ML20101E793

Forwards Response to NRC 960228 Questions Re Equipment Performance & Affects on Plant IPE Results.Rev 0 to Calculation QC-CN-93-003 Also Encl

ML20101E793
Person / Time
Site:	Quad Cities
Issue date:	03/15/1996
From:	Kraft E COMMONWEALTH EDISON CO.
To:	NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM)
Shared Package
ML20101E796	List: ML20101E793 ML20101E816
References
ESK-96-031, ESK-96-31, NUDOCS 9603250219
Download: ML20101E793 (17)

Text

I O ' Commonweahh I'dmm O>mpany i .

Quad Otics Generating Station 22710 2(Oth Asenue North Cordova, 11.61242-9'40 Tel .um,s 22ii ESK-96-03 !

I l March 15,1996 l

1 l U. S. Nuclear Regulatory Commission Attn: Document Control Desk Washington, D.C. 20555 l

Subject:

Quad Cities Nuclear Power Station Units 1 and 2 Comed Response to NRC StafTQuestions Regarding Effects of Emergency Core Cooling System (ECCS) Equipment Failures on Individual Plant Examination

! Values NRC Docket Nos. 50-254 and 50-265 l

References:

(a) R. Pulsifer letter to D. Farrar, dated Februaiy 28,1996.

! (b) Meeting between representatives of Comed and the NRC Staff, dated December 11,1995.

l The purpose of this letter is to respond to the NRC staffs questions (Reference a) regarding equipment performance and its affects on the Quad Cities Individual Plant Examination (IPE) results. This information was requested by the NRC staff during the meeting on December 11, 1995 (Reference b).

When recent (1993 through 1995) unavailability and reliability data is used for key equipment, the result is an increase in Core Damage Frequency (CDF) by a factor of 2.8. This is largely attributable to the high value for unavailability of the Safe Shutdown Makeup Pump (SSMP) I

during 1993. When SSMP unavailability for the years 1994 and 1995 is used, the result is an l

250094 9603250219 960315 '

l PDR ADOCK 05000254 i p PDR 1 A t'nicom Compan) j

. i

ESK-96-031 USNRC Page 2 increase in CDF by a factor of 1.4, which is not considered risk significant per the Probabilistic Safety Assessment (PSA) Applications Guide.

This quantification of CDF does not include hardware additions made since the IPE PRA model for Quad Cities was developed. These additions include the Division I 4kV cross-tie and the Unit 2 SBO diesel generator, which are now fully operational, and the Unit 1 SBO diesel generator, which will be made operational by the end ofJune 1996. A procedure to operate RCIC manually without battery power during extended SBO events has also been in place for more than a year. All of these improvements address reducing the impact ofloss of offsite power and SBO events and provide additional defense-in-depth to lower the actual CDF from that reported above. Comed is considering including these improvements in either the Modified IPE, ,

which is the response to the NRC staff evaluation of the original IPE, or in a future PRA update. l l

Comed understands that the NRC plans to employ their PRA tool to quantify the impact of the unavailability and reliability information provided in the response to Question 3. The NRC-determined impact, of course, should be similar to the results provided in response to Questions 1 i and 2. ComFd would welcome the opportunity to discuss the NRC results compared to the  !

Comed results to resolve any significant differences.

Comed's full response is provided as an attachment to this letter.

If there are any further questions, please contact this oflice.

Sincerely, i

Ob.WA.e- , .

E. S. Krafl, J Site Vice President Quad Cities Nuclear Power Station

Attachment:

Response to NRC Staff Questions Regarding Effects of Equipment Performance on IPE Values cc: H. J. hiiller, Regional Administrator - RIII R. hi. Pulsifer, Project hianager - NRR C. G. hiiller, Senior Resident Inspector - Quad Cities Oflice of Nuclear Facility Safety - IDNS l

l

l Response to NRC StafTQuestions Regarding Effects of Equipment Performance  !

on IPE Values  !

Ouestion 1 1

" Provide an estimate of the Loss of Offsite Power (LOSP) and Station Black Out (SBO) induced change in core damage frequency using the recent equipment i reliability / unavailability data. Provide an overview of the assumptions and methodology used to perform this analysis."

The system reliability and unavailability data described in the answer to Question 3 was quantified ;

by use of the Risk Management Query System (RMQS) computer code. The Quad Cities RMQS  ;

model includes approximately 2600 core damage sequences. The CDF contribution from LOSP l

and SBO events was estimated by selecting the core damage sequences that are initiated by a single and dual unit LOSP or SBO and adding up the CDF attributable to those sequences. The j results and comparison to the original IPE-based RMQS model are as follows:

CDF Attributable to LOSP and SBO Events 1993-1995 Data Original IPE Total CDF (from RMQS) 4.10E-06 1.45E-06 l Single Unit LOSP 1.52E-06 (37.1%) 2.81E-07 (19.4%)

Dual Unit LOSP 1.78E-06 (43.5%) 7.58E-07 (52.3%)

All LOSP ,

3.30E-06 (80.1%) 1.04E-06 (71.7%)

SBO (subset of LOSP 1.05E-06 (25.5%) 6,18E-07 (42.6%)

events) l The values shown in parentheses are the percent of total CDF. From the data presented, it is seen l that the fraction of contribution to total CDF for LOSP events is about the same for the two data sets, but the CDF value attributable to LOSP has increased by more than a factor of three.

Relative contribution of SBO events to total CDF has decreased somewhat when the more recent data is used, but again, the actual CDF value attributable to SBO has increased by about 70% )

over the originalIPE value. l Ouestion 2

" Determine the change in conditional containment failure probability using the recent equipment reliability / unavailability data."

Again, the RMQS model with the recent reliability and unavailability data was used to perform this estimate. The original IPE Submittal Report stated on page 4-257 that containment failure sequences have C, E,0, Q, R, S, T, X, or Y as the fourth character, or GG as the third and fourth characters in the plant damage state code. Sequences with these plant damage state codes were .

i l

ESK-96-031, Attachment, Page 1 of 45

summed with the result that 78.9 % of the total CDF, or 3.2E-06 is associated with containment failure. The original IPE Submittal report stated that 79% of the total CDF, or 1.15E-06 (using the RMQS value of 1.45E-06 for total CDF)is associated with containment failure. Therefore, the conditional containment failure probability is essentially unchanged.

Question 3

" Provide the reliability / unavailability data for 1993 through 1995 for the Emergency Diesel Generators (EDG), High Pressure Coolant Injection (HPCI), Reactor Core Isolation Cooling (RCIC), safe shutdown makeup, offsite and DC power system."

The unavailability and reliability data requested was collected from various plant data sources and !

is shown in the attached two tables. Data for the Residual Heat Removal (RHR) and RHR Service Water Pumps was added to the list requested by the NRC because of past NRC concern regarding RHR system reliability. As requested, data from the years 1993 through 1995 was used in the calculations with the following exceptions:

1. For seven equipment failure types, no failures were experienced at Quad Cities l for the years ofinterest. A standard statistical technique used in the case of no failures is to assume 0.5 failures and use the actual number of demands or hours of operation as the denominator. This technique is akin to assuming you are " half way" to a failure and is valid if the number of demands or hours in the period ofinterest is high enough. This technique was used for:

• Unit 1 EDG failure to start e Unit 1 EDG failure to run

. Unit 2 EDG failure to run e 1/2 EDG failure to run  ;

e RHR Pump failure to start  !

e RHR Pump failure to run

. SSMP failure to start

2. For three equipment failure types, no failures were experienced at Quad Cities for the years ofinterest, but use of the technique described above resulted in unrealistically high failure rates. For these three failure types, no failures have been experienced over the past 11 years. The original IPE used failure rates from IEEE Standard 500-1984 for these equipment failure types. Since Quad Cities has experienced no failures, the IEEE values were used for these three failure types in this calculation as well: l

• HPCI turbine failure to run l

e RCIC Turbine failure to run e SSMP failure to run The changes to unavailability and reliability data were quantified by use of the RMQS computer code discussed in the answer to Question 1. Note that changes were only made ESK-96-031, Attachment, Page 2 of 45 l

O f 1 I l

to the respective basic events in the RhiQS model, not the associated common cause i

factors. Common cause factor changes will be included in the Comed response to the NRC staff evaluation of the original Quad Cities IPE as a part of the hiodified IPE.

Changing the unavailability an'.i reliability data values to those listed in the attached tables results in an increase in CDF by a factor of 2.8. A comparison was performed of this increase to thepermanent CDF change criteria in the PSA (Probabilistic Safety Assessment) Applications Guide published by EPRI. A factor 2.8 increase in CDF is I classified as a potentially risk sigmficant increase that warrantsfurther evaluation 1 according to the PSA Guide. For Quad Cities, a permanent increase in CDF by a factor of greater than 1.9 warrants further evaluation.  !

An examination of the data shows that the unavailability for the SSN1P was 11.1% during the years 1993 through 1995. This is compared to 0.9% for the years 1985 through 1991 as used in the original IPE. The high unavailability value is largely due to a single event in 1993, where one of the two SSMP room cooler compressors was found to be inoperable.

The discovery of the problem occurred on hiay 21 of that year, and a work request was initiated. At that time, the Station believed that the room cooler had redundant compressors, and repair of the broken compressor was delayed by other maintenance activities. During August, a calculation of SSNIP room temperature response was performed that showed one room cooler compressor was not sufficient, and room temperature would quickly rise until the one operating compressor failed on high temperature. Repairs to the compressor were completed on September 16, resulting in an SShiP unavailability for that year approaching 25%.

Since that incident, and since the original IPE results showed the importance of SShfP to CDF, the Station has been very sensitive to SSNIP availability. The Station's on-line maintenance program, in practical use since March of 1995 and formalized in October by implementation of two administrative procedures, requires that compensatory measures be considered when for making a high-risk system such as SSN1P unavailable and therefore limits the length of SSMP outages.

To test the theory that much of the 2.8 factor increase in CDF is due to SSMP unavailability, a sensitivity run was performed that used the SSMP unavailability for the years 1994 and 1995, which was 0.47%. Use of unavailability data for the most recent two years is the approach being used by the Downers Grove PRA Group for PRA model updates. The resulting CDF dropped to a factor of 1.4 increase over the baseline IPE value. This would be considered a non-risk significant increase according to the PSA

, Applications Guide.

l It appears that most of the remaining increase in CDF over the original IPE value is due to an increase in the HPCI failure to start rate and maintenance unavailability, and in an increase in maintenance unavailability for the 1/2 EDG. Again, much of this unavailability occurred in 1993. Since that time, the Station has recognized the importance of improving the reliability and availability of key plant systems. Management of the risk i

l ESK-96-031, Attachment, Page 3 of 45

associated with performing maintenance on-line is also much improved with the implementation of formal administrative controls.

During a conference call with Bob Pulsifer and Jim Trapp of the NRC on March 11,1996, clarification was sought for what was meant by reliability / unavailability data for offsite power and the DC power system. From that call, regarding offsite power, it was understood that the NRC was primarily interested in fmding out if anything has changed in the last few years that would alter the assumptions used to determine the loss of offsite power frequency for the original IPE. The calculation was reviewed, and to the best of our knowledge, none of the inputs to the calculation has changed. Conversely, in the last couple ofyears changes have been implemented at the Station that improve our ability to cope with a loss of offsite power. The most significant of these improvements were making the Unit 2 SBO diesel generator and the 4KV Division I cross-tie operable and implementing a procedure to manually operate RCIC afler battery power has been lost i during an extended SBO event. In addition, the Unit 1 SBO dieselis expected to be operable by the middle of this year.

Regarding DC power availability, it was understood from the conference call that the information sought by the NRC here dealt with unavailability of batteries for the performance of discharge testing. Quad Cities has a bank of 125V maintenance batteries installed on each unit which is connected to the DC loads while the discharge test is performed on the normal Unit 125V battery. For 250V battery discharge testing, the operating unit loads on the battery being tested are moved to the operating unit 250V battery. Except for the brief periods of time while the loads are being transferred, the DC loads are powered on the operating unit and no unavailability results from the performance of battery discharge testing.

Question 4

" Provide the bases for the Individual Plant Examination (IPE) submittal assumptions for the coping duration, loss of offsite power recovery probability, EDG common cause failure factors, and the SBO success criteria for the EDGs/ electrical cross-ties."

Coping Duration The Quad Cities IPE assumed, for sequences in which High Pressure Coolant Injection (HPCI) or Reactor Core Isolation Cooling (RCIC) were successful, that offsite power recovery within six hours would allow use of systems with motor-driven pumps to be used to avert core damage in the event that other injection systems are unable to prevent core damage.

Note that the Safe Shutdown Makeup Pump (SSMP) can, in the event of a single unit SBO, be powered from the opposite unit. This was pointed out in Footnote 8 to Table ESK-96-031, Attachment, Page 4 of 45

4.1.4-1, Quad Cities Plant Response Trees (PRT) Success Criteria, of the IPE Submittal Repon.

The SBO PRTs in the IPE Submittal Report show that core damage would o: cur in SBO events if HPCI, RCIC, SSNfP, and recovery of offsite power were all unsuccessful. The base quantification for the IPE assumed, however, that recovery of offsite power would be unsuccessful (i.e., always fail) if both IIPCI and RCIC were unsuccessful in an SBO event. This conservative assumption is the basis for Footnote 9 of Table 4.1.4-1 of the IPE Submittal Report which states (in reference to SBO success sequences involving failure of high pressure inventory control):

"This success path included only for potential sensitivities and to allow for fiexibility in future modeling modifications. No credit was given for success of these paths in the base quantification."

The only successfid coping duration credited in the JPE, therefore, was recovery of ofpite power within six hours during SBO crents. This duration was based upon the time to boil off the vessel inventory. The coping duration was determined for several cases by simulating the event with the hiodular Accident Analysis Program (h1AAP). Bases for the h1AAP analyses included the conservative assumption that recovery of ofAite power was essential for the following:

a. successful operation of all systems that relied on motor-driven pumps powered by buses affected by the SBO (e.g., feedwater, residual heat removal, core spray, service water, and turbine building closed cooling water) -

1

b. containment venting; and

c. extended operation of systems which rely on station batteries (e.g., automatic depressurization, high pressuie coolant injection, and Reactor Core Isolation Cooling (RCIC)).

1 NOTE: At the time of the original IPE, the assumption was appropriate that j recovery of ofTsite power was essential for extended operation of RCIC.

Subsequently, however, an insight from the IPE resulted in a procedure change, implemented in early 1995, that would permit extended operation of RCIC after battery depletion. Comed is considering crediting extended RCIC operation during an SBO as part of the hiodified IPE.

The IPE Submittal Repon (Reference b) includes details from hiAAP analyses in a description of the dominant accident sequence on page 4-217. In this sequence, HPCI is successful until battery depletion occurs at 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />; no systems are subsequently available to inject into the vessel. (The SSh1P is unavailable because this sequence is a dual unit SBO.) A sustained uncovered core state starts at 9.75 hours8.680556e-4 days <br />0.0208 hours <br />1.240079e-4 weeks <br />2.85375e-5 months <br /> and core damage begins at i1.2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />; containment pressure increases and drywell shell failure is predicted at 18.7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br />.

ESK-96-031, Attachment, Page 5 of 45

l .

1 ,

l 1

i i

l l t

In the dominant sequence described in the IPE Submittal Report, offsite power is not recovered.  ;

The times given in the description illustrate, however, that if offsite power were restored at 6 i

hours (or earlier), then a significant amount of time would be available to the operators to restore l various cooling and injection systems to prevent core damage. l l

l l

l Loss of Ofpite Power Recovery Probability l The bases for the IPE Submittal assumptions for loss of ofTsite power recovery probability were  ;

previously submitted in the Comed response (Reference c) to the NRC's Request for Additional l Information (RAI) on the IPE (Reference d). The pertinent information, submitted as the response to Question 1(b) of the RAI, is provided for convenience in Attachment 4-A.

EDG Common Cause Failure Factors The common cause failure factors used in the original IPE were based on a generic common cause data base. As stated in the Comed response to RAI Question 11(a), this data base was screened for applicability to Quad Cities. A copy of that response is provided for convenience in Attachment 4-B.

The bases for screening individual diesel generator events were documented in a calculation note (Reference e) for the IPE. The calculation note is proprietary to Westinghouse Electric Corporation. This materialis available for your review upon request.

Please note that the resulting 2-out-of-3 and 2-out-of-2 beta factors were 2.9E-3 and 1.5E-3, as listed Table 4.4.3-1, MGL Parameters for Quad Cities, of the IPE Submittal Report. As discussed in the initial Comed response (Reference 1) to the Staff Evaluation l Report on the Quad Cities IPE (Reference g), these beta factors will be replaced with a  :

floor value of 1E-2 for the Modified IPE.

l l

SBO Success Criteriafor the EDGs Electrical Cross-Ties This question is interpreted as addressing whether combinations of EDG/ electrical cross-tie I failures during a Loss Of OfTsite Power (LOOP) event results in a Station Blackout (SBO) in one l

or both units.

l The Quad Cities IPE is based on Unit 1, but includes both single unit and dual unit LOOPS as i

initiating events. As discussed in Section 4.1.2.5 of the IPE Submittal Report (Reference b),

support system event trees were developed for both of these initiating events. Support model quantification was used to determine the frequencies for various support states. The main ESK-96-031, Attachment, Page 6 of 45

distinction between support states was whether the state represented a SBO for Unit 1. Support l states representing an SBO for Unit I were analyzed using the SBO PRTs; otherwise, the support states for LOOP initiating events were analyzed using the LOOP PRTs.

The definition used for the IPE is that SBO events are those occurring due to a LOOP and I a subsequent failure to stan or align the emergency power generation system or to align I

the 4 kV Bus 14-1 to 24-1 cross-tie if power is available from the opposite unit. The 93 l model included only the three Emergency Diesel Generators (EDGs) and not thee BO diesel generators. (Neither the SBO diesel generators nor the 4 kV Bus 13-1 '.o 23-1 cross-tie had been installed at the time of the IPE cutoff. The Unit 2 SBO diesel generator and the 4 kV Bus 13-1 to 23-1 cross-tie have subsequently been placed in service.)

IPE Submittal Report Table 4.5.1-2, " LOOP Support Model Quantification Results," shows the most frequent support state combinations resulting from a single unit LOOP. This table is provided for convenience in Attachment 4-C. This table shows that a single unit LOOP is very unlikely to lead to an SBO. The only support state sequence shown in the table (sequence #26) giving an SBO involves failure of the Unit i EDG, the Unit 1/2 " swing" EDG, and the Bus 14-1 to 24-1 cross-tie.

IPE Submittal Report Table 4.5.1-3, " Dual Unit LOOP Support Model Quantification Results,"

shows the most frequent support state combinations resulting from a dual unit LOOP. This table is provided for convenience in Attachment 4-D. This table shows the following sequences giving SBOs as follows:

1. 8 Failure of the Unit I and Unit 2 EDGs (but not the Unit 1/2 " swing" EDG) gives an SBO in Unit 2 but no SBO in Unit 1.

Note: The Unit 1/2 " swing" EDG can feed either Bus 13-1 or Bus 23-1, but not both; in general, the Unit 1/2 EDG was modeled as feeding Bus 13-1 first.

1. 20 Failure of all three EDGs gives an SBO in both units.

1. 44 Failure of the Unit I and Unit 1/2 EDGs and failure of the Bus 14-1 to 24-1 cross-tie gives an SBO in Unit 1 but no SBO in Unit 2.

No recovery of EDGs or electrical cross-ties is credited in the JPE modeling of SBC events.

Therefore, the SBO success criteria listed in Table 4.1.4-1 of the IPE Submittal do not include any success criteria for EDGs/ electrical cross-ties. Comed regrets any misundersending that mey have resulted from the wording of Footnote 7 to that table which stated:

l "With the exception of some success sequences d ependent on SSMP, recovery of power is required for all SBO success sequences."

ESK-96-031, Attachment, Page 7 of 45

This statement is correct, but was not meant to imply that recovery of EDGs or electrical cross-ties was required. As indicated in the Comed response to RAI Question 1(b), the only recovery of power credited in the IPE is the recovery ofoffsite power. A copy of the response to Question 1(b)is provided for convenience in Attachment 4-A.

Footnote 8 to Table 4.1.4-1 of the IPE Submittal further explains that:

"During a single unit SBO, the SSN1P may be powered from the other unit and prevent core damage without recovery of power to the unit experiencing the SBO."

Conversely, the IPE assumed that the SShiP is unavailable during dual unit SBOs unless ofTsite l power is recovered within the 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> coping duration.

References:

(a) R.ht. Pulsifer Letter to D.L. Farrar, dated February 28,1996 (b) Commonwealth Edison Company, Quad Cities Nuclear Power Station Units I and 2 Individual Plant Examination Submittal Report, Decenicer 1993 (c) J.L. Schrage Letter to NRC, dated August 8,1994 *

(d) C.P. Patel Letter to D.L. Farrar, dated June 9,1994 (e) R.T. Reiner, " Common Cause hfGL Factors for Braidwood, Byron, LaSalle &

Quad Cities IPE Initial Quantification," Westinghouse Calculation Note CN-COA-92-470-RO.

(f) B. Rybak Letter to NRC, dated December 15,1995 (g) R.hi. Pulsifer Letter to D.L. Farrar, dated November 9,1995 1

ESK-96-031, Attachment, Page 8 of 45

Attachment 3-A ESK-96-031, Attachment, Page 9 of 45

Maintenance Unavailability Data 1/85 1/93 THRU COMPONENT TYPE THRU 12/91* 12/95 SOURCE UlEDG 8.69E-03 8.95E-03 SSPI U2 EDG 1.28E-02 1.38E-02 SSPI 1/2 EDG 1.38E-02 5.33E-02 SSPI DGCWP 5.45E-03 1.07E-03 OOS EDG OUTPUT BREAKER 2.26E-03 8.83E-04 OOS HPCI TURBINE 1.45E-02 3.33E-02 SSPI RHR PUMP 6.51 E-03 3.44E-03 OOS RHRSW PUMP 7.77E-03 2.05E-02 OOS RCIC TURBINE 9.40E-03 1.12E-02 SSPI SSMP 9.37E-03 1.11E-01 OOS/NTS

• From original IPE Submittal Report (Reference b) Tabic 4.4.1-4 l

I I

)

ESK-96-031, Attachment. Page 10 of 45

l i

1 i

I 1

i I

Attachment 3-B l

l l

i l

l ESK-96-031, Attachment, Page 11 of 45

Reliability Data From TABLE 4.4.1-3 in Original IPE Submittal 1/85 THROUGH 12/91 1/93 THROUGH 12/95 COMPONENTTYPE GROUPING AND NUMBER NUMBER OF FAILURE NUMBER NUMBER OF FAILURE FAILURE MODE OF DEMANDS RATE OF DEMANDS RATE FAILURES OR HOURS FAILURES OR HOURS U1 EDG FAllURE TO START 3 187 1.60E-02 0.5 54.0 9.26E-03 Ul EDG FAILURE TO RUN 2 469 4.27E-03 0.5 130.5 3.83E-03 U2 EDG FAILURE TO START 3 218 1.38E-02 2 81.0 2.47E-02 g U2 EDG FAILURE TO RUN 1 545 1.83E-03 0.5 178.0 2.81 E-03 7 1/2 EDG FAILURE TO START 2 201 9.94E-03 1 77.0 1.30E-02

$ 1/2 EDG FAILURE TO RUN 4 1252 3.19E-03 0.5 181.1 2.76E-03 h DGCWP FAILURE TO START 4 933 4.29E-03 4 301.0 1.33E-02

.~ DGCWP FAILURE TO RUN 3 2735 1.10E-03 1 552.0 1.81 E-03 2

> EDG OUTPUT BREAKER FAILS TO FUNCTION 9 1639 5.49E-03 1 191.0 5.24E-03 N HPCI TURBINE FAILS TO START 2 145 1.38E-02 2 53.0 3.77E-02 h HPCI TURBINE FAILS TO RUN

• 0.5 143 2.20E-04 ' O.5 26.5 2.20E-04 '

! RHR PUMP FAILS TO START 0.5 1233 4.05E-04 0.5 1128.0 4.43E-04 5 RHR PUMP FAILS TO RUN 1 1381 7.24E-04 0.5 8666.0 5.77E-05 y RHRSW PUMP FAILS TO START 0.5 966 5.18E-04 1 1740.0 5.75E-04

$* RHRSW PUMP FAILS TO RUN 12 247 2.70E-05 ' 1 14398.0 6.95E-05 RCIC TURBINE FAILS TO START 3 172 1.74E-02 1 93.0 1.08E-02 U RCIC TURBINE FAILS TO RUN 0.5 54 2.20E-04 ' O.5 25.0 2.20E-04

• R SSMP FAILS TO START 0.5 79 6.33E-03 0.5 33.9 4.03 E-03 g SSMP FAILS TO RUN 0.5 59 1.06E-04 ' O.5 25.3 1.06E-04 '

NOTES:

1) lEEE Standard 500-1984 value

2) Not considered a failure per EDG Reliability Program because the 1/2 EDG was not required for the shutdown unit at the time (the Unit EDG was operable). It is, however, considered a failure per PRA rules since the 1/2 EDG was thought to be available to the shutdown unit.

l l

l l

1 l

Attachment 4-A  :

1 i

1 k sia.w..a.inn ,+2 wpr ESK-96-031, Attachment, Page 13 of 45

l l

QUESTION 1 (b)

1. Two aspects of the IPEP methodology are not clearly explained in the Submittal.

(b) It is not clear what recovery means in the IPE. Is it taking credit for extra equipment or operator actions restoring for (sic) equipment? Regardless, it appears that recovery is included in the PRT models before initial calculations were performed instead oi, as typically done, being applied to the dominant sequences. Please provide (1) a clear definition of " recovery,"

(2) a description of the treatment of recovery and (3) the data used for the recovery of offsite power.

RESPONSE TO QUESTION 1 (b)

All of the Comed plants being evaluated have put in place the post-TMI, symptom based .

emergency operating procedures (EOP's) which evolved after that event. These procedures direct the operators to perform specific actions based on the developing symptoms associated with plant accidents of various types without trying to diagnose or classify the accident underway.

The Comed IPE program uses a large event tree model which includes, as nodal ,

questions, both systems responses to an accident and the operator responses per the appropriate EOP. In some cases, detailed procedures exist for system level operator I actions which are more properly included in fault tree modeling. Such actions are not l

" recovery actions" in the Comed IPE terminology but are an integral part of the overall  ;

, plant / operator response to an accident.

The Comed adopted " clear definition of ' recovery'" is an action or actions taken beyond the EOP's to restore failed systems or equipment. Such actions might include restoration of failed equipment or accident management actions beyond the EOPs.

These recovery actions were not modeled in the Comed IPE program. As instructed in NUREG-1335 (and re-iterated at the Fort Worth workshop on IPE's), Comed did not take credit for operator actions which were not proceduralized.

Recovery of offsite power is a special case. This recovery action is included in the Comed IPE's since it is included in the EOP's, as a broad instruction to accomplish the recovery. The methodology used for the calculation of the frequency of recovery actions is based on that found in NUREG-1032, " Evaluation of Station Blackout Accidents at Nuclear Power %ts." The Quad Cities specific calculation of the frequency of recovery of offsite power (Calculation Note OC-CN-93-003) is provided as Attachment 1-1. This calculation also provides the data used for the recovery of offsite power.

1-7 ESK-96-031, Attachment, Page 14 of 45

I Certain recovery is credited in the HRA. This can be within the calculation of a HEP, as  ;

justified by specific procedure steps, or as justified by the presence of the Shift Technical Advisor (STA)'(cr Shift Control Roorn Engineer (SCRE)) and the staffing of the Technical Support Center (TSC).

1-8 ESK-96-031, Attachment, Page 15 of 45