ML23066A086

Base SPAR Model Human Failure Event Application of IDHEAS-ECA

ML23066A086
Person / Time
Issue date:	03/08/2023
From:	Coyne K, Christopher Hunter, Jing Xing NRC/RES/DRA/PRB
To:
References
Download: ML23066A086 (1)

Text

Base Standardized Plant Analysis Risk (SPAR) Model Human Failure Event Application of Integrated Human Event Analysis System for Event and Condition Assessment (IDHEAS-ECA)

Christopher Hunter, Qin Pan, Y. James Chang, Jing Xing, and Kevin Coyne U.S. Nuclear Regulatory Commission Washington, D.C.

christopher.hunter@nrc.gov; qin.pan@nrc.gov; james.chang@nrc.gov; jing.xing@nrc.gov; kevin.coyne@nrc.gov

[leave space for DOI, which will be inserted by ANS]

ABSTRACT In 2019, the U.S. Nuclear Regulatory Commission (NRC) developed a new human reliability analysis (HRA) methodIntegrated Human Event Analysis System for Event and Condition Assessment (IDHEAS-ECA). The method is based on state-of-the-art cognitive research and can improve the technical basis, analysis detail, and transparency of key assumptions for estimating the human error probabilities (HEPs) of human failure events (HFEs). The NRC has begun applying IDHEAS-ECA in various risk-informed activities. In addition, the NRC is exploring the transition from the use of the SPAR-H HRA Method to IDHEAS-ECA in risk assessment of initiating events and/or degraded conditions, which are known as event and condition assessments (ECAs). However, HRA evaluations performed by the NRC staff for ECAs have historically been difficult and time consuming due to the limitations in accessing plant-specific data and documentation needed to fully implement HRA methods. As part of a pilot activity for increased use of IDHEAS-ECA, the NRC is building a knowledge base of application examples. An initial activity for building this knowledge base was to identify and evaluate several of the most risk significant HFEs that are commonly used in most standardized plant analysis risk (SPAR) models or that have been identified as risk significant during NRC-conducted ECAs. In addition, using IDHEAS-ECA to evaluate these HFEs in base SPAR models could improve the understanding of uncertainties associated with the use of industry-average (i.e., not plant-specific) HEPs currently in the SPAR models and specifying the contextual differences between accident sequences/cut sets. This paper describes the process of applying IDHEAS-ECA to an HFE with consideration of potential variability due to design differences and differing scenario contexts. In addition, this paper also discusses some general insights on the use of IDHEAS-ECA and illustrates the documentation generated during an IDHEAS-ECA analyses.

Key Words: event and condition assessment, human reliability analysis 1

INTRODUCTION In 2019, the U.S. Nuclear Regulatory Commission (NRC) developed a new human reliability analysis (HRA) methodIntegrated Human Event Analysis System for Event and Condition Assessment (IDHEAS-ECA). The method was tested, piloted, and now is documented in NUREG-2256 [1], Integrated Human Event Analysis System for Event and Condition Assessment (IDHEAS-ECA). The NRC has begun applying IDHEAS-ECA in various risk-informed activities. In addition, the NRC is exploring the transition from the use of the SPAR-H HRA Method [2] to the use of IDHEAS-ECA in risk assessment of initiating events and/or degraded conditions, which are also known as event and condition assessments (ECAs).

The existing human error probabilities (HEPs) of the human failure events (HFEs) in the NRCs standardized plant analysis risk (SPAR) models are industry average values based on the cut set level reviews performed by Idaho National Laboratory (INL). This approach is similar to the use of industry-averaged data for reliability and availability component parameters used in SPAR models. NRC risk analysts determine whether HFE(s) need to be reevaluated for specific ECA applications. However, these reevaluations can be difficult because there are no base HRA evaluations in the SPAR models and due to the limited access to plant-specific data and documentation needed to perform a detailed HRA evaluation.

In addition, the SPAR models often use a single HFE with a single HEP to cover multiple HFE contexts of different accident sequences. These modeling simplifications could result in under-or overestimating the risk of specific ECA scenarios.

As part of the transition to using IDHEAS-ECA, the NRC is building a knowledge base of application examples. An initial activity for building this knowledge base is to identify and evaluate several of the most risk significant common sets of HFEs that are commonly used in most SPAR models or that have been identified as risk significant during NRC-conducted ECAs. NRC risk analysts are working with IDHEAS-ECA developers as part of this effort to ensure the IDHEAS-ECA evaluations are properly performed and documented. In addition, this effort provides feedback to IDHEAS-ECA developers for method improvements. This work will also include the evaluation on how different reactor designs and scenario contexts within the SPAR models could affect the HFE evaluations and will explore how sensitive (or insensitive) the IDHEAS-ECA methodology is to different scenario details (e.g., timing) that have shown to result in variability in calculated HEPs using other HRA methods.

This paper provides the first completed example of a SPAR HFE evaluation using IDHEAS-ECA. The manner of the documentation of this evaluation is simplified when compared to the examples provided in NUREG-2256 [1]; however, the documentation contains all the required elements specified in the guidance.

2 APPLICATION EXAMPLE OF IDHEAS-ECA The HFE example selected for this paper is the failure of operators to initiate feed and bleed cooling.

This HFE is named HPI-XHE-XM-FAB in all pressurized-water reactor (PWR) SPAR models and is commonly a risk significant HFE for most plants. Note that the base SPAR models use a single industry-average HEP of 2x10-2 for this HFE in all PWR SPAR models. In addition, this HEP is applied in all scenarios, except for some external hazards (e.g., seismic) and cut sets where dependency has been identified. This SPAR model simplification will be explored as part of this evaluation. A loss of offsite power (LOOP) was selected as the base case scenario for this example due to its relative high event frequency and because the operator response is simpler. See Table I for additional information.

The IDHEAS-ECA method includes eight steps to define the HFE context, model critical tasks, identify associated performance influencing factors (PIFs), estimate the HEP, and assess uncertainties and other factors. The remainder of this section describes these steps in greater detail.

2.1 Steps 1 and 2 - Scenario Analysis and Analyze HFE Step 1 of using IDHEAS-ECA is to analyze the event to develop a scenario narrative and timeline, to determine the scenario context, and to identify the HFE(s). Step 2 defines the HFE(s) identified in Step 1 and identifies the critical tasks of the HFE(s). The guidance provided in NUREG-2256 to perform these steps is extensive. Given that HPI-XHE-XM-FAB is already defined within the SPAR standardized modeling conventions, the scenario and HFE analyses can be limited to:

developing the scenario description/event context, defining the HFE and critical tasks,

identifying the boundary conditions associated with the HFE (i.e., define the beginning and end points of the HFE (in lieu of a full, detailed timeline),

defining the success criteria for the HFE, identifying the key cues for operator action, and determining the procedural guidance available to operators.

Table I provides the streamlined documentation of the evaluation of these elements for HPI-XHE-XM-FAB. In addition, this table provides information regarding the use of the HFE within the base SPAR model, which allows for the evaluation of technological and scenario contextual differences.

Table I. Scenario Analysis for HPI-XHE-XM-FAB HFE Name HPI-XHE-XM-FAB HFE Definition Operators fail to initiate feed and bleed cooling prior to core damage. The entire HFE is considered as a single critical task.

SPAR Model Application HPI-XHE-XM-FAB is a basic event in the feed and bleed cooling fault tree, which is queried in the event trees for multiple transients. These transients include general transients; loss of main feedwater (MFW); loss of condenser heat sink; losses of alternating current (AC)/direct current (DC) buses; LOOPs; feedwater/steamline breaks; steam generator tube rupture (SGTR); and small loss-of-coolant accidents (LOCAs). The feed and bleed cooling fault tree is queried when there is a successful reactor trip, auxiliary feedwater (AFW) fails, and MFW cannot be restored.

Scenario Description/

Event Context The most risk significant scenarios that include the need for feed and bleed cooling are typically those where the initiating event results in the non-recoverable loss of MFW (e.g., loss of MFW, loss of condenser heat sink, certain losses of AC or DC busses, and LOOP). Of these initiating events, the least complex initiating event is where both MFW and the condensate pumps are unavailable without the potential for recovery since this removes potential recovery options for the operators. The most likely initiating event that would result in this scenario is a LOOP and, therefore, LOOP is selected as the base case for this evaluation for a Westinghouse plant (i.e., the most common PWR).

When a reactor trip occurs due to a LOOP, the main control room (MCR) operators will enter procedure E-0, Reactor Trip or Safety Injection (SI). Since there is no SI actuation or need to manually initiate an SI for this event, operators will transition to procedure ES-0.1, Reactor Trip Response, and will also begin monitoring the critical safety function status trees (CSFST). If narrow-range SG levels are too low and feedwater flow is insufficient, the scenario will be in a red path of the Heat Sink CSFST, which directs operators to enter procedure FR-H.1, Response to a Loss of Secondary Heat Sink. FR-H.1 directs operators to establish adequate feedwater flow, but operators will be unable to do so unless flow from either the turbine-driven or motor-driven AFW pumps is available. In this HFE context, AFW flow is unavailable due to component failure(s) or failure of a critical support system, such as a train of onsite emergency AC power. If all SG levels drop below a certain limit (e.g., wide-range SG level less than 25 percent), operators are directed to immediately initiate feed and bleed cooling. The execution portion of initiating feed and bleed cooling are relatively straight-forward MCR actions initiate SI and open the pressurizer power-operated relief valves (PORVs).

Boundary Conditions The start of this HFE is a LOOP resulting in a subsequent reactor trip (i.e., T = 0). The end of this HFE is either successful initiation of feed and bleed cooling that prevents core damage or the occurrence core damage.

Success Criteria Operators successfully initiate feed and bleed cooling within sufficient time to prevent core damage.

Key Cue(s)

Feedwater flow rates (AFW and MFW)

SG levels (Narrow and Wide Ranges)

Procedural Guidance E-0, Reactor Trip or SI ES-0.1, Reactor Trip Response FR-H.1, Response to a Loss of Secondary Heat Sink

2.2 Step 3 - Modeling Failure of Critical Tasks The next step in the IDHEAS-ECA process is to model the failure of the critical tasks. IDHEAS-ECA uses multiple critical tasks to model an HFE when it includes tasks whose context are significantly different from the other tasks of the HFE (e.g., tasks performed by different group of individuals or from a different location with different environmental effects). However, HPI-XHE-XM-FAB is modeled as a single critical task of IDHEAS-ECA because all cognitive and physical actions are performed by the same crew from the MCR. Critical tasks can include the following five cognitive failure modes (CFMs):

CFM1 - Failure of Detection CFM2 - Failure of Understanding CFM3 - Failure of Decisionmaking CFM4 - Failure Action Execution CFM5 - Failure of Interteam Coordination Table II provides the evaluation details for Step 3 of the IDHEAS-ECA evaluation for base case HPI-XHE-XM-FAB.

Table II. Modeling Failure of Critical Task(s) for HPI-XHE-XM-FAB (Base Case)

CFM Selection Detection - This task requires the operators to detect the alarms and annunciators associated with the LOOP and subsequent reactor trip along with the failure of the AFW system. In addition, operators will need to monitor whether SG levels are adequate to maintain secondary decay heat removal.

Understanding - This task requires the operators to understand secondary decay heat removal cannot be maintained and, therefore, must initiate feed and bleed cooling to prevent core damage.

Decisionmaking - Decisionmaking is not required for this task because with correct understanding of the event, the procedure requires operators to initiate feed and bleed cooling.

Operators are unlikely to be sidetracked by feedwater recovery activities due to the MFW and condensate unavailability caused by the LOOP. Therefore, this CFM is not applicable for this task.

Action Execution - This task requires the operators to manually actuate SI (if automatic actuation has not occurred) and open the pressurizer PORVs. Both actions are accomplished from the MCR.

Interteam Coordination - Interteam coordination is not required for this task because multiple teams would not be involved. Therefore, this CFM is not applicable for this task.

Therefore, the applicable CFMs for this example are:

CFM1 - Failure of Detection CFM2 - Failure of Understanding CFM4 - Failure of Action Execution 2.3 Step 4 - Assessing Performance Influencing Factor Attributes Applicable to the CFMs The PIFs represent the context of the HFE, which facilitate the quantification of the HEP. An analyst assesses the PIF attributes based on the scenario context, the definition of the HFE, and the characterization of the critical tasks. IDHEAS-ECA requires that the base PIFs for scenario familiarity, information

availability and reliability, and task complexity always be evaluated. The analyst must also determine if additional PIFs are applicable and what attributes are appropriate. Table III provides the evaluation of the PIFs for the applicable CFMs for the base case HPI-XHE-XM-FAB.

Table III. PIF Evaluation of the Applicable CFMs for HPI-XHE-XM-FAB (Base Case)

Evaluation of PIFs for the Applicable CFMs CFM1 -Failure of Detection (Base Probability = 1x10-4)

Scenario Familiarity - No impact because operators are routinely trained on loss of secondary decay heat removal events.

Task Complexity - C1: Detection overload with multiple competing signals (1: Few < 7);

There are at least two competing signals (1.) the annunciators/parameters associated with LOOP and reactor trip and (2.) the annunciators/parameters associated with the AFW system failure. Note that multiple alarms associated with the same underlying cause are considered to be one signal. Selection of this PIF attribute increases the probability of CFM1 from the base probability of 1x10-4 (i.e., no PIF attributes are selected) to 3x10-3.

The other PIFs were determined to have a negligible impact on the base case HFE.

CFM2 - Failure of Understanding (Base Probability = 1x10-3)

Scenario Familiarity - No impact because operators are trained on loss of secondary decay heat removal events.

Information Completeness and Reliability - No impact because MCR feedwater flow and SG level indications are sufficient to diagnose loss of secondary decay heat removal events.

Task Complexity - No impact because the requirement of feed and bleed cooling in the event of a loss of all feedwater is basic plant operation concept that is specifically covered by plant procedures.

The other PIFs were determined to have a negligible impact on the base case HFE.

CFM4 - Failure of Action Execution (Base Probability = 1x10-4)

Scenario Familiarity - No impact because the execution steps are routinely trained.

Task Complexity - No impact because the execution steps are straight-forward (i.e., MCR switch manipulations) and proceduralized.

Procedures and Guidance - No impact because the number of execution steps are relatively short and straight-forward.

The other PIFs were determined to have a negligible impact on the base case HFE.

2.4 Step 5 - Estimate Pc IDHEAS-ECA quantifies the HEP of a HFE in two portions: Pc accounts for the portion of the HEP attributed to cognitive failures (i.e., CFMs) assuming that there is adequate time available to perform the action. Pt accounts for the portion of the HEP attributed to the potential that there is inadequate time to perform the action. The quantification of Pc is performed using the assessment of the PIF attributes performed in Step 4 via Equation 1.

= 1 [(1 1) x (1 2) x (1 3) x (1 4) x (1 5)]

(1)

Using the results of the PIF evaluation results in the following Pc for the base case HPI-XHE-XM-FAB:

1 [(1 1) x (1 2) x (1 4)]

= 1 [(1 3 x 103) x (1 1 x 103) x (1 1 x 104)] = 4 x 103

2.5 Step 6 - Estimate Pt The timing information associated with a HFE being evaluated is typically collected as part of the Steps 1 and 2. However, because the timing information is only a direct input to the calculation of Pt, the documentation of this information is provided in Step 6. The specific timing information needed to evaluate Pt using IDHEAS-ECA are the time available (Tavail) and the time required (Treqd). The timing evaluation for the base case HPI-XHE-XM-FAB is provided in Table IV.

Table IV. Timing Evaluation for the HPI-XHE-XM-FAB (Base Case)

Timing Evaluation The Tavail and Treqd were estimated from the time when the cue (low, wide-range SG level) becomes available to the time that feed and bleed has to be established to avoid core damage.

Extensive timing information is not currently available to NRC analysts for this operator action. However, the following timing estimates from licensee probabilistic risk assessments (PRAs) were available through INL:

Plant Treqd Tavail A

8 minutes 20 minutes B

7-8 minutes 25 minutes C

3 minutes 14.4 minutes D

2 minutes 34 minutes The Tavail values are likely conservative based on the limited applicable MELCOR calculations performed (e.g., NUREG-1953 [3], Confirmatory Thermal-Hydraulic Analysis to Support Specific Success Criteria in the Standardized Plant Analysis Risk Models-Surry and Peach Bottom). Given these considerations, the base case HFE assumed that operators would have a minimum of 20 minutes (Tavail) to initiate SI and open the pressurizer PORVs once wide-range level on all SG levels reached the initiation criteria contained in FR-H.1. The Treqd values show relatively high variability even though the execution procedures should be near identical.

Discussions with NRC Technical Training Center (TTC) staff indicate that less than 5 minutes is required to complete the execution, which also include some verification steps. Therefore, Treqd of 5 minutes was selected for the base case HFE.

The current IDHEAS-ECA guidance recommends using a lognormal distribution for time estimates; however, the current IDHEAS-ECA software tool does not have this capability yet.

For the evaluation of this base case HFE, Pt was calculated using a lognormal distribution for Treqd. Tavail is considered a conservative limit and, therefore, no distribution has been assigned.

The selection of the Treqd of 5 minutes was assumed to be the median (i.e., 50 percentile) of the lognormal distribution. An EF of 3 is judged to be reasonably bounding for the base case HFE that results in a lognormal distribution with 5 and 95 percentiles as 1.7 and 15 minutes, respectively. This selection results in a Pt of 2x10-2, which is likely conservative for this base case due to the conservatisms in the EF and Tavail. A narrower Treqd distribution is likely more appropriate for the base case HFE based engineering judgment and a preliminary analysis of timing data MCR operators response to emergency events in nuclear power plant simulators, including NUREG/IA-0216 [4], International HRA Empirical Study, and NUREG-2156 [5],

The U.S. HRA Empirical Study - Assessment of HRA Method Predictions against Operating Crew Performance on a U.S. Nuclear Power Plant Simulator. This preliminary analysis shows that an EF of 2 is reasonable best estimate for the base case HFE, which results in a Pt of 5x10-

4. Note that at the time of publishing this paper, IDHEAS-ECA has not finalized the guidance on specifying the uncertainty bounds for time estimates.

2.6 Step 7 - Calculate Overall HEP The overall HEP is calculated using Equation 2.

= 1 (1 )(1 )

(2)

Therefore, overall HEP for the base case HPI-XHE-XM-FAB is calculated as:

= 1 (1 4 x 103)(1 5 x 104) = 4 x 103 2.7 Step 8 - Analyze Uncertainties, Perform Sensitivity and Dependency Analysis, and Document the Results The final step of the guidance provided in NUREG-2256 includes the analysis uncertainties and performing any sensitivity analyses to evaluate these uncertainties. In addition, a dependency analysis should be performed. Finally, the entire evaluation should be documented. This example is only a single HFE example and, therefore, no dependency evaluation is possible and it outside the scope of this effort.

However, guidance for addressing dependencies can be found in NRC Research Information Letter (RIL) 2021-14, Integrated Human Event Analysis System Dependency Analysis Guidance (IDHEAS-DEP) [6].

The documentation of this analysis is provided in the proceeding sections of this paper.

The following key uncertainties were identified:

The information available to select Tavail is limited. It is believed that the 20 minutes selected for the base case is conservative. However, the Pt for the base case is not a significant contributor to the overall HEP for the base case HFE. This uncertainty is addressed in for alternative scenarios in Section 2.9.

The selection of the appropriate EF for the timing estimates can have a significant effect on the Pt and the overall HEP. The evaluation of the two different EFs associated with Treqd in the base case scenario is provided in Table IV. The guidance for the selection of the EFs associated with timing estimates is still under development.

The Decisionmaking CFM was determined to not be applicable for the base HFE. There is some belief that operators could still hesitate to initiate feed and bleed cooling while attempting to restore AFW in the base case scenario. If analysts believe this is the case, Pc could increase to 2x10-2 as shown in Section 2.9.

Selecting the status of the PIF attribute to C1, Detection Overload with Multiple Competing Signals for the PIF of Task Complexity in the Detection CFM is a potential uncertainty. The guidance on how to count the number of competing signals needs to be more specific to reduce analyst-to-analyst variability. The revised guidance is still under development.

2.8 Technology Differences The HFE HPI-XHE-XM-FAB is contained in all PWR SPAR models, which are comprised of Westinghouse, Combustion Engineering (CE), and Babcock and Wilcox (B&W) designs. The base case example was for a Westinghouse PWR. A description of how MCR operators would respond to the base case example scenario for the other two PWR reactor types, including procedure pathway, is provided in Table V.

Table V. Technology Differences for the HPI-XHE-XM-FAB Procedural Direction for Other PWR Technologies CE Plants - When a reactor trip (regardless of the specific initiating event) occurs, MCR operators will enter E-1, Standard Post Trip Actions. As part of this procedure, operators will verify whether there is sufficient SG level and feedwater flow to at least one SG. Operators are also directed to use the diagnostic flowchart in Attachment 1 of the procedure. This flow chart queries whether at least one SG has adequate feed flow. If the answer is no, operators are directed to enter E-6, Loss of All Feedwater Recovery. E-6 directs operators to continue to establish adequate feedwater flow. If all SG levels drop below a certain limit (e.g., wide-range SG level less than 25 percent), operators are directed to immediately initiate once-through cooling (OTC).

The execution portion of initiating OTC is relatively straight-forwardinitiate SI if not already done and open the pressurizer PORVs.

B&W Plants - When a reactor trip (regardless of the specific initiating event) occurs, MCR operators will enter EOP-1, Reactor Trip. If all feedwater (MFW and AFW) is lost, operators are directed to enter EOP-3 Lack of Heat Transfer. If the subcooling margin decreases below 20°F, EOP-3 directs operators to initiate high-pressure injection (HPI) cooling by entering Repetitive Task 7, HPI Cooling. The execution portion of initiating HPI cooling is relatively straight-forwardinitiate SI if not already done and open the pressurizer PORV and associated block valve.

Based on the similarities of cues and procedures for the three different PWR plant types, there is not expected to be significant differences in the evaluation of Pc for technology differences. However, there could be significant differences in Pt based on timing variabilities associated with the different technologies.

2.9 Initiating Event Variability Feed and bleed cooling is queried in most internal events event trees with the exception of medium and large LOCAs, interfacing-system LOCAs, station blackout (SBO), and anticipated transient without scram (ATWS) scenarios. Many of these initiating events can be considered to be similar transients that will not significantly affect the operator response (e.g., procedure pathway), but rather account for different equipment unavailabilities. There could be some timing differences from the most limiting case of loss of feedwater at T = 0 with no SI; however, any differences would likely result in additional time available for the operators. Therefore, given Pt is an insignificant contributor to the base case scenario, the evaluation of HPI-XHE-XM-FAB is not expected to deviate significantly from the base case for these initiating events, which include:

General Transient Loss of MFW Loss of Condenser Heat Sink Loss of AC/DC Bus Loss of Service Water Loss of Component Cooling Water Additional initiating events that query feed and bleed cooling include:

Small LOCA SGTR MSLB Feedwater Line Break

Based on discussions with NRC TTC staff, these initiating events are not expected to change the procedure pathway significantly since the loss of heat sink takes priority in all of these scenarios. There could be timing differences as a result of some scenarios; however, these differences would result in a longer time available to operators. Therefore, unless Pt is significant contributor for these other scenarios, reevaluation is likely not needed.

The most significant potential for variability for these other initiating events is whether the MFW or condensate systems are available to restore SG inventory. For initiators where MFW is available, the potential for recovery should be accounted for another HFE. In addition, the potential dependency between that HFE and HPI-XHE-XM-FAB could be significant and should be evaluated in detail.

For cases where MFW is unavailable, but condensate injection is possible, reevaluation of HPI-XHE-XM-FAB is likely to be needed because of the potential that operators may delay initiating feed and bleed cooling due to belief that attempts to establish condensate injection to the SGs will occur in time to prevent SG dry-out. In these cases, it is recommended that Decisionmaking CFM be evaluated. In addition, the selection of PIF attributes C24, Multiple Goals Difficult to Prioritize and MF8, Emotional Stress (e.g., Anxiety, Frustration) is likely warranted. These changes would result in base case Pc increasing by an order of magnitude to 4x10-2. In addition, larger uncertainties (as shown in NUREG-2127, The International HRA Empirical Study) associated with potential execution delays due to attempts to recover feedwater/condensate show a wider distribution for Treqd is more appropriate. Therefore, an error factor of 3 was selected for Treqd, which results in a Pt of 2x10-2 that is a significant contributor to the overall HEP.

However, this Pt assumes a Tavail value of 20 minutes, which based on a limited amount of timing information available from licensee PRAs is likely to be conservative. Based on previous NRC research studies (e.g., NUREG-1953 [3]), it is likely that a minimum of 10 additional minutes would be available to operators to initiate feed and bleed cooling prior to core damage. To account for this variability, the Tavail was assigned a normal distribution with a mean value of 30 minutes and standard deviation of 3, which results in a lower bound near original Tavail of 20 minutes. These changes result in a revised Pt of 4x10-3.

Although the base case HEP could be adjusted in a similar manner, this was deemed to be unnecessary since Pc is the dominant contributor to the final base case HEP and further refinement of Pt would not have significantly changed the HEP result. Therefore, the overall HEP is calculated to be 4x10-2 for this more complex scenario, which is an order of magnitude greater than the base case HEP. Further, the difference in the HEPs between the base and complex scenarios is driven by the change to Pc.

2.10 Additional Scenario Variability Similar to the discussion of the initiating event variability, the significant potential for variability is restoring MFW or condensate systems to provide SG inventory makeup. In some cases, the cut sets may have basic events that result in failures either directly or indirectly to either or both of these systems.

However, analysts should review the dominant cut sets of analysis to see if any basic events may result in uncounted for complexities associated with cues, decisionmaking, and execution. Examples of scenarios variabilities that could justify changes to the base case IDHEAS-ECA evaluation include:

Cut sets with basic events that fail SG level instrumentation should be accounted for specifically by modifying the applicable Failure of Detection PIF. Simulator data from NUREG/IA-0216 [4] and NUREG-2156 [5] have shown that failed instrumentation can significantly affect crew response variability.

Cut sets with basic events that could affect decision-making would require that the associated CFM should be evaluated.

Cut sets that have operator actions that occur before the requirement for initiating feed and bleed cooling can change the boundary conditions for HPI-XHE-XM-FAB and, therefore, the HFE should be reevaluated to account for these differences.

Analysts must quantify the PRA at a low enough truncation to ensure that cut sets that contain potential scenario variabilities are identified. In most cases, any potential change in the HEP to account for these variabilities will not result in the cut sets becoming a dominant risk contributor in the base model. However, these scenarios could become dominant in ECAs. In addition to the uncertainties accounted for EFs selected for the time estimates, it is important to note that additional uncertainties exist that are not explicitly considered in IDHEAS-ECA (e.g., crew-to-crew variability leading to differences in event progression and variations in mapping actual crew performance experience to the IDHEAS framework). These uncertainties can be accounted for by selecting an overall uncertainty distribution that is appropriate for the HFE.

3 CONCLUSIONS The example presented in this paper shows that using IDHEAS-ECA could provide a more defensible basis for the HEPs used in the SPAR models. These types of evaluations can provide a baseline from which analysts can more easily modify for ECAs if necessary and, therefore, save time and resources. In addition, these evaluations can be modified to capture reactor technology and contextual variabilities associated with HFEs that can have a significant effect on the calculated HEPs. As the example in this paper has shown, the contextual difference can result in significant differences in the calculated HEP. The process of identifying these types of differences can be iterative in nature. Analysts need to ensure that variabilities that are not risk significant in the base PRA but could be risk significant in ECAs are captured and evaluated appropriately.

The level of effort associated with completing this example was significant. Some of the effort is expanded due to evaluating the example HFE across different reactor technologies in the SPAR models for the U.S. PWR fleet. In addition, the authors do not have access to some information (e.g., specific thermal-hydraulic calculations for the scenario). Efficiencies are likely to be realized in future IDHEAS-ECA evaluations of SPAR model HFEs. It is expected that either the cognitive (Pc) or timing (Pt) are the obvious dominant contributors for some HFEs, which could allow an abridged approach to be used for evaluation for the insignificant contributor. For example, HFEs that have an abundance of time available after the cue to perform an action will result in a negligible Pt and, therefore, a detailed timing analysis is not required.

The NRC plans to perform additional IDHEAS-ECA evaluations of risk significant SPAR model HFEs.

Once this pilot project is completed, the NRC will determine whether the activity will be expanded to additional HFEs, which could allow these evaluations and their calculated HEPs to replace the industry average values currently used in the SPAR models. In addition, benchmarking of these evaluations may provide valuable insights in IDHEAS-ECA in comparison to other methods and instill confidence in the method for new users.

4 ACKNOWLEDGMENTS The authors gratefully acknowledge. James Knudsen (INL) and Gary Calloway (NRC TTC) for providing valuable information to support the evaluation provided in this paper.

5 REFERENCES

1. J. Xing, Y.J. Chang, and J. DeJesus Segarra, Integrated Human Event Analysis System for Event and Condition Assessment (IDHEAS-ECA), U.S. Nuclear Regulatory Commission, NUREG-2256, 2022.

2. D.I. Gertman, H.S. Blackman, et al., The SPAR-H Human Reliability Analysis Method, U.S.

Nuclear Regulatory Commission, NUREG/CR-6883, INL/EXT-05-00509, 2005.

3. H. Esmaili, D. Helton, et al., Confirmatory Thermal-Hydraulic Analysis to Support Specific Success Criteria in the Standardized Plant Analysis Risk Models - Surry and Peach Bottom, U.S.

Nuclear Regulatory Commission, NUREG-1953, 2011.

4. V.N. Dang, J. Forester, et al., International HRA Empirical Study - Phase 3 Report: Results from Comparing HRA Methods Predictions to HAMMLAB Simulator Data on LOFW Scenarios, NUREG/IA-0216, Volume 3, 2014.

5. J. Forester, H. Liao, et al., The U.S. HRA Empirical Study - Assessment of HRA Method Predictions against Operating Crew Performance on a U.S. Nuclear Power Plant Simulator, U.S.

Nuclear Regulatory Commission, NUREG-2156, 2016.

6. M. Kichline, J. Xing, et al., Integrated Human Event Analysis System Dependency Analysis Guidance (IDHEAS-DEP), U.S. Nuclear Regulatory Commission, RIL 2021-14, 2021.