ML20114E200

Final ASP Analysis - Quad Cities 2 (LER 265-01-001-01)

ML20114E200
Person / Time
Site:	Quad Cities
Issue date:	05/12/2020
From:	Christopher Hunter NRC/RES/DRA/PRB
To:
Hunter C (301) 415-1394
References
LER 265-01-001-01
Download: ML20114E200 (48)

Text

1

)LQDO Precursor Analysis Accident Sequence Precursor Program --- Office of Nuclear Regulatory Research Quad Cities 2 Loss of offsite power to Unit 2 but not Unit 1 due to failure of Unit 2 main power transformer with the subsequent failure of a switchyard breaker relay Event Date: 08/02/2001 LER: 265/01-001 CCDP = 5x10-6 August 13, 2004 Event Summary On August 2, 2001, at 0813 hours0.00941 days <br />0.226 hours <br />0.00134 weeks <br />3.093465e-4 months <br />, lightning struck a 345-kv line that connected to the Quad Cities switchyard. Both Unit 1 and Unit 2 were at 100% power. The lightning strike caused the Unit 2 main power transformer to rupture and catch fire, leading to an automatic shutdown of the Unit 2 reactor. Subsequently, additional breakers in the switchyard supplying offsite power to the Unit 2 reserve auxiliary transformer (RAT) opened. Consequently, Unit 2 lost all offsite power. Unit 1 remained connected to the offsite grid with a reduced number of offsite power lines. (Ref. 1)

An unusual event was declared following the Unit 2-centered loss of offsite power (LOOP). The swing emergency diesel generator (EDG 1/2) and the Unit 2 emergency diesel generator (EDG 2) automatically started as required and supplied electrical power to the safety-related buses (bus 23-1 and bus 24-1) for Unit 2. The two station blackout EDGs were manually started as required by station procedures but were not manually loaded to any electrical bus since this was not required.

The Unit 1 EDG (EDG 1) was not required to start because bus 14-1 did not lose voltage, as its electrical feed was from Unit 1. An alternate source of offsite power from Unit 1 to Unit 2, using the RAT of Unit 1 feeding through the station emergency bus cross-tie to Unit 2, was available, but this source of offsite power for Unit 2 was not used during the event.

The Unit 2 reactor core isolation cooling (RCIC) system and the safe shutdown makeup pump were manually started and used to maintain reactor vessel water level. Reactor pressure was controlled with the main steam relief valves. All safety systems operated as designed to shut down the Unit 2 reactor and maintain it in a safe shutdown condition. There were no failures of equipment following the Unit 2-centered LOOP that complicated the controlled shutdown of Unit 2.

The fire in the Unit 2 main power transformer was extinguished at approximately 0845 hours0.00978 days <br />0.235 hours <br />0.0014 weeks <br />3.215225e-4 months <br /> (approximately 32 minutes after the lightning strike) by (1) the automatic actuation of the transformers fire protection deluge system, (2) actions of the station fire brigade, and (3) actions of the local fire departments. Offsite electrical power to Unit 2 emergency buses (buses 23-1 and 24-1) from the Unit 2 RAT was restored at approximately 1047 hours0.0121 days <br />0.291 hours <br />0.00173 weeks <br />3.983835e-4 months <br />. EDG 1/2 and EDG 2 were then shut down. The Unit 2-centered LOOP lasted approximately 2.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />.

Unit 1 power was lowered to approximately 93% following the LOOP at Unit 2. Due to the Unit 2-centered LOOP, Unit 1 was in a 7-day technical specification limiting condition of operation (LCO) from 0813 hours0.00941 days <br />0.226 hours <br />0.00134 weeks <br />3.093465e-4 months <br /> to 1047 hours0.0121 days <br />0.291 hours <br />0.00173 weeks <br />3.983835e-4 months <br /> due to offsite electrical power not being available from Unit 2. Unit 1 was also in another 7-day LCO because the swing diesel, EDG 1/2, was dedicated for use at Unit 2 and not available for Unit 1 from 0855 hours0.0099 days <br />0.238 hours <br />0.00141 weeks <br />3.253275e-4 months <br /> to 1041 hours0.012 days <br />0.289 hours <br />0.00172 weeks <br />3.961005e-4 months <br />.

LER 265/01-001 1 For the initiating event assessment, the parameter of interest is the absolute value of the CCDP.

SENSITIVE - NOT FOR PUBLIC DISCLOSURE 2

Cause. The cause of the Unit 2 main power transformer failure was original equipment manufacturer design and construction errors that allowed the mechanical failure of the bus bar clamps (due to undersized bus bars and bus bar clamp bolts). After the lightning strike, this mechanical failure of the bus bar clamps created a phase-to-phase fault in the main power transformer, which caused a fire in the transformer. The Unit 2 main power transformer was subjected to multiple electrical faults during its service life, which contributed to its ultimate failure.

Although the licensee knew about the faults, they were not tracking the number of faults or the severity of the faults on the transformer. The cause of the subsequent loss of all offsite power to Unit 2 was a transistor failure due to age degradation in a static breaker failure relay, causing a slow relay reset time (Ref. 1). The age-related degradation was not recognized earlier due to the failure to include completion of the reset function in their relay testing program.

Initiating event. For Unit 2, the event is considered a unit-centered LOOP caused by failure of a switchyard breaker relay to properly respond to failure of the Unit 2 main power transformer.

For Unit 1, there is no initiating event. For approximately 2.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />, Unit 1 had restricted electrical power while offsite power was being restored to Unit 2. The 2.5-hour time period that Unit 1 had restricted electric power is much shorter than the time allowed by the Unit 1 technical specifications.

In addition, a screening evaluation was performed that indicated the risk significance of restricted electrical power at Unit 1 for this event was negligible.

Recovery opportunities. At the time of the Unit 2 scram, offsite power was available from Unit 1 for use at Unit 2. However, the operators chose not to use this Unit 1 source of electric power but rather to use the two emergency diesel generators that automatically started and ran for approximately 2.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />. The actual recovery of offsite power to Unit 2 was accomplished by using Unit 2 offsite power sources at approximately 2.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />.

Normal recovery of equipment (default value) was used in the risk analysis for equipment not impacted by the Unit 2 main power transformer fire.

Analysis Results CCDP1 Conditional core damage probability (CCDP) is 5.4 x 10-6 (mean).

Point Value Mean 5%

95%

CCDP 5.5 x 10-6 5.4 x 10-6 7.2 x 10-7 1.7 x 10-5 This CCDP exceeds the Accident Sequence Precursor (ASP) program acceptance threshold value for an initiating event. The CCDP is greater than 1.0 X 10-6, and the CCDP is greater than the CCDP for a transient with loss of reactor feedwater and no reactor feedwater recovery, which is 1.2 X 10-6 (point estimate).

LER 265/01-001 SENSITIVE - NOT FOR PUBLIC DISCLOSURE 3

It should be noted that this initiating event assessment is equivalent to calculating the conditional core damage probability of Unit 2 for a unit-centered LOOP because there were no other failures in the actual event following the Unit 2-centered LOOP.

Dominant sequence LOOP Initiating Event: The core damage sequence with the highest CCDP (2.4 x 10-6 or 43.6% of the total) for the Unit 2 initiating event assessment is LOOP Sequence 65 (see Figure 1). Three other significant core damage sequences are LOOP Sequence 62-04-5 (9.3 x 10-7 or 16.9%), LOOP Sequence 09-5 (9.0 x 10-7 or 16.4%), and LOOP Sequence 61 (7.1 x 10-7 or 12.9%). The events and important TOP events for these three sequences are shown in Table 1 and Table 2a. These include:

LOOP Sequence 65 S

reactor protection system (RPS) fails LOOP Sequence 62-04-5 S

RPS works S

emergency electrical power system works S

one safety relief valve (SRV) sticks open S

safe shutdown makeup system works S

suppression pool cooling fails S

containment spray system fails S

containment venting fails S

following containment failure, equipment fails because of survivability concerns LOOP Sequence 09-5 S

RPS works S

emergency electrical power system works S

all SRVs close S

RCIC system works S

suppression pool cooling fails S

manual depressurization works S

shutdown cooling fails S

containment spray system fails S

containment venting fails S

following containment failure, equipment fails because of survivability concerns LOOP Sequence 61 S

reactor protection system works S

emergency electrical power system works S

all SRVs close S

RCIC system fails S

high pressure coolant injection (HPCI) system fails S

safe shutdown makeup system is unavailable

LER 265/01-001 SENSITIVE - NOT FOR PUBLIC DISCLOSURE 4

S manual depressurization fails S

insufficient control rod drive (CRD) flow to the reactor coolant system Results tables The conditional probabilities of the dominant sequences for the Unit 2-centered LOOP are shown in Table 1.

The event tree sequence logic for the dominant sequences is provided in Table 2a.

Definitions of TOP events are provided in Table 2b.

The highest value conditional cut sets are provided in Table 3.

The definitions and probabilities for certain basic events are provided in Table 4.

Modeling Assumptions Assessment summary This event was modeled as a unit-centered LOOP initiating event for Unit 2.

SPAR model used in the analysis The Standardized Plant Analysis Risk (SPAR) model for Quad Cities 1 & 2 (Rev. 3) was used for this assessment (Ref. 2). The naming convention for event trees, fault trees, and basic events in the model is for Unit 1; however, the model is valid for either unit.

Unique system and operational considerations None.

Modifications to event tree models Recovery of long term shutdown cooling. The recovery rules for the LOOP event tree were modified to credit recovery of shutdown cooling late in certain sequences. This was done in a manner similar to the use of a nonrecovery term for the transient (TRANS) event tree. In the TRANS event tree, the nonrecovery term SDC-LTERM-NOREC was added to certain sequences where (1) the reactor protection system successfully tripped the reactor, (2) the power conversion system has failed, (3) no relief valves have stuck open, (4) high pressure injection (RCIC, HPCI, or safe shutdown system) was successful, (5) the reactor has been successfully depressurized, but (6) long-term decay heat removal has failed (suppression pool cooling [SPC], shutdown cooling [SDC], and containment spray system [CSS]). The selected sequences in the LOOP event tree are sequences 8, 9, 22, 23, and 33. The nonrecovery event SDC-LTERM-NOREC2 (Operator fails to recover shutdown cooling long in the long term) was added to selected sequences of the LOOP event tree where (1) the reactor protection system has successful tripped the reactor, (2) the emergency power system has successfully restored power, (3) no relief valves have stuck open, (4) high pressure injection (RCIC, HPCI, or safe shutdown system) was successful, (5) the reactor has been successfully depressurized, but (6) long-term decay heat removal has failed (SDC and CSS).

The recovery rules for the LOOP event tree were modified as follows:

LER 265/01-001 SENSITIVE - NOT FOR PUBLIC DISCLOSURE 5

Long-term recovery of SDC given initial success of injection.

if system(/RPS)

• system(/EPS)

• system(/SRV) * (system(/RCI2) + system(/HCI) +

system(/SSM))

• system(SDC)

• system(CSS) then AddEvent = SDC-LTERM-NOREC2; endif The value used for SDC-LTERM-NOREC2 in the LOOP sequences was based on the similarity between a unit-centered LOOP with success of the electrical power system and a transient with loss of the power conversion system. In a unit-centered LOOP with success of the electrical power system and no stuck-open relief valve, the recovery of the decay heat removal systems in the long term should be identical to the recovery of the decay heat removal systems in the long term for TRANS with loss of the power conversion system and with no stuck-open relief valve. There is nothing in the unit-centered LOOP logic that would indicate that the operators would have less time to recover the residual heat removal system (RHR) in the long term, that recovery would be any more complicated, or that the stress level would be any higher. The initial stages of the two events might be different, but the long-term RHR recovery actions or inactions would be the same. However, in order to add some conservatism to the analysis, the value used for SDC-LTERM-NOREC2 (3.2E-2) was taken to be twice the value used for SDC-LTERM-NOREC (1.6E-2).

Treatment of RPS. The dominant sequence for core damage is the failure of RPS. In the event tree for LOOP (see Figure 1), the failure of RPS following LOOP (Sequence 65) leads directly to core damage and not to a transfer to an ATWS event tree as found in the IE-TRANS event tree. No modification to Sequence 65 was made for the analysis. No documentation could be found that would allow a change to the sequence to allow a transfer to an ATWS event tree following LOOP. Also, even though the probability of failure of RPS following IE-LOOP is less than the probability of failure of RPS following IE-TRANS, the same values were used for RPS failure following IE-LOOP as used for RPS failure following IE-TRANS. This treatment of RPS results in a higher CCDP in the analysis than might be calculated with more complete documentation of the response of RPS following IE-LOOP.

Modifications to fault tree models Changes were made to the fault tree for the LOOP FLAG sets to allow setting loss of power to the various divisions of electric power. These changes are shown in the table below and in Figures 2 through 15. In addition, a basic event was added to the division I and II ac electric power trees to model the ability of the operators to cross-connect the 4160 V buses to Unit 1, which had offsite power (see Figures 5 and 8).

LER 265/01-001 SENSITIVE - NOT FOR PUBLIC DISCLOSURE 6

Fault Tree Unmodified FLAG Modified FLAG Figure CRD-A LOOP LOOP-I Figure 2 CRD-B LOOP LOOP-II Figure 3 CVS LOOP LOOP-I or LOOP-II Figure 4 DIV-1-AC LOOP-I LOOP-I Figure 5 DIV-1-AC-U2 LOOP-I-U2 LOOP-I-U2 LOOP-I Figure 6 DIV-1-DC LOOP LOOP-I Figure 7 DIV-2-AC LOOP-II LOOP-II Figure 8 DIV-2-AC-U2 LOOP-II-U2 LOOP-II-U2 Figure 9 DIV-2-DC LOOP LOOP-II Figure 10 SWS-U1A LOOP LOOP-I Figure 11 SWS-U1B LOOP LOOP-II Figure 12 SWS-U2A LOOP LOOP-I-U2 Figure 13 SWS-U2B LOOP LOOP-II-U2 Figure 14 TBC-A LOOP LOOP-I Figure 15 Initiating event probability changes For this analysis, the frequency for initiating event IE-LOOP was set equal to 1.0 and the frequencies for all the other initiating events were set to zero. The LOOP FLAG sets were changed as follows to make this a unit-centered LOOP.

LOOP = TRUE LOOP-I = TRUE LOOP-I-U2 = FALSE LOOP-II = TRUE LOOP-II-U2 = FALSE Basic event probability changes Table 4 provides the basic events that were changed to analyze this event.

Several of the basic events changed involve the recovery of ac electrical power. The values used were based on the assumption that offsite power was available from Unit 1 at time T =

0. A general description of the approach to estimating electric power recovery is contained in Attachment A. One of the important assumptions regarding the recovery of offsite power from the Unit 2 switchyard is that at least 30 minutes is required to restore power to

SENSITIVE - NOT FOR PUBLIC DISCLOSURE LER 265/01-001 SENSITIVE - NOT FOR PUBLIC DISCLOSURE 7

emergency loads with offsite power available at time T = 0.0. As seen in Attachment A and Table 5, the final value used in the analysis is dependent on the performance shaping factor used for the time available.

Probability that the operator fails to recover ac power in 30 minutes (ACP-XHE-NOREC-30). This probability was changed to 1.0E-1 as shown in Table 5. The performance shaping factor for time was given a value of 10 since the time available to perform the action is approximately equal to the time required to perform the action.

Probability that the operator fails to recover ac power in 90 minutes (ACP-XHE-NOREC-90). This probability was changed to 1.0E-2 as shown in Table 5. The performance shaping factor for time was given a value of 1.0 since the time available to perform the action is between two and four times the time required to perform the action.

Probability that the operator fails to recover ac power in 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> (ACP-XHE-NOREC-4H). This probability was changed to 1.0E-3 as shown in Table 5. The performance shaping factor for time was given a value of 0.1 since the time available to perform the action is greater than five times the time required to perform the action.

Probability that the operator fails to recover ac power before battery depletion - 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> (ACP-XHE-NOREC-BD). This probability was changed to 1.0E-3 as shown in Table 5. The performance shaping factor for time was given a value of 0.1 since the time available to perform the action is greater than five times the time required to perform the action.

Probability that the emergency diesel generator fails to run for the medium term (EPS-DGN-FR-FTRM). This probability was changed to 9.0E-4 based on a total mission time of 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. That is: the value represents 0.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> at the failure to run/hour of short term and 0.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> at the failure to run/hour of medium term.

Probability that the operator fails to recover offsite power in 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> (OEP-XHE-NOREC-1H). This probability was changed to 4.0E-3 as shown in Table 5. The performance shaping factor for time was given a value of 1.0 since the time available to perform the action is between two and four times the time required to perform the action.

Probability that the operator fails to recover offsite power in 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> (OEP-XHE-NOREC-2H). This probability was changed to 4.0E-3 as shown in Table 5. The performance shaping factor for time was given a value of 1.0 since the time available to perform the action is between two and four times the time required to perform the action.

Probability that the operator fails to recover offsite power in 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> (OEP-XHE-NOREC-4H). This probability was changed to 4.0E-4 as shown in Table 5. The performance shaping factor for time was given a value of 0.1 since the time available to perform the action is greater than five times the time required to perform the action.

Probability that the operator fails to recover offsite power in 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> (OEP-XHE-NOREC-10H). This probability was changed to 4.0E-4 as shown in Table 5. The performance shaping factor for time was given a value of 0.1 since the time available to perform the action is greater than five times the time required to perform the action.

LER 265/01-001 SENSITIVE - NOT FOR PUBLIC DISCLOSURE 8

Unit 2 cross-tie fails from bus 23-1 (EPS-XHE-BUS-23-1). This event was added to model the ability of operators to cross connect bus 13-1 to Unit 2 bus 23-1 (see Figure 5).

This event is assumed to be similar to event EPS-XHE-XE-SBO1 (operator fails to align Unit 1 SBO diesel generator to dead bus), and the nominal human error probability of 1.0E-3 for an action task was used for this event. This basic event does not depend on the recovery of offsite power to the Unit 2 switchyard.

Unit 2 cross-tie fails from bus 24-1 (EPS-XHE-BUS-24-1). This event was added to model the ability of operators to cross connect bus 14-1 to Unit 2 bus 24-1 (see Figure 8).

This event is assumed to be similar to event EPS-XHE-XE-SBO2 (operator fails to align Unit 2 SBO diesel generator to dead bus), and the nominal human error probability of 1.0E-3 for an action task was used for this event. This basic event does not depend on the recovery of offsite power to the Unit 2 switchyard.

Model update Changes to the Rev. 3 SPAR model for Quad Cities are as follows:

Fault tree logic for the injection valve in the HPCI system was updated. A modification was made to the HCI and HC1 fault trees to address the basic event HCI-MOV-CC-IVFRO, failure of injection valve to reopen. The basis for the modifications is given in the footnotes to Table 2b. (Updated fault trees are presented in Figures 16 and 17.)

Fault tree logic for the division I and II electric power systems for both units was updated.

The logic for the station blackout (SBO) buses was revised to remove the ability to supply the bus with power from the other units SBO diesel generator. SBO buses 61 and 71 cannot be tied together if either bus is feeding a 4160 V safety bus. (Updated fault trees are presented in Figures 5, 6, 8, and 9.)

Alpha factors used to calculate the common-cause failure probability for failure to run for the motor-driven service water pumps were updated based on guidance provided by Idaho National Engineering Laboratory. (See Table 6 for the updated alpha factors.)

Alpha factors used to calculate the common-cause failure probability for failure to run for the RHR motor-driven pumps were updated based on guidance provided by Idaho National Engineering Laboratory. (See Table 6 for the updated alpha factors.)

Alpha factors used to calculate the common-cause failure probability for the batteries were updated based on guidance provided by Idaho National Engineering Laboratory. (See Table 6 for the updated alpha factors.)

The failure rate for batteries and battery chargers was updated based on guidance provided by Idaho National Engineering Laboratory. (See Table 4 for the updated failure probabilities.)

These updates are independent of the actual events being analyzed. Bases for the updates are described in the footnotes to Table 2b or 4.

LER 265/01-001 SENSITIVE - NOT FOR PUBLIC DISCLOSURE 9

Related events None Sensitivity studies For selected sequences, credit was given for recovery of shutdown cooling in the long term.

For the initiating event assessment, the nonrecovery value used for SDC-LTERM-NOREC2 was 3.2E-2. This value is two times the value used for nonrecovery of shutdown cooling in the long term for transient sequences. A sensitivity study was made using a value of 0.16 for SDC-LTERM-NOREC2. With this change, the CCDP value increases by a factor of 2 to 9.4E-6 (point estimate). Sensitivity results are provided in the following table.

Event tree name Sequence no.

Conditional core damage probability (CCDP)1 Percentage contribution LOOP 09-5 4.5 x 10-6 47.9 LOOP 65 2.4 x 10-6 25.5 LOOP 62-04-5 9.3 x 10-7 9.9 LOOP 61 7.1 x 10-7 7.6 Total (all sequences)2 9.4 x 10-6 N/A Note:

1.

Values are point estimates. (File name: GEM 265-01-001 Sensitivity 1-7-2004 134536.wpd).

2.

Total CCDP includes all sequences (including those not shown in this table).

Analysts Lead Analyst - Bob Christie Technical Consultant - Michelle Johnson Technical Reviewer - Leonard Palko References 1.

LER 265/01-001, Revision 1, Quad Cities Nuclear Power Station, Unit 2, Reactor Scram due to Failure of Main Power Transformer, April 10, 2002 (ADAMS Accession Number:

ML021190402).

2.

J. A. Schroeder, Standardized Plant Analysis Risk Model for Quad Cities 1 & 2 (ASP BWR C), Revision 3, Idaho National Engineering and Environmental Laboratory, February 2002, Internet computer update was March 7, 2002.

3.

D. M. Ericson, Jr., et. al., Analysis of Core Damage Frequency: Internal Events Methodology, NUREG/CR-4550, Vol. 1, Rev. 1, Sandia National Laboratories, January 1990.

LER 265/01-001 SENSITIVE - NOT FOR PUBLIC DISCLOSURE 10 Table 1. Conditional probabilities associated with the highest probability sequences for the initiating event assessment.

Event tree name Sequence no.

Conditional core damage probability (CCDP)1 Percentage contribution LOOP 65 2.4E-0062 43.6 LOOP 62-04-5 9.3E-007 16.9 LOOP 09-5 9.0E-007 16.4 LOOP 61 7.1E-007 12.9 Total (all sequences)3 5.5E-006 N/A Note:

1.

Values are point estimates. (File name: GEM 265-01-001 1-7-2004 151731.wpd).

2.

No credit was taken for the loss of offsite power deenergizing relays and solenoids.

3.

Total CCDP includes all sequences (including those not shown in this table).

Table 2a. Event tree sequence logic for the initiating event dominant sequences.

Event tree name Sequence no.

Logic

(/ denotes success; see Table 2b for TOP event names)

LOOP 65 RPS LOOP 62-04-5

/RPS /EPS P1 /SSM SPC CSS CVS SURVIVE LOOP 09-5

/RPS /EPS /SRV /RCI2 SPC /DEP SDC CSS CVS SURVIVE LOOP 61

/RPS /EPS /SRV RCI2 HCI SSM DEP CRD

LER 265/01-001 SENSITIVE - NOT FOR PUBLIC DISCLOSURE 11 Table 2b. Definitions of TOP events listed in Table 2a.

TOP event Definition CRD1 Insufficient CRD flow to RCS CSS Containment spray mode of residual heat removal (RHR) system fails CVS1 Containment venting fails DEP Manual depressurization fails EPS Emergency EPS fails HCI2 HPCI fails to provide sufficient flow to reactor vessel P1 One SRV fails to close RCI2 RCIC fails to provide sufficient flow to reactor vessel during LOOP RPS Reactor shutdown fails SDC Shutdown cooling mode of residual heat removal system fails SPC Suppression pool cooling mode of residual heat removal system fails SRV One or more safety relief valves fail to close SSM Safe shutdown makeup system is unavailable SURVIVE Following containment failure, equipment survivability fails Notes:

1.

Changes were made to the fault tree for the LOOP FLAG sets to allow setting loss of power to the various divisions of electric power.

2.

Fault tree logic for the injection valve in the HPCI system was updated. A modification was made to the HCI and HC1 fault trees to address the basic event HCI-MOV-CC-IVFRO, failure of injection valve to reopen. This single basic event in the two fault trees was replaced by an AND gate with three basic events feeding the AND gate.

(See gate HC1-10 in Figure 16 and gate HCI-10 in Figure 17.) This modification was made to consider the possibility of multiple injections of water into the reactor coolant system by the HPCI system.

LER 265/01-001 SENSITIVE - NOT FOR PUBLIC DISCLOSURE 12 Table 3. Conditional cut sets for LOOP sequences.

CCDP1 Percent contribution Minimal cut sets2 Event Tree: LOOP Sequence 65 1.7 x 10-6 69.7 RPS-SYS-FC-PSOVS3 3.8 x 10-7 15.6 RPS-SYS-FC-RELAY3 2.5 x 10-7 10.2 RPS-SYS-FC-CRD 2.4 x 10-6 Total4 Event Tree: LOOP Sequence 62-04-5 7.9E-007 84.9 PPR-SRV-OO-1VLV CVS-XHE-XE-VENT2 RHR-XHE-XM-ERROR 9.4 x 10-7 Total4 Event Tree: LOOP Sequence 09-5 7.9E-007 87.3

/SRV CVS-XHE-XE-VENT2 RHR-XHE-XE-ERROR SDC-LTERM-NOREC2 9.0 x 10-7 Total4 Event Tree: LOOP Sequence 61 1.8E-007 25.2

/SRV DCP-BAT-CF-ALL 8.7E-008 12.2

/SRV DCP-XHE-XE-BCH2A DCP-BDC-LP-BUS1A 7.1 x 10-7 Total4 Total all sequences (including those not shown) = 5.5 x 10-6 Notes:

1. Values are point estimates.

2. See Table 4 for definitions and probabilities for the basic events.

3. No credit was taken for the loss of offsite power deenergizing relays and solenoids.

4. Total CCDP includes all cut sets (including those not shown in this table).

LER 265/01-001 SENSITIVE - NOT FOR PUBLIC DISCLOSURE 13 Table 4. Definitions and probabilities for modified or dominant basic events.

Event name Description Probability/

Frequency Modified ACP-XHE-NOREC-30 Operator fails to recover ac electrical power before 30 minutes 1.0E-1 Yes1 ACP-XHE-NOREC-90 Operator fails to recover ac electrical power before 90 minutes 1.0E-2 Yes1 ACP-XHE-NOREC-4H Operator fails to recover ac electrical power before 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> 1.0E-3 Yes1 ACP-XHE-NOREC-BD Operator fails to recover ac electrical power before battery depletion - 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> 1.0E-3 Yes1 CVS-XHE-XE-VENT2 Dependent operator action - fails to vent containment given operator fails to start/control RHR 5.1E-2 No DCP-BAT-CF-ALL Batteries fail from common-cause 1.9E-7 Yes2, 3 DCP-BAT-LP-250U1 Unit 1 250 V dc battery fails 2.4E-5 Yes3 DCP-BAT-LP-250U2 Unit 2 250 V dc battery fails 2.4E-5 Yes3 DCP-BAT-LP-U1 Unit 1 125 V dc battery fails 2.4E-5 Yes3 DCP-BAT-LP-U2 Unit 2 125 V dc battery fails 2.4E-5 Yes3 DCP-BCH-CF-250ALL 250 Vdc battery chargers fail from common-cause 6.6E-8 Yes2 DCP-BCH-CF-CHRS Battery chargers fail from common-cause 4.7E-8 Yes2 DCP-BCH-FC-250U1 Unit 1 250 V dc battery charger 1 fails 2.4E-5 Yes3 DCP-BCH-FC-250U12 Unit 1 250 V dc standby battery charger 1/2 fails 2.4E-5 Yes3 DCP-BCH-FC-BCH1 Unit 1 125 V dc battery charger 1 fails 2.4E-5 Yes3 DCP-BCH-FC-BCH1A Unit 1 125 V dc standby battery charger fails 2.4E-5 Yes3 DCP-BCH-FC-BCH2 Unit 2 125 V dc battery charger 2 fails 2.4E-5 Yes3 DCP-BCH-FC-BCH2A Unit 2 125 V dc standby battery charger fails 2.4E-5 Yes3 DCP-BDC-LP-BUS1A Division I 125 Vdc bus 1A fails 9.0E-5 No DCP-XHE-XE-BCH2A Operator fails to place standby battery charger in service 1.0E-3 No EPS-DGN-FR-FTRL Diesel generator fails to run, 14 to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> 0.0 Yes4 EPS-DGN-FR-FTRM Diesel generator fails to run, 0.5 to 14 hours1.62037e-4 days <br />0.00389 hours <br />2.314815e-5 weeks <br />5.327e-6 months <br /> 9.0E-4 Yes4 EPS-XHE-XE-BUS-23-1 Unit 2 cross-tie fails from bus 23-1 1.0E-3 Yes5 EPS-XHE-XE-BUS-24-1 Unit 2 cross-tie fails from bus 24-1 1.0E-3 Yes5 HCI-MOV-IVFRO HPCI injection valve fails to reopen 2.0E-1 Yes6 HCI-MULTIPLE-INJECT Probability of multiple HPCI injections 1.2E-1 Yes6 HCI-XHE-XL-INJECT Operator fails to recover HPCI injection valve reopening 8.3E-1 Yes6

Table 4. Definitions and probabilities for modified or dominant basic events (contd).

SENSITIVE - NOT FOR PUBLIC DISCLOSURE LER 265/01-001 Event name Description Probability/

Frequency Modified SENSITIVE - NOT FOR PUBLIC DISCLOSURE 14 IE-LOOP Loss of offsite power initiator 1.0 Yes7 OEP-XHE-NOREC-1H Operator fails to recover offsite power in 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> 4.0E-3 Yes1 OEP-XHE-NOREC-2H Operator fails to recover offsite power in 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> 4.0E-3 Yes1 OEP-XHE-NOREC-4H Operator fails to recover offsite power in 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> 4.0E-4 Yes1 OEP-XHE-NOREC-10H Operator fails to recover offsite power in 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> 4.0E-4 Yes1 PPR-SRV-OO-1VLV One SRV fails to close 3.1E-2 No RHR-XHE-XM-ERROR Operator fails to start/control RHR 5.0E-4 No RPS-SYS-FC-CRD Control rod drive mechanical failure 2.5E-7 No RPS-SYS-FC-PSOVS HCU scram pilot SOVs fail 1.7E-6 No RPS-SYS-FC-RELAY Trip system relays fail 3.8E-7 No SDC-LTERM-NOREC2 Operator fails to recover SDC cooling in the long term 3.2E-2 Yes8 Notes:

1.

Based on human factor evaluation, assuming offsite power is available at time = 0.0 from Unit 1. See Table 5 for human error probability calculations.

2.

Common-cause probability values automatically calculated by GEMS.

3.

Battery and battery charger failure rate was updated to 1.0E-6/hour, based on guidance provided by Idaho National Engineering Laboratory from NUREG/CR-4550, Table 8.2-8. (Ref. 3). Failure probability of 2.4E-5 based on 24-hour mission time.

4.

Diesel generator failure to run probability is based on a total mission time of 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />.

5.

This event was added to model the ability of operators to cross connect division I bus 13-1 to Unit 2 bus 23-1 and division II bus 14-1 to Unit 2 bus 24-1 (see text and Figure 5 and Figure 8). This event involves different operator action than the operator actions to recover offsite power at Unit 2.

6.

Basic events added to fault trees HCI and HC1 to model multiple HPCI injections based on guidance provided by Idaho National Engineering Laboratory.

7.

Initiating event frequency changed to model the event being analyzed (see text).

8.

Recovery of shutdown cooling in the long term is credited (see text).

LER 265/01-001 SENSITIVE - NOT FOR PUBLIC DISCLOSURE 15 Table 5. Human factor evaluation of recovery of ac electrical power.

Recovery event Time Stress Complex Procedure Nominal Adjusted value LOOP Sequences OEP-XHE-NOREC-1H 1

2 2

1 1.0E-3 4.0E-3 OEP-XHE-NOREC-2H 1

2 2

1 1.0E-3 4.0E-3 OEP-XHE-NOREC-4H 0.1 2

2 1

1.0E-3 4.0E-4 OEP-XHE-NOREC-10H 0.1 2

2 1

1.0E-3 4.0E-4 SBO Sequences ACP-XHE-NOREC-30 10 5

2 1

1.0E-3 1.0E-1 ACP-XHE-NOREC-90 1

5 2

1 1.0E-3 1.0E-2 ACP-XHE-NOREC-4H 0.1 5

2 1

1.0E-3 1.0E-3 ACP-XHE-NOREC-BD 0.1 5

2 1

1.0E-3 1.0E-3 Table 6. Revised alpha factors for common-cause failure events.

Event name Event description Probability Distribution parameter DCP-BAT-LP-02A01 250 Vdc battery alpha factor 1 for 2 trains 0.9901068 1.26E+00 DCP-BAT-LP-02A02 250 Vdc battery alpha factor 2 for 2 trains 9.89E-03 1.26E+02 DCP-BAT-LP-04A01 125 Vdc battery alpha factor 1 for 4 trains 0.983541 4.61E+00 DCP-BAT-LP-04A02 125 Vdc battery alpha factor 2 for 4 trains 1.09E-02 2.77E+02 DCP-BAT-LP-04A03 125 Vdc battery alpha factor 3 for 4 trains 4.29E-03 2.79E+02 DCP-BAT-LP-04A04 125 Vdc battery alpha factor 4 for 4 trains 1.24E-03 2.79E+02 ESW-MDP-FR-03A01 Diesel service water motor-driven pump alpha factor 1 for 3 trains (fails to run) 0.9676124 2.41E+01

LER 265/01-001 SENSITIVE - NOT FOR PUBLIC DISCLOSURE 16 Table 6. Revised alpha factors for common-cause failure events (contd).

Event name Event description Probability Distribution parameter ESW-MDP-FR-03A02 Diesel service water motor-driven pump alpha factor 2 for 3 trains (fails to run) 1.38E-02 7.34E+02 ESW-MDP-FR-03A03 Diesel service water motor-driven pump alpha factor 3 for 3 trains (fails to run) 1.86E-02 7.31E+02 MCW-MDP-FR-03A01 Circulating water motor-driven pump alpha factor 1 for 3 trains (fails to run) 0.9676124 2.41E+01 MCW-MDP-FR-03A02 Circulating water motor-driven pump alpha factor 2 for 3 trains (fails to run) 1.38E-02 7.34E+02 MCW-MDP-FR-03A03 Circulating water motor-driven pump alpha factor 3 for 3 trains (fails to run) 1.86E-02 7.31E+02 RHR-MDP-FR-04A01 RHR motor-driven pump alpha factor 1 for 4 trains (fails to run) 0.9917641 3.37E+00 RHR-MDP-FR-04A02 RHR motor-driven pump alpha factor 2 for 4 trains (fails to run) 6.70E-03 4.06E+02 RHR-MDP-FR-04A03 RHR motor-driven pump alpha factor 3 for 4 trains (fails to run) 9.90E-04 4.08E+02 RHR-MDP-FR-04A04 RHR motor-driven pump alpha factor 4 for 4 trains (fails to run) 5.45E-04 4.08E+02 RHR-MDP-FS-04A01 RHR motor-driven pump alpha factor 1 for 4 trains (fails to start) 0.9721242 6.89E+00 RHR-MDP-FS-04A02 RHR motor-driven pump alpha factor 2 for 4 trains (fails to start) 2.53E-02 2.41E+02 RHR-MDP-FS-04A03 RHR motor-driven pump alpha factor 3 for 4 trains (fails to start) 1.69E-03 2.47E+02 RHR-MDP-FS-04A04 RHR motor-driven pump alpha factor 4 for 4 trains (fails to start) 9.03E-04 2.47E+02 SSW-MDP-FR-04A01 RHR service water motor-driven pump alpha factor 1 for 4 trains (fails to run) 0.9692023 3.07E+01 SSW-MDP-FR-04A02 RHR service water motor-driven pump alpha factor 2 for 4 trains (fails to run) 1.35E-02 9.83E+02 SSW-MDP-FR-04A03 RHR service water motor-driven pump alpha factor 3 for 4 trains (fails to run) 4.28E-03 9.92E+02 SSW-MDP-FR-04A04 RHR service water motor-driven pump alpha factor 4 for 4 trains (fails to run) 1.31E-02 9.83E+02 SWS-MDP-FR-05A01 Service water motor-driven pump alpha factor 1 for 5 trains (fails to run) 0.9710674 3.64E+01

LER 265/01-001 SENSITIVE - NOT FOR PUBLIC DISCLOSURE 17 Table 6. Revised alpha factors for common-cause failure events (contd).

Event name Event description Probability Distribution parameter SWS-MDP-FR-05A02 Service water motor-driven pump alpha factor 2 for 5 trains (fails to run) 1.19E-02 1.24E+03 SWS-MDP-FR-05A03 Service water motor-driven pump alpha factor 3 for 5 trains (fails to run) 5.10E-03 1.25E+03 SWS-MDP-FR-05A04 Service water motor-driven pump alpha factor 4 for 5 trains (fails to run) 1.99E-03 1.25E+03 SWS-MDP-FR-05A05 Service water motor-driven pump alpha factor 5 for 5 trains (fails to run) 9.99E-03 1.24E+03

LER 265/01-001 SENSITIVE - NOT FOR PUBLIC DISCLOSURE 18 Attachment A Electrical Power Recovery Model

Background

The time required to restore offsite power to plant emergency equipment is a significant factor in modeling the CCDP given a loss of offsite power (LOOP). SPAR models for LOOP and station blackout (SBO) include various sequence-specific ac power recovery factors that are based on the time available to recover power to prevent core damage. For a sequence involving failure of all of the reactor cooling sources, only about 30 minutes would be available to recover power to help avoid reactor core damage. On the other hand, for sequences involving successful early inventory control and decay heat removal, but failure of long-term decay heat removal, several hours to recover ac power prior to reactor core damage would be available.

Failure to recover offsite power to plant safety-related electrical loads (if needed because EDGs fail to supply the loads), given recovery of power to the switchyard, could result from (1) operators failing to restore proper breaker line-ups, (2) breakers failing to close on demand, or (3) a combination of operator and breaker failures. The dominant contributor to failure to recover offsite power to plant safety-related loads in this situation is operators failing to restore proper breaker line-ups. The SPAR human error model was used to estimate nonrecovery probabilities as a function of time following restoration of offsite power to the switchyard. The best estimate analysis assumes that at least 30 minutes is necessary to restore offsite power to emergency buses given offsite power is available at time T = 0.0..

Human error modeling The SPAR human error model generally considers the following three factors:

S Probability of failure to diagnose the need for action S

Probability of failure to successfully perform the desired action S

Dependency on other operator actions involved in the specific sequence of interest This analysis assumes no probability of failure to diagnose the need to recover ac power and no dependency between operator performance of the power recovery task and any other task the operators may need to perform. Thus, each estimated ac power nonrecovery probability is based solely on the probability of failure to successfully perform the desired action.

The probability of failure to perform an action is the product of a nominal failure probability (1.0 x 10-3) and the following eight performance shaping factors (PSFs):

S Available time S

Stress S

Complexity S

Experience/training S

Procedures S

Ergonomics S

Fitness for duty S

Work processes

LER 265/01-001 SENSITIVE - NOT FOR PUBLIC DISCLOSURE 19 For each ac power nonrecovery probability, the PSF for available time is assigned a value of 10 if the time available to perform the action is approximately equal to the time required to perform the action, 1.0 if the time available is between two and four times the time required, and 0.1 if the time available is greater than or equal to five times the time required. If the time available is inadequate (i.e., less than the time to restoration of power to the switchyard plus 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> for the best estimate case), the ac power nonrecovery probability is 1.0 (TRUE).

The PSF for stress is assigned a value of 5 (corresponding to extreme stress) for all ac power SBO nonrecovery probabilities. The PSF for stress is assigned a value of 2 (corresponding to high stress) for all ac power non-SBO nonrecovery probabilities.

For all of the ac power nonrecovery probabilities, the PSF for complexity is assigned a value of 2 (corresponding to moderately complex) based on the need for multiple breaker alignments and verifications.

For all of the ac power nonrecovery probabilities, the PSFs for experience/training, procedures, ergonomics, fitness for duty, and work processes are assumed to be nominal (i.e., are assigned values of 1.0).

Results Table 5 presents the calculated values for the ac power nonrecovery probabilities used in the best estimate case analysis.

SENSITIVE - NOT FOR PUBLIC DISCLOSURE LER 265/01-001 20 VA1 LO NG -T ERM LO W PRESS INJECTION CR1 CRD INJECT ION (1 PUMP)

CVS CO NT AINMENT VENT ING CSS CONTAINMENT SPRAY SDC SHUTDOW N CO OLING DEP MANUAL REACTOR DEPRESS SPC SUPPRESSION POO L CO OLING VA ALTERNATE LOW PRESS INJECTIO N LCI LOW PRESS COOLANT INJECTION LCS CORE SPRAY CRD CRD INJECTION (2 PUMPS)

DEP MANUAL REACTOR DEPRESS SSM SAFE SHUTDOW N INJECTION HCI HPCI RCI2 RCIC SRV SRV'S CLOSE EPS EM ERGENCY POW ER RPS REACTOR SHUT DOWN IE-LOO P LOSS OF OFFSIT E POW ER STAT E 1

OK 2

OK 3

OK 4

OK 5

CD 6

OK 7

OK 8

CD 9

T POST -CT M-INJ 10 OK 11 CD 12 OK 13 CD 14 T POST -CT M-INJ 15 OK 16 OK 17 OK 18 OK 19 CD 20 OK 21 OK 22 CD 23 T POST -CT M-INJ 24 OK 25 CD 26 OK 27 CD 28 T POST -CT M-INJ 29 OK 30 OK 31 OK 32 OK 33 CD 34 OK 35 OK 36 CD 37 OK 38 OK 39 OK 40 OK 41 OK 42 CD 43 CD 44 OK 45 OK 46 OK 47 OK 48 OK 49 CD 50 CD 51 OK 52 OK 53 OK 54 OK 55 CD 56 CD 57 OK 58 OK 59 OK 60 CD 61 CD 62 T LOOP-1 63 T LOOP-2 64 T SBO 65 CD P1 VA0 P2 LOOP - LOSS OF OFFSITE POWER 2003/12/23 Figure 1. Quad Cities Units 1 and 2 loss of offsite power event tree.

SENSITIVE - NOT FOR PUBLIC DISCLOSURE LER 265/01-001 21 CRD-A 40 DIV-1-AC 7.2E-4 CRD-MDP-FR-PUMPA 146 TBC CRD-A-1 TRUE LOOP-I CRD-A-2 1.0E-3 CRD-XHE-XM-RSTRT 3.0E-3 CRD-MDP-FS-PUMPA 42 DIV-1-DC DIVISION I AC POWER IS UNAVAILABLE INSUFFICIENT CRD FLOW TO RCS CRD PUMP A FAILS TO RUN TURBINE BLDG CLOSED CLG WATER SYSTEM IS UNAVAILABLE PUMP FAILS TO RESTART GIVEN LOOP HAS OCCURED LOSS OF OFFSITE POWER (DIVISION I)

CRD RESTART FAILS OPERATOR FAILS TO RESTART CRD ON EMERGENCY POWER CRD PUMP A FAILS TO START DIVISION I 125 VDC POWER FAILS CRD-A - QUAD CITIES 1 & 2 CONTROL ROD DRIVE SYSTEM FAULT TREE 2003/12/22 Page 21 Figure 2. Control rod drive system fault tree (CRD-A).

SENSITIVE - NOT FOR PUBLIC DISCLOSURE LER 265/01-001 22 CRD-B-1 43 DIV-2-AC 45 DIV-2-DC 3.0E-3 CRD-MDP-FS-PUMPB 1.3E-2 CRD-MDP-TM-TRNB 1.0E-3 CRD-MDP-XR-TRNB 1.0E-3 CRD-XHE-XM-PUMP 1.0E-4 CRD-CKV-CC-PCKVB 7.2E-4 CRD-MDP-FR-PUMPB CRD-B 146 TBC CRD-B-3 TRUE LOOP-II CRD-B-2 1.0E-3 CRD-XHE-XM-RSTRT CRD-B-2 DIVISION II 125 VDC POWER IS UNAVAILABLE DIVISION II AC POWER IS UNAVAILABLE CRD PUMP TRAIN B IS UNAVAILABLE OP FAILS TO RESTORE TRAIN B

TRAIN B UNAVAILABLE DUE TO TEST AND MAINTENANCE CRD PUMP B FAILS TO START CRD PUMP TRAIN B IS UNAVAILABLE OPERATOR FAILS TO START THE STANDBY CRD PUMP CRD PUMP B DISCHARGE CKV FAILS TO OPEN CRD PUMP B FAILS TO RUN TURBINE BLDG CLOSED CLG WATER IS UNAVAILABLE LOSS OF OFFSITE POWER (DIVISION II)

OPERATOR FAILS TO RESTART CRD ON EMERGENCY POWER PUMP FAILS TO START GIVEN LOOP HAS OCCURED PUMP FAILS TO START GIVEN LOOP HAS OCCURED CRD RESTART FAILS A

A CRD-B - QUAD CITIES 1 & 2 CONTROL ROD DRIVE SYSTEM FAULT TREE 2003/12/22 Page 22 Figure 3. Control rod drive system fault tree (CRD-B).

SENSITIVE - NOT FOR PUBLIC DISCLOSURE LER 265/01-001 23 CVS 1.0E-3 CVS-AOV-CC-STACK1 1.0E-3 CVS-AOV-CC-STACK2 1.0E-3 CVS-XHE-XE-VENT FALSE HE-LOIA CVS-1 1.0E-3 CVS-AOV-CC-DWVNT 1.0E-3 CVS-AOV-CC-WWVNT CVS-2 1.0E-3 CVS-XHE-XE-IAC TRUE LOOP-I LOOP-12 TRUE LOOP-II CONTAINMENT VENT LINES FAIL FAILURE TO RESTART INSTRUMENT AIR COMPRESSORS AFTER LOOP CONTAINMENT VENTING CONTAINMENT DAMPER 1-1699-6 FAILS TO OPEN CONTAINMENT DAMPER 1-1601-24 FAILS TO OPEN LOSS OF OFFSITE POWER (DIVISION I)

FAILURE TO RESTART INSTRUMENT AIR COMPRESSORS AFTER LOOP LOSS OF INSTRUMENT AIR INITIATOR CONTAINMENT WETWELL VENT FAILS TO OPEN CONTAINMENT DRYWELL VENT FAILS TO OPEN OPERATOR FAILS TO VENT CONTAINMENT LOSS OF OFFSITE POWER (DIVISION II)

LOSS OF OFFSITE POWER TO 1 OF 2 DIVISIONS CVS - QUAD CITIES 1 & 2 SUPRESSION POOL VENT SYSTEM FAULT TREE 2003/12/22 Page 26 Figure 4. Supression pool vent system fault tree (CVS).

SENSITIVE - NOT FOR PUBLIC DISCLOSUR LER 265/01-001 24 DIV-1-AC 9.0E-5 ACP-BAC-L P-DI DIV-1-AC-1 DIV-1-AC-2 TRUE LOOP-I 122 ROOP DIV-1-AC-3 DIV-1-AC-6 9.0E-5 ACP-BAC-LP-B61 38 DGSBO1 36 DG12 1.0E-3 EPS-XHE-BUS-23-1 UNIT 1 BLACKOUT GENERATOR IS UNAVAILABLE DIVISION I EMERGENCY POWER IS UNAVAILABLE OFFSITE POW ER IS UNAVAILABLE OFFSITE POWER IS UNAVAILABLE LOSS OF POW ER TO 4160 VAC BUS 13-1 DIESEL GENERATOR 1/2 IS UNAVAILABLE DIVISION I AC POW ER IS UNAVAILABLE SBO BUS 61 IS UNAVAILABLE SBO BUS 61 FAILS LOSS OF OFFSITE POWER (DIVISION I)

DIVISION I AC POW ER BUSSES FAIL UNIT 2 CROSSTIE FAILS FROM BUS 23-1 DIV-1-AC - QUAD CITIES 1 & 2 DIVISION I AC POWER SYSTEM FAULT TREE 2004/01/05 Page 40 Figure 5. Unit 1 division I ac power system fault tree (DIV-1-AC).

SENSITIVE - NOT FOR PUBLIC DISCLOSURE LER 265/01-001 25 DIV-1-AC-U2 FALSE ACP-BAC-LP-U2DI DIV-1-AC-U2-1 DIV-1-AC-U2-2 FALSE LOOP-I-U2 122 ROOP DIV-1-AC-U2-3 DIV-1-AC-U2-6 9.0E-5 ACP-BAC-LP-B71 39 DGSBO2 DIV-1-AC-U2-7 36 DG12 TRUE LOOP-I UNIT 2 BLACKOUT GENERATOR IS UNAVAILABLE OFFSITE POWER IS UNAVAILABLE DIESEL GENERATOR 1/2 IS UNAVAILABLE POWER FROM EDGs TO U2 DIV I IS UNAVAILABLE SBO BUS 71 IS UNAVAILABLE U2 DIVISION I EMERGENCY POW ER IS UNAVAILABLE OFFISTE POWER IS UNAVAILABLE LOSS OF POW ER TO 4160 VAC BUS 23-1 QUAD CITIES 1 & 2 UNIT 2 DIVISION I POWER SYSTEM FAULT TREE UNIT 2 DIVISION I AC POW ER IS UNAVAILABLE SBO BUS 71 FAILS LOSS OF OFFSITE POW ER TO U2 DIV I DIESEL 1/2 IS ALIGNED TO UNIT 1 DUE TO LOSS OF OFFSITE POW ER TO U1 DIV I DIV-1-AC-U2 - QUAD CITIES 1 & 2 UNIT 2 DIVISION I POWER SYSTEM FAULT TREE 2004/01/05 Page 41 Figure 6. Unit 2 division I ac power system fault tree (DIV-I-AC-U2).

SITIVE - NOT FOR PUBLIC DISCLOSURE LER 265/01-001 26 DIV-1-DC

9. 0E-5 DCP-BDC-LP-BUS1A DIV-1-DC-1 DIV-1-DC-2

1. 9E-7 DCP-BAT-CF-ALL DIV-1-DC-4 2.4E-5 DCP-BAT-LP-U1 DIV-1-DC-7 1.0E+0 DCP-BAT-LP-U1A TRUE DCP-XHE-XE-U1A DIV-1-DC-3 DIV-1-DC-5

4. 7E-8 DCP-BCH-CF-CHRS 2.4E-5 DCP-BCH-FC-BCH1 43 DIV-2-AC DIV-1-DC-6 40 DIV-1-AC DIV-1-DC-8 4.7E-8 DCP-BCH-CF-CHRS 2.4E-5 DCP-BCH-FC-BCH1A 1.0E-3 DCP-XHE-XE-BCH1A DIV-1-DC-9 DIV-1-DC-10 FALSE HE-LOCA TRUE LOOP-I DIV-1-DC-11 DIV-1-DC-12 TRUE HE-SBO DIV-1-DC-3 DIV-1-DC-2 DIV-1-DC-9 POWER SUPPLIES FAIL UNIT 1 BATTERY CHARGERS FAIL UNIT 1 BATTERY CHARGERS FAIL UNIT 1 BATTERY FAILS UNIT 1 BATTERY FAILS NORMAL AC POWER SUPPLY FAILS STANDBY BATTERY IS UNAVAILABLE UNIT 1 125 VDC BATTERIES FAIL BACKUP AC POW ER SUPPLY FAILS UNIT 1 STANDBY BATTERY CHARGER 1A FAILS DIVISION I 125 VDC POWER IS UNAVAILABLE DIVISION I AC POWER IS UNAVAILABLE BATTERY CHARGING UNAVAILABLE DIVISION II AC POWER IS UNAVAILABLE POW ER SUPPLIES FAIL LOCA OR LOOP INITIATOR POWER SUPPLIES FAIL DURING LOCAs OR LOOP BATTERY CHARGERS FAIL FROM COMMON CAUSE BATTERY CHARGERS FAIL FROM COMMON CAUSE LOSS OF OFFSITE POW ER (DIVISION I)

OPERATOR FAILS TO PLACE STANDBY BATTERY IN SERVICE OPERATOR FAILS TO PLACE STBY BATTERY CHARGER IN SERVICE DIVISION I 125 VDC BUS 1A FAILS UNIT 1 STBY BATTERY CHARGER 1A FAILS UNIT 1 BATTERY CHARGER 1 FAILS UNIT 1 STANDBY BATTERY FAILS UNIT 1 BATTERY FAILS BATTERIES FAIL FROM COMMON CAUSE HOUSE EVENT FOR STATION BLACKOUT EVENTS HOUSE EVENT FOR LOSS OF COOLANT EVENTS POWER SUPPLIES FAIL DURING LOCAs OR LOOP DIV-1-DC - QUAD CITIES 1 & 2 DIVISION I DC POWER SYSTEM FAULT TREE 2004/05/13 Page 42 Figure 7. Unit 1 division I dc power system fault tree (DIV-1-DC).

- NOT FOR PUBLIC DISCLOSURE LER 265/01-001 27 DIV-2-AC 9.0E-5 ACP-BAC-LP-DII DIV-2-AC-1 DIV-2-AC-2 TRUE LOOP-II 122 ROOP DIV-2-AC-3 DIV-2-AC-4 9.0E-5 ACP-BAC-LP-B61 38 DGSBO1 1.0E-3 EPS-XHE-BUS-24-1 35 DG1 UNIT 1 BLACKOUT GENERATOR IS UNAVAILABLE LOSS OF DIVISION II EMERGENCY POW ER OFFSITE POWER IS UNAVAILABLE OFFSITE POWER IS UNAVAILABLE LOSS OF POWER TO 4160 VAC BUS 14-1 DIVISION II AC POWER IS UNAVAILABLE SBO BUS 61 IS UNAVAILABLE SBO BUS 61 FAILS LOSS OF OFFSITE POWER (DIVISION II)

DIVISION II AC POWER BUSSES FAIL UNIT 2 CROSSTIE FAILS FROM BUS 24-1 DIESEL GENERATOR 1 IS UNAVAILABLE DIV-2-AC - QUAD CITIES 1 & 2 DIVISION II AC POWER SYSTEM FAULT TREE 2004/01/05 Page 43 Figure 8. Unit 1 division II ac power system fault tree (DIV-2-AC).

ENSITIVE - NOT FOR PUBLIC DISCLOSURE LER 265/01-001 28 DIV-2-AC-U2 9.0E-5 ACP-BAC-LP-DII DIV-2-AC-U2-1 37 DG2 DIV-2-AC-U2-2 FALSE LOOP-II-U2 122 ROOP DIV-2-AC-U2-3 DIV-2-AC-U2-4 9.0E-5 ACP-BAC-LP-B71 39 DGSBO2 1.0E+0 DIV-2-AC-U2-7 UNIT 2 BLACKOUT GENERATOR IS UNAVAILABLE OFFSITE POWER IS UNAVAILABLE DIESEL GENERATOR 2 IS UNAVAILABLE DIVISION II CROSS TIE FAILS (U2 - U1)

SBO BUS 71 IS UNAVAILABLE LOSS OF U2 DIVISION II EMERGENCY POWER OFFISTE POWER IS UNAVAILABLE LOSS OF POWER TO 4160 VAC BUS 24-1 QUAD CITIES 1 & 2 UNIT 2 DIVISION II POWER SYSTEM FAULT TREE SBO BUS 71 FAILS LOSS OF OFFSITE POWER TO U2 DIV II DIVISION II AC POWER BUSSES FAIL DIV-2-AC-U2 - QUAD CITIES 1 & 2 UNIT 2 DIVISION II POWER SYSTEM FAULT TREE 2003/12/22 Page 44 Figure 9. Unit 2 division II ac power system fault tree (DIV-2-AC-U2).

SENSITIVE - NOT FOR PUBLIC DISCLOSURE LER 265/01-001 29 DIV-2-DC

9. 0E-5 DCP-BDC-LP-BUS1B DIV-2-DC-1 DIV-2-DC-2

1. 9E-7 DCP-BAT-CF-ALL DIV-2-DC-4 2.4E-5 DCP-BAT-LP-U2 DIV-2-DC-7 1.0E+0 DCP-BAT-LP-U2A TRUE DCP-XHE-XE-U2A DIV-2-DC-3 DIV-2-DC-5

4. 7E-8 DCP-BCH-CF-CHRS 2.4E-5 DCP-BCH-FC-BCH2 41 DIV-1-AC-U2 DIV-2-DC-6 44 DIV-2-AC-U2 DIV-2-DC-8 4.7E-8 DCP-BCH-CF-CHRS 2.4E-5 DCP-BCH-FC-BCH2A 1.0E-3 DCP-XHE-XE-BCH2A DIV-2-DC-9 DIV-2-DC-10 FALSE HE-LOCA TRUE LOOP-II DIV-2-DC-11 DIV-2-DC-12 TRUE HE-SBO DIV-2-DC-3 DIV-2-DC-2 DIV-2-DC-9 STANDBY BATTERY IS UNAVAILABLE BACKUP AC POW ER SUPPLY FAILS UNIT 2 125 VDC BATTERIES FAIL NORMAL AC POWER SUPPLY FAILS UNIT 2 BATTERY CHARGERS FAIL UNIT 2 BATTERY CHARGERS FAIL POWER SUPPLIES FAIL UNIT 2 STANDBY BATTERY CHARGER 2A FAILS UNIT 2 BATTERY FAILS UNIT 2 BATTERY FAILS DIVISION II 125 VDC POWER IS UNAVAILABLE BATTERY CHARGERS UNAVAILABLE QUAD CITIES 1 & 2 UNIT 2 DIVISION II POWER SYSTEM FAULT TREE QUAD CITIES 1 & 2 UNIT 2 DIVISION I POWER SYSTEM FAULT TREE POWER SUPPLIES FAIL LOCA OR LOOP EVENTS POW ER SUPPLIES FAIL DURING LOCA OR LOOP BATTERY CHARGERS FAIL FROM COMMON CAUSE BATTERY CHARGERS FAIL FROM COMMON CAUSE LOSS OF OFFSITE POW ER (DIVISION II)

OPERATOR FAILS TO PLACE STANDBY BATTERY IN SERVICE OPERATOR FAILS TO PLACE STBY BATTERY CHARGER IN SERVICE DIVISION II 125 VDC BUS 1B FAILS UNIT 2 STBY BATTERY CHARGER 2A FAILS UNIT 2 BATTERY CHARGER 2 FAILS UNIT 2 STANDBY BATTERY FAILS UNIT 2 BATTERY FAILS BATTERIES FAIL FROM COMMON CAUSE HOUSE EVENT FOR STATION BLACKOUT EVENTS HOUSE EVENT FOR LOSS OF COOLANT EVENTS POWER SUPPLIES FAIL DURING LOCA OR LOOP DIV-2-DC - QUAD CITIES 1 & 2 DIVISION II DC POWER SYSTEM FAULT TREE 2004/05/13 Page 45 Figure 10. Unit 1 division II dc power system fault tree (DIV-2-DC).

SENSITIVE - NOT FOR PUBLIC DISCLOSURE LER 265/01-001 30 SWS-U1A 40 DIV-1-AC SWS-U1A-1 SWS-U1A-2 42 DIV-1-DC 3.0E-3 SWS-MDP-FS-U1A 1.0E-3 SWS-XHE-XM-PUMPS 1.0E-4 SWS-CKV-CC-PCKV1A TRUE LOOP-I 7.2E-4 SWS-MDP-FR-U1A 1.8E-5 SWS-MDP-CF-START 3.2E-6 SWS-CKV-CF-PCKVS FAILURES OF SWS MDP 1A DURING LOOP UNIT 1 PUMP TRAIN 1A IS UNAVAILABLE FAILURES OF SWS MDP 1A DURING LOOP DIVISION I 125 VDC POWER IS UNAVAILABLE DIVISION I AC POWER IS UNAVAILABLE PUMP 1A DISCHARGE CKV 1-3999-4 FAILS TO OPEN OPERATOR FAILS TO START A SERVICE WATER PUMP SERVICE WATER MDP 1A FAILS TO RUN SERVICE WATER MDP 1A FAILS TO START LOSS OF OFFSITE POWER (DIVISION I)

SWS PUMPS FAIL FROM COMMON CAUSE TO START PUMP DISCH CKVS FAIL FROM COMMON CAUSE TO OPEN SWS-U1A - QUAD CITIES 1 & 2 SERVICE WATER SYSTEM FAULT TREE 2003/12/22 Page 141 Figure 11. Unit 1 service water system fault tree (SWS-U1A).

SENSITIVE - NOT FOR PUBLIC DISCLOSURE LER 265/01-001 31 SWS-U1B 43 DIV-2-AC SWS-U1B-1 SWS-U1B-2 45 DIV-2-DC 3.0E-3 SWS-MDP-FS-U1B 1.0E-3 SWS-XHE-XM-PUMPS 1.0E-4 SWS-CKV-CC-PCKV1B TRUE LOOP-II 7.2E-4 SWS-MDP-FR-U1B 3.2E-6 SWS-CKV-CF-PCKVS 1.8E-5 SWS-MDP-CF-START FAILURES OF SWS MDP 1B DURING LOOP FAILURES OF SWS MDP 1B DURING LOOP UNIT 1 PUMP TRAIN 1B IS UNAVAILABLE DIVISION II 125 VDC POWER IS UNAVAILABLE DIVISION II AC POWER IS UNAVAILABLE PUMP 1B DISCHARGE CKV 1-3999-2 FAILS TO OPEN OPERATOR FAILS TO START A SERVICE WATER PUMP SERVICE WATER MDP 1B FAILS TO RUN SERVICE WATER MDP 1B FAILS TO START LOSS OF OFFSITE POWER (DIVISION II)

SWS PUMPS FAIL FROM COMMON CAUSE TO START PUMP DISCH CKVS FAIL FROM COMMON CAUSE TO OPEN SWS-U1B - QUAD CITIES 1 & 2 SERVICE WATER SYSTEM FAULT TREE 2003/12/22 Page 142 Figure 12. Unit 1 service water system fault tree (SWS-U1B).

SENSITIVE - NOT FOR PUBLIC DISCLOSURE LER 265/01-001 32 SWS-U2A 7.2E-4 SWS-MDP-FR-U2A 41 DIV-1-AC-U2 SWS-U2A-1 FALSE LOOP-I-U2 SWS-U2A-2 9.0E-5 DCP-BDC-LP-U2DI 1.0E-4 SWS-CKV-CC-PCKV2A 3.2E-6 SWS-CKV-CF-PCKVS 1.8E-5 SWS-MDP-CF-START 3.0E-3 SWS-MDP-FS-U2A 1.0E-3 SWS-XHE-XM-PUMPS FAILURES OF SWS MDP 2A DURING LOOP FAILURES OF SWS MDP 2A DURING LOOP UNIT 2 PUMP TRAIN 2A IS UNAVAILABLE QUAD CITIES 1 & 2 UNIT 2 DIVISION I POWER SYSTEM FAULT TREE SERVICE WATER MDP 2A FAILS TO START SERVICE WATER MDP 2A FAILS TO RUN PUMP 2A DISCHARGE CKV 2-3999-4 FAILS TO OPEN PUMP DISCH CKVS FAIL FROM COMMON CAUSE TO OPEN SWS PUMPS FAIL FROM COMMON CAUSE TO START LOSS OF OFFSITE POWER (UNIT 2 DIVISION I)

OPERATOR FAILS TO START A SERVICE WATER PUMP UNIT 2 DIVISION I 125 VDC POWER IS UNAVAILABLE SWS-U2A - QUAD CITIES 1 & 2 SERVICE WATER SYSTEM FAULT TREE 2003/12/22 Page 143 Figure 13. Unit 2 service water system fault tree (SWS-U2A).

SENSITIVE - NOT FOR PUBLIC DISCLOSURE LER 265/01-001 33 SWS-U2B 7.2E-4 SWS-MDP-FR-U2B 44 DIV-2-AC-U2 SWS-U2B-1 FALSE LOOP-II-U2 SWS-U2B-2 9.0E-5 DCP-BDC-LP-U2DII 4.2E-6 SSW-CKV-CF-PCKVS 1.0E-4 SWS-CKV-CC-PCKV2B 1.8E-5 SWS-MDP-CF-START 3.0E-3 SWS-MDP-FS-U2B 1.0E-3 SWS-XHE-XM-PUMPS FAILURES OF SWS MDP 2B DURING LOOP FAILURES OF SWS MDP 2B DURING LOOP UNIT 2 PUMP TRAIN 2B IS UNAVAILABLE QUAD CITIES 1 & 2 UNIT 2 DIVISION II POWER SYSTEM FAULT TREE SERVICE WATER MDP 2B FAILS TO RUN SERVICE WATER MDP 2B FAILS TO START SWS MDP 2B DISCHAGE CHECK VALVE FAILS TO OPEN SWS PUMPS FAIL FROM COMMON CAUSE TO START RHRSW PUMP DISCHG CKVS FAIL FROM COMMON CAUSE TO OPEN LOSS OF OFFSITE POWER (UNIT 2 DIVISION II)

OPERATOR FAILS TO START A SERVICE WATER PUMP UNIT 2 DIVISION II 125 VDC POWER IS UNAVAILABLE SWS-U2B - QUAD CITIES 1 & 2 SERVICE WATER SYSTEM FAULT TREE 2003/12/22 Page 144 Figure 14. Unit 2 service water system fault tree (SWS-U2B).

SENSITIVE - NOT FOR PUBLIC DISCLOSURE LER 265/01-001 34 TBC-A 40 DIV-1-AC TBC-A-1 TBC-A-2 42 DIV-1-DC 3.0E-3 TBC-MDP-FS-PUMPA 1.0E-4 TBC-CKV-CC-PCKVA 1.0E-3 TBC-XHE-XM-ERROR TRUE LOOP-I 7.2E-4 TBC-MDP-FR-PUMPA FAILURES OF TBCCW MDP 1A DURING LOOP FAILURE OF TBCCW MDP 1A DURING LOOP FAILURE OF TBCCW MDP 1A DIVISION I 125 VDC POWER IS UNAVAILABLE DIVISION I AC POWER IS UNAVAILABLE OPERATOR FAILS TO START A TBCCW PUMP MDP 1A DISCH CKV 1-3899-11 FAILS TO OPEN TBCCW MDP 1A FAILS TO START TBCCW MDP 1A FAILS TO RUN LOSS OF OFFSITE POWER (DIVISION I)

TBC-A - QUAD CITIES 1 & 2 TBCCW SYSTEM FAULT TREE 2003/12/22 Page 147 Figure 15. TBCCW system fault tree (TBC-A).

SENSITIVE - NOT FOR PUBLIC DISCLOSURE LER 265/01-001 35 HC1 1.0E-3 HCI-XHE-XO-ERROR 2.0E-4 MFW-CKV-CC-TRNB 1.3E-5 MFW-CKV-CF-FEED HC1-1 2.0E-5 CDS-TNK-HW-CST HC1-4 1.0E-4 HCI-CKV-CC-F039 3.0E-3 HCI-MOV-CC-F035 3.0E-3 HCI-MOV-CC-F036 3.0E-3 HCI-MOV-OO-F006 1.2E-4 HCI-STR-PG-HPCI 3.3E-6 RHR-STR-CF-SPOOL HC1-2 1.0E-4 HCI-CKV-CC-F007 2.3E-2 HCI-TDP-TM-TRAIN HC1-10 2.0E-1 HCI-MOV-CC-IVFRO 1.2E-1 HCI-MULTIPLE-INJECT 8.3E-1 HCI-XHE-XL-INJECT HC1-6 8.3E-2 HCI-XHE-XL-START HC1-8 2.5E-2 HCI-MOV-CC-INJEC 1.2E-1 HCI-TDP-FS-TRAIN HC1-7 4.1E-2 HCI-TDP-FR-TRAIN 6.3E-1 HCI-XHE-XL-RUN HC1-3 27 DCP-250A 45 DIV-2-DC HC1-5 1.0E-3 HCI-XHE-XM-RCOOL 47 ESW HC1-2 HPCI FAILS TO START HPCI FAILS TO RUN HPCI FAILS TO START TORUS SUCTION FAILS HPCI WATER SUPPLIES ARE UNAVAILABLE HPCI SUPPORT SYSTEMS ARE UNAVAILABLE HPCI PUMP TRAIN IS UNAVAILABLE ROOM COOLING FAILS DIVISION I 250 VDC POWER IS UNAVAILABLE HPCI FAILS TO PROVIDE SUFFICIENT FLOW TO RX VESSEL DIESEL COOLING WATER IS UNAVAILABLE DIVISION II 125 VDC POWER IS UNAVAILABLE HPCI INJECTION MOV FAILS TO REOPEN HPCI DISCHARGE CKV 1-2301-7 FAILS TO OPEN HPCI PUMP TRAIN IS UNAVAILABLE BECAUSE OF MAINTENANCE HPCI PUMP FAILS TO START HPCI PUMP TRAIN FAILS TO RUN GIVEN IT STARTED OPERATOR FAILS TO RECOVER HPCI INJECT MOV FAILURE TO REOPEN MULTIPLE HPCI INJECTIONS REQUIRED HPCI SUPPRESSION POOL SUCTION STRAINER PLUGS SUPPRESSION POOL STRAINERS FAIL FROM COMMON CAUSE CST ISOLATION VALVE 1-2301-20 FAILS TO CLOSE TORUS SUCTION VALVE 1-2301-35 FAILS TO OPEN TORUS SUCTION VALVE 1-2301-36 FAILS TO OPEN TORUS SUCTION VALVE 1-2301-36 FAILS TO OPEN OPERATOR FAILS TO ESTABLISH ROOM COOLING WITHOUT ESW HPCI INJECTION VALVE FAILS TO REOPEN HPCI INJECTION VALVE CAUSES FAILURE TO START OPERATOR FAILS TO START/CONTROL HPCI INJECTION F EEDWATER CHECK VALVES FAIL FROM COMMON CAUSE FEEDWATER TRAIN B INJECTION CKVS FAIL TO OPEN OPERATOR FAILS TO RECOVER HPCI FAILURE TO START OPERATOR FAILS TO RECOVER HPCI FAILURE TO RUN CONDENSATE STORAGE TANK IS UNAVAILABLE HPCI PUMP TRAIN IS UNAVAILABLE HC1 - QUAD CITIES 1 & 2 HPCI SYSTEM FAULT TREE 2004/05/13 Page 58 Figure 16. HPCI system fault tree (HC1).

SENSITIVE - NOT FOR PUBLIC DISCLOSURE LER 265/01-001 36 HCI 1.0E-3 HCI-XHE-XO-ERROR 2.0E-4 MFW -CKV-CC-TRNB 1.3E-5 MFW -CKV-CF-FEED HCI-1 2.0E-5 CDS-TNK-HW -CST HCI-4 1.0E-4 HCI-CKV-CC-F039 3.0E-3 HCI-MOV-CC-F035 3.0E-3 HCI-MOV-CC-F036 3.0E-3 HCI-MOV-OO-F006 1.2E-4 HCI-STR-PG-HPCI 3.3E-6 RHR-STR-CF-SPOOL HCI-2 1.0E-4 HCI-CKV-CC-F007 2.3E-2 HCI-TDP-TM-TRAIN HCI-10 2.0E-1 HCI-MOV-CC-IVFRO 1.2E-1 HCI-MULTIPLE-INJECT 8.3E-1 HCI-XHE-XL-INJECT HCI-6 8.3E-2 HCI-XHE-XL-START HCI-8 2.5E-2 HCI-MOV-CC-INJEC 1.2E-1 HCI-TDP-FS-TRAIN HCI-7 4.1E-2 HCI-TDP-FR-TRAIN 6.3E-1 HCI-XHE-XL-RUN HCI-3 27 DCP-250A 42 DIV-1-DC HCI-5 1.0E-3 HCI-XHE-XM-RCOOL 47 ESW HCI-2 HPCI FAILS TO START HPCI FAILS TO RUN DIVISION I 250 VDC POWER IS UNAVAILABLE TORUS SUCTION FAILS HPCI SUPPORT SYSTEMS ARE UNAVAILABLE HPCI FAILS TO START HPCI PUMP TRAIN IS UNAVAILABLE ROOM COOLING FAILS DIESEL COOLING W ATER IS UNAVAILABLE DIVISION I 125 VDC POW ER IS UNAVAILABLE HPCI INJECTION MOV FAILS TO REOPEN HPCI WATER SUPPLIES ARE UNAVAILABLE HPCI FAILS TO PROVIDE SUFFICIENT FLOW TO RX VESSEL HPCI DISCHARGE CKV 1-2301-7 FAILS TO OPEN HPCI PUMP TRAIN IS UNAVAILABLE BECAUSE OF MAINTENANCE HPCI PUMP FAILS TO START HPCI PUMP TRAIN FAILS TO RUN GIVEN IT STARTED OPERATOR FAILS TO RECOVER HPCI INJECT MOV FAILURE TO REOPEN MULTIPLE HPCI INJECTIONS REQUIRED HPCI SUPPRESSION POOL SUCTION STRAINER PLUGS SUPPRESSION POOL STRAINERS FAIL FROM COMMON CAUSE CST ISOLATION VALVE 1-2301-20 FAILS TO CLOSE TORUS SUCTION VALVE 1-2301-35 FAILS TO OPEN TORUS SUCTION VALVE 1-2301-36 FAILS TO OPEN TORUS SUCTION VALVE 1-2301-36 FAILS TO OPEN OPERATOR FAILS TO ESTABLISH ROOM COOLING WITHOUT ESW HPCI INJECTION VALVE FAILS TO REOPEN HPCI INJECTION VALVE CAUSES FAILURE TO START OPERATOR FAILS TO START/CONTROL HPCI INJECTION FEEDWATER CHECK VALVES FAIL FROM COMMON CAUSE FEEDW ATER TRAIN B INJECTION CKVS FAIL TO OPEN OPERATOR FAILS TO RECOVER HPCI FAILURE TO START OPERATOR FAILS TO RECOVER HPCI FAILURE TO RUN CONDENSATE STORAGE TANK IS UNAVAILABLE HPCI PUMP TRAIN IS UNAVAILABLE HCI - QUAD CITIES 1 & 2 HPCI SYSTEM FAULT TREE 2004/05/13 Page 59 Figure 17. HPCI system fault tree (HCI).

SENSITIVE - NOT FOR PUBLIC DISCLOSURE 1

Attachment B - Resolution of Comments Region III Comments on Accident Sequence Precursor Report for Quad Cities Unit 2 LOOP and Transformer Fire on August 2, 2001 Region III Comment 1: Page 1, Paragraph 1 - Last sentence states (per the LER) that all offsite power sources to Unit 1 remained normal. This statement is somewhat misleading. While Unit 1 remained connected to the grid, the switchyard breakers which opened due to the lightening strike, transformer failure, and switchyard breaker protective relaying malfunctions resulted in 2 of 5 offsite lines being unavailable to both units. In addition, if switchyard breaker 7-8 would have opened Unit 1 would have scrammed since this breaker was the only one allowing power from the Unit 1 main generator to be supplied to the switchyard.

Response: Text changed to state: Unit 1 remained connected to the offsite grid with a reduced number of offsite power lines.

Region III Comment 2: Page 1, Paragraph 2 - First sentence states that an Unusual Event was declared due to the Unit 2-centered loss of offsite power. I am unsure how this determination was made. Please consider that although the transformer exploded, this event was not what caused the loss of offsite power (LOOP). The LOOP was caused due to a subsequent failure of a switchyard protective relaying reset function. The failure of this relay to properly reset resulted in the switchyard breakers on each side of the relay to open. This is what actually caused the LOOP.

Response: Title changed to Loss of offsite power to Unit 2 but not Unit 1 due to failure of Unit 2 main power transformer with the subsequent failure of a switchyard breaker relay. Text changed to state: An unusual event was declared following the Unit 2-centered loss of offsite power (LOOP).

Region III Comment 3: Page 1, Paragraph 2 - At the bottom of the paragraph, references are made to the Unit 1 EDG and to bus 14-1. The reason for including this information is not clear to me. We may want to better explain that Quad Cities had an opportunity to supply Unit 2 using the grid using the cross tie breaker between bus 14-1 (Unit 1) and bus 24-1 (Unit 2).

However, this is not an easy task. To complete this task, the droop setting on the EDG has to be lowered, the EDG has to be paralleled with the grid, the bus tie breaker has to be closed, and several other actions must be done. The licensee chose not to pursue this route since there was no damage to the Unit 2 reserve auxiliary transformer (RAT). The licensee believed it was a better choice to restore the Unit 2 RAT than complete the actions to cross tie busses 14-1 and 24-1.

SENSITIVE - NOT FOR PUBLIC DISCLOSURE 2

Response: This paragraph describes the state of all the emergency buses and emergency diesel generators at the site, including the station blackout diesels. The Unit 1 emergency diesel generator and bus 14-1 are described for completeness. Text changed to state: The Unit 1 EDG (EDG 1) was not required to start...

Region III Comment 4: Page 1, Paragraph 3 - Second sentence states that reactor pressure was controlled using the main steam relief valves. Do we mean the safety relief valves or the main steam safety valves? Both types of valves exist at Quad Cities. Based on my plant knowledge, I believe we mean the safety relief valves.

Response: Text unchanged. Text is taken verbatim from the LER. It appears that main steam relief valves and safety relief valves are interchangeable nomenclature.

Region III Comment 5: Page 1, Paragraph 4 - Multiple local fire departments were called in to combat the transformer fire.

Response: Text changed to state:...and (3) actions of the local fire departments.

Region III Comment 6: Page 1, Paragraph 5 - Unit 1 did not continue to operate at 100 percent power throughout the event. As stated in Inspection Report 2001012, Unit 1 reactor power was lowered to approximately 93 percent during the Unit 2 transformer fire to recover service water system pressure.

Response: Text changed to state: Unit 1 power was lowered to approximately 93% following the LOOP at Unit 2.

Region III Comment 7: Page 2, Paragraph 1 - While we do not disagree with the information in this paragraph, more is known. Specifically, the Unit 2 main power transformer was subjected to multiple electrical faults during its service life. Although the licensee knew about the faults, they were not tracking the number of faults or the severity of the faults on the transformer. The licensee now states that repeatedly subjecting the undersized bus bar and bus bar clamps to faults caused these components to loosen to the point that a phase-to-phase fault occurred in the transformer.

Response: Text changed to state:...caused a fire in the transformer. The Unit 2 main power transformer was subjected to multiple electrical faults during its service life, which contributed to its ultimate failure. Although the licensee knew about the faults, they were not tracking the number of faults or the severity of the faults on the transformer.

Region III Comment 8: Page 2, Paragraph 1 - In their LER, the licensee stated that age related degradation of a transistor led to slow reset time of the static breaker failure relay. Again, this is a true statement. However, the licensee failed to state that the age related degradation was not recognized earlier due to the failure to include completion of the reset function in their relay testing program.

SENSITIVE - NOT FOR PUBLIC DISCLOSURE 3

Response: Text changed to state:...causing a slow relay reset time (Ref. 1). The age-related degradation was not recognized earlier due to the failure to include completion of the reset function in their relay testing program.

Region III Comment 9: Page 2, Paragraph 2 - The LOOP was not caused by the transformer failure. It was a direct result of the static breaker failure relay malfunction.

Response: Text changed to state: For Unit 2, the event is considered a unit-centered LOOP caused by failure of a switchyard breaker relay to properly respond to failure of the Unit 2 main power transformer.

Region III Comment 10: Page 2, Paragraph 3 - This paragraph mentions that Unit 1 had restricted electrical power while offsite power was being restored to Unit 2. This contradicts Page 1, Paragraph 5 which states that Unit 1 remained at full power. Also, electrical power was restricted to recover service water pressure rather than to restore power to Unit 2.

Response: Text unchanged. The text on page 1, paragraph 5 was changed as noted above.

Region III Comment 11: Page 2, Paragraph 4 - Please consider including the information mentioned on the previous page to explain why the licensee chose not to restore offsite power to Unit 2 using the Unit 1 cross tie. If a decision is made not to include this information, please consider explaining why the NRC feels this would have been a better course of action.

Response: Text unchanged. The ASP analysis is based on what occurred. No judgment is being made as to which action is better. The decision concerning when to restore offsite power must be made by the operators on site depending on the existing conditions.

Region III Comment 12: Page 2, Paragraph 6 - Under the CCDP analysis results section, please consider including the precursor threshold value for an initiating event to provide the reader with a baseline initiating events value.

Response: Text changed to state: This CCDP exceeds the Accident Sequence Precursor (ASP) acceptance threshold. The CCDP is greater than 1.0 x 10-6, and the CCDP is greater than the CCDP for a transient with loss of reactor feedwater and no reactor feedwater recovery, which is 1.2 x 10-6 (point estimate).

Region III Comment 13: General Comments - You may want to consider looking at the inspection reports in addition to the licensees LER. I have found that the licensee tends to only include what is required while providing as little information as possible to the reader. You may find that the inspection reports include more detail on what happened during a specific event and why.

Response: Review of inspection reports has always been a part of the Accident Sequence Precursor program.

SENSITIVE - NOT FOR PUBLIC DISCLOSURE 4

A memo from Peter J. Habighorst, Acting Section Chief, Probabilistic Safety Assessment Branch, Division of Systems Safety and Analysis, Office of Nuclear Reactor Regulation to Larry Rossbach, Project Manager, Division of Licensing Project Management, Office of Nuclear Reactor Regulation, dated July 7, 2004, Review of Preliminary ASP Analysis of a Loss of Off-Site Power Event at Quad Cities in August 2001.

SPSB Comment 1: Generic Comment - In the event summary, the lightning strike caused the Unit 2 main transformer failure, leading to an automatic shutdown of the Unit 2 reactor.

Subsequently, additional breakers in the switchyard supplying offsite power to the Unit 2 reserve auxiliary transformer (RAT) opened, and an unusual event was declared due to the Unit 2 loss of offsite power (LOOP). If the above two events concurred or the breaker openings followed the weather-initiated transformer fire instantly, the event was initiated due to severe weather (lightning strike), leading to a partial LOOP (or transient) and followed by the total loss of offsite power due to the subsequent failures of the breakers.

Response: Analysis was performed as a unit-centered LOOP on Unit 2; that is, only Unit 2 lost offsite power while Unit 1 remained tied to offsite power. Modifications were made to the SPAR Revision 3 models to perform the analysis as a Unit 2-centered LOOP. The nominal SPAR Revision 3 initiating events do not apply to this event. In particular, the SPAR Revision 3 plant-centered LOOP model does not apply because not all units at the site lost offsite power due to problems in the switchyard.

SPSB Comment 2: Generic Comment - The PSFs for recovery actions have been changed.

The assignment of either an overly conservative stress level (such as extreme stress) or a too optimistic value may not be desirable, depending on the PSFs and type of precursor events.

Two PSFs, stress and complex for LOOP sequences have been changed from nominal to high and nominal to moderately complex, respectively. These adjusted recovery actions raised the CDP contribution by a factor of four. For a routine LOOP event with a well defined plant evolution, normal stress level may be more appropriate. The PSFs for this event should be set to nominal values.

Response: Based on a number of evaluations of LOOPs over the last 3 years, including the grid-related LOOPs on August 14, 2003, the Accident Sequence Precursor program reviewed its treatment of recovery of electrical power following LOOP and made some changes to the methods used for the analysis. For LOOPs and partial LOOPs, recovery of electrical power is now generally treated as a human factor evaluation rather than allowing the SPAR Revision 3 models to automatically recalculate recovery based on what kind of LOOP was specified in the computer input. The ASP analysis for Quad Cities Unit 2 represents an event where Unit 2 lost offsite power but Unit 1 did not. The ability to recover electric power at Unit 2 using Unit 1 electrical power existed from time t = 0.0 seconds. The performance shaping factors used in the analysis are consistent with other LOOP evaluations, including evaluations of the grid-related LOOPs on August 14, 2003. These performance shaping factors used in LOOP analyses have been approved by human factors personnel at INEEL.

SENSITIVE - NOT FOR PUBLIC DISCLOSURE 5

SPSB Comment 3: Generic Comment - For SBO sequences, PSF values were changed from nominal to either more-than enough or inadequate for the PSF element, time, and to extreme for the PSF stress. These changes appear to be too extreme, compared with the changes for the recovery actions during the LOOP sequences. Again, these changes may not be appropriate.

Response: The analysis represents an event where Unit 2 lost offsite power but Unit 1 did not.

The performance shaping factors used in the analysis are those appropriate to the event and use assumptions consistent with other LOOP evaluations. These performance shaping factors have been approved by human factors personnel at INEEL.

SPSB Comment 4: Generic Comment - The reviewer employed the Quad Cities SPAR-3 model for initiation and condition evaluation of this ASP event and all of the initial availability numbers were set to nominal values without changing or adjusting PSFs and basic event availability numbers. The availability values of the reactor protection system (RPS) and other successful systems were set as nominal values (not False or 0"). This resulted in: CDP Point Estimate 4.6 x 10-5 Mean 5.4 x 10-5 5th Percentile 3.4 x 10-5 Median 4.3 x 10-5 95th Percentile 1.0 x 10-4 Standard Deviation 6.6 x 10-6

• The analyses were based on a truncation level of 10-11 with the third and fourth moments indicating relatively high uncertainty.

Response: In general, the SPSB results appear to result in a CCDP an order of magnitude higher than the ASP results. The differences are due to a number of considerations, but the major reasons for the differences are believed to be: (1) the nominal SPAR Revision 3 initiating events are not applicable to the event at Quad Cities and (2) the SPSB analysis does not take credit for the ability of the operators to restore electrical power in ways not treated in the nominal SPAR Revision 3 models.

SPSB Comment 5: Specific Comment - The Quad Cities event in August 2001 appeared to be a severe weather related partial LOOP or transient event, unless a plant centered LOOP can be justified. Using nominal values without adjusting the PSF values (Table 5, page 15) and without any credits to successes (zero maintenance model), a plant centered LOOP resulted in a CDP point estimate of 1.1 x 10-4. Event tree sequence 09-5 is the dominant sequence, followed by sequences 61 and 65. However, the CCDP of sequence 65 remains as 2.4 x 10-6, since the sequence involves only the reactor protection system (RPS-SYS-FC-PSOVS, RPSSYS-FC-RELAY, and RPS-SYS-FC CRD). If the lightning strike and severe weather related LOOP (not partial LOOP nor Transient) is employed, a CDP point estimate of 4.6 x 10-5 would result. The dominant sequence would be 09-5, followed by sequences 64-02 and 62-34. Sequence 65 would not register in the severe weather related LOOP evaluation as one of the top sequences.

SENSITIVE - NOT FOR PUBLIC DISCLOSURE 6

Response: The event is not a plant-centered LOOP. Unit 1 did not lose offsite power. The event is a unit-centered LOOP at Unit 2 and is modeled as such in the ASP analysis using the latest techniques for LOOP analysis.

SPSB Comment 6: Specific Comment - The event summary description indicated that the Unit 2 LOOP lasted approximately 2.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />. A more realistic approach of recovery actions could benefit the ASP program. The use of actual offsite power (OSP) restoration time to a safety bus should be more realistic, rather than using a recovery time of more than four hours, which is too conservative.

Response: Offsite power was available to Unit 2 from Unit 1 from time t = 0.0 seconds. The operators chose to allow the emergency diesel generators to continue to power the Unit 2 emergency buses rather than restore electrical power to the Unit 2 emergency buses using Unit 1 electrical power. There were no failures to start or to run of either emergency diesel generator used to power the Unit 2 emergency buses during the event. When the Unit 2 offsite power was restored, the operators restored offsite power to the Unit 2 emergency buses and stopped the emergency diesel generators.

Assuming that an emergency diesel generator powering a Unit 2 emergency bus failed, with a nominal probability, the ASP analysis modeled those operator actions necessary to recover electric power to the emergency bus. Models were created that considered that electric power was available to supply Unit 2 from Unit 1 at time t = 0.0 seconds if a Unit 2 emergency diesel generator were postulated to fail. Probabilities were generated for recovery of electrical power at various recovery times (30 minutes, 60 minutes, 90 minutes, etc.) using techniques applicable to human error analysis. The actual recovery of Unit 2 offsite power at 2.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> is not significant to the analysis and is not included in the ASP analysis.

SPSB Comment 7: Specific Comment - In the modeling assumptions and assessment summary, the event description employed a term, a unit-centered LOOP initiating event. To be consistent with the nomenclature used in the reports for individual plant SPAR models, the term plant centered may be more appropriate instead of the unit-centered term.

Response: The event is not a plant-centered LOOP. Unit 1 remained tied to the offsite power grid. The SPAR Revision 3 model was modified to fit the conditions where Unit 2 lost offsite power but Unit 1 remained tied to the offsite grid.

SPSB Comment 8: Specific Comment - Changes to basic event probability and common cause failure events were made as documented in Tables 4 through 6. The performance shaping factors (PFSs) were revised to elevate operators stress and complex for both LOOP and SBO. Why not assign them normal or nominal numbers?

Response: See response to SPSB Comment #2 and SPSB Comment #3.

SENSITIVE - NOT FOR PUBLIC DISCLOSURE 7

SPSB Comment 9: Specific Comment - Headings in Table 6 appeared to be misleading. The first column heading in Table 6 should be Alpha Identifier instead of Alpha Factor. Also, it would be beneficial to insert Alpha Distribution Parameter in the last column with the beta factor. These changes will make Table 6 more consistent with the other SPAR reports.

Response: The headings in Table 6 have been revised to be consistent with Table B-1 in the documentation of the SPAR Model for Quad Cities 1 & 2 (ASP BWR C).

SPSB Comment 10: Specific Comment - The switching over to the alpha factor from the beta factor was not clearly defined in the report. The rationale of the change should be documented and included. As an example, the change may be needed for the uncertainty analysis. Also, both probability and the beta numbers were changed and different from the numbers listed in the SPAR 3i report. The changes were based on the upgrading of the numbers by INEEL.

However, it would be helpful for readers to include a short explanation of the technical bases for changing the values.

Response: For certain basic events, the latest values recommended by INEEL were used in the analysis. Documentation of the changes will be included in the next revision of the SPAR report published by INEEL. In the meantime, questions concerning the changes should be addressed to the NRC Office of Research.

SPSB Comment 11: Specific Comment - The sensitivity study of non recovery probability is summarized on page 9. It may help to explain the objective of this study and the reason for assuming the non recovery probability could be 10 times greater.

Response: The sensitivity study is not an uncertainty analysis. The study did not mean to imply that the nonrecovery factor could actually be 10 times greater. The sensitivity study just indicates that the CCDP would change by the amount indicated if the basic event were changed to a factor of 10 higher. The text has been changed to state:... A sensitivity study was made using a value of 1.6E-1 for SDC -LTERM-NOREC2. With this change, the CCDP value...

A letter from Patrick R. Simpson, Exelon Nuclear, to the NRC, dated July 9, 2004, Quad Cities Nuclear Power Station, Unit 2, Response to Review of Preliminary Accident Sequence Precursor Analysis of August 2, 2001, Operational Event Licensees Comment 4.1: As calculated by the EGC PRA for QCNPS Unit 2, the CCDP for single-unit loss of offsite power is 4.7 x 10-6. Therefore, the QCNPS PRA supports the NRC Staff conclusion that this event qualifies as an ASP.

Response: No response is required.

SENSITIVE - NOT FOR PUBLIC DISCLOSURE 8

Licensees Comment 4.2: It is interesting to observe that none of the dominant cutsets for the LOOP initiator have anything to do with failure of AC power. This points out the strength of the QCNPS AC power system. What makes the LOOP much worse than an ordinary turbine trip, however, is the loss of power to turbine building systems such as feedwater and turbine bypass valves.

Response: No response is required.

Licensees Comment 4.3: Because QCNPS is a two-unit station that shares several non-safety-related support systems between the units, and because Unit 1 remained online with its normal source of offsite power, the impact of the LOOP is smaller than would be true for a single-unit station. For example, instrument air remained available and non-essential service water remained available. Therefore, motive air remained available for containment vent valves and did not need to be re-started after EDGs energized the safety buses (dash buses). However, inclusion of this information in the SPAR model would not change the dominant sequences and, therefore, would not affect the conclusion that the event is an ASP.

Response: No response is required.

Licensees Comment 4.4: Because of the QCNPS electrical design, condensate pumps can be backed from the EDGs. Therefore, given failure of normal Emergency Core Cooling Systems (ECCS), and given the availability of instrument air and service water, the combination of condensate for injection and standby coolant supply for condenser makeup could be used for reactor makeup. Again, however, inclusion of this information in the SPAR model would not change the dominant sequences and, therefore, would not affect the conclusion that the event is an ASP.

Response: No response is required.

Licensees Comment 4.5: While the CCDPS calculated by the SPAR model and by the EGC PRA are comparable, the sequences and cutsets dominating those CCDPs are significant different.

Specific explanations and suggestions are provided in subsequent comments.

Response: No response is required.

Licensees Comment 4.6: 44% of the SPAR model risk comes from Anticipated Transient Without Scram (ATWS). It is surprising that ATWS would be such a large fraction of LOOP risk, and more surprising that it would be the dominant source. It appears that the size of this contribution is not realistic, and it appears that the reason is a modeling decision to take no credit, for the LOOP initiator, for the ordinary Emergency Operating Procedure actions to respond to an ATWS. To accurately represent risk, the SPAR model should be improved to give that credit. Doing so would reduce the ATWS contribution to LOOP by between one and two orders of magnitude. The Exelon PRA does give that credit, and the top corresponding LOOP/ATWS cutset (LOOP frequency set to 1.0) has a probability of 3.8 x 10-8.

SENSITIVE - NOT FOR PUBLIC DISCLOSURE 9

Response: Exelon is correct in noting that the reason why failure of the reactor protection system (RPS) is such a large fraction of the SPAR model CCDP comes from the modeling assumption to take no credit for the transfer to ATWS event tree following a LOOP with subsequent failure of RPS.

The NRC is considering adding logic to the SPAR models to credit the transfer to the ATWS event tree at Quad Cities following a LOOP and failure of RPS. The NRC would like to make the SPAR models for Quad Cities more realistic with respect to this assumption. However, the SPAR model cannot be changed without documentation verifying the change is appropriate and technically correct. The NRC presently does not have such documentation.

The NRC appreciates your effort to improve the SPAR model for Quad Cities, but the model will remain as stated in the precursor report unless Quad Cities can provide the NRC with the appropriate documentation for changing the model. We would appreciate Quad Cities forwarding to the NRC documentation of the analysis (neutronic and thermal hydraulic) that permits Quad Cities to take credit for the transfer to ATWS event tree following a LOOP and failure of RPS. The NRC would also appreciate copies of the plant-specific emergency operating procedures that guide the Quad Cities operators through the event - LOOP followed by failure of RPS.

Licensees Comment 4.7: ATWS probabilities for QCNPS are based on NUREG/CR-5500, volume III. The mechanical ATWS probability is 2.1 x 10-6 and the electrical is 3.7 x 10-6. It is interesting to observe that the SPAR probabilities appear to be significantly smaller. The SPAR event RPS-SYS-FC-CRD, Control rod drive mechanical failure, has a probability of 2.5 x 10-7. The sum of two electrical SPAR events, RPS-SYS-FC-PSOVS, HCU scram pilot SOVs fail, and RPS-SYS-FC-RELAY, Trip system relays fail, is (1.7 x 10-6 + 3.8 x 10-7) = 2.1 x 10-6. EGC requests that the NRC Staff please provide the bases for the SPAR ATWS probabilities.

Response: The basis for the SPAR ATWS probabilities is NUREG/CR-5500, Volume 3. This can be seen in a comparison of LOOP Sequence 65 in Table 3 of the SPAR analysis to Tables 5 and 6 on pages 23 and 24, respectively, of NUREG/CR-5500, Volume 3.

Minimal cut sets SPAR CCDP Table 3 General Electric Unavailability with Credit for Manual Scram by Operator (NUREG/CR-5500, Volume 3, Table 5)

SPAR

% of CCDP Table 3 Contribution from CCF Events with Credit for Manual Scram by Operator (NUREG/CR-5500, Volume 3, Table 6)

RPS-SYS-FC-PSOVS 1.7 x 10-6 1.9 x 10-6 69.7%

71%

Hydraulic control unit scram pilot SOVs fail in SPAR - HCU in NUREG/CR-5500 RPS-SYS-FC-RELAY 3.8 x 10-7 3.8 x 10-7 15.6%

14%

Trip system relays fail in SPAR - Trip system in NUREG/CR-5500 RPS-SYS-FC-CRD 2.5 x 10-7 2.5 x 10-7 10.2%

10%

Control rod drive mechanical failure in SPAR - Rod in NUREG/CR-5500 Total 2.4 x 10-6 2.6 x 10-6

SENSITIVE - NOT FOR PUBLIC DISCLOSURE 10 Licensees Comment 4.8: 17% of SPAR model risk comes from a sequence involving a stuck-open SRV, failure to cool the containment or to cool the suppression pool, and failure to vent containment. Only one cutset dominates this sequence, and the failures beyond the stuck-open valve involve two operator actions, lining up RHR and venting containment. They are modeled as dependent operator actions (RHR-XHE-XM-ERROR, CVS-XHE-XE-VENT2), and the combination results in a combined operator failure of (5 x 10-4)(3.1 x 10-2) = 1.6 x 10-5. A similar combination of failures in the EGC PRA is assigned a failure probability of 5 x 10-7. The EGC QC HRA (Human Reliability Analysis) Notebook states that the actions to cool the suppression pool and to vent containment have completely different symptoms and QGA instructions to initiate them. The time frames are completely different, and there likely will be different crews involved in making the decisions. Torus cooling is aligned in the first 30 minutes, while containment venting is not required until 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br /> into the event. As a result, it is concluded that there is a low dependence, and EGC assigns a floor value for combined operator actions of 5 x 10-7. It appears that a smaller dependent operator action probability should be used in the SPAR model.

The NRC response is for both Licensee Comment 4.8 and 4.9 Licensees Comment 4.9:16% of SPAR model risk comes from a sequence that is analogous to the above sequence, but involves successful SRV operation. Again, only one cutset represents this sequence. It involves the same dependent operator actions as above, but it also includes some credit for recovery of suppression pool cooling. With this credit, the overall combined operator action probability is reduced to 5 x 10-7, which, by coincidence, is the same as the Exelon probability with no recovery of suppression pool cooling. This supports the comment in Paragraph 4.8.

Response: The value used in the SPAR analysis for CVS-XHE-XE-VENT2, as given in Table 4 of the report, is 5.1 x 10-2 not 3.1 x 10-2. If this correction is made, the combination of operator errors in comment 4.8 is increased to (5 x 10-4)(5.1 x 10-2) = 2.6 x 10-5. If this correction is made, the combinations of operator errors in comment 4.9 is increased to 8.1 x 10-7. However, the Exelon observation is correct in that there is a difference in the treatment of operator actions for the case of LOOP with a stuck-open relief valve versus the LOOP without a stuck-open relief valve. Credit was given for operator recovery of RHR for LOOP with no stuck-open relief valve.

It is believed that a stuck-open relief valve will make the actions of the operators a little more complex and difficult following a LOOP. At the minimum, more mass and energy will be released from the reactor vessel to the suppression pool in a shorter time. Efforts to shut the stuck-open relief valve will also occupy some of the operators attention and resources. In recognition of such factors, no credit was given for operator recovery of decay heat removal if human error were to fail the RHR system following a LOOP with stuck-open relief valve. This was considered a conservative assumption.

The NRC would like to make the SPAR models for Quad Cities more realistic with respect to this assumption. However, the SPAR model cannot be changed without documentation verifying that the change is appropriate and technically correct. The NRC presently does not have such documentation.

SENSITIVE - NOT FOR PUBLIC DISCLOSURE 11 The NRC appreciates your effort to improve the SPAR model for Quad Cities, but the model will remain as stated in the precursor report until Quad Cities can provide the NRC with the appropriate documentation for changing the model. The NRC would appreciate Quad Cities forwarding to the NRC the plant-specific emergency operating procedures that guide the Quad Cities operators through the event - LOOP followed by stuck-open relief valve followed by failure of the RHR system.

Hopefully, Quad Cities personnel would be able to add additional explanation to these operating procedures that would demonstrate that operators would perform the same actions, within the same approximate time frame, for both LOOP without a stuck-open relief valve and failure of the RHR system and LOOP with a stuck-open relief valve and failure of the RHR system.

Licensees Comment 4.10: 13% of SPAR model risk comes from a sequence with failure of all high-pressure injection and failure of manual reactor depressurization. The top two cutsets from this sequence involve loss of DC power on both divisions. The next two comments deal with this sequence.

Response: No response is required.

Licensees Comment 4.11: The first of these cutsets consists of the LOOP initiator and common cause failure of both batteries. Note that this cutset has nothing to do, specifically, with a LOOP.

This failure can happen for any initiator, including ordinary turbine trip, and many initiators are far more likely than a LOOP. In fact, the EGC QCNPS PRA models a loss-of-both-DC-buses initiating event. EGC recognized that, since both DC buses are normally energized, losing both of them at once is likely to be an initiator rather than a dependent failure. Consequently, for EGC, combinations of LOOP and common-cause failure of both DC trains are covered by the loss-of-both-DC-buses initiating event and they are not counted separately for loss of offsite power. If the SPAR model has such an initiator, consider removing these kinds of cutsets from the LOOP logic.

Response: The Quad Cities SPAR model does not have an initiator for dual failure of both dc buses. However, the Quad Cities SPAR model includes a loss-of-dc bus (single) initiator with a initiating event frequency of 2.4 x 10-7/hour. In addition, the SPAR models do include the failure of one or both buses (either by independent failure or common-cause failure) for other initiating events. The probability of both dc buses failing is very small but cannot be discounted. For an actual LOOP, the failure of both of the dc batteries following the LOOP must be calculated as leading to a reactor core damage event.

Licensees Comment 4.12: The second of these cutsets appears to be invalid. It involves the initiator, bus failure for Division I DC, and failure of the operator to align the standby charger for Division II. The logic appears to fail to give credit for the normal supply to Division II DC. This appears to be a logic error.

Response: The SPAR model cut set addressed by this comment is due to incomplete modeling of the dc power system. The current Quad Cities SPAR model does not include alternate dc power supplies to the emergency diesel generators. These alternate dc power supplies will be added to the next revision of the Quad Cities SPAR model, thus eliminating this cut set and similar related cut sets. Inclusion of this change in the SPAR model would not significantly change the dominant

SENSITIVE - NOT FOR PUBLIC DISCLOSURE 12 sequences and, therefore, would not affect the conclusion that the event is an accident sequence precursor.

Licensees Comment 4.13: The SPAR model should probably be revised to recognize dependency of more combinations of independent operator actions. Response to LOOP requires quite a few actions by operators. Of the top nine EGC PRA cutsets, eight of them involve various combinations of failure of two or more potentially dependent operator actions. Those cutsets represent a CCDP of 2.8 x 10-6. It appears that the reason that the EGC model yields a CCDP as large as the SPAR model, after consideration of the comments above, is because it includes many combinations of dependent operator actions not included in the SPAR model. Consider searching for, and then modeling, more such dependencies in the SPAR cutsets.

Response: The SPAR model with respect to dependency of multiple operator action is undergoing review and possible revision.