NG-12-0502, Response to Request for Additional Information, License Amendment Request to Adopt National Fire Protection Association Standard 805, Performance-Based Standard for Fire Protection for Light Water Reactor Generating Plants
| ML13015A350 | |
| Person / Time | |
|---|---|
| Site: | Duane Arnold  |
| Issue date: | 01/11/2013 |
| From: | Richard Anderson NextEra Energy Duane Arnold |
| To: | Document Control Desk, Office of Nuclear Reactor Regulation |
| References | |
| NG-12-0502 | |
| Download: ML13015A350 (38) | |
Text
NExTera EN ERGNY&
ARNOLD January 11,2013 NG-12-0502 10 CFR 50.90 U. S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, DC 20555-0001 Duane Arnold Energy Center Docket No. 50-331 Renewed Op. License No. DPR-49 Response to Request for Additional Information, License Amendment Request to Adopt National Fire Protection Association Standard 805, Performance-Based Standard For Fire Protection For Light Water Reactor Generating Plants
References:
- 1) License Amendment Request (TSCR-1 28): Transition to 10 CFR 50.48(c) - NFPA 805, Performance-Based Standard For Fire Protection For Light Water Reactor Generating Plants (2001 Edition), NG-1 1-0267, dated August 5, 2011 (ML11221A280)
- 2) Clarification of Information Contained in License Amendment Request (TSCR-128): Transition to 10 CFR 50.48(c) - NFPA 805, Performance-Based Standard For Fire Protection For Light Water Reactor Generating Plants (2001 Edition), NG-1 1-0384, dated October 14, 2011
- 3) Electronic Communication, ME6818 Duane Arnold NFPA-805 -
Second Audit Report Questions, dated October 8, 2012 (ML12284A021)
- 4) Response to Second Request for Additional Information, License Amendment Request to Adopt National Fire Protection Association Standard 805, Performance-Based Standard For Fire Protection For Light Water Reactor Generating Plants, NG-1 2-0419, dated October 15, 2012
- 5) License Amendment Request to Adopt National Fire Protection Association Standard 805, Performance-Based Standard For Fire Protection For Light Water Reactor Generating Plants -
Transmittal of CFAST files, NG-12-0291, dated July 9, 2012
- 6) Electronic Communication, ME6818 Duane Arnold NFPA-805 -
Third Request for Additional Information, dated November 8, 2012 (ML12318A394)
A NextEra Energy Duane Arnold, LLC, 3277 DAEC Road, Palo, IA52324
- ~5Q9
Document Control Desk NG-12-0502 Page 2 of 3 In the Reference 1 letter, as clarified by Reference 2, NextEra Energy Duane Arnold, LLC (hereafter NextEra Energy Duane Arnold) submitted a License Amendment Request for the Duane Arnold Energy Center (DAEC) pursuant to 10 CFR 50.90. Subsequently, the NRC Staff requested, via Reference 6, additional information regarding that application.
As a result of discussions with the Staff, Safe Shutdown Analysis RAI 1.01 and Fire Protection Engineering RAI 13 will be submitted on March 6, 2013.
The Staff has confirmed that the following requests are duplications and as such, our responses will not be duplicated in this letter:
- Fire Modeling RAI 02.01 is a duplicate of Reference 3 Question 1;
- Fire Modeling RAI 04.01 is a duplicate of Reference 3 Question 2;
- Fire Modeling RAI 05.01 is a duplicate of Reference 3 Question 3;
- Fire Modeling RAI 07 is a duplicate of Reference 3 Questions 4 and 5.
Our responses for the above RAIs were docketed in Reference 4.
Fire Modeling RAI 07 is a duplicate of Reference 3 Question 6. The requested files were provided via Reference 5. to this letter contains the responses for the remaining information requests.
This additional information does not impact the 10 CFR 50.92 evaluation of "No Significant Hazards Consideration" previously provided in the referenced application.
This additional information does not make changes to any existing commitments and does not make any new commitments.
If you have any questions or require additional information, please contact Tom Byrne at 319-851-7929.
I declare under penalty of perjury that the foregoing is true and correct.
Executed on January 11, 2013 RicadLA'es Vice President, Duane Arnold Energy Center NextEra Energy Duane Arnold, LLC
Document Control Desk NG-12-0502 Page 3 of 3
Attachment:
Response to Request for Additional Information, License Amendment Request to Adopt National Fire Protection Association Standard 805, Performance-Based Standard For Fire Protection For Light Water Reactor Generating Plants cc: NRC Regional Administrator NRC Resident Inspector NRC Project Manager M. Rasmusson (State of Iowa)
Attachment to NG-12-0502 Response to Request for Additional Information, License Amendment Request to Adopt National Fire Protection Association Standard 805, Performance-Based Standard For Fire Protection For Light Water Reactor Generating Plants 34 pages follow
RAI - Safe Shutdown Analysis 5.01 DAEC RAI SSA 5.01 In a letter dated April 23, 2012 (ADAMS Accession No. ML12117A052) the licensee responded to Safe Shutdown Analysis RAI 5 regarding the Updated Final Safety Analysis Report (UFSAR), and confirmed that the format and content will be consistent with frequently asked question (FAQ) 12-0062 (ADAMS Accession No. ML121430035).
Section 7.4.2.1.1 of the UFSAR states: "The alternate shutdown capability system has been designed and installed to meet the requirements of 10 code of federal regulations (CFR) 50, Appendix R,Section III.G. The DAEC submitted the alternate shutdown capability system design to the NRC by Reference 1." Describe the changes planned for Section 7.4 of the UFSAR.
RESPONSE
Upon receipt of the License Amendment approving the transition to NFPA 805, NextEra Energy will update the UFSAR, in accordance with 10 CFR 50.71(e), to reflect this transition. As part of that update, the entire UFSAR Will be reviewed and all outdated information regarding fire protection will be removed as required by 10 CFR 50.71(e).
Page 1 of I Rev A.A. Page 1 of 1
RAI - Fire Protection Engineering 11 DAEC RAI FP 11 The pump house wet pit is the primary source for fire water and is also the common source for the circulating service water system and general service water system.
National Fire Protection Association Standard 805, "Performance-Based Standard for Fire Protection for Light Water Reactor Electric Generating Plants," 2001 Edition, (NFPA 805), Sections 3.5.1, 3.5.2, and 3.5.16 contain provisions for fire water supply reliability and capacity, including requirements for common sources with other plant systems. For a fire in the turbine building that damages the flexible connectors at the circulating water piping connections to the main condenser, describe the operator actions and associated procedures that ensure the discharge of the circulating water through the failed connection does not result in loss of suction supply in the wet pit and subsequent failure of the fire pumps.
RESPONSE
For a fire in the Turbine Building Basement, operator procedures are in place to deal with low water level in the circulating water pit. Per Alarm Response Procedure (ARP) 1C06A, Revision 61, "Annunciator Response Procedure - Panel 1C06A - Feedwater and Condensate," Section D-1 1 for Circ Water Pit Lo Level states:
" If Circ. Water Pit level drops to or below 18 ft. both Circ. Water Pumps 1P-4A and 1P-4B are interlocked from starting.
" If Circ. Water Pit level is below 13.5 feet, declare the Electric and Diesel Fire Pumps inoperable and comply with the Limiting Conditions for Operation of DAEC Fire Plan.
The procedure contains steps to troubleshoot and restore water to the wet pit. The Fire Water Supply System can be supplied from the General Service Water System or the Well Water System. The Well Water connection is independent of the Circulating Water Pit supply. In the event of a loss of Circulating Water to the condenser, condenser back pressure would rise, and become an issue as well. Operations would be investigating the issues under both regular plant procedures, and abnormal and emergency operating procedures. In the event of a prolonged issue, Operations may call out offsite fire department support or established a backup supply using onsite portable equipment to charge the fire water yard main.
In summary, loss of water would be identified via alarms or trip of the system. Both would result in manually securing Circulating Water Pumps, thereby maintaining wet pit inventory. In addition, procedures direct Operations to restore water to the Fire Pumps and to the Circulating Water Pit. Make-up to the Circulating Water Pit is via the River Water Supply Pumps and greatly exceeds the maximum fire protection demand as documented in the response to RAI FP 8.
Page 1 of I Rev A.A. Page I of 1
RAI - Fire Protection Engineering 12 DAEC RAI FP 12 In a letter dated April 23, 2012 (ADAMS Accession No. ML12117A052) the licensee responded to Fire Protection Engineering RAI 2, regarding the use of Electric Power Research Institute (EPRI) Technical Report (TR) 1006756, "Fire Protection Surveillance Optimization and Maintenance Guide for Fire Protection Systems and Features, and indicated that if the methodologies in EPRI TR 1006756 are implemented, surveillance frequencies of fire protection systems may be modified. However, adjusting the frequency of inspection, tests and maintenance activities required by NFPA 805, Section 3.2.3, using a performance-based approach such as EPRI Technical Report 1006756 constitutes the use of a "performance-based method permitted elsewhere in the standard." To implement performance-based changes using EPRI TR 1006756 (or other performance-based methods) to required inspection, tests and maintenance activities, submit a request for the change in accordance with 10 CFR 50.48(c)(2)(vii) and provide proper justification.
RESPONSE
Attachment L, "NFPA 805 Chapter 3 Requirements for Approval (10 CFR 50.48(c)(2)(vii))," of the enclosure to License Amendment Request (ML1221A280) has been amended to include a new Approval Request (Approval Request No. 4). Approval Request No. 4 requests use of the guidance in EPRI Technical Report 1006756 to establish the appropriate inspection, testing, and maintenance frequencies for fire protection systems and features credited by the fire protection program after transitioning to NFPA 805, as described below.
Approval Request 4 NFPA 805 Section 3.2.3(1)
In accordance with 10 CFR 50.48(c)(2)(vii), "Performance-based methods," the fire protection program elements and minimum design requirements of Chapter 3 may be subject to the
,performance-based methods permitted elsewhere in the standard.
In accordance with NFPA 805 Section 2.2.8, the performance-based approach to satisfy the nuclear safety, radiation release, life safety, and property damage/business interruption performance criteria requires engineering analyses to evaluate whether the performance criteria are satisfied.
In accordance with 10 CFR 50.48(c)(2)(vii), the engineering analysis performed shall determine that the performance-based approach utilized to evaluate a variance from the requirements of NFPA 805 Chapter 3:
Page 1 of 6 Rev A.A. Page I of 6
RAI - Fire Protection Engineering 12 (A) Satisfies the performance goals, performance objectives, and performance criteria specified in NFPA 805 related to nuclear safety and radiological release; (B) Maintains safety margins; and (C) Maintains fire protection defense-in-depth (fire prevention, fire detection, fire suppression, mitigation, and post-fire nuclear safety capability).
DAEC requests formal approval of performance-based exception to the requirements in Chapter 3 of NFPA 805 as follows:
NFPA 805, Section 3.2.3(1)
"Proceduresshall be establishedfor implementation of the fire protection program.
In addition to procedures that could be requiredby other sections of the standard, the procedures to accomplish the following shall be established:
Inspection, testing, and maintenance for fire protection systems and features credited by the fire protection program."
DAEC requests the ability to utilize performance-based methods to establish the appropriate inspection, testing, and maintenance frequencies for fire protection systems and features required by NFPA 805. Performance-based inspection, testing, and maintenance frequencies will be established as described in Electric Power Research Institute (EPRI) Technical Report TR-1006756, "Fire Protection Surveillance Optimization and Maintenance Guide for Fire Protection Systems and Features", Final Report, July 2003.
Basis for Request:
NFPA 805 Section 2.6, "Monitoring," requires that "A monitoring program shall be establishedto ensure that the availability and reliability of the fire protection systems and features are maintained and to assess the performance of the fire protection program in meeting the performance criteria.
Monitoring shall ensure that the assumptionsin the engineeringanalysis remain valid."
NFPA 805 Section 2.6.1, "Availability, Reliability, and Performance Levels," requires that "Acceptable levels of availability, reliability,and performance shall be established."
NFPA 805 Section 2.6.2, "Monitoring Availability, Reliability, and Performance," requires that "Methods to monitoravailability, reliability,and performance shall be established.
The methods shall consider the plant operatingexperience and industry operating experience."
The scope and frequency of the inspection, testing, and maintenance activities for fire protection systems and features required in the fire protection program have been Rev A. Page 2 of 6
RAI - Fire Protection Engineering 12 established based on the previously approved Technical Specifications / License Controlled Documents and appropriate NFPA codes and standard. This request does not involve the use of the EPRI Technical Report TR-1 006756 to establish the scope of those activities as that is determined by the required systems review identified in Table 4-3, "NFPA 805 Ch 4 Required FP Systems/Features."
This request is specific to the use of EPRI Technical Report TR-1006756 to establish the appropriate inspection, testing, and maintenance frequencies for fire protection systems and features credited by the fire protection program. As stated in EPRI Technical Report TR- 1006756 Section 10.1, "The goal of a performance-based surveillance program is to adjust test and inspection frequencies commensurate with equipment performance and desired reliability." This goal is consistent with the stated requirements of NFPA 805 Section 2.6. The EPRI Technical Report TR-1 006756 provides an accepted method to establish appropriate inspection, testing, and maintenance frequencies which ensure the required NFPA 805 availability, reliability, and performance goals are maintained.
The target tests, inspections, and maintenance will be those activities for the NFPA 805 required fire protection systems and features. The reliability and frequency goals will be established to ensure the assumptions in the NFPA 805 engineering analysis remain valid. The failure criterion will be established based on the required fire protection systems and features credited functions and will ensure those functions are maintained.
Data collection and analysis will follow the EPRI Technical Report TR-1 006756 document guidance. The failure probability will be determined based on EPRI Technical Report TR-1006756 guidance and a 95% confidence level will be utilized. The performance monitoring will be performed in conjunction with the Monitoring Program required by NFPA 805 Section 2.6 and it will ensure site specific operating experience is considered in the monitoring process. The following is a flow chart that identifies the basic process that will be utilized.
Rev A. Page 3 of 6
RAI - Fire Protection Engineering 12 Program Framework Identify Target Tests and Inspections Establish Reliability and Frequency Goals Set Failure Criteria Assess Licensing Impact and Other Constraints Data Collection and Evaluation Establish Data Collection Guidelines Collect Required Surveillance Data Assemble Data in Spreadsheet or Database Analyze Data to Identify Failures Reliability and Uncertainty Analysis Compute Failure Probabilities Compute Uncertainty Limits Confirm That Reliability Supports Target Frequency Program Implementation Modify Program Documents Revise Surveillance Procedures Conduct Ongoing Performance Monitoring Refine and Modify Frequencies as Appropriate EPRI TR-1006756 - Figure 10-1 Flowchart for Performance-Based Surveillance Program NextEra Energy Duane Arnold does not intend to revise any fire protection surveillance, test or inspection frequencies until after transitioning to NFPA 805. Existing fire protection surveillance, test and inspection will remain consistent with applicable Technical Requirements Manual, Insurer, and NFPA Code requirements. NextEra Energy Duane Arnold's intent is to obtain approval via the NFPA 805 Safety Evaluation to use EPRI Technical Report TR1006756 guideline in the future as opportunities arise.
Page 4 of 6 Rev A.A. Page 4 of 6
RAI - Fire Protection Engineering 12 NextEra Energy Duane Arnold reserves the ability to evaluate fire protection features with the intent of using the EPRI performance-based methods to provide evidence of equipment performance beyond that achievable under traditional prescriptive maintenance practices to ensure optimal use of resources while maintaining reliability.
Nuclear Safety and Radiological Release Performance Criteria:
Use of performance-based test frequencies established per EPRI Technical Report TR-1006756 methods combined with NFPA 805 Section 2.6, Monitoring Program, will ensure that the availability and reliability of the fire protection systems and features are maintained to the levels assumed in the NFPA 805 engineering analysis. Therefore, there is no adverse impact to Nuclear Safety Performance Criteria by the use of the performance-based methods in EPRI Technical Report TR-1 006756.
The radiological release performance criteria are satisfied based on the determination of limiting radioactive release. Fire Protection Systems and Features may be credited as part of that evaluation. Use of performance-based test frequencies established per the EPRI Technical Report TR-1 006756 methods combined with NFPA 805 Section 2.6, Monitoring Program, will ensure that the availability and reliability of the fire protection systems and features are maintained to the levels assumed in the NFPA 805 engineering analysis which includes those assumptions credited to meet the Radioactive Release performance criteria. Therefore, there is no adverse impact to Radioactive Release performance criteria.
Safety Margin and Defense-in-Depth:
Use of performance-based test frequencies established per EPRI Technical Report TR-1006756 methods combined with NFPA 805, Section 2.6, Monitoring Program, will ensure that the availability and reliability of the fire protection systems and features are maintained to the levels assumed in the NFPA 805 engineering analysis which includes those assumptions credited in the Fire Risk Evaluation safety margin discussions. In addition, the use of these methods in no way invalidates the inherent safety margins contained in the codes and standards used for design and maintenance of fire protection systems and features. Therefore, the safety margin inherent and credited in the analysis has been preserved.
The three echelons of defense-in-depth described in NFPA 805 Section 1.2 are: 1) to prevent fires from starting (combustible/hot work controls); 2) rapidly detect, control and extinguish fires that do occur thereby limiting damage (fire detection systems, automatic fire suppression, manual fire suppression, pre-fire plans); and 3) provide adequate level of fire protection for systems and structures so that a fire will not prevent essential safety functions from being performed (fire barriers, fire rated cable, success path remains free of fire damage, recovery actions).
Echelon 1 is not affected by the use of the EPRI Technical Report TR-1 006756 methods. Use of performance-based test frequencies established per EPRI Technical Report TR-1 006756 methods combined with NFPA 805 Section 2.6, Monitoring Program, will ensure that the availability and reliability of the fire protection systems and Rev A. Page 5 of 6
RAI - Fire Protection Engineering 12 features credited for defense-in-depth are maintained to the levels assumed in the NFPA 805 engineering analysis. Therefore, there is no adverse impact to echelons 2 and 3 for defense-in-depth.
==
Conclusion:==
NRC approval is requested for use of the performance-based methods contained in the Electric Power Research Institute (EPRI) Technical Report TR-1006756, "Fire Protection Surveillance Optimization and Maintenance Guide for Fire Protection Systems and Features", Final Report, July 2003 to establish the appropriate inspection, testing, and maintenance frequencies for fire protection systems and features required by NFPA 805. As described above, this approach is considered acceptable because it:
(A) Satisfies the performance goals, performance objectives, and performance criteria specified in NFPA 805 related to nuclear safety and radiological release; (B) Maintains safety margins; and (C)Maintains fire protection defense-in-depth (fire prevention, fire detection, fire suppression, mitigation, and post-fire safe shutdown capability).
Page 6 of 6 Rev A.A. Page 6 of 6
RAI - PRA 04.01 DAEC RAI PRA 04.01 Describe the methodology used for assigning localized transient and hot work ignition sources within a Physical Access Unit (PAU) in sufficient detail to summarize how all magnitude and frequencies were determined. To the extent not discussed in general methodology, provide a general discussion of the following points.
- a. NUREG/6850 provides that transient fires should at a minimum be placed in locations within the plant PAUs where conditional core damage probabilities (CCDPs) are highest for that PAU, i.e., at "pinch points." Pinch points include locations of redundant trains or the vicinity of other potentially risk-relevant equipment, including the cabling associated with each. Transient fires should be placed at all appropriate locations in a PAU where they can threaten pinch points. Hot work should be assumed to occur in locations where hot work is a possibility, even if improbable (but not impossible), keeping in mind the same philosophy.
- b. In a letter dated April 23, 2012 (ADAMS Accession No. ML12117A052) the licensee responded to Probabilistic Risk Assessment RAI 4 stating that, "In the cases where a postulated transient included a larger target set and/or secondary combustibles (e.g., cable trays) a more appropriate area weighting factor was applied." Explain how this weighting factor was developed and identify what locations/PAUs involved these modified weighting factors and what the weighting factors were.
- c. If there are areas within a PAU where no transient or hot work fires are located since those areas are considered inaccessible, describe the criteria used to define "inaccessible." Note that an inaccessible area is not the same as a location where fire is simply unlikely, even if highly improbable.
RESPONSE
- a. Walkdowns were performed to identify locations where fire PRA targets were postulated to be damaged by transient fires. These locations consist of cable tray risers and cable trays routed within the transient vertical zone of influence.
These postulated transient scenarios are where the CCDPs would be expected to be the highest for most transient fires. In addition, pinch points were identified by reviewing the plant locations with VFDRs. If a VFDR was not included in the target set of other postulated fire scenarios then a transient or hot work fire was considered to include the pinch point.
- b. The postulated transient fire scenarios were reviewed and while the methodology would allow for modified area weighting factors none were used. Transient fires that included a larger target set and/or secondary combustibles were treated as bounding fire scenarios and the full transient fire ignition frequency was applied Rev A. Page I of 3
RAI - PRA 04.01 (i.e., area weighting factors were not applied). This treatment was applied for postulated transient fires in the following PAUs:
- PAU 2E - Reactor Building - Offgas Recombiner Room
- PAU 2G - Reactor Building - Steam Tunnel
- PAU 2L - Reactor Building - RHR Valve Room Pipe Chase
- PAU 3E - Reactor Building - Spent Resin Tank Room
- PAU 7F - Turbine Building - Condenser/Heater Bay
- PAU 7H - Turbine Building - North Stair 12
- PAU 1OA - Control Building - Battery Room Corridor
- PAU 1OB - Control Building - 1D2, West Battery Room
- PAU 1OD - Control Building - 1D1, East Battery Room
- PAU 1OG - Control Building - Electrical Chase
- PAU 1 1A - Control Building - Cable Spreading Room
- PAU 17A- Intake Structure - Division I Pump Room (North)
- PAU 17B - Intake Structure - Division II Pump Room (South)
- PAU CT1 - A Cooling Tower (West)
" PAU CT2 - B Cooling Tower (East)
- PAU OUG - Outside Under Ground
- c. Postulated transient fire scenarios were not excluded from the fire PRA because an area was considered inaccessible. Hot work fire scenarios were excluded from five areas based on an expert panel assigning a transient influence factor of "0" to the PAU per NUREG/CR-6850 guidance, because no maintenance was considered possible or allowed during power operation. These five areas include:
- PAU 2H - Reactor Building - North Chase
- PAU 2L - Reactor Building - RHR Valve Room Pipe Chase Rev A. Page 2 of 3
- PAU 2M - Reactor Building - Exhaust Fan Room Chase
- PAU 7D - Turbine Building - Turbine Lube Oil Storage Tank Vault
- PAU 9B - Turbine Building - Turbine Operating Floor Middle Deck In addition, hot work fire scenarios were not postulated in PAU 2G, Reactor Building - Steam Tunnel, because of high radiation levels during power operation and the absence of combustibles.
Page 3 of 3 Rev A. Page 3 of 3
RAI - PRA 62 DAEC RAI PRA 62 In a letter dated April 23, 2012 (ADAMS Accession No. ML12117A052) the licensee responded to Fire Protection Engineering RAI 4 and clarified how sufficient safety margins were evaluated for the 10 CFR 50.48(c)(2)(vii) methods. The LAR does not describe how this evaluation was performed in the fire risk evaluations. Describe the methodology that was used to evaluate safety margins. The description should include what was evaluated, how the evaluations were performed, and what, if any, actions or changes to the plant or procedures were taken to maintain sufficient safety margins.
Furthermore, Section 5.4.3 of the Fire Risk Evaluation Report describes the acceptance criteria for the safety margin evaluation to include: Fire Modeling and Plant System Performance. The guidance in NEI 04-02 Section 5.3.5.3 cites two added categories:.
PRA Logic Model and Miscellaneous. Ifthis guidance was applicable to the safety margin evaluation provide support for excluding these two additional categories in the safety margin evaluation.
RESPONSE
The DAEC Fire Risk Evaluation 0027-0042-000-004, Section 5.4.3 identified the methodology and results of the review performed related to safety margin during the fire risk evaluation process.
Fire modeling performed in support of the transition has been performed within the Fire PRA utilizing codes and standards developed by industry and NRC and/or NIST to provide more realistic results yet with some remaining conservatism. Specifically, the heat release rates utilized in the transition analysis are based upon guidance from NUREG/CR-6850, Task 8, Scoping Fire Modeling. These heat release rates are conservative and represent values used to screen out fixed ignition sources that do not pose a threat to the targets within specific fire compartments and to assign severity factors to unscreened fixed ignition sources. The combined analysis approach is used during transition (NEI 04-02, 5.3.4.3); therefore, maximum expected fire scenario/limiting fire scenario have not been analyzed separately. Fire modeling was performed using the guidance in NUREG/CR-6850, NEI 04-02, associated FAQs, and recommendations discussed in the ERIN report "Supplemental Fire PRA Methods." The bases for the application of these fire modeling codes and standards were not altered in support of this FRE.
Plant system performance parameters (e.g. heat transfer coefficients, pump performance curves, etc.) were not modified as part of the fire risk evaluations. These performance parameters were originally established to support nuclear performance criteria contained in the plant specific accident analyses. These analyses established component and system performance criteria necessary to establish safe and stable plant operation, as well as, safe shut down of the unit in the event of a fire. These performance parameters were not modified as a result of this fire risk evaluation.
Adequate safety margin is maintained for the PRA Logic Model based on conformance to industry accepted codes and standards. The specific codes and standards used in the FPRA application and development were 10 CFR 50.48(c) and NFPA 805, 2001 Rev A. Page I of 2
RAI- PRA 62 edition. In addition, the following standard was used in the development of the Fire PRA, ANS RA-Sa-2009, Addenda A to ASME/ANS RA-S-2008 Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, ASME and the American Nuclear Society, December 2008. The Nuclear Regulatory Commission (NRC) endorsed this Standard in Revision 2 of Regulatory Guide 1.200 in March 2009. An industry peer review was conducted as part of the process and any significant findings were resolved to meet the standard.
Guidance documents employed were NRC Regulatory Guide 1.205, Revision 1 and NUREG/CR-6850.
These codes and standards were applied in a manner which would provide FPRA results which contain and complement safety margin. The bases for the application of these FPRA codes and standards were not altered in support of this fire risk evaluation and therefore no plant or procedure changes were required to address safety margin.
FAQ 08-0054 removed the "miscellaneous category" from NEI 04-02, Section 5.3.5.3.
Page 2 of 2 Rev A.A. Page 2 of 2
RAI - PRA 63 DAEC RAI PRA 63 While the three echelons of defense-in-depth are discussed in LAR Attachment L and in a letter dated April 23, 2012 (ADAMs Accession No. ML12117A052) in response to Fire Protection Engineering RAI 7, neither describes the process in fire risk evaluations for ensuring that defense-in-depth is maintained. Describe the methodology that was used to evaluate defense-in-depth. The description should include what was evaluated, how the evaluations were performed, and what, if any, actions or changes to the plant or procedures were taken to maintain the philosophy of defense-in-depth. Include in the discussion the six acceptance criteria identified in Section 5.4.2 of the Fire Risk Evaluation report, which are taken from NEI 04-02 and NEI 00-01, as applicable.
RESPONSE
The DAEC Fire Risk Evaluation 0027-0042-000-004, Section 5.4.2 identified the methodology and results of the reviews performed for defense-in-depth during the fire risk evaluation process. This review of the impact was performed, using the guidance below from NEI 04-02. NFPA 805 defines DID as:
" Preventing fires from starting.
" Rapidly detecting fires and controlling and extinguishing promptly those fires that do occur, thereby limiting damage.
" Providing adequate level of fire protection for structures, systems and components important to safety; so that a fire that is not promptly extinguished will not prevent essential plant safety functions from being performed.
Each fire area was evaluated for the adequacy of DID. Documentation of these DID requirements can be on a fire area basis and/or tied directly to a VFDR disposition, as appropriate.
In accordance with NFPA 805 Section 2.4.4, Plant Change Evaluation, "...The evaluation process shall consist of an integrated assessment of the acceptability of risk, defense-in-depth, and safety margins." NFPA 805 Section 4.2.4.2 refers to the acceptance criteria in this section. Therefore fire protection systems and features required to demonstrate an adequate balance of DID are required by NFPA 805 Chapter 4.
The VFDRs and the associated Fire Area risk (CDF) and scenario consequences (CCDP values) were evaluated to identify general DID echelon imbalances. Potential methods to balance the DID features were identified ensuring an adequate balance of DID features is maintained for the Fire Area. To aid in the consistency of the review of DID, the guidance provided in Table 1 below was used in the review. These echelons cover a wide range of administrative, active and passive systems and/or features that are qualitatively reviewed against the particular risk characteristics of a fire area where their incorporation would further provide necessary mitigative effects.
The results of the fire risk evaluation reviews associated with defense-in-depth identified the need to credit recovery actions, suppression and detection systems to provide an Page 1 of 3 Rev A. Page 1 of 3
RAI - PRA 63 adequate balance of the defense in depth for each fire area and provide additional enhancements to combustible controls.
Table 1 - Considerations for Defense-in-Depth Determination Method of Providing DID Considerations Echelon 1: Prevent fires from starting
" Combustible Control Combustible and hot work controls are fundamental elements of DID
" Hot Work Control and as such are always in place. The issue to be considered during the FREs is whether this element needs to be strengthened to offset a weakness in another echelon thereby providing a reasonable balance. Considerations include:
" Creating a new Transient Free Areas
" Modifying an existing Transient Free Area The fire scenarios involved in the FRE quantitative calculation should be reviewed to determine if additional controls should be added.
Review the remaining elements of DID to ensure an over-reliance is not placed on programmatic activities to compensate for weaknesses on plant design.
Echelon 2: Rapidly detect, control and extinguish promptly those fires that do occur thereby limiting fire damage
" Detection system Automatic suppression and detection may or may not exist in the fire
" Automatic fire suppression area of concern. The issue to be considered during the FRE is whether installed suppression and or detection is required for DID or
" Portable fire extinguishers provided whether suppression/detection needs to be strengthened to offset a for the area weakness in another echelon thereby providing a reasonable
" Hose stations and hydrants provided balance. Considerations include:
for the area " Ifa fire area contains both suppression and detection and
" Fire Pre-Fire Plan fire fighting activities would be challenging, both detection and suppression may be required 2 Ifa fire area contains both suppression and detection and fire fighting activities would not be challenging, require detection and manual fire fighting (consider enhancing the pre-plans)
" If a fire area contains detection and a recovery action is required, the detection system may be required.
" If a fire area contains neither suppression nor detection and a recovery action is required, consider adding detection or suppression.
The fire scenarios involved in the FRE quantitative calculation should be reviewed to determine the types of fires and reliance on suppression should be evaluated in the area to best determine options for this element of DID.
Echelon 3: Provide adequate level of fire protection for systems and structures so that a fire will not prevent essential safety functions from being performed
" Walls, floors ceilings and structural If fires occur and they are not rapidly detected and promptly elements are rated or have been extinguished, the third echelon of DID would be relied upon. The evaluated as adequate for the issue to be considered during the FRE is whether existing separation hazard. is adequate or whether additional measures (e.g., supplemental
" Penetrations in the fire area barrier barriers, fire rated cable, or recovery actions) are required offset a are rated or have been evaluated as weakness in another echelon thereby providing a reasonable adequate for the hazard. balance. Considerations include:
Rev A. Page 2 of 3
RAI - PRA 63 Table 1 - Considerations for Defense-in-Depth Determination Method of Providing DID Considerations
" Supplemental barriers (e.g., ERFBS,
- If the VFDR is never affected in the same fire scenario, cable tray covers, combustible liquid internal fire area separation may be adequate and no dikes/drains, etc.) additional reliance on recovery actions is necessary.
" Fire rated cable . If the VFDR is affected in the same fire scenario, internal fire
" Reactor coolant pump oil collection area separation may not be adequate and reliance on a system (as applicable) recovery action may be necessary.
" Guidance provided to operations 0 If the consequence associated with the VFDRs is high personnel detailing the required regardless of whether it is in the same scenario, a recovery success path(s) including recovery action and / or reliance on supplemental barriers should be actions to achieve nuclear safety considered.
performance criteria.
- There are known modeling differences between a Fire PRA and nuclear safety capability assessment due to different success criteria, end states, etc. Although a VFDR may be associated with a function that is not considered a significant contribution to core damage frequency, the VFDR may be considered important enough to the NSCA to retain as a recovery action.
The fire scenarios involved in the FRE quantitative calculation should be reviewed to determine the fires evaluated and the consequence in the area to best determine options for this element of DID.
Page 3 of 3 Rev A. Page 3 of 3
RAI - PRA 64 DAEC RAI PRA 64 Describe how core damage frequency (CDF) and large early release frequency (LERF) are estimated in main control room (MCR) abandonment scenarios. Do any fires outside of the MCR cause MCR abandonment because of loss of control and/or loss of control room habitability? Are "screening" values for post MCR abandonment used (e.g., CCDP of failure to successfully switch control to the Primary Control Station and achieve safe shutdown of 0.1) or have detailed human error analyses been completed for this activity. Justify any screening value used. The justification should provide the results of the human failure event (HFE) quantification process described in Section 5 of NUREG-1921, including the following:
- a. The results of the feasibility assessment of the operator action(s) associated with the HFEs, specifically addressing each of the criteria discussed in Section 4.3 of NUREG-1921.
- b. The results of the process in Section 5.2.8 of NUREG-1921 for assigning scoping human error probabilities (HEPs) to actions associated with the use of alternate shutdown, specifically addressing the basis for the answers to each of the questions asked in the Figure 5-5 flowchart.
- c. The results of a detailed human reliability analysis (HRA) quantification, per Section 5.3 of NUREG-1921, if the screening CCDP is determined to not be bounding.
RESPONSE
Section 5.2.2 of the Fire Scenario Report, 0493080001.003, Rev. 4, discusses the review of fire scenarios outside the MCR for the potential of MCR abandonment because of loss of control or habitability. The review did not identify fire scenarios outside the MCR that would result in MCR abandonment because of loss of control or habitability.
Section 5.2.4 and Table 5.2-5 of the Fire Scenario Report discuss and identify the parameters used in estimating the MCR abandonment scenarios CDF and LERF. The discussion includes the process used to assign a CCDP for each scenario. The alternate shutdown capability at DAEC consists of a single division which includes Division 2 Core Spray and RHR and power supplied from Standby Diesel Generator (SBDG) 1G-21.
The abandonment scenarios postulate that all equipment is failed other than those components associated with alternate shutdown capability (ASC). These components are further analyzed to determine if fire impacts could potentially challenge the operators successfully shutting down using the current ASC procedures. Therefore, the impact of a fire resulting in abandonment is characterized by one of the following conditional core damage probabilities:
Page 1 of 5 A.
Rev A. Page I of 5
- 1. A 0.1 CCDP is applied if a fire does not impact ASC equipment or the equipment is available upon transfer at a primary control station (PCS). The CCDP for a single success path without offsite power is used and is based on postulated essential switchgear room fires.
- 2. A conditional spurious probability is applied if a fault impacts ASC equipment and is not recoverable at the PCS based on the current design and procedures. This value would be equal to the likelihood of occurrence using the hot short-induced spurious operation probabilities.
- 3. A 1.0 CCDP is applied if a single or multiple hot short-induced spurious operations (MSO) impacts ASC equipment and is considered not recoverable by ASC based on the current design and procedures. For instance, a MSO could result in an inventory loss greater than the assumed one spurious open relief valve used as the design criteria.
Detailed HRA was performed to ensure the CCDP of 0.1 was appropriate when considering operator actions to establish ASC and ASC equipment was not postulated to be affected by the fire. To establish ASC, most operator actions occur at a primary control station (PCS). Operator actions to establish ASC that do not occur at a PCS were reviewed. The operator action to start the SBDG is not performed at a PCS.
Given loss of offsite power, the SBDG would be required for RPV injection. Per AOP-915, transfer of control is required to be completed within 20 minutes. Therefore, detailed HRA for the action was performed using a 20 minute time window and resulted in an HEP of 0.05 (basic event FSBDG1 G21 -START-HE--). Therefore, the CCDP of 0.1 bounded the operator actions to establish alternate shutdown.
- a. Per Section 4.3 of NUREG-1 921 (Final, issued July 2012), certain basic needs are required to be met in order to credit an action. In particular, these are: cues, procedure direction, training, necessary tools, and sufficient time. As given in of this RAI response, FSBDG1G21-START-HE-- has a cue and procedure direction provided by procedure step 7 (Perform Attachment 7) of AOP 915, SHUTDOWN OUTSIDE CONTROL ROOM. The operators train on Main Control Room Abandonment as part of their initial license and license requalification training. The only tools required for Attachment 7 of AOP 915 are access keys and AOP 915 step 6 directs that a licensed operator take the appropriate keys and establish control at panel 1C388. Finally, there is sufficient time to successfully complete the action.
Section 4.3 of NUREG-1921 also notes that ASME/ANS PRA Standard Supporting Requirement HR-H2 provides the conditions under which credit can be given, but this credit should be addressed as part of the quantification of a detailed analysis using the guidance in Appendix B or Appendix C of NUREG-1921. (Note that the detailed HEP Calculation method used for DAEC was based on Appendix C of the draft version of NUREG-1921 (issued in November 2009). This guidance is similar to that provided in the Appendix B of the final version of NUREG-1921.) An evaluation of the FSBDG1G21-START-HE-- HEP calculation against Appendix B of NUREG-1921 (detailed EPRI method) is provided after the ASME SR discussion below.
Rev A. Page 2 of 5
RAI - PRA 64 Per SR HR-H2 in the ASME PRA Standard:
SR HR-H2 CREDIT operatorrecovery actions only if, on a plant-specific basis, the following occur.
(a) a procedure is availableand operatortraining has included the action as part of crew's training, orjustification for the omission for one or both is provided (b) "cues"(e.g., alarms) that alert the operator to the recovery action provided procedure, training, or skill of the craft exist (c) attention is given to the relevantperformance shaping factors provided in HR-G3 (d) there is sufficient manpower to perform the action.
As discussed above, AOP 915 provides both a cue and procedure direction for the action. As for manpower, DAEC procedure ACP 1410.1 (OPERATIONS WORKING STANDARDS, Rev 95) directs that when the reactor is in Mode 1, 2, or 3, the minimum Operating Crew shall consist of an Operations Shift Manager and a Control Room Supervisor (SRO required), a Shift Technical Advisor, a Nuclear Station Operating Engineering (RO required), two Assistant Nuclear Station Operating Engineers (RO required), a Second Assistant Nuclear Station Operating Engineer (SANSOE), and a Nuclear Station Auxiliary Operator (NSAO).
The Extra Assistant Nuclear Station Operating Engineer (EANSOE) is administratively required on each operating crew and provides for assisting the SANSOE and NSAO in performance of their duties without reducing the Control Room staffing required by Technical Specifications. Either the ANSOE or the EANSOE shall be the Fire Brigade Leader. This normally should be the EANSOE. The Fire Brigade Leader and Operator at the Controls shall be separate individuals. As the staffing requirements of ACP 1410.1 ensure that three ROs are on shift in Modes 1, 2, or 3, the loss of a single RO to fulfill the responsibilities of Fire Brigade Leader will allow two ROs to address plant response and control. One of these ROs is available to address OPS responsibilities at panel 1C388.
SR HR-G3 When estimating HEPs EVALUATE the impact of the following plant-specific and scenario-specificperformance shaping factors:
(a) quality [type (classroom or simulator)and frequency] of the operatortraining or experience (b) quality of the written proceduresand administrativecontrols (c) availabilityof instrumentationneeded to take corrective actions Page 3 of 5 Rev A. Page 3 of 5
RAI - PRA 64 (d) degree of clarity of the cues/indications (e) human-machine interface (0 time availableand time required to complete the response (g) complexity of the required response (h) environment (e.g., lighting, heat, radiation)under which the operatoris working (i) accessibilityof the equipment requiring manipulation
() necessity, adequacy, and availability of special tools, parts,clothing, etc.
These items are addressed as follows:
a) The DAEC operators train on Main Control Room Abandonment via the classroom on an annual basis.
b) AOP 915, SHUTDOWN OUTSIDE CONTROL ROOM, does not contain ambiguous language and the operators have all the procedure direction they need to successfully complete the action.
c) Indications at 1C388 remain available for fires that require control room abandonment.
d) The cues for starting SBDG 1G-21 (1A4 status and AOP 915 Section 7 direction) are clear and available.
e) The interface between the operator and the controls at 1C94 and 1C388 facilitates execution of the action.
f) There is sufficient time to complete this action.
g) The action involves only simple control switch manipulations and display verifications.
h) The PSFs are assessed as negative because of the expected increase in operator stress due to MCR abandonment but they do not prevent successful completion of the action.
i) Fires that require MCR abandonment would not prevent access to 1C94 and 1C388.
j) The only tools required for this action are access keys which AOP 915 directs the RO to obtain prior to leaving the Control Room.
Most of the requirements listed in Appendix B of NUREG-1921 (Detailed Quantification of Fire Human Failure Events Using the EPRI Fire Methodology) are already addressed Rev A. Page 4 of 5
RAI - PRA 64 in the above discussion, such as adequate cues, procedures, manpower, and timing.
CBDTM selections made for the FSBDG1 G21 -START-HE--action were made in accordance with the guidance listed in Table B-9 and as documented in the detailed calculation in Attachment 1. A notable difference between the Table B-9 guidance and the detailed calculation is the evaluation of Pcd, Information Misleading. Although Table B-9 suggests the selection of the "no" branch for "all cues as stated" only if the instrumentation is fully impacted by fire, the DAEC HRA routinely uses the "yes" branch to indicate potential partial instrumentation impacts. This is a more conservative approach which results in a higher unrecovered Pcd value.
- c. A screening CCDP was not applied as a detailed HEP was developed in general agreement with the then-current version of NUREG-1 921 as discussed previously.
Section 5.3 of NUREG-1 921 provides the use of the EPRI HRA Approach as a detailed HRA quantification option (as presented in Appendix B of NUREG-1921 issued in Final).
The EPRI HRA approach was used to perform detailed HRA. Table E-5 of the Fire Scenario Report provides the results of the detailed HRA based on the HRA Calculator.
The basic event to locally start the diesel generator is FSBDG1G21-START-HE-- and has a HEP of 0.05. The detailed HEP calculation for FSBDG1G21-START-HE-- is provided as Attachment 1.
Page 5 of 5 Rev A.
A. Page 5 of 5
FSBDGIG21-START-HE--, OPERATOR FAILS TO START SBDG 1G-21 FROM LOCAL PANEL 1C94 Basic Event Summary Ve _______HEP Siimmrar.-iNo ý Pcog Pexe Total HEP Error I Factor Method CBDTM + ASEP THERP CBDTM + ASEP + THERP Without Recovery 1.4e-02 + 1.OE-2 7.0e-02 With Recovery 8.6e-3 + 1.0e-2 3.2e-02 5.0e-02 5 Initial Cue:
Procedure step 7, Attachment 7 of AOP 915
Dearee of Clarity of Cues & Indications:
Very Good Procedures:
Cognitive: AOP 915 (SHUTDOWN OUTSIDE CONTROL ROOM) Revision: 36 Execution: AOP 915 (SHUTDOWN OUTSIDE CONTROL ROOM) Revision: 36 Cognitive Procedure:
Step: 7 Instruction: When transfers are complete, perform the following sections concurrently: Attachment 7 (perform immediately if 1A4 de-energized)
Training:.
Classroom, Frequency: 1 per year 1 of 13
Identification and Definition:
This action addresses the restoration of power to 4160 Bus 1A4 via SBDG 1G-21 using remote control panel 1C94 and 1C388 per AOP 915, "Shutdown Outside Control Room." AOP 915 is entered when conditions exist that threaten Control Room habitability. These areas include the Cable Spreading Room, Control Room, and Control Building HVAC Room. AOP 915 is expected to be entered if fire is detected anywhere in the Control Room, if fire compromises the function of any safety related systems required to achieve or maintain cold shutdown, or if the CRS determines that evacuation of the Control Room may be required.
Per the Section G2 (DIV 2 AC Power) Compliance Assessment Summary for Fire Area CB1 (CAL-E96-011 Rev 12), regardless of the potential spurious operations and the status of breakers 152-401 and 152-402, the EDG must be demonstrated to provide power to 1A4 within 20 minutes. The worst case scenario of a complete loss of offsite power with the need for EDG 1G21 operation was evaluated. The action includes transfer of control of breakers 152-401, 152-402, and 152-411 to the ASC.
When control has been shifted to panel 1C388:
SBDG 1G-21 will not automatically start and power bus 1A4 on a loss of power.
Automatic load shed and sequencing of loads onto Bus 1A4 will not occur.
Manpower Requirements:
Crew~embe# iv~ J.~tIvia~~Y 9nldd~ quiredli Noes~
o.
Chemistry Technicians Yes 1 0 Shift Manager Yes 1 0 Shift Supervisor Yes 1 0 STA Yes 1 0 Reactor operators Yes 3 1 Plant operators Yes 2 1 Mechanics Yes 2 0 Electricians Yes 2 0 I&C Technicians Yes 2 0 Health Physics Technicians Yes 2 0 2 of 13
Execution Performance Shaping Factors:
Environment: Lighting Emergency Heat/Humidity Normal Radiation Background Atmosphere Normal Special Requirements: Tools (keys) Required Adequate Available Complexity of Response: Cognitive Simple Execution Simple Equipment Accessibility: Local Panel 1C388 Accessible 1C388 and 1C94 Accessible Stress: High PlantResponse As Expected: Yes Workload: High Performance Shaping Factors: Negative Performance Shaping Factor Notes:
The PSFs are potentially negative due to evacuation from the main control room and use of remote shutdown panels and the operator workload is high with limited time available for recovery.
Per step 6 of AOP 915, "One Licensed operator evacuate the Control Room with the following items:
- 1C388 Access Keys (#1)
- Fire Key Ring (If not taken by Fire Brigade Leader)
- Radio AND Proceed to Remote Shutdown Panel 1C388 AND Perform Step (9) of this procedure."
3 of 13
Timin-g:
T 20.00 Minutes Tdelay 5.00 Minutes I TI/2 0.00 Minutes T 5.00 Minutes
.I Irreversible Cue DarnageState I I 4
t=O Timingq Analysis:
Tsw: Per the Section G2 (DIV 2 AC Power) Compliance Assessment Summary for Fire Area CB1 (CAL-E96-011 Rev 12), regardless of the potential spurious operations and the status of breakers 152-401 and 152-402, the EDG must be demonstrated to provide power to 1A4 within 20 minutes.
Operator cue (Tdelay): Because of multiple equipment power loss indications and loss of electrical bus indications, the operators are expected to recognize the loss of bus 1A4 prior to evacuating the main control room. Tdelay assigned at 5 minutes.
TM: Transfer of control to 1C388, travel to 1C94 and 1C388, and reenergizing bus 1A4 is estimated to take 5 minutes.
Time available for cognition and recovery: 10.00 Minutes Time available for recovery: 10.00 Minutes SPAR-H Available time (cognitive): 10.00 Minutes SPAR-H Available time (execution) ratio: 3.00 Minimum level of dependence for recovery: HD 4 of 13
Cognitive Unrecovered FSBDGIG21-START-HE--
Table 1: FSBDGlG21-START-HE-- COGNITIVE UNRECOVERED Pc,: Availability of Information a neg.
PCb: Failure of Attention i neg.
Pcc: Misread/miscommunicate data a neg.
PCd: Information misleading b 3.0e-03 PCe: Skip a step in procedure 9 6.0e-03 Pcf: Misinterpret instruction b 3.0e-03 Pc,: Misinterpret decision logic e 2.0e-03 PCh: Deliberate violation a neg.
Sum of PCa through PCh = Initial Pc = 1.4e-02 5 of 13
pca: Availability of information Indication Avail in CR Indication Warning/Alternate Training on CR Accurate in Procedure Indicators 1.Oe-T1 - (a) neg.
(b) neg.
1.0e+00 (c) neg.
f.O.e-01 Yes0 0010(d) 1.5e-03 Yes [(e) 5.0e-02 o1.0e+00 I,0e+O0 (f) 5.0e-01 (g) a.oe+oo 1.0e+00 Loss of Bus 1A4 would be evidenced by loss of electrical bus indications and multiple equipment power losses.
The MCR instruments not damaged by fire remain accurate. Partial loss of instrumentation due to fire is addressed in CBDTM element Pcd below.
N/A The operators have been trained on all MCR and remote shutdown panel instruments.
pcb: Failure of attention Low vs. Hi Check vs. Monitor Front vs. Back Alarmed vs.Not Workload Panel Alarmed Check 10.0e+O00()ng rot(a) neg.
O.Oe+0O Back (b) 1.5e-04 Low 3.0e-03 1.0e+00 (c) 3.0e-03 1.0e+O0 Front 5.0e-02 (d) 1.5e-04 Monitor O.Oe'ieO (e) 3.0e-03 3.0e-03 [Back {5.0e-02 (f) 3.0e.-04
- 1. Ch ice 3.0e-03 (g) O.0e-03
- 2. Ch ice Front -5.0e-02 (h) neg.
Check i0.0e-oO -O-1.0e+00 - (i) neg.
O.OeUaBack 5.0e-02 () 7.5e-04 High 3.0e.03 (k) 1.5e-02 5.e+Front (I) 7.5e-04 Monitor O.Ce+00 1.0e+00 (m) 1.5e-02 3.0e-03 Back .(n) 1.5e-03 3.0e-03 1.0e+00 (o) 3.0e-02 The operator workload would be high, Loss of Bus 1A4 only needs to be checked to recognize the need for this action.
The indicators are on a front panel.
Alarms are not credited for FPRA.
6 of 13
pcc: Misreadlmiscommunicate data Indicators Easy to Good/Bad Indicator Formal Locate Communications 0.0e-00 (a) neg.
Yes 0.Me+0 F0.01+0 1.0e-03 3.Oe-03 0.0e+00 3.0e-03 (b) 3.0e-03 (c) 1.0e-03 (d) 4.0e-03 No 0.0e+00 (e) 3.0e-03 3.0e-03 (f) 6.0e-03 3.0e-.03 0.0e+00 (g) 4.0e-03 1.0e-03 3.0e-03 (h) 7.0e-03 Loss of 1A4 indications are easy to locate.
The indications are straightforward and easy to read.
Formal Operations communications are required.
pcd: Information misleading All Cues as Stated Warning of Specific Training General Training Differences (a) neg.
Yes 0.0e+00 (b) 3.0e-03 No '¶.Oe+00 3e0 3-3 1.0e-02 (c) 1.0e-02 1.0e+00 1.0e-01 (d) 1.0e-01 1.0e400 1.0e+00 (e) 1.0e+00 Secondary cues and indications not directly applicable to the operator action under consideration could be inaccurate as a result of fire impacts. Therefore, not all cues are as stated.
The DAEC fire area procedures warn of the potential fire impacts on the associated MCR indications.
7 of 13
pce: Skip a step in procedure Obvious vs. Single vs. Multiple Graphically Placekeeping Aids Hidden Distinct 3.0e-03 (a) 1.0e-03 3e11.0e-02 (b) 3.0e-03 0.Oe+00 i 3.0e-03 (c) 3.0e-03
.0e+00 .0e(d) 1.Oe-02 3.Oe+0O 3.0e-03 (e) 2.Oe-03 Yes - - - - - - - -- 1 e02 (f) 4.0e-03 No 3.0e (g) 6.0e-03 1.0e-02 1.0e-02 (h) 1.3e-02 (i) 1.0e-G1 1.0e-01 The AOP contains the information required to address the loss of 1A4. This is not considered to be "hidden" guidance.
The operators are working with AOP 915 and AOP 913 at a minimum.
The steps for 1A4 re-energize are not graphically distinct.
There are place keeping aids in the AOPs.
pcf: Misinterpret instruction Standard or All Required Training on Step Ambiguous wording Information O.Oe+0 (a) neg.
.OFe+-0 -- 1.Oe-1 (b) 3.0e-03 Ys3.0e-02 10 00(c) 3.0e,.02 No 00e+0 1.0-01(d) 3.0e-03
. +1.0e,0 (e) 3.0e-02 3.0e-02 1(f) 6.0e-03 3.0e-02 (g) 6.0e-02 1.0e+00 The procedure wording is standard and straightforward.
The operators might not, however, be alerted to the need to conduct this action immediately as multiple early AOP 915 caution notes state that local control must be established within 20 minutes, however, 20 minutes is the entire system window for this action, which includes transfer of control and reenergizing 1A4 via EDG 1G-21. If 1A4 is lost, the need to control essential power immediately is directed in step 12 located on page 11 of AOP 915. By the time the operators reach that step, the procedure could indicate success in transferring control but bus 1A4 would not have been energized within 20 minutes.
The operators indicated in interviews that they were well aware of this requirement in spite of the apparent lack of direct procedure guidance as to the need to align 1A4 within 20 minutes.
8 of 13
pcg: Misinterpret decision logic "NOT" Statement "AND" or "OR" Both "AND" & Practiced Scenario Statement "OR" I 3.3e-01 (a) 1.6e-02 3e21.0e+00 (b) 4.9e-02 1.2e-0)2 13.3e-01 (c) 6.0e-03 (d) 1.9e-02 S..Oe--03
-01 - (e) 2.0e-03 Yes 1.Oe÷O0 (f) 6.0e-03 No i.0e.00 (g) 1.Oe-02 No3.0e-02
_0 (h) 3.le-02 1.0e-03 .(i) 3.0e-04
.0) 1.0e-03 0.e00O.e+
(k) neg.
3.3e-01 0.Oe+0 (I) neg.
There are no NOT, AND or OR statements in the decision logic for this action.
The operators have practices to reenergize 1A4 from 1C388 via EDG 1G-21.
pch: Deliberate violation Belief in Adequacy Adverse Reasonable Policy of of Instruction Consequence if Alternatives 'Verbatim"
-. Oe+O0V - -(a) neg.
s5.0e-01 (b) 5.Oe-01 No0 1.0e+00 1.0e+00 (c) 1.0e+O0 1.0e+O0 0.0e+00 (d) neg.
O.Oe+O0 (e) neg.
The DAEC operators believe their procedure instructions are adequate.
9 of 13
EPRI HRA Calculator 4.1.1 CBDTM Cognitive Recovery FSBDG1G21-START-HE--
Table 2: FSBDGlG21-START-HE-- COGNITIVE RECOVERY
.......- am "oo1 0l. Initial HEP -6 '5 co - >-> VauFinal
., a) W, co a w) Value Ma, neg. -. . . .1.0e+O0 P Vý.' neg. . - . . .1.0e+O0 neg. 1.0e+00 i 3.0e-03 . . . . . 1.0e+00 3.0e-03
_P, 6q e-03 X . . . . 1.0e-01 6.0e-04 P- 3.0e-03 - 1.0e+Oe 3.0e-03
,. 2.0e-03 - 1.0e+O0 2.0e-03 P neg. - - - - 1.0e+O0 Notes:
Because of the limited time available for recovery, only "self-review" is credited.
ASEP Cognitive Nominal Diagnosis Model In order to compensate for possible non-conservative estimates produced by the cause-based method for short term actions (Time available for recovery <1 hour), the cognitive failure probability for short term actions is taken to be the sum of the cause-based method and ASEP results; longer term actions do not include the ASEP component.
Use Lower Bound because the event is a well-recognized classic (e.g., TMI-2 incident), and the operators have practiced the event in the simulator requalification exercises, and the talk-through and interviews indicate that all the operators have a good verbal recognition of the relevant stimulus patterns and know what to do or which written procedures to follow.
Actual Time Median HEP Mean Upper Bound Lower Bound 10.0 minutes 1.0e-01 3.0e-01 1.0e+00 1.0e-02 Notes/Assumptions: The loss of 1A4 is expected to be clearly indicated. While this action takes place at a remote shutdown panel, the operators recognize the need to maintain 1A4 energized via 1G-21 as a primary goal in the fire event recovery.
10 of 13
EPRI HRA Calculator 4.1.1 Execution Unrecovered FSBDG1G21-START-HE--
Table 3: FSBDGIG21-START-HE-- EXECUTION UNRECOVERED Pro7It trs Over Ride' St:Nu&6'o.o lrff. roX THERP zF ';
M--1ZA-. 5iyp 'Table te:
VERIFY OPEN breakers 1A401 and 1A402 Location: 1C388 EOM 20-7b 1 4.3E-4 EOC 20-12 3 1.3E-3 5 2.a. EOC 20-12 8a 2.7E-4 EOC 20-12 3 1.3E-3 EOC 20-12 8a 2.7E-4 Total Step HEP 1.8e-02 VERIFY the following pump hand switches are OPEN Location: 1C388 EOM 20-7b 1 4.3E-4 CORE SPRAY PUMP 1- 211B EOC 20-12 3 1.3E-3 EOC 20-12 8a 2.7E-4 EOC 20-12 3 1.3E-3 2.b. CD assigned between RHR and RHRSW pump breaker hand switches:
B RHR PUMP 1 P229B, D RHR PUMP 1P229D, B RHRSW Pump 1P22B D RHRSW Pump 1P22D as they are located on the same panel in one horizontal line.
EOC 20-12 8a 2.7E-4 Total Step HEP 1.8e-02 Place the SYNCH SELECTOR SWITCH 125 1A4/SS to the 1G21 position to establish 1G-21 as the incoming power source.
Location: 1C388 EOM 20-7b 1 4.3E-4 5 2.c. EOC 20-12 la neg.
EOC 20-12 8a 2.7E-4 Total Step HEP 3.5e-03 Start diesel generator 1G 21 locally by momentarily placing HS-3232B, ENGINE MODE SEL SW, on Panel 1C94 to the START position.
Location: 1C94 EOM 20-7b 1 4.3E-4 5 2.d. EOC 20-12 la neg.
EOC 20-12 8a 2.7E-4 Total Step HEP 3.5e-03 11 of 13
.0cdre~O KISUTDW OUSD OTROL ROM.:omnnt Verify incoming voltage and EDG frequency Location: 1C388 EOM 20-7b 1 4.3E-4 2.e. EOC 20-11 2 13E-3 EOC 20-11 2 1.3E-3 Total Step HEP 1.5e-02 CLOSE 4 kV breaker 1A411 B DG 1G-21 to BUS 1A4 Location: 1C388 EOM 20-7b 1 4.3E-4 2.f. EOC 20-12 3 1.3E-3 EOC 20-12 8a 2.7E-4 Total Step HEP 1.0e-02 Verify that 4160 BUS 1A4 power available lights are on Location: 1C388 EOM 20-7b 1 4.3E-4 5 Display selection error is considered negligible. EOC 20-11 7 neg.
Total Step HEP 2.2e-03 Verify EMER SW PUMP 1P 99B running.
Location: 1C388 EOM 20-7b 1 4.3E-4 2.h EOC 20-12 3 1.3E-3 EOC 20-12 8a 2.7E-4 Total Step HEP 1.0e-02 Verify ESW red pump running indicating light I Location: 1C388 EOM 20-7b 1 4.3E-4 Self-Review Display selection error considered negligible as it is located directly EOC 20-11 7 neg.
above the pump control switch.
Total Step HEP 2.2e-03 12 of 13
EPRI HRA Calculator 4.1.1 Execution Recovery FSBDG1G21-START-HE--
Table 4: FSBDGlG21-START-HE-- EXECUTION RECOVERY
-'Sca
-Xr Se,.,.ttN ep.Acir~.
owg.
R ,,v . ., . o . . HEP'(Crit)` ,HEP (Rec) DpE . .. _________e (Rec)wý J'.!!: _
2.a. VERIFY OPEN breakers 1A401 and IA402 1.8e-02 9.1e-03 2.e. Verify incoming voltage and EDG frequency 1.5e-02 HD 5.1e-01 2.b. VERIFY the following pump hand switches are OPEN 1.8e-02 9.1e-03 2.e. Verify incoming voltage and EDG frequency 1.5e-02 HD 5.1e-01 2.c. Place the SYNCH SELECTOR SWITCH 125 1A4/SS to the 1G21 3.5e-03 I.8e-03 position to establish IG-21 as the incoming power source.
2.e. Verify incoming voltage and EDG frequency 1.5e-02 HD 5.1e-01 2.d. Start diesel generator 1G 21 locally by momentarily placing HS-3232B, ENGINE MODE SEL SW, on Panel 1C94 to the 3.5e-03 1.8e-03 START position.
2.e. Verify incoming voltage and EDG frequency 1.5e-02 HD 5.1e-01 2.f. CLOSE 4 kV breaker 1A411 B DG IG-21 to BUS 1A4 1.0e-02 5.0e-03 2.f as recovery Verify that 4160 BUS 1A4 power available lights are on 2.2e-03 HD 5.0e-01 2.h Verify EMER SW PUMP IP 99B running. 1.0e-02 5.0e-03 Self-Review Verify ESW red pump running indicating light 2.2e-03 HD 5.0e-01 __ 3.26__N i-0 Ttal Unrecovered: I 6.3e02 : . Total Recovered: 32-2 13 of 13