ML120100509

Regulatory Conference Supporting Documentation for Apparent Violations EA-11-241 and EA-11-243, Attachment 2. SDP Assessment of Service Water Pump P-7C Coupling Failures, Part 2 of 7 Completed

ML120100509
Person / Time
Site:	Palisades
Issue date:	01/05/2012
From:	Entergy Nuclear Operations
To:	Office of Nuclear Reactor Regulation
Shared Package
ML1200100495	List: ML120100494 ML120100496 ML120100499 ML120100503 ML120100506 ML120100509 ML120100511 ML120100514 ML120100515 ML120100516 ML120100540 ML120100544 ML120100546 ML120100547 ML120100548 ML120100550 ML120100552 ML120100558 ML120100559 ML120100560 ML120100562
References
EA-11-241, EA-11-243, PNP 2012-06 EA-PSA-SDP-P7C-11-06, Rev. 0
Download: ML120100509 (39)

Text

Attachment 2 SDP Assessment of Service Water Pump P-7C Coupling Failures EA-PSA-SDP-P7C -1 1-06, Revision 0 365 Pages Follow

EA-PSA-SDP-P7C -1 1-06 Revision: 0 Date: 12/6/2011 Entffffl( Numberof Pages: 365 (including attachments)

Title:

SDP Assessment of Service Water Pump P-7C Coupling Failures Approval: See signature page.

Purpose This analysis assesses the increase in risk during the period Palisades service water (SW) pumps had line shaft couplings installed which had increased susceptibility to intergrannular stress corrosion cracking (IGSCC). Two coupling failures occurred on service water pump P-7C; one failure on September 28, 2009 and a second on August 9, 2011. On both occasions the couplings that failed were of the same material specification and in an area of the pump exposed to a wet-dry cyclic environment that exacerbated the IGSCC process. Following the second failure, the couplings were replaced with a material more suited to the operating environment.

Conclusion Based on the review of the metallurgical studies, data analysis, and model quantification, the following conclusions were reached:

• The coupling failure events are considered repeated independent failures of a single component. The events occurred too far apart in time to have more than a negligible impact on the common cause failure probability.

- This is based on the application of NUREG/CR-6268, and

- The review of draft "Common-Cause Failure Analysis in Event and Condition Assessment: Guidance and Research" [38], Attachment 11.

Although the failures of interest were treated as independent in this analysis, the fraction of the elevated failure rate due to common cause (i.e. the beta factor for pump failure to run) was assumed to be the same as in the base case model. The beta factor used is viewed to be highly conservative for normally operating pumps as there is very little historical evidence of common cause failures of normally operating components. Due to the conservative treatment of common cause failures in this evaluation, the calculated change in CDF is actually dominated by the initiating event frequency estimation involving common cause failure of the two normally operating pumps. A more realistic assessment that takes credit for the fact that the two pump failures are independent failures would result in a much smaller increase in CDF than what has been estimated in this analysis.

• With respect to the technical specification allowed repair time of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> for a single pump out of service, there would be approximately 20 LCO periods between the P-7C failure on August 9, 2011 and the metallurgical report predicted failure time of the P-7B couplings on October 9, 2011 (if the pump were to remain in continuous operation). This span would significantly reduce the potential for concurrent pump failures within the LCO repair time. No cracking was found in the P-7A pump couplings.

• A conservative time dependant convolution analysis was performed that concludes the failure probability of the P-7A and P-7B pumps during the P-7C allowed outage time was small (Attachment 10). These results demonstrate that the common cause term applied in the initiating event frequency calculation in this analysis is conservative by over an order of magnitude.

Entergy PSA EA-PSA-SDP -P7C-11-06 Rev. 0 v` Entergy Engineering I Analysis Page 2 of 38

• The analysis characterized the risk during the period the shaft couplings were constructed from material that was more susceptible to inter-granular stress corrosion cracking (the degraded state period). It was estimated that the SW pump mean failure rate for failure to run increased by a about a factor of 15 compared to the currently employed failure rate.

• The analysis also characterized the risk impact due to the increase in loss of service water initiating event frequency during the degraded state period. The pump failure contribution to initiating event frequency during this period was estimated to increase by 30%.

• The impact of the service water pump increased independent failure probability on core damage frequency due to flooding, seismic, and fire initiating events was evaluated and was determined to be negligible.

In summary; The observed failures are considered independent and have a negligible impact on the common cause failure probability.

Therefore , based on the random nature of the stressors that contribute to IGSCC , as described in the coupling metallurgical reports , the rate and timing of the failures , and 3 rd party expert analyses; the coupling failures contribution to the common cause failure to run probability and loss of service water initiating event frequency, is also negligible. The increase in core damage frequency, while the 416 stainless steel couplings were installed in the Palisades service water pumps is quantified as <1.OE - 6 (Green).

Note: This engineering analysis is not a 10 CFR 50.2 design basis analysis and the results and conclusions of this analysis do not supersede those of any design basis analyses of record. The biases and degree of conservatism embodied in the methods, inputs and assumptions of this analysis may not be appropriate to support all plant activities.

An appropriate level of engineering rigor commensurate with the safety significance of the topic under consideration is ensured in this analysis by conformance with all applicable Entergy procedures.

Entergy PSA EA-PSA-SDP -P7C-11-06 Rev. 0 Entergy Engineering Analysis Page 3 of 38 Table of Contents 1.0 Purpose ....................................................................................................................................................................... 5 2.0 Background ................................................................................................................................................................ 5 2.1 Service Water Pump P-7C Coupling Failure Events and Metallurgic Analysis ............................... ......................... 5 2.2 P-7A and P-7B Coupling Metallurgic Analysis ............................................................................... .......................... 7 2.3 Affects of Neolube and Heat Treatment on IGSCC ......................................................................... ......................... 7 2.4 Corrective Actions ..................................................................................................................................................... 9 3.0 Data Collection ...........................................................................................................................................................9 3.1 Data Collection Background ............................................................................................................ ......................... 9 3.2 Data Validation ................................................................................................................................ ......................... 9 4.0 Qualitative Risk Characterization .................................................................................................... .......................10 4.1 Stressors of the IGSCC Failure Mode ............................................................................................. ....................... 10 4.2 Qualitative Risk Characterization of SW Pump Failures ................................................................. .......................10 5.0 Quantitative Analysis of Risk Significance .................................................................................... ....................... 12 5.1 Service Water Pump Failure Rate ................................................................................................... ....................... 12 5.2 Service Water Pump Failure Rate During Degraded State Period ................................................. .......................13 5.3 Loss of Service Water Initiating Event Frequency ........................................................................... .......................15 5.4 Impact of Increased SW Pump Failure Rate on PRA Mitigation Functions .................................... ....................... 20 5.5 Service Water Pumps P-7A and P- 7B Failure Rates Following Failure of Pump P-7C .................. ....................... 22 6.0 Input .................................................................................................................................................... ....................... 23 6.1 PRA Tools and Models .................................................................................................................... .......................23 7.0 Assumptions ...................................................................................................................................... ....................... 25 7.1 Major Assumptions .......................................................................................................................... ....................... 25 7.2 Minor Assumptions .......................................................................................................................... ....................... 25 8.0 Methodology ...................................................................................................................................... ....................... 26 8.1 Acceptance Criteria ......................................................................................................................... .......................26 9.0 PRA Model Quantification of Increased Risk ................................................................................. .......................26 9.1 Full Power Internal Events (PSAR2c) .............................................................................................. .......................26 9.2 Internal Flooding .............................................................................................................................. .......................28 9.3 Fire Events ....................................................................................................................................... ...................... 28 9.4 Seismic ............................... .............................................................................................................. ...................... 31 10.0 Results ................................................................................................................................................................... 32 10.1 Full Power Internal Events ......................... ................................................................................... ......................32 10.2 Internal Flooding ........................................................................................................................... ......................33 10.3 Fire ................................................................................................................................................ ...................... 33

Entergy PSA EA-PSA-SDP-P7C-11-06 Rev. 0

'v' Entergy Engineering Analysis Page 4 of 38 10.4 Seismic ................................................................................................................. .......... 33 10.5 Total Change in Core Damage Frequency ................ 33 11.0 Conclusion ............................................................................................................................................................ 34 12.0 References ............................................................................................................................................................36 13.0 List of Attachments .............................................................................................................................................. 38

Entergy PSA EA-PSA-SDP-P7C-11-06 Rev. 0

'-Entergy Engineering Analysis Page 5 of 38 1.0 PURPOSE This analysis assesses the increase in risk during the period Palisades ' service water pump couplings had increased susceptibility to intergrannular stress corrosion cracking (IGSCC ). Two coupling failures occurred on service water pump P-7C; one failure on September 28, 2009 and a second on August 9, 2011. On both occasions the couplings that failed were of the same material specification and in an area of the pump exposed to a wet-dry cyclic environment that exacerbated the IGSCC process.

2.0 BACKGROUND

2.1 Service Water Pump P-7C Coupling Failure Events and Metallurgic Analysis Palisades has three vertical service water pumps (P-7A, P-7B, and P7C) that take suction from the intake basin (Lake Michigan) and supply water to the two critical and one non-critical supply header. The pumps are approximately 40 feet tall, with a two stage impeller at the bottom, and connect to the motor via 6 line shafts and 7 couplings (Figure 2.3-1).

In December 2007, the specification for the shaft couplings for P-7A, P-7B, and P-7C was changed from carbon steel to 416 SS under engineering change (EC) 5000121762 [13]. The new material was selected due to its strength, wear resistance and corrosion resistance. The couplings were also redesigned to increase the diameter by 3/16" and incorporate a 1/8" vent hole in the center of the coupling to aid in disassembly and reinstallation as shown in Figure 2.1-1.

{6" x 45' CRAM ER Fx.Ot+/-, OKat (TYP.) -3.0 f+/-.005) - ^- Ms' x 45' CHAMFER All!

Il ! ' !I^ 3.187 dl' 1 IL 0.120 CI IAMcER -S ,fig' THRU (SEE NOTE 112) 95' tTYP.I HOLE 6YRNT 1 LINE SHAFT COUPLING H T .: aSTM S TYP E 416 STAINL ESS STEEL HARDNESS . M A X. 32 'C . MIN: 28RC ff8 REO ' IJ. RF P!M I Figure 2.1-1

Entergy PSA EA - PSA-SDP -P7C-11 -06 Rev. 0

=' Entergy Engineering Analysis Page 6 of 38 In April and May of 2009, Palisades replaced the carbon steel components of the P-7A and P-7B rotating assemblies with the new material (see Table 2.1-1 for events timeline). The P-7C pump couplings were replaced in June of 2009; on September 29, 2009 the first of two failures occurred. The root cause evaluation for this failure determined the #7 coupling failed due to intergrannular stress corrosion cracking (IGSCC) which resulted from high hardness that was beyond specification [4]. The pump was repaired with couplings that were validated as within the proper hardness specification and placed back in service in October 2009.

In August of 2011, the second failure occurred on P-7C at one of the couplings that was installed in October of 2009 . In this event , the #6 (see Figure 2.3-1) coupling failed this failure was also attributed to IGSCC [12]; however, the hardness of the steel was within specification. Further evaluation by the metallurgists determined that, although the hardness was adequate , the heat treatment applied to the coupling , given the environmental and mechanical stresses to which it was exposed, made it particularly susceptible to IGSCC. It was also determined that couplings #5, #6, and #7 experience intermittent cycles of wet and dry conditions depending on if the pump is in operation. This condition exacerbates the environmental contribution to IGSCC.

Table 2.1-1, Service Water Pump Coupling Replacement and Failure Timeline Projected 416 SS Failure Date Coupling Couplings of 416 SS Pump Coupling replaced with Couplings Notes Installation Failure Date Date 17-4PH SS from Metallurgy Report P-7A The 416 SS couplings did not fail on P-7A and showed no signs of cracking. The metallurgy report concluded the heat treatment applied to the P-7A couplings made them less susceptible to IGSCC. The 4-Apr-2009 N/A

>54 days ,

24-Aug-2011 additional Neolube grease applied to the 17-Oct-2011 coupling's threads may also have been a factor in preventing IGSCC [3]. The projected failure date was based on the assumption cracking had started although none was found.

P-7B The 416 SS couplings did not fail on P-7B.

The metallurgy report indicated that IGSCC was beginning to occur and, at the 40 days ,

12-May-2010 N/A 30-Aug-2011 predicted crack propagation rate, the 9-Oct-2011 coupling would not have failed for 40 days from the date of removal if the pump were in continuous operation [3].

P-7C The evaluation of the first failure stated the couplings failed due to IGSCC. The cause (1s` Failure) 12-Jun-2009 29-Sep-2009 N/A N/A was improper tempering resulting in excessive hardness of the material [3].

Failure occurred approximately 3 months after initial installation.

Entergy PSA EA- PSA-SDP -P7C-11 -06 Rev. 0 te Engineering

^b^ Analysis Page 7 of 38 Table 2.1-1, Service Water Pump Coupling Replacement and Failure Timeline Projected 416 SS Failure Date Coupling Couplings of 416 SS Coupling Pump replaced with Couplings Notes Installation Failure Date 17-4PH SS from Date Metallurgy Report This failure occurred approximately 21 months after installation. Further evaluation of the couplings following the second failure in 2011 concluded that the out of specification hardness was not the root (2"d Failure) 2-Oct-2009 9-Aug-2011 18-Oct-2011 N/A cause. The report completed in October 2011 concluded that both the 2009 and 2011 failures were due to IGSCC exacerbated by improper heat treatment and the wet-dry cyclic environment of the

1. 5 - #7 couplings [12][5].

2.2 P-7A and P-7B Coupling Metallurgic Analysis The 416 stainless steel couplings were also installed in the P-7A and P-7B pumps in April and May of 2009. When the couplings were removed in August 2011, they were sent for metallurgical evaluation.

The report concluded that the P-7A couplings had no visual indication of cracking, and if a flaw had initiated on the day the couplings were removed, it would conservatively have required at least 54 days of pump operation for the flaw to propagate through wall. Cracks were found in the #5, #6, and #7, couplings (exposed to the wet-dry environment) of the P-7B pump. The report stated it would require approximately 40 additional days of pump operation beyond they day they were removed for the cracks to propagate through wall [3].

2.3 Affects of Neolube and Heat Treatment on IGSCC Two differences were noted in the metallurgical reports [3] and [5] between the P-7A pump couplings, which had no indication of cracking, and the P-7B and P-7C couplings which had cracking.

1. The heat treatment, for purposes of tempering the steel, applied to each coupling varied in timing, temperature, and number of heat treatments. The P-7A couplings were single tempered, whereas the P-7B and P-7C couplings were double tempered in order to achieve the appropriate hardness. The temperature range of the heat treatment applied to the P-7B and P-7C couplings made them more susceptible to IGSCC.

2. The P-7A coupling threads had a greater amount Neolube grease applied relative to the couplings examined from pumps P-7B and P-7C. It was postulated that this additional grease may have enhanced the coupling's pitting resistance by protecting the threads from corrosive agents in the operating environment. The lubricant is applied to the shaft threads in accordance with the pump reinstallation work instruction, but the amount of grease to apply is not specified.

Entergy PSA EA-PSA-SDP-P7C 06 Rev. 0

=' Enteigy Engineering Analysis Page 8 of 38 Motor Support Motor Shaft Packing Shaft I Discharge Head Gland Follower low Out Coupling #7 2009 Failure Stuffing Box Stuffing Box Bearing Top Column Packing Shaft Coupling #7 Mounting Bracket Spider #8 Spider #6 Top Column Pipe Line Shaft Bearing Line Shaft #6 Line Shaft Bearing Coupling #6 Sleeve Spider #5 Line Shaft #6 Line Shaft #5 -

Coupling #6 - Middle Column Water Level 0 Spider #4 -- Range .

__w. LL Line Shaft #4 Coupling #6 4 2011 Failure Coupling #4 -

Spider #3 - Spider#5 Middle Column Line Shaft #3 - Pipes Coupling #3 --

Spider #2 -

Line Shaft #5 Line Shaft #2 Middle Column Coupling #2 Spider #1 Line Shaft #1 - - Lower Column Top of Water Pipe Level Range Coupling #1 -

Pump Shaft - Nozzle Transition - Coupling #5 Split Thrust Ring 2nd Stage Impeller --- - Top Pump Bowl - Spider #4 Split Thrust Ring ^^- Bottom Pump 1 . 1- 1 Middle Column 1 st Stage Impeller - Bowl

- Suction Nozzle -°- Line Shaft #4 Flow In Suction Nozzle Bearing Figure 2.3-1

Entergy PSA EA- PSA-SDP -P7C-11-06 Rev. 0 Entejgy Engineering Analysis Page 9 of 38 2.4 Corrective Actions Based on the analyses following the second coupling failure , Palisades decided to suspend the development of an improved 416 SS coupling specification and change the material of the line shaft couplings from 416 SS to 17-4PH SS [4]. The replacements were started in August 2011 and were completed in October 2011. This material is less susceptible to IGSCC.

3.0 DATA COLLECTION 3.1 Data Collection Background Data for Service Water pump start demands and run-time was obtained from the PI data archive. PI is a classified category "C" (important to business) system in accordance with Entergy procedure EN-IT-104

[17]. The PPC is its source of data which is a SQA category "B" system (regulatory commitments). Most PPC points are calibrated via technical specification surveillance procedure or by preventive maintenance and controlled calibration sheets.

Part of the PI server system runs on the plant process computer (PPC). This portion monitors selected points every second to test against the exception threshold change value. If the change value is exceeded , the data is passed to the PI server and recorded . The PI server also compares the new value against previous values to see if it still fits on a line within the compression limit. If yes, the data is discarded , otherwise it is added to the archive . For pump starts, the compression limit is simply a change in state ( on-off or start-stopped ), if 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> have passed without an archive update, one is made regardless . PI will generally provide accurate long term values and greater amounts of data when events are changing rapidly.

For this analysis, PI server tags YSP7A_D (Service Water Pump P-7A), YSP7B _D (Service Water Pump P-7B), and YSP7C_D (Service Water Pump P-7C) were used to extract sampled data from the PI archive for the period in which each of the pumps were operating with the replacement 416 stainless steel line shaft couplings ( date ranges as shown in Table 2.1-1).

The data was imported into, Microsoft ExcelT M 2007, using the PI DataLink add-on module. A visual basic macro was developed to count the pump starts and stops and sum the accumulated run time. The macro processed each data point in chronological order to find when the pump state changed from "Stopped " to "Started ". When a change in state was found , a pump start (demand ) was recorded as well as the date/time stamp and the cell shaded yellow . The macro then determined when the pump state was changed from " Started " to "Stopped ", calculated the run time for the demand and shaded the cell light blue. If the calculated run time was less than one minute, the data was assumed erroneous , and the demand as well as the run -time was not counted ; in these cases the cell color was changed from light blue to green . Discarded erroneous runs were typically seconds in duration . This assumption is somewhat conservative as the pumps may have been bumped for rotation checks or strainer basket clearing. The macro input data and a portion of the detailed result of the PI data collection are provided in Attachment 2.

The compiled run-hours data is provided in Table 4.1-1 3.2 Data Validation As validation of the final accumulated data, a portion of the results were reviewed against System Engineering records (Maintenance Rule Availability Database). It was noted that several additional start demands were recorded in the PI archive data, but this is expected as the PI server records a start each time a pump is bumped for testing or maintenance; whereas the system engineer manually logs several post maintenance test motor bumps into a single record for a pump run. Other than the increased number of pump demands, there was excellent agreement between the macro derived data and the manually recorded data.

Entergy PSA EA- PSA-SDP - P7C-11-06 Rev. 0

'v Entergy Engineering Analysis Page 10 of 38 4.0 QUALITATIVE RISK CHARACTERIZATION To evaluate the impact of the events on component independent failure probability, common cause probability, and initiating event frequency, an independent analysis was performed [22] and is enclosed as Attachment 1.

4.1 Stressors of the IGSCC Failure Mode The time to failure of a given material due to stress corrosion cracking in a given environment is dependent on the applied tensile stress as described in Section 4.4 of the October 2011 metallurgy report

[5]. The report states that the time of crack initiation is:

"...highly alloy-environment and applied stress dependant and thus is an unknown without specific test data. The initiation time is also highly dependent upon pre-existing flaws that may have been introduced during heat treatment or thread fabrication. Therefore, predicting initiation time is difficult. Unless there are preexisting flaws, a distribution of 80% initiation and 20%

propagation is considered reasonable for the life of a component subject to SCC process..."

This statement implies that the time to failure due to IGSCC is a function of multiple stressors that each provides an unknown or random contribution to the crack propagation rate. Evidence of the variability in each of the couplings geometry and material properties is shown in Tables 3 3-8 of the metallurgical report. Variability of the hardening and tempering heat traces is shown in Figures 4-1 and 4-2 of the report [5] (the report is enclosed as Attachment 8).

In addition to differences in the couplings physical properties, the tensile stress applied to each coupling varied due to differences in run time from pump to pump as shown in Table 4.1-1.

Table 4 . 1-1, Service Water Pump Run Time and Number of Failures Run Time With 416 SS Pump Number of Run Failures Couplings P-7A 14,999 0 P-7B 8,909 0 P-7C 17,521 2 TOTAL 41,429 2 4.2 Qualitative Risk Characterization of SW Pump Failures A review of NUREG/CR-6268, "Common-Cause Failure Database and Analysis System: Event Data Collection, Classification, and Coding" [21] was performed to evaluate the potential impact on common cause probability based on the following facts:

• Between the times the carbon steel couplings were replaced by 416 Stainless steel, and when they were replaced with 17-4PH SS, the SW pumps were in a degraded state that could potentially increase the likelihood of service water pump failure. This in turn could increase the likelihood of pump failures contributing to a loss of service water initiating event and loss of SW mitigation functions following other initiating events.

• The pumps ran for a combined 41,429 hours0.00497 days <br />0.119 hours <br />7.093254e-4 weeks <br />1.632345e-4 months <br /> with the 416 SS couplings installed, and over this time 2 failures occurred.

• Both failures occurred on one pump as opposed to failures on a redundant pair of pumps.

• The root causes of IGSCC are due to conditions that are random within each component and do not exhibit correlation of the factors between components. While the mechanisms for causing IGSCC may be similar, the specific conditions that give rise to IGSCC are unique to each

Entergy PSA EA-PSA-SDP -P7C-11 -06 Rev. 0

' Entery Engineering Analysis Page 11 of 38 component making them unlikely to be correlated.

• The coupling failures were nearly two years apart (September 29, 2009 and August 9, 2011).

• Following both failures, the plant remained at full power and the pumps were returned to service within the 72-hour limiting condition for operation The criteria, stated in Section 5.1.7.1 of NUREG/CR-6268 for the timing classification of announced common cause failures is stated as follows:

`For announced failures, the timing factor is based on a time-based model. Thus, the timing factor is assigned values based upon a PRA mission time (the period of time the component is usually required to perform its function in a PRA or individual plant examination [IPE], usually 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />).

The following classifications may be used for two consecutive degradations of two components contained in a CCF event:

High (1.0): The component events are separated by no more than the PRA mission time.

Medium (0.5): The component events did not occur within the PRA mission time and two times the PRA mission time.

Low (0.1): The component events are separated by more than two times the PRA mission time and less than three times the PRA mission time.

Not CCF: More than three times the PRA mission time or during the interval between the component events, the component (which was detected, failed, or degraded later) has undergone maintenance, overhaul, or other action that can be regarded as a renewal event for the failure mechanisms. (Note: In this case, the event is not classified as a CCF event.)

Using these criteria, the coupling failure events occurred too far apart in time to be considered common cause failures. With respect to the technical specification allowed repair time of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> for a single pump out of service, there would be approximately 20 LCO periods between the P-7C failure on August 9, 2011 and the metallurgical report predicted failure time of the P-7B couplings on October 9, 2011 (if the pump were to remain in continuous operation). This span would preclude the potential for concurrent pump failures within the LCO repair time. (A quantitative evaluation of the failure probability of the P-7A and P-7B pumps during the allowed outage time, based on crack propagation rate, is provided in Section 5.5. and Attachment 10)

In addition, due to the random aspects of the IGSCC failure mode, it would be very unlikely that the coupling failures would have more than a negligible impact on common cause failure probability;

1. Refer to Attachment 1,

2. Refer to Attachment 10, time-dependent convolution analysis, and

3. Refer to Attachment 11, comments on the draft "Common-Cause Failure Analysis in Event and Condition Assessment: Guidance and Research", ML111890290.

Irrespective of the common cause failure assessment, consideration still must be given to an increase in loss of service water initiating event frequency and an increase of the failure to run basic event probability; which is evaluated in the following sections.

Entergy PSA EA-PSA-SDP -P7C-11-06 Rev. 0 v` Enteigy Engineering Analysis Page 12 of 38 5.0 QUANTITATIVE ANALYSIS OF RISK SIGNIFICANCE This section presents the quantification of the service water pump failure-to-run probability, and loss of service water initiating event frequency, during the degraded state period when the pumps were equipped with couplings which had an increased susceptibility to IGSCC. In addition, the results of a time dependant convolution analysis of the failure probability of the P-7A and P-7B during the P-7C allowed outage time is presented.

The data analysis presented in Sections 5 5.4 [22], is repeated in its entirety, in Attachment 1. The detailed convolution analysis, summarized in Section 5.5, is provided in Attachment 10.

5.1 Service Water Pump Failure Rate 5.1.1 Failure Rate Prior to Installation of 416SS Pump Shaft Couplings The PRA analysis-of-record is based on plant specific operating experience and service data for the SW pumps from 1994 through 1998. During this period, there were no pump failures to run in 68,571 hours0.00661 days <br />0.159 hours <br />9.441138e-4 weeks <br />2.172655e-4 months <br /> of pump operation [23] and [24].

The uncertainty distribution for the SW pump failure to run failure rate, based on this PRA analysis-of-record, was developed using generic parameter references from PLG-0500 [15] as a prior and then updated using the above listed run time with zero failures. Details of this update are in Table 5.1.1-1.

Table 5.1.1-1 Parameters for Analysis-of-record [2] SW Pump Failure Rate Update Based On Prior from PLG-0500 (Case 1)

Parameter Prior Distribution from [15] Posterior Distribution Data Collection Period - 1994 through 1998 Number of Failures - 0 Pump-hours of Operation - 68,571 Distribution Type Lognormal Non-Parametric fit to lognormal Mean 3.42E-5 1.23E-5 RF = SQRT(95%tile/50%tile) 5.0 3.4 5%tile 4.24E-6 2.62E-6 50%tile 2.12E-5 9.82E-6 95%tile 1.06E-4 3.03E-5 The most recent update of the Palisades PRA Data Notebook [28] was completed in 2009 prior to the occurrence of the SW pump failures in question. The update covers the period of January 1, 2005 to January 23, 2008 [Note: Palisades has not yet issued this data as the analysis of record]. During this period there were no SW pump failures to run and the run times associated with each of the SW pumps is indicated in the following table:

Table 5.1.1-2 SW Pump Run Data 1-1-05 Through 1-23-2008 Component Pump Run Failures Run Time (hours)

SW Pump P-7A 0 18,658 SW Pump P-7B 0 17,640 SW Pump P-7C 0 19,490 Total 0 55,788 The uncertainty distribution for the SW pump failure to run in this more recent update was developed using generic parameter estimates from NUREG/CR-6928 [21] as a prior and Bayes' updated with the

Entergy PSA EA-PSA-SDP -P7C-11-06 Rev. 0 te Engineering

^bl Analysis Page 13 of 38 service data in Table 5.1.1-2. Since the generic distribution is a Gamma Distribution and a Poisson likelihood function was used, the posterior distribution is also a Gamma Distribution. The parameters of the prior and updated Gamma distributions for the SW pump failure rate are shown in Table 5.1.1-3.

Table 5.1.1-3 Parameters for Recent PRA SW Pump Failure Rate Update Based On Prior from NUREG/CR-6928 (Case 2)

Parameter Prior Distribution from [20] Posterior Distribution Data Collection Period - 1-1-05 through 1-23-08 Number of Failures - 0 Pump-hours of Operation - 55,788 Distribution Type Gamma Gamma Alpha Parameter 1.66 1.66 Beta Parameter 3.65E+05 4.20E+05 Mean 4.54E-06/hr. 3.95E-06/hr.

RF (=95%tile/50%tile) 3.30 4.9 Each of the plant specific data updates described above covers a rather limited amount of operating experience. To examine a more complete record of the service experience with the SW pumps prior to the installation of the 416 SS pump shaft couplings , a special case was defined to reflect all the experience back to 1980 covering more than 28 years of experience , which again had zero failures in about 490,000 pump hours of operation. The parameters of this update are presented in Table 5 .1.1-4.

Because much of this time period pre-dates EPIX and the maintenance rule, the prior used here reverts back to PLG- 0500 rather than NUREG /CR-6928 because this reference better represents industry generic data over this longer and earlier time period.

In Section 5 . 2 all three cases of failure rate estimates are used to evaluate the change in risk during the degraded state period.

Table 5.1.1-4 Parameters for More Complete SW Pump Failure Rate Update Based on Prior from PLG-0500 (Case 3)

Data Collection Period - 1980 through 4-3-2009 Number of Failures - 0 Pump-hours of Operation - 495,360 Distribution Type Lognormal Non-Parametric fit to lognormal Mean 3.42E-5 3.91 E-6 RF = SQRT(95%tile/50%tile) 5.0 2.7 5%tile 4.24E-6 1.17E-6 50%tile 2.12E-5 3.43E-6 95%tile 1.06E-4 8.31 E-6 5.2 Service Water Pump Failure Rate During Degraded State Period The degraded state period is defined for the purposes of this analysis as the time frame when the SW pumps were operating with 416 SS couplings installed. The 416 SS couplings were installed on the first component on April 4, 2009 (P-7A) and were replaced on the last component in October 2011 (P-7C).

During this period there were two pump failures to run, both on Pump P-7C, and 41,429 pump hours of operation (see Table 4.1-1). Obviously, during the degraded state period, the conditions were substantially different than was the case prior to or following this period. The failure rate distribution for the degraded state period was developed based on the following considerations.

The evidence used to develop the current PRA failure rate distribution, including the generic prior

Entffgy Entergy PSA Engineering EA-PSA-SDP-P7C 06 T Rev. 0 Analysis Page 14 of 38 evidence from NUREG/CR-6928 and the Palisades service data prior to the installation of the 416 SS couplings has questionable relevance to estimating the failure rate during the degraded state period and hence is not used.

There is a large degree of uncertainty in establishing an appropriate prior distribution and therefore a non-informative prior distribution is selected. Keeping with the Gamma distribution family of distributions, the Jeffrey's non-informative prior distribution is used. This is characterized by an alpha parameter of 0.5 and a beta parameter of 0 [25]. This is updated using 2 failures in 41,429 pump-hours of operation to produce the parameters of the degraded state SW pump failure rate as shown in the following table.

Table 5.2-1, Degraded State SW Pump Failure Rate Distribution Parameter Posterior Distribution Distribution Type Gamma Prior Basis Jeffrey's Non-informative Prior ( a=0.5, (3=0)

Alpha Parameter 2.5 Beta Parameter 41,429 Maximum Likelihood Estimation 4.82E-5/hr Mean 6.10E-5/hr 5%tile 1.40E-5/hr 50%tile 5.30E-5/hr 95%tile 1.35E-5/hr A comparison of the Base Case 1, 2, and 3 and Degraded State failure rate parameters is provided in Table 5.2-2 and Figure 5.2-1. Case 3 is viewed as the most realistic model of the SW pump performance prior to the degraded state period as it uses a more complete representation of the service experience. It can be seen from these comparisons that the failure rate during the degraded period is significantly higher than that used in the Base Case PRA model for each of the three analyzed cases. The mean failure rate increases by a factor of more than 5, 15, and 15 compared to the Base Cases 1, 2, and 3, respectively. In addition, the conservative approach taken to throw out the generic industry evidence and the prior Palisades experience in establishing the prior during the degraded state period is seen to have a large impact in the sense that the updated mean is actually greater than the maximum likelihood estimate of the service data during the degraded operation period. This is regarded as a conservative evaluation of the increased SW pump failure rate during the degraded state period.

Table 5.2-2, Comparison of Base Case and Degraded State Failure Rate Parameters Palisades Palisades PRA Base Palisades PRA Base Palisades PRA Base Parameter Degraded State Case 1 Case 2 Case 3 Case Non-Parametric fit to Non-Parametric fit to Distribution Type Gamma Gamma lognormal lognormal Mean 1.23E-5 3.95E-6 3.91 E-6/hr 6.10E-5/hr 5%tile 2.62E-6 5.44E-7 1.17E-6/hr 1.40E-5/hr 50%tile 9.82E-6 3.19E-6 3.43E-6/hr 5.30E-5/hr 95%tile 3.03E-5 9.96E-6 8.31 E-6/hr 1.35E-5/hr

Entergy PSA EA-PSA-SDP -P7C-11-06 Rev. 0

=' Enteigy Engineering Analysis Page 15 of 38 Figure 5.2-1, Comparison of SW Pump Failure Rate Estimates 5.3 Loss of Service Water Initiating Event Frequency The current Palisades PRA model uses a single point data value, which accounts for loss of service water due to all causes, to model the loss of service water initiating event frequency. This is reasonable for the baseline PRA model but it does not lend itself to evaluating the impact of the increased failure rate of the pumps. Hence to support this evaluation, a model of the contributions to the loss of SW initiating event frequency due to SW pump failures is developed. The SW pump induced loss of SW model is developed based on the following considerations.

A SW pump induced loss of service water can be caused by failure of the two normally running pumps and failure or unavailability of the standby pump.

Failure of the two normally running pumps can occur as a result of a common cause failure of both pumps, or failure of one of the pumps followed by failure of the other running pump during the time frame when the first pump is down for repairs.

The standby pump can fail to start, fail to continue running while both of the normally operating pumps are down for repairs, or be unavailable for maintenance.

These considerations yield the following simple model for SW pump induced loss of SW F(LOSWS) = 8766 a ,L OSWWSIE A [5.1]

2LOSWIE 2CCFR (AS + 2FRZCCF + `GMSP) + 22IFR (AFRZIF)(As +AFRI-IF + QMSP) [5.2]

Entergy PSA EA-PSA-SDP-P7C-11 -06 Rev. 0 Ente^gy Engineering Analysis Page 16 of 38 Where:

F(LOSWS) = Frequency per reactor- calendar-year of loss of service water ALOSWSIE = Frequency per operating hour of loss of service water AQ = Plant availability 2CCFR = /3FR 2FR Failure rate for common cause failures of the two normally running pumps As = Failure rate for failure of the standby pump to start on demand I8FR = Common cause beta factor for failure to run of two normally operating pumps 2FR = Failure rate for failure of the standby or operating pump to run 2IFR = (1 - lFR )2FR Failure rate for independent failure to run for each normally running pump ZCCF = Mean time to repair of at least one pump after a common cause failure to run ZIF = Mean time to repair of a normally operating pump after an independent failure to run Maintenance unavailability of a Standby pump while plant in operation (Due to technical specification requirements , maintenance that is performed with the plant at power is QMSP = performed on each pump separately . Therefore , this is the total maintenance unavailability of all three pumps.)

The change in CDF due to changes in the pipe induced loss of SW initiating event frequency can then be estimated using:

ACDF,^Loswrc = (F(LOSWos) - F(LOSWBas^ ))CCDPLOSW

[5.3]

Where:

ACDF,JLOSWJE = Change in CDF due to Change in Pump Induced Loss of SW frequency Loss of SW initiating event frequency evaluated with AFR evaluated using degraded state F(LOSWDs ) =

version of the SW pump failure rate Loss of SW initiating event frequency evaluated with A FR evaluated using Base Case F(LOSWBuse ) =

version of the SW pump failure rate CCDPLOSW = Conditional core damage probability given loss of SW initiating event The data parameters needed to quantify Equation [5.3] include the different versions of the failure rates defined earlier and other parameters from the Palisades PRA and these are summarized in Table [5.3-1].

The models in Equations 5.1 through 5.3 were quantified using Microsoft Crystal BalITM and Excel 2010 software using 100,000 Monte Carlo samples. The results are shown in Tables 5.3-2, 5.3-3, 5.4-1 and Figures 5.3-1, 5.3-2, and 5.3-3.

Entergy PSA EA-PSA-SDP-P7C 06 Rev. 0 OR

=` Entergy Engineering i Analysis Page 17 of 38 Table 5.3-1, Data Parameters Used to Evaluate LOSW IE Frequency Parameter Mean Value Uncertainty Treatment Reference NRC Performance Indicator A = . 92 None , very little uncertainty Data Lognormal Distribution with aS = 1.19E - 3 PLG-0500 [15]

mean = 1.19E-3 ; RF = 4.0 Beta Distribution with a = 16 . 5 N/^ FR = . 0243 Palisades CCF Analysis [28]

and (3=661.5 Gamma Distribution with a = 2.5 FR-DS = 6.1E-05 / hr and (3 = 41,429 Table 5 . 2-1 Lognormal Distribution with 1.23E-5/ hr, Case 1 Table 5 . 1 . 1-1 mean = 1.23E-5 and RF=3.4 Gamma Distribution with a=1.66 3.95E - 6/hr, Case 2 Table 5 . 1 . 1-3 and (3 = 4.2E+05 2FR-Buse Table 5.1.1-4, , this estimate Lognormal Distribution with best represents the SW pump 3.91 E-6/hr, Case 3 mean = 3.91 E - 6 and RF = 2.7 performance prior to installation of 416SS couplings Technical specifications limit TCCF = 6hr None operation to 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> 72hr Technical specifications limit zIF = None operation to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> P-7A = 4. 516E-03 QMSP = P- 7B = 5.387E-03 Lognormal Distribution with Maintenance Unavailability P-7C = 5. 533E-03 mean = 1.55E-2 RF=10 . 0 Analysis [29]

For Base PRA Total=1.55E-02 P-7A =117.2 hrs P-7B=107 . 1 hrs QMSP Lognormal Distribution with Maintenance Rule Unavailability P-7C=256 . 6 hrs mean =1.57E-02 Database; very little uncertainty For Degraded State justifies small range factor Total = 480 . 9 hrs over RF=1 . 5 Period 2 . 5 year degraded state period Uncertainty not included ; not CCDP Given LOSW= 2 .68E-3 Reference [2]

affected by change Uncertainty not included ; not LOSW per PRA = 1.22E-3/yr Reference [11]

affected by change

Entergy PSA EA-PSA-SDP-P7C-11-06 Rev. 0 Entergy Engineering Analysis Page 18 of 38 100000 Trials Frequency View 96,230 Displayed Pump Related LOSW !E Frequency Base Case 3 0 . 14 14,000 0 . 12 12,000 0.10 ---- - - ----- 10 , 000 m

0. 08 $ -

oL

° c^

a- 0.06 6 1 000 95`a = 4. 39E-05 0.04 0.02 2.000 0.00E-00 1.03E-fly 2.00E-05 3.OOE-05 4.ODE-05 5.OOE-05 6,0()E-05 Events per Reactor-Calendar-Year Infinity Certainty : 100.000 a Infinity Figure 5.3-1, LOSW Initiating Event Frequency for Base Case 3 106,000 Trials Frequency View 98,380 Displayed Pump Related LOSW 1E Frequency Degraded State 0 . 07 -- ---_---- - ( - 7,000 0.05- 5 o 004 - 4,000 3 121-0 . 03 3,000 5f =9.99E-04

0. y2 Mean = 3.48E-04 2 , 000 a=6.42E-05

() .0 1 - 1,000 I

0.0* 0 0.06E+60 2.00E-04 4.00E-04 S.OOE-04 8.00E-04 1.06E-03 1.20E-03 1.40E-03 1.66E-03 Events per Reactor-Calendar-Year

-Infinity Certainty: 100.000 Infinity Figure 5 .3-2, LOSW Initiating Event Frequency for Degraded State

Entergy PSA EA- PSA-SDP -P7C 06 Rev. 0 Entegy Engineering Analysis Page 19 of 38 100,000 Trials Frequency View 98,062 Displayed Change in FOSW JE Frequency per Base Case 3 (7.08 0.08 -1 9 , 000 0 . 07 - -- 7,000 0 .06 - 6.000 71 71 0 . 05 -- ° 5.000 M

22 0.04 -` 4,000 M 3,

0 . 03 0.02 Mean = 3.35E-04 2 , 000 5.02E-05 0 . 01 1,000 0.0* o 0.06E+00 2.OOE-04 4.OOE-04 6.OOE-04 3.00E'-04 1.OOE-03 1.20E-03 1.40E-03 1.60E-03 Events per Reactor-Calendar-Year

-Infra ty Certainty: 106.E fa © infinity Figure 5 .3-3, Uncertainty in Change in LOSW IE Frequency per Base Case 3 In Table 5.3-2 the major contributors to loss of SW initiating event frequency are compared between the Base Case 3 and the degraded state period based on mean point estimates of the listed quantities. The results are seen to be dominated by common cause failure to run of the two normally operating pumps with the standby pump in maintenance. This stems in part from the conservative assumption that the fraction of operating pump common cause failures (beta factor) is assumed to be the same as that assessed in the base PRA model for SW failures in the mitigation of other initiating events. There are two reasons why this is conservative. One is that the increase in the failure rate during the degraded period is due to two independent failures so keeping the ratio of common cause failures to the total failure rate is conservative. The second is that the applied beta factor was developed for the SW system in the mitigation mode and there is substantial evidence to support the hypothesis that the fraction of common cause failures in normally operating systems is much smaller than that for systems that need to operate on demand.

The probability of failure the P-7A and P-7B pumps during the allowed outage time of P-7C was conservatively quantified using a time dependant convolution analysis as described in Section 5.5. The result of this analysis (see page 5 of Attachment 10) was a probability of 2.65E-05 over the 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> period, or a rate of 3.68E-07/hr. The common cause failure rate used in the initiating event frequency calculation presented above (equation 5.2 term ACCFR) for the degraded state is RFRAFR = .0243

• 6.1 E-05/hr = 1.482E-06/hr. Therefore, the common cause term applied in initiating event frequency calculation is conservative by over an order of magnitude.

Entergy PSA EA- PSA-SDP -P7C-11-06 Rev. 0 Enter V Engineering Analysis Page 20 of 38 Table 5.3-2, Major Contributors to LOSW IE Frequency (Point Estimate)

Events per Operating hour Events per Reactor-Calendar Year Contributin g Outsets Case 3 Degraded Case 3 Degraded CCF-FR*QMSP 1.47E-09 3.12E-08 1.18E-05 2.51 E-04 2xIFR*IFR*QMSPI'l 3.24E-1 1 1.06E-08 2.61 E-07 8.57E-05 CCF-FR*SFS 1.13E-10 1.75E-09 9.12E-07 1.41 E-05 CCF-FR`SFR 2.23E-12 5.32E-10 1.80E-08 4.29E-06 2xIFR*IFR*SFSE 2.49E-12 5.95E-10 2.01 E-08 4.80E-06 2xIFR*I FR*SFRW 5.90E-13 2.17E-09 4.76E-09 1.75E-05 Total 1.62E-09 4.68E-08 1.31 E-05 3.78E-04 CCF-FR = Common cause failure of both operating pumps IFR = Independent failure to run of an operating pump SFS= Standby pump failure to start SFR=Standby pump failure to run until operating pump failure restored QMSP= Fraction of time plant operates with Standby SW pump in maintenance Note [1]: Combination of two identical cutsets Table 5.3-3 shows the contributors to the LOSW initiating event frequency with the SW system in different alignments. One alignment, which occurs a fraction of the time equal to QMSP is with two operating pumps and the third in maintenance, and the other alignment has the third pump available. It is seen from this table that the pump induced LOSW IE frequency increases by almost a factor of 30 as the system alignment changes from the standby pump being in service to out of service.

Table 5.3-3, Major Contributors to LOSW IE Frequency with SW System in Different Alignments (Point Estimate)

Events per Operating hour Events per Reactor-Calendar Year Contributin g Out se t s Case 3 Degraded Case 3 Degraded Results in Alignment with Standby Pump in Maintenance which occurs QMSP fraction of the time CCF-FR 9.50E-08 1.47E-06 7.66E-04 1.18E-02 2xlFR*IFR"l 2.10E-09 5.00E-07 1.69E-05 4.03E-03 Total 9.71 E-08 1.97E-06 7.83E-04 1.59E-02 Results in Alignment with Standby Pump Available which occurs (1-QMSP) fraction of the time CCF-FR*SFS 1.13E-10 1.75E-09 9.12E-07 1.41 E-05 CCF-FR*SFR 2.23E-12 5.32E-10 1.80E-08 4.29E-06 2xIFR*IFR*SFSI" 2.49E-12 5.95E-10 2.01 E-08 4.80E-06 2xlFR*I FR*SFW1 5.90E-13 2.17E-09 4.76E-09 1.75E-05 Total 1.18E-10 5.05E-09 9.55E-07 4.07E-05 CCF-FR = Common cause failure of both operating pumps IFR = Independent failure to run of an operating pump SFS= Standby pump failure to start SFR=Standby pump failure to run until operating pump failure restored Note 1. Combination of two identical cutsets 5.4 Impact of Increased SW Pump Failure Rate on PRA Mitigation Functions The other source of potential risk impacts comes from increased SW pump failure rates in the mitigation functions for initiating events other than loss of SW. This is best evaluated by revising the PRA model

Entergy PSA EA-PSA-SDP-P7C-11 -06 Rev. 0 MEntejgy Engineering Analysis Page 21 of 38 with the revised failure rate and then comparing the results. However an estimate of the risk impact from such changes can be estimated using the Fussell-Vesely importance metric for basic events involving SW pump failure to run (9.09E-06). Since the F-V importance is approximately equal to the fraction of the CDF with basic events involving SW pump failure, the change in CDF can be estimated using the following equations:

4CDFSWP = (CDFNcw - CDFold ) = FVSWP CDFBASE 'MFR-DS - FV SWP CDFBase FR -Base

[5.4]

^FR-DS

= FVSWPCDFBase -1 FR-Base Using the data above for the Fussell-Vesely value, the data developed previously for the failure rates, and a baseline CDF value of 2.83x10-5, the change in CDF due to changes in the PRA mitigation model from increased SW failure rates is estimated to be an increase of 3.7x10-9 per reactor calendar year using the Case 3 failure rate model, which is about 0.1% of the current baseline CDF. Hence there is no significant risk increase from the mitigation side of the model.

In Table 5.4-1 the results of the quantitative uncertainty analysis are presented for various cases and metrics. The change in LOSW initiating event frequency from the base case to the degraded state period is seen to be an increase of less than about 30% and does not vary appreciably among Cases 1, 2, and

3. Using these results and the CCDP values from Table 5.2-1, it is seen that the increase in CDF due to changes in the SW pump failure rate in the LOSW initiating event frequency is less than 3% based on the mean change in LOSW IE frequency, and only as high as 94% when the 95%tile values for the change in LOSW IE frequency is assumed. The mean change in CDF is seen to be less than 10-6 per reactor-year.

The Base Case 3 results provide the largest increase and the most accurate reflection of the SW pump performance prior to the degraded period. However, it is seen from Table 5.4-1 that the overall results are not particularly sensitive to which version of the Base Case results are used.

Table 5.4-1, Evaluation of LOSW Initiating Event Models and CDF Impacts Parameter [41 Point Estimatel'l Mean

[21 5%tile 50%tile 95%tile RF[31 Pump Related LOSW IE Freq. Case 1 4.32E-05 4.56E-05 1.67E-06 1.44E-05 1.70E-04 10.1 Pump Related LOSW IE Freq. Case 2 1.32E-05 1.37E-05 5.66E-07 4.56E-06 5.03E-05 9.4 Pump Related LOSW IE Freq. Case 3 1.31E-05 1.31E-05 6.39E-07 4.66E-06 4.89E-05 8.8 Pump Related LOSW IE Freq. - Degraded 3.78E-04 3.48E-04 6.42E-05 2.27E-04 9.99E-04 3.9 Change in LOSW IE Freq. Case 1 3.35E-04 3.02E-04 4.18E-06 1.94E-04 9.63E-04 15.2 Change in LOSW IE Freq. Case 2 3.65E-04 3.34E-04 4.99E-05 2.15E-04 9.87E-04 4.4 Change in LOSW IE Freq. Case 3 3.65E-04 3.35E-04 5.02E-05 2.15E-04 9.88E-04 4.4 Change in LOSW IE Freq. Case 1 % 27.4% 24.8% 0.3% 15.9% 78.9% 15.2 Change in LOSW IE Freq. Case 2 % 29.9% 27.4% 4.1% 17.6% 80.9% 4.4 Change in LOSW IE Freq. Case 3 % 29.9% 27.4% 4.1% 17.7% 81.0% 4.4 Change in CDF Case 1 8.97E-07 8.11 E-07 1.12E-08 5.21 E-07 2.58E-06 15.2 Change in CDF Case 2 9.78E-07 8.96E-07 1.34E-07 5.76E-07 2.65E-06 4.4 Change in CDF Case 3 9.78E-07 8.98E-07 1.35E-07 5.78E-07 2.65E-06 4.4 Change in CDF Case 1 (%) 3.2% 2.9% 0.0% 1.8% 9.1% 15.2

Entergy PSA EA-PSA-SDP-P7C 06 Rev. 0

=' Entey Engineering Analysis Page 22 of 38 Table 5.4-1, Evaluation of LOSW Initiating Event Models and CDF Impacts Parameter[4 Point Estimates'] Mean 12] 5%tile 50%tile 95%tile RF[31 Change in CDF Case 2 (%) 3.5% 3.2% 0.5% 2.0% 9.3% 4.4 Change in CDF Case 3 (%) 3.5% 3.2% 0.5% 2.0% 9.4% 4.4 Notes:

[1] Point estimate based on mean values of input parameters

[2] Mean and Percentiles calculated via Monte Carlo on Crystal Ball with 100,000 trials

[3] RF = SQRT(95%tile/5%tile)

[4] Change in CDF results do not include the uncertainty in the CCDP given loss of service water 5.5 Service Water Pumps P-7A and P-7B Failure Rates Following Failure of Pump P-7C The analysis summarized here provides additional perspective on the concurrent failure probability of pumps P-7A and P-7B within the allowed LCO time following failure of P-7C using a time dependant convolution analysis based on the crack growth rate from the metallurgical report [3]. The complete evaluation is provided in Attachment 10.

Using the as-found condition of the P-7A and P-7B pump couplings and conservative assumptions about the crack growth rate (based on the shortest time to failure of the P-7C pump), an estimate of the remaining life for these couplings was provided by the LPI report [3]. From that information, a distribution for the failure to run rate was produced by fitting a generalized gamma distribution to that data. A convolution of the resulting failure rate curves produced a curve representing the probability of failure of both the P-7A and P-7B couplings as a function of time after the couplings were initially installed.

Comparing the probability at the time of P-7C failure and the probability three days later (based on the TS allowed outage time) demonstrates that the likelihood of a total loss of service water during that interval was small (2.65E-05). The figure below is a combination of the degraded failure rates based on as-found conditions along with the convolution curve for those failure rates. It also includes the "delta" curve which shows the difference between the convolution curve value at the time of P-7C failure and the convolution curve at various times after P-7C failure. This evaluation indicates that the likelihood of total loss of service water following failure of the P-7C pump was low for a considerable period of time following the failure of the P-7C pump even with degraded failure rates in the remaining pump couplings.

Entergy PSA EA-PSA-SDP-P7C-11 -06 Rev. 0 Y` EnteW Engineering Analysis Page 23 of 38 i.E+00 2.E-01

--0 Generalized Gamma for w

4R Pump 7A 0

a^.

1 _F-i})

Generalized Gar ma for r^ Pump 78 0

o.

1.C-03 *- -Weibull (3P) fit for convolution of Pump 7A, E dud Pump 7B

-OFconv(t) = Fconv(t)-

1.E-04 Fronv(857) 1.E-05 0 20 40 60 80 100 Day after 2nd failure of Pump 7C Figure 5.5-1, Failure Probability of P-7A and P-7B within P-7C Allowed Outage Time 6.0 INPUT Inputs in this evaluation are separated into several categories: those involving the PRA software tools and existing PRA models and evaluations, and those involving the configuration of the plant during planned maintenance activities. PRA tools and models input define the starting point of the evaluation. Plant configuration inputs define critical configuration that exists during the maintenance activities.

In this analysis, the full power internal events (FPIE) analysis evaluates the current analysis-of-record [2].

6.1 PRA Tools and Models 6.1.1 The SAPHIRE software application used for FPIE PRA model quantification in this analysis is listed in Table 6.1.1.

Table 6.1.1 [1]

Filename Date Time Size SAPHIRE-7-27-852878059 .exe 6 /24/2008 11:48a 18,303 KB

Entergy PSA EA- PSA-SDP -P7C 06 Rev. 0

=' Enter V Engineering i Analysis Page 24 of 38 6.1.2 The CAFTA software application is used for creating and viewing PRA model logic. The baseline CAFTA model serves as the starting point of the core damage fault tree model evaluated in this analysis. Table 6.1.2 below lists the baseline CAFTA files used in the FPIE analysis.

Table 6.1.2 [2]

Filename Description Date Time Size - KB PSAR2c.be PSAR2c CAFTA Basic Event File 6/26/2006 1:42p 1,248 PSAR2c.caf PSAR2c CAFTA Fault Tree File 6/26/2006 1:36p 449 PSAR2c.gt PSAR2c CAFTA Gate Type File 6/24/2006 1:31p 1,024 PSAR2c.tc PSAR2c CAFTA Type Code File 5/27/2004 9:03a 30 PSAR2c CAFTA Files.zip PSAR2c CAFTA zip file 6/29/2006 8:47a 289 6.1.3 The SAPHIRE project model is used for PRA model quantification. Table 6.1.3 lists the PSAR2c SAPHIRE project files used as the initial data set for the FPIE analysis.

Table 6.1.3 [2]

Filename Date Time Size - KB Description Caf2Sap PSAR2c.txt Text rules file used by caf2sap.exe to create MAR-6/29/2006 8:59a 11 D files.

Caf2Sap.exe Visual basic application for creating SAPHIRE 3/24/2003 8:16a 28 MAR-D fault tree files.

Creation of Rules File EXCEL spreadsheet that creates the *.txt rules file 6/26/2006 2:42p 2 , 162 PSAR2c.xls for SAPHIRE MAR-D fault tree assembly.

PSAR2c FTree Logic.ftl MAR-D fault tree file created from the PSAR2c 6/29/2006 9:16a 3 , 421 CAFTA master fault tree.

SAPHIRE v7.26 PSAR2c 6/29/2006 9:43a 1,099 Above listed supporting files.

Ftree Files.zip 6.1.4 Table 6.1.4 defines the house event configuration used in the FPIE evaluation:

Table 6.1.4 House Event House Event A-HSE-CST-MAKEUP F I-HSE-M2LEFT-INS T C-HSE-P-52A-STBY T I-HSE-M2RGHT-INS F C-HSE-P-52B-STBY T M-HSE-P-2A-TRIP T C-HSE-P-52C-STBY F M-HSE-P-2B-TRIP F D-HSE-CHGR1-INS T M-HSE-SJAE1-INS T D-HSE-CHGR2-INS T M-HSE-SJAE2-INS F D-HSE-CHGR3-INS F U-HSE-P-7A-STBY F D-HSE-CHGR4-INS F U-HSE-P-7B-STBY F E-HSE-AIR-GT-75F T U-HSE-P-7C-STBY T E-HSE-AIR-LT-75F F X-HSE-2SG-BLDN 1 E-HSE-BYPASS-REG T X-HSE-2SG-BLDN-A 1 E-HSE-EDG11-DEM T X-HSE-2SG-BLDN-B 1 E-HSE-EDG11-RUN T X-HSE-SGA-BLDN 1 E-HSE-EDG12-DEM T X-HSE-SGB-BLDN 1

Entergy PSA EA-PSA-SDP-P7C 06 Rev. 0 Entergy Engineering Analysis Page 25 of 38 Table 6.1.4 House Event House Event E-HSE-EDG12-RUN T Y-HSE-LOOPIA-BRK T I-HSE-C-2AC-INS T Y-HSE-L00P113-BRK F I -HSE-C-213-INS F Y-HSE-LOOP2A-BRK F I-HSE-F-12A-INS T Y-HSE-LOOP2B-BRK F I-HSE-F-12B-INS F Y-HSE-RAS-POST F I-HSE-F-5A-INS T Y-HSE-RAS-PRE F I-HSE-F-5B-INS F X-HSE-DOOR-167B T X-HSE-DOOR-167 T 7.0 ASSUMPTIONS Assumptions in this evaluation are classified as major or minor as to potential impact on the analysis results. These assumptions are specific to this evaluation. All assumptions of other risk evaluations (e.g.,

full power internal events, flooding, etc.) are applicable unless specifically noted.

7.1 Major Assumptions 7.1.1 The loss of service water initiating event (LOSW- IE) frequency applied to quantify the increase in risk due to the service water pump coupling failures is conservative.

Basis:

The existing LOSW-IE in the analysis-of-record [2] (1.22E-03/yr) is based on data from NUREG/CR-5750 and combines data from both partial and complete loss of service water events [11]. The base calculated LOSW-IE frequency attributed to pump failures from Section 5.4 for Case 3, which uses plant evidence of 495,000 hours0 days <br />0 hours <br />0 weeks <br />0 months <br /> of pump operation without a failure to run, is 4.18E-06/yr. The LOSW-IE frequency for the degraded state, while the 416 SS couplings were installed, was calculated as 1.35E-04/yr.

A conservative time dependant convolution analysis was performed that concludes the failure probability of the P-7A and P-7B pumps during the P-7C allowed outage time was small (Attachment 10). These results, when compared to the common cause term applied in the initiating event frequency calculation, demonstrate the value used is conservative by over an order of magnitude (see Sections 5.3 and 5.5).

Bias:

This approach is conservative, as the Section 5.4 calculated values demonstrate that the NUREG/CR-5750 value derived from the combined partial and complete loss of SW initiating events are conservative for Palisades. The further addition of the difference in the calculated baseline and degraded frequencies adds further conservatism.

7.2 Minor Assumptions 7.2.1 Large Early Release Frequency (LERF) is not quantified for this analysis.

Basis:

Though not quantified it is considered that LERF would be two orders of magnitude less than the estimated CDF cited herein.

Bias:

This assumption is neutral.

^- Enteiy Entergy PSA Engineering EA-PSA-SDP-P7C-11 -06 T Rev. 0 Analysis Page 26 of 38 8.0 METHODOLOGY This evaluation employs the analytical procedures defined in References [2], [6], [7], [8], and [9] and the recommendations from Section 3.4 of [22] (Attachment 1), as described below:

• Modify the current LOSW initiating event frequency by adding a variable for the increase in the LOSW IE frequency using the data for Case 3 in Table 5.4-1 (7th row of data). When reporting a single value, the mean of the distribution is used as all relevant CDF acceptance criteria refer to mean values.

• Change the failure rate distribution for "SW pump failure to run" to reflect the degraded conditions by using the Gamma Distribution parameters in Table 5.2-1.

• Keep all remaining data parameters the same as in the base case.

• Calculate the increase in CDF due to these changes; they should be comparable to those estimated in Section 5.4.

A time dependent conditional probability analysis, using the Lucius Pitkin Inc. (LPI) metallurgical and failure analysis is also presented (Attachment 10). This is followed by comments on the current draft NRC, "Common-Cause Failure Analysis in Event and Condition Assessment: Guidance and Research" template (Attachment 11).

8.1 Acceptance Criteria The Reactor Oversight Process (ROP) acceptance criteria based on quantitative results is presented below:

Evaluated Configuration Color ACDF < 10-6 Green ACDF > 10-6 White

£CDF > 10-5 Yellow ACDF > 10 ° Red 9.0 PRA MODEL QUANTIFICATION OF INCREASED RISK This section describes the analysis, assessment and evaluation employed. Summary results are presented in Section 10.

9.1 Full Power Internal Events (PSAR2c)

The current analysis-of-record [2] model was employed to evaluate the significance of the additional service water pump failures with respect to the full power internal events analyses. Attachment 3 provides a high level PRA model history description since the IPE submittal.

To support the risk evaluation, the SAPHIRE code [1] was employed to evaluate the affects of the increased failure rate. The following change set data was prepared based on the quantitative data analysis and recommendations described in Section 5.0.

9.1.1 SAPHIRE Change Set Development To support the full power internal events random failure analysis, the following SAPHIRE change set data were employed;

Entergy PSA EA- PSA-SDP -P7C-11-06 Rev. 0

'MEnteW Engineering Analysis Page 27 of 38 PSAR2C P7C COUPLING.CSD=

DELTA_SW_416SS Updated SW Pump Failure Prob and IE Frequency DELTA_SW_416SS-FTR Updated SW Pump Failure Prob PSAR2C_P7C_000PLING, DELTA_SW_416SS =

APROBABILITY U-PMMG-P-7A, 1 , , 1.464E-003, , , , , , ,

U-PMMG-P-7B, 1 , , 1.464E-003, , , , , , ,

U-PMMG-P-7C, 1 ,, 1.464E-003, , , , , , ,

IE_LOSWS, 1 , , 1.560E -003, , , , , , ,

"CLASS

• EOS PSAR2C_P7C_000PLING, DELTA_SW_416SS _FTR=

APROBABILITY U-PMMG-P-7A, 1 , , 1.464E-003, , , , , , ,

U-PMMG-P-7B, 1 ,, 1.464E-003, , , , , , ,

U-PMMG-P-7C, 1 , , 1.464E-003, , , , , , ,

"CLASS

• EOS The loss of service water initiating event frequency and pump fail to run probabilities applied to the change sets were derived as shown in the table below.

Table 9.1.1-1, Initiating Event Frequency and SW Pump Fail to Run Probability Applied to SAPHIRE Change Sets Description Value Source Palisades base model loss of service water References [6] and [11]. Note: This value combines the 1 22E-03/yr initiating event frequency frequency for both partial and complete loss of service water.

Increase in loss of service water initiating Table 5.4.1, Change in LOSW-IE from Case 3 (failure rate based 3.35E-04/yr event frequency on 0 SW pump failures from 1980 - 2009) to Degraded State Initiating Event Frequency Applied to 1 , 56E-03/yr = 1.22E-03 + 3.35E-04 Change Set "DELTA SW 416SS" Service Water Pump failure to run probability based on performance during degraded state Table 5.2-1, Gamma distribution from Jeffry's non-informative 6.1 0E-05 / hr period prior.

PRA Mission Time 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> Reference [6]

Service Water Pump Fail-to-Run probability applied to change sets "DELTA SW416SS" and 1. 464E -03 = 6.10E-5/hr x 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> "DELTA SW 416SS FTR"

Entergy PSA EA-PSA-SDP-P7C-11-06 Rev. 0

' Entergy Engineering Analysis Page 28 of 38 9.1.2 Equipment Rotation The assumed plant configuration cited in Reference [2] and is repeated below; PSAR2C P7C COUPLING.CSD =

HEVENTS(LGCLS-NRML-CNF) House Events w/Normal Plant Rotation Set to True PSAR2C P7C COUPLING.CSI =

C-HSE-P-52A-STBY , T, , , , , , , , , M-HSE-SJAEI-INS , T, , , , , , , , ,

C-HSE-P-52B-STBY , T, , , , , , , , , M-HSE-SJAE2-INS , F, , , , , , , , ,

C-HSE-P-52C-STBY , F, , , , , , , , , U-HSE-P-7A-STBY T, , , , , , , , ,

D-HSE-CHGR1-INS , T, , , , , , , , , U-HSE-P-7B-STBY , F, , , , , , , , ,

D-HSE-CHGR2-INS , T, , , , , , , , , U-HSE-P-7C-STBY , F, , , , , , , , ,

D-HSE-CHGR3-INS , F, , , , , , , , , X-HSE-SGA-BLDN , 1 , , 1.000E+000, , , , , , ,

D-HSE-CHGR4-INS , F, , , , , , , , , X-HSE-SGB-BLDN , 1 , , 1.000E+000, , , , , , ,

E-HSE-AIR-LT-75F , F, , , , , , , , , X-HSE-2SG-BLDN 1 , , 1.000E+000, , , , , , ,

E-HSE-AIR-GT-75F , T, , , , , , , , , X-HSE-2SG-BLDN-A , 1, , 1.000E+000, , , , , , ,

I-HSE-M2LEFT-INS , T, , , , , , , , , X-HSE-2SG-BLDN-B , 1 , , 1.000E+000, , , , , , ,

I-HSE-M2RGHT-INS , F, , , , , , , , , Y-HSE-LOOPIA-BRK , T, , , , , , , , ,

I-HSE-F-12A-INS , T, , , , , , , , , Y-HSE-LOOP1 B-BRK , F, , , , , , , , ,

-HSE-F-12B-INS , F, , , , , , , , , Y-HSE-LOOP2A-BRK , F, , , , , , , , ,

I-HSE-F-5A-INS , T, , , , , , , , , Y-HSE-LOOP2B-BRK , F, , , , , , , , ,

-HSE-F-5B-INS , F, , , , , , , , , Y-HSE-RAS-PRE , F, , , , , , , , ,

-HSE-C-2AC-INS , T, , , , , , , , , Y-HSE-RAS-POST , F, , , , , , , , ,

I-HSE-C-2B-INS , F, , , , , , , , , A-HSE-CST-MAKEUP , F, , , , , , , , ,

M-HSE-P-2A-TRIP ,T,,,,,,,,, X-HSE-DOOR-167B ,T,,,,,,,,,

M-HSE-P-2B-TRIP , F, , , , , , , , , X-HSE-DOOR-167 , T, , , , , , , , ,

9.2 Internal Flooding To evaluate the impact of the increased service water pump independent failure probability on internal flooding events , the model developed in references [31][32][33 ] was employed . Although the model referenced has not been formally issued as the analysis-of-record, it was recently developed based on current ASME standards, peer reviewed , and more accurately characterizes flooding risk at Palisades relative to the IPEEE flooding analysis.

The approach to evaluating the increase in flooding risk was to apply change set

`PSAR2C_P7C_COUPLING, DELTA_SW_416SS _FTR' as presented in Section 9.1.1 and calculate the change in core damage frequency relative to the base model . The results of this evaluation are presented in Section 10.2.

9.3 Fire Events This section describes the steps taken to re-create the IPEEE fire analysis. The recreated IPEEE analysis is built upon the Palisades 2004 PSAR2 model [36] as well as that documented in Reference

[35].

Entergy PSA EA- PSA-SDP -P7C-11 -06 Rev. 0 Ente>rgy Engineering Analysis Page 29 of 38 This analysis resurrected the Reference [35] and [36] analyses and applied the IPEEE data, fault tree and event tree logic.

What follows is a summary description that describes how the IPEEE model was changed.

To create the IPEEE fire model using PSAR2, the Reference [35] analysis performed the following:

1. Converted the basic events representing component fire damage in the fire IPEEE to basic event names currently used in the PSAR2 analysis.

2. Modify the PSAR2 fault tree logic to reflect assumptions made in the fire IPEEE.

3. Add fire related failure modes to the PSAR2 fault tree logic.

4. Recreated fire area initiating events.

5. Developed fire accident sequences (1,776).

9.3.1 Basic Event Conversion The fire IPEEE was based on a Palisades internal events PSA model that was current as of 1995.

Updates to the 1995 PSA model have been performed since the IPEEE submittal. Among the changes was a restructuring of the format of the basic event names.

Attachment 4 provides a listing of the basic event names that were selected in the fire IPEEE to represent component failures that would occur as a result of fire damage in the various fire areas of the plant.

9.3.2 Modifications to the PSAR2 [361 Fault Trees [351 As noted above, the fire IPEEE was based on a Palisades internal events PSA model that was current as of 1995 and updates subsequently have been made to the PSA models. These updates reflect plant design changes that have occurred since the fire IPEEE, modifications to the models to address comments by external peer reviewers, changes resulting from a technical adequacy self assessment performed in accordance with Regulatory Guide 1.200, and updates to reliability data. Attachment 6 provides an overview of PRA model changes since the IPEEE submittal.

Changes made to PSAR2 logic to recreate the IPEEE are summarized below and in Attachment 5.

Modifications to Reflect Logic in the Fire IPEEE A number of local operator actions were credited in the fire IPEEE that are not included in the internal events PSA fault tree logic. These operator actions generally take place as a result of loss of power or control circuits due to fire damage in specific fire areas. These recovery actions generally include local closure of breakers or operation of control valves. Attachment 5 provides a complete listing.

Modifications to the PSAR2 logic to reflect logic in the fire IPEEE were implemented in a manner that the fault trees could be quantified in one of three ways:

1. Implement the fire IPEEE logic specifically for the fire area for which the change was intended.

For example, local closure of the breaker for P7B was credited in the fire IPEEE only for control room fires. Gate U973-DG-FIRE was developed to include a local operator action (U-PMOE-PUMP) for closure of this breaker ANDed with all control room fires (gate A69A5-FIRE under OR gate U973-DGA2-FIRE). By setting any of the control room cabinet fire initiating event house events to True, this recovery logic is enabled.

2. Implement the fire IPEEE logic for all fire areas. This is performed using a house event created for this purpose. For example, HSE-ANYFIRE is set to True enabling the U-PMOE-PUMP logic under gate U973-DGA2-FIRE. The HSE-ANYFIRE house event appears ANDed with all fire IPEEE logic incorporated in the PSAR2 fault tree and enables the fire IPEEE logic for all fire

Entergy PSA EA-PSA-SDP-P7C-11-06 Rev. 0 EnteW Engineering Analysis Page 30 of 38 areas.

3. Disable the fire IPEEE logic in the quantification of the fire accident sequences using the PSAR2 logic. This is performed using the HSE-NOTANY house event. By setting this event to True and the HSE-ANYFIRE to False, fire IPEEE changes are disabled and the fault trees quantified without this recovery logic. The purpose of the HSE-NOTANY house event was to facilitate comparison of the effects of the fire IPEEE changes with the PSAR2 logic.

Modifications to Assure Logic Reflects Correct Plant Transient Response to a Fire The PSAR2 fault tree models include house events to activate fault tree logic associated with plant response to transient initiators. As fire initiators are not a part of the list of internal events in PSAR2, a house event is added to the list of transient initiators representing plant trip due to a fire initiator.

Addition of Fire Areas Initiators to the Fault Tree Logic The Palisades PSA models are quantified using house events to represent the various initiating events.

For a given initiating event, setting its house event to True and all other initiator related house events to False enables the appropriate logic in the fault trees for that given initiating event.

Fire initiator house events were added to the PSAR2 model using the information in Attachment 4. Each basic event listed as representing a component failure for a given fire area in Attachment 4 was ORed with a house event representing that fire area. The Add Event program [14] was used to incorporate the house events into the fault trees.

Quantification of the fault trees for a given fire area can then be performed by setting a selected fire area house event to True and all other fire area house events to False. , lists the IPEEE Ignition Frequencies, Fault Tree Names/Frequencies and Fire Area Assigned/Associated Logical Event.

Event Tree Diagrams Two types of event trees were developed. The first type of event tree simply distributes a given fire area into the different sub areas that were developed for that fire area in the Fire IPEEE. For example, the Control Room can be distributed among 18 different control cabinets or an exposure fire that, if unsuppressed, can affect equipment in the entire room. Attachment 7, Figure A7.1 is an example of the event tree that distributes the fires among the various sub areas for the Control Room. The second event tree type defines plant accident sequence response to a given fire and includes important functions and system logic that are developed by the fault trees.

This second linked event tree transfers to the appropriate sub area. Figure A7.8 is an example of an event tree used to quantify control room fires.

Event Tree Rules , Tables A7.1 through A7.10 list rules for quantification of the accident sequences for each fire area.

Accident Sequence Generation and Solution Four steps were performed to quantify the event tree accident sequences.

1. Convert the PSAR2 fire fault tree to SAPHIRE format

2. Develop Change Sets to perform the accident sequence quantification

3. Generate accident sequences using the SAPHIRE "link" command

4. Quantify all the accident sequences Conversion of the PSAR2 fire CAFTA fault tree to a MAR- D format described in the above steps was performed using the Caf2sap program [14].

Entergy PSA EA - PSA-SDP -P7C 06 Rev. 0

'vEnter y' Engineering Analysis Page 31 of 38 9.3.3 Risk Impact of Increased Fail to Run Probability on Fire Events The impact on fire events of the increased service water pump fail to run probability was performed by evaluating the change in fire CDF frequency by applying change set `PSAR2C_P7C COUPLING, DELTA_SW_416SS _FTR' as presented in Section 9.1.1. The results of this analysis are presented in Section 10.3.

9.4 Seismic 9.4.1 Palisades Seismic Design Palisades seismic design standard for safety related equipment was determined by considering the effects of historical earthquakes in the region. Three historical earthquakes have occurred within 100 miles of the site, the largest being an event in 1947 centered in Southern-Central Michigan which was recorded as "VI" on the Modified Mercalli scale or 4.6 on the Richter scale.

The anticipated maximum earthquake intensity at Palisades is between VI and VII (Mercalli Scale). It was recommended originally that Palisades be designed for a surface acceleration value of 0.05 g; however, a value of 0.20 g was used for systems needed to achieve safe shutdown. All safety related equipment is designed to withstand such an event [34].

No faults have been mapped in the vicinity of the site. The nearest inferred large scale faulting is the Tekonsha and Albion-Scipio Trends located about 50 and 60 miles east of the site respectively. These are considered to be post Devonian to pre Pleistocene with most activity occurring in the late Paleozoic

[34]. The most recent earthquake detected at the site was on April 18, 2008. It occurred near Olney, Illinois and it measured 5.4 on the Richter scale at that location, approximately 200 miles SSW of Palisades.

Per the NRCs August 2010 NUREG presentation, Palisades was not in the preliminary list of sites that warranted further evaluation under GI-199.

9.4.2 IPEEE Seismic Evaluation In the Palisades IPEEE (Individual Plant Examination of External Events), a seismic risk assessment was performed. The risk assessment was a hybrid of the conventional PSA and seismic margins analysis.

The seismic analysis has not been updated since that originally developed for the Individual Plant Examination of External Events (IPEEE) submittal [30]. A review of the results of the IPEEE submittal indicated that the core damage frequency was 8.88E-06 with a high confidence low probability of failure (HCLPF) of 0.217g PGA (peak ground acceleration). There were no specific seismic events identified as dominant contributors to the core damage frequency. Important seismic induced failures identified were; the Fire Protection System, Main Steam Isolation Valves, Diesel Generator Fuel Oil Supply, and an under voltage relay for 2400 volt ac Bus 1 D. Several important random failures were identified in the report as important because of their contribution in combination with seismically induced failures. The important random failures (not seismically induced) identified in the report were: diesel generator 1-2, auxiliary feedwater (AFW) pump, P-8C, and atmospheric dump valves.

As noted, the fire protection system is an important contributor to seismic analysis due to the probability of seismically induced failure of fire protection system components and the condensate storage tank (CST). Seismically induced failure of the condensate storage tank results in an earlier need for alignment of an alternate suction source for the operating auxiliary feedwater pump. The fire protection system provides an alternate suction source to AFW pumps P-8A and P-8B. The seismically induced failures of the fire protection system result in long term failure of auxiliary feedwater pumps P-8A and P-8B due to the unavailability of a suction source. Auxiliary feedwater pump P-8C is important to long term makeup to the steam generators should the fire system become unavailable following a seismic event (as discussed

Entergy PSA EA- PSA-SDP -P7C-11-06 Rev. 0

' Entefgy Engineering Analysis Page 32 of 38 in the results for Accident Classes IA & IB, Section 3.6.5.3.1 [30].

The fire protection system has a low fragility and is a significant contributor to seismic risk once the contents of the condensate storage tank (T-2) are depleted and a long term suction source is required for continued operation of the AFW pumps. The seismically induced failure of the fire protection system represents a higher probability of failure of the long term suction to motor-driven auxiliary feedwater pump P-8A and turbine-driven auxiliary feedwater pump P-8B after the depletion of the available tank T-2 inventory. This increased probability of failure of heat removal via the A and B pump trains results in an increased importance of motor-driven auxiliary feedwater pump P-8C. The importance of pump P-8C is a consequence of the fact that service water (a much more seismically rugged system) is more likely to remain available as a long term suction source to pump P-8C.

9.4.3 Evaluation of Increased Service Water Pump Failure Probability on Seismic Risk As the Palisades seismic PRA hasn't been updated since the IPEEE, a characterization of the impact on seismic events of the increased service water pump fail to run probability was performed by evaluating the change in failure probability of the service water system fault tree (gate sws-mspi) by applying change set 'PSAR2C_P7C_000PLING, DELTA_SW_416SS _FTR' as presented in Section 9.1.1. The results of this analysis are presented in Section 10.4.

10.0 RESULTS 10.1 Full Power Internal Events As described in Sections 5 . 0 and 8 . 0 above, the OCDF/yr was calculated using the Palisades full power internal events analysis-of-record . The results of this analysis are presented in Table 10.1-1.

Table 10.1-1, Change in Risk due to Increased Failure Probability of SW Pump Couplings CDF/yr Case

1. SAPHIRE Project Change Set(s) (unsubsumed/subsumed) # Outsets Comments (Truncation @ 1 E-10)

1. HEVENTS(LGCLS- Analysis-of-record with base PSAR2c 10,697 /

2.832E-05 / 2.696E-05 house events set to NRML-CNF) 8 619 normal plant rotation

1. HEVENTS(LGCLS- Normal plant rotation, and 1 PSAR2C _ P7C _ 000PLING NRML-CNF) 10,712 / increased SW pump fail to 2.832E-05 / 2.696E-05 8,621 run probability per Table 2.DELTA SW 416SS FTR 5.2-1 Normal plant rotation,

1. HEVENTS(LGCLS- increased LOSW IE 2 PSAR2C _ P7C _ 000PLING NRML-CNF) 10, 736/ frequency per Table 5.4-1, 2.924E-05 / 2.787E-05 8,641 and increased SW pump

2. DELTA SW 416SS fail to run probability per Table 5.2-1 Change in Core Damage Frequency Relative to Base Case Case 1 ACDF/yr with 1 ACDF/yr s increased pump fail to run probability Case 2 ACDF/yr with (2.787E 2.696E -05) increased LOSW IE 2 ACDF/yr

= 9.1 E-07 frequency and pump fail to run probability

[1] This value is deemed conservative based on the common cause factors applied to the change in initiating event frequency calculation as described in Section 5.3 and summarized in Section 11.

Entergy PSA EA- PSA-SDP -P7C-11-06 Rev. 0 Enter y Engineering Analysis Page 33 of 38 10.2 Internal Flooding The flooding model calculated a OCDF/yr of 1.0E-08 using the change set DELTA_SW_416SS_FTR

( increased SW pump failure to run probability ) as described in Section 9.1.1.

10.3 Fire The fire results were obtained by solving the SAPHIRE change sets 'PSAR2C_P7C_000PLING, DELTA_SW_416SS _FTR', discussed in 9.1.1.

The results in Table 10.3-1 indicate that the change in core damage frequency for those sequences with SW pump cutset elements is small (<1 E-08/yr). This is consistent with the IPEEE [37] fire results in that the core damage frequency was dominated by secondary side random heat removal failures; specifically, auxiliary feedwater and once-through-cooling (OTC) failures.

Table 10.3-1, Change in Core Damage Frequency from Fire Events with Increased SW Pump Fail to Run Probability Case # SWS Pump Core Damage Frequency (Truncation @ 1 E-10) /yr IPEEE Modified Fire Model - Base Case 7.26E-10 IPEEE Modified Fire Model - w/SWS Coupling Failure Included 7.69E-09 Change in System Failure Probability Relative to Base Case ACDF/yr (7.69E 7.26E-10) = 6.96E-09 10.4 Seismic To evaluate the potential impact on the seismic analysis, the relative increase in system failure probability using the DELTA_SW_416SS_FTR change set (increased SW pump failure to run) was calculated. It was fond that the system failure probability (failure of all three service water pumps) increased from 3.399E-05 to 3.508E-05, or a A of 1.09E-06.

As the change in the system failure probability is small; the impact on the service water system functional importance in a seismic event would also be relatively insignificant, as this increase is a result of random independent failures, whereas the seismic CDF is primarily a function of components that have failed due to the seismic event.

10.5 Total Change in Core Damage Frequency The total increase in core damage frequency, due to the increased failure rate of the service water pumps, is the sum of the changes in risk contribution from the full power internal events, fire, flooding, and seismic results presented in Sections 10.1 - 10.4.

Total OCDF = (9.1E - 07) + (1.0E - 08) + (6.96E - 09 ) + e = 9.3E - 07/yr As the results demonstrate, the primary contribution to the increase in core damage frequency is from the increase in loss of service water initiating event frequency (LOSW-IE) applied to the full power internal events model.

The approach applied to develop the magnitude of the LOSW-IE increase in considered conservative. As presented in Section 5.3, the fraction of the elevated failure rate due to common cause (i.e. the beta factor for pump failure to run) was assumed to be the same as in the base case model. The beta factor used is viewed to be highly conservative for normally operating pumps as there is very little historical evidence of common cause failures of normally operating components. Due to the conservative

Entergy PSA EA- PSA-SDP -P7C-11 -06 Rev. 0

^=' Enter Engineering Analysis Page 34 of 38 treatment of common cause failures in this evaluation, the calculated change in CDF is actually dominated by the initiating event frequency estimation involving common cause failure of the two normally operating pumps. A more realistic assessment that takes credit for the fact that the two pump failures are independent failures would result in a much smaller increase in CDF than what has been estimated in this analysis.

In addition, the probability of failure the P-7A and P-7B pumps during the allowed outage time of P-7C was conservatively quantified using a time dependant convolution analysis as described in Section 5.5.

The result of this analysis (see page 5 of Attachment 10) was a probability of 2.65E-05 over the 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> period, or a rate of 3.68E-07/hr. The common cause failure rate used in the initiating event frequency calculation presented above (equation 5.2 term ACCFR) for the degraded state is RFRAFR = .0243

• 6.1 E-05/hr = 1.482E-06/hr. Therefore, the common cause term applied in initiating event frequency calculation is conservative by over an order of magnitude.

11.0 CONCLUSION

Based on the review of the metallurgical studies, data analysis, and model quantification, the following conclusions were reached:

• The coupling failure events are considered repeated independent failures of a single component.

The events occurred too far apart in time to have more than a negligible impact on the common cause failure probability.

- This is based on the application of NUREG/CR-6268, and

- The review of draft "Common-Cause Failure Analysis in Event and Condition Assessment: Guidance and Research" [38], Attachment 11.

Although the failures of interest were treated as independent in this analysis, the fraction of the elevated failure rate due to common cause (i.e. the beta factor for pump failure to run) was assumed to be the same as in the base case model. The beta factor used is viewed to be highly conservative for normally operating pumps as there is very little historical evidence of common cause failures of normally operating components. Due to the conservative treatment of common cause failures in this evaluation, the calculated change in CDF is actually dominated by the initiating event frequency estimation involving common cause failure of the two normally operating pumps. A more realistic assessment that takes credit for the fact that the two pump failures are independent failures would result in a much smaller increase in CDF than what has been estimated in this analysis.

• With respect to the technical specification allowed repair time of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> for a single pump out of service, there would be approximately 20 LCO periods between the P-7C failure on August 9, 2011 and the metallurgical report predicted failure time of the P-7B couplings on October 9, 2011 (if the pump were to remain in continuous operation). This span would significantly reduce the potential for concurrent pump failures within the LCO repair time. No cracking was found in the P-7A pump couplings.

• A conservative time dependant convolution analysis was performed that concludes the failure probability of the P-7A and P-7B pumps during the P-7C allowed outage time was small (Attachment 10). These results demonstrate that the common cause term applied in the initiating event frequency calculation in this analysis is conservative by over an order of magnitude.

• The analysis characterized the risk during the period the shaft couplings were constructed from material that was more susceptible to inter-granular stress corrosion cracking (the degraded state period). It was estimated that the SW pump mean failure rate for failure to run increased by a about a factor of 15 compared to the currently employed failure rate.

Entergy PSA EA- PSA-SDP -P7C-11 -06 Rev. 0 Entergy Engineering Analysis Page 35 of 38

• The analysis also characterized the risk impact due to the increase in loss of service water initiating event frequency during the degraded state period. The pump failure contribution to initiating event frequency during this period was estimated to increase by 30%.

• The impact of the service water pump increased independent failure probability on core damage frequency due to flooding, seismic, and fire initiating events was evaluated and was determined to be negligible.

In summary; The observed failures are considered independent and have a negligible impact on the common cause failure probability. Therefore, based on the random nature of the stressors that contribute to IGSCC, as described in the coupling metallurgical reports, the rate and timing of the failures, and 3rd party expert analyses; the coupling failures contribution to the common cause failure to run probability and loss of service water initiating event frequency, is also negligible. The increase in core damage frequency, while the 416 stainless steel couplings were installed in the Palisades service water pumps is quantified as

<1.OE-6 (Green).

Entergy PSA EA-PSA-SDP -P7C-11-06 Rev. 0 Ente;rgy Engineering Analysis Page 36 of 38

12.0 REFERENCES

[1] EA-PSA-SAPHIRE- 09-08 , Rev. 0, SAPHIRE v7.27 Testing and Software Quality Assurance Plan, December 2009

[2] EA-PSA-PSAR2c-06-10, Rev. 0, Update of Palisades CDF Model - PSAR2b to PSAR2c, June 2006

[3] Lucius Pitkin Inc. (LPI) report F11358-LR-001 Rev. 0, "Past Operability Assessment of Service Water Pumps P-7A and P-7B associated with As-found Evaluation of Pump Shaft Couplings -

Palisades Nuclear Plant", Lucius Pitkin, Inc., September 28, 2011 (enclosed as Attachment 9)

[4] CR-PLP-2009-04519 Root Cause Evaluation Report, "Service Water Pump P-7C Line Shaft Coupling Failure" Rev. 1, 3-9-2010

[5] Lucius Pitkin Inc. (LPI) report F11358-R-001 Rev.1, "Metallurgical and Failure Analysis of SWS Pump P-7C Coupling #6", December 2011 (enclosed as Attachment 8)

[6] SAPHIRE REFERENCE MANUAL, "SYSTEMS ANALYSIS PROGRAMS FOR HANDS ON INTEGRATED RELIABILITY EVALUATIONS (SAPHIRE) VERSION 6.0", Idaho National Engineering Laboratory, 1998. EN-WM-104, Revision 4, On Line Risk Assessment, May 2011

[7] SAPHIRE TECHNICAL REFERENCE, "Systems Analysis Program for Hands-on Integrated Reliability Evaluations (SAPHIRE) Version 6.0", Idaho National Engineering Laboratory, 1998.NUMARC 93-01, Revision 3, Industry Guideline for Monitoring the Effectiveness of maintenance at Nuclear Power Plants, Nuclear Energy Institute, July 2000

[8] NUREG/CR-2300 volume 1, "PRA Procedures Guide". ASME/ANS RA-Sa-2009, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, American Society of Mechanical Engineers, American National Standard

[9] NUREG-0492, "Fault Tree Handbook"

[10] NUREG/CR-5750 (INEEL/EXT-98-00401), "Rates of Initiating Events at U.S. Nuclear Power Plants:

1987-1995", February 1999

[11] EA-PSA-DATA-04-08 Rev. 0, "Determination of Palisades Initiating Event (IE) Frequencies using INEEL Prior Data"

[12] CR-PLP-2011-03902 Root Cause Evaluation Report, "Service Water Pump P-7C Line Shaft Coupling Failure" Rev. 0, 9-8-2011

[13] Engineering Change 5000121762 (formerly EC-1 0087), "P-7A, P-7B, P-7C Service Water Pump Refurbishment Design Configuration Changes/Documentation", September 7, 2007

[14] EA-PSA-SAPHIRE-03-02 Rev. 0, "Verification and Validation of SAPHIRE Versions 6.75, 6.76, 7.18, 7.20 and 7.21"

[15] PLG-0500, "Database for Probabilistic Risk Assessment for Light Water Nuclear Power Plants,"

Pickard Lowe and Garrick, 1989

[16] EA-PSA-SAPHIRE-04-02 Rev. 0, "Update of Palisades CDF Model - PSARIB Modified w/HELB to PSAR2"

[17] EN-IT- 104 Rev. 7, "Software Quality Assurance Program"

[18] WI-SWS- M-04 Rev. 5, "Service Water Pumps P-7B and P -7C Removal, Inspection, and Reinstallation"

[19] WI-SWS-M-03 Rev. 4, "Service Water Pump P-7A Removal, Inspection, and Reinstallation"

[20] NUREG/CR-6928 (INL/EX-06-11119), "Industry-Average Performance for Components and

Entergy PSA EA-PSA-SDP-P7C-11 -06 Rev. 0

=' Enteigy Engineering Analysis Page 37 of 38 Initiating Events at U.S. Commercial Nuclear Power Plants", February 2007

[21] NUREG/CR-6268 Rev. 1, "Common-Cause Failure Database and Analysis System: Event Data Collection, Classification, and Coding", September 2007

[22] "Risk Significance Evaluation of Service Water Pump Failures for Palisades Nuclear Power Station", Karl N. Fleming, November 2011

[23] EA-PSA-1 999-0008 Rev. 0, "Palisades PSA Model - Power Operations - Data Collection - Plant Specific Data"

[24] EA-PSA-1999-0010 Rev. 0, "Palisades PSA Bayesian Update"

[25] NUREG/CR-6823, Idaho National Laboratory, "Handbook of Parameter Estimation for Probabilistic Risk Assessment", September 2003

[26] Palisades Safety Assessment Notebook NB-PSA-DA, Rev. 5, "Data Analysis"

[27] American Society of Mechanical Engineers and American Nuclear Society, Addenda to ASME/ANS RA-S-2008 Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, ASME/ANS RA-Sa-2009, New York (NY), February 2009

[28] ERIN Engineering and Research Inc., "Palisades Nuclear Application Common Cause Application, July 2004

[29] EA-PSA-1999-011 Rev. 0, "Palisades PSA Model - Equipment Out of Service"

[30] Letter from Consumers Power to U.S. NRC ( Document Control Desk ), Subject : Response to Generic Letter 88- 20, Supplement 4, Individual Plant Examination of External Events for Severe Accident Vulnerabilities, Final Report , Dated : June 30, 1995[G326/2290]

[31] EA-PSA-INTFLOOD- 09-03 ( 01) Rev . 1 (DRAFT) " Internal Flooding and Spray Initiating Events-Identification of Flood Areas, Flood and Spray Sources, and Impacted Components"

[32] EA-PSA-INTFLOOD-09-03 ( 02) Rev . 1 (DRAFT ) "Palisades Internal Flooding Analysis for Internal Events PSA - Initiating Event Frequencies for Flooding and Spray Events"

[33] EA-PSA-INTFLOOD- 09-03(03) Rev . 1 (DRAFT ) "Palisades Internal Flooding Analysis for Internal Events PSA - Calculation of Core Damage Frequency"

[34] Palisades Updated Final Safety Analysis Report (FSAR) Rev. 28

[35] EA-PSA-MOV-05-01, Rev. 0, Use of the Palisades PSA to Evaluate the Importance of MOV Hot Shorts

[36] EA-PSA-SAPHIRE-04-02 Rev. 0, "Update of Palisades CDF Model - PSAR1 B Modified w/HELB to PSAR2"

[37] Consumers Power, Palisades Nuclear Plant, "Individual Plant Examination of External Events for Severe Accident Vulnerabilities," Response to Generic Letter 88-20, Supplement 4, Final Report, June 1995.

[38] Song-Hua Shen et.al.,"Common-Cause Failure Analysis in Event and Condition Assessment:

Guidance and Research", ML111890290, draft.

Entergy PSA EA-PSA-SDP-P7C-11-06 Rev. 0

'v' Enteigy Engineering Analysis Page 38 of 38 13.0 LIST OF ATTACHMENTS Attachment 1 Risk Significance Evaluation of Service Water Pump Failures for Palisades Nuclear Power Station, Karl N. Fleming, November 2011 (29 pages)

Attachment 2 Service Water Pump Run Time PI Data Analysis (6 pages)

Attachment 3 PRA Model History (6 pages)

Attachment 4 Fire IPEEE to PSAR2 Basic Event Translation (66 pages)

Attachment 5 Modifications to PSAR2 Logic for Fire Model (16 pages)

Attachment 6 IPEEE Ignition Frequency, Fault Tree Names, Fire Areas (9 pages)

Attachment 7 Fire Event Tree Accident Sequences (22 pages)

Attachment 8 Lucius Pitkin Inc. (LPI) report F11358-R-001 Rev.0, "Metallurgical and Failure Analysis of SWS Pump P-7C Coupling #6", October 2011 (report body, does not include attachments*) (83 pages)

Attachment 9 Lucius Pitkin Inc. (LPI) report F11358-LR-001 Rev. 0, "Past Operability Assessment of Service Water Pumps P-7A and P-7B associated with As-found Evaluation of Pump Shaft Couplings - Palisades Nuclear Plant", Lucius Pitkin, Inc., September 28, 2011 (41 pages)

Attachment 10 Evaluation of Service Water Pumps P-7A and P-7B Failure Rates Following Failure of Pump P-7C (15 pages)

Attachment 11 Comments on Draft NUREG "Common-Cause Failure Analysis in Event and Condition Assessment: Guidance and Research" (29 pages)

Attachment 12 Comments on NRC Inspection Report Preliminary White Finding (5 pages)

• Attachments A-X of LPI P-7C report available upon request A: Miscellaneous Inputs B: Receipt Inspection Reports C: Visual Inspection D: Magnetic Particle Testing E: Hardness Survey Data F: Tensile Test Data G: Charpy Test Data X: Rev. 0 Comment and Resolution