TECHNICAL BASIS

SHUTDOWN OPERATIONS

SIGNIFICANCE DETERMINATION PROCESS

(IMC 0609, App G)

BWR AND PWR PHASE 2 SIGNIFICANCE DETERMINATION PROCESS FOR SHUTDOWN

TABLE OF CONTENTS

APPENDIX G BWR PHASE 2 SHUTDOWN TEMPLATE
[3](#__RefHeading___Toc193076239)

1.0 OBJECTIVE [3](#__RefHeading___Toc193076240)

2.0 INTRODUCTION [3](#__RefHeading___Toc193076241)

2.1 Model Scope [3](#__RefHeading___Toc193076242)

2.2 Limitations of the PRA model [3](#__RefHeading___Toc193076243)

3.0 CHARACTERIZATION OF SHUTDOWN OPERATIONS
[3](#__RefHeading___Toc193076244)

4.0 SHUTDOWN INITIATING EVENTS [3](#__RefHeading___Toc193076245)

5.0 SHUTDOWN INITIATING EVENT FREQUENCIES
[3](#__RefHeading___Toc193076246)

6.0 EVENT TREE MODELS [3](#__RefHeading___Toc193076247)

6.1 Overview [3](#__RefHeading___Toc193076248)

6.2 Event Tree Success Criteria [3](#__RefHeading___Toc193076249)

6.3 General Description/Philosophy for Event Trees
[3](#__RefHeading___Toc193076250)

7.0 HUMAN ERROR PROBABILITIES [3](#__RefHeading___Toc193076251)

7.1 Basis for HEPs used in the IEL Tables
[3](#__RefHeading___Toc193076252)

7.2 Basis for HEPs used in the Worksheets
[3](#__RefHeading___Toc193076253)

APPENDIX G PWR PHASE 2 SHUTDOWN TEMPLATE
[3](#__RefHeading___Toc193076254)

1.0 OBJECTIVE [3](#__RefHeading___Toc193076255)

2.0 INTRODUCTION [3](#__RefHeading___Toc193076256)

2.1 Model Scope [3](#__RefHeading___Toc193076257)

2.2 Limitations of the PRA model [3](#__RefHeading___Toc193076258)

3.0 CHARACTERIZATION OF SHUTDOWN OPERATIONS
[3](#__RefHeading___Toc193076259)

4.0 SHUTDOWN INITIATING EVENTS [3](#__RefHeading___Toc193076260)

5.0 SHUTDOWN INITIATING EVENT FREQUENCIES
[3](#__RefHeading___Toc193076261)

6.0 EVENT TREE MODELS [3](#__RefHeading___Toc193076262)

6.1 Overview [3](#__RefHeading___Toc193076263)

6.2 Event Tree Success Criteria [3](#__RefHeading___Toc193076264)

6.3 General Description/Philosophy for Event Trees
[3](#__RefHeading___Toc193076265)

7.0 HUMAN ERROR PROBABILITIES [3](#__RefHeading___Toc193076266)

7.1 Basis for HEPs used in the IEL Tables
[3](#__RefHeading___Toc193076267)

7.2 Basis for HEPs used in the Worksheets
[3](#__RefHeading___Toc193076268)

APPENDIX G BWR PHASE 2 SHUTDOWN TEMPLATE[]{#__RefHeading___Toc193076239
.anchor}

1.0 OBJECTIVE[]{#__RefHeading___Toc193076240 .anchor}

The objective of this basis document is to define the PRA model used to
develop Appendix G for BWRs and the BWR Shutdown Template.

2.0 INTRODUCTION[]{#__RefHeading___Toc193076241 .anchor}

2.1 Model Scope[]{#__RefHeading___Toc193076242 .anchor}

This low power and shutdown PRA model focuses on shutdown operations
when more than one fuel assembly is in the reactor vessel. This PRA
specifically covers shutdown operations which begin when the licensee
has met the entry conditions for RHR, and RHR cooling has been initiated
and ends when the licensee is heating up, and RHR has been secured.

Once the plant is above the RHR entry conditions, a severe accident
during this configuration is expected to produce a plant response that
is bounded by the plant response to full power initiating events. For
deficiencies occurring above the RHR entry conditions, the full power
SDP tools should be used acknowledging: (1) decay heat is less compared
to full power, potentially allowing more time for operator recovery (2)
some mitigating systems may require manual operation versus automatic
operation, and (3) some containment systems may not be required to be
operable potentially increasing the likelihood of containment failure.

2.2 Limitations of the PRA model[]{#__RefHeading___Toc193076243 .anchor}

The template is a simplified tool that generates an order-of-magnitude
assessment of the risk significance of the inspection findings during a
shutdown. This template is developed for a BWR plant, considering the
features of a General Electric BWR 4 - Mark I plant. However, it can be
used for different plant classes as long as the analyst considers each
system and strategy that can be sued to maintain the shutdown key safety
functions such as the ability to: maintain/recover DHR heat removal,
maintain RCS level control, and maintain RCS pressure control.

This generic tool could not include plant specific mitigating features
because they vary between licensees and outages. Therefore, the analyst
has to consider the licensee's outage-specific mitigation capability.

Since the template was developed based on maintaining key shutdown
safety functions, this template does not provide any information on
frontline system dependencies. The analyst should refer to the
system-dependency table provided in the at-power phase 2 Notebooks.
However, the analyst has to consider additional dependencies for
additional systems/functions not needed at full power (e.g., AC power
for containment closure). The analyst also has to consider whether a
support system is needed for the frontline system at shutdown.

3.0 CHARACTERIZATION OF SHUTDOWN
OPERATIONS[]{#__RefHeading___Toc193076244 .anchor}

The risk significance of an inspection finding at shutdown depends on
the plant configuration. To account for the plant's changing
configuration and decay heat level during shutdown, this PRA model
parses an outage into plant operational states (POSs) and time windows
(TWs). The plant response to the a loss or interruptions of RHR is
assumed to remain constant during a given POS. Time Windows are used to
separate POSs occurring early in the outage when decay heat is high to
POSs occurring late in the outage when decay heat is low.

For this template, Figure 1 defines the POSs and time windows for a BWR
plant. It also shows the relationship between the POSs and the modes
laid down in the Technical Specifications (TSs). We now describe the
POSs and Time Windows (TWs).

POS 1 - This POS starts when the RHR system is put into service. and
tThe vessel head is on and the RCS is closed such that an extended loss
of the DHR function without operator intervention could result in a RCS
re-pressurization above the shutoff head for the RHR pumps. This POS
covers part of Hot Shutdown (Mode 3) and Cold Shutdown (Mode 4) of the
TS Modes.

POS 2 - This POS represents the shutdown condition when (1) the vessel
head is removed, and the reactor pressure vessel water level is less
than the minimum level required for movement of irradiated fuel
assemblies within the reactor pressure vessel as defined by Technical
Specifications OR (2) a sufficient RCS vent path exists for decay heat
removal. This POS occurs during Mode 5.

POS 3 - This POS represents the shutdown condition when the reactor
pressure vessel water level is equal or greater than the minimum level
required for movement of irradiated fuel assemblies within the reactor
pressure vessel as defined by Technical Specifications. This POS occur
during Mode 5.

Early Time Window (TW-E) - This time widow represents the time before
POS 3 is entered. The decay heat is relatively high. The reactor is
either in POS 1 or 2.

Late Time Window (TW-L )- This time window represents the time after POS
group 3. The decay heat is relatively low. The reactor is either in POS
1, 2, or 3

The above definitions of the POSs and Time Windows can be used to
address different types of plant shutdowns, i.e., refueling outage,
planned maintenance outage, and an unplanned outage. Depending on the
type of outage and its duration, the POSs and TWs can be identified from
the above list. For example, all POSs and both TWs will apply to a
refueling outage. Only POS 1 and the early Time Window (TW-E) may apply
to an unplanned outage.

NOTE: The operator credits in the SDP worksheets are given for Time
Window - E. The same worksheets can be used for Time Window - L except
the credits for operator response may need to be changed to account for
the longer operator's response time. Detailed instructions are given in
Chapter 6.0 of this template

4.0 SHUTDOWN INITIATING EVENTS[]{#__RefHeading___Toc193076245 .anchor}

An initiating event at shutdown is defined as an event that causes a
loss or interruption of the decay heat removal function. This template
considers the three internal initiators known to dominate the
internal-event shutdown risk based on the Grand Gulf Shutdown PRA
(NUREG/CR 6143).

The following are the initiating events considered, with their
applicability to the three POSs.

Loss of RHR (LORHR) - This initiating event category includes losses of
RHR resulting from failures of the RHR system (such as RHR pump failure)
or failures of the RHR support systems such as loss of RBC, loss of SRW,
loss of vital AC, and loss of DC power (Loss of offsite power is treated
as a separate category.) This category also includes interruptions of
RHR caused by spurious ESFAS signals such as RHR suction valve closure.
This initiating event category is considered for POS 1 and POS 2. This
category is not considered applicable to POS 3, since the time to core
uncovery is assumed to be greater than 24 hours.

Loss of Offsite Power (LOOP) - This initiating event category covers
losses of offsite power at shutdown which cause a loss of RHR, and
operator action is needed to restore RHR. This initiator category is
considered for only POS 1 and POS 2. This category is not considered
applicable to POS 3, since the time to core uncovery is assumed to be
greater than 24 hours.

Loss of Reactor Inventory (LOI) - This initiating event category
includes losses of RCS inventory that lead to a loss of RHR due to
isolation of RHR on Level 3 or loss of RHR due to loss of RHR pump
suction. Many of these flow diversions are caused from improper
alignment of valves. This initiator category is considered for all POS
groups.

5.0 SHUTDOWN INITIATING EVENT FREQUENCIES[]{#__RefHeading___Toc193076246
.anchor}

Initiating event frequencies were estimated by searching LERs from 1992
to 1998[^1] and the totaling the number of refueling hours.

  --------- --------------- ---------------------- ------------- ----------- ----------
  **Row**   **Approximate   **Example Event Type** **Estimated               
            Conditional                            IEL^(1)^**                
            Frequency**                                                      

  **0**     \> 1 per yr     Loss of a Operating    **0**         **1**       **2**
                            Train of RHR (LORHR)                             

  **I**     1 per 1-10 yr   Loss of offsite power  **1**         **2**       **3**
                            (LOOP)                                           

  **II**    1 per 10-10 ^2^ Loss of Inventory      **2**         **3**       **4**
            yr              (LOI)                                            

                                                   **\> 30       **3-30      **\< 3
                                                   days**        days**      days**

                                                   **Exposure                
                                                   Time for                  
                                                   Degraded                  
                                                   Condition**               
  --------- --------------- ---------------------- ------------- ----------- ----------

1\. The likelihood ratings are presented in terms of 0, 1, 2, etc. A
rating of 0 is comparable to a frequency of 1 per year, a rating of 1 is
comparable to a frequency of 1E-1 per year, and similarly, a rating of 2
is comparable to a frequency of 1E-2 per year.

6.0 EVENT TREE MODELS[]{#__RefHeading___Toc193076247 .anchor}

6.1 Overview[]{#__RefHeading___Toc193076248 .anchor}

For each event tree, there is an associated worksheet that defines each
top event function in the event tree by:

-   Top Event Function - A key safety function that is necessary to
    restore core cooling given a loss or interruption of the RHR
    function (e.g. the operator initiates RCS injection before core
    damage).

-   Success Criteria - The minimum set of equipment that can be used to
    fulfill the top event function.

-   Instrumentation - The minimum set of instrumentation needed by the
    operator to fulfill the top event function.

-   Equipment Credit - The credit given to the top event function by the
    analyst based on all available systems able to fulfill the top event
    function. The equipment credit used in the worksheets are similar to
    the equipment credits used in the full power SDP worksheets.
    Temporary equipment credit is obtained using Table 6.

-   Operator Credit - The credit given for the operator to perform the
    corresponding top event function. The default operator credit for
    performing the top event assumes that: (1) the success criteria for
    the top event function has been met and (2) the minimum set of
    instrumentation needed by the operator is available and providing
    reliable indication. Operator credits were developed using the
    SPAR-H methodology developed by INEL (ADAMS Accession number
    ML031540054).

> NOTE: The analyst must adjust the default operator credits in the
> worksheets using the following table if:

-   If the referenced instrumentation is missing or misleading, then the
    operator credit is decreased by two or becomes zero if the operator
    credit becomes negative.

> Referring to the SPAR-H LP&SD worksheets, the PSF level for stress is
> now considered to be high, and the PSF level for ergonomics is now
> considered missing/misleading. Using the SPAR-H worksheets, this
> condition results in an HEP multiplier of 100.

-   The default time is incorrect and is significantly reduced. If the
    diagnosis time is less than 20 minutes, OR the time necessary to
    perform the action is approximately the available time, then the
    operator credit is decreased by two or becomes zero if the operator
    credit becomes negative.

-   Referring to the SPAR-H LP&SD worksheets, the PSF level for
    available time for diagnosis becomes barely adequate and has a
    multiplier of ten. The PSF level for available time for the action
    portion of the task has a PSF multiplier of 10.

-   If the operator action is complicated by missing equipment,
    unaccessible equipment, steam or high radiation, or loop seals for
    pumps that must be vented, then the operator credit is decreased by
    two or becomes zero if the operator credit becomes negative.

> Referring to the SPAR-H LP&SD worksheets, the PSF level for stress is
> now considered to be high, and the PSF level for ergonomics is now
> considered to be missing/misleading. Using the SPAR-H LP&SD
> worksheets, this condition results in an HEP multiplier of 100.

-   If the procedure is not complete for the shutdown plant
    configuration, then the operator credit is decreased by one or
    becomes zero if the operator credit becomes negative.

> Referring to the SPAR-H LP&SD worksheets, the PSF level for procedures
> is considered as incomplete. The HEP multiplier is assigned a factor
> of 20.

-   Function Credit - The lower of [Equipment Credit]{.underline} and
    [Operator Credit]{.underline}.

6.2 Event Tree Success Criteria[]{#__RefHeading___Toc193076249 .anchor}

The Success Criteria for the BWR Shutdown Template is based on the RES
Grand Gulf PRA referenced in Table 5.1.1 of NUREG/CR-6143 Vol 2. Part
1A.

6.3 General Description/Philosophy for Event
Trees[]{#__RefHeading___Toc193076250 .anchor}

6.3.1. LOI Event Trees

POS 1- Head on

> The LOI event trees are defined as a losses of RCS inventory such that
> DHR should have isolated on low level (Level 3). Losses though the
> downcomer can be isolated by the automatic isolation of DHR on low
> level. Losses from the bottom head (such as through a breached RWCU
> drain line) are not assumed to be isolable for phase 2 analysis. For
> phase 2 analysis, the break size is assumed not be large enough to be
> able to remove decay heat, so RCS pressure control is necessary.
> Should the operator fail to manually inject early, the possibility of
> manual high pressure injection with the SRVs steaming at their safety
> setpoint is considered.

POS 2- Head off

> The LOI event trees are defined as a losses of RCS inventory such that
> DHR should have isolated on low level (Level 3). Losses though the
> downcomer can be isolated by the automatic isolation of DHR on low
> level. Losses from the bottom head (such as through a breached RWCU
> drain line) are not assumed to be isolable for phase 2 analysis.

6.3.2 LORHR Event Trees

> The LORHR event trees are defined as losses or interruptions of the
> RHR system due failures of the RHR system and/or its support systems
> (such as SSW or DC power). Recovery of DHR must take place before (1)
> RHR shutoff head is reached in POS 1, or (2) low RCS level is reached
> in POS 2 when RHR is automatically isolated, else RCS injection is
> required to prevent core damage. It is assumed that automatic ECCS via
> a LPCI train is not available since the LPCI train would have been
> re-configured for RHR recovery.

6.3.3 LOOP Event Trees

> The LOOP event trees evaluate losses of offsite power that result in a
> loss or interruption of the operating train of RHR. For POS 1, AC
> independent injection and RCS pressure control is assumed to be
> sufficient until battery depletion. Based on the RES Grand Gulf
> Shutdown PRA (NUREG/CR-6143 Vol 2, Part 1 , page 8-49), each ESF
> battery bank can supply the required DC loads for 11 hours after a
> loss of AC power if unnecessary loads are shed.

7.0 HUMAN ERROR PROBABILITIES[]{#__RefHeading___Toc193076251 .anchor}

7.1 Basis for HEPs used in the IEL Tables[]{#__RefHeading___Toc193076252
.anchor}

> If a licensee has a finding that increases the likelihood of a loss of
> RHR, IEL tables were created to estimate the new conditional
> likelihood that a loss of RHR will occur due to the performance
> deficiency given the occurrence of the performance deficiency and/or
> condition.
>
> The following HEP tables were used in the BWR Shutdown template. The
> tables for LOI and LORHR are constructed using the same format. The
> first column is used to estimate the time to loss of the RHR function
> from the specific initiating event. The second column determines the
> availability of key instrumentation that would help the operator to:
> (1) diagnose that a potential problem exists with maintaining the RHR
> function and (2) diagnose how to recover from the potential problem
> such that an interruption or loss of the RHR function is prevented.
>
> From the first column, the time to loss of the RHR function was then
> divided by two to determine how long the (1) operator had to diagnose
> the specific action needed to recover RHR and (2) the operator had to
> perform the specific action needed to recover RHR. (The factor two was
> used to keep this phase 2 model simple.) Then, the third and fourth
> columns ask if (1) the specific action to recover RHR can be
> identified within ½ time to loss of the RHR function and (2) if action
> to recover RHR can be performed within ½ time to loss of the RHR
> function.
>
> It was assumed that failure of the operator to diagnose the tasks
> needed to be performed to prevent a loss of the RHR function would
> dominate the IEL rather than failure of the operator to perform the
> necessary physical manipulations of the task.
>
> The IELs corresponding to ½ time to loss of the RHR function come from
> "Nominal Model of estimated HEPs and EFs within time for diagnosis
> within time T by control room personnel of an abnormal event
> annunciated closely in time," (Table 12-4, NUREG/CR 1278). The median
> joint HEP curve was used assuming the operator had key instrumentation
> referenced in the IEL tables.
>
> If the licensee did not have the key instrumentation referenced in the
> IEL tables, then the IEL was assessed a multiplier of 100 based on the
> SPAR-H methodology. Referring to the LP&SD SPAR-H worksheets, if the
> licensee has missing/misleading instrumentation, the PSF multiplier is
> assessed as 50. This loss of instrumentation will result in the task
> complexity changing from nominal to moderately complex, resulting in
> an additional multiplier of 2.

7.2 Basis for HEPs used in the Worksheets[]{#__RefHeading___Toc193076253
.anchor}

> SPAR-H methodology developed by INEL was used to derive the HEPs for
> the worksheets (ADAMS accession number ML031540084). Since every
> interruption of RHR requires a successful operator response to prevent
> core damage, operator error is a key contributor to shutdown risk.
> Operator error appears in almost every top event/mitigation path in
> the shutdown event trees.
>
> The SPAR-H LP&SD worksheets were used to develop a diagnosis
> probability. for each safety function that has an operator credit.
> Using the SPAR-H method given a similar set of PSFs, the diagnosis
> probability dominates the action probability. Therefore, to simplify
> the model for phase 2 analysis , the diagnosis probability defines the
> operator credits used in the worksheets. The first safety function
> does not include dependence in the operator credit estimate. The
> second and succeeding safety functions include an estimate of
> dependence.
>
> The inferred definition of diagnosis is any cognitive decision making
> that is necessary to perform a task. This definition includes all
> cognitive tasks ranging from responding to annunciators to recognizing
> what is necessary to recover a failed RHR system. The inferred
> definition of action is any manipulation involved in performing the
> task.
>
> The analyst must recognize that the impact of various PSFs may overlap
> each other. For example, if the procedures are poor, the time
> available to perform an action may be decreased if the operator is
> following the procedures step-by-step.
>
> In the following sections, each default operator credit referenced in
> the worksheets is derived in the following sections using the SPAR-H
> methodology.
>
> Referring to the SPAR-H LP&SD worksheets, for each operator credit,
> the available time was evaluated. This is defined the time that the
> action must be completed (often in terms of several hours) minus the
> time it takes to perform the action (often in terms of minutes) plus
> the time it takes to receive the first cue. The definitions for
> nominal time, extra time, and expansive time are given in the
> worksheets.

7.2.1 HEPs for the POS 1 and POS 2 for Loss of Inventory Events

LOI POS 1 Worksheet

MINJ: Operator manually initiates low pressure injection before RHR
shutoff head is reached given the leak path has been isolated. For cues,
it is assumed that the operator has received the automatic isolation of
RHR on Level III alarm. As an additional cue, if RCS injection is
delayed, the operators would see rising RCS pressure. It is also assumed
that the operators have procedures for this action at shutdown as
recommended by NUMARC 91-06.

> Time to RHR shutoff head is assumed to occur after 1 hour. The time to
> manually initiate RCS injection is assumed to take minutes to perform.
> Thus, using the SPAR-H LP&SD worksheets, the PSF level for time is
> considered to be expansive. All other PSF levels are considered
> nominal. The default operator credit is estimated to be 1E-4 or an
> operator credit of 4.

MINJX: Operator manually initiates low pressure injection before RCS
pressure control is needed or core damage given the leak path has not
been isolated. For cues, it is assumed that the operator has received
the automatic isolation of RHR on Level III alarm. Also, the operators
would receive a RCS low low level alarm (level 2). It is also assumed
that the operators have procedures for this action at shutdown as
recommended by NUMARC 91-06. Time to RHR shutoff head is assumed to be
greater than 1 hour. Time to core damage given the leak is assumed to
occur greater than 2 hours. The time to manually initiate injection is
assumed to take minutes to perform. Using the SPAR-H LP&SD worksheets,
the PSF level for time is considered to be expansive. All other PSF
levels are considered nominal, the default operator credit is estimated
to be 1E-4.

RHRREC: Operator recovers RHR before RCS pressure control is needed
given the leak path has been isolated, and the operators successfully
initiated RCS injection. Time to RHR shutoff head is assumed to be
greater than 1 hour. For cues, it is assumed that the operator has
received the automatic isolation of RHR on Level III alarm. It is also
assumed that the operators have procedures for this action as
recommended by NUMARC 91-06. The time to recover RHR from the control
room is assumed to take minutes. The time to RHR shutoff head is assumed
to be greater than 1 hour. Using the SPAR-H LP&SD worksheets, the PSF
level for time is considered to be expansive. All other PSF levels are
considered nominal, the default operator credit is estimated to be 1E-4.

SRV: Operator controls RCS pressure using an SRV or other means so that
core heat removal can be sustained, given the operators successfully
initiated RCS injection but failed to restore RHR. This action has to be
performed before core damage. For cues, the operator has increasing RCS
pressure and the alarm associated with automatic isolation of shutdown
cooling suction valves above 135 psig. The time needed to open the SRVs
is assumed to take minutes; the time to core damage is assumed to be
greater than 3 hour with injection. Using the SPAR-H LP&SD worksheets,
the PSF level for time is considered to be expansive. All other PSF
levels are considered nominal, the default operator credit is estimated
to be 1E-4.

> Considering dependence with RHRREC, the timing of both actions is
> simultaneous but not close in time. For this event, the operators have
> successfully initiated RCS injection. Now, the operators have failed
> to recover RHR before RCS pressure control is needed but must control
> RCS pressure to allow low pressure injection to continue. For cues,
> the operator has increasing RCS pressure. The dependency between
> RHRREC and SRV is believed to be low. Using the SPAR-H worksheets, the
> task failure with dependence was estimated as .05, so the revised HEP
> credit is 2.

MINJY: Operator initiates high pressure injection given complete failure
of the operator to manually inject at low pressure (MINJ). Failure of
MINJ includes equipment failure and operator failure. This action has to
be performed before core damage. For cues, the operator has increasing
RCS pressure, automatic isolation of the shutdown cooling suction valves
at 135 psig, and possibly the SRVs lifting. The time needed to open the
SRVs and initiate high pressure injection is assumed to take minutes.
Using the SPAR-H LP&SD worksheets, the time to perform the action is
considered nominal. All other PSF levels are considered nominal, the
default operator credit is estimated to be 1E-2.

> Considering dependence with MINJ, the timing of both actions is not
> close in time. The operators have additional cues increasing RCS
> pressure, automatic isolation of the shutdown cooling suction valves
> at 135 psig, and possibly the SRVs lifting. Thus, the dependency
> between the two actions was believed to be moderate. Using the SPAR-H
> worksheets, the task failure with dependence was estimated as 1E-1 or
> an operator credit of 1.

CV: Operator successfully initiates containment venting and/or makeup
water to the suppression pool for long term cooling given the operator
successfully initiated RCS injection. It is assumed that the operator
has hours to this action. For cues, the operator may have increasing
suppression pool temperature; however suppression pool temperatures are
not required to be monitored at shutdown. Suppression pool level is
required to be monitored at shutdown to support ECCS operability. Using
the SPAR-H LP&SD worksheets, the time to perform the action versus the
time to perform the action is considered expansive. However, the stress
level for this action is perceived to be extreme, and it is assumed that
training for this scenario is low. Regarding the ergonomics PSF level,
if the suppression pool level temperature is available, then all other
PSF levels (other than stress and training) are considered nominal, the
default operator credit is rounded to 1E-3.

LOI POS 2 and POS 3 WORKSHEET

MINJ: Operator manually initiates low pressure injection before core
damage given the leak path has been isolated. For cues, it is assumed
that the operator has received the automatic isolation of RHR on Level
III alarm. It is also assumed that the operators have procedures for
this action at shutdown as recommended by NUMARC 91-06. Time to core
damage is assumed to occur after 3 hours. The time to manually initiate
injection is assumed to take minutes to perform. As an additional cue,
if RCS injection is delayed, the operators would encounter steaming from
the top of the open vessel. Using the SPAR-H LP&SD worksheets, the PSF
level for time is considered to be expansive since initiating injection
is assumed to take minutes. All other PSF levels are considered nominal,
the default operator credit is estimated to be 1E-4.

MINJX: Operator manually initiates low pressure injection before core
damage given the leak path has not been isolated and automatic ECCS
injection has failed. For cues, it is assumed that the operator has
received the automatic isolation of RHR on Level III alarm. Also, the
operators would receive a RCS low low level alarm (level 2). It is also
assumed that the operators have procedures for this action at shutdown
as recommended by NUMARC 91-06. Using the SPAR-H LP&SD worksheets, the
PSF level for time is considered to be expansive since the time to
initiate RCS injection is assumed to take minutes and core damage is
assumed to occur after 2 hours given the leak. All other PSF levels are
considered nominal, the default operator credit is estimated to be 1E-4.

RHRREC: Operator recovers RHR before long term makeup to the suppression
pool is needed given successful manual injection or automatic injection.
For cues, it is assumed that the operator has received the automatic
isolation of RHR on Level III alarm. It is also assumed that the
operators have procedures for this action as recommended by NUMARC
91-06. The time to recover RHR from the control room is assumed to take
minutes. Using the SPAR-H LP&SD worksheets, the PSF level for time is
considered to be expansive. All other PSF levels are considered nominal,
the default operator credit is estimated to be 1E-4.

LCOOL: Operator successfully initiates makeup water to the suppression
pool for long term cooling given the operator successfully initiated RCS
injection or given successful automatic injection. It is assumed that
the operator has hours to this action. For cues, suppression pool level
is required to be monitored at shutdown to support ECCS operability.
Using the SPAR-H LP&SD worksheets, the time to perform the action versus
the time to perform the action is considered expansive. All other PSF
levels are considered nominal, the default operator credit is estimated
as 1E-4

> Given successfully RCS injection, it was assumed that there is no
> dependence between restoration of RHR and the operator failing to
> continue long term makeup

LOOP POS 1 and POS 2 Worksheet

ACI&SRV: Operator manually initiates AC independent low pressure
injection (e.g. fire water) and initiates RCS pressure control (e.g.
opens SRVs) before core damage. For cues, it is assumed that the
operator has received indication that a total loss of AC power occurred
via alarms. Time to core damage is assumed to occur after 3 hours. The
time to manually initiate AC independent injection is assumed to be
completed under 1 hour. Therefore, using the SPAR-H LP&SD worksheets,
the PSF level for time is considered to be expansive. The PSF level for
stress is assumed to be extreme, and the level of training for this
situation is assumed to be low. All other PSF levels are considered
nominal. Using the SPAR-H LP&SD worksheets, the default HEP is rounded
to 1E-3.

ACI: Operator manually initiates AC independent low pressure injection
(e.g. fire water) before core damage. For cues, it is assumed that the
operator has received indication that a total loss of AC power occurred
via alarms. Time to core damage is assumed to occur after 3 hours. The
time to manually initiate AC independent injection is assumed to be
completed under 1 hour. Therefore, using the SPAR-H LP&SD worksheets,
the PSF level for time is considered to be expansive. The PSF level for
stress is assumed to be extreme, and the level of training for this
situation is assumed to be low. All other PSF levels are considered
nominal. Using the SPAR-H LP&SD worksheets, the default HEP is rounded
to 1E-3.

LORHR POS 1 Worksheet

RHRREC: Operator recovers a train of RHR before RHR shutoff head is
reached and RCS pressure control is needed. Use the operator response
curves in NUREG 1278 Table 12-4, if each of the following statements are
true.

> A. There are trouble alarms present for the finding.
>
> B. The action to recover RHR can be identified (diagnosed) within ½
> the time to RHR shutoff head
>
> C. The action to recover RHR can be performed within ½ the time to RHR
> shutoff head
>
> THEN CREDIT = 0 if T~shut~ \< 20 minutes

CREDIT = 1 if 20 minutes\< T~shut~ \< 40 minutes

CREDIT = 2 if 40 minutes \<T~shut~ \< one hour

CREDIT = 3 if T~shut~ \> one hour.

MINJ&SRV: Operator manually (1) initiates RCS injection using another
standby low pressure injection pumps in addition to the two LPCI pumps
that are being used to satisfy the RHR function and (2) initiates RCS
pressure control (e.g. opens an SRV) before RHR shutoff head is reached
It is assumed that the operators have received trouble alarms for the
RHR system. It is assumed that the operator must perform this action
before core damage which is assumed to occur after 3 hours. Using the
SPAR-H LP&SD worksheets, the PSF level for time is considered to be
expansive since initiating RCS injection and pressure control is assumed
to require minutes. It is assumed that the operators have procedures for
this action at shutdown as recommended by NUMARC 91-06. Thus, all other
PSF levels are considered nominal. Using the SPAR-H LP&SD worksheets,
the default HEP is rounded to 1E-4.

> Considering dependence between RHRREC and MINJ&SRV, the dependence is
> assumed to be low. The timing of both actions is not close in time.
> Also, the operators will receive additional cues such as increasing
> RCS pressure and the automatic isolation of RHR at 135 psig. Using the
> SPAR LP&SD worksheets, considering low dependence the revised HEP is 1
> E-2 or an operator credit of 2.

MINJY: Operator initiates high pressure injection given complete failure
of the operator to manually inject at low pressure (MINJ). Failure of
MINJ includes equipment failure and operator failure. This action has to
be performed before core damage. For cues, the operator has increasing
RCS pressure, automatic isolation of the shutdown cooling suction valves
at 135 psig, and possibly the SRVs lifting. The time needed to open the
SRVs and initiate high pressure injection is assumed to take minutes.
Using the SPAR-H LP&SD worksheets, the time to perform the action is
considered nominal. All other PSF levels are considered nominal, the
default operator credit is estimated to be 1E-2.

> Considering dependence with MINJ, the timing of both actions is not
> close in time. The operators have additional cues increasing RCS
> pressure, automatic isolation of the shutdown cooling suction valves
> at 135 psig, and possibly the SRVs lifting. Thus, the dependency
> between the two actions was believed to be moderate. Using the SPAR-H
> worksheets, the task failure with dependence was estimated as 1E-1 or
> an operator credit of 1.

CV: Operator successfully initiates containment venting and/or makeup
water to the suppression pool for long term cooling given the operator
successfully initiated RCS injection but fails to recover RHR. It is
assumed that the operator has hours to this action. For cues, the
operator may have increasing suppression pool temperature; however
suppression pool temperatures are not required to be monitored at
shutdown. Suppression pool level is required to be monitored at shutdown
to support ECCS operability. Using the SPAR-H LP&SD worksheets, the time
to perform the action versus the time to perform the action is
considered expansive. However, the stress level for this action is
perceived to be extreme, and it is assumed that training for this
scenario is low. Regarding the ergonomics PSF level, if the suppression
pool level temperature is available, then all other PSF levels (other
than stress and training) are considered nominal, the default operator
credit is rounded to 1E-3.

LORHR POS 2 Worksheet

RHRREC: Operator recovers a train of RHR before low RCS level is reached
(level 3), and RHR is automatically isolated. Use the operator response
curves in NUREG 1278 Table 12-4, if each of the following statements are
true.

.

There are trouble alarms present for the finding.

B.  The action to recover RHR can be identified (diagnosed) within ½ the
    time to RHR shutoff head

C.  The action to recover RHR can be performed within ½ the time to RHR
    shutoff head

> THEN CREDIT = 0 if T~isol~ \< 20 minutes

CREDIT = 1 if 20 minutes \< T~isol~ \< 40 minutes

CREDIT = 2 if 40 minutes \< T~isol~ \< one hour

CREDIT = 3 if if T~isol~ \> one hour.

MINJ: Operator manually initiates RCS injection using another standby
high or low pressure injection pumps in addition to the two LPCI pumps
that are being used to satisfy the RHR function before core damage is
reached. It is assumed that the operators have received trouble alarms
for the RHR system. It is assumed that the operator must perform this
action before core damage which is assumed to occur after 3 hours. Using
the SPAR-H LP&SD worksheets, the PSF level for time is considered to be
expansive since initiating RCS injection is assumed to require minutes.
It is assumed that the operators have procedures for this action at
shutdown as recommended by NUMARC 91-06. Thus, all other PSF levels are
considered nominal. Using the SPAR-H LP&SD worksheets, the default HEP
is rounded to 1E-4.

> Considering dependence between RHRREC and MINJ, the dependence is
> assumed to be low. The timing of both actions is not close in time.
> Also, the operators will receive additional cues such as decreasing
> RCS level and the RCS low low level alarms. Using the SPAR LP&SD
> worksheets, considering low dependence the revised HEP is 1 E-2 or an
> operator credit of 2.

LCOOL: Operator successfully initiates makeup water to the suppression
pool for long term cooling given the operator successfully initiated RCS
injection. It is assumed that the operator has hours to this action. For
cues, suppression pool level is required to be monitored at shutdown to
support ECCS operability. Using the SPAR-H LP&SD worksheets, the time to
perform the action versus the time to perform the action is considered
expansive. All other PSF levels are considered nominal, the default
operator credit is estimated as 1E-4.

APPENDIX G PWR PHASE 2 SHUTDOWN TEMPLATE[]{#__RefHeading___Toc193076254
.anchor}

1.0 OBJECTIVE[]{#__RefHeading___Toc193076255 .anchor}

The objective of this basis document is to define the PRA model used to
develop Appendix G for PWRs and the PWR Shutdown Template.

2.0 INTRODUCTION[]{#__RefHeading___Toc193076256 .anchor}

2.1 Model Scope[]{#__RefHeading___Toc193076257 .anchor}

This low power and shutdown PRA model focuses on shutdown operations
when more than one fuel assembly in the reactor vessel. This PRA
specifically covers shutdown operations which begin when the licensee
has met the entry conditions for RHR, and RHR cooling has been initiated
and ends when the licensee is heating up, and RHR has been secured.

Once the plant is above the RHR entry conditions, a severe accident
during this configuration is expected to produce a plant response that
is bounded by the plant response to full power initiating events. For
deficiencies occurring above the RHR entry conditions, the full power
SDP tools should be used acknowledging: (1) decay heat is less compared
to full power, potentially allowing more time for operator recovery (2)
some mitigating systems may require manual operation versus automatic
operation, and (3) some containment systems may not be required to be
operable potentially increasing the likelihood of containment failure.

2.2 Limitations of the PRA model[]{#__RefHeading___Toc193076258 .anchor}

The template is a simplified tool that generates an order-of-magnitude
assessment of the risk significance of the inspection findings during a
shutdown. This template is developed for a PWR plant, considering the
features of a Westinghouse 4-loop plant. However, it can be used for
different plant classes as long as the analyst considers each system and
strategy that can be used to maintain the shutdown key safety functions
such as the ability to maintain/recover DHR heat removal, maintain RCS
level control, maintain RCS pressure control, and maintain a containment
closure capability.

This generic tool could not include plant specific mitigating features
because they vary between licensees and outages. Therefore, the analyst
has to consider the licensee's outage-specific mitigation capability.

Since the template was developed based on maintaining key shutdown
safety functions, this template does not provide any information on
frontline system dependencies. The analyst is to refer to the
system-dependency table provided in the at-power Notebooks. The analyst
has to consider additional dependencies for additional systems/functions
not needed at full power (e.g., AC power for containment closure). The
analyst also has to consider whether a support system is needed for the
frontline system at shutdown. For example, CCW may not be required for
high pressure injection pump bearing and motor cooling if the pump is
pumping cool water (\< 120F).

3.0 CHARACTERIZATION OF SHUTDOWN
OPERATIONS[]{#__RefHeading___Toc193076259 .anchor}

The risk significance of an inspection finding at shutdown depends on
the plant configuration. To account for the plant's changing
configuration and decay heat level during shutdown, this PRA model
parses an outage into plant operational states (POSs) and time windows
(TWs). The plant response to the a loss or interruptions of RHR is
assumed to remain constant during a given POS. Time Windows are used to
separate POSs occurring early in the outage when decay heat is high to
POSs occurring late in the outage when decay heat is low.

For this template, Figure 1 defines the POSs and time windows for a PWR
plant. It also shows the relationship between the POSs and the modes
defined in the Technical Specifications (TSs). We now describe the POSs
and Time Windows (TWs).

POS 1 - This POS starts when the RHR system is put into service. The RCS
is closed such that the steam generators could be used for decay heat
removal, if the secondary side of a steam generator is filled. The RCS
may have a bubble in the pressurizer. This POS ends when the RCS is
vented such that the steam generators cannot sustain core head removal.
This POS typically includes Mode 4 (hot shutdown) and portions of Mode 5
(cold shutdown).

POS 2 - This POS starts when the RCS is vented such that: (1) the steam
generators cannot sustain core heat removal and (2) a sufficient vent
path exists for feed and bleed. This POS includes portions of Mode 5
(cold shutdown) and Mode 6 (refueling). Reduced inventory conditions and
midloop operations with a vented RCS are subsets of this POS.

> Note: Performance deficiencies occurring during a vacuum refill of the
> RCS require use of the POS 1 event trees.

POS 3 - This POS represents the shutdown condition when the refueling
cavity water level is at or above the minimum level required for
movement of irradiated fuel assemblies within containment as defined by
Technical Specifications. This POS occurs during Mode 6.

Early Time Window (TW-E) - This time widow represents the time before
POS 3 is entered. The decay heat is relatively high. The reactor is
either in POS 1 or 2.

Late Time Window (TW-L) - This time window represents the time after POS
group 3. The decay heat is relatively low. The reactor is either in POS
1, 2, or 3

The above definitions of the POSs and Time Windows can be used to
address different types of plant shutdowns, i.e., refueling outage,
planned maintenance outage, and an unplanned outage. Depending on the
type of outage and its duration, the POSs and TWs can be identified from
the above list. For example, all POSs and both TWs will apply to a
refueling outage. Only POS 1 and the early Time Window (TW-E) may apply
to an unplanned outage.

NOTE: The operator credits in the SDP worksheets are given for Time
Window Early (TW-E). The same worksheets can be used for Time Window L
(TW-L) except the credits for operator response may need to be changed
to account for the longer operator's response time. Detailed
instructions are given in Chapter 6.0 of this template

4.0 SHUTDOWN INITIATING EVENTS[]{#__RefHeading___Toc193076260 .anchor}

An initiating event at shutdown is defined as an event that causes a
loss or interruption of the decay heat removal function. This template
considers the four internal initiators known to dominate the
internal-event shutdown risk based on the Surry Shutdown PRA (NUREG/CR
6144).

The following are the initiating events considered, with their
applicability to the POS groups.

Loss of RHR (LORHR) - This initiating event category includes losses of
RHR resulting from failures of the RHR system (such as RHR pump failure)
or failures of the RHR support systems such as loss of CCW, loss of SRW,
loss of vital AC, and loss of DC power. (Loss of offsite power is
treated as a separate category.) This category also includes
interruptions of RHR caused by spurious ESFAS signals such as RHR
suction valve closure. This initiating event category is considered for
POS 1 and POS 2 . This category is not considered necessary to POS 3,
since the time to core uncovery is assumed to be greater than 24 hours.

Loss of Offsite Power (LOOP) - This initiating event category covers
losses of offsite power at shutdown which cause an interruption in DHR.
This initiator category is considered for all POSs. For POS 3, if a LOOP
or SBO could cause a loss of the refueling cavity seal to due a loss of
support systems, then this issue is evaluated by using the POS 2 LOOP
worksheets.

Loss of Reactor Inventory (LOI) - This initiating event category
includes losses of RCS inventory that lead to a loss of RHR due to loss
of RHR pump suction. Many of these flow diversions are caused from
improper alignment of valves. This initiator category is considered for
all POSs.

Loss of Level Control (LOLC) - This initiating event category includes:
(1) the operator overdrains the RCS to reach midloop conditions such
that the RHR function is lost, and (2) the operator fails to maintain
level control and/or RHR flow control while in midloop such that the RHR
function is lost. This initiator is considered for midloop operations
only.

Other initiators that merit consideration include those events that
challenge low-temperature over pressure protection (LTOP), and findings
that increase the likelihood of a reactivity transient. In Surry
Shutdown PRA (NUREG/CR 6144), these two initiators were found to make a
smaller contribution to the core damage frequency than the four
initiators discussed above. For some inspection findings, their
contribution may become significant. Therefore, they will go directly to
Headquarters for Phase 3 analysis.

5.0 SHUTDOWN INITIATING EVENT FREQUENCIES[]{#__RefHeading___Toc193076261
.anchor}

Initiating event frequencies were estimated by searching LERs from 1992
to 1998[^2] and the totaling the number of refueling hours.

**Table 5 - Initiating Event Likelihoods (IELs) for Condition Findings -
PWRs**

  --------- --------------- ---------------------- ------------- ---------- --------
  **Row**   **Approximate   **Example Event Type** **IEL**                  
            Conditional                                                     
            Frequency**                                                     

  **I**     \> 1 per 1-10   Loss of offsite power  **1**         **2**      **3**
            yr              (LOOP), Loss of RHR                             
                            (LORHR)                                         

  **II**    1 per 10-10 ^2^ Loss of Inventory      **2**         **3**      **4**
            yr              (LOI)                                           

  **III**   1 per 10-10^2^  Loss of Level Control  **2**         **2**      **2**
            yr              (LOLC)[^3]                                      

                                                   **\> 30       **3-30     **\< 3
                                                   days**        days**     days**

                                                   **Exposure               
                                                   Time for                 
                                                   Degraded                 
                                                   Condition**              
  --------- --------------- ---------------------- ------------- ---------- --------

LOLC is only applicable to POS group II.

LORHR and LOI are not applicable to POS group III.

6.0 EVENT TREE MODELS[]{#__RefHeading___Toc193076262 .anchor}

6.1 Overview[]{#__RefHeading___Toc193076263 .anchor}

For each event tree, there is an associated worksheet that defines each
top event function in the event tree by:

-   Top Event Function - A key safety function that is necessary to
    restore core cooling given a loss or interruption of the RHR
    function (e.g. the operator initiates RCS injection before core
    damage).

-   Success Criteria - The minimum set of equipment that can be used to
    fulfill the top event function.

-   Instrumentation - The minimum set of instrumentation needed by the
    operator to fulfill the top event function.

-   Equipment Credit - The credit given to the top event function by the
    analyst based on all available systems able to fulfill the top event
    function. The equipment credit used in the worksheets are similar to
    the equipment credits used in the full power SDP worksheets.
    Temporary equipment credit is obtained using Table 6.

-   Operator Credit - The credit given for the operator to perform the
    corresponding top event function. The default operator credit for
    performing the top event assumes that: (1) the success criteria for
    the top event function has been met, and (2) the minimum set of
    instrumentation needed by the operator is available and providing
    reliable indication. Operator Credits were developed using the
    SPAR-H methodology developed by INEL (ADAMS Accession number
    ML031540084)

> NOTE: The analyst must adjust the default operator credits in the
> worksheets if:

-   If the referenced instrumentation if missing or misleading, then the
    operator credit is decreased by two or becomes zero if the operator
    credit becomes negative.

> Referring to the SPAR-H LP&SD worksheets, the PSF level for stress is
> now considered to be high, and the PSF level for ergonomics is now
> considered missing/misleading. Using the SPAR-H LP&SD worksheets, this
> condition results in an HEP multiplier of 100.

-   The default time is incorrect and significantly reduced. If the
    diagnoses time is less than 20 minutes, OR the time to perform the
    action is approximately the time required, then decrease the
    operator credit by one or becomes zero if the operator credit
    becomes negative.

> Referring to the SPAR-H LP&SD worksheets, the PSF level for available
> time for diagnoses becomes barely adequate and has a multiplier of 10.
> The PSF level for available time for the action portion of the task
> has a PSF multiplier of 10.

-   If the action is complicated by missing equipment, unaccessible
    equipment, steam or high radiation, or Loop seals for pump venting,
    then the operator credit is decreased by two or becomes zero if the
    operator credit becomes negative.

> Referring to the SPAR-H LP&SD worksheets, the PSF level for stress is
> now considered to be high, and the PSF level for ergonomics is now
> considered to be missing/misleading. Using the SPAR-H worksheets, this
> results in an HEP multiplier of 100.

-   If the procedure are not complete for the shutdown plant
    configuration, then the operator credit is decreased by one or
    becomes zero if the operator credit becomes negative.

> Referring to the SPAR-H LP&SD worksheets, the PSF level for procedures
> is considered as incomplete. The HEP multiplier was assigned a factor
> of 20.

-   Function Credit - The lower of [Equipment Credit]{.underline} and
    [Operator Credit.]{.underline}

6.2 Event Tree Success Criteria[]{#__RefHeading___Toc193076264 .anchor}

The Success Criteria for the PWR Shutdown Template is based on the Byron
Units 1 and 2 LP&SD success criteria shown in referenced 1. As shown,

+-------------+------------+-------------+-------------+-------------+
| Initiator:  | 13 MW      | 10 MW       | 7 MW        | 5 MW        |
| LOOP,       |            |             |             |             |
| LORHR, LOI, | (2 days)   | (5 days)    | (12 days)   | (32 days)   |
|             |            |             |             |             |
| LOLC        |            |             |             |             |
+-------------+------------+-------------+-------------+-------------+
| FEED        | 1 of 2 LPI | 1 of 2 LPI  | 1 of 2 LPI  | 1 of 2 LPI  |
|             |            |             |             |             |
|             | OR         | OR          | OR          | OR          |
|             |            |             |             |             |
|             | 1 of 2     | 1 of 2 HPSI | 1 of 2 HPSI | 1 of 2 HPSI |
|             | HPSI OR    |             |             |             |
|             |            | OR          | OR          | OR          |
|             | 1 of 2     |             |             |             |
|             | CVCS       | 1 of 2 CVCS | 1 of 2 CVCS | 1 of 2 CVCS |
+-------------+------------+-------------+-------------+-------------+
| RHR-R       | Operator   | Operator to | Operator to | Operator to |
|             | to recover | recover 1   | recover 1   | recover 1   |
|             | 1 of 2 RHR | of 2 RHR    | of 2 RHR    | of 2 RHR    |
|             | trains     | trains      | trains      | trains      |
+-------------+------------+-------------+-------------+-------------+
| Reflux      | 2 SG       | 1 SG        | 1 SG        | 1 SG        |
| Cooling     | (available | (available  | (available  | (available  |
|             | short-term | short-term  | short-term  | short-term  |
| (SG)        | cooling).  | cooling).   | cooling).   | cooling).   |
|             | Makeup FW  | Makeup FW   | Makeup FW   | Makeup FW   |
|             | to 2 SG    | to 1 SG     | to 1 SG     | to 1 SG     |
|             | (long      | (long term) | (long term) | (long term) |
|             | term)      |             |             |             |
+-------------+------------+-------------+-------------+-------------+
| BLEED       | 1PORV or   | 1PORV or    | 1PORV or    | 1PORV or    |
|             | safety     | safety      | safety      | safety      |
|             | valve      | valve       | valve       | valve       |
|             | removed or | removed or  | removed or  | removed or  |
|             | RCS        | RCS opening | RCS opening | RCS opening |
|             | opening of | of          | of          | of          |
|             | equivalent | equivalent  | equivalent  | equivalent  |
|             | size       | size        | size        | size        |
+-------------+------------+-------------+-------------+-------------+
| Gravity     | 1 SV       | 1 SV        | 1 SV        | 1 SV        |
| Feed        | removed    | removed and | removed and | removed and |
|             | and LPI    | LPI flow    | LPI flow    | LPI flow    |
|             | flow path  | path        | path        | path        |
|             | (provides  | (provides   | (provides   | (provides   |
|             | 4.3 hours  | 6.5 hrs for | 12 hrs for  | 24 hrs for  |
|             | for        | operator    | operator    | operator    |
|             | operator   | actions)    | actions)    | actions)    |
|             | actions)   |             |             |             |
+-------------+------------+-------------+-------------+-------------+

6.3 General Description/Philosophy for Event
Trees[]{#__RefHeading___Toc193076265 .anchor}

6.3.1 LOLC Event Trees

> The LOLC event trees is defined as (1) the operator overdrains the RCS
> to reach midloop conditions such that the RHR function is lost, and
> (2) the operator fails to maintain level control and/or RHR flow
> control while in midloop such that the RHR function is lost. The LOLC
> does not require termination of the RCS leak path since it is assume
> to terminate without operation action at the bottom of the hot leg. If
> the event occurs in POS 1, then secondary reflux cooling can be used.
> Successful RCS injection is required to restore RCS level such that
> RHR can be recovered and provide for core cooling if SG cooling is not
> available. Failure to recover RHR before RWST depletion is assumed to
> fail recirculation from the sump since the RHR pumps are assumed to
> also perform the recirculation function. Recovery of RHR does not
> guarantee available recirculation since the sump may be unavailable
> due to trash.

6.3.2 LOI Event Trees

> The LOI event trees evaluate losses of RCS inventory that lead to a
> loss of RHR due to loss of RHR pump suction that do not involve a loss
> of level control at midloop (LOLC events). Many of these flow
> diversions are caused from improper alignment of valves. This
> initiator category is considered for all POSs. In POS 1, since the RCS
> may be pressurized, a LOI may lead to losses of inventory below the
> hotleg due to RCS de-pressurization. In POS 2, LOI events do not
> require termination of the RCS leak path since it is assume to
> terminate without operation action at the bottom of the hot leg. If
> the event occurs in POS 1, then secondary reflux cooling can be used
> as long as the core is covered. Successful RCS injection is required
> to restore RCS level such that RHR can be recovered. Failure to
> recover RHR before RWST depletion is assumed to fail recirculation
> from the sump since the RHR pumps are assumed to also perform the
> recirculation function. Recovery of RHR does not guarantee available
> recirculation since the sump may be unavailable due to trash.

6.3.3 LORHR Event Trees

> The LORHR event trees evaluate losses of the operating train of RHR
> that result from failures of the RHR system itself or from failures of
> the RHR support systems. These failures could also cause failure of
> the standby RHR system. The analyst is asked to consider whether RHR
> can be recovered prior to boiling to account for the possibility of
> voids being swept into the RHR pumps, necessitating that the RHR pumps
> be vented. Failure to recover RHR before RWST depletion is assumed to
> fail recirculation from the sump since the RHR pumps are assumed to
> also perform the recirculation function. Recovery of RHR does not
> guarantee available recirculation since the sump may be unavailable
> due to trash.

6.3.4 LOOP Event Trees

> The LOOP event trees evaluate loss of offsite power that result in a
> loss or interruption of the operating train of RHR. For POS 1, reflux
> cooling is considered if sufficient inventory exist until offsite
> power is recovered. For POS 2, gravity feed may be recited if gravity
> feed is expected to be available after RCS boiling initiates. To
> credit gravity feed, the licensee should have considered:

-   pressure drops in the surge line

-   entrained water accumulating in the pressurizer

-   RCS vent paths that are restricted (to control loose parts or
    control off gassing)

7.0 HUMAN ERROR PROBABILITIES[]{#__RefHeading___Toc193076266 .anchor}

7.1 Basis for HEPs used in the IEL Tables[]{#__RefHeading___Toc193076267
.anchor}

> If a licensee has a finding that increases the likelihood of a loss of
> RHR, IEL tables were created to estimate the new conditional
> likelihood that a loss of RHR will occur due to the performance
> deficiency given the occurrence of the performance deficiency and/or
> condition.
>
> The following HEP tables were used in the PWR Shutdown template. The
> tables for LOI, LORHR, and LOLC are constructed suing the same format.
> The first column is used to estimate the time to loss of the RHR
> function from the specific initiating event . The second column
> determines the availability of key instrumentation that would help the
> operator to: (1) diagnose that a potential problem exists with
> maintaining the RHR function and (2) diagnose how to recover from the
> potential problem such that an interruption or loss of the RHR
> function is prevented.
>
> From the first column, the time to loss of the RHR function was then
> divided by two to determine how long the operator had to (1) diagnose
> the specific action needed to prevent RHR from being interrupted and
> (2) perform the specific action needed to prevent RHR from being
> interrupted. (The factor of two was used to keep this phase 2 model
> simple.) The third and fourth columns ask if (1) the specific action
> to recover RHR can be identified within ½ time to loss of the RHR
> function and (2) if action to recover RHR can be performed within ½
> time to loss of the RHR function.
>
> It was assumed that failure of the operator to diagnose the tasks
> needed to be performed to prevent a loss of the RHR function would
> dominate the IEL rather than failure of the operator to perform the
> necessary physical manipulations of the task.
>
> The IELs corresponding to ½ time to loss of the RHR function come from
> "Nominal Model of estimated HEPs and EFs within time for diagnosis
> within time T by control room personnel of an abnormal event
> annunciated closely in time." Table 12-4, in NUREG/CR 1278. The median
> joint HEP curve was used assuming the operator had key instrumentation
> referenced in the IEL tables.
>
> If the licensee did not have the key instrumentation referenced in the
> IEL tables, then the IEL was assessed a multiplier of 100 based on the
> SPAR-H methodology. Referring to the LP&SD SPAR-H worksheets, if the
> licensee has missing/misleading instrumentation, the PSF multiplier is
> assessed as 50. This loss of instrumentation will result in the task
> complexity changing from nominal to moderately complex, resulting in
> an additional multiplier of 2.

7.2 Basis for HEPs used in the Worksheets[]{#__RefHeading___Toc193076268
.anchor}

> SPAR-H methodology developed by INEL was used to derive the HEPs for
> the worksheets (ADAMS accession number ML031540084). Since every
> interruption of RHR requires a successful operator response to prevent
> core damage, operator error is a key contributor to shutdown risk.
> Operator error appears in almost every top event/mitigation path in
> the shutdown event trees.
>
> The SPAR-H LP&SD worksheets were used to develop a diagnosis
> probability. for each safety function that has an operator credit.
> Using the SPAR-H method given a similar set of PSFs, the diagnosis
> probability dominates the action probability. Therefore, to simplify
> the model for phase 2 analysis , the diagnosis probability defines the
> operator credits used in the worksheets. The first safety function
> does not include dependence in the operator credit estimate. The
> second and succeeding safety functions include an estimate of
> dependence.
>
> The inferred definition of diagnosis is any cognitive decision making
> that is necessary to perform a task. This definition includes all
> cognitive tasks ranging from responding to annunciators to recognizing
> what is necessary to recover a failed RHR system. The inferred
> definition of action is any manipulation is involved in performing the
> task.
>
> The analyst must recognize that the impact of various PSFs may overlap
> each other. For example, if the procedures are poor, the time
> available to perform an action may be decreased if the operator is
> following the procedures step-by-step.
>
> In the following sections, each default operator credit referenced in
> the worksheets is derived in the following sections using the SPAR-H
> methodology.
>
> Referring to the SPAR-H LP&SD worksheets, for each operator credit,
> the available time was evaluated. This is defined the time that the
> action must be completed (often in terms of several hours) minus the
> time it takes to perform the action (often in terms of minutes) plus
> the time it takes to receive the first cue. The definitions for
> nominal time, extra time, and expansive time are given in the
> worksheets.

7.2.1 HEPs for the POS 1 and POS 2 LOLC Worksheets

LOLC POS 1 Worksheet

SG Cooling (SG): Operator acknowledges a loss of RHR function and
maintains SG cooling by: (1) maintaining adequate level for 24 hours and
(2) venting steam from SGs and (3) keeping the RCS closed. It is assumed
that the operators have CETs and SG level and pressure indication. It is
also assumed that the operator have procedures which are supported by
analysis for shutdown conditions. Using the SPAR-H LP&SD diagnosis
worksheets, the PSF level for time is considered expansive. The
experience/training in these procedures is considered to be low for
shutdown conditions when the RCS may not be full.. All other PSF levels
are considered nominal. The default operator credit is assumed to be
1E-3.

FEED&BLEED: Operator initiates RCS injection and RCS bleed before core
damage. It is assumed that the operator has RCS level indication and
CETs with a CET hi alarm setpoint. It is assumed that the operator have
procedures for this action as recommended by NUMARC 91-06.

> Time is to core damage is assumed to occur after 3 hours. The time to
> manually initiate injection is assumed to take minutes to perform.
> Rising CET values and the CET hi alarm would be received well before
> RCS boiling. Therefore, using the SPAR-H LP&SD worksheets, the PSF
> level for time is considered to be expansive. All other PSF levels are
> considered nominal, since FEED &BLEED is a common recovery procedure
> for an extended loss of RHR and is performed similar to the full power
> procedures. The default operator credit is estimated to be 1E-4.
>
> Considering dependence, if the operator failed to maintain SG cooling,
> the PORVs and/or the RHR relief valves would lift providing the
> operator additional cues that RHR cooling is interrupted. The actions
> to initiate FEED&BLEED would be performed by the same crew, but not
> close in time. Thus, the dependency between the two actions was
> determined to be low. Using the SPAR-H worksheets, the task failure
> with dependence was estimated as 5E-2. Since the SDP uses operator
> credits in multiplies of ten, the revised operator default credit is
> 2.

RHR-R: Given a loss of RHR due to loss of level/flow control, the
operator can recover one of two operable trains of RHR before RWST
depletion. It was assumed that the operators had at least 10 hours to
repair/recover one operable train of RHR before RWST depletion based on
a full RWST. The operator may need to fill the RCS and vent the RHR
pumps. As recommended in GL 88-17, the licensees should have procedures
for this recovery action. Using the SPAR-H LP&SD worksheets, the PSF
level for time was considered extra not expansive since action outside
the control is required. All other PSF levels were considered nominal.
The default operator credit was estimated as 1E-3.

RWSTMU: It was assumed that the licensee could makeup to the RWST if
long term RHR recovery failed. The time to perform this action was
considered expansive. It was assumed that the licensee has procedures
for this action, and the operator has RWST level indication with a low
level alarm. Using the SPAR-H LP&SD worksheets, the PSF level for time
is considered expansive. The stress was assumed to be high and the
complexity was assumed to be high, the operators would be simultaneously
trying to recover RHR. All other PSF levels were assumed to be nominal.
The default HEP was estimated as 1E-3.

> Considering dependence with RHR-R, an additional shift would be
> available due to the long time duration. The timing of both actions is
> simultaneous but not close in time. The operators would receive the
> additional cue of the RWST level alarm Thus, the dependency between
> the two actions was believed to be low. Using the SPAR-H worksheets,
> the task failure with dependence was estimated as 5E-2. Since the SDP
> uses operator credits in multiplies of ten, the revised operator
> default credit is 2.

LOLC POS 2 WORKSHEET

FEED: Operator initiates RCS injection before core damage. It is assumed
that the operator has RCS level indication and CETs. It is assumed that
the operator have procedures for this action as recommended by NUMARC
91-06.

> Core damage is assumed to occur after 3 hours without FEED. The time
> to manually initiate injection is assumed to take minutes to perform.
> Rising CET values and the CET hi alarm would be received well before
> RCS boiling. Also, since the RCS is open, steam would be an additional
> visual cue. Therefore, using the SPAR-H LP&SD worksheets, the PSF
> level for time is considered to be expansive. All other PSF levels are
> considered nominal, since FEED is a common recovery procedure for an
> extended loss of RHR and is performed similar to the full power
> procedures. The default operator credit is estimated to be 1E-4.

RHR-R: Given a loss of RHR due to loss of level/flow control, the
operator can recover one of two operable trains of RHR before RWST
depletion. It was assumed that the operators had at least 10 hours to
repair/recover one operable train of RHR before RWST depletion based on
a full RWST. The operator may need to fill the RCS and vent the RHR
pumps. As recommended in GL 88-17, the licensees should have procedures
for this recovery action. Using the SPAR-H LP&SD worksheets, the PSF
level for time was considered extra not expansive since operator action
outside the control room is required.. All other PSF levels were
considered nominal. The default operator credit was estimated as 1E-3.

RWSTMU: It was assumed that the licensee could makeup to the RWST if
long term RHR recovery failed. The time to perform this action was
considered expansive. It was assumed that the licensee has procedures
for this action, and the operator has RWST level indication with a low
level alarm. Using the SPAR-H LP&SD worksheets, the PSF level for time
is considered expansive. The stress was assumed to be high and the
complexity was assumed to be high, the operators would be simultaneously
trying to recover RHR. All other PSF levels were assumed to be nominal.
The default HEP was estimated as 1E-3.

> Considering dependence with RHR-R, an additional shift would be
> available due to the long time duration. The timing of both actions is
> simultaneous but not close in time. The operators would receive the
> additional cue of a low RWST level alarm. Thus, the dependency between
> the two actions was believed to be low. Using the SPAR-H worksheets,
> the task failure with dependence was estimated as 5E-2. Since the SDP
> uses operator credits in multiplies of ten, the revised operator
> default credit is 2.

7.2.2 HEPs for the POS 1 and POS 2 LOOP Worksheets

SGSBO: Operator acknowledges a LOOP and maintains SG cooling by: (1)
maintaining adequate SG level for 24 hours and (2) venting steam from
SGs and (3) keeping the RCS closed. It is assumed that the operators
have CETs and SG level and pressure indication. It is also assumed that
the operator have procedures which are supported by analysis for
shutdown conditions. Using the SPAR-H LP&SD diagnosis worksheets, the
PSF level for time is considered expansive. The experience/training in
these procedures is considered to be low. All other PSF levels are
considered nominal. The default operator credit is assumed to be 1E-3.

GRAVITY: Operator initiates Gravity Feed assuming SBO before core
damage. Requires an available flow path, procedures, and supporting
analyses.

> Gravity feeding to the RCS may be credited if Gravity Feed is expected
> to be available AFTER RCS boiling initiates. To credit Gravity Feed,
> the analyst needs to consider the following factors that can negate
> the elevation head provided by the RWST or other sources of RCS
> inventory: (1) pressure drops in the surge line (2) entrained water
> accumulating in the pressurizer (3) RCS vent paths that are restricted
> (to control loose parts or control off gassing).
>
> Using the SPAR-H LP&SD diagnosis worksheets, the PSF level for time is
> considered expansive. The experience/training in these procedures is
> considered to be low. All other PSF levels are considered nominal. The
> default operator credit is assumed to be 1E-3.

7.2.3 HEPs for the POS 1 and POS 2 LOI Worksheets

LOI POS 1 Worksheet

FEED: Operator acknowledges a loss of inventory and initiates RCS
injection before core damage. It is assumed that the operator has RCS
level indication and CETs. It is assumed that the operator have
procedures for this action as recommended by NUMARC 91-06. Using the
SPAR-H LP&SD worksheets, the PSF level for time is considered
exapansive. All other PSF levels are considered nominal, since FEED is a
common recovery procedure for any type of loss of RCS inventory and is
similar response to the full power procedures. The default operator
credit is estimated to be four.

LEAK-STOP: Operator isolates leak before RWST depletion given successful
FEED. Using the SPAR-H LP&SD worksheets, the PSF level for available
time is considered to be expansive. However, the diagnoses on the
operator's part to locate the source of the leak and isolate is
considered to be highly complex and high stress. All other PSFs were
considered to be nominal. The default operator credit was estimated as
three (1E-3). The time assumption assumes that the leak does not impact
the availability of the standby injection pumps (e.g. Wolf Creek
draindown event in 1994).

LEAK-STOP2: The operator isolates the leak before core uncovery at which
point the SG cooling is no longer considered to prevent core damage
given unsuccessful FEED.

> Using the SPAR-H LP&SD worksheets, the PSF level for time is
> considered to be extra not expansive. The diagnoses on the operator's
> part to locate the source of the leak and isolate is considered to be
> highly complex and high stress. All other PSFs were considered to be
> nominal. Thus, the default failure probability was estimated as 1E-2.
> Considering dependence, both the FEED task and the LEAK-STOP task
> occur using the same crew and an not close in time. However,
> additional cues would be provided to the operator indicating the
> location of an LOI such as sump level alarms, tank level alarms,
> visible flooding , etc. The dependency was believed to be low. The
> revised operator credit considering dependence was estimated as 2
> (.01)

SG Cooling (SG): Operator successfully isolates the leak before core
uncovery and maintains SG cooling by: (1) maintaining adequate level for
24 hours and (2) venting steam from SGs and (3) keeping the RCS closed.
It is assumed that the operators have CETs and SG level and pressure
indication. It is also assumed that the operator have procedures which
are supported by analysis for shutdown conditions. Using the SPAR-H
LP&SD diagnosis worksheets, the PSF level for time is considered
expansive. The experience/training in these procedures is considered to
be low. All other PSF levels are considered nominal. The default
operator credit is assumed to be 1E-3.

BLEED: The operator opens a PORV or vent path large enough to remove
decay heat by FEED&BLEED. This tasks assumes that the operators already
have successfully isolated the leak and started RCS injection. It is
assumed that the operator have procedures for FEED&BLEED as recommended
by NUMARC 91-06. Using the SPAR-H LP&SD worksheets, the PSF level for
time is considered expansive. All other PSF levels are considered
nominal, since FEED&BLEED PORV is a common recovery procedure an
extended loss of RHR. The default operator credit is estimated to be
four.

RHR-R: Given a loss of RHR function due to an LOI, the operator can
recover one of two operable trains of RHR before RWST depletion. It was
assumed that the operators had at least 10 hours to repair/recover one
operable train of RHR before RWST depletion based on a full RWST. The
operator may need to fill the RCS and vent the RHR pumps. As recommended
in GL 88-17, the licensees should have procedures for this recovery
action. Using the SPAR-H LP&SD worksheets, the PSF level for time was
considered extra not expansive. All other PSF levels were considered
nominal. The default operator credit was estimated as 1E-3.

RWSTMU: It was assumed that the licensee could makeup to the RWST if
long term RHR recovery failed. The time to perform this action was
considered expansive. It was assumed that the licensee has procedures
for this action, and the operator has RWST level indication with a low
level alarm. Using the SPAR-H LP&SD worksheets, the PSF level for time
is considered expansive. The stress was assumed to be high and the
complexity was assumed to be high, the operators would be simultaneously
trying to recover RHR. All other PSF levels were assumed to be nominal.
The default HEP was estimated as 1E-3.

> Considering dependence with RHR-R, an additional shift would be
> available due to the long time duration. The timing of both actions is
> simultaneous but the close in time. The operators would receive the
> additional cue of a low RWST level RWST alarm. Thus, the dependency
> between the two actions was believed to be low. Using the SPAR-H
> worksheets, the task failure with dependence was estimated as 5E-2.
> Since the SDP uses operator credits in multiplies of ten, the revised
> operator default credit is 2.

LOI POS 2 Worksheet

FEED: Operator initiates RCS injection before core damage. It is assumed
that the operator has RCS level indication and CETs. It is assumed that
the operator have procedures for this action as recommended by NUMARC
91-06.

> Core damage is assumed to occur after 3 hours without FEED. The time
> to manually initiate injection is assumed to take minutes to perform.
> Rising CET values and the CET hi alarm would be received well before
> RCS boiling. Also, since the RCS is open, steam would be an additional
> visual cue. Therefore, using the SPAR-H LP&SD worksheets, the PSF
> level for time is considered to be expansive. All other PSF levels are
> considered nominal, since FEED is a common recovery procedure for an
> extended loss of RHR and is performed similar to the full power
> procedures. The default operator credit is estimated to be 1E-4.

RHR-R: Given a loss of RHR due to loss of level/flow control, the
operator can recover one of two operable trains of RHR before RWST
depletion. It was assumed that the operators had at least 10 hours to
repair/recover one operable train of RHR before RWST depletion based on
a full RWST. The operator may need to fill the RCS and vent the RHR
pumps. As recommended in GL 88-17, the licensees should have procedures
for this recovery action. Using the SPAR-H LP&SD worksheets, the PSF
level for time was considered extra not expansive since operator action
outside the control room is required.. All other PSF levels were
considered nominal. The default operator credit was estimated as 1E-3.

RWSTMU: It was assumed that the licensee could makeup to the RWST if
long term RHR recovery failed. The time to perform this action was
considered expansive. It was assumed that the licensee has procedures
for this action, and the operator has RWST level indication with a low
level alarm. Using the SPAR-H LP&SD worksheets, the PSF level for time
is considered expansive. The stress was assumed to be high and the
complexity was assumed to be high, the operators would be simultaneously
trying to recover RHR. All other PSF levels were assumed to be nominal.
The default HEP was estimated as 1E-3.

> Considering dependence with RHR-R, an additional shift would be
> available due to the long time duration. The timing of both actions is
> simultaneous but the close in time. The operators would receive the
> additional cue of a RWST low level alarm. Thus, the dependency between
> the two actions was believed to be low. Using the SPAR-H worksheets,
> the task failure with dependence was estimated as 5E-2, Since the SDP
> uses operator credits in multiplies of ten, the revised operator
> default credit is 2.

7.2.4 HEPs for the POS 1 and POS 2 LORHR Worksheets

LORHR POS 1 Worksheet

RHR-S: The operators ability to quickly recover the alternate train of
RHR from the control room before boiling given a loss or interruption of
the operating train of RHR. Using the operator response curves in NUREG
1278 Table 12-4, it was assumed if RHR recovery action can be identified
within ½ TBB AND

RHR recovery action can be performed within ½ TBB.

AND

Trouble alarms are available.

THEN CREDIT = 0 if TBB \< 20 minutes

CREDIT = 1 if 20 minutes \< TBB \< 40 minutes

CREDIT = 2 if 40 min. \< TBB \< 1hour

CREDIT = 3 if TBB \> 1 hour.

SG Cooling (SG): Operator acknowledges a loss of RHR function and
maintains SG cooling by: (1) maintaining adequate level for 24 hours and
(2) venting steam from SGs and (3) keeping the RCS closed. It is assumed
that the operators have CETs and SG level and pressure indication. It is
also assumed that the operator have procedures which are supported by
analysis for shutdown conditions. Using the SPAR-H LP&SD diagnosis
worksheets, the PSF level for time is considered expansive. The
experience/training in these procedures is considered to be low. All
other PSF levels are considered nominal. The default operator credit is
assumed to be 1E-3.

FEED&BLEED: Operator initiates RCS injection and RCS bleed before core
damage. It is assumed that the operator has RCS level indication and
CETs. It is assumed that the operator have procedures for this action as
recommended by NUMARC 91-06. Using the SPAR-H LP&SD worksheets, the PSF
level for time is considered exapansive. All other PSF levels are
considered nominal, since FEED &BLEED is a common recovery procedure for
an extended loss of RHR and is similar to the full power procedures. The
default operator credit is estimated to be 1E-4.

> Considering dependence, if the operator failed to maintain SG cooling,
> the PORVs and/or the RHR relief valves would lift providing the
> operator additional cues the RHR cooling is interrupted. The actions
> would be performed by the same crew, but not close in time. Thus, the
> dependency between the two actions was believed to be low. Using the
> SPAR-H worksheets, the task failure with dependence was estimated as
> 5E-2. Since the SDP uses operator credits in multiplies of ten, the
> revised operator default credit is 2.

RHR-R: Given that RHR could not be recovered before boiling, the
operators can recover/repair one of two operable trains of RHR before
RWST depletion. It was assumed that the operators had at least 10 hours
to repair/recover one operable train of RHR before RWST depletion based
on a full RWST. The level of diagnoses to recover/repair the RHR system
is considered to be highly complex and high stress. The PSF level for
time is considered extra not expansive since operator action outside the
control room is necessary. All other PSFs were considered to be nominal.
Using the SPAR-H LP&SD worksheets, the default HEP was estimated as
1E-2.

RWSTMU: It was assumed that the licensee could makeup to the RWST if
long term RHR recovery failed. The time to perform this action was
considered expansive. It was assumed that the licensee has procedures
for this action, and the operator has RWST level indication with a low
level alarm. Using the SPAR-H LP&SD worksheets, the PSF level for time
is considered expansive. The stress was assumed to be high and the
complexity was assumed to be high, the operators would be simultaneously
trying to recover RHR. All other PSF levels were assumed to be nominal.
The default HEP was estimated as 1E-3.

> Considering dependence with RHR-R, an additional shift would be
> available due to the long time duration. The timing of both actions is
> simultaneous but the not close in time. The operators would receive
> the additional cue of a RWST low level alarm. Thus, the dependency
> between the two actions was believed to be low. Using the SPAR-H
> worksheets, the task failure with dependence was estimated as 5E-2.
> Since the SDP uses operator credits in multiplies of ten, the revised
> operator default credit is 2.

LORHR POS 2 Worksheet

RHR-S: The operators ability to quickly recover the alternate train of
RHR from the control room before boiling given a loss or interruption of
the operating train of RHR. Using the operator response curves in NUREG
1278 Table 12-4, it was assumed if RHR recovery action can be identified
within ½ TBB AND

RHR recovery action can be performed within ½ TBB.

AND

Trouble alarms are available.

THEN CREDIT = 0 if TBB \< 20 minutes

CREDIT = 1 if 10 min. \< TBB \< 30 minutes

CREDIT = 2 if 30 min. \< TBB \< 1hour

CREDIT = 3 if TBB \> 1 hour

FEED: Operator initiates RCS injection before core damage. It is assumed
that the operator has RCS level indication and CETs. It is assumed that
the operator have procedures for this action as recommended by NUMARC
91-06.

> Core damage is assumed to occur after 3 hours without FEED. The time
> to manually initiate injection is assumed to take minutes to perform.
> Rising CET values and the CET hi alarm would be received well before
> RCS boiling. Also, since the RCS is open, steam would be an additional
> visual cue. Therefore, using the SPAR-H LP&SD worksheets, the PSF
> level for time is considered to be expansive. All other PSF levels are
> considered nominal, since FEED is a common recovery procedure for an
> extended loss of RHR and is performed similar to the full power
> procedures. The default operator credit is estimated to be 1E-4.

RHR-R: Given that RHR could not be recovered before boiling, the
operators can recover/repair one of two operable trains of RHR before
RWST depletion. It was assumed that the operators had at least 10 hours
to repair/recover one operable train of RHR before RWST depletion based
on a full RWST. The level of diagnoses to recover/repair the RHR system
is considered to be highly complex and high stress. The PSF level for
time is considered extra not expansive since operator action outside the
control room may be required. All other PSFs were considered to be
nominal. Using the SPAR-H LP&SD worksheets, the default HEP was
estimated as 1E-2.

RWSTMU: It was assumed that the licensee could makeup to the RWST if
long term RHR recovery failed. The time to perform this action was
considered expansive. It was assumed that the licensee has procedures
for this action, and the operator has RWST level indication with a low
level alarm. Using the SPAR-H LP&SD worksheets, the PSF level for time
is considered expansive. The stress was assumed to be high and the
complexity was assumed to be high, the operators would be simultaneously
trying to recover RHR. All other PSF levels were assumed to be nominal.
The default HEP was estimated as 1E-3.

> Considering dependence with RHR-R, an additional shift would be
> available due to the long time duration. The timing of both actions is
> simultaneous but the not close in time. The operators would receive
> the additional cue of a RWST low level alarm. Thus, the dependency
> between the two actions was believed to be low. Using the SPAR-H
> worksheets, the task failure with dependence was estimated as 5E-2.
> Since the SDP uses operator credits in multiplies of ten, the revised
> operator default credit is 2.

(This page has been intentionally left blank)

[^1]: Loss of Shutdown Cooling Initiating Events Data Summary
    (1992-1998), Jim Houghton, RES , NRC Internal Report

[^2]: Loss of Shutdown Cooling Initiating Events Data Summary
    (1992-1998), Jim Houghton, RES, Internal Report

[^3]: Loss of level control failure considers two events during midloop
    operation: (1) the operator overdrains the RCS to reach midloop
    conditions such that the RHR function is lost, and (2) the operator
    fails to maintain level control and/or RHR flow control while in
    midloop such that the RHR function is lost. Loss of level control
    failure is dominated by likelihood of overdraining to reach midloop
    condition given that the licensee entered midloop conditions which
    is a demand failure and not time dependent.