Text

Final ASP Analysis - Prairie Island 1 and 2 (LER 282-00-003).pdf
	ML20114E161
Person / Time
Site:	Prairie Island
Issue date:	05/12/2020
From:	Christopher Hunter; NRC/RES/DRA/PRB
To:	;
	Hunter C (301) 415-1394
References
	IR 2000003, IR 2000004, LER 282-00-003
	Download: ML20114E161 (25)
	v • d • e

Final Precursor Analysis Accident Sequence Precursor Program --- Office of Nuclear Regulatory Research Prairie Island, Units Degradation of the Bearing Lubrication for the Cooling Water Pumps Following Loss of Offsite Power Condition 1 and 2 Date: LERs: 282/00-003 and Units 1 and 2 11/1/2000 282/00-004 CDP = 1x10-6 Condition Summary A 1988 change in the backwash system for the cooling water (CL) pump drive shaft bearing lubrication water supply system (DSBLWSS) could result in loss of plant cooling water during postulated loss-of-offsite-power (LOOP) conditions (Refs. 1 and 2). The three safety-related cooling water pumps (two diesel-driven and one motor-driven) supply river water cooling to safety-related equipment in both units, including (1) the emergency diesel generators (EDGs) for Unit 1, (2) the component cooling water systems for both units, and (3) the instrument air compressors for both units. In January 1977, the plant changed the classification of the source of the DSBLWSS from safety-related to nonsafety-related. The DSBLWSS provides lubrication and cooling for the cooling water pump shaft bearings and seals. The classification change was approved based on the unsubstantiated belief that the DSBLWSS was not required for pump operation. In 1988, a modification was performed to the DSBLWSS that made the DSBLWSS dependent on the capability to backwash the system filters. The conditions assessed in this analysis were created as the result of this 1988 modification. In November 2000, the licensee subsequently discovered that the DSBLWSS is indeed required for extended operation of the pumps.

In addition, during the time period of the analysis for this filter clogging issue, another potential failure could also have affected the CL system pumps at Prairie Island. A potential failure of the air/vacuum valves on the discharge of the cooling water pumps could result in the failure of the safety-related CL pumps as a result of flooding.

Cause. The original DSBLWSS was classified as safety-related and consisted of water supplied from the cooling water system pump discharge header. During a subsequent modification in 1988, the flowpath for the DSBLWSS was rerouted through a filter system, which now made long-term operation dependent on the ability to backwash the filters. There are two filters on a common line that supply cooling water to the three safety-related pumps. This modification did not identify the need for a safety-related power supply to the backwash system components, as it was thought the DSBLWSS was not needed to prevent failure of the pumps, but was desirable from an economic standpoint because it extended the life of the bearings. If a LOOP occurred, power for the backwash system would be lost. With no backwashing of the filters, they would eventually clog, making the DSBLWSS unavailable. After a short period of time, this could render the safety-related cooling water pumps inoperable and nonrecoverable.

In addition, since the 1977 safety classification change, several other changes have been made to the DSBLWSS, including the substitution of the nonsafety-grade plant well water system as the 1

LER 282/00-004 preferred water source instead of the safety-related supply from the discharge of the CL pumps.

Portions of the plant well water system piping are nonseismically qualified polyvinylchloride piping.

Because the nonsafety-related DSBLWSS might not be available after a seismic event, a LOOP, and possibly other failures, licensee personnel declared all three safety-related pumps inoperable on November 1, 2000.

In a separate, but related event (LER 282/00-003), the licensee determined that following failure of the air/vacuum valves on the discharge of the CL pumps, the pumps could be flooded and subsequently fail. The air/vacuum valves are designed to vent trapped air at the discharge of each pump when the pumps initially start. The valves are supposed to close after initial startup when the air has been removed from the system. If one of the valves fails to close, water from the discharge of the pumps could collect in the area and flood out the pumps.

Condition duration. This condition is risk significant under two types of conditions: (1) during river water conditions that would cause rapid plugging of the two DSBLWSS filters and (2) following seismic events. Since 1988, time periods existed in which a postulated LOOP, combined with adverse river water conditions, could have resulted in filter plugging in 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months . Consistent with the practice of the Accident Sequence Precursor (ASP) program, the event condition was assessed assuming a 1-year period from November 1, 1999, to November 1, 2000 (although sensitivity analyses were performed for other periods).

The potential failure of the air/vacuum valves overlapped the above period. This condition existed since plant startup in 1973.

Recovery opportunities. Following the initial plugging of the DSBLWSS filters, the operators would be able to manually switch to the standby filter. A control room alarm will annunciate to indicate the need to switch to the standby filter. If offsite power is not recovered before the second filter clogs, the operators could take manual actions to clear one or both of the filters. However, without offsite power, this is not a proceduralized process. Therefore, credit was given for potentially switching to the bypass filter, but not for clearing the clogged filters.

No recovery was assumed following seismic events. For events that induced a LOOP, it was assumed that both filters would clog before offsite power would be restored. For those events that involved piping failures, CL pump failure was assumed to occur prior to repairs of the system being completed.

No recovery was assumed in the case of the failure of the air/vacuum valves described in LER 282/2000-003.

Other conditions, failure, and unavailabilities. The potential failure of the safety-related CL pumps following a failure of the air/vacuum valves on the discharge of the pumps was described in LER 282/00-003 (Ref. 3) and was analyzed separately from this event (Ref. 4). However, because the time period of these two events overlap, the results from this previous analysis are included here to assess the cumulative effect of the two events.

2 October 7, 2002 SENSITIVE - NOT FOR PUBLIC DISCLOSURE

LER 282/00-004 Analysis Results

! Importance.1 The risk significance of the potential cooling water system unavailability from the filter clogging issue is determined by subtracting the nominal core damage probability from the conditional core damage probability.

Conditional core damage probability (CCDP) = 1.7E-007 Nominal core damage probability (CDP) = 9.1E-008 Importance (CDP = CCDP - CDP) = 7.9E-008 During the time period of the analysis for the issue described in LER 282/00-004, another potential failure could also have affected the CL system pumps at Prairie Island as described in LER 282/00-003 (Ref. 3) and analyzed separately from this event (Ref. 4). The combined effects of these two events can be assessed by summing the CCDPs for the two events because the potential causes were assumed to be independent of each other, in other words, having one occur does not increase the probability of the other event occurring. Therefore, the combined CCDP for the two events is very closely approximated by the values in the following table.

Event Importance 282/00-003 R00 7.2E-07 282/00-004 R01 (nonseismic) 7.9E-08 282/00-004 R01 (seismic) 5.1E-07 Total 1.3E-06 The delta CDP for this event in conjunction with another condition (LER 282/00-003) that existed during the same time period has the potential to result in a precursor event with a combined CDP of 1.3E-6.

The ASP program acceptance threshold is an importance (CDP) of 1E-6.

Because of the uncertainty associated with some of the assumptions used in the analysis, a number of sensitivity analyses were performed. The results of the sensitivity analyses generally resulted in increases to the importance values for the event. Details of the sensitivity analyses can be found following the Modeling Assumptions section.

! Dominant sequence. The dominant core damage sequence for the filter clogging issue (LER 282/2000-004) is a LOOP coincident with adverse river water conditions followed by:

1 Since this condition did not involve an actual initiating event, the parameter of interest is the measure of the incremental increase between the conditional probability for the period during which the condition existed and the nominal probability for the same period but with the condition nonexistent and plant equipment available. This incremental increase or importance is determined by subtracting the CDP from the CCDP. This measure is used to assess the risk significance of hardware unavailabilities especially for those cases where the nominal CDP is high with respect to the incremental increase of the conditional probability caused by the hardware unavailability.

3 October 7, 2002 SENSITIVE - NOT FOR PUBLIC DISCLOSURE

LER 282/00-004 C Successful reactor trip C Successful restoration of emergency power C Successful actuation of auxiliary feedwater (AFW)

C Power-operated relief valves/safety relief valves (PORVs/SRVs) open during LOOP C PORVs and block valves and SRVs fail to reclose during LOOP C Failure of the high-pressure injection (HPI) system during LOOP The dominant core damage sequence for the potential failure of the air/vacuum issue (LER 282/2000-003) is a steam generator tube rupture followed by:

C Successful reactor trip C Successful operation of the AFW system C Failure of the HPI system C Operator attempts to lower RCS pressure to less than the steam generator pressure C Failure of the PORVs to operate during depressurization These dominant sequences apply to both Units 1 and 2. Although the Unit 2 EDGs are unaffected by the loss of the CL pumps (they have a self-contained cooling system), electrical power without cooling capability for other plant components allows for very limited long-term cooling of the plant. Most components will fail in the long term without external cooling.

! Results tables. The results tables document the results of the analysis for LER 282/2000-004. Results of the analysis for LER 282/2000-003 can be found in Reference 4.

- Table 1 provides the importance values for some dominant sequences.

- Table 2a provides the event tree sequence logic for the dominant sequences.

- Table 2b defines the nomenclature used in Table 2a.

- Table 3 provides the conditional cut sets for the dominant sequences.

- Table 4 provides the definitions and probabilities for selected events.

Modeling Assumptions

! Assessment summary. This event was modeled as a conditional assessment with the plant susceptible to the filter clogging condition for a period of 1 year (8,784 hours0.00907 days 0.218 hours 0.0013 weeks 2.98312e-4 months ). The cooling water system failure probability was increased based on the probability of failure of the DSBLWSS. The periods of adverse river water conditions during this 1-year period were assumed to total 6 days; however, this is only an assumption because the actual duration and times of the adverse river water conditions are unknown. Sensitivity analyses were performed to assess the significance of this assumption. Also note that the susceptibility to this failure varied from year to year. Sensitivity analyses were performed to assess the impact for other time periods. The assumed 6-day period is based on analysis of Mississippi River water flow at a point near the Prairie Island plant. The Revision 2QA model for Prairie Island (Ref. 5) does not include a loss of cooling water coincident with a loss of offsite power event tree.

Therefore, a conditioning event tree (and associated events) was constructed to model the 4 October 7, 2002 SENSITIVE - NOT FOR PUBLIC DISCLOSURE

LER 282/00-004 event along with extensive modification of the Revision 2QA model. Most of these model revisions were based on the Revision 3i model for Prairie Island (Ref. 6).

! Duration. Since 1988, time periods existed in which a postulated LOOP, combined with adverse river water conditions, could have resulted in filter plugging in 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months . The 3-hour plugging duration was based on information provided by the Nuclear Regulatory Commission (NRC) (Ref. 7), and is based on quarterly licensee water samples from the system. The 3-hour time period accounted for worst-case flows in the system and used the worst-case sample results. The time period during which such river water conditions have occurred is unknown. To determine the importance for the event, it was assumed that the adverse river water conditions existed for 6 days. This period is based on analysis of Mississippi River water flow at a point near the Prairie Island plant. However, this is only an assumption because the actual duration of the adverse river water conditions is unknown. Sensitivity analyses were performed using other assumptions for the period of adverse river conditions.

In order to estimate the potential period of vulnerability for this condition, an estimate of the distribution of turbidity conditions for the intake water is needed. The U.S. Army Corps of Engineers (USACE) was consulted to provide additional information on this subject. The USACE does not directly measure turbidity of the water at its facilities (in this case, locks and dams on the Mississippi River). However, the USACE indicated that turbidity is correlated to three general factors: level of the river, time of the year, and water flow. These factors are related in that the water level tends to increase during periods of high flow. In addition, high flows tend to occur in the late spring and early summer. This is also the period when solids tend to appear in the water from tree pollen and other organic material released during the spring. The USACE does record flow rates at each of the dams on the Mississippi River.

Prairie Island is located about 1.5 miles upstream of Lock and Dam #3.

Because the other factors predominantly occur during the period of highest river flow (and there are no direct data from the USACE available on these factors), it will be assumed that river turbidity is directly related to river flow.

Information on water flow through Lock and Dam #3 was obtained for approximately a 21-year period (January 1980 through December 2000). These data were analyzed to determine the distribution of the data. A plot of the data, sorted from highest to lowest flow, is shown on the following page.

5 October 7, 2002 SENSITIVE - NOT FOR PUBLIC DISCLOSURE

LER 282/00-004 Lock and Dam #3 River Flow January 1980 to December 2000 Data Sorted Highest to Lowest Value 180000 160000 140000 Flow in CFPS 120000 100000 80000 60000 40000 20000 0

0 1000 2000 3000 4000 5000 6000 7000 8000 Days This distribution indicates that the highest flow rates rarely occur. The top 2.5% of the data ranges from 67,600 cubic feet per second (cfps) (43% of maximum) up to 159,200 cfps. The top 5% ranges from 54,100 cfps (34% of maximum) to 159,200 cfps. This indicates that over the 21 years of data, the highest flow rates are rare.

Examination of the data for the 1-year time period of the analysis indicates a similar distribution as shown in the next graph. However, the skewing of the data is not as severe.

The top 2.5% of the data ranges from 28,800 cfps (87% of maximum) up to 33,200 cfps. The top 5% ranges from 27,000 cfps (81% of maximum) to 33,200 cfps. This also indicates that over the 1-year period of interest, the highest flow rates are relatively rare.

6

LER 282/00-004 Discharge Flow Lock and Dam #3 35000 30000 Flow in CFPS__

25000 20000 15000 10000 5000 0

0 50 100 150 200 250 300 350 400 Days The following graph shows the distribution of flows throughout the 1-year period of interest in the analysis. It shows that the peak flows occurred in early spring and late summer. The flow rates during the spring, when higher amounts of organic materials would be expected in the water, peaks at 28,900 cfps. This is 87% of the maximum flow for the year and 18% of the maximum flow observed over the past 21 years.

Lock and Dam #3 Flow Rates 35000 30000 25000 Flow in CFPS__

20000 15000 10000 5000 0

Nov-99 Jan-00 Mar-00 May-00 Jul-00 Sep-00 Date It should also be noted that the maximum flow during the period of interest was 21% of the maximum flow observed over the past 21 years.

7

LER 282/00-004 The following graph indicates the flow from Lock and Dam #3 over the 21-year period from January 1980 to January 2000. During this period, the peak flows observed were in 1992 and 1996. The condition under analysis existed during this period (1988 to November 1, 2000).

Consistent with the practice of the ASP program, a 1-year period of analysis was selected.

The period of analysis was assumed to be November 1, 1999, to November 1, 2000. If the period of analysis is changed, for example, to examine 1996 or 1992, this duration of the period of concern, and, therefore, the risk significance of the condition, would increase.

Selecting other periods could decrease the risk significance of the issue.

Lock and D am #3 Flow Rates 180000 160000 140000 120000 Flow in CFPS__

100000 80000 60000 40000 20000 0

D -79 D -80 D -81 D -82 D -83 D -84 D -85 D -86 D -87 D -88 D -89 D -90 D -91 D -92 D -93 D -94 D -95 D -96 D -97 D -98 D -99 D -00 Date The 3-hour plugging rate also assumes that the maximum flow is going through the filters coincident with the highest levels of turbidity. Turbidity and flow rates through the filters are not directly related. Therefore, assuming the period of the analysis is from November 1, 1999, to November 1, 2000, it seems very conservative to assume that the condition existed for 6 days during the period. This accounts for the top 10% of the flow rates (30,100 cfps to 33,200 cfps) during that period.

The duration of the potential failure of the air/vacuum valve overlapped the period of the increased potential clogging rate for the cooling water filters. Therefore, the same 1-year period was analyzed for LER 282/00-003.

! Dependence of turbidity on severe weather. Assessing the dependence of the clogging rate of the filters on the effects of severe weather in the vicinity or upriver from the plant is a difficult task. The clogging rate of the filters is dependent upon the river turbidity (the amount of solids in the river) at the location of the plants intake and the flow rate through the filters.

This in turn is dependent upon (1) the amount of material entering the river, (2) the amount 8

LER 282/00-004 of previously deposited material churned up and reentering the river flow, and (3) the amount of material redeposited prior to reaching the plants intake. All three of these factors are time-dependent because they change with time during a storm and after a storm occurs, and all are dependent upon localized flow rates. The first two factors are also dependent upon the duration of the storm and the amount of precipitation. The amount of material entering the river is also dependent upon the time of year (more pollen and organic material in the spring than other times of the year). In general, storms with high winds (storms that are more likely to cause LOOPs at a plant) are fast moving and therefore, less likely to deposit large volumes of precipitation in the area of the plant.

To illustrate these issues, suppose a major thunderstorm with high winds moves across the area and causes a LOOP at the plant. At the initiation of the LOOP, the plant begins offsite power restoration activities. However, the river turbidity has probably not changed significantly because the runoff has not affected the river at the location of the plants inlet yet. The runoff from the storm would need to flow from where it started into creeks, tributaries, and the Mississippi River, and then flow downstream to the plant location. Once it enters the river, the speed of the flow decreases and some deposition would occur. The slower flow rate further increases the time to reach the plants intake. The slow river flow is a more significant factor at the plant location because it is just upstream of a dam (about 1.5 miles) where the river is deeper and therefore, slower than in other areas.

So the nominal clogging rate of the filters would not change immediately following the LOOP, but would increase over time as the storm moves through and could continue to increase after the storm has passed. As the probability of clogging increases however, the probability of offsite power recovery also increases.

With all of these factors to consider, it is a difficult task to determine the exact relationship between severe weather and the time-dependent clogging rate of the filters.

Therefore, the base case analysis assumed that the events were independent. A sensitivity analysis was performed to assess the impact of complete dependence between the events.

! Timing assumptions. If the primary cooling water pump DSBLWSS filter becomes plugged in 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months , operators will have 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months to switch to the backup filter. The 1-hour switchover time is based on a vendor analysis that indicates that the cooling water pumps can run for 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months without bearing cooling water. Continued operation of the cooling water pumps requires that the operators either (1) switch to the standby filter within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months to restore DSBLWSS operation for another 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months (until the standby filter plugs) or (2) recover offsite power within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months to restore the automatic backwash operation of the filters that would restore cooling water flow for the duration of the event. If offsite power is recovered within the first 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months , switching to the backup filter is not required. Recovery of offsite power in this case requires restoration of offsite power to the nonsafety-related bus that powers the filter backwash system. Failure to switch to the standby filter or recover offsite power results in the loss of the cooling water pumps. This results in failure of the Unit 1 EDGs due to loss of cooling (Unit 2 EDGs are unaffected by loss of the cooling water system as they are air cooled). Cooling is also lost to the station instrument air compressors, all safety-related pumps, heat exchangers, and room coolers.

9 October 7, 2002 SENSITIVE - NOT FOR PUBLIC DISCLOSURE

LER 282/00-004 If operators successfully switch to the backup filter, they now have an extra 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months available to restore offsite power because it will take 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months for the standby filter to plug after it is placed into service. Assuming that the operators initially switch to the backup filter at the end of the 1-hour period available after the primary filter plugs, the operators would have a total of 7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months available to restore offsite power. If offsite power is not restored within 7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months , the cooling water pumps were assumed to fail.

! Other important assumptions

1. It was assumed that the offsite power recovery times assumed in the simplified plant analysis risk (SPAR) models will result in restoration of power to the nonsafety-related power supply for the DSBLWSS. The offsite power recovery times used in the SPAR models are based on data and analysis from NUREG-1032 (Ref. 8). However, the NUREG analysis examines power recovery to the safety-related buses at a plant. Normally, this is the issue of concern because emergency response equipment usually has a safety-related power supply.

However, in this case, recovery of offsite power may or may not result in the prompt restoration of power to the lubricating water filter backwash system. Because the operators believe that all equipment required for emergency response is powered from the emergency buses, restoration of offsite power to the nonsafety-related buses may not be a high priority.

As a result, there may be a delay in the restoration of offsite power to the lubricating water filter backwash power supply.

This assumption regarding power recovery time for nonsafety-related buses is a nonconservative assumption and could have a significant impact on the analysis. For example, if it took the operators 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after the restoration of offsite power to the safety-related buses to restore power to the nonsafety-related buses, then the operators would only have 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months to recover offsite power, rather than the 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months assumed in the analysis. This delay could be affected by many factors, including the cause of the LOOP.

2. It was assumed that at the end of 7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months , all of the cooling water pumps would fail simultaneously. This is a conservative assumption and does not have a significant effect on the analysis. Most likely, the operators would have an additional hour to restore the cooling water to service following the plugging of the second (standby) filter. This 1-hour period is based on the expected response of the operators following the LOOP. All three cooling water pumps would automatically start at the initiation of the LOOP, but one or two of the pumps would probably be manually shut down early in the event response. Only one pump is required to supply the design basis accident cooling loads for each unit. Therefore, one pump could be shut down early in the event and then restarted later in the event to extend the required offsite power recovery time by 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . This scenario was considered highly probable because the operators would be attempting to minimize loading of the EDGs. One cooling water pump may be able to supply cooling to both units during LOOP conditions without a loss-of-coolant accident (LOCA). In this case, two of the three pumps would be shut down early in the event and, therefore, 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months would be available (because a pump can run an hour without cooling water) to address the problems following the loss of the first cooling water pump at the 8-hour time mark. No credit was taken for additional operator actions beyond the switch to the bypass filter at 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . Therefore, the pumps are assumed to fail 10 October 7, 2002 SENSITIVE - NOT FOR PUBLIC DISCLOSURE

LER 282/00-004 after 7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months if offsite power is not restored. This assumption does not have a significant effect on the analysis because the conditional probability of failing to recover offsite power after 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is close to 1.

3. It was assumed that the operators would not attempt to restore the operation of the DSBLWSS at 7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months . The operators could bypass, clean, or replace the filters at this point, but no credit was taken for this action because there is no procedure for performing this action under LOOP conditions. (No manual backwash capability of the filters exists to recover or to prevent plugging of the filters.) There is a filter bypass capability using a manual valve (CL 23), but the alarm procedure does not direct the operator to manually bypass the filters.

4. It was assumed that following failure of the cooling water pumps from lack of DSBLWSS flow, recovery of the pumps would require significant repair or replacement of the bearings and, therefore, the pumps were essentially nonrecoverable. This is a conservative assumption and may have a significant effect on the analysis. Simple recovery of the pumps could allow restoration of one cooling water pump before another one fails. From an offsite power recovery standpoint, this assumption does not have a significant effect because this is only an issue if offsite power is recovered after 7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months . Because the conditional probability of failing to recover offsite power within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months , given it was not recovered within 7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months , is nearly 1, this assumption may not be a significant factor in the analysis.

5. The cross-tie of the Unit 2 EDGs to Unit 1 was modeled. Unit 2 EDGs can be cross-tied to Unit 1 to provide power to the safety-related buses of Unit 1 and vice-versa. The Unit 2 EDGs are not affected by this condition because they each have a self-contained cooling unit.

6. Station blackout parameter assumptions include that the Prairie Island reactor coolant pump (RCP) seals are of the Westinghouse old O-ring design and battery lifetime is 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months . The 2-hour battery lifetime is consistent with the 1994 Individual Plant Examination report. The RCP seal design was assumed to still be the old O-ring design; however, it is believed that implementation of the new O-ring design would not significantly change the results of this analysis as RCP seal failures were not in any of the dominant sequences.

! SPAR model used in the analysis The SPAR model for Prairie Island Units 1 and 2, Version 2QA (Ref. 7) was used for the analysis.

! Unique system and operational considerations As described above, the CL system was modeled to show the dependence of frontline systems on the CL system. The CL system fault tree includes the potential for the failure of the safety-related CL pumps from failure of the DSBLWSS.

! Modifications to event tree and fault tree models The model was extensively modified to account for the dependence of systems on the CL system. Two fault trees were developed for the cooling water system. The two fault trees 11 October 7, 2002 SENSITIVE - NOT FOR PUBLIC DISCLOSURE

LER 282/00-004 reflect the system configuration without offsite power (CL-L). The trees include the potential for the safety-related pumps to fail from the failure of the DSBLWSS.

The electric power fault trees were also modified to include the cross-tie to the Unit 2 EDGs and the Unit 2 safeguards buses. The Unit 2 safeguards buses were included because they are the power supply for the motor-driven CL pump. Fault trees for the Unit 2 EDGs were also added.

CL system dependency was added to the following fault trees: high-pressure injection, high-pressure recirculation, low-pressure recirculation, emergency diesel generators 1A and 1B, feed and bleed, residual heat removal, main feedwater, and steam generator depressurization.

The AFW system fault tree was modified to add the cross-tie capability.

! Basic event probability changes. Table 4 provides the basic events that were used to reflect the event condition being analyzed. The bases for these changes are as follows:

- Initiating event probability. The initiating event frequency for a LOOP for Prairie Island is 8.84E-6/hr. Assuming the adverse river water conditions existed for 6 days/year, the initiating event frequency is:

(8.84E-6/hr) x 6 days/365 days = 1.45E-7/hr The initiating event frequency assumes that the two events are independent. That is, that the adverse river conditions and a LOOP would not occur simultaneously as a result of a single cause. This may be a nonconservative assumption in that severe weather or extreme severe weather such as tornados and severe thunderstorms that cause LOOPs may also cause adverse river conditions to be present at the same time. However, the adverse river conditions may be a delayed effect from the storms and, therefore, the assumption of independence of the events may be valid.

Because this condition is only a concern for LOOP events, the other initiators were set to zero.

12 October 7, 2002 SENSITIVE - NOT FOR PUBLIC DISCLOSURE

LER 282/00-004

- Failure of the cooling water pumps from loss of pump cooling (CL-PMP-CF-PCLGW). This probability was determined using a small event tree as shown in the following figure:

OP Operator OP Recovery Switches to Recovery IE-LOOP-ARC in 4 Hours SB Filter in 7 Hours Sequence Total State 0.955 1 NA OK 0.27 2 NA OK 1 9.98E-01 0.73 3 3.28E-02 Loss of CW 0.045 2.00E-03 4 9.00E-05 Loss of CW Total 3.29E-02 Sensitivity analyses were performed to assess the impact of changes to the operator recovery probabilities.

Failure to recover offsite power within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . This probability was obtained from the weighted average nonrecovery probability for LOOPs from Figure 6-1 of the Rev. 2QA model (Ref. 7). The value used was 0.045.

Probability of failing to switch to the standby filter. The SPAR human error worksheet was consulted for evaluating the probability that operators fail to switch from the primary filter to the backup filter. It was assumed that the operator response would not involve significant diagnostic tasks because an alarm will activate and direct the operator to switch to the standby filter in accordance with the alarm response procedure. The operator action nominal base case probability was increased assuming that the operator would be under a high stress level during the restoration and that experience/training would be nominal for this task. While training on this specific filter would be infrequent, especially in light of the fact that the systems importance was downgraded and the operators believe that bearing cooling was not needed for pump operability, the similarity of this type of system to many others in the facility would indicate a nominal value for training.

Human error probability for switching filters = 1E-3 (nominal action probability) x 2 (high stress) = 2E-3 Attachment A is the completed ASP human reliability analysis (HRA) calculation sheet for this parameter.

The clogging of the filters was assumed to not occur until at least 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months into the event. At this point, the initial response would have been complete and the 13

LER 282/00-004 operators would most likely be able to turn their attention to lower priority issues such as this filter issue.

In addition, assuming that all the pumps would not fail simultaneously (a good assumption), once one pump did experience some problems, operators would certainly look at restoration of cooling water flow even if they didnt believe it was required. Therefore, it was assumed that the level of urgency and the potential conflicting priorities in this task would not significantly effect the probability.

However, a sensitivity analysis was performed to assess the impact of the HRA value.

Failure to recover offsite power within 7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months given it was not recovered in 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . The probability for failing to recover offsite power in 7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months was obtained from the weighted average nonrecovery probability for LOOPs from Figure 6-1 of the Rev. 2QA model. The value used was 0.033. Therefore, the contingent probability is 0.033/0.045 = 0.73.

S Probability of failure of the motor-driven CL pumps (CL-MDP-FC-121, CL-MDP-FC-11, CL-MDP-FC-21). The value used was 3.2E-2. This value was based on the value used in the Revision 3i model (Ref. 6) that includes the cooling water system. This value includes (1) failure of the motor-driven pump, (2) failure of the associated check valve, (3) unavailability of the pump due to test and maintenance, and (4) failure to restore the pump to operability following test and maintenance.

S Probability of failure for the diesel-driven, safety-related cooling water pumps (CL-DDP-FC-12, CL-DDP-FC-22). The value used was 7.7E-2. This value was based on the value used in the Revision 3i model that includes the cooling water system. This value includes (1) failure of the diesel-driven pump, (2) failure of the associated check valve, (3) unavailability of the pump due to test and maintenance, (4) failure to restore the pump to operability following test and maintenance, (5) failure of the associated dc bus, and (6) common-cause failure of the diesel-driven pumps.

S Common-cause failure of the nonsafety-related motor-driven pumps (CL-MDP-CC-FC). The value used was 3.2E-3. This value was based on a beta factor of 0.1.

S Failure of division A and B ac power 4160V buses for Unit 2 (ACP-BAC-LP-2A, ACP-BAC-LP-2B). The value used was 9.0E-5. This value was based on the value used for the Unit 1 buses.

S Common-cause failure of division A and B ac power 4160V buses for Units 1 and 2 (ACP-BAC-CC-1A1B, ACP-BAC-CC-1A2A, ACP-BAC-CC-1B2B). The value used was 9.0E-6. This value was based on a beta factor of 0.1.

S Failure of motor-driven AFW pump 21 (AFW-MDP-FC-21). The value used was 3.9E-

3. This value was based on the value used for AFW pump 12.

14 October 7, 2002 SENSITIVE - NOT FOR PUBLIC DISCLOSURE

LER 282/00-004 S Common-cause failure of the motor-driven AFW pumps (AFW-MDP-CC-12&21). The value used was 2.1E-4. This value was based on a beta factor of 0.056. This is the value used for AFW pumps in other Revision 2QA models.

S Probability of the operator failing to cross-tie AFW motor-driven pump 21 to Unit 1 (AFW-XHE-FC-21). The probability of the operator failing to cross-tie the Unit 2 motor-driven AFW pump was set to 2.0E-2. This value is calculated by using the ASP HRA methodology, assuming that there is no significant amount of diagnostic activity and with nominal values for all performance shaping factors except for available time and stress.

It was assumed the time available to perform the task was approximately the time required for the task to be performed. This results in a multiplier of 10. Stress was assumed to be high. This results in a multiplier of 2 and a total multiplier of the base value of 20. This value also is appropriate for the cross-tie of AFW pump 12 to Unit 2. See Attachment A for the HRA worksheet.

S Failure of EDGs 2A and 2B (EPS-DGN-FC-2A, EPS-DGN-FC-2B). The value used was 6.0E-2. This value was based on the value used for the Unit 1 EDGs.

S Common-cause failure of Unit 2 EDGs (EPS-DGN-CF-ALL2). The value used was 1.1E-3. This value was based on the value used for the Unit 1 EDGs.

S Operator fails to cross-tie to the opposite bus (OEP-XHE-XT-1A2A, OEP-XHE-XT-1B2B, OEP-XHE-XT-2A1A, OEP-XHE-XT-2B2A). The Unit 2 EDGs were added to the model. An operator failure probability to cross-tie to the opposite bus was added. The value used was 3.2E-3. This value was based on the value used for this action in the Revision 3i model for Prairie Island.

S Sequence nonrecovery probabilities (LOOP-10-NREC, LOOP-17-NREC). The value used for each of the dominant sequences was 1.0. This value was used to ensure that the nonrecovery values were conservative.

S Loss of offsite power flag for division 2A and 2B ac buses (LOSP-2A, LOSP-2B).

These flags were added to allow the emergency power fault trees to be turned on and off for the LOOP sequences. These flags are set to TRUE for LOOP sequences like the flags for division 1A and 1B. By setting all four flags, a LOOP event is a loss of power to both units, as opposed to a unit-centered LOOP. This is a conservative value in that some LOOPs only effect one unit.

! Model update The SPAR model for Prairie Island Units 1 and 2 was updated to account for updates of system/component failure probabilities and initiating event frequencies based on recent operating experience. These updates are independent of the actual event being analyzed.

Bases for these updates are described in the footnotes to Table 4.

! Effect of seismically induced loss of offsite power 15 October 7, 2002 SENSITIVE - NOT FOR PUBLIC DISCLOSURE

LER 282/00-004 Because the SPAR models and the event data in those models do not account for LOOP events resulting from external events, additional consideration was given to addressing seismically induced LOOP events. Based on a review of the seismic hazard curves for Prairie Island, the estimated mean annual frequency of seismically induced, nonrecoverable LOOP events is 3.1E-5.2 This frequency, combined with the expected 6 days per year of adverse river water conditions, yields a CDP for this condition of 5.1E-7 (3.1E-5*6/365). A sensitivity analysis was performed to assess the significance of this assumption.

! Relationship to other Prairie Island events During the time period of the analysis for this issue, another potential failure could also have affected the CL system pumps at Prairie Island. This other issue is the potential failure of the safety-related CL pumps following a failure of the air/vacuum valves on the discharge of the pumps. This issue was described in LER 282/00-003 (Ref. 3) and was analyzed separately from this event (Ref. 4). The combined effects of these two events can be assessed by summing the CCDPs for the two events because the potential causes are independent of each other, in other words, having one occur does not increase the probability of the other event occurring. Therefore, the combined CCDP for the two events is very closely approximated by the values in the following table. The combined effect of these two events has the potential to result in a precursor event with a combined CDP of 1.3E-6.

Event CCDP 282/00-003 R00 7.2E-07 282/00-004 R01 (nonseismic) 7.9E-08 282/00-004 R01 (seismic) 5.1E-07 Total 1.3E-06 Sensitivity Analyses A variety of sensitivity analyses were performed to assess the impact of a number of parameter changes.

! Initiating event duration. A sensitivity analysis was performed to assess the effects of longer event durations. The following sensitivity analyses were performed.

2 The mean annual frequency of seismically induced, nonrecoverable LOOP events is based on a review of the seismic hazard curves presented in NUREG-1488 by a subject matter expert (M. K. Ravindra - contributing author to Seismic Fragilities for Nuclear Power Plant Risk Studies). The frequency is derived by convolving the mean seismic hazard curve with the family of LOOP seismic fragility for the ceramic insulators in the switchyard, which are vulnerable to earthquake-induced motion.

16 October 7, 2002 SENSITIVE - NOT FOR PUBLIC DISCLOSURE

LER 282/00-004 Days of adverse Range of flow Ratio of Case Description river conditions IE-LOOP/hr rates (cfps) CCDP CCDP Base Assuming the top 10% of river 6 1.45E-07 30,100 to 33,200 7.90E-08 1.0 flows in the 1-year period of the analysis 1 Assuming the number of days 54 1.30E-06 21,900 to 33,200 6.80E-07 8.6 river flow was above 21-year average during 1-year period of the analysis 2 Assuming the number of days 132 3.19E-06 21,900 to 1.70E-06 21.5 river flow was above the 21- 159,200 year average for an average year 3 Assuming complete NA 8.84E-06 NA 4.60E-06 58.2 dependence of filter clogging on LOOPs 4 Assuming complete NA 3.86E-06 NA 2.80E-06 35.4 dependence of filter clogging on severe and extreme severe weather LOOPs only As noted above, the initiating event frequency is essentially a direct multiplier on the CCDP for the event and has an almost one-for-one effect on the CCDP of the event. All of the values for the sensitivity analyses range from 6.8E-7 to 4.6E-6. Using the highest value would still result in an overall event importance of less than 1E-5.

! Operator recovery actions. A sensitivity analysis was performed to assess the impact of changes in the probability of the operator failing to bypass the first clogged filter. This probability could be strongly affected by the operators perception of the importance of the task. Because the plant believed the filters were not required for pump operation, it may not have placed a high priority on switching to the bypass filter. The operators perception of the priority of an action will affect the probability that it will be successfully completed in the time required. There would be some effect on the probability of failure throughout the event. This effect would be larger whenever competing activities are present and the operator believes that he can only perform high priority activities in the amount of time available. As a result, this effect would be largest early on in an event when many high priority activities would need to be performed, and, in general, would decrease over time as the workload decreases and the operators feel more comfortable in understanding the plant condition. This is not always true as some time-critical tasks can occur far into an event, such as switchover of the RHR pumps to the sump during a small-break LOCA event. In the Prairie Island event however, the initial focus of the operators would be on ensuring that the emergency diesel generators start up and are running properly. Once these are up and running smoothly, the restoration of offsite power is the next focus.

A diagnostic component was added to the task, and the training/experience level was changed from nominal to low for the diagnostic task. This increased the failure probability from 2E-3 to 0.1, an increase of a factor of about 50.

17

LER 282/00-004 A sensitivity analysis was also performed setting the HRA failure value to 1.0, an increase of a factor of 500.

The sensitivity analysis results indicate the following:

Change in failure of the cooling water HRA failure pumps from loss of pump cooling Ratio to Case value (CL-PMP-CF-PCLGW) base case Base 2.00E-03 3.29E-02 1.00 1 1.00E-01 3.41E-02 1.04 2 1.00E+00 4.50E-02 1.37 An increase of the HRA failure value by a factor of 500 (Case 2), increased the CCDP for the event by a factor of 1.37. This indicates that the results are insensitive to the operator recovery probability.

! Seismic events. A sensitivity analysis was performed to assess the assumptions made for seismic events.

The base assessment for seismic events assumed that seismic events were independent from the adverse river conditions. This approximation does not account for seismically induced LOOP events that simultaneously result in adverse river water conditions or that directly damages the DSBLWSS piping. Assuming that a seismic event results in a failure of DSBLWSS piping, and that failure of the piping would be unrecoverable, the resulting CDP would be the same as the estimated mean annual frequency of seismically induced, nonrecoverable LOOP events, 3.1E-5. Although the licensee does not have documentation of the seismic qualification of the system, the system may be able to survive a seismic event.

The licensee had a seismic expert examine a portion of the DSBLWSS piping. This expert determined that the piping would survive a seismic event. For purposes of this analysis, the piping was assumed to fail and result in core damage whenever a seismic event occurred.

Seismic-related Ratio to Case CCDP base case Base 5.1E-07 1.0 1 3.1E-05 60.8 Using an assumption of complete dependence on seismic events, the importance of the event is in the 1E-5 range.

! Use of SG PORVs for primary side depressurization. A sensitivity analysis was also performed for LER 282/00-003. This analysis examined the potential for using the steam generator (SG) PORVs for primary side cooling and depressurization following feed and bleed operation under loss of instrument air conditions. The SG PORVs have air accumulators, but the licensee does not have documentation to prove the effectiveness of the accumulators.

Therefore, no credit was taken for these accumulators, even though it is believed that they will allow for operation of the SG PORVs under these conditions.

18

LER 282/00-004 The following table indicates the results of the sensitivity analyses.

Event CCDP Ratio 282/00-003 R00 (base case) 7.2E-07 1.0 282/00-003 R00 (sensitivity analysis) 3.4E-07 0.5 The results indicate that the CCDP for the event is not significantly affected by this change.

Lead analyst - Lee Vanden Heuvel Technical reviewer - Leonard Palko References

1. Licensee Event Report 282/00-004-00, Inoperability of Safeguards Cooling Water (Essential Service Water) Pumps Caused by Unqualified Lubricating Water Supply to the Pump Shaft Bearings, December 1, 2000.

2. Licensee Event Report 282/00-004-01, Inoperability of Safeguards Cooling Water (Essential Service Water) Pumps Caused by Unqualified Lubricating Water Supply to the Pump Shaft Bearings, March 22, 2001.

3. Licensee Event Report 282/00-003-00, Flooding from Postulated Failure of Air/Vacuum Valve Has Potential to Disable Both Trains of Essential Service (Cooling) Water, November 27, 2000.

4. Preliminary ASP Analysis, Potential for Failure of Safety-related Cooling Water Pumps from Flooding Due to Failure of Cooling Water Pump Air/Vacuum Valves, ASP Analysis Report of LER 282/00-003-00.

5. James K. Knudsen and Scott T. Beck, Simplified Plant Analysis Risk Model for Prairie Island Units 1 and 2 (ASP PWR B), Revision 2QA, Idaho National Engineering and Environmental Laboratory, April 1998.

6. James K. Knudsen, Standardized Plant Analysis Risk Model for Prairie Island Units 1 and 2 (ASP PWR B), Revision 3i, Idaho National Engineering and Environmental Laboratory, November 1999.

7. EA-00-282, Prairie Island Nuclear Generating Plant - NRC Inspection Report 50-282/00-12 (DRS); 50-306/00-13 (DRS), Section 1.2.b, December 20, 2000.

8. U.S. Nuclear Regulatory Commission, Evaluation of Station Blackout Accidents at Nuclear Power Plants, NUREG-1032, June 1988.

9. F. M. Marshall, et al., Common-Cause Failure Parameter Estimations, NUREG/CR-5497, U.S.

Nuclear Regulatory Commission, Washington, D.C., October 1998.

19

LER 282/00-004

10. G. M. Grant, et al., Reliability Study: Emergency Diesel Generator Power System, 1987-1993, NUREG/CR-5500, Vol. 5, U.S. Nuclear Regulatory Commission, Washington, D.C.,

September 1999.

11. C. L. Atwood, et al., Evaluation of Loss of Offsite Power Events at Nuclear Power Plants:

1980-1996, NUREG/CR-5496, U.S. Nuclear Regulatory Commission, Washington, D.C.,

November 1998.

12. J. P. Poloski, et al., Rates of Initiating Events at U.S. Nuclear Power Plants: 1987-1995, NUREG/CR-5750, U.S. Nuclear Regulatory Commission, Washington, D.C., February 1999.

20 October 7, 2002 SENSITIVE - NOT FOR PUBLIC DISCLOSURE

LER 282/00-004 Table 1. Importance associated with the highest probability sequences.1 Conditional core damage Core damage probability probability Importance Event tree name Sequence no. (CCDP) (CDP) (CCDP - CDP)3 LOOP 10 9.9E-008 6.4E-008 LOOP 17 3.2E-008 1.9E-008 Total (all sequences)2 1.7E-007 9.1E-008 7.9E-008 1

(File Name: T3 GEM 282-00-004 2QA 09-29-2002 110109.wpd) 2 Total importance includes all sequences (including those not shown in this table).

3 Importance is calculated using the total CCDP and total CDP from all sequences. Sequence level importance measures are not additive.

Table 2a. Event tree sequence logic for dominant sequences.

Event tree Sequence Logic name no. (/ denotes success; see Table 2b for fault tree names)

LOOP 10 /RT-L, /EP, /AFW-L, PORV-L, PRVL-RES, HPI-L LOOP 17 /RT-L, /EP, AFW-L, F&B-L Table 2b. Definitions of top events listed in Table 2a.

Top event Definition AFW-L No or insufficient AFW flow during LOOP EP Emergency power system failures F&B-L Failure to provide feed and bleed cooling during LOOP HPI-L No or insufficient flow from the HPI system during LOOP PORV-L PORVs/SRVs open during LOOP PRVL-RES PORVs and block valves fail to reclose during LOOP RT-L Reactor trip fails during LOOP 21

LER 282/00-004 Table 3. Conditional cut sets for the dominant sequences.1 Percent CCDP contribution Minimum cut sets Event Tree: LOOP, Sequence 10 2.2E-008 22.3 EPS-DGN-FC-1A EPS-DGN-FC-2A PPR-SRV-CO-L PPR-SRV-OO-PRV2 LOOP-10-NREC 2.2E-008 22.3 EPS-DGN-FC-1B EPS-DGN-FC-2B PPR-SRV-CO-L PPR-SRV-OO-PRV1 LOOP-10-NREC 1.2E-008 12.2 EPS-DGN-FC-2A PPR-SRV-CO-L PPR-SRV-OO-PRV2 CL-PMP-CF-PCLGW LOOP-10-NREC 1.2E-008 12.2 EPS-DGN-FC-2B PPR-SRV-CO-L PPR-SRV-OO-PRV1 CL-PMP-CF-PCLGW LOOP-10-NREC 9.7E-008 Total2 Event Tree: LOOP, Sequence 17 8.8E-009 27.8 AFW-PUMP-CF-ALL CL-PMP-CF-PCLGW LOOP-17-NREC 2.9E-009 9.3 EPS-DGN-FC-1B EPS-DGN-FC-2B AFW-XHE-FC-21 AFW-TDP-FC-TDP LOOP-17-NREC 3.2E-008 Total2 1

See Table 4 for definitions and probabilities for the basic events.

2 Total CCDP includes all cut sets (including those not shown).

Table 4. Definitions and probabilities for modified or dominant basic events.

Event name Description Probability Modified ACP-BAC-CC-1A1B Common-cause failure of Unit 1 4160-V ac buses 9.0E-006 YES1 ACP-BAC-CC-1A2A Common-cause failure of ac power 4160-V ac 9.0E-006 YES1 buses 1A and 2A ACP-BAC-CC-1B2B Common-cause failure of ac power 4160-V ac 9.0E-006 YES1 buses 1B and 2B ACP-BAC-LP-2A Division 2A ac power 4160-V ac bus fails 9.0E-005 YES1 ACP-BAC-LP-2B Division 2B ac power 4160-V ac bus fails 9.0E-005 YES1 AFW-MDP-CC-12&21 Common-cause failure of motor-driven pumps 2.1E-004 YES1 AFW-MDP-FC-21 AFW motor-driven pump 21 fails 3.9E-003 YES1 AFW-PUMP-CF-ALL Common-cause failure of AFW pumps 2.1E-004 NO AFW-TDP-FC-TDP AFW turbine-driven pump fails 3.2E-002 NO AFW-XHE-FC-21 Operator fails to cross-tie AFW motor-driven pump 2.0E-002 YES1 21 to Unit 1 CL-DDP-FC-12 Failure of diesel-driven safety-related cooling water 7.7E-002 YES1 pump 12 22

LER 282/00-004 Table 4. Definitions and probabilities for modified or dominant basic events. (contd)

Event name Description Probability Modified CL-DDP-FC-22 Failure of diesel-driven safety-related cooling water 7.7E-002 YES1 pump 22 CL-MDP-CC-FC Common-cause failure of the nonsafety-related 3.2E-003 YES1 cooling water pumps CL-MDP-FC-11 Failure of safety-related cooling water pump 11 3.2E-002 YES1 CL-MDP-FC-121 Failure of safety-related cooling water pump 121 3.2E-002 YES1 CL-MDP-FC-21 Failure of safety-related cooling water pump 21 3.2E-002 YES1 CL-PMP-CF-PCLGW Loss of safety-related cooling water pumps due to 3.3E-002 YES1 failure of the DSBLWSS EPS-DGN-CF-ALL Common-cause failure of Unit 1 EDGs 1.1E-003 YES1, 2, 3 EPS-DGN-CF-ALL2 Common-cause failure of Unit 2 EDGs 1.1E-003 YES1, 2,3 EPS-DGN-FC-1A Diesel generator 1A fails 6.0E-002 YES3 EPS-DGN-FC-1B Diesel generator 1B fails 6.0E-002 YES3 EPS-DGN-FC-2A Diesel generator 2A fails 6.0E-002 YES1, 3 EPS-DGN-FC-2B Diesel generator 2B fails 6.0E-002 YES1, 3 IE-LOOP Initiating event frequency for loss of offsite power 1.45E-007 YES4, 5 events IE-SGTR Initiating event frequency for steam generator tube 0.0E+000 YES1 ruptures IE-SLOCA Initiating event frequency for small break LOCA 0.0E+000 YES6 events IE-TRAN Initiating event frequency for transients 0.0E+000 YES1 LOOP-10-NREC LOOP Sequence 10 nonrecovery probability 1.0E+000 YES7 LOOP-17-NREC LOOP Sequence 17 nonrecovery probability 1.0E+000 YES7 LOSP-2A Loss of division 2A offsite power flag TRUE YES1 LOSP-2B Loss of division 2B offsite power flag TRUE YES1 OEP-XHE-XT-2A1A Operator fails to cross-tie to bus 1A 2.2E-002 YES1 PPR-SRV-OO-PRV-1 PORV 1 fails to reclose after opening 3.0E-002 No PPR-SRV-OO-PRV-2 PORV 2 fails to reclose after opening 3.0E-002 No PPR-SRV-CO-L PORVs/SRVs open during LOOP 1.6E-001 No

1. Basic event added for new modeling for this event.

2. Base case model updated based on NUREG/CR-5497, Tables 5-2 and 5-5 (Ref. 9).

3. Base case model updated based on NUREG/CR-5500, Volume 5, Tables C-4, C-6, and C-7 (Ref. 10).

4. Base case model updated based on NUREG/CR-5496, Tables B-4 (Ref. 11).

5. Base case model updated based on NUREG/CR-5750, Table H-3 (Ref. 12).

6. Base case model updated based on NUREG/CR-5750, Table 3-1 (Ref. 12).

7. Basic event changed to reflect event being analyzed.

23

LER 282/00-004 Attachment A - HRA Calculations

1. Human error probability for operator to switch to the standby filter Table A.1 Probability of failing to switch to the standby filter Physical operator action failure probability Performance Shaping Factors Value (PSFs) PSF Levels Multiplier Basis Used

1. Available Time Inadequate [P(failure = 1.0)] a 1 Time available - time required 10 Nominal 1 See text Available > 50x time required 0.01

2. Stress Extreme 5 2 High 2 See text Nominal 1

3. Complexity Highly 5 1 Moderately 2 Nominal 1 See text

4. Experience/ Low 3 1 Training Nominal 1 See text High 0.5

5. Procedures Not available 50 1 Available, but poor 5 Nominal 1 See text

6. Ergonomics Missing/misleading 50 1 Poor 10 Nominal 1 See text Good 0.5

7. Fitness for Duty Unfit [P(failure = 1.0)] a 1 Degraded fitness 5 Nominal 1 See text

8. Work Processes Poor 2 1 Nominal 1 See text Good 0.8 Total = (1)x(2)x(3)x(4)x(5)x(6)x(7)x(8) 2

. Nominal Failure Probability 1.00E-03 Adjusted Probability = Total x Nominal 2.00E-03 NOTES

a. Task failure probability is 1.0 regardless of other PSFs.

24

LER 282/00-004

2. Operator fails to cross-tie AFW motor-driven pump 21 to Unit 1 (AFW-XHE-FC-21)

Table A.2 Probability of failing to cross-tie AFW motor-driven pump 21 to Unit 1 Physical operator actions failure probabilities Performance Shaping Factors Value (PSFs) PSF Levels Multiplier Basis Used

1. Available Time Inadequate 1.0a 10 Time available = time required 10 Nominal 1 Available > 50x time required 0.01

2. Stress Extreme 5 2 High 2 Nominal 1

3. Complexity Highly 5 1 Moderately 2 Nominal 1

4. Experience/ Low 3 1 Training Nominal 1 High 0.5

5. Procedures Not available 50 1 Available, but poor 5 Nominal 1

6. Ergonomics Missing/misleading 50 1 Poor 10 Nominal 1 Good 0.5

7. Fitness for Duty Unfit 1.0a 1 Degraded fitness 5 Nominal 1

8. Work Processes Poor 2 1 Nominal 1 Good 0.8 Total = (1)x(2)x(3)x(4)x(5)x(6)x(7)x(8) 2.00E+01 Nominal Failure Probability 1.00E-03 Adjusted Probability = Total x Nominal 2.00E-02 NOTES

a. Task failure probability is 1.0 regardless of other PSFs.

25

ML20114E161

Text

Navigation menu

Search