ML20112J239

Final ASP Analysis - Indian Point 2 (LER 247-00-001-01)

ML20112J239
Person / Time
Site:	Indian Point
Issue date:	05/12/2020
From:	Christopher Hunter NRC/RES/DRA/PRB
To:
Hunter C (301) 415-1394
References
LER 247-00-001-01
Download: ML20112J239 (14)

Text

)LQDO Precursor Analysis Accident Sequence Precursor Program --- Office of Nuclear Regulatory Research Indian Point, Unit 2 Manual reactor trip following steam generator tube failure Event Date: 02/15/200 LER: 247/00-001 CCDP = 5 x10-4 April 30, 2004 Event Summary In early February 2000, primary-to-secondary tube leakage - ranging from one to four gallons per day (gpd) - was detected in steam generator (SG) No. 24. On February 15, 2000, while the unit was operating at 99% power, SG leakage rapidly increased from 4 gpd to greater than 75 gallons per minute (gpm). The reactor was manually tripped 13 minutes later, and the faulted steam generator was isolated one hour after the reactor trip. In addition to shutting down the reactor and isolating the affected steam generator, the plant operators also took appropriate action to cool down and depressurize the reactor coolant system to prevent leakage into the faulted steam generator. The highest leak rate which was observed during the event (about 146 gpm) occurred prior to the reactor trip.

Safety injection was manually initiated 1.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> after the trip in response to an excessive cooldown rate that caused a rapid reduction in the pressurizer level. Safety injection was reset and the reactor pressure was reduced to below main steam line safety valve setpoints within 30 minutes following safety injection initiation.

Plant cooldown was recommenced about four hours after the reactor trip by using the intact steam generators and the main condenser. The residual heat removal (RHR) system was placed in-service and the primary-to-secondary tube leakage was terminated about 17 and 19 hours2.199074e-4 days <br />0.00528 hours <br />3.141534e-5 weeks <br />7.2295e-6 months <br />, respectively, following the reactor trip. The plant cooldown continued and the plant entered cold shutdown 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> following the tube failure. (Refs. 1 and 2)

Complications. A number of problems involving equipment and operator actions complicated the event response and delayed achieving the cold shutdown condition (Ref. 2).

" Rapid initial reactor coolant system (RCS) depressurization resulted in manual safety injection (SI) initiation.

" Main condenser vacuum was lost twice for durations of one and two hours, respectively, during cooldown.

" The isolation valve seal water system became inoperable during the event, which required operator response and an entry into a Technical Specification Limiting Condition for Operation statement.

" Prior to placing the overpressure protection system in service, it was necessary to enter the containment to install a temporary nitrogen supply for the pressurizer power-operated relief valve (PORV) to compensate for a design deficiency.

1

LER 247/00-001

" Problems with the auxiliary spray valve lineup delayed final depressurization.

" Problems with the component cooling water (CCW) valve lineup to the RHR heat exchanger delayed the pre-operational RHR heatup.

" Some SG leak rate monitoring equipment was degraded for an extended period of time, which limited the amount of SG leak rate information available to the operators prior to the event.

" Conflicting requirements between an emergency operating procedure and the special operating procedure for the RHR system caused a one-hour delay in bringing the RHR system online.

" Leakage occurred past the main steam isolation valve (MSIV) on the faulted steam generator.

As the result of the last two conditions, the pressure in the faulted steam generator slowly decreased below RCS pressure due to ambient heat loss and normal post-trip steam losses through main steam isolation boundaries. The gradual pressure loss in the faulted steam generator caused a slow primary-to-secondary leakage that gradually overfilled the steam generator and almost caused filling of the main steam line at 19 hours2.199074e-4 days <br />0.00528 hours <br />3.141534e-5 weeks <br />7.2295e-6 months <br /> following the reactor trip.

Additional information regarding the condition of the steam generator tubes and the internal stresses on the tubes is contained in References 3 and 4.

Analysis Results

! Total conditional core damage probability (CCDP)

The estimated total CCDP for the steam generator tube failure at Indian Point 2 is 4

4.6x10- . This estimate is based on the combined results from two analyses: one scenario involving a spontaneous tube rupture scenario and the other involving a tube failure with low leak rate (see Modeling Assumptions-Assessment). The results show the following:

! The contribution from a steam generator tube failure with lower associated primary-to-secondary leak rates (75 - 225 gpm), as were observed during the Indian Point 2 event (maximum leak rate = 146 gpm), is the majority contributor 4

(3.0x10- - 65%) compared to the contribution from the large tube rupture (> 225 4

gpm) scenario (1.6x10- - 35%).

The CCDP associated with this event with this event slightly increased over the estimated CCDP calculated in the preliminary analysis. This increase was due to three factors. First, the preliminary analysis was performed using the Revision 2QA Standardized Plant Analysis Risk (SPAR) model for Indian Point 2, which had not been reviewed against the licensees probabilistic risk analysis (PRA) for that plant. On the other hand, the final analysis was performed with the Revision 3 SPAR model for Indian Point 2, which had received an onsite quality assurance review, was compared to the licensees PRA for the plant, was discussed extensively with the licensees PRA staff, 2

SENSITIVE - NOT FOR PUBLIC DISCLOSURE

LER 247/00-001 and had been revised to address the comments obtained from the onsite review and benchmarking. Second, the Revision 3 SPAR model for Indian Point 2 incorporated the recently developed SGTR event tree for Westinghouse pressurized water reactors (PWRs), which was not available when the preliminary analysis was performed. Third, the final analysis considered the operator performance issue raised by Region 1 involving the performance of the operators on their re-qualification examinations and the effect it could have had on their response to the steam generator tube failure event.

! Dominant sequence Sequence 3 for both the spontaneous steam generator tube rupture (SGTR) scenario and the smaller leak scenario accounts for 67% of the total contribution to the CCDP.

The steam generator rupture failure event tree with the dominant sequence highlighted is provided in Fig. 1.

The events in Sequence 3 involve:

! Spontaneous rupture (with an associated leak rate >225 gpm) or smaller leak (75

- 225 gpm) from a steam generator tube(s) failure,

! Successful reactor trip,

! Successful response of the auxiliary feedwater system,

! Successful response of the high-pressure injection system,

! Successful isolation of the faulted steam generator by the operators,

! Successful RCS cooldown via the steam generator atmospheric dump valves (ADVs),

! Successful RCS depressurization,

! Successful termination or control of safety injection (SI),

! Failure to initiate residual heat removal (RHR),

! Failure of alternate long-term heat removal.

All six minimum cutsets in Sequence 3 (see Table 3) consist of at least one human error-related failure involving the following key operator actions:

! Initiate the RHR system.

! Align city, fire water, or other source of water to the auxiliary feedwater (AFW) suction.

! Depressurize steam generators to atmospheric pressure.

! Tables of results

! The conditional probabilities of the dominant sequences are shown in Table 1.

! The logic for the dominant sequences in the Indian Point 2 SGTR event tree is provided in Table 2a.

! Table 3 provides the conditional cut sets for the dominant sequences.

! Sensitivity Study/Uncertainty Analysis 3

SENSITIVE - NOT FOR PUBLIC DISCLOSURE

LER 247/00-001 This analysis included sensitivity studies on the effects of operator performance assumptions on the mean CCDP. The considerations that were taken into account include good crew performance during the event, poor crew performance during the biannual dynamic simulator requalification exam (4 out of 7 crews failed), many examples of poor work processes during the event, and the comparison between the details of the actual event occurrence and the event assumptions used in the SPAR model.

The sensitivity study consisted of modifying the performance shaping factors (PSFs) of all the applicable operator actions, thus modifying the human error probabilities (HEPs).

Three cases were performed: best estimate, upper bound, and lower bound (for both leak scenarios). Best estimate case details are provided under Modeling Assumptions.

SPAR model PSFs were adjusted further, if warranted, for the upper and lower bound cases. Listed below are the significant PSF adjustments for the upper bound case human performance basic events:

! Work Processes PSF was set to Poor for all applicable events.

! Training PSF was set to Nominal for OPR-XHE-RECOVER, MSS-XHE-ERROR, and RCS-XHE-DIAG.

! Ergonomics PSF was set to Poor for RCS-XHE-DIAG.

! Stress PSF was set to Moderate for RCS-XHE-XM-RCSDEP.

! Complexity PSF was set to Moderate for RCS-XHE-XM-RCSDEP, PCS-XHE-XM-CDOWN, and RHR-XHE-XM.

! Complexity PSF was set to High for MSS-XHE-XM-ERROR.

The following adjustments were made for the lower bound case:

! Stress PSF was set to Nominal for MSS-XHE-ERROR and RCS-XHE-DIAG.

! Complexity PSF was set to Moderate for PCS-XHE-XM-CDOWN and RHR-XHE-XM.

The human error probabilities (HEPs) for all three cases and both leak scenarios are provided in Table 5a and 5b. In addition, the CCDP values for the sensitivity and uncertainty study are provided in Table 6.

4 SENSITIVE - NOT FOR PUBLIC DISCLOSURE

LER 247/00-001 Modeling Assumptions

! Assessment Summary The modeling approach used in analyzing this event is the same one used by the NRC staff in the Significance Determination Process (SDP) evaluation of the event reported in Reference 5.1 Discussions with staff experts indicated that, considering the conditions associated with the flaw that existed in Indian Point 2 SG No. 24 at the time, either a partially opened tube failure with low leak rates or a spontaneous, fully open tube rupture with related high leak rates could have occurred when the degraded tube failed.

Basically, this approach split the conditional probability of steam generator tube rupture size given a steam generator tube failure into two parts, according to break flow rates.

In this approach, tube failures whose associated flow rates exceed the flow of one charging pump, but are less than the full charging system capacity are grouped into a different conditional probability category than the tube failures that result in leak rates that exceed full charging system capacity. This approach is appropriate when considering events that have different steps and/or event response times for the mitigation processes or substantially different probabilities for success of similar steps to be treated separately.

The model which was used in this analysis was the Indian Point 2, Revision 3 SPAR Model, dated 04/15/2002 (Ref. 6). The CCDP associated with each of the two scenarios was quantified using the SGTR event tree from this model with appropriate input changes to the human error probabilities to reflect the time available for operator response to the specific scenario considered.

! Initiating Event Frequency Changes As explained in the detailed discussion of the SDP evaluation of this event presented in Reference 5, the NRC staff used the existing base of operating experience to estimate the conditional probability that the steam generator tube failure would result in each of the two different leak rate ranges. Reference 7 contains a summary of the operating experience associated with steam generator tube failures. Considering the type of steam generator design, location of the tube flaw, the tube failure mechanism, and other relevant conditions, there are two previous steam generator tube ruptures which are pertinent to the one that occurred at Indian Point 2.

The two similar tube rupture events occurred at Surry 2 in 1976 and at the Doel Unit 2 reactor in Belgium in1979. The Doel 2 tube failure resulted in a leak rate of 135 gpm; the tube failure at Surry 2 had an associated leak rate of 330 gpm. The operating experience data indicate that tube failures of the specific type that occurred at Indian 1

Indian Point 2 had operated with the degraded steam generator tube in a degraded condition for some time prior to the February 15, 2000 failure. The risk associated with a potential tube failure induced by a steam generator depressurization transient event (e.g., a main steam line break) was considered in detail in Reference 5.

This issue was also examined relative to the degraded steam generator tube at Indian Point 2 in the precursor analysis of the reactor trip, ESF actuation, and subsequent loss of 480 Volt bus 6A, which occurred at Indian Point 2 on August 31, 1999, as reported in LER No. 247-99-015.

5 SENSITIVE - NOT FOR PUBLIC DISCLOSURE

LER 247/00-001 Point 2 (resulting in leak rates in the range 75-225 gpm) occur approximately twice as often as tube failures with relatively higher leak rates (>225 gpm).

Based on this result, in Reference 5, the staff used a conditional probability split of 0.67 for steam generator tube ruptures with associated leak rates between 75-225 gpm and 0.33 for tube ruptures with associated leak rates > 225 gpm. These probabilities were used in the subject analysis (i.e., in each case, the initiating event probability IE-SGTR was set to 1.0 in the event assessment and the CCDP calculated was multiplied by 0.67 for the low leak rate case and by 0.33 for the high leak rate case).

! Basic Event Changes For all of the human events that were applicable to the SGTR event (all of the notable basic events, including all modified basic events, are provided in Table 4), the Work Processes performance shaping factors (PSF) were changed from Nominal (or Good) to Poor. The changes were based on the problems that occurred before and during the event. The two largest indicators that poor work processes existed were multiple work arounds and long-standing equipment performance deficiencies. In addition, the plant violated Technical Specifications, displayed poor emergency response, and operators did not maintain proper logs during the event.

Changes to human error probabilities (HEP) were made for both cases-spontaneous tube rupture scenario and the tube failure with low leak rate scenario-to reflect the event condition analyzed. In some cases, the HEPs were the same for both cases, but for a few events, probabilities differed. The differences are due to the expected change of the PSFs between the two cases. The events that had PSFs modified, as compared to the SPAR Human Error Worksheets, and the bases for the changes are as follows:

! Operator fails to diagnose SGTR and start procedures. For the spontaneous rupture and smaller leak, the Training PSF was changed from Good to Nominal.

The basis for the change was that, although 4 out of 7 crews failed the biannual dynamic simulator exam, the crews had prior knowledge of the leak and exhibited good performance in diagnosing the SGTR during the event. For the smaller leak scenario only, the Stress PSF was changed from High to Nominal.

It is believed that the stress was not as high as in a spontaneous rupture, especially since the crews were already monitoring the leak and were dealing with a smaller leak rate.

! Operator fails to isolate the faulted steam generator. For the spontaneous rupture and smaller leak, the Training PSF was changed from Good to Nominal.

The basis for the change was that, although 4 out of 7 crews failed the biannual dynamic simulator exam, the crews had prior knowledge of the leak and exhibited good performance in isolating the faulted steam generator during the event. For the smaller leak scenario only, the Stress PSF was changed from High to Nominal. It is believed that the stress was not as high as in a spontaneous rupture, especially since the crews were already monitoring the leak and were dealing with a smaller leak rate.

! Operator fails to initiate cooldown. For both leak scenarios, the Complexity PSF was changed from Nominal to Moderate. This change was due to the 6

SENSITIVE - NOT FOR PUBLIC DISCLOSURE

LER 247/00-001 problems faced by the operators during the cooldown. Specifically, the operators had to control the atmospheric dump valves using a manual work around that caused the plant to exceed the maximum cooldown rate allowed by the Technical Specifications.

! Operator fails to initiate RHR. For both leak scenarios, the Complexity PSF was changed from Nominal to Moderate. This change was made due to the problems faced by the operators while initiating RHR. Specifically, the component cooling water (CCW) valves were out of position, which caused complications.

The human basic events that only had the Work Processes PSF changed are also shown in Table 4. In addition, human error events, their associated probabilities, and the bases for the changes are presented in the SPAR Human Error Worksheets.

References

1. LER 247/00-001-00, Manual Reactor Trip Following Steam Generator Tube Rupture, dated March 17, 2000.

2. NRC Augmented Inspection Team Report No. 05000247/2000-002, April 28, 2000.

3. LER 247/00-003-00, Steam Generators 21 and 24 Classified as Category C-3 per Technical Specification Table 4.13-1, dated April 24, 2000.

4. LER 247/00-005-00, Steam Generator Primary to Secondary Side Design Pressure Differential Exceeded, dated May 22, 2000.

5. Significance Determination Risk Assessment for Indian Point Unit 2 Steam Generator Inspection Findings - Review of Licensee Response to Initial Significance Determination and Final Staff Analysis, Enclosure No. 2 to letter dated November 20, 2000, from Hubert J. Miller, USNRC, to John Groth, Consolidated Edison.

6. Idaho National Engineering and Environmental Laboratory, Simplified Plant Analysis Risk (SPAR) Model for Indian Point Unit 2, Revision 3i, May 2002.

7. P. E. MacDonald, et al., Steam Generator Tube Failures, NUREG/CR-6365, April 1996.

8. J. C. Byers, et al., Revision of the 1994 ASP HRA Methodology (Draft),

INEEL/EXT-99-00041, January 1999.

9. Indian Point Station, Unit 2, Individual Plant Examination, dated August 12, 1992.

10. Indian Point Station, Unit 2, Updated Final Safety Analysis Report.

11. F. Marshall, A. Azarm, and D. Rasmuson, Common-Cause Failure Database and Analysis System, NUREG/CR-6286, Volumes 1-4, June 1998.

7 SENSITIVE - NOT FOR PUBLIC DISCLOSURE

LER 247/00-001

12. S. A. Eide, et. al., Reliability Study: Westinghouse Reactor Protection System, 1984-1995, NUREG/CR-5500, Vol. 2, April 1999.

13. R. J. Belles, et al., Precursors to Potential Severe Core Damage Accidents: 1996, NUREG/CR-4674, Vol. 25, December 1997.

8 SENSITIVE - NOT FOR PUBLIC DISCLOSURE

LER 247/00-001 SG R EA C TO R FEE D W A TE R H I GH FE ED F AU L T ED S EC O N D A R Y RCS T ER M IN A TE RWS T R ES ID U A L A L TE R NA TE H IG H T U BE TR I P P R ES S UR E AN D S TE A M S ID E D EP R ES S O R C O N TR O L R EF IL L H EA T L O N G TE R M PR E S SU R E R U P TU R E I N JE C TIO N BL E E D G EN E R AT O R C OOLD O W N S A FET Y R EM O VA L H E AT R EC I R C I SO L AT IO N I N JE C TI O N R E MO VA L I E- S G TR RT FW HPI FA B S GI S SC PZ R CS I R FL R HR L TH R H PR # E N D -S TA TE 1 OK 2 OK 3 CD 4 OK 5 CD 6 OK 7 CD 8 OK 9 CD 10 OK 9

11 CD 12 OK 13 OK 14 CD 15 CD 16 CD S 17 CD 18 OK 19 CD 20 CD 21 CD 22 CD Figure 1. Steam Generator Tube Rupture Event Tree

LER 247/00-001 Table 1. Conditional probabilities associated with the highest probability sequences.

Conditional core Event tree Sequence damage probability Percent name no. (CCDP) contribution SGTR 03 3.1E-004 67.4 SGTR 11 7.0E-005 15.2 Total (all sequences)(1) 4.6E-004 100

1. Total CCDP includes all sequences (including those not shown in this table).

Table 2a. Event tree sequence logic for dominant sequences.

Event tree Sequence Logic name no. (/ denotes success; see Table 2b for top event names)

SGTR 03 /RT /FW /HPI /SGI /SSC /PZR /CSI RHR LTHR SGTR 11 /RT /FW /HPI SGI RFL1 Table 2b. Definitions of top events listed in Table 2a.

CSI Operator fails to control/terminate safety injection FW Failure to feed steam generators HPI No or insufficient flow from the high-pressure injection system LTHR Alternate long-term decay heat removal unavailable PZR Primary system depressurization fails RHR No or insufficient flow from the RHR system RT Reactor fails to trip during transient SGI Operator fails to isolate faulted steam generator SSC Secondary side cooldown fails 10 SENSITIVE - NOT FOR PUBLIC DISCLOSURE

LER 247/00-001 Table 3. Conditional cut sets for the dominant sequence. (See Table 4 for definitions and probabilities for the basic events.)

Percent CCDP Contribution Minimum cut sets (of basic events)

Event Tree: SGTR, Sequence 03 8.0E-005 25.5 RHR-XHE-XM AFW-XHE-XM-CITYFIRE 6.0E-005 19.1 RHR-MOV-OO-RWST AFW-XHE-XM-CITYFIRE 6.0E-005 19.1 RHR-MOV-CC-SUCB AFW-XHE-XM-CITYFIRE 6.0E-005 19.1 RHR-MOV-CC-SUCA AFW-XHE-XM-CITYFIRE 8.0E-006 2.6 RHR-XHE-XM AFW-XHE-XM-SGDEP 6.0E-006 1.9 RHR-MOV-OO-RWST AFW-XHE-XM-SGDEP 6.0E-006 1.9 RHR-MOV-CC-SUCA AFW-XHE-XM-SGDEP 6.0E-006 1.9 RHR-MOV-CC-SUCB AFW-XHE-XM-SGDEP 6.0E-006 1.4 RHR-MDP-CF-ALL AFW-XHE-XM-CITYFIRE 3.1 E-4 Total1 Event Tree: SGTR, Sequence 11 4.0E-005 57.1 MSS-VCF-HW-ISOL HPI-XHE-XM-RWSTR1 2.2E-005 31.4 MSS-XHE-XM-ERROR HPI-XHE-XM-RWSTR1 8.5E-006 12.1 RCS-XHE-DIAG HPI-XHE-XM-RWSTR1 OPR-XHE-RECOVER 7.0 E-5 Total1

1. Total CCDP includes all cutsets (including those not shown in this table).

11 SENSITIVE - NOT FOR PUBLIC DISCLOSURE

LER 247/00-001 Table 4. Definitions and probabilities for selected basic events.

Probability/

Event Name Description Frequency Modified (per hour)

AFW-XHE-XM-CITYFIRE Failure to align city, FWS, or other source to AFW suction 2.0x10-2 Yes1 AFW-XHE-XM-SGDEP Operator fails to depressurize SGs to atmospheric pressure 2.0x10-3 Yes1 AFW-XHE-XM-TDP Operator fails to open and align TDP discharge AOVs 2.0x10-3 Yes1 HPI-XHE-XM-FB Operator fails to initiate feed and bleed cooling 4.0x10-2 Yes1 HPI-XHE-XM-RWSTR Operator fails to refill the RWST 2.0x10-3 Yes1 HPI-XHE-XM-RWSTR1 Operator fails to refill the RWST (dependent) 4.0x10-3 Yes1 HPI-XHE-XM-THRTL Operator fails to throttle HPI to reduce pressure 2.0x10-3 Yes1 HPR-XHE-XM Operator fails to initiate HPR system 2.0x10-3 Yes1 IE-LDC22 Initiating Event-Loss of DC bus 22 0.0 Yes2 IE-LLOCA Initiating Event-Large Loss of Accident Coolant 0.0 Yes2 IE-LOCCW Initiating Event-Loss of Component Cooling Water 0.0 Yes2 IE-LOOP Initiating Event-Loss of Offsite Power 0.0 Yes2 IE-LOSWS Initiating Event-Loss of Service Water 0.0 Yes2 IE-MLOCA Initiating Event-Medium Loss of Accident Coolant 0.0 Yes2 IE-RHR-DIS-V Initiating Event-RHR Discharge ISLOCA 0.0 Yes2 IE-RHR-DIS-V Initiating Event-RHR Suction ISLOCA 0.0 Yes2 IE-SGTR Initiating Event-Steam Generator Tube Rupture 1.0 Yes2 IE-SI-CLDIS-V Initiating Event-SI cold leg ISLOCA 0.0 Yes2 IE-SI-HLDIS-V Initiating Event-SI hot leg ISLOCA 0.0 Yes2 IE-SLOCA Initiating Event-Small Loss of Accident Coolant 0.0 Yes2 IE-TRANS Initiating Event-Transient 0.0 Yes2 MSS-VCF-HW-ISOL Ruptured SG isolation fails 1.0x10-2 No MSS-XHE-XM-ERROR Operator fails to isolate faulted steam generator 4.0x10-3 Yes3 MSS-XHE-XM-ERROR1 Operator fails to isolate faulted steam generator (dependent) 5.4x10-2 Yes3 OPR-XHE-RECOVER Operator fails to depressurize RCS below SG SRV 8.0x10-2 Yes3 PAB-XHE-XM-RMCOOL Operator fails to open doors to provide alternate cooling 2.0x10-3 Yes1 PCS-XHE-XM-CDOWN Operator fails to initiate cooldown 4.0x10-3 Yes3 PCS-XHE-XM-CDOWN1 Operator fails to initiate cooldown (dependent) 5.4x10-2 Yes3 RCS-XHE-DIAG Operator fails to diagnose SGTR to start procedures 2.0x10-2 Yes3 RCS-XHE-XM-RCSDEP Operator fails to depressurize the RCS 2.0x10-3 Yes1 RHR-MDP-CF-ALL RHR pumps common cause failure 2.2x10-4 No RHR-MOV-CC-SUCB Failure of RHR suction MOV 730 3.0x10-3 No RHR-MOV-CC-SUCA Failure of RHR suction MOV 731 3.0x10-3 No RHR-MOV-OO-RWST RHR/RWST isolation MOV fails 3.0x10-3 No RHR-XHE-XM Operator fails to initiate RHR system 4.0x10-3 Yes3

1. Human error probabilities (HEP) were modified to reflect the poor work processes (details located in Modeling Assumptions-Basic Event Modifications). Only the Work Processes PSF was changed from nominal to poor (see SPAR Model Human Error Worksheets).

2. Although the initiating event frequency for a steam generator tube failure was set to 1.0, the conditional probability that the tube failure would result in a leak rate >225 gpm was assumed to be 0.33, and the conditional probability that the tube failure would result in a leak rate in the range 75 gpm to 225 gpm was assumed to be 0.67, based on operating experience data. For bases for these values, see text (Modeling Assumptions-Initiating Event Frequency Changes). All other initiating event frequencies were set to 0.0.

3. Human error probabilities were modified to reflect actual plant conditions during the event (e.g, unavailable equipment, complications, and work processes). Details on if/how the PSFs were modified for HEP are located in Modeling Assumptions-Initiating Event Frequency Changes and SPAR Model Human Error Worksheets.

12 SENSITIVE - NOT FOR PUBLIC DISCLOSURE

LER 247/00-001 Table 5a. HEPs for small leak scenario sensitivity study.

SPAR Upper Bound Best Estimate Lower Bound Event Name HEPs HEPs HEPs1 HEPs AFW-XHE-XM-CITYFIRE 1.0x10-2 2.0x10-2 2.0x10-2 1.0x10-2 AFW-XHE-XM-SGDEP 1.0x10-3 2.0x10-3 2.0x10-3 1.0x10-3 AFW-XHE-XM-TDP 1.0x10-3 2.0x10-3 2.0x10-3 1.0x10-3 HPI-XHE-XM-FB 2.0x10-2 4.0x10-2 4.0x10-2 2.0x10-2 HPI-XHE-XM-RWSTR 1.0x10-3 2.0x10-3 2.0x10-3 1.0x10-3 HPI-XHE-XM-RWSTR1 2.0x10-3 4.0x10-3 4.0x10-3 2.0x10-3 HPI-XHE-XM-THRTL 1.0x10-3 2.0x10-3 2.0x10-3 1.0x10-3 HPR-XHE-XM 1.0x10-3 2.0x10-3 2.0x10-3 1.0x10-3 MSS-XHE-XM-ERROR 2.0x10-3 2.0x10-2 4.0x10-3 2.0x10-3 MSS-XHE-XM-ERROR1 5.2x10-2 6.9x10-2 5.4x10-2 5.2x10-2 OPR-XHE-RECOVER 2.0x10-2 8.0x10-2 8.0x10-2 2.0x10-2 PAB-XHE-XM-RMCOOL 1.0x10-3 2.0x10-3 2.0x10-3 1.0x10-3 PCS-XHE-XM-CDOWN 1.0x10-3 4.0x10-3 4.0x10-3 4.0x10-3 PCS-XHE-XM-CDOWN1 1.0x10-2 5.4x10-2 5.4x10-2 5.4x10-2 RCS-XHE-DIAG 8.0x10-3 4.0x10-1 2.0x10-2 4.0x10-3 RCS-XHE-XM-RCSDEP 1.0x10-3 8.0x10-3 2.0x10-3 1.0x10-3 RHR-XHE-XM 2.0x10-3 4.0x10-3 4.0x10-3 4.0x10-3 Table 5b. HEPs for large leak scenario sensitivity study.

SPAR Upper Bound Best Estimate Lower Bound Event Name HEPs HEPs HEPs1 HEPs AFW-XHE-XM-CITYFIRE 1.0x10-2 2.0x10-2 2.0x10-2 1.0x10-2 AFW-XHE-XM-SGDEP 1.0x10-3 2.0x10-3 2.0x10-3 1.0x10-3 AFW-XHE-XM-TDP 1.0x10-3 2.0x10-3 2.0x10-3 1.0x10-3 HPI-XHE-XM-FB 2.0x10-2 4.0x10-2 4.0x10-2 2.0x10-2 HPI-XHE-XM-RWSTR 1.0x10-3 2.0x10-3 2.0x10-3 1.0x10-3 HPI-XHE-XM-RWSTR1 2.0x10-3 4.0x10-3 4.0x10-3 2.0x10-3 HPI-XHE-XM-THRTL 1.0x10-3 2.0x10-3 2.0x10-3 1.0x10-3 HPR-XHE-XM 1.0x10-3 2.0x10-3 2.0x10-3 1.0x10-3 MSS-XHE-XM-ERROR 2.0x10-3 2.0x10-2 8.0x10-3 2.0x10-3 MSS-XHE-XM-ERROR1 5.2x10-2 6.9x10-2 5.8x10-2 5.2x10-2 OPR-XHE-RECOVER 2.0x10-2 8.0x10-2 8.0x10-2 2.0x10-2 PAB-XHE-XM-RMCOOL 1.0x10-3 2.0x10-3 2.0x10-3 1.0x10-3 PCS-XHE-XM-CDOWN 1.0x10-3 4.0x10-3 4.0x10-3 4.0x10-3 PCS-XHE-XM-CDOWN1 1.0x10-2 5.4x10-2 5.4x10-2 5.4x10-2 RCS-XHE-DIAG 8.0x10-3 4.0x10-1 4.0x10-2 4.0x10-3 RCS-XHE-XM-RCSDEP 1.0x10-3 8.0x10-3 2.0x10-3 1.0x10-3 RHR-XHE-XM 2.0x10-3 4.0x10-3 4.0x10-3 4.0x10-3

1. Best Estimate human error probabilities are also located in Table 4. In addition, the definitions of the human error basic events located in Table 5a and 5b are provided in Table 4.

13 SENSITIVE - NOT FOR PUBLIC DISCLOSURE

LER 247/00-001 Table 6. Summary of CCDP results from the sensitivity and uncertainty study.

Lower Bound Best Estimate Upper Bound 95% Percentile 6.4E-004 1.3E-003 2.0E-003 Mean 2.3E-004 4.6E-004 7.0E-004 5% Percentile 4.1E-005 7.8E-005 1.2E-004 Point Estimate 2.4E-004 4.6E-004 6.9E-004 14 SENSITIVE - NOT FOR PUBLIC DISCLOSURE