feedback feedback on performance. on performance.

d. Exnerinnes Operators experienced in Operators not experienced in dealing with target event. dealing with target event.

1 l

I.

i 1

l 1

m.--, - . - , - . ,,~~-,e-------,,,----ww,---,. ,-,w..,------,e, - ---.,---,c,..e.,-,- ,---w,,-.. v,,-.-...,,w>, ew.,,,,, - , , -- - - - --- - - - , -

.. e

) ,

resniting naconditional probabilities (frequencies) of operator successes are susanarized below.

E.3.1. . Operator Controls Repressurizatica Following the practice session, the first operator action from Table E.1 to be addressed was Ib, for which the following initial conditions were set:

(a) .The steam-line break consisted of a 1-ft2 3,g,,

(b) The reactor was at in11 power.

(c) The break was outside the containment vessel.

A definition of the target event was at first rather elusive. Starting with the operator recognizing that a steam-line break had occurred, the group considered several intermediate actions before arriving at the fol-lowings Operator throttles charging panps after primary pressure j reaches high pressure safety injection (HPSI) head.

2 (Corresponds to Step 8 of Calvert Cliffs energency opera-tions procedures for a staan-line break.)

i This was considered the event which wonid determine whether or not the operator wonid successimily control the repressurization. In arriving at l

__ . . _ . .__ _ _ _ _ . . , . . . . _ _ _ _ _ . . . _ _ _ _ . . _ _ . _ _ . _ _ _ _ _ _ _ _ _ _ . . ~ _ . - . . . - _ _ - . . _ _ _ _ , _ _ . , _ _ . _ . , . _ . _ , _ _ . . - _

their prediction, the group followed the 10 steps outlined in Section D.4 of Appendix d. As noted.there, the final step lavolves sensitivity ana-

-lyses to determine ranges of disagreement, if any exist.

Discussion of the input assessments took about four hours, with consider-able disagreement expressed for ovar one-half of the assessments. Finally, a set of assessments was agreed upon as 'a base case, and this yielded a probability of success for the target event of 0.974. Then the contentions 1

. assessments were replaced by the most pessimistic values, the target suc-cess probability dropped to 0.867. When they were replaced by the most optimistic assessments, the success probability rose to 0.992. These two values were taken as the minus (-) and plus (+) uncertainty valt9s, respec-1' tively; however, in fairness, it should be said that during theise sensi-tivity analyses no individual in the group believed all of the pessimistic or all of the optimistic assessments. Thus, the agreed-upos range of suo- l cess probability from 0.867 to 0.992 considerably exceeds the range that would have been obtained if each individual's assessments had been tried in the influence diagram. 14oked at differently, the range of the failure rate, 0.008 to 0.133, is little more than 15 to 1, which is considerably less than the factors of 100 or even 1000 that occasionally characterize

)

the uncertainty in failure rates obtained by other methods. '

The 0.026 failure frequency (1 - 0.974) was attributed both to personal factors and to the quality of informatioa available to the operator (con-trol room design and procedures). The quality of information wks con-sidered to be the factor which could be improved most easily. Specifi-cally, the importance of this operator action could be better defined in l

l

the procedures and a P/T CRT plot with the acceptable ranges of operation marked would greatly improve the quality of information.

Additional sensitivity analyses were performed to see what the effect would be of improving the Calvert Cliffs design and procedures. This can be simulated in the influence diagram (see Appendiz D) by moving the weights of evidence to 100 on both these influences. When that is done, the proba-bility of success rises to 0.986 A minimally licensemble plant was also simulated by assigning 0 to both design and procedures, with the resulting probability of success dropping to 0.880.

If all the bottom-level influences are scored at 0, then the probability of success is 0.546. This suggests that the operator in a plant with rather inadequate procedures and design still has better than a 50% change of per-forming this particular target event successfully. Similarly, in the maxi-q mally feasible plant that would be characterized by a score of 100 on all ,/

the bottom-level influences, the probability of success moves to 0.992.* f,/

With the completion of the evaluation of operator action 1b, perturbations covering operator actions ic, Id, and le were considered. Again, the operator was to control repressurization following steam-line breaks as described in Table E.1. Although many of the influence weighting fac* ors changed from those used for operator action Ib, the changes were conflict-I ing with respect to the final success and failure frequencies. Thus the 0.974 frequency of success and the 0.026 frequency of failure obtained for o'perator action Ib were assumed to also apply to operator actions ic-le.

l 1

-. ... .. .. o .. . .. . - . .. ., , .s ..,, .....

j

e .

CC-E.11 1[

Operator action la differed from operator actions 1b-le in that it was to be performed following a LOCA rather than a steam-line break. In this case, the success and f ailure frequencies were evaluated to be 0.968 and 0.032, respectively. The increased failure rate was due almost exclusively i

to the perception that the information in the LOCA procedures associated with performing this action was less informative than that found in the procedures for steam-line breaks.

E.3.2. Operator Controls Anziliary Feedwater to Maintain Steam Generator  ;

Level (Operator Actions 2a-2d)

Operator actions 2a, 2b, 2c, and 2d required that the operator control aux-111ary feedwater (AFW) to maintain the steam ganerator level following steam-line breaks. These operator actior.2 were considered to be very sini-lar to operator actions Ib, Ic, id, and le, respectively. Both sets of actions are performed during the same basic time frene and both involve the monitoring of a parameter to ensure that an operational limit is not exceeded. Thus, the failure frequency of 0.026 determined for operator actions 1b-Id was assumed to also be valid for operator actions 2a-2d.

However, since the sets of actions were considered to be very similar, it would appear that there is a high coupling between the two actions. That is, success of operator action Ib would imply an increased potential for the success of operator action 2a, while a failure of operator action ib l

i wonid imply an increased potential for the failure of operator action 2a.

l The dependence equations developed in NUREG/CR-1278 (Ref.1) were used to quantify this coupling. With the high dependency equation, the frequency of failure to control AFW to maintain steam generator level is decreased to l

l

CC-E.12 0.013 when repressurization is controlled and to 0.50 when repressurization is not controlled. Thus three separate frequencies were defined dependent upon the following' conditions:

L (1) Repressurization does not occur - frequency of failure to control AFW = 0.026.

(2) Repressurization occurs and is controlled by the operator - fre- -

quency of failure to control AFW = 0.013.

(3) Repressurization occurs and is not controlled by the operator -

frequency of failure to control APW = 0.50.

E.3.3. Operator Isolates PORY that Failed to Close (Operator Actions 3a and Sb)

Operator actions 3a and 3b called for the isolation of a power-operated relief valve (POKV) following its failure to close. For this assessment, PORY or esings were placed into two categories: (1) those which result from an inadvertent transfer to the open condition or from an initial high pres-sure transient and (2) taose which result from a failure to control repres-surization during pressure recovery following a separate initiating event.

For the first category, the POKV failure to close was treated as the over-cooling initiating event, and the probability of isolation was evainated.

l The influence diagram evaluation produced success and failure frequencies l

l r.

l l

s a CC-E.13 of 0.999 and 0.001, respectively, for isolation within 5 minutes. These f, values were eventually changed

• to 0.99 and 0.01 for isolation within 15 I/

minutes after a review of the evaluation of this operator action revealed that the primary reason for a low failure rate was the operator familiarity of the event as a result of the TMI-2 accident. Every operator has under-gone simulation of this event and has been constantly reminded of its symp-taas. Thus the high success rate of 0.999 was determined as a result of personal factors (experience and training) dominating over all other fac-tors. In retrospect, we feel that for the present operational time frams, the value of 0.999 success may not be unreasonable. However, since the evaluation was to be performed for up to a 32 effective full power year life of the plant, there is potential time to lose this high familiarity associated with the PORY failure, not just by individual operators but within the training program itself. - This is not necessarily bad. It sin-ply seens that the relative training associated with a PORY. failure will evoutuallystabilizeatalevelcorrespondingtothep$rceivedimportance

of the event with respect to other potential events. As a result of this perceived phenomenon, the success and failure frequencies were changed to 0.99 and 0.01 respectively. For similar reasons the time frame for response also was changed from 5 minutes to 15 minutes.

For the second category of PORY failure to close, the sequence involved with the initial event must be examined to identify influences which might affect the probability of isolating the PORV. The one important factor identified was that the operator has already failed to control the repres-surization. Thus, with respect to operator performance, an abnormal state of operation has already been achieved. This implies that the probability

• n. .. in. a r .a .. . 4. i is. ., a s a . .

1 I

CC-E.14 )

~

I, j of isolating the PORY in this second category may be somewhat lower than that calculated for the first category.

The difference was estimated by evaluating the coupling between the two I

)

operator actions: (1) isolate PORY, and (2) control repressurization.  !

l From tb.is evaluation it was determined that the coupling should not be con-sidered to be high since the PORY failure will reverse the trend of the recovery. That is, both temperature and pressure will start to decrease again, which, along with the display cues associated with the FORV opening l

and subsequent failure, should attract the attention of the operator to the PORV. Thus, a low coupling factor was assumed, and the category 1 frequen-cies of operator success and failure in isolating the PORY (0.99 and 0.01, respectively) were reduced to 0.94 and 0.06, respectively; for category 2 events, c

In summary, two conditional sets of success and failure probabilities were estimated for the operator action of isolating failed-open PORY. These two sets are defined as follows:

(1) Use 0.99 and 0.01 as the success and failure probabilities when the PORY failure is the overcooling initiating event.

(2) Use 0.94 and 0.06 as the success and failure probabilities when l the PORY fallnre ocents as a result of a failure to control repressurization following a separate initiating event.

l l

v CC-E.15

/+a f 4 y

E.3.4. Operator Isolates Stock-Open ADV Within 30 Minutes (Operator Action 4)

Operator action 4 was the action evaluated during the practice session described in Section E.2 above. Because some of the panel members were still confused about the evaluation process during the practice session,-

this action was re-evaluated later in the week. The resniting probabili-ties for success and failure for this event were estimated to be 0.964 and 0.036, respectively, the failures being at+-ibuted almost entirely to per-sonal factors.

It should be noted that in the actual PTS risk analysis for Calvert Cliffs Unit i no credit was taken for the isolation of the ADY. It was clear from the thermohydraulic analysis that at 30 minutes isolation of a failed open ADV would have an impact- only if flow was maintained to the steam genera-tor. Since no dominant risk sequences were identified for this categorT, the isolation of the ADY was in general determined to be insignificant.

E.3.5. Operator Stops Forced Main Feed after MFIVs Fall to Close on SGIS Following a Steam-line Break (Operator Action 5) 1 Operator sction 5 calls for the operator to stop forced main feed given that the main feed isolation valves (MFIVs) fail to close on steam genera-tor isolation signal (SGIS) following a steam-line break. An evaluation of l

l~

l this action yielded success and failure probabilities of 0.973 and 0.026, respectively. The failurec were attributed to minar deficiencies in the l

i l

. CC-E.16 '

i ~n) 1 quality of laformation and personal factors. However, as in the case of ADY isolation, credit was not taken for this operator action. At hot 0%

power the main feed flow is very small (11%) and at full power the risk associated with continued flow to the steam-line break'was considered to be very small relative to other events even without operator stoppage of flow.

-Thus, the analysis was simplified by not taking credit for this operator ,

action.

E.4. Annlication 31 H&B Methodoloav la A Sas11-RE1Ak LEEA EISA1 Followed hI LRAR E123 Stannation One of the potential PTS sequences is a small-break LOC. event wish a loss -

of natural circulation af ter the reactor coolant pumps have been tripped.

This low flow condition could lead to rapid cooling of the downconer region

and thus is of some concern. A discussion was held, therefore, to identify potential operator actions which could introduce flow into the loops given i

that the operator recognizes a violation of the PTS relationship. It was determined that the most likely recovery action would be to further reduce pressure by opening a PORY. Thus the potential for performing this action was evaluated.

Since the panel members were not prepared to discuss this action on the level of . detail necessary to perform an influence diagram evaluation, a  !

complete analysis was not performed. Instead, each participant was asked l l

i to estimate a final success frequency for the action, keeping the lower 1evel influences in mind but not actually evaluating them. The success frequencies estimated were very low. Frequencies of success estimated by l

l W - -w -' -. e ,-

• wed _ w e--- pw- ---y

, a CC-E.17 p/

7 g[ . . -

seven participants were 0.01, 0.03, 0.05, 0.05, 0.20, 0.70, and 0.75, the last two estimates being made by the operators. The greap as a whole felt that the operators might have a better feel for this action, but there was enough skepticism to keep anyone from changing his estimate. Thus, a value of 0.05 was agreed to by the majority of the group. This low value was based primarily on the group's opinion that a complex assimilation of data might be necessary to really identify a need foa actions and even upon identification of a necd, there might be some reluctance to open a PORY with a small-break LOCA event already in progress.

Even though this frequency of success was obtained from a less rigorous approach than that used for other operator actions, the value was used as a gauge of the likelihood of recovery. Therefore, since the recovery esti-mate was very low, no credit for recovery was included in the analysis.

E.5. Ann 11eation d STAHR Methodolony ig a Reactor T$lg Followine Lgga g h Coolant h Sunniv Subsequent to the meeting of the group, several additional operator actions have been identified which might be of interest. These actions were Isi-tially evaluated on the basis of their impact on consequence rather than on j f re quency. With one exception, these operator actions were determined to l

j have little if any effect on the final consequences and thus were ignored.

i The exception was the operator action which involves tripping the reactor coolant pumps when pump coolant water supply is lost. As stated earlier, failure to trip the pumps when circulating pump coolant water is lost has been assumed to lead to a pump seal failure, i.e., a small-break LOCA. The

-. n , , . ~ . . , , , , _- . , ,. . , _ , , ,- . . . , . . , . . . . , , ,

<e . .

CC-E.18 ,'!f

+

' problem of assigning a frequency of success to this operator action is that 4

- the time' available to trip the pumps before seal failure occurs cannot be well defined. A 15-minute time frame was chosen for analysis purposes.

Various time ro11 ability correlations were examined and a failure frequency of 5 x 10-2 was chosen. This probability represents the least defendable frequency associated with an operator action that has developed in this study. However, a review of the final PTS risk integration (Chapter 6) showed that with a value of 5 x 10-2 the risk contribution of this sequence was small. In fact, it would appear that the frequency of failure to trip the pumps would havc to approach 0.5 in order for this sequence to have a measurable contribution to the risk, and this value would definitely appear to be too high.

E.6. Summary Statement This appendix has described how one relatively small group in a very lim-ited time span was able to learn the principals of the STAHR methodology and to apply it to specified target events. The concensus of the group was that the failure probabilities calculated were reasonable even though they were higher than would have been originally perceived.

1 4

.- p. 4 lCC-8,19 k/f((

manmets 1* MREG/CR-1278, N

e t

. - . -- __ -