Text

Phase 3 Potential Loss of RHR Due to Inadequate Cooling of Suction Line During Mode 4 to Mode 3 Transition at Wolf Creek
	ML091760764
Person / Time
Site:	Wolf Creek
Issue date:	06/24/2009
From:	Mitman J T, Runyan M F, Zoulis A M; NRC/NRR/DRA/APOB, Division of Reactor Safety IV
To:	;
	Zoulis, A.M. NRR/DRA/APOB 415-1209
Shared Package
ML091760692	List: ML091760764;
References
	Download: ML091760764 (90)
	v • d • e

Phase 3 Potential Loss of RHR Due to Inadequate Cooling of Suction Line During Mode 4 to Mode 3 Transition at Wolf Creek

Probabilistic Risk Assessment (PRA) Analyst: Antonios Zoulis, Reliability and Risk Analyst, NRR/DRA/APOB Probabilistic Risk Assessment (PRA) Analyst: Jeff Mitman, Senior Reliability and Risk Analyst, NRR/DRA/APOB Probabilistic Risk Assessment (PRA) Analyst: Michael Runyan Senior Reactor Analyst, R-IV/DRS Peer Reviewer: Gareth Parry, Senior Level Advisor NRR/DRA

Page 1 1.0 Introduction On October 3, 2008, Wolf Creek reported a condition which affected the Residual Heat Removal System (RHR). The condition existed from at least 1990 to May 2008. This condition would have prevented the RHR system from performing its function due to system piping being saturated during heat up or cool down between Mode 3 and Mode

4. Prior to identifying this condition, Wolf Creek Generating Station during plant startups would have one or both of the RHR trains lined up to the Reactor Coolant System (RCS) for shutdown cooling (SDC) and they would secure them prior to entering Mode 3 from Mode 4 (Mode 3 starts when RCS temperature exceeds 350 oF). A simplified RHR piping schematic is shown in Figure 1. System procedures require the RHR system to be cooled down using the mini-flow recirculation line, following alignment for Emergency Core Cooling System (ECCS) injection mode. The physical location at which the mini-flow piping connects to the suction of the RHR system prevented approximately 140 feet of RHR suction line between the RCS hot leg isolation valve and the mini-flow line location from being cooled, this piping would remain above 198 oF for approximately 29 hours3.356481e-4 days 0.00806 hours 4.794974e-5 weeks 1.10345e-5 months . Licensee analysis indicates that if an RHR pump were switched to injection mode (either manually or from a Safety Injection System (SIS) signal) with water temperature above 198 oF water in the suction piping would flash to steam with the potential consequence of pump steam binding and/or piping water hammer. This would occur because a lowering of system pressure at the pump suction would flash the water into steam, depending upon the initial water temperature. As long as the saturation pressure in the RCS hot leg is higher than the static pressure from the Refueling Water Storage Tank (RWST), the check valve located in the supply line from the RWST will not open and no injection will occur. As the RHR pump is started, the pressure in the RCS hot leg will decrease which will cause the hot pressurized water to flash, before the pressure is low enough to open the check valve. The steam void could extend to the pump suction and steam bind the pump or water hammer could ensue failing the pumps. Likewise, if a Mode 4 Loss of Inventory (LOI), with water temperature between 198 oF and 350 o F, were to occur the operators would align the RHR system for injection and make the pumps susceptible to the failures discussed above.

In both Mode 3 and 4, if a loss of coolant accident (LOCA) or LOI inside containment were to occur, the operators are directed to establish long term cooling via internal recirculation. For low pressure recirculation, the RHR system takes suction from the containment sump and supplies cool water to the RCS. For high pressure recirculation, cases where the pressure is above the shutoff head of the RHR pumps, the RHR system is aligned to take suction from the containment sump and discharges to either the charging system or high pressure injection system. This is referred to as high pressure "piggyback" operation. During any Safety Injection from the RWST, when RWST level reaches 36%, per Wolf Creek design, auto-swapover from the RWST to the containment sump occurs. Opening of the RHR suction valves from the sump would cause a water hammer once the hot piping, exposed to the containment sump atmospheric conditions, flashes. Based on current licensee analysis (the licensee is currently performing more detailed analysis to determine if this assumption is correct) the water hammer would fail the RHR systems ability to provide long-term cooling.

Page 2 Figure 1 Simplified RHR Schematic Drawing Showing Affected Piping

Page 1 In situations where auto-injection was not initiated such as Mode 4 and Mode 3 prior to 1935 psig or when establishing internal recirculation, the pumps would be manually started and the operators have an opportunity to stop the pumps prior to failure 2.0 Discussion of the Performance Deficiency

The licensee's failure to provide adequate procedures for changing modes of operation of the RHR system was a performance deficiency. System procedures require the RHR system to be cooled down using the mini-flow recirculation line, following alignment for Emergency Core Cooling System (ECCS) injection mode from SDC. The physical location at which the mini-flow piping connects to the suction of the RHR system prevented approximately 140 feet of RHR suction line between the RCS hot leg isolation valve and the mini-flow line location from being adequately cooled. This resulted in water temperatures as high as 350 oF in the RHR suction line. If the RHR system was started with this elevated suction temperature, the potential existed for steam binding and/or water hammer damaging the pumps.

3.0 Applicable Plant Modes During Condition The condition was applicable during transition from Mode 4 to Mode 3 when the RCS temperature exceeded approximately 198 oF. Since the condition spanned many years of plant operation, the 12 month period with the longest duration in this configuration was used for the analysis. Based on licensee review, in 2002 the site conducted a refueling outage and a forced outage. The RHR system was vulnerable to steam binding and/or water hammer for a total duration of 143.68 hours7.87037e-4 days 0.0189 hours 1.124339e-4 weeks 2.5874e-5 months .

4.0 Licensee Event Mitigation Capability The site transition from Mode 4 to Mode 3 requires most equipment to be operable or available. Accumulators were not available until RCS pressure exceeded approximately 1000 psig and the Turbine Driven Auxiliary Feed pump was not available since secondary side steam pressure never exceeded 900 psig during the analyzed duration for this condition.

5.0 Significance Determination Process (SDP) Phase 2 Summary Since this concern only exists while the plant was shutdown, the inspectors evaluated this finding in accordance with NRC Inspection Manual Chapter 0609 Appendix G, "Shutdown Operations Significant Determination Process (SDP)," February 28, 2005. Specifically, Appendix G, Attachment 2: "Phase 2 Significance Determination Process Template for PWR during Shutdown" was used. As part of the SDP, the inspectors assess conditions or events that represent a loss of control. The inspectors used the loss of RHR worksheets. Using a duration of 3-30 days and evaluating all LOCA initiators and SGTR, the finding was found to be greater than green and per Appendix G the analysis was submitted to Headquarters for evaluation.

6.0 Initiation of a Phase 3 SDP Risk Assessmen t The Shutdown SDP proceduralized in IMC 0609, Appendix G, is a tool used to screen shutdown findings for potential significance. This finding could not be screened as Page 2 having very low significance using the Phase 2 analysis. Therefore, a Phase 3 SDP risk assessment was performed by the Office of Nuclear Reactor Regulation (NRR).

The analysts used the following references in preparing the risk assessment:

NUREG/CR-6883, "The SPAR-H Human Analysis Method." August 2005

NUREG-1842, "Good Practices for Implementing Human Reliability Analysis." April 2005

NUREG/CR-6595 Revision 1, "An Approach for Estimating the Frequencies of Various Containment Failure Modes and Bypass Events." October 2004 7.0 Development of the Model

No Low Power/Shutdown (LP/SD) or Transitional Power SPAR model exists for the Wolf Creek site. Therefore, the at-power Wolf Creek SPAR model was modified to allow analysis of the potential loss of RHR condition. Since the condition transitions between Mode 4 and Mode 3, potential initiators for both modes were evaluated. In addition, each mode was divided into specific plant operating states (POS) to account for changing plant conditions, equipment availability, and plant response. Figures 2 and 3 delineate the two modes and plant response during the analyzed condition for Wolf Creek Refueling Outage 12 (RF12) and Forced Outage 2002 respectively.

New event trees (ET) were created to analyze the condition for Small LOCA (SLOCA) and Medium LOCA (MLOCA) in Mode 3 and Loss of Inventory (LOI) inside and outside containment in Mode 4.

These ETs are shown in Appendix A. The ETs were linked to existing at-power fault trees (FT) and/or new FTs as required. The existing FTs were modified as necessary to appropriately describe system dependencies during applicable conditions and the different success criterion.

8.0 Model Assumptions

The major assumptions for the analysis are as follows:

For all initiators in modes 3 and 4, the RHR pumps are assumed to fail either due to the steam binding or water hammer which occurs on auto-swapover from the RWST to the containment sump. This is a conservative assumption which the licensee is currently evaluating.

For all initiators in modes 3 and mode 4, the licensee has determined that the temperature necessary to prevent RHR damage is 198 oF. The original value cited in their root cause analysis was 250 oF. This lower temperature increases the duration of this condition but is a conservative value and the licensee is performing a calculation to obtain a more accurate value.

For all initiators in modes 3 and 4, at-power maintenance terms were not quantified since they are not representative of transitional mode maintenance activities

For MLOCA and SLOCA initiator frequencies in Mode 3, the analysis used the Wolf Creek at-power SPAR Model frequencies.

LOI inside and outside containment for Mode 4, the initiating event frequency used is from EPRI TR-1003113 "Analysis of Loss of Decay Heat Removal Trends & Initiating Event Frequencies (1989 - 2000)." This frequency may be conservative since it Page 3 Figure 2 Wolf Creek RF12 Press Temp Curve

-100.0 200.0300.0400.0500.0600.0 4/2 4/02 13:16 4/2 4/02 17:1 5 4/2 4/02 21:0 0 4/25/02 0:4 5 4/2 5/02 4: 3 0 4/25/02 8:15 4/25/02 12:00 4/25/02 1 5:45 4/25/02 1 9:30 4/25/02 2 3:15 4/26/02 3:00 4/26/02 6:45TimeTemperature

-500.01,000.01,500.02,000.02,500.0PressureThot (BBU0013)Press (BBP0403)Mode 4Both Trains of RHR in SDCMode 3Both Trains of RHR in LPIAccumulators Available 1000 psigECCS Auto Initiation 1930 psig, Low pressurizer pressure 350 o FPOS 4POS 3aPOS 3bPOS 3cECCS Auto Initiation Containment Hi pressure > 4.5 psig (MLOCA)

Page 4 Figure 3 Wolf Creek 2002 Forced Outage Press Temp Curve

-100.0 200.0 300.0400.0500.0 600.05/18/02 17:52 5/1 8/02 18: 33 5/1 8/02 19: 2 3 5/1 8/02 20: 13 5/1 8/02 21: 0 3 5/1 8/02 21: 53 5/1 8/02 22: 4 3 5/18/0 2 23: 33 5/19/02 0: 23 5/1 9/02 1:1 3 5/19/02 2: 03 5/1 9/02 2:5 3 5/19/02 3:4 3 5/1 9/02 4:3 3 5/19/02 5:1 3 5/19/02 6:03 5/19/02 6:5 3 5/19/02 7:43 5/19/0 2 8:3 3 5/19/02 9:23 5/1 9/02 1 0: 135/19/02 11

03 5/1 9/02 1 1: 535/19/02 12:43 5/1 9/02 13: 335/19/02 14:23 5/1 9/02 15: 135/19/02 16:03 5/1 9/02 16: 53 5/1 9/02 17: 4 3TimeTemperature

-500.0 1,000.0 1,500.0 2,000.02,500.0PressureThot (BBU0013)Press (BBP0403)

Accumulators Available 1000 psigMode 4Both Trains of RHR in SDCMode 3Both Trains of RHR in LPI 350 o FECCS Auto Initiation 1930 psig, Low pressurizer pressurePOS 4POS 3aPOS 3bPOS 3cECCS Auto Initiation Containment Hi pressure > 4.5 psig (MLOCA)

Page 5 incorporates loss of inventory events in mode 4, 5, and 6 of PWR shutdown operation.

The duration for cool down where this condition was applicable was approximately 5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months . For a condition of this short duration to contribute significantly to the overall risk, the CDF would have to exceed 5E-4 per year. There is no indication that CDF would approach this value. Therefore, these short durations during cooling down were not evaluated separately in this analysis but the cooldown exposure was added to the overall exposure of 143.68 hours7.87037e-4 days 0.0189 hours 1.124339e-4 weeks 2.5874e-5 months .

SGTR initiator was not analyzed due the ability of the plant to equalize pressure and terminate the tube leak before RHR injection would be required. In addition, the leak size is very small and within the capacity of the charging system to maintain level 9.0 HRA Analysis Mode 4 operation is highly dependent on operator actions as most of the required actions are manual (e.g., initiating feed of the RCS). Additional analysis was conducted to properly characterize the required manual actions. The HEPs were calculated using the Low Power Shutdown SPAR-H worksheets from NUREG/CR-6883. Consideration was given to the available time to perform the action, the stress levels of the crew during the event, complexity of the action, crew experience and applicable and relevant training, quality and thoroughness of procedures, ergonomics, fitness of duty issues, and the available work processes.

The Mode 3 HEPs utilized the at-power model human actions. These values can be conservative since the available times may be longer since the plant is still below normal operating temperature and pressure for most of the duration of this condition and the decay heat levels are significantly lower than for events initiating at power. Table 1 shows a summary of the HEPs, a detailed discussion of the HRA is given in Appendix B.

In addition to the calculation of specific HEPs for this condition, sequences or cutsets which involved multiple operator actions were examined for human action dependency in all modes. Such dependency can occur due to a common cue or short/limited time separation between different cues. The method of identifying dependent operator actions involved reviewing the cutsets that were generated following quantification of the accident sequences. Once those HFEs that were dependent on previously occurring HFEs were identified, SPAR-H was used to perform the initial dependency analysis to calculate the dependent HEP values. Those dependent HEPs and their corresponding values are reported in Table 2. A more detailed description of the dependency analysis is given in Appendix B.

Page 6 Table 1 Summary of HRA Results Human Error Event Description Operator Shifts Time Available Mean Diagnosis HEP Mean Action HEP Total Mean HEP Mode 4 Human Failure Events SD-SLOI-DIAG-XHE Operator fails to diagnose small LOI outside of containment before loss of SDC One 70 min. 1.0E-3 0 1.0E-3 SD-SLOI-FEED-XHE Operator fails to initiate feed before loss of SDC One 70 min. 2.0E-3 2.00E-03 4.0E-3 SD-SLOI-FEED-LT-XHE Operator Fails to Initiate feed after loss of SDC, before core damage One 90 min. 2.0E-3 1.00E-03 3.0E-3 SD-SLOI-ISOL-AFD-XHE Operator fail to terminate SLOI leak before RWST is depleted Two ~25 hrs. 0 1.0E-5 1.0E-5 SD-SLOI-ISOL-BRF-XHE Operator fails to terminate SLOI leak before SDC fails One 60 min. 0 2.0E-3 2.0E-3 SD-SLOI-LTR1-XHE Operators fail to Refill BWST as Part of Long Term Recovery Two ~25 hrs. 1.0E-2 2.0E-3 1.2E-2 SD-SLOI-LTR2-XHE Operators fail to Restart LPI in SDC Mode as Part of Long Term Recovery Two ~25 hrs. 0 2.0E-3 2.0E-3 Mode 3 Human Failure Events M3-DHC-REC-LATE Operators fail to Refill RWST as Part of Long Term Recovery when Pressure is Below 1000psig One ~5hrs 1.0E-1 4.0E-04 1.0E-1 M3a-DHC-REC-LATE Operators fail to Refill RWST as Part of Long Term Recovery when Pressure is Above 1000psig One ~5hrs 1.0E-2 4.0E-04 1.0E-2 Notes: Estimated TTB = 120 minutes Estimated TTCD is 90 minutes if drain down continues to midloop Success criteria > 100 gpm

Page 7 Table 2 Summary of Dependent HEP Results Dependent HEP Name Description Applicable Operator Action Failures Independent HEP SPAR-H Dependent HEP SD-SLOI-FEED-LT-XHE-D1 Operator fails to diagnose LOI before loss of SDC and feed RCS late before CD SD_SLOI_DIAG_XHE

SD_SLOI_FEED_LT_XHE 3.0E-03 5.3E-02 SD-SLOI-ISOL-BRF-XHE-D2 Operator fails to feed before loss of SDC, isolate LOI before loss of SDC, and feed after loss of SDC SD-SLOI-FEED-XHE

SD-SLOI-ISOL-BRF-XHE

SD-SLOI-FEED-LT-XHE 2.0E-03 5.2E-02 SD-SLOI-FEED-LT-XHE-D2 Operator fails to feed before loss of SDC, isolate LOI before loss of SDC, and feed after loss of SDC SD-SLOI-FEED-XHE

SD-SLOI-ISOL-BRF-XHE

SD-SLOI-FEED-LT-XHE 3.0E-03 1.5E-01 SD-SLOI-FEED-LT-XHE-D3 Operator fails to isolate LOI and feed after loss of SDC SD-SLOI-ISOL-BRF-XHE

SD-SLOI-FEED-LT-XHE 3.0E-03 5.3E-02 SD-SLOI-FEED-LT-XHE-D4 Operatory fails to feed before loss of SDC and feed after loss of SDC SD-SLOI-FEED-XHE

SD-SLOI-FEED-LT-XHE 3.0E-03 5.3E-02 SD-SLOI-ISOL-BRF-XHE-D6 Operator fails to feed early and fails to isolate before loss of SDC SD-SLOI-FEED-XHE

SD-SLOI-ISOL-BRF-XHE 2.0E-03 5.2E-02 SD-SLOI-LTR1-XHE-D7 Operator fails to isolate LOI and makeup to BWST SD-SLOI-ISOL-AFD-XHE

SD-SLOI-LTR1-XHE 1.2E-02 1.2E-02 Page 8 10.0 Conditional Core Damage Probability (CCDP) Assessment Results A detailed Phase 3 Significance Determination Process risk analysis was performed. NRC Inspection Manual Chapter (IMC) 0609 Appendix G Attachment 2 supplies guidance for performing Phase 2 analysis during modes 4, 5, & 6. Section 4.4 of this procedure directs the analyst to access the significance of shutdown events by calculating an incremental conditional core damage probability (ICCDP). NRC Inspection Manual Chapter (IMC) 0609 Appendix A applies to at-power conditions. The inspection manual chapters do not address transition modes between hot shutdown and at-power. The analyst analyzed this condition by calculation the ICCDP. The above described SPAR model was evaluated using the SAPHIRE code version 7.27.

As stated above, the condition in question was applicable for Mode 3 and 4 when the RHR suction temperature exceeded approximately 198 oF. This impacted the ability of the station to utilize RHR for injection, recirculation, and long-term cooling. The initiators evaluated consisted of MLOCA and SLOCA for Mode 3 and LOI inside and outside containment in Mode 4. During 2002, Wolf Creek conducted a refueling outage and a force outage. Both outages were analyzed for this condition.

Each Mode was divided into specific POSs which accounted for different initial plant conditions. It is important to note that this analysis assumes failure of the RHR pumps with no credit for recovery. The POS was evaluated separately for its base case CDF and its conditional CDF. The delta CDF was then multiplied by the duration to calculate the CCDP. The duration for each POS was initially developed by the licensee and verified by the analyst using plant pressure temperature data. In the "Plant Operating State Evaluation

" section is a description of each POS and its applicable assumptions. Tables 3a and 3b, which follows, describe the outages, modes, POSs, initial conditions, durations, base case CDF, conditional CDF, and the final CCDP. The result of the CCDP analysis is 2.84E-7. Based on these results the finding is of low safety significance, and the color is green.

The analysis included POSs in hot shutdown and hot standby. In hot shutdown, the analyst determined that shutdown initiators should be used. These include LOI, loss of off-site power (LOOP), and loss of shutdown cooling (LOSDC). After reviewing the applicable event trees, the analyst determined that the plant response to LOOP and LOSDC would not impacted by the unavailability of RHR. Since this condition renders the RHR unavailable during injection, a loss of RHR would not result in a substantial delta CDF from the base case LOSDC. Likewise, during a LOOP, the initiator does not postulate a LOCA which would require the RHR to be used for injection and thus does not contribute to the delta CDF for this analysis. Therefore, these initiators were not analyzed.

In hot standby, the internal event initiators for the at-power SPAR model were reviewed. These are shown in the below table:

At-power Internal Initiating EventsLoss of DC Bus NK01 Initiating Event Loss of DC Bus NK04 Initiating Event LARGE LOSS OF COOLANT ACCIDENT INITIATING EVENT ISLOCA IE 2-CKV HPI interface LOSS OF SERVICE WATER COOLING INITIATING EVENT LOSS OF CONDENSER HEAT SINK Page 9 At-power Internal Initiating EventsLOSS OF MAIN FEEDWATER ISLOCA IE 2-CKV LPI interface REACTOR VESSEL RUPTURE INITIATING EVENT Loss of Component Cooling Water Initiating Event TRANSIENT SMALL LOCA VERY SMALL LOCA SMALL LOCA - M3 MEDIUM LOCA LOSS OF OFFSITE POWER STEAM GENERATOR TUBE RUPTURE Bounding sensitivity analyses were performed by conservatively assuming the RHR pumps were failed. Without applying recovery, the delta CDF was quantified from the base case CDF and the conditional CDF. From these bounding sensitivity analyses, the only initiating events that are applicable or contribute to the risk in this analysis are the small and medium LOCA initiating events. Therefore, these were the only two that were analyzed.

External events for this analysis were not analyzed since the probability of those events coupled with the loss of inventory or LOCA would be very low and not contribute significantly to the overall CCDP.

Plant Operating State Evaluation Mode 4 (Applicable to RF12 and Forced Outage 2002) POS-4a and LOI Outside Containment In this POS, the plant is heating up and transition from Mode 4 to Mode 3. The transition point to Mode 3 is 350 oF. At the time of this condition, the RHR pumps ran in shutdown cooling until approximately 350 oF. If a LOI outside containment were to occur, the operators would attempt to isolate the leak, monitor level, and initiate feed as required. The RHR pumps, if required, would be aligned to inject into the RCS. If feed is successful the operators have more time to isolate the leak and recover from the event. The operators have procedural guidance to refill the RWST and provided cool water to the RCS to prevent core damage in the event RHR is lost. In this condition the analyst assumed the pumps would steam bind or water hammer preventing the RHR systems from providing injection and long-term cooling.

Page 10 POS-4b and LOI Inside Containment In this POS, the plant is heating up and transitioning from Mode 4 to Mode 3. The transition point to Mode 3 is 350 oF. At the time of this condition, the RHR pumps ran in shutdown cooling until approximately 350 oF. If a LOI inside containment were to occur, the operators would attempt to isolate the leak, monitor level, and initiate feed as required. The RHR pumps, if required, would be aligned to inject into the RCS. If feed is successful the operators have more time to isolate the leak and recover from the event. The operators have procedural guidance to refill the RWST and provided cool water to the RCS to prevent core damage in the event RHR is lost. In this condition the analyst assumed the pumps would steam bind or water hammer preventing the RHR systems from providing injection and long-term cooling.

POS-3a1 and MLOCA (No Accumulators)

In this POS, the plant is in MODE 3, below 1000 psig, continuing to heat-up to normal operating temperature and pressure when a medium LOCA occurs. The accumulators are not available as the plant RCS pressure is below 1000 psig. If containment pressure exceeds 4.5 psig an auto-ECCS will occur, pressure will decrease rapidly and the RHR pumps will begin injecting immediately from the RWST. When the RHR pumps start the suction piping will flash to steam rending the RHR pumps unavailable for injection or recirculation. The operators can maintain injection with other sources but require a long-term cooling success path via refilling the RWST or restoration of a RHR train. The operators have procedural guidance to refill the RWST and provided cool water to the RCS to prevent core damage in the event RHR is lost.

POS-3b1 and MLOCA In this POS, the plant is in MODE 3, above 1000 psig, continuing to heat-up to normal operating temperature and pressure when a medium LOCA occurs. The accumulators are available as the plant is above 1000 psig and inject (technical specification requires accumulator operable before exceeding this pressure). If containment pressure exceeds 4.5 psig an auto-ECCS will occur pressure will decrease rapidly and the RHR pumps will begin injecting immediately from the RWST. When the RHR pumps start, the suction piping will flash to steam rending the RHR pumps unavailable for injection or recirculation. The operators can maintain injection with other sources but require a long-term cooling success path via refilling the RWST or restoration of a RHR train. The operators have procedural guidance to refill the RWST and provided cool water to the RCS to prevent core damage in the event RHR is lost. POS-3c1 and MLOCA (Auto-ECCS)

POS is similar to POS-3b1 except the Wolf Creek P-7 interlock is cleared once the RCS pressure exceeds 1935 psig. P-7 disables the auto-ECCS due to low pressurizer pressure when the plant is performing a controlled plant shutdown. With RCS pressure above 1935 psig an auto-ECCS will result when either containment pressure exceeding 4.5 psig or pressurizer pressure falls below 1935 psig. POS-3a2 and SLOCA (No Accumulators)

In this POS, the plant is in MODE 3, below 1000 psig, continuing to heat-up to normal operating temperature and pressure when a small LOCA occurs. The accumulators are Page 11 not available as the plant RCS pressure is below 1000 psig. Auto-ECCS will not initiate on containment pressure as pressure will not exceed 4.5 psig, and the low pressurizer pressure interlock (P7) has not been cleared. The plant can mitigate the SLOCA using its charging system, high pressure injection system, or low pressure injection system. Secondary cooling is available via the auxiliary feedwater or main feedwater start-up pumps. The most probable sequences involve successful injection and the necessity to establish long-term cooling. If the operators begin to establish internal recirculation from the containment sump, the suction piping will flash to steam and the subsequent water hammer will render the RHR pumps unavailable for injection or recirculation. The operators can maintain injection with other sources such as high pressure injection and charging until the RWST is depleted and therefore, require a long-term cooling success path via refilling the RWST. The operators have some procedural guidance to refill the RWST and provided cool water to the RCS to prevent core damage in the event RHR is lost. POS-3b2 and SLOCA In this POS, the plant is in MODE 3, above 1000 psig, continuing to heat-up to normal operating temperature and pressure when a small LOCA occurs. The accumulators are available as the plant is above 1000 psig. Auto-ECCS will not initiate on containment pressure as pressure will not exceed 4.5 psig, and the low pressurizer pressure interlock (P7) has not been cleared. The plant can mitigate the SLOCA using its charging system, high pressure injection system, or low pressure injection system. Secondary cooling is available via the auxiliary feedwater or main feedwater start-up pumps. The most probable sequences involve successful injection and the necessity to establish long-term cooling. If the operators begin to establish internal recirculation from the containment sump, the suction piping will flash to steam and the subsequent water hammer will render the RHR pumps unavailable for injection or recirculation. The operators can maintain injection with other sources until the RWST is depleted and therefore, require a long-term cooling success path via refilling the RWST. The operators have procedural guidance to refill the RWST and provided cool water to the RCS to prevent core damage in the event RHR is lost. POS-3c2 and SLOCA (Auto-ECCS)

This POS is similar to POS-3b2 except the Wolf Creek P-7 block is cleared once RCS pressure exceeds 1935 psig. P-7 disables the auto-ECCS due to low pressurizer pressure when the plant is in a controlled shutdown. Therefore, an auto-ECCS will result due to low pressurizer pressure below 1935 psig. The safety injection signal will start the charging system, high pressure injection system, and low pressure injection system as well as other systems. Secondary cooling is available via the auxiliary feedwater and main feedwater start-up pump. The RHR pumps will start but not inject as pressure in the RCS will remain above the pump shutoff head of approximately 300 psig. Wolf Creek procedures direct the operators to monitor level and reduce injection flow rate as necessary. The most probable sequences involve successful injection and the necessity to establish long-term cooling. When the operators begin to establish internal recirculation from the RWST, the suction piping will flash to steam and the subsequent water hammer will render the RHR pumps unavailable for injection or recirculation. The operators can maintain injection with other sources until the RWST is depleted and therefore, require a long-term cooling success path via refilling the RWST. The operators have procedural guidance to refill the RWST and provided cool water to the RCS to prevent core damage in the event RHR is lost.

Page 12 ModePOSInitial ConditionsDuration (Hrs)InitiatorBase Case CDF/yrConditional CDF/yrICCDP 4aIE-LOI-OC1.48E-051.73E-055.65E-09 4bIE-LOI-IC1.47E-051.73E-055.70E-09 3a1Both RHR Trains aligned for LPI, Accumulators not available, Auto ECCS, TD AFW not availableIE-MLOCA1.49E-072.42E-057.53E-09 3a2Both RHR Trains aligned for LPI, Accumulators not available, Manual ECCS, TD AFW not availableIE-SLOCA3.43E-077.23E-052.26E-083b1Both RHR Trains aligned for LPI, Accumulators available, Auto ECCS, TD AFW not availableIE-MLOCA1.48E-076.57E-061.41E-083b2Both RHR Trains aligned for LPI, Accumulators available, Manual ECCs Initiation, TD AFW not availableIE-SLOCA3.43E-071.95E-054.20E-08 3c1IE-MLOC A1.48E-076.57E-062.71E-08 3c2IE-SLOC A3.43E-077.48E-063.01E-0878.51.55E-07ModePOSDescriptionDuration (Hrs)IEBase Case CDF/yrConditional CDF/yrICCDP 4aIE-LOI-OC1.48E-051.73E-051.79E-09 4bIE-LOI-IC1.47E-051.73E-051.81E-09 3a1Both RHR Trains aligned for LPI, Accumulators not available, Auto ECCS, TD AFW not availableIE-MLOCA1.49E-072.42E-059.12E-09 3a2Both RHR Trains aligned for LPI, Accumulators not available, Manual ECCS, TD AFW not availableIE-SLOCA3.43E-077.23E-052.73E-083b1Both RHR Trains aligned for LPI, Accumulators available, Auto ECCS, TD AFW not availableIE-MLOCA1.48E-076.57E-061.76E-093b2Both RHR Trains aligned for LPI, Accumulators available, Manual ECCs Initiation, TD AFW not availableIE-SLOCA3.43E-071.95E-055.24E-09 3c1IE-MLOCA1.48E-076.57E-063.90E-08 3c2IE-SLOC A3.43E-077.48E-064.34E-0865.181.29E-07Total CCDP2.84E-072.75Mode 337.006.18Mode 4Both RHR Trains aligned for shutdown coolingTable 3b Wolf Creek 2002 Force Outage Power Ascension Time Windows2002 Forced OutageBoth RHR Trains aligned for LPI, Accumulators available, Auto ECCS Initiation, TD AFW not availableMode 3Both RHR Trains aligned for LPI, Accumulators available, Auto ECCS Initiation, TD AFW not available53.27Mode 3Table 3a Wolf Creek 2002 RF12 Power Ascension Time Windows19.5Both RHR Trains aligned for shutdown coolingMode 42002 RF1219.25Mode 3 (<1000 psig)Mode 32.4Mode 3 (<1000 psig)3.33 Page 13 11.0 Conditional Large Early Release Probability (CLERP) Assessment The figure of merit for this analysis is incremental conditional large early release probability (ICLERP). This ICLERP analysis is based on the method for shutdown described in NUREG/CR-6595 Revision 1, "An Approach for Estimating the Frequencies of Various Containment Failure Modes and Bypass Events," dated 10/2004. This report supplies simplified containment event trees (CET) to determine if the core damage sequence contributes to LERF. NUREG/CR-6595 presents its analysis in terms of LERF, which is interpreted here as ICLERP.

NUREG/CR-6595 defines LERF as "- the frequency of those accidents leading to significant, unmitigated releases from containment in a time frame prior to effective evacuation of the close-in population such that there is a potential for early health effects." This is identical to the definition of LERF in IMC 0609 Appendix H. Figure 4.1 (PWR Large Dry Containment Event Tree) from NUREG/CR-6595 is applicable to the Wolf Creek condition.

The analysis can be divided into containment bypass events and non-containment bypass events. The only containment bypass events were LOI outside containment events. For the non-containment bypass events the CCDP is 2.77E-7 by subtracting the bypass sequences from the total CDF. Therefore, the review of the LERF event tree yields a worst case containment failure probability for the Wolf Creek containment of 1E-2. With a CCDP of 2.77E-7 this yields a CLERP of 2.72E-9 which is a green.

The LOI outside containment CCDP is 7.45E-9 which bypasses containment. Assuming a LERF factor of 1.0, the CLERP for those sequences is less than 1E-07 which is green.

12.0 Sensitivity Analysis Several sensitivity cases were conducted to further understand the event. The cases are described below. Case 1: Assume Operator Action to Refill RWST Fails This sensitivity case assumed that the refill of the RWST failed for all initiators. It was calculated by setting all RWST operator action to True (1.0). The calculated CCDP was 1.20E-05. Case 2: Assume Operator Action to Refill RWST is Successful This sensitivity case assumed that the refill of the RWST succeeded for all initiators. It was calculated by setting all RWST operator action to False (0.0). The calculated CCDP was 8.31E-08.

Page 14 Case 3: Assume value for Operator Action to Refill RWST which results in CCDP of 1E-06. This sensitivity case calculated the probability of refill of the RWST which would result in a CCDP of 1.00E-06. The M3-DHC-REC-LATE and M3a-DHC-REC-LATE probability would be 1E-01. Given the applicable procedures and level of training of the operators an HEP value of this magnitude is not realistic.

Case 2: Assume no credit for Operator Action to Refill RWST below 1000psig in Mode 3 and Mode 4. This sensitivity case assumed that the refill of the RWST failed for all initiators when pressure is below 1000psig for mode 3 and mode 4. The calculated CCDP was 2E-06. This illustrates the importance of the operator actions during shutdown and is a potential area for improvement. The plant should evaluate revising the applicable mode 3 and mode 4 procedures.

Page 15

Appendix A: Model Figures

Page 16 Figure A-1: Mode 4 - Loss of Inventory Outside Containment Event Tree SD-SLOI-LTR-FTLong term recoveryin SLOISD-SLOI-FEED-LT-FTOperators initiate feed after RHR failure; before core damageSD-SLOI-ISOL-FTOperatorsterminate SLOISD-SLOI-FEED-FTOperators initiateRCS FEED SD-SLOI-DIAGOperators Diagnose SLOI Eventbefore loss of RHRIE-M4-SLOI-OCSLOI Outside of ContainmentOccurs -M4

END-STATE1 OK2 OK3 CD-SD4 OK 5 OK6 CD-SD7 CD-SD8 OK9 CD-SD10 CD-SDSD-SLOI-ISOL-AFD-FTSD-SLOI-ISOL-BRF-FTSD-SLOI-LTR-FT1SD-SLOI-LTR-FT2 SD-SLOI-LTR-FT2 M4-SLOI-OC - Small Loss of Inventory Event Occurs in M4 - Inside Containment2009/06/23

Page 17 Figure A-2: Mode 4 - Loss of Inventory Inside Containment Event Tree SD-SLOI-LTR-FTLong term recoveryin SLOISD-SLOI-FEED-LT-FTOperators initiate feed after RHR failure; before core damageSD-SLOI-ISOL-FTOperatorsterminate SLOISD-SLOI-FEED-FTOperators initiateRCS FEED SD-SLOI-DIAGOperators Diagnose SLOI Eventbefore loss of RHRIE-M4-SLOI-ICSLOI Inside of ContainmentOccurs -M4

END-STATE1 OK2 OK3 CD-SD 4 OK5 OK6 CD-SD 7 CD-SD8 OK9 CD-SD10 CD-SDSD-SLOI-ISOL-AFD-FTSD-SLOI-ISOL-BRF-FTSD-SLOI-LTR-FT1SD-SLOI-LTR-FT1SD-SLOI-LTR-FT2 M4-SLOI-IC - Small Loss of Inventory Event Occurs in M4 - Inside Containment2009/06/23

Page 18 M3-DHC-RECOVDecay heat coolingrecovery in mode 3HPR-M3HIGHPRESSURERECIRC LPR-M3 LOWPRESSURERECIRC LPI-M3LOWPRESSUREINJECTIONSSC-M3COOLDOWN(PRIMARY ANDSECONDARY)AFW-A-M3AUXILIARYFEEDWATER ACCACCUMULATOR3-OF-3HPI-M3HIGHPRESSUREINJECTIONIE-M3-MLOCAMEDIUM LOCA - M3

END-STATE1 OK2 OK3 OK4 CD5 OK6 CD7 OK 8 CD9 OK10 CD11 CD12 CD 13 CD14 CDSSC1 M3-MLOCA - Medium LOCA Event Occurs During M32009/05/20Figure A-3: Mode 3 - Medium LOCA Event Tree

Success Path Page 19 Figure A-4: Mode 3 - Small LOCA Event Tree M3-DHC-RECOdecay heat coolingrecovery in mode 3 LPR-M3LOWPRESSURERECIRC HPR-M3HIGHPRESSURERECIRCRHR-M3RESIDUALHEATREMOVALLPI-M3LOWPRESSUREINJECTIONSSC-M3COOLDOWN(PRIMARY ANDSECONDARY)FAB-M3FEED ANDBLEEDHPI-M3HIGHPRESSUREINJECTIONFW-M3FEEDWATERAVAILABLEMFW or AFWIE-M3-SLOCASMALL LOCA - M3

END-STATE1 OK2 OK3 OK4 OK5 CD6 OK 7 CD 8 OK 9 OK10 CD11 CD12 CD13 OK 14 CD15 CDSSC1 M3-SLOCA - Small LOCA Event Occurs During M32009/05/13 Success Path Page 20 Figure A-5: Mode 4 - Operators Diagnose LOI Event Before Loss of RHR Fault Tree SD-SLOI-DIAG1.000E-3SD-SLOI-DIAG-XHEOperators DiagnoseSmall LOI Outsideof ContainmentEventOperators fail to diagnosesmall LOI outside ofcontainment before loss ofSDC SD-SLOI-DIAG - Operators Diagnose SLOI Event before loss of RHR2008/09/01Page 280

Page 21 Figure A-6: Mode 4 - Operators initiate RCS FEED Fault Tree SD-SLOI-FEED-FT4.000E-3SD-SLOI-FEED-XHESD-SLOI-INJ 133HPI 69CVC189LPIOperators initiateRCS makeup forSLOI outsidecontainment eventRCS Injection MethodsEquipmentHIGH PRESSUREINJECTION WOLF CREEK CHARGINGSYSTEM LOW PRESSUREINJECTION Operator fails to initiatefeed before loss of SDC SD-SLOI-FEED-FT - Operators initiate RCS FEED2009/05/07Page 281

Page 22 Figure A-7: Mode 4 - Operators terminate LOI After Feed Initiates Fault Tree SD-SLOI-ISOL-AFD-FT1.000E-5SD-SLOI-ISOL-AFD-XHE1.000E-6SD-ISOL-EQP-FAILURESOperators terminateSLOI after feed initiates Operators fail toterminate SLOI leakbefore RWST is depletedFAILURES OF EQUIPMENTTO ISOLATE SD-SLOI-ISOL-AFD-FT - Operators terminate SLOI after feed initiates2009/05/07Page 299

Page 23 Figure A-8: Mode 4 - Operators terminate LOI Before Loss of RHR Fault Tree SD-SLOI-ISOL-BRF-FT2.000E-3SD-SLOI-ISOL-BRF-XHE1.000E-6SD-ISOL-EQP-FAILURESOperators terminate SLOIbefore SDC fails (RCS leveldrops below midloop)FAILURES OF EQUIPMENTTO ISOLATEOperator fail to terminateSLOI leak before SDCfails SD-SLOI-ISOL-BRF-FT - Operators terminate SLOI before SDC fails (RCS level drops below midloop)2009/06/04Page 301

Page 24 Figure A-9 Mode 4 - Operators initiate feed after RHR failure; before core damage Fault Tree SD-SLOI-FEED-LT-FT3.000E-3SD-SLOI-FEED-LT-XHESD-SLOI-FEED-LT-FT2133HPI189LPI 69CVCOperators initiate RCSmakeup for SLOI outsidecontainment event 3before CDInjection MethodsHIGH PRESSUREINJECTION LOW PRESSUREINJECTION WOLF CREEK CHARGINGSYSTEM Operators fail to initiatefeed after loss of SDC;before core damage SD-SLOI-FEED-LT-FT - Operators initiate feed after RHR failure; before core damage2009/05/07Page 283

Page 25 Figure A-10 Mode 4 - Late Recovery and Refill of RWST Fault Tree 140 HPR194LPRSD-SLOI-LTR-FT1TRUEGCSS-FLAGGCSS-CSS-FLAG1.200E-2SD-SLOI-LTR1-XHE6.270E-5CSS-MDP-CF-START1.043E-5CSS-MDP-CF-RUN5.379E-4CSS-MDP-FR-P1B5.379E-4CSS-MDP-FR-P1A1.500E-3CSS-MDP-FS-P1B1.500E-3CSS-MDP-FS-P1AGCSS-CCFGCSS-PUMP-1BGCSS-PUMPS-RUNGCSS-PUMPSGCSS-PUMPS-START-RUN7.430E-4CSS-XVM-CC-V0001GCSS-FLOW-PATHGSD-RWST-REFILL7.430E-4CSS-XVM-CC-V00241.000E-3CSS-AOV-CC-HV001SD-SLOI-LTR2-FT3GRWST-MAKEUP-INJ-M4A129FPS309GRWS-MAKEUPHIGH PRESSURE RECIRC LOW PRESSURE RECIRC Long Term Recovery inLOIOperators fail to RefillRWST as Part of LongTerm RecoveryCSS PUMPS FAIL FROMCOMMON CAUSE TOSTART CSS PUMPS FAIL FROMCOMMON CAUSE TO RUN CSS PUMP P1B FAILS TORUN CSS-PUMP P1A FAILS TORUN CSS PUMP P1A FAILSTO STARTCCF OF CONTAIMENTPUMPS TO STARTAND RUNCONTAINMENT SPRAYPUMPS FAILCSS PUMPS FAIL TO RUNCSS PUMP 1B FAILSTO START OR RUNCSS PUMP P1B FAILSTO START CSS PUMPS FAIL 1A &1B FAIL TO START ORRUNCSS MANUAL VALVEFAILS TO OPEN CSS FLOW PATHFAILS TO THE RWSTMakeup to RWSTFAILURE OFCONTAINMENT SPRAYTO REFILL RWSTCSS MANUAL VALVEFAILS TO OPEN CSS ISOLATION VALVEFAILS TO OPEN GATE TURNS ON OROFF FOR RWSTMAKEUPFIRE PROTECTIONSYSTEN UNAVAILABLE FAILURE OF RWSTMAKEUP INJECTIONFLAG TURNS ON OROFF MAKEUP FORRWSTFAILURE OF REACTORWATER MAKEUPSYSTEM SD-SLOI-LTR-FT1 - Long Term Recovery in LOI2009/05/20Page 304

Page 26 Figure A11- Mode 3 - Auxiliary Feed Water Fault Tree FW-M3FW-AFW-FAIL 24 AFW 198 MFWFW-M3-ACTUATION1.000E-3ECCS-AUTO-ACT-M31.000E-2FW-XHE-ACT-M3308MFW-STARTUPMAIN FEEDWATERIS UNAVAILABLEBoth MFW andAFW failFW auto andmanual actuationin mode 3 failsFEEDWATER AVAILABLEMFW or AFWAFW IS UNAVAILABLEmanual actuationof FW in mode 3Automatic actuation ofECCS in mode 3MAIN FEEDWATER FW-M3 - FEEDWATER AVAILABLE MFW or AFW2009/05/12Page 285

Page 27 Figure A12- Mode 3 - Late Recovery and Refill RWST SD-LTR-RWST-RHR1.000E-3CSS-AOV-CC-HV0017.430E-4CSS-XVM-CC-V0024GSD-RWST-REFILLGCSS-FLOW-PATH7.430E-4CSS-XVM-CC-V0001GCSS-PUMPS-START-RUNGCSS-PUMPSGCSS-PUMPS-RUNGCSS-PUMP-1BGCSS-CCF1.500E-3CSS-MDP-FS-P1A1.500E-3CSS-MDP-FS-P1B5.379E-4CSS-MDP-FR-P1A5.379E-4CSS-MDP-FR-P1B1.043E-5CSS-MDP-CF-RUN6.270E-5CSS-MDP-CF-STARTGCSS-CSS-FLAGTRUEGCSS-FLAG1.000E-2M3-DHC-REC-LATE129FPS 309GRWS-MAKEUPGRWST-REFILL-INJCSS ISOLATION VALVEFAILS TO OPEN CSS MANUAL VALVEFAILS TO OPEN FAILURE OFCONTAINMENT SPRAYTO REFILL RWSTCSS FLOW PATHFAILS TO THE RWSTCSS MANUAL VALVEFAILS TO OPEN CSS PUMPS FAIL 1A &1B FAIL TO START OR RUNCSS PUMP P1B FAILSTO START CSS PUMP 1B FAILSTO START OR RUNCSS PUMPS FAIL TO RUNCONTAINMENT SPRAYPUMPS FAILCCF OF CONTAIMENTPUMPS TO STARTAND RUNCSS PUMP P1A FAILSTO STARTCSS-PUMP P1A FAILS TORUN CSS PUMP P1B FAILS TORUN CSS PUMPS FAIL FROMCOMMON CAUSE TO RUN CSS PUMPS FAIL FROMCOMMON CAUSE TOSTART GATE TURNS ON OROFF CSS FOR RWSTMAKEUPFLAG TURNS ON OROFF CSS FOR RWSTMAKEUPLong Term Recovery(RWST MU)Operators fail to RefillRWST as Part of LongTerm RecoveryFIRE PROTECTIONSYSTEN UNAVAILABLE FAILURE OF RWSTINJECTIONS SOURCESFAILURE OF REACTORWATER MAKEUPSYSTEM SD-LTR-RWST-RHR - Long Term Recovery (RWST MU and SDC)2009/05/20Page 306

Page 28 Appendix B: HRA Analysis Page 29 Human Error Probabilities A high level discussion of the Human Reliability Analysis (HRA) is presented above in Section 7 on Model Development. Also included above is a summary of the HRA results. The following discusses the Human Failure Events (HFE), the derivation of the in individual Human Error Probabilities (HEP) and the analysis of the dependency between these HEPs. This HRA analysis was done consistent with the guidance of NUREG/CR-6883, "The SPAR-H Human Reliability Analysis Method," dated August 2005.

The Human Error Probabilities (HEPs) for this analysis were calculated using the Low Power Shutdown SPAR-H worksheets from NUREG/CR-6883. Consideration was given to the available time to perform the action, the stress levels of the crew during the event, complexity of the action, crew experience and applicable and relevant training, quality and thoroughness of procedures, ergonomics, fitness of duty issues, and the available work processes.

The HEPs for this analysis are shown in Table 1 above. The detail description of each HEP is discuss below. Tables B1-B9c contains the diagnosis and/or action worksheets from SPAR-H used to develop the above HEPs.

B1 HFE ID: SD-SLOI-DIAG-XHE HFE Definition This HFE represents the failure of the diagnosis step that requires the operating crew to recognize that an event has occurred, determine what type of event it is and determine which procedure(s) need to be used to address the event.

Description and Context Associated with Event

Operators are transitioning in Mode 3 when LOI event occurs. RHR is aligned to shutdown cooling.

Operator Action Success Criteria

The operator must recognize the abnormal event and start implementation of procedure OFN-BB-31 "Shutdown LOCA." The operator needs to perform this action before RCS level drops to the middle of the hotleg at which time the LPI/SDC pumps will begin to cavitate. There are about 70 minutes to diagnose this event and correct the situation, see timing section below for more details.

Cues

The control room receives no annunciators on the decreasing RCS level.

Decreasing level on control room indicators and associated computer displays feed from the level transmitters.

Page 30 Procedure and Relevant Steps

OFN-BB-31 "Loss of Decay Heat Removal" is the controlling procedure for this event.

It supplies the appropriate entry conditions.

MCR or Local Action

This is a main control room cognitive event. The level indication is indicated in the control room. The reactor operator is responsible for monitoring the appropriate RCS parameters and the shift supervisor (SRO) is responsible for decision making.

Diagnosis (with or w/o recovery) / Execution (with or w/o recovery) / Diagnosis + Execution

This is a purely diagnostic event. If the operator fails to recognize that an event is occurring or fails to recognize that this is a loss of inventory event, there will be additional cues when the RCS level decreases sufficiently to perturb the SDC pumps.

However, this second scenario will be evaluated with a second HFE. Therefore, there is no recovery analyzed in this event.

Time Windows / Nominal / mean /median actions times

For diagnosis 30 of the total available 70 minutes is allocated to perform this function.

Relevant Performance Shaping Factors

Only those PSF which are or might be impacted are discussed here: others are nominal.

Complexity: Obvious Diagnosis Define Subtasks / failure modes / assign BE id(s)

Subtasks: There are none.

Failure modes: Operator fails to recognize RCS level is decreasing. Operators recognize that level is decreasing but fail to enter the correct procedure.

BE Id: SD-SLOI-DIAG- XHE B2 HFE ID: SD-SLOI-FEED-XHE HFE Definition

This HFE represents the failure of the operator to inject into the RCS to maintain or increase RCS level after recognizing that a LOI is in progress.

Page 31 Description and the Context Associated with the Event

Operators are transitioning in Mode 3 when LOI event occurs. RHR is aligned to shutdown cooling.

Operator Action Success Criteria

Injection must be established before RCS level drops to midloop to prevent loss of SDC due to cavitation of the LPI pumps. The flow rate must exceed the rate of loss of inventory. Methods available to inject include HPI, Charging, and LPCI.

Cues

The major portion of the diagnoses and therefore, the associated cues are addressed in the previously occurring HFE (SD-SLOI-DIAG-XHE). However, the following additional cues were prompted by associated procedures:

o Decreasing RCS level Procedure + Relevant Steps OFN-BB-31 rev 10, "Loss of Decay Heat Removal" supplies guidance on injection by the following priority: Charging, HPI, and LPCI.

MCR or Local Action

The actions when transitioning from Mode 4 to 3 are in the main control room.

Diagnosis (with or w/o recovery) / Execution (with or w/o recovery) / Diagnosis + Execution

This HFE is primarily action but does contain some cognitive (diagnosis) effort in the decision making.

Time Windows / Nominal / mean /median actions times

Time available for diagnosis and subsequent operator actions is approximately 70 minutes. Thirty minutes was allocated to perform the previous diagnoses and is handled by HFE SD-SLOI-DIAG-XHE.

A portion of the 70 minutes must be allocated to the event diagnosis action. The remaining time is left to perform this HFE. For HFE SD-SLOI-DIAG-XHE 30 minutes of the total was allocated for diagnosis, this leaves the remaining 40 minutes to perform this action.

Page 32 Relevant Performance Shaping Factors

Only those PSF which are or might be impacted are discussed here: all other PSFs remained at their nominal value.

o Stress: With a LOI event occurring stress was elevated.

o Complexity:

o Additional cues result in obvious diagnose.

Define Subtasks / failure modes / assign BE id(s)

Failure modes:

o MCR operator fails to direct the equipment operator to manipulate the correct valves or pump. o BE Id: SD-SLOI-FEED-XHE B3 HFE ID: SD-SLOI-FEED-LT-XHE HFE Definition

This HFE represents the failure of the operator to feed the RCS with one or more injections methods after the RCS level has decreased to midloop. Level reaching midloop requires securing the LPI pumps from SDC. The operator must diagnose the cavitation of the running LPI/SDC pumps by recognizing the loss of inventory. Then secure the running LPI pumps. Finally, the operator is required to inject into the RCS via one of several methods to increase RCS level. The potentially available methods to inject are:

o "Forced injection with a charging pump o Forced injection with a HPI pump o Forced injection with a LPI pump Description and Context Associated with Event

Previous to this HFE, RCS water level has continued to decrease unabated until midloop and the running LPI/SDC pumps have begun to cavitate. The operators have not isolated the leak nor injected into the RCS. Because the leak path is from purification system via LPI and the hotleg the loss of additional inventory ceases when level reaches the bottom of the hotleg. However, without SDC in-service boiling will result.

This condition causes two additional sets of annunciators to alarm in the MCR. They are the low flow and low differential pressure.

The LPI pumps are available to perform forced injection. However, two of these pumps were previously running in SDC and had to be secured due to air entrainment and subsequent cavitation. These pumps would need to be filled and vented before they could be placed in injection mode. OFN-BB-31 supplies guidance on how to fill and vent the pumps.

Page 33 Operator Action Success Criteria

Injection must be established before RCS level drops to the top of active fuel with subsequent core damage.

Time to boil from the bottom of the hotleg is about 50 minutes. Time to core uncovery is about 90 minutes.

To prevent core damage, the inject flow rate must exceed the mass loss rate from boiling. This value is estimated at 100 gpm. To re-flood the RCS and restart LPI/SDC a higher flow rate is required. This value is estimated at 200 gpm. Methods available to inject include the charging, HPI, and realignment of LPI from SDC to injection from the RWST only.

Cues o Low indicated RCS level on LT.

o "Low Pressure Decay Heat Loop A (or B) Flow Low" annunciator o "Low Pressure Injection Pump A (or B) Differential Pressure Low" annunciator Procedure and Relevant Steps

The Alarm Response Guides for the above cues discussed above direct the operator to OFN-BB-31."

MCR or Local Action

The diagnosis and action is performed in the MCR.

Diagnosis (with or w/o recovery) / Execution (with or w/o recovery) / Diagnosis + Execution

This HFE is a combination of action and diagnosis. It contains some cognitive (diagnosis) effort to recognize the loss of SDC due to cavitation.

Time Windows / Nominal / mean /median actions times

Cavitation of the LPI/SDC pumps will occur approximately 70 minutes after the LOI starts. If no actions to inject water into the RCS are successful, core damage will occur approximately 90 minutes after loss of SDC.

Time is allocated as follows: 30 minutes to diagnose the event (the cues for this event are fully annunciated) and enter the appropriate OFN-BB-31 steps. The remaining 60 minutes are allocated to start one of the three injection methods. sixty minutes is sufficient time to perform injection.

Page 34 Relevant Performance Shaping Factors

Only those PSF which are or might be impacted are discussed here other PSFs remain at their nominal value.

o Complexity:

o Cues for diagnosis are very clear and unambiguous, obvious diagnosis.

Define Subtasks / failure modes / assign BE id(s)

o Subtasks:

o Failure modes:

o MCR operator fails to direct the equipment operator to manipulate the correct valves or pump. o MCR operator fails to manipulate the correct valves or pump in the appropriate manner. o BE Id: SD-SLOI-FEED-LT-XHE B4 HFE ID: SD-SLOI-ISOL-AFD-XHE HFE Definition

This HFE represents the failure of the operator to isolate the LOI. This is after the operator has succeeded in initiating feed into the RCS at a rate that prevents further decrease in RCS level.

Description and Context Associated with Event

Previous to this HFE, the operator has correctly diagnosed the LOI, and initiated makeup to the RCS at a rate greater than the rate of loss. The operator must work through the correct procedure (OFN-BB-31) and perform the appropriate steps to isolate.

Operator Action Success Criteria

Identify and isolate the LOI. Because feed to the RCS has already been accomplished, this action needs to be completed before the RWST is depleted.

Cues

The major portion of the diagnoses and therefore, the associated cues are addressed in the previously occurring HFE (SD-SLOI-DIAG-XHE). However, the following cues are present:

o Decreasing RWST level Procedure and Relevant Steps

OFN-BB-31 "Shutdown LOCA" Page 35 MCR or Local Action

All actions occur in the main control room.

Diagnosis (with or w/o recovery) / Execution (with or w/o recovery) / Diagnosis + Execution

Action without recovery

Time Windows / Nominal / mean /median actions times

Because feed to the RCS has already been accomplished, this action needs to be completed before the RWST is depleted. On average there are approximately 360,000 gallons of water in the RWST of which 316800 are useable. At an assumed injection rate of 200 gpm, the RWST would last approximately 25 hours2.893519e-4 days 0.00694 hours 4.133598e-5 weeks 9.5125e-6 months before it will be depleted.

Relevant Performance Shaping Factors

Only those PSF which are or might be impacted are discussed here other PSFs remain at their nominal value.

o Time: Expanded time is available Define Subtasks / failure modes / assign BE id(s)

o Isolate LOI.

o Failure modes:

o MCR operator fails to direct the equipment operator to manipulate the correct valves or pump.

o Equipment operator fails to manipulate the correct valves or pump in the appropriate manner.

o BE Id: SD-SLOI-ISOL-AFD-XHE

B5 HFE ID: SD-SLOI-ISOL-BRF-XHE HFE Definition

This HFE represents the failure of the operator to isolate the LOI before RCS water level reaches the midloop. This is after the operator has failed to initiate feed into the RCS at a rate that prevents further decrease in RCS level.

Description and Context Associated with Event

Previous to this HFE, the operator has correctly diagnosed the LOI, and but has failed to initiated makeup to the RCS at a rate greater than the rate of loss. The operator Page 36 must work through the correct procedure (OFN-BB-31) and perform the appropriate steps to isolate RCS.

Operator Action Success Criteria

Isolate LOI before level drops to midloop conditions and the running LPI/SDC pumps need to be secured due to cavitation.

Cues

The major portion of the diagnoses and therefore, the associated cues are addressed in the previously occurring HFE (SD-SLOI-DIAG-XHE). However, the following cues are present:

o Decreasing RCS level Procedure and Relevant Steps

OFN-BB-31 "Shutdown LOCA" supplies guidance to the operators.

MCR or Local Action

Actions will be in the MCR but isolating the LOI may be a local action.

Diagnosis (with or w/o recovery) / Execution (with or w/o recovery) / Diagnosis + Execution

Action without recovery

Time Windows / Nominal / mean /median actions times

Because the operator has failed to initially to feed the RCS level continues to decrease. This action must be completed prior to level reaching midloop at which point LPI/SDC will need to be secured. Shortly after reaching a level of 0, the running DHR pumps will need to be secured to prevent damage to them. Thus the time available for diagnosis and subsequent operator actions is approximately 90 minutes.

The previous diagnosis, however, is handled by HFE SD-SLOI-DIAG-XHE.

A portion of the 90 minutes must be allocated to the event diagnosis HFE. The remaining time is left to perform this HFE. For HFE SD-SLOI-DIAG-XHE 30 minutes of the total was allocated for diagnosis this leaves the remaining 60 minutes to perform this action.

Relevant Performance Shaping Factors

Only those PSF which are or might be impacted are discussed here other PSFs remain at their nominal value.

o Stress: With a LOI event occurring stress was elevated.

Page 37 Define Subtasks / failure modes / assign BE id(s) o Failure modes:

o MCR operator fails to direct the equipment operator to manipulate the correct valves or pump. o Equipment operator fails to manipulate the correct valves or pump in the appropriate manner. o BE Id: SD-SLOI-ISOL-BRF-XHE

B6 HFE ID: SD-SLOI-LTR1-XHE (RWST Makeup)

HFE Definition

This HFE represents the failure to makeup to the RWST. Operators have succeeded in initiating feed into the RCS in excess of the leakage rate from the LOI but have not been successful in terminating the leak. If the leak is not terminated, the RWST will eventually be depleted. Therefore, makeup to the RWST is required.

Description and Context Associated with Event

Prior to this action, the operators have successfully diagnosed the original LOI, they have succeeded in establishing flow into the RCS in excess of the inventory being lost through the leak, and thus SDC remains in service. However, they have not been successful in isolating the leak. Because of the relative low required injection rate, and the high inventory in the RWST a significant amount of time is available to perform this action.

Operator Action Success Criteria

Makeup to the RWST before it is depleted at a rate greater than the rate which water is being feed into the RCS

Cues o Decreasing level in the RWST o Indicated level of 6% in RWST Procedure and Relevant Steps

OFN-EJ-40 CL RECIRC during Mode 3, With Accumulators Isolated, and Mode 4, 5 or 6 directs the operators to perform recirculation but does not provide guidance to refill the RWST.

MCR or Local Action

It is anticipated that most actions are local.

Page 38 Diagnosis (with or w/o recovery) / Execution (with or w/o recovery) / Diagnosis + Execution

Diagnosis and action without recovery

Time Windows / Nominal / mean /median actions times

RWST will be depleted in approximately 25 hours2.893519e-4 days 0.00694 hours 4.133598e-5 weeks 9.5125e-6 months after injection is initiated.

Relevant Performance Shaping Factors

Only those PSF which are or might be impacted are discussed here other PSFs remain at their nominal value.

o Complexity: Moderately complex Define Subtasks / failure modes / assign BE id(s)

o Subtasks:

o Failure modes: MCR operator fails to direct the equipment operator to manipulate the correct valves or pump.

o Equipment operator fails to manipulate the correct valves or pump in the appropriate manner. o BE Id: SD-SLOI-LTR1-XHE B7 HFE ID: SD-SLOI-LTR2-XHE (Restart LPI/SDC)

HFE Definition

This HFE represents failure to restore LPI in SDC mode of operations. Operators initially were not successful in initiating feed into the RCS but have recovered and subsequently started feed in excess of the leakage rate from the LOI. However, they have not been successful in terminating the leak. LPI/SDC is not running but RCS level has been raised above the minimum level required for LPI/SDC operation. This action restarts LPI/SDC.

Description and Context Associated with Event

Prior to this action, the operators have successfully diagnosed the original LOI; they have succeeded in recovering RCS level after an initial failure. However, they have not been successful in isolating the leak. SDC is not in-service. Because of the relative low required injection rate, and the high inventory in the RWST a significant amount of time is available to perform this action.

Operator Action Success Criteria

Operators restore SDC to operation.

Page 39 Cues o Knowledge that the running LPI/SDC pumps had been secured due to low RCS level and cavitation.

Procedure and Relevant Steps

OFN-BB-31 supplies guidance on realigning LPI for SDC mode.

MCR or Local Action

Actions are a combination of MCR and local.

Diagnosis (with or w/o recovery) / Execution (with or w/o recovery) / Diagnosis + Execution

Action without recovery

Time Windows / Nominal / mean /median actions times

As RCS makeup in excess of the loss rate has been established, a long time is available to restore LPI/SDC. It is assumed that at least 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months are available.

Relevant Performance Shaping Factors

Only those PSF which are or might be impacted are discussed here other PSFs remain at their nominal value.

o Complexity: complex but routinely performed Define Subtasks / failure modes / assign BE id(s)

o Subtasks: Unknown o Failure modes: MCR operator fails to direct the equipment operator to manipulate the correct valves or pump.

o Equipment operator fails to manipulate the correct valves or pump in the appropriate manner. o BE Id: SD-SLOI-LTR2-XHE B8 HFE ID: M3-DHC-REC-LATE (RWST Makeup RCS<1000psig)

HFE Definition

This HFE represents the failure to makeup to the RWST. Operators have succeeded in initiating feed into the RCS in excess of the leakage or boil-off rate of the RCS but are not able to terminate the leak. Injection is supplied by either high pressure injection or the charging system. However, the RWST will eventually be depleted.

Therefore, makeup to the RWST is required.

Page 40 Description and Context Associated with Event

Prior to this action, the operators have successfully diagnosed the LOCA they have succeeded in establishing flow into the RCS. However, they cannot isolate the leak.

Because of the relative low required injection rate, and the high inventory in the RWST a significant amount of time is available to perform this action.

Operator Action Success Criteria

Makeup to the RWST before it is depleted at a rate greater than the rate which water is being feed into the RCS

Cues o Decreasing level in the RWST o RWST low level alarm(s)

Procedure and Relevant Steps

OFN-EJ-40 CL RECIRC During Mode 3, With Accumulators Isolated, Mode 4, 5 OR 6 directs the operators to perform recirculation but does not provide guidance to refill the RWST. MCR or Local Action

Most actions are local.

Diagnosis (with or w/o recovery) / Execution (with or w/o recovery) / Diagnosis + Execution

Diagnosis and action without recovery

Time Windows / Nominal / mean /median actions times

RWST will be depleted in approximately 5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months after injection is initiated.

Relevant Performance Shaping Factors

Only those PSF which are or might be impacted are discussed here other PSFs remain at their nominal value.

o Timing: Extra time, operators have 5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months to diagnose issue and begin makeup o Stress: With a LOCA event occurring stress will be elevated o Complexity: Moderately complex to perform but Obvious Diagnosis o Procedures: Incomplete, procedures are infrequently used and must be adapted to this condition o

Page 41 Define Subtasks / failure modes / assign BE id(s) o Subtasks:

o Failure modes: MCR operator fails to direct the equipment operator to manipulate the correct valves or pump.

o Equipment operator fails to manipulate the correct valves or pump in the appropriate manner. o BE Id: M3-DHC-REC-LATE B9 HFE ID: M3-DHC-REC-LATE (RWST Makeup RCS>1000psig)

HFE Definition

This HFE represents the failure to makeup to the RWST. Operators have succeeded in initiating feed into the RCS in excess of the leakage or boil-off rate of the RCS but are not able to terminate the leak. Injection is supplied by either high pressure injection or the charging system. However, the RWST will eventually be depleted.

Therefore, makeup to the RWST is required.

Description and Context Associated with Event

Prior to this action, the operators have successfully diagnosed the LOCA they have succeeded in establishing flow into the RCS. However, they cannot isolate the leak.

Because of the relative low required injection rate, and the high inventory in the RWST a significant amount of time is available to perform this action.

Operator Action Success Criteria

Makeup to the RWST before it is depleted at a rate greater than the rate which water is being feed into the RCS

Cues o Decreasing level in the RWST o RWST low level alarm(s)

Procedure and Relevant Steps

EMG C-11 Loss of Emergency Coolant Recirculation directs the operators to refill the RWST. Step 3 directs the operators to check level and begin makeup to the RWST.

MCR or Local Action

It is anticipated that most actions are local.

Diagnosis (with or w/o recovery) / Execution (with or w/o recovery) / Diagnosis + Execution

Diagnosis and action without recovery Page 42 Time Windows / Nominal / mean /median actions times

RWST will be depleted in approximately 5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months after injection is initiated.

Relevant Performance Shaping Factors

Only those PSF which are or might be impacted are discussed here other PSFs remain at their nominal value.

o Timing: Extra time, operators have 5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months to diagnose issue and begin makeup o Stress: With a LOCA event occurring stress will be elevated o Complexity: Moderately complex to perform but Obvious Diagnosis Define Subtasks / failure modes / assign BE id(s)

o Subtasks:

o Failure modes: MCR operator fails to direct the equipment operator to manipulate the correct valves or pump.

o Equipment operator fails to manipulate the correct valves or pump in the appropriate manner. o BE Id: M3a-DHC-REC-LATE Page 43 Table B1 PSFsPSF LevelsMultiplier for DiagnosisSelected PSFPlease note specific reasons for PSF level selection in this column.Inadequate timeP(failure) = 1.0 Barel y ade quate time

(?2/3 Nominal

)10Nominal time1XExtra time (between 1 and 2 x nominal and > than 30 min)0.1Expansive time (> 2 x nominal and > 30 min)0.01Insufficient information 1Extreme5High2Nominal1XInsufficient information 1Highly5Moderately Complex2 Nominal1Obvious diagnosis0.1XInsufficient information 1Low10Nominal1XHigh0.5Insufficient information 1Not available50Incomplete1Available, but poor5Nominal1X Diagnostic/symptom oriented0.5Insufficient information 1Missing/Misleading50Poor10Nominal1XGood0.5Insufficient information 1UnfitP(failure) = 1.0Degraded Fitness5Nominal1XInsufficient information 1Poor2Nominal1 XGood0.8 Insufficient information 1NHEP =1.00E-3Negative PSFs adjustment

(>3 NAFinal Diagnosis HEP1.00E-03Part I. DIAGNOSIS WORKSHEETPlant: Oconee Initiating Event: Basic Event: SD-SLOI-DIAG-XHEBasic Event

Description:

Operator fails to Diagnose Loss of Inventory before loss of DHRHRA Worksheets for LPSD SPAR HUMAN ERROR WORKSHEETAvailable TimeStress Complexity Experience/ TrainingDiagnoses requires monitoring simple display. Site is ramping up in power activities minimal durin g this period. Procedures Ergonomics/H MFitness for DutyWork Processes

Page 44 Table B2a PSFsPSF LevelsMultiplier for DiagnosisSelected PSFPlease note specific reasons for PSF level selection in this column.Inadequate timeP(failure) = 1.0 Barel y ade quate time

(?2/3 Nominal

)10Nominal time1X Extra time (between 1 and 2 x nominal and > than 30 min)0.1Expansive time (> 2 x nominal and > 30 min)0.01Insufficient information 1Extreme5High2XNominal1Insufficient information 1Highly5Moderately Complex2 Nominal1 Obvious diagnosis0.1XInsufficient information 1Low10Nominal1XHigh0.5Insufficient information 1Not available50Incomplete20 Available, but poor5 Nominal1X Diagnostic/symptom oriented0.5Insufficient information 1Missing/Misleading50Poor10 Nominal1X Good0.5Insufficient information 1UnfitP(failure) = 1.0Degraded Fitness5Nominal1XInsufficient information 1Poor2Nominal1X Good0.8Insufficient information 1NHEP =2.00E-3Negative PSFs adjustment

(>3 NAFinal Diagnosis HEP2.00E-03 Procedures Ergonomics/ HMIFitness for DutyWork Processe sLOI caused elevated stress. Additional ques result in obvious diagnosis.Available TimeStress Complexity Experience/ TrainingPart I. DIAGNOSIS WORKSHEETPlant: Wolf Creek Initiation of Feed during SD Basic Event: SD-SLOI-FEED-XHEBasic Event

Description:

Operator Fails to Initiate Feed during Shutdown before loss of LPI/DHRHRA Worksheets for LPSD SPAR HUMAN ERROR WORKSHEET

Page 45 Table B2b PSFsPSF LevelsMultiplier for ActionSelected PSFPlease note specific reasons for PSF level selection in this column.Inadequate timeP(failure) = 1.0 Time Available is ? the time required10Nominal time1XTime available is ? 5x the time required0.1 Time available is ? 50x the time required0.01 Insufficient information1Extreme5 Hi gh2XNominal1 Insufficient information1Highly5Moderately2 Nominal1X Insufficient information1Low3Nominal1X Hi gh0.5Insufficient information1Not available50Incomplete20Available but poor5 Nominal1XInsufficient information1Missing/Misleading50Poo r 10Nominal1X Good0.5 Insufficient information1UnfitP(failure) = 1.0Degraded Fitness5 Nominal1XInsufficient information1Poor5Nominal1XGood0.5 Insufficient information1NHEP =2.00E-3Negative PSFs adjustment

(>3negative NAFinal Action HEP2.00E-03Available TimeStress Complexity Experience/ Training Procedures Ergonomics/ HMIFitness for Duty Work ProcessesLOI caused elevated stress. Part II. ACTION WORKSHEETPlant: Wolf Creek Initiation of Feed during SD Basic Event: SD-SLOI-FEED-XHEBasic Event

Description:

Operator Fails to Initiate Feed during Shutdown before loss of LPI/DHRHRA Worksheets for LPSD SPAR HUMAN ERROR WORKSHEET

Page 46 Table B2c Diagnosis HEP +Action HEP = Pw/od 2.00E-03 +2.00E-03 =4.00E-03Part III - CALCULATE TASK FAILURE PROBABILITY WITHOUT FORMAL DEPENDENCYPlant: Wolf Creek Initiation of Feed during SD Basic Event: SD-SLOI-FEED-XHEHRA Worksheets for LPSD

Page 47 Table 3a PSFsPSF LevelsMultiplier for DiagnosisSelected PSFPlease note specific reasons for PSF level selection in this column.Inadequate timeP(failure) = 1.0 Barel y ade quate time

(?2/3 Nominal

)10Nominal time1X Extra time (between 1 and 2 x nominal and > than 30 min)0.1 Expansive time (> 2 x nominal and > 30 min)0.01 Insufficient information 1Extreme5High2X Nominal1Insufficient information 1Highly5Moderately Complex2 Nominal1 Obvious diagnosis0.1XInsufficient information 1Low10Nominal1X High0.5Insufficient information 1Not available50Incomplete20 Available, but poor5 Nominal1X Diagnostic/symptom oriented0.5Insufficient information 1Missing/Misleading50Poor10 Nominal1X Good0.5Insufficient information 1UnfitP(failure) = 1.0Degraded Fitness5 Nominal1XInsufficient information 1Poor2Nominal1 XGood0.8 Insufficient information 1NHEP =2.00E-3Negative PSFs adjustment

(>3negative NAFinal Diagnosis HEP2.00E-03 Procedures Ergonomics/ HMIFitness for DutyWork ProcessesLOI caused elevated stress. Available TimeStress Complexity Experience/ TrainingPart I. DIAGNOSIS WORKSHEETPlant: Wolf Creek Initiation of Feed during SD Basic Event: SD-SLOI-FEED-LT-XHE Basic Event

Description:

Operator Fails to Initiate Feed during Shutdown before core damage after SDC failureHRA Worksheets for LPSD SPAR HUMAN ERROR WORKSHEET

Page 48 Table 3b PSFsPSF LevelsMultiplier for ActionSelected PSFPlease note specific reasons for PSF level selection in this column.Inadequate timeP(failure) = 1.0 Time Available is ? the time required10Nominal time1X Time available is ? 5x the time required0.1Time available is ? 50x the time required0.01Insufficient information1Extreme5 Hi g h2Nominal1 XInsufficient information1 Highly5Moderately2Nominal1XInsufficient information1Low3 Nominal1X Hi gh0.5Insufficient information1Not available50Incomplete20Available but poor5 Nominal1X Insufficient information1Missing/Misleading50Poor1 0Nominal1XGoo d0.5Insufficient information1UnfitP(failure) = 1.0Degraded Fitness5Nominal1XInsufficient information1Poor5 Nominal1XGoo d0.5Insufficient information1NHEP =1.00E-3Negative PSFs adjustment

(>3negative NAFinal Action HEP1.00E-03Available TimeStress Complexity Experience/ Training Procedures Ergonomics/ HMIFitness for DutyWork ProcessesPart II. ACTION WORKSHEETPlant: Wolf Creek Initiation of Feed during SD Basic Event: SD-SLOI-FEED-LT-XHEBasic Event

Description:

Operator Fails to Initiate Feed during Shutdown before core damage after SDC failureHRA Worksheets for LPSD SPAR HUMAN ERROR WORKSHEET

Page 49 Table 3c Diagnosis HEP +Action HEP = Pw/od 2.00E-03 +1.00E-03 =3.00E-03Part III - CALCULATE TASK FAILURE PROBABILITY WITHOUT FORMAL DEPENDENCYPlant: Wolf Creek Initiation of Feed durin g SD Basic Event: SD-SLOI-FEED-LT-XHEHRA Worksheets for LPSD

Page 50 Table 4a PSFsPSF LevelsMultiplier for ActionSelected PSFPlease note specific reasons for PSF level selection in this column.Inadequate timeP(failure) = 1.0 Time Available is ? the time re quired10Nominal time1 Time available is ? 5x the time re quired0.1Time available is ? 50x the time re quired0.01XInsufficient information1Extreme5 Hi g h2Nominal1 XInsufficient information1Highly5Moderately2Nominal1X Insufficient information1Low3 Nominal1 X Hi gh0.5Insufficient information1 Not available50Incomplete20Available but poor5 Nominal1X Insufficient information1Missing/Misleading50 Poor10Nominal1 XGood0.5Insufficient information1 UnfitP(failure) = 1.0Degraded Fitness5Nominal1X Insufficient information1Poor5 Nominal1 XGood0.5Insufficient information1NHEP =1.00E-5Negative PSFs adjustment

(>3 NAFinal Action HEP1.00E-05Part II. ACTION WORKSHEETPlant: Wolf Creek Initiating Event: Basic Event: SD-SLOI-ISOL-AFD-XHEBasic Event

Description:

Operator fails to Isolate Loss of Inventory before core damageHRA Worksheets for LPSD SPAR HUMAN ERROR WORKSHEET30 hours is availalble to perform this function. Takes about 15 minutes to perform.This is simple task. Procedures Ergonomics/

HMIFitness for DutyWork ProcessesAvailable TimeStress Complexity Experience/ Training

Page 51 Table 5a PSFsPSF LevelsMultiplier for ActionSelected PSFPlease note specific reasons for PSF level selection in this column.Inadequate timeP(failure) = 1.0 Time Available is ? the time required10Nominal time1X Time available is ? 5x the time required0.1Time available is ? 50x the time required0.01Insufficient information1Extreme5 Hi gh2XNominal1Insufficient information1Highly5Moderately2 Nominal1XInsufficient information1Low3Nominal1X Hi gh0.5Insufficient information1Not available50Incomplete20Available but poor5Nominal1XInsufficient information1Missing/Misleading50Poor1 0Nominal1XGood0.5Insufficient information1UnfitP(failure) = 1.0Degraded Fitness5Nominal1XInsufficient information1Poor5 Nominal1XGood0.5 Insufficient information1NHEP =2.00E-3Negative PSFs adjustment

(>3negative NAFinal Action HEP2.00E-03Available TimeStress Complexity Experience/ TrainingThis is simple task. Procedures Ergonomics /HMIFitness for DutyWork Processes40 minutes is availalble to perform this function. Takes about 15 minutes to perform.LOI caused elevated stress. Part II. ACTION WORKSHEETPlant: Wolf Creek Initiating Event: Basic Event: SD-SLOI-ISOL-BRF-XHEBasic Event

Description:

Operator fails to Isolate Loss of Inventory before Loss of LPI/SDCHRA Worksheets for LPSD SPAR HUMAN ERROR WORKSHEET

Page 52 Table 6a PSFsPSF LevelsMultiplier for DiagnosisSelected PSFPlease note specific reasons for PSF level selection in this column.Inadequate timeP(failure) = 1.0 Barel y ade quate time

(?2/3 Nominal

)10Nominal time1X Extra time (between 1 and 2 x nominal and > than 30 min)0.1 Expansive time (> 2 x nominal and > 30 min)0.01 Insufficient information 1Extreme5High2 Nominal1XInsufficient information 1Highly5Moderately Complex2 Nominal1X Obvious diagnosis0.1Insufficient information 1Low10Nominal1XHigh0.5Insufficient information 1Not available50Incomplete20 Available, but poor5 Nominal1X Diagnostic/symptom oriented0.5Insufficient information 1Missing/Misleading50Poor10 Nominal1X Good0.5Insufficient information 1UnfitP(failure) = 1.0Degraded Fitness5Nominal1XInsufficient information 1Poor2Nominal1 XGood0.8Insufficient information 1NHEP =1.00E-2Negative PSFs adjustment (>3 negative PSFs)

NAFinal Diagnosis HEP1.00E-02 Procedures Ergonomics/HMIFitness for DutyWork ProcessesAvailable TimeStress Complexity Experience/TrainingPart I. DIAGNOSIS WORKSHEETPlant: Wolf Creek Initiating Event: Basic Event: SD-SLOI-ISOL-BRF-XHEBasic Event

Description:

Operator fails to Isolate Loss of Inventory before Loss of LPI/SDCHRA Worksheets for LPSD SPAR HUMAN ERROR WORKSHEET

Page 53 Table 6b PSFsPSF LevelsMultiplier for ActionSelected PSFPlease note specific reasons for PSF level selection in this column.Inadequate timeP(failure) = 1.0 Time Available is ? the time required10Nominal time1X Time available is ? 5x the time required0.1Time available is ? 50x the time required0.01Insufficient information1Extreme5 Hi gh2XNominal1Insufficient information1Highly5Moderately2 Nominal1XInsufficient information1Low3Nominal1X Hi gh0.5Insufficient information1Not available50Incomplete20Available but poor5Nominal1XInsufficient information1Missing/Misleading50Poor1 0Nominal1XGood0.5Insufficient information1UnfitP(failure) = 1.0Degraded Fitness5Nominal1XInsufficient information1Poor5 Nominal1XGood0.5 Insufficient information1NHEP =2.00E-3Negative PSFs adjustment

(>3negative NAFinal Action HEP2.00E-03Available TimeStress Complexity Experience/ TrainingThis is simple task. Procedures Ergonomics /HMIFitness for DutyWork Processes40 minutes is availalble to perform this function. Takes about 15 minutes to perform.LOI caused elevated stress. Part II. ACTION WORKSHEETPlant: Wolf Creek Initiating Event: Basic Event: SD-SLOI-ISOL-BRF-XHEBasic Event

Description:

Operator fails to Isolate Loss of Inventory before Loss of LPI/SDCHRA Worksheets for LPSD SPAR HUMAN ERROR WORKSHEET

Page 54 Table 6c Diagnosis HEP +Action HEP = Pw/od 1.00E-02 +2.00E-03 =1.20E-02Part III - CALCULATE TASK FAILURE PROBABILITY WITHOUT FORMAL DEPENDENCYPlant: Wolf Creek Initiating Event: Basic Event: SD-SLOI-ISOL-BRF-XHEBasic Event

Description:

Operator fails to Isolate Loss of Inventory before Loss of LPI/SDCHRA Worksheets for LPSD

Page 55 Table 7a PSFsPSF LevelsMultiplier for ActionSelected PSFPlease note specific reasons for PSF level selection in this column.Inadequate timeP(failure) = 1.0 Time Available is ? the time required10Nominal time1X Time available is ? 5x the time required0.1Time available is ? 50x the time required0.01Insufficient information1Extreme5 Hi g h2Nominal1 XInsufficient information1Highly5Moderately2XNominal1Insufficient information1Low3Nominal1X Hi gh0.5Insufficient information1Not available50Incomplete20Available but poor5Nominal1X Insufficient information1Missing/Misleading50Poor10Nominal1X Good0.5 Insufficient information1UnfitP(failure) = 1.0Degraded Fitness5 Nominal1X Insufficient information1Poor5Nominal1XGood0.5 Insufficient information1NHEP =2.00E-3Negative PSFs adjustment

(>3negative NAFinal Action HEP2.00E-03Part II. ACTION WORKSHEETPlant: Wolf Creek Initiating Event: Basic Event: SD-SLOI-LTR2-XHEBasic Event

Description:

Operator fails to recover LPI in SDC mode.HRA Worksheets for LPSD SPAR HUMAN ERROR WORKSHEETThis task is complex. Procedures Ergonomics/ HMIFitness for Duty Work ProcessesAvailable TimeStress Complexity Experience/ Training Page 56 Table 8a Mode 3 RCS<1000psig PSFsPSF LevelsMultiplier for DiagnosisSelected PSFPlease note specific reasons for PSF level selection in this column.Inadequate timeP(failure) = 1.0 Barel y ade quate time

(?2/3 Nominal

)10Nominal time1Extra time (between 1 and 2 x nominal and > than 30 min)0.1XExpansive time (> 2 x nominal and > 30 min)0.01Insufficient information 1Extreme5High2XNominal1Insufficient information 1Highly5Moderately Complex2Nominal1XObvious diagnosis0.1Insufficient information 1Low10Nominal1XHigh0.5Insufficient information 1Not available50XAvailable, but poor5Nominal1Diagnostic/symptom oriented0.5Insufficient information 1Missing/Misleading50Poor10 Nominal1XGood0.5Insufficient information 1UnfitP(failure) = 1.0Degraded Fitness5 Nominal1XInsufficient information 1Poor2Nominal1 XGood0.8 Insufficient information 1NHEP =1.00E-1Negative PSFs adjustment

(>3 NAFinal Diagnosis HEP1.00E-01Part I. DIAGNOSIS WORKSHEETPlant: Wolf Creek Initiating Event: Basic Event: M3-DHR-REC-LATEBasic Event

Description:

Operator fails to Diagnose Loss of Inventory before loss of DHRHRA Worksheets for LPSD SPAR HUMAN ERROR WORKSHEETAvailable TimeStress Complexity Experience/ TrainingOperators will have extra time to evaluate plant conditions and determine appropriated success path.Operators will be under high stress conditions.Procedures have no guidance to refill the RWST. Procedures Ergonomics/H MFitness for DutyWork Processes Page 57 Table 8b Mode 3 RCS<1000psig PSFsPSF LevelsMultiplier for ActionSelected PSFPlease note specific reasons for PSF level selection in this column.Inadequate timeP(failure) = 1.0 Time Available is ? the time required10Nominal time1 Time available is ? 5x the time required0.1X Time available is ? 50x the time required0.01 Insufficient information1Extreme 5 Hi g h 2XNominal 1Insufficient information1Highly 5Moderately2X Nominal 1Insufficient information1Low 3Nominal 1X Hi g h0.5Insufficient information1Not available50Incomplete20 Available but poor5 Nominal 1XInsufficient information1Missing/Misleading50Poor 10Nominal 1XGoo d0.5Insufficient information1UnfitP(failure) = 1.0Degraded Fitness5 Nominal 1XInsufficient information1Poor 5Nominal 1XGoo d0.5Insufficient information1NHEP =4.00E-4Negative PSFs adjustment (>3 negative PSFs)

NAFinal Action HEP4.00E-04Available TimeStress Complexity Experience/Training Procedures Ergonomics/HMIFitness for DutyWork ProcessesOperators have approximately 5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months before RWST is depleted at the auto-swapover setpoint and additional time before time to boil and core damage.Operators will be under high stress conditions.May require to interpret other procedures and apply them to this condition.Part II. ACTION WORKSHEETPlant: Wolf Creek Initiating Event: Basic Event: M3-DHR-REC-LATE Basic Event

Description:

Operator fails to Diagnose Loss of Inventory before loss of DHRHRA Worksheets for LPSD SPAR HUMAN ERROR WORKSHEET

Page 58 Table 8c Mode 3 RCS<1000psig Diagnosis HEP +Action HEP = Pw/od 1.00E-01 +4.00E-04 =1.00E-01Part III - CALCULATE TASK FAILURE PROBABILITY WITHOUT FORMAL DEPENDENCYPlant: Wolf Creek Initiating Event: Basic Event: M3-DHR-REC-LATEBasic Event

Description:

Operator fails to Diagnose Loss of Inventory before loss of DHRHRA Worksheets for LPSD

Page 59 Table 9a Mode 3 RCS>1000psig PSFsPSF LevelsMultiplier for DiagnosisSelected PSFPlease note specific reasons for PSF level selection in this column.Inadequate timeP(failure) = 1.0 Barel y ade quate time

(?2/3 Nominal

)10Nominal time1Extra time (between 1 and 2 x nominal and > than 30 min)0.1XExpansive time (> 2 x nominal and > 30 min)0.01Insufficient information 1Extreme5High2XNominal1Insufficient information 1Highly5Moderately Complex2Nominal1XObvious diagnosis0.1Insufficient information 1Low10Nominal1XHigh0.5Insufficient information 1Not available50Available, but poor5xNominal1Diagnostic/symptom oriented0.5Insufficient information 1Missing/Misleading50Poor10 Nominal1XGood0.5Insufficient information 1UnfitP(failure) = 1.0Degraded Fitness5 Nominal1XInsufficient information 1Poor2Nominal1 XGood0.8 Insufficient information 1NHEP =1.00E-2Negative PSFs adjustment

(>3 NAFinal Diagnosis HEP1.00E-02 Procedures Ergonomics/H MFitness for DutyWork ProcessesOperators will have extra time to evaluate plant conditions and determine appropriated success path.Operators will be under high stress conditions.Available TimeStress Complexity Experience/ TrainingPart I. DIAGNOSIS WORKSHEETPlant: Wolf Creek Initiating Event: Basic Event: M3a-DHR-REC-LATE Basic Event

Description:

Operator fails to Diagnose Loss of Inventory before loss of DHRHRA Worksheets for LPSD SPAR HUMAN ERROR WORKSHEET Page 60 Table 9b Mode 3 RCS>1000psig PSFsPSF LevelsMultiplier for ActionSelected PSFPlease note specific reasons for PSF level selection in this column.Inadequate timeP(failure) = 1.0 Time Available is ? the time required10Nominal time1 Time available is ? 5x the time required0.1X Time available is ? 50x the time required0.01 Insufficient information1Extreme 5 Hi g h 2XNominal 1Insufficient information1Highly 5Moderately2X Nominal 1Insufficient information1Low 3Nominal 1X Hi g h0.5Insufficient information1Not available50Incomplete20 Available but poor5 Nominal 1XInsufficient information1Missing/Misleading50Poor 10Nominal 1XGoo d0.5Insufficient information1UnfitP(failure) = 1.0Degraded Fitness5 Nominal 1XInsufficient information1Poor 5Nominal 1XGoo d0.5Insufficient information1NHEP =4.00E-4Negative PSFs adjustment (>3 negative PSFs)

NAFinal Action HEP4.00E-04Available TimeStress Complexity Experience/Training Procedures Ergonomics/HMIFitness for DutyWork ProcessesOperators have approximately 5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months before RWST is depleted at the auto-swapover setpoint and additional time before time to boil and core damage.Operators will be under high stress conditions.May require to interpret other procedures and apply them to this condition.Part II. ACTION WORKSHEETPlant: Wolf Creek Initiating Event: Basic Event: M3a-DHR-REC-LATE Basic Event

Description:

Operator fails to Diagnose Loss of Inventory before loss of DHRHRA Worksheets for LPSD SPAR HUMAN ERROR WORKSHEET

Page 61 Table 9c Mode 3 RCS>1000psig Diagnosis HEP +Action HEP = Pw/od 1.00E-02 +4.00E-04 =1.04E-02Part III - CALCULATE TASK FAILURE PROBABILITY WITHOUT FORMAL DEPENDENCYPlant: Wolf Creek Initiating Event: Basic Event: M3a-DHR-REC-LATEBasic Event

Description:

Operator fails to Diagnose Loss of Inventory before loss of DHRHRA Worksheets for LPSD

Page 62 Analysis of Dependency between HEP The initial dependency between multiple operator actions was also performed using NUREG/CR-6883. The approach used to resolve these dependencies follows the method proscribed in the SPAR-H guidance. The analyst deviated from the SPAR-H methodology when events that contained intervening successes between failed human actions were encountered. Under these situations zero dependency was assigned. The results are summarized in Table 2 above and follow the dependency model used in the SPAR-H method.

The 2003 version of the ASME PRA Standard requires that the total combined probability of all the HEPs in the same accident sequence or cutset should not be less than a justified value. The 2005 version of this standard removes this requirement. However, NUREG-1792, Good Practices for Implementing Human Reliability Analysis," Section 5.3.3.6, recommends a minimum cutoff value of 1E-5. As a starting point the analyst used this value. Because the final results are dominated by a single sequence involving a value above the cutoff, applying a cutoff will not materially impact the results. Therefore no further cutoff analysis were applied to this SDP at this time.

The equations that were used to calculate the dependency were as following:

Complete Dependence the probability of failure = 1.0

High Dependence the probability of failure = (1 + P)/2

Moderate Dependence the probability of failure = (1 +6P)/7

Low Dependence the probability of failure = (1 + 19P)/20 SAPHIRE rules were then created to search for the cutset results for the various combinations of HEPs and the cutsets were modified appropriately.

Tables B8 to B14 contains the dependency event trees for these dependent HEPs as determined by the SPAR-H methodology. However, as discussed above, where deemed appropriate, the analyst deviated from the SPAR-H rules and imposed a lower value for the dependencies. This is discussed in the individual dependency analysis below.

B8 SD-SLOI-FEED-LT-XHE-D1

This modified HEP accounts for the dependence between the diagnoses of the initial event and the subsequent action to perform injection once level reaches the midloop level requiring the shutdown of the running LPI/SDC pumps. The dependency analysis is shown in Table B8. Both actions are performed by the same crew; however, they are separated by approximately 70 minutes. The actions are performed on different panels in the main control room (MCR). Additional cues are received when midloop level is reached as the running SDC pumps begin to cavitate. There are no intervening successes. The SPAR-H methodology determines this to be a "low" dependence.

Page 63 B9 SD-SLOI-ISOL-BRF-XHE-D2 This modified HEP accounts for the dependence between the HFE representing the initial injection into the RCS prior to loss of SDC and the additional action to isolate the leak. This step accounts for the dependency between the first pair of HFEs in Sequence 7 which under some conditions can contain three HFEs. The dependency analysis is shown in Table B9. Both actions occur simultaneously and are performed by different members of the same crew. Both actions are direct by the MCR operator but are performed by different equipment operators. It is important to note that both actions are ultimately dependent on proper analysis of the situation and use of OFN-BB-31 performed by the shift supervisor; if this were not the case the actions would be independent. Additional cues are received by different portions of OFN-BB-31. There are no intervening successes. The SPAR-H methodology determines this to be a "low" dependence.

B10 SD-SLOI-FEED-LT-XHE-D2

This modified HEP accounts for the dependence between the HFE representing the action to isolate the leak and the subsequent action to inject late into the RCS. This step accounts for the dependency between the second pair of HFEs in a sequence containing three HFEs. The initial pair is analyzed in Section B10 above. The HFE pair is shown in Table B10. It should be recognized that prior to attempting to perform the late injection (the second of these two HFEs) the operator has failed to perform an early injection. The consequence of this earlier failure is that water level has dropped to midloop necessitating the shutdown of the operating SDC pumps. The first action occurs early while the second action occurs 70 minutes into the event and is assumed to be performed by the same crew. Both actions are direct by the MCR operator but are performed by different equipment operators. Additional cues are received when level reaches midloop as the SDC pumps begin to cavitate. There are no intervening successes. The SPAR-H methodology determines this to be a "moderate" dependence.

B11 SD-SLOI-FEED-LT-XHE-D3 This modified HEP accounts for the dependence between the HFE representing the action to isolate the leak and the subsequent action to inject late into the RCS. In contrast to the previous HFE pair discussed in Section B11 above, this pair has is not preceded by an earlier HFE. This HFE pair is shown in Table B4. Prior to the second of these actions, water level has dropped to midloop necessitating the shutdown of the operating SDC pumps. The first action occurs early while the second action occurs 70 minutes into the event and is assumed to be performed by the same crew. Both actions are direct by the MCR operator but are performed by different equipment operators. Additional cues are received when level reaches midloop as the SDC pumps begin to cavitate. There are no intervening successes. The SPAR-H methodology determines this to be a "low" dependence.

Page 64 B12 SD-SLOI-FEED-LT-XHE-D4 This modified HEP accounts for the dependence between the HFE representing the action to perform an early injection (early meaning before level drops to midloop requiring securing the running SDC pumps) and the subsequent action to inject late into the RCS. This HFE pair is shown in Table B12. Prior to the second of these actions, water level has dropped to midloop necessitating the shutdown of the operating SDC pumps. The first action occurs early while the second action occurs 70 minutes into the event, both events are assumed to be performed by the same crew. Both actions are direct by the MCR operator but are performed by different equipment operators. Additional cues are received when level reaches midloop as the SDC pumps begin to cavitate. There is an intervening success which is isolation of the leak. The SPAR-H methodology determines this to be a "low" dependence.

B13 SD-SLOI-ISOL-BRF-XHE-D6 This modified HEP accounts for the dependence between the HFE representing the initial injection into the RCS prior to loss of SDC and the additional action to isolate the leak. The dependency analysis is shown in Table B13. Both actions occur simultaneously and are performed by different members of the same crew. Both actions are direct by the MCR operator but are performed by different equipment operators. It is important to note that both actions are ultimately dependent on proper analysis of the situation and use of OFN-BB-31 performed by the shift supervisor; if this were not the case the actions would be independent. Additional cues are received by different portions of OFN-BB-31. There are no intervening successes. The SPAR-H methodology determines this to be a "low" dependence.

B14 SD-SLOI-LTR1-XHE-D7

This modified HEP accounts for the dependence between the HFE representing the action to isolate the leak and the subsequent action to makeup to the BWST prior to its depletion. It should be noted that this occurs after an initial success to establish feed of the RCS from the BWST. This HFE pair is shown in Table B14. The first failed action occurs relatively early while the second action occurs very late. The second action is not required until approximately 25 hours2.893519e-4 days 0.00694 hours 4.133598e-5 weeks 9.5125e-6 months after event initiation. Because of the late time of this event it is assumed to be performed by a different crew. Both actions are direct by the MCR operator but are performed by different equipment operators. Additional cues are received when BWST level decreases to point requiring refill. There are no intervening successes. The SPAR-H methodology determines this to be a "zero" dependence based on the performance by different crews.

Page 65 Table B8: SD-SLOI-FEED-LT-XHE-D1 1st Action2nd Action3rd Action4th ActionMultiple Human ErrorsSame or Different CrewTime Between Events Close or Not CloseSame or Different LocationAdditional Cues?Intervening Success?SD-SLOI-DIAG-XHESD-SLOI-FEED-LT-XHESameN/AN/AClose in timeN/AN/ADifferentYes (related)NoYes (not related)SameNoSameYes (related)Yes (not related)Yes NoNot close in timeYes (related)NoYes (not related)

NoDifferentYes (related)Yes (not related)Yes NoDifferentIndependent HEP1.00E-033.00E-03 LD5.3E-023.0E-065.3E-05ZeroLowModerateLowLowLowModerateModerateZeroComment: Dependence LevelN/ACompleteHighLowModerateHighZeroZeroZeroCompleteCompleteCompleteCompleteCompleteCompleteCompleteModerateHighHighModerateHighCompleteLowLowModerateModerateHighHighHighCompleteLowModerateModerateTotal Conditional Joint HEP =Total Un-conditional Joint HEP =Conditional HEP =ModerateModerateHighLow Page 66 Table B9: SD-SLOI-BRF-XHE-D2 1st Action2nd Action3rd Action4th ActionMultiple Human ErrorsSame or Different CrewTime Between Events Close or Not CloseSame or Different LocationAdditional Cues?Intervening Success?SD-SLOI-FEED-XHESD-SLOI-ISOL-BRF-XHESameN/AN/AClose in timeN/AN/ADifferentYes (related)NoYes (not related)SameNoSameYes (related)Yes (not related)Yes NoNot close in timeYes (related)NoYes (not related)

NoDifferentYes (related)Yes (not related)Yes NoDifferentIndependent HEP4.00E-032.00E-03 LD5.2E-028.0E-062.1E-04HighCompleteHighCompleteCompleteModerateHighCompleteHighCompleteCompleteZeroLowModerateLowModerateHighHighCompleteZeroLowModerateHighModerateHighCompleteModerateZeroLowModerateHighZeroLowModerateLowModerateN/ACompleteCompleteLowModerateZeroLowLowModerateModerateConditional HEP =Total Un-conditional Joint HEP =Total Conditional Joint HEP =Comment: Dependence Level

Page 67 Table B10: SD-SLOI-FEED-LT-XHE-D2 1st Action2nd Action3rd Action4th ActionMultiple Human ErrorsSame or Different CrewTime Between Events Close or Not CloseSame or Different LocationAdditional Cues?Intervening Success?SD-SLOI-FEED-XHESD-SLOI-ISOL-BRF-XHESD-SLOI-FEED-LT-XHESameN/AN/AClose in timeN/AN/ADifferentYes (related)NoYes (not related)SameNoSameYes (related)Yes (not related)Yes NoNot close in timeYes (related)NoYes (not related)

NoDifferentYes (related)Yes (not related)Yes NoDifferentIndependent HEP4.00E-032.00E-033.00E-03LDMD5.2E-021.5E-011.0E+001.5E-012.4E-083.1E-05Comment: Dependence LevelLowModerateN/ACompleteCompleteLowModerateZeroHighZeroLowModerateLowModerateZeroLowModerateModerateHighModerateHighCompleteCompleteZeroLowModerateModerateLowModerateHighCompleteCompleteHighCompleteCompleteConditional HEP =Total Un-conditional Joint HEP =Total Conditional Joint HEP =HighCompleteZeroLowModerateHighLowModerateHighCompleteHigh Page 68 Table B11: SD-SLOI-FEED-LT-XHE-D3 1st Action2nd Action3rd Action4th ActionMultiple Human ErrorsSame or Different CrewTime Between Events Close or Not CloseSame or Different LocationAdditional Cues?Intervening Success?SD-SLOI-ISOL-BRF-XHESD-SLOI-FEED-LT-XHESameN/AN/AClose in timeN/AN/ADifferentYes (related)NoYes (not related)SameNoSameYes (related)Yes (not related)Yes NoNot close in timeYes (related)NoYes (not related)

NoDifferentYes (related)Yes (not related)

Ye s NoDifferentIndependent HEP2.00E-033.00E-03 LD5.3E-026.0E-061.1E-04Comment: Dependence LevelLowModerateN/ACompleteCompleteLowModerateZeroHighZeroLowModerateLowModerateZeroLowModerateModerateHighModerateHighCompleteCompleteZeroLowModerateModerateLowModerateHighCompleteCompleteHighCompleteCompleteConditional HEP =Total Un-conditional Joint HEP =Total Conditional Joint HEP =HighCompleteZeroLowModerateHighLowModerateHighCompleteHigh Page 69 Table B12: SD-SLOI-FEED-LT-XHE-D4 1st Action2nd Action3rd Action4th ActionMultiple Human ErrorsSame or Different CrewTime Between Events Close or Not CloseSame or Different LocationAdditional Cues?Intervening Success?SD-SLOI-FEED-XHESD-SLOI-FEED-LT-XHESameN/AN/AClose in timeN/AN/ADifferentYes (related)NoYes (not related)SameNoSameYes (related)Yes (not related)Yes NoNot close in timeYes (related)NoYes (not related)

NoDifferentYes (related)Yes (not related)Yes NoDifferentIndependent HEP4.00E-033.00E-03 LD5.3E-021.2E-052.1E-04Comment: Dependence LevelLowModerateN/ACompleteCompleteLowModerateZeroHighZeroLowModerateLowModerateZeroLowModerateModerateHighModerateHighCompleteCompleteZeroLowModerateModerateLowModerateHighCompleteCompleteHighCompleteCompleteConditional HEP =Total Un-conditional Joint HEP =Total Conditional Joint HEP =HighCompleteZeroLowModerateHighLowModerateHighCompleteHigh Page 70 Table B13: SD-SLOI-BRF-XHE-D6 1st Action2nd Action3rd Action4th ActionMultiple Human ErrorsSame or Different CrewTime Between Events Close or Not CloseSame or Different LocationAdditional Cues?Intervening Success?SD-SLOI-FEED-XHESD-SLOI-ISOL-BRF-XHESameN/AN/AClose in timeN/AN/ADifferentYes (related)NoYes (not related)SameNoSameYes (related)Yes (not related)Yes NoNot close in timeYes (related)NoYes (not related)

NoDifferentYes (related)Yes (not related)Yes NoDifferentIndependent HEP4.00E-032.00E-03 LD5.2E-028.0E-062.1E-04Comment: Dependence LevelLowModerateN/ACompleteCompleteLowModerateZeroHighZeroLowModerateLowModerateZeroLowModerateModerateHighModerateHighCompleteCompleteZeroLowModerateModerateLowModerateHighCompleteCompleteHighCompleteCompleteConditional HEP =Total Un-conditional Joint HEP =Total Conditional Joint HEP =HighCompleteZeroLowModerateHighLowModerateHighCompleteHigh Page 71 Table B14: SD-SLOI-LTR1-XHE-D7 1st Action2nd Action3rd Action4th ActionMultiple Human ErrorsSame or Different CrewTime Between Events Close or Not CloseSame or Different LocationAdditional Cues?Intervening Success?SD-SLOI-ISOL-AFD-XHESD-SLOI-LTR1-XHESameN/AN/AClose in timeN/AN/ADifferentYes (related)NoYes (not related)SameNoSameYes (related)Yes (not related)Yes NoNot close in timeYes (related)NoYes (not related)

NoDifferentYes (related)Yes (not related)Yes NoDifferentIndependent HEP1.00E-051.20E-02 ZD1.2E-021.0E+001.0E+001.2E-021.2E-071.2E-07Comment: Dependence LevelLowModerate N/ACompleteCompleteLowModerateZeroHighZeroLowModerateLowModerateZeroLowModerateModerateHighModerateHighCompleteCompleteZeroLowModerateModerateLowModerateHighCompleteCompleteHighCompleteCompleteConditional HEP =Total Un-conditional Joint HEP =Total Conditional Joint HEP =HighCompleteZeroLowModerateHigh LowModerateHighCompleteHigh Page 72 Appendix C Initiator Cutsets Page 73 Table C1 Mode 3 POS 3a1 Medium LOCA (Accumulators Unavailable below 1000psig)

Cut No. % Total % Cut Set Prob./Frequency Basic EventDescriptionEvent Prob.1 82.81 82.81 2.000E-005 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 M3-DHC-REC-LATE Operators fail to Refill RWST as Part of Long Term Recovery 1.000E-001 2 86.12 3.31 8.000E-007 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 OPR-XHE-XM-DEPRCSM OPERATOR FAILS TO DEPRESSURIZE RCS/ SECONDARY SIDE (MLOCA) 4.000E-003 3 88.26 2.14 5.177E-007 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 AFW-ACX-FR-SGF02A AFW MDP A ROOM COOLER FAILS TO RUN 2.589E-003 4 90.40 2.14 5.177E-007 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 AFW-ACX-FR-SGF02B AFW MDP B ROOM COOLER FAILS TO RUN 2.589E-003 5 92.47 2.07 5.000E-007 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 AFW-ACX-TM-SGF02A AFW MDP A ROOM COOLER UNAVAILABLE DUE TO T&M 2.500E-003 6 94.54 2.07 5.000E-007 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 AFW-ACX-TM-SGF02B AFW MDP B ROOM COOLER UNAVAILABLE DUE TO T&M 2.500E-003 7 95.78 1.24 3.000E-007 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 AFW-MDP-FS-PAL01A AFW MOTOR-DRIVEN PUMP 1A FAILS TO START 1.500E-003 8 97.02 1.24 3.000E-007 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 AFW-MDP-FS-PAL01B AFW MOTOR-DRIVEN PUMP 1B FAILS TO START 1.500E-003 9 97.85 0.83 2.000E-007 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 AFW-XHE-XR-SGF02A OP FAILS TO RESTORE AFW MDP A ROOM COOLER AFTER T&M 1.000E-003 10 98.68 0.83 2.000E-007 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 AFW-XHE-XR-SGF02B OP FAILS TO RESTORE AFW MDP B ROOM COOLER AFTER T&M 1.000E-003 11 99.34 0.66 1.600E-007 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 AFW-ACX-FS-SGF02A AFW MDP A ROOM COOLER FAILS TO START 8.000E-004 12 100.00 0.66 1.600E-007 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 AFW-ACX-FS-SGF02B AFW MDP B ROOM COOLER FAILS TO START 8.000E-004 13 100.00 0.45 1.076E-007 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 AFW-MDP-FR-PAL01A AFW MOTOR-DRIVEN PUMP FAILS TO RUN 5.379E-004 14 100.00 0.45 1.076E-007 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 AFW-MDP-FR-PAL01B AFW MOTOR-DRIVEN PUMP FAILS TO RUN 5.379E-004 15 100.00 0.36 8.800E-008 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 HPI-SYS-FC-RWSTLLO FAILURE OF RWST LEVEL LO 2/4 INSTRUMENTATION (SA) 4.400E-004 16 100.00 0.07 1.650E-008 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 AFW-MDP-CF-START CCF OF AFW MDPS TO START 8.250E-005 17 100.00 0.06 1.455E-008 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 AFW-ACX-CF-GF02ABR CCF OF AFW MDP ROOM COOLERS TO RUN 7.274E-005 18 100.00 0.06 1.440E-008 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 AFW-FCV-FC-HV05 SG D CONTROL AOV HV05 FROM MDP FAILS 7.200E-005 19 100.00 0.06 1.440E-008 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 AFW-FCV-FC-HV07 SG A CONTROL AOV HV07 FROM MDP FAILS 7.200E-005 20 100.00 0.06 1.440E-008 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 AFW-FCV-FC-HV09 SG B CONTROL AOV HV09 FROM MDP FAILS 7.200E-005 Page 74 Table C2 Mode 3 POS 3b1 & 3c1 Medium LOCA

Cut No. % Total % Cut Set Prob./Frequency Basic Event DescriptionEvent Prob.1 30.45 30.45 2.000E-006 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 M3-DHC-REC-LATE Operators fail to Refill RWST as Part of Long Term Recovery 1.000E-002 2 42.63 12.18 8.000E-007 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 OPR-XHE-XM-DEPRCSM OPERATOR FAILS TO DEPRESSURIZE RCS/ SECONDARY SIDE (MLOCA) 4.000E-003 3 50.51 7.88 5.177E-007 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 AFW-ACX-FR-SGF02A AFW MDP A ROOM COOLER FAILS TO RUN 2.589E-003 4 58.39 7.88 5.177E-007 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 AFW-ACX-FR-SGF02B AFW MDP B ROOM COOLER FAILS TO RUN 2.589E-003 5 66.00 7.61 5.000E-007 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 AFW-ACX-TM-SGF02A AFW MDP A ROOM COOLER UNAVAILABLE DUE TO T&M 2.500E-003 6 73.61 7.61 5.000E-007 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 AFW-ACX-TM-SGF02B AFW MDP B ROOM COOLER UNAVAILABLE DUE TO T&M 2.500E-003 7 78.18 4.57 3.000E-007 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 AFW-MDP-FS-PAL01A AFW MOTOR-DRIVEN PUMP 1A FAILS TO START 1.500E-003 8 82.75 4.57 3.000E-007 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 AFW-MDP-FS-PAL01B AFW MOTOR-DRIVEN PUMP 1B FAILS TO START 1.500E-003 9 85.80 3.05 2.000E-007 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 AFW-XHE-XR-SGF02A OP FAILS TO RESTORE AFW MDP A ROOM COOLER AFTER T&M 1.000E-003 10 88.85 3.05 2.000E-007 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 AFW-XHE-XR-SGF02B OP FAILS TO RESTORE AFW MDP B ROOM COOLER AFTER T&M 1.000E-003 11 91.29 2.44 1.600E-007 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 AFW-ACX-FS-SGF02A AFW MDP A ROOM COOLER FAILS TO START 8.000E-004 12 93.73 2.44 1.600E-007 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 AFW-ACX-FS-SGF02B AFW MDP B ROOM COOLER FAILS TO START 8.000E-004 13 95.37 1.64 1.076E-007 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 AFW-MDP-FR-PAL01A AFW MOTOR-DRIVEN PUMP FAILS TO RUN 5.379E-004 14 97.01 1.64 1.076E-007 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 AFW-MDP-FR-PAL01B AFW MOTOR-DRIVEN PUMP FAILS TO RUN 5.379E-004 15 98.35 1.34 8.800E-008 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 HPI-SYS-FC-RWSTLLO FAILURE OF RWST LEVEL LO 2/4 INSTRUMENTATION (SA) 4.400E-004 16 98.60 0.25 1.650E-008 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 AFW-MDP-CF-START CCF OF AFW MDPS TO START 8.250E-005 17 98.82 0.22 1.455E-008 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 AFW-ACX-CF-GF02ABR CCF OF AFW MDP ROOM COOLERS TO RUN 7.274E-005 18 99.04 0.22 1.440E-008 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 AFW-FCV-FC-HV05 SG D CONTROL AOV HV05 FROM MDP FAILS 7.200E-005 19 99.26 0.22 1.440E-008 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 AFW-FCV-FC-HV07 SG A CONTROL AOV HV07 FROM MDP FAILS 7.200E-005 20 99.48 0.22 1.440E-008 IE-M3-MLOCA MEDIUM LOCA - M3 2.000E-004 AFW-FCV-FC-HV09 SG B CONTROL AOV HV09 FROM MDP FAILS 7.200E-005 Page 75 Table C3 Mode 3 POS 3a2 Small LOCA (No Auto-ECCS below 1000psig)

Cut No. % Total % Cut Set Prob./Frequency Basic Event DescriptionEvent Prob.1 83.05 83.05 6.000E-005 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 M3-DHC-REC-LATE Operators fail to Refill RWST as Part of Long Term Recovery 1.000E-001 2 91.36 8.31 6.000E-006 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 FW-XHE-ACT-M3 manual actuation of FW in mode 3 1.000E-002 3 99.67 8.31 6.000E-006 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 HPI-XHE-ACT-M3 manual actuation of ECCS in mode 3 fails 1.000E-002 4 100.00 1.66 1.200E-006 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 OPR-XHE-XM-DEPRCS OPERATOR FAILS TO DEPRESSURIZE RCS/ SECONDARY SIDE 2.000E-003 5 100.00 0.37 2.640E-007 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 HPI-SYS-FC-RWSTLLO FAILURE OF RWST LEVEL LO 2/4 INSTRUMENTATION (SA) 4.400E-004 6 100.00 0.17 1.200E-007 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 FW-XHE-ACT-M3 manual actuation of FW in mode 3 1.000E-002 HPI-XHE-XM-FB OPERATOR FAILS TO INITIATE FEED AND BLEED COOLING 2.000E-002 7 100.00 0.06 4.200E-008 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 FW-XHE-ACT-M3 manual actuation of FW in mode 3 1.000E-002 PPR-SRV-CC-456A PORV 456A FAILS TO OPEN ON DEMAND 7.000E-003 8 100.00 0.06 4.200E-008 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 FW-XHE-ACT-M3 manual actuation of FW in mode 3 1.000E-002 PPR-SRV-CC-455A PORV455A FAILS TO OPEN ON DEMAND 7.000E-003 9 100.00 0.02 1.200E-008 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 HPI-XHE-ACT-M3 manual actuation of ECCS in mode 3 fails 1.000E-002 OPR-XHE-XM-DEPRCS OPERATOR FAILS TO DEPRESSURIZE RCS/ SECONDARY SIDE 2.000E-003 10 100.00 0.01 5.562E-009 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 HPI-PMP-FC-GASBIND COMMON CAUSE GAS INTRUSTION FAILURE ALL 4 HP ECCS PUMPS (PSA) 9.270E-006 11 100.00 0.00 3.270E-009 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 IAS-MDC-FR-CKA01C Instrument Air Compressor CkA01C Fails to Run 5.887E-002 MSS-ARV-CF-SGPORVS CCF OF SG ARVs FOR SEC SIDE COOLDOWN 9.257E-005 12 100.00 0.00 2.640E-009 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 FW-XHE-ACT-M3 manual actuation of FW in mode 3 1.000E-002 HPI-SYS-FC-RWSTLLO FAILURE OF RWST LEVEL LO 2/4 INSTRUMENTATION (SA) 4.400E-004 13 100.00 0.00 2.537E-009 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 FW-XHE-ACT-M3 manual actuation of FW in mode 3 1.000E-002 PPR-SRV-CF-PORVS CCF OF PORVs TO OPEN 4.228E-004 14 100.00 0.00 6.665E-010 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 IAS-MDC-FS-CKA01C Instrument Air Compressor CKA01C Fails to Start 1.200E-002 MSS-ARV-CF-SGPORVS CCF OF SG ARVs FOR SEC SIDE COOLDOWN 9.257E-005 15 100.00 0.00 5.554E-010 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 CWS-SYS-FC-IAS Central Chilled Water System Unavailable (PSA) 1.000E-002 MSS-ARV-CF-SGPORVS CCF OF SG ARVs FOR SEC SIDE COOLDOWN 9.257E-005 16 100.00 0.00 5.280E-010 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 HPI-SYS-FC-RWSTLLO FAILURE OF RWST LEVEL LO 2/4 INSTRUMENTATION (SA) 4.400E-004 OPR-XHE-XM-DEPRCS OPERATOR FAILS TO DEPRESSURIZE RCS/ SECONDARY SIDE 2.000E-003 17 100.00 0.00 3.044E-010 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 PPR-SRV-CF-PORVS CCF OF PORVs TO OPEN 4.228E-004 RCS-AOV-CC-455B NORMAL SPRAY VALVE 455B FAILS TO OPEN 1.200E-003 18 100.00 0.00 3.044E-010 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 Page 76 Cut No. % Total % Cut Set Prob./Frequency Basic Event DescriptionEvent Prob. PPR-SRV-CF-PORVS CCF OF PORVs TO OPEN 4.228E-004 RCS-AOV-CC-455C NORMAL SPRAY VALVE 455C FAILS TO OPEN 1.200E-003 19 100.00 0.00 1.389E-010 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 ACP-CRB-CC-PA0101 CIRCUIT BREAKER PA0101 FAILS TO OPEN ON DEMAND 2.500E-003 MSS-ARV-CF-SGPORVS CCF OF SG ARVs FOR SEC SIDE COOLDOWN 9.257E-005 20 100.00 0.00 1.389E-010 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 ACP-CRB-OO-PA0110 CIRCUIT BREAKER PA0110 FAILS TO CLOSE ON DEMAND 2.500E-003 MSS-ARV-CF-SGPORVS CCF OF SG ARVs FOR SEC SIDE COOLDOWN 9.257E-005 Page 77 Table C3 Mode 4 POS 3b2 Small LOCA (No Auto-ECCS above 1000psig)

Cut No. % Total % Cut Set Prob./Frequency Basic Event DescriptionEvent Prob.1 30.82 30.82 6.000E-006 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 M3-DHC-REC-LATE Operators fail to Refill RWST as Part of Long Term Recovery 1.000E-002 2 61.64 30.82 6.000E-006 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 FW-XHE-ACT-M3 manual actuation of FW in mode 3 1.000E-002 3 92.46 30.82 6.000E-006 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 HPI-XHE-ACT-M3 manual actuation of ECCS in mode 3 fails 1.000E-002 4 98.62 6.16 1.200E-006 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 OPR-XHE-XM-DEPRCS OPERATOR FAILS TO DEPRESSURIZE RCS/ SECONDARY SIDE 2.000E-003 5 99.98 1.36 2.640E-007 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 HPI-SYS-FC-RWSTLLO FAILURE OF RWST LEVEL LO 2/4 INSTRUMENTATION (SA) 4.400E-004 6 100.0 0 0.62 1.200E-007 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 FW-XHE-ACT-M3 manual actuation of FW in mode 3 1.000E-002 HPI-XHE-XM-FB OPERATOR FAILS TO INITIATE FEED AND BLEED COOLING 2.000E-002 7 100.0 0 0.22 4.200E-008 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 FW-XHE-ACT-M3 manual actuation of FW in mode 3 1.000E-002 PPR-SRV-CC-456A PORV 456A FAILS TO OPEN ON DEMAND 7.000E-003 8 100.0 0 0.22 4.200E-008 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 FW-XHE-ACT-M3 manual actuation of FW in mode 3 1.000E-002 PPR-SRV-CC-455A PORV455A FAILS TO OPEN ON DEMAND 7.000E-003 9 100.0 0 0.06 1.200E-008 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 HPI-XHE-ACT-M3 manual actuation of ECCS in mode 3 fails 1.000E-002 OPR-XHE-XM-DEPRCS OPERATOR FAILS TO DEPRESSURIZE RCS/ SECONDARY SIDE 2.000E-003 10 100.0 0 0.03 5.562E-009 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 HPI-PMP-FC-GASBIND COMMON CAUSE GAS INTRUSTION FAILURE ALL 4 HP ECCS PUMPS (PSA) 9.270E-006 11 100.0 0 0.02 3.270E-009 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 IAS-MDC-FR-CKA01C Instrument Air Compressor CkA01C Fails to Run 5.887E-002 MSS-ARV-CF-SGPORVS CCF OF SG ARVs FOR SEC SIDE COOLDOWN 9.257E-005 12 100.0 0 0.01 2.640E-009 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 FW-XHE-ACT-M3 manual actuation of FW in mode 3 1.000E-002 HPI-SYS-FC-RWSTLLO FAILURE OF RWST LEVEL LO 2/4 INSTRUMENTATION (SA) 4.400E-004 13 100.0 0 0.01 2.537E-009 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 FW-XHE-ACT-M3 manual actuation of FW in mode 3 1.000E-002 PPR-SRV-CF-PORVS CCF OF PORVs TO OPEN 4.228E-004 14 100.0 0 0.00 6.665E-010 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 IAS-MDC-FS-CKA01C Instrument Air Compressor CKA01C Fails to Start 1.200E-002 MSS-ARV-CF-SGPORVS CCF OF SG ARVs FOR SEC SIDE COOLDOWN 9.257E-005 15 100.0 0 0.00 5.554E-010 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 CWS-SYS-FC-IAS Central Chilled Water System Unavailable (PSA) 1.000E-002 MSS-ARV-CF-SGPORVS CCF OF SG ARVs FOR SEC SIDE COOLDOWN 9.257E-005 16 100.0 0 0.00 5.280E-010 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 HPI-SYS-FC-RWSTLLO FAILURE OF RWST LEVEL LO 2/4 INSTRUMENTATION (SA) 4.400E-004 OPR-XHE-XM-DEPRCS OPERATOR FAILS TO DEPRESSURIZE RCS/ SECONDARY SIDE 2.000E-003 17 100.0 0 0.00 3.044E-010 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 Page 78 Cut No. % Total % Cut Set Prob./Frequency Basic Event DescriptionEvent Prob. PPR-SRV-CF-PORVS CCF OF PORVs TO OPEN 4.228E-004 RCS-AOV-CC-455B NORMAL SPRAY VALVE 455B FAILS TO OPEN 1.200E-003 18 100.0 0 0.00 3.044E-010 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 PPR-SRV-CF-PORVS CCF OF PORVs TO OPEN 4.228E-004 RCS-AOV-CC-455C NORMAL SPRAY VALVE 455C FAILS TO OPEN 1.200E-003 19 100.0 0 0.00 1.389E-010 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 ACP-CRB-CC-PA0101 CIRCUIT BREAKER PA0101 FAILS TO OPEN ON DEMAND 2.500E-003 MSS-ARV-CF-SGPORVS CCF OF SG ARVs FOR SEC SIDE COOLDOWN 9.257E-005 20 100.0 0 0.00 1.389E-010 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 ACP-CRB-OO-PA0110 CIRCUIT BREAKER PA0110 FAILS TO CLOSE ON DEMAND 2.500E-003 MSS-ARV-CF-SGPORVS CCF OF SG ARVs FOR SEC SIDE COOLDOWN 9.257E-005 Page 79 Table C5 Mode 3 POS 3c2 Small LOCA (Auto-ECCS)

Cut No. % Total % Cut Set Prob./Frequency Basic Event DescriptionEvent Prob.1 80.26 80.26 6.000E-006 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 M3-DHC-REC-LATE Operators fail to Refill RWST as Part of Long Term Recovery 1.000E-002 2 96.31 16.05 1.200E-006 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 OPR-XHE-XM-DEPRCS OPERATOR FAILS TO DEPRESSURIZE RCS/ SECONDARY SIDE 2.000E-003 3 99.84 3.53 2.640E-007 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 HPI-SYS-FC-RWSTLLO FAILURE OF RWST LEVEL LO 2/4 INSTRUMENTATION (SA) 4.400E-004 4 99.92 0.08 6.000E-009 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 ECCS-AUTO-ACT-M3 Automatic actuation of ECCS in mode 3 1.000E-003 HPI-XHE-ACT-M3 manual actuation of ECCS in mode 3 fails 1.000E-002 5 100.0 0 0.08 6.000E-009 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 ECCS-AUTO-ACT-M3 Automatic actuation of ECCS in mode 3 1.000E-003 FW-XHE-ACT-M3 manual actuation of FW in mode 3 1.000E-002 6 100.0 0 0.07 5.562E-009 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 HPI-PMP-FC-GASBIND COMMON CAUSE GAS INTRUSTION FAILURE ALL 4 HP ECCS PUMPS (PSA) 9.270E-006 7 100.0 0 0.04 3.270E-009 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 IAS-MDC-FR-CKA01C Instrument Air Compressor CkA01C Fails to Run 5.887E-002 MSS-ARV-CF-SGPORVS CCF OF SG ARVs FOR SEC SIDE COOLDOWN 9.257E-005 8 100.0 0 0.01 6.665E-010 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 IAS-MDC-FS-CKA01C Instrument Air Compressor CKA01C Fails to Start 1.200E-002 MSS-ARV-CF-SGPORVS CCF OF SG ARVs FOR SEC SIDE COOLDOWN 9.257E-005 9 100.0 0 0.01 5.554E-010 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 CWS-SYS-FC-IAS Central Chilled Water System Unavailable (PSA) 1.000E-002 MSS-ARV-CF-SGPORVS CCF OF SG ARVs FOR SEC SIDE COOLDOWN 9.257E-005 10 100.0 0 0.01 5.280E-010 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 HPI-SYS-FC-RWSTLLO FAILURE OF RWST LEVEL LO 2/4 INSTRUMENTATION (SA) 4.400E-004 OPR-XHE-XM-DEPRCS OPERATOR FAILS TO DEPRESSURIZE RCS/ SECONDARY SIDE 2.000E-003 11 100.0 0 0.00 3.044E-010 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 PPR-SRV-CF-PORVS CCF OF PORVs TO OPEN 4.228E-004 RCS-AOV-CC-455B NORMAL SPRAY VALVE 455B FAILS TO OPEN 1.200E-003 12 100.0 0 0.00 3.044E-010 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 PPR-SRV-CF-PORVS CCF OF PORVs TO OPEN 4.228E-004 RCS-AOV-CC-455C NORMAL SPRAY VALVE 455C FAILS TO OPEN 1.200E-003 13 100.0 0 0.00 1.389E-010 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 ACP-CRB-CC-PA0101 CIRCUIT BREAKER PA0101 FAILS TO OPEN ON DEMAND 2.500E-003 MSS-ARV-CF-SGPORVS CCF OF SG ARVs FOR SEC SIDE COOLDOWN 9.257E-005 14 100.0 0 0.00 1.389E-010 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 ACP-CRB-OO-PA0110 CIRCUIT BREAKER PA0110 FAILS TO CLOSE ON DEMAND 2.500E-003 MSS-ARV-CF-SGPORVS CCF OF SG ARVs FOR SEC SIDE COOLDOWN 9.257E-005 15 100.0 0 0.00 1.238E-010 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 ACP-CRB-CC-PA0101 CIRCUIT BREAKER PA0101 FAILS TO OPEN ON DEMAND 2.500E-003 AFW-MDP-CF-START CCF OF AFW MDPS TO START 8.250E-005 16 100.0 0 0.00 1.238E-010 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 ACP-CRB-OO-PA0110 CIRCUIT BREAKER PA0110 FAILS TO CLOSE ON 2.500E-003 Page 80 Cut No. % Total % Cut Set Prob./Frequency Basic Event DescriptionEvent Prob.DEMAND AFW-MDP-CF-START CCF OF AFW MDPS TO START 8.250E-005 17 100.0 0 0.00 1.200E-010 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 ECCS-AUTO-ACT-M3 Automatic actuation of ECCS in mode 3 1.000E-003 FW-XHE-ACT-M3 manual actuation of FW in mode 3 1.000E-002 HPI-XHE-XM-FB OPERATOR FAILS TO INITIATE FEED AND BLEED COOLING 2.000E-002 18 100.0 0 0.00 1.091E-010 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 ACP-CRB-CC-PA0101 CIRCUIT BREAKER PA0101 FAILS TO OPEN ON DEMAND 2.500E-003 AFW-ACX-CF-GF02ABR CCF OF AFW MDP ROOM COOLERS TO RUN 7.274E-005 19 100.0 0 0.00 1.091E-010 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 ACP-CRB-OO-PA0110 CIRCUIT BREAKER PA0110 FAILS TO CLOSE ON DEMAND 2.500E-003 AFW-ACX-CF-GF02ABR CCF OF AFW MDP ROOM COOLERS TO RUN 7.274E-005 20 100.0 0 0.00 9.900E-011 IE-M3-SLOCA SMALL LOCA - M3 6.000E-004 AFW-MDP-CF-START CCF OF AFW MDPS TO START 8.250E-005 MFW-MDP-FS-AE02 STARTUP FEEDWATER PUMP FAILS TO START 2.000E-003 Page 81 Table C6 Mode 4 POS 4a Loss of Inventory Outside Containment Cut No. % Total % Cut Set Prob./ Frequency Basic Event DescriptionEvent Prob. 1 53.63 53.63 9.275E-006 IE-M4-SLOI-OC SLOI Outside of Containment Occurs -M4 1.750E-001 SD-SLOI-DIAG-XHE Operators fail to diagnose small LOI outside of containment before loss of SDC 1.000E-003 SD-SLOI-FEED-LT-XHE-D1 Operators fail to initiate feed after loss of SDC; before core damage 5.300E-002 2 85.20 31.57 5.460E-006 IE-M4-SLOI-OC SLOI Outside of Containment Occurs -M4 1.750E-001 SD-SLOI-FEED-LT-XHE-D2 Operators fail to initiate feed after loss of SDC; before core damage 1.500E-001 SD-SLOI-FEED-XHE Operator fails to initiate feed before loss of SDC 4.000E-003 SD-SLOI-ISOL-BRF-XHE-D2 Operator fail to terminate SLOI leak before SDC fails 5.200E-002 3 97.34 12.14 2.100E-006 IE-M4-SLOI-OC SLOI Outside of Containment Occurs -M4 1.750E-001 SD-SLOI-DIAG-XHE Operators fail to diagnose small LOI outside of containment before loss of SDC 1.000E-003 SD-SLOI-LTR1-XHE Operators fail to Refill RWST as Part of Long Term Recovery 1.200E-002 4 99.87 2.53 4.368E-007 IE-M4-SLOI-OC SLOI Outside of Containment Occurs -M4 1.750E-001 SD-SLOI-FEED-XHE Operator fails to initiate feed before loss of SDC 4.000E-003 SD-SLOI-ISOL-BRF-XHE-D6 Operator fail to terminate SLOI leak before SDC fails 5.200E-002 SD-SLOI-LTR1-XHE Operators fail to Refill RWST as Part of Long Term Recovery 1.200E-002 5 99.99 0.12 2.100E-008 IE-M4-SLOI-OC SLOI Outside of Containment Occurs -M4 1.750E-001 SD-SLOI-ISOL-AFD-XHE Operators fail to terminate SLOI leak before RWST is depleted 1.000E-005 SD-SLOI-LTR1-XHE-D7 Operators fail to Refill BWST as Part of Long Term Recovery 1.200E-002 6 100.00 0.01 2.100E-009 IE-M4-SLOI-OC SLOI Outside of Containment Occurs -M4 1.750E-001 SD-ISOL-EQP-FAILURES FAILURES OF EQUIPMENT TO ISOLATE 1.000E-006 SD-SLOI-LTR1-XHE Operators fail to Refill RWST as Part of Long Term Recovery 1.200E-002 7 100.00 0.00 3.710E-011 IE-M4-SLOI-OC SLOI Outside of Containment Occurs -M4 1.750E-001 SD-ISOL-EQP-FAILURES FAILURES OF EQUIPMENT TO ISOLATE 1.000E-006 SD-SLOI-FEED-LT-XHE-D4 Operators fail to initiate feed after loss of SDC; before core damage 5.300E-002 SD-SLOI-FEED-XHE Operator fails to initiate feed before loss of SDC 4.000E-003 8 100.00 0.00 1.887E-011 IE-M4-SLOI-OC SLOI Outside of Containment Occurs -M4 1.750E-001 CCW-HTX-CF-ALL COMMON CAUSE FAILURE OF CCW HEAT EXCHANGERS 1.348E-006 OPR-XHE-XM-ALTCOOL OPERATOR FAILS TO ALIGN FIRE WATER COOLING TO CCP/SI PUMPS 4.000E-002 SD-SLOI-ISOL-BRF-XHE Operator fail to terminate SLOI leak before SDC fails 2.000E-003 9 100.00 0.00 1.680E-011 IE-M4-SLOI-OC SLOI Outside of Containment Occurs -M4 1.750E-001 HPI-TNK-FC-RWST RWST IS UNAVAILABLE 4.800E-008 SD-SLOI-ISOL-BRF-XHE Operator fail to terminate SLOI leak before SDC fails 2.000E-003 10 100.00 0.00 1.367E-011 IE-M4-SLOI-OC SLOI Outside of Containment Occurs -M4 1.750E-001 CVC-ACX-CF-GL12ABS CCF OFCCP MDP ROOM COOLERS TO START 8.875E-005 HPI-SYS-FC-RWSTLLO FAILURE OF RWST LEVEL LO 2/4 INSTRUMENTATION (SA) 4.400E-004 SD-SLOI-ISOL-BRF-XHE Operator fail to terminate SLOI leak before SDC fails 2.000E-003 11 100.00 0.00 9.656E-012 IE-M4-SLOI-OC SLOI Outside of Containment Occurs -M4 1.750E-001 CVC-MDP-CF-START CHARGING PUMPS FAIL FROM COMMON CAUSE TO START 6.270E-005 HPI-SYS-FC-RWSTLLO FAILURE OF RWST LEVEL LO 2/4 INSTRUMENTATION (SA) 4.400E-004 SD-SLOI-ISOL-BRF-XHE Operator fail to terminate SLOI leak before SDC fails 2.000E-003 12 100.00 0.00 9.435E-012 IE-M4-SLOI-OC SLOI Outside of Containment Occurs -M4 1.750E-001 CCW-HTX-CF-ALL COMMON CAUSE FAILURE OF CCW HEAT EXCHANGERS 1.348E-006 OPR-XHE-XM-ALTCOOL OPERATOR FAILS TO ALIGN FIRE WATER COOLING TO CCP/SI PUMPS 4.000E-002 SD-SLOI-DIAG-XHE Operators fail to diagnose small LOI outside of containment before loss of SDC 1.000E-003 13 100.00 0.00 8.400E-012 IE-M4-SLOI-OC SLOI Outside of Containment Occurs -M4 1.750E-001 SD-ISOL-EQP-FAILURES FAILURES OF EQUIPMENT TO ISOLATE 1.000E-006 SD-SLOI-FEED-XHE Operator fails to initiate feed before loss of SDC 4.000E-003 SD-SLOI-LTR1-XHE Operators fail to Refill RWST as Part of Long Term Recovery 1.200E-002 14 100.00 0.00 8.400E-012 IE-M4-SLOI-OC SLOI Outside of Containment Occurs -M4 1.750E-001 HPI-TNK-FC-RWST RWST IS UNAVAILABLE 4.800E-008 SD-SLOI-DIAG-XHE Operators fail to diagnose small LOI outside of containment before 1.000E-003 Page 82 Cut No. % Total % Cut Set Prob./ Frequency Basic Event DescriptionEvent Prob. loss of SDC 15 100.00 0.00 6.834E-012 IE-M4-SLOI-OC SLOI Outside of Containment Occurs -M4 1.750E-001 CVC-ACX-CF-GL12ABS CCF OFCCP MDP ROOM COOLERS TO START 8.875E-005 HPI-SYS-FC-RWSTLLO FAILURE OF RWST LEVEL LO 2/4 INSTRUMENTATION (SA) 4.400E-004 SD-SLOI-DIAG-XHE Operators fail to diagnose small LOI outside of containment before loss of SDC 1.000E-003 16 100.00 0.00 4.828E-012 IE-M4-SLOI-OC SLOI Outside of Containment Occurs -M4 1.750E-001 CVC-MDP-CF-START CHARGING PUMPS FAIL FROM COMMON CAUSE TO START 6.270E-005 HPI-SYS-FC-RWSTLLO FAILURE OF RWST LEVEL LO 2/4 INSTRUMENTATION (SA) 4.400E-004 SD-SLOI-DIAG-XHE Operators fail to diagnose small LOI outside of containment before loss of SDC 1.000E-003 17 100.00 0.00 4.168E-012 IE-M4-SLOI-OC SLOI Outside of Containment Occurs -M4 1.750E-001 CCW-MDP-CF-RUN CCW PUMPS FAIL FROM COMMON CAUSE TO RUN 2.977E-007 OPR-XHE-XM-ALTCOOL OPERATOR FAILS TO ALIGN FIRE WATER COOLING TO CCP/SI PUMPS 4.000E-002 SD-SLOI-ISOL-BRF-XHE Operator fail to terminate SLOI leak before SDC fails 2.000E-003 18 100.00 0.00 3.511E-012 IE-M4-SLOI-OC SLOI Outside of Containment Occurs -M4 1.750E-001 CVC-MOV-CF-112DE CCF OF CVC SUCTION MOVs CV112D/E 2.280E-005 HPI-SYS-FC-RWSTLLO FAILURE OF RWST LEVEL LO 2/4 INSTRUMENTATION (SA) 4.400E-004 SD-SLOI-ISOL-BRF-XHE Operator fail to terminate SLOI leak before SDC fails 2.000E-003 19 100.00 0.00 3.511E-012 IE-M4-SLOI-OC SLOI Outside of Containment Occurs -M4 1.750E-001 CVC-MOV-CF-8803AB CCF OF DISCHARGE MOVs 8803A & B TO OPEN 2.280E-005 HPI-SYS-FC-RWSTLLO FAILURE OF RWST LEVEL LO 2/4 INSTRUMENTATION (SA) 4.400E-004 SD-SLOI-ISOL-BRF-XHE Operator fail to terminate SLOI leak before SDC fails 2.000E-003 20 100.00 0.00 3.511E-012 IE-M4-SLOI-OC SLOI Outside of Containment Occurs -M4 1.750E-001 CVC-MOV-CF-8801AB COMMON CAUSE FAILURE OF DISCHARGE MOVs 8801A & B 2.280E-005 HPI-SYS-FC-RWSTLLO FAILURE OF RWST LEVEL LO 2/4 INSTRUMENTATION (SA) 4.400E-004 SD-SLOI-ISOL-BRF-XHE Operator fail to terminate SLOI leak before SDC fails 2.000E-003

Page 83 Table C7 Mode 4 POS 4b Loss of Inventory Inside Containment Cut No. % Total % Cut Set Prob./ Frequency Basic Event DescriptionEvent Prob. 1 53.63 53.63 9.275E-006 IE-M4-SLOI-IC SLOI Inside of Containment Occurs -M4 1.750E-001 SD-SLOI-DIAG-XHE Operators fail to diagnose small LOI outside of containment before loss of SDC 1.000E-003 SD-SLOI-FEED-LT-XHE-D1 Operators fail to initiate feed after loss of SDC; before core damage 5.300E-002 2 85.20 31.57 5.460E-006 IE-M4-SLOI-IC SLOI Inside of Containment Occurs -M4 1.750E-001 SD-SLOI-FEED-LT-XHE-D2 Operators fail to initiate feed after loss of SDC; before core damage 1.500E-001 SD-SLOI-FEED-XHE Operator fails to initiate feed before loss of SDC 4.000E-003 SD-SLOI-ISOL-BRF-XHE-D2 Operator fail to terminate SLOI leak before SDC fails 5.200E-002 3 97.34 12.14 2.100E-006 IE-M4-SLOI-IC SLOI Inside of Containment Occurs -M4 1.750E-001 SD-SLOI-DIAG-XHE Operators fail to diagnose small LOI outside of containment before loss of SDC 1.000E-003 SD-SLOI-LTR1-XHE Operators fail to Refill RWST as Part of Long Term Recovery 1.200E-002 4 99.87 2.53 4.368E-007 IE-M4-SLOI-IC SLOI Inside of Containment Occurs -M4 1.750E-001 SD-SLOI-FEED-XHE Operator fails to initiate feed before loss of SDC 4.000E-003 SD-SLOI-ISOL-BRF-XHE-D6 Operator fail to terminate SLOI leak before SDC fails 5.200E-002 SD-SLOI-LTR1-XHE Operators fail to Refill RWST as Part of Long Term Recovery 1.200E-002 5 99.99 0.12 2.100E-008 IE-M4-SLOI-IC SLOI Inside of Containment Occurs -M4 1.750E-001 SD-SLOI-ISOL-AFD-XHE Operators fail to terminate SLOI leak before RWST is depleted 1.000E-005 SD-SLOI-LTR1-XHE-D7 Operators fail to Refill BWST as Part of Long Term Recovery 1.200E-002 6 100.00 0.01 2.100E-009 IE-M4-SLOI-IC SLOI Inside of Containment Occurs -M4 1.750E-001 SD-ISOL-EQP-FAILURES FAILURES OF EQUIPMENT TO ISOLATE 1.000E-006 SD-SLOI-LTR1-XHE Operators fail to Refill RWST as Part of Long Term Recovery 1.200E-002 7 100.00 0.00 3.710E-011 IE-M4-SLOI-IC SLOI Inside of Containment Occurs -M4 1.750E-001 SD-ISOL-EQP-FAILURES FAILURES OF EQUIPMENT TO ISOLATE 1.000E-006 SD-SLOI-FEED-LT-XHE-D4 Operators fail to initiate feed after loss of SDC; before core damage 5.300E-002 SD-SLOI-FEED-XHE Operator fails to initiate feed before loss of SDC 4.000E-003 8 100.00 0.00 1.887E-011 IE-M4-SLOI-IC SLOI Inside of Containment Occurs -M4 1.750E-001 CCW-HTX-CF-ALL COMMON CAUSE FAILURE OF CCW HEAT EXCHANGERS 1.348E-006 OPR-XHE-XM-ALTCOOL OPERATOR FAILS TO ALIGN FIRE WATER COOLING TO CCP/SI PUMPS 4.000E-002 SD-SLOI-ISOL-BRF-XHE Operator fail to terminate SLOI leak before SDC fails 2.000E-003 9 100.00 0.00 1.680E-011 IE-M4-SLOI-IC SLOI Inside of Containment Occurs -M4 1.750E-001 HPI-TNK-FC-RWST RWST IS UNAVAILABLE 4.800E-008 SD-SLOI-ISOL-BRF-XHE Operator fail to terminate SLOI leak before SDC fails 2.000E-003 10 100.00 0.00 1.367E-011 IE-M4-SLOI-IC SLOI Inside of Containment Occurs -M4 1.750E-001 CVC-ACX-CF-GL12ABS CCF OFCCP MDP ROOM COOLERS TO START 8.875E-005 HPI-SYS-FC-RWSTLLO FAILURE OF RWST LEVEL LO 2/4 INSTRUMENTATION (SA) 4.400E-004 SD-SLOI-ISOL-BRF-XHE Operator fail to terminate SLOI leak before SDC fails 2.000E-003 11 100.00 0.00 9.656E-012 IE-M4-SLOI-IC SLOI Inside of Containment Occurs -M4 1.750E-001 CVC-MDP-CF-START CHARGING PUMPS FAIL FROM COMMON CAUSE TO START 6.270E-005 HPI-SYS-FC-RWSTLLO FAILURE OF RWST LEVEL LO 2/4 INSTRUMENTATION (SA) 4.400E-004 SD-SLOI-ISOL-BRF-XHE Operator fail to terminate SLOI leak before SDC fails 2.000E-003 12 100.00 0.00 9.435E-012 IE-M4-SLOI-IC SLOI Inside of Containment Occurs -M4 1.750E-001 CCW-HTX-CF-ALL COMMON CAUSE FAILURE OF CCW HEAT EXCHANGERS 1.348E-006 OPR-XHE-XM-ALTCOOL OPERATOR FAILS TO ALIGN FIRE WATER COOLING TO CCP/SI PUMPS 4.000E-002 SD-SLOI-DIAG-XHE Operators fail to diagnose small LOI outside of containment before loss of SDC 1.000E-003 13 100.00 0.00 8.400E-012 IE-M4-SLOI-IC SLOI Inside of Containment Occurs -M4 1.750E-001 Page 84 Cut No. % Total % Cut Set Prob./ Frequency Basic Event DescriptionEvent Prob. SD-ISOL-EQP-FAILURES FAILURES OF EQUIPMENT TO ISOLATE 1.000E-006 SD-SLOI-FEED-XHE Operator fails to initiate feed before loss of SDC 4.000E-003 SD-SLOI-LTR1-XHE Operators fail to Refill RWST as Part of Long Term Recovery 1.200E-002 14 100.00 0.00 8.400E-012 IE-M4-SLOI-IC SLOI Inside of Containment Occurs -M4 1.750E-001 HPI-TNK-FC-RWST RWST IS UNAVAILABLE 4.800E-008 SD-SLOI-DIAG-XHE Operators fail to diagnose small LOI outside of containment before loss of SDC 1.000E-003 15 100.00 0.00 6.834E-012 IE-M4-SLOI-IC SLOI Inside of Containment Occurs -M4 1.750E-001 CVC-ACX-CF-GL12ABS CCF OFCCP MDP ROOM COOLERS TO START 8.875E-005 HPI-SYS-FC-RWSTLLO FAILURE OF RWST LEVEL LO 2/4 INSTRUMENTATION (SA) 4.400E-004 SD-SLOI-DIAG-XHE Operators fail to diagnose small LOI outside of containment before loss of SDC 1.000E-003 16 100.00 0.00 4.828E-012 IE-M4-SLOI-IC SLOI Inside of Containment Occurs -M4 1.750E-001 CVC-MDP-CF-START CHARGING PUMPS FAIL FROM COMMON CAUSE TO START 6.270E-005 HPI-SYS-FC-RWSTLLO FAILURE OF RWST LEVEL LO 2/4 INSTRUMENTATION (SA) 4.400E-004 SD-SLOI-DIAG-XHE Operators fail to diagnose small LOI outside of containment before loss of SDC 1.000E-003 17 100.00 0.00 4.168E-012 IE-M4-SLOI-IC SLOI Inside of Containment Occurs -M4 1.750E-001 CCW-MDP-CF-RUN CCW PUMPS FAIL FROM COMMON CAUSE TO RUN 2.977E-007 OPR-XHE-XM-ALTCOOL OPERATOR FAILS TO ALIGN FIRE WATER COOLING TO CCP/SI PUMPS 4.000E-002 SD-SLOI-ISOL-BRF-XHE Operator fail to terminate SLOI leak before SDC fails 2.000E-003 18 100.00 0.00 3.511E-012 IE-M4-SLOI-IC SLOI Inside of Containment Occurs -M4 1.750E-001 CVC-MOV-CF-112DE CCF OF CVC SUCTION MOVs CV112D/E 2.280E-005 HPI-SYS-FC-RWSTLLO FAILURE OF RWST LEVEL LO 2/4 INSTRUMENTATION (SA) 4.400E-004 SD-SLOI-ISOL-BRF-XHE Operator fail to terminate SLOI leak before SDC fails 2.000E-003 19 100.00 0.00 3.511E-012 IE-M4-SLOI-IC SLOI Inside of Containment Occurs -M4 1.750E-001 CVC-MOV-CF-8803AB CCF OF DISCHARGE MOVs 8803A & B TO OPEN 2.280E-005 HPI-SYS-FC-RWSTLLO FAILURE OF RWST LEVEL LO 2/4 INSTRUMENTATION (SA) 4.400E-004 SD-SLOI-ISOL-BRF-XHE Operator fail to terminate SLOI leak before SDC fails 2.000E-003 20 100.00 0.00 3.511E-012 IE-M4-SLOI-IC SLOI Inside of Containment Occurs -M4 1.750E-001 CVC-MOV-CF-8801AB COMMON CAUSE FAILURE OF DISCHARGE MOVs 8801A & B 2.280E-005 HPI-SYS-FC-RWSTLLO FAILURE OF RWST LEVEL LO 2/4 INSTRUMENTATION (SA) 4.400E-004 SD-SLOI-ISOL-BRF-XHE Operator fail to terminate SLOI leak before SDC fails 2.000E-003

ML091760764

Contents

Text

Description:

Description:

Description:

Description:

Description:

Description:

Description:

Description:

Description:

Description:

Description:

Description:

Description:

Description:

Description:

Description:

Description:

Navigation menu

ML091760764

Text

Description:

Description:

Description:

Description:

Description:

Description:

Description:

Description:

Description:

Description:

Description:

Description:

Description:

Description:

Description:

Description:

Description:

Navigation menu

Search