ML050950565

Final Precursor Analysis - Fitzpatrick Grip Loop

ML050950565
Person / Time
Site:	FitzPatrick
Issue date:	12/17/2004
From:	Christopher Hunter NRC/RES/DRAA/OERAB
To:
Shared Package
ML060030075	List: ML050950555 ML050950565 ML050960036 ML050960041 ML050960051 ML050960242 ML050960252 ML050960263 ML060030080
References
LER 03-001
Download: ML050950565 (14)

Text

Enclosure Final Precursor Analysis Accident Sequence Precursor Program --- Office of Nuclear Regulatory Research Fitzpatrick Automatic Reactor Trip and Loss of Offsite Power Due to the August 14, 2003, Transmission Grid Blackout Event Date 8/14/2003 LER: 333/03-001 CCDP1 = 4x10-6 December 17, 2004 Event Summary At 1611 hours0.0186 days <br />0.448 hours <br />0.00266 weeks <br />6.129855e-4 months <br /> on August 14, 2003, Fitzpatrick experienced grid instability and a subsequent reactor trip while operating at 100 % power. Loss of offsite power (LOOP) occurred at 1613 hours0.0187 days <br />0.448 hours <br />0.00267 weeks <br />6.137465e-4 months <br />. Plant emergency diesel generators (EDGs) started and supplied power to safety-related plant loads until offsite power was restored. Attachment A is a timeline of significant events (Refs. 1 and 2).

Cause. The reactor trip and LOOP were caused by grid instability associated with the regional transmission system blackout that occurred on August 14, 2003.

Other conditions, failures, and unavailable equipment. On August 29, EDG A was determined to be inoperable due to out of tolerance no-load frequency, traceable to recovery from the August 14 event (Ref. 1). EDG A provided reliable emergency power throughout the LOOP event, and the equipment outage occurred after the event itself. Therefore, the inoperability of EDG A will be addressed in a separate analysis.

Recovery opportunities. Offsite power was recovered over a period of time, commencing at 1900 hours0.022 days <br />0.528 hours <br />0.00314 weeks <br />7.2295e-4 months <br /> on August 14, 2003, with restoration of the 115 kV transmission system with an imposed load limit and ending at 2400 hours0.0278 days <br />0.667 hours <br />0.00397 weeks <br />9.132e-4 months <br /> on August 14, 2003, with restoration of 115 kV transmission system to full capacity. Offsite power was restored to the first emergency bus at 2307 hours0.0267 days <br />0.641 hours <br />0.00381 weeks <br />8.778135e-4 months <br /> and to the second emergency bus at 2328 hours0.0269 days <br />0.647 hours <br />0.00385 weeks <br />8.85804e-4 months <br /> (Ref. 1).

Analysis Results

! Conditional Core Damage Probability (CCDP)

The CCDP for this event is 4x10-6. The acceptance threshold for the Accident Sequence Precursor Program is a CCDP of 1x10-6. This event is a precursor.

Mean 5% 95%

Best estimate 4x10-6 3x10-7 1x10-5

! Dominant Sequences 1

For the initiating event assessment, the parameter of interest is the measure of the CCDP. This is the value obtained when calculating the probability of core damage for an initiating event with subsequent failure of one or more components following the initiating event.

1

LER 333-03-001 The dominant core damage sequence for this assessment is LOOP/station blackout sequence (SBO) 47-08 (48.6% of the total CCDP). The LOOP and station blackout event trees are shown in Figures 1 and 2.

The events and important component failures in LOOP Sequence 47-08 are:

S LOOP occurs, S reactor shutdown succeeds, S emergency power is unavailable, S safety relief valves successfully reclose, S reactor core isolation cooling provides sufficient flow to the reactor vessel, S operator fails to strip dc loads, and S ac power is not recovered in 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />.

! Results Tables S The CCDP value for the dominant sequence is shown in Table 1.

S The event tree sequence logic for the dominant sequence is presented in Table 2a.

S Table 2b defines the nomenclature used in Table 2a.

S The most important cut sets for the dominant sequence are listed in Table 3.

S Table 4 presents names, definitions, and probabilities of (1) basic events whose probabilities were changed to update the referenced SPAR model, (2) basic events whose probabilities were changed to model this event, and (3) basic events that are important to the CCDP result.

Modeling Assumptions

! Assessment Summary This event was modeled as a loss of offsite power initiating event. Rev. 3.10 (SAPHIRE

7) of the Fitzpatrick SPAR model (Ref. 3) was used for this assessment. The specific model version used as a starting point for this analysis is dated December 10, 2004.

Since this event involves a LOOP of significant duration (potentially longer than the battery depletion time), probabilities of nonrecovery of offsite power at different times following the LOOP are important factors in the estimation of the CCDP.

Best estimate: Offsite power to the plants switchyard is assumed to be stable and useable when reported as such to plant operators by load dispatchers. This occurred at 1900 hours0.022 days <br />0.528 hours <br />0.00314 weeks <br />7.2295e-4 months <br />, about 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> following LOOP, in this event. This time is reasonable as the best estimate recovery time because it reflects the emergency operations policy for system restoration as documented in the North American Electric Reliability Council (NERC)

Operating Manual (Ref. 4).

Failure to recover offsite power to plant safety-related loads (if needed because EDGs fail to supply the loads), given recovery of power to the switchyard, could result from (1) operators failing to restore proper breaker line-ups, (2) breakers failing to close on demand, or (3) a combination of operator and breaker failures. The dominant contributor to failure to recover offsite power to plant safety-related loads in this situation is operators failing to 2

LER 333-03-001 restore proper breaker line-ups. This analysis assumed that at least 30 minutes are necessary to restore power to an emergency bus given that offsite power is available in the switchyard2. The time available for operators to restore proper breaker line-ups to prevent core damage is dependent on specific accident sequences and is modeled as such using the SPAR human reliability model (Ref. 5). Assumptions described below, combined with the assumption of offsite power restoration described above, form the bases for the LOOP nonrecovery probabilities.

! Important Assumptions Important assumptions regarding power recovery modeling include the following:

S No opportunity for the recovery of offsite power to safety-related loads is considered for any time prior to power being available in the switchyard.

S At least 30 minutes are required to restore power to emergency loads after power is available in the switchyard.

S SPAR models do not credit offsite power recovery following battery depletion.

The GEM program used to determine the CCDP for this analysis will calculate probabilities of recovering offsite power at various time points of importance to the analysis based on historical data for grid-related LOOPs. In this analysis, this feature was overridden; offsite power recovery probabilities were based on (1) known information about when power was restored to the switchyard and (2) use of the SPAR human error model to estimate probabilities of failing to realign power to emergency buses for times after power was restored to the switchyard.

Attachment B is a general description of analysis of loss of offsite power events in the Accident Sequence Precursor Program. It includes a description of the approach to estimating offsite power recovery probabilities.

! Basic Event Probability Changes Table 4 includes basic events whose probabilities were changed to reflect the event being analyzed. The bases for these changes are as follows:

S Probability of failure to recover offsite power in 30 minutes (OEP-XHE-XL-NR30M). During the event, offsite power was not available in the switchyard until 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> after the LOOP. Therefore, there was no opportunity to recover offsite power in 30 minutes and OEP-XHE-XL-NR30M was set to TRUE.

S Probability of failure to recover offsite power in 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> (OEP-XHE-XL-NR01H).

During the event, offsite power was not available in the switchyard until 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> after the LOOP. Therefore, there was no opportunity to recover offsite power in 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> and OEP-XHE-XL-NR01H was set to TRUE.

S Probability of failure to recover offsite power in 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> (OEP-XHE-XL-NR02H). During the event, offsite power was not available in the switchyard until 2

Sensitivity analysis has shown that the difference between 30 and 60 minutes restoration time has minimal effect on the results.

3

LER 333-03-001 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> after the LOOP. Therefore, there was no opportunity to recover offsite power in 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> and OEP-XHE-XL-NR02H was set to TRUE.

S Probability of failure to recover offsite power in 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> (OEP-XHE-XL-NR04H). During the event, offsite power was not available in the switchyard until 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> after the LOOP. Therefore, the operators had approximately 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> to recover offsite power to the vital safety buses, which is double the required time to perform the action. Using the SPAR human error model to determine the value (see Attachment C), OEP-XHE-XL-NR04H was set to 1.0x10-2.

S Probability of failure to recover offsite power in 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> (OEP-XHE-XL-NR10H). During the event, offsite power was not available in the switchyard until 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> after the LOOP. Therefore, the operators had approximately 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> to recover offsite power to the vital safety buses, which is double the required time to perform the action. Using the SPAR human error model to determine the value (see Attachment C), OEP-XHE-XL-NR10H was set to 1.0x10-3.

S Probability of diesel generators failing to run (ZT-DGN-FR-L). The default diesel generator mission times were changed to reflect the actual time to recover power to the first safety bus (7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br />). Since the overall fail-to-run is made up of two separate factors, the mission times for the factors were set to the following: ZT-DGN-FR-E = 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> (base case value) and ZT-DGN-FR-L = 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.

References

1. Licensee Event Report 333/03-001, Revision 0, Automatic Reactor Shutdown Due to Grid Instability Associated With the August 14th, 2003 Transmission Grid Blackout and Related Plant MODE Change with the A EDG Subsystem Inoperable, event date August 14, 2003 (ADAMS Accession No. ML0329601250).

2. NRC Region 1 Grid Special Report, October 15, 2003 (ADAMS Accession No. ML0324102160).

3. R. F. Buell and J. A. Schroeder, Standardized Plant Analysis Risk Model for Fitzpatrick (ASP BWR C), Revision 3, December 2004.

4. NERC Operating Manual.

5. D. Gertman, et al., SPAR-H Method, INEEL/EXT-02-10307, Draft for Comment, November 2002 (ADAMS Accession No. ML0315400840).

4

LER 333-03-001 Table 1. Conditional probabilities associated with the highest probability sequences.

Conditional core damage Percentage Event tree Sequence no. probability (CCDP)1 contribution name LOOP 47-08 1.7x10-6 48.6%

2 -6 Total (all sequences) 3.5x10

1. Values are point estimates. (File name: GEM 333-03-001 12-13-2004.wpd)

2. Total CCDP includes all sequences (including those not shown in this table).

Table 2a. Event tree sequence logic for the dominant sequences.

Event tree Sequence Logic name no. (/ denotes success; see Table 2b for top event names)

LOOP 47-08 /RPS, EPS, /SRV, /RCI, STRIP-LOAD, AC-2HR Table 2b. Definitions of fault trees listed in Table 2a.

EPS EMERGENCY POWER IS UNAVAILABLE AC-02H OPERATOR FAILS TO RECOVER AC POWER IN 2 HOURS RCI RCIC FAILS TO PROVIDE SUFFICIENT FLOW TO REACTOR RPS REACTOR SHUTDOWN FAILS SRV SRVS FAIL TO CLOSE STRIP-LOAD FITZPATRICK 125 DC LOAD STRIPPING FAILS Table 3. Conditional cut sets for dominant sequences.

Percent CCDP1 contribution Minimal cut sets2 Event Tree: LOOP, Sequence 47-02 5.5x10-7 33.1 EPS-XHE-XL-NR02H DCP-XHE-XM-STRIP EPS-XHE-XR-FIREDAMP 3.6x10-7 21.7 EPS-XHE-XL-NR02H DCP-XHE-XM-STRIP EPS-DGN-CF-RUN 2.2x10-7 13.1 EPS-XHE-XL-NR02H DCP-XHE-XM-STRIP ESW-MOV-CF-102AB 1.7x10-6 Total (all cut sets)3

1. Values are point estimates.

2. See Table 4 for definitions and probabilities for the basic events.

3. Totals includes all cut sets (including those not shown in this table).

5

LER 333-03-001 Table 4. Definitions and probabilities for modified or dominant basic events.

Probability/

Event name Description frequency Modified DCP-XHE-XM-STRIP OPERATOR FAILS TO STRIP DC LOADS TO 3.0x10-2 No EXTEND BATTERY LIFE EPS-DGN-CF-RUN COMMON CAUSE FAILURE OF DIESEL 1.7x10-5 No GENERATORS TO RUN EPS-XHE-XL-NR02H OPERATOR FAILS TO RECOVER EDG IN 2 7.1x10-1 No HOURS EPS-XHE-XR- FAILURE TO RESTORE FIRE DAMPERS 2.6x10-5 No FIREDAMP AFTER TEST AND MAINTENANCE ESW-MOV-CF-102AB ESW LOAD ISOLATION VALVES FAIL FROM 1.0x10-5 No COMMON CAUSE IE-LOOP LOSS OF OFFSITE POWER INITIATING 1.0 Yes1 EVENT OEP-XHE-XL-NR30M OPERATOR FAILS TO RECOVER OFFSITE TRUE Yes2 POWER IN 30 MINUTES OEP-XHE-XL-NR01H OPERATOR FAILS TO RECOVER OFFSITE TRUE Yes2 POWER IN 1 HOUR OEP-XHE-XL-NR02H OPERATOR FAILS TO RECOVER OFFSITE TRUE Yes2 POWER IN 2 HOURS OEP-XHE-XL-NR04H OPERATOR FAILS TO RECOVER OFFSITE 1.0x10-2 Yes2 POWER IN 4 HOURS OEP-XHE-XL-NR10H OPERATOR FAILS TO RECOVER OFFSITE 1.0x10-3 Yes2 POWER IN 10 HOURS PPR-SRV-OO-1VLV ONE SRV FAILS TO CLOSE 2.0x10-3 Yes3 ZT-DGN-FR-L EDG FAILS TO RUN (LONG TERM) 4.8x10-3 Yes4

1. Initiating event assessment- all other initiating event frequencies set to zero.

2. Evaluated per SPAR-H method (Ref. 5). See Attachment C for further details.

3. Updated value per detailed review of LERs.

4. Changed mission time to correspond to the time that offsite power was restored to the first vital bus. See report and Basic Event Probability Changes for further details.

6

LER 333-03-001 Attachment A Event Timeline Table A.1 Timeline of significant events.

Time1 Event 1611 Reactor trips due to grid instability 1613 Offsite power is lost to emergency buses; emergency diesel generators automatically start and load to power the emergency buses 1900 Offsite power is restored to the switchyard with a 5 MW load limit 2000 Load limit is raised from 5 MW to 10 MW 2307 First emergency bus (10600) is switched to offsite power source 2328 Second emergency bus (10500) is switched to offsite power source 2345 Emergency diesel generators are shut down 2400 All load restrictions are removed

1. All times are on August 14, 2003.

7

LER 333-03-001 Attachment B LOOP Analysis Procedure This procedure is not intended to stand alone; instead it is intended to augment ASP Guideline A:

Detailed Analysis3. LOOP event analyses are a type of initiating event assessment as described in ASP Guideline A. Specific analysis steps that are unique to ASP analysis of LOOP events are included here.

1. Determine significant facts associated with the event.

1.1 Determine when the LOOP occurred.

1.2 Determine when stable offsite power was first available in the switchyard.

1.3 Determine when offsite power was first restored to an emergency bus.

1.4 Determine when offsite power was fully restored (all emergency buses powered from offsite, EDGs secured).

1.5 Identify any other significant conditions, failures, or unavailabilities that coincided with the LOOP.

2. Model power recovery factors associated with the best estimate case and any defined sensitivity cases.

2.1 For the best estimate case, the LOOP duration is the time between the occurrence of the LOOP and the time when stable power was available in the switchyard plus the assumed time required to restore power from the switchyard to emergency buses. Attachment C documents the probabilistic analysis of power recovery factors for the best estimate case analysis.

2.2 If EDGs successfully start and supply emergency loads, plant operators do not typically rush to restore offsite power to emergency buses, preferring to wait until grid stability is more certain. Therefore, a typical upper bound sensitivity case considers the LOOP duration as the time between the occurrence of the LOOP and the time when offsite power was first restored to an emergency bus. Attachment C documents the probabilistic analysis of power recovery factors for the sensitivity case analysis.

3. Model event-specific mission durations for critical equipment for the best estimate case and any defined sensitivity cases. (For most equipment, SPAR model failure probabilities are not functions of defined mission durations and are therefore not affected by this analysis step. Notable exceptions include EDGs and, for PWRs, turbine-driven auxiliary feedwater pumps.)

3.1 For the best estimate case, mission durations are set equal to the assumed LOOP duration as defined in Step 2.1 above.

3.2 For a typical upper bound sensitivity case, mission durations are set equal to the time between the occurrence of the LOOP and the time when offsite power was fully restored to all emergency buses. (Note these mission durations are longer than the assumed LOOP duration defined in Step 2.2 above; they are intended to represent the longest possible mission duration for any critical equipment item.)

3 ASP Guideline A: Detailed Analysis, U.S. Nuclear Regulatory Commission.

8

LER 333-03-001 Attachment C Power Recovery Modeling

! Background The time required to restore offsite power to plant emergency equipment is a significant factor in modeling the CCDP given a LOOP. SPAR LOOP/SBO models include various sequence-specific ac power recovery factors that are based on the time available to recover power to prevent core damage. For a sequence involving failure of all of the cooling sources, only about 30 minutes would be available to recover power to help avoid core damage. On the other hand, sequences involving successful early inventory control and decay heat removal, but failure of long-term decay heat removal, would accommodate several hours to recover ac power prior to core damage.

In this analysis, offsite power recovery probabilities are based on (1) known information about when power was restored to the switchyard and (2) estimated probabilities of failing to realign power to emergency buses for times after offsite power was restored to the switchyard. Power restoration times were reported by the licensee in the LER and in response to the questionnaire that was conducted by the NRC Regional Office. The time used is the time at which the grid operator informed the plant that power was available to the switchyard (with a load limit). Although the load limit was adequate to energize plant equipment and, if necessary, prevent the occurrence of an SBO sequence, plant operators did not immediately load safety buses onto the grid. This ASP analysis does not consider the possibility that grid power would have been unreliable if that power were immediately used.

Failure to recover offsite power to plant safety-related loads (if needed because EDGs fail to supply the loads), given recovery of power to the switchyard, could result from (1) operators failing to restore proper breaker line-ups, (2) breakers failing to close on demand, or (3) a combination of operator and breaker failures. The dominant contributor to failure to recover offsite power to plant safety-related loads in this situation is operators failing to restore proper breaker line-ups. The SPAR human error model (ref.) was used to estimate nonrecovery probabilities as a function of time following restoration of offsite power to the switchyard. The best estimate analysis assumes that at least 30 minutes are necessary to restore offsite power to emergency buses given offsite power is available in the switchyard.

! Human Error Modeling The SPAR human error model generally considers the following three factors:

S Probability of failure to diagnose the need for action S Probability of failure to successfully perform the desired action S Dependency on other operator actions involved in the specific sequence of interest This analysis assumes no probability of failure to diagnose the need to recover ac power and no dependency between operator performance of the power recovery task and any other task the operators may need to perform. Thus, each estimated ac power nonrecovery probability is based solely on the probability of failure to successfully perform the desired action.

9

LER 333-03-001 The probability of failure to perform an action is the product of a nominal failure probability (1.0x10-3) and the following eight performance shaping factors (PSFs):

S Available time S Stress S Complexity S Experience/training S Procedures S Ergonomics S Fitness for duty S Work processes For each ac power nonrecovery probability, the PSF for available time is assigned a value of 10 if the time available to perform the action is approximately equal to the time required to perform the action, 1.0 if the time available is between 2 and 4 times the time required, and 0.1 if the time available is greater than or equal to 5 times the time required. If the time available is inadequate (i.e., less than the time to restoration of power to the switchyard plus 30 minutes for the best estimate), the ac power nonrecovery probability is 1.0 (TRUE).

The PSF for stress is assigned a value of 5 (corresponding to extreme stress) for all ac power nonrecovery probabilities. Factors considered in assigning this PSF include the sudden onset of the LOOP initiating event, the duration of the event, the existence of compounding equipment failures (ac power recovery is needed only if one or more emergency buses are not powered by EDGs), and the existence of a direct threat to the plant.

For all of the ac power nonrecovery probabilities, the PSF for complexity is assigned a value of 2 (corresponding to moderately complex) based on the need for multiple breaker alignments and verifications.

For all of the ac power nonrecovery probabilities, the PSFs for experience/training, procedures, ergonomics, fitness for duty, and work processes are assumed to be nominal (i.e., are assigned values of 1.0).

! Results Table C.1 presents the calculated values for the ac power nonrecovery probabilities used in the best estimate analysis.

Table C.1 AC Power Nonrecovery Probabilities PSF Nominal Time Product of Nonrecovery Nonrecovery Factor Value Available All Others Probability OEP-XHE-XL-NR30M 1.0x10-3 Inadequate -- TRUE OEP-XHE-XL-NR01H 1.0x10-3 Inadequate -- TRUE OEP-XHE-XL-NR02H 1.0x10-3 Inadequate -- TRUE OEP-XHE-XL-NR04H 1.0x10-3 1 10 1.0x10-2 OEP-XHE-XL-NR10H 1.0x10-3 0.1 10 1.0x10-3 10

LER 333-03-001 11

LER 333-03-001 Attachment D Response to Comments Comments were provided by the licensee (Ref. D-1).

1. Comment from Licensee - Reactor coolant boil-off time The ASP analysis did not include the three-hour reactor coolant boil-off time, which would take place in a site blackout sequence after battery depletion with initially successful HPCI/RCIC. Crediting this time in the analysis would increase the maximum offsite power recovery time to 7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> and reduce the CCDP. The NRC analysis permitted a maximum recovery time of only 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />, i.e. 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> (when the 115kV system was first adequately energized), plus one hour to realign the safety buses, 10500 and 10600.

Response: The SPAR model does not credit recovery of offsite power in a station blackout following depletion of station batteries. Breakers in the switchyard and in the plant would have to be closed, and that may not be possible or feasible without any ac or dc power available. The SPAR model would be revised only if (1) a procedure exists to recover offside power following battery depletion, (2) the procedure has been demonstrated to work, and (3) operators are trained on the procedure. Furthermore, thermal-hydraulic models do not show a three hour boil-off time in this scenario; the time would be closer to one hour.

2. Comment from Licensee - Firewater backup for EDG jacket cooling The crosstie between the firewater system and EDG jacket coolers can be credited in accident sequence cutsets which involve failures of components in the ESW system with successful closure of 46MOV-102A/B. As an example, for the dominant core damage sequence LOOP/SBO sequence 47-02, fire water cross-tie recovery can be credited for cutsets of CCDP 6.5E-7 and below.

Response: The firewater backup is included for EDG cooling. For sequence 47-02, each cut set in the GEM report with CCDP below 6.5E-7 contains the event FWS-XHE-ERROR.

FWS-XHE-ERROR is defined as operator fails to start/control firewater injection/cooling, which is used for alternate injection and for EDG jacket cooling. The probability of FWS-XHE-ERROR is 6.0E-2.

References:

1. Entergy Nuclear Operations, Inc. Comments on Preliminary Accident Sequence Precursor Analysis of August 14, 2003 Operational Event, Letter from Michael R. Kansler to U.S.

Nuclear Regulatory Commission, May 17, 2004 (ML041460505).

12

LER 333/03-001 L OSS O F RE AC T OR E MER G EN C Y SR V' S R CIC H PCI MAN U AL C O RE LO W P RE SS A LTER NATE SU PPRES SIO N M AN UA L C O NT AIN MEN T CO N TAIN ME NT C RD LO NG -TER M O FF SITE SH UT D OW N P O WER CLO SE RE ACTO R S PR AY CO O L ANT L O W PRES S PO O L R EA CT O R SP RA Y V EN TIN G INJ EC TIO N LO W P RE SS P O WER DE PRESS IN JEC T IO N INJEC TION CO O L ING D EP RE SS (1 P UM P) IN JEC T IO N IE-L O O P RP S E PS SR V R CI H CI DE P L CS LC I VA SPC D EP C SS CVS C R1 VA1 # ST AT E 1 OK 2 OK 3 OK VA2 4 CD 5 OK 6 OK 7 CD T8 PO ST-C TM-IN J 9 OK 10 CD 11 OK 12 CD 13 CD 14 OK 15 OK 16 OK VA2 17 CD 18 OK 19 OK 20 CD 21 CD 13 22 OK 23 CD 24 OK 25 CD 26 CD 27 OK 28 OK 29 OK 30 OK 31 CD 32 CD 33 OK 34 OK 35 OK 36 OK 37 CD 38 CD 39 OK 40 OK SP 1 41 OK C S1 42 CD 43 CD 44 CD P1 T4 5 LO O P -1 P2 T4 6 LO O P -2 T4 7 SBO T4 8 AT WS Figure 1: Fitzpatrick LOOP event tree.

LER 333/03-001 TRANSFER S RV'S RCIC HP CI DC LOADS MA NUAL FIREW ATER OFFSITE BRANCH CLOSE STRI PPED REA CTOR INJE CTION POWER SBO DEP RESS RECOVERY EPS S RV RCI HCI STRI P-LOAD DEP VA3 AC # STATE 1 OK A C-04H 2 CD 3 OK A C-04H 4 CD 5 OK A C-04H 6 CD 7 OK A C-02H 8 CD 9 OK A C-04H 10 CD 11 OK A C-04H 12 CD 13 OK A C-04H 14 CD 14 15 OK A C-02H 16 CD 17 OK A C-30M 18 CD 19 OK A C-02H 20 CD 21 OK A C-02H 22 CD P1 23 OK A C-02H 24 CD 25 OK A C-02H 26 CD HC1 27 CD 28 OK A C-01H 29 CD P2 30 OK A C-01H 31 CD HC1 32 CD Figure 2: Fitzpatrick SBO event tree with dominant sequence highlighted.