Text

Final ASP Analysis - Indian Point 2 (LER 247-99-015)
	ML20112J404
Person / Time
Site:	Indian Point
Issue date:	05/12/2020
From:	Christopher Hunter; NRC/RES/DRA/PRB
To:	;
	Hunter C (301) 415-1394
References
	LER 247-99-015
	Download: ML20112J404 (87)
	v • d • e

1

)LQDO Precursor Analysis Accident Sequence Precursor Program --- Office of Nuclear Regulatory Research Indian Point 2 Loss of Offsite Power to Safety-related Buses Following a Reactor Trip and an Emergency Diesel Generator Output Breaker Trip Opening (YHQW'DWH 8/31/1999/(5 247/99-015

&&'3 2[5 March 17, 2003 Event Summary On August 31, 1999, the reactor inadvertently tripped while the licensee was replacing a defective bi-stable in a pressurizer low pressure instrument channel. After the reactor trip, the station blackout logic matrix generated a blackout signal as a result of a sustained under-voltage condition at the safety-related 480-V buses. The station blackout signal stripped the 480-V buses and reloaded them onto the emergency diesel generators (EDGs). The EDG output breaker to 480-V bus 6A tripped within 14 seconds after closing due to an over-current condition on the bus.

Normally when the station auxiliary transformer tap changer is in the automatic mode, the tap changer would move to restore degraded voltage conditions in the switchyard. However, due to a defective voltage control relay, the tap changer was being operated in the manual mode at the time of the event. As the result of the voltage anomaly in the switchyard caused by the main generator trip, the tap changer was not able to correct the degraded condition. Therefore, a sustained under-voltage condition on the safety-related buses exceeded the allowable setpoint value (180 seconds +/- 30 seconds). Consequently, the station blackout logic matrix generated a blackout signal. The station blackout signal stripped the 480-V buses and reloaded them onto the EDGs.

480-V bus 6A loaded onto its EDG (EDG 23). Eight seconds after EDG 23 started, the output breaker from the EDG to bus 6A closed. Approximately 14 seconds later, the breaker tripped to its open position due to an over-current condition. Consequently, bus 6A lost power from both the EDG and offsite power supply. The other 480-V buses were energized by their respective EDGs.

The blackout logic prohibits the transfer of safety-related 480-V buses 2A, 3A, 5A, and 6A back to their 6.9-kV buses until the blackout logic signal is reset. With bus 6A de-energized, the under-voltage interlock prevented the reset of the blackout logic. Consequently, bus 6A remained de-energized. After approximately 7.4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months , instrument bus 24 was lost when the voltage on DC bus 24 became low (battery charger 24 is powered from bus 6A). Offsite power was restored to 480-V bus 5A approximately 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months following event initiation.

Additional Event-Related Information Loss of 480-V bus 6A and consequences - During this event, the reactor trip was followed by a loss of offsite power to safety-related 480-V buses. Due to tripping of the output breaker of EDG 23, emergency onsite power from EDG 23 was unavailable to 480-V bus 6A. That is, both

LER 247/99-015 2

SENSITIVE - NOT FOR PUBLIC DISCLOSURE offsite and onsite power were unavailable to bus 6A. De-energization of bus 6A caused the unavailability of power to the following risk-important equipment:

Motor-driven auxiliary feedwater pump P-23; High-pressure safety injection pump P-23; Charging pump P-23; Sump recirculating pump P-22; Residual heat removal pump P-22; The block valve for one of the two pressurizer power-operated relief valves (PORVs); and Battery charger 24.

Even though power was unavailable to loads powered from bus 6A, offsite power was available to non-safety-related loads powered from the 6.9 kV buses. Further, 480-V buses 2A, and 3A were powered from EDG 22; 480-V bus 5A was powered from EDG 21.

Loss of DC bus 24 and consequences - DC bus 24 is fed from two power sources. One of these sources is battery charger 24, which is powered from 480-V bus 6A. When power supply to bus 6A failed, there was no power supply to battery charger 24. The second power supply for DC bus 24 is battery 24. This battery is designed to supply its shutdown loads for a period of two hours following a plant trip and loss of all AC power. However, during this event, the battery supported the DC loads for approximately 7.4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months without any power to the battery charger. During that period of time, power was not restored to battery charger 24. As a result, battery 24 continued to drain and the DC bus 24 voltage continued to drop. Instrument bus 24 was lost when the voltage on the DC bus 24 became too low for inverter 24 to provide AC power to the instrument bus.

When instrument bus 24 lost power, the auxiliary feedwater flow control to steam generator 24 lost power. As a result, the flow control valve assumed its fully open position. In response, the operators secured auxiliary feedwater pump 22 (the turbine-driven auxiliary feedwater pump).

Water levels in the steam generators were maintained by starting and stopping the turbine-driven auxiliary feedwater pump three times (in lieu of running the pump continuously while taking local-manual control of the flow control valves).

Potential for steam generator tube rupture - The event analyzed in this report occurred on August 31, 1999. On February 15, 2000 (approximately six months later), a steam generator tube leak occurred at Indian Point 2 (LER 247-00-001, Ref. 3). During that event, steam generator leakage rapidly increased from 4 gallons per day to greater than 75 gallons per minute. Primary-to-secondary leakage (0.5 gallons per day) was first detected by condenser off-gas sampling in September 1998. The leak rate slowly increased during the next 12 months and reached 2 gallons per day, when the plant tripped on August 31 due to the loss of offsite power (Ref. 4). In spite of its degradation, that tube did not rupture as the result of the plant transient that followed the loss of offsite power event. However, if additional mitigating system failures that could introduce additional stresses on the steam generator tubes would have occurred during the loss of power event (e.g., steam generator dry out as a result of loss of auxiliary feedwater), the degraded tube may have ruptured. This analysis includes an evaluation of the significance of this condition in addition to the evaluation of the trip and loss of EDG 23. Details of this evaluation are presented in Attachment 3.

EDG surveillance test failure - On November 29, 1998, with the unit operating at 99% power, surveillance test PT-M21 Emergency Diesel Generators was being performed. After 20 minutes operation under load, the fuel injection line to the number eight cylinder of EDG 21

LER 247/99-015 3

SENSITIVE - NOT FOR PUBLIC DISCLOSURE began to leak. Operators had to terminate the surveillance and repair the leak (LER 247 019, Ref. 5). The condition that led to the loss of offsite power on August 31, 1999, co-existed with this condition. Therefore, a reactor trip could have led to a loss of offsite power as well as a loss of an EDG. The analysis includes an evaluation of the significance of this condition in addition to the evaluation of the trip and loss of EDG 23.

Recovery opportunities. Recovery opportunities examined in this analysis included the following alternatives to AFW:

Main Feedwater - Consistent with its design, the main feedwater system at Indian Point 2 remained available after the trip. Its availability in the long-term was considered.

Feed and Bleed Cooling - The available time for initiating feed and bleed following loss of feedwater to assure success was assessed. Its dependency upon offsite power was also considered.

Alternate Safe Shutdown System (ASSS) - Its potential use of the alternate safe shutdown system in the event of a loss of auxiliary feedwater in both the short-and the long-term were considered.

This analysis also examined the potential for recovering the following sources of electric power for Safety Bus 6A:

Offsite Power - The analysis considered the possibility of recovering offsite power within the time required for successful initiation of feed and bleed cooling.

EDG 23 - The analysis considered the possibility that the EDG 23 output breaker would trip open again during startup of loads.

Special Considerations. Comments received from Region I on the original final analysis and the discovery of additional mitigation capability that had not been previously identified prompted a reanalysis of the event. This reanalysis also examined the uncertainty associated with the estimated CCDP. Parameter uncertainty was addressed by employing the uncertainty analysis capability built into the Revision 3 SPAR models. Uncertainty in both equipment performance and human performance was considered. The issue of model uncertainty was addressed through the performance of various sensitivity studies. The results of the revised final analysis presented in Table A1-9 reflect these uncertainty considerations.

Two issues that a significant impact on the results of the final analysis were the use of condensate injection as an alternate means of secondary cooling and the operator performance issue identified by Region I as a concern in their comments on the original final analysis. To consider condensate injection, modifications were made to the SPAR model as described in Tables A1-5 and A1-7. As a result of these modifications, the issues regarding the availability of MFW following reactor trip and the use of ASSS became less significant.

In one of their comments on the original final analysis, Region I expressed the concern that the analysis did not seem to reflect the fact that the operators at Indian Point 2 had exhibited poor performance on their operator requalification examinations over an extended period of time (at least 3 years). To address this comment and the associated uncertainty in human error probabilities introduced by this issue, a sensitivity study of operator performance was performed at part of the reanalysis. This sensitivity study focused on the question of anticipated operator

LER 247/99-015 4

SENSITIVE - NOT FOR PUBLIC DISCLOSURE response to the scenarios associated with the loss of electric power to a safety bus. The specific cases considered in this study and their associated assumptions, bases, and probability values are described in Tables A1-5, A1-7, and A1-8. The specific HRA worksheets used in the low estimate, the best estimate, and the high estimate cases in the human performance sensitivity study are presented in Attachment 3. These worksheets identify the performance shaping factors and their corresponding bases which were used to estimate the human error probabilities used for each of the three cases in the study. In characterizing the results of the revised final analysis for the purposes of the Accident Sequence Precursor (ASP) Programs database, the results of the best estimate case have been used.

Analysis Results

Conditional Core Damage Probability (CCDP)

The conditional core damage probability associated with this event is as follows:

Conditional Core Damage Probability (CCDP) 95% percentile 7.8E-05 mean 2.5E-05 5% percentile 1.9E-06

Dominant sequences Loss of Offsite Power (LOOP) Sequence 18: The dominant core damage sequence is LOOP Sequence 18, which contributes 45% of the total CCDP. The events and important component failures in Sequence 18 (shown in Figure 2) are as follows:

LOOP occurs,

Successful reactor trip,

Successful operation of the emergency power system,

Failure of the AFW system, and

Failure of the bleed portion of feed and bleed cooling, leading to core damage.

Other Dominant Sequences: The three next most dominant sequences consist of station blackout sequences (LOOP Sequences 19-05, 19-02, and 19-22) which involve:

Failure of reactor coolant pump seals (RCP seal LOCA) and subsequent failure of hish pressure recirculation,

Failure to recover a.c. power before battery depletion, or

Failure of auxiliary feedwater with failure to recover offsite power in the short-term, respectively.

Each of these sequences contributes ~1.3-2.5E-06 to the overall CCDP, with the total contribution being 5E-06, which is about 35% of the overall CCDP.

LER 247/99-015 5

SENSITIVE - NOT FOR PUBLIC DISCLOSURE The fifth most dominant sequence is an anticipated transient without scram (ATWS) sequence (LOOP Sequence 20), which involves:

Failure of the reactor trip function.

This sequence contributes 1.2 E-06, which is about 8% of the overall CCDP.

Results tables The conditional probabilities of the dominant sequences are shown in Table 1 The event tree sequence logic for the dominant sequences is provided in Table 2a, and definitions of top events are provided in Table 2b.

The conditional cut sets for the dominant sequences are provided in Table 3.

The definitions and probabilities/frequencies for the basic events which appear in the dominant sequences or which were modified specifically for this analysis are presented in Table 4.

Analysts Analysts:

Patrick OReilly (lead), Don Marksberry, Eli Goldfeiz, James Houghton, Sunil Weerakkody NRC technical reviewers: Gary DeMoss, Michael Cheok.

Modeling Assumptions

Assessment summary The Level 1, Revision 3 Standardized Plant Analysis Risk (SPAR) model for Indian Point 2 (Ref. 3) was used for this assessment. The SPAR model was modified as described in to reflect the plant conditions during the event being analyzed, and to address comments on the preliminary analysis which were received from the licensee and from the NRCs Region I office during the ASP Programs Peer Review process.

Subsequently, further modifications were made to the SPAR model to address comments received from Region I following their review of the original final analysis.

In addition, the model was modified to reflect updates in the fault trees, basic events, initiating event frequencies, and failure probabilities based on recent operating experience.

ASP analysis approach The following steps were taken for this analysis:

1. Facts. Identify unique system and operational considerationsthese are the facts in which assumptions and model modifications are based.

2. Sequences of interest. Identify sequences that result in the loss of instrument air and thus the failure of all AFW pumps.

LER 247/99-015 6

SENSITIVE - NOT FOR PUBLIC DISCLOSURE

3. Recovery opportunities. Identify recovery opportunities and estimate associated non-recovery probabilities.

4. Update SPAR model (base case). Modify the SPAR model base case to reflect:

Updates in the initiating event frequencies and failure probabilities Changes to event and fault trees to reflect failure modes being modeled

5. Modify SPAR model (current case). Modify the SPAR model current case to reflect the effects of the event being analyzed.

6. Analysis. Run the SPAR model and evaluate results for adequacy.

7. Reviews. Perform independent technical reviews by PRA analysts.

Plant-specific system and operational considerations (facts)

Details of plant-specific system design and operational considerations are provided in. These are the facts on which the assumptions and model modifications are based. Details are provided for:

Recovery of auxiliary feedwater.

Recovery of main feedwater.

Secondary side depressurization.

Establishing condensate flow

Recovery of offsite power.

Recovery of emergency power.

Recovery of safety-related ac buses.

Recovery of high pressure injection.

Recovery of high pressure recirculation.

Use of the alternate safe shutdown system (ASSS).

ASP Peer Review Process After the preliminary analysis of this event was completed, it was sent out to the Indian Point 2 licensee and to cognizant members of the NRC staff and Region I for review/comment in accordance with the ASP Programs Peer Review process.

Comments received from the licensee on the preliminary analysis and our responses to these comments are contained in Attachment 2. Once all comments on the preliminary analysis had been reviewed and evaluated according to the ASP Programs Peer Review criteria, the final analysis was prepared and documented. Upon receiving the final analysis, Region I provided a number of comments, which are presented in Attachment 3.

LER 247/99-015 7

SENSITIVE - NOT FOR PUBLIC DISCLOSURE References 1.

LER 247/99-015, Reactor Trip, ESF Actuation, Entry into TS 3.0.1, and Notification of Unusual Event, August 31, 1999 (ADAMS Accession No. ML).

2.

U.S. Nuclear Regulatory Commission, NRC Augmented Inspection Team - Reactor Trip with Complications, Report No. 50-247/99-08, October 19, 1999.

3.

LER 247/00-001, Manual Reactor Trip Following Steam Generator Tube Rupture, March 17, 2000 (ADAMS Accession No. ML).

4.

U.S. Nuclear Regulatory Commission, NRC Augmented Inspection Team - Steam Generator Tube Failure, Report No. 50-247/2000-002, April 28, 2000.

5.

LER 247/98-019, Emergency Diesel 21 Failure, November 24, 1998 (ADAMS Accession No. ML).

6.

Idaho National Engineering and Environmental Laboratory, Simplified Plant Analysis Risk Model for Indian Point Unit 2, Revision 2QA, April 1998.

7.

Letter from A. Alan Blind (Consolidated Edison Company) to U.S. Nuclear Regulatory Commission, Review of NRCs Preliminary Accident Sequence Precursor Analysis of August 1999 Operational Event at Indian Point Unit 2, June 5, 2001.

8.

Memorandum from Ashok C. Thadani to William D. Travers, Closeout of Generic Safety Issue 23: Reactor Coolant Pump Seal Failure, U.S. Nuclear Regulatory Commission, November 8, 1999.

9.

R.G. Neve and H.W. Heiselmann, Cost/Benefit Analysis for Generic Issue 23: Reactor Coolant Pump Seal Failure, NUREG/CR-5167, April 1991.

10.

U.S. Nuclear Regulatory Commission, Final Significance Determination for a Red Finding and Notice of Violation at Indian Point 2, November 20, 2000.

11.

F.M. Marshall, D.M. Rasmusson, and A. Mosleh, Common-Cause Failure Parameter Estimations, NUREG/CR-5497, October 1998.

12.

G. M. Grant, et al., Reliability Study: Emergency Diesel Generator Power System, 1987-1993, NUREG/CR-5500, Vol. 5, September 1999.

13.

J. P. Poloski, et al., Reliability Study: Auxiliary/Emergency Feedwater System, 1987-1995, NUREG/CR-5500, Vol. 1, August 1998.

14.

J. P. Poloski, et al., Rates of Initiating Events at U.S. Nuclear Power Plants: 1987-1995, NUREG/CR-5750, February 1999.

15.

S. D. Weerakkody, et al., Assessment of Risk Significance Associated with Issues Identified at D. C. Cook Nuclear Power Plant, NUREG-1728, October 2000.

16.

Individual Plant Examination for Indian Point Unit No. 2 Nuclear Generating Station, August 1992.

LER 247/99-015 8

S Figure 1. Electrical power diagram at Indian Point 2.

Figure removed during SUNSI review.

LER 247/99-015 9

ENSITIVE - NOT FOR PUBLIC DISCLOSURE HPR-LOOP HIGH PRESSURE RECIR-CULATION RHR-LOOP RESIDUAL HEAT REMOVAL COOLDOWN-LOOP RCS COOLDOW N SGCOOL-L SECONDARY COOLING RECOVERED OP-6H OFFSITE POWER REC IN 6 HRS OP-2H OFFSITE POWER REC IN 2 HRS HPI-LOOP-2H HIGH PRESSURE INJECTION BLEED BLEED PORTION OF F & B COOLING PORV-RES PORVs CLOSE PORV-L NO PORVs OPEN AFW-LOOP AUXILIARY FEEDWATER EP EMERGENCY POW ER RT-L REACTOR TRIP IE-LOOP LOSS OF OFFSITE POWER END-STATE FR 1

OK 2

OK 3

OK 4

OK 5

CD 6

OK 7

CD 8

OK 9

CD 10 CD 11 OK 12 OK 13 CD 14 OK 15 OK 16 CD 17 CD 18 CD 19 T SBO 20 CD Figure 2. LOOP Event Tree for Indian Point 2. The Dominant Sequence Has Been Highlighted.

LER 247/99-015 10 SENSITIVE - NOT FOR PUBLIC DISCLOSURE Table 1. Conditional Probabilities Associated with the Dominant Sequences.1 Event Tree Name Sequence No.

Conditional core Damage Probability (CCDP)

LOOP 18 6.7E-06 LOOP 19-05 2.5E-06 LOOP 19-02 1.4E-06 LOOP 19-22 1.3E-06 LOOP 20 1.2E-06 Total (All Sequences)2 Point Estimate 1.5E-05 Mean3 2.2E-05 95th Percentile3 7.8E-05 5th Percentile3 1.9E-06 1.

File name: GEM 294-99-015 1-24-2003 093737.

2.

Total CCDP includes all sequences (including those not shown in this table).

3.

Values generated using the uncertainty analysis option in SAPHIRE. The Monte Carlo Uncertainty Method was used with 5,000 histories.

Table 2a. Event Tree Sequence Logic for the Dominant Sequences Event Tree Name Sequence No.

Logic

(/ denotes success; see Table 2.b for top event names)

LOOP 18

/RT-L, /EP, AFW-LOOP, BLEED LOOP 19-05

/RT-L, EP, /AFW, /PORV-SBO, SEALLOCA, /OP-SL, /HPI,

/COOLDOWN, RHR, HPR LOOP 19-02

/RT-L, EP, /AFW, /PORV-SBO, /SEALLOCA, ACP-BD LOOP 19-22

/RT-L, EP, AFW, OEP-ST LOOP 20 RT-L

LER 247/99-015 11 SENSITIVE - NOT FOR PUBLIC DISCLOSURE Table 2b. Definitions of Fault Trees Listed in Table 2a.

AFW NO OR INSUFFICIENT AFW FLOW AFW-LOOP NO OR INSUFFICIENT AFW FLOW DURING LOOP BLEED FAILURE OF BLEED PORTION OF FEED & BLEED COOLING COOLDOWN RCS COOLDOWN TO RHP PRESSURE USING TBVs, ETC.

EP EMERGENCY POWER SYSTEM FAILS HPI NO OR INSUFFICIENT FLOW FROM THE HPI SYSTEM HPR NO OR INSUFFICIENT FLOW FROM THE HPR SYSTEM OEP-ST FAILURE TO RECOVER OFFSITE POWER IN THE SHORT-TERM OP-SL OPERATOR FAILS TO RECOVER OFFSITE POWER (SEAL LOCA)

PORV-SBO PORVs/SRVs OPEN DURING STATION BLACKOUT RHR NO OR INSUFFICIENT FLOW FROM THE RHR SYSTEM RT-L REACTOR FAILS TO TRIP DURING LOOP SEALLOCA RCP SEALS FAIL DURING LOOP

LER 247/99-015 12 SENSITIVE - NOT FOR PUBLIC DISCLOSURE Table 3. Conditional Cut Sets for Dominant Sequences.

Event Tree: LOOP, Sequence 18 CCDP Percent Contribution Minimal Cut Sets1 1.4E-06 21.0 AFW-PMP-CF-ALL COND-XHE-XM-LOOP-2H 4.9E-07 7.4 AFW-XHE-XL-TDPFR AFW-TDP-FR-22 EPS-DGN-FR-22 EPS-XHE-NOREC-2H OEP-XHE-NOREC-LOOP-2H COND-XHE-XM-LOOP-2H 4.1E-07 6.2 AFW-XHE-XL-TDPFR AFW-TDP-FR-22 EPS-DGN-TM-22 EPS-XHE-NOREC-2H OEP-XHE-NOREC-LOOP-2H COND-XHE-XM-LOOP-2H 3.1E-07 4.6 AFW-MDP-CF-AB AFW-XHE-XL-TDPFR AFW-TDP-FR-22 COND-XHE-XM-LOOP-2H 2.3E-07 3.5 AFW-AOV-CF-SGS COND-XHE-XM-LOOP-2H 2.3E-07 3.5 AFW-CKV-CF-PMPS COND-XHE-XM-LOOP-2H 2.3E-07 3.5 AFW-CKV-CF-SUCT COND-XHE-XM-LOOP-2H 1.9E-07 2.8 AFW-TDP-TM-22 EPS-DGN-FR-22 EPS-XHE-NOREC-2H OEP-XHE-NOREC-LOOP-2H COND-XHE-XM-LOOP-2H 1.7E-07 2.5 AFW-XHE-XL-TDPFR AFW-TDP-FR-22 EPS-DGN-FS-22 EPS-XHE-NOREC-2H OEP-XHE-NOREC-LOOP-2H COND-XHE-XM-LOOP-2H 1.7E-07 2.5 AFW-CKV-CF-SGS COND-XHE-XM-LOOP-2H 1.6E-07 2.4 AFW-TDP-TM-22 EPS-DGN-TM-22 EPS-XHE-NOREC-2H OEP-XHE-NOREC-LOOP-2H COND-XHE-XM-LOOP-2H 1.4E-07 2.1 AFW-XHE-XL-TDPFS AFW-TDP-FS-22 EPS-DGN-FR-22 EPS-XHE-NOREC-2H OEP-XHE-NOREC-LOOP-2H COND-XHE-XM-LOOP-2H 1.2E-07 1.8 AFW-XHE-XL-TDPFS AFW-TDP-FS-22 EPS-DGN-TM-22 EPS-XHE-NOREC-2H OEP-XHE-NOREC-LOOP-2H COND-XHE-XM-LOOP-2H 1.2E-07 1.8 AFW-MDP-CF-AB AFW-TDP-TM-22 COND-XHE-XM-LOOP-2H

LER 247/99-015 13 SENSITIVE - NOT FOR PUBLIC DISCLOSURE Event Tree: LOOP, Sequence 18 (Continued)

CCDP Percent Contribution Minimal Cut Sets1 8.9E-08 1.3 AFW-MDP-CF-AB AFW-XHE-XL-TDPFS AFW-TDP-FS-22 COND-XHE-XM-LOOP-2H 7.8E-08 1.2 PPR-SRV-CC-2 AFW-XHE-XL-TDPFR AFW-TDP-FR-22 EPS-DGN-FR-22 EPS-XHE-NOREC-2H OEP-XHE-NOREC-LOOP-2H Event Tree: LOOP, Sequence 19-05 CCDP Percent Contribution Minimal Cut Sets1 3.9E-07 15.6

/PPR-SRV-CO-SBO RCS-MDP-LK-SEALS SWS-MDP-CF-FRALL 3.9E-07 15.3

/PPR-SRV-CO-SBO RCS-MDP-LK-SEALS SWS-STR-CF-ALL 3.8E-07 15.2

/PPR-SRV-CO-SBO RCS-MDP-LK-SEALS SWS-MDP-CF-FSALL 1.3E-07 5.2

/PPR-SRV-CO-SBO RCS-MDP-LK-SEALS EPS-DGN-FR-21 SWS-XHE-XM-MDP EPS-DGN-FR-22 1.1E-07 4.4

/PPR-SRV-CO-SBO RCS-MDP-LK-SEALS EPS-DGN-FR-21 SWS-XHE-XM-MDP EPS-DGN-TM-22 1.1E-07 4.4 EPS-DGN-TM-21 /PPR-SRV-CO-SBO RCS-MDP-LK-SEALS SWS-XHE-XM-MDP EPS-DGN-FR-22 8.1E-08 3.2

/PPR-SRV-CO-SBO RCS-MDP-LK-SEALS SWS-XHE-XM-MDP EPS-DGN-CF-RUN 4.5E-08 1.8

/PPR-SRV-CO-SBO RCS-MDP-LK-SEALS EPS-DGN-FR-21 SWS-XHE-XM-MDP EPS-DGN-FS-22 4.5E-08 1.8

/PPR-SRV-CO-SBO RCS-MDP-LK-SEALS SWS-XHE-XM-MDP EPS-DGN-FS-21 EPS-DGN-FR-22 3.8E-08 1.5 EPS-DGN-TM-21 /PPR-SRV-CO-SBO RCS-MDP-LK-SEALS SWS-XHE-XM-MDP EPS-DGN-FS-22

LER 247/99-015 14 SENSITIVE - NOT FOR PUBLIC DISCLOSURE Event Tree: LOOP, Sequence 19-05 (Continued)

CCDP Percent Contribution Minimal Cut Sets1 3.8E-08 1.5

/PPR-SRV-CO-SBO RCS-MDP-LK-SEALS SWS-XHE-XM-MDP EPS-DGN-FS-21 EPS-DGN-TM-22 Event Tree: LOOP, Sequence 19-02 CCDP Percent Contribution Minimal Cut Sets1 6.1E-07 42.4

/PPR-SRV-CO-SBO /RCS-MDP-LK-SEALS ACP-XHE-NOREC-BD EPS-DGN-CF-RUN EPS-XHE-NOREC-7H EPS-XHE-NOREC-4H 1.6E-07 11.0

/PPR-SRV-CO-SBO /RCS-MDP-LK-SEALS ACP-XHE-NOREC-BD EPS-DGN-CF-STRT EPS-XHE-NOREC-7H EPS-XHE-NOREC-4H 1.1E-07 7.8 SWS-MDP-CF-SWESS /PPR-SRV-CO-SBO

/RCS-MDP-LK-SEALS ACP-XHE-NOREC-BD EPS-XHE-NOREC-7H EPS-XHE-NOREC-4H 3.7E-08 2.5

/PPR-SRV-CO-SBO /RCS-MDP-LK-SEALS EPS-DGN-FR-21 ACP-XHE-NOREC-BD EPS-DGN-FR-22 EPS-DGN-FR-23 3.1E-08 2.1 EPS-DGN-TM-21 /PPR-SRV-CO-SBO

/RCS-MDP-LK-SEALS ACP-XHE-NOREC-BD EPS-DGN-FR-22 EPS-DGN-FR-23 EPS-XHE-NOREC-7H EPS-XHE-NOREC-4H 3.1E-08 2.1

/PPR-SRV-CO-SBO /RCS-MDP-LK-SEALS EPS-DGN-FR-21 ACP-XHE-NOREC-BD EPS-DGN-FR-22 EPS-DGN-TM-23 EPS-XHE-NOREC-7H EPS-XHE-NOREC-4H 3.1E-08 2.1

/PPR-SRV-CO-SBO /RCS-MDP-LK-SEALS EPS-DGN-FR-21 ACP-XHE-NOREC-BD EPS-DGN-TM-22 EPS-DGN-FR-23 EPS-XHE-NOREC-7H EPS-XHE-NOREC-4H 2.7E-08 1.9

/PPR-SRV-CO-SBO /RCS-MDP-LK-SEALS EPS-DGN-FR-21 ACP-XHE-NOREC-BD EPS-DGN-FR-22 SWS-MDP-TM-26 EPS-XHE-NOREC-7H EPS-XHE-NOREC-4H 2.3E-08 1.6 EPS-DGN-TM-21 /PPR-SRV-CO-SBO

/RCS-MDP-LK-SEALS ACP-XHE-NOREC-BD EPS-DGN-FR-22 SWS-MDP-TM-26 EPS-XHE-NOREC-4H EPS-XHE-NOREC-7H

LER 247/99-015 15 SENSITIVE - NOT FOR PUBLIC DISCLOSURE Event Tree: LOOP, Sequence 19-02 (Continued)

CCDP Percent Contribution Minimal Cut Sets1 2.2E-08 1.5

/PPR-SRV-CO-SBO /RCS-MDP-LK-SEALS EPS-DGN-FR-21 ACP-XHE-NOREC-BD EPS-DGN-FR-22 EPS-XHE-NOREC-7H EPS-XHE-DG23-OB-S-4H EPS-XHE-NOREC-4H 2.2E-08 1.5

/PPR-SRV-CO-SBO /RCS-MDP-LK-SEALS ACP-XHE-NOREC-BD SWS-AOV-CF-DGS EPS-XHE-NOREC-7H EPS-XHE-NOREC-4H 1.8E-08 1.3

/PPR-SRV-CO-SBO /RCS-MDP-LK-SEALS EPS-DGN-FR-21 ACP-XHE-NOREC-BD EPS-DGN-TM-22 EPS-XHE-NOREC-7H EPS-XHE-DG23-OB-S-4H EPS-XHE-NOREC-4H 1.8E-08 1.3 EPS-DGN-TM-21 /PPR-SRV-CO-SBO

/RCS-MDP-LK-SEALS ACP-XHE-NOREC-BD EPS-DGN-FR-22 EPS-XHE-NOREC-7H EPS-XHE-DG23-OB-S-4H EPS-XHE-NOREC-4H Event Tree: LOOP, Sequence 19-22 CCDP Percent Contribution Minimal Cut Sets1 2.8E-07 21.5 OEP-XHE-NOREC-ST EPS-DGN-CF-RUN AFW-XHE-XL-TDPFR AFW-TDP-FR-22 EPS-XHE-NOREC-2H 1.1E-07 8.2 OEP-XHE-NOREC-ST EPS-DGN-CF-RUN AFW-TDP-TM-22 EPS-XHE-NOREC-2H 8.1E-08 6.2 OEP-XHE-NOREC-ST EPS-DGN-CF-RUN AFW-XHE-XL-TDPFS AFW-TDP-FS-22 EPS-XHE-NOREC-2H 7.3E-08 5.6 OEP-XHE-NOREC-ST AFW-XHE-XL-TDPFR EPS-DGN-CF-STRT AFW-TDP-FR-22 EPS-XHE-NOREC-2H 5.2E-08 4.0 SWS-MDP-CF-SWESS OEP-XHE-NOREC-ST AFW-XHE-XL-TDPFR AFW-TDP-FR-22 EPS-XHE-NOREC-2H 2.8E-08 2.1 OEP-XHE-NOREC-ST EPS-DGN-CF-STRT AFW-TDP-TM-22 EPS-XHE-NOREC-2H 2.4E-08 1.8 AFW-AOV-CC-1139 OEP-XHE-NOREC-ST EPS-DGN-CF-RUN EPS-XHE-NOREC-2H

LER 247/99-015 16 SENSITIVE - NOT FOR PUBLIC DISCLOSURE Event Tree: LOOP, Sequence 19-22 (Continued)

CCDP Percent Contribution Minimal Cut Sets1 2.4E-08 1.8 OEP-XHE-NOREC-ST EPS-DGN-CF-RUN AFW-XHE-XM-TDP EPS-XHE-NOREC-2H 2.1E-08 1.6 OEP-XHE-NOREC-ST AFW-XHE-XL-TDPFS EPS-DGN-CF-STRT AFW-TDP-FS-22 EPS-XHE-NOREC-2H 2.0E-08 1.5 SWS-MDP-CF-SWESS OEP-XHE-NOREC-ST AFW-TDP-TM-22 EPS-XHE-NOREC-2H 1.9E-08 1.5 EPS-DGN-FR-21 OEP-XHE-NOREC-ST AFW-XHE-XL-TDPFR AFW-TDP-FR-22 EPS-DGN-FR-22 EPS-XHE-NOREC-2H EPS-XHE-DG23-OB-S-2H 1.7E-08 1.3 EPS-DGN-TM-21 OEP-XHE-NOREC-ST AFW-XHE-XL-TDPFR AFW-TDP-FR-22 EPS-DGN-FR-22 EPS-XHE-NOREC-2H EPS-XHE-DG23-OB-S-2H 1.6E-08 1.3 EPS-DGN-FR-21 OEP-XHE-NOREC-ST AFW-XHE-XL-TDPFR AFW-TDP-FR-22 EPS-DGN-TM-22 EPS-XHE-NOREC-2H EPS-XHE-DG23-OB-S-2H 1.5E-08 1.2 SWS-MDP-CF-SWESS OEP-XHE-NOREC-ST AFW-XHE-XL-TDPFS AFW-TDP-FS-22 EPS-XHE-NOREC-2H 1.4E-08 1.1 EPS-DGN-FR-21 OEP-XHE-NOREC-ST AFW-XHE-XL-TDPFR AFW-TDP-FR-22 EPS-DGN-FR-22 EPS-DGN-TM-23 EPS-XHE-NOREC-2H 1.4E-08 1.1 EPS-DGN-TM-21 OEP-XHE-NOREC-ST AFW-XHE-XL-TDPFR AFW-TDP-FR-22 EPS-DGN-FR-22 EPS-DGN-FR-23 EPS-XHE-NOREC-2H 1.4E-08 1.1 EPS-DGN-FR-21 OEP-XHE-NOREC-ST AFW-XHE-XL-TDPFR AFW-TDP-FR-22 EPS-DGN-TM-22 EPS-DGN-FR-23 EPS-XHE-NOREC-2H

LER 247/99-015 17 SENSITIVE - NOT FOR PUBLIC DISCLOSURE Event Tree: LOOP, Sequence 20 CCDP Percent Contribution Minimal Cut Sets1 1.2E-06 100.0 RPS-VCF-FO-MECH 1.

See Table 4 for definitions and probabilities for the basic events.

LER 247/99-015 18 SENSITIVE - NOT FOR PUBLIC DISCLOSURE Table 4. Definitions and Probabilities for Modified or Dominant Basic Events.

Prob./

Modi-Event Name Description Freq.

fied?1 ACP-XHE-NOREC-BD OPERATOR FAILS TO RECOVER AC POWER BEFORE BATTERY DEPLETION 4.0E-003 NO AFW-AOV-CC-1139 FAILURE OF AFW TDP STEAM ADMISSION AOV 1139 1.0E-003 NO AFW-AOV-CF-SGS CCF OF STEAM GENERATOR INLET AOVS (FCVS) 5.8E-006 NO AFW-CKV-CF-PMPS CCF OF AFW PUMP DISCHARGE CHECK VALVES 5.8E-006 NO AFW-CKV-CF-SGS CCF OF STEAM GENERATOR INLET CHECK VALVES 4.2E-006 NO AFW-CKV-CF-SUCT CCF OF AFW PUMP SUCTION CHECK VALVES 5.8E-006 NO AFW-MDP-CF-AB COMMON CAUSE FAILURE OF AFW MOTOR DRIVEN PUMP 6.5E-004 NO AFW-MDP-FR-21 AFW MOTOR-DRIVEN PUMP 21 FAILS TO RUN 4.0E-003 YES AFW-MDP-FR-23 AFW MOTOR-DRIVEN PUMP 23 FAILS TO RUN 4.0E-003 YES AFW-PMP-CF-ALL COMMON CAUSE FAILURE OF AFW PUMPS 3.5E-005 NO AFW-TDP-FR-22 AFW TURBINE DRIVEN PUMP FAILS TO RUN 1.4E-002 NO AFW-TDP-FS-22 AFW TURBINE DRIVEN PUMP FAILS TO START 6.8E-003 NO AFW-TDP-TM-22 AFW TDP UNAVAILABLE DUE TO TEST AND MAINTENANCE 4.5E-003 NO AFW-XHE-XL-TDPFR OPERATOR FAILS TO RECOVER AFW TDP (FAILS TO RUN) 8.3E-001 NO AFW-XHE-XL-TDPFS OPERATOR FAILS TO RECOVER AFW TDP (FAILS TO START) 5.0E-001 NO AFW-XHE-XM-TDP OPERATOR FAILS TO OPEN AND ALIGN TDP DISCHARGE AOVs 1.0E-003 NO CCW-MDP-FC-MDP23 FAILURE OF CCW MDP-23 3.8E-003 CCW-MDP-TM-MDP23 CCW MDP-23 UNAVAILABLE DUE TO TEST & MAINTENANCE 1.1E-002 NO COND-XHE-XM-LOOP-2H OPERATOR FAILS TO ESTABLISH CONDENSATE IN 2 HOURS (LOOP) 4.0E-002 NO COND-XHE-XM-SBO-2H OPERATOR FAILS TO ESTABLISH CONDENSATE IN 2 HOURS (SBO) 4.0E-002 NO COND-XHE-XM-SBO-7H OPERATOR FAILS TO ESTABLISH CONDENSATE IN 7 HOURS (SBO)

TRUE YES EPS-DG23-BREAKER EDG 23 OUTPUT BREAKER FAILS OPEN TRUE YES EPS-DGN-CF-RUN COMMON CAUSE FAILURE OF DIESEL GENERATORS TO RUN 8.4E-004 NO EPS-DGN-CF-STRT COMMON CAUSE FAILURE OF DIESEL GENERATORS TO START 2.2E-004 NO

LER 247/99-015 19 SENSITIVE - NOT FOR PUBLIC DISCLOSURE Table 4. Definitions and Probabilities for Modified or Dominant Basic Events. (Contd)

Prob./

Modi-Event Name Description Freq.

fied?1 EPS-DGN-FR-21 EDG 21 FAILS TO RUN 3.7E-002 NO EPS-DGN-FR-22 EDG 22 FAILS TO RUN 3.7E-002 NO EPS-DGN-FR-23 EDG 23 FAILS TO RUN 3.7E-002 NO EPS-DGN-FR-FTRL DIESEL GENERATOR FAILS TO RUN (14-24 HOURS) 1.3E-004 YES EPS-XHE-DG23-OB-S-4H CAPABILITY TO RECLOSE OUTPUT BREAKER IN 4 HOURS (SBO) 2.2E-002 YES EPS-XHE-DG23-OB-L-4H CAPABILITY TO RECLOSE OUTPUT BREAKER IN 4 HOURS (LOOP)

TRUE YES EPS-XHE-DG23-OB-S-2H CAPABILITY TO RECLOSE OUTPUT BREAKER IN 2 HOURS (SBO) 4.2E-002 YES EPS-XHE-DG23-OB-L-2H CAPABILITY TO RECLOSE OUTPUT BREAKER IN 2 HOURS (LOOP)

TRUE YES EPS-XHE-NOREC-4H OPERATOR FAILS TO RECOVER EDG IN 4 HOURS 5.0E-001 NO EPS-XHE-NOREC-7H OPERATOR FAILS TO RECOVER EDG IN 7 HOURS 4.2E-001 NO HPI-MDP-CF-ALL HPI PUMP COMMON CAUSE FAILURES 1.3E-004 NO HPI-MOV-OC-SUCT HPI SUCTION VALVES FAIL 1.0E-004 NO HPR-MOV-OO-RWST HPI RWST SUCTION MOV FAILS TO CLOSE 3.0E-003 NO HPI-XHE-XM-FB OPERATOR FAILS TO INITIATE FEED

& BLEED COOLING 2.0E-002 NO HPI-XHE-XM-THRTL OPERATOR FAILS TO THROTTLE HPI TO REDUCE PRESSURE 2.0E-003 YES HPR-MOV-OO-RWST HPI RWST SUCTION MOV FAILS TO CLOSE 3.0E-003 NO HPR-XHE-XM OPERATOR FAILS TO INITIATE HPR 2.0E-003 YES HPR-XHE-XM1 OPERATOR FAILS TO INITIATE HPR (DEPENDENT) 5.1E-002 NO IE-LDC22 LOSS OF DC BUS 22 INITIATING EVENT 0.0E+000 YES IE-LDC24 LOSS OF DC BUS 24 INITIATING EVENT 0.0E+000 YES IE-LLOCA LARGE LOSS OF COOLANT ACCIDENT 0.0E+000 YES IE-LOCCW LOSS OF COMPONENT COOLING WATER INITIATING EVENT 0.0E+000 YES IE-LOOP LOSS OF OFFSITE POWER INITIATING EVENT 1.0E+000 YES IE-LOSWS LOSS OF SERVICE WATER INITIATING EVENT 0.0E+000 YES IE-MLOCA MEDIUM LOSS OF COOLANT ACCIDENT 0.0E+000 YES IE-RHR-DIS-V RHR DISCHARGE ISLOCA INITIATING EVENT 0.0E+000 YES IE-RHR-SUC-V RHR SUCTION ISLOCA INITIATING EVENT 0.0E+000 YES

LER 247/99-015 20 SENSITIVE - NOT FOR PUBLIC DISCLOSURE Table 4. Definitions and Probabilities for Modified or Dominant Basic Events. (Contd)

Prob./

Modi-Event Name Description Freq.

fied?1 IE-SGTR STEAM GENERATOR TUBE RUPTURE 0.0E+000 YES IE-SI-CLDIS-V SI COLD LEG ISLOCA INITIATING EVENT 0.0E+000 YES IE-SI-HLDIS-V SI HOT LEG ISLOCA INITIATING EVENT 0.0E+000 YES IE-SLOCA SMALL LOSS OF COOLANT ACCIDENT 0.0E+000 YES IE-TRANS TRANSIENT INITIATING EVENT 0.0E+000 YES LOSP-2A LOSS OF DIV 2A OFFSITE POWER FALSEYES LOSP-5A LOSS OF DIV 5A OFFSITE POWER FALSEYES LOSP-6A LOSS OF DIV 6A OFFSITE POWER FALSEYES MFW-SYS-TRIP MAIN FEEDWATER SYSTEM UNAVAILABLE GIVEN REACTOR TRIP TRUE YES MFW-SYS-UNAVAIL MAIN FEEDWATER SYSTEM UNAVAILABLE TRUE YES MFW-XHE-ERROR OPERATOR FAILS TO RESTORE MFW FLOW TRUE YES MFW-XHE-NOREC OPERATOR FAILS TO RECOVER MFW FLOW TRUE YES OEP-XHE-NOREC-2H OPERATOR FAILS TO RECOVER OFFSITE POWER IN 2 HOURS FALSEYES OEP-XHE-NOREC-6H OPERATOR FAILS TO RECOVER OFFSITE POWER IN 6 HOURS FALSEYES OEP-XHE-NOREC-LOOP-4H OPERATOR FAILS TO RECOVER OFFSITE POWER IN 4 HOURS (LOOP) 4.0E-003 NO OEP-XHE-NOREC-LOOP-2H OPERATOR FAILS TO RECOVER OFFSITE POWER IN 2 HOURS (LOOP) 4.0E-002 NO OEP-XHE-NOREC-SBO-4H OPERATOR FAILS TO RECOVER OFFSITE POWER IN 4 HOURS (SBO) 4.0E-003 NO OEP-XHE-NOREC-SBO-2H OPERATOR FAILS TO RECOVER OFFSITE POWER IN 2 HOURS (SBO)

IGNORE YES OEP-XHE-NOREC-SL OPERATOR FAILS TO RECOVER OFFSITE POWER (SEAL LOCA)

FALSEYES OEP-XHE-NOREC-ST OPERATOR FAILS TO RECOVER OFFSITE POWER IN SHORT TERM 4.0E-002 NO OEP-XHE-XM-GT2 OPERATOR FAILS TO START AND ALIGN GAS TURBINE IN 2 HOURS IGNORE YES OEP-XHE-XM-GT6 OPERATOR FAILS TO START AND ALIGN GAS TURBINE IN 6 HOURS IGNORE YES OEP-XHE-XM-GTBD OPERATOR FAILS TO START AND ALIGN GAS TURBINES BEFORE BATTERY DEPLETION IGNORE YES

LER 247/99-015 21 SENSITIVE - NOT FOR PUBLIC DISCLOSURE Table 4. Definitions and Probabilities for Modified or Dominant Basic Events. (Contd)

Prob./

Modi-Event Name Description Freq.

fied?1 OEP-XHE-XM-GTSL OPERATOR FAILS TO START AND ALIGN GAS TURBINE DURING SEAL LOCA IGNORE YES OEP-XHE-XM-GTST OPERATOR FAILS TO START AND ALIGN GAS TURBINE IN SHORT TERM IGNORE YES PCS-XHE-XM-CDOWN OPERATOR FAILS TO INITIATE COOLDOWN 2.0E-003 YES PCS-XHE-XO-SECL OPERATOR FAILS TO ESTABLISH SECONDARY COOLING DURING LOOP TRUE YES PPR-MOV-FC-BLK1 PORV 1 (455C) BLOCK VALVE 535 CLOSED DURING POWER OPERATION TRUE NO PPR-MOV-FC-BLK2 PORV 2 (456) BLOCK VALVE 536 CLOSED DURING POWER OPERATION TRUE NO PPR-MOV-OO-BLK1 PORV 1 (455C) BLOCK VALVE 535 FAILS TO CLOSE 3.0E-003 NO PPR-MOV-OO-BLK2 PORV 2 (456) BLOCK VALVE 536 FAILS TO CLOSE 3.0E-003 NO PPR-SRV-CC-2 PORV 2 (456) FAILS TO OPEN ON DEMAND 6.3E-003 NO PPR-SRV-CO-L PORVs/SRVs OPEN DURING LOOP 4.0E-002 NO PPR-SRV-CO-SBO PORVs/SRVs OPEN DURING STATION BLACKOUT 4.0E-002 NO PPR-SRV-OO-1 PORV 1 (455C) FAILS TO RECLOSE AFTER OPENING 3.0E-002 NO PPR-SRV-OO-2 PORV 2 (456) FAILS TO RECLOSE AFTER OPENING 3.0E-002 NO PPR-XHE-XM-BLK OPERATOR FAILS TO CLOSE BLOCK VALVES 2.0E-003 NO RCS-MDP-LK-SEALS RCP SEALS FAIL W/O COOLING AND INJECTION 1.0E-001 YES RHR-XHE-XM OPERATOR FAILS TO INITIATE RHR SYSTEM 2.0E-003 YES RPS-VCF-FO-MECH CONTROL ROD ASSEMBLIES FAIL TO INSERT 1.2E-006 NO SSS-XHE-ALIGN-L-2H FAILURE TO ALIGN ALTERNATE SAFE SHUTDOWN POWER (LOOP 2 HOURS)

TRUE YES SSS-XHE-ALIGN-S-2H FAILURE TO ALIGN ALTERNATE SAFE SHUTDOWN POWER (SBO 3 HOURS)

TRUE YES SSS-XHE-ALIGN-S-6H FAILURE TO ALIGN ALTERNATE SAFE SHUTDOWN POWER (SBO 6 HOURS)

TRUE YES SWS-MDP-CF-FRALL CCF OF SWS PUMPS TO RUN 4.1E-006 YES SWS-MDP-CF-FSALL CCF OF SWS PUMPS TO START 4.0E-006 YES 1.

NOTE: The bases for the probability values which were modified specifically for this analysis are discussed in Attachment 1.

LER 247/99-015 22 SENSITIVE - NOT FOR PUBLIC DISCLOSURE ATTACHMENT 1 MODIFICATIONS TO THE REVISION 3 SPAR MODEL FOR INDIAN POINT 2 FOR REVISED FINAL ANALYSIS OF THE AUGUST 31, 1999 LOSS OF OFFSITE POWER EVENT This attachment presents in tabular form the modifications to the Revision 3 SPAR model for Indian Point 2 which were made to perform the revised final analysis. It also describes the changes that were made to address comments on the preliminary analysis which were received from the licensee and those that were made to address comments on the original final analysis which were received from Region I. Table A1-1 summarizes the major changes made to the Revision 3 SPAR model. Table A1-2 identifies the modifications which were made to the event trees for the front line and support systems to perform the analysis. Tables A1-3a and A1-3b present the a.c. power dependencies associated with the model changes identified in Table A1-2 for the LOOP Event Tree and the Station Blackout Event Tree, respectively. Table A1-4 compares the failure and non-recovery probabilities for key AFW system components used in the original final analysis, the as-produced Revision 3 SPAR model for Indian Point 2, the RES report on AFW unreliability (NUREG-5500, Volume 1), and the Indian Point 2 Revision 3 SPAR model as modified for the revised final analysis. A number of technical issues were identified based on comments which Region I provided on the original final analysis of this event. These issues are presented in Table A1-5. This table also identifies how each issue was considered in the original final analysis versus the revised final analysis and the basis for any difference in the treatment. A number of the assumptions used in estimating the equipment failure probabilities and human error probabilities for the revised final analysis were based on specific values of time to core uncovery. These values are summarized in Table A1-6. They were obtained from the Indian Point 3 Individual Plant Examination (IPE), and are based on thermal-hydraulic analyses. Table A1-7 identifies the basic events whose associated probabilities were either updated (with more recent operating experience data) or changed in the analysis of this event. Finally, Table A1-8 shows the basic event probabilities which were used in the sensitivity study performed to address the comment received from Region I regarding the performance of the operators at Indian Point 2. The values of these probabilities used for each of the three cases examined in this specific sensitivity study are compared in Table A1-8 with the corresponding values that were used in the original final analysis. Finally, Table A1-9 presents the results of the sensitivity study which was performed to assess the effect of the operator performance issue raised by Region I in a comment on the original final analysis of this event.

LER 247/99-015 23 SENSITIVE - NOT FOR PUBLIC DISCLOSURE Table A1-1. Summary of Revision 3 SPAR Model Changes.

Change Details NOTE: Changes made resulted in a model specific for this initiating event only.

1 Incorporated Rhodes RCP seal LOCA model 2 Credit EDG 23 output breaker recovery at the sequence level: different non-recovery probabilities for LOOP and SBO sequences, and 2-hr and 4-hr sequences

Created sequence-specific fault trees for EDG 23 with sequence-specific output breaker non-recovery probability included in the trees.

3 Credit EDG recovery (repair) at the sequence level: different non-recovery probabilities for 2-hr and 4-hr sequences

No credit for ac power recovery for feed and bleed systems due to short time to initiate Feed

&Bleed.

Added non-recovery probabilities to the bus fault trees (see bus fault tree modifications).

4 Credit offsite power recovery at the sequence level: different non-recovery probabilities for LOOP and SBO sequences, and 2-hr, 4-hr, and 6-hr sequences

No credit for ac power recovery for feed and bleed (F&B) systems due to short time to initiate F&B (Sequence 17); however, recovery was credited for HPI injection for stuck-open safety valve (Sequence 10).

Added non-recovery probabilities tot the bus fault trees (see bus fault tree modifications).

Top events OP-2H and OP-6H set to FALSE--

avoid double crediting offsite power recovery.

No credit for offsite power recovery in the AFW fault tree in the SBO event treeavoid double crediting offsite power recovery.

5 Credit ASSS for MD-AFW pump 21 at the sequence level: different non-recovery probabilities for LOOP and SBO sequences, and 2-hr and 4-hr.

No credit for ASSS after battery depletion due to lack of instrumentation.

Modified AFW fault tree for LOOP and SBO event trees.

6 Credit condensate injection as alternate to auxiliary feedwater at the sequence level:

different non-recovery probabilities for LOOP and SBO sequences

No credit for condensate injection after battery depletion due to lack of instrumentation, but did give credit for SBO case, because offsite power to 6.9 kV buses was available during the event.

Modified AFW fault tree for LOOP and SBO event trees.

LER 247/99-015 24 SENSITIVE - NOT FOR PUBLIC DISCLOSURE Change Details 7 Created new sets of 480 v bus fault trees with sequence-specific EDG, EDG 23 output breaker, and offsite power non-recovery probabilities

For LOOP sequences, complete full fault trees were created for 2-hr and 4-hr core uncovery times (non-recovery probability is dependent on the core uncovery time).

For SBO sequences, partial fault trees for buses 2A/3A (EDG 22), and 5A (EDG 21) were created for 2-hr and 4-hr core uncovery times. Since the EP top event in the LOOP event tree accounted for the failure modes (FTS, FTR, MOOS) for EDGs 21 and 22, only the ac recovery must be modeled in fault trees associated with SBO sequences.

ExceptionSince EDG-23 is set to TRUE due to the failed open breaker, all failure modes for EDG-23 must be modeled in fault trees associated with SBO sequences.

8 Removed all event tree links in LOOP event tree; add new link for HPI-LOOP-FB to HPI branch in LOOP sequence 17

Fault tree HPI-LOOP-FB does not credit ac power recovery due to short Feed & Bleed Cooling initiation times.

Fault tree HPI-LOOP-2H does credit ac power recovery for the stuck-open PORV (Sequence 10).

Table A1-2. Event Tree Modifications.

FRONT-LINE SYSTEMS Loss of Offsite Power (non-SBO) Event Tree Station Blackout Sub-Tree EP

Modify existing fault tree---Replace with:

(EP-DGN21 + EP-DGN22 + EP-DGN23)

(no credit for recovery or DGN23 breaker reclose )

No change to parent node names required AFW-LOOP (New)

(2 hr recovery time)

Add new power fault trees

- DIV-3A-AC-LOOP-2H to AFW-MDP21-LOOP

- DIV-6A-AC-LOOP-2H to AFW-MDP23-LOOP

Changed event name from SSS-XHE-XE-ALIGN to SSS-XHE-ALIGN-L-2H

Add new subtree to top node: (COND-XHE-XE-LOOP-2H) * (BLEED-1-LOOP + BLEED-2-LOOP)

Replace this tree at the top event

Change node names of parent nodes by adding

-LOOP at the end of the name AFW

(2 hr recovery time)

Note: OEP-ST credits ac power recovery; therefore, power to pumps does not need LOOP non-recovery

- Replace DIV-3A-AC to AFW-MDP21 with EPS-XHE-NOREC-2H

- Replace DIV-6A-AC to AFW-MDP23 with EP-DGN23-SBO-2H

Add new subtree to top node: (COND-XHE-XE-SBO-2H) * (BLEED-1-SBO + BLEED-2-SBO)

Changed event name from SSS-XHE-XE-ALIGN to SSS-XHE-ALIGN-S-2H

No change to parent node names required

LER 247/99-015 25 SENSITIVE - NOT FOR PUBLIC DISCLOSURE FRONT-LINE SYSTEMS (Continued)

Loss of Offsite Power (non-SBO) Event Tree Station Blackout Sub-Tree BLEED

(1/2-hr recovery time)

Note: No time for recovery of power to block valves (valve closed during power operations); therefore, no credit for LOOP included in power tree (shortcut by adding EDG tree to PORV block valves)

Modify existing fault tree

- BLEED-5 = EP-DGN23 <OR> PPR-MOV-CC-BLK1

- BLEED-6 = EP-DGN21 <OR> PPR-MOV-CC-BLK2

No change to parent node names required OEP-ST

(2 hr recovery time)

Modify existing fault tree

- Add EP-DGN23-SBO-2H

No change to parent node names required SEALLOCA

No change to fault tree OP-SL

No change to fault tree, but the single basic event is set to FALSE for Rhodes model HPI-LOOP-2H (New)

(2 hr recovery time for injection mode onlyno F&B-

--with AFW available)

Add new power fault trees

- DIV-5A-AC-LOOP-2H to HPI-MDP21-LOOP-2H

- DIV-2A-AC-LOOP-2H to HPI-MDP22-LOOP-2H

- DIV-6A-AC-LOOP-2H to HPI-MDP23-LOOP-2H

Replace this tree as the top event

Change node names of parent nodes by adding

-LOOP-2H at the end of the name

Remove Event Tree Link (HPI-L) to sequences 10 and 17 ACP-BD

(7 hr recovery time)

Modify existing fault tree---Add new basic events to top event:

- COND-XHE-XM-7H (event-specific)

- SSS-XHE-ALIGN-S-6H (IP2 specific)

- EPS-DGN-NOREC-7H = 0.42 (this is an adjustment to account for the 4-hr non-recovery probability in EP-DGN23-SBO-4H, below.

Add subtree to top node:

EP-DGN23-SBO-4H

No change to parent node names required HPI-FB (New)

(1/2 hour recovery time)

Note: No time to restore power (offsite or EDG recovery) to HPI system (shortcut by adding EDG tree to HPI pumps)

Add new power fault trees

- EP-DGN21 to HPI-MDP21-LOOP-FB

- EP-DGN22 to HPI-MDP22-LOOP-FB

- EP-DGN23 to HPI-MDP23-LOOP-FB

Add to Event Tree Link rule to sequence 17

Change node names of parent nodes by adding

-LOOP-FB at the end of the name HPI

(4 hr recovery time)

No change to fault tree. (The modified DIV-XX-AC trees credit ac power recovery based on 4-hr recovery time during SBO.)

No change to parent node names required OP-2H

Set OEP-XHE-NOREC-2H to False

Note: Recovery of offsite power is credited in top events down the sequence OP-6H

Set OEP-XHE-NOREC-6H to False

Note: Recovery of offsite power is credited in top events down the sequence. Also, this is not a 6-hour sequence; it is a 3-hour RWST depletion sequence.

LER 247/99-015 26 SENSITIVE - NOT FOR PUBLIC DISCLOSURE FRONT-LINE SYSTEMS (Continued)

Loss of Offsite Power (non-SBO) Event Tree Station Blackout Sub-Tree SGCOOL-L

(4 hr recovery time)

Replace this tree as the top event (Note: This is an existing tree used in rules)

Add new power fault trees

- DIV-5A-AC-LOOP-4H to SGCL-PRV-BLK-1L

- DIV-6A-AC-LOOP-4H to SGCL-PRV-BLK-2L

PCS-XHE-XO-SECL is set to TRUE

Remove Event Tree Link (SGCOOL-L) to sequences 15/16

No change to parent node names required COOLDOWN-L (New)

(4 hr recovery time)

Add new power fault tree

- DIV-2A-AC-LOOP-4H to COOLDOWN-3-LOOP

Replace this tree as the top event

Change node names of parent nodes by adding

-LOOP at the end of the name COOLDOWN

(4 hr recovery time)

No change to fault tree. (The modified DIV-XX-AC trees credit ac power recovery based on 4-hr recovery time during SBO.)

No change to parent node names required RHR-LOOP (New)

(4 hr recovery time)

New fault tree replaces RHRnew subtrees must be created:

- RHR-HTX21-LOOP

- RHR-HTX22-LOOP

- RHR-MDP21-LOOP

- RHR-MDP22-LOOP

Add new power fault tree to main and subtrees

- DIV-xx-AC-LOOP-4H

Replace this tree as the top event

Change node names of parent nodes by adding

-LOOP at the end of the name RHR

(4 hr recovery time)

No change to fault tree. (The modified DIV-XX-AC trees credit ac power recovery based on 4-hr recovery time during SBO.)

No change to parent node names required HPR-LOOP (New)

(4 hr recovery time)

New fault tree replaces HPRnew subtrees must be created:

- HPR-PATH-LOOP

- REC-MDPxx-LOOP

- HPI-MDPxx-LOOP-4H

Add new power fault tree to main and subtrees

- DIV-xx-AC-LOOP-4H

Replace this tree as the top event

Change node names of parent nodes by adding

-LOOP at the end of the name

Remove Event Tree Link (HPR-L) to sequences 9 and 16 HPR

(4 hr recovery time)

No change to fault tree. (The modified DIV-XX-AC trees credit ac power recovery based on 4-hr recovery time during SBO.)

No change to parent node names required

LER 247/99-015 27 SENSITIVE - NOT FOR PUBLIC DISCLOSURE SUPPORT SYSTEMS Loss of Offsite Power (non-SBO)

Station Blackout EP-DGNxx-LOOP-2H (New)

(2 hr recovery time)

New fault trees for EDGs 21, 22, 23 that model breaker, EDG, and offsite power non-recoveries.

- Add new event EPS-XHE-NOREC-2H to EP-DGNxx-LOOP-2H

- Add new subtree to EP-DGN23-1-LOOP-2H:

(EPS-DG23-BREAKER + EPS-XHE-DGN23-OB-L-2H)

Change node names of parent nodes by adding

-LOOP-2H at the end of the name EP-DGN23-SBO-2H (New)

(2 hr recovery time)

New fault tree for EDG 23 that models breaker, EDG, and offsite power non-recoveries. EDG unavailability (no recovery) for EDGs 21 and 22 already accounted in EP top event in the LOOP event tree.

- Add new event EPS-XHE-NOREC-2H

- Add new subtree to EP-DGN23-1-SBO-2H:

(EPS-DG23-BREAKER + EPS-XHE-DGN23-OB-S-2H)

Change node names of parent nodes by adding

-SBO-2H at the end of the name EP-DGNxx-LOOP-4H (New)

(4 hr recovery time)

New fault trees for EDGs 21, 22, 23 that model breaker, EDG, and offsite power non-recoveries.

- Add new event EPS-XHE-NOREC-4H to EP-DGNxx-LOOP-4H

- Add new subtree to EP-DGN23-LOOP-4HEPS-DG23-BREAKER + EPS-XHE-DGN23-OB-L-4H

Change node names of parent nodes by adding

-LOOP-4H at the end of the name EP-DGN23-SBO-4H (New)

(4 hr recovery time)

New fault tree for EDG 23 that models breaker, EDG, and offsite power non-recoveries. EDG unavailability (no recovery) for EDGs 21 and 22 already accounted for in EP top event in the LOOP event tree.

- Add new event EPS-XHE-NOREC-4H

- Add new subtree to EP-DGN23-1-SBO-4H:

(EPS-DG23-BREAKER + EPS-XHE-DGN23-OB-S-4H)

Change node names of parent nodes by adding

-SBO-4H at the end of the name DIV-2A-AC-LOOP-2H (New)

DIV-3A-AC-LOOP-2H (New)

DIV-5A-AC-LOOP-2H (New)

DIV-6A-AC-LOOP-2H (New)

(2 hr recovery time)

Add new event OEP-XHE-NOREC-LOOP-2H to

- DIV-2A-AC-LOOP-2H

- DIV-5A-AC-LOOP-2H

- DIV-6A-AC-LOOP-2H

Add new trees EPS-DGNxx-LOOP-2H

Remove flag node LOSP-XX

Change node names of parent nodes by adding

-LOOP-2H at the end of the name DIV-2A-AC-SBO-2H (New)

DIV-3A-AC-SBO-2H (New)

DIV-5A-AC-SBO-2H (New)

DIV-6A-AC-SBO-2H (New)

(2 hr recovery time)

Create new trees: DIV-2A-AC-SBO-2H and DIV-5A-AC-SBO-2H

- Add new event OEP-XHE-NOREC-SBO-2H

- Add new event EPS-XHE-NOREC-2H

- Remove flag node LOSP-XX

Create new tree: DIV-6A-AC-SBO-2H

- Add new event OEP-XHE-NOREC-SBO-2H

- Add new tree EP-DGN23-SBO-2H

- Remove flag node LOSP-XX

Change node names of parent nodes by adding

-SBO-2H at the end of the name

LER 247/99-015 28 SENSITIVE - NOT FOR PUBLIC DISCLOSURE SUPPORT SYSTEMS (Continued)

Loss of Offsite Power (non-SBO)

Station Blackout DIV-2A-AC-LOOP-4H (New)

DIV-3A-AC-LOOP-4H (New)

DIV-5A-AC-LOOP-4H (New)

DIV-6A-AC-LOOP-4H (New)

(4 hr recovery time)

Add new event OEP-XHE-NOREC-LOOP-4H to

- DIV-2A-AC-LOOP-4H

- DIV-5A-AC-LOOP-4H

- DIV-6A-AC-LOOP-4H

Add new trees EP-DGNxx-LOOP-4H

Remove flag node LOSP-XX

Change node names of parent nodes by adding

-LOOP-4H at the end of the name DIV-2A-AC DIV-5A-AC DIV-6A-AC

(4 hr recovery time)

Modify existing fault trees for DIV-2A-AC and DIV-5A-AC

- Add new event OEP-XHE-NOREC-SBO-4H

- Replace EP-DGN21, 22 with EPS-XHE-NOREC-4H

- Remove flag node LOSP-XX

Modify existing fault trees for DIV-6A-AC

- Add new event OEP-XHE-NOREC-SBO-4H

- Replace EP-DGN23 WITH new tree EP-DGN23-SBO-4H

- Remove flag node LOSP-XX

No change to parent node names required DIV-xx-DC

No change to bus trees (uses SBO 4-H tree)

DIV-xx-DC

No change to bus trees (uses SBO 4-H tree)

CCW

No change to bus trees (uses SBO 4-H tree)

CCW

No change to bus trees (uses SBO 4-H tree)

PAB

No change to bus trees (uses SBO 4-H tree)

PAB

No change to bus trees (uses SBO 4-H tree)

EP-DG-VENT

Remove EDG power source subtrees (EP-DG-FANxxx-yyy)

Change top node logic to 5 of 6 (OR gate)

EP-DG-VENT

Remove EDG power source subtrees (EP-DG-FANxxx-yyy)

Change top node logic to 5 of 6 (OR gate)

LER 247/99-015 29 SENSITIVE - NOT FOR PUBLIC DISCLOSURE Table A1-3a. LOOP Event TreeAC Power Dependencies (This information provided in Table A1-2).

Top Event New Core Uncovery Time (hours)

Offsite power recovery EDG recovery Bus Type EDG Type EP no various no no n/a EP-DGNxx AFW-LOOP yes 2

yes yes DIV-xx-AC-LOOP-2H (EP-DGNxx-LOOP-2H)

BLEED no 0.5 no no n/a EP-DGNxx HPI-LOOP yes 2

yes yes DIV-xx-AC-LOOP-2H (EP-DGNxx-LOOP-2H)

HPI-FB yes 0.5 no no n/a EP-DGNxx OP-2H no Set OEP-XHE-NOREC-2H to FALSE (offsite power recovery included at the system level)

OP-6H no Set OEP-XHE-NOREC-6H to FALSE (offsite power recovery included at the system level)

SGCOOL no 4

yes yes DIV-xx-AC-LOOP-4H (EP-DGNxx-LOOP-4H)

COOLDOWN-L yes 4

yes yes DIV-2A-AC-LOOP-4H (EP-DGN2A-LOOP-2H)

RHR-LOOP yes 4

yes yes DIV-xx-AC-LOOP-4H (EP-DGNxx-LOOP-4H)

HPR-LOOP yes 4

yes yes DIV-xx-AC-LOOP-4H (EP-DGNxx-LOOP-4H)

AC Power Event Trees EP-DGNxx no n/a no no EP-DGNxx-LOOP-2H yes 2-hr recovery time n/a yes EP-DGNxx-LOOP-4H yes 4-hr recovery time n/a yes

LER 247/99-015 30 SENSITIVE - NOT FOR PUBLIC DISCLOSURE Table A1-3b. SBO Event TreeAC Power Dependencies (This information provided in Table 2).

Top Event New Core Uncovery Time (hours)

Offsite power recovery EDG recovery Bus Type EDG Type AFW no 2

no yes n/a EP-DGNxx-SBO-2H PORV-RES no 2

yes yes DIV-xx-AC-SBO-2H (EP-DGNxx-SBO-2H)

OEP-ST no 2

yes yes OEP-XHE-NOREC-ST (basic event)

EPS-DGN-NOREC-2H (basic event)

OP-SL no Set to FALSE (Rhodes model)

OEP-BD no 7

yes yes ACP-XHE-NOREC-BD (basic event)

EPS-DGN-NOREC-7H (basic event)

HPI no 4

(injection) yes yes DIV-xx-AC-SBO-4H (EP-DGNxx-SBO-4H)

COOLDOWN no 4

yes yes DIV-xx-AC-SBO-4H (EP-DGNxx-SBO-4H)

RHR no 4

yes yes DIV-xx-AC-SBO-4H (EP-DGNxx-SBO-4H)

HPR no 4

yes yes DIV-xx-AC-SBO-4H (EP-DGNxx-SBO-4H)

AC Power Event Trees EP-DGNxx no n/a no no EP-DGNxx-SBO-2H yes 2-hr recovery time n/a yes EP-DGNxx-SBO-4H yes 4-hr recovery time n/a yes

LER 247/99-015 31 SENSITIVE - NOT FOR PUBLIC DISCLOSURE Table A1-4. Comparison of AFW Failure and Non-Recovery Probabilities.

Motor-driven pump Turbine-driven pump Original Final Analysis Rev. 3 SPAR Model NUREG Modified Model Original Final Analysis Rev. 3 SPAR Model NUREG NUREG+

RADS Modified model MOOS na 1.1e-03 2.3e-03 1.1e-03 na 7.8e-03 7.8e-03 7.8e-03 4.5e-03 incl recov Recovery na na 5.0e-01 na na na 5.8e-01 5.8e-01 na FTS 3.0e-03 8.1e-02 1.9e-02 IP2-specific 1.9e-02 3.0e-02 6.8e-03 2.7e-02 6.8e-03 6.8e-03 Recovery 5.8e-01 2.1e-01 2.1e-01 2.1e-01 5.8e-01 na 5.0e-01 5.0e-01 5.0e-01 FTR 3.0e-05 per hour 3.3e-04 per hr 7.6e-04 3.3e-04 per hr 1.0e-04 per hour 1.19e-3 per hour 4.3e-03 1.19e-3 per hour 1.19e-3 per hour Mission time 2.4e+01 2.4e+01 na 1.2e+01 2.4e+01 2.4e+01 na 1.2e+01 1.2e+01 Recovery 5.8e-01 7.5e-01 7.5e-01 7.5e-01 5.8e-01 na 8.3e-01 8.3e-01 8.3e-01 Steam valve na na na na na 1.0e-03 1.4e-03 1.4e-03 1.0e-03 incl recov Recovery na na na na na na 7.5e-01 7.5e-01 na Failure Probability (w/o recovery) 3.7e-03 9.0e-02 2.2e-02 2.4e-02 3.2e-02 4.4e-02 4.1e-02 3.0e-02 2.7e-02 Failure Probability (w/recovery) 2.2e-03 2.4e-02 5.7e-03 8.1e-03 1.9e-02 4.4e-02 2.3e-02 2.1e-02 2.1e-02 CCF Motor-Driven pumps 2.0e-04 2.5e-03 CCF Pumps (ALL) 5.6e-05 3.5e-05 Note: AFW TD pump MOOS includes recovery (not modeled separately in Revision 3 SPAR Model)

LER 247/99-015 32 SENSITIVE - NOT FOR PUBLIC DISCLOSURE Table A1-5. Region I Issues Addressed in Original ASP Analysis and Revised Best Estimate Region I Issue ASP Analysis Basis Original Final Revised Best Est SPAR Model Used Rev. 2QA Rev. 3 Modified to incorporate Rhodes Reactor Coolant Pump Seal (RCP) Seal LOCA Model Revision 3 SPAR model includes SWS & CCW; Revision 2QA SPAR model does not.

Operator Performance Nominal See basis>>

Failure probabilities of operator actions calculated using HRA worksheet for three cases. Based on INEEL input, specific to IP2 conditions, the specific performance shaping factors (PSFs) adjusted are Experience/Training (PSF level = Low) and Work Processes (PSF level = Poor). The three cases:

Lower bound--Nominal (no adjustments)

Best estimate--Adjustments for diagnosis activities only Upper bound--Adjustments for diagnosis activities and for non-EOP guided actions.

Credit MFW Following Trip Yes No MFW would most likely be available for at least a couple of hours following the tripone pump turbine oil pump is dc-powered; feedwater regulating valves are powered from batteries; however, either main steam depletion or battery depletion will eventually fail MFW.

Sensitivity analysis shows this change has a negligible importance.

Credit Condensate Injection as Alternate to AFW No Yes Condensate injection is an alternate to AFW per EOP FR-H.1 (Response to Loss of Secondary Heat Sink).

Credit ASSS within 2 hrs as Alternate to AFW Yes No Due to poor operator performance issue, HRA calculations result in a estimated failure probability of 1.0.

Sensitivity analysis shows this change has a negligible importance.

Credit ASSS (or anything) at Battery Depletion Yes No Losses of motor control, flow control, and indication upon battery depletion make this alternate success path not available.

Sensitivity analysis shows this change has a relatively minor importance.

LER 247/99-015 33 SENSITIVE - NOT FOR PUBLIC DISCLOSURE Region I Issue ASP Analysis Basis Original Final Revised Best Est Feed & Bleed (F&B) Initiation Times Credit LOOP and EDG Recovery in F&B Sequences 2 hrs Yes 0.5 hr No Feed & Bleed Cooling must be initiated within 30 minutes following loss of feedwaterbased on thermal-hydraulics analysis using MAPP.

Short time makes LOOP and EDG recovery unlikely for HPI and bleed systems.

This change has a relatively minor importance.

Offsite Power Recovery during Non-SBO LOOP 2-hr and 4-hr Sequences Yes No EOP E-0 will identify the need to restore power to a bus needed for HPI injection (LOCA sequences).

EOP FR-H.1 will identify the need to restore power to buses needed for Feed & Bleed Cooling (loss of heat sink sequences). Operator can walk through E-0 and FR-H.1 within several minutes. AOI 27.1.1 (Loss of Normal Station Power) can be completed within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . Safety systems initiated within 1/2 hr.

Recovery of EDG 23 Output Breaker during Non-SBO LOOP Sequences Yes No For SBO, EOP ECA-0.0 instructs the operators to place loads in pull-to-lock; therefore, the breaker (w/

the low overcurrent trip setpoint) will not trip open during start up of the loads.

For non-SBO LOOP sequences (w/ one EDG loaded),

EOP ECA-0.0 will not be entered and loads not placed in pull-to-lock. When breaker is re-closed, the overcurrent conditions will most likely result in the breaker tripping open for the second time.

Given that sensitivity analysis showed this recovery action had a minor significance, the recovery feasibility was not examined any further.

LER 247/99-015 34 SENSITIVE - NOT FOR PUBLIC DISCLOSURE Table A1-6. Core uncovery times. [From Indian Point 3 Individual Plant Examination (IPE), Appendix B, Thermal-Hydraulic Analyses]

Loss of all feedwater

Feed & Bleed Cooling must be initiated in about 1/2 hour.

AFW must be restored in about 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months .

RWST is depleted in about 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months during Feed & Bleed Coolingusing both PORVs (required) and 3 HPI pumps.

HPR must be initiated in about 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months .

Stuck-open pressurizer power-operated relief valve (PORV) results in core uncovery in about 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months .

HPI and AFW must be recovered in about 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months .

RWST deletes in about 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months given a stuck-open PORV or an RCP seal LOCA.

HPR must be initiated in about 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months .

LER 247/99-015 35 SENSITIVE - NOT FOR PUBLIC DISCLOSURE Table A1-7. Basic event updates and changes.

Parameter Original ASP Analysis Best Est Value Basis ACP-XHE-NOREC-BD 1E-2 see Table 6

Operator fails to restore offsite power within 7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months following an SBObased on SPAR HRA worksheets. (See OEP-XHE-NOREC-SBO-4H)

AFW-MDP-FS-21, 23 3e-3 1.9e-2 Motor-driven AFW FTSFrom NUREG/CR-5500, Vol 1, Indian Point 2-specific.

AFW-MDP-FR-21, 23 3e-5/hr 24-hr mission time 3.3e-4/hr 12-hr mission time Motor-driven AFW FTR---calculated for a 12-hour mission time corresponding to the actual time for LOOP restoration. Lambda is from the Revision 3 SPAR model, which is based on NUREG/CR-5500, Vol. 1.

Note: This value is slightly conservative for SBO sequences where offsite power can be restored within 5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months with a 95% confidence.

AFW-TDP-FR-22 1e-4/hr 24-hr mission time 1.2e-3/hr 12-hr mission time AFW TD Pump fails to runcalculated for a 12-hour mission time corresponding to the actual time for LOOP restoration. Lambda is from the Revision 3 SPAR model, which is based on data from RADS.

AFW-MDP-TM-21, 23 none 1.1e-3 AFW MD pump unavailable due to test and maintenanceFrom the Revision 3 SPAR model, which is based on NUREG/CR-5500, Vol. 1., with non-recovery applied.

AFW-MDP-TM-21, 23 none 4.5e-3 AFW MD pump unavailable due to test and maintenanceFrom NUREG/CR-5500, Vol. 1, with non-recovery applied.

AFW non-recovery 0.58 various Non-recovery of various failure modes from Revision 3 SPAR model, which is based on NUREG/CR-5500, Vol. 1. Recovery actions only include those possible from the control room (e.g.,

restart pump, open valve).

COND-XHE-XM-LOOP-2H not in model See Table A-7 Operator fails to establish condensate flow within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months following loss of all feedwater during LOOPRevision 3 SPAR model update based on the SPAR HRA worksheets.

Added new event to fault tree AFW-LOOP (new).

COND-XHE-XM-SBO-2H not in model See Table A-7 Operator fails to establish condensate flow within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months following loss of all feedwater during SBORevision 3 SPAR model update based on the SPAR HRA worksheets.

Added new event to fault tree AFW (existing).

COND-XHE-XM-SBO-7H not in model TRUE Operator fails to establish condensate flow within 7 hour8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months sSet to TRUE given battery depletion and loss of control and indication.

Added to existing fault tree OEP-BD.

EPS-DG23-BREAKER TRUE TRUE

LER 247/99-015 36 SENSITIVE - NOT FOR PUBLIC DISCLOSURE EPS-DGN-FR-FTRL 10 hr (mission time) 0.5 hr (mission time)

EDG fails to run long-term (14-24 hrs)-Event-specific update based on an EDG mission time of 12 hrs (actual time for LOOP restoration).

Note: This value is slightly conservative for SBO sequences where offsite power can be restored within 5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months with a 95% confidence.

EPS-DGN-FR-FTRM 13.5 hr (mission time) 13.5 hr (mission time)

EDG fails to run medium-term (0.5-14 hrs)--

Revision 3 SPAR model updated.

Note: This value is slightly conservative for SBO sequences where offsite power can be restored within 5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months with a 95% confidence.

EPS-XHE-NOREC-2H 0.71 0.71 EDG non-recovery probability for 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months sequencesbased on e(-0.173t).

Added new event to existing trees: OEP-BD, EP-DGNxx-LOOP-2H, EP-DGNxx-SBO-2H.

EPS-XHE-NOREC-4H 0.5 0.5 EDG non-recovery probability for 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months sequencesbased on e(-0.173t).

Added new event to existing trees: EP-DGNxx-LOOP-2H, EP-DGNxx-SBO-2H.

EPS-XHE-NOREC-7H 0.42 0.42 EDG non-recovery probability for 7-hour sequencesbased on e(-0.173t) multiplied by an adjustment factor to compensate for double counting the EDG non-recovery in the AFW fault tree (based on a 2-hour recovery time). EPS-XHE-NOREC-7H = [e(-0.173*7hrs)]/[e(-0.173*2hrs)]

Added new event to fault tree OEP-BD.

EPS-XHE-DG23-OB-L-2H 1E-2 See Table A-7 Operator fails to reclose output breaker in 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months given LOOP (non-SBO)based on the SPAR HRA worksheets.

Added new event to new fault tree EP-DGN23-LOOP-2H.

EPS-XHE-DG23-OB-L-4H 1E-2 See Table A-7 Operator fails to reclose output breaker in 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months given LOOP (non-SBO)based on the SPAR HRA worksheets.

Added new event to new fault tree EP-DGN23-LOOP-4H.

EPS-XHE-DG23-OB-S-2H 1E-2 See Table A-7 Operator fails to reclose output breaker in 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months given SBObased on the SPAR HRA worksheets.

Added new event to fault tree EP-DGN23-SB0-4H.

EPS-XHE-DG23-OB-S-4H 1E-2 See Table A-7 Operator fails to reclose output breaker in 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months given SBObased on the SPAR HRA worksheets.

Added new event to fault tree EP-DGN23-SB0-4H.

HPI-XHE-XM-FB 1E-2 See Table A-7 Current value from Revision 3 SPAR model (=2e-2).

Value from original analysis updated.

LER 247/99-015 37 SENSITIVE - NOT FOR PUBLIC DISCLOSURE HPI-XHE-XM-THRTL 1E-2 See Table A-7 Current value from Revision 3 SPAR model (=1e-3)

Value from original analysis updated.

HPR-XHE-XM 1E-2 See Table A-7 Current value from Revision 3 SPAR model (=1e-3).

Value from original analysis updated.

MFW-SYS-TRIP 0.8 TRUE MFW isolates following reactor trip---Set to TRUE, based on common Westinghouse plant trip response.

Value from original analysis updated.

MFW-SYS-UNAVAIL 0.2 TRUE MFW pumps trip prior to or immediately following a reactor trip Set to TRUE, based on eventual loss of steam and condenser vacuum.

MFW-XHE-ERROR FALSE True Operator fails to restore MFW flow following MFW-SYS-TRIPSet to TRUE, based on eventual loss of steam and condenser vacuum MFW-XHE-NOREC 0.2 TRUE Operator fails to restore MFW flow following MFW-SYS-TRIPSet to TRUE, based on eventual loss of steam and condenser vacuum.

Value from original analysis updated.

OEP-XHE-NOREC-2H FALSE Operator fails to restore offsite power within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months following a LOOP (non-SBO)Set to FALSE (offsite power recovery credited at the system level).

OEP-XHE-NOREC-6H FALSE Operator fails to restore offsite power within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months following a LOOP (non-SBO)Set to FALSE (offsite power recovery credited at the system level).

OEP-XHE-NOREC-LOOP-2H 0.1 See Table A-7 Operator fails to restore offsite power within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months following a LOOP (non-SBO)based on SPAR HRA worksheets.

Added new event to new fault trees DIV-xx-AC-LOOP-2H.

OEP-XHE-NOREC-LOOP-4H 1E-2 See Table A-7 Operator fails to restore offsite power within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months following a LOOP (non-SBO)based on SPAR HRA worksheets.

Added new event to new fault trees DIV-xx-AC-LOOP-4H.

OEP-XHE-NOREC-SBO-2H Ignore Operator fails to restore offsite power within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months following a SBOSet to IGNORE to prevent double counting (already included in top event OEP-ST) for AFW failure sequence.

Added new event to new fault trees DIV-xx-AC-SBO-2H.

OEP-XHE-NOREC-SBO-4H 1E-2 See Table A-7 Operator fails to restore offsite power within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months following a SBObased on SPAR HRA worksheets.

Added new event to new fault trees DIV-xx-AC-SBO-4H.

OEP-XHE-NOREC-SL FALSE FALSE Rhodes model inputRevision 3 SPAR model updated.

LER 247/99-015 38 SENSITIVE - NOT FOR PUBLIC DISCLOSURE OEP-XHE-NOREC-ST (2-hrs) 0.1 See Table A-7 Operator fails to restore offsite power within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months following a SBObased on SPAR HRA worksheets.

OEP-XHE-XM-GT2 Ignore Ignore Operator fails to align gas turbineSet to IGNORE since gas turbine provides power through the switchyard and power was available in the switchyard during the event.

OEP-XHE-XM-GT6 Ignore Ignore See basis for OEP-XHE-XM-GT2.

OEP-XHE-XM-GTBD Ignore Ignore See basis for OEP-XHE-XM-GT2.

OEP-XHE-XM-GTSL Ignore Ignore See basis for OEP-XHE-XM-GT2.

OEP-XHE-XM-GTST Ignore Ignore See basis for OEP-XHE-XM-GT2.

PCS-XHE-XO-CDOWN 1e-3 See Table A-7 Operator fails to initiate cooldown---based on SPAR HRA worksheets.

PCS-XHE-XO-SECL See Table A-7 Operator fails to establish secondary cooling during LOOP based on SPAR HRA worksheets.

PPR-MOV-FC-BLK1 TRUE TRUE PORV 1 (455C) Block Valve 535 fails to open PPR-MOV-FC-BLK2 TRUE TRUE PORV 1 (456C) Block Valve 536 fails to open PPR-SRV-CO-L 4E-2 4E-2 Pressurizer safety valves open during LOOPevent-specific change (see ASP report).

PPR-SRV-CO-SBO 4E-2 4E-2 Pressurizer safety valves open during SBOevent-specific change (see ASP report).

RCS-MDP-LK-SEALS 0.22 0.1 RCP seal fails during SBO---Changed for a 5-hour mission time for seal integrity based on the upper bound recovery time for restoration of offsite power given a SBO. Rhodes model estimates:

gpm/

Prob.

pmp t = core uncovery 0.78 21 18 hrs w/o RCS cooling 0.09 57 9 hrs w/o RCS cooling 0.02 76 7 hrs w/o RCS cooling 0.1 182 4 hrs w/o RCS cooling 0.005 480 1 hr w or w/o RCS cooling*

Sensitivity studies show the contribution to risk of this failure mechanism negligible compared to the 0.1 mechanism Revision 3 SPAR model update.

RHR-XHE-XM 1E-3 See Table A-7 Operator fails to initiate RHR.

RPS-XHE-XL-REC 0.44 5E-3 Operator fails to de-energize MG sets given failure of RPS breakersUpdate of Revision 3 SPAR model based on SPAR HRA worksheets.

RPS-XHE-XM-SCRAM 1E-2 5E-3 Operator fails to manually trip the reactorUpdate of Revision 3 SPAR model based on SPAR HRA worksheets.

LER 247/99-015 39 SENSITIVE - NOT FOR PUBLIC DISCLOSURE Parameter Original ASP Analysis Best Est Value Basis SSS-XHE-ALIGN-L-2H 0.5 See Table A-7 Operator fails to establish ASSS within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months during a LOOP (non-SBO)-based on SPAR HRA worksheets.

Added to new fault tree AFW-LOOP.

SSS-XHE-ALIGN-S-2H 0.5 See Table A-7 Operator fails to establish ASSS within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months during a SBO---based on SPAR HRA worksheets.

Modified event name to fault tree AFW.

SSS-XHE-ALIGN-S-6H 5E-2 TRUE Operator fails to establish ASSS within 7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months during a SBOSet to TRUE given battery depletion and loss of control and indication.

Added new event to existing fault tree OEP-BD.

SWS-MDP-CF-FRALL none 4e-6 CCF of all SWS pumps FTRFrom CCF database.

SWS-MDP-CF-FSALL none 4e-6 CCF of all SWS pumps FTSEstimate. To be updated using CCF database.

LER 247/99-015 40 SENSITIVE - NOT FOR PUBLIC DISCLOSURE Table A1-8. Basic Event Probabilities for Sensitivity Study (Summary).

Event Name Value in Original Final Analysis Low Estimate Best Estimate High Estimate ACP-XHE-NOREC-BD (7-hrs) 1E-2 4E-3 4E-3 4E-3 COND-XHE-XM-LOOP-2H TRUE 4E-2 4E-2 4E-2 COND-XHE-XM-SBO-2H TRUE 4E-2 4E-2 4E-2 EPS-XHE-DG23-OB-L-2H 1E-2 TRUE TRUE TRUE EPS-XHE-DG23-OB-L-4H 1E-2 TRUE TRUE TRUE EPS-XHE-DG23-OB-S-2H 1E-2 4E-3 4.2E-2 5.2E-2 EPS-XHE-DG23-OB-S-4H 1E-2 3E-3 2.3E-2 3.2E-2 HPI-XHE-XM-FB 1E-2 8E-3 2E-2 2E-2 HPI-XHE-XM-THRTL 1E-2 8E-4 2E-3 2E-3 HPR-XHE-XM 1E-3 8E-4 2E-3 2E-3 OEP-XHE-NOREC-LOOP-2H 0.1 4E-2 4E-2 2.4E-1 OEP-XHE-NOREC-LOOP-4H 1E-2 4E-3 4E-3 2.4E-2 OEP-XHE-NOREC-SBO-4H 1E-2 4E-3 4E-3 4E-3 OEP-XHE-NOREC-ST (2-hrs) 0.1 4E-2 4E-2 4E-2 PCS-XHE-XM-CDOWN 1E-3 4E-4 2E-3 2E-3 RHR-XHE-XM 1E-3 8E-4 2E-3 2E-3 SSS-XHE-ALIGN-L-2H 0.5 4.4E-1 TRUE TRUE SSS-XHE-ALIGN-S-2H 0.5 2.4E-1 TRUE TRUE Other basic events COND-XHE-XM-SBO-7H TRUE TRUE TRUE TRUE EPS-DG23-BREAKER TRUE TRUE TRUE TRUE EPS-DGNxx-NOREC-2H 0.71 0.71 0.71 0.71 EPS-DGNxx-NOREC-4H 0.5 0.5 0.5 0.5 EPS-XHE-NOREC-2H 0.71 0.71 0.71 0.71 EPS-XHE-NOREC-7H 0.42 0.42 0.42 0.42 MFW-SYS-TRIP 0.8 TRUE TRUE TRUE MFW-SYS-UNAVAIL 0.2 TRUE TRUE TRUE MFW-XHE-ERROR FALSE TRUE TRUE TRUE MFW-XHE-NOREC 0.2 TRUE TRUE TRUE OEP-XHE-NOREC-2H FALSE FALSE FALSE FALSE

LER 247/99-015 41 SENSITIVE - NOT FOR PUBLIC DISCLOSURE Event Name Value in Original Final Analysis Low Estimate Best Estimate High Estimate OEP-XHE-NOREC-6H FALSE FALSE FALSE FALSE OEP-XHE-NOREC-SBO-2H IGNORE IGNORE IGNORE IGNORE OEP-XHE-NOREC-SL FALSE FALSE FALSE FALSE OEP-XHE-XM-GTxx TRUE TRUE TRUE TRUE PCS-XHE-XO-SECL 0.34 0.34 0.34 0.34 PPR-SRV-CO-L 4E-2 4E-2 4E-2 4E-2 PPR-SRV-CO-SBO 4E-2 4E-2 4E-2 4E-2 RCS-MDP-LK-SEALS 0.22 0.1 0.1 0.1 RPS-XHE-XL-REC 0.44 5E-3 5E-3 5E-3 RPS-XHE-XM-SCRAM 1E-2 5E-3 5E-3 5E-3 SSS-XHE-ALIGN-S-6H 5E-2 TRUE TRUE TRUE Table A1-9. Summary of CCDP Results from Operator Performance Sensitivity Study.

Low Estimate Best Estimate High Estimate 95% Percentile 6.9E-05 7.8E-05 1.3E-04 Mean 2.1E-05 2.2E-05 4.0E-05 5% Percentile 1.7E-06 1.9E-06 2.8E-06 Point Estimate 1.3E-05 1.5E-05 3.3E-05

LER 247/99-015 42 SENSITIVE - NOT FOR PUBLIC DISCLOSURE ATTACHMENT 2 HRA WORKSHEETS USED IN OPERATOR PERFORMANCE SENSITIVITY STUDY

LER 247/99-015 43 SENSITIVE - NOT FOR PUBLIC DISCLOSURE OEP-XHE-NOREC-ST (2 hrs), OEP-XHE-NOREC-SBO-4H, ACP-XHE-NOREC-BD (7 hrs)(Operator action tasks)

Operator fails to restore ac power (offsite and EDG) during SBO

[ ] High end; [ ] Best estimate; [ ] Low end Performance Shaping Factors (PSF)

PSF Levels Multipliers (SBO)

Operator action task Basis 2H 4H 7H

1. Available Time Inadequate 1.0a 1.0a 1.0a Offsite power must be restored to HPI (2h), HPR (4h), and AFW (7h). EOP ECA-0.0 will identify the need to restore power to a bus needed for HPI. Operator can walkthrough ECA-0.0 TO Step 6 within several minutes.

AOI 27.1.1 can be completed less than 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . Safety system initiated within 1/2 hr.

Time available time required 10

10 10 Nominal 1

1

Available > 50x time req.

0.01 0.01 0.01

2. Stress Extreme 5

5 5

Core uncovery in 2-4 hours if bus(es) not energized from switchyard and safety systems initiated. However, knowing power exists in the switchyard and an available success path exists provides some relief from extreme stress.

High 2

2

Nominal 1

1 1

3. Complexity Highly 5

5 5

Somewhat difficult to perform. Actions in AOI 27.1.1 include (1) removing and re-installing breaker control fuses, (2) local closing of transformer output breaker, (3) control room manipulations.

Moderately 2

2

Nominal 1

1 1

4. Experience/

Training Low 3

3 3

Low end case assumption.

Nominal 1

1

High 0.5 0.5 0.5

5. Procedures Not available 50 50 50 Instructions to restore power from the switchyear to safety buses in Abnormal Operating Instructions (AOI) 27.1.1 (Loss of Normal Station Power); Step 4.5.

Available, but poor 5

5 5

Nominal 1

1

6. Ergonomics Missing/Misleading 50 50 50 Design of plant supports correct performance, but does not enhance performance or make tasks easier to carry out.

Poor 10 10 10 Nominal 1

1

Good 0.5 0.5 0.5

7. Fitness for Duty Unfit 1.0a 1.0a 1.0a Degraded Fitness 5

5 5

Nominal 1

1

8. Work Processes Poor 2

2 2

Low end case assumption.

Nominal 1

1

Good 0.8 0.8 0.8 Total = (1)x(2)x(3)x(4)x(5)x(6)x(7)x(8) 40.0 4.0 4.0 Note: This task does not contain a significant amount of diagnosis activity. Identification of the need to restore offsite power to needed bus is thru ECA-0.0.

Nominal Failure Probability 1.0E-3 1.0E-3 1.0E-3 Action Failure Prob. (PSF x Nominal) 4.0E-2 4.0E-3 4.0E-3 Diagnostic Failure Prob. (from other table) na na na Total Error Prob. (Action + Diagnostic) 4.0E-2 4.0E-3 4.0E-3

LER 247/99-015 44 SENSITIVE - NOT FOR PUBLIC DISCLOSURE COND-XHE-XM-LOOP-2H and COND-XHE-XM-SBO-2H (Operator action task)Operator fails to establish condensate flow in 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months

[ ] High end; [ ] Best estimate; [] Low end Performance Shaping Factors (PSF)

PSF Levels Multiplier Multiplier Operator action task Basis 2H LOOP 2H SBO

1. Available Time Inadequate 1.0a 1.0a About 1-2 hours to complete actions; local actions required. TTC performed actions from control room (simulator) within 30 minutes. Local actions (see Complexity, below) may extend time to about 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

Time available time required 10

10

Nominal 1

1 Available > 50x time required 0.01 0.01

2. Stress Extreme 5

5 Core uncovery in 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months if condensate system not initiated. However, knowing power exists in the switchyard and an available success path exists provide some relief from extreme stress High 2

2

Nominal 1

1

3. Complexity Highly 5

5 Somewhat difficult to perform. Local actions required forlifting leads or installing flexible air hose (FR-H.1 Step 12.e).

Moderately 2

2

Nominal 1

1

4. Experience/

Training Low 3

3 Low end case assumption (Periodic EOP training would yield a high PSF level, but considering that local actions are required, nominal level is assigned.

Nominal 1

1

High 0.5 0.5

5. Procedures Not available 50 50 FR-H.1 (Response to Loss of Secondary Heat Sink); SOP 20.2 (Condensate System Operation); and AOI 27.1.9 for local operation of the SG dump valves.

Available, but poor 5

5 Nominal 1

1

6. Ergonomics Missing/Misleading 50 50 Design of plant supports correct performance, but does not enhance performance or make tasks easier to carry out.

Poor 10 10 Nominal 1

1

Good 0.5 0.5

7. Fitness for Duty Unfit 1.0a 1.0a Degraded Fitness 5

5 Nominal 1

1

8. Work Processes Poor 2

2 Low end case assumption.

Nominal 1

1

Good 0.8 0.8 Total = (1)x(2)x(3)x(4)x(5)x(6)x(7)x(8) 40.0 40.0 Note: This task does not require a significant amount of diagnosis activity, because this alternative means of steam generator injection is proceduralized in FR-H.1.

Nominal Failure Probability 1E-3 1E-3 Action Failure Prob. (PSF x Nominal) 4.0E-2 4.0E-2 Diagnostic Failure Prob. (from other table) na na Total Error Prob. (Action + Diagnostic) 4.0E-2 4.0E-2

a. Task failure probability is 1.0 regardless of other PSFs.

LER 247/99-015 45 SENSITIVE - NOT FOR PUBLIC DISCLOSURE EPS-XHE-DG23-OB-L-2H and EPS-XHE-DG23-OB-L-4H (Diagnostic task)Operator fails to re-close output breaker (given LOOP and at least one EDG running to a bus that will not help to prevent core uncovery)

[ ] High end; [ ] Best estimate; [ ] Low end Performance Shaping Factors (PSF)

PSF Levels (LOOP) Multiplier Diagnostic task Basis 2H 4H

1. Available Time Inadequate 1.0a 1.0a The operating EDG may distract the operators; however, degraded critical safety function (Heat Sink) will direct the operators to EOP FR-H.1. The EOP will identify the need to establish power to Bus 6A ( the remaining option). Operators can walkthrough the FR-H.1 within several minutes.

Barely adequate < 20 m 10 10 Nominal 30 m 1

1 Extra > 60 m 0.1

0.1

Expansive > 24 h 0.01 0.01

2. Stress Extreme 5

5 Core uncovery in 2 or 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months if Bus 6A not energized and safety systems initiated.

However, knowing power exists in the switchyard provides some relief from extreme stress.

High 2

2

Nominal 1

1

3. Complexity Highly 5

5 Some ambiguity with the knowledge of the state of the bus, e.g., potential fault could damage EDG and bus further. However, the 4-hr sequence provides some time to assess the availablility of the bus.

Moderately 2

2 Nominal 1

1

4. Experience/

Training Low 10 10 Low end case assumption.

Nominal 1

1

High 0.5 0.5

5. Procedures Not available 50 50 FR-H.1 (Response to Loss of Secondary Heat Sink) is a diagnostic/symptom oriented procedure.

Available, but poor 5

5 Nominal 1

1 Diagnostic/symptom oriented 0.5

0.5

6. Ergonomics Missing/Misleading 50 50 Design of plant supports correct performance, but does not enhance performance or make tasks easier to carry out.

Poor 10 10 Nominal 1

1

Good 0.5 0.5

7. Fitness for Duty Unfit 1.0a 1.0a Degraded Fitness 5

5 Nominal 1

1

8. Work Processes Poor 2

2 Low end case assumption.

Nominal 1

1

Good 0.8 0.8 Total = (1)x(2)x(3)x(4)x(5)x(6)x(7)x(8) 0.2 0.1 Nominal Failure Probability 1.0E-2 1.0E-2 Adjusted Probability = Total x Nominal 2.0E-3 1.0E-3

a. Task failure probability is 1.0 regardless of other PSFs.

LER 247/99-015 46 SENSITIVE - NOT FOR PUBLIC DISCLOSURE EPS-XHE-DG23-OB-L-2H and EPS-XHE-DG23-OB-L-4H (Operator action task)Operator fails to re-close output breaker (given LOOP and at least one EDG running to a bus that will not help to prevent core uncovery)

[ ] High end; [ ] Best estimate; [ ] Low end Performance Shaping Factors (PSF)

PSF Levels Multiplier Multiplier Operator action task Basis 2H 4H

1. Available Time Inadequate 1.0a 1.0a Once the need to reclose EDG breaker has been determined, the only remaining action is to (1) reset the breaker locally, and (2) send an aux operator locally to observed the EDG when the breaker is closed from the control room.

Time available time required 10 10 Nominal 1

1

Available > 50x time required 0.01 0.01

2. Stress Extreme 5

5 Same as diagnosis.

High 2

2

Nominal 1

1

3. Complexity Highly 5

5 Some local action is required; however, that task of resetting the breaker is a routine task and not difficult to perform.

Moderately 2

2 Nominal 1

1

4. Experience/

Training Low 3

3 Low end case assumption.

Nominal 1

1

High 0.5 0.5

5. Procedures Not available 50 50 ES-0.1 (Reactor Trip Response), Step 1, instructs the operator to restore power to de-energized buses. SOP 27.3.1 provides instuctions for closing breaker of an EDG.

Available, but poor 5

5 Nominal 1

1

6. Ergonomics Missing/Misleading 50 50 Design of plant supports correct performance, but does not enhance performance or make tasks easier to carry out.

Poor 10 10 Nominal 1

1

Good 0.5 0.5

7. Fitness for Duty Unfit 1.0a 1.0a Degraded Fitness 5

5 Nominal 1

1

8. Work Processes Poor 2

2 Low end case assumption.

Nominal 1

1

Good 0.8 0.8 Total = (1)x(2)x(3)x(4)x(5)x(6)x(7)x(8) 2.0 2.0 Nominal Failure Probability 1E-3 1E-3 Action Failure Prob. (PSF x Nominal) 2.0E-3 2.0E-3 Diagnostic Failure Prob. (from other table) 2.0E-3 1.0E-3 Total Error Prob. (Action + Diagnostic) 4.0E-3 3.0E-3

a. Task failure probability is 1.0 regardless of other PSFs.

LER 247/99-015 47 SENSITIVE - NOT FOR PUBLIC DISCLOSURE EPS-XHE-DG23-OB-S-2H and EPS-XHE-DG23-OB-S-4H (Diagnostic task)Operator fails to re-close output breaker (given SBO)

[ ] High end; [ ] Best estimate; [ ] Low end Performance Shaping Factors (PSF)

PSF Levels (SBO) Multiplier Diagnostic task Basis 2H 4H

1. Available Time Inadequate 1.0a 1.0a ECA-0.0 Step 6 provides an action to energize 480 V bus with running EDG.

Barely adequate < 20 m 10 10 Nominal 30 m 1

1 Extra > 60 m 0.1

0.1

Expansive > 24 h 0.01 0.01

2. Stress Extreme 5

5 Core uncovery in 2 or 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months if Bus 6A not energized and safety systems initiated.

However, knowing power exists in the switchyard provides some relief from extreme stress.

High 2

2

Nominal 1

1

3. Complexity Highly 5

5 Some ambiguity with the knowledge of the state of the bus, e.g., potential fault could damage EDG and bus further. However, the 4-hr sequence provides some time to assess the availablility of the bus.

Moderately 2

2 Nominal 1

1

4. Experience/

Training Low 10 10 Low end case assumption.

Nominal 1

1

High 0.5 0.5

5. Procedures Not available 50 50 ECA-0.0 (Loss of All AC Power) is a diagnostic/symptom oriented procedure.

Available, but poor 5

5 Nominal 1

1 Diagnostic/symptom oriented 0.5

0.5

6. Ergonomics Missing/Misleading 50 50 Design of plant supports correct performance, but does not enhance performance or make tasks easier to carry out.

Poor 10 10 Nominal 1

1

Good 0.5 0.5

7. Fitness for Duty Unfit 1.0a 1.0a Degraded Fitness 5

5 Nominal 1

1

8. Work Processes Poor 2

2 Low end case assumption.

Nominal 1

1

Good 0.8 0.8 Total = (1)x(2)x(3)x(4)x(5)x(6)x(7)x(8) 0.2 0.1 Nominal Failure Probability 1.0E-2 1.0E-2 Adjusted Probability = Total x Nominal 2.0E-3 1.0E-3

a. Task failure probability is 1.0 regardless of other PSFs.

LER 247/99-015 48 SENSITIVE - NOT FOR PUBLIC DISCLOSURE EPS-XHE-DG23-OB-S-2H and EPS-XHE-DG23-OB-S-4H (Operator action task)Operator fails to re-close output breaker (given SBO)

[ ] High end; [ ] Best estimate; [ ] Low end Performance Shaping Factors (PSF)

PSF Levels (SBO) Multiplier Operator action task Basis 2H 4H

1. Available Time Inadequate 1.0a 1.0a Once the need to reclose EDG breaker has been determined, the only remaining action is to (1) reset the breaker locally, and (2) send an aux operator locally to observed the EDG when the breaker is closed from the control room.

Time available time required 10 10 Nominal 1

1

Available > 50x time required 0.01 0.01

2. Stress Extreme 5

5 Same as diagnosis.

High 2

2

Nominal 1

1

3. Complexity Highly 5

5 Some local action is required; however, that task of resetting the breaker is a routine task and not difficult to perform.

Moderately 2

2 Nominal 1

1

4. Experience/

Training Low 3

3 Low end case assumption.

Nominal 1

1

High 0.5 0.5

5. Procedures Not available 50 50 ECA-0.1 (Loss of All AC Power) Step 6, instructs the operator to restore power to de-energized buses. SOP 27.3.1 provides instuctions for closing breaker of an EDG.

Available, but poor 5

5 Nominal 1

1

6. Ergonomics Missing/Misleading 50 50 Design of plant supports correct performance, but does not enhance performance or make tasks easier to carry out.

Poor 10 10 Nominal 1

1

Good 0.5 0.5

7. Fitness for Duty Unfit 1.0a 1.0a Degraded Fitness 5

5 Nominal 1

1

8. Work Processes Poor 2

2 Low end case assumption.

Nominal 1

1

Good 0.8 0.8 Total = (1)x(2)x(3)x(4)x(5)x(6)x(7)x(8) 2.0 2.0 Nominal Failure Probability 1.0E-3 1.0E-3 Action Failure Prob. (PSF x Nominal) 2.0E-3 2.0E-3 Diagnostic Failure Prob. (from other table) 2.0E-3 1.0E-3 Total Error Prob. (Action + Diagnostic) 4.0E-3 3.0E-3

a. Task failure probability is 1.0 regardless of other PSFs.

LER 247/99-015 49 SENSITIVE - NOT FOR PUBLIC DISCLOSURE HPI-XHE-XM-FB, HPI-XHE-XM-THRTL (Operator action task)Operator fails to initiate and throttle feed and bleed, respectively (given LOOP with loss of all feedwater)

[ ] High end; [ ] Best estimate; [ ] Low end Performance Shaping Factors (PSF)

PSF Levels Multiplier Operator action task Basis

-FB

-THRTL

1. Available Time Inadequate 1.0a 1.0a Thermal-hydraulics analysis from the IP3 IPE indicates that F&B cooling must be initiated within 30 minutes of the total loss of feedwater.

Time available time required 10

10 Nominal 1

1

Available > 50x time required 0.01 0.01

2. Stress Extreme 5

5 Core uncovery within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months following loss of AFW. F&B must be initiated within 30 minutes upon loss of AFW. However, 2 of 3 buses must be energized for F&B to work.

Therefore, knowing that an available success path exists reduces the stress level from extreme.

High 2

2

Nominal 1

1

3. Complexity Highly 5

5 Not difficult to perform. All actions are procedurized and be completed from the control room.

Moderately 2

2 Nominal 1

1

4. Experience/

Training Low 3

3 Low end case assumption for EOP proceduralized and routinely practiced tasks.

Nominal 1

1 High 0.5

0.5

5. Procedures Not available 50 50 FR-H.1 (Loss of Secondary Heat Sink) provides instructions for initiating F&B.

Available, but poor 5

5 Nominal 1

1

6. Ergonomics Missing/Misleading 50 50 (This PSF may be rated good is the control room panels provide the needed information and the ability to carry out the task in such a way that lessens the opportunity for error.)

Poor 10 10 Nominal 1

1

Good 0.5 0.5

7. Fitness for Duty Unfit 1.0a 1.0a Degraded Fitness 5

5 Nominal 1

1

8. Work Processes Poor 2

2 Low end case assumption for EOP proceduralized tasks that are performed in the control room (i.e., no local tasks).

Nominal 1

1 Good 0.8

0.8

Total = (1)x(2)x(3)x(4)x(5)x(6)x(7)x(8) 8.0 0.8 Nominal Failure Probability 1.0E-3 1.0E-3 Action Failure Prob. (PSF x Nominal) 8E-3 8E-4 Diagnostic Failure Prob. (from other table) na na Total Error Prob. (Action + Diagnostic) 8E-3 8E-4

a. Task failure probability is 1.0 regardless of other PSFs.

LER 247/99-015 50 SENSITIVE - NOT FOR PUBLIC DISCLOSURE HPR-XHE-XM, RHR-XHE-XM (Operator action task)Operator fails to initiate HPR and RHR, respectively

[ ] High end; [ ] Best estimate; [ ] Low end Performance Shaping Factors (PSF)

PSF Levels Multiplier Operator action task Basis HPR RHR

1. Available Time Inadequate 1.0a 1.0a HPR or RHR must be established 4-5 hours before RWST empties during a seal LOCA or SORV.

Time available time required 10 10 Nominal 1

1

Available > 50x time required 0.01 0.01

2. Stress Extreme 5

5 Actions are still required to avert core uncovery. However, power is available to one or more buses and multiple proceduralized success paths exists. But, the recovery of power during a SBO or complicated LOOP has a high stress level.

High 2

2

Nominal 1

1

3. Complexity Highly 5

5 Not difficult to perform. All actions are procedurized and be completed from the control room.

Moderately 2

2 Nominal 1

1

4. Experience/

Training Low 3

3 Low end case assumption for EOP proceduralized and routinely practiced tasks.

Nominal 1

1 High 0.5

0.5

5. Procedures Not available 50 50 EOPs and SOPs.

Available, but poor 5

5 Nominal 1

1

6. Ergonomics Missing/Misleading 50 50 (This PSF may be rated good is the control room panels provide the needed information and the ability to carry out the task in such a way that lessens the opportunity for error.)

Poor 10 10 Nominal 1

1

Good 0.5 0.5

7. Fitness for Duty Unfit 1.0a 1.0a Degraded Fitness 5

5 Nominal 1

1

8. Work Processes Poor 2

2 Low end case assumption for EOP proceduralized tasks that are performed in the control room (i.e., no local tasks).

Nominal 1

1 Good 0.8

0.8

Total = (1)x(2)x(3)x(4)x(5)x(6)x(7)x(8) 0.8 0.8 Nominal Failure Probability 1.0E-3 1.0E-3 Action Failure Prob. (PSF x Nominal) 8E-4 8E-4 Diagnostic Failure Prob. (from other table) na na Total Error Prob. (Action + Diagnostic) 8E-4 8E-4

a. Task failure probability is 1.0 regardless of other PSFs.

LER 247/99-015 51 SENSITIVE - NOT FOR PUBLIC DISCLOSURE OEP-XHE-NOREC-LOOP-2H and OEP-XHE-NOREC-LOOP-4H (Operator action task)Operator fails to recover offsite power within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months and 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months

[ ] High end; [ ] Best estimate; [] Low end Performance Shaping Factors (PSF)

PSF Levels (LOOP) Multiplier Operator action task Basis 2H 4H

1. Available Time Inadequate 1.0a 1.0a Offsite power must be restored to HPI (2hrs) and HPR (4hrs). EOP E-0 will identify the need to restore power to a bus needed for HPI injection. Operator can walk through E-0 (Step 3) within several minutes. AOI 27.1.1 can be completed within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . Safety systems initiated within 1/2 hr.

Time available time required 10

10 Nominal 1

1

Available > 50x time req.

0.01 0.01

2. Stress Extreme 5

5 Core uncovery in 2-4 hours if bus(es) not energized from switchyard and HPI/HPR initiated. However, knowing power exists in the switchyard provides some relief from extreme stress.

High 2

2

Nominal 1

1

3. Complexity Highly 5

5 Somewhat difficult to perform.

Actions in AOI 27.1.1 include (1) removing and re-installing breaker control fuses, (2) local closing of transformer output breaker, (3) control room manipulations Moderately 2

2

Nominal 1

1

4. Experience/

Training Low 3

3 Low end case assumption.

Nominal 1

1

High 0.5 0.5

5. Procedures Not available 50 50 Instructions in Abnormal Operating Instructions (AOI) 27.1.1 (Loss of Normal Station Power); Step 4.5.

Available, but poor 5

5 Nominal 1

1

6. Ergonomics Missing/Misleading 50 50 Design of plant supports correct performance, but does not enhance performance or make tasks easier to carry out.

Poor 10 10 Nominal 1

1

Good 0.5 0.5

7. Fitness for Duty Unfit 1.0a 1.0a Degraded Fitness 5

5 Nominal 1

1

8. Work Processes Poor 2

2 Low end case assumption.

Nominal 1

1

Good 0.8 0.8 Total = (1)x(2)x(3)x(4)x(5)x(6)x(7)x(8) 40.0 4.0 Note: This task does not contain a significant amount of diagnosis activity.

Identification of the need to restore offsite power to needed bus is thru E-0 for SORV and FR-H.1/ES-1.1 for HPR initiation during F&B Nominal Failure Probability 1.0E-3 1.0E-3 Action Failure Prob. (PSF x Nominal) 4E-2 4E-3 Diagnostic Failure Prob. (from other table)

See note See note Total Error Prob. (Action + Diagnostic) 4E-2 4E-3

a. Task failure probability is 1.0 regardless of other PSFs.

LER 247/99-015 52 SENSITIVE - NOT FOR PUBLIC DISCLOSURE PCS-XHE-XM-CDOWN (Operator action task)Operator fails to initiate RCS cooldown via steam generator dump valves (given LOOP)

[ ] High end; [ ] Best estimate; [ ] Low end Performance Shaping Factors (PSF)

PSF Levels Multiplier Operator action task Basis

1. Available Time Inadequate 1.0a RHR must be established about 4-5 hours before RWST empties during a seal LOCA or SORV.

Time available time required 10 Nominal 1

Available > 50x time required 0.01

2. Stress Extreme 5

Actions are still required to avert core uncovery. However, power is available to one or more buses and multiple proceduralized success paths exists. But, the recovery of power during a SBO or complicated LOOP has a high stress level.

High 2

Nominal 1

3. Complexity Highly 5

Not difficult to perform.

Moderately 2

Nominal 1

4. Experience/

Training Low 3

Low end case assumption for EOP proceduralized and routinely practiced tasks.

Nominal 1

High 0.5

5. Procedures Not available 50 Available, but poor 5

Nominal 1

6. Ergonomics Missing/Misleading 50 (This PSF may be rated good is the control room panels provide the needed information and the ability to carry out the task in such a way that lessens the opportunity for error.)

Poor 10 Nominal 1

Good 0.5

7. Fitness for Duty Unfit 1.0a Degraded Fitness 5

Nominal 1

8. Work Processes Poor 2

Low end case assumption Nominal 1

Good 0.8

Total = (1)x(2)x(3)x(4)x(5)x(6)x(7)x(8) 0.8 Nominal Failure Probability 1.0E-3 Action Failure Prob. (PSF x Nominal) 8.0E-4 Diagnostic Failure Prob. (from other table) na Total Error Prob. (Action + Diagnostic) 8.0E-4

a. Task failure probability is 1.0 regardless of other PSFs.

LER 247/99-015 53 SENSITIVE - NOT FOR PUBLIC DISCLOSURE SSS-XHE-L-2H and SSS-XHE-S-2H (Diagnostic task)Operator fails to initiate ASSS within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months during LOOP and SBO, respectively

[ ] High end; [ ] Best estimate; [ ] Low end Performance Shaping Factors (PSF)

PSF Levels Multiplier Multiplier Diagnostic task Basis 2H LOOP 2H SBO

1. Available Time Inadequate 1.0a 1.0a 1-2 hours to initiate ASSS power to AFW pump 21 (per SRI and SRA).

Therefore, little time is available for identify the need for ASSS.

Barely adequate < 20 m 10

10

Nominal 30 m 1

1 Extra > 60 m 0.1 0.1 Expansive > 24 h 0.01 0.01

2. Stress Extreme 5

5 Core uncovery in 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months if ASSS not established. However, knowing power exists in the switchyard to power ASSS provides some relief from extreme stress.

High 2

2

Nominal 1

1

3. Complexity Highly 5

5 Operators must deduce that ASSS is the only option when all other means are not available (e.g., repairing TDAFW, MFW, condensate, F&B) or not preferred (i.e.,

reclosing EDG breaker to Bus 6A). EOP FR-H.1 lists all other options except ASSS, however. Easier for SBO with no EDGs available.

Moderately 2

2 Nominal 1

1

4. Experience/

Training Low 10 10 Low end case assumption.

Nominal 1

1

High 0.5 0.5

5. Procedures Not available 50 50 AOI 27.1.9 (Control Room Inaccessibility Safe Shutdown Control) provides instruction for initiating ASSS during control room evacuation. However, skill-of-the-craft is needed to deduce that ASSS is the option for the specific scenario of interest.

Available, but poor 5

5 Nominal 1

1

Diagnostic/symptom oriented 0.5 0.5

6. Ergonomics Missing/Misleading 50 50 Design of plant supports correct performance, but does not enhance performance or make tasks easier to carry out.

Poor 10 10 Nominal 1

1

Good 0.5 0.5

7. Fitness for Duty Unfit 1.0a 1.0a Degraded Fitness 5

5 Nominal 1

1

8. Work Processes Poor 2

2 Low end case assumption.

Nominal 1

1

Good 0.8 0.8 Total = (1)x(2)x(3)x(4)x(5)x(6)x(7)x(8) 40 20 Nominal Failure Probability 1.0E-2 1.0E-2 Adjusted Probability = Total x Nominal 4.0E-1 2.0E-1

a. Task failure probability is 1.0 regardless of other PSFs.

LER 247/99-015 54 SENSITIVE - NOT FOR PUBLIC DISCLOSURE SSS-XHE-L-2H and SSS-XHE-S-2H (Operator action task)Operator fails to initiate ASSS within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months during LOOP and SBO

[ ] High end; [ ] Best estimate; [ ] Low end Performance Shaping Factors (PSF)

PSF Levels Multiplier Multiplier Operator action task Basis 2H LOOP 2H SBO

1. Available Time Inadequate 1.0a 1.0a 1-2 hours to initiate ASSS power to AFW pump 21 (per SRI and SRA).

Time available time required 10

10

Nominal 1

1 Available > 50x time required 0.01 0.01

2. Stress Extreme 5

5 Core uncovery in 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months if ASSS not established. However, knowing power exists in the switchyard to power ASSS provides some relief from extreme stress.

High 2

2

Nominal 1

1

3. Complexity Highly 5

5 Somewhat difficult to perform.

Two operators are required to complete local action. Coordination required with CR and the two (local) operators. Tasks (open/close breaker, transfer switch) are routine.

Moderately 2

2

Nominal 1

1

4. Experience/

Training Low 3

3 Low end case assumption.

Nominal 1

1

High 0.5 0.5

5. Procedures Not available 50 50 Abnormal Operating Instruction (AOI) AOI 27.1.9 (Control Room Inaccessibility Safe Shutdown Control).

Available, but poor 5

5 Nominal 1

1

6. Ergonomics Missing/Misleading 50 50 Design of plant supports correct performance, but does not enhance performance or make tasks easier to carry out.

Poor 10 10 Nominal 1

1

Good 0.5 0.5

7. Fitness for Duty Unfit 1.0a 1.0a Degraded Fitness 5

5 Nominal 1

1

8. Work Processes Poor 2

2 Low end case assumption.

Nominal 1

1

Good 0.8 0.8 Total = (1)x(2)x(3)x(4)x(5)x(6)x(7)x(8) 40.0 40.0 Nominal Failure Probability 1.0E-3 1.0E-3 Action Failure Prob. (PSF x Nominal) 4.0e-2 4.0e-2 Diagnostic Failure Prob. (from other table) 4.0E-1 2.0E-1 Total Error Prob. (Action + Diagnostic) 4.4E-1 2.4E-1

a. Task failure probability is 1.0 regardless of other PSFs.

LER 247/99-015 55 SENSITIVE - NOT FOR PUBLIC DISCLOSURE OEP-XHE-NOREC-ST (2 hrs), OEP-XHE-NOREC-SBO-4H, ACP-XHE-NOREC-BD (7 hrs)(Operator action tasks)

Operator fails to restore ac power (offsite and EDG) during SBO

[ ] High end; [] Best estimate; [ ] Low end Performance Shaping Factors (PSF)

PSF Levels Multipliers (SBO)

Operator action task Basis 2H 4H 7H

1. Available Time Inadequate 1.0a 1.0a 1.0a Offsite power must be restored to HPI/HPR or motor-driven AFW pumps. EOP ECA-0.0 will identify the need to restore power to a bus needed for HPI or AFW. Operator can walk through E-0.0 (Step 3) within several minutes. AOI 27.1.1 can be completed within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months (max). HPI/HPR initiated within 1/2 hr. Core uncovery in 2-4 hours if bus(es) not energized from switchyard and HPI/HPR or AFW initiated. However, knowing power exists in the switchyard provides some relief from stress. Actions in AOI 27.1.1 include (1) removing and re-installing breaker control fuses, (2) local closing of transformer output breaker, (3) control room manipulations.

Time available time required 10

10 10 Nominal 1

1

Available > 50x time required 0.01 0.01 0.01

2. Stress Extreme 5

5 5

High 2

2

Nominal 1

1 1

3. Complexity Highly 5

5 5

Moderately 2

2

Nominal 1

1 1

4. Experience/

Training Low 3

3 3

Assume nominal level of training/experience for Best Estimate Case, since this is an operator action activity.

Nominal 1

1

High 0.5 0.5 0.5

5. Procedures Not available 50 50 50 Instructions in Abnormal Operating Instructions (AOI) 27.1.1 (Loss of Normal Station Power); Step 4.5.

AOI referenced in EOP ECA 0.0 (Loss of All AC Power).

Available, but poor 5

5 5

Nominal 1

1

6. Ergonomics Missing/Misleading 50 50 50 Poor 10 10 10 Nominal 1

1

Good 0.5 0.5 0.5

7. Fitness for Duty Unfit 1.0a 1.0a 1.0a Degraded Fitness 5

5 5

Nominal 1

1

8. Work Processes Poor 2

2 2

Assume nominal work processes for Best Estimate Case, since this is an operator activity.

Nominal 1

1

Good 0.8 0.8 0.8 Total = (1)x(2)x(3)x(4)x(5)x(6)x(7)x(8) 40 40 40 Same as Low End Case.

Nominal Failure Probability 1.0E-3 1.0E-3 1.0E-3 Action Failure Prob. (PSF x Nominal) 4.0E-2 4.0E-2 4.0E-2 Diagnostic Failure Prob. (from other table) na na na Total Error Prob. (Action + Diagnostic) 4.0E-2 4.0E-2 4.0E-2

a. Task failure probability is 1.0 regardless of other PSFs.

LER 247/99-015 56 SENSITIVE - NOT FOR PUBLIC DISCLOSURE COND-XHE-XM-LOOP-2H and COND-XHE-XM-SBO-2H (Operator action task)Operator fails to establish condensate flow in 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months

[ ] High end; [] Best estimate; [ ] Low end Performance Shaping Factors (PSF)

PSF Levels Multiplier Multiplier Operator action task Basis 2H LOOP 2H SBO

1. Available Time Inadequate 1.0a 1.0a About 1-2 hours to complete actions; local actions required. TTC performed actions from control room (simulator) within 30 minutes. Local actions (see Complexity, below) will extend time to about 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

Time available time required 10

10

Nominal 1

1 Available > 50x time required 0.01 0.01

2. Stress Extreme 5

5 Core uncovery in 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months if condensate system not initiated. However, knowing power exists in the switchyard provides some relief from stress High 2

2

Nominal 1

1

3. Complexity Highly 5

5 Local action requiredlifting leads or installing flexible air hose.

Moderately 2

2

Nominal 1

1

4. Experience/

Training Low 3

3 Assume nominal level of training/experience for Best Estimate Case, since this is an operator action activity.

Nominal 1

1

High 0.5 0.5

5. Procedures Not available 50 50 FR-H.1 (Response to Loss of Secondary Heat Sink); SOP 20.2 (Condensate System Operation); and AOI 27.1.9 for local operation of the SG dump valves Available, but poor 5

5 Nominal 1

1

6. Ergonomics Missing/Misleading 50 50 Poor 10 10 Nominal 1

1

Good 0.5 0.5

7. Fitness for Duty Unfit 1.0a 1.0a Degraded Fitness 5

5 Nominal 1

1

8. Work Processes Poor 2

2 Assume nominal work processes for Best Estimate Case, since this is an operator action activity.

Nominal 1

1

Good 0.8 0.8 Total = (1)x(2)x(3)x(4)x(5)x(6)x(7)x(8) 40 40 Note: This task does not require a significant amount of diagnosis activity, because this alternative means of steam generator injection is proceduralized in FR-H.1.

Nominal Failure Probability 1E-3 1E-3 Action Failure Prob. (PSF x Nominal) 4.0E-2 4.0E-2 Diagnostic Failure Prob. (from other table) na na Total Error Prob. (Action + Diagnostic) 4.0E-2 4.0E-2

a. Task failure probability is 1.0 regardless of other PSFs.

LER 247/99-015 57 SENSITIVE - NOT FOR PUBLIC DISCLOSURE EPS-XHE-DG23-OB-L-2H and EPS-XHE-DG23-OB-L-4H (Diagnostic task)Operator fails to re-close output breaker (given LOOP and at least one EDG running to a bus that will not help to prevent core uncovery)

[ ] High end; [] Best estimate; [ ] Low end Performance Shaping Factors (PSF)

PSF Levels (LOOP) Multiplier Diagnostic task Basis 2H 4H

1. Available Time Inadequate 1.0a 1.0a The operating EDG may distract the operators; however, degraded critical safety function (Heat Sink) will direct the operators through EOP FR-H.1. The EOP will identify the need to establish power to Bus 6A ( the remaining option). Operators can walkthrough the FR-H.1 within several minutes to an hour.

Barely adequate < 20 m 10 10 Nominal 30 m 1

1 Extra > 60 m 0.1 0.1

Expansive > 24 h 0.01 0.01

2. Stress Extreme 5

5 Core uncovery in 2-4 hours if Bus 6A not energized and safety systems initiated.

However, knowing power exists in the switchyard provides some relief from stress.

High 2

2

Nominal 1

1

3. Complexity Highly 5

5 Some ambiguity with the knowledge of the state of the bus, e.g., potential fault could damage EDG and bus further. However, the 4-hr sequence provides some time to assess the bus.

Moderately 2

2 Nominal 1

1

4. Experience/

Training Low 10

10

Based on operators performance on requalification examinations, assume low level of experience/training.

Nominal 1

1 High 0.5 0.5

5. Procedures Not available 50 50 FR-H.1 Available, but poor 5

5 Nominal 1

1 Diagnostic/symptom oriented 0.5

0.5

6. Ergonomics Missing/Misleading 50 50 Poor 10 10 Nominal 1

1

Good 0.5 0.5

7. Fitness for Duty Unfit 1.0a 1.0a Degraded Fitness 5

5 Nominal 1

1

8. Work Processes Poor 2

2

Working through EOPs is practiced routinely during requalification simulator training.

Based on operators performance on requalification examinations, assume poor work processes for diagnostic tasks.

Nominal 1

1 Good 0.8 0.8 Total = (1)x(2)x(3)x(4)x(5)x(6)x(7)x(8) 40 2

Nominal Failure Probability 1.0E-2 1.0E-2 Adjusted Probability = Total x Nominal 4.0E-1 2.0E-2

a. Task failure probability is 1.0 regardless of other PSFs.

LER 247/99-015 58 SENSITIVE - NOT FOR PUBLIC DISCLOSURE EPS-XHE-DG23-OB-L-2H and EPS-XHE-DG23-OB-L-4H (Operator action task)Operator fails to re-close output breaker (given LOOP and at least one EDG running to a bus that will not help to prevent core uncovery)

[ ] High end; [ ] Best estimate; [ ] Low end Performance Shaping Factors (PSF)

PSF Levels Multiplier Multiplier Operator action task Basis 2H 4H

1. Available Time Inadequate 1.0a 1.0a Once the need to reclose EDG breaker has been determined, the only remaining action is to (1) reset the breaker locally, and (2) send an aux operator locally to observed the EDG when the breaker is closed from the control room.

Time available time required 10

10 Nominal 1

1

Available > 50x time required 0.01 0.01

2. Stress Extreme 5

5 See diagnosis, above.

High 2

2

Nominal 1

1

3. Complexity Highly 5

5 Some local action is required; however, that task of resetting the breaker is not difficult to perform.

Moderately 2

2

Nominal 1

1

4. Experience/

Training Low 3

3 Nominal 1

1

High 0.5 0.5

5. Procedures Not available 50 50 ES-0.1 (Reactor Trip Response), Step 1, instructs the operator to restore power to de-energized buses.

Available, but poor 5

5 Nominal 1

1

6. Ergonomics Missing/Misleading 50 50 Poor 10 10 Nominal 1

1

Good 0.5 0.5

7. Fitness for Duty Unfit 1.0a 1.0a Degraded Fitness 5

5 Nominal 1

1

8. Work Processes Poor 2

2 Assume nominal work processes for Best Estimate Case, since this is an operator action task.

Nominal 1

1

Good 0.8 0.8 Total = (1)x(2)x(3)x(4)x(5)x(6)x(7)x(8) 40 4

Nominal Failure Probability 1E-3 1E-3 Action Failure Prob. (PSF x Nominal) 4.0E-2 4.0E-3 Diagnostic Failure Prob. (from other table) 4.0E-1 2.0E-2 Total Error Prob. (Action + Diagnostic) 4.4E-1 2.4E-2

a. Task failure probability is 1.0 regardless of other PSFs.

LER 247/99-015 59 SENSITIVE - NOT FOR PUBLIC DISCLOSURE EPS-XHE-DG23-OB-S-2H and EPS-XHE-DG23-OB-S-4H (Diagnostic task)Operator fails to re-close output breaker (given SBO)

[ ] High end; [ ] Best estimate; [ ] Low end Performance Shaping Factors (PSF)

PSF Levels (SBO) Multiplier Diagnostic task Basis 2H 4H

1. Available Time Inadequate 1.0a 1.0a Operators will go directly to SBO EOP-ECA 0.0. Procedure instructs operators to restore power cy cycling the tripped breaker. The instructions include measures that prevent breaker from tripping open again.

Barely adequate < 20 m 10 10 Nominal 30 m 1

1 Extra > 60 m 0.1

0.1

Expansive > 24 h 0.01 0.01

2. Stress Extreme 5

5 High 2

2

Nominal 1

1

3. Complexity Highly 5

5 Moderately 2

2 Nominal 1

1

4. Experience/

Training Low 10

10

Assume low level of experience/training for Best Estimate Case - diagnostic activity.

Nominal 1

1 High 0.5 0.5

5. Procedures Not available 50 50 Available, but poor 5

5 Nominal 1

1 Diagnostic/symptom oriented 0.5

0.5

6. Ergonomics Missing/Misleading 50 50 Poor 10 10 Nominal 1

1 Good 0.5 0.5

7. Fitness for Duty Unfit 1.0a 1.0a Degraded Fitness 5

5 Nominal 1

1

8. Work Processes Poor 2

2

Although working through EOPs is practiced routinely during requalification simulator training, assume poor work processes for Best Estimate Case.

Nominal 1

1 Good 0.8 0.8 Total = (1)x(2)x(3)x(4)x(5)x(6)x(7)x(8) 4.0 2.0 Nominal Failure Probability 1.0E-2 1.0E-2 Adjusted Probability = Total x Nominal 4.0E-2 2.0E-2

a. Task failure probability is 1.0 regardless of other PSFs.

LER 247/99-015 60 SENSITIVE - NOT FOR PUBLIC DISCLOSURE EPS-XHE-DG23-OB-S-2H and EPS-XHE-DG23-OB-S-4H (Operator action task)Operator fails to re-close output breaker (given SBO)

[ ] High end; [ ] Best estimate; [ ] Low end Performance Shaping Factors (PSF)

PSF Levels (SBO) Multiplier Operator action task Basis 2H 4H

1. Available Time Inadequate 1.0a 1.0a Once the need to reclose EDG breaker has been determined, the only remaining action is to (1) reset the breaker locally, and (2) send an aux. operator locally to observe the EDG when the breaker is closed from the control room.

Time available time required 10 10 Nominal 1

1

Available > 50x time required 0.01 0.01

2. Stress Extreme 5

5 See diagnosis, above.

High 2

2

Nominal 1

1

3. Complexity Highly 5

5 Some local action is required, however, the task of resetting the breaker is not difficult to perform.

Moderately 2

2 Nominal 1

1

4. Experience/

Training Low 3

3 Assume a nominal level of experience/training for the Best Estimate Case for this operator action task.

Nominal 1

1

High 0.5 0.5

5. Procedures Not available 50 50 ECA 0.0 instructs the operators to restore power to de-energized buses.

Available, but poor 5

5 Nominal 1

1

6. Ergonomics Missing/Misleading 50 50 Poor 10 10 Nominal 1

1

Good 0.5 0.5

7. Fitness for Duty Unfit 1.0a 1.0a Degraded Fitness 5

5 Nominal 1

1

8. Work Processes Poor 2

2 Assume nominal work processes for Best Estimate Case for this operator action task.

Nominal 1

1

Good 0.8 0.8 Total = (1)x(2)x(3)x(4)x(5)x(6)x(7)x(8) 2.0 2.0 Nominal Failure Probability 1.0E-3 1.0E-3 Action Failure Prob. (PSF x Nominal) 2.0E-3 2.0E-3 Diagnostic Failure Prob. (from other table) 4.0E-2 2.0E-2 Total Error Prob. (Action + Diagnostic) 4.2E-2 2.2E-2

a. Task failure probability is 1.0 regardless of other PSFs.

LER 247/99-015 61 SENSITIVE - NOT FOR PUBLIC DISCLOSURE HPI-XHE-XM-FB, HPI-XHE-XM-THRTL (Operator action task)Operator fails to initiate and throttle feed and bleed, respectively (given LOOP with loss of all feedwater)

[ ] High end; [ ] Best estimate; [ ] Low end Performance Shaping Factors (PSF)

PSF Levels Multiplier Operator action task Basis

-FB

-THRTL

1. Available Time Inadequate 1.0a 1.0a It is assumed that there is just enough time to initiate feed and bleed cooling.

Time available time required 10

10 Nominal 1

1

Available > 50x time required 0.01 0.01

2. Stress Extreme 5

5 High 2

2

Nominal 1

1

3. Complexity Highly 5

5 FR-H.1, Loss of Secondary Heat Sink, instructs the operator to establish and maintain feed and bleed cooling.

Moderately 2

2 Nominal 1

1

4. Experience/

Training Low 3

3 A nominal level of experience/training is assumed for the Best Estimate Case for these operator action tasks.

Nominal 1

1

High 0.5 0.5

5. Procedures Not available 50 50 Available, but poor 5

5 Nominal 1

1

6. Ergonomics Missing/Misleading 50 50 Poor 10 10 Nominal 1

1

Good 0.5 0.5

7. Fitness for Duty Unfit 1.0a 1.0a Degraded Fitness 5

5 Nominal 1

1

8. Work Processes Poor 2

2 Assume nominal work processes for the Best Estimate Case for this operator action task.

Nominal 1

1

Good 0.8 0.8 Total = (1)x(2)x(3)x(4)x(5)x(6)x(7)x(8) 20 2

Note: These tasks do not require a significant amount of diagnosis activity.

Feed and bleed cooling is proceduralized in FR-H.1.

Nominal Failure Probability 1.0E-3 1.0E-3 Action Failure Prob. (PSF x Nominal) 2.0E-2 2.0E-3 Diagnostic Failure Prob. (from other table) na na Total Error Prob. (Action + Diagnostic) 2.0E-2 2.0E-3

a. Task failure probability is 1.0 regardless of other PSFs.

LER 247/99-015 62 SENSITIVE - NOT FOR PUBLIC DISCLOSURE HPR-XHE-XM, RHR-XHE-XM (Operator action task)Operator fails to initiate HPR and RHR, respectively

[ ] High end; [ ] Best estimate; [ ] Low end Performance Shaping Factors (PSF)

PSF Levels Multiplier Operator action task Basis HPR RHR

1. Available Time Inadequate 1.0a 1.0a Time available time required 10 10 Nominal 1

1

Available > 50x time required 0.01 0.01

2. Stress Extreme 5

5 High stress during complicated LOOP/SBO scenario. Operators must perform action prior to RWST Low Level alarm.

High 2

2

Nominal 1

1

3. Complexity Highly 5

5 Moderately 2

2 Nominal 1

1

4. Experience/

Training Low 3

3 Assume a nominal level of experience/training for the Best Estimate Case for these operator action tasks.

Nominal 1

1

High 0.5 0.5

5. Procedures Not available 50 50 Available, but poor 5

5 Nominal 1

1

6. Ergonomics Missing/Misleading 50 50 Poor 10 10 Nominal 1

1

Good 0.5 0.5

7. Fitness for Duty Unfit 1.0a 1.0a Degraded Fitness 5

5 Nominal 1

1

8. Work Processes Poor 2

2 Assume nominal work processes for the Best Estimate Case for this operator action task.

Nominal 1

1

Good 0.8 0.8 Total = (1)x(2)x(3)x(4)x(5)x(6)x(7)x(8) 2 2

Note: These tasks do not require a significant amount of diagnosis activity.

Switchover to HPR is proceduralized in ES1.3, Transfer to Cold Leg Recirculation.

Nominal Failure Probability 1.0E-3 1.0E-3 Action Failure Prob. (PSF x Nominal) 2.oE-3 2.0E-3 Diagnostic Failure Prob. (from other table) na na Total Error Prob. (Action + Diagnostic) 2.0E-3 2.0E-3

a. Task failure probability is 1.0 regardless of other PSFs.

LER 247/99-015 63 SENSITIVE - NOT FOR PUBLIC DISCLOSURE OEP-XHE-NOREC-LOOP-2H and OEP-XHE-NOREC-LOOP-4H (Operator action task)Operator fails to recover offsite power within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months and 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months

[ ] High end; [ ] Best estimate; [ ] Low end Performance Shaping Factors (PSF)

PSF Levels (LOOP) Multiplier Operator action task Basis 2H 4H

1. Available Time Inadequate 1.0a 1.0a Offsite power must be restored to HPI/HPR. EOP E-0 will identify the need to restore power to a bus needed for HPI.

Operator can walk through E-0 (Step 3) within several minutes. AOI 27.1.1 can be completed within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months (max). HPI/HPR initiated within 1/2 hr Time available time required 10

10 Nominal 1

1

Available > 50x time req.

0.01 0.01

2. Stress Extreme 5

5 Core uncovery in 2-4 hours if bus(es) not energized from switchyard and HPI/HPR initiated. However, knowing power exists in the switchyard provides some relief from stress.

High 2

2

Nominal 1

1

3. Complexity Highly 5

5 Actions in AOI 27.1.1 include (1) removing and re-installing breaker control fuses, (2) local closing of transformer output breaker, (3) control room manipulations Moderately 2

2

Nominal 1

1

4. Experience/

Training Low 3

3 Assume a nominal level of experience/training for the Best Estimate Case for this operator action task.

Nominal 1

1

High 0.5 0.5

5. Procedures Not available 50 50 Instructions in Abnormal Operating Instructions (AOI) 27.1.1 (Loss of Normal Station Power); Step 4.5.

Available, but poor 5

5 Nominal 1

1

6. Ergonomics Missing/Misleading 50 50 Poor 10 10 Nominal 1

1

Good 0.5 0.5

7. Fitness for Duty Unfit 1.0a 1.0a Degraded Fitness 5

5 Nominal 1

1

8. Work Processes Poor 2

2 Assume nominal work processes for the Best Estimate Case for this operator action task.

Nominal 1

1

Good 0.8 0.8 Total = (1)x(2)x(3)x(4)x(5)x(6)x(7)x(8) 40 40 Note: This task does not contain a significant amount of diagnosis activity.

Identification of the need to restore offsite power to critical bus is thru E-0 for SORV and FR-H.1/ES-1.1 for HPR initiation during F&B cooling.

Nominal Failure Probability 1.0E-3 1.0E-3 Action Failure Prob. (PSF x Nominal) 4.0E-2 4.0E-2 Diagnostic Failure Prob. (from other table)

See note See note Total Error Prob. (Action + Diagnostic) 4.0E-2 4.0E-2

a. Task failure probability is 1.0 regardless of other PSFs.

LER 247/99-015 64 SENSITIVE - NOT FOR PUBLIC DISCLOSURE PCS-XHE-XM-CDOWN (Operator action task)Operator fails to initiate RCS cooldown via steam generator dump valves (given LOOP)

[ ] High end; [ ] Best estimate; [ ] Low end Performance Shaping Factors (PSF)

PSF Levels Multiplier Operator action task Basis

1. Available Time Inadequate 1.0a Time available time required 10 Nominal 1

Available > 50x time required 0.01

2. Stress Extreme 5

It is assumed that the stress level is greater than nominal.

High 2

Nominal 1

3. Complexity Highly 5

Moderately 2

Nominal 1

4. Experience/

Training Low 3

Nominal 1

High 0.5

5. Procedures Not available 50 Available, but poor 5

Nominal 1

6. Ergonomics Missing/Misleading 50 Poor 10 Nominal 1

Good 0.5

7. Fitness for Duty Unfit 1.0a Degraded Fitness 5

Nominal 1

8. Work Processes Poor 2

Assume nominal work processes for the Best Estimate Case for this operator action task.

Nominal 1

Good 0.8 Total = (1)x(2)x(3)x(4)x(5)x(6)x(7)x(8) 2 Note: This task does not require a significant amount of diagnosis activity and is proceduralized.

Nominal Failure Probability 1.0E-3 Action Failure Prob. (PSF x Nominal) 2.0E-3 Diagnostic Failure Prob. (from other table) na Total Error Prob. (Action + Diagnostic) 2.0E-3

a. Task failure probability is 1.0 regardless of other PSFs.

LER 247/99-015 65 SENSITIVE - NOT FOR PUBLIC DISCLOSURE SSS-XHE-L-2H and SSS-XHE-S-2H (Diagnostic task)Operator fails to initiate ASSS within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months during LOOP and SBO, respectively

[ ] High end; [ ] Best estimate; [ ] Low end Performance Shaping Factors (PSF)

PSF Levels Multiplier Multiplier Diagnostic task Basis 2H LOOP 2H SBO

1. Available Time Inadequate 1.0a 1.0a 1-2 hours to initiate ASSS power to AFW pump 21 (per SRI and SRA).

Therefore, little time is available for identifying the need for ASSS.

Barely adequate < 20 m 10

10

Nominal 30 m 1

1 Extra > 60 m 0.1 0.1 Expansive > 24 h 0.01 0.01

2. Stress Extreme 5

5 Core uncovery in 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months if ASSS not established. However, knowing power exists in the switchyard provides some relief from stress.

High 2

2

Nominal 1

1

3. Complexity Highly 5

5 Operators must deduce that ASSS is the only option when all other means are not available (e.g., repairing TDAFW, MFW, condensate, F&B) or not preferred (i.e.,

reclosing EDG breaker to Bus 6A). EOP FR-H.1 lists all other options except ASSS, however. Easier for SBO with no EDGs available.

Moderately 2

2 Nominal 1

1

4. Experience/

Training Low 10

10

Assume a low level of experience/training for the Best Estimate Case for this diagnostic task.

Nominal 1

1 High 0.5 0.5

5. Procedures Not available 50 50 AOI 27.1.9 provides instruction for initiating ASSS during control evacuation. However, skill-of-the-craft is needed to deduce that ASSS is the option for the specific scenario of interest.

Available, but poor 5

5 Nominal 1

1

Diagnostic/symptom oriented 0.5 0.5

6. Ergonomics Missing/Misleading 50 50 Poor 10 10 Nominal 1

1

Good 0.5 0.5

7. Fitness for Duty Unfit 1.0a 1.0a Degraded Fitness 5

5 Nominal 1

1

8. Work Processes Poor 2

2

Assume poor work processes for the Best Estimate Case for this diagnostic task.

Nominal 1

1 Good 0.8 0.8 Total = (1)x(2)x(3)x(4)x(5)x(6)x(7)x(8) 800 400 Nominal Failure Probability 1.0E-2 1.0E-2 Adjusted Probability = Total x Nominal 1.0 1.0

a. Task failure probability is 1.0 regardless of other PSFs.

LER 247/99-015 66 SENSITIVE - NOT FOR PUBLIC DISCLOSURE SSS-XHE-L-2H and SSS-XHE-S-2H (Operator action task)Operator fails to initiate ASSS within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months during LOOP and SBO

[ ] High end; [ ] Best estimate; [ ] Low end Performance Shaping Factors (PSF)

PSF Levels Multiplier Multiplier Operator action task Basis 2H LOOP 2H SBO

1. Available Time Inadequate 1.0a 1.0a 1-2 hours to initiate ASSS power to AFW pump 21 (per SRI and SRA).

Time available time required 10 10 Nominal 1

1 Available > 50x time required 0.01 0.01

2. Stress Extreme 5

5 Core uncovery in 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months if ASSS not established. However, knowing power exists in the switchyard provides some relief from stress.

High 2

2 Nominal 1

1

3. Complexity Highly 5

5 Two operators are required to complete local action. Coordination required with CR and the two (local) operators. Tasks (open/close breaker, transfer switch) are routine Moderately 2

2 Nominal 1

1

4. Experience/

Training Low 3

3 Nominal 1

1 High 0.5 0.5

5. Procedures Not available 50 50 Abnormal Operating Instruction (AOI) AOI 27.1.9 (Control Room Inaccessibility Safe Shutdown Control)

Available, but poor 5

5 Nominal 1

1

6. Ergonomics Missing/Misleading 50 50 Poor 10 10 Nominal 1

1 Good 0.5 0.5

7. Fitness for Duty Unfit 1.0a 1.0a Degraded Fitness 5

5 Nominal 1

1

8. Work Processes Poor 2

2 Nominal 1

1 Good 0.8 0.8 Total = (1)x(2)x(3)x(4)x(5)x(6)x(7)x(8)

Nominal Failure Probability 1.0E-3 1.0E-3 Action Failure Prob. (PSF x Nominal)

Diagnostic Failure Prob. (from other table) 1.0 1.0 Total Error Prob. (Action + Diagnostic) 1.0 1.0

a. Task failure probability is 1.0 regardless of other PSFs.

LER 247/99-015 67 SENSITIVE - NOT FOR PUBLIC DISCLOSURE OEP-XHE-NOREC-ST (2 hrs), OEP-XHE-NOREC-SBO-4H, ACP-XHE-NOREC-BD (7 hrs)(Operator action tasks)

Operator fails to restore ac power (offsite and EDG) during SBO

[] High end; [ ] Best estimate; [ ] Low end Performance Shaping Factors (PSF)

PSF Levels Multipliers (SBO)

Operator action task Basis 2H 4H 7H

1. Available Time Inadequate 1.0a 1.0a 1.0a Offsite power must be restored to HPI/HPR or motor-driven AFW pumps. EOP ECA-0.0 will identify the need to restore power to a bus needed for HPI or AFW. Operator can walk through E-0.0 (Step 3) within several minutes. AOI 27.1.1 can be completed within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months (max). HPI/HPR initiated within 1/2 hr. Core uncovery in 2-4 hours if bus(es) not energized from switchyard and HPI/HPR or AFW initiated. However, knowing power exists in the switchyard provides some relief from stress. Actions in AOI 27.1.1 include (1) removing and re-installing breaker control fuses, (2) local closing of transformer output breaker, (3) control room manipulations.

Time available time required 10

10 10 Nominal 1

1

Available > 50x time required 0.01 0.01 0.01

2. Stress Extreme 5

5 5

High 2

2

Nominal 1

1 1

3. Complexity Highly 5

5 5

Moderately 2

2 2

Nominal 1

1

4. Experience/

Training Low 3

3 3

Assume a nominal level of experience/training for the High End Case for these operator action tasks.

Nominal 1

1

High 0.5 0.5 0.5

5. Procedures Not available 50 50 50 Instructions in Abnormal Operating Instructions (AOI) 27.1.1 (Loss of Normal Station Power); Step 4.5.

AOI referenced in EOP ECA-0.0 (Loss of All AC Power).

Available, but poor 5

5 5

Nominal 1

1

6. Ergonomics Missing/Misleading 50 50 50 Poor 10 10 10 Nominal 1

1

Good 0.5 0.5 0.5

7. Fitness for Duty Unfit 1.0a 1.0a 1.0a Degraded Fitness 5

5 5

Nominal 1

1

8. Work Processes Poor 2

2 2

Assume nominal work processes for the High End Case for these specific operator action tasks.

Nominal 1

1

Good 0.8 0.8 0.8 Total = (1)x(2)x(3)x(4)x(5)x(6)x(7)x(8) 40 4

4 These operator actions are proceduralized in ECA 0.0 Nominal Failure Probability 1.0E-3 1.0E-3 1.0E-3 Action Failure Prob. (PSF x Nominal) 4.0E-2 4.0E-3 4.0E-3 Diagnostic Failure Prob. (from other table) na na na Total Error Prob. (Action + Diagnostic) 4.0E-2 4.0E-3 4.0E-3

a. Task failure probability is 1.0 regardless of other PSFs.

LER 247/99-015 68 SENSITIVE - NOT FOR PUBLIC DISCLOSURE COND-XHE-XM-LOOP-2H and COND-XHE-XM-SBO-2H (Operator action task)Operator fails to establish condensate flow in 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months

[] High end; [ ] Best estimate; [ ] Low end Performance Shaping Factors (PSF)

PSF Levels Multiplier Multiplier Operator action task Basis 2H LOOP 2H SBO

1. Available Time Inadequate 1.0a 1.0a About 1-2 hours to complete actions; local actions required. TTC performed actions from control room (simulator) within 30 minutes. Local actions (see Complexity, below) will extend time to about 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

Time available time required 10

10

Nominal 1

1 Available > 50x time required 0.01 0.01

2. Stress Extreme 5

5 Core uncovery in 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months if condensate system not initiated. However, knowing power exists in the switchyard provides some relief from stress High 2

2

Nominal 1

1

3. Complexity Highly 5

5 Local action requiredlifting leads or installing flexible air hose.

Moderately 2

2

Nominal 1

1

4. Experience/

Training Low 3

3 Assume a nominal level of experience/training for the High End Case, since these are operator action activities.

Nominal 1

1

High 0.5 0.5

5. Procedures Not available 50 50 FR-H.1 (Response to Loss of Secondary Heat Sink); SOP 20.2 (Condensate System Operation); and AOI 27.1.9 for local operation of the SG dump valves Available, but poor 5

5 Nominal 1

1

6. Ergonomics Missing/Misleading 50 50 Poor 10 10 Nominal 1

1

Good 0.5 0.5

7. Fitness for Duty Unfit 1.0a 1.0a Degraded Fitness 5

5 Nominal 1

1

8. Work Processes Poor 2

2 Assume nominal work processes for the High End Case, since these are operator action activities.

Nominal 1

1

Good 0.8 0.8 Total = (1)x(2)x(3)x(4)x(5)x(6)x(7)x(8) 40 40 Note: This task does not require a significant amount of diagnosis activity, because this alternative means of steam generator injection is proceduralized in FR-H.1.

Nominal Failure Probability 1E-3 1E-3 Action Failure Prob. (PSF x Nominal) 4.0E-2 4.0E-2 Diagnostic Failure Prob. (from other table) na na Total Error Prob. (Action + Diagnostic) 4.0E-2 4.0E-2

a. Task failure probability is 1.0 regardless of other PSFs.

LER 247/99-015 69 SENSITIVE - NOT FOR PUBLIC DISCLOSURE EPS-XHE-DG23-OB-L-2H and EPS-XHE-DG23-OB-L-4H (Diagnostic task)Operator fails to re-close output breaker (given LOOP and at least one EDG running to a bus that will not help to prevent core uncovery)

[] High end; [ ] Best estimate; [ ] Low end Performance Shaping Factors (PSF)

PSF Levels (LOOP) Multiplier Diagnostic task Basis 2H 4H

1. Available Time Inadequate 1.0a 1.0a The operating EDG may distract the operators; however, degraded critical safety function (Heat Sink) will direct the operators through EOP FR-H.1. The EOP will identify the need to establish power to Bus 6A ( the remaining option). Operators can walk through the FR-H.1 within several minutes to an hour.

Barely adequate < 20 m 10 10 Nominal 30 m 1

1 Extra > 60 m 0.1 0.1

Expansive > 24 h 0.01 0.01

2. Stress Extreme 5

5 Core uncovery in 2-4 hours if Bus 6A not energized and safety systems initiated.

However, knowing power exists in the switchyard provides some relief from stress.

High 2

2

Nominal 1

1

3. Complexity Highly 5

5 Some ambiguity with the knowledge of the state of the bus, e.g., potential fault could damage EDG and bus further. However, the 4-hr sequence provides some time to assess the bus.

Moderately 2

2 Nominal 1

1

4. Experience/

Training Low 10

10

Based on operators performance on requalification examinations, assume low level of experience/training.

Nominal 1

1 High 0.5 0.5

5. Procedures Not available 50 50 FR-H.1 Available, but poor 5

5 Nominal 1

1 Diagnostic/symptom oriented 0.5

0.5

6. Ergonomics Missing/Misleading 50 50 Poor 10 10 Nominal 1

1

Good 0.5 0.5

7. Fitness for Duty Unfit 1.0a 1.0a Degraded Fitness 5

5 Nominal 1

1

8. Work Processes Poor 2

2

Working through EOPs is practiced routinely during requalification simulator training.

Based on operators performance on requalification examinations, assume poor work processes for this diagnostic task.

Nominal 1

1 Good 0.8 0.8 Total = (1)x(2)x(3)x(4)x(5)x(6)x(7)x(8) 40 2

Nominal Failure Probability 1.0E-2 1.0E-2 Adjusted Probability = Total x Nominal 4.0E-1 2.0E-2

a. Task failure probability is 1.0 regardless of other PSFs.

LER 247/99-015 70 SENSITIVE - NOT FOR PUBLIC DISCLOSURE EPS-XHE-DG23-OB-L-2H and EPS-XHE-DG23-OB-L-4H (Operator action task)Operator fails to re-close output breaker (given LOOP and at least one EDG running to a bus that will not help to prevent core uncovery)

[] High end; [ ] Best estimate; [ ] Low end Performance Shaping Factors (PSF)

PSF Levels Multiplier Multiplier Operator action task Basis 2H 4H

1. Available Time Inadequate 1.0a 1.0a Once the need to reclose EDG breaker has been determined, the only remaining action is to (1) reset the breaker locally, and (2) send an aux operator locally to observed the EDG when the breaker is closed from the control room.

Time available time required 10

10 Nominal 1

1

Available > 50x time required 0.01 0.01

2. Stress Extreme 5

5 See diagnosis, above.

High 2

2

Nominal 1

1

3. Complexity Highly 5

5 Some local action is required; however, that task of resetting the breaker is not difficult to perform.

Moderately 2

2

Nominal 1

1

4. Experience/

Training Low 3

3

Assume a low level of experience/training for the High End Case for these operator action tasks.

Nominal 1

1 High 0.5 0.5

5. Procedures Not available 50 50 ES-0.1 (Reactor Trip Response), Step 1, instructs the operator to restore power to de-energized buses.

Available, but poor 5

5 Nominal 1

1

6. Ergonomics Missing/Misleading 50 50 Poor 10 10 Nominal 1

1

Good 0.5 0.5

7. Fitness for Duty Unfit 1.0a 1.0a Degraded Fitness 5

5 Nominal 1

1

8. Work Processes Poor 2

2

Assume poor work processes for the High End Case for these operator action tasks.

Nominal 1

1 Good 0.8 0.8 Total = (1)x(2)x(3)x(4)x(5)x(6)x(7)x(8) 240 24 Nominal Failure Probability 1E-3 1E-3 Action Failure Prob. (PSF x Nominal) 2.4E-1 2.4E-2 Diagnostic Failure Prob. (from other table) 4.0E-1 2.0E-2 Total Error Prob. (Action + Diagnostic) 6.4E-1 4.4E-2

a. Task failure probability is 1.0 regardless of other PSFs.

LER 247/99-015 71 SENSITIVE - NOT FOR PUBLIC DISCLOSURE EPS-XHE-DG23-OB-S-2H and EPS-XHE-DG23-OB-S-4H (Diagnostic task)Operator fails to re-close output breaker (given SBO)

[] High end; [ ] Best estimate; [ ] Low end Performance Shaping Factors (PSF)

PSF Levels (SBO) Multiplier Diagnostic task Basis 2H 4H

1. Available Time Inadequate 1.0a 1.0a Operators will go directly to SBO EOP-ECA 0.0. Procedure instructs operators to restore power cy cycling the tripped breaker. The instructions include measures that prevent breaker from tripping open again.

Barely adequate < 20 m 10 10 Nominal 30 m 1

1 Extra > 60 m 0.1

0.1

Expansive > 24 h 0.01 0.01

2. Stress Extreme 5

5 High 2

2

Nominal 1

1

3. Complexity Highly 5

5 Moderately 2

2 Nominal 1

1

4. Experience/

Training Low 10

10

Assume low level of experience/training for High End Case - diagnostic activity.

Nominal 1

1 High 0.5 0.5

5. Procedures Not available 50 50 Available, but poor 5

5 Nominal 1

1 Diagnostic/symptom oriented 0.5

0.5

6. Ergonomics Missing/Misleading 50 50 Poor 10 10 Nominal 1

1

Good 0.5 0.5

7. Fitness for Duty Unfit 1.0a 1.0a Degraded Fitness 5

5 Nominal 1

1

8. Work Processes Poor 2

2

Although working through EOPs is practiced routinely during requalification simulator training, assume poor work processes for High End Case.

Nominal 1

1 Good 0.8 0.8 Total = (1)x(2)x(3)x(4)x(5)x(6)x(7)x(8) 4 2

Nominal Failure Probability 1.0E-2 1.0E-2 Adjusted Probability = Total x Nominal 4.0E-2 2.0E-2

a. Task failure probability is 1.0 regardless of other PSFs.

LER 247/99-015 72 SENSITIVE - NOT FOR PUBLIC DISCLOSURE EPS-XHE-DG23-OB-S-2H and EPS-XHE-DG23-OB-S-4H (Operator action task)Operator fails to re-close output breaker (given SBO)

[] High end; [] Best estimate; [ ] Low end Performance Shaping Factors (PSF)

PSF Levels (SBO) Multiplier Operator action task Basis 2H 4H

1. Available Time Inadequate 1.0a 1.0a Once the need to reclose EDG breaker has been determined, the only remaining action is to (1) reset the breaker locally, and (2) send an aux operator locally to observed the EDG when the breaker is closed from the control room.

Time available time required 10 10 Nominal 1

1

Available > 50x time required 0.01 0.01

2. Stress Extreme 5

5 See diagnosis above.

High 2

2

Nominal 1

1

3. Complexity Highly 5

5 Some local action is required; however, that task of resetting the breaker is not difficult to perform.

Moderately 2

2 Nominal 1

1

4. Experience/

Training Low 3

3

Assume a low level of experience/training for the High End Case for these operator action tasks.

Nominal 1

1 High 0.5 0.5

5. Procedures Not available 50 50 ES-0.1 (Reactor Trip Response), Step 1, instructs the operator to restore power to de-energized buses.

Available, but poor 5

5 Nominal 1

1

6. Ergonomics Missing/Misleading 50 50 Poor 10 10 Nominal 1

1

Good 0.5 0.5

7. Fitness for Duty Unfit 1.0a 1.0a Degraded Fitness 5

5 Nominal 1

1

8. Work Processes Poor 2

2

Assume poor work processes for the High End Case for these operator action tasks.

Nominal 1

1 Good 0.8 0.8 Total = (1)x(2)x(3)x(4)x(5)x(6)x(7)x(8) 12 12 Nominal Failure Probability 1.0E-3 1.0E-3 Action Failure Prob. (PSF x Nominal) 1.2E-2 1.2E-2 Diagnostic Failure Prob. (from other table) 4.0E-2 2.0E-2 Total Error Prob. (Action + Diagnostic) 5.2E-2 3.2E-2

a. Task failure probability is 1.0 regardless of other PSFs.

LER 247/99-015 73 SENSITIVE - NOT FOR PUBLIC DISCLOSURE HPI-XHE-XM-FB, HPI-XHE-XM-THRTL (Operator action task)Operator fails to initiate and throttle feed and bleed, respectively (given LOOP with loss of all feedwater)

[] High end; [ ] Best estimate; [ ] Low end Performance Shaping Factors (PSF)

PSF Levels Multiplier Operator action task Basis

-FB

-THRTL

1. Available Time Inadequate 1.0a 1.0a It is assumed that there is just enough time to initiate feed and bleed cooling.

Time available time required 10

10 Nominal 1

1

Available > 50x time required 0.01 0.01

2. Stress Extreme 5

5 High 2

2

Nominal 1

1

3. Complexity Highly 5

5 FR-H.1, Loss of Secondary Heat Sink, instructs the operator to establish and maintain feed and bleed cooling.

Moderately 2

2 Nominal 1

1

4. Experience/

Training Low 3

3 A nominal level of experience/training is assumed for the High End Case for these operator action tasks.

Nominal 1

1

High 0.5 0.5

5. Procedures Not available 50 50 Available, but poor 5

5 Nominal 1

1

6. Ergonomics Missing/Misleading 50 50 Poor 10 10 Nominal 1

1

Good 0.5 0.5

7. Fitness for Duty Unfit 1.0a 1.0a Degraded Fitness 5

5 Nominal 1

1

8. Work Processes Poor 2

2 Nominal 1

1

Good 0.8 0.8 Total = (1)x(2)x(3)x(4)x(5)x(6)x(7)x(8) 20 2

Note: these tasks do not require a significant amount of diagnosis activity. Feed and bleed cooling is proceduralized in FR-H.1.

Nominal Failure Probability 1.0E-3 1.0E-3 Action Failure Prob. (PSF x Nominal) 2.0E-2 2.0E-3 Diagnostic Failure Prob. (from other table) na na Total Error Prob. (Action + Diagnostic) 2.0E-2 2.0E-3

a. Task failure probability is 1.0 regardless of other PSFs.

LER 247/99-015 74 SENSITIVE - NOT FOR PUBLIC DISCLOSURE HPR-XHE-XM, RHR-XHE-XM (Operator action task)Operator fails to initiate HPR and RHR, respectively

[] High end; [ ] Best estimate; [ ] Low end Performance Shaping Factors (PSF)

PSF Levels Multiplier Operator action task Basis HPR RHR

1. Available Time Inadequate 1.0a 1.0a Time available time required 10 10 Nominal 1

1

Available > 50x time required 0.01 0.01

2. Stress Extreme 5

5 High stress during complicated LOOP/SBO scenario. Operators must perform action prior to RWST Low Level alarm.

High 2

2

Nominal 1

1

3. Complexity Highly 5

5 Moderately 2

2 Nominal 1

1

4. Experience/

Training Low 3

3 Assume a nominal level of experience/training for the Best Estimate Case for these operator action tasks.

Nominal 1

1

High 0.5 0.5

5. Procedures Not available 50 50 Available, but poor 5

5 Nominal 1

1

6. Ergonomics Missing/Misleading 50 50 Poor 10 10 Nominal 1

1

Good 0.5 0.5

7. Fitness for Duty Unfit 1.0a 1.0a Degraded Fitness 5

5 Nominal 1

1

8. Work Processes Poor 2

2 Assume nominal work processes for the high End Case for these operator action tasks.

Nominal 1

1

Good 0.8 0.8 Total = (1)x(2)x(3)x(4)x(5)x(6)x(7)x(8) 2 2

Note: These tasks do not require a significant amount of diagnosis activity.

Switchover to HPR is proceduralized in ES1.3, Transfer to Cold Leg Recirculation.

Nominal Failure Probability 1.0E-3 1.0E-3 Action Failure Prob. (PSF x Nominal) 2.0E-3 2.0E-3 Diagnostic Failure Prob. (from other table) na na Total Error Prob. (Action + Diagnostic) 2.0E-3 2.0E-3

a. Task failure probability is 1.0 regardless of other PSFs.

LER 247/99-015 75 SENSITIVE - NOT FOR PUBLIC DISCLOSURE OEP-XHE-NOREC-LOOP-2H and OEP-XHE-NOREC-LOOP-4H (Operator action task)Operator fails to recover offsite power within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months and 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months

[] High end; [ ] Best estimate; [ ] Low end Performance Shaping Factors (PSF)

PSF Levels (LOOP) Multiplier Operator action task Basis 2H 4H

1. Available Time Inadequate 1.0a 1.0a Offsite power must be restored to HPI/HPR. EOP E-0 will identify the need to restore power to a bus needed for HPI.

Operator can walkthrough E-0 (Step 3) within several minutes. AOI 27.1.1 can be completed within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months (max). HPI/HPR initiated within 1/2 hr.

Time available time required 10

10 Nominal 1

1

Available > 50x time req.

0.01 0.01

2. Stress Extreme 5

5 Core uncovery in 2-4 hours if bus(es) not energized from switchyard and HPI/HPR initiated. However, knowing power exists in the switchyard provides some relief from stress.

High 2

2

Nominal 1

1

3. Complexity Highly 5

5 Actions in AOI 27.1.1 include (1) removing and re-installing breaker control fuses, (2) local closing of transformer output breaker, (3) control room manipulations Moderately 2

2

Nominal 1

1

4. Experience/

Training Low 3

3

Based on the operators performance on requalification examinations, assume a low level of experience/training in the High End Case for these operator action tasks.

Nominal 1

1 High 0.5 0.5

5. Procedures Not available 50 50 Instructions in Abnormal Operating Instructions (AOI) 27.1.1 (Loss of Normal Station Power); Step 4.5.

Available, but poor 5

5 Nominal 1

1

6. Ergonomics Missing/Misleading 50 50 Poor 10 10 Nominal 1

1

Good 0.5 0.5

7. Fitness for Duty Unfit 1.0a 1.0a Degraded Fitness 5

5 Nominal 1

1

8. Work Processes Poor 2

2

Based on the operators performance on requalification examinations, assume poor work processes in the High End Case for these operator action tasks.

Nominal 1

1 Good 0.8 0.8 Total = (1)x(2)x(3)x(4)x(5)x(6)x(7)x(8) 240 24 Note: This task does not contain a significant amount of diagnosis activity.

Identification of the need to restore offsite power to critical bus is thru E-0 for SORV and FR-H.1/ES-1.1 for HPR initiation during F&B Nominal Failure Probability 1.0E-3 1.0E-3 Action Failure Prob. (PSF x Nominal) 2.4E-1 2.4E-2 Diagnostic Failure Prob. (from other table)

See note See note Total Error Prob. (Action + Diagnostic) 2.4E-1 2.4E-2

a. Task failure probability is 1.0 regardless of other PSFs.

LER 247/99-015 76 SENSITIVE - NOT FOR PUBLIC DISCLOSURE PCS-XHE-XM-CDOWN (Operator action task)Operator fails to initiate RCS cooldown via steam generator dump valves (given LOOP)

[] High end; [ ] Best estimate; [ ] Low end Performance Shaping Factors (PSF)

PSF Levels Multiplier Operator action task Basis

1. Available Time Inadequate 1.0a Time available time required 10 Nominal 1

Available > 50x time required 0.01

2. Stress Extreme 5

It is assumed that the stress level is greater than normal.

High 2

Nominal 1

3. Complexity Highly 5

Moderately 2

Nominal 1

4. Experience/

Training Low 3

Assume a nominal level of experience/training in the High End Case for this operator action task.

Nominal 1

High 0.5

5. Procedures Not available 50 Available, but poor 5

Nominal 1

6. Ergonomics Missing/Misleading 50 Poor 10 Nominal 1

Good 0.5

7. Fitness for Duty Unfit 1.0a Degraded Fitness 5

Nominal 1

8. Work Processes Poor 2

Assume nominal work processes in the High End Case for this operator action task.

Nominal 1

Good 0.8 Total = (1)x(2)x(3)x(4)x(5)x(6)x(7)x(8) 2 Note: this task does not require a significant amount of diagnosis activity and is proceduralized.

Nominal Failure Probability 1.0E-3 Action Failure Prob. (PSF x Nominal) 2.0E-3 Diagnostic Failure Prob. (from other table) na Total Error Prob. (Action + Diagnostic) 2.0E-3

a. Task failure probability is 1.0 regardless of other PSFs.

LER 247/99-015 77 SENSITIVE - NOT FOR PUBLIC DISCLOSURE SSS-XHE-L-2H and SSS-XHE-S-2H (Diagnostic task)Operator fails to initiate ASSS within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months during LOOP and SBO, respectively

[] High end; [ ] Best estimate; [ ] Low end Performance Shaping Factors (PSF)

PSF Levels Multiplier Multiplier Diagnostic task Basis 2H LOOP 2H SBO

1. Available Time Inadequate 1.0a 1.0a 1-2 hours to initiate ASSS power to AFW pump 21 (per SRI and SRA).

Therefore, little time is available for identify the need for ASSS.

Barely adequate < 20 m 10

10

Nominal 30 m 1

1 Extra > 60 m 0.1 0.1 Expansive > 24 h 0.01 0.01

2. Stress Extreme 5

5 Core uncovery in 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months if ASSS not established. However, knowing power exists in the switchyard provides some relief from stress.

High 2

2

Nominal 1

1

3. Complexity Highly 5

5 Operators must deduce that ASSS is the only option when all other means are not available (e.g., repairing TDAFW, MFW, condensate, F&B) or not preferred (i.e.,

reclosing EDG breaker to Bus 6A). EOP FR-H.1 lists all other options except ASSS, however. Easier for SBO with no EDGs available.

Moderately 2

2 Nominal 1

1

4. Experience/

Training Low 10

10

Based on the operators performance on the requalification examinations, assume a low level of experience/training in the High End Case for these operator action tasks.

Nominal 1

1 High 0.5 0.5

5. Procedures Not available 50 50 AOI 27.1.9 provides instruction for initiating ASSS during control evacuation. However, skill-of-the-craft is needed to deduce that ASSS is the option.

Available, but poor 5

5 Nominal 1

1

Diagnostic/symptom oriented 0.5 0.5

6. Ergonomics Missing/Misleading 50 50 Poor 10 10 Nominal 1

1

Good 0.5 0.5

7. Fitness for Duty Unfit 1.0a 1.0a Degraded Fitness 5

5 Nominal 1

1

8. Work Processes Poor 2

2

Based on the operators performance on the requalification examinations, assume poor work processes in the High End Case for this operator action task.

Nominal 1

1 Good 0.8 0.8 Total = (1)x(2)x(3)x(4)x(5)x(6)x(7)x(8) 800 400 Nominal Failure Probability 1.0E-2 1.0E-2 Adjusted Probability = Total x Nominal 1.0 1.0

a. Task failure probability is 1.0 regardless of other PSFs.

LER 247/99-015 78 SENSITIVE - NOT FOR PUBLIC DISCLOSURE SSS-XHE-L-2H and SSS-XHE-S-2H (Operator action task)Operator fails to initiate ASSS within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months during LOOP and SBO

[] High end; [ ] Best estimate; [ ] Low end Performance Shaping Factors (PSF)

PSF Levels Multiplier Multiplier Operator action task Basis 2H LOOP 2H SBO

1. Available Time Inadequate 1.0a 1.0a 1-2 hours to initiate ASSS power to AFW pump 21 (per SRI and SRA).

Time available time required 10 10 Nominal 1

1 Available > 50x time required 0.01 0.01

2. Stress Extreme 5

5 Core uncovery in 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months if ASSS not established. However, knowing power exists in the switchyard provides some relief from stress.

High 2

2 Nominal 1

1

3. Complexity Highly 5

5 Two operators are required to complete local action. Coordination required with CR and the two (local) operators. Tasks (open/close breaker, transfer switch) are routine Moderately 2

2 Nominal 1

1

4. Experience/

Training Low 3

3 Nominal 1

1 High 0.5 0.5

5. Procedures Not available 50 50 Abnormal Operating Instruction (AOI) AOI 27.1.9 (Control Room Inaccessibility Safe Shutdown Control)

Available, but poor 5

5 Nominal 1

1

6. Ergonomics Missing/Misleading 50 50 Poor 10 10 Nominal 1

1 Good 0.5 0.5

7. Fitness for Duty Unfit 1.0a 1.0a Degraded Fitness 5

5 Nominal 1

1

8. Work Processes Poor 2

2 Nominal 1

1 Good 0.8 0.8 Total = (1)x(2)x(3)x(4)x(5)x(6)x(7)x(8)

Nominal Failure Probability 1.0E-3 1.0E-3 Action Failure Prob. (PSF x Nominal)

Diagnostic Failure Prob. (from other table) 1.0 1.0 Total Error Prob. (Action + Diagnostic) 1.0 1.0

a. Task failure probability is 1.0 regardless of other PSFs.

LER 247/99-015 79 SENSITIVE - NOT FOR PUBLIC DISCLOSURE ATTACHMENT 3 EVALUATION OF INDUCED STEAM GENERATOR TUBE RUPTURE POTENTIAL A consequential steam generator tube rupture could have increased the risk associated with this event. As demonstrated below, the impact of the degraded steam generator tube on the CCDP associated with this event is negligible.

In order to contribute to CCDP, the probability of one of the sequences discussed below must be significant compared to the CCDP associated with the loss of electric power to safety bus 6A event itself.

A3-1. Sequence 1: Failure to control reactivity introduces additional stresses on the degraded steam generator tube This sequence consists of the following events:

Failure of reactor trip function.

Degraded steam generator tube fails as a result of additional stresses created by ATWS event.

Core damage results from failure to mitigate the subsequent steam generator tube rupture.

The contribution from this sequence was included as part of the estimated CCDP resulting from the final analysis of the loss of offsite power to bus 6A.

A3-2. Sequence 2: Failure to introduce auxiliary feedwater causes dryout of steam generator and introduces additional stresses on the degraded steam generator tube This sequence consists of the following events:

Auxiliary feedwater fails.

Feed and bleed cooling fails.

Degraded steam generator tube fails due to steam generator dryout.

Core damage results from failure to mitigate the subsequent steam generator rupture.

Since the feed and bleed function was unavailable when the event occurred (due to the loss of power to one of the two closed PORV block valves), the contribution from this sequence was also included as part of the estimated CCDP resulting from the final analysis of the loss of offsite power to bus 6A.

A3-3. Sequence 3: Secondary side pressure reduces rapidly due to main steam line break while the primary pressure stays high This sequence consists of the following events:

Main steam line break occurs.

Rapid secondary side depressurization leads to a steam generator tube rupture.

Core damage results from failure to mitigate the subsequent steam generator tube rupture.

LER 247/99-015 80 SENSITIVE - NOT FOR PUBLIC DISCLOSURE The CCDP contribution for this sequence can be estimated as follows:

(probability of loss of offsite power to bus 6A)*(probability of a main steam line break outside containment - from Ref. A.3-1)*(CCDP associated with a classical SGTR - from Indian Point 2 SPAR model) = (1.0)*(3.0E-4 /yr)*(1yr/8760 hr)*(24hr)*(4.0E-4) = 3.3E-10 Compared with the estimated CCDP from the loss of offsite power to bus 6A (2.2E-5),

the contribution of Sequence 3 is negligible.

A3-4. Sequence 4: Secondary side pressure reduces rapidly due to stuck-open steam generator relief valve while the primary system pressure stays high This sequence consists of the following events:

Primary side heat removal degrades and consequently reactor coolant system pressure stays high.

Secondary side pressure increases due to a loss of heat sink (main condenser) upon reactor trip and challenges a steam generator power-operated relief valve.

Steam generator power-operated relief valve fails to open, resulting in a challenge of a steam generator safety valve.

Steam generator safety valve opens, but fails to close, resulting in depressurization of the secondary side.

Degraded steam generator tube fails as a result of the depressurization.

Core damage results from failure to mitigate the subsequent steam generator tube rupture.

The CCDP contribution for this sequence can be estimated as follows:

(probability of loss of offsite power to bus 6A)*(probability of a loss of main condenser after reactor trip - from Ref. A.3-2)*(probability that SG power-operated relief valve fails to open)*(probability that SG safety valve is challenged, given SG PORV fails to open)*(probability that SG safety valve fails to close-from Ref. A.3-3)*(probability degraded SG tube fails)*(CCDP associated with a classical SGTR) =

(1.0)*(5.0E-02)*(5.0E-04)*(1.0)*(9.0E-02)*(1.0)*(4.0E-04) <<1.0E-06 Compared with the estimated CCDP from the loss of offsite power to bus 6A (2.2E-05),

the contribution of Sequence 4 is negligible.

A3-5. Sequence 5: Primary pressure increases as a result of the failure of all a.c. power and relief valves fail to lift This sequence consists of the following events:

All a.c. power is lost.

Reactor coolant system pressure increases to pressurizer safety valve setpoint (since Indian Point 2 operates with the pressurizer PORV block valves normally closed, the PORVs could not be used to relieve pressure because the block valves would not open due to loss of all a.c. power, and therefore the reactor coolant system pressure would increase to the safety valve setpoint).

LER 247/99-015 81 SENSITIVE - NOT FOR PUBLIC DISCLOSURE Pressurizer safety valves fail to lift.

Core damage results from failure to mitigate the subsequent steam generator tube rupture.

Since the product of the probability of failure of all a.c. power and the probability of all of the safety valves failing to lift is extremely small, the CCDP contribution from this sequence is also <<1.0E-06.

References A3-1. S. D. Weerakkody et al., Assessment of Risk Significance Associated with Issues Identified at D. C. Cook Nuclear Power Plant, NUREG-1728, October 2000.

A.3-2. J. P. Poloski et al., Rates of Initiating Events at U. S. Nuclear Power Plants: 1987-1995, NUREG/CR-5750, February 1999.

A.3-3. Individual Plant Examination for Indian Point Unit No. 2 Nuclear Generating Station, August 1992.

LER 247/99-015 82 SENSITIVE - NOT FOR PUBLIC DISCLOSURE ATTACHMENT 4 RESPONSES TO COMMENTS A4-1. Comments on Preliminary Analysis Comments on the preliminary analysis were provided by the licensee (Ref. A.2-1).

1.

Comment from LicenseeMain feedwater non-recovery probability:

Main feedwater was indeed available following this event and could in fact have provided makeup to the steam generators without additional operator action, had the remaining auxiliary feedwater pumps failed to operate. Following the trip, the reactor coolant system temperature drops below 541oF, which closes the main feedwater regulating valves and ninety seconds later, closes the main feedwater bypass valves. Had auxiliary feedwater not been available, the primary system temperature would have begun to recover. Once the primary system temperature rose above 541oF, the signal to the regulating valves would have cleared and the valves would have automatically re-opened. Since the main feedwater pumps were still running, makeup would have been restored to the steam generators.

Response: We agree with this comment. MFW would most likely be available for at least a couple of hours following the trip. In addition, one pump turbine oil pump is dc-powered and the feedwater regulating valves are powered from batteries. However, after some period of time, either main steam depletion or battery depletion will eventually cause MFW to fail.

The results of a sensitivity analysis indicated that the availability of MFW has a negligible importance relative to the use of condensate injection as a viable means of recovering secondary cooling given the circumstances considered in the analysis of this event.

Therefore, because of the uncertainty regarding the duration of MFW availability after a reactor trip given these circumstances, we did not credit MFW in the revised final analysis.

2.

Comment from LicenseeTurbine-driven auxiliary feedwater pump failure probability:

It is true that the turbine-driven auxiliary feedwater (TDAFW) pump was stopped and restarted to control flow to the steam generators. However, as stated in the event description section, this did not occur until more than seven hours after the event, following battery 24 depletion. As a result, it is not appropriate to use the higher failure rate (.093) during the first seven hours of the event. This is significant in several respects when examining the dominant contributors for Sequence 17, described in Table 6 of your analysis.

The dominant contribution to failure of emergency diesel generator (EDG) 22 is failure to start or failure to run within the first hour, both of which would have occurred far in advance of battery depletion. Since the dominant cutsets combine failure of the TDAFW pump with failure of EDG 22 (which provides emergency power to auxiliary feedwater pump 21), we do not believe it is reasonable to assume that the operators would have turned off the only remaining auxiliary feedwater pump as they did in the event, where they knew that the other motor driven pump remained available. As a

LER 247/99-015 83 SENSITIVE - NOT FOR PUBLIC DISCLOSURE result, we believe that use of the base probability for failure of the TDAFW pump would be more appropriate when considering this combination of basic events.

The basic event value used for recovery associated with this sequence (LOOP NREC) is based on a two-hour recovery time window. Since the higher value proposed for the TDAFW pump failure rate applies after battery depletion at seven hours, a more appropriate value for this recovery term, when used in association with the higher TDAFW pump failures rate would be one associated with a nine hour (seven hour delay + two hour recovery) time window. Based on the information provided in your report, this time window would produce a frequency for the time after battery depletion that is more than two orders of magnitude lower then that which would be associated with the time prior to battery depletion. Again, use of the base probability for failure of the TDAFW pump would be more appropriate when combined with the currently proposed recovery term.

Sequence 17 includes guaranteed failure of the bleed and feed cooling method. As mentioned previously, decay heat removal would be substantially reduced at the time of battery depletion, and bleed and feed cooling with a single pressurizer power-operated relief valve would be a success path at that point. As a result, cutsets that include the TDAFW pump failure to start should really be evaluated under two conditions:

(1)

Initial failure to start, with the base (0.03) failure to start probability and no assumed bleed and feed backup capability, and (2)

Failure to start (re-start) after battery depletion with some credit for bleed and feed backup cooling.

Given the time available for the operator to initiate bleed and feed cooling seven hours after the event, even with a single relief path, it would not be unreasonable to expect a reduction of two orders of magnitude in cutset frequency for case (2) above. As a result, the failure frequency associated with the second time period would be relatively insignificant compared to the initial time period.

Based on the above, we believe that use of the base probability for failure of the TDAFW pump would be more appropriate when considering the combination of basic events included in the LOOP Sequence 17 cutsets.

Response: This comment pertains to the preliminary analysis, which used the Revision 2QA SPAR model for Indian Point 2. The Revision 3 SPAR model for Indian Point 2 was used in the revised final analysis. For this analysis, the turbine-driven AFW pump failure-to-start and failure-to-run probabilities were updated using data from the RADS database, which the agency has created using operational experience data from the EPIX equipment performance database maintained for the industry by the Institute for Nuclear Power Operations (INPO). Other failure modes for the turbine-driven and motor-driven AFW pumps were updated using data from the RES report documenting the AFW unreliability study (NUREG-5500, Vol. 1). The specific equipment failure probabilities used in the final analysis for auxiliary feedwater system components are summarized in Table A1.-4. This table also compares the probability values used in the revised final analysis with the corresponding values used in the original final analysis, the default

SENSITIVE - NOT FOR PUBLIC DISCLOSURE LER 247/99-015 84 SENSITIVE - NOT FOR PUBLIC DISCLOSURE values from the Revision 3 SPAR model for Indian Point 2, and the values contained in NUREG-5500, Volume 1. The issue of treatment of AFW failure and non-recovery probabilities is also addressed in Table A.1-5.

3.

Comment from LicenseeProbability of failing to recover emergency power to bus 6A:

As discussed previously, this recovery action (Operator fails to close output breaker of EDG 23"), as analyzed in Section 1 of Attachment 1 of the report, is dominated by the time required to remove the tagout on bus 6A. Since bus 6A was not actually tagged out until more than four hours after the event, the above value would only be reasonable for scenarios where recovery of the EDG was not attempted prior to that point. For loss of all power events, the other EDGs would have to be initially successful and not fail until after four hours. As noted previously, the dominant contribution to failure of the other two EDGs is failure to start or failure to run within the first hour, both of which would have occurred in advance of the tagout of the bus. For loss of auxiliary feedwater caused by failure of bus 3A and failure of the TDAFW pump, again the dominant contributors are early failures. Since in both instances, bus 6A would not yet have been tagged out, the recovery analyzed in Section 1 of Attachment 1 of the ASP analysis should not include tag removal time (which currently dominates that human action). Without that contribution, this basic event would be reduced by a factor of ten.

Response: The probability that the operators would recognize and recover the output breaker for EDG 23 was a key issue in the analysis of this event. For the case of station blackout (SBO) sequences, the issue was quite clear. The operators would be explicitly directed by the plants emergency operating procedures to take the appropriate actions which would prevent the breaker from tripping open again. However, in the case of non-SBO LOOP sequences, it was uncertain whether the operators would realize that the breaker would trip open again unless proper precautions were taken before attempting to restore power to bus 6A. This uncertainty was compounded by the operator performance problems which had been observed at the plant. As a result of this uncertainty, no credit was given in the revised final analysis for recovering the output breaker for EDG 23. Details of the information found in a review of the plants emergency operating procedures that led to this conclusion may be found in Table A.1-5.

4.

Comment from LicenseeProbability of failing to recover offsite power to safety-related buses from 6.9kV buses:

The human error probability calculation for recovering power to the 480V buses from the 6.9kv buses is not accurate in that it assumes that the same actions as required for loss of bus 6A would have to be performed in the event of failure of all EDGs. In such a case, the operators would actually be directed to emergency operating procedure ECA-0.0, Loss of All AC Power. This is a much clearer path. ECA-0.0 is a well-recognized and understood procedure and part of operator ongoing training. In fact, in response to the station blackout rule, it was demonstrated that offsite power can be restored using the gas turbines in less than one hour. As noted in the preliminary accident sequence precursor analysis, there would have been no need to start the gas turbines for this event, since offsite power was already available from the 138kV and 13.8kV offsite power feeders.

LER 247/99-015 85 SENSITIVE - NOT FOR PUBLIC DISCLOSURE Response: After consideration of all of the factors associated with recovering offsite power during non-SBO 2-and 4-hr sequences (including uncertainty in the anticipated operator response to the situation), the revised final analysis did not give credit for offsite power recovery during these scenarios. The results of a sensitivity study indicated that this had a relatively small effect on the analysis. Table A.1-5 contains a discussion of this issue.

5.

Comment from LicenseeAlternate Safe Shutdown System availability:

Indian Point 2 also has an installed Alternate Safe Shutdown System (ASSS) which can provide power to a minimum set of equipment (including auxiliary feedwater pump 21) required to achieve safe shutdown without use of power from the 480VAC vital buses.

Although this system requires operator action, it was available during this event and its use is described in an abnormal operating procedure (AOI 27.19) that is referred to in Emergency Operating Procedure ECA-0.0, discussed above.

Response: No credit for the use of the ASSS was given:

Short-term - As a result of the evaluation of the poor operator performance issue, the revised final analysis did not give credit for use of the ASSS in the short-term. This issue and its significance are discussed in Table A.1-5.

Long-term - As a result of the uncertainty associated with the availability of required control systems and indication, no credit was given for use of ASSS in the long-term.

Again, a discussion of this issue and its significance may be found in Table A.1-5.

6.

Comment from LicenseeLocal control of turbine-driven auxiliary feedwater pump after battery depletion:

Cutsets associated with LOOP Sequence 18-02 assume that battery depletion precludes further use of the turbine-driven auxiliary feedwater pump. Indian Point 2 has installed pneumatic steam generator level and pressure monitoring instrumentation that is located in the auxiliary feedwater pump room and does not depend on DC power. This would allow the operators to continue local control and use of the turbine-driven pump to feed the steam generators even after battery depletion.

Response: The procedures and training are inadequate to justify credit for continued TDAFW pump operation after battery depletion. As in the response to Comment 5 above, this issue is discussed in Table A.1-5.

No comments were received from Region I on the preliminary analysis.

A4-2. Comments on Final Analysis Before the final analysis was distributed, Region I provided a number of comments which, upon evaluation, followup discussions with Region I staff, and discovery of key information about mitigation measures which had not been previously available, resulted in the reanalysis of the event. Region Is comments are identified in Table A1-5.

LER 247/99-015 86 SENSITIVE - NOT FOR PUBLIC DISCLOSURE

Reference:

A4-1. A. A. Blind, Consolidated Edison Company of New York, Inc., letter to U.S. Nuclear Regulatory Commission, dated June 5, 2001. (ADAMS Accession No. ML011590137).

LER 247/99-015 87 SENSITIVE - NOT FOR PUBLIC DISCLOSURE ATTACHMENT 6 REVISED FAULT TREES (NOTE: The page numbers indicate the pages in the Indian Point 2 Revision 3 SPAR model fault trees that were changed. Fault trees which were not revised are not included.)

ML20112J404

Text

Reference:

Navigation menu

Search