POLICY ISSUE

INFORMATION

October 5, 2006 SECY-06-0208

FOR: The Commissioners

FROM: Luis A. Reyes

Executive Director for Operations

SUBJECT: STATUS OF THE ACCIDENT SEQUENCE PRECURSOR PROGRAM

AND THE DEVELOPMENT OF STANDARDIZED PLANT ANALYSIS

RISK MODELS

PURPOSE:

To inform the Commission of the status of the Accident Sequence Precursor (ASP) Program,

provide the annual quantitative ASP results, and communicate the status of the development of

the Standardized Plant Analysis Risk (SPAR) models. This paper does not address any new

commitments or resource implications. 

SUMMARY:

This report discusses the following activities, which the staff has performed since the last status

report (SECY-05-0192), dated October 24, 2005:

• completion of the analysis of the fiscal year (FY) 2004 and FY 2005 events to identify

precursors (i.e., events with a conditional core damage probability (CCDP) or increase in

core damage probability (ΔCDP) that is greater than or equal to 1×10-6)

CONTACTS: John V. Kauffman, RES/DRASP (ASP Program)

301-415-6830
The Commissioners -2-

Donald A. Dube, RES/DRASP (SPAR Model Development Program)

301-415-5472

• review of the status of the screening and analyses of events for FY 2006 to identify

significant precursors, defined as CCDP or ΔCDP that is greater than or equal to 1×10-3

• evaluation of precursor data to identify statistically significant adverse trends for the Industry

Trends Program

• implementation of process changes to further improve ASP efficiency and timeliness

• review of status and progress on SPAR model development, including activities under the

Risk Assessment Standardization Project (RASP)

• identification of SPAR model and other probabilistic risk assessment (PRA) lessons learned

during Mitigating Systems Performance Index (MSPI) development and implementation

• resolution of organizational conflict of interest concerns with the contractor (Idaho National

Laboratory) for several projects including SPAR model development

In addition, this report summarizes related upcoming activities for the next 12 months.

BACKGROUND:

In a memorandum to the Chairman dated April 24, 1992, the staff of the U.S. Nuclear

Regulatory Commission (NRC) committed to report periodically to the Commission on the

status of the ASP Program. In SECY-94-268, dated October 31, 1994, the staff made two

significant changes to the report. First, the staff committed to provide the report annually, and

second, the staff began to provide annual quantitative ASP results. The ASP Program

systematically evaluates U.S. nuclear power plant operating experience to identify, document,

and rank the operating events that were most likely to have led to inadequate core cooling and

severe core damage (precursors), accounting for the likelihood of additional failures. 

In SECY-02-141, dated March 8, 2002, the staff expanded the annual ASP SECY paper to

include detailed information on the status of the SPAR Model Development Program. The

objective of the SPAR Model Development Program is to develop standardized risk analysis

models and tools that staff analysts use in many regulatory activities. 

DISCUSSION:

This section summarizes the status, accomplishments, and results of each program since the

previous status report, SECY-05-0192, dated October 24, 2005.

Status of the ASP Program and SPAR Model Development Program
The Commissioners -3-

1 In SECY-05-0192, the staff reported a step increase in the mean occurrence rate of all precursors at about

the FY 2000 time frame. This step increase was found to be attributed to (1) an increase in scope of the

ASP Program starting in FY 2000 (e.g., inclusion of potential precursors involving fire, external events, highenergy line breaks, and internal flooding), (2) one outlier group of 11 precursors involving cracks in control

rod drive mechanism housings between FY 2001 and FY 2003, which also would be considered part of the

scope increase (i.e., classified prior to FY 2000 as impractical to analyze) and (3) a second outlier group of

18 precursors involving loss of offsite power events during the FY 2001–2005 period. The NRC has

implemented several initiatives to address these outlier events. 

The following subsections summarize the status of ongoing activities and the accomplishments

of the ASP Program and SPAR Model Development Program. Enclosure 1 to this paper

provides additional background and detail of the status of these two programs, while Enclosure

2 provides details of ASP results, trends, and insights. 

ASP Program

• In SECY-04-0210, dated November 8, 2004, the staff informed the Commission of a plan to

improve the timeliness of ASP analyses and complete the analysis of prior years’ precursor

events. We have completed the analyses of all precursor events that were identified in FY

2004 (17 precursors) and FY 2005 (15 precursors). The staff has begun the analysis of

approximately 50 events in FY 2006 that were identified as potential precursors (i.e., CCDP

or ΔCDP greater than or equal to 1×10-6).

• The staff completed the screening for FY 2006 events for significant precursors (i.e., CCDP

or ΔCDP greater than or equal to 1×10-3). The staff identified no significant precursors in

FY 2005 and FY 2006. In addition, the staff identified no statistically significant trend for

significant precursors during the FY 1996–2005 period.

• The risk contribution from all precursors as measured by the integrated ASP index was

generally constant during the period from FY 1996 through FY 2005 and has decreased

since FY 2003. 

• The staff evaluated precursor data through FY 2005 to identify statistically significant

adverse trends for the Industry Trends Program. The data for the rates of occurrence of all

precursors during the period from FY 1996 through FY 2005 were divided into two

statistically distinct groups, FY 1996–2000 and FY 2001–2005.1

 The analysis detected no

statistically significant trend for either of these 5-year periods. Enclosure 2 documents the

results of this evaluation.

• Over the more recent time period from FY 2001–2005, the analysis detected a statistically

significant decreasing trend for higher risk precursors (i.e., CCDP or ΔCDP greater than or

equal to 1×10-4).

• The staff implemented an initiative to further improve the timeliness of ASP analyses by

streamlining the analysis and review processes. The analysis process will now include 

results from the Significance Determination Process (SDP) and Management Directive (MD)

8.3, “NRC Incident Investigation Program,” when practicable. This action will prevent

duplication of analyses and reduce unintended consequences of inconsistent outcomes. 
The Commissioners -4-

The staff has streamlined the review process to reduce the number of ASP analyses that

undergo formal peer review. This revised review process will reduce administrative and

review burdens to NRC staff and licensees for cases where formal peer reviews are

considered of minimal value. However, rigorous independent reviews will continue to be

performed by ASP Program analysts for all ASP analyses. 

SPAR Model Development Program

The staff continued work to improve the quality of SPAR models and to add efficiency to the

evaluation process that use these models. Specifically, the staff:

• Continued to develop enhancements to Revision 3 SPAR models. A total of 39 plant

models (out of 72 models) have been completed so far. This effort involved a detailed

individual accident scenario level review against the respective licensee’s plant PRA. In

addition, SPAR model enhancements include the resolution of the PRA modeling issues

that were previously identified during the onsite quality reviews of the SPAR models, MSPI

pilot program reviews, and through feedback from model users.

• Incorporated external initiating events (i.e., internal fires, floods, and seismic events) into

the Revision 3 SPAR models for nine plants.

• Developed a user-friendly interface for SDP assessments using the Revision 3 SPAR

models.

• Developed initial SPAR models for 11 lead plants for internal initiating events during lowpower and shutdown (LP/SD) operations.

• Developed SPAR models for calculating the large early release frequency (LERF) for the

lead plants in six plant classes, representing varying plant and containment designs.

• Completed the first draft of a SPAR model quality assurance plan and formulation of a

process for the integration of internal events, external events, LP/SD, and LERF modules

into a comprehensive SPAR model for each plant.

• Interacted with the Advisory Committee on Reactor Safeguards (ACRS) in its quality review

of the SPAR Model Development Program, specifically, as the models have been applied to

the reevaluation of station blackout risk at nuclear power plants. The ACRS concluded that

the overall quality of this project was more than satisfactory and the results met research

objectives.

• Used SPAR models to support the implementation of the MSPI by verifying licensee results

and by helping resolve the PRA quality issue. Enclosure 1 discusses this in more detail. 

Enclosure 3 documents the lessons learned in terms of changes to licensee PRA models

and to the SPAR models.

In a September 28, 2005 memorandum, the Office of the General Counsel identified potential

organizational conflict of interest concerns with the contractor (Idaho National Laboratory) for

several projects including those for SPAR model development. The granting of a waiver in the

third quarter of FY 2006 has allowed SPAR model development and RASP projects to proceed. 

This issue has impacted activities and schedules related to the SPAR Model Development
The Commissioners -5-

Program and implementation of guidelines under RASP, and delayed a number of tasks

scheduled for completion in FY 2006 and early FY 2007. Specifically, these delays impacted

the development of SPAR models for LP/SD operations and external event initiators, and the

development of detailed guidelines for the use of SPAR models for LP/SD operations, external

event initiators, and calculation of LERF. Agency programs that were impacted by these delays

included the SDP, ASP Program, and the MD 8.3 Program. 

Upcoming Activities

The staff has planned the following activities for the next 12 months:

• Use the SPAR models to support the development of the state-of-the-art realistic

consequence analysis of severe accidents at nuclear power plants to determine risk

significant accident scenarios taking into consideration current plant capabilities.

• Identify and complete the preliminary analysis of significant precursors that occur through

June 30, 2007, to support the agency’s Strategic Plan goals for monitoring performance.

• Continue the screening, review, and analysis (preliminary and final) of events for FY 2006

and FY 2007, using MD 8.3 and SDP results when available, under the revised, streamlined

ASP process.

• Complete the preliminary assessment of all FY 2006 ASP events to support the Agency

Action Review Meeting, by April 2007. In addition, preliminary assessments will also be

completed for events occurring during the first quarter of FY 2007 for those events where

the inspection reports are completed during that quarter.

• Continue enhancing the Revision 3 SPAR models for internal events during power

operations. Major activities include re-examination of several of the MSPI pilot models and

completion of enhanced models for non-MSPI plants.

• Continue developing SPAR models for internal events during LP/SD operations, LERF, and

external events in accordance with the current SPAR Model Development Plan. Plans are 

to complete three external events models for boiling-water reactors, and five additional

LP/SD models.

• Continue implementing RASP, including streamlining and coordinating ASP and SDP

analyses, and implementing guidelines for the application of SPAR models to operating

events analysis.

CONCLUSIONS

The ASP Program continues to evaluate the safety significance of operating events at nuclear

power plants and to provide insights to NRC’s regulatory programs. The SPAR model

development program is continuing to develop and improve independent risk analysis tools and

capabilities to support the use of PRA in the agency’s risk-informed regulatory activities. The

staff uses SPAR models to support the Reactor Oversight Process, the ASP Program, the 

MD 8.3 evaluations, and the Generic Safety Issue resolution process. The staff also uses

SPAR models to perform analyses in support of risk-informed reviews of license amendments

and to independently verify the MSPI.
The Commissioners -6-

RESOURCE:

Resources to support the ASP Program are $600K and 5.3 full-time equivalents (FTE) in FY

2007, and $700K and 5.3 FTE in FY 2008. Resources for the SPAR Model Development

Program are $2,770K and 2.8 FTE in FY 2007 and 2,660K and 2.9 FTE in FY 2008. These

resources are contained in the FY 2008 budget. 

COORDINATION:

The Office of the General Counsel reviewed this Commission paper and has no legal objection. 

The Chief Financial Officer reviewed this package and determined that it has no financial

impact.

/RA Martin J. Virgilio Acting For/

Luis A. Reyes

Executive Director

 for Operations

Enclosures:

1. Status of the Accident Sequence Precursor

Program and the Standardized Plant Analysis 

Risk Model Development Program

2. Results, Trends, and Insights from the 

Accident Sequence Precursor Program

3. SPAR Model and Other Probabilistic Risk 

Assessment Lessons Learned from Mitigating 

Systems Performance Indicator Development 

and Implementation
The Commissioners -6-

COORDINATION:

The Office of the General Counsel reviewed this Commission paper and has no legal objection. 

The Chief Financial Officer reviewed this package and determined that it has no financial

impact.

/RA Martin J. Virgilio Acting For/

Luis A. Reyes

Executive Director

 for Operations

Enclosures:

1. Status of the Accident Sequence Precursor

Program and the Standardized Plant Analysis 

Risk Model Development Program

2. Results, Trends, and Insights from the 

Accident Sequence Precursor Program

3. SPAR Model and Other Probabilistic Risk 

Assessment Lessons Learned from Mitigating 

Systems Performance Indicator Development 

and Implementation

OAR in ADAMS? (Y or N) Y ADAMS ACCESSION NO.: ML061920242 TEMPLATE NO. SECY-012

Publicly Available? (Y or N) N DATE OF RELEASE TO PUBLIC N/A SENSITIVE? N 

to receive a copy of this document, indicate in the box “C” copy w/o attach/encl “E” copy w/attach/encl “N” no copy “e” electronic copy

OFFICE OEGIB PRB RASPB OEGIB PRB OERA DRASP

NAME JKauffman* DDube* CHunter* MCheok* ARubin* PBaranowsky* FEltawila*

DATE 08/25/06 09/01/06 08/31/06 09/01/06 09/01/06 09/06/06 09/08/06

OFFICE OGC OCFO NRR Tech RES DMDMRS EDO 

NAME KCyr* JFunches* JDyer* QTE* BSheron* MVirgilo LReyes

DATE 09/14/06 09/20/06 09/26 /06 09/22/06 09 /27/06 10/05/06 10/05/06

 OFFICIAL RECORD COPY Res File Code: 2C-3

* See previous concurrence.
The Commissioners -7-

COMMISSION PAPER DATED: 10/05/06

SUBJECT: STATUS OF THE ACCIDENT SEQUENCE PRECURSOR PROGRAM AND

THE DEVELOPMENT OF STANDARDIZED PLANT ANALYSIS RISK MODELS

DISTRIBUTION: 

OEGIB RF DOC SECY 

DRASP RF OGC OPA

EDO ACRS REGIONS

WITS #199200101 CFO

Commissioners OCA
1 Enclosure 1

Status of the Accident Sequence Precursor Program

and the Standardized Plant Analysis Risk

Model Development Program

1.0 Accident Sequence Precursor Program Background

The Nuclear Regulatory Commission (NRC) established the Accident Sequence Precursor

(ASP Program in 1979 in response to the “Risk Assessment Review Group Report”

(NUREG/CR-0400, dated September 1978). The ASP Program systematically evaluates U.S.

nuclear power plant operating experience to identify, document, and rank the operating events

that were most likely to have led to inadequate core cooling and severe core damage

(precursors), accounting for the likelihood of additional failures.

To identify potential precursors, NRC staff reviews plant events from licensee event reports

(LERs), inspection reports, and special requests from NRC staff. The staff then analyzes any

identified potential precursors by calculating a probability of an event leading to a core damage

state. A plant event can be one of two types, either (1) an occurrence of an initiating event,

such as a reactor trip or a loss of offsite power (LOOP), with any subsequent equipment

unavailability or degradation, or (2) a degraded plant condition depicted by unavailability or

degradation of equipment without the occurrence of an initiating event.

For the first type, the staff calculates a conditional core damage probability (CCDP). This

metric represents a conditional probability that a core damage state is reached, given an

occurrence of an initiating event (and any subsequent equipment failure or degradation). 

For the second type, the staff calculates an increase in core damage probability (ΔCDP). This

metric represents the increase in the probability of reaching a core damage state for the period

that a piece of equipment or a combination of equipment is deemed unavailable or degraded

from a nominal core damage probability for the same period for which the nominal failure or

unavailability probability is assumed for the subject equipment.

The ASP Program considers an event with a CCDP or a ΔCDP greater than or equal to 1×10-6

to be a precursor. The ASP Program defines a significant precursor as an event with a CCDP

or ΔCDP greater than or equal to 1×10-3.

Program objectives. The ASP Program has the following objectives:

• provide a comprehensive, risk-informed view of nuclear power plant operating experience

and provide a measure for trending nuclear power plant core damage risk

• provide a partial check on dominant core damage scenarios predicted by probabilistic risk

assessments (PRAs)

• provide feedback to regulatory activities
2 Enclosure 1

The NRC also uses the ASP Program to monitor performance against the safety goal

established in the agency’s Strategic Plan. (See NUREG-1100, Vol. 22, “Performance Budget: 

Fiscal Year 2007,” dated February 2006.) Specifically, the program provides input to the

following performance measures:

• zero events per year identified as a significant precursor of a nuclear reactor accident (i.e.,

CCDP or ΔCDP greater than or equal to 1×10-3)

• no more than one significant adverse trend in industry safety performance (determination

principally made from the Reactor Oversight Program (ROP) but supported by ASP results) 

Program scope. The ASP Program is one of three agency programs that assess the risk

significance of issues and events. (The other two programs are the significance determination

process (SDP) and the event response evaluation process, as defined in Management Directive

(MD) 8.3, “NRC Incident Investigation Program.”) Compared to the other two programs, the

ASP Program assesses the significance of a different scope of operating experience at U.S.

nuclear power plants. For example, compared to the SDP, the ASP Program analyzes initiating

events, as well as degraded conditions where there was no identified deficiency in the

licensee’s performance. The ASP Program scope also includes events with concurrent,

multiple degraded conditions. 

2.0 ASP Program Status

Analysis of ASP events. Table 1 of Enclosure 2 to this paper provides the status of events

identified as potential precursors under the ASP Program. The staff has completed all

precursor analyses from fiscal year (FY) 2004 and FY 2005. The analyses of FY 2006 events

are in progress.

Control rod drive mechanism (CRDM) cracking events. The staff completed an analysis for

the conditions involving primary water stress-corrosion cracking of CRDM housings initially

discovered at 11 plants in FY 2001–2003. The staff is currently documenting and reviewing the

analyses. The Office of Nuclear Regulatory Research (RES) has coordinated with the Office of

Nuclear Reactor Regulation (NRR) on input for several of these analyses. To complete the

remainder of the analyses, the staff decided to simplify the inputs for initiating event frequencies

and potential sump-clogging probabilities. This simplification is justified since the staff had

determined that more detailed analysis did not result in additional insights. This simplification

did not affect ASP trends and results, and the staff has included these events in the total count

and trending of all precursors (i.e., CCDP or ΔCDP $1×10-6).

ASP Program status. The staff plans to complete its preliminary assessments of all FY 2006

events by April 2007 and complete all FY 2006 analyses by September 2007. In addition, the

ASP Program will give priority to analyses of potentially high-risk events when such events are

identified during NRC inspections or in LERs.

Investigation of trends and engineering insights. From its analysis of ASP data, the staff

has developed and investigated trends to better understand their causes. Enclosure 2 provides

the details.

ASP streamlining. In June 2006, the staff implemented changes to streamline the ASP

process and thus improve ASP timeliness and efficiency. Although the objectives of the ASP,

SDP, and MD 8.3 are different, the risk models and technical methods used are generally
3 Enclosure 1

similar. One of the objectives of ASP streamlining is to gain efficiencies by using results from

the SDP and MD 8.3 evaluations, where applicable, in the ASP Program. Another major

objective is to achieve better coordination among the ASP, SDP, and MD 8.3 Programs. Better

coordination will increase the timeliness of all three programs. The following summarizes the

new process:

Selection of precursors with an SDP or documented MD 8.3 evaluation. For degraded

conditions or significant operational occurrences for which there is an SDP or documented

MD 8.3 quantitative risk evaluation, the ASP Program will utilize the results of these

evaluations, where applicable, without performing a separate ASP analysis. As in the past,

NRR and the regions will be performing the SDP and MD 8.3 evaluations using the

respective program’s process and guidelines. It is not the intent of this ASP Program

change to propose changes to the SDP or MD 8.3 processes; rather, the ASP Program will

use documented results from these processes where appropriate and applicable. As part of

the NRR user need request on the Risk Assessment Standardization Project (RASP), RES

will continue to provide technical assistance to NRR or the regional senior reactor analysts

(SRAs), when requested, in utilizing or modifying the standardized plant analysis risk

(SPAR) models as part of SDP Phase 3 or MD 8.3 analyses. 

Selection of precursors with no SDP or documented MD 8.3 evaluation. The ASP Program

will continue to perform analyses for events for which there is no SDP or MD 8.3 evaluation. 

Examples of these types of events include most initiating events and plant conditions where

there are no performance deficiencies. In addition, because of differences in the objectives

of the ASP and SDP Programs, in cases where there are concurrent multiple degraded

conditions, the ASP process will analyze these conditions together. (The SDP Program

analyzes concurrent multiple degraded conditions that involve different performance

deficiencies individually.) In performing these ASP analyses, RES will continue to interact

with NRR and the SRAs in obtaining plant and event information/data and to discuss results

on an ongoing basis.

Potentially significant precursors. For all events (including those being evaluated by the

SDP or MD 8.3 processes) that, based on preliminary evaluations, could be significant

precursors (defined as events with CCDPs or ΔCDPs greater than or equal to 1×10-3), the

ASP Program will perform an expedited analysis to support the reporting requirements in

the annual NRC Performance and Accountability Report to Congress and to support the

proposed new abnormal occurrence criteria described in SECY-05-0137. In performing

these ASP analyses, RES will interact closely with NRR and the regions to obtain plant and

event information/data and to discuss results on an ongoing basis. 

New peer review process. As part of the new ASP process, the staff will revise the peer

review process to make it more efficient. For lower risk events, if the ASP analysis results

in a CCDP or ΔCDP of less than 1×10-4, RES will no longer request formal NRR, regional

office, or licensee review. RES will issue a summary of the analysis results by

memorandum to NRR, the regional offices, and the licensee for information. If NRR, the

regional offices, or the licensee chooses to comment on these analyses, RES will continue

to address these comments and revise the ASP analysis if necessary. For higher risk

events (i.e., for ASP analysis results greater than 1×10-4), RES will continue to request

formal review comments by NRR, the regional offices, and the licensee. The staff will issue

these ASP analyses as final after resolution of peer review comments. This revised review

process will reduce administrative and review burdens to NRC staff and licensees.
4 Enclosure 1

3.0 SPAR Model Development Program Background

The objective of the SPAR Model Development Program is to develop standardized risk

analysis models and tools that staff analysts use in many regulatory activities, including the

ASP Program and Phase 3 of the SDP. The SPAR models have evolved from two sets of

simplified event trees initially used to perform precursor analyses in the early 1980s. Today’s

Level 1, Revision 3, SPAR models for internal events are far more comprehensive than their

predecessors. For example, the revised SPAR models include a new, improved LOOP/station

blackout (LOOP/SBO) module, improved reactor coolant pump seal failure model, and updated

estimates of accident initiator frequencies and equipment reliability based on more recent

operating experience data.

The Level 1, Revision 3, SPAR models consist of a standardized, plant-specific set of risk

models that use the event-tree/fault-tree linking methodology. They employ an NRC-developed

standard approach for event-tree development, as well as a standard approach for input data

for initiating event frequencies, equipment performance, and human performance. These input

data can be modified to be more plant- and event-specific when needed. The system fault

trees contained in the SPAR models are not as detailed as those contained in licensees’ PRAs. 

The initial set of 72 Revision 3 SPAR models, representing all 103 operating units, was

completed and benchmarked against licensee PRAs during the onsite quality assurance

reviews of these models. On the whole, the results of the benchmarking indicate that the

difference observed between the SPAR models and the licensee plant PRAs is not very

significant from an overall risk standpoint.

In 1999, the SPAR Model Users Group (SMUG) assumed coordination of model development

efforts that support the ASP Program and other risk-informed regulatory processes. This group

consists of representatives from RES, NRR, and the NRC’s regional offices. In August 2000,

the SMUG completed the SPAR Model Development Plan, which addresses the following

models:

• internal initiating events during full-power operation (Revision 3 SPAR models)

• internal initiating events during low-power and shutdown (LP/SD) operations

• external initiating events (including fires, floods, and seismic events)

• calculation of large early release frequency (LERF)

In addition to SMUG, the NRC staff initiated the Risk Assessment Standardization Project

(RASP) in February 2004. The primary focus of RASP is to standardize risk analyses in SDP

Phase 3, ASP, and MD 8.3. Under this project, the NRC staff is working to complete the

following activities:

• enhance SPAR models to be more plant-specific and enhance the codes used to

manipulate the SPAR models

• document consistent methods and guidelines for risk assessments of internal events during

power operations, internal fires and floods, external events (e.g., seismic events and

tornadoes), internal events during LP/SD operations, and LERF sequences

• provide on-call technical support to NRR and regional senior reactor analysts
5 Enclosure 1

4.0 Recent Achievements

The SPAR Model Development Program continues to play an integral role in the ASP analysis

of operating events. Many other agency activities, such as the Reactor Oversight Program

(ROP), MD 8.3 evaluations, licensing actions, and the Mitigating Systems Performance Index

(MSPI), involve the use of SPAR models. New SPAR models are under development in

response to staff needs for modeling internal initiating events during LP/SD operations, external

initiating events, and LERFs.

One recent example of the use of SPAR to support agency work is the assessment of SBO risk. 

Enhanced SPAR models were applied to this assessment. In FY 2006, the NRC issued

NUREG/CR-6890, “Reevaluation of Station Blackout Risk at Nuclear Power Plants.” Volume 1

of the report contains updates of LOOP initiating event frequencies and nonrecovery

probabilities. Volume 2 presents SBO risk estimates in terms of core damage frequency (CDF)

for the nuclear industry and the fleet of nuclear power plants. Volume 3 contains the resolution

of comments. The report concludes that LOOP frequencies have decreased, but duration times

have increased. The study also shows that SBO CDF estimates have decreased. The baseline

results reflect improving emergency diesel generator performance, improving plant-specific

SBO coping capabilities (e.g., turbine-driven pump performance), increasing duration of LOOP

events, and lower overall loss of offsite power frequency observed during the 1997–2003

period.

Another example of the use of SPAR is the MSPI project. The staff used the SPAR models as

part of its review of the technical adequacy of the licensee PRA models for MSPI

implementation in FY 2006. The staff reviewed design features, operations features, or

modeling methods, as appropriate and made cross-comparisons with SPAR model results. The

staff noted differences or outliers and discussed their basis with the licensees. The staff

continued to work with licensees until it had resolved all MSPI outlier concerns. The industry

implemented over a dozen PRA model changes as a result of this comprehensive review effort. 

In summary, the use of SPAR models proved to be invaluable in resolving PRA adequacy

concerns for implementation of MSPI. Enclosure 3 discusses this in more detail.

The staff is currently using SPAR models to support the development of the state-of-the-art

reactor consequence analysis of severe accidents at nuclear power plants. Based on insights

resulting from this activity, the staff plans to update the SPAR models, as appropriate, based on

current plant capabilities and safety enhancements. Initially, the plants to be evaluated will be

the six lead (pilot) plants in the state-of-the-art reactor consequence analysis project. In

addition, the staff will update the SPAR models, as appropriate and on a plant-by-plant basis, to

include plant safety enhancements resulting from Phases 1, 2 and 3 Section B.5.b

assessments as the engineering and risk information on the pertinent systems become

available to the staff as part of normal NRC regulatory activities.

5.0 SPAR Model Development Status

In conformance with the SPAR Model Development Plan, the staff has completed the following

activities in model and method development since the previous status report (SECY-05-0192).

SPAR models for analysis of internal initiating events during full-power operation

• The staff developed enhanced Revision 3 SPAR models in response to an NRR user need. 

This effort involved (1) performing a cut-set-level review against the respective licensee’s
6 Enclosure 1

plant PRA for each of the Revision 3 SPAR models for 39 models that were not pilot plants

in the MSPI Program, and (2) incorporating into the Revision 3 SPAR models the resolution

of the PRA modeling issues that were identified (a) during the onsite quality assurance (QA)

reviews of the Revision 3 SPAR models, (b) during the MSPI pilot program reviews, and (c)

based on feedback from model users.

SPAR models for analysis of internal initiating events during LP/SD operation

• This effort is part of the RASP in support of ASP and SDP Phase 3 analyses.

• Before 2006, the staff had completed initial development of 11 LP/SD SPAR models. It

completed no additional models in FY 2006 because of a potential conflict of interest with

the NRC contractor at Idaho National Laboratory (INL). The staff has resolved this issue

with INL and is now preparing additional LP/SD models in anticipation of onsite quality

assurance (QA) reviews.

SPAR models for the calculation of LERF

• This effort is part of the RASP in support of ASP and SDP Phase 3 analyses. The staff

completed the LERF SPAR model for Grand Gulf (the lead plant in the fourth class), which

is a boiling-water reactor (BWR) with a Mark III containment. The staff subsequently sent

the model to the licensee in the course of preparing for the onsite QA review of the model

against the Level 2/LERF model.

• The staff also completed models for the lead plant (LaSalle) in the fifth plant class (BWRs

with Mark II containments) and the sixth plant class (pressurized-water reactors (PWRs)

with subatmospheric containments) in FY 2006.

SPAR models for the analysis of external events

• The staff is performing this effort, which is part of the RASP in support of ASP and SDP

Phase 3 analyses, in conjunction with NRR’s SDP external events Phase 2 worksheet

benchmarking program.

• Nine preliminary SPAR models that contain internal and external events are complete and

are available for trial use and evaluation by the staff.

6.0 Additional Achievements

Validation of SPAR models. Validation of the SPAR models is an ongoing effort. The staff

compared the SPAR models to the plant PRA models during SDP Phase 2 Notebook plant

visits and MSPI reviews and considered feedback from SDP and ASP analysts. The licensees

have also provided feedback, which the staff has incorporated as appropriate. Metrics are used

to quantify the degree of agreement between the SPAR models and licensee PRAs. On the

whole, this benchmarking has indicated that the CDFs from the SPAR models are within a

factor of 2, on average, when compared to the estimates from the licensee PRA models. This

is within the generally accepted uncertainty for internal event PRAs. Most of the differences are

well understood and result from the use of plant-specific versus industry-averaged performance

data. In some cases, a few key modeling assumptions account for relatively large differences

between licensee PRA and SPAR model results. The reports for each SPAR model describe
7 Enclosure 1

the benchmarking comparisons, as well as the significant modeling differences between the

SPAR and licensee PRA models.

Advisory Committee on Reactor Safeguards Review. The Advisory Committee on Reactor

Safeguards (ACRS) selected the SPAR Model Development Program as one of three projects

to review during 2005 for “research quality.” The ACRS found the SPAR Model Development

Program and its application as part of NUREG/CR-6890, “Reevaluation of Station Blackout Risk

at Nuclear Power Plants,” to be “more than satisfactory” and found that the program and

NUREG/CR results meet the research objectives. The ACRS also noted the value of SPAR

models as an “independent capability to evaluate risk issues across the population of operating

plants.” The ACRS report entitled, “ACRS Assessment of the Quality of Selected NRC

Research Projects,” dated October 2005, documents the results of their review. This document

is publically available and can be accessed from the NRC’s Agencywide Documents Access

and Management System (ADAMS Accession No. ML053110211).

Methods guidelines. The staff completed initial guidelines for performing risk assessments for

the internal fire and flood initiators and external events during power operations in September

2006. The deliverable was in the form of a practical, “how to” handbook of methods, best

practices, examples, tips, and precautions for applying the new SPAR models for external

events that are under development. The staff issued this handbook for trial use. The staff and

the contractor for ASP Program support have been using the trial-basis guidelines for internal

events during power operations for over 1 year. The handbook has also proven useful to new

analysts who recently started work on the ASP and reactor oversight process programs and will

reduce the time and resources needed to train future new analysts. The staff began working on

guidelines to address LP/SD operations and LERF. The staff developed draft guidance for the

calculation of LERF, applied this guidance in an analysis of a recent LOOP event, and is

currently evaluating the results of this pilot application. During FY 2007, the staff will issue a

revision of the handbook that incorporates comments from users and expands discussion,

guidance, and examples of internal and external events. Plans are to integrate all guidance into

one handbook.

Efficiency improvements. Enhancements of the SPAR models, improvements to the Systems

Analysis for Hands-on Integrated Reliability Evaluation (SAPHIRE) code, and the

implementation of guidelines for agency risk applications all contribute to increased staff

efficiency. SPAR models that accurately reflect plant design, operation, and performance result

in improved turnaround time for SDP and ASP analyses. When the SPAR models substantially

agree with the licensee’s own PRA models, less time is required to resolve significant

differences between the two models. Improvements to the SAPHIRE code allow efficient

development and use of the SPAR models. A SAPHIRE version is under development which

streamlines development of large, complex models, such as external events models and can

solve integrated internal and external events SPAR models. In addition, improved guidelines

for the application of SPAR models to operational events result in reduced training needs and

greater standardization.

Finally, the staff is coordinating its development of SPAR fire models with the regulatory efforts

under National Fire Protection Association (NFPA) 805, “Performance-Based Standard for Fire

Protection for Light Water Reactor Electric Generating Plants.” Significant synergies and

resource savings should result from early identification of fire PRA reporting requirements once

licensees complete their fire PRA models and NFPA 805 submittals.
1 Enclosure 2

Results, Trends, and Insights from the

Accident Sequence Precursor Program

This enclosure discusses the results of accident

sequence precursor (ASP) analyses conducted by

the U.S. Nuclear Regulatory Commission (NRC),

as they relate to events that occurred during Fiscal

Years (FY) 2004–2006. Based on those results,

this document also discusses the NRC’s analysis

of historical ASP trends, and the evaluation of the

related insights. The seven tables and nine figures

that augment this discussion appear at the end of

this enclosure.

1.0 ASP Event Analyses

Table 1 summarizes the status of the NRC’s ASP

analyses, as of September 30, 2006. Specifically,

the table identifies ASP analyses that the NRC

staff has completed for events that occurred during

FY 2004–2006. (Note that, as of September 30,

2006, the staff had not yet screened all of the FY

2006 events.) The following subsections

summarize the results of these analyses, which

are further detailed in the associated Tables 1–7.

FY 2004 analyses. The ASP analyses for FY

2004 identified 17 precursors. Of the 17

precursors, 14 occurred while the plants were at

power.

Table 2 presents the results of the staff’s ASP

analyses for FY 2004 precursors that involved

initiating events, while Table 3 presents the

analysis results for precursors that involved

degraded conditions.

FY 2005 analyses. The ASP analyses for FY

2005 identified 15 precursors. Of the 15

precursors, 13 occurred while the plants were at

power.

Table 4 presents the results of the staff’s ASP

analyses for FY 2005 precursors that involved

initiating events, while Table 5 presents the

analysis results for precursors that involved

degraded conditions.

FY 2006 analyses. The staff has completed all

screening and reviews for potential significant

precursors (i.e., conditional core damage

probability (CCDP) or increase in core damage

probability (ΔCDP) $1×10-3) through September

30, 2006. In particular, the staff reviewed a

combination of licensee event reports (LERs) (as

required by Title 10, Section 50.73, of the Code of

Federal Regulations) and daily event notification

reports (as required by Title 10, Section 50.72, of

the Code of Federal Regulations) to identify

potential significant precursors. The staff is still

screening and reviewing LERs concerning other

potential precursor events that occurred during FY

2006.1

 The goal is to complete preliminary

assessments of all FY 2006 events by April 2007.

2.0 Industry Trends

This section discusses the results of trending

analyses for all precursors and significant

precursors.

Statistically significant trend. The trending

method used in this analysis is consistent with

those methods used in the staff’s risk studies. (See

Appendix E of Reference 1.) The trending method

uses the p-value approach for determining the

probability of observing a trend as a result of

chance alone. A trend is considered statistically

significant if the p-value is smaller than 0.05. The

figures at the end of this enclosure show the pvalue for each trend.

Data coverage. Most of the data used in the

trending analyses span the period from FY 1996

through FY 2005. The trends include the results of

both final and preliminary analyses of potential

precursors. However, the following exception

applies to the data coverage of the trending

analyses:

• Significant precursors. The trend of significant

precursors includes events that occurred during

FY 2006. The results for FY 2006 are based on

the staff’s screening and review of a combination

of LERs and daily event notification reports.2

The staff analyzes all potential significant

precursors immediately.

Precursor trend evaluation. Last year’s status

report (SECY-05-0192) documented an

investigation into the apparent low number of

precursors during FY 1997–1999 and the

1 Licensees have a 60-day grace period after an event

or discovery of a degraded condition to submit an

LER.

2 The staff has completed all screening and reviews 

through September 30, 2006.
2 Enclosure 2

subsequent increase in FY 2000–2004. The main

conclusions of that investigation were that ASP

Program changes (e.g., inclusion of Reactor

Oversight Process findings and inclusion of

external initiated events) that occurred in FY 2001

significantly increased the number of precursors

identified compared to those identified in previous

years. In addition, recent groups of outlier events

(e.g., the 2003 northeast U.S. electrical blackout

resulting in 8 precursor events, the 11 control rod

drive mechanism (CRDM) housing cracking

conditions between FY 2000 and FY 2003) and the

high number of loss of offsite power (LOOP)

events that occurred in FY 2003 and FY 2004 were

significant contributors to increasing trends. 

The staff did not redo work performed as part of

last year’s analysis as part of this year’s analysis. 

Instead, five-year trend analyses were performed

for FY 1996–2000 and FY 2001–2005 periods for

groups of precursor affected by the increase in

ASP scope (i.e., precursors that involve degraded

conditions) that occurred in FY 2001. For the

precursor groups not affected by the increase in

ASP scope (e.g., precursors involving initiating

events), 10-year trend analyses were performed. 

Performing the trend analyses in this manner more

accurately reflect precursor trends over a period

when the analyses of events were consistently

completed.

2.1 Occurrence Rate of All Precursors

The NRC’s Industry Trends Program (ITP)

provides the basis for addressing the agency’s

performance goal measure on the number of

“statistically significant adverse industry trends in

safety performance” (one measure associated with

the safety goal established in the NRC’s Strategic

Plan). Precursors identified by the ASP Program

are one indicator used by the ITP to assess

industry performance.

Results. Figure 1 depicts the occurrence rate for

all precursors by fiscal year during FY 1996–2000

and FY 2001–2005 periods. A review of the data

for that period reveals the following insights:

• The analysis divided the data from FY 1996

through FY 2005 into two parts, FY 1996–2000

and FY 2001–2005, because of the ASP

Program scope increased (e.g., inclusion of

external events and significance determination

process (SDP) findings) in FY 2000. These

increases in scope have resulted in the

identification of an increasing number of lower

risk precursors (i.e., CCDP or ΔCDP <10-4). 

The analysis identified no trend for either of

these 5-year periods. The mean rate of

occurrence of all precursors in the time period

from FY 2001–2005 is higher than what is

observed during FY 1996 through FY 2000. In

addition to the increases in ASP Program scope,

the increased number of outlier events (e.g., the

11 grid-related LOOP events in FY 2003 and FY 

2004 and the 11 CRDM housing cracking events

between FY 2001 and FY 2003) accounts for the

observed change.

• Over the more recent time period from FY

2001–2005, the analysis detected a statistically

significant decreasing trend for higher risk

precursors (i.e., CCDP or ΔCDP $10-4).

2.2 Significant Precursors

The ASP Program provides the basis for the FY

2006 performance goal measure of “zero events

per year identified as a significant precursor of a

nuclear accident” (one measure associated with the

safety goal established in the NRC’s Strategic

Plan).3

 Specifically, the Strategic Plan defines a

significant precursor as an event that has a

probability of at least 1 in 1000 ($10-3) of leading to

a reactor accident (see Reference 2).

Table 6 summarizes all significant precursors that

occurred from FY 1969 through FY 2006.

Results. Figure 2 depicts the number of significant

precursors that occurred during FY 1996–2006. A

review of the data for that period reveals the

following insights:

• There were no significant precursors identified in

FY 2006.

• The staff does not detect any statistically

significant trend in the occurrence of significant

precursors during FY 1996–2006. In addition, 

the analysis revealed no trend for significant

precursors during the FY 2001–2006 period.

• Over the past 20 years, significant precursors

have occurred, on average, about once every 4

years. The events in this group involve differing

failure modes, causes, and systems.

3 Before FY 2005, the performance goal measure for

significant precursors was “no more than one event

per year identified as a significant precursor of a

nuclear accident.” 
3 Enclosure 2

3.0 Insights and Other Trends

The following sections provide additional ASP

trends and insights from the period FY 1996

through FY 2005.

3.1 Initiating Events vs. Degraded Conditions

A precursor can be the result of either (1) an

operational event involving an initiating event such

as a LOOP, or (2) a degraded condition found

during a test, inspection, or engineering evaluation. 

A degraded condition involves a reduction in safety

system reliability or function for a specific duration

(although no reactor trip initiator actually occurred

during this time that challenged the degraded

condition).

A review of the data for FY 1996–2005 yields 

insights described below.

Initiating events

• Over the past 10 years, precursors involving

degraded conditions outnumbered initiating

events (69 percent compared to 31 percent,

respectively). This predominance was most

notable in FY 2001 and FY 2002, when

degraded conditions contributed to 91 percent

and 100 percent of the identified precursors,

respectively.

• The mean occurrence rate of precursors

involving initiating events exhibits an increasing

trend that is statistically significant for the period

from FY 1996 through FY 2005, as shown in

Figure 3. Specifically, the occurrence rate of

such precursors increased over this period by a

factor of 3. The analysis detected no trend

when the 2003 northeast blackout events are

excluded from the data.

• Of the precursors involving initiating events

during FY 1996–2005,64 percent are LOOP

events. During the period from FY 2001

through FY 2005, 70 percent of all initiating

event precursors involved a LOOP. 

Degraded conditions

• The analysis divided the data from FY 1996

through FY 2005 into two parts, FY 1996–2000

and FY 2001–2005, because of the ASP

Program scope increased (e.g., inclusion of

external events and SDP findings) in FY 2000. 

The mean occurrence rate of precursors

involving degraded conditions exhibits a

statistically significant decreasing trend during

the FY 2001–2005 period, as shown in Figure 4. 

The analysis detected no trend for the FY

1996–2000 period.

• From FY 1996 through FY 2005, approximately

one-half of the precursors involving degraded

conditions had a condition start date before FY

1996. 

3.2 Precursors Caused by Degraded

Conditions

Most precursors involving degraded conditions

result from equipment unavailabilities. Such events

typically occur for extended periods without a

reactor trip, or in combination with a reactor trip in

which a risk-important component is unable to

perform its safety function as a result of a degraded

condition.

A review of the data for FY 1996–2005 yields 

insights described below concerning the

unavailability of safety-related equipment.4

Equipment unavailabilities at boiling-water

reactors

• Of the 16 precursors involving the unavailability

of safety-related equipment that occurred at

boiling-water reactors (BWRs) during FY

1996–2005, most were caused by failures in the

emergency power system (69 percent), residual

heat removal system (31 percent), or highpressure coolant injection system (13 percent).

Emergency core cooling systems in

pressurized-water reactors

• The unavailability of safety-related high- and/or

low-pressure injection trains contributed to 61

percent of all identified precursors that occurred

at pressurized-water reactors (PWRs) during FY

1996–2005. Failures in either the emergency

core cooling system (ECCS) (22 percent) or

emergency power sources (18 percent) caused

most of these unavailabilities, or they resulted

from design-basis issues involving other

structures or systems that impact either the

ECCS or one of its support systems (51

percent).

4 The sum of percentages presented in this section

does not always equal 100 percent because some

precursors involve multiple equipment unavailabilities.
4 Enclosure 2

• A condition that affected sump recirculation

during postulated loss-of-coolant accidents

(LOCAs) of varying break sizes caused 25 of

the precursors.

Auxiliary/emergency feedwater systems in

PWRs

• The unavailability of one or more trains of the

auxiliary and emergency feedwater (AFW/EFW)

systems contributed to 39 percent of all

precursors that occurred at PWRs. Most of

these unavailabilities were the result of failures

in the AFW/EFW systems (16 percent) or

emergency power sources (35 percent), or they

resulted from design-basis issues involving

other structures or systems that impact either

the AFW/EFW systems or one of their support

systems (49 percent).

• The seven precursors that involved a failure in

an AFW/EFW train yield the following insights:

S Two of the train failures occurred following a

reactor trip.

S All seven of the precursors involved the

unavailability of the turbine-driven

AFW/EFW pump train.

Emergency power sources in PWRs

• The unavailability of emergency power sources

such as emergency diesel generators (EDGs)

and hydroelectric generators (at Oconee),

contributed to 23 percent of all precursors that

occurred at PWRs.5

 Most of these

unavailabilities resulted from random hardware

failures in the emergency power system (44

percent).

• The other unavailabilities were attributable to

design-basis issues (36 percent) and losses of

service water (20 percent).

• In all the analyzed LOOP events at PWRs, the

turbine-driven AFW/EFW pumps were

operable.

Section 3.3 discusses insights related to precursors

that involved a LOOP with simultaneous EDG

unavailability.

3.3 Precursors Involving LOOP Initiating

Events

Six LOOP events occurred during FY 2004, while

only one LOOP event occurred during 2005. The

FY 2005 LOOP event occurred at Waterford, while

the plant was shut down, and was caused by the

effects of Hurricane Katrina.

Results. A review of the data for FY 1996–2005

leads to the following insights:

• The mean occurrence rate of precursors

resulting from a LOOP does not exhibit a trend

that is statistically significant for the period from

FY 1996 through FY 2005, as shown in Figure 5. 

It is noted that the number of LOOP events in

2003 and 2004 is much higher than in previous

years. The NRC has implemented initiatives to

address this increase. 

• Of the LOOP precursor events that occurred

during FY 1996–2005, 11 percent had a CCDP

$1×10-4.

• A simultaneous unavailability of an emergency

power system train was involved in 4 of the 27

LOOP precursor events during FY 1996–2005. 

One of these precursors was a significant

precursor (Catawba Unit 2, 1996).

3.4 Precursors at BWRs vs. PWRs

Since FY 2001, 25 precursors have occurred at

BWRs, which is 22 more than the total from the

previous 5 years. Over the past 10 years, 109

precursors have occurred at PWRs, with

approximately 60 percent occurring in the past 5

years.

A review of the data for FY 1996–2005 reveals the 

results for BWRs and PWRs described below.

BWRs

• The analysis divided the data from FY 1996

through FY 2005 into two parts, FY 1996–2000

and FY 2001–2005, because of the ASP

Program scope increased (e.g., inclusion of

external events and SDP findings) in FY 2000. 

The analysis identified no trend for either of

these 5-year periods, as shown in Figure 6. The

mean rate of occurrence of precursors occurring

5 Not all EDG unavailabilities are precursors. The

ASP Program screens out an EDG unavailability for

a period of less than one surveillance test cycle

(1 month) is screened out in the ASP Program

(assuming no other complications). In addition, the

risk contributions of EDG unavailabilities vary from

plant-to-plant and may result in a ΔCDP less than

the threshold of a precursor (1×10-6).
5 Enclosure 2

at BWRs in the time period from FY 2001–2005 is

higher than what is observed during FY 1996

through FY 2000. In addition to the increase in

ASP Program scope, the large number of LOOP

events that occurred at BWRs in FY 2003 account

for the observed change.

• An average of three precursors per year

occurred at BWRs during the FY 1996–2005

period.

• LOOP events contributed to 60 percent of

precursors involving initiating events at BWRs.

• Only three precursors occurred at a BWR

during the 5-year period from FY 1996 through

FY 2000.

PWRs

• The analysis divided the data from FY 1996

through FY 2005 into two parts, FY 1996–2000

and FY 2001–2005, because of the ASP

Program scope increased (e.g., inclusion of

external events and SDP findings) in FY 2000. 

The analysis identified no trend for either of

these 5-year periods, as shown in Figure 7. 

The mean rate of occurrence of precursors

occurring at PWRs in the time period from FY

2001–2005 is higher than what is observed

during FY 1996 through FY 2000. In addition to

the increases in ASP Program scope, the

increased number of outlier events (e.g., the 6

grid-related LOOP events in FY 2003 and FY 

2004 and the 11 CRDM housing cracking

events between FY 2001 and FY 2003)

accounts for the observed change.

 

• An average of 11 precursors per year occurred

at PWRs during FY 1996–2005.

• LOOP events contribute to 69 percent of

precursors involving initiating events at PWRs.

3.5 Integrated ASP Index

The staff derives the integrated ASP index for

order-of-magnitude comparisons with

industry-average core damage frequency (CDF)

estimates derived from probabilistic risk

assessments (PRAs) and the NRC’s Standardized

Plant Analysis Risk (SPAR) models. The index or

CDF from precursors for a given fiscal year is the

sum of CCDPs and ΔCDPs in the fiscal year

divided by the number of reactor-calendar years in

the fiscal year.

The integrated ASP index, includes the risk

contribution of a precursor for the entire duration of

the degraded condition (i.e., the risk contribution is

included in each fiscal year that the condition

exists). The risk contributions from precursors

involving initiating events are included in the fiscal

year that the event occurred.

Examples. A precursor involving a degraded

condition is identified in FY 2003 and has a ΔCDP

of 5×10-6. A review of the LER reveals that the

degraded condition has existed since a design

modification performed in FY 2001. In the

integrated ASP index, the ΔCDP of 5×10-6 is

included in the FYs 2001, 2002, and 2003.

For an initiating event occurring in FY 2003, the

CCDP from this precursor is included only in FY

2003.

Results. Figure 8 depicts the integrated ASP

indices for FY 1996–2005. A review of the ASP

indices leads to the following insights:

• Based on order of magnitude, the average

integrated ASP index for the period from FY

1996 through FY 2005 is consistent with the

CDF estimates from the SPAR models and the

licensees’ PRAs.

• The risk contribution from precursors is generally

constant over this time period and has

decreased since FY 2003.

• Contributions to the average integrated CDF

from precursors over the 10-year period (FY

1996–2005) are as follows:

S Four precursors contribute to nearly one-half

(43 percent) of the average integrated CDF

from precursors over the 10-year period. 

Specifically, long-term degraded conditions at

Point Beach Units 1 and 2 (discovered in

2001) involved potential common-mode

failure of all AFW pumps, while long-term

degraded conditions at D.C. Cook Units 1 and

2 (discovered in 1999) involved a number of

locations in the plant where the effects of

postulated high-energy line break events

would damage safety-related components. 

The associated ΔCDPs of the degraded

conditions at Point Beach and D.C. Cook

were high (7×10-4 and 4×10-4, respectively)

and the degraded conditions had existed

since plant construction.

S Two significant precursors (i.e., CCDP or
6 Enclosure 2

ΔCDP $1×10-3) contribute to 25 percent of the

average integrated CDF from precursors over the

10-year period. Each significant precursor existed

for a 1-year period. Table 6 describes these

events.

S The remaining 32 percent of the average

integrated CDF from precursors over the

10-year period was from contributions from

131 precursors.

Limitations. Using CCDPs and ΔCDPs from ASP

results to estimate CDF is difficult because (1) the

mathematical relationship requires a significant

level of detail, (2) statistics for frequency of

occurrence of specific precursor events are

sparse, and (3) the assessment must also account

for events and conditions that did not meet the

ASP precursor criteria.

The integrated ASP index provides the contribution

of risk (per FY) resulting from precursors and

cannot be used for direct trending purposes since

the discovery of precursors involving longer term

degraded conditions in future years may change

the cumulative risk from the previous year(s). 

Because of these and other limitations, the staff

has primarily used the rate of CCDPs and ΔCDPs

as a trending indication.

3.6 Consistency with PRAs and IPEs

A secondary objective of the ASP Program is to

provide a partial validation of the dominant core

damage scenarios predicted by PRAs and

individual plant examinations (IPEs). Most of the

identified precursor events are consistent with

failure combinations identified in PRAs and IPEs.

However, a review of the precursor events for FY

1996–2005 reveals that approximately 36 percent

of the identified precursors involved event initiators

or failure modes that were not explicitly modeled in

the PRA or IPE for the specific plant where the

precursor event occurred. Table 7 lists these

precursors. The occurrence of these precursors

does not imply that explicit modeling is needed;

however, such modeling could yield insights that

could be incorporated in future revisions of the

PRA.

3.7 Review of Human Error Contributions

The staff reviewed precursor data from the ASP

Program during the FY 2000–2004 period to

identify the kinds of human errors that are

associated with precursor events. In this updated

review, the staff used the classification scheme and

approach developed in previous studies

(References 3 and 4) of the same subject. In

addition, the staff identified and compared human

errors associated with select Green inspection

findings during FY 2004 the human errors

associated with higher risk precursor events. The

following summarizes these findings:

• Number of human errors in precursors. The

average number of errors per precursor was

approximately three. Although precursors can

involve multiple error events, the CCDP or ΔCDP

for these precursors was generally low (in the 10-

6

 to 10-5 range), an indication that sufficient

redundancy and defense-in-depth remained.

• Error contributions to precursors. Figure 9

shows the percentage of precursors with at least

one error in a subcategory. When the

percentage of precursors with at least one error

in the subcategory is considered, the dominant

subcategories are inadequate

procedures/procedure development (39

percent); design deficiencies (33 percent);

inadequate engineering evaluation/review (28

percent); failure to correct known deficiencies

(25 percent); inadequate maintenance and

testing practices (18 percent); issues with

management oversight (15 percent); and

incorrect operator action/inaction (14 percent).

• Higher risk precursors. The staff reviewed

precursors with a CCDP or ΔCDP greater than

or equal to 1×10-5 to identify the error(s) that

contributed most to the overall risk of the

initiating event (CCDP) or degraded condition

(ΔCDP).

Of the 30 higher risk precursors, design-related

errors caused 35 percent. Errors in the Design

and Engineering category contributed to the risk

of 9 out of 18 degraded conditions and 2 out of

13 initiating events.

Of the 13 precursors involving initiating events,

11 had no significant risk contribution from

human errors. Most of these events involved a

LOOP initiator caused by a fault outside the plant

boundary, such as grid-related and hurricanerelated LOOP events.

4.0 Summary

This section summarizes the ASP results, trends,

and insights.
7 Enclosure 2

• Significant precursors. No significant

precursors (i.e., CCDP or ΔCDP $1×10-3) were

identified in FYs 2005 or 2006. The ASP

Program provides the basis for the FY 2005

performance goal measure of “zero events per

year identified as a significant precursor of a

nuclear accident.” The NRC’s Performance

and Accountability Report for FY 2006 and the

NRC Performance Budget for FY 2007 will

report these results.

• Occurrence rate of all precursors. The

analysis divided the data from FY 1996 through

FY 2005 into two parts, FY 1996–2000 and FY

2001–2005, because of the ASP Program

scope increased (e.g., inclusion of external

events and SDP findings) in FY 2000. These

increases in scope have resulted in the

identification of an increasing number of lower

risk precursors (i.e., CCDP or ΔCDP <10-4). 

The analysis identified no trend for either of

these 5-year periods. The mean rate of

occurrence of all precursors in the time period

from FY 2001–2005 is higher than what is

observed during FY 1996 through FY 2000. In

addition to the increases in ASP Program

scope, the increased number of outlier events

(e.g., the 11 grid-related LOOP events in FY

2003 and FY 2004 and the 11 CRDM housing

cracking events between FY 2001 and FY

2003) accounts for the observed change.

Over the more recent time period from FY

2001–2005, the analysis detected a statistically

significant decreasing trend for higher risk

precursors (i.e., CCDP or ΔCDP $10-4).

The ITP uses this trend as one of the agency’s

monitored indicators. The NRC's Performance

and Accountability Report for FY 2006 and the

NRC Performance Budget for FY 2007 will

report these results.

5.0 References

1. U.S. Nuclear Regulatory Commission.

NUREG/CR-5750, “Rates of Initiating Events at

U.S. Nuclear Power Plants: 1987–1995.” 

Washington, DC. February 1999.

2. U.S. Nuclear Regulatory Commission. 

NUREG-1100, Vol. 21, “Performance Budget,

Fiscal Year 2006.” Washington, DC. February

2005.

3. U.S. Nuclear Regulatory Commission. 

NUREG/CR-6753, “Review of Findings for

Human Performance Contribution to Risk in

Operating Events.” Washington DC. August

2001.

4. U.S. Nuclear Regulatory Commission. 

NUREG/CR-6775, “Human Performance

Characterization in the Reactor Oversight

Process.” Washington, DC. September 2001.
8 Enclosure 2

Table 1. Status of ASP analyses (as of September 30, 2006).

Status FY 2004 FY 2005 FY 2006a

Analyzed events that were determined not to be precursors 27 32 2

Events to be further analyzed -- -- 50

ASP precursor analyses 15 7 –b

SDP (or MD 8.3) results used for ASP program input 2 8 –b

Total precursors identified 17 15 --

a. As of September 30, 2006, the staff has not yet screened all of the FY 2006 events and unavailabilities.

b. Based on historical data, expectations are that approximately 40 percent of ASP precursors will use SDP or MD 8.3 results. 

Table 2. FY 2004 precursors involving initiating events (as of September 30, 2006).

Event Date Plant Description CCDP

1/23/04 Calvert Cliffs 2 Reactor trip caused by loss of main feedwater and complicated by a

failed relay causing overcooling. LER 318/04-001 2×10-6

5/5/04 Dresden 3 Plant-centered LOOP due to breaker malfunction. LER 249/04-003 3×10-6

6/14/04 Palo Verde 1 Grid-related LOOP with offsite power recovery complications due to

breaker failure. LER 528/04-006 9×10-6

6/14/04 Palo Verde 2 Grid-related LOOP with an emergency diesel generator unavailable.

LER 528/04-006 4×10-5

6/14/04 Palo Verde 3 Grid-related LOOP with offsite power recovery complications due to

breaker failure. LER 528/04-006 9×10-6

9/25/04 St. Lucie 1 Severe weather LOOP caused by Hurricane Jeanne while the plant

was shut down. LER 335/04-004 1×10-5

9/25/04 St. Lucie 2 Severe weather LOOP caused by Hurricane Jeanne while the plant

was shut down. LER 335/04-004 1×10-5
9 Enclosure 2

Table 3. FY 2004 precursors involving degraded conditions (as of September 30, 2006).

Event

Datea

Condition

Durationb Plant Description ΔCDP

11/3/03 since plant

startup Surry 1

Potential loss of reactor coolant pump (RCP) seal cooling

due to postulated fire damage to emergency switchgear. 

LER 280/03-005

1×10-6

11/3/03 since plant

startup Surry 2 Potential loss of RCP seal cooling due to postulated fire

damage to emergency switchgear. LER 280/03-005 1×10-6

1/4/04 720 hours Brunswick 2 EDG “3” unavailable due to jacket water leak. LER 325/04-

001 2×10-6

2/3/04 since plant

startup Turkey Point 3 Triennial fire protection issues. LER 251/04-007 7×10-6

2/3/04 since plant

startup Turkey Point 4 Triennial fire protection issues. LER 251/04-007 7×10-6

2/19/04 61 hours Palo Verde 2

Failure to implement design of steam generator nozzle dam

requiring an extended time in reduced RCS inventory

configuration. IR 529/04-04, IR 529/04-09

1×10-5

3/17/04 1117 hours Peach Bottom 3 High-pressure coolant injection (HPCI) unavailable due to

failed flow controller. LER 278/04-001 2×10-6

7/31/04 11 yearsc Palo Verde 1 Containment sump recirculation potentially inoperable due

to pipe voids. LER 528/04-009 4×10-5

7/31/04 11 yearsc Palo Verde 2 Containment sump recirculation potentially inoperable due

to pipe voids. LER 528/04-009 4×10-5

7/31/04 11 yearsc Palo Verde 3 Containment sump recirculation potentially inoperable due

to pipe voids. LER 528/04-009 4×10-5

a. ASP event date is the discovery date for a precursor involving a degraded condition.

b. Condition duration is the time period when the degraded condition existed. The ASP Program limits the analysis exposure time of

degraded condition to 1 year.

c. Exact date not given. LER states that condition had existed since 1992 when the new feedwater control system was installed before

the power uprate.
10 Enclosure 2

Table 4. FY 2005 precursors involving initiating events (as of September 30, 2006).

Event Date Plant Description CCDP

10/10/04 Hope Creek Manual reactor scram due to moisture separator reheater drain line

failure. LER 354/04-010 3×10-6

11/20/04 Vogtle 2

Reactor trip with safety injection and full-open demand from steam

bypass valves caused by operator error and failed circuit card. 

LER 425/04-004

3×10-6

12/10/04 River Bend Reactor trip due to loss of a non-vital 120V instrument bus. LER

458/04-005 3×10-5

2/22/05 Watts Bar Low-temperature, over-pressure valve actuations while shut down. 

IR 390/05-03 7×10-6

4/17/05 Millstone 3 Inadvertent reactor trip and safety injection with failure of

turbine-driven AFW pump to start (recoverable). LER 423/05-002 3×10-6

6/23/05 Columbia Reactor trip due to feedwater pump trip cause by maintenance

personnel error. LER 397/05-004 1×10-5

8/29/05 Waterford Severe weather LOOP caused by Hurricane Katrina while plant was

shut down. LER 382/05-004 2×10-6
11 Enclosure 2

Table 5. FY 2005 precursors involving degraded conditions (as of September 30, 2006).

Event

Datea

Condition

Durationb Plant Description ΔCDP

10/19/04 682 hours Fort Calhoun EDG 2 inoperable for 28 days due to blown fuse. LER

285/04-002 4×10-6

11/22/04 6024 hours Watts Bar Component cooling backup line from essential raw cooling

water unavailable due to silt blockage. IR 390/04-05 8×10-6

1/27/05 10 yearsc Crystal River 3

Single-failure vulnerability of 4160 V engineered safeguard

feature (ESF) bus protective relay schemes caused by

common power metering circuits. LER 302/05-001 

5×10-6

2/2/05 13 yearsd LaSalle 1

Single-failure vulnerability of 4160 V ESF bus protective relay

schemes caused by common power metering circuits. 

LER 373/05-001

5×10-6

2/2/05 13 yearsd LaSalle 2

Single-failure vulnerability of 4160 V ESF bus protective relay

schemes caused by common power metering circuits. 

LER 373/05-001

5×10-6

 2/11/05 since plant

startup Kewaunee

Several design deficiencies could lead to unavailability of

AFW pumps during postulated events (e.g., high-energy line

break and tornado). LER 305/05-002, LER 305/05-006, LER

305/05-008

1×10-5

4/27/05 17 days Indian Point 2

Potential degradation of safety injection system due to

nitrogen accumulation from leaking accumulator. IR 50-

247/05-06

3×10-6

5/10/05 since plant

startup Kewaunee

Design deficiency could cause unavailability of safety-related

equipment during postulated internal flooding. LER 305/05-

004

Yellowe

a. ASP event date is the discovery date for a precursor involving a degraded condition.

b. Condition duration is the time period when the degraded condition existed. The ASP Program limits the analysis exposure time of

degraded condition to 1 year.

c. Exact date not given. LER states that condition had existed since a 1990 design modification.

d. Conditions had existed since design modifications completed on 03/08/91 for Unit 1 and 02/01/92 for Unit 2.

e. The result presented is the final significance determination under the Reactor Oversight Process. Separately, the licensee’s

numerical estimate was approximately 8×10-5. The staff confirmed that this condition meets the ASP Program threshold of a

precursor (i.e., ΔCDP >1×10-6), but does not exceed the threshold of a significant precursor (i.e., ΔCDP >1×10-3).
12 Enclosure 2

Table 6. Significant (CCDP or ΔCDP $1×10-3) accident sequence precursors during the 1969–2005 period in

order by event date. (See notes at the end of table)

Plant

ΔCDP

or

CCDP

Date Description

Davis-Besse 6×10-3 2/27/02

Multiple conditions coincident with reactor pressure vessel (RPV) head

degradation

The analysis included multiple degraded conditions discovered on various

dates. These conditions included cracking of CRDM nozzles and RPV head

degradation, potential clogging of the emergency sump, and potential

degradation of the high-pressure injection (HPI) pumps during recirculation. 

LER 346/02-002

Catawba 2 2×10-3 2/6/96

LOOP with an EDG unavailable

When the reactor was at hot shutdown, a transformer in the switchyard

shorted out during a storm, causing breakers to open and resulting in a

LOOP event. Although both EDGs started, the output breaker of EDG 1B, to

essential bus 1B failed to close on demand, leaving bus 1B without AC

power. After 2 hours and 25 minutes, operators successfully closed the EDG

1B output breaker. LER 414/96-001 

Wolf Creek 1 3×10-3 9/17/94

Reactor coolant system (RCS) blowdown to refueling water storage tank

(RWST)

When the plant was in cold shutdown, operators implemented two

unpermitted simultaneous evolutions, which resulted in the transfer of 9,200

gallons (34,825 liters) of RCS inventory to the RWST. Operators immediately

diagnosed the problem and terminated the event by closing the residual heat

removal (RHR) cross-connect motor-operated valve. The temperature of the

RCS increased by 7 EF (4 EC) as a result of this event.

LER 482/94-013

Harris 1 6×10-3 4/3/91

HPI unavailability for one refueling cycle

A degraded condition resulted from relief valve and drain line failures in the

alternative minimum flow systems for the charging/safety injection pumps,

which would have diverted a significant amount of safety injection flow away

from the reactor coolant system. The root cause of the degradation is

believed to have been water hammer, as a result of air left in the alternative

minimum flow system following system maintenance and test activities.

LER 400/91-008

Turkey Point 3 1×10-3 12/27/86

Turbine load loss with trip; control rod drive (CRD) auto insert fails;

manual reactor trip; power-operated relief valve (PORV) sticks open

The reactor was tripped manually following a loss of turbine governor oil

system pressure and the subsequent rapid electrical load decrease. Control

rods failed to insert automatically because of two cold solder joints in the

power mismatch circuit. During the transient, a PORV opened but failed to

close (the block valve had to be closed). The loss of governor oil pressure

was the result of a cleared orifice blockage and the auxiliary governor

dumping control oil. LER 250/86-039
Plant

ΔCDP

or

CCDP

Date Description

13 Enclosure 2

Catawba 1 3×10-3 6/13/86

Chemical and volume control system (CVCS) leak (130 gpm) from the

component cooling water (CCW)/CVCS heat exchanger joint (i.e., smallbreak loss-of-coolant accident (LOCA))

A weld break on the letdown piping, near the CCW/CVCS heat exchanger

caused excessive RCS leakage. A loss of motor control center power caused

the variable letdown orifice to fail open. The weld on the 1-inch (2.54-cm)

outlet flange on the variable letdown orifice failed as a result of excessive

cavitation-induced vibration. This event was a small-break LOCA. 

LER 413/86-031

Davis-Besse 1×10-2 6/9/85

Loss of feedwater; scram; operator error fails AFW; PORV fails open

While at 90-percent power, the reactor tripped with main feedwater (MFW)

pump 1 tripped and MFW pump 2 unavailable. Operators made an error in

initiating the steam and feedwater rupture control system and isolated EFW

to both steam generators (SGs). The PORV actuated three times and did not

reseat at the proper RCS pressure. Operators closed the PORV block

valves, recovered EFW locally, and used HPI pump 1 to reduce RCS

pressure. LER 346/85-013

Hatch 1 2×10-3 5/15/85

Heating, ventilation, and air conditioning (HVAC) water shorts panel;

safety relief valve (SRV) fails open; HPCI fails; reactor core isolation

cooling (RCIC) unavailable

Water from an HVAC vent fell onto an analog transmitter trip system panel in

the control room (the water was from the control room HVAC filter deluge

system which had been inadvertently activated as a result of unrelated

maintenance activities). This resulted in the lifting of the SRV four times. The

SRV stuck open on the fourth cycle, initiating a transient. Moisture also

energized the HPCI trip solenoid making HPCI inoperable. RCIC was

unavailable due to maintenance. LER 321/85-018

Lasalle 1 2×10-3 9/21/84

Operator error causes scram; RCIC unavailable; RHR unavailable

While at 23-percent power, an operator error caused a reactor scram and

main steam isolation valve (MSIV) closure. RCIC was found to be

unavailable during testing (one RCIC pump was isolated, and the other pump

tripped during the test). RHR was found to be unavailable during testing

because of an inboard suction isolation valve failing to open on demand. 

Both RHR and RCIC may have been unavailable after the reactor scram. 

LER 373/84-054

Salem 1 5×10-3 2/25/83

Trip with automatic reactor trip capability failed

When the reactor was at 25-percent power, both reactor trip breakers failed

to open on demand of a low-low SG level trip signal. A manual trip was

initiated approximately 3 seconds after the automatic trip breaker failed to

open, and was successful. The same event occurred 3 days later, at

12-percent power. Mechanical binding of the latch mechanism in the breaker

under-voltage trip attachment failed both breakers in both events.

LER 272/83-011
Plant

ΔCDP

or

CCDP

Date Description

14 Enclosure 2

Davis-Besse 2×10-3 6/24/81

Loss of vital bus; failure of an EFW pump; main steam safety valve lifted

and failed to reseat

With the plant at 74-percent power, the loss of bus E2 occurred because of a

maintenance error during CRDM breaker logic testing. A reactor trip

occurred, due to loss of CRDM power (bus E2), and instrumentation power

was also lost (bus E2 and a defective logic card on the alternate source). 

During the recovery, EFW pump 2 failed to start because of a maladjusted

governor slip clutch and bent low speed stop pin. A main steam safety valve

lifted, and failed to reseat (valve was then gagged). LER 346/81-037 

Brunswick 1 7×10-3 4/19/81

RHR heat exchanger damaged

While the reactor was in cold shutdown during a maintenance outage, the

normal decay heat removal system was lost because of a failure of the single

RHR heat exchanger that was currently in service. The failure occurred when

the starting of a second RHR service water pump caused the failure of a

baffle in the waterbox of the RHR heat exchanger, thereby allowing cooling

water to bypass the tube bundle. The redundant heat exchanger was

inoperable because maintenance was in progress. LER 325/81-032 

Millstone 2 5×10-3 1/2/81

Loss of DC power and one EDG as a result of operator error; partial

LOOP

When the reactor was at full power, the 125 V DC emergency bus was lost as

a result of operator error. The loss of the bus caused the reactor to trip, but

the turbine failed to trip because of the unavailability of DC bus A. Loads

were not switched to the reserve transformer (following the manual turbine

trip) because of the loss of DC bus A. Two breakers (on the B 6.9 kV and

4.16 kV busses) remained open, thereby causing a LOOP. EDG B tripped as

a result of leakage of the service water flange, which also caused the B 4.16 

kV bus to be de-energized. An operator recognition error caused the PORV

to be opened at 2380 psia. LER 336/81-005

St. Lucie 1 1×10-3 6/11/80

Reactor coolant pump seal LOCA due to loss of CCW; top vessel head

bubble

At 100-percent power, a moisture-induced short circuit in a solenoid valve

caused a CCW containment isolation valve to shut causing loss of CCW to all

RCPs. While pressure was reduced to initiate the shutdown cooling system

(SCS), the top head water flashed to steam, thus forming a bubble (initially

undetected by the operators). During the cooldown, the SCS relief valves

lifted and low-pressure safety injection (LPSI) initiated (i.e., one LPSI pump

started charging, while the other was used for cooldown). LER 335/80-029

Davis-Besse 1×10-3 4/19/80

Loss of two essential busses

When the reactor was in cold shutdown, two essential busses were lost

because of breaker ground fault relay actuation during an electrical lineup. 

The decay heat drop line valve was shut, and air was drawn into the suction

of the decay heat removal pumps, resulting in loss of a decay heat removal

path. LER 346/80-029
Plant

ΔCDP

or

CCDP

Date Description

15 Enclosure 2

Crystal River 3 5×10-3 2/26/80

Loss of 24-V DC power to non-nuclear instrumentation (NNI)

The 24-V power supply to the NNI was lost as a result of a short to ground. 

This initiated a sequence of events in which the PORV opened (and stayed

open) as a direct result of the loss of the NNI power supply. HPI initiated as a

result of depressurization through the open PORV, and with approximately

70 percent of NNI inoperable or inaccurate, the operator correctly decided

that there was insufficient information available to justify terminating HPI. 

Therefore, the pressurizer was pumped solid, one safety valve lifted, and flow

through the safety valve was sufficient to rupture the reactor coolant drain

tank rupture disk, thereby spilling approximately 43,000 gallons (162,800

liters) of primary water into the containment. LER 302/80-010 

Hatch 2 1×10-3 6/3/79

Loss of feedwater; HPCI fails to start; RCIC is unavailable

During a power increase, the reactor tripped because a condensate system

trip. HPCI failed to initiate on low-low level due to a failed turbine stop valve. 

In addition, water from leaking mechanical seal lines and an unknown valve

caused water to back up and contaminate the pump oil. RCIC was out of

service for unspecified reasons. LER 366/79-045

Oyster Creek 2×10-3 5/2/79

Loss of feedwater flow

During testing of the isolation condenser, a reactor scram occurred. The

feedwater pump tripped and failed to restart. The recirculation pump inlet

valves were closed. The isolation condenser was used during cooldown.

LER 219/79-014

Three Mile Island 2 1 3/28/79

Loss of feedwater; PORV failed open; operator errors led to core

damage

Operators misinterpreted plant conditions, including the RCS inventory,

during a transient that was triggered by a loss of feedwater and a stuck-open

PORV. As a result, the operators prematurely shut off the high-pressure

safety injection system, turned off the reactor coolant pumps, and failed to

diagnose and isolate a stuck-open pressurizer relief valve. With no RCS

inventory makeup, the core became uncovered and fuel damage occurred. In

addition, contaminated water was spilled into the containment and auxiliary

buildings. LER 320/79-012

Salem 1 1×10-2 11/27/78

Loss of vital bus and scram; multiple components lost

While the reactor was at 100-percent power, vital instrument bus 1B was lost

as a result of the failure of an output transformer and two regulating resistors. 

Loss of the vital bus caused a false low RCS loop flow signal, thereby

causing a reactor trip. Two EFW pumps failed to start (one because of the

loss of vital bus 1B, and the other because of a maladjustment of the

over-speed trip mechanism). Inadvertent safety injection occurred as a result

of decreasing average coolant temperature and safety injection signals.

LER 272/78-073

Calvert Cliffs 1 3×10-3 4/13/78

LOOP; one EDG failed to start

With the plant shut down, a protective relay automatically opened the

switchyard breakers, resulting in a LOOP. EDG 11 failed to start. EDG 22

started and supplied the safety busses. LER 317/78-020
Plant

ΔCDP

or

CCDP

Date Description

16 Enclosure 2

Farley 1 5×10-3 3/25/78

Low-Low water level in one SG trip/scram; turbine-driven EFW pump

fails

A low-level condition in a single SG resulted in a reactor trip. The turbinedriven EFW pump failed to start. Both motor-driven EFW pumps started, but

were deemed ineffective because all recirculation bypass valves were open

(thereby diverting flow). A recirculation valve was manually closed.

LER 348/78-021

Rancho Seco 1×10-1 3/20/78

Failure of NNI and steam generator dryout

When the reactor was at power, a failure of the NNI power supply resulted in a

loss of main feedwater, which caused a reactor trip. Because instrumentation

drift falsely indicated that the steam generator contained enough water,

control room operators did not act promptly to open the EFW flow control

valves to establish secondary heat removal. This resulted in steam generator

dryout. LER 312/78-001

Davis-Besse 5×10-3 12/11/77

EFW pumps inoperable during test

During EFW pump testing, operators found that control over both pumps was

lost because of mechanical binding in the governor of one pump and blown

control power supply fuses for the speed changer motor on the other pump. 

LER 346/77-110

Davis-Besse 7×10-2 9/24/77

Stuck-open pressurizer PORV

A spurious half-trip of the steam and feedwater rupture control system

initiated closure of the startup feedwater valve. This resulted in reduced

water level in SG 2. The pressurizer PORV lifted nine times and then stuck

open because of rapid cycling. LER 346/77-016

Cooper 1×10-3 8/31/77

Partial loss of feedwater; reactor scram; RCIC and HPCI degraded

A blown fuse caused the normal power supply to the feedwater and RCIC

controllers to fail. The alternate power supply was unavailable because of an

unrelated fault. A partial loss of feedwater occurred, and the reactor tripped

on low water level. RCIC and HPCI operated, however, both pumps did not

accelerate to full speed (RCIC because of the failed power supply and HPCI

because of a failed governor actuator). LER 298/77-040

Zion 2 2×10-3 7/12/77

Testing causes instrumentation errors

With the reactor in hot shutdown, testing caused operators to lose indications

of reactor and secondary system parameters. In addition, inaccurate inputs

were provided to control and protection systems. LER 304/77-044

Millstone 2 1×10-2 7/20/76

LOOP from grid disturbance; errors in EDG loading fail the ECCS

With the reactor at power, a main circulating water pump was started, which

resulted in an in-plant voltage reduction to below the revised trip set point. 

This isolated the safety-related busses and started the EDGs. Each time a

major load was tied onto the diesel, the revised under-voltage trip set points

tripped the load. As a result, at the end of the EDG loading sequence, all

major loads were isolated, even though the EDGs were tied to the safetyrelated busses. LER 336/76-042
Plant

ΔCDP

or

CCDP

Date Description

17 Enclosure 2

Kewaunee 5×10-3 11/5/75

Inoperable EFW pumps during startup as a result of leaks from the

demineralizer into the condensate storage tank (CST)

Mixed bed resin beads were leaking from the demineralizer in the makeup

water system and migrated to the CST. As a result, during startup, both

motor-driven EFW pump suction strainers became clogged, thereby resulting

in low pump flow. The same condition occurred for the turbine-driven EFW

pump suction strainer. LER 305/75-020

Brunswick 2 9×10-3 4/29/75

Multiple valve failures; RCIC inoperable as a result of stuck-open

down/safety valve

At 10-percent power, the RCIC system was determined to be inoperable, and

SRV B was stuck open. The operator failed to scram the reactor according to

the emergency operating procedures (EOPs). The HPCI system failed to run

and was manually shut down as a result of high torus level. Loop B of RHR

failed as a result of a failed service water supply valve to the heat exchanger. 

The reactor experienced an automatic scram on manual closure of the MSIV. 

LER 324/75-013

Browns Ferry 1 2×10-1 3/22/75

Cable tray fire

The fire was started by an engineer, who was using a candle to check for air

leaks through a firewall penetration seal to the reactor building. The fire

resulted in significant damage to cables related to the control of Units 1 and

2. All Unit 1 ECCS were lost, as was the capability to monitor core power. 

Unit 1 was manually shut down and cooled using remote manual relief valve

operation, the condensate booster pump, and control rod drive system

pumps. Unit 2 was shut down and cooled for the first hour by the RCIC

system. After depressurization, Unit 2 was placed in the RHR shutdown

cooling mode with makeup water available from the condensate booster

pump and control rod drive system pump. LER 259/75-006

Turkey Point 3 2×10-2 5/8/74

Failure of three EFW pumps to start during test

Operators attempted to start all three EFW pumps while the reactor was at

power for testing. Two of the pumps failed to start as a result of

over-tightened packing. The third pump failed to start because of a

malfunction in the turbine regulating valve pneumatic controller.

LER 250/74-LTR

Point Beach 1 5×10-3 4/7/74

Inoperable EFW pumps during shutdown

While the reactor was in cooldown mode, motor-driven EFW pump A did not

provide adequate flow. The operators were unaware that the in-line suction

strainers were 95 percent plugged (both motor-driven pumps A and B). A

partially plugged strainer was found in each of the suction lines for both

turbine-driven EFW pumps. LER 266/74-LTR

Point Beach 1 1×10-3 1/12/71

Failure of containment sump valves

During a routine check of the containment tendon access gallery, air was

observed leaking from the packing of one sump isolation valve. Operators

attempted to open the valve, but the valve failed to open because of a

shorted solenoid in the hydraulic positioner. The redundant sump isolation

valve was also found inoperable because of a stuck solenoid in the hydraulic

positioner. LER 266/71-LTR

NOTES:

• Events are selected on the basis of CCDPs, as estimated by the ASP Program.

• Because of model and data uncertainties, it is difficult to differentiate between events with CCDPs that are within a factor of about 3. 

• ASP analyses have been performed since 1969, and the associated methodologies and PRA models have evolved over the past 35

years. Consequently, the results obtained in the earlier years may be conservative when compared to those obtained using the

current methodology and PRA models.
18 Enclosure 2

Table 7. Precursors involving failure modes and event initiators that were not explicitly modeled in the PRA or

IPE concerning the specific plant at which the precursor event occurred.

Plant Year Event Description

Kewaunee 2005 Design deficiency could cause unavailability of safety-related equipment during

postulated internal flooding. LER 305/05-004

LaSalle 1 & 2

Crystal River 3 2005 Single-failure vulnerability of 4160 V ESF bus protective relay schemes caused by

common power metering circuits. LER 302/05-001, LER 373/05-001

Watts Bar 2005 Component cooling backup line from essential raw cooling water was unavailable

because silt blockage. IR 390/04-05

Watts Bar 2005 Low-temperature, over-pressure valve actuations while shut down. IR 390/05-03

Calvert Cliffs 2 2004 Failed relay causes overcooling condition during reactor trip. LER 318/04-001

Palo Verde 1, 2, & 3 2004 Containment sump recirculation potentially inoperable because of pipe voids.

LER 528/04-009

Shearon Harris 1 2003

Postulated fire could cause the actuation of certain valves which could result in a loss

of the charging pump, RCP seal cooling, loss of RCS inventory, and other conditions. 

LER 400/02-004

St. Lucie 2 2003 RPV head leakage because of cracking of CRDM nozzles. LER 389/03-002

Crystal River 3

Three Mile Island 1

Surry 1

North Anna 1 & 2

2002 RPV head leakage because of cracking of CRDM nozzle(s). LER 302/01-004, LER

289/01-002, LER 280/01-003, LER 339/01-003, LER 339/02-001

Columbia 2 2002 Common-cause failure of breakers used in four safety-related systems.

IR 397/02-05

Davis-Besse 2002 Cracking of CRDM nozzles and RPV head degradation, potential clogging of the

emergency sump, and potential degradation of the HPI pumps. LER 346/02-002

Callaway 2002 Potential common-mode failure of all AFW pumps because of foreign material in the

CST caused by degradation of the floating bladder. LER 483/01-002

Point Beach 1 & 2 2002

Potential common-mode failure of all auxiliary feedwater (EFW) pumps because of a

design deficiency in the EFW pumps’ air-operated minimum flow recirculation valves. 

The valves fail closed on loss of instrument air, which could potentially lead to pump

deadhead conditions and a common mode, non-recoverable failure of the EFW

pumps. LER 266/01-005

Harris 2002 Potential failure of RHR pump A and containment spray pump A because of debris in

the pumps’ suction lines. LER 400/01-003

Oconee 1, 2, & 3

Arkansas 1

Palisades

2001

RPV head leakage because of cracking of CRDM nozzle(s). LER 269/00-006, LER

269/02-003, LER 269/03-002, LER 270/01-002, LER 270/02-002, LER 287/01-001 ,

LER 287/01-003, LER 287/03-001, LER 313/01-002, LER 313/02-003, LER 255/01-

002, LER 255/01-004

Kewaunee 2001

Failure to provide a fixed fire suppression system could result in a postulated fire that

propagates and causes the loss of control cables in both safe-shutdown trains.

IR 305/02-06

Prairie Island 1 & 2 2000

A 1988 change in the backwash system for the cooling water pump drive shaft

bearing lubrication water supply system could result in loss of plant cooling water

during postulated LOOP conditions. LER 282/00-004

Oconee 1, 2, & 3 2000

Non-seismic 16-inch fire system piping header transited through the auxiliary building

and posed a potential flooding problem should the piping rupture during a seismic

event. IR 269/00-08
Plant Year Event Description

19 Enclosure 2

Cook 1 & 2 1999 Postulated high-energy line leaks or breaks in turbine building leading to failure of

multiple safety-related equipment. LER 315/99-026

Oconee 1, 2, & 3 1999 Postulated high-energy line leaks or breaks in turbine building leading to failure of

safety-related 4 kV switchgear. LER 269/99-001

Cook 2 1998 Postulated high-energy line break in turbine building leading to failure of all CCW

pumps. LER 316/98-005

Oconee 1, 2, & 3 1998

Incorrect calibration of the borated water storage tank (BWST) level instruments

resulting in a situation where the (EOP requirements for BWST-to-reactor building

emergency sump transfer would never have been met; operators would have been

working outside the EOP. LER 269/98-004

Haddam Neck 1996 Potentially inadequate RHR pump net positive suction head following a large- or

medium-break LOCA because of design errors. LER 213/96-016

LaSalle 1 & 2 1996 Fouling of the cooling water systems because concrete sealant injected into the

service water tunnel. LER 373/96-007

Wolf Creek 1996

Reactor trip with the loss of one train of emergency service water because of the

formation of frazil ice on the circulating water traveling screens with concurrent

unavailability of the turbine-driven AFW pump. LER 482/96-001
20 Enclosure 2

0.00

0.05

0.10

0.15

0.20

0.25

0.30

0.35

1988 1989 1990 1991 1992 1993 1994 1995 1996 1997 1998 1999 2000 2001 2002 2003 2004 2005

Fiscal Year

Occurrence Rate

Historical Precursors (FY 88-95)

FY 96-00 Precursors

FY 01-05 Precursors

Mean (FY 96-00)

Mean (FY 01-05)

Figure 1: Total Precursors– occurrence rate, by fiscal year. Data for FY 1988 through FY 1995 are shown for historical

perspective. Data from FY 2001 through FY 2005 represent the period with an increased ASP scope. No statistically

significant trend (p-value = 0.8608) is detected during the FY 2001–2005 period. Data from FY 1996 through 2000 are

charted separately since it is part of the data from within the last 10 years without the increase in ASP scope. No

statistically significant trend (p-value = 0.3735) is detected during the FY 1996–2000 period.
21 Enclosure 2

0

1

2

3

4

5

1996 1997 1998 1999 2000 2001 2002 2003 2004 2005 2006

Fiscal Year

Number of Precursors

Figure 2: Significant precursors (CCDP or ΔCDP 

$10-3)– number of precursors, by fiscal year. No trend

line is shown because no trend is detected that is

statistically significant (p-value = 0.4677). 

0.00

0.02

0.04

0.06

0.08

0.10

0.12

1996 1997 1998 1999 2000 2001 2002 2003 2004 2005

Fiscal Year

Occurrence Rate

FY 96-05 Precursors

Mean (with Northeast Blackout events excluded)

Mean (All Initiating Events)

Figure 3: Precursors involving initiating events–

occurrence rate, by fiscal year. The increasing trend is

statistically significant (0.0489). No statistically

significant trend (p-value = 0.3303) is detected when the

2003 Northeast blackout events are excluded.

0.00

0.05

0.10

0.15

0.20

0.25

0.30

1996 1997 1998 1999 2000 2001 2002 2003 2004 2005

Fiscal Year

Occurrence Rate

FY 96-00 Precursors

FY 01-05 Precursors

Mean (FY 96-00)

Mean (FY 01-05)

Figure 4: Precursors involving degraded conditions–

occurrence rate, by fiscal year. A statistically significant

decreasing trend (p-value = 0.0099) is detected during

the FY 2001–2005 period of increased ASP scope. No

statistically significant trend (p-value = 0.2100) is

detected during the period without the increase in ASP

scope (FY 1996–2000).

0.00

0.02

0.04

0.06

0.08

0.10

0.12

1996 1997 1998 1999 2000 2001 2002 2003 2004 2005

Fiscal Year

Occurrence Rate

FY 01-05 Precursors

Mean (with Northeast Blackout events excluded)

Mean (All LOOPs)

Figure 5: Precursors involving loss of offsite power

events– occurrence rate, by fiscal year. No statistically

significant trend (p-value = 0.0551) is detected during the

FY 1996–2005 period. No statistically significant trend

(p-value = 0.5109) is detected when the 2003 Northeast

blackout events were excluded.

0.00

0.05

0.10

0.15

0.20

0.25

0.30

0.35

1996 1997 1998 1999 2000 2001 2002 2003 2004 2005

Fiscal Year

Occurrence Rate

FY 96-00 Precursors

FY 01-05 Precursors

Mean (FY 96-00)

Mean (FY 01-05)

Figure 6: Precursors involving BWRs– occurrence

rate, by fiscal year. No statistically significant trend (pvalue = 0.0904) is detected during the FY 2001–2005

period of increased ASP scope. No statistically

significant increasing trend (p-value = 0.7773) is detected

during the period without the increase in ASP scope

(FY1996–2000).

0.00

0.05

0.10

0.15

0.20

0.25

0.30

1996 1997 1998 1999 2000 2001 2002 2003 2004 2005

Fiscal Year

Occurrence Rate

FY 96-00 Precursors

FY 01-05 Precursors

Mean (FY 96-00)

Mean (FY 01-05)

Figure 7: Precursors involving PWRs– occurrence

rate, by fiscal year. No statistically significant trend (pvalue = 0.8111) is detected during the FY 2001–2005

period of increased ASP scope. No statistically

significant trend (p-value = 0.2225) is detected during the

period without the increase in ASP scope (FY

1996–2000).
22 Enclosure 2

1.E-06

5.E-05

1.E-04

1996 1997 1998 1999 2000 2001 2002 2003 2004 2005

Fiscal Year 

Annual ASP Index (per reactor year)

Significant precursors

All other precursors

Long-term degraded important precursors

Enhanced SPAR Model CDF

SPAR Model Average CDF

Average Annual ASP Index

Figure 8: Integrated ASP Index– risk contribution from precursors, per fiscal year. The risk contribution from precursors

involving degraded conditions is included in all fiscal years when the degraded condition existed. The risk contribution from

precursors involving initiating events is included only in the fiscal year in which the event occurred.
23 Enclosure 2

0% 5% 10% 15% 20% 25% 30% 35% 40% 45%

Command and Control

Operator Training/Knowledge

Operator Action/Inaction

Communications

Inadequate Procedures

Design deficiencies

Design Change Testing

Design and Engineering Review

Ineffective Abnormal Control Indications

Configuration M anagement

Work Package, QA, & Use

M aintenance Action

Inadequate M aintenance Knowledge

Inadequate Post-M aintenance Testing

Failure to Follow Industry Notices

Failure to Follow Industry Practices

Failure to Trend/Use Problem Reports

Failure to Correct Deficiencies

M anagement Oversight

Inadequate M anagement Knowledge

Organization

Error subcategory

Precentage of precursors with at least one error in a subcategory

Precursors

Figure 9: Percentage of precursors with at least one error in an error subcategory.
1 Enclosure 3

Standardized Plant Analysis Risk Model and Other Probabilistic Risk

Assessment Lessons Learned from Mitigating Systems Performance

Index Development and Implementation

1.0 Introduction

The Standardized Plant Analysis Risk (SPAR) Model Development Program has played an

integral role in the Accident Sequence Precursor (ASP) Program analysis of operating events. 

In a complementary fashion, one of the objectives of the ASP Program is to use plant operating

experience results and insights for feedback to the SPAR models, as well as to licensee

probabilistic risk assessment (PRA) models. In addition, the use of SPAR models as part of the

ASP Program and the significance determination process (SDP) Phase 3 evaluations also

provides the opportunity for review and benchmarking of the SPAR models against the licensee

PRA models in cases where the licensee also provides risk-related input to the ASP and SDP

evaluations.

In a similar manner, over the past year, as part of the NRC’s efforts to implement the Mitigating

Systems Performance Index (MSPI), the staff used SPAR models as a tool to help determine

and verify the quality of PRAs needed for MSPI implementation. This MSPI PRA quality task

provided many lessons learned in terms of modeling and data found in the SPAR models and in

licensee PRA models. This enclosure summarizes these lessons learned.

2.0 Background

The MSPI is formulated as a simplified linear approximation of the change in core damage

frequency (CDF) attributable to changes in the reliability and availability of risk-significant

elements of a plant system in response to internal initiating events with the reactor operating at

power. The Birnbaum importance of a basic event is the partial derivative of the CDF with

respect to the basic event probability in a PRA model and provides a measure of the risk

sensitivity of a plant component to CDF.

The Birnbaum importance measures of the monitored components are critical inputs to the

MSPI calculation, and each licensee determines its measures by using its PRA model. An

important aspect of PRA quality for MSPI implementation is the comparison of Birnbaum values

within different classes of plant design. The Birnbaum values for like components modeled in

the PRAs for two plants of similar design should be relatively close. For example, two four-loop

pressurized-water reactors (PWRs) of the same thermal rating, with similar numbers and

ratings of emergency diesel generators, auxiliary feedwater system pumps, and emergency

core cooling system components, should generally have Birnbaum values for like components

that agree to within about a factor of 3 based on previous staff reviews. Greater differences

can be attributable to the following:

• Important differences in balance-of-plant design, particularly electrical power and cooling

water dependencies, or plant backfits can result in two otherwise similar plant designs having

divergent values.

• Differences in operating procedures and plant equipment performance may occur because 

some plants may have implemented off-normal or emergency operating procedures to

address risk-significant scenarios. In other cases, the plant equipment performances might

differ, and these are reflected in differing PRA model inputs and outputs.
2 Enclosure 3

• Finally, PRA modeling assumptions and methods may differ. Two different organizations

may have prepared the PRA models for two sister plants and used different software and

databases and/or different levels of detail in their modeling.

In this regard, the SPAR models representing all 103 operating plants have proven useful in

establishing a benchmark for this effort. Because the SPAR models use identical industryaverage failure rates and similar modeling techniques, two of the three elements contributing to

differences in plant Birnbaum values can be eliminated. Theoretically, any differences that exist

for Birnbaum values for like components in a group of sister plants would arise from differences

in plant design. In many cases, very subtle differences such as the direct current (DC) power

dependencies or the installation of a nonsafety pump can account for an order of magnitude or

more difference in Birnbaum values.

3.0 Use of SPAR Models to Address PRA Quality in MSPI

The staff used the SPAR models as part of its review of the technical adequacy of the licensee

PRA models for implementation of the MSPI in FY 2006. The staff obtained PRA information

from the industry in the form of Birnbaum importance measures at the basic-event level from

the draft MSPI basis documents provided by the licensees in September 2005. The staff

assigned plants to SPAR groups based on specific design characteristics. Plant PRA model

Birnbaums were then compared to the Birnbaums of the SPAR group. If the Birnbaums were

comparable, the staff eliminated the plant PRA model component as a possible outlier. If not

comparable, the staff then reevaluated each candidate outlier to determine if the basic event

was in the appropriate group. Basic event Birnbaums were reassigned to different groups as

appropriate and the process repeated. The staff then evaluated the remaining plant

components that could not be eliminated by the above screening against the following three

criteria: 

• Was the Birnbaum different because of an identifiable design feature?

• Was the Birnbaum different because of an identifiable operations feature (data, procedure)?

• Was the Birnbaum different because of an identifiable modeling method difference?

The review encompassed design features, operations features, or modeling method, as

appropriate. If the modeling or method was acceptable to the staff, it eliminated the basic event

as a possible outlier. In addition, the staff used the industry’s own PRA cross-comparison

efforts, in the form of Westinghouse Owners Group (WOG) and Boiling Water Reactors

Owners Group (BWROG) reports (References 2 and 3), to attempt to address candidate

outliers. If the information available to the NRC reviewers was not adequate to explain the

outlier issue, the staff usually contacted the licensee in an effort to resolve the issue. Those

candidate outliers that could not be resolved by this review effort were then characterized as

final outliers.

For each final outlier, the staff contacted the licensee and explained why the staff believed the

plant PRA value was an outlier. Each licensee had an opportunity to resolve the concern. 

Often, this involved performing PRA model sensitivity studies, providing relevant procedures

and data, or providing relevant PRA model calculations. The staff continued to work with the

industry until all MSPI outlier concerns were resolved, either by the staff’s acceptance of the

reason for the Birnbaum value difference, or by the licensee changing its PRA model. Various

plants made over one dozen PRA model changes as a result of this comprehensive review

effort. In addition, the SPAR models were changed, in part to address needed enhancements

identified in the outlier review process.
3 Enclosure 3

4.0 SPAR Model Changes

A number of changes to the SPAR models have been or are being implemented as a result of

the MSPI PRA outlier identification and resolution process. In most cases, these same issues

had been identified as part of the overall SPAR model enhancement effort, and were being

implemented one plant model at a time consistent with previously planned model updates. The

following describes some of the more significant SPAR modeling issues that arose during the

PRA outlier resolution process.

Loss of vital alternating current (AC) bus frequency. During the review of a number of

candidate outliers for auxiliary/emergency feedwater pumps for PWRs, the staff found that the

loss of AC bus (with no recovery) frequency used in the SPAR model was significantly higher

than that used by most of the industry. This manifested itself in Birnbaum importance values

for such pumps being much higher in the SPAR model than in the licensees’ PRAs. In its

review of the operating events database used for SPAR, the staff found that 75 percent of the

original events listed were not applicable and should be eliminated from the data, and that the

loss of vital AC bus frequency should decrease by about a half order of magnitude. The staff is

incorporating these changes into the SPAR models as it updates each model.

Loss of vital DC bus frequency. Similar to the preceding issue regarding the loss of vital AC

bus frequency, staff reviews identified that the loss of vital DC bus (with no recovery) frequency

in the SPAR models was significantly higher than that used by most of the industry. Review of

the operating events database used for SPAR found that two out of three of the original events

listed should be eliminated from the data, and that the loss of vital DC bus frequency should

decrease by about a half order of magnitude. The staff is incorporating these changes into the

SPAR models as it updates each model.

Loss of vital electrical bus event modeling. During the process of addressing PRA

candidate outliers, the staff identified asymmetries in the Birnbaum values for some pumps both

within the SPAR models and within the licensees’ PRA models. For example, the Birnbaum

value for the emergency feedwater pump on one safety train might be high, while the value for

the opposite train was low. In some cases, the asymmetry represented real plant design

asymmetry regarding power supply dependencies. In other cases, this asymmetry was an

artifact of the method the licensee used to model test and maintenance unavailability. In still

other cases, the SPAR model used the simplifying approach of modeling the loss of only one

electrical division, usually the more important division, while doubling the frequency as

appropriate. This modeling assumption manifested itself in incorrect Birnbaum values for some

key components in the SPAR models. The staff is changing the SPAR models to explicitly treat

the loss of each risk-significant electrical bus separately, as appropriate.

Single loss-of-service-water frequency value for all sites. The SPAR models use a single,

operating experience-based value for the total loss-of-service- water frequency at all plants

irrespective of plant design and site characteristics, e.g., ocean site versus inland river location

with cooling towers. However, during its reviews, the staff noted significant site-to-site

variations for loss-of-service- water frequency used in licensee PRAs. As a consequence, the

staff has initiated a task to identify the feasibility and data needs for developing site-specific

frequencies for loss of service water. If successful, this effort may lead to the development of

plant-specific initiator fault trees for events such as loss of service water, loss of component

cooling water, and loss of instrument air.
4 Enclosure 3

In addition to the above anticipated model changes, the SPAR Model Development Program

will address a number of long outstanding issues. Many of these issues became evident during

the MSPI PRA outlier identification and resolution process. Examples include the following:

• the need to perform confirmatory thermal-hydraulic (T-H) analyses in support of system

success criteria that differ from the standard set in the SPAR models, e.g., number of

pressurizer power-operated relief valves (PORVs) needed for bleed and feed success in

PWRs

• development of a standard approach for recovery from station blackout after battery

depletion

• development of a standard approach for modeling BWR reactor vessel injection following

gradual containment overpressurization owing to loss of suppression pool cooling

The staff has identified the need for extensive T-H analyses in a number of areas to provide

more solid technical bases for success criteria and operator action timing, consistent with

requirements set forth in the American Society of Mechanical Engineers (ASME) PRA standard

(Reference 1), for example. As part of the Risk Assessment Standardization Project (refer to

Enclosure 1 for details about RASP), the staff is developing a multiyear plan and schedule. 

This work plan will be completed in FY 2007.

5.0 Licensee PRA Model Issues

During the MSPI PRA outlier resolution process, the staff identified a number of common issues

in some of the licensees’ PRA models. In conjunction with the licensees, the staff ultimately

resolved most of these issues. The following describes several of the more important issues

that were frequently observed.

Loss of offsite power (LOOP) issues. The PRA outlier screening process identified a number

of emergency diesel generator (EDG) Birnbaum values from the licensees’ PRAs that appeared

low compared to those within the industry plant group, or compared to the SPAR model values. 

Most of these issues related in some form to one or more of the following:

• the application of convolution integrals for assessing more accurately the timing of

equipment failures and the impact on offsite power recovery

• low contribution from one or two components to the total LOOP frequency, e.g., weatherrelated or grid-related 

• the treatment of alternate power supplies as partially or totally independent from the LOOP

events in the data, e.g., 161-kV or 69-kV emergency power source 

The staff obtained and reviewed several detailed offsite power recovery calculations using

convolution integrals. In most cases, the net effect of these analyses is to reduce the

contribution of LOOP/station blackout sequences to CDF. The reduction is a function of the

degree of redundancy of emergency power supplies, the number and diversity of equipment

available for coping with the station blackout event, and critical timing issues such as core

uncovery and battery depletion. The staff found the analyses to be acceptable and was able to

resolve several PRA outlier issues.
5 Enclosure 3

The LOOP frequency comprises several elements. While there are plant-to-plant variations in

the modeling of LOOP events, generally the elements consist of grid-related, plant-centeredrelated, and severe weather-related components. In several cases, the staff determined that

the licensee’s model had not included the weather-related component as is accepted practice

for most PRAs, and the licensee agreed to incorporate that component. In several other cases,

the licensee used a grid-related component lower than the norm because that plant’s

geographic location makes it less susceptible to grid-related events, as most grid-related events

tend to occur in the Northeast. The staff generally found the analyses to be reasonable in this

regard. In at least one case, the PRA model for a plant in the Northeast revised its PRA model

to reflect a higher contribution of grid-related events, based on regional operating experience

data.

Finally, a number of plant PRA models had LOOP frequencies substantially lower than the

norm based on quantitative credit taken for alternate or emergency offsite power supplies from

161-kV or 69-kV lines, for example. The staff agreed that such alternate power supplies

provided a safety benefit. However, the staff’s concern was with how the LOOP data were

being applied within the PRA model in question. The LOOP data compiled by Idaho National

Laboratory are for total losses. The data already include the loss of primary and secondary

sources of offsite power at plant sites. No data had been collected on partial LOOP events

which might prove useful to licensees in their plant-specific analyses. Rather, several licensees

used the total LOOP data in effect as partial LOOP data, then credited plant-specific features

such as an emergency reserve auxiliary transformer to effectively reduce the probability of

sequences leading to core damage. In the absence of reliable data for partial LOOP events,

the licensees’ methods were not appropriate. Licensees agreed to revise their LOOP analyses

after the staff expressed these concerns.

Loss-of-service-water frequency. As discussed above, the SPAR models use a value based

an operating experience for the total loss of service/raw water (LOSW) frequency. The value is

an estimate based on the number of applicable reactor-years in the United States with no

observed, sustained total loss during power operation. Aware of the wide variability of site

characteristics and service water system design, the staff generally had minimal concerns

about plant-specific frequencies that differed from the SPAR value. However, in several

instances, the staff observed LOSW frequencies that were as much as two orders of magnitude

below the SPAR value and most generally accepted values used in the industry PRA models. 

The staff was particularly concerned when the site in question had experienced precursors to

LOSW events such as frazil ice, sea grass clogging of screens, debris infiltration, and other

events. The staff requested the licensees to reconsider their initiator frequencies in light of

operating experience, and most licensees agreed to increase the LOSW frequencies to varying

degrees and as much as an order of magnitude in two cases.

Credit for reactor pressure vessel (RPV) injection following BWR containment

overpressure. The staff observed a number of instances in which Birnbaum values for EDGs,

residual heat removal pumps, and/or emergency service water (ESW) pumps in the licensees’

PRAs were lower than expected. Closer review revealed that the amount of credit taken for

RPV injection following BWR overpressure could have a significant impact on CDF and

Birnbaum values. In two cases, sensitivity studies performed by the licensees indicated that

this credit reduced the internal events CDF by factors of about 2 to 3. Additionally, Birnbaum

values for important components such as EDGs and ESW pumps would increase by an order

of magnitude without such credit.
6 Enclosure 3

The staff conducted extensive reviews for several plants where this credit appeared to be a

factor in the PRA outlier status. Information useful to the staff in its reviews included:

• potential containment failure modes, pressures, and locations

• location of piping penetrations

• systems credited for injection

• location and environmental qualification of mitigating equipment

• reactor/auxiliary building room heatup calculations from steam ingress

• dependencies and location of equipment necessary to depressurize the reactor and keep the

safety relief valves open

• location of backup nitrogen supplies

• time available for operator action

• containment event trees to address the phenomena

• sensitivity studies of the potential impact of various key assumptions.

The staff reviewed all relevant information in detail and found the information provided by the

licensee to be acceptable for MSPI implementation. The staff plans a number of additional

studies associated with these issues as part of RASP.

Station blackout mitigation after battery depletion. A number of licensees took significant

credit for station blackout mitigation following station battery depletion. The staff’s primary

concern is with the ability to monitor critical process variables, control important equipment, and

operate high-voltage circuit breakers in the absence of DC power. In several instances, the

licensee informed the staff of the availability of batteries dedicated to switchyard operation. 

Additionally, licensees provided information on relevant procedures and training for the

mitigation measures in question. The staff reviewed the information on an individual basis. 

Where the licensees provided sufficient bases for the credit, the staff accepted the modeling for

the purpose of MSPI implementation. In one case, the licensee agreed to not credit operator

recovery actions for certain sequences. 

6.0 Generic Industry PRA Issues

The staff identified several PRA issues generic to the industry during the MSPI PRA outlier

resolution process. The following describes three of the more significant examples.

Model truncation and convergence. The ASME PRA standard provides specific guidance

and instruction regarding appropriate PRA model truncation levels and CDF convergence. 

During its reviews, the staff identified several concerns about the truncation levels in some of

the preliminary PRA model quantifications performed by licensees. In several instances, the

licensees did not demonstrate an adequate degree of convergence of the CDF in the PRA

model. In other cases, while the analysis showed the CDF to be adequately converged, the

licensees did not demonstrate adequate convergence of the Birnbaum values (derived from the

CDF and Fussell-Vesely values). Sensitivity studies performed by the staff, as well as those
7 Enclosure 3

published in the open literature, have identified that in many instances truncation levels need to

be an order of magnitude or more lower for Birnbaum values to be converged to the same

precision as CDF, especially for low Fussell-Vesely and Birnbaum values. In one instance, the

licensee demonstrated by way of sensitivity study that reduction of the truncation level from

3×10-11 to 1×10-12 resulted in a 17 percent increase in CDF and a 30 percent increase in the

Birnbaum value for the component in question.

As a result, the MSPI working group specified several options for the licensees to use in their

PRA model quantification. The default option is to use a truncation level seven orders of

magnitude lower than the baseline CDF. Thus, if the baseline CDF is, for example, 1×10-5/yr, a

truncation limit of 1×10-12/yr would be acceptable. However, for a number of licensees, their

PRA models were too large or the number of cut-sets generated too great to allow

quantification in a reasonable amount of time. Therefore, the working group provided two

alternative approaches. One alternative allowed for the derivation of Birnbaum importance

measures for monitored components based on first principles, i.e., by requantification of the

model with basic event probability set to 1.0 (failed). The second alternative approach allowed

for use of higher truncation limits by demonstrating adequate convergence of the Birnbaum

value for the monitored component(s) in question. The staff was satisfied that the licensees

ultimately demonstrated adequate levels of truncation and convergence for MSPI

implementation.

Small loss-of-coolant accident (LOCA) frequency. During the PRA outlier resolution

process, the staff identified a systematic bias in the Birnbaum values for the high-pressure

safety injection (HPSI) pumps in the SPAR models. Overlaying the plots of the distribution of

Birnbaum values from the SPAR models and from industry PRAs for PWRs demonstrated that,

on average, SPAR HPSI pump values were significantly lower than industry values. Review of

the underlying data from industry and SPAR clearly showed that the industry’s small LOCAinitiating event frequencies were significantly higher than the mean value of 4×10-4/yr used in

the SPAR models. For example, WCAP-16464-NP (Reference 2) provides the small LOCA

initiator frequencies for Westinghouse/Combustion Engineering plants. The median initiator

frequency for this group of plants is approximately 3×10-3/yr, or nearly an order of magnitude

higher than the SPAR value. The data also indicate a range of plant-specific frequencies

spanning a factor of about 40 from a low of 2.5×10-4/yr to a high of 1×10-2/yr. While the

definition of “small” LOCAs can vary from plant to plant, this variation would appear to exceed

reasonable expectations. For example, plant-specific LOCA analyses may define “small-break”

LOCAs to be between 1/2-inch and 2-inch equivalent diameter sizes at one plant, while another

plant might have used 3/8-inch as the lower bound and 1.9-inch as the upper bound. 

Regardless, these small differences in the definition of break size can hardly account for the

large variation in initiator frequencies. 

While there generally is good consistency across the industry as to what constitutes mediumbreak and large-break LOCAs, such is not the case with small LOCAs. Some licensees include

mechanical failure of reactor coolant pump seals in the small LOCA category, while others have

split off the low end of the small LOCA spectrum and created small-small or very small LOCA

categories, which have altogether different success criteria than small LOCAs. A consequence

of this inconsistency in small LOCA definition and variation in small LOCA frequency is the

difficulty of making direct comparisons between the SPAR models and the industry PRA models

as a whole. The industry could significantly enhance PRA modeling by standardizing the

process for defining LOCAs and for apportioning the total LOCA frequency in those cases

where some plant-to-plant variation is necessary because of design differences.
8 Enclosure 3

PORV success criteria for bleed and feed. In a few cases, the PRA outlier resolution

process identified major differences in the Birnbaum values for auxiliary feedwater (AFW)

pumps that were attributable to variation in success criteria for pressurizer PORVs for bleed

and feed. For example, a number of plants have used 2-of-2 PORVs in their success criteria,

while other plants have specified 1-of-2. Still other plants have used a combination of 2-of-2

and 1-of-2 based on sequence specific circumstances. While there are design and procedural

reasons for such variation (specifically, reactor thermal power rating and PORV relief capacity),

often the success criterion is the result of the degree of analysis undertaken by the licensee. In

one case, the staff reviewed nearly a thousand pages of analysis prepared, in part, to establish

plant-specific success criteria. The staff’s review of WCAP-16464-NP (Reference 1), which

summarizes bleed-and-feed success criteria as well as PORV relief capacity, identified some

lack of consistency within the industry in this regard. 

For some plants with a high degree of redundancy and diversity of power supplies for AFW, for

example, the calculated CDF and overall risk profile may not be sensitive to this criterion. For

still other plants, it has been demonstrated that the CDF can vary by as much as a factor of 2 or

3 depending on this criterion. One objective of the SPAR Model Development Project is to

account for plant-specific variation in design, and hence success criteria, for the use of such

mitigation strategies as bleed and feed. However, it is not possible to duplicate the wide

variation in success criteria while still maintaining the degree of standardization desired in the

SPAR models, especially if the industry has different success criteria. As discussed above, the

staff is initiating a study to perform confirmatory analyses in support of system success criteria

that differ from the standard set in the SPAR models (e.g., the number of pressurizer PORVs

needed for bleed-and-feed success in PWRs). This study is being performed as part of RASP.

 

7.0 Comparison of Licensee PRA Model CDF with SPAR Model CDF

The staff compared the April 1, 2006, licensee CDF values to the most current SPAR values. 

Although only about half of the SPAR models have undergone the latest phase of

enhancement, 80 percent of the SPAR model CDFs are presently within a factor of 2 of

licensees’ internal events model CDFs. The average SPAR model CDF is approximately

8 percent higher than the average licensee CDF, so no significant systematic bias in the SPAR

models is evident. The staff considers this a strong validation of SPAR model fidelity.

8.0 Summary of Results

Implementation of the MSPI represents a major step forward for risk-informed performance

indicators. It is widely perceived as the first industrywide application using a structured process

to address PRA quality. 

Before MSPI implementation, the staff established a systematic process to understand PRA

modeling differences. This process examined differences both within the industry, by

comparing PRA values for classes of similar plants, and between plant PRA models and the

NRC’s own SPAR models.

The process identified PRA differences with the potential to impact the MSPI, then set out to

identify whether those differences originated in bona fide design differences, differences in

plant operating procedures and performance, or PRA modeling methods and assumptions. In

the process, the staff screened in over 260 candidate PRA outliers, which eventually

consolidated to several dozen plant-specific issues. The staff then addressed these issues in

detail and resolved all PRA outliers before MSPI implementation on April 1, 2006. From these

PRA reviews, the staff gained important insights into potential enhancements to both the NRC’s
9 Enclosure 3

SPAR models and the industry PRA models. As part of RASP, the staff is now planning to

address the most important remaining issues affecting SPAR model fidelity.

9.0 References

1. American Society of Mechanical Engineers, ASME RA-S-2002, “Standard for Probabilistic

Risk Assessment for Nuclear Power Plant Applications,” April 5, 2002, and Addenda,

December 2005.

2. Armstrong, J. and R. Schneider, “Westinghouse Owner’s Group Mitigating Systems

Performance Index Cross Comparison,” WCAP-16464-NP, Revision 0 (proprietary),

August 2005.

3. BWR Owners Group Integrated Risk-Informed Regulation Committee, “BWR Owner’s

Group MSPI Cross Comparison Preliminary Results,” NEDO-33215, Class I (proprietary),

September 2005.

4. Dube, D.A., C.L. Atwood, S.A. Eide, B.B. Mrowca, R.W. Youngblood, and D.P. Zeek,

“Independent Verification of the Mitigating Systems Performance Index (MSPI) Results for

the Pilot Plants, Final Report,” NUREG-1816, U.S. Nuclear Regulatory Commission,

February 2005. 

5. Eide, S.A., C.D. Gentillon, T.E. Wierman, and D.M. Rasmuson, “Reevaluation of Station

Blackout Risk at Nuclear Power Plants, Analysis of Loss of Offsite Power Events: 1986-

2004,” NUREG/CR-6890, Vol. 1, Idaho National Laboratory, December 2005.

6. O’Reilly, P.D., F.M. Reinhart, D.A. Dube, E.B. Goldfeiz, D.M. Rasmuson, S. Sancaktar,

and J.A. Vail, “The NRC’s SPAR Model Enhancement Program: Objectives, Status,

Implication,” PSA ‘05, San Francisco, CA, September 2005.