ML090260290

Responses to NRC Requests for Additional Information Dated December 24, 2008 Regarding Application for Renewed Operating Licenses

ML090260290
Person / Time
Site:	Prairie Island
Issue date:	01/23/2009
From:	Wadley M D Northern States Power Co, Xcel Energy
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
L-PI-09-007
Download: ML090260290 (44)

Text

@, Xcel Energyw January 23,2009 L-PI-09-007 10 CFR 54 U S Nuclear Regulatory Commission ATTN: Document Control Desk Washington, DC 20555-0001 Prairie Island Nuclear Generating Plant Units 1 and 2 Dockets 50-282 and 50-306 License Nos. DPR-42 and DPR-60 R~SDO~S~S to NRC Requests for Additional lnformation Dated December 24,2008 Reaardina A~~lication for Renewed O~eratina Licenses By letter dated April 11, 2008, Northern States Power Company, a Minnesota Corporation, (NSPM) submitted an Application for Renewed Operating Licenses (LRA) for the Prairie Island Nuclear Generating Plant (PINGP) Units 1 and 2. In a letter dated October 23, 2008, the NRC transmitted Requests for Additional lnformation (RAls) regarding the Severe Accident Management Alternatives analysis provided as part of the Environmental Report included in the LRA. NSPM responded to those RAls in a letter dated November 21,2008. On December 24,2008, the NRC transmitted follow up RAls related to the NSPM responses. This letter provides responses to those follow up RAls. Enclosure 1 provides the text of each follow up RAI followed by the NSPM response. Enclosures 2 and 3 provide detailed information about two operator actions discussed in the response to SAMA follow up RAI 5a. If there are any questions or if additional information is needed, please contact Mr. Eugene Eckholt, License Renewal Project Manager.

Summarv of Commitments This letter contains no new commitments or changes to existing commitments.

I declare under penalty of perjury that the foregoing is true and correct.

Executed on January 23, 2009.

Michael D. Wadley u Site Vice President, Prairie Island Nuclear Generating Plant Units 1 and 2 Northern States Power Company - Minnesota 171 7 Wakonade Drive East Welch, Minnesota 55089-9642 Telephone:

651.388.1 121 Document Control Desk Page 2 Enclosures (3) cc: Administrator, Region Ill, USNRC License Renewal Project Manager, Prairie Island, USNRC Resident Inspector, Prairie Island, USNRC Prairie Island Indian Community ATTN: Phil Mahowald Minnesota Department of Commerce NSPM Responses to NRC Requests for Additional Information Dated December 24,2008 SAMA Follow Up RAI 1 e The response (p.

10) noted a probabilistic risk assessment (PRA) maintenance and an updated fact and observation (F&O) had been identified and resolved. Describe the F&O and its resolution.

In addition, describe the scope and personnel qualifications of the three reviews identified as being part of the self-assessment process (p. 11). NSPM Response to SAMA Follow Up RAI le PRA Proqram Maintenance

& Update F&O A description of the PRA Program Maintenance and Update Fact & Observation from the Westinghouse Owners Group Prairie Island PRA Peer Review of September 2000 is provided below with a summary of its resolution.

==

Description:==

A PRA group procedure requires evaluation of PRA results when the model is updated. The procedure indicates that the evaluation must include a review of the top cutsets and basic event importance measures to ensure that dominant contributors to risk are modeled accurately and that dependant operator actions are treated appropriately. The procedure also requires a focus on understanding and addressing risk significant issues that have resulted from the latest requantification.

For a full PRA update, consideration should also be given to reviewing more than just dominant contributors and top cutsets, depending on the extent of the modeling change. For example, any updated model revision may produce results that will require a deeper review than an examination of top cutsets, top risk importance contributors, and overall CDFILERF values. Resolution:

Two procedures were developed to address the maintenance and update process of the PRA model. 1. A fleet procedure was created in order to provide a PRA guideline for model maintenance and update. The purpose of this guideline is to identify requirements for maintaining and upgrading the PRA model to ensure that its representation of the as-built, as-operated plant is sufficient to support applications for which it is being used.

2. A site procedure was created in order to provide a guideline to perform a PRA model quantification.

The purpose of this guideline is to provide instructions on how to structure the Quantification of the PRA model following a periodic or maintenance update of the PRA model. The PRA Quantification is designed to examine the model's result and to confirm that it reflects the design, operation, and maintenance of the plant. The PRA Model Quantification Guideline Enclosure 1 NSPM Responses to NRC Requests for Additional Information Dated December 24,2008 prescribes reviews on cutsets, recovery actions, mutually exclusive events, circular logic, asymmetries, initiating event distributions, and important operator actions, just to name a few. It was created to meet the High Level requirements for the model Quantification Element as stated in the ASME Standard for PRA. Self Assessments Descriptions of the scope and personnel qualifications for three self-assessments are provided below: PRA Program Snapshot Evaluation (April 2007) Topic: PlNGP PRA benchmark against Regulatory Guide 1.200, Revision 1, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities.

Scope: Evaluate the following with respect to impact on conformance with industry standards and expectations:

PlNGP PRA model against selected PRA elements Open PRA Model Review items Potential for MSPl margin improvement Standards:

Regulatory Guide 1.200, Revision 1 , An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk- Informed Activities ASME RA-S-2005, Standard for Probabilistic Risk Assessment for Nuclear Power Applications NEI 00-02, Self-Assessment Process for Addressing ASME PRA Standard RA-SB-2005, as Endorsed by NRC Regulatory Guide 1 .ZOO Objectives: Perform a complete review of selected PRA Technical Elements as defined by Regulatory Guide 1.200, Revision 1 and ASME RA-S-2005 capability category I I. Determine if there are any PRA model issues for the MSPl systems that could improve MSPl margin if corrected or implemented. Team Resources: The review team consisted of several members who had extensive knowledge in PRA methods. There were four team members with 18 years or greater experience in PRA. One team member had 9 years of PRA experience and two members had 3 years or less. The total number of years of PRA experience for the team was approximately 90 years. This does not include the number of years of experience in other areas of the nuclear industry.

Enclosure 1 NSPM Responses to NRC Requests for Additional Information Dated December 24,2008 PRA Proaram Focused Self-Assessment (Mav 2004) Topic: Assess the PI PRA Program against the Nuclear Management Company (NMC) Fleet PRA Standard and industry best practices.

This was the first self- assessment of the PI PRA program and helped maintain the program health status in the "Assessment" category green. Scope: The assessment consisted of a combination of document reviews, interviews, and field observations.

Data included, but was not limited to: Procedure and document reviews Personal observations or interviews CAP and/or other database reviews Compliance with NMC Fleet PRA Standard Industry best practices Standards:

NMC Fleet Probabilistic Risk Assessment Standard PI Procedure for the Program Health Process PI Procedure for the Action Request System Objectives:

Has the facility established and is it implementing and maintaining the PRA program consistent with the requirements of the above listed Standards?

Are the Program related outputs consistent with the related standard (Program Health, Gap Analysis, Program Notebook, spreadsheets, goals, etc.) Team Resources: The review team consisted of several members who had extensive knowledge in PRA methods. There were three team members with 14 years or greater experience in PRA. The other team member had 6 years of PRA experience.

The total number of years of PRA experience for the team was approximately 51 years. This does not include the number of years of experience in other areas of the nuclear industry.

Nuclear Oversiqht Observation Re~0r-t (June 2003) Topic: PlNGP PRA Risk Assessment Program reviewed against NUMARC 93-01, Industry Guideline for Monitoring the Effectiveness of Maintenance Activities at Nuclear Power Plants.

Enclosure 1 NSPM Responses to NRC Requests for Additional Information Dated December 24,2008 Scope: The assessment consisted of a combination of document reviews, interviews, and observed performance and review of results. Data included, but was not limited to:

Procedure and document reviews Personal observations or interviews CAP and/or other database reviews Documents Reviewed:

NUMARC 93-01 , Industry Guideline for Monitoring the Effectiveness of Maintenance Activities at Nuclear power Plants, Rev 3, July 2000.

10CFR50.65 NMC Fleet Probabilistic Risk Assessment Standard NMC Fleet Procedure for PRA Guideline for Peer Review F&O Assessment PI Procedure for MR(a)(4) PRA Risk Assessment Preparation PI Procedure for On-Line Scheduling Process PI Procedure for Engineering Support Personnel Training Plan Regulatory Guide 1.182, Assessing and Managing Risk Before Maintenance Activities at Nuclear Power Plants, May 2000. PI Procedure for the Assessment and Management of Risk Associated with Maintenance Activities NMC PRA Gap Analysis/PRA Improvement Plan (418103) Objectives: Perform a review of site procedures related to the assessment and management of risk associated with maintenance activities against NUMARC 93-01 guidance. Review gap analysis summary for PI PRA Program and compare to NMC Fleet PRA Standard. Interview and/or observe Work Week Schedulers and Operation personnel on the performance of Maintenance Rule (a)(4) risk assessments. Team Resources:

The review team consisted of one Nuclear Oversight (NOS) Senior Assessor. The NOS Senior Assessor had 16 years of nuclear experience. This included 2 years experience in NOS and 14 years experience in the Engineering and Chemistry departments.

SAMA Follow Up RAI If The Prairie Island Nuclear Generating Plant (PINGP) PRA uses a Westinghouse reactor coolant pump seal loss-of-coolant accident (LOCA) model (WCAP-10541, 1986), that pre-dates the Westinghouse Owners Group (WOG) 2000 model approved by the NRC in 2003 for plants using high-temperature O-rings.

The peer review of the PINGP PRA occurred prior to the approval of the WOG 2000 model, and as such would not have Enclosure 1 NSPM Responses to NRC Requests for Additional Information Dated December 24,2008 identified this as an issue. Provide an assessment of the impact on the severe accident mitigation alternative (SAMA) identification and screening if the PINGP PRA utilized the WOG 2000 model. NSPM Response to SAMA Follow Up RAI If All four of Prairie Island's installed RCPs have been upgraded with high temperature O- rings. High temperature O-rings and hard seal parts manufactured by Areva have been evaluated and accepted as interchangeable with the same parts manufactured by Westinghouse. Westinghouse and Areva O-rings and hard seal parts are installed in various combinations in all four of Prairie Island's installed pumps. However, application of the WOG 2000 seal LOCA model is reserved for Westinghouse-supplied packages with high temperature O-ring seals. In its SER endorsing the WOG 2000 model (WCAP-15603 Rev. 1 A), the NRC stated: WCAP-15603, Revision 1, was published to provide a consensus RCP seal leakage model for those plants that utilize the Westinghouse seal packages with high- temperature O-rings.

The WOG 2000 model does not address the Westinghouse seal packages utilizing old O-rings. The staff expectation is that the Rhodes model will be used to model the Westinghouse seal packages that use old O-rings.

The Areva O-ring seals have been qualified by Jeumont for the same high temperature service as the Westinghouse O-rings and there is no difference in design basis performance characteristics. However, there may be a difference in the beyond design basis ultimate failure pressure characteristics.

At this point in time, this difference has not been resolved.

Therefore, for the purposes of responding to this question, a sensitivity analysis involving a modification to the PRA RCP seal leakage models to conservatively incorporate the Rhodes model (as presented in WCAP-16141, Section 5.0) was developed. In this model, four potential leakage scenarios are postulated:

Table If-1 RCP Seal Leakage Scenarios for the Unqualified Seal Material Timing After Loss of All RCP Seal Cooling I Probability I 1 0-1 3 minutes 1 13 minutes - 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> I > 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> I I

Reference:

WCAP-16141, Table 5-1 g pmlpum p 21 21 2 1 21 These leakage scenarios are referred to as "21/300", "76/300", "1 82/3001', and "480" in the WCAP SBO event tree for a "typical" plant with unqualified RCP seals. gpmlpump 2 1 76 182 480 gpmlpump 300 300 300 480 0.78 0.02 0.195 0.005 Enclosure 1 NSPM Responses to NRC Requests for Additional Information Dated December 24,2008 Figure If-1 below is a reproduction of Figure 5-1 from WCAP-16141:

L OSP RPS OGS AFW OP A RLO ACR 2 or 1 EDGs Core lkrcovery Core Uncovery Core Ihcorery Core chcovery Rx Core lkr- Core Lhcovery Core Uncowry InT11 rnm LOSP Oocurs '&CAF-1614' Figure If-1 SBO Event Tree Addressing RCP Seal Leakage for Unqualified Seal Material 21;300 Tn~Pea IF T42 rnln LF; Fak T1D Fak TDP Fak Fak 0 Al'eS'S In Tt In T21 rnm IDP 76,300 Mn Nan+ FA h Tl? mm In T31 mtn 2 l~r00 1821300 Fak 1 - Fsk Fak hT41 mm 480 iff E2 rnm Fsk I 7&~.300 F* !! in T32 rnm t 82bM1 Enclosure 1 NSPM Responses to NRC Requests for Additional Information Dated December 24,2008 Since the IPE, the PlNGP seal LOCA model has relied on the results of thermal hydraulic analysis cases run using MAAP code 3.0b. This version of the MAAP code is known to be significantly conservative with respect to the timing of core uncovery and core damage following initiation of RCP seal LOCA events. PlNGP is currently in the process of updating its MAAP thermal hydraulic analyses to new cases run using Revision 4.0.6 of the MAAP4 computer code. Currently only a limited set of Sf30 cases have been run and the available case results are considered preliminary.

Therefore, a set of generic thermal hydraulic analysis cases using MAAP4 was used as a check of the preliminary, plant-specific results.

WCAP-16141, Appendix A provides generic core uncovery times for Westinghouse reactor classes, including 2-loop plants such as Prairie Island. The document states: Since the NRC SE item # 7 requires plant-specific analyses for core uncovery times, the value of this appendix can be seen as follows: 1. It provides the minimum factors to be considered in MAAP analyses for specific scenarios for core uncovery.

2. It reports generic core uncovery times that can be compared against plant- specific calculations as a sanity check. Thus, the contents of this appendix could assist in obtaining uniformity of calculation models and results throughout the industry.

Moreover, it is not expected that plant-specific analyses will yield substantially different core uncovery times than those reported in this appendix.

The seal LOCA analysis results for 2-loop plants from WCAP-16141, Appendix A (specifically Table

3) were used as a check on the reasonableness of the timing of core uncovery and core damage provided by the preliminary plant-specific MAAP cases.

Enclosure 1 NSPM Responses to NRC Requests for Additional Information Dated December 24,2008 Table lf-2 below provides a summary of the available MAAP case runs and results and a comparison with the generic case results:

rate after X minutes; X=13 for PINGP, X=30 for WCAP) (2) TDAFWP runs until DC control power is lost (2 hrs assumed for PINGP) (3) CooldownIDepressurization assumed started at t=30 minutes (3a) Cooldown/Depressurization assumed started at t=420 minutes (One hour after AC Power Restored)

(4) AC power restored for initiation of RCS makeup to prevent core uncovery; WCAP-16141 cases did not model this as purpose was to determine time required (5) PINGP runs assume injection systems restored after AC recovery; WCAP-16141 does not credit AC recovery (6) Defined as hottest core node Temperature

> 1800 OF or hottest core exit Temperature

> 1200 F for 30 minutes (PINGP); core exit thermocouples

> 1200 OF (WCAP-16141)

(7) Although AC is restored in MAAP case, it occurs too late to prevent core damage (8) No available MAAP cases for PINGP for these conditions; assumed core damage if TDAFWP fails and AC not recovered within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> Table lf-2 Summary of Available Plant-Specific and Generic MAAP Cases for RCP Seal LOCA The preliminary results for the available plant-specific MAAP cases were found to be reasonably close to the WCAP generic 2-loop plant results. In cases where AC is not recovered in time, core uncovery and core damage occur slightly earlier in these scenarios for the PINGP MAAP cases than for the generic cases. Key contributors to this difference are the assumptions of a higher initial core power level (1 683 MWt vs. 151 8 MWt) and a lower ANV capacity (200 gpm vs. 400 gpm) for PINGP than for the generic case. The plant-specific case runs ended between t=12 hours to t=24 hours (depending on the scenario), whereas the WCAP generic runs were allowed to run for a longer period. Based on these results, a SBO event tree model for PINGP based on the Rhodes model presented in WCAP-16141, Section 5.0, was developed, except that only those event tree branches corresponding to the largest seal leakage assumption (480 gpmlpump) were included, as there are no available plant-specific or generic MAAP cases that model the Rhodes assumption of a 300 gpm leak occurring at 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. This treatment provides a very conservative, bounding model for SBO; however, the results are Pump Seal Leakage Rate (1) (gpm) (1) Presented in WCAP-16141, Appendix A, Table 3 format (initial seal leakage ratelleakage Secondary Side Heat Sink (2) Yes Yes Yes No PI NGP- Specific 0121 0 1480 01480 01480 WCAP- 161 41 21121 21 1480 211480 21 1480 RCS Cooldown and Depress- urization No No Time to Core Damage (hrs)

(6) PINGP- Specific (no CD) (no CD) 2.3 NlA(8) WCAP 161 41 33.8 7.5 2.4 2.2 Time of AC Recovery (hrs)

(4) Time of Core Uncovery (hrs) (5) PINGP- Specific 6 6 5 (7) 1 PINGP- Specific (no CU) 5.3 1.8 N/A(8) WCAP- 161 41 No No No No WCAP- 161 41 32.2 6.2 1.9 1.8 Enclosure 1 NSPM Responses to NRC Requests for Additional Information Dated December 24,2008 responsive to the RAI question. Figure lf-2 below provides a graphical representation of the event tree model that was used for this sensitivity case:

/ INITIATOR I AFT I OA7 I RLO Statlcn TD AFW Punp Operator RCP Seal Blacked Rum fa 2 hrs Leakage Depffis ACS Rwvry (to Invmtay lnvmtay nttlte HPI pror to core 01 so*, 1 IbW 0.- so*, 2 <Dm 0.- SOW 3 row l,.rng mm14 OK ¶OW5 (Il*D.MZ 'BOW6 0nD.w 'BOW-7 <hn Damg 'BOW8 OK ¶O+W9 CD~ Domqc SOW-LO Ibwo.mg 'BOW-,, (be DIl"apc SOW 12 Figure lf-2 SBO Event Tree for Sensitivity Analysis (Bounding 480 GPMIPump Leakage Case Assumption)

Note that the four potential leakage scenarios modeled in WCAP-16141 Figure 5-1 (21 1300, 761300, 1 821300, and 480) have been conservatively reduced to only one, the 480 gpm case, based on a lack of available plant-specific MAAP analyses for the other cases. This treatment effectively assumes that, on any SBO event, a 480-gpm per pump leakage event occurs at t=13 minutes with a probability of 1 .O. Only the RLO (assumed leakage scenario) and ACR (AC Power Recovery) event tree headings represent changes to the existing SBO event tree logic in the PRA model; all of the failure logic associated with the other event tree headings already exist in the PRA model and were not changed for this sensitivity analysis. Required power recovery times were chosen based on the results of the (preliminary) plant-specific MAAP analyses for the 480 gpm per pump leakage case (see Table lf-2). It was assumed that power must be restored within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> in order for the operator to successfully start and align injection systems to prevent core damage in the event that the turbine-driven AFW pump successfully operates for 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />, and operator action to cool down and depressurize the RCS at 30 minutes is successful. It was assumed that power must be restored within the first hour in the cases where either AFW fails to operate or cooldown and depressurization is Enclosure 1 NSPM Responses to NRC Requests for Additional Information Dated December 24,2008 unsuccessful. Failure of power recovery results in core damage regardless of the leakage scenario.

Table lf-3 provides the results of the sensitivity analysis (SBO contribution) compared to the original PRA SBO contribution as presented in the response to SAMA RAI 1 b in the NSPM letter dated November 21, 2008: Table lf-3 Change in SBO CDF Contribution Over Baseline I SBOCDF I Model Sensitivity Case Contribution I (per rx-yr) Comment Sensitivity case assumes 480 1.04E-06 The results of the sensitivity analysis show that when the impact of moving to the more accurate RCP seal LOCA thermal hydraulic calculations of MAAP 4.0 is taken into consideration, the contribution of SBO remains small even when assuming much higher seal leakage rates very early in the event. As shown in Table If-1 above, the probability that an RCP seal leakage event scenario will be less severe than 480 gpm (even for unqualified seals) is over 99%. Therefore, when sufficient plant-specific MAAP analysis case runs are available to allow modeling of the lower leakage rates specified in the Rhodes model (similar to that shown in Figure If-1 above), it is anticipated that the SBO contribution to the overall CDF will actually be significantly lower than it was calculated to be in the Rev. 2.2 SAMA version. gpmlpump leakage for all SBO events; core uncoveryldamage timing is based on MAAP 4.0 TH analysis Baseline (Rev. 2.2 SAMA) Change: Based on the results of the sensitivity analysis presented above, NSPM believes that there would have been no impact on the SAMA identification and screening presented in the ER had an RCP seal leakage model consistent with more currently acceptable methodologies been utilized in the PlNGP PRA model. SAMA Follow Up RAI I h 8.52E-07 1.90E-07 Based on the description provided, the dominant internal flooding sequence (involving cooling water header rupture) would result in core damage at both units. The benefits of any related SAMAs should therefore be doubled. Identify all sequences resulting in core damage at both units. Confirm that the benefits for related SAMAs were appropriately assessed, i.e., doubled where appropriate. (Also see RAI 5.b) Baseline assumes WCAP-10541 leakage and seal failure probabilities; core uncoveryldamage timing is based on MAAP 3.0b TH analysis = (22% increase over baseline)

Enclosure 1 NSPM Responses to NRC Requests for Additional Information Dated December 24,2008 NSPM Response to SAMA Follow Up RAI 1 h The PINGP PRA model is a linked fault tree model that quantifies Unit 1 and Unit 2 core damage risk independently. The impact of loss of equipment that is shared, such as the Cooling Water system, is modeled explicitly in the failure logic for both units and is reflected separately in the risk metrics for each unit. Similarly, equipment that exists on one unit but that can be cross-tied or otherwise put into service to support the other unit is modeled explicitly. This allows the model to account for the fact that, on a dual-unit initiating event, equipment on one unit that would otherwise be available to provide a support function for the opposite unit, may not be available. All SAMAs were evaluated with attention to the potential decrease in risk to each unit individually. Therefore, there is no need to "double" the core damage risk benefit for any of the SAMAs evaluated.

Also, a number of SAMAs were developed that have a positive risk benefit to both units (generally these SAMAs involve enhancements to equipment that is either shared by both units or that is crosstie-able between units).

Typically these SAMAs are implemented by a single modification that provides benefits to both units. As previously discussed, the costs associated with these modifications were evenly apportioned between the units (this is appropriate since the risk-reduction benefit to each unit is determined separately). This process ensures that the benefits for these SAMAs were appropriately assessed. SAMA Follow Up RAI 2b The last paragraph of the RAI response provides a qualitative comparison of the conditional probabilities of the steam generator tube rupture (SGTR) under specific primary and secondary side conditions, but does not include a characterization of the PINGP-specific results for induced SGTR. Provide the frequency-weighted conditional probability of temperature induced-SGTR (over all sequences involving high primary side and low secondary side pressure, and a dry secondary side) for PINGP. Provide an assessment of the impact on the SAMA identification and screening if a conditional probability of 0.25 (similar to NUREG-1 570) is assumed for these sequences. NSPM Response to SAMA Follow Up RAI 2b NSPM understands this question to be asking for the impact to the SAMA results given the assumption that containment bypass due to induced SGTR from any cause (not only TI-SGTR as identified in the question) occurs with a probability of 0.25 following any core damage sequence involving high primary side and low secondary side steam generator pressure, and a dry steam generator secondary side. This is consistent with the NUREG-1 570 induced SGTR baseline case results for Surry presented in NUREG-1 570 Table 5.8 and described in NUREG-1 570 Section 6.1.

As discussed during the December 9, 2008, conference call with the NRC staff, NSPM could not identify any NUREG-1 570 results showing a 0.25 conditional probability of TI-SGTR alone.

Enclosure 1 NSPM Responses to NRC Requests for Additional Information Dated December 24,2008 Tables 2b-1 and 2b-2 below show the Unit 1 and Unit 2 95th percentile cost-benefit results, respectively, as modified by the NSPM responses to SAMA RAI questions 6.b and 6.g in the NSPM letter of November 21, 2008. Note that the positive net values (indicated by bold italics) for SAMAs 9 and 22 on both units, and SAMA 19a on Unit 2, indicates that they were found to be cost beneficial on those units.

In the tables below, the increased cost of implementation of SAMA 2 described in the response to SAMA RAI 6.b has been reflected in the tables, as has the corresponding increase in the cost of implementation for SAMA 12 (SAMA 12 assumes the modifications associated have also been installed).

In addition, the cost associated with SAMA 20 has been modified as described in the response to SAMA Follow-Up RAI 6c below. Table 2b-1 Table 2b-2 Enclosure 1 NSPM Responses to NRC Requests for Additional Information Dated December 24,2008 Tables 2b-3 and 2b-4 provide the same information for each unit, but the averted cost- risk values include the increased value due to the assumption that ISGTR occurs with a conditional probability of 0.25 following a High-Dry core damage event. Table 2b-4 Unit 2 95th Percentile Results per SAMA Uncertainty I I I I I I Table 2b-3 Unit 1 95th Percentile Results per SAMA Uncertainty Cost of 1 Ratio of 95th 1 Unit 2 Averted 1 Net Value 1 / ID 1 Implementation to SAMA CDF Cost-Risk SAMA ID SAMA 1 SAMA 2 SAMA 3 SAMA 5 SAMA 9 SAMA 10 SAMA 12 SAMA 15 SAMA 17 SAMA 19 SAMA 19a SAMA 20 SAMA 21 SAMA 22 Cost of Implementation

$4,250,000

$1,200,000

$250,000 $1,500,000

$62,500 $2,866,000

$1,800,000

$1 30,000 $2,362,000

$700,000 $1,935,000

$244,000 $3,000,000

$39,000 SAMA 1 SAMA 2 SAMA 3 Note that, under the hypothetical assumption that 25% of High-Dry core damage sequences lead to ISGTR, SAMA 3 (Provide Alternate Flow Path from RWST to Charging Pump Suction) becomes cost-beneficial on both units.

SAMA 5 SAMA 9 SAMA 10 SAMA 12 SAMA 15 SAMA 17 SAMA 19 SAMA 19a SAMA 20 SAMA 21 - SAMA 22 However, this assumption is based on results generated in NUREG-1 570, which used the Surry plant (3-loop PWR) as the baseline plant. As described in the response to Ratio of 95th to SAMA CDF 2.89 2.69 2.75 2.86 2.87 2.84 2.79 2.90 2.89 2.86 2.77 2.85 2.91 2.89 $4,250,000

$1,200,000

$250,000 $1,500,000

$62,500 $2,866,000

$1,800,000

$1 30,000 $2,362,000

$700,000 $1,935,000

$244,000 $3,000,000

$39,000 Unit 1 Averted Cost-Risk

$1,868,573

$578,252 $386,974 $1 14,588 $340,502 $204,758 $794,683 $0 $265,104 $1 72,668 $1,756,854

$1 53,784 $222,090 $1 52,585 2.82 2.79 2.71 Net Value -$2,381,427

-$621,748

$136,974 -$1,385,412

$2 78,002 -$2,661,242

-$1,005,317

-$130,000

-$2,096,896

-$527,332

-$178,146

-$90,216 -$2,777,910

$1 13,585 2.89 2.75 2.86 2.92 2.84 2.86 2.87 2.74 2.85 2.76 2.84 $2,034,256

$646,787 $422,548 -$2,215,744

-$553,213

$172,548 , $520,978 $355,554 $224,331 $1,236,665

$117,199 $1,429,419

$1 72,989 $3,534,505

$1 56,367 $263,556 $356,733 -$979,022

$293,054 -$2,641,669

-$563,335

-$12,801 -$932,581

-$527,011

$1,599,505

-87,633 -$2,736,444

$3 1 7,733 Enclosure 1 NSPM Responses to NRC Requests for Additional Information Dated December 24,2008 SAMA RAI 2.b in the NSPM letter of November 21, 2008, the ISGTR analysis incorporated in the Rev. 2.2 SAMA PRA model is based on a methodology developed specifically for Westinghouse 2-loop plants (WCAP-16341 -P). This methodology was developed with the knowledge of NUREG-1 570 and other more recent analyses of the potential for ISGTR. Therefore, NSPM does not feel that the assumption that 25% of High-Dry core damage sequences lead to ISGTR is valid for Prairie Island.

Further, as described in the response to RAI question 8.i, NSPM has already agreed to further assess the cost benefit of a proposed steam generator safety valve gagging device that could significantly reduce the risk associated with ISGTR. Therefore, NSPM does not plan to further assess the potential for implementation of SAMA 3. During the validation of this response a discrepancy was identified in the baseline ISGTR sequence quantification in the Rev. 2.2 SAMA model. Specifically, a Small LOCA core damage sequence that did not involve dry SG conditions was included in the ISGTR quantification, while another Small LOCA core damage sequence which did involve dry SG conditions was not included. The sequence that was included has a much higher frequency than does the sequence that was not included, and there are no subsequent failure events included in the ISGTR models that would be negatively impacted had the correct sequence been used; therefore, use of the model without dry SG conditions provides conservative results for the ISGTR quantification.

All of the results presented thus far (in the ER and in the RAI responses, including this one) include the conservative treatment. Therefore, the set of SAMAs that has been identified as cost beneficial to date represents an upper bound relative to ISGTR (i.e., correction of the discrepancy may show that SAMA 3 is not cost-beneficial). This discrepancy is being entered into the Corrective Action Program for resolution.

SAMA Follow Up RAI 3a and 3b In order to support the assumption that the fire core damage frequency (CDF) is comparable to the internal events CDF (9.79E-6 for Unit 1 and 1.21 E-5 for Unit 2), it should be shown, preferably through sensitivity analysis or other quantitative arguments, that the individual plant examination of external events (IPEEE) fire CDF value (4.9E-5) is conservative by a factor of 4 to 5 (for Units 2 and 1, respectively).

The information provided in the RAI response is general and qualitative in nature, and does not sufficiently demonstrate that such a large reduction in the fire CDF is appropriate (For example, the discussion of control room fires [65% contributor] states that partitioning of a cabinet within a panel zone was not credited. What is not stated is that the main control panel is a contiguous arrangement of panel sections without barriers or boundaries. The IPEEE used partitioning process of overlapping zones [25 zones] to subdivide the panel based on consideration of nominal panel fire heat rate, nominal heat value of the cable bundle, available fire suppression time of 15 minutes and the general vertical propagation tendency of fire in open back panels.

Therefore, the zones are subdivided panel sections. In addition, the statement that manual suppression credit was only applied to cutsets representing 43% of the internal fires CDF appears to be misleading.

The IPEEE indicates that manual suppression was applied to all control room fires with a 10 minute fire suppression failure probability of 1.6E-2.).

However, the 46 percent Enclosure 1 NSPM Responses to NRC Requests for Additional Information Dated December 24,2008 reduction in the conditional core damage probability (CCDP) since the IPEEE cited in the response (p. 23) would suggest that a factor of 2 reduction in CDF might be justified. Provide additional information on how the CCDP was computed, and on how the events on which it is based relate to the dominant fire events. Clarify whether the CCDP value includes station blackout events. NSPM Response to SAMA Follow Up RAI 3a and 3b A complete update to the fire PRA models provided in the Fire IPEEE is not yet available.

In its response to SAMA RAI 3b of November 21, 2008, NSPM provided as much quantitative evidence that the risk due to internal fires is lower than calculated in the IPEEE as was reasonably available.

The fire IPEEE stated clearly that the control room panels are subdivided panel sections. This fact is not relevant to the point made in the response.

Further subdivision of panel zones for refinement of the analysis was not performed in the IPEEE. The linear length of each analysis "zone" was taken to be 10 feet, and each zone overlapped with the zones adjacent to it such that damage to components located within any main control board area was assumed to result from a fire initiated within either of two panel zones. Also, the assumption that any fire (regardless of intensity, location or other factors) that initiates within a panel zone damages all equipment within the panel zone is very conservative.

Current control room analysis methodologies would allow further refinement to credit the potential for self-extinguishment given separation between combustibles within panel zones and cable and component materials used within the panels. The statement in the RAI response that manual suppression credit was only applied to cutsets representing el 3% of the internal fires CDF is correct. The statement in the follow-up question, "The IPEEE indicates that manual suppression was applied to all control room fires with a 10 minute fire suppression failure probability of 1.6E-2," is incorrect. This value was used in the control room fire closeout strategy scenario document, attached to the IPEEE report as Appendix B, Attachment 2 (ERIN Engineering Calculation 130-98-01, Fire Area Scenario for FA 13, p. 7 and p. A-1 3). This document provides the initial development of the control room analysis, but the quantitative portions of this document were used only for initial screening of the control room (Fire Area 13). The control room did not screen out, and the analysis was further refined for the final IPEEE quantification.

Page A-1 3 of the scenario document provides the event tree used in the initial screening quantification, and shows the 1.6E-2 manual suppression failure probability value. However, the diagram also shows that credit for manual suppression was only applied to fires that were large enough to propagate beyond the boundaries of the initiating panel zone. As shown on the diagram, only 8.3%

of fires were assumed to be fires of this magnitude (this event tree and severity factor were carried through the final analysis quantification).

In the final, overall fire IPEEE quantification results (including control room fires and fires in ail other fire areas), credit for the potential for successful fire suppression was only applied to cutsets representing

<13% of the internal fires CDF.

Enclosure 1 NSPM Responses to NRC Requests for Additional Information Dated December 24,2008 Note that the final probability value for failure of manual suppression of control room fires used in the final IPEEE quantification (4.OE-2) was higher than that shown on the diagram on page A-1 3 of the control room scenario document, while the probability of failure of the operators to successfully shut the plant down from outside the control room (given failure of manual suppression) was lower (6.4E-2). However, in the final quantification for the IPEEE, the overall sequence CCDP (given a fire initiating in the control room) was actually higher by over 60% than that shown on page A-1 3 of the scenario document (see Table 3ab-1 below). The 46 percent reduction in the conditional core damage probability (CCDP) since the IPEEE, cited in the response, applies to normal (or general) plant transient-initiated events. This value was computed by comparing the CCDP of the I-TR1 (normal transient) initiating event from the Level 1, Rev. 1 internal events model results, to the CCDP for the corresponding initiating event (1-1 -TR1) in the Rev. 2.2 SAMA model (The Fire IPEEE PRA model was built upon the Level 1, Rev. 1 Unit 1 -only internal events PRA model). The TR1 initiating event CCDP is relevant to fires that result in a unit shutdown (with appropriate accounting for fire-induced equipment damage) but that do not result in a fire-induced LOCA or other more complicated transients such as loss of main feedwater or SBO. This is generally considered to be the most likely transient to occur following an initiating fire event at PINGP. Table 3ab-1 Control room abandonment sequence CCDP: Change from scenario document to that used in final IPEEE fire PRA results However, as described in the NSPM response to SAMA RAI 3b, the IPEEE results showed that the dominant fire initiating events are fires in control room panel zones 5 and 6, which together account for approximately 40% of the total fire-induced CDF. These events are assumed to involve loss of main feedwater (MFW) and auxiliary feedwater (AFW). The reduction in CCDP associated with loss of MFW events (the I- TR4 initiating event in the Level 1, Rev. 1, model compared to the 1-1 -TR4 initiating event from the Rev. 2.2 SAMA model) is 31.7%. This CCDP reduction also applies to the most risk-significant fires from Fire Area 32 (Auxiliary Feedwater Pump/lnstrument Air Compressor Room), which also involve loss of MFW, and other initiating events that were not screened out of the IPEEE analysis.

FA 13 Scenario document Final IPEEE parameters Also, as described in the NSPM response to SAMA RAI 3b, the IPEEE results showed that fires in control room panels leading to LOOPISBO account for approximately 11 % of Fire Severity (% that are Large fires) 8.30E-02 8.33E-02 Sequence CCDP increase over scenario document assumptions

= Manual Suppression (failure of) 1.60E-02 4.00E-02 61 % Shutdown from Outside CRM (failure of) 1.00E-01 6.40E-02 Sequence CCDP 1.33E-04 2.13E-04 Enclosure 1 NSPM Responses to NRC Requests for Additional Information Dated December 24,2008 the total fire-induced CDF. Although the SBO contribution to core damage was not directly quantified for the Level 1, Rev. 1, internal events model update, the loss of offsite power (LOOP) initiating event contribution was quantified.

The reduction in CCDP associated with LOOP events (the I-LOOP initiating event in the Level 1, Rev. 1, model compared to the I-LOOP initiating event from the Rev. 2.2 SAMA model) is 80.6%. LOOP events in which onsite AC power from the emergency diesel generators is available following an accident progression are similar to a loss of MRN initiating event (see discussion regarding reduction of the CCDP associated with loss of MFW in the preceding paragraph). As shown in Table If -3 above, the CDF contribution associated with SBO events was calculated to be 8.52E-7/rx-yr for the Rev. 2.2 SAMA model. However, as described in the response to SAMA Follow Up RAI If above, when sufficient plant-specific MAAP analysis case runs are available to allow modeling of the lower leakage rates specified in the Rhodes model, it is anticipated that the SBO contribution to the overall CDF will actually be significantly lower than it was calculated to be in the Rev. 2.2 SAMA version. An upgrade to the internal fires PRA is currently being developed as part of the fire protection program transition to one meeting the risk-informed, performance-based fire protection rule, 10CFR50.48~~ which endorses National Fire Protection Association (NFPA) Standard 805 (NFPA-805).

A number of tasks have been preliminarily completed for this upgrade, including a revision to the most risk-significant internal fires initiating event frequencies from the IPEEE. This analysis is based on the methodology of NUREG/CR-6850. The preliminary results of this analysis show that the fire initiating event frequencies for the most risk significant fire areas for the IPEEE, (i.e. fires in Fire Areas 13 and 32, Control Room and ARN/lnstrument Air Compressor Room), are lower than calculated for the IPEEE, as shown in Table 3ab-2 below:

(1) From PlNGP IPEEE Table B.2.6.3 Table 3ab-2 PlNGP Fire initiating Event Frequency Comparison: . -- IPEEE vs. Preliminary FPRA Upgrade Calculated Values SAMA Follow Up RAI 5a IPEEE Dominant Fire Area 13 32 It is understood from the response that improved training will not provide any additional benefit. However, the failure probabilities of 1.9E-02 and 5.3E-02 appear to have room for improvement. Explain the characteristics of these actions (and the calculator used to Change -41 % -42% Description Control Room "B" Train Hot Shutdown PanelIAFWlIA Compressor Room IPEEE Fire CDF Contribution 65.3% 16.7% IPEEE IE Frequency (per year) (1) 2.04E-02 4.48E-03 Preliminary FPRA Upgrade IE Frequency (per year) 1.20E-02 2.60E-03 Enclosure 1 NSPM Responses to NRC Requests for Additional Information Dated December 24,2008 determine its value) that prevents lower calculated values given excellent training and emergency operating plan-driven direction.

NSPM Response to SAMA Follow Up RAI 5a As discussed in the original RAI response, the two operator actions of concern are:

OSLOCAXXCDY:

Operator Fails To Perform RCS Cooldown and Depressurization on Small LOCA (Failure probability of 1.92E-02)

OHRECIRCC2Y:

Operator Fails To Initiate High Head Recirculation Conditional on Failure of RCS Cooldown and Depressurization (Failure Probability of 5.3E-02) The human reliability analysis (HRA) was performed using Version 3.0 Beta of the EPRl HRA calculator. This calculator uses the Caused-Base Decision Tree Methodology (CBDTM) together with tables from NUREGICR-1278 (USNRC Technique for Human Error Rate Prediction (THERP)).

This is consistent with the EPRl HRA Users Group HRA Methodology and consistent with the state-of-the-art in the industry. The impact of timing, experienceltraining and procedures were factored into the analysis.

In general, EOP direction and training is assumed for using the CBDT method. In addition, the CBDT method credits general and specific training in scenarios where there could be problems with the operator information or operator-procedure interfaces. Thus, for relatively standard EOP scenarios, which implicitly assume procedural direction and training, one can not drive the numbers lower by crediting "better" training. Had there been no EOP direction or training, the CBDT method could not be used, and the Human Error Probability (HEP) numbers would be in the order of 1 E-01. The THERP tables used in the analysis also assume Rule Based Actions are being modeled. Other factors may also influence the HRA calculation.

Further review was conducted on the two operator actions listed above to determine how other factors, such as timing and dependencies, impact the HEP analysis.

OSLOCAXXCDY Assessment:

Review of OSLOCAXXCDY determined that the dominant contributor to the overall Human Error Probability (HEP) was the execution probability.

The execution probability is approximately 84% of the overall total HEP. The execution probability was determined to be 1.6E-02. There were 19 critical operator steps identified from the EOP for this action. The timing analysis was also reviewed.

For operator action OSLOCAXXCDY, the timing analysis plays a critical role in the ability to credit recovery for the execution portion.

Due to the limited time available for recovery (approximately 5 minutes) no recovery credit was applied to the execution probability; this resulted in a relatively high HEP value of 1.9E-02. The time available for recovery is brief since it would take approximately 2.6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> to perform the required actions (cooldown and depressurize the Enclosure 1 NSPM Responses to NRC Requests for Additional Information Dated December 24,2008 Reactor Coolant System and lineup Residual Heat Removal (RHR) system for shutdown cooling).

This is almost the same time it would take the Refueling Water Storage Tank (RWST) to reach its low level alarm

(-2.7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br />). This operator action is discussed in detail in Enclosure

2. OH RECI RCC2Y Assessment: Operator action OHRECIRCC2Y (Operator Fails To Initiate High Head Recirculation Conditional on Failure of RCS Cooldown and Depressurization) involves the failure of the operator to initiate high head recirculation following a small LOCA conditional of failure of the operator to perform RCS cooldown and depressurization for a small LOCA event (OSLOCAXXCDY).

Since these two operator actions (OSLOCAXXCDY and OHRECIRCC2Y) appear in the same SLOCA initiating cutset, OHRECIRCC2Y is a conditional operator action based on OHRECIRCSMY which is discussed in Enclosure

3. OHRECIRCSMY was calculated using Version 3.0 Beta of the EPRl HRA calculator and used the Caused-Base Decision Tree Methodology (CBDTM) together with the THERP methodology. The total HEP calculated for OHRECIRCSMY is 3.6E-03. The conditional probability of operator action OHRECIRCC2Y, which is derived from OHRECIRCSMY, is quantified by determining the level of dependence.

Many factors may influence the level of dependence such as timing, location, and the relationship between persons performing the actions. An evaluation of the timing associated with this particular core damage sequence (SLOCA initiating event with successful SI Pump injection) shows that there is adequate time between performance of operator action OSLOCAXXCDY and OHRECIRCC2Y (greater than 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />). This is based on the ability to maintain core cooling for several hours (-2.7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br />) with the SI pump injecting RWST water before the low level alarm is reached and transfer to recirculation is required.

In addition, other factors can be evaluated to determine dependency, such as: same crew, cognition (cues/procedures), resources, location and stress. For the OHRECIRCC2Y dependency analysis, the same crew is used (since the time delay is less than the shift length of 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />), different procedures and cues are used for each action, operator actions do not occur at the same time and adequate resources are available since the two operator actions (OSLOCAXXCDY and OHRECIRCC2Y) are not simultaneous.

Also, the stress level associated with the operator action OHRECIRCSMY is Moderate. After reviewing the dependency factors, the most significant being the timing and the stress level, a Low Dependency (LD) was assigned. Based on USNRC Technique for Human Error Rate Prediction (THERP), the conditional probability equation used to determine the HEP value for OHRECIRCC2Y is: OHRECIRCC2Y (Low Dependence)

= (1 + 19N)/20 Where: N = 3.6E-03 (HEP value for OHRECIRCSMY)

Enclosure 1 NSPM Responses to NRC Requests for Additional Information Dated December 24,2008 Note that using the THERP dependency formula approach to determine dependency analysis can be seen as very conservative. However, the THERP approach is standard industry practice. SAMA Follow Up RAI 5b Three candidate SAMAs (6, 6a, and 13) and 2 IPE-identified enhancements related to internal flooding were dismissed on the basis of a cooling water header piping modification in 1992, and deterministic considerations described in a 1995 engineering calculationlwhite paper. However, the IPE and 7 subsequent PRA updates (up to and including the current PRA) continue to model the rupture of the cooling water header. Justify why the piping modification should be credited (for eliminating cooling water header ruptures) in the SAMA evaluation, in view of the fact that the IPE and subsequent PRA updates continue to model these pipe breaks, and that the American Society of Mechanical Engineers PRA standard would call for treatment of such flood sources.

Provide a quantitative evaluation of the costs and benefits of each of the aforementioned SAMAs I enhancements based on the current PRA treatment of cooling water header pipe breaks. NSPM Response to SAMA Follow Up RAI 5b The current PRA model still includes initiating events modeling all of the internal flooding initiating events included in the IPE model (expanded now to include their impacts to both units). The CL header piping modifications and considerations contained in the engineering calculation referred to in the question were used in a previous model update to attempt to model the frequency of flooding events in each class that have a more realistic set of consequences.

Previously the consequences associated with the worst case (and lowest frequency) piping rupture were applied to the entire frequency of potential piping rupture events in each area (most of which are higher frequency, lower consequence events).

This was felt to be skewing the results of the PRA in an overly- conservative manner. It is now understood that this method is not consistent with the PRA standard and will be corrected in a future PRA update; however, this treatment was included in the version of the PRA used for the SAMA analysis.

No SAMAs were excluded from consideration based on either the piping modification or the engineering calculation.

SAMA Follow Up RAI 5d and 5e A review of Table F.5-3 finds that several screened Phase I candidates (i.e., SAMAs 6, 6a, 7, 8, 13, 14 and 16) do not appear to meet the environmental report (ER) Section 4.1 7.1 screening criteria. In addition, the discussion for the basis for screening SAMA 14 does not appear to address the benefit of improved operator training for power-operated relief valve failure to re-seat. Its screening appears to be based on model limitations as Enclosure 1 NSPM Responses to NRC Requests for Additional Information Dated December 24,2008 opposed to actual benefit.

As such, the ER Section F.5.2 criteria do not appear to be consistent with the ER Section 4.1 7.1 criteria.

Confirm that both sets of screening criteria are used. Explicitly identify the ER Section F.5.2 and the ER Section 4.17.1 screening criterion used for each screened SAMA. NSPM Response to SAMA Follow Up RAI 5d and 5e The table below identifies the Phase 1 screening criteria used for SAMAs 6, 6a, 7, 8, 13, 14, and 16. As applied in the ER, this particular screening process was used to identify those SAMAs that were readily observed as not being cost beneficial, and thus not being applicable to the Phase 2 quantification of averted cost-risk.

The process involved cutset reviews and the CDF contribution of those targeted accident sequences for which the SAMAs were developed.

The applicable screening criteria from both Sections 4.1 7.1 and F.5.2 are listed to emphasize that the screening criteria cited in these sections address the same intent. SAMA ID and Description - 6 Consider installing waterproof equipment (valves,level sensors) capable of automatically isolating the flooding source.

Description of Disposition For either unit, Auxiliary Building Zone 7 flooding initiating events account for only about 2% of the CDF and only about 1% of the LERF. The cost and complexity of implementing this SAMA would be significant, involving system modifications that would entail extensive engineering support, specialized hardware and instrumentation, and regulatory analyses to support modifications to the facility. In order to minimize the cost of the modification, the existing ring header isolation MOVs would have to be used (those that currently split the ring header into two safeguards headers on an S- signal on either unit) in order to prevent a dual- unit outage to install new isolation valves. Under this design, however, isolation of an entire train of safeguards equipment (those supplied by CL) to stop the flooding event would leave both units susceptible to a single failure for im~ortant safetv functions. (Sect. Specific Criteria from Section 4.17.1 Candidates with no sianificant benefit in PWRs such as PINGP. Specific Criteria from Section F.5.2 Engineering Judgment:

Using extensive plant knowledge and sound engineering judgment, potential SAMAs are evaluated based on their expected maximum cost and dose benefits; those that are deemed not beneficial are screened from further analysis.

Enclosure 1 NSPM Responses to NRC Requests for Additional Information Dated December 24,2008 SAMA ID and Description

-.-- 6a Consider segregating this zone into 2 compartments to reduce the impact of a flood on both trains of SI and RHR, --- 7 The ability to use non-safety related diesel generators

~3 and ~4 would provide a backup source of power in addition to the existing four safety related diesels Dl, D2, D5, and D6.

8 installation of a swing or SBO diesel would provide increased defense in depth and could be considered for LOOP conditions.

-. Description of Disposition The maximum risk benefit for this SAMA is low (see SAMA 6 discussion above). The Cost of implementing this SAMA is estimated to be significantly greater than that of SAMA 6. Furthermore, this SAMA relies on operator action to identify and isolate the header with the break (the current, pre-SAMA implementation situation). With the higher likelihood of isolation failure due to operator vs. automatic action, a large portion of the risk benefit from this SAMA would not be realized. (Sect. F.5.2.2) SBO is already a small contributor - <8% of CDF, <1% of LERF, <0.02% of early CF.

Top SBO-related release categories involve sequences in which containment and/or vessel does not fail.

Also, significant costs would be incurred to upgrade D3 and D4 to safety-related status, which would ultimately cost more than the benefit gained from a 2% improvement in CDF. (Table F.5-3)

SBO is a significant contributor to CDF for both units (provides about 8% of the total CDF). However, it contributes 4% to the LERF, and <0.02% to the frequency of all early containment failure sequences. All of the top SBO-related release categories involve sequences in which the containment andlor reactor vessel does not fail. The risk benefit of this SAMA is further reduced by the need for operator action (including local actions) for implementation. (Sect. F.5.2.3) Specific Criteria from Section 4.17.1 Candidates whose estimated implementation costs exceed the maximum averted cost-risk and/or candidates with no sianificant benefit in PWRs such as PINGP.

Candidates whose estimated implementation costs exceed the maximum averted cost-risk and/or candidates with no sianificant benefit in PWRs such as PINGP. Candidates whose estimated implementation costs exceed the maximum averted cost-risk.

Specific Criteria from Section F.5.2 Engineering Judgment: Using extensive plant knowledge and sound engineering judgment, potential SAMAs are evaluated based on their expected maximum cost and dose benefits; those that are deemed not beneficial are screened from further analysis.

Engineering Judgment: Using extensive plant knowledge and sound engineering judgment, potential SAMAs are evaluated based on their expected maximum cost and dose benefits; those that are deemed not beneficial are screened from further analysis.

Engineering Judgment:

Using extensive plant knowledge and sound engineering judgment, potential SAMAS are evaluated based on their expected maximum cost and dose benefits; those that are deemed not beneficial are screened from further analysis.

Enclosure 1 NSPM Responses to NRC Requests for Additional Information SAMA ID and Description 13 This initiator represents an internal flooding scenario that disables various safety-relate-j components, Mitigation of this event can be accomplished via an automatic sump pump system to remove water if the operator fails to isolate Zone 7 of the Aux. Bldg.

14 Reinforce operator training to isolate PORVS when symptoms reveal valves have failed to re-seat. This reduces the amount of radioactivity released to the environment.

Consider replacing with more reliable or robust valves to better isolate following lifting. - Dated December 24,2008 Description of Disposition The maximum risk benefit for this SAMA is low (see SAMA 6 discussion above).

The cost of implementing this SAMA would be about the same, or slightly less, than the cost of SAMA 6, however, as with SAMA 6a, this SAMA relies on operator action to identify and isolate the header with the break (the current, pre-SAMA implementation situation). Therefore, a large portion of the risk benefit from this SAMA would not be realized. Also, even with successful operator action, the result is the loss of at least one train of safeguards equipment. (Sect.

F.5.2.4) Existing model considers that failure to close and failure to open lead to the same accident class, GLH (assuming failure of operator to CooldownIDepressurize per ECA 3.113.2, which leads to SGTR source term).

Therefore, quantification of this SAMA modification would produce no difference in the calculated frequency of offsite release or its magnitude. (Table F.5-3) Specific Criteria from Section 4.1 7.1 Candidates with no sianificant benefit in PWRs such as PINGP. Candidates with no sianificant benefit in PWRs such as PINGP. Specific Criteria from Section F.5.2 Engineering Judgment:

Using extensive plant knowledge and sound engineering judgment, potential SAMAs are evaluated based on their expected maximum cost and dose benefits; those that are deemed not beneficial are screened from further analysis.

Engineering Judgment:

Using extensive plant knowledge and sound engineering judgment, potential SAMAs are evaluated based on their expected maximum cost and dose benefits; those that are deemed not beneficial are screened from further analysis.

Enclosure 1 NSPM Responses to NRC Requests for Additional Information Dated December 24,2008 SAMA ID and Description 16 Failure of MV- 321 69 to open disables RHR Loop B return. Proper operation of this valve is most likely tracked via the MR. Consider replacing this MOV with a FC air-operated valve for improved reliability.

This would eliminate CCF for inboard MOVs that currently exist on this flow path.

As described in Section 5.1 .I of the ER, Phase 1 SAMAs were, in part, identified through a review of the importance measures associated with the Rev. 2.2 SAMA model PRA CDF calculation for each unit.

SAMA 14 was identified as a potential Phase 1 candidate SAMA due to the importance measures associated with Unit 2 basic events 2SGTRRLFFTC and 2SGTRRLFSUC. These two events, both having a probability of 0.5, are split fractions that represent failure of a secondary relief valve to close given SG overfill following a SGTR event and successful closure of all relief valves, respectively. Both events have the same probability (0.5) and in the baseline PRA quantification, success or failure of this event tree top event heading leads to an identical accident progression (operator action to depressurize the plant to the point at which RHR shutdown cooling can be placed in service is required to prevent core damage). This treatment essentially gives no credit for the fact that the valves may successfully reclose; the existence of this event tree top event heading is only for sensitivity purposes and does not otherwise play a role in the PRA. Description of Disposition Failure of this valve to open results in failure of shutdown cooling initiation (there is no CCF ' for inboard MOVs that currently exist for the flow path involved in these sequences).

This may not have any positive impact on CDF (FC air-operated valve inside containment may be less reliable than a MOV due to reliance on containment instrument air supply) and would have little, if any, impact on LERF. (Table F.5-3) Note that in the response to SAMA RAI 8(i) in the letter of November 21, 2008, NSPM stated that it had entered the proposed SAMA (SG relief valve gagging device) into the Corrective Action Program for a more detailed examination of viability and implementation cost. This proposed plant modification, if proven to be cost beneficial and implemented, would effectively reduce the offsite dose risk associated with stuck open safety relief valves on SGTR events. Specific Criteria from Section 4.17.1 Candidates whose estimated implementation costs exceed the maximum averted cost-risk and/or candidates with no sianificant benefit in PWRs such as PINGP.

Specific Criteria from Section F.5.2 Engineering Judgment:

Using extensive plant knowledge and sound engineering judgment, potential SAMAs are evaluated based on their expected maximum cost and dose benefits; those that are deemed not beneficial are screened from further analysis.

Enclosure 1 NSPM Responses to NRC Requests for Additional Information Dated December 24,2008 SAMA Follow Up RAI 59 Based on the description provided, the dominant internal flooding sequence (involving cooling water header rupture) would result in core damage at both units. Provide an evaluation of a less extensive, alternative SAMA that would limit water damage to the systems, structures, and components for a single unit (so that core damage would be limited to one unit). Provide the costs and benefits for this alternative.

NSPM Response to SAMA Follow Up RAI 59 The dominant internal flooding sequence involves a CL header rupture in the Component Cooling heat exchanger room in the Auxiliary Building.

This room is located in the basement of the Auxiliary Building, near the center of the building between the two units. However, the equipment in the room is not separated by unit; rather, it is separated by train. The Train A CC heat exchangers and pumps are located on the "Unit 1" side of the room, while the Train B CC heat exchangers and pumps are located on the "Unit 2" side of the room. The PRA model assumes that, due to the potentially high flow rate out the break and water spray potential, both pumps on the break side of the room are affected.

In order to stop the flow out the break, the operators would have to isolate the ruptured CL header.

Therefore, a wall or other flood-limiting barrier down the middle of the room would leave one CC pump and heat exchanger operable in the non-isolated train on the side of the room without the break.

If that one remaining pump failed to function, or happened to be out of service for maintenance (for example) when the event occurred, all CC would be lost to both units, even though the CL header break was successfully isolated.

An attempt to construct barriers to protect both CC trains for one unit would have a similar problem; on any CL piping rupture at least one train of CC would still be lost on both units.

Any of a number of single failures in the opposite train would lead to loss of all CC on the unit with the flood protection installed. Therefore, it is not practical to design a flood barrier that can protect one unit at the expense of the other. This also goes against the design philosophy of the plant which is to design and install safety measures that will protect both units. SAMA Follow Up RAI 6c The life-cycle cost is identified as $1 00K. However, SAMA 20 changes a normally open motor-operated valve to normally-closed.

Demonstrate that this change will add

$1 00K additional life-cycle cost to an existing valve. In addition, the noted design cost reduction of 30% does not yield the reduced second unit cost.

Address this apparent discrepancy.

NSPM Response to SAMA Follow Up RAI 6c Plant operation with these valves normally closed would require that the valves automatically open following a LOCA event to supply flow to the reactor vessel. Failure of these valves to open would contribute to loss of low head injection capability during LOCA events. To ensure valve operability, periodic cycling of valves and general maintenance will be required at a cost of $1 00,000 per unit. Additional reviews of these Enclosure 1 NSPM Responses to NRC Requests for Additional Information Dated December 24,2008 life-cycle costs revealed these costs would be inherent to maintaining these valves whether the valves are open or closed. Therefore, the $1 00,000 per unit life cycle costs were removed from the cost estimate for SAMA 20 as indicated below. Although this lowered the cost estimate for SAMA 20, the analysis demonstrated that implementation would not be cost beneficial. Order-of Magnitude Cost Estimate for SAMA 20 SAMA ID No.: 20 Title: Close Low Head Injection MOVs to Prevent RCS Backflow to SI System

Description:

Change the safety-related motor-operated low head reactor vessel injection valves (one valve in each Emergency Core Cooling System train) from normally open to normally closed. Valves would need modifying by drilling a hole in the upstream disk in order to eliminate any pressure locking concern. Assumptions:

Each valve will be placed in the closed position (or verified closed) by the control room operator prior to entering the appropriate Tech Spec MODE and each valve will receive, as it does presently, an "S" (safety injection) signal-therefore, in order to implement this alternative, procedure and drawing changes are required.

The design requirements for the valve and its motor operator which were in effect at the time the valve was a normally closed valve are still valid. The current valve design will support the modification to eliminate any pressure locking concern. The valve MEDP (maximum expected differential pressure) and actuator will not be changed by this modification. Minor changes in the wedge friction factor may occur, but will not change the valve actuator or its settinas.

-- PHASE StudyIAnalyses - - Design - ITEM 1 2 -- - - - -- . 3 4 I Implement 16 17 5 - -- - RESOURCE Contract Labor PlNGP Support Contract Labor Contract Labor Contract Life Cycle - ESTIMATE UNIT 1 $40,000 $1 2,000 FUNCTIONAL AREA Engineering Design Studies Engr / Ops / Lic Labor PlNGP Support 8 9 GRANDTOTAL I ESTIMATE UNIT 2 $40,000 $1 2,000 Engr Design - Mech 1 Civil Engr Design - Elec / i&C Main / Cont Engineering 10 1 $268,000 1 $220,000 Engr / Ops / Maint Labor Materials PlNGP SUDDO~~ Note: The cost estimate for the second unit reflects a saving of approximately 30% on the Design Phase. $60,000 $60,000 $50,000 $2,000 Labor $42,000 $42,000 $40,000 $50,000 $2,000 Material & Material Mgmt Engr / Ops / Lic $28,000 Ops / Maint for 20 years $1,000 $3,000 $1,000 $3,000 0 0 Enclosure 1 NSPM Responses to NRC Requests for Additional Information Dated December 24,2008 SAMA Follow Up RAI 6.9 The corrected treatment of uncertainties shows SAMA 19a as potentially cost beneficial.

Discuss Nuclear Management Company's plans for further evaluation or implementation of this SAMA. NSPM Response to SAMA Follow Up RAI 69 Since the results of the corrected treatment of uncertainties show SAMA 19a as potentially cost beneficial, the benefits for replenishing RWST from a large water source should be considered further. Other engineering reviews are necessary to determine ultimate implementation.

SAMA 19a has been entered into the PlNGP Corrective Action Program for further evaluation.

Enclosure 2 OSLOCAXXCDY, Operator Fails To Perform RCS Cooldown And Depressurization CBDTMrrHERP 04/23/05 J. F. Grobbelaar, SClENTECH I 1 Initial Conditions: Steady state, full power operation.

2. Initiating Event: Small LOCA

3. Accident sequence (preceding functional failures and successes): Reactor trip (reactor trip and bypass breakers are open). Turbine trip (both turbine stop valves are closed). Both safeguards buses are energized.

SI is actuated and required.

AFW flow greater than 200 gpm. PORVs closed RCS pressure > 1250 PSlG 4. Preceding operator error or success in sequence: Entered 1 E-0. Transferred to 1 E-1 from 1 E-0 step 12. Stopped RCPs

5. Operator action success criterion:

Cooldown and depressurize the RCS to Mode 5, Cold Shutdown conditions following a loss of reactor coolant inventory.

6. Consequence of failure: High head recirculation would be required.

7. Key assumptions: RCPs not running Enclosure 2 OSLOCAXXCDY, Operator Fails To Perform RCS Cooldown And Depressurization The most critical steps in 1 ES-1.1 are to start the cooldown (step 6) and to depressurize (step 9). The depressurization will not work (pressurizer level and subcooling) without cooldown, so failure to cooldown will be "recovered" by depressurization. There are numerous steps in the procedure checking pressurizer level and subcooling, hence recovering depressurization and therefore cooldown. Other Procedure Job Performance Measure Classroom Training TW 1 42 Minutes Tdelav 1 15 Minutes 1C15 RH-5s Frequency:

.5 per year (cognitive)

SPAR-H Available time I 1 Minutes Ti12 TM Time available for recovery SPAR-H Available time The time to reach recirculation switchover (33% RWST level) for Small LOCA is 2.7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> (1 62 minutes) from calculation file V.SPA.93.004, "PI SLOCA WIARN, 2 SI, 2 Accum, 1 FCU, No Recirc". RHR can be put in service when the RCS hot leg temperature is less than 350 F.

Time to cool down from 547 F to 350 F at 100 F/hr would take about 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />

= 120 minutes. The system time window is taken as the time to reach recirculation switchover reduced by the actual time that it would take to cooldown and depressurize, which is 162 - 120 = 42 minutes. This is conservative as it does not take the effect of the cooldown on flow rate into account, and it does not take the stopping of 1 SI pump into account.

0 Minutes 22 Minutes 5 Minutes 5 Minutes Per the operator interviews, it takes 15 minutes to navigate to ES-1 .l, so Td = 15 minutes.

Per JPM RH-5S, the time for completion to put RHR in shutdown cooling is 12 minutes. The manipulation time from 1 ES-1.1 step 10 onwards is included in the 120 minutes for cooling down, so it does not have to be accounted for in Tm. The important manipulations are to start the cooldown (step 6) and depressurization (step 9). The first 9 steps are estimated to take less than 10 minutes, so the total manipulation time to be accounted for is Tm = 22 (12 + 10) minutes.

Enclosure 2 OSLOCAXXCDY, Operator Fails To Perform RCS Cooldown And Depressurization Pcd: Information misleading a neg . PC,: Skip a step in procedure 3.0e-03 P,+: Misinter~ret Instructions nea. Cognitive Complexity I Simple Equipment Accessibility I Main Control Room: Accessible PC,: Misinterpret decision logic Pch: Deliberate violation initial P,(without recovery credited)

-- PC~ I neg. - - I 1.0 Final PC (with recoverv credited)

I 3.0e-03 Notes No cognitive recovery credited.

Notes I a neg. neg. 3.0e-03 Environment . .. Notes Stress is low, as all equipment is available and all safety functions are satisfied. Cooldown, Equipment Accessibility Stress depressurization and placing RHR in service are routine actions performed for every cold shutdown. In this scenario, the only difference is that SI is running, which is stopped during the evolution.

Lighting Heat Radiation - -- Execution Complexity I Simple Normal Normal Background Atmosphere Main Control Room 1-nw Normal Accessible Enclosure 2 OSLOCAXXCDY, Operator Fails To Perform RCS Cooldown And Depressurization Stress Factor 1 1 1 1 1 1 ExbcutCon Unrecovered Step No. 5 6.c RNO 6,d RNo 1O.c 2.d RNo 12.e 5'a RNo 18.d Over Ride 0 0 0 0 0 1.7e-03 1.3E-3 O.Oe+O 0 1.3E-3 O.Oe+O 0 1.3E-3 2.6e-03 1.3E-3 O.Oe+O 0 3.8E-3 2.6e-03 1.3E-3 O.Oe+O 0 1.3E-3 2.6e-03 1.3E-3 2.6e-03 1.3E-3 O.Oe+O 0 Error 1 Type EOM EOC EOM EOC EOM EOC EOM EOC EOM EOC EOM EOC EOM EOC EOM EOC EOM EOC EOM Procedure:

1 ES-1 .I, Instruction Place All PRZR Heaters In Off Pos~t~on Comments: Start one condensate pump Comments:

Recovered by step 9 Dump steam to condenser from intact SGs Comments:

Recovered by step 9 Depressurize RCS To Refill PRZR: Use one PORV Comments: This step is performed immediately before startlng an RCP. Transitions from other steps when PRZR level is low are also possible.

For all possible entries, the RCS should be subcooled prior to RCS depressurization.

Since this prior subcooling requirement ensures a small break, subcooling should be restored with continued cooldown if subcooling is lost during the depressurization.

Pressurizer level (and pressure) will increase after the operator stops the depressurization until injection flow balances break flow and loss due to cooldown shrink. This step is a recovery step for cooldown, as depressurization can not commence without sufficient subcooling margin which is obtained by cooldown. PRZR level - GREATER THAN 21 % [41%] Comments: Potential recovery step Start 11 RHR pump. Comments: Stop last SI pump Comments:

Depressurize RCS To Minimize Subcooling: Use one PORV Comments:

Close accumulator isolation valves:

Comments:

.. MV-32071 .. MV-32072 Check RCS hot leg temperature - LESS THAN 350 F Comments:

If not, operators are directed to go to step 26 and will be Total HEP I 1.7e- 03 O.Oe+ 00 O.Oe+ 00 I 2.6e O.Oe+ 00 2.6e- 03 O.Oe+ 00 2.6e- 03 2.6e- 03 O.Oe+ 00 THERP Table 20-7b 20-12 20-7b 20-12 20-7b 20-12 20-7b 20-12 20-7b 20-1 1 20-7b 20-12 20-7b 20-12 20-7b 20-12 20-7b 20-12 20-7b Item I 1 3 1 3 2 5 2 3 2 4 2 3 2 3 2 3 2 3 2 Enclosure 2 OSLOCAXXCDY, Operator Fails To Perform RCS Cooldown And Depressurization bution Urtrecovered EOC D'lo Procedure:

1 ES-1 .l, .. MV-32165, LOOP A HOT LEG TO RHR, using CS-46228

.. MV-32230, LOOP B HOT LEG TO RHR, using CS-46227

.. MV-32231, LOOP B HOT LEG TO RHR, using CS-46229 Error Type EOC EOM EOM Step No. 25.d D.ll D.12 D.13 D.14 D.16 D.18 27 Instruction - d~rected In step 27 to return to step 2 rf RCS temperature IS not less than 200 F. This is a potential recovery step for the getting the initial cooldown and depressurization going.

Align RHR for shutdown cooling per Attachment D Comments:

OPEN RHR Suction Isolation valves from the RCS: Comments:

.. MV-32164, LOOP A HOT LEG TO RHR, using CS- 46226 Recovered by D. 1 8 Throttle CV-31236, 12 RHR HX RC OUTLET FLOW (1 HC-625), Comments:

Recovered by D.18 Throttle OPEN CV-31237, 1111 2 RHR HX BYPASS FLOW (1 HC- 626A), to approximately 30%.

Comments:

Recovered by D.18 Start 12 RHR Pump using CS-46185. Comments: Recovered by D.18 OPEN MV-32066, RHR TO RC LOOP B COLD LEG, using CS- 46225. Comments: Recovered by D.18 Place CV-31237, 1 111 2 RHR HX BYPASS FLOW (1 HC-626A), in "AUTO". Comments: Recovered by 0.1 8 Adjust CV-31236, 12 RHR HX RC OUTLET FLOW (1 HC-625), to obtain desired cooldown rate. Comments:

Check RCS Temperatures LESS THAN 200 (If not, return to step 2) Comments:

THERP 3.8E-3 1.3e-03 O.Oe+O 0 Table 20-1 1 20-7b 20-7b EOM EOC EOM EOC EOM EOC EOM EOC EOM EOC EOM EOC EOM EOC Item 4 2 2 Stress Factor 1 20-7b 20-12 20-7b 20-12 20-7b 20-12 20-7b 20-12 20-7b 20-12 20-7b 20-12 20-7b 20-1 1 Over Ride 2 3 2 3 2 3 2 3 2 3 2 3 4 Total HEP 1 1.3e- 03 O.Oe+O 0 1.3E-3 O.Oe+O 0 1.3E-3 O.Oe+O 0 1.3E-3 O.Oe+O 0 1.3E-3 O.Oe+O 0 1.3E-3 2.6e-03 1.3E-3 O.Oe+O 0 3.8E-3 1 1 1 1 1 1 1 O O O O O O O.Oe+ 00 O.Oe+ 00 O.Oe+ 00 O.Oe+ 00 O.Oe+ 00 2.6e- 03 O.Oe+ 00 Enclosure 2 OSLOCAXXCDY, Operator Fails To Perform RCS Cooldown And Depressurization vw Bkecutfon Recovered Step I No. I - - 1 I 5 I 1 Place All PRZR Heaters In Off Pos~t~on RNO Recovery Step NO. 1.7e-03 0.0e+00 6.c 6,d 9.a RNO 10.c I 1.7e-03 1 0.0e+00 1 Start one condensate pump 12.d RNO 12.e 15.a Action 1 Dump steam to condenser from intact SGs Depressurize RCS To Refill PRZR:

Use one PORV PRZR level - GREATER THAN 21% RNO 18.d 25.a [4 1 %] Start 11 RHR pump. Stop last SI pump Depressurize RCS To Minimize 25.d D.10 D.ll I 1 HX BYPASS FLOW (1 HC-626A).

to 1 1 1 1 1 1 0.0e+00 2.6e-03 0.0e+00 subcooling: Use one PORV Close accumulator isolation valves:

Check RCS hot leg temperature - LESS I OUTLET FLOW (1 HC-625), HEP (Crit) 1 0.0e+00 2.6e-03 O.Oe+OO 2.6e-03 O.Oe+OO 2.6e THAN 350 F Align RHR for shutdown cooling per Attachment D OPEN RHR Suction Isolation valves from the RCS: Throttle CV-31236, 12 RHR HX RC HEP (Rec) Dep. 2.6e-03 O.Oe+OO 2.6e-03 2.6e-03 0.0e+00 I O.Oe+OO 0.12 0.13 D.14 Cond. HEP Total for ~ ec Step ; 2.6e-03 0.0e+00 1.3e-03 O.Oe+OO O.Oe+OO I COLD LEG, using CS-46225.

1.3e-03 0.0e+00 O.Oe+OO I Throttle OPEN CV-31237, 1 111 2 RHR , . approximately 30%.

Start 12 RHR Pump using CS-46185. OPEN MV-32066, RHR TO RC LOOP 6 D.18 0.0e+00 1 1 O.Oe+OO O.Oe+OO O.Oe+OO 0.0e+00 D.16 BYPASS FLOW (1 HC-626A), in "AUTO". Adjust CV-31236, 12 RHR HX RC OUTLET FLOW (1 HC-625), to obtain desired cooldown rate. 0.0e+00 0 .Oe+00 1 Place CV-31237, 1 111 2 RHR HX 2.6e-03 I 2.6e-03 Enclosure 2 OSLOCAXXCDY, Operator Fails To Perform RCS Cooldown And Depressurization Enclosure 3: OHRECIRCSMY, Operator Fails To Initiate Hiqh Head Recirc. For A Small LOCA 04/23/05 J. F. Grobbelaar, SCIENTECH Total HEP I Error Factor

_I 1. Initial Conditions: Steady state, full power operation.

Without Recovery I 3.2e-03 2. Initiating Event: Small LOCA (2" break) 6.0e-02 3. Accident sequence (preceding functional failures and successes):

Reactor trip (reactor trip and bypass breakers are open). Turbine trip (both turbine stop valves are closed). Both safeguards buses are energized.

SI is actuated and required.

AFW flow greater than 200 gpm.

With Recovery 4. Preceding operator error or success in sequence: Entered 1 E-0. Transferred to 1 E-1 Transferred to 1 ES-1.1 5. Operator action success criterion: Diagnose need for recirculation switchover and switch over to recirculation 5 1.7e-04 6. Consequence of failure: Core damage.

3.4e-03 3.6e-03 Enclosure 3: OHRECIRCSMY, Operator Fails To Initiate High Head Recirc. For A Small LOCA Tsw = 10.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />.= 61 8 minutes Td = 2.7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> = 162 minutes The timing for the small LOCA (2" break) comes from calculation file V.SPA.93.004, "PI SLOCA WIAW, 2 SI, 2 Accum, 1 FCU, No Recirc." The time to 33% level is 2.7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> and the time from 33% RWST level until core damage is 7.6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. Cognitive Complexity ( Complex Equipment Accessibility I Main Control Room: Accessible Enclosure 3: OHRECIRCSMY, Operator Fails To Initiate Hiqh Head Recirc. For A Small LOCA Notes Self review is credited as the RWST level is continuously monitored. Special Requirements 1 Tools I Required 1 Adequate Available Environment Lighting Normal - -- Heat Normal - - Radiation Background Atmosphere Normal Equipment Accessibility Auxiliary Building Accessible Stress Moderate Notes Execution Complexity I Complex Enclosure 3: OHRECIRCSMY, Operator Fails To Initiate Hiqh Head Recirc. For A Small LOCA

.. Sl-32-3, CNTMT SUMP B TO 11 RHR PMP MV-32077 BONNET K'l VENT 1 EOC 20-13 1 1.3E-3 1 Exkutkn Unrecovered

/ .. 9-32-4, CNTMT SUMP B TO 12 RHR PMP MV-32078 BONNET I I I I 1 I Procedure:

1 ES-1.2, Error Type EOM Step No. VENT Align RHR sump pump discharge valves (located above RHR Pits): Comments: Regarded as single perceptual unit:

Instruction Vent the bonnets of Sump 6 to RHR MVs by OPENING AND THEN CLOSING the following valves (Located in CS pump room): Comments: Regarded as a single perceptual unit:

K.7 EOM .. Position WL-87-1, RHR PIT SUMP #I 1 DISCHARGE, to "ANNULUS SUMP" .. Position WL-87-2, RHR PIT SUMP #12 DISCHARGE, to "ANNULUS SUMP" Unlock and place the following 480V breakers to "ON": Comments: Regarded as single perceptual unit:

THERP K.8 3.5e-03 Table 20-7b 20-7b EOM 32207 (Located

~ast of Aux operator Shack) (Key #29) Remove cotter key AND travel stop for the following valves: Comments: Regarded as single perceptual unit:

Item 1 O.Oe+O 0 .. MCC 1 K1-E2 (BKR 11 1J-19), 11 RHR HX TO 11 SI PMP MV- 32206 (Located North of RHR pits) (Key #28) .. MCC 1KA2-Dl (BKR 1218-34), 12 RHR HXTO 12 SI PUMP MV- K.9 Stress Factor 20-7b EOM .. CV-31381,ll CC HX CLG WTR OUTLET CV .. CV-31411,12 CC HX CLG WTR OUTLET CV K.10 EOC Over Ride 1 20-7b A 1 711 6" socket and a 1 711 6" open-end wrench are needed Position WL-86-1, SAMPLE SINK TO CHEM DRAINIRHR SUMP, to "CLOSED, Sample Sink Drains to 12 RHR Pit Sump". Comments: Located halfway up the stairs by the Aux Bldg Operator shack Total , HEP 20-12 8.5e-03 1 E~~ EOC I I I I 1 12 3.5e-03 I I 20-7b 20-1 3.8E-3 2 O.Oe+O 0 ,3E-3 2 Enclosure 3: OHRECIRCSMY, Operator Fails To Initiate Hiqh Head Recirc. For A Small LOCA I' E%ecutlon Unrecovered I I Procedure:

1 ES-1.2, 7 8 10 ll.a Error Type EOM EOC EOM EOC EOM EOC EOM EOC EOM I EOC Step No. 2 3 4 5 6 Instruction Reset S1 Comments:

Non-critical, recovered by step 5 Reset Containment Spray Comments: Non critical - recovered by step 5 Check Both Trains Of Safeguards Pumps Available For Recirculation Comments:

Stop One Train Of Safeguards Pumps Comments:

.. RHR pump .. SI pump .. CS pump Recovered by subsequent steps that refer to valve alignments of "idle" pump.

Close RWST To RHR Isolation Valve For Idle RHR Pump: Comments:

MV-32084 OR MV-32085 Close SI Test Line To RWST Valves Comments:

Verify RHR To Reactor Vessel Injection Valve Alignment:

Comments:

.. MV-32064 - OPEN .. MV-32065 - OPEN Check Containment Level - GREATER THAN 1.75 FEET Comments:

Verify RWST to RHR isolation valve for idle RHR pump - CLOSED: Comments:

MV-32084 MV-32085 Check Sump B to RHR MV bonnets vented per ATTACHMENT K 11.' Ienmmnn+r.

THERP EOM EOC EOM EOM EOC EOM EOC O.Oe+O 0 neg. O.Oe+O 0 neg. 2.6e-03 1.3E-3 O.Oe+O 0 1.3E-3 3.5e-03 1.3E-3 Table 20-7b 20-12 20-7b 20-12 20-7b 20-9 20-7 20-12 20-7b 20-12 EOM Item 1 la 1 la 1 3 1 3 1 / 3 20-7b 20-12 20-7b 20-7b 20-1 1 20-7b 20-11 Stress Factor 2 2 2 2 20-7b 2 3 2 2 4 2 8 Over Ride 0 0 0 2 / 2.6e-03 O.Oe+ 00 O.Oe+ 00 2.6e- 03 O.Oe+ 00 3.5e- 03 5.2e-03 1.3E-3 O.Oe+O 0 7.6e-03 3.8E-3 2.6e-03 neg. 2 2.6e- 03 2 0 5.2e- 03 O.Oe+ 00 7.6e- 03 2.6e- 03 Enclosure 3: OHRECIRCSMY, Operator Fails To Initiate Hiqh Head Recirc. For A Small LOCA w Wecutlon Unrecovered I Procedure:

1 ES-1.2, ' Error Type EOM EOC EOM EOC EOM EOC EOM EOC EOM EOC EOM EOC EOM EOC Step No. 1l.c 13.a 3'b 14.a 4'b 4'c 4'd Instruction Open Sump B to RHR sola at ion valves for

~dle RHR pump: Comments:

.. MV-32075 AND MV-32077 -0R- .. MV-32076 AND MV-32078 Verify Sump B to RHR isolation valves are full open Comments: MV-32075 and MV-32077 OR MV-32076 and MV-32078 Start idle RHR pump Comments:

Close SI pump suction isolation valve for idle SI pump Comments:

MV-32162 -0R- MV-32163 Open RHR supply to idle SI pump Comments:

Start idle SI pump Comments:

Check SI flow - FLOW INCREASE (1 Fl-925) Comments:

recovers crm actions. LD THERP 5.2e-03 1.3E-3 2.6e-03 neg. 5.2e-03 1.3E-3 5.2e-03 1.3E-3 5.2e-03 1.3E-3 5.2e-03 1.3E-3 1.0e-02 3.8E-3 Table 20-7b 20-12 20-7b 20-1 1 20-7b 20-12 20-7b 20-12 20-7b 20-12 20-7b 20-12 20-7b 20-1 1 Item 2 3 2 8 2 3 2 3 2 3 2 3 2 4 Stress Factor 2 2 Over Ride Total HEP 5.2e- 03 2.6e- 03 5.2e- 03 5.2e- 03 5.2e- 03 5.2e- 03 1.0e- 02 Enclosure 3: OHRECIRCSMY, Operator Fails To Initiate Hiqh Head Recirc. For A Small LOCA Step No. K. 1 K.8 K.9 4 / 925) Recovery Step NO. 1l.b 1l.b 1l.b 14.d 6 I1 .a 7 w mcomlid "p I Close RWST To RHR Isolation Valve For I 3.5e-03 Idle RHR Pump: Verify RWST to RHR isolation valve for 1 925) Action Vent the bonnets of Sump B to RHR MVs by OPENING AND THEN CLOSING the following valves (Located in CS pump room):

Check Sump B to RHR MV bonnets vented per ATTACHMENT K Unlock and place the following 480V breakers to "ON": Check Sump B to RHR MV bonnets vented per ATTACHMENT K Remove cotter key AND travel stop for the following valves:

Check Sump B to RHR MV bonnets vented per ATTACHMENT K Check Both Trains Of Safeguards Pumps Available For Recirculation Check SI flow - FLOW INCREASE (1 FI- 1.8e-04 14.d 1 THAN 1.75 FEET 2.6e-03 4.5e-04 10 I1 .c idle RHR pump - CLOSED: Close S1 Test Line To RWST Valves Check SI flow - FLOW INCREASE (1 FI- / Check Containment Level - GREATER I 7.6e-03 LD 6.0e-02 I 14.d I Check SI flow - FLOW INCREASE (1 FI- / HEP (Crit) 3.5e-03 8.5e-03 3.5e-03 2.6e-03 LD 1.0e-02 13.a Dep. LD LD LD LD HEP (Rec) 2.6e-03 2.6e-03 2.6e-03 1.0e-02 5.2e-02 5.2e-03 925) Open Sump B to RHR isolation valves for idle RHR pump: Verify Sump B to RHR isolation valves are full open Cond. HEP (Rec) 5.2e-02 5.2e-02 5.2e-02 6.0e-02 1.0e-02 Total for Step 1.8e-04 4.5e-04 1.8e-04 1.5e-04 5.2e-03 LD 2.6e-03 6.0e-02 3.1 e-04 LD 5.2e-02 2.7e-04 Enclosure 3: OHRECIRCSMY, Operator Fails To Initiate High Head Recirc. For A Small LOCA . . I idle SI pump I 14.d I Check SI flow - FLOW INCREASE (1 FI- I 1.0e-02 LD 6.0e-02 / 925) 14.a 14.b 14.c I Close SI pump suction isolation valve for I 5.2e-03 1 925) Total Unrecovered:

3.1 e-04 14.d 14.d 6.0e-02 925) Open RHR supply to idle SI pump Check SI flow - FLOW INCREASE (1 FI- 925) Start idle SI pump Check SI flow - FLOW INCREASE (1 FI- Total Recovered:

5.2e-03 5.2e-03 1 3.4e-03 1.0e-02 1.0e-02 LD L D 6.0e-02 6.0e-02 3.1 e-04 3.1 e-04 I