Risk Assessment of Operational Events 

Volume 4 – Shutdown Events 

Revision 1.0 

April 2011 

SDP Phase 3 ● ASP ● MD 8.3
Risk Assessment of Operational Events ii 
 iii Handbook Vol. 4 – Shutdown Events 

TABLE OF CONTENTS 

1.0 Introduction ................................................................................................................... 1-1

1.1 Objectives ................................................................................................................. 1-1

1.2 Scope of the Handbook ............................................................................................. 1-1

1.3 Audience for the Handbook ....................................................................................... 1-2

1.4 Handbook Content .................................................................................................... 1-2

1.5 Companion References to the Handbook .................................................................. 1-3

1.6 Questions, Comments, and Suggestions ................................................................... 1-4

1.7 References ................................................................................................................ 1-5

2.0 Scope and Summary .................................................................................................... 2-1

2.1 Scope ........................................................................................................................ 2-1

2.2 Summary ................................................................................................................... 2-1

2.3 Currently Available Tools, Models and Documents .................................................... 2-2

2.4 Status of SD Models .................................................................................................. 2-2

2.5 Examples of “Old” versus “New” Models .................................................................... 2-3

2.6 New Tool (Shutdown Core Uncovery Calculator) ....................................................... 2-3

2.8 Additional Considerations for Shutdown Risk Analysis .............................................. 2-9

2.9 Example CCDPs and CDPs ....................................................................................... 10

2.10 References .............................................................................................................. 2-11

3.0 Scenario Definition and Quantification .......................................................................... 3-1

3.1 Scenario Types ......................................................................................................... 3-1

3.2 Process Outline ......................................................................................................... 3-1

4.0 Shutdown Event Analysis .............................................................................................. 4-1

4.1 Examples 4.1a and 4.1b ............................................................................................ 4-1

4.2 Example 4.2 .............................................................................................................. 4-3

5.0 Shutdown Condition Analysis – 1 POS ......................................................................... 5-1

5.1 Example 5.1 .............................................................................................................. 5-1

5.2 Example 5.2 .............................................................................................................. 5-1

6.0 Shutdown Condition Analysis – Multiple POSs ............................................................. 6-1

7.0 Cases Where No SPAR-SD Model Exists ..................................................................... 7-1

7.1 Example Condition Analysis – Modify At-Power Model .............................................. 7-1

7.2 Example Event Analysis – Create New ET ................................................................ 7-1

8.0 Miscellaneous SD-Related Considerations ................................................................... 8-1

8.1 Core Damage ............................................................................................................ 8-1

8.2 RHR Recovery in the Long Term ............................................................................... 8-1

8.3 Containment Integrity ................................................................................................ 8-1

8.4 Sequence Mission Time ............................................................................................ 8-2

8.5 Shutdown Procedures ............................................................................................... 8-2

8.6 Equipment Availability ............................................................................................... 8-2

8.7 Transition Risk and Low Power ................................................................................. 8-2

8.8 Over-Drain Events during Mid-Loop Operation – PWR .............................................. 8-2

8.9 Decay Heat Time Windows ....................................................................................... 8-4
Risk Assessment of Operational Events iv 

8.10 System Success Criteria ........................................................................................... 8-4

8.11 Alarms, Interlocks, and Automatic Actions ................................................................. 8-4

8.12 Electrical Power ......................................................................................................... 8-4

8.13 Valve Alignment ........................................................................................................ 8-4

Appendix A – Model and Data for Shutdown Events ............................................................... A-1

Appendix B – Treatment of Operator Actions in Shutdown Scenarios ..................................... B-1
 v Handbook Vol. 4 – Shutdown Events 

ACRONYMS 

AC alternate current 

AFW auxiliary feedwater 

ASP accident sequence precursor 

ATHEANA a Technique for Human Event Analysis 

ATWS anticipated transient without scram 

 

BWR boiling-water reactor 

 

CCDP conditional core damage probability 

CD core damage 

CDF core damage frequency 

CDP core damage probability 

 

DH decay heat 

DHR decay heat removal 

DT duration time 

 

ET event tree 

 

FT fault tree 

 

HEP human error probability 

HFE human failure event 

HHSI high-head safety injection 

 

IMC inspection manual chapter 

 

LOI loss of inventory 

LOOP loss of offsite power 

LORHR loss of residual heat removal 

LPI low-pressure injection 

LTOP low-temperature over-pressurization 

 

MCR main control room 

MMG model maker’s guideline (shutdown) 

MWHUT miscellaneous waste holdup tank 

 

NRC U.S. Nuclear Regulatory Commission 

 

OD over-drain 

 

POS plant operating state 

PRA probabilistic risk assessment 

PWR pressurized-water reactor 

 

RCS reactor coolant system 

RHR residual heat removal 

 
Risk Assessment of Operational Events vi 

SAPHIRE Systems Analysis Programs for Hands-on Integrated Reliability Evaluations 

SD Shutdown 

SDP Significance determination process 

SG steam generator 

SI safety injection 

SPAR Standardized Plant Analysis Risk 

SRA senior reactor analyst 

SRO senior reactor operator 

STW sequence time window 

 

TDP turbine-driven pump 

T/M test or maintenance 
 1-1 Handbook Vol. 1 – Shutdown Events 

Shutdown Events: 

Introduction

Section 1 

Rev. 1.0 

1.0 Introduction 

1.1 Objectives 

The first objective of the Risk Assessment of Operational Events Handbook (sometimes known as 

“RASP Handbook” or “handbook”) is to document methods and guidance that U.S. Nuclear 

Regulatory Commission (NRC) staff could use to achieve more consistent results when 

performing risk assessments of operational events and licensee performance issues. 

The second objective is to provide analysts and Standardized Plant Analysis Risk (SPAR) 

model developers with additional guidance to ensure that the SPAR models used in the risk analysis 

of operational events represent the as-built, as-operated plant to the extent needed to support the 

analyses. 

This handbook represents best practices based on feedback and experience from the analyses 

of over 600 precursors of events dating back to 1969 in the Accident Sequence Precursor (ASP) 

Program and numerous Significance Determination Process (SDP) Phase 3 analyses (since 

2000). 

1.2 Scope of the Handbook

The scope of the handbook is provided below. 

! Applications. The methods and processes described in the handbook can be primarily 

applied to risk assessments for Phase 3 of the SDP, the ASP Program, and event 

assessments under the NRC=s Incident Investigation Program (in accordance with 

Management Directive 8.3). The guidance for the use of SPAR models and Systems 

Analysis Programs for Hands-on Integrated Reliability Evaluations (SAPHIRE) software 

package can be applied in the risk analyses for other regulatory applications, such as 

the Generic Issues Program and special risk studies of operational experience. 

! Relationships to program requirements. This handbook is intended to provide 

guidance for implementing requirements contained in program-specific procedures, such 

as Inspection Manual Chapter (IMC) 0609, “Significance Determination Process,” and 

IMC 0309, “Reactive Inspection Decision Basis for Reactors.” It is not the scope of this 

handbook to repeat program-specific requirements in the handbook, since these 

requirements may differ among applications and may change as programs evolve. 

Program-specific requirements supersede guidance in this handbook. 

! Deviations from methods and guidance. Some unique events may require an 

enhancement of an existing method or development of new guidance. Deviations from 

methods and guidance in this handbook may be necessary for the analysis of atypical 

events. However, such deviations should be adequately documented in the analysis to 

allow for the ease of peer review. Changes in methodologies and guidance will be 

reflected in future revisions of this handbook.
1. Introduction 

Risk Assessment of Operational Events 1-2 

1.3 Audience for the Handbook 

The principal users of this handbook are senior reactor analysts (SRAs) and headquarters risk 

analysts involved with the risk analysis of operational events. It is assumed that the analysts 

using this handbook have received probabilistic risk assessment (PRA) training at the SRA 

qualification level. Analysts using this handbook should be familiar with the risk analysis of 

operational events, SAPHIRE software package, and key SPAR model assumptions and 

technical issues. Although, this handbook could be used as a training guide, it is assumed that 

an analyst either has completed the NRC course “Risk Assessment in Event Evaluation” 

(Course Number P-302) or has related experience. 

1.4 Handbook Content 

The revised handbook includes three volumes, designed to address Internal Events (Volume 1), 

External Events (Volume 2), SPAR Model Reviews (Volume 3), and Shutdown Events (Volume 

4). Each volume is complementary to the others. The scope of these volumes is as follows: 

! Volume 1, Internal Events. Volume 1, “Internal Events,” provides generic methods and 

processes to estimate the risk significance of initiating events (e.g., reactor trips, losses 

of offsite power) and degraded conditions (e.g., a failed high pressure injection pump, 

failed emergency power system) that have occurred at nuclear power plants.1

 Specifically, this volume provides guidance on the following analysis methods: 

- Exposure Time Determination and Modeling 

- Failure Determination and Modeling 

- Mission Time Modeling 

- Modeling Recovery and Repair Actions in Event Assessment 

- Multi-Unit Considerations Modeling 

- Treatment of Common-Cause Failures in Events Assessment (Future)

 In addition, the appendices provide further guidance on the following analysis topics: 

- Road Map – Risk Analysis of Operational Events 

Although, the guidance in this volume of the handbook focuses on the analysis of 

internal events during at-power operations, the basic processes for the risk analysis of 

initiating events and degraded conditions can be applied to external events, as well as 

events occurring during shutdown operations. 

! Volume 2, External Events. Volume 2, “External Events,” provides methods and 

guidance for the risk analysis of initiating events and conditions associated with external 

events. External events include internal flooding, internal fire, seismic, external flooding, 

external fire, high winds, tornado, hurricane, and others. This volume is intended to 

complement Volume 1 for Internal Events and Volume 4 for Shutdown Events. 

Specifically, this volume provides the following guidance: 

- Internal Flood Modeling and Risk Quantification 

 

1 In this handbook, Ainitiating event@ and Adegraded condition@ are used to distinguish an incident involving a reactor 

trip demand from a loss of functionality during which no trip demand occurred. The terms “operational event” and 

Aevent,@ when used, refer to either an initiating event or a degraded condition.
1. Introduction 

 1-3 Handbook Vol. 1 – Shutdown Events 

- Internal Fire Modeling and Risk Quantification 

- Seismic Event Modeling and Seismic Risk Quantification 

- Other External Events Modeling and Risk Quantification 

! Volume 3, SPAR Model Reviews. Volume 3, “SPAR Model Reviews,” provides analysts 

and SPAR model developers with additional guidance to ensure that the SPAR models used 

in the risk analysis of operational events represent the as-built, as-operated plant to the 

extent needed to support the analyses. This volume provides checklists that can be 

used following modifications to SPAR models that are used to perform risk analysis of 

operational events. These checklists were based on the PRA Review Manual 

(NUREG/CR-3485, Ref. 1-1), the PRA Standard [ASME RA-S-2005 (Ref. 1-2) and

Regulatory Guide 1.200 (Ref. 1-3)], and experiences and lessons learned from SDP and 

ASP analyses. 

In addition, this volume summarizes key assumptions in a SPAR model and unresolved 

technical issues that may produce uncertainties in the analysis results. The importance 

of these assumptions or issues depends on the sequences and cut sets that were 

impacted by the operational event. Additionally, plant-specific assumptions and issues 

may play an even larger role in the analysis uncertainties. This volume is intended to 

complement Volume 1 for Internal Events, Volume 2 for External Events, and Volume 4 

for Shutdown Events, or whenever a modification to the SPAR model is required. 

! Volume 4, Shutdown Events. Volume 4, “Shutdown Events,” provides methods and 

guidance for the risk analysis of initiating events and conditions associated with plant 

shutdown (SD) events. The current scope is limited to shutdown events at select plant 

operating states for pressurized water reactor (PWR) and boiling water reactor (BWR) 

plants (e.g., hot shutdown, cold shutdown, refueling outage, and mid-loop operations for 

PWRs). This guide does not address the risk assessments of low-power and large early 

release frequency events. 

Specifically, this volume addresses the following four cases: 

- Initiating Event Analysis 

- Plant Condition Analysis Involving One Plant Operating State (POS) 

- Plant Condition Analysis Involving Multiple POSs 

- Special Cases (with no pre-defined POS available for the shutdown scenario of 

interest). 

Additionally, this volume provides insightful discussions on a set of frequently encountered 

issues to consider when developing shutdown risk models. This set of issues include (i) 

treatment of operator actions and human error dependencies, (ii) equipment test and 

maintenance configurations, and (iii) decay heat loads during time between shutdown and 

event initiation. This volume is intended to complement Volume 1 for Internal Events and 

Volume 2 for External Events. 

1.5 Companion References to the Handbook 

Guidance in the three volumes of the handbook often refers to other references, as applicable to 

the application. A bibliography of current technical references used in the risk analysis of 

operational events is provided in Volume 3, in which most of the documents are referenced in 

individual sections throughout the handbook. 
1. Introduction 

Risk Assessment of Operational Events 1-4 

Key companion references that are an extension to this handbook include: 

- PRA Standard (Refs. 1-2 and 1-3) 

- NUREG/CR-6823, “Handbook of Parameter Estimation for Probabilistic Risk 

Assessment” (Ref. 1-4) 

- NUREG-1792, “Good Practices for Implementing Human Reliability Analysis” 

(Ref. 1-5) 

- NUREG-1842, “Evaluation of Human Reliability Analysis Methods Against Good 

Practices” (Ref. 1-6) 

- NUREG/CR-6883, “SPAR-H Human Reliability Analysis Method” (Ref. 1-7) 

- NUREG-1624, Rev. 1, “Technical Basis and Implementation Guide for A 

Technique for Human Event Analysis (ATHEANA)” (Ref. 1-8) 

- NUREG-1880, “ATHEANA User’s Guide” (Ref. 1-9) 

- NUREG/CR-6850, “EPRI/NRC-RES Fire PRA Methodology for Nuclear Power 

Facilities, Volume 2: Detailed Methodology” (Ref. 1-10) 

- Handbook for Phase 3 Fire Protection (FP) Significance Determination Process 

(SDP) Analysis (Ref. 1-11) 

- Basic SAPHIRE training manual (Ref. 1-12) 

- Advanced SAPHIRE training manual (Ref. 1-13) 

- Plant-specific SPAR model manual 

1.6 Questions, Comments, and Suggestions 

Questions, comments, and suggestions should be directed to the following: 

From internal NRC staff and NRC contractors: 

! Volume 1, Internal Events 

 - Chris Hunter, 301-415-7575, Christopher.Hunter@nrc.gov

- See-Meng Wong, 301-415-1125, See-Meng.Wong@nrc.gov

! Volume 2, External Events 

 - Selim Sancaktar, 301-215-7572, Selim.Sancaktar@nrc.gov

! Volume 3, SPAR Model Reviews 

 - Peter Appignani, 301-251-7608, Peter.Appignani@nrc.gov

! Volume 4, Shutdown Events 

 - Selim Sancaktar, 301-215-7572, Selim.Sancaktar@nrc.gov

From external NRC stakeholders (e.g., public, licensees): 

! All handbook volumes; Significant Determination Process 

 - Steve Vaughn, 301-415-3640, Stephen.Vaughn@nrc.gov
1. Introduction 

 1-5 Handbook Vol. 1 – Shutdown Events 

1.7 References 

1-1. U.S. Nuclear Regulatory Commission, “PRA Review Manual,” NUREG/CR-3485, 

September 1985. (ADAMS Accession Number ML063550234) 

1-2. American Society of Mechanical Engineers, “Standard for Probabilistic Risk Assessment 

for Nuclear Power Plant Applications,” ASME RA-S-2005, 2005. 

1-3. U.S. Nuclear Regulatory Commission, Regulatory Guide 1.200, “An Approach for 

Determining the Technical Adequacy of Probabilistic Risk Assessment Results for RiskInformed Activities,” Revision 1, January 2007. http://www.nrc.gov/reading-rm/doccollections/reg-guides/power-reactors/active/01-200/01-200r1.pdf

1-4. U.S. Nuclear Regulatory Commission, “Handbook of Parameter Estimation for 

Probabilistic Risk Assessment,” NUREG/CR-6823, September 2003. 

http://www.nrc.gov/reading-rm/doc-collections/nuregs/contract/cr6823/

1-5. U.S. Nuclear Regulatory Commission, “Good Practices for Implementing Human 

Reliability Analysis,” NUREG-1792, April 2005. 

http://www.nrc.gov/reading-rm/doc-collections/nuregs/staff/sr1792/

1-6. U.S. Nuclear Regulatory Commission, “Evaluation of Human Reliability Analysis 

Methods against Good Practices,” NUREG-1842, March 2006. 

http://www.nrc.gov/reading-rm/doc-collections/nuregs/staff/sr1842/

1-7. U.S. Nuclear Regulatory Commission, “The SPAR-H Human Reliability Analysis 

Method,” NUREG/CR-6883, August 2005. 

http://www.nrc.gov/reading-rm/doc-collections/nuregs/contract/cr6883/

1-8. U.S. Nuclear Regulatory Commission, “Technical Basis and Implementation Guide for A 

Technique for Human Event Analysis (ATHEANA),” NUREG-1624, Rev. 1, May 2000. 

http://www.nrc.gov/reading-rm/doc-collections/nuregs/pubs/

1-9. U.S. Nuclear Regulatory Commission, “ATHEANA User’s Guide,” NUREG-1880, June 

2007. http://www.nrc.gov/reading-rm/doc-collections/nuregs/staff/sr1880/

1-10. U.S. Nuclear Regulatory Commission, “EPRI/NRC-RES Fire PRA Methodology for 

Nuclear Power Facilities, Volume 2: Detailed Methodology,” NUREG/CR-6850, 

September 2005. http://www.nrc.gov/reading-rm/doc-collections/nuregs/contract/cr6850/

1-11. U.S. Nuclear Regulatory Commission, “Handbook for Phase 3 Fire Protection (FP) 

Significance Determination Process (SDP) Analysis,” December 2005. (ADAMS 

Accession Number ML053620267) 

1-12. Idaho National Laboratory, “SAPHIRE Basics - An Introduction to Probabilistic Risk 

Assessment via the Systems Analysis Program for Hands-On Integrated Reliability 

Evaluations (SAPHIRE) Software,” Current Revision. 

1-13. Idaho National Laboratory, “Advanced SAPHIRE - Modeling Methods for Probabilistic 

Risk Assessment via the Systems Analysis Program for Hands-On Integrated Reliability 

Evaluations (SAPHIRE) Software,” Current Revision. 

 2-1 Handbook Vol. 4 – Shutdown Events 

Shutdown Events: 

Scope and Summary

Section 2 

Rev. 1.0 

2.0 Scope and Summary 

2.1 Scope 

The current scope of this Handbook is limited to shutdown events at different plant operating states 

(POSs) listed below and calculation of core damage frequency (CDF) values only. It does not 

address the risk assessments of low power and large early release frequency events. POS 

applicable to BWRs and PWRs are defined as the following: 

! BWR POSs

- Mode 3—Hot Shutdown 

- Mode 4—Cold Shutdown 

- Mode 5—Refueling Outage 

! PWR POSs

- Mode 3—Hot Shutdown 

- Mode 4—Cold Shutdown 

- Mode 5—Mid-Loop Operations 

- Mode 6—Refueling Outage 

2.2 Summary 

This document contains RASP Handbook guidance for plant event and condition analyses of 

shutdown events, using SPAR models. The document addresses four categories of analyses: 

1. Initiating event analysis [calculate conditional core damage probability (CCDP)]. 

2. Plant condition analysis involving one POS [calculate core damage probability (CDP)]. 

3. Plant condition analysis involving multiple POSs (calculate CDP). 

4. Special cases (no predefined POS available for the SD scenario of interest). 

In this document, the terms for “initiating event analysis” and “event analysis” are used 

interchangeably. 

Experience with performing actual SDP Phase 3 and ASP analyses of SD events over the last 

few years indicate that whenever a need for a plant-specific shutdown analysis arises, either 

there is no SPAR-SD model available; or it is available but is not updated; or is not suitable for 

the case being analyzed. Therefore, a case-specific model needs to be constructed in a short 

time frame. It is expected that this Handbook should be used in conjunction with the SD Model 

Maker’s Guide (MMG) by experienced PRA analysts only. This Handbook guidance and the 

MMG are intended to capture the technology and knowledge base accumulated on this subject, 

and relies on the analyst's proficiency with the competent use of the SAPHIRE software. The 

accompanying event tree (ET) library and the human error probability (HEP) library are also 
2. Scope and Summary 

Risk Assessment of Operational Events 2-2 

intended to capture the accumulated knowledge base and support the consistent application of 

the technology. 

2.3 Currently Available Tools, Models and Documents 

The following tools, models, and documents available for quantifying SD risk in addition to this 

document: 

- SAPHIRE software to run the models (Ref. 2-1); 

- SPAR Shutdown Model Maker’s Guideline (MMG) (Ref. 2-2) 

- Shutdown event tree template library (Ref. 2-2) 

- Shutdown operator actions and human error probability (HEP) library (Ref. 2-2) 

- SPAR shutdown models for a limited number of plants (Ref. 2-2) 

Figure 2-1 provides a visual summary of elements available to an analyst. 

Figure 2-1. Elements Available to an Analyst for SD 

2.4 Status of SD Models 

The current version of this Handbook guidance is provided for use with the existing SPAR-SD 

models available to NRC analysts. Currently, there are eight SPAR-SD models in the SAPHIRE 

User Group webpage (Ref. 2-1): 

Plant Name Plant Type Status 

Davis-Besse PWR/BW SAPHIRE8 compatible, final version 

Columbia BWR SAPHIRE8 compatible, final version 

Seabrook PWR/W SAPHIRE8 compatible, final version 

Turkey Point PWR/W SAPHIRE8 compatible, final version 

Comanche Peak PWR/W SAPHIRE8 compatible, final version 

SPAR-SD Models 

for Specific Plants 

SD Event Tree 

Library 

(Templates) 

SD Operator 

Action and HEP 

Library 

Previously 

Performed and 

Documented SD 

SDP or ASP 

Analyses 

Construction of a New 

Plant-Specific SPARSD Model by RES 

and/or INL 

New SD Event or Plant 

Condition Analysis for SDP 

Phase 3, ASP, and Similar 

Purposes 

SD Model Maker’s 

Guideline (MMG) 
2. Scope and Summary 

 2-3 Handbook Vol. 4 – Shutdown Events 

Brunswick BWR SAPHIRE8 compatible, final version 

San Onofre PWR/CE SAPHIRE8 compatible, final version 

Grand Gulf BWR SAPHIRE8 compatible, draft version 

For each SPAR-SD model, the SD model documents (in WORD and EXCEL files), HEP 

calculations, etc. can be found in the SPAR model folder named Shared\Documents\XXXX-SDDocs, where XXXX refers to the acronym for the plant in question. 

Earlier SPAR-SD models utilized a set of identical SD event trees. These models are 

characterized by a main event tree named SD which defines plant operating states and 

transfers into sub event trees for the POSs. The event tree nodes are defined formally; the 

plant specific nature of these nodes is introduced in fault tree logic. This approach is no longer 

used since it is shown to be of limited benefit for actual SDP and ASP analyses. However, 

since some of the current models contain also this form (in addition to the new ET templates by 

SD initiating events), some examples for these models are mentioned in the Handbook. 

2.5 Examples of “Old” versus “New” Models 

Figure 2-2 shows the old model ETs for the Columbia plant; they are highlighted in the list. 

Figure 2-3 shows the “new” SD event trees for the same plant. Note that both models coexist 

for this plant. Figure 2-4 shows the “new” ET models for the Davis Besse plant. Note that the 

“old” SD ET models are removed for this plant. Eventually, all “old” SD ET models will be 

removed. 

The new SD event tree models always start with the name SD- and can be run individually, just 

like the ETs for internal events. 

2.6 New Tool (Shutdown Core Uncovery Calculator) 

An MS EXCEL based new tool has been created for calculation of core uncovery times for given 

configurations of water volumes above the core during a shutdown POS. This calculator (Ref. 

2-3) allows for accounting of decay heat production rate, losses due to boiling, and losses due 

to reactor coolant system (RCS) boundary breaks (if applicable). The calculator can also be 

used in a stand-alone mode to estimate decay heat rates after N hours from shutdown. The 

uncovery times calculated by this calculator can be used to estimate time windows available for 

operator actions during various SD POSs. Figures 2-5, 2-6, and 2-7 illustrate worksheets from 

the calculator workbook. An user’s guide and overview are provided in Ref. 2-2 (refer to 

documents titled Shutdown Core Uncovery Calculator and Shutdown Calculator Presentation). 
2. Scope and Summary 

Risk Assessment of Operational Events 2-4 

Figure 2-2. “Old” ET Models for Columbia Plant 
2. Scope and Summary 

 2-5 Handbook Vol. 4 – Shutdown Events 

Figure 2-3. “New” ET Models for Columbia Plant 
2. Scope and Summary 

Risk Assessment of Operational Events 2-6 

Figure 2-4. “New” ET Models for Davis Besse Plant 
2. Scope and Summary 

 2-7 Handbook Vol. 4 – Shutdown Events 

Figure 2-5. Worksheet from the SD Core Uncovery Calculator
2. Scope and Summary 

Risk Assessment of Operational Events 2-8 

Figure 2-6. Worksheet from the SD Core Uncovery Calculator
2. Scope and Summary 

 2-9 Handbook Vol. 4 – Shutdown Events 

Figure 2-7. Worksheet from the SD Core Uncovery Calculator 

2.8 Additional Considerations for Shutdown Risk Analysis 

In addition to the important aspects of shutdown risk mentioned above, several issues, unique 

to shutdown operations, should be addressed when performing a risk analysis. For additional 

guidance on these SD-related considerations, refer to Section 8. These considerations are 

provided in Section 8 to give the analyst a list of frequently encountered pitfalls in developing 

shutdown risk models. Some of these considerations are highlighted below. 

! Operator Actions. Operator actions generally contribute significantly to the most risk 

important SD scenarios. Multiple operator actions may be credited in a scenario, with 

potential interaction (dependencies) among them. Appendix B discusses the treatment 

of operator actions in SD scenarios. 

! Testing and maintenance during forced and planned outages. If the scenario is 

during a forced outage, the test and maintenance (T/M) unavailabilities may be nominal 

(as modeled in the at-power model). However, if the scenario is during a planned 

outage, plant procedures or administrative controls may preclude scheduled test and 

maintenance on key equipment trains (such as emergency diesel generators); on the 

other hand, random failures may occur and lead to unscheduled maintenance. 

In some SD scenarios, multiple trains of the same system may be out of service due to 

scheduled maintenance. This may not be allowed during power operation. These 
2. Scope and Summary 

Risk Assessment of Operational Events 2-10 

aspects of shutdown conditions should be considered on a case by case basis and, if 

necessary, should be used to justify modifying the T/M unavailabilities for the case. 

! Time between shutdown and event or plant condition. Another important aspect in 

characterizing shutdown risk is the decay heat level. The time between the plant 

shutdown and occurrence of an event or plant condition determines the decay heat rate 

applicable to the scenario and may affect the operator action time windows, and even 

equipment success criteria. To account for the various levels of decay heat (DH), four 

time windows were defined in terms of time after reactor shutdown. These four DH time 

windows are defined in Table 2-1 and discussed in Section 8.9. 

Table 2-1. Decay Heat Time Window Definition2

Condition DH Time 

Window 1 

DH Time 

Window 2 

DH Time 

Window 3 

DH Time 

Window 4 

Time following shutdown < 75 h Between 75 h 

and 240 h 

Between 240 

h and 768 h 

> 768 h 

(32 days) 

Percent of full power 0.54 0.41 0.29 0.20 

2.9 Example CCDPs and CDPs 

As shown below, a set of example CCDPs and CDPs is provided for plant SD modes modeled 

by template event trees in the current SPAR-SD models for a PWR. 

Shutdown Scenario CCDPs 

Mode/POS LORHR LOOP LOI OD* 

M4 1.3E-05 2.3E-06 3.3E-05 PWR Mode 4 

M5 1.0E-05 2.3E-06 3.2E-05 PWR Mode 5 

ML 1.4E-04 1.8E-04 1.5E-03 2.5E-03 PWR Mode 5 RCS 

Open 

M6 1.1E-05 PWR Mode 6 

(Refueling) 

When the model is complete, the CDP per hour for each POS can be calculated and recorded in 

a table such as the one below. 

POS CDPs (per hour in that mode)

Mode/POS LORHR LOOP LOI OD* 

M4 4.1E-11 9.3E-12 2.8E-11 PWR Mode 4 

M5 3.3E-11 9.3E-12 2.7E-11 PWR Mode 5 

ML 4.6E-10 7.5E-10 1.3E-09 4.4E-05 PWR Mode 5 RCS 

Open 

M6 9.3E-12 PWR Mode 6 

(Refueling) 

* Per mid-loop operation (demand basis) 

Loss of inventory (LOI) event 

Loss of RHR (LORHR) cooling event 

Loss of offsite power (LOOP) event 

Over-drain (OD) event during mid-loop operation 

 

2

 Time Window definitions are taken from NUREG/CR 6144 and are given in SPAR-SD model reports of the earlier 

SPAR-SD models, such as Davis-Besse. 
2. Scope and Summary 

 2-11 Handbook Vol. 4 – Shutdown Events 

2.10 References 

2-1. Idaho National Laboratory, “SAPHIRE Users Group,” https://saphire.inl.gov/, User Area 

Accessible to NRC-Authorized Account Holders Only. 

2-2. Shutdown SPAR Model Library, Internal NRC ADAMS Accession Number 

ML070220201, Internal ADAMS Accessible to NRC-Authorized Account Holders Only 

2-3 Shutdown Core Uncovery Calculator, Internal NRC ADAMS Accession Numbers: 

ML101880081 (Calculator), Internal ADAMS Accessible to NRC-Authorized Account 

Holders Only. 

 3-1 Handbook Vol. 4 – Shutdown Events 

Shutdown Events:

Scenario Definition and Quantification

Section 3 

Rev. 1.0 

3.0 Scenario Definition and Quantification 

Shutdown scenarios can be defined and their CCDPs (for event analysis) or CDPs (for plant 

condition analysis) can be calculated using a SPAR-SD model. In this Handbook, it is assumed 

that there may or may not be a plant-specific SPAR-SD model available to the analysts. 

At this time, there are only a few SPAR-SD models available. The analyst may need to 

construct the needed SD scenarios using portions of model logic from the at-power model, SD 

event tree templates, and the SD HEP library mentioned in Section 2, and illustrated in Figure 2-

1. The system fault trees can be borrowed from the existing at-power model and modified as 

necessary to map the realistic SD conditions. 

3.1 Scenario Types 

In this document, the following cases are discussed and examples are provided: 

! Event analysis (calculate a CCDP) 

! Plant condition analysis involving one POS (calculate CDP). 

! Plant condition analysis involving multiple POSs (calculate CDP). 

! Special cases (no predefined POS available for the SD scenario of interest). 

For plant condition cases, CDP of the condition case is discussed; CDP of the based case could 

be calculated by removing the condition from the model. CDP of the base case can be 

separately calculated and subtracted from the CDP of the condition case to calculate the 

scenario delta-CDP, when needed. If the CDP of the base case is judged not to affect the 

scenario delta-CDP classification, then base case calculation need not be performed. 

It is assumed that the analyst will need to construct a SPAR-SD model containing a minimum 

set of needed POSs and initiating events to address the issue. 

3.2 Process Outline 

The following process is provided to model SD scenarios and quantify their CDFs: 

! Identify if the issue is an event analysis or a plant condition analysis. 

! Identify the shutdown state(s), mode(s), or POS(s) the issue applies to. In some cases, 

an issue (such as a plant condition) may not apply to as few of the POSs; thus the 

remaining POSs need not be considered. See Figure 3-1 for definition of a detailed set 

of POSs for a PWR. 

! For an event analysis, identify the following (see Section 4 for examples):
3. Scenario Definition and Quantification 

Risk Assessment of Operational Events 3-2 

- Initiating event (see Table 3-1); 

- Failed components/unavailable components (if any); 

- Operator actions that may need to be adjusted; 

- Time since the plant was last shutdown; and 

- Whether the event is during a forced outage or a planned outage. 

Table 3-1. PWR SPAR SD Model Initiating Events3

SPAR Name Description4 

IESD-LORHR Loss of Decay Heat Removal Capability [Other Than Residual Heat Removal 

(RHR) Loop Isolation] 

IESD-ISOL RHR Loop Isolation 

IESD-LOOP LOOP 

IESD-LOAC Loss of Operating an Alternate Current (AC) Division 

IESD-LOI Loss of Inventory Due to Loss-of-Coolant Accident (LOCA) or Recoverable 

Diversion of RCS Coolant 

IESD-LOLC Loss of Level Control at Reduced Inventory 

IESD-OD Loss of Inventory at Reduced Inventory Due to Over-Draining (Demand-Related 

Rate)5

! For a plant condition analysis, identify the following: 

- POS (or multiple POSs) involved; 

(Identify only the minimum number of POSs and initiating events necessary for 

the issue, since most likely, new ETs need to be constructed.) 

- Time spent in each in each POS; 

- Failed components/unavailable components (if any); 

- Operator actions that may need to be adjusted; 

- Time since the plant was last shutdown; 

- Whether the condition is during a forced outage or a planned outage; and 

- If PWR and mid-loop operations are involved, the number of times the mid-loop 

state is entered. 

See Section 5 for examples with one POS; see Section 6 for examples with multiple 

POSs. 

! If available, use a plant-specific SPAR-SD model. The most likely case is that such a 

model will not be available. In that case, construct (or import from the ET library) the 

minimum number of ETs to carry out the analysis 

 

3

 Taken from a SPAR-SD model in Reference 1-3. 

4 Rates are given per shutdown year (except for IESD OD).

5

 IESD-OD is the demand-related loss of inventory caused by the operator over-draining the RCS with the intent of 

reducing RCS level to mid-loop (or reduced inventory conditions). This SPAR value is per demand, and does not 

have time-based units. 
3. Scenario Definition and Quantification 

 3-3 Handbook Vol. 4 – Shutdown Events 

! Quantify the CCDP or CDP of the scenario by solving for the sequences of only those 

ETs that are involved in the scenario. 

! Examine the cutsets to make sure that they reflect the intended scenario. Especially 

check operator action HEPs and validity of cutsets containing operator actions. Check 

for dependencies among operator actions. Modify as needed to obtain a proper 

estimate of risk for cutsets involving multiple operator actions. In the newer models built 

by MMG, dependencies are introduced by SAPHIRE basic event replacement rules 

(contained in recovery rules file); this is discussed in Appendix B. 

In the SPAR-SD models, the SD scenario is assumed to occur at some “nominal” time after the 

reactor shutdown. If the event/plant condition applies to an earlier POS during the shutdown, 

operator time windows may be shorter (due to higher decay heat) than the same event/plant 

condition applying to a later POS (say after refueling is completed). The POS occurring early or 

late after shutdown may affect the operator action success criteria (by affecting the available 

time window), and even may affect system success criteria. Nominal means that the POS 

occurs in the most likely DH time window (See Section 8.9 and Table 2-1) expected for that 

POS. For example hot shutdown and hot standby will be in DH time window 1; cold shutdown 

and refueling will be in DH time window 2. In forced outages for repairs, cold shutdown may 

slide into DH time windows 3 and 4. A 20- to 30-day refueling outage will span DH time 

windows 1, 2 and 3, but will not go into DH time window 4. 

The event tree of Figure 3-1 is used to help an analyst to identify POSs of interest. Twelve 

POS’s for various PWR shutdown states are defined by Figure 3-1. 

Figure 3-1. Example Definition of Plant Operating States (POS) 
3. Scenario Definition and Quantification 

Risk Assessment of Operational Events 3-4 

The next four sections discuss examples for illustrative purposes; the values used in the 

examples are for illustration only.
 4-1 Handbook Vol. 4 –Shutdown Events 

Shutdown Events:

Shutdown Event Analysis

Section 4 

Rev. 1.0 

4.0 Shutdown Event Analysis 

This section provides examples of how to quantify the CCDP of an event that occurs in 

shutdown, and that can be modeled by one of the existing SPAR-SD models. These examples 

are: 

! Example 4.1a: A loss of RHR event occurs during refueling mode; event importance is 

calculated by using the Davis-Besse SPAR-SD model. 

! Example 4.1b: A loss of RHR event occurs during refueling mode; event importance is 

calculated by using the Seabrook SPAR-SD model. 

! Example 4.2: A LOOP event due to hurricane occurs during Mode 4; event importance is 

calculated by using the Davis-Besse SPAR-SD model. 

In a shutdown event analysis, the POS is fixed and the initiating event has already occurred; 

CCDP of the event is to be calculated. The analyst must set the initiating event (IE) frequency 

to 1.0 for the event tree that is used to model the relevant POS and IE. The event tree 

sequences are then solved to calculate the scenario CCDP. 

The analyst must exercise caution when using an existing SPAR-SD event tree model to ensure 

that the model is actually applicable to the scenario in question. When an existing SPAR-SD 

event tree is observed to be not applicable to the scenario, the analyst needs to create a SD 

event tree or modify an existing SD event tree. Assumptions are often made about the initiating 

event (failure mechanism, recoverability), success criteria, system availability and lineup, etc. in 

the existing event tree models. It is not feasible to model all possible scenarios in the existing 

SD models. The analyst must review the model and model documentation to ensure the 

applicability to the event that is to be assessed. 

4.1 Examples 4.1a and 4.1b 

While the plant is in Mode 6, RCS full and vented and RCS loops open, a loss of RHR event 

occurs. What is the CCDP? 

! 4.1a. Using the Davis-Besse SPAR-SD Model (pre-MMG model). The results of 

process steps 1, 2, and 3 described in Section 2.2 apply to this case; the results of these 

steps are summarized in the following paragraph. 

This is an event importance analysis. This plant mode is represented by POS-M6XFVO 

(see Table A-2 for these POS definitions) in the Davis-Besse shutdown model. The 

initiating event is IESD-LORHR. The existing model assumptions with respect to 

equipment availability and operator actions are assumed to apply. No other equipment 

is affected in this scenario. The plant has been shutdown for 18 days, before this event 

has occurred. 
4. Shutdown Event Analysis 

Risk Assessment of Operational Events 4-2 

Process step 4 does not apply since this case is not a plant condition. For step 5, a 

plant-specific SPAR-SD model is available and can be used. Step 6 is discussed in the 

next paragraph. 

To quantify the CCDP of this case, make a change set containing eight basic events; six 

basic events are set to FALSE; one set to TRUE; and one is set to 1.0, as shown below. 

Event Probability

IESD-ISOL FALSE 

IESD-LOAC FALSE 

IESD-LOI FALSE 

IESD-LOLC FALSE 

IESD-LOOP FALSE 

IESD-LORHR TRUE 

IESD-OD FALSE 

POS-M6XFVO 1.0 

In this case, the POS basic event is set to 1.0; the loss of RHR initiating event has 

occurred and its basic event is set to TRUE; the remaining initiating events for the same 

POS are set to FALSE. Note that in this model, and in all pre-MMG SPAR-SD models, it 

is not possible to select and run a single initiating event tree for a POS; the whole POS 

CCDP must be quantified, because the underlying ET rules are determined by the POS. 

On the other hand, in the post-MMG SPAR-SD models (see the next case 3.1b); one or 

more initiating events for a plant mode or multiple plant modes can be selected and 

quantified, since each ET includes its own underlying rules. 

Select the change set; generate. Then select all sequences for the POS-M6XFVO and 

solve with cutoff probability of 1E-12. The resulting CCDP is 1.0E-05, with 3653 cutsets. 

Per step 7 of the process, examine cutsets to establish that they make sense and 

contain all intended failures. 

! 4.1b. Using the Seabrook SPAR-SD Model (made by using MMG model). The same 

process as Example 3.1a is followed. 

This plant mode is represented by the event tree M6-LORHR in the Seabrook shutdown 

model. The initiating event is IE-M6-LORHR. The existing model assumptions with 

respect to equipment availability and operator actions are assumed to apply. No other 

equipment is affected in this scenario. The plant has been shutdown for 18 days, before 

this event has occurred. 

Note that this is a post-MMG model. Thus a single SD event tree can be quantified 

without involving other event trees for the same SD mode. This quantification is identical 

to what would have been done for an event analysis for power operations. 

To quantify the CCDP of this case, make a change set containing one basic event, 

namely the initiating event frequency of IE-M6-LORHR set to TRUE. Select the change 

set; generate. Then select all sequences for M6-LORHR and solve with cutoff 

probability of 1E-13. The resulting CCDP is 3.3E-03, with 536 cutsets. Note that the ET 
4. Shutdown Event Analysis

 4-3 Handbook Vol. 4 –Shutdown Events 

success criteria in this model require recovery of RHR in the long term to avoid core 

damage. 

Examine cutsets to establish that they make sense and contain all intended failures. 

4.2 Example 4.2 

! Description of the case.6

 In the late evening hours of September 5th, the unit was 

shutdown in Mode 4 as the effects of Hurricane J, a Category 3 hurricane on the SaffirSimpson scale, were experienced at the site. Earlier that day the unit was taken off-line, 

as required by the emergency plan implementing procedures, prior to the onset of 

hurricane force winds at the site. 

The unit was removed from service at 1100 hours on September 5th. At 2356 hours the 

same day, power to the east switchyard bus was lost causing a complete loss of offsite 

power. The emergency diesel generators started in response the LOOP conditions and 

safe shutdown loads were sequenced onto the unit's safety busses. 

! Scenario Setup. Davis-Besse SPAR-SD model was used to illustrate quantification of 

event importance for this case. The plant was in POS-M4EFIO; IESD-LOOP event 

occurred; plant was in mode 4 thirteen hours after the shutdown. This is a forced outage 

scenario. 

The following offsite power recovery distribution was created for particular scenario. 

Note that the basic events for this recovery already exist in the SPAR model and contain 

nominal recovery probabilities based on average actuarial behavior of the fleet of 

domestic nuclear power plants. Not all recovery basic events may be actually utilized in 

a given SPAR model. The probability distribution used for this case recognizes the 

following: 

- Offsite recovery during the first hour is not credited due to high hurricane winds 

at the site. 

- During the second hour a 50% chance of recovery was modeled. 

- During the third hour, a high probability (95%) of offsite recovery was modeled. 

- After the third hour, the recovery was modeled to be highly likely to occur 

(99.5%) without distinguishing when it actually occurs. 

This recovery failure distribution can be assigned to the applicable basic events in the 

model as follows: 

Event Description Probability

OEP-XHE-XL-NR01H OPERATOR FAILS TO RECOVER OFFSITE POWER 

IN 1 HOUR 1 

OEP-XHE-XL-NR90M OPERATOR FAILS TO RECOVER OFFSITE POWER 

IN 90 MINUTES Not used 

 

6

 This event happened at a different site; it is used here for illustration purposes only. 
4. Shutdown Event Analysis 

Risk Assessment of Operational Events 4-4 

Event Description Probability

OEP-XHE-XL-NR02H OPERATOR FAILS TO RECOVER OFFSITE POWER 

IN 2 HOURS 0.5 

OEP-XHE-NOREC-BD OPERATOR FAILS TO RECOVER OFFSITE POWER 

BEFORE BATTERY DEPLETION 0.5 

OEP-XHE-XL-NR03H OPERATOR FAILS TO RECOVER OFFSITE POWER 

IN 3 HOURS 0.05 

OEP-XHE-XL-NR04H OPERATOR FAILS TO RECOVER OFFSITE POWER 

IN 4 HOURS 0.005 

OEP-XHE-XL-NR05H OPERATOR FAILS TO RECOVER OFFSITE POWER 

IN 5 HOURS 0.005 

OEP-XHE-XL-NR06H OPERATOR FAILS TO RECOVER OFFSITE POWER 

IN 6 HOURS 0.005 

OEP-XHE-XL-NR07H OPERATOR FAILS TO RECOVER OFFSITE POWER 

IN 7 HOURS 0.005 

OEP-XHE-XL-NR08H OPERATOR FAILS TO RECOVER OFFSITE POWER 

IN 8 HOURS 0.005 

However, an examination of the SD LOOP model shows that the model credits only a 

single AC power recovery action at 6 hours for this SD ET follows: 

OSP-SD-06HRS with failure probability of 5.7E-02. This value is replaced with 5.0E-03, 

as given in the above data. 

Since this is a pre-MMG SPAR-SD model, to quantify the CCDP of this case, make a 

change set containing nine basic events; six basic events corresponding to other 

initiating events are set to FALSE; two are set to 1.0 (POS and the actual initiating event 

that has occurred); and one is set to 5.0E-03 (the AC power recovery basic event 

affected by the case), as shown below. 

Event Probability 

IESD-ISOL FALSE 

IESD-LOAC FALSE 

IESD-LOI FALSE 

IESD-LOLC FALSE 

IESD-LOOP 1.0 

IESD-LORHR FALSE 

IESD-OD FALSE 

OSP-SD-06HRS 5.00E-03 

POS-M4EFIO 1.0 

Select the change set; generate. Then select all sequences for the POS-M4EFIO and 

solve with cutoff probability of 1E-12. The resulting CCDP is 8.176E-5, with 44954 

cutsets. 

Examine top cutsets to establish that they make sense and contain all intended failures. 

Note that this model does not consider battery depletion, and early problems with 

auxiliary feedwater (AFW) turbine-driven pump (TDP) control. Another scenario 

approach, which uses a modified at-power LOOP event tree for modeling this scenario, 
4. Shutdown Event Analysis

 4-5 Handbook Vol. 4 –Shutdown Events 

may be considered. In that case, the at-power LOOP event tree can be modified to 

remove anticipated transient without scram (ATWS) and reactor coolant pump (RCP) 

LOCA issues; and quantified with a more detailed AC power recovery distribution. 

 5-1 Handbook Vol. 4 – Shutdown Events 

Shutdown Events:

Shutdown Condition Analysis – 1 POS

Section 5 

Rev. 1.0 

5.0 Shutdown Condition Analysis – 1 POS 

In this section, examples of plant condition analysis for one POS and for multiple POSs are 

given. The examples calculate CDP for a time spent in a POS for a specified number of hours 

[duration time (DT)] with the plant condition. 

5.1 Example 5.1 

Plant spends 200 hrs in POS 12 (POS-M6XFVO; Mode 6, RCS Full and Vented, Loops Open) 

with AFW TDP 11 and DG 11 out of service. What is the total CDP during this shutdown? 

The POS fraction is 200/8760 = 0.022831. 

To quantify the CDP of this case, make a change set containing the following basic 

events: 

Event Probability

AFW-TDP-TM-11 TRUE 

EPS-DGN-TM-DG11 TRUE 

POS-M6XFVO 2.283E-02 

Select the change set; generate. Then select all sequences for the POS-M6XFVO and 

solve with cutoff probability of 1E-12. The resulting CDP is 3.374E-6, with 7642 cutsets. 

Examine top cutsets to establish that they make sense and contain all intended failures. 

If needed provide recovery actions or additional credit. 

5.2 Example 5.2 

While early in mode 5, with RCS reduced, vented and loops open (POS-M5ERVO), the plant 

spends 30 hours; what is the CDP? During this time the RCS level was drained to mid-loop 

level once. 

The POS fraction is 30/8760 = 0.003425. 

This POS is one of the two mid-loop modes where the demand based IESD-OD initiating 

event applies. The value of IESD-OD in the model is 0.018, which implies that, every 

time this mid-loop POS is exercised (regardless of its duration), there is a 1.8% chance 

that over-draining would occur. 

The initiating event “frequency” (challenge) of this event does not depend on how long is 

the POS DT, but depends on how many times (N) the mid-loop is exercised. Since the 

POS fraction is DT related, the initiating event frequency of IESD-OD must be adjusted 

so that the product of POS fraction times the IESD-OD is N times 0.018: 
5. Shutdown Condition Analysis – 1 POS 

Risk Assessment of Operational Events 6-2 

DT / 8760 *(frequency of IESD) = N * 0.018 

Thus, the frequency of IESD = N * 0.018 *8760 / DT 

In this case, N=1, and DT = 30 

Frequency of IESD = 5.256. 

This is the value that must be assigned to IESD-OD in the change set. 

To quantify the CDP of this case, make a change set containing the following basic 

events: 

Event Probability 

IESD-OD 5.256E+00 

POS-M5ERVO 3.425E-03 

Select the change set; generate. Then select all sequences for the POS-M5ERVO and 

solve with cutoff probability of 1E-12. The resulting CDP is 6.793E-7, with 3592 cutsets. 

Examine top cutsets to establish that they make sense and contain all intended failures. 

If needed provide recovery actions or additional credit. 
 6-1 Handbook Vol. 4 – Shutdown Events 

Shutdown Events:

Shutdown Condition Analysis – Multiple POSs

Section 6 

Rev. 1.0 

6.0 Shutdown Condition Analysis – Multiple POSs 

If there is a plant-specific SPAR-SD model, then this case can be treated as a sum of multiple 

single-POS cases. CDPs for each POS can be calculated and added. This is illustrated in the 

example shown in Tables 5-1a, and 5-1b for a PWR case. This case is for illustration purposes 

only. 

In this case, plant is placed in cold shutdown for forced outage for tech-spec related minor 

repairs. During cold shut down, it is discovered that one high-head safety injection (HHSI) 

pump was inoperable for the last 614 hours. Five hundred hours were at-power; the remaining 

114 hours were at different shutdown states. The base case CDPs for at-power and shutdown 

states are already calculated and given in the SPAR-SD model report as: 

Mode CDP 

(for 8760 hours) 

Power Operation 1.8E-05 

M4 5.5E-06 

M5 5.8E-06 

MR 1.3E-03 

ML 1.8E-03 

M6 1.5E-04 

The hot standby CDP can be approximated by the at-power CDP since the same plant 

configuration (except for reactor trip) exists. This approximation may be slightly conservative. 

The plant response to events at hot standby is the same as the one for at-power operation. If 

needed, this assumption can be modified to remove events like ATWS, Transients, etc., which 

may not be applicable to the mode being modeled. In the current case, this correction is not 

deemed to be a contributing factor. 

Table 6-1a shows the calculation of the base plant CDP for the 614 hour-time window in 

multiple states. Then, the SPAR-SD model is run with one HHSI pump set to failure and new 

CDPs are calculated. These CDPs are used in Table 6.1b to calculate the plant condition CDP. 

Finally, the plant condition importance is calculated as the difference between the plant 

condition CDP and the base CDP: 

Plant Condition Importance = Plant Condition Case CDP – Base Case CDP 

= 1.23E-06 - 1.11E-06 = 1.2E-07 

Table 6-2 shows an example table that can be used for a similar calculation for a BWR. An 

application to a BWR is shown in Table 6-3. Note that in this case, only the plant condition CDP 

is calculated, but not the base case CDP, since the plant condition CDP is already less than 1E06. 
6. Shutdown Condition Analysis – Multiple POSs 

Risk Assessment of Operational Events 6-2 

Table 6-1a. Plant Condition Importance Calculation – PWR Base Case 

Case Name Example PWR case with multiple shutdown states and at-power state involved. Base 

case CDP calculation. 

Case Description Plant is placed in cold shutdown for forced outage for TS-related minor repairs. 

During cold shut down, it is discovered that one HHSI pump was inoperable for the 

last 614 hour time period. 500 hours were at power. Estimate the event importance 

for this plant condition. 

Plant 

Operating 

State 

TS 

Mode 

TS Mode 

Description POS Description DH Time Window 

Hours 

in POS 

CDF (per yr) 

or CCDP 

POS 

CDP 

Additional 

Equipment 

Unavailable 

P1 1 Power Operation Low power and reactor 

shutdown N/A 500 1.80E-05 1.03E-06 

P2 3 Hot Standby 

Cooldown with Steam 

Generators (SGs) from 

operating temperature to 

345°F 

1 4 1.80E-05 8.22E-09 

P3 4 Hot Shutdown Cooldown with RHR from 

345°F to 200°F) 1 35 5.50E-06 2.20E-08 

P4 5 Cold Shutdown Cooldown with RHR (below 

~200°F) 1-2 75 5.80E-06 4.97E-08 

P5 5 Cold Shutdown Draining RCS to mid-loop 

P6 5 Cold Shutdown Mid-loop operation 

P7 5 Cold Shutdown Fill for refueling 

P8 6 Refueling Refueling 

P9 5 Cold Shutdown Draining RCS to mid-loop 

after refueling 

P10 5 Cold Shutdown Mid-loop operations after 

refueling 

P11 5 Cold Shutdown Refilling RCS 

P12 5 Cold Shutdown RCS heat-up solid and 

draw bubble 

P13 4 Hot Shutdown RCS heat-up to 350°F 

P14 2 Startup RCS heat-up with SGs 

available (above 350°F) 

P15 1 Power Operation Startup and low power 

operations 

Base Case CDP = 1.11E-06 
6. Shutdown Condition Analysis – Multiple POSs 

 6-3 Handbook Vol. 4 – Shutdown Events 

Table 6-1b. Plant Condition Importance Calculation – PWR Condition Case 

Case Name Example PWR case with multiple shutdown states and at-power state involved. Plant 

condition CDP calculation. 

Case Description Plant is placed in cold shutdown for forced outage for tech-spec related minor 

repairs. During cold shut down, it is discovered that one HHSI pump was inoperable 

for the last 614 hour time period. 500 hours were at power. Estimate event 

importance for this plant condition. 

Plant 

Operating 

State 

TS 

Mode 

TS Mode 

Description POS Description DH Time Window 

Hours 

in POS 

CDF (per yr) 

or CCDP 

POS 

CDP 

Additional 

Equipment 

Unavailable 

P1 1 Power Operation Low power and reactor 

shutdown N/A 500 2.00E-05 1.03E-06 

One HHSI 

pump out of 

service 

P2 3 Hot Standby 

Cooldown with SGs from 

operating temperature to 

345°F 

1 4 2.00E-05 8.22E-09 

One HHSI 

pump out of 

service 

P3 4 Hot Shutdown Cooldown with RHR from 

345°F to 200°F) 1 35 6.10E-06 2.20E-08 

One HHSI 

pump out of 

service 

P4 5 Cold Shutdown Cooldown with RHR (below 

~200°F) 1-2 75 6.50E-06 4.97E-08 

One HHSI 

pump out of 

service 

P5 5 Cold Shutdown Draining RCS to mid-loop 

P6 5 Cold Shutdown Mid-loop operation 

P7 5 Cold Shutdown Fill for refueling 

P8 6 Refueling Refueling 

P9 5 Cold Shutdown Draining RCS to mid-loop 

after refueling 

P10 5 Cold Shutdown Mid-loop operations after 

refueling 

P11 5 Cold Shutdown Refilling RCS 

P12 5 Cold Shutdown RCS heat-up solid and 

draw bubble 

P13 4 Hot Shutdown RCS heat-up to 350°F 

P14 2 Startup RCS heat-up with SGs 

available (above 350°F) 

P15 1 Power Operation Startup and low power 

operations 

Plant Condition Case CDP = 1.23E-06 

DH Time Window Percent of Full power Time Following Shutdown (in hours) 

1 0.54 T<75 (3 days) 

2 0.41 75=<T<240 (10 days) 

3 0.29 240=<T<768 (32 days) 

4 0.20 768<=T (32 days) 
6. Shutdown Condition Analysis – Multiple POSs 

Risk Assessment of Operational Events 6-4 

Table 6-2. Plant Condition Importance Calculation Table for a BWR 

Case Name

Case Description

Plant 

Operating 

State 

TS 

Mode TS Mode Description POS Description 

DH 

Time 

Wind

ow 

Hours 

in POS 

CDF (per 

yr) or 

CCDP 

POS 

CDP 

Additional 

Equipment 

Unavailable 

B1 1 

Power Operations: 

Mode Switch in Run, 

plant at any 

temperature 

 

B2 2 

Startup: Mode Switch 

in Startup/Hot 

Standby, plant at any 

temperature 

Hot Standby; T > 200 °F; 

early refueling 

B3 3 

Hot shutdown: Mode 

Switch in Shutdown, 

plant temperature 

greater than 200°F, 

Hot shutdown; T ≤ 200 °F; 

early refueling 

B4 4 

Cold Shutdown: Mode 

Switch in Shutdown, 

plant temperature 

200oF, or lower 

Early refueling; RCS 

pressure low; RCS level 

normal 

 

B5 5 

Refueling: Fuel in 

vessel with head detensioned or removed, 

Mode Switch in 

Shutdown or 

Refueling 

Early refueling [ reactor 

pressure vessel (RPV) 

head off]; RCS pressure 

low; RCS level normal 

 

B6 5 Refueling 

Early refueling(RPV head 

off); RCS pressure low; 

RCS level at steam line 

 

B7 5 Refueling 

Refueling(RPV head off); 

RCS pressure low; upper 

pool filled 

 

B8 5 Refueling 

Late refueling(RPV head 

off); RCS pressure low; 

RCS level at steam line 

 

B9 5 Refueling 

Late refueling(RPV head 

off); RCS pressure low; 

RCS level normal 

 

B10 4 Cold Shutdown 

Late refueling; RCS 

pressure low; RCS level 

normal 

 

B11 4 Cold Shutdown 

Late refueling; RCS 

pressure high (hydrostatic 

test); RCS level normal 

 

B12 3 Hot Shutdown Hot Shutdown T > 200 °F; 

late 

B13 2 

Startup: Mode Switch 

in Startup/Hot 

Standby, plant at any 

temperature 

Startup 

Total CDP = 
6. Shutdown Condition Analysis – Multiple POSs 

 6-5 Handbook Vol. 4 – Shutdown Events 

Table 6-3. Plant Condition Importance Calculation Table for a BWR 

Case Name BWR plant-XOC loss of 4.16 kV Emergency Bus 1C due to ground fault in normally 

energized underground cable 

Case Description Plant condition analysis with 4160 emergency VAC unavailable for 130 hours at 

shutdown conditions (due to TS requirements). See Note 1 for initiating events at 

shutdown considered. 

Plant 

Operating 

State 

TS 

Mode 

TS Mode 

Description POS Description DH Time Window 

Hours 

in POS 

CDF (per 

yr) or 

CCDP 

POS 

CDP 

Additional 

Equipment 

Unavailable 

B1 1 Power 

Operation 

Power Operation (full or 

partial) 

B2 2 Hot Standby Hot Standby, early refueling 

B3 3 Hot Shutdown Hot Shutdown T > 200 °F; 

early refueling 1 75 4.18E-09 3.13E-07 4.16 kV Bus 

1C 

B4 4 Cold Shutdown Cold Shutdown T ≤ 200 °F; 

early refueling 2 55 4.18E-09 2.30E-07 4.16 kV Bus 

1C 

B5 5 Refueling 

Early Refueling; RCS 

pressure low; RCS level 

normal 

 

B6 5 Refueling 

Early Refueling (RPV head 

off); RCS pressure low; RCS 

level normal 

 

B7 5 Refueling 

Early Refueling (RPV head 

off); RCS pressure low; RCS 

level at steam line 

 

B8 5 Refueling 

Refueling(RPV head off); 

RCS pressure low; upper 

pool filled 

 

B9 5 Refueling 

Late Refueling(RPV head 

off); RCS pressure low; RCS 

level at steam line 

 

B10 4 Cold Shutdown Cold Shutdown T ≤ 200 °F; 

late 

B11 4 Cold Shutdown Hydro test; Cold shutdown 

late refueling 

B12 3 Hot Shutdown Hot Shutdown T > 200 °F; 

late refueling 

B13 2 Startup Startup 

Total Condition CDP = 130 5.43E-07 

Note 1: During shutdown period, isolation condenser could be credited for decay heat removal, as modeled in the at-power 

operation in the SPAR models. 

Plant Mode / Event Type IE Frequency (per year) Condition CDF (per year) Condition CDF (per hr) 

LOOP / IE-LOOP-SD 3.31E-02 2.96E-07 3.38E-11 

Loss of Running RHR / IE-TRANS-SD 5.00E-06 4.02E-06 4.59E-10 

Loss of DC Bus B / IE-LODCB-SD 2.50E-03 1.40E-07 1.60E-11 

Loss of Intake Structure / IE-LOIS-SD 7.50E-03 3.05E-05 3.48E-09 

Loss of SW / IE-LOSWS-SD 4.00E-04 1.63E-06 1.86E-10 

 Total = 4.18E-09 

Note 2: Base CDP is not calculated since the plant condition CDP is already less than 1E-06. 

 7-1 Handbook Vol. 4 – Shutdown Events 

Shutdown Events:

Cases Where No SPAR-SD Model Exists 

Section 7 

Rev. 1.0 

7.0 Cases Where No SPAR-SD Model Exists 

7.1 Example Condition Analysis – Modify At-Power Model 

If there is no SPAR-SD model, and it is not feasible to construct one in a short time period, then 

the analyst should focus on a minimum number of risk-relevant POSs and initiating events. An 

actual example of such an SDP Phase 3 analysis occurred in 2009 for a four-loop single unit 

PWR where the RHR pumps had a condition during Mode 2. This condition is determined to be 

limited to Modes 2 and 3 only and a short time window. The risk-significant initiating events for 

this condition were determined to be events generating a safety injection (SI) signal (mainly 

LOCAs of different sizes). The modeling was limited to Mode 2 with LOCA initiating events and 

the ETs from at-power mode were borrowed and simplified to assess the risk for a short time 

window of this condition. The condition importance (ΔCDP) was quantified. 

7.2 Example Event Analysis – Create New ET 

For SD events or plant conditions that may not have a readily available SD SPAR model, an 

issue-specific model would have to be developed. An example is the ASP analysis performed 

for an event that involved low-temperature over-pressure (LTOP) conditions. No ET model for 

that event existed and was previously created. The ET models created for this event are given 

in the ET data base. One of these ETs is shown in Figure 7-1 for illustrative purposes. 

Definition, assignment, and quantification of shutdown-specific operator actions in fault trees 

(FTs) are discussed further in Appendix B of this document. 

The following process is provided in these cases: 

! Identify whether the issue is an event analysis or a plant condition analysis. 

! Identify the shutdown state(s), mode(s), or POS(s) the issue lends itself. See Figure 3-1 

for definition of POSs for an example plant, such as Davis-Besse. (The Davis-Besse 

SPAR-SD model is built by generic ET templates. For a later SPAR-SD model built by 

MMG, see Seabrook MMG model.) 

! For an event analysis, identify the following: 

- Initiating event; 

- POS; 

- Failed components / unavailable components (if any); 

- Operator actions that may need to be adjusted; 

- Time since the plant was last shutdown; and 

- Whether the event is during a forced outage or a planned outage. 

! For a plant condition analysis, identify the following: 
7. Cases Where No SPAR-SD Model Exists 

Risk Assessment of Operational Events 7-2 

Figure 7-1. Example Event Tree for LTOP Event 

- POS (or multiple POSs) involved; (Identify only the minimum number of POSs 

and initiating events necessary for the issue, since most likely, new ETs need to 

be constructed.) 

- Time spent in each in each POS; 

- Failed components / unavailable components (if any); 

- Operator actions that may need to be adjusted; 

- Time since the plant was last shutdown; 

- Whether the condition is during a forced outage or a planned outage; and 

- If PWR and mid-loop operations are involved, the number of times the mid-loop 

state is entered. 

! Download the latest SPAR model available for the plant in question. Examine the 

available ETs for at-power and/or SD modes in the model. If existing ET models that 

can be used with small modifications can be identified, copy and revise them. Also, 

examine the contents of the ET library for ET models that may be used with small 

revisions and import them if found. Make necessary changes to FTs and basic events, 

as needed. If the case requires major revisions, or totally new ETs, seek the assistance 

of the designated SD-cognizant person in your organization. 

 Figure 7-2 shows a SD event tree template for a 4-loop Westinghouse PWR, taken from 

an existing SPAR-SD model, for the loss of RHR cooling event in plant Modes 4 or 5. 

SD-LTOP-XHE-REC

Operator recovery action to

Open a valve (RV or PORV)

Fails after LTOP Challenge

SD-LTOP-RHR-RV-CL

RHR Suction Relief Valve Fails to

Close after LTOP Challenge

SD-LTOP-RHR-RV-OP

RHR Suction Relief Valve Opens

After LTOP Challenge and

Failure of PORVs to Open

SD-LTOP-PORV-CL

PORV(s) Close After LTOP

Challenge

SD-LTOP-PORV-OP

Cold Overpressure Mitigation

System Works 

(1/2 PORVs Open)

IE-SD-LTOP-OF

LTOP event due to 

overfeeding occurs

# END-STATE-NAMES

1 OK

2 OK

3 OK

4 T LOIG2

5 OK

6 T LOIG2

 SD-LTOP-OF - LTOP with overfill challenge during LP&SD operation 2008/12/08
7. Cases Where No SPAR-SD Model Exists 

 7-3 Handbook Vol. 4 – Shutdown Events 

Almost all event tree top nodes contain “stub” fault trees, where a operator action 

defined specifically for this shutdown mode is “or-gated” with the system failure fault 

tree (to be transferred-in. Figures 7-3 and 7-4 illustrate two such “stub-FTs” for two of 

the top nodes of the event tree given in Figure 7-2. 

Figure 7-2. Example Event Tree for Loss of RHR Cooling Event 

Figure 7-3. Stub-Fault-Tree for Event Tree Top “Initiate Standby RHR Train”7,8

 

7

 Basic event for a new (not present in the at-power model) SD operator action is defined. HEP calculated as 4E-03. 8

 New fault tree model made by copying a train of RHR from the at-power fault tree and setting T/M and other 

operator actions that do not apply to this SD state to zero (or removing them from the new fault tree). 
7. Cases Where No SPAR-SD Model Exists 

Risk Assessment of Operational Events 7-4 

Figure 7-4. Stub-Fault-Tree for Event Tree Top “Establish Forced Feed”9,10,11

! Quantify the CCDP or CDP of the scenario by solving for the sequences of only those 

ETs that are involved in the scenario. 

! Examine the cutsets to make sure that they reflect the intended scenario. Especially 

check operator action HEPs and validity of cutsets containing operator actions. Check 

for dependencies among operator actions. Modify as needed to obtain a proper 

estimate of risk for cutsets involving multiple operator actions. In the newer models built 

by MMG, dependencies are introduced by SAPHIRE basic event replacement rules; this 

is discussed in Appendix B. 

 

9

 New fault tree SD-LPI is made by copying and modifying the low-pressure injection (LPI) fault tree from at-power 

model. 

10 Existing high-pressure injection (HPI) fault tree is used. 

11 Basic event for a new (not present in the at-power model) SD operator action is defined (HEP calculated as 1E03). 
 8-1 Handbook Vol. 4 – Shutdown Events 

Shutdown Events:

Miscellaneous SD-Related Considerations

Section 8 

Rev. 1.0 

8.0 Miscellaneous SD-Related Considerations 

This section briefly discusses miscellaneous shutdown-related issues, and items that may be 

considered. Not all items are addressed yet in this version. 

For each of these items, how they are addressed may be highly dependent on the individual 

plant and the specific event or condition being analyzed. If an existing SPAR-SD model is being 

used, then the analyst should review the model and model documentation to ensure that these 

issues are addressed in a way that is consistent with the details of the specific event or 

condition being analyzed. 

8.1 Core Damage 

It is assumed that the progression of a core damage (CD) sequence during shutdown 

operations will in most cases follow the steps such as: 

! Boiling 

! Core Uncovery 

! Core Damage 

In many cases, boiling or core uncovery times can be easily estimated, even by hand 

calculations, and are used as surrogates for core damage. The analyst must recognize that 

using these surrogates in SD models is deemed to be conservative. No attempt is made in this 

Handbook to define CD during shutdown operations; it can be taken as the same as core 

damage during at-power operations. 

8.2 RHR Recovery in the Long Term 

It is recommended that in a shutdown sequence, the sequence success criteria should always 

include long term recovery of RHR (or sustained operation of RHR). Temporary temperature 

control strategies (e.g., gravity injection) can be used as the means to gain time to repair/restore 

RHR, but not necessarily as a sufficient condition to declare sequence success (i.e., no core 

damage). A stable end state definition for a SD sequence should terminate with restoration of 

decay cooling (normally by RHR). 

A simple long term RHR repair model is provided in the MMG. 

8.3 Containment Integrity 

In cold shutdown and refueling modes, the containment may be open and it may take time, at 

the order of hours, to close the containment hatches. This should be considered as a factor if 

fission product release is also analyzed. In refueling mode, if RCS boiling occurs, the effect of 

steam in operations in the containment and in securing the containment must be considered. 
8. Miscellaneous SD-Related Considerations 

Risk Assessment of Operational Events 8-2 

8.4 Sequence Mission Time 

In some shutdown sequences, the time to core damage may be longer than 24 hours (for 

example in a loss of decay heat removal during refueling with reactor cavity filled and no loss of 

inventory event). The mission time for such sequences should be extended beyond the usual 

24-hour period (see Volume 1, Section 4); until a sustainable safe state is reached. Such a 

longer time window may also allow crediting recovery/repair actions that may have not been 

feasible in a 24-hour period. 

8.5 Shutdown Procedures 

Availability of, or lack of, shutdown procedures specific to the event(s) being analyzed is crucial 

to the fidelity of the models. These procedures determine which operator actions and 

equipment are feasible to be credited. This point is also emphasized in the MMG and it is 

recommended that the first step in model construction should be to obtain the plant-specific 

procedures and make sure that the event trees reflect the realistic operator actions and 

hardware-human interactions. 

8.6 Equipment Availability 

In different shutdown operation modes, different trains of equipment may be taken out of service 

or aligned to other functions than normally expected. This type of equipment unavailability is 

not random, but is planned. Moreover, the list of unavailable equipment is likely to change from 

one shutdown mode or POS to the next. This equipment unavailability should be factored into 

the ET and FT models. MMG specifies identification of available equipment by the plant 

operational modes in question at an early stage of the modeling process. 

8.7 Transition Risk and Low Power 

Current version of this Handbook is limited to hot shutdown, cold shutdown, and refueling 

modes of the shutdown operations. It does not discuss low-power operation modes and 

transition risk. 

8.8 Over-Drain Events during Mid-Loop Operation – PWR 

The loss of inventory due to over-draining initiating event is defined as the operator error of over 

draining the reactor vessel when going to a mid loop condition in the RCS. This is not an actual 

RCS leak or LOCA that requires isolation; simply a case of when the operator is lowering level 

for mid loop operations, the RCS level was reduced to the point where RHR cooling was 

rendered inoperable (at least temporarily). The loss is assumed to terminate when the level 

drops below the bottom of the RCS loop hot leg). However, RCS makeup is required to re 

establish RHR cooling. 

Since this initiating event is possible only during drain down to reduce inventory, it can only 

occur during the transition from POS M5 full inventory or POS-M6 to M5 reduced inventory. 

Also note that the loss of inventory at reduced inventory initiating event is a demand based 

initiating event. The demand (or opportunity for the failure event to occur) is the draining of the 

RCS to reach a mid-loop condition. 
8. Miscellaneous SD-Related Considerations 

 8-3 Handbook Vol. 4 – Shutdown Events 

The initiating event demand-frequency for this event is initially set to two demands per outage, 

which is the expected number of times drain-down is expected in a refueling outage. This is 

followed by an even tree node that models the operator error of over-draining with a HEP of 

1.8E 02 (taken from PWR models in Reference 1-3). The initiating event frequency may be 

zero if mid-loop is not entered in the shutdown of interest; it may be 2 if mid-loop is entered 

once to place the SG nozzle dams, and once to remove them. In one occasion, it was entered 

six times in a 30-hour period due to problems with leakage of the nozzle dams. 

It should be noted that this event is caused by an operator error to terminate the drain-down. 

Ensuing operator actions postulated to deal with the event may need to be conditioned on the 

original operator error that caused the initiating event. Figure 8-1 illustrates the ET for overdrain events. 

Figure 8-1. Template Event Tree for Over-Drain Event (ML-OD) for PWRs 

Insights from past SD risk studies indicate that the CCDP of this event may be significantly 

higher than other initiating events. This is due to the fact that the event causes loss of RHR and 

also allows a short time window for recovery since the water level is very close to the top of the 

core and boiling will uncover the core in a relatively short time. 

SD-LOI-LTR-FT

LONG TERM RECOVERY 

IN LOI

SD-LOI-FEED-LT-FT

OPERATORS INITIATE FEED

AFTER RHR FAILURE

BEFORE CORE DAMAGE

SD-OD-RHR-REC-FT

OPERATORS RESTART 

RHR AND TERMINATE LOI

SD-LOI-FEED-FT

OPERATORS INITIATE

RCS FEED

SD-OD-DIAG-FT

OPERATORS DIAGNOSE OD

EVENT BEFORE CORE

 UNCOVERY

SD-OD-OPER-ER-FT

NO OPERATOR ERROR 

CAUSING OVERDRAIN

AND FAILURE OF

RUNNING RHR PUMP

IE-ML-OD

NUMBER OF TIMES RCS 

LEVEL IS REDUCED TO 

HOT LEG OR MIDLOOP 

# END-STATE-NAMES

1 OK

2 OK

3 OK

4 CD-SD

5 OK

6 CD-SD

7 CD-SD

8 CD-SD

2 DEMANDS PER OUTAGE

 HEP-1 = 1.8E-02

 HEP-2 = 2E-04

 SD-ML-OD - Number of times RCS level is reduced to hot leg or midloop 2010/05/10
8. Miscellaneous SD-Related Considerations 

Risk Assessment of Operational Events 8-4 

8.9 Decay Heat Time Windows 

The amount of time that has passed since the reactor is tripped determines the decay heat 

level, thus the time to boiling if RCS is not cooled. The longer this time is the longer will be the 

time to boiling and the time to core damage, which allows more time for recovery and operator 

actions. 

Four DH time windows are defined for the SPAR-SD models, as shown in Table 2-1. The 

concept of the plant being in a POS in an “early” DH time window, or a “late” DH time window is 

mentioned in the SPAR-SD models. DH time window should not be confused with the operator 

action time window, although the later DH time windows will allow longer operator action time 

windows. 

8.10 System Success Criteria 

The success criteria for the systems modeled may need to be adjusted for shutdown operations. 

For example, the number of pump trains required or dependence on pump room cooling are 

success criteria that may be different during shutdown than at-power. 

The existing SPAR-SD models have already incorporated features in the system FTs to account 

for differences in shutdown success criteria. However, the success criteria can also depend on 

the details of the specific event or condition being analyzed. For example, if a LOI is being 

modeled, the size of the break flow will influence the number of pumps to be able to cope with 

the event and the operator action time windows. For smaller LOI events, less number of pumps 

may be sufficient and longer time windows for operator actions may be available. 

8.11 Alarms, Interlocks, and Automatic Actions 

During shutdown operations some of the alarms, interlocks, and automatic actions, which are 

normally active while at power, could be inactive or defeated. These issues can have 

considerable effects on the system response and operator response to an accident. An 

example may be an RHR automatic isolation signal on high pressure that is defeated during 

shutdown operations. 

8.12 Electrical Power 

Dependencies on electrical power sources can be different at shutdown conditions than atpower. This is especially true when electrical bus or diesel generator maintenance is being 

performed during an outage. The plant may use an alternate electrical line-up or add an 

additional diesel generator during shutdown. If these changes can be supported by plant 

shutdown procedures, then the shutdown model should credit them. 

8.13 Valve Alignment 

The alignment of certain key valves may be different during shutdown modes than at-power. 

Typically, basic events and fault trees are “borrowed” from the at-power model and used in the 

shutdown model. Due to the differences in valve alignment, some basic events may not be 

applicable in shutdown modes. Modifying the shutdown model to account for all valve line-up 

changes is likely not practical. Nevertheless, the shutdown model cutset results should be 

reviewed to see that any risk important basic events are actually valid for the shutdown POS. 
8. Miscellaneous SD-Related Considerations 

 8-5 Handbook Vol. 4 – Shutdown Events 

An example of a valve alignment that can make an at-power basic event invalid is given here. 

An RHR heat exchanger service water supply valve may be normally closed during power 

operation, and a failure-to-open (FTO) The basic event is included in the at-power model. 

When the plant is shutdown, the same valve is normally open. For the purposes of a SD event 

analysis, the FTO basic event would not be valid. 

 A-1 Handbook Vol. 4 – Shutdown Events 

Shutdown Events:

Appendix A – Model and Data for Shutdown Events

Appendix A 

Rev. 1.0 

Appendix A – Model and Data for Shutdown Events 

A.1 Correspondence between Operating Modes and POSs 

Table A-1 shows the correspondence between NUREG/CR-6144 POSs, technical specification 

operating modes, and SPAR POSs. This table is taken from SPAR-SD models, Table 1-4. 

Table A-2 provides the POS naming convention. 

A.2 Initiating Event Frequencies 

Seven initiating event categories are defined for shutdown operations. The initiating event 

frequencies of these categories are given in Table A-3. Note that IESD OD “frequency” is 

actually a demand failure per entry to the applicable POSs (POS-M5ERVO, and POSM5LRVO); it does not apply to the remaining ten POSs. 
Appendix A – Road Map: Risk Analysis of Operational Events 

Risk Assessment of Operational Events A-2 

Table A-1. Comparison of POS Definitions 

NUREG/CR-6144 

POS Description 

Technical 

Specification 

Operating Mode 

(SPAR POS) 

1 

Low Power Operation and Reactor Shutdown

• Turbine and Rx power levels are decreased to low power levels w/out 

causing Rx trip or loss of power conversion system (PCS) 

• Power at 10-15% 

• RCS temp (Tave) is 547°F 

Mode 1 - Power 

Operation 

2 

Cooldown with SGs to 345°F

• Cooldown from 547°F and 2235 psig to RCS temp ~345°F and press 

~345 psig 

Mode 3 - Hot 

Standby 

3 

Cooldown with RHR to 200°F

• Cooldown of Rx from 345°F to ≤ 200°F by controlled main turbine steam 

bypass (while maintaining SG pressure) 

• RHR is placed in service during hold 

• All engineered safeguard pumps (except one charging pump) is placed in 

pull-to-lock (PTL) 

• RCS pressure is maintained at 345 psig with a bubble in the pressurizer 

• Once RHR is in service SG steaming and RHR cooling is used to 

cooldown RC until SG pressure decreases to 5 to 15 psig (RCS temp 

220 - 250°F) 

Mode 4 (M4E) - 

Hot Shutdown 

Before Refueling 

(Early) 

4 

Cooldown to Ambient Temperature (using RHR)

• RCS is cooled down from 195 to ~ 140°F by RHR heat exchangers flow 

control 

• RCS pressure is maintained at 345 psig with a bubble in Pressurizer 

Mode 5 (M5EF) - 

Cold Shutdown 

Before Refueling 

(Early), Full RCS 

Inventory 

5 

Draining the RCS to Mid-Loop

• Starting at 140°F with a bubble, the one operating RCP and pressurizer 

heaters are secured 

• The RCS is depressurized by spray down of the pressurizer and filling it 

Mode 5 (M5EF) - 

Cold Shutdown 

Before Refueling 

(Early), Full RCS 

Inventory 

6 Mid-Loop Operations

• RCS at mid-loop, may be vented, the RC loops may be isolated 

Mode 5 (M5ER) - 

Cold Shutdown 

Before Refueling 

(Early), Reduced 

RCS Inventory 

7 

Fill for Refueling

• The Rx head is de-tensioned, unbolted, and removed 

• The water level is raised to flood the Rx 

• The upper internals are removed and stored underwater 

Mode 5 (M5ER) - 

Cold Shutdown 

Before Refueling 

(Early), Reduced 

RCS Inventory 

8 

Refueling

• With Rx head removed and refueling cavity flooded, the spent fuel 

assemblies are removed from the Rx core 

Mode 6 (M6) 

Refueling 

9 Draining RCS to Mid-Loop after Refueling

• The Rx head bolts are tensioned 

Mode 5 (M5LR) - 

Cold Shutdown 

After Refueling 

(Late), Reduced 

RCS Inventory 
 A-3 Handbook Vol. 4 – Shutdown Events 

NUREG/CR-6144 

POS Description 

Technical 

Specification 

Operating Mode 

(SPAR POS) 

10 Mid-Loop Operations after Refueling

Mode 5 (M5LR) - 

Cold Shutdown 

After Refueling 

(Late), Reduced 

RCS Inventory 

11 

Refill RCS Completely

• Water level is raised using CVCS 

• RCS is brought solid 

Mode 5 (M5LF) - 

Cold Shutdown 

After Refueling 

(Late), Full RCS 

Inventory 

12 Heat-up Solid and Draw a Bubble

• The solid RCS is pressurized to ~345 psig 

Mode 5 (M5LF) - 

Cold Shutdown 

After Refueling 

(Late), Full RCS 

Inventory 

13 

Heat-up to 350°F

• Pressurizer ~345 psig, temperature controlled by RHR heat exchanger 

flow at 195°F 

Mode 4 (M4L) - 

Hot Shutdown 

After Refueling 

(Late) 

14 

Heat-up with SGs available

• The RCS and secondary systems continue the unit heat-up within heat-up 

rate limits 

Mode 2 - Startup 

15 

Rx Startup and Low Power Operation

• RCS pressure at 2235 psig, temperature at 547°F 

• Rx brought critical and power increased (<10%) to warm-up 

Mode 1 - Power 

Operation 
Appendix A – Road Map: Risk Analysis of Operational Events 

Risk Assessment of Operational Events A-4 

Table A-2. POS Naming Convention 

POS naming convention is based on a six-character identifier that defines five different plant operating 

state characteristics: 

Plant Mode 

M4 Mode 4 

M5 Mode 5 

M6 Mode 6 

Time Frame (in Relation to Refueling Mode) 

E Early (before refueling) 

L Late (after refueling) 

X Not applicable (refueling mode) 

RCS Inventory Status 

R Reduced RCS inventory 

F Full RCS inventory 

RCS Pressure Boundary Status 

V Vent open in the RCS pressure boundary 

I Intact RCS pressure boundary 

RCS Loop Status 

B Blocked RCS loops (i.e., all steam generators are isolated from the rest of the RCS) 

O Open RCS loops (i.e., RCS flow through the steam generators is possible) 

For example POS-M6XFVB stands for plant is in mode 6; plant is in refueling mode; RCS is full; RCS is 

vented (open); RCS loops are blocked. 

Table A-3. Davis-Besse LP/SD SPAR Model Initiating Events 

Initiating 

Event Name Description Initiating Event Frequency (/yr)12

IESD-LORHR Loss of decay heat removal capability (other than RHR loop 

isolation) 9.74E-03 

IESD-ISOL RHR loop isolation 4.87E-03 

IESD-LOOP Loss of offsite power 1.93E-01 

IESD-LOAC Loss of operating AC division 1.15E-01 

IESD-LOI Loss of inventory due to LOCA or recoverable diversion of RCS 

coolant 1.95E-02 

IESD-LOLC Loss of level control at reduced inventory 1.31E-01 

IESD-OD Loss of inventory at reduced inventory due to over-draining 

(demand-related rate)13 1.80E-02b

 

12 Rates are given per shutdown year (except for IESD-OD). 

13 IESD-OD is the demand-related loss of inventory caused by the operator over-draining the RCS with the intent of 

reducing RCS level to mid-loop (or reduced inventory conditions). This SPAR value is per demand, and does not 

have time-based units. 
 B-1 Handbook Vol. 4 – Shutdown Events 

Shutdown Events:

Appendix B – Treatment of Operator Actions in Shutdown 

Scenarios

Appendix B 

Rev. 1.0 

Appendix B – Treatment of Operator Actions in Shutdown Scenarios 

This subject is discussed in detail in Attachment A of the MMG. The contents of the attachment 

are repeated here for the convenience of the reader. 

B.1 Process Steps 

1. Obtain and refer to the plant-specific procedures. 

2. Define operator action at the highest possible level – e.g. at the event tree node level, 

initially. Further breakdown can be done later on as needed. (See Figure B-1 for an 

example). 

3. Fill out a task analysis form for each operator action defined, using the plant procedures 

for the shutdown conditions. (Table B-1-1) 

4. Quantify HEP of each defined action without dependency considerations. Use SPAR-H 

plus the tables attached to the MMG. 

5. Use the event tree picture to identify sequences with multiple operator actions and 

potential HEP dependencies. Mark these on the event tree picture (see example in 

Figure B-1-2). From these, define HEP dependency rules for multiple HEPs appearing 

in cutsets. Put these HEP dependency rules in SPAR-SD model recovery files (See 

example in Table B-1-2). Calculate HEPs for dependent actions. Refer to HEP 

dependency rules in Table B-1-3 for these calculations. 

5a. If an initiating event is caused by a human error, make sure that this is also 

considered for starting a chain of dependency rules. 

6. Use Table B-1-4 to limit total HEP credit taken in a sequence based on sequence 

characteristics such as: 

6a. Sequence time window (STW) from the beginning of the first action to the noreturn time for the last action to be credited. 

6b. Complexity of all the actions viewed together in the sequence. 

6c. Number of failed systems/trains/components; complexity of the failed equipment 

status. 

6d. Abundance or lack of multiple cues, team members, teams, checking and 

recovery opportunities in the sequence. 

Key issues addressed: 

! Keeping HEP basic event inflation from happening (e.g. number of basic events 

defined).
Appendix B Treatment of Operator Actions in Shutdown Scenarios 

Risk Assessment of Operational Events B-2 

! Dependency modeling (including dependency on initiating event human errors). 

! Sequence cutoff probability limit for HEPs. 

! Systematic use and documentation of dependency rules and sequence cutoff credit 

given. 

What is new? 

! Weak dependence is introduced; 

! Sequence cutoff probability is read off a table. 

B.2 HEP Library 

Previously calculated HEPs for SD events are assembled in a table of HEP library as a 

reference. Table B-2-1 illustrates the contents of this library. 

Figure B-1. Example Placement of HEP in Event Tree Node FT 

LP-INJ-FT

3.700E-3

LP-XHE-FAILS-SD-M4 LP-SYS-FAILS

7

LP-SYS-1-FT

8

LP-SYS-2-FT

Failures of

LP systems

LP System 1

fails

LP System 2

fails

Opr.fail to diag.

need & actu. LP

inj. (SD mode 4) 

LP Injection

fails in Mode 4

 LP-INJ-FT - LP Injection fails in Mode 4 2008/12/19 Page 9
Appendix B Treatment of Operator Actions in Shutdown Scenarios 

 B-3 Handbook Vol. 4 – Shutdown Events 

Figure B-1-2. Illustration of Marking Potential HEP Dependencies on an ET

Notes for Figure B-1-2: 

The purpose is to identify rules for potential HEP dependencies in core damage sequences, including failure of an operator action 

that may have caused the initiating event. 

- Label each ET node, including the initiating event by integers as shown. Assume each of the 6 nodes thus labeled may 

have an operator action as a single element cutset. If one node does not have such a HEP its integer is not used in the 

next steps. 

- Examine sequences leading to core damage and containing consecutive failed operator actions. Label consecutive failed 

nodes with HEPs along a core damage sequence with the integer corresponding to the ET node (see Figure B-1-2 for 

illustration). 

In this example, the initiating event does not have any operator failure. As an illustration, look at sequence 10 which has two 

consecutive operator actions, 2 and 5. This sets up rule #1 which will be placed in the SPAR-SD model recovery file as: 

If HEP2 and HEP5 exist in the same cutset, replace HEP5 with HEP5D (dependent HEP5 is labeled as HEP5D in this case). In 

SAPHIRE recovery rules terminology, this rule will look like as follows: 

if HEP2 * HEP5 then 

DeleteEvent = HEP5; 

AddEvent = HEP5D; 

endif 

- Note that if there is a successful ET node (containing a single-element cutset operator action) between two other failed 

event tree nodes with operator actions, it breaks the dependency. For example, in sequence 6, there is no potential 

dependency rule between HEP4 and HEP6, since success of node 5 with a successful HEP breaks a potential 

dependence. 

- Note that sequence #7 provides 3 different potential dependency rules, one for HEPs 3, 4, and 5; a second one for HEPs 

4 and 5; and a third one for HEPs 3 and 4. 

- This example identifies and defines 6 potential dependency rules, which need to be analyzed to see if actual 

dependencies exist. If they do, then HEPs for each must be calculated and placed as additional basic events into the 
Appendix B Treatment of Operator Actions in Shutdown Scenarios 

Risk Assessment of Operational Events B-4 

SPAR-SD model. Then, the 6 recovery rules corresponding to these should be placed into the recovery rules file, in a 

separate paragraph at the end. 

Table B-1-1. Example Task Analysis before HEP Calculation 

HEP ID: SD-SLOI-DIAG-XHE 

Task Analysis before HEP Calculation 

1. Operator Action Description 

This is diagnosis step that requires the operator to recognize the that an event has occurred, 

determine what type of event it is and determine which procedure(s) need to be used to address 

the event. 

The control room received multiple annunciators when the electrical power slow transferred from 

the aux transformer to the backup transformer. The electrical transient also caused the running 

SDC pumps to stop momentarily while power swapped and both pumps restarted when power 

was returned. 

The control room received no annunciators on the decreasing RCS level. 

2. Other Failed Equipment / Events

Most of the electrical loads re-energized as the slow transfer progressed. However, the 1XP 600 

volt AC attempted to re-energize but tripped on high in-rush current. It remained de-energized 

throughout the event and was not re-energized until several hours after the event. This 

complicated the event because it removed motive power from several front line systems that were 

required to mitigate the event. It did not impact any of the instrumentation that were required to 

diagnoses the event. However, it did distract the operators by adding to the cognitive work load. 

3. Operator Action Success Criteria

The operator must recognize the abnormal event and start implementing the applicable 

procedure AP-26 “Loss of Decay Heat Removal”. 

4. Cues 

Decreasing level on control room indicators and associated computer displays feed from LT-5A 

and 5B. When level has decreased approximately 10 inches to a plus 60 inches a computer point 

alarm annunciated in the control room. However, the operators missed this annunciation as it 

was masked by many other computer points that were received due to the loss of power and 

subsequent re-energization. 

A secondary cue was increasing level in the miscellaneous waste holdup tank (MWHUT). The 

combination of lowering RCS level and rising MWHUT level is indicative of a problem with the 

purification system. 

5. Procedure + Relevant Steps 

AP-26 “Loss of Decay Heat Removal” revision 20 was the controlling procedure for this event. It 

supplies the appropriate entry conditions in Step 1. The relevant entry conditions are: 

- Loss of RCS inventory while on LPI DHR 

- Loss of DHR capability as a result of loss of power 
Appendix B Treatment of Operator Actions in Shutdown Scenarios 

 B-5 Handbook Vol. 4 – Shutdown Events 

6. Main Control Room or Local Action 

This is a main control room (MCR) cognitive event. The level indication is indicated in the control 

room. The reactor operator is responsible for monitoring the appropriate RCS parameters and 

the shift supervisor (SRO) is responsible for decision making. 

7. Diagnosis (with or w/o recovery) / Execution (with or w/o recovery) / Diagnosis + Execution 

This is a purely diagnostic event. If the operator fails to recognize that an event is occurring or 

fails to recognize that this is a loss of inventory event, there will be additional cues when the RCS 

level decreases sufficiently to perturb the SDC pumps. However, this second scenario will be 

evaluated with a second human failure event (HFE). Therefore, there is no recovery analyzed in 

this event. 

8. Time Windows / Nominal / Mean / Median Actions Times 

RCS level was decreasing at approximately one inch per minute. The indicated starting level was 

70 inches; this is from a reference point of instrument zero at the center line of the hot leg. 

Shortly after reaching a level of 0, the running decay heat removal (DHR) pumps will need to be 

secured to prevent damage to them. This will be indicated to the operator by additional control 

room annunciators. Thus the time available for diagnosis and subsequent operator actions is 

approximately 70 minutes. The subsequent actions, however, will be handled by other HFEs. 

As a point of reference, the operators recognized the event and entered the correct procedure in 

about two minutes. 

9. Relevant Performance Shaping Factors 

- Time: Additional time was available for this event. 

- Stress: With a LOI event occurring stress was elevated. In addition to the LOI an 

additional stressor was the momentary loss of offsite power and a subsequent failure to 

re-energize the 1XP bus. 

- Complexity: With the reactor in cold shutdown, the operators’ primary focus is on reactor 

level and temperature. The RCS level was being displayed on multiple monitors in the 

MCR. The operators monitored this parameter by looking for a flat line response on the 

displays. A flat line indicated that level was being maintained as desired. A decreasing 

level indicated a problem. However, there were no direct annunciators on this parameter. 

The first MCR annunciator would not be received on this parameter until 70 minutes after 

the event initiation. There was a computer point alarm that was received about 10 

minutes after the event initiation, however, the operators missed this cue. Finally, the 

entry conditions for this procedure were straightforward and simple and the operators 

were well trained on them. 

10. Define Subtasks / Failure Modes / Assign BE ID(s) 

- Subtasks: There are none. 

- Failure modes: 

Operator fails to recognize RCS level is decreasing. 

Operators recognize that level is decreasing but fail to enter the correct procedure. 

- BE ID: SD-SLOI-DIAG-XHE 
Appendix B Treatment of Operator Actions in Shutdown Scenarios 

Risk Assessment of Operational Events B-6 

Table B-1-2. Example HEP Dependency Rules in the SAPHIRE Project Recovery File 

|SD – SAPHIRE Recovery Rules for Conditional HEP Substitutions in SD CDF Cutsets 

|Rule 1: 2,6 

if SD-SLOI-DIAG-XHE * SD-SLOI-ISOL-BCD-XHE then 

DeleteEvent = SD-SLOI-ISOL-BCD-XHE; 

AddEvent = SD-SLOI-ISOL-BCD-XHE-D1; 

|Rule 2: 3,5,6 

elsif SD-SLOI-FEED-XHE * SD-SLOI-ISOL-BRF-XHE * SD-SLOI-ISOL-BCD-XHE then 

DeleteEvent = SD-SLOI-ISOL-BRF-XHE; 

DeleteEvent = SD-SLOI-ISOL-BCD-XHE; 

AddEvent = SD-SLOI-ISOL-BRF-XHE-D2; 

AddEvent = SD-SLOI-ISOL-BCD-XHE-D2; 

endif 

Table B-1-3. HEP Dependency Rules 

q2 is potentially dependent on q1 

Dependency Level Calculation of q1 Example with q2= 0.01 Small q2 Approximation 

No Dependency q2 0.01 q2 

Weak dependency (1+99*q2) / 100 0.02 0.01 

Low dependency (1+19*q2) / 20 0.06 0.05 

Medium dependency (1+6*q2) / 7 0.15 0.15 

High Dependency (1+q2) / 2 0.51 0.5 

Complete dependency 1 1 1 

Notes: 

1. All dependency levels except for “weak dependency” are defined in SPAR-H. 

2. Weak dependency level is introduced to give analysts more modeling options, especially with 

longer time windows that may be available in shutdown operations: use weak dependency when 

two HEPs are in a sequence with a large time window; actions are simple; abundant or clear cues 

exist, yet no dependence cannot be postulated. 
Appendix B Treatment of Operator Actions in Shutdown Scenarios 

 B-7 Handbook Vol. 4 – Shutdown Events 

Table B-1-4. Sequence Cutoff Probabilities 

Case-1 Case-2 Case-3 

Hour Complicated Nominal Case Simple

1 1.0E-03 1.0E-04 1.0E-05 

8 1.0E-04 3.0E-05 1.0E-06 

12 3.0E-05 1.0E-05 3.0E-07 

16 1.0E-05 1.0E-06 1.0E-07 

24 1.0E-06 1.0E-07 1.0E-08 

48 1.0E-07 1.0E-08 < 1E-08 

- Do not use if the total time window is less than 1 hour. 

- Measure sequence time window (STW) from the beginning of first action to point of no return time 

of last action. 

- This time window may be less than the total time to core damage. 

- Use geometric interpolation for other hours not shown in the tables. 

Use the following three criteria to select a case; if the sum is 2 or 3, assign a case; otherwise keep going 

with the tie-breaker criteria 4, 5, 6 to assign a case. (The numbers are placed for illustration; ignore them 

when using this process.) 

No Maybe Yes 

1. Abundant and Clear Cues; New Ones in Time 1 

2. Simple Event 1 

3. Few Equipment Failures 1 

Sum = 2 1 0 

Assign to case Case 1 Case 2 Case 3 

Tie Breaker

4. All actions Proceduralized 

5. All actions in MCR 

6. All actions in Simulator Training 

7. Change from Emergency Operating Procedures/Emergency Response Guidelines to FRGs (Change 

of Procedure) 

Tie Breaker Sum = 
Appendix B Treatment of Operator Actions in Shutdown Scenarios 

Risk Assessment of Operational Events B-8 

Table B-2-1. HEP Library (partial list for illustration) 

Plant Oconee 

Initiating Event Small Loss of Inventory during Cold Shutdown 

Human Error 

Event Description

Controlled 

by OPs 

Crew

Time 

Available

Mean 

Diagnosis 

HEP

Mean 

Action 

HEP

Total 

Mean 

HEP

Comments 

SD-SLOIDIAG-XHE 

Operator fails to 

diagnose small LOI 

outside of containment 

before loss of SDC 

One 30 min 1.0E-03 N/A 1.0E-03 Extra time, 

simple 

SD-SLOIFEED-XHE Operator fails to initiate 

feed before loss of SDC One 40 min 2.0E-03 4.0E-03 6.0E-03 

High stress, 

obvious 

diagnosis, 

procedures 

less than 

desirable 

SD-SLOIFEED-LT-XHE 

Operator fails to initiate 

feed after loss of SDC, 

before core damage 

One 90 min 2.0E-04 1.0E-03 1.2E-03 

Extra time, 

obvious 

diagnosis, high 

stress, poor 

procedures 

SD-SLOIISOL-AFDXHE Operator fail to terminate 

SLOI leak before RWST 

is depleted 

Two ~30 hrs N/A 1.0E-05 1.0E-05 Extra time, 

SD-SLOIISOL-BRFXHE Operator fails to 

terminate SLOI leak 

before SDC fails 

One 40 min N/A 2.0E-03 2.0E-03 High stress 

SD-SLOILTR1-XHE 

Operators fail to refill 

BWST as part of longterm recovery Two ~30 hrs 1.0E-05 4.0E-04 4.1E-04 

Extra time, 

obvious 

diagnosis, 

moderate 

complexity, 

incomplete 

procedures 

SD-SLOILTR2-XHE 

Operators fail to restart 

LPI in SDC mode as part 

of long-term recovery 

Two ~30 hrs N/A 2.0E-04 2.0E-04 

Extra time, 

moderate 

complexity 

Notes: 

1. An HEP below this value will push into reliability range of automatic actuation logic 

2. Estimated TTB = 20 minutes 

3. Estimated TTCD is 90 minutes if drain down continues to mid-loop 

4. Success criteria > 100 gpm 

5. Source: ML0832604041 

6. N/A = Not Applicable