Text

Submittal of Additional Information Concerning Auxiliary Feedwater Orifice Regulatory Conference
	ML031820744
Person / Time
Site:	Point Beach
Issue date:	06/27/2003
From:	Cayia A; Nuclear Management Co
To:	Dyer J; Region 3 Administrator
References
	NRC-2003-0059
	Download: ML031820744 (144)
	v • d • e

NMC)

Committed to Nuclear Excellence /

Operated by Nuclear Management Company, LLC Point Beach Nuclear Plant NRC 2003-0059 June 27,2003 Mr. J. E. Dyer, Regional Administrator U. S. Nuclear Regulatory Commission Region Ill 801 Warrenville Road Lisle, IL 60532-4351 DOCKET NUMBERS 50-266 AND 50-301 POINT BEACH NUCLEAR PLANT, UNITS 1 AND 2 SUBMITTAL OF ADDITIONAL INFORMATION CONCERNING AUXILIARY FEEDWATER ORIFICE REGULATORY CONFERENCE

Dear Mr. Dyer:

On June 6, 2003, a regulatory conference was conducted between representatives of the Nuclear Management Company, LLC (NMC) and members of your Staff to discuss the Auxiliary Feedwater Orifice Issue at Point Beach Nuclear Plant (PBNP). During the presentation, a several questions were raised regarding information presented or discussed during the conference. The majority of these questions were related to the preliminary probabilistic risk assessment (PRA) NMC is presently working on. Although we do not anticipate completion of this assessment until later this summer, NMC agreed to present additional information concerning these preliminary results. Attached and enclosed with this letter are answers to the specific questions asked at the conference and preliminary information concerning the PRA assessment. As discussed at the conference, and confirmed in a telephone call between your G. Grant and M. Reddemann on June 19, 2003, we agreed to provided this information by June 27,2003.

If you have any questions, please contact Gordon P. Arent at 920/755-6518.

GPddmd Enclosure 6590 Nuclear Road Two Rivers, Wisconsin 54241 Telephone: 920.755.2321

NRC 2003-0059 June 27,2003

Attachment:

1. Response to Questions from the June 6, 2003 Regulatory Conference

2. Qualification of the Risk Increase Point Beach AFW Orifice Issue (Preliminary)

3. Calculation of Availability/Reliability of the Water Treatment System (Final)

4. Hydraulic Calculation for Injecting Low-Pressure Water into the Steam Generators (Final)

5. Summary of MAAP Analysis (Preliminary)

6. Summary of Human Error Analysis (Preliminary) cc:

(with enclosure) cc:

(w/o enclosure)

S. Burgess, Senior Reactor Analyst, NRC Region Ill T. Vegel, PBNP Branch Chief, NRC Region Ill Mr. M. Kunowski, Project Engineer, NRC Region Ill NRC Resident Inspector - Point Beach Nuclear Plant PSCW

ATTACHMENT 1 Response to Questions Made During the Regulatory Conference Held on June 6,2003 POINT BEACH NUCLEAR PLANT, UNITS 1 AND 2

NRC 2002-0059 Page 1 of 7 1. Please provide specific information on the Enhance Understanding of System, Design and Accident Progression training being provided to Engineering and Operations.

Enqineerinu Traininq There is training planned to review the final configuration of all the AFW modifications. This training includes the identification of the safety portion of the system. This is in the Engineering Curriculum Review Committees for review and is not currently scheduled due to the flux of changes being made.

Section 3 of Chapter 14 of the FSAR, Accident Analysis, which covers large and small break LOCAs was completed on June 12, 2003. There are a few that have not completed the training and are being tracked via remediation forms. Remediation will consist of reviewing a videotaped classroom presentation, questions with the instructor, and an evaluation. Another section of Chapter 14 is scheduled in December.

Operability Determination Training is scheduled for every Tuesday starting July 8 and ending August 12 (two sessions on July 15). The Licensed Senior Reactor Operators, Certified Senior Reactor Operators, and those Engineers who have or wish to have Operability Determination qualifications have been invited. The pilot for this session was completed on June 26, 2003.

A Modifications training session was provided during the roll out of the Fleet Modification process to all design engineers. The topic of procedural adherence was reinforced. Future qualifications for those engineers who perform modifications is linked to this training. This training was completed in March 2003.

Human Error Avoidance training was provided to the Engineering staff to assist in self-checking and questioning attitudes (QV & V) during April and May of 2003.

50.59-refresher training is in the planning stage, but has not yet been scheduled. This will incorporate Engineers and Operators.

Operations Training The Operation Department has had training on the implications these modification as they were being incorporated in the plant. This training has been through standard and routine classroom training and on the Simulator. Just in Time Training (JITT) has been used to ensure that all of the crews understand the procedural requirements and system responses as the modifications were made.

BR-91-143 - Simulator briefing on how to operate AFW under the new procedural requirements.

LP 3627 AFW system review given in cycle 02-01 Simulator Guide (SG) 96 - Loss of Instrument Air and affects on A M

were discussed LP 3648 - Recirculation issues discussed in cycle 02-02 LP 371 9 - Recirculation changes associated with removing internal to a check valve Briefing 02-1 57 - On shift brief regarding AFW operational changes Entry for October 31 regarding AFW recirc issues JITT briefing for Emergency AFW issues on November 2002 (BR02-155)

Briefing 02-1 80 - Recirculation issues briefing provided (Thanksgiving week) Ops Notebook SG Provided in cycle 03-01 for ruptured/Faulted Steam Generator and operators action while using AFW.

NRC 2002-0059 Page 2 of 7 LP 3735 - AFW issues - Reviewed the status of the AFW system (1.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months )

SG-123 - Loss of IA - AFW aspects were evaluated. (Cycle 03-02)

BR-03-084 - Briefing on AFW. (Cycle 03-02)

SG-0122 - Loss of AC and the AFW effects were discussed. (Cycle 03-02)

SG-0126 - Instrument Bus malfunctions - AFW Recirculation requirements were discussed.

(Cycle 03-03)

LP 3757 AFW review - Updated the crews on the status of AFW (Cycle 03-03)

2. How does Point Beach calculate the reliability and availability of the Water Treatment System. Please provide availability data specifically covering the period of concern (partial system unavailability included).

The calculation for Water Treatment availability and reliability is provided in Attachment 3.

3. Provide the numbers for the internal events and seismic profiles. Include the instantaneous risk values.

Over the I year period considered in the risk evaluation two AFW pump recirculation orifice configurations were considered. First was the period of time where only the motor driven pumps had the modification orifices. The instantaneous plant risk increase during this period was 1. I 1 E-5/yr. Second was the period of time where both the motor driven and turbine driven pumps had the modified orifices. For this period of time, the instantaneous risk increase was 1.16E-4/yr. These values include internal events and seismic. These values are preliminary and will be re-evaluated upon completion of the verification/validation of the evaluation and completion of the fire risk significance.

The qualification methodology used to establish the plant risk described above is provided in.

4. Please provide details and hydraulic analysis for capability to supply adequate Steam Generator (S/G) flow from Service Water or Fire Water with a disabled AFW pump. Did you consider clearances in the stalled AFW pumps and the strainer sizes in both the Service Wafer and Fire Water system.

The hydraulics analysis developed to determine the ability to supply low pressure water to the steam generators is provided in Attachment 4.

NRC 2002-0059 Page 3 of 7

5. Was the SQUG methodology used for the Condensate Storage Tank (CST) seismic fagility? If not, what type was done?

The CSTs capacity calculation followed the SQUG methodology as contained in Section 7 of the Generic Implementation Procedure (GIP) with the single exception of the allowable buckling stress knockdown factor. It is noteworthy to explain that the GIP (SQUG Methodology) is used for design basis assessments in resolving the issues addressed by US1 A-46, and that the CST is not part of the Point Beach A-46 safe shutdown equipment list (SSEL). The GIP methodology would call for a knockdown factor of 0.72 while the EPRI Report NP-6041-SL, A Methodology for Assessment of Nuclear Power Plant Seismic Margin (Revision I), Section H, which applies almost the identical methodology to the GIP methodology, calls for 0.90 as the knockdown factor for purposes of fragility calculations that are used for probabilistic assessments in calculating beyond design basis capacities. Had the CST been deterministically evaluated for the A-46 design basis assessment, its calculated seismic capacity would exceed the Point Beach design basis Safe Shutdown Earthquake (SSE), which is a 0.12 g peak ground acceleration (PGA) event, with more than a 50% margin using the aforementioned 0.72 knockdown; however, this was not formally calculated since the CST is not part of the Point Beach A-46 SSEL component population as previously stated. Additionally, the tanks damping was conservatively set at 4% of critical damping, as called for by the GIP, as opposed to 5%

damping allowed by NP-6041 for the tanks impulsive modes.

The CSTs median fragility, A,,,, capacity is calculated as follows:

TankA, = 0.12g x 1.99 x 2.1 = 0.50 g (PGA)

Where 1.99 is the factor of safety from S&A calculation 91C2696-C-014 with respect to the design basis (SSE) earthquake using the aforementioned knockdown factor of 0.90, and the 2.1 factor is the approximate ratio of the median fragility to the seismic capacity calculated in the referenced calculation, which is explained in next paragraph.

The methodology in EPRl Report NP-6041-SL uses an approach called the Conservative Deterministic Failure Margin (CDFM) methodology that when implemented yields a seismic capacity termed the High Confidence of a Cow Probability of Failure, the acronym for which is HCLPF. This value contains significant conservative bias and is defined in the seismic probabilistic risk assessment (SPRA) to be the 95% confidence of a 5% probability of exceedance. Based on EPRl Report TR-103959, Methodology for Developing Seismic, Sections 2 and 3, the factor of 2.1 is the approximate conversion factor from a HCLPF developed using the CDFM methodology (also referred to as HCLPF84) to a median fragility for which overall logarithmic standard deviation, fi,, is 0.40 for US plant sites east of the Rocky Mountains. This value of the logarithmic standard deviation is identical to that used for the original Point Beach SPRA for the IPEEE assessments.

As part of the evaluation of the CST, a walkdown was performed to determine if there were any potential seismic interactions in the area. It was determined that the masonry wall on the Operations office at El. 44 was a potential interaction concern. Therefore, the fragility of the wall was also determined. The wall is constructed of unreinforced concrete masonry units. This capacity is based on the tensile strength of the mortar (32 psi) compared to the calculated mortar stress (20 psi) for the design basis event which is then factored by the 2.1 conversion factor described above.

NRC 2002-0059 Page 4 of 7 The following equation shows the development of the walls fragility:

Wall A, = 0.12g x (32/20) x 2.1 = 0.40 g (PGA)

Based on comparison of the two fragilities, the system fragility for the CST is therefore governed by the wall fragility of 0.40 g (PGA).

6. What effect does the seismic event have on Fire Water?

It was assumed in the original IPEEE submittal that the Fire System was seismically weak and was not credited as an AFW make-up source. No further analysis of this system was performed for this Significance Determination Process (SDP) evaluation. Therefore, Fire Water is still not credited. The IPEEE analysis showed that Service Water was a reliable water source for the AFW system upon a loss of the CSTs. There would be little benefit to credit the use of Fire Water for a seismic event.

7. Following a safety injection, would the Water Treatment (WT) continue to run or would it have to be restored? If the Water Treatment System must be restored following that safety injection, does procedural guidance exist?

Following an SI, the water treatment plant would continue to supply demineralized water to the CSTs, assuming no loss of power to the plant due to the event. Service water supply to the temporary sand filter trailer would be lost due to closure of SW-2817 and/or SW-4478.

Because of the inventory in the clearwel12, demin flow would not be interrupted. Normal clearwell level is approx 543 inches yielding approx 51,000 gal above clearwell pump trip. This inventory could be used to maintain flow to the CST4.

Following SI reset, the SW supply to the sand filter trailer can be realigned by opening SW-2817 and SW-4478. Opening SW-2817 and SW-4478 is procedurally directed in EOP 1.I, SI Termination. No specific direction to align SW to the water treatment plant are provided in other EOPs following SI is reset. In those instances, opening SW-2817 and SW-4478 could be performed using skill of the craft.

Once SW flow is established to the filter trailer, plant operation is normal.

Start up of the plant following SI could be somewhat longer if clearwell level is allowed to lower until the clearwell pumps trip. In this case make up flow to the CSTs would stop and the plant would have to be started up. Startup could be 40 minutes to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months .

Ref M-2207 Sh 1 Ref TLB-50 A review of clearwell level recorder from 06/10/03 to 06/20/03 shows a nominal clearwell level of 78% (54.3)

(51,486 gal above pump trip). A min level of 60% (38,220 gal above pump trip ) and a max level of 96% (64,752 gal above pump trip). Ref TLB-50 for T-l19A Ref TLB-34

NRC 2002-0059 Page 5 of 7

8. Please provide the extent of equipment operation that is required to restore power and the Water Treatment returned to service. Is equipment restoration required? Does procedural guidance exist for an LOOP event?

If the plant experienced a loss of offsite power, the temporary sand filter trailer5, pretreatment chemical injection6, pretreatment, the reverse osmosis units, and water treatment would lose power.

After offsite power is restored to B-077 and B-228 the plant could be restarted. Procedures, 01-73 and OI-73F do not specifically address recovery of the WT Plant following the postulated scenario. Power to 2B-02 would be restored using an existing procedure, AOP-18 in conjunction with AOP 0.1. The B-22 feeder breaker 2852-42C, on 2B-02 would trip on under-voltage and require reset.g This action is not procedurally driven but would be performed from the control room using skill of the craft. Power to B-07 would be restored using AOP-18 with no breaker resets required. Individual pumps may require UV reset using Operator skill of the craft to recover the plant. The temporary sand filter trailer air operated valves would fail as is on loss of power to the portable air compressor. The trailer would likely drain to the clearwell. Upon restoration of flow, some throttling of the SW supply or alignment of the trailer may be required.

The time required to startup the water treatment plant is influenced by how long the plant has been off line. Generally, speaking the longer off line the longer the required rinse time for the softeners, RO membranes, and demineralizers. Discussions with qualified Auxiliary Operators produce an estimate of 40 minutes to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months depending on the rinse time and impact evolutions in progress at the time of power loss. The simplified, general flow path for system start up is as follows: (note that some of these operations may be done in paralell) Start up multimedia trailer to supply filtered raw water to the clearwell. Rinse in and put a softener bed on line. Startup reverse osmosis units. Rinse in a cation demin and establish a vacuum in the deareator. Rinse in an anion and mixed bed.

9. Please provide the status on the Margin Recovery for Auxiliary Feedwater.

Sargent & Lundy (S&L) has been contracted to complete a study to restore design margins to the PBNP AFW System.

The following potential options have been identified for AFW System Margin Recovery:

Make no physical modifications (i. e., recovery margin through refined analyses),

Make minor physical modifications (e.g., more accurate instrumentation to reduce impact of instrument inaccuracies on system margins),

Make major physical modifications (e.g., replace motor driven AFW pumps and motors), and Make major system modifications (Le., change the way that the system is designed to operate).

Ref Temp Mod 02-037, power from 74-L Ref Temp Mod 02-037, power from 74-L and B-71 B-07 power is from 13.8KV bus H-0 1 B-22 power is from 480V bus 2B-02 via 2A-02 Ref AOP 0.1 Att A 5

6 7

8

NRC 2002-0059 Page 6 of 7 These options are not mutually exclusive and the recommended approach for the AFW system margin recovery may include changes from more than one of these options.

For each of the options, S&L will perform technical feasibility study. For the options judged to be technically feasible, order of magnitude cost estimates will be developed.

This report is expected in August 2003.

After this report is received PBNP will consider the options and proceed with the most feasible recommendations.

Also: Work orders have been initiated to ensure that the entrance of valves MS-2005 and MS-2010 have rounded profile to minimize flow losses. An add sheet has been started to complete the work during U2R26. See OD for CR 00-1235 for more details.

10. Provide the basis for crediting filling of a steam generator (S/G) with Cold Fire or Service Water considering a dry or near dry steam generator.

In the event that normal AFW flow is unavailable due to pump failure, and other methods of restoring normal feedwater of condensate flow to the steam generators are not available, the steam generators may reach a dryout condition. In addition, if normal bleed and feed (using the high head SI pumps), or charging feed & bleed do not succeed in removing sufficient decay heat, critical safety procedures will instruct the operators to depressurize the steam generators and provide make-up flow by any means necessary. Using the Service Water system to provide flow through a seized AFW pump, cold lake water can be fed into a dry, hot steam generator.

The issue of thermal shock to the tubes and the shell has previously been considered in the preparation of the Severe Accident Management Guidance (SAMG) documents. The background document for SAG-I, Inject into the Steam Generators, discusses this possibility, and advises to limit the reintroduction of feedwater into a dry steam generator to no more than 100 gpm for the first 10 minutes. This should limit the thermal stress developed in the tubes and the shell. In our MAAP analyses, the use of the service water system flow through an idle AFW pump has been shown to be approximately 90 gpm total, or 45 gpm per steam generator. Since this is well below the 100 gpm limit recommended in the SAMGs, severe thermal stresses are not expected to occur in the dry steam generators once SW flow is established.

1 1. Taking into account that the S W Zurn strainer internals are not seismic, what affect will a seismic event have on the quality of water to the Auxiliary Feedwater system (considering low pressure injection). Would the SW Zurn strainer need to be bypassed?

In March of this year an analysis was done to evaluate the seismic capability of the internals of Service Water Zurn strainers SW-291 I-BS and SW-2912-BS. The analysis determined that the internal components of the strainer are rugged and adequately mounted and will not fail during of after a seismic event causing a blockage of flow. The analysis qualifies the convoluted screen, its mounting and mounting of the back wash arm. The operation of the backwash arm is not part of the qualification.

The evaluations are found in SQ-002126 and SQ-002127, which are provided at the back of this attachment.

NRC 2002-0059 Page 7 of 7

12. Please address the measure of certainty in the utilizing the Modular Accident Analysis Program (MAAP).

The Modular Accident Analysis Program (MAAP), is a best-estimate, general-purpose severe accident code that can be used to predict transient behavior in the reactor coolant and secondary systems, core damage, and containment response. MAAP is widely used in the industry for performing thermal-hydraulic analyses to support PRA modeling, predict severe accident phenomenon, and to provide best-estimate transient behavior for various transients.

Fauske & Associates (FAI), Inc developed MAAP, and maintain it under industry, EPRI, and DOE sponsorship.

MAAP is considered acceptable for supporting engineering bases for success criteria and event timing for quantification of Core Damage Frequency per ASME RA-S-2002. The standard recognizes the use of appropriate, realistic, best estimate analyses for thermal-hydraulic engineering bases.

MAAP has been benchmarked against experimental and industrial data. Some examples of these benchmarks include hydrogen mixing experiments at the decommissioned HDR reactor in Germany, fuel element behavior at the CORA test facility (also in Germany), and modeling of the Three Mile Island accident from initiation through core damage. Other benchmarking studies have also demonstrated the RCS modeling capabilities of MAAP (e.g., Davis-Besse Loss of Feedwater, Prairie Island steam generator tube rupture, and Crystal River stuck open PORV).

Although the MAAP code has not been explicitly benchmarked against Point Beach specific transients or analysis results, the MAAP parameter file is a Point Beach specific input originally developed for use under MAAP3, and later revised for use with MAAP4. Therefore, there is a high degree of confidence that the MAAP4 code will properly predict transient behavior of the Point Beach reactors.

13. Provide a preliminary quantification of the risk increase of the Aux Feedwater orifice issue for internal events and seismic.

Results of the preliminary quantification and a description of how the quantification was performed is included in Attachment 2. This attachment includes the event trees from the base Point Beach PRA model that were modified to account for this issue, the quantification by initiating event and sequence, and a detailed description of how the quantification was performed, again by initiator and sequence. is a summary of the MAAP analyses that were performed to support the success criteria for systems credited in the quantification. (preliminary information). is a summary of the development of human error probabilities used in the quantification. (preliminary information).

I GIP Rev 2, Corrected, 2/14/92 Status: Yes Sheet 1 of 10 SCREENING EVALUATION WORK SHEET (SEWS)

ID : SW-2911-BS ( Rev. 1 )

Description : NORTH SERVICE WATER HEADER ZURN STRAINER Building : CWPH Manufacturer, Model, Etc. :

I Class : 0. Other I Floor El. : 8.00 I Room, Row/Col :

1.

2.

3.

4.

5.

Does capacity exceed demand?

Yes Elevation where equipment receives seismic input 8.00 NIA N/A Elevation of seismic input below about 40' from grade (grade = 8.00)

Equipment has fundamental frequency above about 8 Hz (est. frequency = 10.00)

Capacity based on:

I Demand based on:

ANCHORAGE 7. The sizes and locations of anchors have been determined.

2. Appropriate equipment characteristics have been determined (mass, CG, natural freq.,

damDina. center of rotation).

Yes Yes Y.

3. The type of anchorage is covered by the GIP.

4. The adequacy of the anchorage installation has been evaluated (weld quality and length, Yes Yes nuts and washers, expansion anchor tightness, etc.)

length, anchor spacing, free-edge distance, concrete strength/condition, and concrete cracking.

6. For bolted anchorages, any gaps under the base are less than 114.

7. Factors affecting essential relays have been considered: gaps under the base, capacity INTERACTION EFFECTS Yes NIA reduction for expansion anchors.

considered.

8. The base has adequate stiffness and the effect of prying action on anchors has been

9. The strength of the equipment base and the load path to the CG is adequate.

IO. The adequacy of embedded steel, grout pads or farge concrete pads have been evaluated.

11. The anchorage capacity exceeds the demand.

Yes Yes Yes Yes IS EQUIPMENT SEISMICALLY ADEQUATE?

Yes

1. Soft targets are free from impact by nearby equipment or structures.

2. If the equipment contains sensitive relays, it is free from all impact by nearby equipment or structures.

RECD MAR 1 0 2003 Yes NIA

~

3. Attached lines have adequate flexibility.

4. Overhead equipment or distribution systems are not likely to collapse.

5. No other adverse concerns were found.

Ye<

~

Yes Yes

SCREENING EVALUATION WORK SHEET (SEWS) 1 Manufacturer, Model, Etc. :

GIP Rev 2, Corrected, 2/74/92 Status: Yes Sheet 2 of 10 COMMENTS The SRT is D. N. Carter & D. P. Brown on 3/6/2003 SEWS Revisions:

Rev. 0 - Original A46 Evaluation Rev. 1 - Clarification of scope of original evaluation.

References:

1. Sargent & Lundy Dwgs. B-4, B-5 & B-16

2. Spec G-236-06

3. S&L Form 1737-8

4. Zurn "STRAIN-O-MATIC" catalog (Manual #164) (Contained in CIM00612).

5. Zurn Industries Drawing 47736 (Contained in CIM00612)

6. Bill of Material for Zurn Figure 592-24", Model '67' (Attached)

7. BECH Drawing M-207, sheet 1, Rev. 63.

Description of Issue:

During the A46 evaluation, the service water strainers were qualified as Equipment Class 0 which means that while no specific earthquake experience data exists for the type of equipment, the Seismic Review Team was able to qualify by analysis. An analysis of this type generally makes a judgment as to the ruggedness of the particular piece of equipment. The determination of ruggedness is based on a review of the equipment design.

While the Rev. 0 SEWS provides the seismic qualification for the entire strainer and therefore implicitly covers the internal components, the evaluation does not explicitly address the seismic qualification of the internal components. This evaluation provides clarification that the internal components are seismically adequate to continue straining service water during and after a seismic event.

Description of Strainer:

The strainer consists of a cylindrical body which is anchored to the floor. Attached to the cylinder are two flanges 180 degrees apart. The service water pipes connect to the flanges. Inside the strainer, there is convoluted screen attached to a frame. The screen forms a 240 degree (approx.) arc. The screen is attached to the frame with 20 112"-13 hex head screws, nuts and washers. In addition there is a backwash arm inside the strainer. The backwash arm is attached to a shaft which penetrates the cover and base of the strainer. It is supported off bearings at each of these locations.

Seismic Evaluation of Strainer:

The 20 112"-13 screws will assure that the screen does not detach from the supporting frame. This number of screws is judged to be adequate to prevent the screen from dislodging from the supporting frame. The backwash arm spans between the top cover and the base of the strainer. This is approximately 47". The backwash arm is adequately supported to prevent it from a failure which would cause the service water to clog. Therefore, it is concluded that the service water strainer internal components will not fail during a seismic event causing clogging

i SCREENING EVALUATlON WORK SHEET (SEWS)

GIP Rev 2, Corrected, 2/14/92 Status: Yes Sheet 3 of 10 of the service water system. The backwash arm is the only moving part of the strainer. As documented in the Rev. 0 SEWS, the backwash arm control panel was not required to be seismically qualified. Therefore, the backwash arm is not qualified for function as part of this evaluation. This qualification only addresses the non moving iparts of the strainer and the mounting of the backwash arm.

Clarification of strainer model:

Per CHAMPS the strainer is a model no. 592A-24-70117. The '24' indicating that the attached pipes are 24" diameter. Per Ref. #7, the strainer is to be attached to 24" lines. The dimensions shown in Ref. #4 for a 24" strainer do not match field dimensions. A review of the bill of material for the strainers (Ref. #6) reveals that the dimensions for the strainer are comparable to the Size 18 or 20 strainer shown in Ref. #4. Therefore, the use of the dimensions and weight for the 18" strainer for the anchor analysis in the Rev. 0 SEWS is correct.

Revision 0 Notes:

Capacity:

The SRT estimated the fundamental frequency at about 10 Hz.

Anchorage:

The strainer is supported on four short (approx. 4") legs. The legs are anchored by 4 - 1" cast-in-place anchor bolts (1 bolt per leg) onto 2 concrete piers (2 legs per pier). The pier are 3'-9" long x 1'-0" wide x 18" high and 2 -

9" apart (c/c).

The strain's dimensions are 43" diameter and 55" tall. The bolts are arranged in a 46-118 diameter bolt circle (DBC), such that the center of the DBC is at the center of the two piers. The weight of the strain is 4150# and the center of gravity can be assumed at about 30" above the piers.

The attached piping is well supported, so only the weight of the strainer needs to be accounted for in the anchor analysis.

Refer to Rev. 0 SEWS for Anchor Analysis.

Since, there is no floor response spectra available, use the peak of the ground response spectra for the anchorage analysis.

Other:

The SRT noted that there may be an interaction concern with the strainer control panels (RK-31 8 RK-32).

However, WEPCo determined that the strainers do not need to operate, they just need to maintain SW system integrity. Hence, the strainer control panel were deleted from the SSEL.

The seismic qualification for the strainer is the Rev. 0 8, 1 SEWS.

This evaluationis identified as SQ-002126.

SCREENING EVALUATION WORK SHEET (SEWS)

Attachment:

BOM For Strainer P,&e 1

Attachment:

5OM for Strainer Page 2

Attachment:

BOM for Strainer Page 3

Attachment:

BOM for Strainer Page 4

Attachment:

BOM for Strainer Page 5

Attachment:

BOM for Strainer page 6 GIP Rev 2, Corrected, 2/14/92 Status: Yes Sheet 4 of IO

GIP Rev 2, Corrected, 2/14/92 I

SCREENING EVALUATION WORK SHEET (SEWS)

Status: Yes GIP Rev 2, Corrected, 2/14/92 Status: Yes Sheet 5 of 10 SCREENING EVALUATION WORK SHEET (SEWS)

ID : SW-2911-BS ( Rev. 1 )

Description : NORTH SERVICE WATER HEADER ZURN STRAINER Building : CWPH Manufacturer, Model, Etc. :

1 Class: 0. Other 1 Floor El. : 8.00 I Room, Row/Col :

BOM For Strainer Paqe 1 I L....

1/1

SCREENING EVALUATION WORK SHEET (SEWS)

BOM for Strainer Paqe 2 GI P Rev 2, Corrected, 2/14/92 Status: Yes Sheet 6 of 10 111

SCREENING EVALUATION WORK SHEET ISEWS) 1 Sheet 7 of 10 ID : SW-291 I-BS ( Rev. 1 )

Description : NORTH SERVICE WATER HEADER ZURN STRAINER Building : CWPH Manufacturer, Model, Etc. :

1 Class : 0. Other 1 Floor El. : 8.00 1 Room, Row/Col :

GIP Rev 2, Corrected, 2/14/92 Status: Yes BOM for Strainer Page 3

SCREENING EVALUATION WORK SHEET (SEWS)

BOM for Strainer Pacle 4 GIP Rev 2, Corrected, 2/14/92 Status: Yes Sheet 8 of 10 1 /1

SCREENING EVALUATION WORK SHEET (SEWS)

GIP Rev 2, Corrected, 2/14/92 Status: Yes Sheet 9 of 10 BOM for Strainer Paqe 5 ID : SW-2911-8s ( Rev. 1 )

Description : NORTH SERVICE WATER HEADER ZURN STRAINER Building : CWPH Manufacturer, Model, Etc. :

d I Class: 0. Other I Floor El. : 8.00 I Room, Row/Col :

I c.-..

1.

.. L.. i

SCREENING EVALUATION WORK SHEET (SEWS)

I Sheet 10 of 10 ID : SW-2911-BS ( Rev. 1 )

Description : NORTH SERViCE WATER HEADER ZURN STRAINER Building : CWPH I Class: 0. Other I Floor El. : 8.00 1 Room, Row/Col :

GIP Rev 2, Corrected, 2/14/92 Status: Yes I Manufacturer. Model. Etc. :

BOM for Strainer pane 6 RUtl tc of hnrdhola i1ttiwo vlth

SCREENJNG EVALUATION WORK SHEET (SEWS)

SEISMIC CAPACITY VS DEMAND GIP Rev 2, Corrected, 2/14/92 Status: Yes Sheet 1 of 4

1.

Elevation where equipment receives seismic input 8.00

2.

NIA

3.

NJA

4.

Capacity based on:

I

5.

Demand based on:

2 Elevation of seismic input below about 40' from grade (grade = 8.00)

Equipment has fundamental frequency above about 8 Hz (est. frequency = 10.00)

Does capacity exceed demand?

Yes

1. The sizes and locations of anchors have been determined.

ANCHORAGE Yes damping, center of rotation).

3. The type of anchorage is covered by.the GIP.

4. The adequacy of the anchorage installation has been evaluated (weld quality and length, Yes Yes nuts and washers, expansion anchor tightness, etc.)

5. Factors affecting anchorage capacity or margin of safety have been considered: embedment Yes length, anchor spacing, free-edge distance, concrete strengthkondition, and concrete cracking.

6. For bolted anchorages, any gaps under the base are less than 114.

7. Factors affecting essential relays have been considered: gaps under the base, capacity

8. The base has adequate stiffness and the effect of prying action on anchors has been

9. The strength of the equipment base and the load path to the CG is adequate.

IO. The adequacy of embedded steel, grout pads or large concrete pads have been evaluated.

11. The anchoraae caDacitv exceeds the demand.

reduction for expansion anchors.

considered.

Are anchorage requirements met?

Yes Yes NIA Yes Yes Yes Yes INTERACTION EFFECTS

' 1. Soft targets are free from impact by nearby equipment or structures.

Yes N/A Yes Yes Yes

2. If the equipment contains sensitive relays, it is free from all impact by nearby equipment or structures.

3. Attached lines have adequate flexibility.

4. Overhead equipment or distribution systems are not likely to cottapse.

5. No other adverse concerns were found.

Is equipment free of interaction effects?

IS EQUIPMENT SEISMICALLY ADEQUATE?

Yes Yes -

SCREENING EVALUATION WORK SHEET (SEWS)

COMMENTS GiP Rev 2, Corrected, 2/14/92 Status: Yes Sheet 2 of 4 The SRT is D. N. Carter & D. P. Brown on 3/6/2003 SEWS Revisions:

Rev. 0 - Original A-46 Evaluation Rev. 1 - Clarification of scope of original evaluation.

References:

1. Sargent & Lundy Dwgs. 6-4, B-5 & B-16

2. Spec G-236-06

3. S&L Form 1737-8

4. Zurn "STRAIN-O-MATIC' catalog (Manual #164) (Contained in ClM00612).

5. Zurn Industries Drawing 47736 (Contained in CIM00612)

6. Bill of Material for Zurn Figure 592-24", Model '67' (Attached to SEWS for SW-2911-8s)

7. BECH Drawing M-207, sheet 1, Rev. 63..

Description of Issue:

During the A46 evaluation, the service water strainers were qualified as Equipment Class 0 which means that while no specific earthquake experience data exists for the type of equipment, the Seismic Review Team was able to qualify by analysis. An analysis of this type generally makes a judgment as to the ruggedness of the particular piece of equipment. The determination of ruggedness is based on a review of the equipment design.

While the Rev. 0 SEWS provides the seismic qualification for the entire strainer and therefore implicitly covers the internal components, the evaluation does not explicitly address the seismic qualification of the internal components. This evaluation provides clarification that the internal components are seismically adequate to continue straining service water during and after a seismic event.

Description of Strainer:

The strainer consists of a cylindrical body which is anchored to the floor. Attached to the cylinder are two flanges 180 degrees apart. The service water pipes connect to the flanges. Inside the strainer, there is convoluted screen attached to a frame. The screen forms a 240 degree (approx.) arc. The screen is attached to the frame with 20 1/2"-13 hex head screws, nuts and washers. In addition there is a backwash arm inside the strainer. The backwash arm is attached to a shaft which penetrates the cover and base of the strainer. It is supported off bearings at each of these locations.

Seismic Evaluation of Strainer:

The 20 1/2"-13 screws will assure that the screen does not detach from the supporting frame. This number of screws is judged to be adequate to prevent the screen from dislodging from the supporting frame. The backwash arm spans between the top cover and the base of the strainer. This is approximately 47". The backwash arm is adequately supported to prevent it from a failure which would cause the service water to clog. Therefore, it is concluded that the service water strainer internal components will not fail during a seismic event causing clogging

SCREENING EVALUATION WORK SHEET (SEWS)

I Sheet 3 of 4 ID : SW-2912-BS ( Rev. 1 )

Description : SOUTH SERVICE WATER HEADER ZURN STRAINER Building : CWPH Manufacturer, Model, Etc. :

I Class: 0. Other I Floor El. : 8.00 1 Room, Row/Col :

GIP Rev 2, Corrected, 2/14/92 Status: Yes of the service water system. The backwash arm is the only moving part of the strainer. As documented in the Rev. 0 SEWS, the backwash arm control panel was not required to be seismically qualified. Therefore, the backwash arm is not qualified for function as part of this evaluation. This qualification only addresses the non moving iparts of the strainer and the mounting of the backwash arm.

Clarification of strainer model:

Per CHAMPS the strainer is a model no. 592A-24-70117. The '24' indicating that the attached pipes are 24" diameter. Per Ref. #7, the strainer is to be attached to 24" lines. The dimensions shown in Ref. &I for a 24" strainer do not match field dimensions. A review of the bill of material for the strainers (Ref. #6) reveals that the dimensions for the strainer are comparable to the Size 18 or 20 strainer shown in Ref. #4. Therefore, the use of the dimensions and weight for the 18" strainer for the anchor analysis in the Rev. 0 SEWS is correct.

Revision 0 Notes:

Capacity:

The SRT estimated the fundamental frequency at about 10 Hz.

Anchorage:

The strainer is supported on four short (approx. 4") legs. The legs are anchored by 4 - 1" cast-in-place anchor bolts (1 bolt per leg) onto 2 concrete piers (2 legs per pier). The pier are 3'-9" long x 1'-0" wide x 18" high and 2'-

9' apart (clc).

The strain's dimensions are 43" diameter and 55" tall. The bolts are arranged in a 46-118 diameter bolt circle (DBC), such that the center of the DBC is at the center of the two piers. The weight of the strain is 415W and the center of gravity can be assumed at about 30" above the piers.

The attached piping is well supported, so only the weight of the strainer needs to be accounted for in the anchor analysis.

The anchor analysis is in the Rev. 0 SEWS for SW-291 l-BS.

Since, there is no floor response spectra available, use the peak of the ground response spectra for the anchorage analysis. For anchorage analysis see SW-2911 -BS.

Other:

The SRT noted that there may be an interaction concern with the strainer control panels (RK-31 & RK-32).

However, WEPCo determined that the strainers do not need to operate, they just need to maintain SW system integrity. Hence, the strainer control panel were deleted from the SSEL.

The seismic qualification for the strainer is the Rev. 0 & 1 SEWS.

This evaluationis identified as SQ-002127.

SCREENING EVALUATION WORK SHEET (SEWS)

Evaluated by:

Date:

GIP Rev 2, Corrected, 2/14/92 Status: Yes Sheet 4 of 4 3-6-03

ATTACHMENT 2 Qualification of the Risk Increase -

Point Beach AFW Orifice Issue (Preliminary)

POINT BEACH NUCLEAR PLANT, UNITS I AND 2

Quantification of the Risk Increase Point Beach AFW Orifice Issue

1. Modified PRA Model Event Trees - Showing New Top Events and Sequences

2. Sequence Quantification - Summary of Potentially Significant Initiating Events - Unit 2

3. Description of Sequence Quantification by Initiator

LOSS OF SERVICE WATER INITIATOR TSW UCCESS "NEW' "NEW' SWSUPPLY CHARGING AFW AFW LOW FAILURE INJECTION PRESS ISUPP~~.

Disch)

SIG INJ I E a W IPlU9)

(Flre Water)

S P E H

-AFE

-AFP

-LOW UCCESS I I UPPLY SUCCESS r-SUCCESS l----l rsw ISW-AFP SWAFP-LOW SWAFE SWEH iWSP iWSP4FP

,WSP.AFP-LOW WSP-AFE WSP-CH PlNAOEMENF COMPANY FREOUENCY NEW SEQ NEW SEQ LOSS OF SERVICE WATER EVEN TREE KVlmPRAVtreZEl!TSW..vt WR31iw3 (42824 WInNUPRA 2.3 Qwnlltkatlon Dtte: 22-35-07 2:07:47pm TOTAL CMF-O.M)E+O Licensed io: PTBEACH

-0SSOFNY OFFSITE POWER 11 I

I "NEW'

" N W '

"NEW' "NEW' "NEW' "NEW' DlESE GAS AFW

?ACTOR RCS AFW RCS LOW RCS

!ECOVERHUTDOW SEAL IGHHEA LONG UPPLYIN( TURBINE 3 W P L FEED FEED PRESS FEED MFW COOLING LOCA SAFETY TERM 805 OR I A 9LCOOLl BLEED BLEED SJGINJ BLEED NJECTIOICOOUNG IEadYI (Early)

(Plug)

(Lata)

(SW

[Chaq)

-0G 41

-AFE 5 C

-FEE 4 F P

-FBL

.LOW Z F B

-MFL

-RHR S L HHI I C SUCCESS 1

r-p-1 0

C 0

01 41 31 c

K N

K

.(

N

I f - - -

I

!FAIL I

I TIWSC-AFP OK R4G-SC-AFP-RHR MIN r1DGSC4FP-FBL OK OK ri.ce-sc-AFP-FBL.Low RDQSC4FP-FBL-LOW-RHR MIN

'I-DQSC-AFP-FBLIOWCF0 OK

'IWSC-AFP-FBLIOWSFBMFL MIN

'I-W-AFE IDQ-AFE-LC 1DOAFE-FBE 1.0-SEQUENCE DESCRIPTOR KWrePRALFIreNnTI.EVT WIzv2w3 I42824 WlnNUPRA 2.1 Llsased to: PT-BEACH Qumntlncdon ode: cwm 823:mm TOTAL CMF - o.wEtwo T t TT-A$P TI-AFP-RHR TTAFP-FBL ri+vp-FBL-Low r w P - F B u o w - R H R IT-AFP-FBL-LOWSF8

'I#P+BL-LOWZFB-MFL

'ISC lSC4.C ISCHHI 14FE 1 4 F E I C I-AFE-FBE I-%

IDG-AFP IDGAFP-RHR IDG-AFP-FBL DG-AFP-FELLOW DGAFP-FBL-LOW-RHR

~ F P - F B L I O W Z F B NUCLL POINT BEACH NUCLEAR P W

LOSS OF OFFSITE WWER EVENT TREE DGAFP-FBL-LOWSFBMFL TIDOSC TI-OGSCIC TIWSC-HHI FREOUENCY NEWSEQ NEW SEQ I

1 W G E M E N T COMPANY

LOSSOF OPERATOR AFW W R V NSTRUMENT CONTROLS RECLOSES AIR CHARGING FLOW (Early)

TIA 4 C I F

-RC UCCESS "NEW" "NEW" "NEW.'

..NEW AFW LOW RCS SHUTDOWN HIGHHEAD LONG PRESS FEED COOLING SAFETY TERM SIGINJ BLEED INJECTION COOLIN(

(Plug) lsw)

ICharg)

-AFL

-LOW

+EL

-RHR

-HHI

-LC UCCESS SUCCESS r--

J--

SEQUENCE DESCRIPTOR TIA nA-AFL IIAIFL-LOW IIA-AFLCOWSIHR

'U-AFL-LOW-FBL

'?A-RC

!A.Rc.Lc IA-RCHHI IA-AFE IAOC AQCIFL AOC-AFL-LOW A4C-AFLIOW.RHR AOC-AFLIOW-FBL AOC-RC 44c-Rc.Lc 4OC-RCHHI LOC-AFE iLECTRlC POWERCOMPANY F R E 0 U E N C Y NEW SEQ NEW SEO K:wirrPtu,uira2\\EnTILsvt WIZMW~ i l : 2 ~ : m WI~NUPRA 1.1 WISI I

POINT BEACH NUCLEAR PLANT Quantlflutlon Datm %205-97 2M:Mprn TOTAL CMF - O.WE*WO U c a d to: PTBEACH 1

LOSSOF INSTRUMENTAIRMNTTREE

"NEW' "NEW.

LOSS OF AFW AFW RCS 125VOC FEED BUS DO1 BLEED INITIATOR (Early]

(Plug)

(L*te)

TO1

-AF

-AFL i B L

,-A SUCCESS "NEW'

'*NEW.'

"NEW' LOW REC SHUTDOWN RCS LONG PRESS FEED COOLINQ FEED TERM SIQINJ BLEED BLEED COOLlb (SWI IChargI IEarlyl 4 0 W Z F B 4HR

-FB

c UL-.

UL SEOUENCE DESCRIPTOR TO1 TOl-AFL IDIAFL-RHR IDI-AFL-FBL

'DI-AFL-FBL-LOW OI-AFL-FBLIOW-RHR 01 -AFL-FBLIOWZFB D1-AF WAFS-LC

)I.AF-FB W Q E M E N T COMPANY FREOUENCY NEW SEO NEW SEQ LOSS OF 325 VOC BUS W1 EVENT TREE

TRANSIENT WITHOUT PCS SEOUENCE DESCRIPTOR

'*NEW"

..NEW.'

"NEYP'

" N W.

..NEW' LOW RCS SUTDOWN LONG FEED FEED PRESS FEED COOUNG TERM BLEED BLEED SIGINJ BLEED COOUNC AFW AFW RCS RCS 2

'UFLAHR

.AFL-FBL AFL.FBLIOW AFL-FBL-LOW-RHR IFL.FELIOW-CFB iFE-LC FE-FBE YAGEMENT C O M P W FREQUENCY NEW sEa NEW SEQ TRANSIENT WITHOUT PCS AVAIIABLE EVEEM TREE

IRANSIENT NEW NEW

..NEW NEW NEW AFW AFW MAIN RCS LOW RCS SHUTDOWN RCS LONG I

WITH PCS 73 FEEDWATER FEED PRESS FEED COOLINO FEE0 TERM BLEED SIGINJ BLEED BLEED COOLINC (Early)

(Plug1 (LdCl (SWl (Chargl IEarfy)

AFE

-AFL

-MF

-FBL LOW

-CFB 4 H R

BE

-LC 1

IF AIL SEOUENCE DESCRIPTOR 3

I-AFL I-AFL-MF AFL-MF-RHR

-/\\FL-MF-FBL AFL-MF-FBL-LOW AFL-MF-FBL-LOW-RHR AFL-MF-FBLIOW-CFB

&FE WE-MF tFE-MF-LC NAOEMENT COMPANY FREQUENCY NEVSEQ NEW SEO TRANSIENT WITH PCS EVENT TREE r e ~ ~ ~ w n 2 \\ ~ n ~ 3. s v t wrum3 1l:za:u w t n ~ u ~ ~ ~ 2. 1

~tmc.tlon m e : 3.zcoa 2:ill:ispm TOTAL CMF - O.WE+WO

~ s c d Lo: PTBEACH

9 0 3 2 8 SO-38V 1 LO-38OE 90-3SZ'L 90-302' I L 0 9 9 l ' S SO-38s' 1 90-3Pl'l

L I

n lD 0

x ul m

in2 E 2 Initiating Event b 5 r

I VI 2 Control of Charging v) 5 Aux Feedwater (Early f Failure)

VI Q

injection (via Service

& 5 Water)

R Aux Feedwater (Plug) 4 3 2 n Low Press. S/G v) 5 RCS Feed and Bleed p f (Charging) ui N

m 2

E e Shutdown Cooling 6 3 0

2 CoreDamage 0

Probability m x 2 Aux Feedwater f (Early Failure) d b

E 2

2

& $ Aux Feedwater 2 2 (Plug)

N 2 2 RCS Feed and 2 5 Bleed (Late)

N n Low Press. SIG

$ injection (via 5 Service Water)"

2 d n RCS Feed and

I E Bleed a 3 (Charging)"

0 8

2 P

g CoreDamage 6

e HEP Depencancy Probability m

2 Low Press. S/G 5 Water)"

Injection (via Service

1. I "Independent I Failure Probability "Dependant Failure Probability W

N m 8 "

P P

n lD

?t

-4 4 n E $ Initiating Event

$ 3 v) f Failure)

Aux Feedwater (Earl)

VI n

UI 8 $ Aux Feedwater (Plug

+ 3 m

6 RCS Feed and Bleed p (Late) ln

" n 6 3 E Shutdown Cooling w

2

-I Probability CoreDamage RCS Feed and Bleed 5 (Charging)"

$ Initiating Event 2 Aux Feedwater (Early Failure) n Low Press. S/G 3 Water)"

X $ injection (via Service I

I

$ RCS Feed and Bleed

?

g CoreDamage Probability sl

$j "Dependant Failure N

l-t---- lfli Initiating Event I 1 Control of Charging VI 6 Aux Feedwater (Early f Failure)

I I:

0 0

Core Damage Probability m

Failure Probability "Dependant Failure Probability N

EO-32L'S I PO-361'2 I

SO-38P't I 90-38E.6 I 10+319'2 I

I

Description of Sequence Quantification by Initiator LOSS OF SERVICE WATER Loss of Service Water also results in a loss of Instrument Air due to lack of cooling for compressors. This makes the PORVs and Feed and Bleed using SI unavailable. SI is also not available for containment sump recirculation due to lack of cooling. Success for this event without the orifice plugging issue is by use of AFW from the CST initially, then by use of fire water to provide AFW suction supply and CST refill and cooling for the TDAFW pump. With the orifice issue, this will result in failure of AFW pumps that are allowed to run against a dosed discharge valve. Charging feed and bleed is not credited for this initiator because SI is not available for RCS makeup when the Pressurizer safety valves fail open from passing water. Loss of Service Water also eliminates all means of cooling containment. Water Treatment is not available because it requires Instrument Air and Service Air for numerous valves and other functions.

Sequence #3 Successes prior to the new branches: Charging injection for RCP seal cooling, AFW with suction from the CST Event / Description sw Supply Failure of the Service Water supply pumps or header

~~

~

Aux Feedwater (Plug)

Probability that AFW does not fail early and that operators fail to prevent plugging of all available AFW pumps.

Quantification Base PRA model fault tree frequency for loss of SW supply.

5.48E-O5/yr The random early failure of AFW is from the PRA model fault tree modified to remove late supply failures. If one pump fails randomly, it is assumed that the operators will not be able to recognize a common cause and will start a second pump, which will then also fail.

The probability of operators failing to recognize the common cause of failures before all pumps are failed was quantified by an HRA event tree.

For the time period when all AFW pumps were susceptible:

6.43E-01 = (3.86E-01

1.0) + (6.14E-01

4.18E-01) 3.86E-01 Fault tree quantification for any one AFW pump fails randomly given SW failure event 1.o Assumed operator failure if one AFW pump fails randomly 6.14E-01 Complementary event - no AFW pumps fail randomly 4.18E-01 HEP for failure to recognize common cause failure due to plugging given no random failures occurred Page 1

Event / Descriution Low Press S/G Injection (Fire Water)

Depressurize the SGs by manually opening the atmospheric steam dumps and inject using fire water through the failed AFW pumps.

Quantification For the time period when only MDAFW pumps were susceptible:

9.95E-02 Fault tree quantification for TDAFW pump fails randomly given SW failure event These values are then combined by the fraction of the year the pumps were susceptible to arrive at the final result:

3.563-01 = (6.43E-01*0.472) + (9.95E-02*0.528)

This is the HEP for opening the atmospheric steam dumps and recognizing and eliminating the flow diversion for fire water to the CST. Hardware failures are not included because the fire water system had to succeed early or the AFW pumps would not have failed. Note that the loss of Service Water is the only event where this methodology is credited without charging feed and bleed.

4.603-02 Sequence #8 Successes prior to the new branches: Charging injection for RCP seal cooling, AFW with suction from the CST.

Event / Description SW Discharge Failure of the Service Water discharge header.

Aux Feedwater (Plug)

Probability that AFW does not fail early and that operators fail to prevent plugging of all available AFW pumps.

Low Press S/G Injection (Fire Water)

Depressurize the SGs by manually opening the atmospheric steam dumps and inject using fire water through the failed AFW pumps.

Quantification Base PRA model fault tree frequency for loss of SW discharge.

5.37E-06lyr

~~

For SW discharge failures, both turbine driven AFW pumps are failed because they have no cooling (fire water uses the same discharge flowpath as does SW). One motor driven AFW pump must be used on each unit. Since there is only one pump available on each unit, it is assumed that the operators will not be able to recognize a common cause in time to save either pump.

1.00 This is the HEP for opening the atmospheric steam dumps and recognizing and eliminating the flow diversion for fire water to the CST. Hardware failures are not included because the fire water system had to succeed early or the AFW pumps would not have failed. Note that the loss of Service Water is the only event where this methodology is credited without charging feed and bleed.

4.603-02

~

Page 2

DUAL UNIT LOSS OF OFFSITE POWER For this dual unit transient, restoration of offsite power must be accomplished with enough time remaining before the CST is drained to allow for restoration of Water Treatment. MAAP runs showed this time to be approximately 1.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months . A restoration of offsite power probability at one hour was therefore used.

Sequence #3 Successes prior to the new branches: At least one diesel generator or the gas turbine, AFW with suction from the CST, RCP seal cooling.

Event / Descriution T1 Initiating Event Dual Unit loss of offsite Dower initiator Aux Feedwater (Plug)

Probability that AFW does not fail early and that operators fail to prevent plugging of all available AFW pumps.

Ouantification Frequency from the base PRA model.

7.1 E-03/yr The random early failure of AFW is from the PRA model fault tree modified to remove late supply failures. If one pump fails randomly, it is assumed that the operators will not be able to recognize a common cause and will start a second pump, which will also fail.

Water Treatment is also credited here when offsite power is recovered before the CST is depleted. Water Treatment random failures are from a new fault tree. Recovery of offsite power probability at one hour is from the base PRA model.

The probability of operators failing to recognize the common cause of failures before all pumps are failed was quantified by an HRA event tree.

For the time period when all AFW pumps were susceptible:

4.90E-01 = 5.83E-01* [(2.26E-01

1.0) + (7.74E-01

7.95E-01)J 5.83E-01 2.26E-01 1.o 7.74E-0 1 7.95E-01 Fault tree quantification for failure of Water Treatment following a DLOOP event - includes recovery of offsite power within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

Fault tree quantification for any one AFW pump fails randomly given T1 initiating event Assumed operator failure if one AFW pump fails randomly Complementary event - no AFW pumps fail randomly HEP for failure to recognize common cause failure due to plugging given no random failures occurred For the time period when only MDAFW pumps were susceptible:

4.45E-02 = 5.83E-01* (7.64E-02" 1.0)

Page 3

Event / Description f Low Press S/G Injection (Service i Water)

Failure of feed and bleed using SI after initial AFW success Depressurize the SGs by manually opening the atmospheric steam dumps and inject using service water through the failed AFW pumps.

RCS Feed and Bleed (Charging )

Feed and bleed using maximum charging flow and pressurizing the RCS up to the Pressurizer safety valve setpoint.

Main Feedwater (Recovery)

Recovery of offsite power and Main Feedwater late Quantification 5.83E-01 Fault tree quantification for failure of Water Treatment following a DLOOP event - includes recovery of offsite power within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

7.64E-02 Fault tree quantification for TDAFW pump fails randomly given TI initiating event 1.o Assumed operator failure if one AFW pump fails randomly These values are then combined by the fraction of the year the pumps were susceptible to arrive at the final result:

2.553-01 =

(4.90E-01*0.472) + (4.45E-02*0.528)

Base PRA model fault tree quantification with an HEP for establishing feed and bleed using high pressure SI that takes credit for additional time available later in the event because decay heat is lower.

1.423-02 This is the HEP for opening the atmospheric steam dumps as directed in procedure CSP-H.l, RNO column if the bleed portion of SI feed and bleed fails. Hardware failures are not included because the service water system had to succeed early or the AFW pumps would not have failed.

For this event, this action is completely dependent on the action to establish feed and bleed using charging since both are required for success. This is because low pressure steam generator injection will eventually lead to an open Pressurizer safety valve and charging is required for RCS makeup.

1.00 Base PRA model fault tree quantification with an HEP for maximizing charging flow snd following the RNO column in CSP-H. 1 if the bleed portion of SI feed and bleed fails (approximately 60% of the failures of SI feed and bleed). Charging feed and bleed is also credited as directed in CSP-CI when the core exit temperature exceeds 700'F. This is credited when the feed portion of SI feed and bleed fails (the remaining 40% of the failures).

L.54E-02

~~~~

Recovery of offsite power given that it was not recovered earlier in time to restore Water Treatment. Probability is from the base PRA model. Random failure of Main Feedwater is also from the base PRA model fault tree. This method is only credited Nhen following the RNO column of CSP-H.l if the bleed portion of SI feed and bleed Fails.

5.993-01 Page 4

Event / Description

~ Quantification This factor accounts algebraically for the dependencies between the human actions within these mitigating strategies. Complete dependency is assumed for the cognitive portion of the actions because they are all directed from the same procedure CSP-H.1.

A medium dependency is assumed for the execution portions of the HEPs because they are directed by separate steps and sufficient time is available to complete all the actions. The result is a multiplier that is applied to the product of the independent failures.

4.12E+01 Sequence #8 Successes prior to the new branches: : At least one diesel generator or the gas turbine, AFW with suction from the CST, RCP seal cooling.

Event / Description T1 Initiating Event Dual Unit loss of offsite power initiator Aux Feedwater (Plug)

Probability that AFW does not fail early and that operators fail to prevent plugging of all available AFW pumps.

Frequency from the base PRA model.

7.1 E-03Iyr The random early failure of AFW is from the PRA model fault tree modified to remove late supply failures. If one pump fails randomly, it is assumed that the operators will not be able to recognize a common cause and will start a second pump, which will also fail.

Water Treatment is also credited here when offsite power is recovered before the CST is depleted. Water Treatment random failures are from a new fault tree. Recovery of offsite power probability at one hour is from the base PRA model.

The probability of operators failing to recognize the common cause of failures before all pumps are failed was quantified by an HRA event tree.

For the time period when all AFW pumps were susceptible:

4.90E-01 = 5.83E-01* [(2.26E-01

1.0) + (7.74E-01

7.95E-01)]

5.83E-01 Fault tree quantification for failure of Water Treatment following a DLOOP event - includes recovery of offsite power within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

2.26E-01 Fault tree quantification for any one AFW pump fails randomly given T1 initiating event 1.o Assumed operator failure if one AFW pump fails randomly 7.74E-01 Complementary event - no AFW pumps fail randomly Page 5

Event / Descrktion I RCS Feed and Bleed (Late)

Shutdown Cooling Closed cycle RCS cooling using the RHR system.

Quantification 7.95E-01 HEP for failure to recognize common cause failure due to plugging given no random failures occurred For the time period when only MDAFW pumps were susceptible:

4.45E-02 = 5.83E-01* (7.64E-02* 1.0) 5.83E-01 Fault tree quantification for failure of Water Treatment following a DLOOP event - includes recovery of offsite power within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

Fault tree quantification for TDAFW pump fails randomly given T1 initiating event Assumed operator failure if one AFW pump fails randomly 7.64E-02 1.o These values are then combined by the fraction of the year the pumps were susceptible to arrive at the final result:

2.553-01 =

(4.90E-01*0.472) + (4.45E-02*0.528)

~

~~

Success branch.

This value is based upon a quantification of the base PRA model fault tree for RHR zooling. A high dependency recovery of test return valves that were left in the open position following the last flow test of RHR was also applied in this case because of Lime available.

3.323-03 LOSS OF INSTRUMENT AIR In this event, Water Treatment is failed because it is dependent on both Instrument and Service Air supplies for operation. SI feed and bleed is also not available because the Pressurizer PORVs require instrument air to open. Opening of the Steam Generator atmospheric steam dumps requires local manual action because instrument air is not available.

Page 6

Sequence #4 Successes prior to the new branches: Control of Charging flow (dependent on Instrument Air),

and AFW with suction from the CST.

Event / Description TIA Initiating Event Loss of Instrument Air Initiator Aux Feedwater (Plug)

Probability that AFW does not fail early and that operators fail to prevent plugging of all available AFW pumps.

Ouantification

~~

PRA model fault tree for the loss of instrument air initiator 6.60E-05 The random early failure of AFW is from the PRA model fault tree modified to remove late supply failures. If one pump fails randomly, it is assumed that the operators will not be able to recognize a common cause and will start a second pump, which will then also fail.

The probability of operators failing to recognize the common cause of failures before all pumps are failed was quantified by an HRA event tree.

For the time period when all AFW pumps were susceptible:

5.77E-01 = (2.73E-01

1.0) + (7.27E-01

4.18E-01) 2.73E-01 Fault tree quantification for any one AFW pump fails randomly given IA failure event 1.o Assumed operator failure if one AFW pump fails randomly 7.27E-01 Complementary event - no AFW pumps fail randomly 4.18E-01 HEiP for failure to recognize common cause failure due to plugging given no random failures occurred For the time period when only MDAFW pumps were susceptible:

7.22E-02 Fault tree quantification for TDAFW pump fails randomly given IA failure event These values are then combined by the fraction of the year the pumps were susceptible to arrive at the final result:

3.10E-01 = (5.77E-01*0.472) + (7.22E-02*0.528)

Page 7

Event / DescriDtion Low Press S/G Injection (Service Water)

Depressurize the SGs by manually opening the atmospheric steam dumps and inject using service water through the failed AFW pumps.

RCS Feed and Bleed (Charging )

Feed and bleed using maximum charging flow and pressurizing the RCS up to the Pressurizer safety valve setpoint.

HEP Dependency L Ouantitication This is the HEP for opening the atmospheric steam dumps as directed in procedure CSP-H. 1, RNO column if the bleed portion of SI feed and bleed fails. Hardware failures are not included because the service water system had to succeed early or the AFW pumps would not have failed.

For this event, this action is completely dependent on the action to establish feed and bleed using charging since both are required for success. This is because low pressure steam generator injection will eventually lead to an open Pressurizer safety valve and charging is required for RCS makeup.

1.00 Base PRA model fault tree quantification with an HEP for maximizing charging flow and following the RNO column in CSP-H.l because the bleed portion of SI feed and bleed fails due to not having instrument air available for the Pressurizer PORVs.

2.233-02 Because low pressure steam generator injection is already completely dependent on the charging feed and bleed action, no other dependencies need to be applied.

1.00 Sequence #5 Successes prior to the new branches: Control of Charging flow (dependent on Instrument Air),

and AFW with suction from the CST.

Event / Description TIA Initiating Event Loss of Instrument Air Initiator Aux Feedwater (Plug)

Probability that AFW does not fail early and that operators fail to prevent plugging of all available AFW pumps.

Ouantification

~~

PRA model fault tree for the loss of instrument air initiator 6.6OE-05

~~

~

The random early failure of AFW is from the PRA model fault tree modified to remove late supply failures. If one pump fails randomly, it is assumed that the operators will not be able to recognize a common cause and will start a second pump, which will then also fail.

The probability of operators failing to recognize the common cause of failures before all pumps are failed was quantified by an HRA event tree.

For the time period when all AFW pumps were susceptible:

5.77E-01 = (2.73E-01

1.0) + (7.27E-01

4.18E-01)

Page 8

Event I Description Low Press S/G Injection (Service Water)

Depressurize the SGs by manually opening the atmospheric steam dumps and inject using service water through the failed AFW pumps.

RCS Feed and Bleed

[Charging )

Shutdown Cooling Closed cycle RCS zooling using the RHR system.

~

puantification 2.73E-01 Fault tree quantification for any one AFW pump fails randomly given IA failure event 1.o Assumed operator failure if one AFW pump fails randomly 7.27E-01 Complementary event - no AFW pumps fail randomly 4.18E-01 HEP for failure to recognize common cause failure due to plugging given no random failures occurred For the time period when only MDAFW pumps were susceptible:

7.22E-02 Fault tree quantification for TDAFW pump fails randomly given IA failure event These values are then combined by the fraction of the year the pumps were susceptible to arrive at the final result:

3.10E-01 = (5.77E-01*0.472) + (7.22E-02*0.528)

This is the HEP for opening the atmospheric steam dumps as directed in procedure CSP-H. 1, RNO column if the bleed portion of SI feed and bleed fails. Hardware failures are not included because the service water system had to succeed early or the AFW pumps would not have failed.

For this event, this action is completely dependent on the action to establish feed and bleed using charging since both are required for success. This is because low pressure steam generator injection will eventually lead to an open Pressurizer safety valve and charging is required for RCS makeup.

1.00 Success branch

_ _ _ _ _ ~

rhis value is based upon a quantification of the base PRA model fault tree for RHR zooling. A high dependency recovery of test return valves that were left in the open position following the last flow test of RHR was also applied in this case because of the Lime available.

2.903-03 LOSS OF DC BUS DO2 Loss of DC Bus DO2 on Unit 2 leads directly to a reactor trip. It also causes a loss of Main Feedwater because the feedwater regulating valves require power from this DC bus to function.

The Water Treatment System is not available because it is dependent on DC power from D02.

Page 9

Sequence #3 Successes prior to the new branches: AFW with suction from the CST Event / Description TD2 Initiating Event Loss of DC bus DO2 Aux Feedwater (Plug)

Probability that AFW does not fail early and that operators fail to prevent plugging of all available AFW pumps.

Failure of feed and bleed using SI after initial AFW success Low Press S/G Injection (Service Water)

Depressurize the SGs by manually opening the atmospheric steam dumps and inject using service water through the failed AFW pumps.

Ouantification PRA model fault tree for loss of DC bus DO2 initiator 1.20E-03 If one AFW pump fails randomly, it is assumed that the operators will not be able to recognize a common cause and will start a second pump, which will then also fail.

The random early failure of the TDAFW pump is from the PRA model fault tree modified to remove late supply failures.

For the time period when all AFW pumps were susceptible:

1.oo For a loss of DO2 event, one MDAFW pump is failed because it has no control power. Even though Unit 1 will still likely have Main Feedwater available and two AFW pumps will be available to Unit 2, it is assumed that the Operators will not be able to diagnose the plugging problem before the second pump is also failed.

For the time period when only MDAFW pumps were susceptible:

6.49E-02 Fault tree quantification for TDAFW pump fails randomly given DO2 failure event These values are then combined by the fraction of the year the pumps were susceptible to arrive at the final result:

5.06E-01 = (1.00*0.472) + (6.49E-02*0.528)

Base PRA model fault tree quantification with an HEP for establishing feed and bleed using high pressure SI that takes credit for additional time available later in the event 3ecause decay heat is lower.

2.11E-02 rhis is the HEP for opening the atmospheric steam dumps as directed in procedure 2SP-H. 1, RNO column if the bleed portion of SI feed and bleed fails. Hardware

'ailures are not included because the service water system had to succeed early or the 4FW pumps would not have failed.

'or this event, this action is completely dependent on the action to establish feed and Aeed using charging since both are required for success. This is because low pressure

team generator injection will eventually lead to an open Pressurizer safety valve and

harging is required for RCS makeup.

1.00 Page 10

Event / Description RCS Feed and Bleed (Charging )

Feed and bleed using maximum charging flow and pressurizing the RCS up to the Pressurizer safety valve setpoint.

HEP Dependency Ouantification

~

Base PRA model fault tree quantification with an HEP for maximizing charging flow and following the RNO column in CSP-H. 1 if the bleed portion of SI feed and bleed fails (approximately 40% of the failures of SI feed and bleed for the TD2 event).

Charging feed and bleed is also credited as directed in CSP-Cl when the core exit temperature exceeds 700°F. This is credited when the feed portion of SI feed and bleed fails [the remaining 60% of the failures).

2.24E-02 This factor accounts algebraically for the dependencies between the human actions within these mitigating strategies. Complete dependency is assumed for the cognitive portion of the actions because they are all directed from the same procedure CSP-H. 1.

A medium dependency is assumed for the execution portions of the HEPs because they are directed by separate steps and sufficient time is available to complete all the actions. The result is a multiplier that is applied to the product of the independent failures.

2.16E+01 Sequence #7 Successes prior to the new branches: AFW with suction from the CST.

Event / Description TD2 Initiating Event Loss of DC bus DO2 Aux Feedwater (Plug)

Probability that AFW does not fail early and that operators fail to prevent plugging of all available AFW pumps.

Ouantification PRA model fault tree for loss of DC bus DO2 initiator 1.20E-03 If one AFW pump fails randomly, it is assumed that the operators will not be able to recognize a common cause and will start a second pump, which will then also fail.

The random early failure of the TDAFW pump is from the PRA model fault tree modified to remove late supply failures.

For the time period when all AFW pumps were susceptible:

1.oo For a loss of DO2 event, one MDAFW pump is failed because it has no control power. Even though Unit 1 will still likely have Main Feedwater available and two AFW pumps will be available to Unit 2, it is assumed that the Operators will not be able to diagnose the plugging problem before the second pump is also failed.

For the time period when only MDAFW pumps were susceptible:

6.49E-02 Fault tree quantification for TDAFW pump fails randomly given DO2 failure event These values are then combined by the fraction of the year the pumps were susceptible Page 11

Event / Description RCS Feed and Bleed (Late)

Shutdown Cooling Quantification to arrive at the final result:

5.06E-01 = (l.OO*O.472) + (6.49E-02*0.528)

Success branch for SI feed and bleed.

Closed cycle RCS cooling using the RHR system.

This value is based upon a quantification of the base PRA model fault tree for RHR cooling given a loss of D02. A high dependency recovery of test return valves that were left in the open position following the last flow test of FUR was also applied in this case because of the time available.

9.503-03 TRANSIENT WITHOUT HEAT SINK The only time this transient is a concern is if Main Feedwater is not available. If Main Feedwater does not succeed, then Aux Feedwater would be needed and is susceptible to plugging.

Sequence #3 Successes prior to the new branches: AFW with suction from the CST.

Event I Description Modified T2 Initiating Event Trip with a loss of heat sink as modified to include only the fraction of events where Main Feedwater is not available.

Aux Feedwater (Plug)

Probability that AFW does not fail early and that operators fail to prevent plugging of all available AFW pumps.

Ouantification The base T2 initiator frequency from the PRA model was reduced to the fraction of events where main feed is lost to initiate the event and by the fraction of events where main feedwater fails randomly. The random MFW failure probability is from a quantification of the base PRA model fault tree.

5.813-02 = (1-7.70E-Ol)*(1.9OE-01) + (7.70E-Ol)*(1.90E-Ol)*(9.48E-02) 1.90E-01 T2 initiating event frequency from the base PRA model.

7.7OE-01 Fraction of T2 events that are not loss of MEW from the base PRA model 9.48E-02 Random failure probability of MFW from base PRA model fault tree quantification. This includes hardware failures and the HEP for hotwell refill using the Fire Water System The random early failure of AFW is from the PRA model fault tree modified to remove late supply failures. If one pump fails randomly, it is assumed that the operators will not be able to recognize a common cause and will start a second pump, which will also fail.

Water Treatment is also credited here. Water Treatment random failures are from a new fault tree.

Event / DescriDtion

~~

~

RCS Feed and Bleed

Late)

'ailure of feed and bleed ising SI after initial WW success Quantification The probability of operators failing to recognize the common cause of failures before all pumps are failed was quantified by an HRA event tree.

For the time period when all AFW pumps were susceptible:

3.20E-02 = 3.31E-02" [(1.68E-01

1.0) + (8.32E-01

9.61E-01)]

3.3 1E-02 1.68E-01 1.o 8.32E-0 1 9.6 1E-0 1 Fault tree quantification for failure of Water Treatment following a T2 event.

Fault tree quantification for any one AFW pump fails randomly given T2 initiating event Assumed operator failure if one AFW pump fails randomly Complementary event - no AFW pumps fail randomly HEP for failure to recognize common cause failure due to plugging given no random failures occurred For the time period when only MDAFW pumps were susceptible:

2.15E-03 = 3.31E-02* (6.49E-02" 1.0) 3.31E-02 Fault tree quantification for failure of Water Treatment following a T2 event.

6.49E-02 Fault tree quantification for TDAFW pump fails randomly given T2 initiating event 1.o Assumed operator failure if one AFW pump fails randomly rhese values are then combined by the fraction of the year the pumps were susceptible o arrive at the final result:

1.63E-02 = (3.20E-02*0.472) + (2.15E-03*0.528) 3ase PRA model fault tree quantification with an HEP for establishing feed and bleed ising high pressure SI that takes credit for additional time available later in the event Iecause decay heat is lower.

1.12E-02 Page 13

I Event /Description Low Press S/G Injection (Service Water)

Depressurize the SGs by manually opening the atmospheric steam dumps and inject using service water through the failed AFW pumps.

RCS Feed and Bleed (Charging )

Feed and bleed using maximum charging flow and pressurizing the RCS up to the Pressurizer safety valve setpoint.

HEP Dependency Quantification This is the HEP for opening the atmospheric steam dumps as directed in procedure CSP-H.1, RNO column if the bleed portion of SI feed and bleed fails. Hardware failures are not included because the service water system had to succeed early or the AFW pumps would not have failed.

For this event, this action is completely dependent on the action to establish feed and bleed using charging since both are required for success. This is because low pressure steam generator injection will eventually lead to an open Pressurizer safety valve and charging is required for RCS makeup.

1.00 Base PRA model fault tree quantification with an HEP for maximizing charging flow and following the RNO column in CSP-H. 1 if the bleed portion of SI feed and bleed fails (approximately 40% of the failures of SI feed and bleed for the TD2 event).

Charging feed and bleed is also credited as directed in CSP-C1 when the core exit temperature exceeds 700°F. This is credited when the feed portion of SI feed and bleed fails (the remaining 60% of the failures).

L.27E-02 rhis factor accounts algebraically for the dependencies between the human actions within these mitigating strategies. Complete dependency is assumed for the cognitive iortion of the actions because they are all directed from the same procedure CSP-H. 1.

4 medium dependency is assumed for the execution portions of the HEPs because they ire directed by separate steps and sufficient time is available to complete all the ictions. The result is a multiplier that is applied to the product of the independent ailures.

!.40E+01 Page 14

Sequence #7 Successes prior to the new branches: AFW with suction from the CST (EventlDescriation Modified T2 Initiating Event Trip with a loss of heat sink as modified to include only the fraction of events where Main Feedwater is not available.

AM Feedwater (Plug)

Probability that AFW does not fail early and that operators fail to prevent plugging of all available AFW pumps.

~~

Ouantification The base T2 initiator frequency from the PRA model was reduced to the fraction of events where main feed is lost to initiate the event and by the fraction of events where main feedwater fails randomly. The random MFW failure probability is from a quantification of the base PRA model fault tree.

5.813-02 = (1-7.70E-01)*(1.9OE-01) + (7.70E-01)*( 1.90E-01)*(9.48E-02) 1.90E-01 T2 initiating event frequency from the base PRA model.

7.7OE-01 Fraction of T2 events that are not loss of MFW from the base PRA model 9.48E-02

'Random failure probability of MEW from base PRA model fault tree quantification. This includes hardware failures and the HEP for hotwell refill using the Fire Water System The random early failure of AFW is from the PRA model fault tree modified to remove late supply failures. If one pump fails randomly, it is assumed that the operators will not be able to recognize a common cause and will start a second pump, which will also fail.

Water Treatment is also credited here. Water Treatment random failures are from a new fault tree.

The probability of operators failing to recognize the common cause of failures before 311 pumps are failed was quantified by an HRA event tree.

For the time period when all AFW pumps were susceptible:

3.20E-02 = 3.31E-02* [(1.68E-01

1.0) + (8.32E-01

9.61E-01)]

3.31E-02 Fault tree quantification for failure of Water Treatment following a T2 event.

Fault tree quantification for any one AFW pump fails randomly given T2 initiating event 1.68E-01 1.o 8.32E-01 9.61E-01 Assumed operator failure if one AFW pump fails randorr..j Complementary event - no AFW pumps fail randomly HEP for failure to recognize common cause failure due to plugging given no random failures occurred

or the time period when only MDAFW pumps were susceptible:

!.15E-03 = 3.31E-02* (6.49E-02* 1.0)

Page 15

Event / Description RCS Feed and Bleed (Late)

Quantification Success branch for SI feed and bleed.

Shutdown Cooling Closed cycle RCS cooling using the RHR system.

This value is based upon a quantification of the base PRA model fault tree for RHR cooling given a T2 event. A high dependency recovery of test return valves that were left in the open position following the last flow test of RHR was also applied in this case because of the time available.

2.813-03 TRANSIENT WITH HEAT SINK Sequence #3 Successes prior to the new branches: AFW with suction from the CST.

Event / Description T3 Initiating Event Trip where the Main Condenser heat sink and Main Feedwater are still available.

Aux Feedwater (Plug)

Probability that AFW does not fail early and that operators fail to prevent plugging of all available AFW pumps.

Quantification Frequency from the base PRA model.

6.60E-01 The random early failure of AFW is from the PRA model fault tree modified to remove late supply failures. If one pump fails randomly, it is assumed that the operators will not be able to recognize a common cause and will start a second pump, which will also fail.

Water Treatment is also credited here. Water Treatment random failures are from a new fault tree.

The probability of operators failing to recognize the common cause of failures before Page 16

Event / Description Failure of feed and bleed using SI after initial AFW success Main Feedwater Main Feedwater fails to continue to run following a general plant trip.

RCS Feed and Bleed (Late)

Quantification all pumps are failed was quantified by an HRA event tree.

For the time period when all AFW pumps were susceptible:

3.20E-02 = 3.31E-02* [(1.68E-01

1.0) + (8.32E-01

9.61E-01)]

3.31E-02 Fault tree quantification for failure of Water Treatment following a T2 event.

Fault tree quantification for any one AFW pump fails randomly given T2 initiating event Assumed operator failure if one AFW pump fails randomly Complementary event - no AFW pumps fail randomly HEP for failure to recognize common cause failure due to plugging given no random failures occurred 1.68E-01 1.o 8.32E-01 9.61E-01 For the time period when only MDAFW pumps were susceptible:

2.15E-03 = 3.31E-02* (6.49E-02* 1.0) 3.3 1E-02 Fault tree quantification for failure of Water Treatment following a T2 event.

Fault tree quantification for TDAFW pump fails randomly given T2 initiating event Assumed operator failure if one AFW pump fails randomly 6.49E-02 1.o rhese values are then combined by the fraction of the year the pumps were susceptible

o arrive at the final result:

L.63E-02 = (3.20E-02*0.472) + (2.15E-03*0.528)

Xandom failure probability from the base PRA model fault tree quantification.

9.743-03 3ase PRA model fault tree quantification with an HEP for establishing feed and bleed ising high pressure SI that takes credit for additional time available later in the event iecause decay heat is lower.

1.12E-02 Page 17

I Low Press S/G Injection (Service Water)

Depressurize the SGs by manually opening the atmospheric steam dumps and inject using service water through the failed AFW pumps.

RCS Feed and Bleed (Charging )

Feed and bleed using maximum charging flow and pressurizing the RCS up to the Pressurizer safety valve setpoint.

HEP Dependency Quantification This is the HEP for opening the atmospheric steam dumps as directed in procedure CSP-H.1, RNO column if the bleed portion of SI feed and bleed fails. Hardware failures are not included because the service water system had to succeed early or the AFW pumps would not have failed.

For this event, this action is completely dependent on the action to establish feed and bleed using charging since both are required for success. This is because low pressure steam generator injection will eventually lead to an open Pressurizer safety valve and charging is required for RCS makeup.

1.00 Base PRA model fault tree quantification with an HEP for maximizing charging flow and following the RNO column in CSP-H.1 if the bleed portion of SI feed and bleed fails (approximately 40% of the failures of SI feed and bleed for the TD2 event).

Charging feed and bleed is also credited as directed in CSP-Cl when the core exit temperature exceeds 700°F. This is credited when the feed portion of SI feed and bleed fails (the remaining 60% of the failures).

1.273-02 rhis factor accounts algebraically for the dependencies between the human actions within these mitigating strategies. Complete dependency is assumed for the cognitive Jortion of the actions because they are all directed from the same procedure CSP-H. 1.

4 medium dependency is assumed for the execution portions of the HEPs because they ire directed by separate steps and sufficient time is available to complete all the ictions. The result is a multiplier that is applied to the product of the independent ailures.

1.40E+01 Sequence #7 Successes prior to the new branches: AFW with suction from the CST.

I Event / Description I Ouantification 1 T3 Initiating Event I Frequency from the base PRA model.

I I

Trip where the Main Condenser heat sink and Main Feedwater are still available.

6.60E-01

~

~-~

I Aux Feedwater (Plug) I The random early failure of AFW is from the PRA model fault tree modified to remove Probability that AFW does not fail early and that operators fail to late supply failures. If one pump fails randomly, it is assumed that the operators will not be able to recognize a common cause and will start a second pump, which will also fail.

Page 18

Event / DescriDtion available AFW pumps.

ICs Feed and Bleed Late)

Main Feedwater vlain Feedwater fails to

ontinue to run following i general plant trip.

Quantification Water Treatment is also credited here. Water Treatment random failures are from a new fault tree.

The probability of operators failing to recognize the common cause of failures before all pumps are failed was quantified by an HRA event tree.

For the time period when all AFW pumps were susceptible:

3.20E-02 = 3.31E-02* [(1.68E-01

1.0) + (8.32E-01

9.61E-01)]

3.3 1E-02 Fault tree quantification for failure of Water Treatment following a T2 event.

Fault tree quantification for any one AFW pump fails randomly given T2 initiating event Assumed operator failure if one AFW pump fails randomly Complementary event - no AFW pumps fail randomly HEP for failure to recognize common cause failure due to plugging given no random failures occurred 1.68E-01 1.o 8.32E-0 9.61E-0 For the time period when only MDAFW pumps were susceptible:

2.15E-03 = 3.31E-02" (6.49E-02* 1.0) 3.31E-02 Fault tree quantification for failure of Water Treatment following a T2 event.

Fault tree quantification for TDAFW pump fails randomly given T2 initiating event Assumed operator failure if one AFW pump fails randomly 6.49E-02 1.o rhese values are then combined by the fraction of the year the pumps were susceptible o arrive at the final result:

1.63E-02 = (3.20E-02*0.472) + (2.15E-03*0.528) juccess branch for SI feed and bleed.

tandom failure probability from the base PRA model fault tree quantification.

1.74E-03 Page 19

Event /Description Shutdown Cooling Quantification Closed cycle RCS cooling using the RHR I system.

' This value is based upon a quantification of the base PRA model fault tree for RHR cooling given a T2 event. A high dependency recovery of test return valves that were left in the open position following the last flow test of RH?? was also applied in this case because of the time available.

2.813-03 SINGLE UNIT LOOP On Unit 2, this event results in a loss of Water Treatment because the primary AC power for the system comes from Unit 2 balance of pIant sources. For this single unit transient, restoration of offsite power must be accomplished with enough time remaining before the CST is drained to allow for restoration of Water Treatment. MAAP runs showed this time to be approximately 4.8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . A restoration of offsite power probability at four hours was therefore used.

Sequence #3 Successes prior to the new branches: AFW with suction from the CST.

Event / Description SLOOP Single unit loss of offsite power.

Aux Feedwater (Plug)

Probability that AFW does not fail early and that operators fail to prevent plugging of all available AFW pumps.

~~

~

Quantification Fraction of T2 events that are SLOOP from the base PRA model.

2.393-02 = (1.9E-01

1.26E-0 1) 1.90E-01 T2 initiating event frequency from the base PRA model.

1.26E-01 Fraction of T2 events that are from a single unit loss of offsite power from data analysis for the base PRA model The random early failure of AFW is from the PRA model fault tree modified to remove late supply failures. If one pump fails randomly, it is assumed that the operators will not be able to recognize a common cause and will start a second pump, which will also fail.

Water Treatment and Main Feedwater are also credited here when offsite power is recovered before the CST is depleted. Water Treatment random failures are from a new fault tree. Main Feedwater failure probability is from the base PRA model fault tree and hotwell makeup using fire water. Recovery of offsite power probability at four hours is from the base PRA model.

The probability of operators failing to recognize the common cause of failures before all pumps are failed was quantified by an HRA event tree.

For the time period when all AFW pumps were susceptible:

1.33E-01 = 1.38E-01" [(2.26E-01

1.0) + (7.74E-01

9.61E-01)]

Page 20

Event /Description AFW success Quantification 1.38E-01 = 1.30E-01 + (2.90E-02

2.61E-01) 1.30E-01 Failure to recover offsite power in 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months 2.90E-02 Failure of Water Treatment 2.61E-01 Failure of Main Feedwater or hotwell makeup using water from the Fire Protection System.

2.26E-01 Fault tree quantification for any one AFW pump fails randomly given T1 initiating event Assumed operator failure if one AFW pump fails randomly Complementary event - no AFW pumps fail randomly HEP for failure to recognize common cause failure due to plugging given no random failures occurred 1.o 7.74E-01 9.61E-01 For the time period when only MDAFW pumps were susceptible:

1.05E-02 = 1.38E-01" (7.64E-02* 1.0) 1.38E-01 = 1.30E-01 + (2.90E-02

2.61E-01) 1.3OE-01 Failure to recover offsite power in 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months 2.90E-02 Failure of Water Treatment 2.61E-01 Failure of Main Feedwater or hotwell makeup using water from the Fire Protection System.

7.64E-02 Fault tree quantification for TDAFW pump fails randomly given T1 initiating event Assumed operator failure if one AFW pump fails randomly 1.0 rhese values are then combined by the fraction of the year the pumps were susceptible o arrive at the final result:

i.85E-02 =

(1.33E-01*0.472) + (1.05E-02*0.528) 3ase PRA model fault tree quantification with an HEP for establishing feed and bleed sing high pressure SI that takes credit for additional time available later in the event

)ecause decay heat is lower.

..42E-O2 Page 2 1

Event / Description Low Press S/G Injection (Service Water)

Depressurize the SGs by manually opening the atmospheric steam dumps and inject using service water through the failed AFW pumps.

RCS Feed and Bleed (Charging )

Feed and bleed using maximum charging flow and pressurizing the RCS up to the Pressurizer safety valve setpoint.

HEP Dependency puantification This is the HEP for opening the atmospheric steam dumps as directed in procedure CSP-H.1, RNO column if the bleed portion of SI feed and bleed fails. Hardware failures are not included because the service water system had to succeed early or the AFW pumps would not have failed.

For this event, this action is completely dependent on the action to establish feed and bleed using charging since both are required for success. This is because low pressure steam generator injection will eventually lead to an open Pressurizer safety valve and charging is required for RCS makeup.

1.00

~~

Base PRA model fault tree quantification with an HEP for maximizing charging flow and following the RNO column in CSP-H.l if the bleed portion of SI feed and bleed fails (approximately 40% of the failures of SI feed and bleed for the TD2 event).

Charging feed and bleed is also credited as directed in CSP-C1 when the core exit temperature exceeds 700'F. This is credited when the feed portion of SI feed and bleed fails (the remaining 60% of the failures).

1.543-02

~~

This factor accounts algebraically for the dependencies between the human actions within these mitigating strategies. Complete dependency is assumed for the cognitive portion of the actions because they are all directed from the same procedure CSP-H.l.

4 medium dependency is assumed for the execution portions of the HEPs because they ue directed by separate steps and sufficient time is available to complete all the ictions. The result is a multiplier that is applied to the product of the independent Failures.

1.61E+01 Sequence #7 Successes prior to the new branches: AFW with suction from the CST.

I I

Event / Description SLOOP Single unit loss of offsite power.

Ouantification Fraction of T2 events that are SLOOP from the base PRA model.

2.393-02 = (1.9E-01

1.26E-01) 1.9OE-01 T2 initiating event frequency from the base PRA model.

1.26E-01 Fraction of T2 events that are from a single unit loss of offsite power from data analysis for the base PRA model Aux Feedwater (Plug)

Probability that AFW does not fail early and The random early failure of AFW is from the PRA model fault tree modified to remove late supply failures. If one pump fails randomly, it is assumed that the operators will not be able to recognize a common cause and will start a second pump, which will also Page 22

~

Event / Description that operators fail to prevent plugging of all available AFW pumps.

~

Ouantification fail.

Water Treatment and Main Feedwater are also credited here when offsite power is recovered before the CST is depleted. Water Treatment random failures are from a new fault tree. Main Feedwater failure probability is from the base PRA model fault tree and hotwell makeup using fire water. Recovery of offsite power probability at four hours is from the base PRA model.

The probability of operators failing to recognize the common cause of failures before all pumps are failed was quantified by an HRA event tree.

For the time period when all AFW pumps were susceptible:

1.33E-01 = 1.38E-01* [(2.26E-01

1.0) + (7.74E-01

9.6lE-01)]

1.38E-01 = 1.30E-01 + (2.9OE-02

2.61E-01) 1.30E-01 Failure to recover offsite power in 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months 2.90E-02 Failure of Water Treatment 2.61E-01 Failure of Main Feedwater or hotwell makeup using water from the Fire Protection System.

2.26E-01 Fault tree quantification for any one AFW pump fails randomly given T1 initiating event Assumed operator failure if one AFW pump fails randomly Complementary event - no AFW pumps fail randomly HEP for failure to recognize common cause failure due to plugging given no random failures occurred 1.o 7.74E-01 9.61E-01 For the time period when only MDAFW pumps were susceptible:

1.05E-02 = 1.38E-01" (7.64E-02* 1.0) 1.38E-01 = 1.3OE-01 + (2.90E-02

2.61E-01) 1.3OE-01 Failure to recover offsite power in 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months 2.9OE-02 Failure of Water Treatment 2.61E-01 Failure of Main Feedwater or hotwe11 makeup using water from the Fire Protection System.

7.64E-02 Fault tree quantification for TDAFW pump fails randomly given T1 initiating event Assumed operator failure if one AFW pump fails randomly 1.o Page 23

Event I Description RCS Feed and Bleed 1 (Late)

Ouantification These values are then combined by the fraction of the year the pumps were susceptible to arrive at the final result:

6.853-02 = (1.33E-01*0.472) i-(1.05E-02*0.528)

Shutdown Cooling Seismic-Low Closed cycle RCS cooling using the RHR system.

Based on the SI fragility curve from the seismic PRA done for the IPEEE.

Success branch for SI feed and bleed.

This value is based upon a quantification of the base PRA model fault tree for RHR cooling given a T1 event. A high dependency recovery of test return valves that were left in the open position following the last flow test of RHR was also applied in this case because of the time available.

3.323-03 SEISMIC EVENT - LOW Walkdowns of critical equipment were performed by seismic experts to support this risk evaluation. The observations made on these walkdowns confirmed that instrument air would be lost in a seismic event above an operating basis earthquake. However, these walkdowns also confirmed that the CST and AFW suction piping from the CST would survive intact an event of magnitude almost up to a safe shutdown earthquake. This means that AFW with suction from the CST can be credited until CST inventory is depleted. Also surviving intact up to this magnitude is the charging system (although charging normally relies on instrument air to increase pump speed above minimum). Charging feed and bleed can then also be credited. The seismic event frequency where a different response is required is determined by the fragility of the SI system. The low magnitude seismic events are where SI is still available.

Sequence #4 Successes prior to the new branches: Control of Charging flow (dependent on Instrument Air),

and AFW with suction from the CST.

1 I

I Event /Description I Quantification Lower magnitude seismic event above the operating basis earthquake but where SI/RHR is still available.

Aux Feedwater (Plug)

Probability that AFW does not fail early and 2.50E-04lyr The random early failure of AFW is from the PRA model fault tree modified to remove late supply failures. If one pump fails randomly, it is assumed that the operators will not be able to recognize a common cause and will start a second pump, which will then Page 24

Event / Description that operators fail to prevent plugging of all available AFW pumps.

Aow Press S/G njection (Service Water)

Iepressurize the SGs by nanually opening the

.&nospheric steam lumps and inject using ervice water through the ailed AFW pumps.

LCS Feed and Bleed Charging )

eed and bleed using iaximum charging flow nd pressurizing the RCS p to the Pressurizer afety valve setpoint.

Ouantification also fail.

The probability of operators failing to recognize the common cause of failures before all pumps are failed was quantified by an HRA event tree.

For the time period when all AFW pumps were susceptible:

5.77E-01 = (2.73E-01

1.0) + (7.27E-01

4.18E-01) 2.73E-01 Fault tree quantification for any one AFW pump fails randomly given IA failure event 1.0 Assumed operator failure if one AFW pump fails randomly 7.27E-01 Complementary event - no AFW pumps fail randomly 4.18E-01 HEP for failure to recognize common cause failure due to plugging given no random failures occurred For the time period when only MDAFW pumps were susceptible:

7.22E-02 Fault tree quantification for TDAFW pump fails randomly given IA failure event These values are then combined by the fraction of the year the pumps were susceptible to arrive at the final result:

3.10E-01 = (5.77E-01*0.472) + (7.22E-02*0.528)

This is the HEP for opening the atmospheric steam dumps as directed in procedure 2SP-H. 1, RNO column if the bleed portion of SI feed and bleed fails. Hardware railures are not included because the service water system had to succeed early or the 4FW pumps would not have failed.

?or this event, this action is completely dependent on the action to establish feed and ileed using charging since both are required for success. This is because low pressure

team generator injection will eventually lead to an open Pressurizer safety valve and

harging is required for RCS makeup.

1.00 3ase PRA model fault tree quantification with an HEP for maximizing charging flow md following the RNO column in CSP-H. 1 because the bleed portion of SI feed and

)leed fails due to not having instrument air available for the Pressurizer PORVs.

!.233-02 Page 25

Event /Description HEP Dependency 1.00 Ouantification Because low pressure steam generator injection is already completely dependent on the charging feed and bleed action, no other dependencies need to be applied.

Sequence #5 Successes prior to the new branches: Control of Charging flow (dependent on Instrument Air),

and AFW with suction from the CST.

1 Event /Description Seismic-Low Lower magnitude seismic event above the operating basis earthquake but where SI/RHR is still available.

Aux Feedwater (Plug)

Probability that AFW does not fail early and that operators fail to prevent plugging of all available AFW pumps.

Quantification Based on the SI fragility curve from the seismic PRA done for the LPEEE.

The random early failure of AFW is from the PRA model fault tree modified to remove late supply failures. If one pump fails randomly, it is assumed that the operators will not be able to recognize a common cause and will start a second pump, which will then also fail.

The probability of operators failing to recognize the common cause of failures before all pumps are failed was quantified by an HRA event tree.

For the time period when all AFW pumps were susceptible:

5.77E-01 = (2.73E-01

1.0) + (7.27E-01

4.18E-01) 2.73E-01 Fault tree quantification for any one AFW pump fails randomly given IA failure event 1.o Assumed operator failure if one AFW pump fails randomly 7.27E-01 Complementary event - no AFW pumps fail randomly 4.18E-01 HEP for failure to recognize common cause failure due to plugging given no random failures occurred For the time period when only MDAFW pumps were susceptible:

7.22E-02 Fault tree quantification for TDAFW pump fails randomly given IA failure event These values are then combined by the fraction of the year the pumps were susceptible to arrive at the final result:

Page 26

I Event / Description t---

Low Press S/G Injection (Service Water)

Depressurize the SGs by manually opening the atmospheric steam dumps and inject using service water through the failed AFW pumps.

RCS Feed and Bleed (Charging )

Shutdown Cooling Closed cycle RCS cooling using the RHR system.

Ouantification 3.10E-01= (5.77E-01*0.472) + (7.22E-02*0.528)

This is the HEP for opening the atmospheric steam dumps as directed in procedure CSP-H.1, RNO column if the bleed portion of SI feed and bleed fails. Hardware failures are not included because the service water system had to succeed early or the AFW pumps would not have failed.

For this event, this action is completely dependent on the action to establish feed and bleed using charging since both are required for success. This is because low pressure steam generator injection will eventually lead to an open Pressurizer safety valve and charging is required for RCS makeup.

1.00 Success branch This value is based upon a quantification of the base PRA model fault tree for RHR cooling. A high dependency recovery of test return valves that were left in the open position following the last flow test of RHR was also applied in this case because of the time available.

2.903-03 SEISMIC EVENT - HIGH These seismic events are those above the magnitude where SI fails but where AFW with suction from the CST is still intact.

Successes prior to the new branches: AFW with suction from the CST Event / Description Seismic Event - High Seismic event large enough to fail SI/RHR but less than the AFW failure magnitude.

Quantification Based on the AFW and SI fragility curves from the seismic PRA done for the IPEEE, with additional information provided by walkdowns of the CST and AFW suction piping.

2.02E-05 Aux Feedwater (Plug)

Probability that AFW does not fail early and that operators fail to prevent plugging of all available AFW pumps.

The random early failure of AFW is from the PRA model fault tree modified to remove late supply failures. If one pump fails randomly, it is assumed that the operators will not be able to recognize a common cause and will start a second pump, which will then also fail.

The probability of operators failing to recognize the common cause of failures before all pumps are failed was quantified by an HRA event tree.

For the time period when all AFW pumps were susceptible:

Event /Description Low Press SIG Injection (Service Water)

>epressurize the SGs by nanually opening the itmospheric steam lumps and inject using iervice water through the ailed AFW pumps.

5.77E-01 = (2.738-01

1.0) -I- (7.278-01

4.18E-01) 2.73E-01 Fault tree quantification for any one AFW pump fails randomly given IA failure event Assumed operator failure if one AFW pump fails randomly Complementary event - no AFW pumps fail randomly HEP for failure to recognize common cause failure due to plugging given no random failures occurred 1.o 7.27E-01 4.18E-01 For the time period when only MDAFW pumps were susceptible:

7.22E-02 Fault tree quantification for TDAFW pump fails randomly given IA failure event These values are then combined by the fraction of the year the pumps were susceptible to arrive at the final result:

3.10E-01 = (5.77E-01*0.472) + (7.22E-02*0.528) rhis is the HEP for opening the atmospheric steam dumps as directed in procedure ZSP-H. 1, RNO column if the bleed portion of SI feed and bleed fails. Hardware

'ailures are not included because the service water system had to succeed early or the W pumps would not have failed.

?or this event, this action is completely dependent on the action to establish feed and Aced using charging since both are required for success. This is because low pressure

team generator injection will eventually lead to an open Pressurizer safety valve and

harging is required for RCS makeup.

1.00 Page 28

Internal Events Screened from Further Consideration Large LOCA AFW is not used in response to this event.

Medium LOCA The mission time for AFW in this event i s less than one hour. CST volume is sufficient for this period of time, so swap of the suction to Service Water or Fire Protection water is not required and the AFW pumps would not be failed.

Small LOCA MAAP analysis of this event has demonstrated that, following initial success of AFW, cooldown through the break with an SI pump injecting is sufficient to reach RCS conditions where RHR can be placed into service before core uncovery occurs. For cases where SI is not available, injection using the charging pumps is also sufficient to prevent core damage.

Excessive LOCA The reactor pressure vessel rupture event leads directly to core damage. AFW is not credited.

Interfacing Systems LOCA An unisolated interfacing systems rupture will lead directly to core damage. AFW is not credited.

Steam Generator Tube Rupture Similar to the Small LOCA, MAAP analysis has shown that with an SI pump injecting, cooldown through the ruptured tube and the atmospheric steam dump is sufficient to reach RCS conditions where RHR can be placed into service before core uncovery occurs. For cases where SI is not available, injection using the charging pumps is also sufficient to prevent core damage.

Feed and bleed conditions are never reached because the ruptured tube keeps the affected steam generator filled above the level that would cause the operators to initiate it.

Loss of DC Bus DO1 On Unit 2, Main Feedwater is still available for this event and AFW would only be used if MFW was to fail randomly. The initiating event frequency and plant response will be similar to that for a loss of Bus DO2 except that availability of Main Feedwater will reduce it by at least an order of magnitude.

Station Blackout The SBO initiating event frequency is low enough to bring this event to less than 1% of the total change in CDP.

Steam Line Break Outside Containment A preliminary quantification the delta CDP for this event showed it to be less than 1% of the total.

Page 29

Feed Line or Steam Line Break Inside Containment A preliminary quantification the delta CDP for this event showed it to be less than 1% of the total.

Loss of Component Cooling Water A preliminary quantification the delta CDP for this event showed it to be less than 1% of the total.

Page 30

ATTACHMENT 3 Calculation of Availabilitv/Reliabilitv of the Water Treatment System (Final)

POINT BEACH NUCLEAR PLANT, UNITS I AND 2

Point Beach Nuclear Plant 1

I This Calculation has been reviewed in accordance with NP 7.2.4. The review was arrnmnlinhed hv nne n r a combination of the follnwine (check all that aodv):

Reviewers' Initials CALCULATION COVER SHEET 1 CalculatiodAddendum Number: I Title of CalculatiodAddendum:

12003-0053 Water Treatment System Reliability and Availability for AFW Orifice Issue Risk I

I System (CHAMPS Identifier Codes):

None Original CalculatiodAddendum CI Supersedes CalculatiodAddendum I 0 Revised CalculatiodAddendum Revision ## -

I QAScope OYes HNo Discipline CIV NUC C]ELEC UCOMP u I & C OCHElWRAD UMECH C]SYST I

HPRA Associated Documents:

None Superseded By CalculatiodAddendum #

None I 0 A review of a representative sample of repetitive calculations.

I PBF-1608 Revision 5 01/10/01 Page 1

Reference:

NP 7.2.4

CalcuIation 2003-0053 Revision 0

Section or Attachment Cover Sheet Page Inventory Comments 1.0 Purpose 2.0 Methodology 3.0 Acceptance Criteria 4.0 Assumptions 5.0 References 6.0 Inputs 7.0 Calculation 8.0 Results and ConcIusions Appendix A Appendix B Appendix C Appendix D 4ppendix E Calculation Page Inventory Page #(s)

Revision Section or Attachment Page #(s)

Revision 1

0 2

0 3

0 4

0 5

0 5 - 6 0

6 0

7 - 9 0

9 0

10- 12 0

13 - 15 0

16 - 17 0

18 - 19 0

20 - 25 0

PBF-1603 Revision 5 Ol/iO/Ol Page 2

Reference:

NP i.2.4

Calculation 2003-0053 Revision 0

Comments And Resolution Reviewer Comments:

Common mode failures for components in the Water Treatment system could be significant and need to be included in the hardware failures.

Resolution:

Common mode failures were added using generic common mode factors. The total hardware failure probability increased by a little more than double, but is still dominated by test and maintenance unavailability and support system failures.

PBF-1608 Revision 5 01/10/01 Page 3 ReFcrence SP 7.2 4

Calculation 2003-0053 Revision 0

1.0 PURPOSE The purpose of this calculation is to determine a probability that the Water Treatment System will not be available during a 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months time period following a plant trip or accident. This probability includes both an equipment maintenance unavailability component and an equipment reliability component. The result of this calculation are used as an input to the Auxiliary Feedwater (AFW) recirculation orifice issue Phase 3 Significance Determination Process (SDP) risk calculation.

The scope of this calculation is Non-QA. It is a PRA calculation that is being performed using standard industry PRA guidance. Specifically:

0 0

0 Another technically qualified person shall review the calculation. However, this review is not required to be independent.

Inputs and Assumptions shall be reviewed and be reasonable for the scenario being analyzed (best-estimate).

Inputs and Assumptions are not required to be validated.

Inputs and assumptions already contained within the revision of the PRA model being used to support this calculation are not required to be documented here. Changes to the inputs and assumptions specific to this calculation shall be documented in the inputs and assumptions section of this calculation.

The PRA software programs used to support this calculation are best-estimate tools and are not required to meet the criteria of Appendix A of Np 7.2.4.

References used to support this calculation are,be documented. This includes the revision of the PRA model a

supporting the calculation.

i" Acronyms used in this calculation:

AFW CST DLOOP HEP HRA MOV P&ID SI SLOOP Auxiliary Feedwater Condensate Storage Tank Dual Unit Loss of Offsite Power Human Error Probability Human Reliability Analysis Motor Operated Valve Piping and Instrument Diagram Safety Injection Single Unit Loss of Offsite Power 2.0 METHODOLOGY The failure probability or the Water Treatment System was determined in this calculation by a simplified fault tree analysis because detailed results of individual component importances within the system were not needed - only a final failure probability was required. The failure of the system itself was determined from a table of component failure probabilities. This value was then input to the fault tree, where test and maintenance unavailability and human error probability were added and the required support system fault trees were linked in.

Hardware failure probabilities within the system itself were determined by use of a failure modes table of components within the various trains of the system (Attachment B). Failures within the various trains were summed together and then multiplied together to find the failure probability of all of the redundant paths. This method was continued through the entire system to determine a final hardware failure probability for Water Treatment.

The fault tree that was used to link in the support system failures is shown in Attachment A. This fault tree was developed from the P&IDs [References. 5.4 through 5.71 for support system information and from the Point Beach CHAMPS database [Reference 5.81 for component electrical power supply information. The fault tree was quantified using the WinNUPRA PRA software [Reference 5.31 for two different top gates: Water Treatment failure with and SI signal present and Water Treatment failure with no SI signal present. These two values provided the final result.

Page 4

Calculation 2003-0053 Revision 0

3.0 ACCEPTANCE CRITERIA The results of this calculation are the probability that the Water Treatment System will be unavailable at any time during a 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months time period when required to help mitigate an accident. No acceptance criteria apply.

4.0 ASSUMPTIONS 4.1 It is assumed that the portions of the Point Beach PRA Model used in this calculation provide probability results that are of sufficient accuracy for the purpose of this evaluation. The PRA model version used for this calculation is Revision 3.07 dated 01/09/2003. This model has not yet undergone final review and the documentation is thus still in draft form. However, the results from the model have been reviewed and are considered to be reasonable, and no significant changes are expected to result from the final review.

It is assumed that including only the major flowpath components for the Water Treatment System will provide a reasonable estimate of the failure probability for the entire system. These major flowpath elements include pumps, check valves, air operated valves, and their respective power supplies and support systems.

The failure probability for control circuits, filters, and chemical addition components are small compared to the major component failure probabilities and can there fore be neglected without affecting the results to any significant degree.

It is assumed that the maintenance unavailability for the Water Treatment System (i.e,, times when the entire system was off line and no water makeup was available) is no more than 3.5 days per year or about 0.01.

This value is based on an interview of a Plant Manager and another SRO in November 2002. No plant log records of Water Treatment System unavailability are available. System Engineer notes from November 2001 through October 2002 did not indicate any time that the entire system was unavailable. Only portions of the multi-train system were noted as being unavailable. The System Engineer confirmed that the 0.01 value for test and maintenance unavailability was bounding in a teleconference held on 06/16/2003. See also the tabulation of component unavailability events in Appendix E.

It is assumed that the generic industry data for component reliabilities also apply to the Water Treatment System component reliabilities. This is standard PRA practice for systems for which little or no plant specific data is available.

It is assumed that a human error probability for the Operator failing to maintain CST level from the Water Treatment System following events where a Safety Injection Signal is not received is 1.OE-03. This is a nominal HEP for an operator to read a gauge and control flow manually given feedback from the Control Room operator that the CST level will continue to fall if the action is not done properly.

It is assumed that the Water Treatment System is required to operate for a 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months time period following a plant trip or accident. This is consistent with the mission time assumed for other support systems in the Point Beach PRA Model.

It is assumed that the generic common cause terms from NUREG/CR-5485 are sufficient to evaluate the magnitude of the common cause failures in this calculation. This is consistent with the philosophy used for the Point Beach PRA Model for systems that do not have specific terms.

4.2 4.3 4.4 4.5 4.6 4.7

5.0 REFERENCES

5.1 5.2 5.3 5.4 Point Beach PRA Model Revision 3.05, dated 09/12/2002.

Point Beach PRA Model Data Analysis Notebook, PRA 4.0, Draft.

WinNUPRA Version 2.1, SCIENTECH, Inc.

Point Beach P&ID M-210 Sheet 1, Plant Make-up Water Treatment System Pretreatment System, Revision 16,03/01/2003 Point Beach P&ID M-210 Sheet 2, Plant Make-up Water Treatment System Demineralizer System, Revision 19,01/15/2003 5.5 Page 5

Calculation 2003-0053 Revision 0

5.6 5.7 5.8 5.9 Point Beach P&ID WSC D96G0901, Water Treatment Reverse Osmosis System, Revision 09,03/25/2000 Point Beach P&ID M-2207 Sheet 1, Service Water, Revision 54, 06/17/2000 Point Beach CHAMPS (Component History and Maintenance Planning System) Database Guidelines on Modeling Common Cause Failures in Probabilistic Risk Assessment, NUREG/CR-5485, November 1998.

6.0 INPUTS 6.1 6.2 6.3 6.4 6.5 6.6 6.7 The following support system fault trees from Revision 3.05 of the Point Beach PRA Model were linked into the Water Treatment System fault tree developed for this calculation: Instrument Air (IA.lgc), Service Water (SWS.lgc), 480 V MCC 2B32 (2B32.lgc), 480 V MCC 2B42 (2B42.lgc), 480 V Bus 2B02 (2B02.lgc), 4 KV Bus lA02 (1A02.lgc), and 13.8 KV Bus H01 (HOl.lgc). These fault trees also link to their own respective support system fault trees. By Assumption 4.1, all of these fault tree models and their basic event data inputs are incorporated into this calculation by reference and are not evaluated further here.

From Assumption 4.3, the test and maintenance unavailability of the Water Treatment System is 0.01.

A human error probability for the operator failing to restore the Water Treatment System following a Safety Injection signal is 3.9E-03. This is from the HRA report prepared by SCIENTECH for the Auxiliary Feedwater orifice issue response.

From Assumption 4.5, a human error probability for failure to maintain CST level using the Water Treatment System for events where an SI signal was not received is 1.OE-03.

The following generic industry component failure probabilities are taken from Table 8 of Reference 5.2:

Electrical Panel Loss of Power 1.00E-O7/hr Electrical Bus Loss of Power 1.00E-O7/hr Electric Power Transformer Fault 8.10E-O7/hr Air Operated Valve Failure to Open Check Valve Failure to Open Check Valve Failure to Close Motor Driven Pump Failure to Start 1.74E-03 5.00E-05 1.00E-03 1.40E-03 Motor Driven Pump Failure to Run 3.40E-O5/hr The following plant specific component failure probabilities are taken from Table 5 in Reference 5.2:

Service Water MOV failure to open 2.OOE-03 The following generic common mode failure terms were extracted from Table 5-1 1 in Reference 5.9:

Demand Failures:

2 / 2 components -

4.70E-02 3 I 3 components -

7.19E-02 Run Failures:

2 I 2 components -

2.35E-02 3 / 3 components -

3.73E-02 Page 6

Calculation 2003-0053 Revision 0

7.0 CALCULATION As described in the Methodology section, this calculation is divided into two distinct parts: to determine the hardware failure probability for the system and to link in the support system failures, human error probabilities, and test and maintenance unavailability.

The hardware failure probability for the Water Treatment System was determined using a table of component failure modes and probabilities that were combined in a manner to account for parallel flow paths. The table is shown in Attachment B. Some of the component failure probability values in the table are derived from those in Input 6.5 and these are calculated below. The component failure probabilities that are taken directly from those in Input 6.5 are not repeated below.

Reverse Osmosis Units -

This failure probability is a combination of pump failure to start and failure to run for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months for the booster pump and high pressure pump in each of the three units.

2*( 1.40E-03 + 3.40E-O5/hr*24hrs) = 4.43E-03 WT-702A, B, and C Check Valves These Clearwell Pump discharge check valves may need to cycle open or closed if pumps are swapped during the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months run, so thz failure probabilities for one cycle open and closed were used.

(1.00E-03 + 5.00E-05) = 1.05E-03 P95A, B, and C Clearwell Pumps -

This failure probability is a combination of pump failure to start and failure to run for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

(1.40E-03 + 3.40E-O5/hr*24hrs) = 2.22E-03 P56A, B, and C Deaerator Vacuum Pumps - This failure probability is a combination of pump failure to start and failure to run for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

(1.4OE-03 + 3.40E-O5/hr*24hrs) = 2.22E-03 P44A, B, and C Deaerator Water Pumps -

This failure probability is a combination of pump failure to start and failure to run for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

(1.4OE-03 + 3.40E-O5/hr*24hrs) = 2.22E-03 WT-709A, B, and C Check Valves These Deaerator outlet check valves may need to cycle open or closed if pumps are swapped during the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months run, so the failure probabilities for one cycle open and closed were used.

(1.00E-03 + 5.00E-05) = 1.05E-03 The "Combined Probability" column in Attachment B takes into account the multiple failures that need to occur in redundant components for a failure in the flowpath to occur. For sections of the system with two redundant flowpaths, the individual component probabilities in each train are first summed and then squared to arrive at the combined probability for that section. For sections of the system with three redundant flowpaths, the individual component probabilities in each train are first summed and then cubed to arrive at the combined probability for that section.

Double Failures:

Mixed Bed Valves

( 1.74E-03 + 1.74E-03)2 = 1.2 IE-05 Product Transfer Pumps

( 1.05E-03 + 2.22E-03)' = 1.07E-05 Page 7

Calculation 2003-0053 Revision 0

Triple Failures:

Cation Valves Reverse Osmosis Units Clearwell Pumps Water Softener Valves Gravity Filter Valves Deaerator Vacuum Pumps Deaerator Water Pumps Anion Valves (1.74E-03 + 1.74E-03)3 = 4.21E-08 (4.43E-03)3 = 8.71E-08 (1.05E-03 + 2.22E-03)3 = 3.48E-08 (1.74E-03 + 1.74E-03)3 = 4.21E-08 (1.74E-03 + 1.74E-03)3 = 4.21E-08 (2.22E-03)3 = 1.09E-08 (1.05E-03 + 2.22E-03)3 = 3.48E-08 (1.74E-03 + 1.74E-03)3 = 4.21E-08 The common mode portion of the failure calculation is shown below.

Double Failures:

Mixed Bed Valves Product Transfer Pumps Triple Failures:

Cation Valves Reverse Osmosis Units Clearwell Pumps Water Softener Valves Gravity Filter Valves Deaerator Vacuum Pumps Deaerator Water Pumps Anion Valves (1.74E-03

4.70E-02)

4 combinations

= 3.27E-04 (1.05E-03

4.7OE-02) + (1.40E-03

4.7OE-02) + (8.16E-04

2.35E-02)

= 1.34E-04 (1.74E-03

7.19E-02)

8 combinations

= 1.00E-03

[(1.40E-03

7.19E-02) + (8.16E-04

3.73E-02)J

8 combinations

= 1.05E-03 (I.05E-03

7.19E-02) + (1.4OE-03

7.19E-02) + (8.16E-04

3.73E-02)

= 2.07E-04 (1.74E-03

7.19E-02)

8 combinations

= 1.00E-03

( I.74E-03

7.19E-02)

8 combinations

= 1.00E-03 (1.4OE-03

7.19E-02) + (8.16E-04

3.73E-02)

= 1.31E-04 (1.05E-03

7.19E-02) + (1.40E-03

7.19E-02) + (8.16E-04

3.73E-02)

= 2.07E-04 (1.74E-03

7.19E-02)

8 combinations

= I.0OE-03 Page 8

Calculation 2003-0053 Revision 0

The singe, double, and triple failures were added together with the common mode failures for each section to arrive at the total failure probability for the system. As shown on the table in Attachment B, the Water Treatment hardware failure probability is 8.56E-03.

The next step is to quantify the fault tree for Water Treatment using the above derived value for hardware failures and other inputs and linked support systems. The fault tree, shown in Attachment A, has two top gates. The first, on page 1 at location 0-0, provides the failure probability for Water Treatment when an SI initiation signal caused isolation of Service Water from Water Treatment. The second top gate, on page 2 at location 0-0, is for continued Water Treatment System operation following a plant trip where an SI did not occur. A generic initiating event with a frequency value of 1.0 is ANDed in just below each of these two top gates. The reason for this generic initiator is to eliminate cutsets in the power supply train that only occur for LOOP or SBO events. These cutsets, which involve failures of diesel generators or the gas turbine, are not valid for this quantification because offsite power must be available or be restored for Water Treatment to function. For the SLOOP and DLOOP events, the restoration of offsite power is dealt with outside of this calculation.

The two top gates of the Water Treatment fault tree were quantified with a cutoff value of 1.OE-10. A listing of the top 100 core failure cutsets are listed in Appendix C for cases where a Safety Injection signal causes isolation of the Service Water supply, and in Appendix D for cases where there is no SI signal received.

8.0 RESULTS AND CONCLUSIONS Quantification of the fault tree model for the Water Treatment System provided the following probability results for system reliability and unavailability:

5.12E-02 for events where an SI signal occurs 2.67E-02 for events where an SI signal does not occur Note that these probability results do not include the probability of restoring offsite power and the human error probability to re-start Water Treatment after a loss of offsite power event. These will need to be factored in to the above results for the SLOOP and DLOOP events for a complete probability that the Water Treatment System is unavailable following these events.

Page 9

APPENDIX A Water Treatment System Fault Tree Calculation 2003-0053 Revision 0

w Page 10

Calculation 2003-0053 Revision 0

APPENDIX A Water Treatment System Fault Tree w

I Page 11

Calculation 2003-0053 Revision 0

APPENDIX A Water Treatment System Fault Tree 2

3 Page 12

Calculation 2003-005 3 Component Dependency Valve Mode Component Prob.

Combined Prob.

PositiodComponent Notes Single Failures:

0 Revision 1.74E-03 1.74E-03 WT-9027 Clarifier Tank Inlet Control AOV IA NO cc Double Failures:

WT 9273 A, B mixed bed Inlet AOV Y-10 C-212 PLC Normally open when CC 1.74E-03 online. Fail closed on loss of power.

Y-10 C-212 PLC Online as selected by operator.

cond.

U-8 A, B Mixed Bed WT 9288 A, B mixed bed Outlet AOV Y-10 C-212 PLC NO, trips on high 1.74E-03 1.21 E-05 Common Mode 3.27E-04 APPENDIX B Water Treatment System Equipment Failure Modes Quantification WT 677 A, B Product Transfer Pump Check Passive Discharge check cc valve. Opens with transfer pump flow.

P-239 A, B Product Transfer Pump PP-71 Nomally operating.

System bypass fails open.

Common Mode Triple Failures:

WT 9240 A, B, C cation Inlet AOV Y-10 C-212 PLC Normally open when CC 1.74E-03 online. Fail closed on loss of power.

Y-10 C-212 PLC Online as selected by operator.

online. Fail closed on loss of power.

U-10 A, 8, C Cation Bed WT 9249 A, B, C cation Outlet AOV Y-10 C-212 PLC Normally open when CC 4.21 E-08 Common Mode 1.00E-03 1.74E-03 1.74E-03 WT-9058 Mixed Effluent Control AOV IA NO, trips on no P-44 CC A, B or C 1.05E-03 2.22E-03 1.07E-05 1.34E-04 1.74E-03 Page 13

Calculation 2003-0053 Revision 0

APPENDIX B Water Treatment System Equipment Failure Modes Quantification WT 702 A, 8, C Cleatwell Pump Check Passive P-95 A, B, 8, C Clearwell pumps B-71 Common Mode WT 9228 A, B, C Water Softener Inlet AOV YO9 C-210 PLC U-13 A, B, C Water Softener YO9 c-210 PLC WT 9237 A, B, C Water Softener Outlet AOV YO9 C-210 PLC Common Mode WT 9035 A, 8, C Filter Inlet AOV F-68 A, 8, C Gravity Filter IA, C-210 c-210 WT 9034 A, 6, C Filter Outlet AOV IA, C-210 Common Mode Component Dependency Valve Mode Component Prob.

Combined Prob.

(Reverse Osmosis Units PP-71 Common Mode PositiodCornponent Notes Nomally operating based on flow demand. Isolation valves fail shut on loss of power. System bypass fails open.

Discharge check valve. Opens with clearwell pump flow.

NR, trip on low cleatwell 'level Nomally open if demin is online. Fails shut on loss of power.

Online as selected by operator.

Nomally open if demin is online. Fails shut on loss of power.

Closed With Pretreatment filter trailer in service.

Offline With Pretreatment filter trailer in service.

Closed With Pretreatment filter trailer in service.

cc cc cc 4.43E-03 1.05E-03 2.22E-03 1.74E-03 1.74E-03 1.74E-03 1.74E-03 8.71 E-08 1.05E-03 3.48E-08 2.07E-04 4.21 E-08 1.00E-03 4.21 E-08 1.00E-03 Page 14

Calculation 2003-0053 Revision 0

APPENDIX B Water Treatment System Equipment Failure Modes Quantification PositiodComponent Notes One pump normally inservice. Loss of pump will cause low vacuum alarm.

-56 A, B & C Dearator Vacuum Pumps 8-22 Common Mode Mode Component Prob.

Combined Prob.

omDonent Dependency Valve 2.22E-03 1.09E-08 1.31 E-04

'-44 A, B & C Dearator Water Pumps 8-22 One or two NR, trip on dearator Ivl or anion 00s Discharge check valve. Opens with deaerator pump flow.

VT 709 A, B, C Dearator Outlet Check Passive Common Mode YT 9254 A, B, C Anion Inlet AOV Y-10 C-212 PLC Normally open when online. Fail closed on loss of power.

Y-10 C-212 PLC Online as selected by operator.

Y-10 C-212 PLC Normally open when online. Fail closed on loss of power.

J-14 A, 5, C Anion Bed YT 9269 A, B, C Anion Outlet AOV Common Mode cc cc 2.22E-03 1.05E-03 1.74E-03 1.74E-03 3.48E-08 2.07E-04 cc 4.21 E-08 1.OOE-03 TOTALSYSTEM FAILURE PROBABILITY 8.56E-03 Page 15

Calculation 2003-0053 Revision 0

APPENDIX C Water Treatment System Fault Tree Quantification -With SI Signal Top 100 Cutsets 1

2 3

4 5

6 7

8 9

10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 1.0000E-002 8.5600E-003 6.9800E-003 6.98003-003 4.4756E-003 3.90003-003 2.2000E-003 2.20003-003 2.0000E-003 2.0000E-003 5.72743-004 3.0000E-004 1.84573-004 1.38483-004 1.37213-004 9.81913-005 9.8191E-005 7.89403-005 7.3545E-005 2.9000E-005 2.4000E-005 2.40003-005 2.34193-005 2.2100E-005 1.4100E-005 7.6109E-006 7.6109E-006 7.6109E-006 6.6100E-006 6.51693-006 6.51693-006 5,96313-006 5.1000E-006 3.7858E-006 3.3450E-006 3.1078E-006 3.10783-006 3.1078E-006 3.10783-006 3.1078E-006 3.10783-006 3.0382E-006 3.0102E-006 2.6800E-006 2.6800E-006 2.58403-006 2.58403-006 2.4000E-006 2.40003-006 2.4000E-006 INIT-WITH-SI INIT-WITH-SI 48O-BS--TM--2B04 48O-BS--TM--2B03 INIT-WITH-SI INIT-WITH-SI 480-MCC-TM--2B32 480-MCC-TM--2B42 INIT-WITH-SI INIT-WITH-SI 416-BKR-OOlA5255 ESF-REL-FT-86B2B 138-HEP-STARTGO5 INIT-WITH-SI INIT-WITH-SI INIT-WITH-SI INIT-WITH-SI 138-GT--FS---G05 138-GT--TM---G05 INIT-WITH-SI INIT-WITH-SI INIT-WITH-SI 138-GT--FR---G05 416-BKR-CM003755 ESF-REL-CM-86GX1 480-BKR-C025235C 480-BKR-C025231B 416-BKR-C01A5255 416-BS--TM--2A02 INIT-WITH-SI INIT-WITH-SI 125-HEP-EOP10-08 INIT-WITH-SI 416-BS--TM--2A02 INIT-WITH-SI 125-FU--S02705F2 125-FU--S02703F2 125-FU--S02703Fl 125-FU--S00208Fl 125-FU--S00208F2 125-FU--S02705Fl INIT-WITH-SI INIT-WITH-SI INIT-WITH-SI INIT-WITH-SI INIT-WITH-SI INIT-WITH-SI INIT-WITH-SI INIT-WITH-SI 125-BS--LP---D13 WT--HDW-TM--SYST WT--HDW-FO--SYST INIT-WITH-SI INIT-WITH-SI SA--K---TM-O003A WT--HEP-REST--SI INIT-WITH-SI INIT-WITH-SI WT--MOV-CC-02817 WT--MOV-CC-O4478 INIT-WITH-SI INIT-WITH-SI 345-GRD-LP--LOSP SA--K---FS-O003B SA--K---TM-O003A SA--K---FR-O003A SA--K---FR-O003B 345-GRD-LP--LOSP 345-GRD-LP--LOSP WT--PNL-LP---Y10 WT--PNL-LP---YOg WT--BUS-LP---B71 345-GRD-LP--LOSP INIT-WITH-SI INIT-WITH-SI INIT-WITH-SI INIT-WITH-SI INIT-WITH-SI 480-HEP-2B042B02 SA--F---PG-O035B SA--F---PG-O035A 345-GRD-LP--LOSP SW--MDP-CM-RPUMP 480-BKR-0025226C SA--K---TM-O003A INIT-WITH-SI INIT-WITH-SI INIT-WITH-SI INIT-WITH-SI INIT-WITH-SI INIT-WITH-SI SA--K---FR-O003A SA--K---FR-O003A SA--K---TM-O003A SA--K---TM-O003B SA--K---TM-O003A SA--K---TM-O003B WT--BUS-LP---B22 WT--PNL-LP--P?71 INTT-WITH-SI Page 16 INIT-WITH-SI SA--K---TM-O003A SW--SOV-CC-2832B SA--K---TM-O003B SA--K---TM-o003A INIT-WITH-SI INIT-WITH-SI INIT-WITH-SI INIT-WITH-SI SA--K---TM-O003A SA--K---TM-O003B INIT-WITH-SI INIT-WITH-SI SW--CKV-CC-HX50B

Calculation 2003-0053 Revision 0

APPENDIX C Water Treatment System Fault Tree Quantification - With SI Signal Top 100 Cutsets 51 2.4000E-006 52 2.40003-006 53 2.40003-006 54 2.4000E-006 55 2.40003-006 56 2.4000E-006 57 2.4OOOE-006 58 2.40003-006 59 2.40003-006 60 2.1542E-006 61 1.60563-006 62 1.6056E-006 63 1.2989E-006 64 8.13183-007 65 8.13183-007 66 5.72743-007 67 5.0917E-007 68 5.0000E-007 69 5.0000E-007 70 5.0000E-007 71 5.0000E-007 72 4.7269E-007 73 4.72693-007 74 4.72693-007 75 3.28043-007 7 6 2.2054E-007 77 2.0164E-007 78 1.9978E-007 79 1.74003-007 80 1.74003-007 81 1.74003-007 82 1.60563-007 83 1.6056E-007 84 1.42973-007 85 1.42973-007 86 1.29493-007 87 1.29493-007 88 1.29493-007 89 1.2949E-007 90 1.08773-007 91 1.0877E-007 92 1.00003-007 93 1.0000E-007 94 1.0000E-007 95 9.0000E-008 96 8.83423-008 97 8.2924E-008 98 8.2160E-008 99 7.9952E-008 100 7.9215E-008 48O-MCC-LP--2B32 480-BS--LP--2B03 138-BS--LP---H01 125-BS--LP---D02 480-BS--LP--2B02 480-BS--LP--2B04 416-BS--LP--lA04 480-MCC-LP--2B42 416-BS--LP--lA02 INIT-WITH-SI INIT-WITH-SI INIT-WITH-SI 48O-X---LP-2XYO6 138-BKR-OOH52G05 138-BKR-00H52-10 416-BKR-002A5248 48O-BKR-CO-429DR ESF-REL-SA-86A02 ESF-REL-SA-25A04 ESF-REL-SA-2SI12 ESF-REL-SA-2SI22 INIT-WITH-SI INIT-WITH-SI INIT-WITH-SI 416-BKR-002A5248 125-HEP-D305-D02 INIT-WITH-SI INIT-WITH-SI INIT-WITH-SI INIT-WITH-SI INIT-WITH-SI 480-BS--LP--lB04 120-BS--LP-O2Y06 INIT-WITH-SI INIT-WITH-SI 1251FU--S00203F2 1251FU--S00203Fl 1251FU--S00208Fl 1251FU--S00208F2 125-FU--S03013F2 125-FU--SO3013Fl 1251BS--LP---D13 1251BS--LP---D27 1251BS--LP---D02 ESF-REL-FT-86TG1 125-HEP--D50-D53 INIT-WITH-SI INIT-WITH-SI INIT-WITH-SI INIT-WITH-SI IA--AOV-OC-00187 INIT-WITH-SI INIT-WTTH-SI INIT-WITH-SI INIT-WITH-SI INIT-WITH-SI INIT-WITH-SI INIT-WITH-SI INIT-WITH-SI INIT-WITH-SI SA--K---FR-O003A SA--HX--IL-O050B SA--HX--IL-O050A INIT-WITH-SI 345-GRD-LP--LOSP 345-GRD-LP--LOSP 480-HEP-2B042B02 INIT-WITH-SI INIT-WITH-SI INIT-WITH-SI INIT-WITH-SI INIT-WITH-SI sw--cKV-oo---32c SW--CKV-O0---32F SW--CKV-O0---32A 480-BKR-0025226C 125-INV-LP--OD08 SA--F---PG-O035A SA--F---PG-O035A SW--CKV-C0---32D SW--CKV-C0---32E SW--CKV-C0---32B INIT-WITH-SI INIT-WITH-SI SA--F---PG-O035B SA--F---PG-O035A INIT-WITH-SI INIT-WITH-SI INIT-WITH-SI INIT-WITH-SI 125-HEP-D06--D02 125-HEP-D06--D02 INIT-WITH-SI INIT-WITH-SI INIT-WITH-SI ESF-REL-FT-86x01 138-HEP-STARTG05 SA--K---FR-O003B SA--K---TM-O003A SA--K---TM-O003B SA--K---TM-O003A INIT-WITH-SI INIT-WITH-SI INIT-WITH-SI SA--K---TM-O003A SW--MDP-FR---32C SW--MDP-FR---32F SW--MDP-FR---32A INIT-WITH-SI INIT-WITH-SI SA--K---FS-O003B SW--SOV-CC-2832B SW--MDP-TM---32D SW--MDP-TM---32E SW--MDP-TM---32B SA--K---TM-O003B SA--K---TM-O003A SA--K---FR-O003A SA--K---FR-O003B INIT-WITH-SI INIT-WITH-SI INIT-WITH-SI 138-X---LP--lX03 SW--SOV-OC-2832A SW--SOV-OC-2832A SW--AOV-OC-2836A INIT-WITH-SI Page 17

Calculation 2003-0053 Revision 0

APPENDIX D Water Treatment System Fault Tree Quantification - Without SI Signa1 Top 100 Cutsets 1

2 3

4 5

6 7

8 9

10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 4 %

49 50 1.0OOOE-002 8.56003-003 4.4756E-003 1.OOOOE-003 5.72743-004 4.66963-004 3.0000E-004 1.84573-004 1.47183-004 1.3848E-004 1.37216-004 9.8191E-005 9.81913-005 7.89403-005 7.3545E-005 4.6138E-005 2.9000E-005 2.40003-005 2.40003-005 2.34193-005 2.2100E-005 1.4100E-005 1.0245E-005 7.6109E-006 6.9800E-006 6.61003-006 6.51693-006 6.5169E-006 5.963l.E-006 5.1000E-006 3.9978E-006 3.78583-006 3.34503-006 3.2290E-006 3.10783-006 3.1078E-006 3.10783-006 3.10783-006 3.1078E-006 3.10?83-006 3.03823-006 3.0102E-006 2.6800E-006 2.68003-006 2.5840E-006 2.5840E-006 2.40003-006 2.4000E-006 2.40003-006 2.4000E-006 INIT-WITH-NO-SI INIT-WITH-NO-SI INIT-WITH-NO-SI INIT-WITH-NO-SI 416-BKR-001A5255 480-BS--TM--2B04 ESF-REL-FT-86B2B 138-HEP-STARTG05 480-MCC-TM--2B42 INIT-WITH-NO-SI INIT-WITH-NO-SI INIT-WITH-NO-SI INIT-WITH-NO-SI 138-GT--FS---G05 138-GT--TM---G05 416-BS--TM--2A02 INIT-WITH-NO-SI INIT-WITH-NO-SI INIT-WITH-NO-SI 138-GT--FR---GO5 416-BKR-CM003755 ESF-REL-CM-86GX1 480-BS--TM--2B04 416-BKR-C01A5255 480-BS--TM--2B03 416-BS--TM--2A02 INIT-WITH-NO-SI INIT-WITH-NO-SI 125-HEP-EOP10-08 INIT-WITH-NO-SI 416-BKR-002A5248 416-BS--TM--2A02 INIT-WITH-NO-SI 480-MCC-TM--2B42 125-FU--S02703F2 125-FU--S02705F2 125-FU--S02703F1 125-FU--S00208F1 125-FU--S00208F2 125-FU--S02705F1 INIT-WITH-NO-SI INIT-WITH-NO-SI INIT-WITH-NO-SI INIT-WITH-NO-SI INIT-WITH-NO-SI INIT-WITH-NO-SI INIT-WITH-NO-SI INIT-WITH-NO-SI 138-BS--LP---H01 480-BS--LP--2B02 WT--HDW-TM--SYST WT--HDW-FO--SYST SA--K---TM-O003A WT--HEP-RESTNOSI INIT-WITH-NO-SI INIT-WITH-NO-SI INIT-WITH-NO-SI 345-GRD-LP--LOSP INIT-WITH-NO-SI SA--K---FS-O003B SA--K---TM-O003A SA--K---FR-O003B SA--K---FR-O003A 345-GRD-LP--LOSP 345-GRD-LP--LOSP 480-BS--TM--2B04 WT--PNL-LP---YlO WT--PNL-LP---YOg WT--BUS-LP---B71 345-GRD-LP--LOSP INIT-WITH-NO-SI INIT-WITH-NO-SI INIT-WITH-NO-SI INIT-WITH-NO-SI INIT-WITH-NO-SI 480-HEP-2B042B02 SA--F---PG-O035A SA--F---PG-O035B 345-GRD-LP--LOSP SW--MDP-CM-RPUMP 480-BS--TM--2B04 480-BKR-0025226C SA--K---TM-O003A INIT-WITH-NO-SI INIT-WITH-NO-SI INIT-WITH-NO-SI INIT-WITH-NO-SI INIT-WITH-NO-SI INIT-WITH-NO-SI INIT-WITH-NO-SI SA--K---FR-O003A SA--K---FR-O003A SA--K---TM-O003B SA--K---TM-O003A SA--K---TM-O003B SA--K---TM-O003A WT--BUS-LP---B22 WT--PNL-LP--PP71 INIT-WITH-NO-SI INIT-WITH-NGSI INIT-WITH-NO-SI SA--K---TM-O003A SA--K---TM-O003A SW--SOV-CC-2832B SA--K---TM-O003A SA--K---TM-O003B INIT-WITH-NO-SI INIT-WITH-NO-SI INIT-WITH-NO-SI INIT-WITH-NO-SI SW--CKV-O0---32F INIT-WITH-NO-SI SA--K---TM-O003B SA--K---TM-O003A INIT-WITH-NO-SI INIT-WITH-NO-SI INIT-WITH-NO-SI SW--CKV-CC-HXSOB SA--K---FR-O003A SA--K---FS-O003B SW--SOV-CC-2832B SW--SOV-OC-2832A SW - - S OV-OC - 2 8 3 2 B SW--AOV-OC-2836A SW--AOV-OC-2836B Page 18

Calculation 2003-0053 Revision 0

51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 APPENDIX D Water Treatment System Fault Tree Quantification - Without SI Signal Top 100 Cutsets 2.4000E-006 2.4000E-006 2.4000E-006 2.4000E-006 2.15423-006 1.6056E-006 1.6056E-006 1.2989E-006 8.13183-007 8.13183-007 6.79943-007 5.7274E-007 5.37463-007 5.09173-007 5.09173-007 5.0000E-007 5.0000E-007 5.0000E-007 5.0000E-007 4.7269E-007 4.72 693-007 4.7269E-007 3.2804E-007 2.7962E-007 2.6960E-007 2.2054E-007 2.14313-007 2.01643-007 1.9978E-007 1.7400E-007 1.74003-007 1.74003-007 1.67523-007 1.6056E-007 1.60563-007 1.60563-007 1.60563-007 1.5426E-007 1.42973-007 1.4297E-007 1.3552E-007 1.2949E-007 1.29493-007 1.29493-007 1.2949E-007 1.08773-007 1.0877E-007 1.0000E-007 1.0000E-007 1.00003-007 416-BS--L?--lA02 416-BS--LP--lA04 125-BS--LP---D02 125-BS--LP---D13 INIT-WITH-NO-SI INIT-WITH-NO-SI INIT-WITH-NO-SI 48O-X---LP-2XYO6 138-BKR-00H52-10 138-BKR-OOH52G05 480-BS--TM--2B04 416-BKR-002A5248 125-HEP-lB49D301 INIT-WITH-NO-SI 480-BKR-CO-429DR 480-BKR-C025231B ESF-REL-SA-86A02 ESF-REL-SA-25AO4 ESF-REL-SA-2SI22 ESF-REL-SA-2SI12 INIT-WITH-NO-SI INIT-WITH-NO-SI INIT-WITH-NO-SI 416-BKR-002A5248 480-BS--TM--2B04 480-BS--TM--2BO4 125-HEP-D305-D02 480-MCC-TM--2B42 INIT-WITH-NO-SI INIT-WITH-NO-SI INIT-WITH-NO-SI INIT-WITH-NO-SI INIT-WITH-NO-SI 480-BS--TM--2BO4 480-BS--LP--IB04 120-BS--LP-O2Y06 480-BS--LP--ZBO4 480-MCC-LP--2B42 416-BKR-CM004448 INIT-WITH-NO-SI INIT-WITH-NO-SI 4 16 -X- - -L?- - 2x12 1251FU--S00208F2 1251FU--SOO203F2 1251FU--S00203F1 1251FU--S00208F1 125-FU--S03013Fl 125-FU--S03013F2 1251BS--LP---D02 1251BS--LP---D13 1251BS--LP---D27 INIT-WITH-NO-SI INIT-WITH-NO-SI INIT-WITH-NO-SI INIT-WITH-NO-SI SA--K---FR-O003A SA--HX--IL-O050B SA--HX--IL-O050A INIT-WITH-NO-SI 345-GRD-LP--LOSP 345-GRD-LP--LOSP INIT-WITH-NO-SI 480-HEP-2B042B02 480-BS--TM--2B03 INIT-WITH-NO-SI INIT-WITH-NO-SI INIT-WITH-NO-SI INIT-WITH-NO-SI INIT-WITH-NO-SI INIT-WITH-NO-SI SW--CKV-O0---32F SW--CKV-O0---32A sw--cKV-oo---32c 480-BKR-0025226C INIT-WITH-NO-SI INIT-WITH-NO-SI 125-INV-LP--ODO8 INIT-WITH-NO-SI SA--F---PG-O035A SA--F---PG-O035A SW--CKV-C0---32E SW--CKV-C0---32D SW--CKV-C0---32B INIT-WITH-NO-SI INIT-WITH-NO-SI INIT-WITH-NO-SI INIT-WITH-NO-SI INIT-WITH-NO-SI 480-BS--TM--2BO4 SA--F---PG-O035B SA--F---PG-O035A 480-BS--TM--2BO4 INIT-WITH-NO-SI INIT-WITH-NO-SI INIT-WITH-NO-SI INIT-WITH-NO-SI 125-HEP-D06--DO2 125-HEP-D06--DO2 INIT-WITH-NO-SI INIT-WITH-NO-SI INIT-WITH-NO-SI SA--K---FR-O003B SA--K---TM-O003A SA--K---TM-O003B SA--K---TM-O003A INIT-WITH-NO-SI INIT-WITH-NO-SI SA--F---PG-O035A INIT-WITH-NO-SI 48O-MCC-TM--2B49 SW--MDP-FR---32F SW--MDP-FR---32A SW--MDP-FR---32C INIT-WITH-NO-SI SW--SOV-OC-2832A SW--AOV-OC-283 6A INIT-WITH-NO-SI SA--F---PG-O035A SA--K---FS-O003B SW--SOV-CC-2832B SW--MD?-TM---32E SW--MDP-TM---32D SW--MDP-TM---32B SA--HX--IL-O050A SA--K---TM-O003B SA--K---TM-O003A SA--K---TM-O003A SA--K---TM-o003A INIT-WITH-NO-SI SA--K---FR-O003A SA--K---FR-O003B INIT-WITH-NO-SI INIT-WITH-NO-SI INIT-WITH-NO-SI Page 19

Calculation 2003-0053 Revision 0

APPENDIX E Water Treatment System Component Unavailability Events from System Engineer Events Log Maintenance unavailability for the Water Treatment System is difficult to quantify from the usual plant record sources used for a PRA because it is a non-safety related, non-Maintenance Rule system. As was stated in Assumption 4.3, a maintenance unavailability value of 1.OE-02 was assumed for this calculation. System Engineer notes on individual occurrences were reviewed in order to provide additional justification that the assumption was valid. Relevant entries are reproduced in the table starting on the next page. These notes deal primarily with the reverse osmosis units which are serviced by the vendor. Plant records for maintenance on these units are spotty because of the vendor contract.

Plant work history records from CHAMPS on other components in the Water Treatment System from September 2000 through the present were also reviewed. The most frequently worked components in the main process stream appear to have been the Deaerator Water Pumps, O-P-O44A, B, and C, and the Deaerator Vacuum Pumps, O-P-056A. B, and C, which together had 33 occurrences of work being performed ranging from oil changes to pump replacement. If 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months of unavailability per occurrence is assumed, this results in a maintenance unavailability for these components of:

(33

8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months ) / (6 pumps

2.5 years

8760 hourdyear) = 2.01E-03 / pump From the data in the table that follows, an unavailability per reverse osmosis unit can also be determined. Summing up the unavailability time for each of the three units and dividing by the 2.5 year time period provides the following results:

For U-17A 233.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months / (2.5 years

8760 houdyear) = l.lE-02 For U-17B 148 hours0.00171 days 0.0411 hours 2.44709e-4 weeks 5.6314e-5 months I (2.5 years

8760 hourdyear) = 6.8E-03 For U-17C 194 hours0.00225 days 0.0539 hours 3.207672e-4 weeks 7.3817e-5 months l(2.5 years

8760 hour0.101 days 2.433 hours 0.0145 weeks 0.00333 months slyear) = 8.9E-03 Except for reverse osmosis unit U-17A, individual unavailability values for these components is less than the assumed system unavailability. Because these components are in parallel trains that provide redundancy, work on these individual components will not lead directly to system unavailability. Two occurrences of system unavailability due to maintenance on a single component were recorded for replacement of valves 0-WT-00101C and 0-WT-00301B. The estimated time to replace these valves also totaled much less than the assumed 1.OE-02 system unavailability. Therefore, the assumed value for system unavailability is sufficient to also account for component unavailability combined with random failures in the other trains.

Page 20

Calculation 2003-0053 Revision 0

APPENDIX E Water Treatment System Component Unavailability Events from System Engineer Events Log Datdtime CHAMPS ID Component Event description.

Estimated Unavailable Unavailable Component Hours 9/6/00 12:OO P-238A Pump Replaced the " A RO unit's feed pump and motor. Work was done 5.5 U-17A 9/15/00 14:OO U-17C RO Replaced the membranes in the "C" RO unit due to low flow that 8

U-17C 9/25/00 6:25 P-236B Pump B RO unit chemical feed pump seized. Fixed the same day. Pump 8

U-178 at about 1730.

was discovered on 9/8/00.

flow switch problem causing RO not to run due to interlock.

10/8/00 8:29 U-17A RO

" A RO tripped on high pressure. RO unit taken offline until membrane is changed..

10/1 O/OO 8:26 U-17A RO Changed out membranes in "A" RO skid.

48 U-17A 1 1 /15/00 8:30 U-176 RO Skid Changed out membranes in "B" RO skid.

8 U-178 1 1 /28/00 1 0:OO P-237C Pump Replaced booster pump.

4 U-17C 12/8/00 8:48 P-237C Pump Replaced fuses for P-237C-M. Two fuses were blown with the left 2

U-17C fuse still OK. Replaced all three fuses.

Operations noted that lower bearing on motor was very hot and you 1/12/01 9:oo P-2388 Pump could smell smoke.

P-238B Pump Due to a hot lower bearing found on 1/12, we replaced the P-238B 4

U-17B m,-.irrr 1 /17/01 10:30 I I l U l W l.

2/6/01 2255 P-237C Pump Booster pump failure. Replaced fuses.

2 U-178 2/15/01 515 P-237C Pump Thermal overload tripped. Skid output only 85 gpm without booster pump. "C" skid set to Lag2.

2/19/01 14:OO P-237C Pump Replaced Fuse Block and fuses. Motor trip may have been in 4

U-17C intermediate position. Pump back in service.

2/25/01 9:44 P-2388 Pump Pump tripped on low suction pressure. No fuse or overload problems.. Filters may have been changed since trip.

2/26/01 8:25 P-238B Pump Checked pump trip problem. Found that WT-09148, pump suction AOV, wasn't opening.

ran on the solenoid from the leak on WT-659B may have caused it.

Reset alarm and turned booster pump off. Getting 80 gpm out of C skid without booster pump.

2/27/01 14:35 P-238B Pump Found bad solenoid coil on WT-9148B. Looks like the water that 72 U-17B 3/23/01 12:30 P-237C Pump Turned on booster pump to increase flow and got failure alarm.

Page 2 1

Calculation 2003-005 3 Revision 0

APPENDIX E Water Treatment System Component Unavailability Events from System Engineer Events Log Datdtime CHAMPS ID Component Event description.

Estimated Unavailable Unavailable Component Hours 3/26/01 12:OO P-237C Pump Replaced fuses and reset overload and pump ran.

2 3/27/01 1O:OO P-237C Pump Operator found P-237C not running with no alarm and switch in auto.

Operator found no power to "A" skid. They checked fuses and supply breaker and found no problems.

Turned disconnect to on and power switch to on and skid started up.

transformer was broken and arcing. Lead was reattached from below so the cable won't be a problem in the future. The cable in the other two skids isn't long enough to affect the transformer connections.

membranes. 6.5 Month Run Time to pump with 12 guage as in other units. Worked on contactor/overload unit.

membranes. 6 Month Run Time Informed by operations that we had a fuse blow on U-17C. When it was replaced, it blew again. The only 8 Amp fuse on the drawing is FU-9, off the transformer, which supplies control power. Lookina 4/2/01 2:30 U-17A 4/2/01 7:30 U-17A RO Skid RO Skid 4/4/01 1 1 :30 U-17A RO Skid Found problem with U-17A power. Terminal connector for stepdown 48 U-17A 4/6/01 8:30 U-17C RO Skid Replaced 8040-LHY-CPA3 membranes with 8040-UHY-ESPA 8

U-17C 4/6/01 8:30 P-237C Pump Repaired pump. Found two fuses blown. Replaced 14 guage wire 4/6/01 13:OO U-17A RO Skid Replaced 8040-LHY-CPA3 membranes with 8040-UHY-ESPA 8

U-17A 6/14/01 6100 WT-00101 C Valve WT plant shutdown for replacement of WT-101 C.

8 WT 7/12/01 9:30 U-17C RO Skid into when they can get the transformer and replace it.

7/16/01 12:15 U-17C RO Skid While waiting for tagout to replace transformer, found the "C" skid 100 U-17C antiscalant mixer was seized. After disconnecting it, the RO unit ran without blowing 8 amp fuse. The power for this mixer comes off the outlet circuit. RO unit is operational, but the mixer doesn't work. If antiscalant needs to be batched, it will need to be manually agitated.

7/17/01 17:OO U-178 RO Skid Membranes changed out.

8 U-176 1011 8/01 14:30 U-17A RO Skid Replaced membrane.

8 U-17A 10/23/01 13:30 U-17C RO Skid Replaced membrane.

8 U-17C 1 1 /28/01 14:OO U-178 RO Skid Replaced membrane.

8 U-178 Page 22

Calculation 2003-005 3 Revision 0

APPENDIX E Water Treatment S ys tern Component Unavai iabili t y Events from System Engineer Events Log DateAime CHAMPS ID Component Event description.

Estimated Unavailable Unavailable Component Hours 12/19/01 1500 U-17A RO Skid Replaced CPA-3 membranes with SPA membranes. Couldn't seal 8

U-17A F-225A on the west end. Found scratch in O-ring seating suface of filter housing. This crack will have to be filled in the future. It will most likely require the membranes to be unloaded so the surface can be dry.

Failed PMT. WO returned to status 75 and new tagout being prepared. Need to get repair kit to fill scratch in membrane vessel F-225A on sealing surface. Will schedule repair once kit is available.

1211 9/01 1500 U-178 RO Skid Repaired leaks.

4 U-178 12/20/01 1 1 :oo U-17A RO Skid

~~

12/23/01 12:55 P-238C Pump Both pumps failure. One Phase blown. Replaced 60 amp fuses.

2 U-17C 12/23/01 12:55 P-237C Pump Both pumps failure. One Phase blown. Replaced 60 amp fuses.

~~

12/23/01 12:55 U-17A RO Skid F-231A leak on west end. Repaired leak.

4 U-17A 12/23/01 16:40 U-17B RO Skid F-232B east end leak. Repaired leak.

4 U-178 12/23/01 16:40 P-237C Pump Booster pump failure. One phase blown. Replaced 15 Amp fuses.

2 U-17C Found one loose wire.

1/7/02 8:OO P-236C Pump Leak repaired.

4 U-17C 1 /21/02 0:oo U-178 RO Skid Replaced Quad Ring in F-2328.

4 U-176 2/9/02 12:OO P-237C Pump P-237C-M tripped and motor was hot. P-237C turned off and "C" skid run in Lag 2.

Ran "C" RO unit without booster pump. Got -94 cmm without 2/11/02 11 :oo P-237C Pump booster pump. WT A0 to put "C" RO' back on no;mal rotation.

2/14/02 12:OO P-237C Pump Found the left fuse blown and the thermal overload tripped.

4 U-17C Returned P-237C to service after it running about 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months without 2/17/02 8:OO P-237C Pump Pump tripped again. Told operations to run skid with booster pump turned off.

2/18/02 8:OO P-237C Pump Looked at pump. Found overload tripped again. Operator heard that right fuse was blown and was replaced. Had operations turn booster pump off and run skid.

row)bearing was destroyed.

any problems.

3/11 /02 1O:OO P-044C Pump P-44C being overhauled due to bearing failure. Outboard (Double a

P-44c Page 23

Calculation 2003-0053 Revision 0

APPENDIX E Water Treatment System Component Unavailability Events from System Engineer Events Log Datdtime CHAMPS ID Component Event description.

Estimated Unavailable Unavailable Component Hours 3/26/02 1 1 :00 P-236B Pump Fixed leak on pump. Was discharge flow switch.

4 U-17B 3/26/02 12:30 U-17A RO Skid Replaced quad rings on F-227A east and west, and F-230 east. No 4

U-17A leaks.

turned off.

3/26/02 16:30 P-237A Pump Pump tripped again. Told operations to run skid with booster pump 4/16/02 14:OO P-152-2 Pump Repairing speed controller on P-152.

4/22/02 7:30 P-152-2 Pump Returned to service.

7/2/02 13:30 P-237A Pump Replaced pump and fuses due to pump tripping in the past. (see 4

U-17A 3/26/02 entry) Fuse block not changed.

7/25/02 0:OO P-236A PUMP Antiscalant pump didn't run. Suspect flow switch problem.

9/4/02 12:20 U-17C RO Skid Membrane change from ESPA-1 to CPA-3 membranes. No leaks 8

U-17C after replacement. Flow meter for reject repaired and pH meter probe changed. Membranes lasted just over 10 months between cleanings. Initial pressure was -1 65 at 66F.

10/22/02 0:oo P-237A Pump Pump still blows fuses. Concluded that new pump is needed.

2 U-17A 11/11/02 12:oo P-236A Pump Replaced pump. Have been having problems with skid tripping on 4

U-17A antiscalant flow. After several other attempts to solve the problem, the pump capacity was checked and found to be low, along with it making noise.

1 1 /13/02 0:OO P-237A Pump Replaced Pump. Was tripping/blowing fuses.

4 U-17A 1 1 /13/02 0:OO U-17B RO Skid Replaced membranes with ESPA membranes.

8 U-176 11/21/02 0:oo U-17C RO Skid Skid tripped offline with no alarm at C-212. Ops found the booster 8

U-17C pump overload tripped and reset it earlier. No power to panel or instrumentation. Found 1 main fuse blown and 1 booster pump fuse blown. Replace all three phase's fuses on main and booster pump.

Restarted and it ran fine all day.

repeatedly.

12/5/02 0:OO P-2378 Pump Reported that B-RO Booster pump trouble alarm coming in 1 2/11 /2002 P-237C Pump Replaced Pump.

8 U-17C I

211 112002 P-2378 Pump Trouble shot pump. Found all fuses OK. Thermal overload tripped.

a U-178 1 /9/03 0:OO U-17A RO Skid Repaired F-227A. Removed half shim and added whole shim, 4

U-17A Possible problem with TOL.

Page 24

Calculation 2003-0053 Revision 0

APPENDIX E Water Treatment System Component Unavailability Events from System Engineer Events Log Datdtime CHAMPS ID Component Event description.

Estimated Unavailable Unavailable Component

~

Hours 4

U-17C 1 /10/03 0:OO U-17C RO Skid Repaired leak on F-23OC.

1 /la03 0:OO P-237A Pump A-RO Booster pump tripped.

1 /15/03 0:OO P-237A Pump Replaced fuses and reset overload. One phase blown and overload tripped probably due to subsequent startup attempts on 2 phases.

1 /15/03 0:OO P-237B Pump Replace contactor and overload modules.

1/21/03 0:OO P-237C Pump Replace overload module with more comPatible one than installed 72 U-17A 4

U-178 1 /21/03 0:OO U-17C RO Skid Replaced CPA-3 Membranes with ESPA membranes.

8 U-17C on -1 2/18/02.

Page 25

ATTACHMENT 4 Hvdraulic Calculation for lniectina Low-Pressure Water Into the Steam Generators (Final)

POINT BEACH NUCLEAR PLANT, UNITS 1 AND 2

Page 1 rhis Calculation has been reviewed in accordance with NP 7.2.4. The review was accomplished by one or a combination of the following (check all that apply):

7 7

A review of a representative sample of repetitive calculations.

A review of the calculation against a similar calculation previously performed.

a A detailed review of the original calculation.

7 A review by an alternate, simplified, or approximate method of calculation.

I I

Point Beach NucIear Plant CALCULATION COVER SHEET Calculation/Addendum Number: I Title of Calculation/Addendum:

Reviewers' Initials

/+ 6 / d q V

I 2003-0021

'reparer (xi 0

n Estimate of Service Water Flow to Each Steam Generator Through the Turbine-Driven I Auxiliary Feedwater Pumps Reviewer Discipline Name Signature Date M

Jeremy 3. Fischer 4/2/03 0

3 M

John R. Olvera n

System (CHAMPS Identifier Codes):

AF, S W, FP 0

0 1

Original CalculationlAddendum Supersedes Calculation/Addendum 0 Revised Calculation/Addendum Revision # -

I o

0 cl Discipline OCIV NUC OELEC DCOMP n I & C OCHEM/RAD HMECH USYST Associated Documents:

Superseded By Calculation/Addendum ##

Reference:

NP 7.2.4 PBF-1608 Revision 5 01/10/01

Calculation 2003-0021, Rev. 0 Estimate of Service Water Flow to Each Steam Generator Through the Turbine-Driven Auxiliary Feedwater Pumps Section or Attachment Cover Sheet Page Inventory Purpose Assumptions Comments References Calculation Page Inventory Page #(s)

Revision Section or Attachment Page #(s)

Revision 1

0 2

0 3

0 4

0 Page 2 PBF-1608 Revision 5 01/10/01

Reference:

NP 7.2.4

Calculation 2003-002 1, Rev. 0 Estimate of Service Water Flow to Each Steam Generator Through the Turbine-Driven Auxiliary Feedwater Pumps Comments And Resolution 1 Reviewer Comments:

Reviewer Comments:

Page 3 PBF-1608 Revision S 01/10/01

Reference:

NP 7.2.4

Calculation 2003-002 1, Rev. 0 Estimate of Service Water Flow to Each Steam Generator Through the Turbine-Driven Auxiliary Feedwater Pumps Page 4 Purpose The purpose of this non-QA scope calculation is to estimate Service Water (SW) flow to each Steam Generator (SG) at various SG pressures when the Auxiliary Feedwater (AFW) pumps are not running. While each steam generator could potentially receive service water though both the Turbine Driven (TDAFW) and Motor Driven (h4DAFW) pumps, only flow through the TDAFW pump will be considered. This is conservative since crediting flow through MDAFW pumps in addition to flow through the TDAFW pumps would increase flow per SG. The results of this calculation will be used to support a Probabilistic Risk Assessment (PRA) effort to quantify Core Damage Frequency (CDF) associated with LER 266/2002-033-

00.

This is a non-QA scope calculation and is developed consistent with good engineering practices and documented as appropriate for the task at hand.

Ass u m p t i o ns Validated Assumptions

1.

It is assumed that service water header pressure is at 68 usig. Basis: During normal system operation, service water system pressure as read on PI-2844n845 is maintained between 50 psig and 90 psig [Reference I]. Additionally, during the valve misposition event, which introduced service water into the steam generators, service water pressure was at 68 psig [Reference 21. This pressure is typical for normal operation. Service water pressure is maximized during an accident.

2. It is assumed that the steam generators were at atmospheric pressure, 0 pig, during the valve mispostion event, which introduced service water into the steam generators [Reference 21. Basis: Reactor cooIant temperature recorded during the event indicates 92°F [Input 83, which is not adequate to induce secondary boiling.

Unvalidated Assumptions None.

References

1. 07-70, Rev. 43, Service Water System Operation

2. CR 99-0575 Service Water Introduced to SG During IT-295 Valve Stroke Test

3. Crane Technical Paper 4 10, Flow of Fluids Through Valves, Fittings, and Pipes

4. Johnston Pump Company, Pump Performance Characteristics dated 12/8/2000

5. PT 0-PT-FP-004 Annual Fire Fump Capacity Test dated 7/19/2002

6. Bechtel Drawings P-I13 Sheets 2 and 3 Revision 1, Service Water Supply Header

7.

Bechtel Drawing P-212 Revision 8, Feedwater System Loop A & B

8.

Bechtel Drawing P-117Revision IO, Aux Feedwater Pump Suction From Condensate Storage Tanks

9. Bechtel Drawing P-I13 Sheet 4 Revision 2 Service Water AFW Pump Supply Header

10. Bechtel Drawing P-113 Sheet 1 Revision 1 Service Water North and South Supply Header Attachments

1.

CR 99-0575 [Reference 21

2.

Historical Data Log Report

3.

Service Water Pump Performance [Reference 41

Calculation 2003-0021, Rev. 0 Estimate of Service Water Flow to Each Steam Generator Through the Turbine-Driven Auxiliary Feedwater Pumps Page 5 Inputs

1.

2.

3.

4.

5.

6.

7.

8.

Service water header pressure, Service water flow through 2P29 during misposition event, Steam generator pressure during misposition event, Plant elevation of PI-2844/2845, Plant elevation of 2HX 1 A/B feedwater nozzle (average),

Density of water at 60F, Plant elevation of AFW pump inlet, Reactor coolant temperature, 68 psig 86 gpm 0 psig 19 ft 77 ft 62.4 Ib/ft3 10 ft 92F

[Assumption 13

[Attachment 23

[Assumption 21

[Reference 61

[Reference 71

[Reference 3, page A-61

[Reference 81

[Attachment 21 Acceptance Criteria None.

Methodology Bernoullis theorem Peference 3, Equation 3-11 can be applied to the modeled system boundaries (ie, AFW pump inlet and steam generator) and the piping and components located between these boundaries. This principle can be used to estimate service water flow to each steam generator at various steam generator pressures when the auxiliary feedwater pumps are not running. For this scenario, Bernoullis theorem comprises of water pressure available at the AFW pump inlet, elevation pressure losses, dynamic pressure losses, and steam generator pressure. The piping located between the SW header pressure indicator and the AFW pump inlet will not be included within the modeled system boundaries because the majority of this piping is 6 inches or larger in diameter and less than 300 ft in length [References 6, 8,9, IO], which will produce negligible dynamic pressure losses for the flow rates (no greater than 86 gpm) considered in this calculation. These losses are negligible because IO0 gpm of 60°F water flowing through a 6 inch schedule 40 pipe only produces a 0.036 psid pressure drop

[Reference 3, page B-141. Velocity head differences between the system boundaries will be neglected because of the low flow rates and relatively large pipe diameters. By determining dynamic pressure losses at specified flow rates, steam generator pressure can be determined for these flow rates fiom the following relationship, SG Pressure = Pressure available at the AFWpump - Elmution Pressure Loss - Qnamic Pressure Loss Water Pressure Available at the AFW Pump Pressurized water can be supplied to the AFW pump inlet by the service water or fire water systems. Supply by the service water system is bounding for the purposes of this calculation due to the lower head developed by the service water pumps at the specified flow rates. For this calculation, the service water pressure available at the AFW pump inlet will be fixed at 68 psig [Input 13. It is appropriate to fm the water pressure available at the AFW pump inlet given the pump head development capabilities of the service water and fire water pumps at the specified flow rates [Attachment 3, References 51.

Pressure mailable at the AFWpump = &l&g The lowest value sum of flow rates to each steam generator (40.1 gprn and 45.9 gpm) [Attachment 21 during the valve misposition event [Reference 21 will be used for this input. This is conservative, as it will increase the calcuLated system flow resistance.

Instrument uncertainty will not be considered, as this is a best estimate, non-design basis calculation. Investigation has identified no process measurement biases.

Calculation 2003-0021, Rev. 0 Estimate of Service Water Flow to Each Steam Generator Through the Turbine-Driven Auxiliary Feedwater Pumps Page 6 Elevation Pressure Loss The difference in elevation between the steam generator feedwater nozzle and the AFW pump inlet is 67 ft (77 ft - 10 ft)

[Inputs 5,7]. This elevation loss can be expressed in units of pressure as follows [Reference 3, Equation 3-233; Input 61, Elevation pressure loss @sit$ = A2 (p/ 144) = (67J) ((62.4 lb@) / (144 in2/ f?)) = 29 mid Any elevation difference between the steam generator feedwater nozzle and the steam generator internal ring header is more than compensated for by neglecting the 9 ft elevation difference between the service water header and the AFW pump inlet Pnputs 4,7].

Dynamic Pressure Loss Plant data [Attachments 1,2] is used to determine pressure losses due to flow through the AFW pump (when it is not running) and SG feedring nozzles, pipe fiiction (minimal due to the low flow rates and relatively large flow areas), changes in direction of flow path, obstructions in flow path, and sudden or gradual changes in the cross-section and shape of the flow path of the flowing water. Flow coefficient, C, is a convenient method of expressing pressure loss versus flow characteristics as follows.

This flow coefficient is calculated using plant data, which provides the maximum flow at atmospheric steam generator conditions. Therefore, a high confidence level can be associated with the C, determined at this data point. In absence of additional data points between maximum flow (86 gpm) and shutoff (0 gpm), the C, calculated using plant data (maximum flow) will be used to extrapolate dynamic pressure loss, A!', at less than maximum flow rates. This approach considers the C, value to be constant at specified flow rates (Le., dynamic losses are proportional to the square of flow rate). This is an estimation using actual plant data with Darcy's Formula to approximate a flow versus pressure relationship.

Given the low flow rates and relatively large flow areas, the dynamic losses due to fiiction resulting from actual flowpath length are minor compared to the losses fiom directional changes, obstructions, expansions, and contractions in components such as the AFW pump. Therefore, the C, is considered to be relatively insensitive to changes in non-turbulent fiiction factors associated with the specified flow rates [Reference 3 Page 2-81.

SG Pressure The allowable steam generator pressure for each specified flow rate is determined by deducting the elevation and dynamic pressure losses fiom the water pressure available at the AFW pump inlet.

SG Pressure = Pressure available at the AFWpump - Elevation Pressure Loss - Dynamic Pressure Loss

~

3AZ is substituted for /IC, of Reference 3 Equation 3-23.

Calculation 2003-002 1, Rev. 0 Estimate of Service Water Flow to Each Steam Generator Through the Turbine-Driven Auxiliary Feedwater Pumps Page 7 Total Flow (gpm)

Flow per SG (gpm)

Water pressure available at the AFW PWP (psig)

(Psidl Elevation pressure loss Dynamic pressure loss

@id)

SG pressure (psig)

Calculation 0

10 20 30 40 50 60 70 80 86 0

5 10 15 20 25 30 35 40 43 68 68 68 68 68 68 68 68 68 68 29 29 29 29 29 29 29 29 29 29 0

0.53 2.11 4.75 8.44 13.18 18.98 25.84 33.75 39.0 39.0 38.5 36.9 34.3 30.6 25.8 20.0 13.2 5.3 0.0 Water pressure available at the AFW pump and elevation pressure loss have been determined in the methodology section of this calculation to be 68 psig and 29 psid respectively.

Dynamic Pressure Loss Dynamic Pressure Loss at Plant Data Point To determine dynamic pressure loss, Af, using plant data, SG pressure and elevation pressure loss must be deducted fkom the SW header pressure. Substituting these values produces 39 psid (68 psig - 29 psid - 0 psig) [Inputs 1,3, elevation loss is determined in the methodology section]. This pressure loss occurs at a total flow rate of 86 gpm [Input 21. It should be noted that SG level was at normal level during the misposition event [Attachment 23. Neglecting the additional elevation pressure loss produces a conservatively lower C,.

62.41blcu.j-39psid(62.4) - 13.8 Cv = 86gpm Dynamic Pressure Loss at Specified Flows The C, calculated at the plant data point is used to extrapolate dynamic pressure loss, dp, at specified total flow rates of 0, 10,20,30,40,50,60,70, and 80 gpm.

AP = 39psid (86;mJ

= opsid SG Pressure SG pressure is the difference between SW header pressure, 68 psig [Input 11 and the sum of all losses in the system at total flow rates of 0, 10,20,30,40,50,60, 70,80, and 86 gpm. Flow to each SG will be approximately haIf of the total flow rate as demonstrated by plant data [Attachment 21.

Results

Calculation 2003-002 1, Rev. 0 Estimate of Service Water Flow to Each Steam Generator Through the Turbine-Driven Auxiliary Feedwater Pumps Page 8 SW Flow to Each SG vs. SG Pressure 40 35 30 n

,? 25 E

Y V 3 20 n

0 t4 2

0 r) 5 0

0 5

20 25 30 35 40 45 Flow t o each SO (Qpm)

Conclusions This non-QA scope calculation and its results will be used to support a Probabilistic Risk Assessment (PRA) effort to quantify Core Damage Frequency (CDF) associated with LER 266/2002-033-00. A high level of confidence can be placed in the maximum flow value (86 gprn at atmospheric steam generator pressure) as it is based on information from the plant historical data log report. Extrapolation of the flow versus pressure relationship between the plant data point (maximum flow) and shutoff (0 gpm) is based on an estimation using this plant data. While each steam generator could potentialIy receive service water through both the Turbine Driven pumps and the Motor Driven pumps, only flow through the Turbine Driven pumps has been considered in this calculation. Neglecting flow contributions from the Motor Driven pump is conservative as it reduces the available cooling water flow rates to each steam generator.

I

-1 L

COUDITION REPORTS (CRs)

CR 99-0575 PAGE :

DATE : -

of -

08/24 / 99 STATUS: CLOSED UNIT: 0 SYSTEM: AF I N I T I A T E D : 02/17/99 CLOSEO: 08/24/99 HSS #:

INITIATOR: HERB BENEDUH AOHI N I STRATOR: TON SHELEY ISSUE MANAGER: BRIAN OGRADY NUMBER OF OPEN ACTIONS : 0 NUMBER OF CLOSED ACTIONS : 5 TOTAL NUMBER OF ACTIONS : 5 Service Uater Introduced To SG During IT-295 Valve Stroke Test DESCRIPTION:

Ouring performance o f 11-85 (manuat valve stroke for the AUX Feed Punp discharge and service water suppty valve Unit R)

Service water was introduced through ZPZ9 and into discharge piping leading to ZHX 1A+B. Service water press in the AFW pmp room uas 66 psig.

Per step 4.5.8 ZAF-4006 uas opened by handwheel.

SU was blown down per step 4.5.10 through ZAF-63.

step 4.5.11 shuts ZAF-4006.

Another operator then mentioned 3 2 9 uas spinning during the flush but had stopped.

t o tHXlA+B steam generators uas cotd to the touch and dmp u i t h SUeat just l i k e the SU piping and 2P-29 suction line.

Discharge piping coming frcm P38 A was uarm to the touch as other ambient temp piping.

Other problem noted: Per step 4.5.11 ue cannot "Disengage" 2AF-4006 handwheel with pouer breaker open per step 4.5.6.

Significance:

Sv i s not desirable uater chemistry for steam generators.

Corrective act ions:

The piping leading Test terminated. Operations i s developing a plan to flush the feed uater flow path, and possibility of draining the steam generators of contaminants.

Recomnenda t ions:

I T 295 needs t o be corrected Screener Comnent:

None (PJW PLA comnent:

IT-290 and 295 have &en placed on admin hold.

(02/19/99 JRA1) In addition t o the investigation associated u i t h the RCE, I have inter-vieued the personnel who wrote, revieued, and performed this procedure. A meeting was held inchding the Ops Manager, Procedures Program Manager, OPS Corrective Action Specialist, end Ops Procedure Lead. The event uas revieued for the purpose of assessing the vulnerability of the organizationto another similar event, and to determine uhether any proapt preemptive actions should be taken. Decisions uere made to meet u i t h the procedure u r i t e r s as a group to reinforce the expectation for quality and discover uhat edditionat resources uere needed t o support that Level of performanca;to meet u i t h each Operating crew and c l a r i f y expectations for procedure revieus, pre-job briefs, comnunication, procedure arhereence, a n d seif-checking; end t o esteblish a team of individuals t o perform detailed revieus of major procedures yet t o be performed p r i o r to end o f UZRU. These short-term ections w i l l be supplemented by edditionel intermediate-term actions directed at improving the procedure revieu process.

(OB/t4/99 TPS) ALL corrective actions out o f the RCE have k e n cmpleted.

STATUS UPDATE:

SCREENED BY : TOM SHELEY DATE: 02/1a/99 C ~ M I T M E N T................

CY/N):

M REGULATORY REPORTABLE.....(YRII:

N TS VIOLATION..............CY/N):

N 10 CFR 21................. ( Y I N ) : N TS LCO....................(Y/N):

N OPERABILITY IHPACT PER TS.<Y/N):

N JCO REaUIRED..............

(Y/N):

N nss REVIEU................ (YIN):

N SCAO......................(Y/N): n OPERABILITY DETERHINATIOH.(Y/N):

N SUPPORTING DETERMINATIONS:

TRENDING INFOR~TlOll:

WEN-:

F i r s t Ouarter 1999 uno-:

oPEuTrow Thls event I s not reportable, nor i s i t a Tech Spec vfolatfon.

UHI-:

INADEQUATE PROGRAM MONITORING OR MANAGEMENT INADEQUATE INTERFACE AMWG DRGANIZATlON LACK OF INFORMATION VALIDATION / VERIFICAflON J)IADEQUAfE JOB SKILLS, UORK PRACTICE OR DECISION MAKING URONC ASSUMPTION UHAT-:

PROCEDURE REVfEU INADEQUATE SYSTEH: AUXILMRY FEEDWATER Human error within the technical revieu process.

THe t o support the test.See RCE 99-041 f o r edditionel why OPERATIONS PROCEDURE SRO apptied poor judgment i n essming the plant conditons uould be adequate code, and trending.

IT-295 OH 1.1 (r(

1.4 REFERENCES

LEVEL B RTS-S 13 OM 1.0 NP 1.1.3 1T-290 OEVEL 0 NP 1.1.3 on 4.3.f O O L /

REASOMS WHY DATA MAY BE UNAVAILA

1. OATA UAS NEVER RECORDED r H i s COULD OCCUR OURINC A FAILUQk OR DfSK P R O T K r l O N CUMPUTER MESSAGE: 'NO DATA

@w. u I

2. DATA UAS CUT OF PAME THIS RtANS A READING WAS k INSTRUMENT RECEIVING THE 0 COMPUTCR 6I:SSACE:

'CONV/ER POINT BEAC 2

HISTORICAL DAFA UC RCPIlWI UfSCONSlN TI.fC1R C P0Yf.X I

-i a

L 166 1 F14056 FT4037 FT 128 L T 4 3 3 1 L S I A PTGZUA t t w PCNr PCN r GPM GP M CPM PCNT DEGF PSIG

. EAM GENERATOR LEVEL a. 1 RED EAW GENERATOR LEVEL ZB-1 Y'CU A AUX FEED FLOV B AUX FEED FLOW ARCING L I N E FLOU ESWRIZER LEVEL COLD CAL S UtOE RANGE rEMP COLD LEG B i

S b7? PRESSURE loop A

.E :

MPUTER FAILURE, POWER OBrAIWEO FROM THE A.

TIMC UAii:

lT471 63.5 6S.5 tJ3.5 63.5 63.5 a. 5 63.5 63-5 62.5 63.5 63.5 63.5 6.5.S 63.5 63.5 63.5 63 -5 63 -5 63.5 63 - 5 63.5

63.

/--..

I

uo 02/17/99

.:UO 02/17/99 12 :GZ :on 07/1 //vv 1 Z :

05: OC OL/ 1 I f 99 lZ:O>:UO 07/lT/99 TZ:06:0U 02f 17/99 12:0.7:00 OZ/lf/YY 12:OB:OO 07/ tf/W 12: 09: 00 02/ 17/99 12: 13:OO 07/1I/YY 1 2: 1 1 :OU UL/17/99 12: 12: OC UX/ 17/99 1Z:lS:OC O ? f l f / Y ?

12: 10 :

OC 02/17/99 12: 15 : 00 07/17/99 12:lb:OO 02/1//YY I t : t/:OU 02/17/49 12: 19: OU 01/17/94 12:20:00 02/1//99 12:21:00 02/f7/Q9 UO OATA i t ~ i 3 : a o 02/17/99 I 2: 22: a0 w

i 1 z :ZL : 00 ai?/ 171~9 12: 25; oa o u i 7/99 00 02/7 f/YY n ; r m i w 12:2.$:00 02/17/99 12:26:00 OZ/tl/W

.477:00 02/11/99

00 02/17/99 18130: 00 OZ/1 f/99 12:32: 00 02/17/99 12:33:00 OW7/99 12:3&:0!l 02/17/99 12:35:00 02/17/99 12:3/: 00 02/17/99 17:39: 00 02/ 17/ 99 12 I 40 : 00 02/17/99 12:41:00 02f17/99 I2:U: 00 02/ 17/99 I 2:tt : 00 02/

7 7/99 12:45:00 02/17/VV 17:46:00 02/17/99 12:47:00 02111/VV 12:U : 00 02/17/99 I250 :UO 02/17/99 I z-. J i :

oo 12:56:au 02111199 12:3rj:OO O ~ I W N IZM:OO a 2 / 1 7 / ~ 9 I t: t9: oo 021 17/99 24.4 26.5 26.6 26.4 24.2 26.3 24.3 2c -2 24.2 ZL.2 24.3 24.3

-\\

Lfcibl 64.U u*

-0 64.0 64.0 66.O 66.0 6 4. 0 64.0 66.0 64.0 64.0 60.0 64.0 64.0 64 -0 64.0 66.0 64.0 64.0 64.0 64.0 61.0 64.0

&.a

63.

64.0 64.3 M. 7 65.0 65.4

65.

-I---

65.7 63.7 65.8 65.8 65.8 65.8 65.8 65.8 65-8 65.7 65.7 65.7 65.7 65.7 6s. 7 65.7 65.7 65.7 65.7 65.8 65._

65.2 65..

65.I 65.'

65..

65.

65 -

65.

65 -

'A" f r4Us6 0. 6 0.6 0.6 U.6 0.6 0.6 0.6 0.6 0.6 0.6 0.6 U.6 0.6 u.5 0.6 0.6 0.6 0.6 0.6 0.6 0.6 0.6 0.6 0.6 r r c w 3.5 0 -3 0.3 a.3 0.3 0.5 0.3 u.3 0.3 0.1 0.3 0.3 0.3 0.3 0.3 0.3 0.3 0.5 0.5 0.3 0.3 0.J 0.3 0.3

--__e 0-6 2 bS.2 68.9 43.8 48.0 GJ.4 47.0 40.1 45.9 0.4 0.2 I ::;

I 0.6 0.6 0.6 0.6 0.6 0.6 9.6 a - 6 u.5 0.6 0.6 0.6 0.6 0.6 0.6 0.6 0.2 0.3 0.3 0.3 0.3 0.3 0.3 0.3 0.3 0.3 0.3 0.3 0.3 0.3 0.3 0.3 0.3 a.3 F I120 18.4 25.2

?L-I 24.4 76.6 S4.L 26.4 24.4 24.5 24.4 24.1 Zl. 1 24.2 24.1 94.1 70.2 24.2 24.2 24.1 24.s 24.3 24.2 24.3 24.3 24.4 24.4 24.5 24.4 24.5 24.4 21.5 24.4 11.3 24.4

1. :cn 1au.4 100,4 100.5 1U0.5 100.7 100.8 130.8 iao.8 1ou.a 1oo.a 100.8 tao.8 100.8 10U.8 100.8 100.8 1011.8 100.8 100.8 100.8 100.8 100.8 1UO.B 100.8 100.8 100.8 100.8 100.0 100.8 100.8 100.8 100.8 100.8 190.8 100.8 1UO.8 100.8 100.8 100.8 100.8 100.8 100.6 1oo.a 1oo.a iao.8 100.8 iao.8 100.8 100.8 100.8 45 l n 92 97 vz 9?

92 97 92 92 92 92 92 92 9 2 92 92 92 92 92 92 92 92 92 92 PZ 92 92 92 92 92 92 92 92

91.

92 9z 92 92 92 92 92 vz 92 92 92 92 92 92 92 92 92 2

155 155 178 218 543 350 3 14 373 370 J ro 773 375 J 16 377 5 16 376 J IS 3 15 515 3 76 5f6 376 316 3 76 J 16 J76 5 76 3 76 376 3 I6 T 76 3 16 376 3f6 3 76 J f 6 376 3 75 376 375 3 f b 3 7s 376 3 75 375 J 75 3 76 5 IS 3 76 315

&v. 0 F--.

!:OO 5 : 00 15: (04 : uu f iNE 5;;5,:00 1J : 5 2 ; 00

-*z :SA :uo 1 2 ; 54.: on I

z: 55 :on I 2 : s6;no 12 : SI: 00 1Z:58:00 1 Z..TrQ:.OO 1J:CO :oo 13 :

01 :

00 13: 02: 00

. 1S:03 :

00 13: C4 :On 1s I O 5 I O 6 13: 36 : 00 1J:llI:W 13: 08 :OD 13: O9rOO 132 1o:oo 15: 11 :cu 13; 1;i:OO

?J: 1J:OU 13:10:00 13: fSrilcl 15: 16:OO 13; r 7 m

!A: 18:OO b:oo 1:OO

. *. 21 200 13: 22 roo 1 Y : 21 :a0 15: 26 :

00 13: 25 :00 13 :26 :DO 13: 27: 00 I f : 28 : ou 13:zY zoo 13 :3Q :

00 13:Jl :no I3:32: 00 I3 :

J3-00 13 :36 :OD l3:35 :

00 I 3:36 :

UO If; 37: 00 IS I30 :

00 13: 39: 00 IJ:GO :

00

3:4iron O A l l UZ/ 17/99 02/ 1 //99 O ? / 1 Ti W 0 1 1 1 ui/

1 1f 99 OZ/11fYY 02/ 17/9P 02/ 1 N V V ut/ 1 7/ 99 02/1 //w U2/ 17/99 07/ 1 ? / 9 V 02/ 17/99 QZ/17/9V 02/17/99 ow1 f / 9 Y 021 1 ?/V9 02/1 //vv OZ/t7/9Q O7/11/VV 02/17/99 O W 1 1/99 02/ 17/99 02/17/99 O%/ 1 I / V V 02f 17/99 02/1 1/99 a?/ 1 NVV 0211 7/99 02/1 f / O V U2/17/99 07/7 ?/W U2/17/9P 02/ 17/99 02/ 17/99 02/1 r//srp 02/17f09 O Z / l N 9 V 02/17/99 02/17/99 02/17/99 07/11/99 QZ/ 17/99 02/ 1 7f 09 oz f 1 ?/Y9 0?/1?/99 02/17/99 02/17/w 02/ !7/99 oz/t f / Y Y D?/ t 7/99 02/17/99 02/ 1 f /Q*

OZ/1//99 w i 7 / w Llf.61 65.f 65.6 65 -i I r461 65.7 65.7 65.1

.6S.?

65.7 65.7 65.I 65.7 65.7 65.7 65.6 65 -6 65 -6 65.6 65.6 65 -6 65.6 65.6 65.6 65.6 65.6 65 -6 65.6 6.5.6 65.6 65.6 65.6 65.6 65.6 65.7 (59.T 65.7 65.7 65-7 65.7 65.7 65.7 65.7 65 -7 65.7

65. I 45.7 69.7 65.7 65.7 65.6 65.7 65.7 63.7 65.7 65.7 I 1L71 45.2 65.7 65.2 I T 4 7 1 65 *s 65.3 65.3

. 65.3 05.3 F T L O W U.b 0. 6 0.6 F i 4036 0.6 0.5 0.5 0.6 0.6 0.6 0.5 0.6 0.5 0.6 0.6 0.6 0.6 0.6 0.6 0.6 0.6 0.6 0.5 0.6 0.6 0.5 0.6 0-6 0.6 0.6 0.6 0.6 0.6 0.6 0.6 0.6 0.6 0.5 0.6 U.6 0.6 0.6 0.6 U.6 0.4 0.6 0.5 0.6 0.5 0.6 0.6 0-6 0.6 0.6 0-6 I r4oJr O..%

U.3 0..i rTLOS7 a.3 a.3 0.3 0.3 0.3 0.5 0.3 0.3 0.3 0.3 0.3 0.1 0.3 0. 3 0.3 0.5 0.2 0.3 0.3 0.2 0.s 0.3 0.3

0. J 0.2 0.3 0.3 0.5 O.J 0.3 0.3 0.3 0.3 0.3 0.3 0.3 0.3 0.3 0.3 0.3 0.3 0.3 0.s 0.3 0-3 0.J 0. 3 0.5 0.3 n.3 n-5 T r i m Zf.. 4 24.4 I4.&

FTlZU 24.t 24.4 24.L 76.4 24.4 24.4 3C.6 26.4 ZL.4 24.4 24 -4 24.5 26.4 24.4 2G.3 24.4 26.4 26.5 26.6 24.5 24.4 26.4 26.4 24.1 2d.S 26.6 24.3 24.3 24.3 26.3 2G.3 24.3 26.3 24.4 24.t 2C.4 24.4 21.4 24.L 26.4 24.4 21.6 tL.4 24.4 21.6 24.6 24.5 2c.5 24.5 24.5 24.4 LZL37 100.8 100.A iao.8 L r433 100.8 1OQ.B 9on.a 1oo.n loo.!,

iat1.8 100.8 100.8 100.8 100.8 100.8 100.8 100.8 100.8 ioa.8 100.8 100.8 100.8 100.8 100.8 100.8 1D0.8 100.8 1oo.a 100.8 100.8 100.8 100.8 100.a 100.8 1ao.a 100.8 100.8 100.8 100.8 100.8 100.8 100.8 100.8 100.8 100.8 100.11 1UU.8 100.8 1oo.n 1oo.a iao.8 100.8 100.6 100.8 100.8 I C ' r l A V';

95 V6 I6514 vi!

92 92 92 92 92 92 9z 92 92 92 0 2 92 92 92 92 92 92 92 v2 92 97 YZ Q t 92 92 91 VI 91 91 v1 91 91 91 91 91 91 91 91 91 91 91 91 Y t v1 92 92 V J 93 YL V4 477; P I CEOA 376 3 75 S f b 3 76 A I6 176 376 3 76 5 fb f 76 3fb 3f6 S76 5 f b 176 J 16 376 JIB 175 3%

3 I5 376 375 5 f6 3l?

T 76 3 15 3 76 315 3 76 375 376 3 76 I 16 576 S7b 3

76 3 76 3 76 3 I6 376 5 76 376 Jf6 371 306 31J 316 311

305, 31 1

OATE I.TL6l t 1671 F IC056 F I

65.

65

65.

65

65.

65 -

65.

65 -

65.

6s.

65 -

65.

65 -

65.

65 -

65.

65 -

65.

6s.

65.

! 1:OO 02/17/99 2:SJ 02/17/99 02/ 17/99 12:SL;OO 02/17/90 IZ:55:00 UZ/lI/W 12:56:00 02/11/99 12:57:00 UZf 1f/W 12 :sa: 00 OZ/

1 T/W 12:59:00 02/17/99 13 :

OC: UU O?/ 1 7/99 13:Ol:OO 02/17/99 13; 33;OO U2/17/99

!i:36: oc UZ/l //w.

3: CS:CO 02/17/W 13:06:00 01/17/W 13:07:00 02/77/99 13 :OB: 00 02/17f 99 i3:OQ:OO 02/17/99

? 5 : I0:UU G2/1 //W o t / i 7/49.

15 :

12 : ou uz/1 I/*

?3:1S:OC 02/17/W 13 : I4:CU U2/17/99 13 z Ii :Gi!

U?/i 1/99 13:lbrUO U2/17/9?

fS:l7:0(3 07/1?/W J,3:<8:00 02/17/9Q 1:oo 02/17/99 J:OO 02/17/99

.,.L1:00 02/1r/99 13:22rOU 02/17/99 13:23:00 02/17/W 13:ZG:OU oz/1r/w t 3: 25 ; 00 02/17/94 1 3 : Z l : O O OZ/l7lW 13 :

27: 00 O2/ 1 f f 9 9 13 :

28: 00 U2/17/9Y 13 J 29 :

00 02/17/ 99 13 :

30 :

OU OZ/ 17/YY 1 3 3 1 :00 02/17/99 13 ~32:

00 02/1 ?IVY 13 : 33 :

00 02/ 17/9V 13:34:00 021 17/99 13;35:00 02117/99 13:37:00 02/17/99 13 :38:00 02/17/99 13:39:00 OZf17iW w 4 0 : 00 02/17/99 13:61:00 02/17/99 t L : 53: 00 13 :

32: a0 ut/ I 719~

73 :I t :mi 13 :36:00 1121 17/99 65.1 65.7 65.7 65.7

65. I 6S.7

65. f 65.7 65.7 65.7 65.6 65.6 65.6 65.6 AS.6 65.6 65.6 65.6 45.6 65.6 65.6 65.6 65.6 65.6 65.6 65.6 65.6 6.5.6 65.6 65.7 65.7 65.7 65.7 65.7 65.7 65.1 65.7 65.7 65.7 65.7 65.7 65.7 65.1 65.7 65.7 65.6 65.7 65.7 65.7 65.7 65.7 0.6 0.5 0.5 0.6 0.6 0.6 0.6 0.5 0.6 0.6 0.6 0.6.

, U.6 0.6 0.6 0.6 0.6 0.5 0.6 0.6,

0.5 0.6 0.6 0.6 0.6 0.6 0.6 0.6 0.6 0.6 0.6 0.6 0.5 0.6 0.6 0.6 0.6 0.6 0.6 0.6 0.6 0.5 0.6 0.5 0.6 0.6 0.6 0.6 0.6 0.6 0.5 2057 0.3 0.3 0.5 0.3 0.3 0.s 0.T 0.5 0.3 0.3 0.3 0.3 0.3 0.3 0.3 0 -3 0.3 0.2 0.3

. 0.3 0.2 0.3 0.3 0.5 0.3 0.3 0.2 0.3 0.3 0.3 0.3 0.3 0.3 0.3 0.3 0.3 0.3 0.3 0.3 0.3 0.3 0.5 0.3 0.3 0.3 0.3 0.3 0.3 0.3 0.3 0.J z

26.2 24.4 24.4 24.4 22.4 24.4 ZL. 4 Zb.4 44.4 24.4 24.4 24.5 24.4 20.4 24.3 24.4 24.4 24.5 26.4 26.5 2 4. G 24.4 24.4 24.4 26.5 24.4 26.3 24.3 24.3 24.3 24.3 24.3 ZC-3 14.4 20.4 24.4 ZC.4 24.4 2c.4 24.4 24.4 24.4 24.4 26.6 24.4 24.6 24.5 2b.5 24.5 24.5 24.4 100.8 100.8 1w.a 100.8 100.8 100.8 100.8 100.8 100.8 100.8 100.8 lO0.B 100.8 100.8 100.8 100.8 100.8 100.8.

100.R 100.8 100.1 100.8 100.8 100.8 100.8 100.8 100.1 100.1 100.8 100.8 100.8 100.8 100.8 100.8 100.8 ta0.R 100.8 fao.8 1oo.a 100.8 100.8 1ao.o 100.8 100.8 100.E 100.8 100.8 100.8 100.8 100.8 100.8 92 P?

92 97 92 92 92 92 v2 92 92 92 92 92 92 92 92 92 92 92 9?

92 9z 92 92 92 91 91 91 91 91 91 91 91 91 91 91 91 91 91 91 91 91 91 91 Vi!

92 93 93 94 9L

,; 76

r

. r 7 r 5 I6 3 76 3 76 3 16 376 376 3 76 176 316 3 76 376 376 3 76 3 76 5 76 3 76 3 75 3 Ib 37s 5 16 J 75 3 76 J 15 376 3IS 3 76 315 376 3 75 376 3 I6 3 76 3 76 3 7h 316 176 3 76 376 3 76 376 376 3 16 371 306 313 316 31 1 31 1 309

i rni Dn rt LI471

&5.1 65.2 65 65.2 65.2 65.2 65.2 65.7 65.2 65.Z 65.2 65.2 65 -2 65.2 65.2 65.2 6f.2 65.2 65.2

,- *\\

!:UO 02/17/99 5;oo 02/1I/QV

? 3: 46: 00 U t / 1 7/ 99 15:45:00 02/11/99 13:46:UO 02/17/99 13:47:00 02/11/99 13:09: OU 02/17/99 13 :

5 1 :

00 071 I 1/YY 13: 52: 00 02/ 17/99 1_1:53:00 OL/1'I/YV 13:56:00 02/17/99 13:SS:OO 02/11/99 13 :

56: 00 021 17/99 13 :

48: 00 021 I I/W 13 ;so:au 0211 7/99 75: 57: ao 0211 7/99 i s :sa: oo 0 w 7 m 13:59:0a uiv17/w 16: 00: 00 0?/17199 END OF DATA

.Z LfG61 6>.f 65.6 65.6 6'; -6 65 -6 65.6 65.6 65.6 65.6 65.7 65.7

65. I 65.7 65.1 65.7 65.1 65.7 6s. /

65.7 F74036 0.6 0.6 0.6 0.6 0.6 0.6 0.6 0.5 0.6 0.6 0.6 6.6 0.6 0.6 0.6 0.6 0.5 0.6 0.5 F 1401/

0.3 0. 3 0.3 0.3 0.3 0.3 0.5 0.3 0. 3 0.3 0.2 0.3 0.3 0.3 0.3 0.3 0.3 0.3 0.3 4

t I 128 24.6 26.4 Z6.2 24 -5 24.3 17.1 17.3 17.1 17.6 17.5 t t.6 17.6 17.7 17.6 17.7 11.6 17.6 17.6 17.7 1 IC3 100.8 100.8 100.8 100.7 100.7 100.6 100.5 100.5 iao.8 100.4 100.6 100.4 100.4 100.4 lOCt.0 1OO.L 100.4 100.4 100.6 rC5IA 05 95 96 96 95 98 94 95 93 93 93 93 95 93 94' 94 9L 94 9d 2

513

.114 310 316 262 220 194 175 16L lS?

151 147 1LI

? / r l 1 &O 139 1 JY 140 5513

ATTACHMENT 5 Summary of MAAP Analvsis (Preliminary)

POINT BEACH NUCLEAR PLANT, UNITS 1 AND 2

DRAFT Event Timeline & Accident Sequence Success Criteria Analyses Using The MAAP Computer Code Purpose The analyses provide input for various transients to determine 1) the acceptability of postulated transients defined in the Point Beach Probabilistic Risk Assessment (PRA) analysis, with respect to operator actions and available equipment and, 2) timing information of key events to be used for the purposes of Human Error Probability (HEP) calculations.

The intended use of the analyses is to support specific accident sequences used in the PRA analysis of the AFW recirculation orifice issue for the purposes described above.

Methodology The analyses are performed using the Modular Accident Analysis Program (MAAP),

version 4.0.4.

MAAP is a best-estimate, general-purpose severe accident code that can be used to predict transient behavior in the reactor coolant and secondary systems, core damage, and containment response. MAAP is widely used in the industry for performing thermal-hydraulic analyses to support PRA modeling, predict severe accident phenomenon, and to provide best-estimate transient behavior for various transients.

Fauske & Associates, Inc (FAI) developed MAAP, and maintains it under industry and EPRI sponsorship. MAAP has been benchmarked extensively against experimental and industrial data, and is considered acceptable for PRA support applications.

A MAAP model for a particular plant is documented in a plant specific parameter file. A parameter file for Point Beach was developed for earlier PRA applications for use with the MAAP3 code. FA1 later revised the parameter file for use with MAAP code version 4.0.4.

This is the version of the Point Beach parameter file that is used for these analyses.

Changes to the model for a specific analysis are implemented using an input file. The input file allows changes to the parameter file values, modeling of initiating events, modeling of operator interventions, and specification of outputs.

Three types of analyses are performed to determine the effect of specific recovery actions:

1. Base case. For this scenario, the AFW system takes suction from the Condensate Storage Tank (CST) and draws it down to the low-low level (eight foot indicated level). The AFW suction is then transferred by procedure to the Service Water (SW) system. It is assumed that the AFW pumps fail immediately upon transfer to c

DRAFT the SW system. After the steam generators boil down to the 55 wide range level, charging feed & bleed is initiated.

2. The use of an additional volume of condensate from the water treatment systems clearwell is credited. Manual alignment of this source of clean water is required, but is not modeled in the MAAP analyses. The use of this water extends the time for which AFW is delivered to the steam generators. The impact on the analysis results is 1) to extend the time available for cooldown to RHR conditions and, 2) to allow additional decrease in the decay heat level, which improves the effectiveness of the charging feed and bleed operation if required.

3. Credit is given for using the SW system to flow water through an idle AFW pump into the steam generators. This is an operation that may be attempted after all other possible options to get water into the steam generators have failed. It involves performing a rapid depressurization of the steam generators and aligning either SW or firewater into the AFW pump suction piping. The SW header pressure is sufficient to overcome the head difference from the AFW pumps to the steam generators once the secondary pressure drops low enough.

The following are the accident scenarios that are analyzed;

1. Dual unit loss of ofssite power (DLOOP). This event causes both units to lose power to all station auxiliaries. It is essentially a loss of normal feedwater with a concurrent reactor trip and reactor coolant pump trip. AFW flow for each unit is assumed to only draw on its respective condensate storage tank (CST) inventory.

2. Single unit loss of normal feedwater (SLONF). This event is similar to the dual-unit event, except that the reactor coolant pumps are assumed to remain on initially, and the inventory of both CSTs is available for use on the affected unit.

The reactor is allowed to trip on low-low steam generator level.

3. Small break loss of coolant accident (SBLOCA). Three sizes are analyzed; 1/2 inch, 1 inch, and 2 inches. Smaller breaks are within the make-up capability of the charging system, and the ECCS safety injection pumps mitigate larger breaks.

This accident scenario does not use charging feed & bleed in the same way as DLOOP and SLONF since charging and SI pumps may already be in service, and a leak path from the RCS is already established. However, the intact steam generator is modeled to be available for decay heat removal and cooldown.

4. Steam generator tube rupture (SGTR). This accident scenario does not use charging feed & bleed in the same way as DLOOP and SLOW since charging and SI pumps may already be in service, and a leak path from the RCS is already established. However, the intact steam generator is modeled to be available for decay heat removal and cooldown.

Acceptance Criteria The criterion for acceptable results is that the peak core node temperature remains less than 1800 F. A brief uncovering of the core is acceptable as long as this temperature criterion is met.

DRAFT Inputs & Assumptions The major assumptions used in these analyses are as follows;

1. It is assumed that the LOAC event causes a coincident loss of normal feedwater, a reactor coolant pump trip, and a reactor/turbine trip. Basis: In a dual unit LOAC, the loss of AC power would likely cause a plant-wide failure of all plant loads not powered from emergency power. The same is true for a single unit event, but the loss of power is restricted to a single units loads.

2. It is assumed that the units are thermal-hydraulically identical for the purposes of this calculation. Basis: In reality, if a dual-unit LOAC occurs, there will be differences in various parameters such as reactor trip times, relief valve setpoints and flow capacities, etc. As a result, AFW flows will not be symmetrical.

However, for calculating the CST drain-down time, it is conservative to assume that AFW flow is split symmetrically between all four steam generators. Under this condition, all steam generators will have to be refilled to and maintained at the operating level, maximizing the usage of the CST inventory.

3. It is assumed that the inventories of both CSTs are available to both units. Basis:

The CSTs are normally aligned such that they are hydraulically connected for operational purposes (e.g., to allow the inventory to be accessed from either tank, and to prevent level surging transients (sloshing). This doesnt affect the dual unit analysis since the units are assumed to behave symmetrically, but does allow the inventory of two tanks to be used for the single unit events.

4. It is assumed that the AFW flow is modeled for this MAAP analysis as a combination of flow from the MDAFW pumps and the TDAFW pump for each unit. For a dual unit event, each steam generator may receive (260 + 100 + 100)/2 GPM = 230 gpm. For a single unit event, each steam generator may receive (260

+ 200 + 200)/2 gpm = 330 gpm. (see Inputs 7 & 8). However, the analysis will limit the total AFW flow if the SG level approaches the normal water level, and throttle the flow back to zero as needed.

Nominal operating conditions and setpoints are used as inputs for all of the analyses.

1. Rated thermal power is 1518.5 MWt.

2. Initial steam generator water mass corresponds to a nominal operating level (64%

NR).

3. The nominal and initial pressurizer pressures are 2250 psia.

4. When modeled, the pressurizer sprays are fully open at 2325 psia.

5. When modeled, the pressurizer heaters are fully on at 2235 psia.

6. The nominal CST level is 17.05 ft for the dual-unit case, and 16.0 ft for the single-unit case. These values are based on a review of operational data for a one-year period, and are determined at a 95% confidence level.

DRAFT

7. The AFW TD pumps provide a nominal flow of 260 gpm at 1200 psia. Even though the design capacity of the TDAFW pumps is 400 gpm, they are throttled to provide a total flow of 260 gpm. MAAP uses nominal values for the constant flow AFW feature.

8. The AFW MD pumps provide a nominal flow of 200 gpm at 1200 psia. MAAP uses nominal values for the constant flow AFW feature.

9. Flow capacity of one charging pump is 60.5 gpm.

10. The low-low level setpoint in the CST is at 8 ft indicated level.

11. The flow of service water into the steam generators through an idle AFW pump has been estimated from plant data (PBNP calculation 2003-0021, Revision 0).

12. The clearwell inventory available for transfer to the CSTs is assumed to be at 60 inches. Normally, the clearwell is kept above this level.

Results The summary of results is provided in the Table 1. The table gives a brief description of the transient, timing results for the CST drain down, time to reach RHR cut-in conditions or sump recirculation criteria (as applicable), and time to initiate charging feed and bleed (if applicable). Values given as '524 hrs" indicate that the long term cooling criteria had not been met within the analysis time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . However, in these cases the results indicate stable or decreasing temperatures. The table also gives the peak core node temperature reached, or trend if temperature does not increase during the transient, and a time to core damage (if applicable). Note that these are draft results that are subject to change pending validation of the inputs and the analyses.

Dual Unit Loss of Ofssite Power The CST is drained down to the 8-foot level at approximately 1.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months . The use of charging feed and bleed (initiated at 4.8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months ) provides enough decay heat removal to maintain core cooling well below the acceptance criteria of 1800 "F. A sensitivity analysis examined delaying the initiation of charging feed and bleed by one hour. The result showed a minor increase in the peak core node temperature.

Use of Service Water (SW) injection into the steam generators under low pressure results in the core remaining covered, and in a lower peak core node temperature.

Single Unit Loss of Normal Feedwater The CST is drained down to the 8-foot level at approximately 2.2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months presuming the reactor trips on a low-low level steam generator level. The use of charging feed and bleed (initiated at 5.7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months ) provides enough decay heat removal to maintain core cooling well below the acceptance criteria of 1800 "F.

A loss of all normal feedwater may occur as a result of failure of the buses that supply power to the main feedwater pumps, reactor coolant pumps, and reactor trip breakers. A

DRAFT sensitivity analysis was therefore also performed that credited an immediate reactor trip and reactor coolant pump trip. In this case, the CST drain down time was approximately 4.8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . The use of charging feed and bleed (initiated at 8.8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months ) provides enough decay heat removal to maintain core cooling well below the acceptance criteria of 1800 OF.

The use of Service Water (SW) injection into the steam generators under low pressure results in part of the core becoming uncovered for a period of time. However, the peak core node temperature remains well below the acceptance criteria of 1800 OF.

The use of additional clean water from the make-up water treatment plant clearwell allowed sufficient cooling to reach the RHR cut-in temperature in approximately 5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months .

The cooldown was assumed to begin 30 minutes after the initiating event, and progressed at a rate of approximately 50 F/hr.

Small Break Loss of Coolant Accident This analysis assumed three small break sizes (1/2, I, and 2), both with and without the high pressure safety injection (SI) pumps available. The cases where the SI pumps were available resulted in adequate core cooling with no drain down of the CST to the 8-foot level. For cases in which the SI pumps were unavailable, the two larger breaks (2 and 1) resulted in a peak core node temperature excursion, but remained well below the acceptance criteria of 1800 F using charging injection. The peak core node temperature for the smallest break (1/2) remained stable or decreasing.

Steam Generator Tube Rupture The SGTR accident by default will use high head SI pumps and charging pumps as needed to maintain reactor coolant inventory. It also requires the AFW system to cool down the intact SG to allow the RHR system to be used for heat removal, thus terminating any further steam releases to the environment. This analysis is primarily concerned with the ability to maintain core cooling and inventory.

The base case results show that the CST will drain down to the 8-foot level in approximately 3.6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . This assumes that the cool down begins 30 minutes after the event occurs and assumes a cool down rate of 100 OF/hr. The use of the clearwell inventory to augment the CST inventory predicts that the RHR cut-in temperature is reached in 8.5 hrs. The use of the SW injection into the steam generators under low pressure results in the core remaining covered, and in decreasing peak core node temperature.

&+-

Run Description Time to Time to Time to Peak core Time to drain RHR initiate node core CST to 8 Cut-In or charging temperature damage feet Sump F & B Recirc.

F & B w160 gPm charging 1.5 hrs

>24 hrs 4.8 hrs lb IC Id flow N o F & B 1.5 hrs NIA NIA F & B 1.5 hrs

>24 hrs 4.8 hrs delayed one hour UseofSW 1.5 hrs

>24hrs NIA through idle AFW pump DRAFT l a 103'1 "F None

> 1800°F 1037 "F 7.9 hrs None 696 "F None 2a F & B w160 gpm charging flow 2aa F & B w160 gPm charging flow -

Prompt Rx &

RCP trip

>1800 "F 8.9 hrs 2.2 hrs NIA NIA 2.2 hrs

>24hrs NIA I through idle AFW pump 2d Useof NIA NIA NIA None 5 hrs clearwell inventorv iBLOCA Case 3a I 2" break NIA Decreasing None WmPI for xfr to recirc.

I 3b I 2" break w/o NIA 1162 "F None HPI for xfr to 1 sump recirc.

Decreasing NIA Decreasing None None None DRAFT

! & Success Criteria Results I

Table 1 Description MAAP An; Time to pes Timir Time to RHR Cut-In or Sump Recirc.

5.8 hrs for xfr to sump Run Time to initiate charging F & B Peak core node temperature Time to core damage drain CST to 8 feet 1 break w m 1 Remains >

8 NIA 3c 3d Decreasing None recirc.

>24 hrs 1 break wlo HPI Remains >

8 1061 F None NIA for xfr to sump recirc 3e Decreasing Yone

/2) break VVIHPI 5.1 hrs

>24 hrs NIA for xfr to sump recirc.

724 hrs for xfr to sump recirc 3f 4.0 hrs Decreasing 4Jone NiA 4 break w/o

I lase 3ase case iGTA 4a Jse of

leawell 4b 4c nventory Jse of SW 3.6 hrs 3 hrough idle IFW pump

ATTACHMENT 6 Summaw of Human Error Analysis (Preliminary)

POINT BEACH NUCLEAR PLANT, UNITS I AND 2

EPRl Human Reliability Calculator (TM) 2.01 06/27/2003 1

Human Error Probability Development..........................................................

2 1.1 General Approach..................................................................................

2 1.2 Quantification.........................................................................................

2 1.2.1 Stress..............................................................................................

3 1. 2.2 1. 2.3 Recovery.........................................................................................

4 Dependencies.................................................................................

5 2

Results...........................................................................................................

8 Failure to control ARN pump flow..........................................................

8 Dual unit event................................................................................

9 Loss of instrument air....................................................................

10 2.1 2.1. 1 2.1. 2 2.1.3 Single unit event..............................................................................

9 Loss of heat sink...................................................................................

15 2.2 2.2.1 2.2.2 2.2.3 2.2.4 2.2.5 2.2.6 2.2.7 2.2.8 2.2.9 2.2.10 Cognition to enter CSP-H.l...........................................................

19 Cognition'to enter Feed and Bleed................................................

20 Feed and bleed.............................................................................

21 Feed an. d bleed using charging in CSP-H.l..................................

22 Cognition to enter CSP-C.l...........................................................

23 Feed and bleed using charging in CSP-C.l..................................

24 Supply S/G with service water given instruction............................

25 Supply S/G with service water given no specific instruction.......... 26 Supply S/G with fire water given instruction..................................

27 Isolate fire water diversion paths....................

28 1

EPRI Human Reliability Calculator (TM) 2.01 06/27/2003 1 Human Error Probability Development 1.1 General Approach Post-initiator human interactions occur after an initiating event and consist of a cognitive element and an execution element. The cognitive element includes detection, diagnosis and decision-making, while the execution element consists of manipulation tasks. Post-initiator human interactions occur in response to some cue; the cue may be the initiating event itself, an alarm, a procedural step or an observation. Post-initiator human interactions are dynamic and subject to time constraints, which is assumed to increase the level of dependency between members of the crew. This will increase the joint probabilities of failure. Stress generally increases the probability failure. Some performance shaping factors may mitigate the stress level thus decreasing the probability of failure, while other performance shaping factors may aggravate the stress level thus increasing the probability of failure. Post-initiator human interactions are analyzed in a cue-response time framework.

The general approach to the post-initiator HRA is as follows:

IDENTIFY through a systematic review of the relevant procedures the set of operator responses required for each of the accident sequences.

DEFINE human failure events that represent the impact of not properly performing the required responses, consistent with the structure and level of detail of the accident sequences.

ASSESS the probability of each HFE using a well-defined and self-consistent process that addresses the plant-specific and scenario-specific influences on human performance, and addresses potential dependencies between human failure events in the same accident sequence ASSESS recovery actions (at the cutset or scenario level) and model only if it has been demonstrated that the action is plausible and feasible for those scenarios to which they are applied.

Estimates of probabilities of failure shall address dependency on prior human failures in the scenario 1.2 Quantification A general framework for analyzing post-initiator human errors is shown in Figure 1-1. In response to a cue, a cognitive error, denoted as pc, can lead to failure of the human interaction if not recovered. If cognition is successful, an execution error, denoted as PE, can lead to failure of the human interaction if not recovered.

The cognitive HEPs are analyzed and quantified using the cause based decision tree method (CBDTM) [EPRI TR-1002591, while the execution HEPs are analyzed and quantified using the technique for human error rate prediction 2

EPRl Human Reliability Calculator (TM) 2.01 06/27/2003 (THERP) [NUREGER-12781 embodied in the EPRl HRA CalculatorTM version 2.01.

Cognitive Cognitive Execution Error Cue Error Recovery Success or Fai I u re Execution Recovery Success PE Fai I ure Success Success P E Fai I u re PER Figure 1-1 : Assessment of Post-initiator Human Error Probabilities pc 1.2.1 Stress Operators are usually highly skilled in performing the necessary tasks - most having more than ten years experience and each having more than 6 months experience.

In most cases, optimum stress is applied due to the level of experience, the nature of the event and lack of being unduly challenged in performing the procedure-directed tasks. Some events, however, result in a high stress situation. For example, a steam generator tube rupture (SGTR) event would in general result in a high stress situation and the nominal human error probabilities would be modified as appropriate.

PER Fai I u re Application of stress factors in HRAs tends to be quite subjective, and can vary considerably between analyses. The following is suggested to consider stress more objectively:

3

EPRl Human Reliability Calculator (TM) 2.01 06/27/2003

a.

b.

C.

Optimum stress (xl) is usually applied to tasks directed by the emergency operating procedures (EOPs). In some cases, such as steam generator tube rupture, the stress level is judged higher and a moderate stress (x2) is applied.

Moderate stress (x2) is usually applied to task directed by the critical safety function (CSP) or emergency contingency action (ECA) procedures.

Extreme stress (x5) is applied if additional human interaction is required because of subsequent equipment failure whilst in an FR or ECA.

The above stress guidelines are based on how far the plant is from core damage.

These stress levels can be further increased if it is judged that there are further aggravating factors. For example, if the operator has reached the last step in a CSP procedure before core damage would occur should the step fail, extreme stress would be warranted. If there is a fire which causes the initiating event and impacts the instrumentation required to mitigate, a higher stress level than those given above would be justified.

The stress multipliers are applied to the execution HEPs only, as the impact of stress on cognition is implicitly accounted for in the CBDTM by considering the factors that would increase or decrease stress e.g. low vs. high workload.

1.2.2 Recovery Recovery is only credited if there is a definite cue or alarm to alert the operator to revisit the decision. The operators must also receive training on the recovery.

Examples include, a circular path through the procedure (but taking care that this does not allow self-recovery from error modes that represent misunderstanding), an alarm (except where already credited in the decision tree), or the STA following the critical safety function status trees.

It is assumed that each operator is responsible for completing specific tasks.

Crew composition varies from site to site. Generally, there is a Control Room Supervisor (CRS), Reactor Operator (RO) and a Balance of Plant Operator (BOP) who are normally in the control room; there is a Shift Supervisor (SS) and a Shift Engineer (SE, who is also the STA) on each operating crew. The RO and BOP operators are familiar with the operations and controls in the entire control room; each is assigned one position for a shift, but can be rotated to the other position on a different shift. For non-time critical actions where the extra crew members are not specifically assigned to other tasks, a recovery factor for the extra crew member is generally credited. Credit for STA actions, generally Critical Safety Function Status Tree related, should not be assumed until 15 minutes after the initiating event occurs.

The time variable enters the analysis through application of recovery factors such 4

EPRl Human Reliability Calculator (TM) 2.01 06/27/2003 Recovery Factor Other Crew as extra crew, STA review, and shift change. Recovery may be accomplished by the same crew member who initially executed the critical steps or it could be by other crew members, the STA, ERF or the next shift. Recovery by other crew members, the STA, ERF or the next shift could only be credited when it is certain that they would be in the CR. The Emergency Response Facility (ERF) Review recovery factor is not applied if the human interaction takes place less than 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months into the sequence, or if the time available for the human interaction is less than 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . The Technical Support Center (TSC) and Operations Support Center (OSC) are typically manned within one hour of an emergency plan declaration. Usually, recovery factors are effective at the times shown in Table 1-1 Time Effective On multi-unit plants with physically adjacent Table 1-1: When Recovery Factors Could Be Credited STA ERF 15 minutes after reactor trip.

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after reactor trip.

control rooms, crew from the unaffected unit/s can be credited at any time. If the initiating event affects all units (e.g. LOOP), crew from the other unit should not be credited.

Shift Change 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months after reactor trip given 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months shifts 9 hours1.041667e-4 days 0.0025 hours 1.488095e-5 weeks 3.4245e-6 months after reactor trip given 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months shifts I

I I

Although multiple instances for recovery can typically be identified, it is prudent to only credit the single, most certain recovery factor - especially when the time window is less than an hour. This may be slightly conservative, but it is more defendable. If the time window is very long (several hours), the application of multiple recoveries is more defendable. However, for the sake of consistency in the HRA, it is advisable to adhere to policy of crediting a single recovery factor only.

1.2.3 Dependencies 1.2.3.1 Dependency within the same HFE Dependency within the same HFE is applicable whenever recovery factors are credited or when there are redundant actions. Redundant actions are actions along an alternative success path. For example, in a case where the operator is required to manually start RHR where only one train of RHR is required, there 5

EPRl Human Reliability Calculator (TM) 2.01 06/27/2003 High Moderate Low L

r

\\

I \\

r may be separate steps in the procedure that direct the operator to first start train A and later to start train B. The starting of train B is redundant to the starting of train A, because only 1 train is required. The operator needs to fail both steps in order to fail the action.

In the quantification of the action, the dependency between the failure of the first step and the failure of the second step need to be considered.

Zero k

The determination of the level of dependence between two actions is not an exact science and remains quite subjective. Many factors may influence the level of dependence such as timing, location, procedure and the relationship between persons performing the actions. These factors should be discussed and reviewed by plant operations personnel. For post-initiator actions, timing is deemed the important underlying factor.

The SCIENTECH guidance is to establish a minimum level of dependence based on the timing, and to adjust this level of dependence higher if additional factors influencing dependencies are identified. The minimum level of dependence based on timing between human interactions is shown in Figure 1-2.

Conditional Probability Equation (N=

HEP)

Level Of Dependence

pproximate Value for Small N Figure 1-2: Level of Dependence as a Function of Time The conditional probability of one action given another action, within the same HFE, is usually quantified by determining the level of dependency and then applying the formulas from THERP Table 20-17 that are reproduced below in Table 1-2.

Table 1-2: Conditional Probability Equations I

I I

I N

I I Zero dependence (ZD) 0.05 1 + 19N 20 Low Dependence (LD) 6

EPRl Human Reliability Calculator (TM) 2.01 06/27/2003 Level Of Dependence Table 1-2: Conditional Probability Equations Conditional Probability Approximate Value Equation (N=

HEP) for Small N Medium dependence (MD) 1+6N 7

0.14 0.5 l + N 2

High Dependence (HD)

Complete Dependence (CD) 1.o 1.o 1.2.3.2 Dependencv between different HFEs Dependencies between different HFEs are important to consider where such HFEs occur in the same cutset or accident sequence. If dependencies are not considered, the cutset probabilities, and hence the top event probability, can be significantly underestimated. Dependencies may be identified and examined during the initial review of event tree sequences, during operator interviews, and during review of cutsets with multiple operator actions.

The first step in the cutset review is to identify the cutsets with HFE combinations. There are various procedures for doing so. Typically, all HEPs will be set to 1.0 to identify cutsets with the highest risk achievement worth HFE combinations. This also serves to identify cutsets with probabilities that remain below some truncation limit even with all HEPs set to 1.O, and therefore does not warrant any further analyses. The procedure for identifying HFE combinations could be iterative.

The second step is to screen the important combinations of HFEs identified above. Generally, pre-initiator HFEs and post-initiator HFEs could be considered independent.

However, there are cases such as with miscalibration of instrumentation channels, where the post-initiator HFE would be increased because of the miscalibration.

Pre-initiators are also generally considered independent of each other.

The third step is to analyze each HFE combination that cannot be screened out.

Factors that can cause dependencies between HFEs are:

Commoncues Relatively short time separation between HFEs Same location Same person performing actions Same procedure Staffing resources 7

EPRl Human Reliability Calculator (TM) 2.01 06/27/2003 I__

A combination of post-initiator HFEs is first analyzed to determine if there is a common cue. If so, a common cognitive element should be modeled for them.

This would entail modeling a cognitive HFE as a separate basic event and replacing each dependent basic event with an OR gate that has in its domain the common cognitive HFE and the independent part of the dependent HFE.

The conditional probabilities of dependent HFEs can be quantified either by explicit analysis or by applying the conditional probability equations of Table 1-2 above. However, explicit analysis is always the preferred method, especially for important combinations.

2 Results 2.1 Failure to control AFW pump flow A potential AFW pump common cause failure mechanism had been identified due to the design of the recirculation line orifices. The concern was that if the AFW suction had to be switched to the service water system, the orifices might have clogged, as the service water strainer mesh is 1/8 inch while the AFW orifice channel holes were much smaller. AFW suction has to be switched to service water on condensate storage tank low-low level (8 feet level). This level would have been reached within approximately 1.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months in the event of a dual unit loss of offsite power. In a single unit scenario, this level would have been reached in approximately 4.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months . Had AFW pump suction been switched over and the orifices of the running pump/s clogged, the running AFW pump/s would have failed.

Given a scenario where the running pump/s failed on switchover to service water, there would have been some potential for the operators to diagnose the cause of the failure/s and to then control the remaining pump/s in a stop-start (batch) mode. In stop-start mode, the operators would fill the S/Gs to 64% (NR) and then stop the pumph. When the S/G levels had boiled off to 29% (NR), the operators would restart the pumps and fill the S/Gs again. This control regime would not have depended on recirculation flow, so orifice blocking would not have constituted a failure mode. Running the remaining pumps in a stop-start control regime would have been the only successful strategy to prevent the failure of all AFW pumps and hence loss of the AFW system.

In the event that a running pump/s had failed on switchover to service water, the diagnosis of the cause of failure would have been complicated by the lack of any direct indications to the cause. Recirculation flow rate is not indicated in the control room, but a local flow indicator is provided on each recirculation line. The only flow indication in the control room is on forward flow to the S/Gs. Had a pump failed due to a blocked orifice in the recirculation line, the local flow indicator would have been of no use after the failure. The operators would have had to diagnose the cause from indirect indications and cues.

8

EPRl Human Reliability Calculator (TM) 2.01 0 6/27/20 03 Dual unit event Loss of Instrument Air The HEPs for failure to diagnose the cause of the running A M

pump failures and implementing a start-stop running regime in mitigation are summarized in Table 2-1 and discussed in the following sub-sections.

0.8 0.4 Table 2-1 : AFW pump flow control HEPs Sinale unit event 2.1.1 Single unit event The diagnosis of the cause of failure and mitigating control strategy for a single unit event is examined in the decision tree in Figure 2-1. The initiating event is postulated as a loss of offsite power that is not recovered within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months requiring ARN suction switchover to service water. After switchover to service water, the running TDAFW pump is assumed to fail. Given the TDAFW pump failure, it is deemed that the operators would in, most cases, not diagnose that service water is related to the failure (Pcog= 0.84) - as the failure of a single pump would most probably be ascribed to random causes. Given that the operators would not diagnose service water as related to the cause of failure, it is deemed that they would start both the standby MDAFW pumps without any delay (Pcog= 0.99).

This sequence constitutes the dominant sequence (Pcog= 0.83). If the operators diagnose that service water is related to the cause of failure, it is deemed that they would delay starting the standby MDAFW pumps in most cases (Pcog= 0.89),

or in some cases, they may declare the AFW inoperable (Pcog= 0.1). If the operators delay the start of the standby MDARN pumps, they would have approximately an hour for diagnosis before they would be procedurally required to start the pumps on S/G NR 29% level.

During this hour available for diagnosis, it is deemed that, most of the time, the operators would not diagnose that the orifices are blocked (Pcog= 0.73). No credit is given to the TSC for diagnosis as complete dependence is assumed. Given that the crew would not diagnose blocked orifices, they would start the MDAFW pumps and throttle flow as soon as S/G levels are recovered - leading to failure of the MDAFW pumps and loss of the AFW system.

The total probability of cognitive failure is calculated as 0.961 =1.O.

2.1.2 Dual unit event The diagnosis of the cause of failure and mitigating control strategy for a dual unit event is examined in the decision tree in Figure 2-2. The initiating event is postulated as a dual loss of offsite power that is not recovered within 1.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months requiring AFW suction switchover to service water. After switchover to service water, the running TDAFW pumps are assumed to fail. Given the failure of the 9

EPRl Human Reliability Calculator (TM) 2.01 06/27/2003 T D A W pumps, it would be unlikely for the operators not to diagnose that service water is related to the failure (Pcog= 0.16) - as the failure of both pumps in quick succession would most probably be ascribed to common causes.

If the operators would not diagnose service water as related to the cause of failure, they would start both the standby MDAW pumps without any delay (Pcog= 0.99).

In most cases, the operators would diagnose that service water is related to the failure (Pcog= 0.84). Given that the operators would diagnose service water as related to the cause of failure, they would delay the start of the standby MDARN pumps in most cases (Pcog= 0.89), or in some cases, they may declare the ARN inoperable (Pcog= 0.1). If the operators delay the start of the standby MDAW pumps, they would have approximately an hour for diagnosis before they would be procedurally required to start the pumps on S/G NR 29% level. During this hour available for diagnosis, it is deemed that, most of the time, the operators would not diagnose that the orifices are blocked (Pcog= 0.73). No credit is given to the TSC for diagnosis as complete dependence is assumed. Given that the crew would not diagnose blocked orifices, they would start the MDAFW pumps and throttle flow as soon as S/G levels are recovered - leading to failure of the MDAFW pumps and loss of the AFW system. The total probability of cognitive failure is calculated as 0.795 = 0.8.

2.1.3 Loss of instrument air The diagnosis of the cause of failure and mitigating control strategy for a loss of instrument air (dual unit) is examined in the decision tree in Figure 2-3. On a loss of instrument air, the operators were instructed per the foldout page of E-0 (and some other E procedures) to operate the AFW system in a stop-start mode

- relying on forward indicated flow only:

AFW MINIMUM FLOW REQUIREMENTS IF any AFW pump min-recirc valve fails shut annunciator CO1 A 1-9, INSTRUMENT AIR HEADER PRESSURE LOW in alarm, THEN monitor and maintain minimum AFW flow or stop the affected AFW pump as necessary to control S/G levels.

o P-38A minimum flow - GREATER THAN 50 GPM o P-38B minimum flow - GREATER THAN 50 GPM o P-29 minimum flow - GREATER THAN 75 GP M The basis for the above statement was to mitigate against closure of the AFW recirculation line valves. The problem with the AFW recirculation line valves had been identified prior to the issue with the blocking of the orifices. The blocking of the orifices would have resulted in a similar failure mode as would closure of the recirculation line valves - although the operator would have had no direct indications that the orifices had been blocked. The unintended benefit of the above continuous action statement was that in the event of loss of instrument air, the operators would have run the AFW pumps in a stop/start regime, which would also have mitigated against blocking of the orifices.

10

EPRl Human Reliability Calculator (TM) 2.01 06/27/2003 Per the loss of instrument air procedure, the operators are instructed to gag open the recirculation flow isolation valves. With these valves gagged open, it would not have been necessary to run the AFW system in accordance with the continuous action statement anymore.

However, the operators may have regarded the continuous action statement to remain valid even after the valves were gagged open - continuing to run the AFW in a stop-start mode. Based on the operator interviews, it is deemed that there is a 50/50 chance that the operators would have continued running the AFW in a stop/start mode. This guarantees success in approximately 50% of cases.

If the operators had reverted to throttled flow, the running TDAFW pumps would have failed on switchover to service water, and the decision logic following from this node on is the same as in the decision tree for the dual unit event. The total probability of cognitive failure is 0.41 8 = 0.4.

11

EPRl Human Reliability Calculator (TM) 2.01 Loss of Running Swllchover Running Ops fall lo Ops start Ops fall lo TSC falls lo Ops start Pcog Power OIIsile pumps to Sw pump fails diagnose SW nnulnlng pumps dlagnore orliias dlagnare orficer remalnlng early early blocked blocked pumps late 4

4 4

4 4 to 5 0

4 65 65 65 86 86 86 5

65 65 65 65 10 29 29 86 86 86 86 to 70 70 06/27/2003 Total PCOg eline [hrsl NR level I%]

WR level [%1 slslon logic Dartnose O.OOE+M) 0.99 0.00E+00 Throttled F

1 TDAFW Fail 1

3 not fail 5

0 0.00E+00 Declare inoperable F

Starl F

0.1 1.60E-02 0.01 1.60E-03 Stop/statt 5

Do not starl 0.01 8.40E-05 Do not start I ri Do not fail Figure 2-1 : Decision logic for failure to control AFW pump flow given a single unit event 12

EPRl Human Reliability Calculator (TM) 2.01 la1 Loss Running Switchover Running Ops fall to Opr Hart Ops fall lo TSC fails lo Ops sbrt Power

=dY

=dY blocked blocked on 29% level

' Offsite pumps lo SW pumps fall diagnose SW remainlng pump diagnose oriflws diagnose orflces remaining pump 0

1.5 1.5 1.5 1 5 1.5 1.5102.5 2.5 65 65 65 65 65 65 651029 29 e6 e6 86 86 86 88 86 to 70 70 06/27/2003 Pcog Total PCW wiine Ihrsl i NR level I%]

i WR level [%I tdsion logic 2 TDAFW 0

I lo not fail S

O.M)E+W Do not fail 1 Fail Stop'start S

0.99 2.00E-01 Diagnose 0.27 I

7.30E-01 Throttled F

0.01 2.02E-03 0.01 O.M)E+M)

I Throttled F

0.99 5.40E-01 c

leclare inoperable 0.1 8.40E-02 Stari F

0.01 8.40E.03 Stoplstart S

Do not Start 0.01 1.60E-05 0 01 Throttled F

0.99 1.58503 Fail 0.16 Start F

0 99 1.58E-01 0.795 Figure 2-2: Decision logic for failure to control AFW pump flow given a dual unit event 13

EPRl Human Reliability Calculator (TM) 2.01 06/27/2003 Figure 2-3: Decision logic for failure to control AFW pump flow given a loss of instrument air 14

EPRl Human Reliability Calculator (TM) 2.01 CST level c 13.5' CST level c 8' SG 29% NR 2.2 Loss of heat sink The accident scenarios that are impacted by the orifice plugging issue are scenarios where main feedwater, condensate and make-up to the condensate storage tank are unavailable - requiring the use of AFW and switchover of AFW suction to service water on CST low-low level. Following the failure of the AFW system on switchover to service water, the loss of heat sink procedure (CSP-H.l) is entered on S/G NR level < 29% with total feed flow to the S/Gs less than 200 gpm. The operator actions of interest are those required by CSP-H.1 (and CSP-C.l in some cases).

nia 20 rnin 77 AOP-23 97 min 77 CSP-H.l steps 1 2.9 hrs 114 The loss of heat sink timeline is based on a dual unit loss of offsite power event.

This is most limiting on the time windows as the loss of AFW occurs after approximately an hour-and-a-half when decay heat load is relatively high (compared to single unit events where the switchover occurs after 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months ). The timeline with time windows are summarized in Table 2-2. The relatively long time windows are the primary mitigating factor in the human reliability analysis as more time is available for cognition, execution and recovery of human errors.

SG 55"WR SG dry RCS T > 700 F + RVLVL c 25' RCS T > 1800F I

Table 2-2: Loss of Heatsink Timeline I

CSP-H.l steps 27 4.8 hrs 96 6.4 hrs 90 Enter CSP-C.1 7.2 hrs 42 7.9 hrs 0

to 38 Parameter Procedure and Time Window

[minutes]

I to26 I

The main decision points and transfers in CSP-H.l are shown in Figure 2-4. In the first part of the procedure, the operators will be trying to restore ARN, main feedwater and condensate. If condensate remains unavailable, the operators are returned to step 1 and they will keep iterating through the procedure until the entry conditions for feed and bleed are met. When RCS feed and bleed criteria are met, they will transfer to step 27. If an RCS feed path cannot be established, for example if SI is unavailable, the procedure transfers them back to step 1.

Assuming a verbatim compliance with procedures, the operators will remain in this iterative loop until the entry criteria for CSP-C.l are met via the critical function status trees. If an RCS feed path is established, the operators proceed to establish an RCS bleed path by opening the PORVs. If all the PORVs can not be opened, the operators are instructed in the RNO column of step 38 to align 15

EPRl Human Reliability Calculator (TM) 2.01 any source (service water, fire water) to an S/G and to depressurize that S/G.

Continuing in the procedure, the operators are instructed to maximize charging.

In step 46 the operators are instructed to align any available water source to the S/Gs.

16

A v)

C

.I-2 Q,

(d v)

C 0

c -

.I-s v) 3 0

3 c

C

.I-s t

C CD cn E

......... I --.---------.-------

.I......................................................

I

t -4 c

E P

7 r 1

1

EPRl Human Reliability Calculator (TM) 2.01 The main operator actions credited in loss of heatsink scenarios are:

Cognition to enter CSP-H. 1 Cognition to enter feed and bleed Feed and bleed Feed and bleed using charging Cognition to enter CSP-C.1 Feed and bleed using charging in CSP-C.l Depressurization of an S/G to allow service water injection Depressurization of an S/G to allow fire water injection Isolation of fire water diversion flow paths The main operator action HEPs with error factors and dependency levels used for recovery are summarized in Table 2-3. These dependency levels are used between the initial failure mechanism and the recovery mechanism within the human failure event itself. For example, the cognitive error by the crew to enter the feed and bleed part of CSP-H.l may be recovered by the ERF with some level of dependence between the crew and ERF accounted for. A high stress level was used in the quantification of the execution part of all these HEPs.

Table 2-3: Loss of Heatsink Operator Action HEPs I

Description The main operator actions are briefly summarized in the following sub-sections:

18

EPRl Human Reliability Calculator (TM) 2.01 2.2.1 Cognition to enter CSP-H.l Table 2-4: COG CSP H.l

SUMMARY

HFE Scenario Description Initiating event: Loss of Instrument Air Accident sequence: E-0, E-0.1, loss of ARN on CST suction switchover to service water at 1.5 hrs, S/G boil down to 29% at 2.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months , entry into CSP-H.l required Preceding equipment failures: Water Treatment refill of CST unavailable. All AFW pumps failed due to blocked flow restricting orifices in the pump recirculation lines on switchover to Service Water.

Success criterion: Enter CSP-H.l Related Human Interactions:

The following actions are dependent on this HFE:

Hotwell make-up using firewater Locally opening feedwater regulating bypass valve Procedure and step governing HI: Cognitive: CSP - ST.0, Figure 3 Cue: NARROW RANGE LEVEL IN ANY S/G GREATER THAN [51%] 29% (Yes/No) 19

EPRl Human Reliability Calculator (TM) 2.01 2.2.2 Cognition to enter Feed and Bleed Table 2-5: COG-CSP-H.l F&B

SUMMARY

Analysis Results:,

without Recovery with Recovery Pcoq ;"

" J'?

2.1 e-02 1.3e-03 HFE Scenario Description Initiating event: Dual unit loss of offsite power.

Event sequence: E-0, E-0.1, loss of ARN on CST suction switchover to service water at 1.5 hrs, S/G boil down to 29% at 2.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months , entry into CSP-H.l, S/G boil down to 55" at 5 hrs requiring feed and bleed.

Success criterion: Go to step 27 in CSP-H.l Related Human Interactions This HFE is completely dependent on the cognitive HEP for entering CSP-H.l (COG-CSP-H.1)

The following actions are completely dependent on this HFE:

Feed and bleed using SI and PORVs (FEEDANDBLEED-MD)

Feed and bleed using PORVs given that SI is running (FEEDANDBLEED-SI-MD)

Feed and bleed using charging (FB-CHARGING-MD)

SI actuation given charging feed and bleed success (ACTUATE-SI)

Depressurization of an S/G and supply using service water (OP-SG-SUPPLY-SW-MD)

Depressurization of an S/G and supply fire water (OP-SG-SUPPLY-FW-MD)

Isolation of CST given fire water success (OP-SG-SUPPLY-FIRE-IS)

Procedure and step governing HI: Cognitive: CSP-H.l step 2 Cue:

0 Wide range level in both S/Gs -

LESS THAN

[145 INCHES] 55 INCHES OR 0

RCS pressure - GREATER THAN 2335 PSlG DUE TO LOSS OF SECONDARY HEAT SINK 20

EPRl Human Reliability Calculator (TM) 2.01 2.2.3 Feed and bleed Table 2-6: FEEDANDBLEED-MD

SUMMARY

HFE Scenario

Description:

Initiating event: Dual unit loss of offsite power Accident sequence: E-0, E-0.1, loss of AFW on CST suction switchover to service water at 1.5 hrs, S/G boil down to 29% at 2.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months , entry into CSP-H.l. S/G boil down to 55" at 5 hrs Preceding equipment failures:. Water Treatment refill of CST unavailable. All AFW pumps failed due to blocked flow restricting orifices in the pump recirculation lines on switchover to Service Water.

RCPs are stopped.

Related Human Interactions:

Feed and bleed using charging Procedure and step governing HI:

Execution: CSP-H. 7 21

EPRl Human Reliability Calculator (TM) 2.01 2.2.4 Feed and bleed using charging in CSP-H.l Table 2-7: FB-CHARGING-MD

SUMMARY

HFE Scenario

Description:

Initiating event: Dual unit loss of offsite power.

Event sequence: E-0, E-0.1, loss of AFW on CST suction switchover to service water at 1.5 hrs, S/G boil down to 29% at 2.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months , entry into CSP-H.1, S/G boil down to 55" at 5 hrs, normal feed and bleed failure.

Success criterion: Establish feed using charging to pump against the primary safety relief valves as bleed.

Related Human Interactions:

This HFE depends on the cognitive: CSP-H.1 step 2 Feed and bleed using SI and PORVs Performance Shaping Factors:

Relatively long time window from S/G low-low level in both S/Gs at 5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months to core damage at 7.9 hours1.041667e-4 days 0.0025 hours 1.488095e-5 weeks 3.4245e-6 months Feed and bleed initiation can be delayed for an hour after CSP-H.l entry and still be successful. More than an hour is therefore available for recovery.

Procedure and step governing HI: Execution: CSP-H.l steps 40 + 41 22

EPRl Human Reliability Calculator (TM) 2.01 2.2.5 Cognition to enter CSP-C.l Table 2-8: COG-CSP-C.1

SUMMARY

without Recovery with Recovery I

HFE Scenario

Description:

The operators may get into a do loop in CSP-H.1 in the feed and bleed section if SI fails. On RCS high temperature though, the critical function status trees will get them into C.1 where they will be instructed to maximize charging. Although they will also be instructed to blow down the S/Gs to atmospheric when RCS core exit temp > 1200 F, this will be too late to prevent core damage.

Related Human Interactions: Feed and bleed in CSP-H.1 Procedure and step governing HI: CSP-ST.0 Figure 2 Cue: RCS high temperature.

23

EPRl Human Reliability Calculator (TM) 2.01 2.2.6 Feed and bleed using charging in CSP-C.l Table 2-9: FB-CHARGING-CSP-C.1

SUMMARY

HFE Scenario

Description:

The operators may get into a do loop in CSP-H.1 in the feed and bleed section if SI fails. On RCS high temperature though, the critical function status trees will get them into C.l where they will be instructed to maximize charging. Although they will also be instructed to blow down the S/Gs to atmospheric when RCS core exit temp > 1200 F, this will be too late to prevent core damage.

Related Human Interactions:

This HFE completely depends on cognitive success for entering CSP-C.1 Procedure and step governing HI: CSP-(2.1 step 3a 24

EPRl Human Reliability Calculator (TM) 2.01 2.2.7 Supply S/G with service water given instruction Table 2-10: OP-SG-SUPPLY-SW-MD

SUMMARY

HFE Scenario

Description:

IE: Loss of instrument air Initial conditions: PORVs unavailable due to loss of IA. Recovery of nitrogen supply inside containment not credited. AFW failed due to orifice blocking due to switchover of suction to service water on CST 8 feet level per AOP-23. Main feedwater and condensate unavailable due to loss of IA. The operators end up in the feed & bleed section of CSP-H.l. If an RCS bleed path can not be established, the operators are instructed to align any available water source to an S/G and to depressurize the S/G as required.

Success criteria: Verify service water is available - this is a given as service water was used before as a source to AFW. Depressurize an S/G to allow service water to inject Related Human Interactions: Feed and bleed Procedure and step governing HI: CSP-H.l step 38 R.N.O.

Cue:

Service water availability: N Supply Header pressure; PI-2844 on CO1, S Supply Header pressure: PI-2845 on CO1 Injection path to S/G via AFW: AFW valve status indications PZR PORVS - EITHER ONE NOT OPEN 25

EPRl Human Reliability Calculator (TM) 2.01 2.2.8 Supply S/G with service water given no specific instruction Table 2-1 1 : OP-SG-SUPPLY-COG-MD

SUMMARY

HFE Scenario

Description:

IE: TIA Accident sequence: On CST 8 feet level, operators are required to switch AFW suction to service water (SW) per AOP-23. Due to AFW pump recirculation orifice blocking, the AFW pumps fail after switchover to SW.

However, the SW system remains aligned to the AFW suction. Per CSP-H.l step 46, the operators are required to supply the S/Gs with any source of water. With SW already aligned, the S/G can be supplied with service water directly if it is sufficiently depressurized.

Success criterion: Depressurize one S/G to allow SW to inject.

Related Human Interactions:

Switchover to service water on CST 8 feet level Feed and bleed Performance Shaping Factors:

Depressurization of an S/G is part of the fundamental operator skills set.

Procedure and step governing HI: CSP-H.1 step 46 Cue: Align available water source to one S/G

- Any water source 26

EPRl Human Reliability Calculator (TM) 2.01 2.2.9 Supply S/G with fire water given instruction Table 2-12: OP-SG-SUPPLY-FW-MD

SUMMARY

HFE Scenario

Description:

IE: Loss of service water Initial conditions: Loss of IA due to loss of service water. PORVs unavailable due to loss of IA.

Recovery of nitrogen supply inside containment not credited. AFW failed due to orifice blocking due to switchover of suction to.fire water on CST 8 feet level per AOP-23. Main feedwater and condensate unavailable due to loss of IA. The operators end up in the feed & bleed section of CSP-H.l, If an RCS bleed path can not be established, the operators are instructed to align any available water source to an S/G and to depressurize the S/G as required.

Success criteria: Verify fire water is available - this is a given as fire water was used before as a source to AFW. Depressurize an S/G as necessary to inject fire water.

Related Human Interactions:

Feed and bleed Isolation of fire water diversion flow paths Performance Shaping Factors:

High stress due to CSP-H.l Long time window Procedure and step governing HI: CSP-H.1 step 38 R.N.O.

Cue:

Both PORVS are not open.

Fire water availability: Pressure indicators on back panels Injection path to S/G via AFW: AFW valve status indications 27

EPRl Human Reliability Calculator (TM) 2.01 2.2.10 Isolate fire water diversion paths Table 2-13: OP-SG-SUPPLY-FIRE-IS

SUMMARY

HFE Scenario

Description:

IE: Loss of service water Initial conditions: Loss of IA due to loss of service water. PORVs unavailable due to loss of IA.

Recovery of nitrogen supply inside containment not credited. AFW failed due to orifice blocking due to switchover of suction to fire water on CST 8 feet level per AOP-23. Main feedwater and condensate unavailable due to loss of IA. The operators end up in the feed & bleed section of CSP-H.1. If an RCS bleed path can not be established, the operators are instructed to align any available water source to an S/G and to depressurize the S/G as required.

Success criteria: Verify fire water is available - this is a given as fire water was used before as a source to AFW. However, in order to pump through the stationary AFW pumps, the CSTs need to be isolated locally from the AFW suction header. The operators must realize that they are not getting flow into the S/G because of the fire water flow diversion taking place.

Related Human Interactions: OP-SG-SUPPLY-FIRE Procedure and step governing HI: CSP-H.l step 38 R.N.O.

28

NRC-2003-0059, Submittal of Additional Information Concerning Auxiliary Feedwater Orifice Regulatory Conference

Contents

Text

Dear Mr. Dyer:

Attachment:

References:

Attachment:

Attachment:

Attachment:

Attachment:

Attachment:

Attachment:

References:

Reference:

Reference:

5.0 REFERENCES

Reference:

Reference:

Reference:

1.4 REFERENCES

SUMMARY

SUMMARY

SUMMARY

Description:

SUMMARY

Description:

SUMMARY

Description:

SUMMARY

Description:

SUMMARY

Description:

SUMMARY

Description:

SUMMARY

Description:

SUMMARY

Description:

Navigation menu

NRC-2003-0059, Submittal of Additional Information Concerning Auxiliary Feedwater Orifice Regulatory Conference

Text

Dear Mr. Dyer:

Attachment:

References:

Attachment:

Attachment:

Attachment:

Attachment:

Attachment:

Attachment:

References:

Reference:

Reference:

5.0 REFERENCES

Reference:

Reference:

Reference:

1.4 REFERENCES

SUMMARY

SUMMARY

SUMMARY

Description:

SUMMARY

Description:

SUMMARY

Description:

SUMMARY

Description:

SUMMARY

Description:

SUMMARY

Description:

SUMMARY

Description:

SUMMARY

Description:

Navigation menu

Search