ML24033A060
| ML24033A060 | |
| Person / Time | |
|---|---|
| Site: | Grand Gulf  |
| Issue date: | 02/01/2024 |
| From: | Christopher Hunter NRC/RES/DRA/PRB |
| To: | |
| References | |
| LER 416-2022-003 | |
| Download: ML24033A060 (1) | |
Text
1 Final ASP Analysis - Reject Accident Sequence Precursor Program - Office of Nuclear Regulatory Research Grand Gulf Nuclear Station Manual Reactor Scram due to Trip of the A Reactor Feedwater Pump Event Date: 12/19/2022 LER:
416-2022-003 CCDP =
5x10-6 IR: 05000416/2003001 Plant Type:
General Electric Type 6 Boiling-Water Reactor (BWR) with Mark III Containment Plant Operating Mode (Reactor Power Level):
Mode 1 (100% Reactor Power)
Analyst:
Reviewer:
Completion Date:
Christopher Hunter Kelly Dickerson 2/1/2024 1
EVENT DETAILS 1.1 Event Description On December 19, 2022, condensate booster pump A tripped resulting in main control room (MCR) operators entering the feedwater system malfunction off-normal event procedure and reducing core flow to 70 million pound-mass per hour. While reducing core flow, operators observed rapidly lowering suction pressure for reactor feedwater pumps A and B. Reactor feedwater pump A subsequently tripped on low suction pressure. A recirculation flow control valve runback occurred as designed. However, reactor water level continued to lower due to the reduction in feedwater flow. MCR operators manually scrammed the plant when reactor water level was at approximately 17 inches of water and trending down.
High-pressure core spray (HPCS) was manually started to restore reactor water level.
Approximately 25 minutes after all feedwater was lost, operators successfully restarted reactor feedwater pump A.1 The reactor core isolation cooling (RCIC) system was unavailable during the event due to maintenance. Additional information is provided in licensee event report (LER) 416-2022-003, Manual Reactor Scram due to Trip of the A Reactor Feedwater Pump, (ML23047A547) and inspection report (IR) 05000416/2023001, Grand Gulf Nuclear Station -
Notice of Violation; Integrated Inspection Report 05000416/2023001 and NRC Investigation Report 4-2022-004, (ML23110A800).
1.2 Cause The direct cause of the loss of reactor feedwater and subsequent manual reactor scram was the heater drain tank level control valves being unable to respond quickly enough to mitigate the heat drain tank level oscillations during the transient caused by condensate booster pump trip and subsequent rapidly lower water level.
1 The recovery of reactor feedwater during this event was not needed immediately because HPCS successfully provided reactor inventory makeup. In the event of a postulated HPCS failure, operators could have restored reactor feedwater more quickly.
LER 416-2022-003 2
2 MODELING 2.1 SDP Results/Basis for ASP Analysis The Accident Sequence Precursor (ASP) Program performs independent analyses for initiating events. ASP analyses of initiating events account for all failures/degraded conditions and unavailabilities (e.g., equipment out for maintenance) that occurred during the event, regardless of licensee performance.2 No windowed events were identified.
NRC inspectors identified a Green (i.e., very low safety significance) finding, documented in IR 05000416/2023001, associated with the licensees failure to perform appropriate design verifications of an engineering change associated with the feedwater heater level control valves.
As a result, the system response of a condensate booster pump trip was not adequately analyzed which contributed to a loss of feedwater event and plant scram when a condensate booster pump tripped on December 19, 2022. The LER is closed.
2.2 Analysis Type An initiating event analysis was performed using a test and limited use (TLU) of the version 8.80 standardized plant analysis risk (SPAR) model for Grand Gulf Nuclear Station created in August 2023. The TLU model modified the base SPAR model to include credit for recovery of reactor feedwater. This change was made by adding a new top event fault tree (MFW-R) that is queried in the event of the failure/unavailability of both RCIC and HPCS. The fault tree consists of a new human failure event (HFE) MFW-XHE-XL-RECOV (operator fails to restore feedwater injection given feedwater trip) along with the hardware structures, systems, and components (SSCs) that would render reactor feedwater unavailable. The modified loss of main feedwater event tree is provided in Figure A-1 of Appendix A.
2.3 SPAR Model Modifications No modifications were made to the TLU version of the base SPAR model to support this analysis.
2.4 Analysis Assumptions The following modeling assumptions were determined to be significant to the modeling of this initiating event assessment:
The probability of IE-LOMFW (loss of main feedwater) was set to 1.0 due to loss of reactor feedwater initiating event that resulted in the manual reactor scram. All other initiating event probabilities were set to zero.
Basic event CDS-MDP-FR-BPMPA (condensate booster pump A fails to run) was set to TRUE due to a motor failure resulting in the pump trip.
Basic event RCI-TDP-TM-TRAIN (RCIC train is unavailable because of maintenance) was set to TRUE due to RCIC being unable to fulfil its safety function due to maintenance.
2 ASP analyses also account for any degraded condition(s) that were identified after the initiating event occurred if the failure/degradation exposure time(s) overlapped the initiating event date.
LER 416-2022-003 3
Basic event HCS-TDP-TM-HPCS (HPCS train is unavailable because of maintenance) was set to FALSE because technical specifications do not allow concurrent maintenance unavailabilities of RCIC and HPCS. In addition, key HPCS support system test/maintenance basic events SSW-MDP-TM-PUMPC (SSW pump C is unavailable because of maintenance) and HCS-ACX-TM-B001A (HPCS room cooling unit T51-B001A unavailable) were set to FALSE.
The human error probability (HEP) for the new HFE MFW-XHE-XL-RECOV was set to 0.2 based on an evaluation using IDHEAS-ECA. Details regarding this evaluation are provided in the following table:
Table 1. IDHEAS-ECA Evaluation of MFW-XHE-XL-RECOV HFE Definition Operators fail to recover reactor feedwater given the unavailability/failure of all high-pressure injection and reactor depressurization prior to core damage. This entire HFE is considered as a single critical task within the IDHEAS-ECA framework.
Scenario Description/
Event Context A loss of reactor feedwater transient and subsequent manual reactor scram occurred at Grand Gulf Nuclear Station on December 19, 2022. The cause of the loss of reactor feedwater was due to the trip of condensate booster pump A. In addition, the feed flow transient response was not sufficient to prevent lowering reactor water levels. During the event, MCR operators manually initiated HPCS to restore reactor water level. The RCIC system was unavailable due to maintenance and is considered nonrecoverable.
Approximately 25 minutes after the reactor scram, reactor feedwater pump A was restarted.
The dominant scenario from the Grand Gulf SPAR model is a loss of reactor feedwater transient and the unavailability of RCIC due to maintenance (nonrecoverable), and the postulated failures of HPCS and manual emergency depressurization of the reactor.
The existing SPAR model does not credit potential recovery of reactor feedwater and, therefore, the model was revised to allow credit for recovery.
When a loss of reactor feedwater resulting in a reactor scram occurs, MCR operators will enter the Reactor Pressure Vessel (RPV) Control emergency operating procedure (EOP) to control reactor water level and pressure. Operators will continue monitoring reactor water level and attempt to restore and maintain reactor water level in the normal post-trip level band using the preferred high-pressure injection systems. These preferred systems may include feedwater, RCIC, HPCS, and the control rod drive (CRD) pumps. In the base case scenario, feedwater is initially failed and RCIC is unavailable due to maintenance. The Grand Gulf SPAR model does not credit the CRD pumps as sufficient to be the sole source of high-pressure injection. If a postulated failure of HPCS occurred, operators would attempt to restore reactor feedwater, which was successful during the event. If operators are unsuccessful, and reactor water level cannot be restored or maintained above the top active fuel (TAF), operators are directed to initiate an emergency depressurization of the reactor. The failure to emergency depressurize the reactor is assumed to result in core damage. Note that this assumes that operators have bypassed the automatic depressurization system (ADS) function to automatically open the ADS valve when reactor water level reaches level 1.
Boundary Conditions The start of this HFE is when the loss of reactor feedwater initiating event results in a subsequent reactor scram (i.e., t = 0). This scenario assumes that RCIC is unavailable due to maintenance (nonrecoverable) and the postulated failure of HPCS. The end of this HFE is successful recovery of reactor feedwater prior to core damage.
Success Criteria Operators successfully recover reactor feedwater prior to reactor water level reaching the emergency depressurization limit.
LER 416-2022-003 4
Key Cue(s)
- Reactor water level and associated annunciators
- Annunciators associated with failures of HPCS Procedural Guidance
- RPV Control EOP CFM Selection Detection - This task requires the operators to detect the alarms and annunciators associated with reactor water level and the failure/unavailability of high-pressure injection (RCIC and HPCS).
Understanding - This task requires the operators to understand that with RCIC and HPCS unavailable, the recovery of reactor feedwater is the only way to prevent the need to initiate an emergency reactor depressurization.
Decisionmaking - Decisionmaking is not required for this task because procedures direct operators to restart a reactor feedwater pump, if possible.
Action Execution - This task requires the operators to manually restart a reactor feedwater pump. This action is accomplished by valve manipulations, system alignment checks, setting the startup feedwater level controller, and restarting the reactor feedwater pump. All of these actions are performed from the MCR.
Interteam Coordination - Interteam coordination is not required for this task because multiple teams would not be involved. Therefore, this CFM is not applicable for this task.
Evaluation of PIFs for Applicable CFMs CFM1 -Failure of Detection (Base Probability = 1x10-4)
- Scenario Familiarity - No impact because operators are routinely trained on losses of reactor feedwater and high-pressure injection.
- Task Complexity - C1: Detection overload with multiple competing signals (1: Few
< 7); There are at least three competing signals, including the annunciators/parameters associated with the (1.) loss of reactor feedwater transient, (2.) subsequent reactor trip, and (3.) failure of HPCS. Selection of this PIF attribute increases the probability of CFM1 from the base probability of 1x10-4 (i.e., no PIF attributes are selected) to 3x10-3.
- The other PIFs were determined to have a negligible impact on the base case HFE.
CFM2 - Failure of Understanding (Base Probability = 1x10-3)
- Scenario Familiarity - No impact because operators are routinely trained on losses of reactor feedwater and high-pressure injection.
- Information Completeness and Reliability - No impact because reactor water level and indications of the failure of high-pressure injection are sufficient to diagnose the need to recover reactor feedwater.
- Task Complexity - No impact because the operators are trained to attempt to restart feedwater (if available) if RCIC and HPCS are unavailable.
- The other PIFs were determined to have a negligible impact on the base case HFE.
CFM4 - Failure of Action Execution (Base Probability = 1x10-4)
- Scenario Familiarity - No impact because the execution steps are routinely trained.
- Task Complexity - No impact because the execution steps are straightforward (i.e., MCR switch manipulations) and proceduralized.
- The other PIFs were determined to have a negligible impact on the base case HFE.
Using these assumptions, Pc is calculated as 4.1x10-3 by summing the probabilities of CFM1 (3x10-3), CFM2 (1x10-3), and CFM4 (1x10-4).
Timing Evaluation The Tavail and Treqd were estimated from the start of the event (i.e., t = 0) until damage is assumed to occur. The licensee MAAP calculation for a main steam isolation resulting in a loss of feedwater with no sources of high-pressure injection (i.e., RCIC or HPCS)
LER 416-2022-003 5
available results in reactor water level reaching TAF in approximately 12 minutes after the initiating event occurred. Note that this time estimate is considered worst case and additional time may be available if systems such as CRD are providing limited inventory makeup to the reactor. It is expected to take approximately 5 minutes for operators to get through their immediate actions from the reactor trip and procedure prior to attempting to recover reactor feedwater. Given these considerations, the Tavail is estimated to be 7 minutes for this HFE. The Treqd estimate for operators to complete the procedure steps (e.g., system checks, valve manipulations, etc.) to recover a reactor feedwater pump during this event is 5 minutes. Note that at Grand Gulf the reactor feedwater pumps are steam driven, which requires additional steps to be completed (compared to electrically driven pumps) to restore them to service. Also note that these time estimates may be conservative if operators can quickly perform system checks, if there were no additional failures that required troubleshooting or verification; and operators work procedures in parallel and, therefore, reducing the time to get through the procedure steps.
The current IDHEAS-ECA guidance recommends using a lognormal distribution for the time estimates; however, the current IDHEAS-ECA software tool does not have this capability yet. The selection of the Treqd of 5 minutes was assumed to be the median (i.e., 50th percentile) of the lognormal distribution. Tavail is treated as a single value with no distribution assigned for the base case. No guidance exists for treating the uncertainty associated with Tavail estimates, and it is noted as a key uncertainty for this evaluation. The Pt was calculated using an EF of 2 for the lognormal distribution of Treqd, which is considered to be appropriate for actions performed from the MCR based on a preliminary analysis of timing data MCR operators response to emergency events in nuclear power plant simulators, including NUREG/IA-0216, International HRA Empirical Study - Phase 1 Report: Description of Overall Approach and Pilot Phase Results from Comparing HRA Methods to Simulator Performance Data (ML093380283),
NUREG-2156, The U.S. HRA Empirical Study: Assessment of HRA Method Predictions against Operating Crew Performance on a U.S. Nuclear Power Plant Simulator (ML16179A124), EPRI NP-6937-L, Operator Reliability Experiments Using Power Plant Simulators, and simulator data from other sources. This selection results in a Pt of 0.2.
At the time of completing this analysis, the guidance on specifying the uncertainty bounds for time estimates in IDHEAS-ECA has not been finalized.
Recovery Recovery credit is not provided for this task.
Calculated HEP HEP = 1 (1 Pc) (1 Pt) = 1 (1 - 4.1x10-3) (1 - 0.2) = 0.2 Key Uncertainties The following key uncertainties were identified:
- The Tavail estimate may be conservative for certain scenarios. Specifically, this evaluation assumes the worst case time to when reactor water level will reach TAF.
Maximized CRD flow is not credited as an alternative source of high-pressure injection that is able to maintain reactor water level above TAF by itself and, therefore, is not credited in Grand Gulf SPAR model. However, CRD would delay how quickly reactor water level reached TAF. However, there are no thermal-hydraulic calculations available that show how much longer Tavail would be for these scenarios.
- The selection of the appropriate EF for the timing estimates can have a significant effect on the Pt and the overall HEP. In general, the empirical studies referenced in the timing evaluations involved specific scenarios involving procedurally-driven MCR operator actions; however, these studies did not fully investigate the full range of scenario variabilities associated with the analyzed HFE and, therefore, the selection of the EF of 2 for Treqd is an uncertainty associated with this evaluation. The guidance for the selection of the EFs associated with timing estimates is still under development.
LER 416-2022-003 6
The HEP for the existing HFE ADS-XHE-XM-MDEPR (operator fails to initiate reactor depressurization) was set to 2x10-3 based on an evaluation using IDHEAS-ECA. This HFE was revaluated due to potential effects of the recovery of reactor feedwater operator action that is in the same dominant cutsets as ADS-XHE-XM-MDEPR. Details regarding this evaluation are provided in the following table:
Table 2. IDHEAS-ECA Evaluation of ADS-XHE-XM-MDEPR HFE Definition Operators fail to initiate reactor depressurization following a loss of all high-pressure injection prior to core damage. This entire HFE is considered as a single critical task within the IDHEAS-ECA framework.
Scenario Description/
Event Context When a loss of feedwater resulting in a reactor trip occurs, MCR operators will enter the RPV Control EOP to control reactor water level and pressure. Operators will continue monitoring reactor water level and attempt to restore and maintain reactor water level in the normal post-trip level band using the preferred high-pressure injection systems.
These preferred systems may include feedwater, RCIC (which is unavailable due to maintenance) and HPCS (which is failed in this scenario), and the CRD pumps. The Grand Gulf SPAR model does not credit CRD pumps as sufficient to be the sole source of high-pressure injection. With RCIC and HPCS unavailable, and CRD insufficient to restore reactor water level, operators will attempt to recover a reactor feedwater pump, which is possible because only a single condensate booster pump failed during the event.
If the preferred high-pressure injection systems are unavailable or unable to maintain water level within the normal or expanded post-trip level band, operators will lower reactor pressure using an available pressure control system (e.g., turbine bypass valves, safety relieve valves, HPCS, RCIC, etc.) while maintaining a cooldown rate of less than 100°F per hour. It is assumed the turbine bypass valves are unavailable due to the main steam isolation valves being closed for the base case scenario. If operators are unable to maintain the minimum reactor water level (i.e., top of active fuel), they are directed by the RPV Control EOP to emergency depressurize the reactor by manually opening all available ADS valves. Note that operators are required to have at least one train of low-pressure injection running prior to performing the emergency depressurization. It is expected that the low-pressure coolant injection (LPCI) and low-pressure core spray (LPCS) pumps will be running due to reactor water level reaching the Level 1 setpoint, which results in an automatic start of these systems. If LPCI and LPCS are unavailable, operators will manually start another preferred injection system (e.g., RHR). If a preferred system is unavailable, operators will use an alternate source of injection (e.g., firewater, standby liquid control, etc.). As a SPAR model simplification, ADS-XHE-XM-MDEPR and the associated depressurization fault tree logic assumes that there is insufficient time available to perform the initial pressure reduction using normal systems prior to the requirement for emergency depressurization using all available ADS valves. This modeling assumption is potentially conservative for some scenarios (e.g., scenarios where CRD flow is maximized may offer sufficient time for normal pressure reduction methods prior to reactor water level reaching the set point requiring emergency reactor depressurization for some plants).
Boundary Conditions The start of this HFE is when reactor water level reaches top of active fuel (i.e., when the RPV Control EOP directs operators to initiate an emergency depressurization of the reactor). This scenario assumes that RCIC and HPCS are unavailable from the beginning of the event. In addition, CRD is assumed to be unavailable, but note that early CRD is not queried in most BWR SPAR models. In addition, the scenario assumes that operators have not recovered a reactor feedwater pump yet.
Either LPCI and/or LPCS are assumed to have automatically started when reactor water level reaches the Level 1 setpoint. These systems are assumed to remain running
LER 416-2022-003 7
throughout this scenario (i.e., it is not expected that operators would need to manually start a low -pressure injection system prior to initiating emergency depressurization).
The end of this HFE is successful reactor depressurization in time to allow for low-pressure injection to prevent core damage.
Success Criteria Operators successfully depressurize the reactor within sufficient time to allow a low -pressure injection source to recover water level and prevent core damage.
Key Cue(s)
- Reactor water level and associated annunciators
- Annunciators associated with failures of RCIC, HPCS, and reactor feedwater (e.g., pump isolation trip, turbine trip, pump discharge low flow, etc.)
Procedural Guidance
- RPV Control EOP CFM Selection Detection - This task requires the operators to detect the alarms and annunciators associated with reactor water level (i.e., level reaching TAF) and the failure of high-pressure injection (RCIC and HPCS).
Understanding - This task requires the operators to understand that with reactor water level reaching TAF and no source of high-pressure injection available, they must initiate a manual reactor depressurization to allow for a source of low-pressure injection to prevent core damage.
Decisionmaking - Decisionmaking is required for this task because there may be some nominal decisionmaking to move on from recovery of reactor feedwater activities to emergency depressurization even with the explicit procedural direction.
Action Execution - This task requires the operators to manually depressurize the reactor by opening the ADS valves. This action is accomplished by simple switch manipulations from the MCR.
Interteam Coordination - Interteam coordination is not required for this task because multiple teams would not be involved. Therefore, this CFM is not applicable for this task.
Evaluation of PIFs for Applicable CFMs CFM1 -Failure of Detection (Base Probability = 1x10-4)
- Scenario Familiarity - No impact because operators are routinely trained on a loss of feedwater transient and subsequent failure/unavailability of all sources of high-pressure injection.
- Task Complexity - No impact because the initial signals received at the start of the event are assumed to no longer have an impact on the operators ability to detect when the cue for this task (i.e., reactor water level reaching TAF) is received later.
- The other PIFs were determined to have a negligible impact on the base case HFE.
CFM2 - Failure of Understanding (Base Probability = 1x10-3)
- Scenario Familiarity - No impact because operators are trained on a loss of feedwater transient and subsequent failure/unavailability of all sources of high-pressure injection.
- Information Completeness and Reliability - No impact because reactor water level and indications of the failure of RCIC/HPCS are sufficient to diagnose a loss of feedwater transient and subsequent failure/unavailability of all sources of high-pressure injection.
- Task Complexity - No impact because the requirement to manually depressurize the reactor when reactor feedwater and all other sources of high-pressure injection are not available is a fundamental plant operation concept that is specifically covered by plant procedures.
- The other PIFs were determined to have a negligible impact on the base case HFE.
LER 416-2022-003 8
CFM3 - Decisionmaking (Base Probability = 1x10-3)
- Scenario Familiarity - No impact because operators are routinely trained on a loss of feedwater transient and subsequent failure/unavailability of all sources of high-pressure injection.
- Information Completeness and Reliability - No impact because reactor water level and indications of the failure of RCIC/HPCS are sufficient to diagnose a loss of feedwater transient and subsequent failure/unavailability of all sources of high-pressure injection.
- Task Complexity - No impact because the requirement to manually depressurize the reactor when reactor feedwater and all sources of high-pressure injection are not available is a fundamental plant operation concept that is specifically covered by plant procedures.
- The other PIFs were determined to have a negligible impact on the base case HFE.
CFM4 - Failure of Action Execution (Base Probability = 1x10-4)
- Scenario Familiarity - No impact because the execution steps are routinely trained.
- Task Complexity - No impact because the execution steps are straightforward (i.e., MCR switch manipulations) and proceduralized.
- The other PIFs were determined to have a negligible impact on the base case HFE.
Using these assumptions, Pc is calculated as 2.2x10-3 by summing the probabilities of CFM1 (1x10-4), CFM2 (1x10-3), CFM3 (1x10-3), and CFM4 (1x10-4).
Timing Evaluation The Tavail and Treqd were estimated from the time when the cue (reactor water level reaches the requirement for emergency depressurization) becomes available to the time that depressurization is sufficient to allow for a low-pressure injection system to restore reactor inventory to prevent core damage. The licensee MAAP calculation for a main steam isolation resulting in a loss of feedwater with no sources of high-pressure injection (i.e., RCIC or HPCS) available results in reactor water level reaching TAF in approximately 12 minutes after the initiating event occurred. Emergency depressurization would need to occur within 27 minutes (i.e., t = 27 minutes) to allow sufficient time for the low-pressure system(s) to provide adequate reactor water makeup to prevent core damage. And although the actual transient that occurred was less severe than the assumptions associated with this calculation, the Tavail of 15 minutes was used in this evaluation. In addition, MCR operators could depressurize the reactor prior to water level reaching TAF if they believe that they cannot restore level before it lowers to TAF. Additional time would be available in this scenario. The Treqd is estimated to be 2 minutes for operators to manually open all ADS valves from the MCR (i.e., simple switch manipulations).
The current IDHEAS-ECA guidance recommends using a lognormal distribution for the time estimates; however, the current IDHEAS-ECA software tool does not have this capability yet. The selection of the Treqd of 2 minutes was assumed to be the median (i.e., 50th percentile) of the lognormal distribution. Tavail is treated as a single value with no distribution assigned for the base case; the potential variabilities of other initiating events are considered and discussed in the Initiating Event Variability section. For the evaluation of this base case HFE, Pt was calculated using an EF of 2 for the lognormal distribution of Treqd, which is considered to be appropriate for actions performed from the MCR based on a preliminary analysis of timing data MCR operators response to emergency events in nuclear power plant simulators, including NUREG/IA-0216, NUREG-2156, EPRI NP-6937-L, and simulator data from other sources. This selection results in a Pt of 8.7x10-7. At the time of completing this analysis, the guidance on specifying the uncertainty bounds for time estimates in IDHEAS-ECA has not been finalized.
Recovery Recovery credit is not provided for this task.
LER 416-2022-003 9
HFE Dependency. Dependency between the two HFEs (MFW-XHE-XL-RECOV and ADS-XHE-XM-MDEPR) is already considered in the IDHEAS-ECA evaluation of the individual HFEs. These dependencies are accounted for by evaluating the 2nd HFE (ADS-XHE-XM-MDEPR) within the context that the first HFE (MFW-XHE-XL-RECOV) has occurred. However, a separate dependency evaluation was performed to determine if potential additional dependencies need to be considered. This dependency evaluation was performed using the IDHEAS dependency approach documented in Research Information Letter (RIL) 2021-14, Integrated Human Event Analysis System Dependency Analysis Guidance (IDHEAS-DEP), (ML21316A107). The first step of a dependency evaluation using IDHEAS-DEP is to perform a predetermination analysis using Table 1 from RIL 2021-14. This predetermination analysis is documented in the following table:
Table 3. Dependency Predetermination Analysis Dependency Relationship Assessment Guidelines Potential Dependency Complete Dependency Are the following three factors applicable?
HFE1 and HFE2 use the same procedure, AND HFE1 is likely to occur because of issues associated with the common procedure (such as having an ambiguous or incorrect procedure), AND There is no opportunity to recover from the issue with the procedure between HFE1 and HFE2.
No R1Functions or Systems Do HFE1 and HFE2 have the same functions/systems OR do HFE1 and HFE2 have coupled systems or processes that are connected due to automatic responses or resources needed.
No R2Time Proximity Are HFE1 and HFE2 performed close in time OR are the cues for HFE1 and HFE2 presented close in time?
Yes R3Personnel Are HFE1 and HFE2 performed by the same personnel?
Yes R4Location Are HFE1 and HFE2 performed at the same location OR are the workplaces for HFE1 and HFE2 are affected by the same condition (e.g., low visibility, high temperature, low temperature, or high radiation)?
Yes R5Procedure Does HFE1 and HFE2 use the same procedure?
No The predetermination analysis identified the R2 (Time Proximity), R3 (Personnel), and R4 (Location) as factors that have the potential for dependency between MFW-XHE-XL-RECOV and ADS-XHE-XM-MDEPR. The next step of the IDHEAS-DEP evaluation is to perform a screening analysis of these potential dependency factors using Table 2.1 from RIL 2021-14. This screening analysis is documented in the following table:
Calculated HEP HEP = 1 (1 Pc) (1 Pt) = 1 (1 - 2.2x10-3) (1 - 8.7x10-7) = 2x10-3 Key Uncertainties The following key uncertainties were identified:
- The selection of the appropriate EF for the timing estimates can have a significant effect on the Pt and the overall HEP. In general, the empirical studies referenced in the timing evaluations involved specific scenarios involving procedurally-driven MCR operator actions; however, these studies did not fully investigate the full range of scenario variabilities associated with the analyzed HFE and, therefore, the selection of the EF of 2 for Treqd is an uncertainty associated with this evaluation. The guidance for the selection of the EFs associated with timing estimates is still under development.
LER 416-2022-003 10 Table 4. Dependency Screening Analysis Potential Dependency Factors Basis for Discounting Potential Dependency Factor R2.1 Close time proximity in performing HFE1 and HFE2 leads to consequential dependency.
A. Occurrence of HFE1 reduces the time available or increases the time required for HFE2.
R2.1A is discounted by There is no change in the time available and time required for HFE2 due to HFE1.
There is no change in the time available and time required to perform the emergency depressurization given a failure of operators to recover feedwater.
R2.2 Close time proximity in receiving the cues for HFE1 and HFE2 leads to consequential dependency.
A. Cues for HFE1 and HFE2 occur close in time such that the cue for HFE2 is likely to be masked or forgotten by the time that HFE2 needs to be performed.
R2.2A is discounted by AThe cues for HFE1 and HFE2 do not occur close in time.
The cues for recovering of reactor feedwater and initiating an emergency depressurization occur sufficiently apart that the potential for masking is very unlikely.
R3.1 Same personnel leads to cognitive dependency.
A. Same person performs the two HFEs; thus, the person may incorrectly interpret the situation for HFE2 due to occurrence of HFE1.
B. Same personnel or crew makes diagnosis or decisionmaking in the two HFEs; thus, personnel may experience groupthink, which causes a biased or incorrect mental model for HFE2.
R3.1A and R3.1B are discounted by A/BDifferent procedures are used for HFE1 and HFE2.
Different procedures are used for recovery of reactor feedwater and initiating an emergency depressurization.
R3.2 Same personnel leads to consequential dependency.
A. Mental fatigue, time pressure, or stress level increase due to the same personnel performing HFE1 and HFE2.
B. Personnel need to perform HFE1 and HFE2 at the same time.
R3.2A is discounted by AWorkload is similar to training situations and occurs within a single shift, so no increase in stress, time pressure, or mental fatigue.
The workload for this scenario is similar to training situations and occurs within a single shift and, therefore, is not expected to increase the stress, time pressure, or mental fatigue.
R3.2B is discounted by BHFE1 and HFE2 are not performed at the same time.
The recovery reactor feedwater and initiating an emergency depressurization are not performed at the same time.
R3.3 Same personnel leads to resource-sharing dependency.
A. Reduced staffing or missing key members results in higher workload than in training or lack of key knowledge needed.
B. Shared staff requires changes to the work practices for HFE2 to accommodate shortage of staffing due to occurrence of HFE1.
R3.3A and R3.3B are discounted by A/BStaffing is adequate, and good work practices are enforced.
The staffing to perform these two actions is adequate, and the good work practices are expected to be enforced.
R4.1 Same location leads to consequential dependency.
A. HFE1 degrades the work environment for HFE2.
R4.1A is discounted by AHFE1 has no impact on the workplace.
The failure to recover reactor feedwater would not have an impact on the workplace.
LER 416-2022-003 11 R4.2 Same location and time leads to consequential dependency.
A. HFE1 and HFE2 use the same workplace at the same time such that HFE1 may interfere with or cause distractions in the performance of HFE2.
R4.2A is discounted by AHFE1 and HFE2 are not performed at the same time.
The recovery of reactor feedwater and the initiation of emergency depressurization are not performed at the same time.
The screening analysis discounted dependency effects of R2 (Time Proximity), R3 (Personnel), and R4 (Location) between MFW-XHE-XL-RECOV and ADS-XHE-XM-MDEPR. Therefore, the individual HEPs were used in this analysis.
3 ANALYSIS RESULTS 3.1 Results The mean CCDP for this analysis is calculated to be 4.5x10-6. The ASP Program threshold for initiating events is a CCDP of 10-6 or the plant-specific mean CCDP of an uncomplicated reactor trip with a non-recoverable loss of feedwater and the condenser heat sink, whichever is greater.
This CCDP equivalent for Grand Gulf Nuclear Station is 1.4x10-5.3 Therefore, this event is not a precursor. The parameter uncertainty results for this analysis provided below:
Table 5. Parameter Uncertainty (CCDP) Results 5%
Median Point Estimate Mean 95%
2.3x10-8 9.3x10-7 4.5x10-6 4.5x10-6 2.0x10-5 3.2 Dominant Sequences4 The dominant accident sequence is a LOMFW sequence 14 (CCDP = 4.2x10-6), which contributes approximately 92 percent of the total CCDP. The sequences that contribute at least 1.0 percent to the total CCDP are provided in the following table. The event tree with the dominant sequence is shown graphically in Figure A-1 of Appendix A.
Table 6. Dominant Sequences Sequence CDP Description LOMFW 14 4.2x10-6 91.7%
Loss of reactor feedwater initiating event; RCIC is unavailable due to maintenance and HPCS fails; and operator failures to recover reactor feedwater and to initiate an emergency depressurization of the reactor results in core damage.
LOMFW 78-51 1.2x10-7 2.6%
Loss of reactor feedwater initiating event; consequential loss of offsite power occurs; the emergency diesel generators (EDGs) successfully provide safety-related alternating-current (AC) power; RCIC is unavailable due to maintenance and HPCS fails; and operator failure to initiate an emergency depressurization of the reactor results in core damage.
3 This CCDP is calculated using the revised HEP for ADS-XHE-XM-MDEPR provided in Section 2.4.
4 The CCDPs in this section are point estimates.
LER 416-2022-003 12 Sequence CDP Description LOMFW 78-54-12 1.2x10-7 2.6%
Loss of reactor feedwater initiating event; consequential loss of offsite power occurs; the EDGs fail resulting in a station blackout; RCIC is unavailable due to maintenance and HPCS fails; and operator failure to recovery alternating-current power within 30 minutes is assumed to result in core damage.
3.3 Key Uncertainties The key uncertainties associated with this analysis are limited to those identified in HRA evaluations of the two HFEs documented in Section 2.4. These uncertainties are provided in Tables 1 and 2.
LER 416-2022-003 A-1 Appendix A: Key Event Tree Figure A-1. Grand Gulf Loss of Reactor Feedwater Event Tree IE-LOMFW LOSS OF FEEDWATER RPS REACTOR PROTECTION SYSTEM OEP FAILURE OF OFFSITE POWER TO 'E' BUSES SRV SRV'S CLOSE CND MAIN CONDENSER HCS HPCS RCI RCIC MFW-R MAIN FEEDWATER SPC SUPPRESSION POOL COOLING DEP MANUAL REACTOR DEPRESS CRD CRD INJECTION (2 PUMPS)
CDS CONDENSATE INJECTION IS UNAVAILABLE LPI LOW PRESSURE INJECTION (LPCS OR LPCI)
VA ALTERNATE LOW PRESS INJECTION SPC SUPPRESSION POOL COOLING DEP MANUAL REACTOR DEPRESS SDC SHUTDOWN COOLING CSS CONTAINMENT SPRAY PCSR POWER CONVERSION SYSTEM RECOVERY CVS CONTAINMENT VENTING LI LATE INJECTION IS UNAVAILABLE End State (Phase - CD) 1 OK 2
OK 3
OK 4
OK 5
OK 6
CD 7
OK 8
CD 9
OK 10 OK 11 OK 12 OK 13 CD 14 CD 15 OK 16 OK 17 OK 18 OK 19 OK 20 OK LI04 21 CD 22 OK 23 OK 24 OK 25 OK LI04 26 CD 27 OK 28 OK 29 OK 30 OK 31 OK 32 CD 33 OK 34 OK 35 OK 36 OK 37 OK LI08 38 CD 39 OK SD1 40 OK CS1 41 OK 42 OK 43 OK LI11 44 CD 45 CD 46 OK 47 OK 48 OK 49 CD 50 CD 51 OK 52 OK 53 OK 54 OK 55 OK 56 CD 57 OK 58 OK 59 OK 60 OK 61 OK 62 OK LI08 63 CD 64 OK SP1 65 OK SD1 66 OK CS1 67 OK 68 OK 69 OK LI11 70 CD 71 CD 72 OK 73 OK LI13 74 CD 75 CD P1 76 1SORV P2 77 2SORVS 78 LOOPPC 79 ATWS 80 CD