NUREG-1753

Risk-Based Performance 

Indicators: Results of 

Phase 1 Development 

U.S. Nuclear Regulatory Commission 

Office of Nuclear Regulatory Research 

Washington, DC 20555-0001
AVAILABILITY OF REFERENCE MATERIALS 

IN NRC PUBLICATIONS

NRC Reference Material 

As of November 1999, you may electronically access 

NUREG-series publications and other NRC records at 

NRC's Public Electronic Reading Room at 

www.nrc.gov/NRC/ADAMS/index.html. 

Publicly released records include, to name a few, 

NUREG-series publications; Federal Register notices; 

applicant, licensee, and vendor documents and 

correspondence; NRC correspondence and internal 

memoranda; bulletins and information notices; 

inspection and investigative reports; licensee event 

reports; and Commission papers and their 

attachments. 

NRC publications in the NUREG series, NRC 

regulations, and Title 10, Energy, in the Code of 

Federal Regulations may also be purchased from one 

of these two sources. 

1. The Superintendent of Documents 

U.S. Government Printing Office 

Mail Stop SSOP 

Washington, DC 20402-0001 

Internet: bookstore.gpo.gov 

Telephone: 202-512-1800 

Fax: 202-512-2250 

2. The National Technical Information Service 

Springfield, VA 22161-0002 

www.ntis.gov 

1-800-553-6847 or, locally, 703-605-6000 

A single copy of each NRC draft report for comment is 

available free, to the extent of supply, upon written 

request as follows: 

Address: Office of the Chief Information Officer, 

Reproduction and Distribution 

Services Section 

U.S. Nuclear Regulatory Commission 

Washington, DC 20555-0001 

E-mail: DISTRIBUTION@nrc.gov 

Facsimile: 301-415-2289 

Some publications in the NUREG series that are 

posted at NRC's Web site address 

www.nrc.gov/NRC/NUREGSfndexnum.html 

are updated periodically and may differ from the last 

printed version. Although references to material found 

on a Web site bear the date the material was 

accessed, the material available on the date cited may 

subsequently be removed from the site.

Non-NRC Reference Material 

Documents available from public and special technical 

libraries include all open literature items, such as 

books, journal articles, and transactions, Federal 

Register notices, Federal and State legislation, and 

congressional reports. Such documents as theses, 

dissertations, foreign reports and translations, and 

non-NRC conference proceedings may be purchased 

from their sponsoring organization. 

Copies of industry codes and standards used in a 

substantive manner in the NRC regulatory process are 

maintained at

The NRC Technical Library 

Two White Flint North 

11545 Rockville Pike 

Rockville, MD 20852-2738 

These standards are available in the library for 

reference use by the public. Codes and standards are 

usually copyrighted and may be purchased from the 

originating organization or, if they are American 

National Standards, from

American National Standards Institute 

11 West 4 2 m Street 

New York, NY 10036-8002 

www.ansi.org 

212-642-4900

Legally binding regulatory requirements are stated 

only in laws; NRC regulations; licenses, including 

technical specifications; or orders, not in 

NUREG-series publications. The views expressed 

in contractor-prepared publications in this series 

are not necessarily those of the NRC. 

The NUREG series comprises (1) technical and 

administrative reports and books prepared by the 

staff (NUREG-XXXX) or agency contractors 

(NUREG/CR-XXXX), (2) proceedings of 

conferences (NUREG/CP-XXXX), (3) reports 

resulting from international agreements 

(NUREG/IA-XXXX), (4) brochures 

(NUREG/BR-XXXX), and (5) compilations of legal 

decisions and orders of the Commission and 

Atomic and Safety Licensing Boards and of 

Directors' decisions under Section 2.206 of NRC's 

regulations (NUREG-0750).
NUREG-1753 

Risk-Based Performance 

Indicators: Results of 

Phase 1 Development 

Manuscript Completed: November 2001 

Date Published: April 2002 

H. G. Hamzehee,' Principal Author 

Contributing Authors: 

R. W. Youngblood2, S. A. Eide3, R. F. Buell', 

H. Dezfuli2, C. Atwood3, C. Smith2

, R. Bertucio4, 

L. Wolfram3, J. F. Meyer', F. Zikria2, K. Green2 

'Division of Risk Analysis and Applications 

Office of Nuclear Regulatory Research 

U.S. Nuclear Regulatory Commission 

Washington, DC 20555-0001 

2ISL, Inc. 

11140 Rockville Pike 

Rockville, MD 20852 

3

Idaho National Engineering and Environmental Laboratory 

2525 N. Fremont Avenue 

Idaho Falls, ID 83415 

4

SCIENTECH, Inc. 

400 West Gowe Street 

Kent, WA 98032
NUREG-1753, has been reproduced from 

the best available copy.
ABSTRACT

This report presents the results of the Phase 1 development of risk-based performance indicators (RBPIs) to potentially enhance the Reactor Oversight Process (ROP). SECY-99-007 recognized that improved performance indicators may be developed as part of the evolution of the ROP. RBPIs reflect changes in licensee performance that are logically related to risk and associated models. To the extent practical, the RBPIs identify declining performance before performance becomes unacceptable, without incorrectly identifying normal variations as degradations (i.e., avoid false-positive indications and false-negative indications). Phase 1 of the RBPI development includes performance indicators that are related to the initiating events cornerstone, mitigating systems cornerstone, and the containment portion of the barrier integrity cornerstone. The potential integration of RBPIs into the ROP would follow the change process described in IMC-0608, "Performance Indicator Program."

iii
TABLE OF CONTENTS 

A B STR A CT ................................................................. 111 

LIST OF FIGU RES .......................................................... vii 

LIST OF TA BLES ........................................................... viii 

EXECUTIVE SUM M ARY ..................................................... ix 

FOREW ORD ............................................................... xix 

ACKNOW LEDGM ENTS ..................................................... xxi 

ABBREVIATIONS AND ACRONYMS........................................ xxlll 

1. INTRODUCTION ....................................................... 1-1 

1.1 Purpose of Report ................................................. 1-1 

1.2 Characteristics of RBPIs ............................................ 1-2 

1.3 Organization of Report ............................................. 1-2 

2. PROCESS FOR IDENTIFICATION OF RBPIs ................................. 2-1 

2.1 Systematic Process for RBPI Development .............................. 2-1 

2.2 Risk Perspectives Associated With RBPI Development .................... 2-9 

3. RESU LTS .............................................................. .3 -1 

3.1 Results for Internal Events at Full Power ............................... 3-1 

3.1.1 Initiating Events Cornerstone ................................. 3-1 

3.1.1.1 R B PIs ............................................ 3-1 

3.1.1.2 Industry-W ide Trending .............................. 3-2 

3.1.1.3 Inspection Areas Covered by New RBPIs ................ 3-3 

3.1.2 Mitigating Systems Cornerstone ............................... 3-4 

3.1.2.1 RBPIs ............................................ 3-4 

3.1.2.2 Industry-W ide Trending .............................. 3-8 

3.1.2.3 Inspection Areas Potentially Affected by RBPIs ........... 3-9 

3.1.3 Barrier Integrity Cornerstone: Containment Performance .......... 3-9 

3.2 Results for Shutdown .............................................. 3-11 

3.2.1 Initiating Events Cornerstone ................................ 3-12 

3.2.2 Mitigating Systems Cornerstone .............................. 3-12 

3.2.3 Barrier Integrity Cornerstone: Containment Integrity at Shutdown ... 3-18 

3.3 Results for External Events (Fire) .................................... 3-19 

3.3.1 Initiating Events Cornerstone ................................ 3-20 

3.3.2 Mitigating Systems Cornerstone .............................. 3-20 

4. ASSESSMENT OF RISK COVERAGE BY RBPIs .............................. 4-1

V
5. VALIDATION AND VERIFICATION ........................................ 5-1 

5.1 Development of a Systematic Process for RBPI Identification ............... 5-1 

5.2 Assurance That RBPIs Satisfy Specific Characteristics .................... 5-1 

5.3 Testing of the RBPIs for Practicality of Calculation and Credibility of Results .. 5-2 

6. KEY ISSUES AFFECTING RBPI DEVELOPMENT AND IMPLEMENTATION ...... 6-1 

6.1 Program Coordination Issues ......................................... 6-1 

6.2 Plant-Specific RBPI Formulation ..................................... 6-3 

6.3 Selection of Risk Metrics for Use in Assessing Containment Barrier 

Perform ance .................................................... 6-3 

6.4 Formulation of G/W Threshold In Terms of Performance Percentile .......... 6-4 

6.5 Development of RBPIs at Higher Level ................................ 6-4 

6.6 Issues Related to Shutdown RBPI Development .......................... 6-5 

7. REFEREN CES ........................................ .................. 7-1 

Appendix A: RBPI Determination for Internal Events/Full-Power Accident Risk ......... A-1 

Appendix B: RBPI Determination for Shutdown Modes Accident Risk .................. B-1 

Appendix C: RBPI Determination for External Events Accident Risk ................... C-1 

Appendix D: Assessment of RBPI Coverage ..................................... D-1 

Appendix E: RBPI Data Collection and Analysis ................................... E-1 

Appendix F: Statistical Methods and Results ..................................... F-1 

Appendix G: Development of Risk-Based Performance Indicators: Program Overview .... G-1 

Appendix H: Risk-Based Performance Indicator Definitions, Data, and Calculational 

Procedures ......... ........................................... H -1 

Appendix I: Summary of Major Industry and ACRS Comments on Draft Report .......... I-1

vi
LIST OF FIGURES 

Figure 2.1 RBPI Development Process .......................................... 2-2 

Figure 2.2 Margin Between Core Damage Early Fatality Risk, QHOs, and Current Overall 

Accidental Death Risk ........................................... 2-11 

Figure 3.1.1-1 Time-Dependent Trending of Loss of Offsite Power Initiating Events ...... 3-4 

Figure 3.1.2-1 Time-Dependent Trending of Emergency Diesel Generator Common Cause 

Failure Events .................................................. 3-8 Figure 4-1 a RBPI Coverage of Dominant Full-Power Internal Event Core Damage 

Sequences by Initiating Events for BWR 3/4 Plant 18 ................... 4-9 

Figure 4-lb RBPI Coverage of Dominant Full-Power Internal Event Core Damage 

Sequences by Initiating Events for WE 4-Lp Plant 22 ................... 4-10

vii
LIST OF TABLES

Table ES-1 Summary of Phase 1 Risk-Based Performance Indicators .................. xvi 

Table ES-2 Summary of Phase 1 Performance Areas Proposed for Industry-Wide Trending xvii 

Table 3. 1.1-1 Initiating Event RBPIs ...... .................................. 3-2 

Table 3.1.1-2 Summary of Inspection Areas Impacted by New RBPIs for Initiating Events 

C ornerstone .................................................... 3-4 

Table 3.1.2-1 Candidate Mitigating System RBPIs ................................. 3-6 

Table 3.1.2-2 BWR Mitigating System RBPIs .................................... 3-7 

Table 3.1.2-3 PWR Mitigating System RBPIs .................................... 3-7 

Table 3.1.2-4 Summary of Inspection Areas Potentially Affected by RBPIs for Mitigating 

Systems Cornerstone ...................................... ...... 3-9 

Table 3.1.3-1 Summary of Inspection Areas Impacted by Potential RBPIs for Containment 

Portion of Barrier Integrity Cornerstone ............................. 3-11 

Table 3.2.2-1 Baseline and Thresholds for Time in Risk-Significant Configurations 

Indicators - PW Rs .............................................. 3-13 

Table 3.2.2-2 Baseline and Thresholds for Time in Risk-Significant Configurations 

Indicators - BW Rs .............................................. 3-13 

Table 3.2.2-3 PWR Shutdown Configurations Risk Classification (Based on a Generic 

Westinghouse 4-Loop Shutdown PRA Model) ....................... 3-14 

Table 3.2.2-4 BWR Shutdown Configurations Risk Classification (Based on 

NUREG/CR-6166 Results) ....................................... 3-16 

Table 3.2.2-5 Summary of Inspection Areas Impacted by Potential Shutdown RBPIs for 

M itigating Systems Cornerstone ................................... 3-17 

Table 4-1 Coverage of Risk-Significant Core Damage Elements from SPAR Models ...... 4-1 

Table 4-2a RBPI Coverage of Dominant Full-Power Internal Event Core Damage 

Sequences - BWR 3/4 Plant 18 (IPE Data Base Results) ................. 4-3 

Table 4-2b RBPI Coverage of Dominant Full-Power Internal Event Core Damage 

Sequences WE 4-Lp Plant 22 (IPE Data Base Results) ................... 4-6 

Table 4-3 Mitigating System Elements That Appear in Dominant Core Damage Sequences 

but Are Not Covered by RBPIs .................................... 4-11 

Table 5.3-1 Plant Performance Bands for Initiating Event RBPIs (1999) ............... 5-3 

Table 5.3-2 Plant Performance Bands for Mitigating System Unavailability RBPIs (1999) 5-5 

Table 5.3-3 Plant Performance Bands for Mitigating System Unreliability RBPIs 

(1997 - 1999) ................................................... 5-8 

Table 5.3-4 Plant Performance Bands for Component Class RBPIs (1997 - 1999) ....... 5-10 

Table 5.3-5 Industry Trends for Initiating Event RBPIs (1997 through 1999) ........... 5-13 

Table 5.3-6 Industry Trends for Mitigating System Unavailability RBPIs 

( 997through 1999) ............................................ 5-13 

Table 5.3-7 Industry Trends for Mitigating System Unreliability RBPIs 

(1997 through 1999) ............................................ 5-14 

Table 5.3-8 Industry Trends for Component Class RBPIs (1997 through 1999) .......... 5-14

viii
EXECUTIVE SUMMARY

Purpose 

The purpose of this report is to present the results of the Phase I development of risk-based 

performance indicators (RBPIs) to potentially enhance the Reactor Oversight Process (ROP). The 

White Paper entitled "Development of Risk-Based Performance Indicators: Program Overview" 

described the concepts for the RBPI development. The purpose of the RBPI development is to 

examine the technical feasibility of providing improved performance indicators for potential 

implementation in the ROP. Phase 1 of the RBPI development includes indicators that are 

related to the initiating events cornerstone, the mitigating systems cornerstone, and the 

containment portion of the barrier integrity cornerstone. In addition, industry-wide trending is 

provided to support the agency's Strategic Plan Performance Measures, provide input to 

assessing the ROP's effectiveness, and feedback insights to the inspection program. 

This work is part of the development and evolution of performance indicators in the current ROP 

and is closely coordinated with existing ROP efforts. There are several key implementation 

issues summarized in this executive summary and Section 6 of the report, including the 

verification of risk models and data. The potential integration of RBPIs into the ROP would 

follow the guidelines in IMC-0608, "Performance Indicator Program." This would include a 

pilot program prior to the full implementation of RBPIs and interaction with stakeholders to 

resolve implementation issues raised in this report or by external stakeholders during the review 

of this report. 

What Are RBPls? 

RBPIs reflect changes in licensee performance that are logically related to risk and associated 

models. That is, they provide performance measures whose impact on core damage frequency 

(CDF) and large early release frequency (LERF) can be established through a risk model or risk 

logic. In developing RBPIs, "performance" refers to the conduct of activities in design, 

procurement, construction, operation, and maintenance that support achievement of the 

objectives of the cornerstones of safety in the ROP. 

The RBPIs developed in this report have the following characteristics: 

The RBPIs are compatible with, and complementary to, the risk-informed inspection 

activities of the oversight process. 

• The RBPIs cover all modes of plant operation. 

* Within each mode, the RBPIs cover risk-important SSCs to the extent practical. 

* The RBPIs are capable of implementation without excessive burdens to licensees or NRC 

in the areas of data collection and quantification. 

To the extent practical, the RBPIs identify declining performance before performance 

becomes unacceptable, without incorrectly identifying normal variations as degradations 

(i.e., avoid false positive indications and false negative indications). 

The RBPIs are amenable to establishment of plant-specific thresholds similar to the ROP.

ix
In addition to plant-specific RBPIs, some risk-significant aspects of performance that cannot be 

effectively assessed on a plant-specific basis have been identified for industry-wide trending. 

This task provides an input for measuring the effectiveness of the overall ROP, as well as 

supporting the agency's Strategic Plan Performance Measures. 

Potential Benefits of RBPIs 

The ROP uses two methods for monitoring plant performance, cumulative indicators and 

individual findings from inspections. Both methods provide indications that are evaluated with 

respect to their risk significance, and are used to determine the level of NRC oversight. The 

current ROP utilizes performance indicators that measure plant performance and use generic 

performance thresholds as described in SECY-99-007, "Recommendations for Reactor Oversight 

Process Improvement." SECY-99-007 recognized that improved performance indicators may be 

developed as part of the evolution of the ROP. 

RBPIs are intended to provide improved indicators for the ROP. However, the decision to use the 

candidate RBPIs, in whole or in part, in the ROP will be made as part of the established ROP 

change process. 

Subsequent to the closing of the comment period for this report, the agency and industry (through 

the continuing ROP interactions) have identified several aspects of unreliability and 

unavailability indicators from the RBPI development that will be piloted in 2002 for potential 

implementation in the ROP. These involve unreliability and unavailability indicators associated 

with the six SSUPIs under the mitigating system cornerstone of the current ROP. 

In addition to RBPIs, selected performance areas will be trended on an industry-wide basis. The 

industry-wide trending efforts support the Strategic Plan Performance Measures. Specifically, the 

industry-wide trending from this program along with trending from other programs, such as the 

Accident Sequence Precursor (ASP) Program, will be used to assess performance against the 

Nuclear Reactor Safety measure: "no statistically significant adverse industry trends in safety 

performance." SECY-0 1-0111, titled "Development of an Industry Trends Program for Operating 

Power Reactors," describes the intended approach for using industry trend information in 

regulatory applications. 

The RBPI development potentially provides the following benefits to the ROP: 

More comprehensive coverage of significant contributors to plant risk 

- Unreliability indicators were developed at the componentltrain/system level. 

Indicators for shutdown modes were developed. RBPIs for fire and the 

containment portion of the barrier integrity cornerstone were identified consistent 

with the state-of-the-art models, data, and methods currently available for these 

areas.

x
More recognition of plant-specific attributes

- The RBPI threshold values are more plant-specific and reflect risk-significant 

differences in plant designs. 

Industry-wide trending of plant-specific RBPIs as well as risk-significant performance 

measures that are impractical to monitor on a plant-specific basis. 

- Trending provides measures of the ROP effectiveness. 

Trending provides feedback to the ROP to adjust technical emphasis and overall 

inspection frequencies. 

- Trending provides input to the agency's Strategic Plan Performance Measures. 

Risk Perspectives on RBPI Development 

The thresholds in the ROP for performance indicators and the Significance Determination 

Process (SDP) are based on changes in the CDF of approximately IE-6, IE-5, and 1E-4 per year. CDF changes associated with the lower thresholds are only a fraction of the total CDF at a plant. 

Changes in performance corresponding to the red performance band (ACDF above 1 E-4 per year) 

are on the same order of magnitude as our current estimates of total CDFs. Thus, the ROP 

thresholds represent a graded approach that responds to larger increases in risk with greater 

regulatory response. In addition, our understanding of public risk corresponding to these values 

for CDF indicates that margin exists between the risk associated with performance changes at the 

ROP thresholds and both the Quantitative Health Objectives (QHOs) of the Commission's Safety 

Goal Policy Statement and the existing individual risk of accidental death (approximately a factor 

of 25 and 2500, respectively). 

An inherent implication of monitoring risk attributes is that there is a time delay between the 

onset of a change in performance and the ability of the indicator to detect that a change has 

occurred. In this sense, all indicators are "lagging," or at best concurrent with, the performance 

change being monitored. In the case of RBPIs, this is not a significant issue because each 

indicator represents one of many elements of risk, for which there is still margin to the agency stated public health objectives. Thus, the indicators are "lagging" for the parameter monitored, 

but "leading" indicators for overall risk. 

In addition, operating experience does not indicate that the large changes in the reliability of 

equipment or the frequency of initiators necessary to cause an indicator to go from nominal to 

unacceptable performance occur often. However, even if large changes occur, the monitoring 

intervals and thresholds have been set so that the probability of failure to detect that performance 

has changed over the monitoring period is low and the incremental risk accumulation over that 

time is small compared to the QHOs and individual accidental death risk.

xi
Summary of Results

The Phase I RBPI development identified performance indicators and areas for industry-wide 

trending for potential use in the ROP. The risk elements were disaggregates, to develop 

thresholds for the indicators that would consistently reflect the risk impact of performance 

changes. For the majority of RBPIs, train-level rather than system-level indicators were required, 

and unreliability and unavailability were treated separately, rather than as a combined failure 

probability. The differences in the risk implication of performance changes at these levels are 

inherent in the calculation of risk. While performance can be monitored at other levels, setting 

thresholds with consistent risk implications between and among indicators is problematic. A total 

of 21 indicators for pressurized water reactors (PWRs) and 16 indicators for boiling water 

reactors (BWRs) were identified (including proposed RBPIs with no current data reporting). 

These RBPIs are listed in Table ES-land are briefly discussed below. 

Initiating Events Cornerstone 

Three initiating event frequency indicators for internal events were identified under the initiating 

events cornerstone of safety: general transients, loss of feedwater, and loss of heat sink. Other 

risk-significant initiating events did not accumulate data in a timely manner for plant-specific 

assessment of performance due to their low frequencies, and were therefore included in the 

industry-wide trending. Fire initiating events and the risk-significant initiating events during the 

shutdown modes were also included in the industry-wide trending due to their low frequencies. 

Mitigating Systems Cornerstone 

For power operation, 13 RBPIs for BWRs and 18 RBPIs for PWRs under the mitigating systems 

cornerstone of safety were identified. These involved unreliability and unavailability indicators at 

the train-level for risk-significant safety systems and cross-system performance of key 

components. RBPIs for key components were developed to help assess cross-cutting performance 

issues that might not be practical to detect by an individual system or train performance indicator. 

The thresholds for these indicators are currently based on plant-specific assessment of CDF 

changes. Some of these systems may also affect LERF, and it is possible for thresholds 

determined from changes in LERF to be more limiting than thresholds determined from changes 

in CDF. However, the LERF models and related data needed to determine these thresholds are 

not currently available. 

For shutdown modes of operation, four potential RBPls under the mitigating systems cornerstone 

of safety for PWRs and BWRs were proposed. They monitor time spent in risk-significant 

shutdown configurations. The risk-significant shutdown configurations are combinations of 

equipment unavailabilities and the reactor states associated with decay heat rates, reactor coolant 

system (RCS) integrity, and RCS level. The threshold values are generic and reflect CDF 

changes associated with spending excess time in the more risk-significant shutdown 

configurations. The generic baseline performance values were based on the past performance 

data for a number of plants. The generic threshold values were derived using two shutdown risk 

models (one for a PWR, and one for a BWR) that are representative of risk during shutdown

xii
operation. Internal and external stakeholder comments indicated that the approach presented for 

potential shutdown RBPIs was more appropriate for potential application in the Significance Determination Process (SDP) of the ROP. Consequently, this report documents the technical 

work associated with shutdown RBPIs, but future use of this effort will concentrate on evaluating 

the significance of shutdown conditions for the SDP. 

Potential RBPIs for fire events under the mitigating systems cornerstone of safety were 

identified. These RBPIs were related to the unreliability and unavailability of fire 

detection/suppression systems. However, the models and data currently available are not 

amenable for use in determining RBPIs. 

Containment Portion of Barrier Integrity Cornerstone 

Potential RBPIs for the containment systems affecting LERF for selected containment types were 

identified. These involved the containment isolation function, the drywell spray system, and the 

hydrogen ignitor function. However, baseline performance values for these potential containment 

RBPIs could not be determined due to the unavailability of performance data. LERF models for 

setting thresholds are not available for all containment types. In addition, the available models 

are not compatible with the Standardized Plant Analysis Risk (SPAR) Revision 3 models for 

assessing the CDF impacts which are the inputs to the LERF models. Therefore, no containment 

RBPIs are provided. 

Industry-Wide Trending 

The industry-wide trending includes the plant-specific RBPIs as well as risk-significant performance areas that cannot be monitored at a plant-specific level. The RBPIs each have the 

characteristic that there is sufficient data for plant-specific trending so that plant-specific performance changes can be detected in a timely manner. Some performance features that are 

risk-significant do not occur frequently enough to be trended on a plant-specific basis, but can be 

trended on an industry basis. For example, loss-of-offsite-power events during power operations 

occur on average about once every 20 reactor years. Thus, approximately five events are 

expected to occur each year in the industry. These events can be trended at the industry level, but 

are not amenable to plant-specific monitoring. The industry trending will consist of trending of 

each of the RBPIs identified earlier as well as the performance elements noted in Table ES-2. 

SECY-0 1-0111 describes the intended approach for using industry trend information in 

regulatory applications. 

Risk Coverage 

As part of this RBPI development effort, an evaluation was done to assess the extent of risk 

coverage by RBPIs and industry-wide trending. Approximately 40% of the risk-significant 

elements in the SPAR models were covered by RBPIs. 

In addition, the dominant accident sequences from the Individual Plant Examination (IPE) database were reviewed. Most of the dominant accident sequences had one or more events 

covered by RBPIs or industry-wide trending. Tables (4-2a and 4-2b) are provided in the report to

xiii
show which elements of the dominant accident sequences were covered and which ones were 

not. 

Key Issues Affecting Feasibility of Potential Implementation of RBPIs 

Several implementation issues have emerged in the course of the development described in this 

report. These are discussed briefly below. 

Are any additional performance indicators needed in the ROP? 

Interactions with stakeholders commenting on the White Paper indicated differing views on this 

subject. Industry representatives questioned whether NRC needed to have a broader coverage of 

risk measured in the ROP indicators, especially if the coverage did not result in a corresponding 

reduction in the inspection program. Other external stakeholder comments favored more 

indicators as well as additional inspections. 

The RBPI development program is focused on demonstrating the technical feasibility of 

providing additional objective indicators that cover a broader spectrum of risk-significant plant 

performance. Future work may identify additional candidates. Any potential new performance 

indicators will be assessed in a pilot program consistent with the change process described in 

IMC-0608 prior to implementation. 

Subsequent to the closing of the comment period for this report, the agency and industry (through 

the continuing ROP interactions) have identified several aspects of unreliability and 

unavailability indicators from the RBPI development that will be piloted in 2002 for potential 

implementation in the ROP. These involve unreliability and unavailability indicators associated 

with the six SSUPIs under the mitigating system cornerstone of the current ROP. 

Is the number of potential new indicators appropriate? Which of the proposed indicators would 

be most beneficial? 

The RBPI Phase 1 development identified 22 potential indicators for PWRs and 17 potential 

indicators for BWRs. If all of these performance indicators were implemented, they could 

potentially replace 8 (3 initiating event and 5 mitigating system) of 18 existing indicators in 

whole or in part, bringing the total number of indicators per plant to about 30. In addition to the 

issue of the appropriate risk scope of ROP indicators (noted above), it will be necessary to assess 

whether potentially expanding the total number of indicators to approximately 30 per plant 

(approximately 25 of them based on currently available data) is reasonable from a 

logistics/process point of view. For example, the criteria that result in plants entering various 

columns of the Action Matrix will have to be reconsidered. Section 6.5 discusses results of 

preliminary work to examine the feasibility of developing indicators at a higher level (system or 

cornerstone level) by combining results of lower level data and models. In follow-on work, 

higher level indicators may be investigated further.

xiv
Do the data sources for RBPIs exist and have sufficient quality for use in the ROP? 

A significant portion of the RBPIs require access to and use of data from the Equipment Performance and Information Exchange (EPIX) system. These data are voluntarily provided by industry in response to the Commission decision to forgo the Reliability Data Rule. Full industry participation, verification, and validation of the existing EPIX and the development of guidelines for consistent reporting are important to the feasibility of many RBPIs as potential improvements 

to the ROP. 

Performance data are not readily available from EPIX for several of the proposed indicators. The 

NRC is working with industry groups to expand the reliability data collection in this voluntary 

system to include data that will support evaluation of performance in these areas. 

Data accuracy and licensee burden in this area are recognized as important implementation issues, which will be further investigated during the implementation phase using the change 

process in IMC-0608. 

Will SPAR Revision 3i models be used for setting plant-specific thresholds for all plants? 

Approximately 50 Standardized Plant Accident Risk (SPAR) Revision 3i models are currently available. Completion of all 70 SPAR Revision 3i models is scheduled for the end of calendar 

year 2002. As more models are made available for use in the RBPI development program, it will 

be possible to determine if plants can be grouped so that a few models can be used to set 

thresholds for all plants or individual models will be needed for each. The RBPI development 

program will continue to use the SPAR Revision 3i models as they are developed. External 

stakeholder comments on the White Paper indicated that peer review by licensees should be 

included in the development of these models. Two additional implementation issues are whether 

licensees or NRC will calculate the thresholds and indicators and whether licensee models 

(meeting as-yet-to-be-developed NRC specifications) could be used instead of the SPAR models. 

It is yet to be determined whether a plant-specific model will be required to set performance thresholds for each plant or whether a representative model is sufficient for a group of plants. Furthermore, it has not been determined whether the calculation for thresholds and indicators 

will be routinely performed by NRC staff using SPAR Revision 3i models, licensees using SPAR 

Revision 3i models, or licensees using their own risk models that meet specifications agreed 

upon and reviewed by the NRC. These are potential options that will be dealt with through IMC

0608. 

Will LERF models be used for setting thresholds for mitigating and containment systems? 

There are a limited number of large early release frequency (LERF) models available to set 

thresholds for performance of systems that impact the integrity of the containment barrier. In 

addition, currently available data are inadequate for establishing performance measures for the 

containment systems. Also, for some systems under the mitigating systems cornerstone, the 

thresholds associated with changes in core damage frequency (CDF) due to performance degradations may not be limiting compared to changes in LERF. To assess that condition. LERF

Xv
models that reflect the impact of potential CDF changes are needed. The current plan for 

developing LERF models over the next several years will support limited capability for 

identifying RBPIs or setting plant-specific LERF thresholds.

Table ES-1 Summary of Phase 1 Risk-Based Performance Indicators 

Safety 

Cornerstone Existing PIs Proposed RBPIs 

- Unplanned scram - General transient 

- LONHR - LOFW

Initiating Event

Mitigating System

Barriers

- Unplanned reactor 

power changes 

- EPS (UA) 

- RHR (UA) 

- PWR 

AFW (UA) 

HPI (UA) 

- BWR 

HPCS/HPCI (UA) 

RCIC/IC (UA) 

- Safety system 

functional failures

- RCS specific activity 

- RCS identified leak 

rate

- LOHS 

PWR at Power 

- EPS (UR&UA) 

- AFW-MDP 

(UR&UA) 

- AFW-TDP 

(UR&UA) 

- HPI (UR&UA) 

- PORV (UR) 

- RHR (UR&UA) 

- SWS (UR&UA) 

- CCW (UR&UA) 

- AOV (UR) 

- MOV (UR) 

- MDP (UR)

BWR at Power 

- EPS (UR&UA) 

- HPCS/HPCI 

(UR&UA) 

- RCIC/IC 

(UR&UA) 

- RHR (UR&UA) 

- SWS (UR&UA) 

- AOV (UR) 

- MOV (UR) 

- MDP (UR)

- *CIV (UR&UA) - *Drywell spray (Markl)(UR&UA) 

- *CIV (Mark III) 

(UR&UA)

Shutdown Fire 

- *Time in High, None

medium, significant, low or riskearly 

reduced inventory 

(vented) 

configurations

None

* Requires data that are not currently reported. 

Note: The emergency preparedness, occupational radiation safety, public radiation safety, and physical protection 

cornerstones of safety are not included in the Phase I RBPL scope.

xvi

None
Table ES-2 Summary of Phase 1 Performance Areas Proposed for Industry-Wide 

Trendine

Safety Cornerstone

Initiating Event

Mitigating System

Barriers

Industrv-Wide Trend

Full Power 

- All proposed IE RBPIs listed in Table ES-I - Internal flooding 

- Initiators evaluated as ASPs 

- Loss of instrument/control air (for BWRs and PWRs) - LOOP 

- Loss of vital AC bus 

- Loss of vital DC bus 

- Small LOCA (including very small LOCA) - SGTR 

- Stuck open safety/relief valves 

Shutdown 

- LOOP during shutdown modes 

- Loss of RHR during shutdown modes - Loss or diversion of RCS inventory during shutdown modes leading to loss of RHR - Loss of RCS level control (during transition to mid-loop) leading to loss of RHR (for PWRs only) 

Fire 

- Fire events in risk-significant fire areas

- All proposed mitigating system RBPIs listed in Table ES-I - CCF events for AFW pumps 

- CCF events for diesel generators 

- Total CCF events

None

xvii

f

_L___

I

Industry-Wide Trend
FOREWORD

The Reactor Oversight Process (ROP) was implemented to improve the NRC's regulatory oversight of licensee operation of commercial nuclear power plants. It is intended to better risk

inform agency actions and bring more objectivity to the regulatory process. The ROP is 

consistent with the goals of the Commission's PRA Policy Statement and the NRC's Strategic Plan (NUREG-1614), which include increased use of the PRA technology in "regulatory matters 

to the extent supported by the state-of-the-art in PRA methods and data and in a manner that 

complements the NRC's deterministic approach and supports the NRC's traditional defense-in

depth philosophy." The development of the potential risk-based performance indicators (RBPIs) described in this report is intended to represent a further improvement to the ROP that would be 

appropriate as part of this regulatory evolution. 

SECY-99-007 and 99-007A described the revised Reactor Oversight Process. The ROP was 

implemented at all plants in April 2000 following a 6-month pilot program conducted in 1999. 

The results of this pilot program were described in SECY-00-0049. A fundamental aspect of the 

ROP is the use of both performance indicators and inspection findings to determine whether the 

objectives of the ROP's cornerstones of safety are being met on a plant-specific basis. 

In addition to these changes at the NRC, the industry is using more performance-based approaches to enhance its operations, including gathering and analyzing both plant-specific and 

industry-wide data. Furthermore, technological advances such as the Internet have resulted in 

improved capabilities to gather and share such data. Through such technological developments, both the industry and the NRC have expanded their capabilities to model and assess the risk

significance of plant operations. 

In light of these evolving capabilities and the movement toward more risk-informed and 

performance-based oversight, the Risk-based Performance Indicators were developed to (1) address specific areas in the current ROP that were identified in SECY-00-0049 as possible enhancements and (2) potentially support any future development of performance indicators 

using improved risk analysis tools. This report discusses the technical feasibility of using currently available risk models and data to enhance the NRC's ability to monitor plant-specific safety performance of reactors in a risk-informed and performance-based manner. This 

development activity is designed to fit into the ROP concept for indicators, thresholds, and 

performance monitoring while continuing to move the NRC's programs forward in accordance 

with the PRA Policy Statement and the goals of the Strategic Plan. 

The Strategic Plan also articulates the NRC's efforts to increase public confidence. One of the strategies for achieving that goal is as follows: "We will make public participation in the 

regulatory process more accessible. We will listen to the public's concerns and involve our 

stakeholders more fully in the regulatory process." In keeping with this philosophy, the NRC has 

sought, and continues to seek, input from internal and external stakeholders on the ROP as the 

program evolves. With respect to the development of potential RBPIs, the first key stakeholder 

interactions were held to obtain input to the RBPI White Paper (SECY-00-0 146), which 

described the principles for the RBPI development. This report represents the second 

opportunity for external stakeholder participation in the RBPI development process. There will

xix
be additional opportunities for internal and external stakeholder involvement as the process 

continues to evaluate the feasibility of potential implementation of these (or other) performance 

indicators in accordance with the ROP change process. 

During recent ROP stakeholder discussions, the NRC and the industry have identified several 

aspects of the unreliability and unavailability indicators from the RBPI development that would 

potentially enhance the current set of the ROP performance indicators. As a result, the NRC staff 

is working with the industry to start a pilot program in early 2002. This pilot program will 

include unreliability indicators for six mitigating systems in the ROP, as well as changes to the 

current Safety System Unavailability Performance Indicators (SSUPIs). In addition, some 

follow-on development work will be continued, as summarized below: 

"• Development of enhanced performance indicators for the containment portion of the barrier 

integrity cornerstone of safety. 

"* Development of an approach for determining plant-specific performance thresholds for 

unavailability and unreliability indicators. 

"• Development of performance indicators at higher levels, such as at the system or function 

level. 

"• Technology transfer of shutdown RBPI results and insights to support the Significance 

Determination Process (SDP) for shutdown modes.

XX
ACKNOWLEDGMENTS

The authors acknowledge extensive collaboration with many colleagues at INEEL, ISL, 

SCIENTECH, and NRC. The development process has also benefitted from numerous important 

discussions with internal and external stakeholders, as well as the ACRS. This report has 

benefitted greatly from careful review and editing by S. Mays (NRC). All of the authors are 

grateful to Colleen Amoruso (ISL) for production of the integrated document.

xxi
ABBREVIATIONS AND ACRONYMS

AC vital AC buses 

ACBU1 other onsite backup 1 

ACC accumulators 

ADS automatic depressurization system 

AFW auxiliary feedwater 

AMI alternate makeup 1 

AM2 alternate makeup 2 

AOV air-operated valve 

ARI alternate rod insertion 

ASP accident sequence precursor 

ASPC alternate suppression pool cooling 

AUXCI auxiliary cooling 1 

AUXC2 auxiliary cooling 2 

BI borated injection 

BWR boiling water reactor 

CCDP conditional core damage probability 

CCDF conditional core damage frequency 

CCF common cause failure 

CCW component cooling water 

CD core damage 

CDF core damage frequency 

CDP core damage probability 

CHPI normally running makeup (injection) 

CHPR normally running makeup (during recirculation) 

CIV containment isolation valve 

CONDA condenser available 

CRDS control rod drive pumps 

CS core spray 

CSR containment spray recirculation

xxiii
CTS condensate pumps 

DBI design basis issue 

DDP diesel-driven pump 

DWS drywell spray 

EAC emergency AC power (usually EDGs) 

EDC battery-backed DC buses 

EDG emergency diesel generator 

EPIX Equipment Performance and Information Exchange System 

EPS emergency power system 

ESAS 1 engineered safety actuation system 1 

ESW emergency service water 

FTLR Fail to Load and Run 

FTR Fail to Run 

FTS Fail to Start 

GT general transients 

HP1 high-pressure 1 

HPCI high-pressure coolant injection 

HPCS high-pressure core spray 

HPI high-pressure injection system 

HPR high head safety injection (during recirculation) 

HUM operator action 

HVAC heating, ventilation, air conditioning 

HVAC 1 heating, ventilation, air conditioning 1 

HVAC2 heating, ventilation, air conditioning 2 

HVAC3 heating, ventilation, air conditioning 3 

IA instrument air compressors 

IC isolation condenser 

INEEL Idaho National Engineering and Environmental Laboratory 

INPO Institute for Nuclear Power Operations 

IPE Individual Plant Examination 

IPEEE Individual Plant Examination for External Events

xxiv
ISLOCA interfacing systems LOCA 

LER Licensee Event Report 

LERF large early release frequency 

LLOCA large loss-of-coolant accident 

LOCA loss-of-coolant accident 

LOFW loss of feedwater 

LOHS loss of heat sink 

LONHR loss of normal heat removal 

LOOP loss-of-offsite-power event 

LOSP loss of offsite power 

LP1 low-pressure 1 

LP2 low-pressure 2 

LP3 low-pressure 3 

LPCI low-pressure coolant injection 

LPCS low-pressure core spray 

LPI low-pressure injection 

LPR low-pressure recirculation 

MDAFW motor-driven auxiliary feedwater pumps 

MDP motor-driven pump 

MFW main feedwater pumps 

MLE Maximum Likelihood Estimate 

MLOCA medium loss-of-coolant accident 

MOR monthly operating report 

MOV motor-operated valve 

MSIV main steam isolation valve 

NISP non-I E startup pumps 

NRC U.S. Nuclear Regulatory Commission 

NRR Office of Nuclear Reactor Regulation 

OA3 alternate air system 3 

PORV power-operated relief valve 

PPORV pressurizer power-operated relief valves

xxv
PRA 

PSRV 

PWR 

QHO 

RADS 

RAW 

RBCLCW 

RBPI 

RCIC 

RCPS 

RCS 

RECIRC 

RHR 

ROP 

RPS 

RWST 

SBO 

SCSS 

SDC 

SDP 

SG 

SGTR 

S1 

S2 

S3 

SDAFW 

SGA 

SGS 

SI 

SLC 

SLOCA

xxvi

probabilistic risk assessment 

pressurizer safety relief valve 

pressurized water reactor 

Quantitative Health Objective 

Reliability and Availability Database System 

Risk Achievement Worth 

reactor building closed loop cooling water 

risk-based performance indicator 

reactor core isolation cooling 

reactor coolant pump seal 

reactor coolant system 

recirculation pumps 

residual heat removal 

Reactor Oversight Process 

reactor protection system 

refueling water storage tank 

station blackout 

sequence coding and search system 

shutdown cooling 

Significance Determination Process 

steam generator 

steam generator tube rupture 

medium Loss-of-Coolant Accident 

small loss-of-coolant accident 

small-small loss-of-coolant accident 

steam-driven auxiliary feedwater pumps 

steam generator atmospheric dump valves 

steam generator safety valves 

safety injection 

standby liquid control 

small loss-of-coolant accident
SPAR 

SPC 

SRV 

SRVS 

SSCs 

SSW 

SSUPI 

SW2 

SW3 

SWS 

T&M 

T-AC 

T-ATWS 

T-AUXC2 

T-CCW 

T-DC 

T-ESW 

T-EXFW 

T-HVAC1 

T-HVAC2 

T-IA 

T-IFL 

T-IORV 

T-IORV/ 

SORV 

T-LMFW 

T-LOOP 

T-MSIV 

T-NSW 

T-RX 

T-SGTR

xxvii

Standardized Plant Analysis Risk 

suppression pool cooling 

safety relief valve 

safety relief valves steam 

systems, structures, and components 

standby service water 

safety system unavailability performance indicator 

alternate service water 2 

alternate service water 3 

service water system 

test & maintenance 

transient - initiated by loss of vital AC buses 

transient - anticipated transient without scram 

transient - initiated by loss of auxiliary cooling 2 

transient - initiated by loss of component cooling water 

transient - initiated by loss of DC buses 

transient - initiated by loss of essential service water pumps 

transient - excessive feedwater addition 

transient - initiated by loss of heating, ventilation, and air conditioning 1 

transient - initiated by loss of heating, ventilation, and air conditioning 2 

transient - initiated by loss of instrument air compressors 

transient - internal flood 

transient - inadvertent open relief valve 

transient - inadvertent or stuck open relief valve 

transient - loss of main feedwater 

transient - loss of offsite power 

transient - initiated by failure of main steam isolation valve 

transient - initiated by loss of normal service water pumps 

transient - reactor trip 

transient - steam generator tube rupture
T-SLBIC 

T-SLBOC 

T-SW2 

T-TBCLCW 

T-TT 

T-UHS 

T-VAC 

TB 

TDP 

UA 

UR 

V 

V&V 

V-AR1 

V-CCW 

V-CHPI 

V-HPI 

V-LPI 

V-RHR 

VAC 

VENT

transient - steam line break inside containment 

transient -steam line break outside containment 

transient - initiated by loss of alternate service water 2 

transient - initiated by loss of turbine building closed loop cooling water 

transient - turbine trip 

transient - loss of ultimate heat sink 

transient - initiated by loss of vital instrument AC 

turbine bypass valves 

turbine-driven pump 

unavailability 

unreliability 

interfacing system loss-of-coolant accident 

validation and verification 

interfacing system loss-of-coolant accident in alternate recirculation 1 

interfacing system loss-of-coolant accident in component cooling water 

interfacing system loss-of-coolant accident in normally running makeup 

(injection) 

interfacing system loss-of-coolant accident in high head safety injection 

interfacing system loss-of-coolant accident in low-pressure injection 

interfacing system loss-of-coolant accident in residual heat removal 

vital instrument AC 

venting system

xxviii
1. INTRODUCTION

1.1 Purpose of Report 

The purpose of this report is to present the results of the Phase 1 development of risk-based 

performance indicators (RBPIs) to potentially enhance the Reactor Oversight Process (ROP). 

The development process was previously described in the White Paper entitled "Development of 

Risk-Based Performance Indicators: Program Overview" (Ref. 1, provided here as Appendix G). 

This work is part of the development and evolution of performance indicators in the current ROP 

and is closely coordinated with existing ROP efforts. Changes to the existing ROP indicators are 

not imminent. There are several key implementation issues summarized in the executive 

summary and Section 6 of the report, including the verification of risk models and data. The 

potential integration of RBPIs into the ROP would follow the guidelines in IMC-0608, 

"Performance Indicator Program." This would include a pilot program prior to the full 

implementation of RBPIs and interaction with stakeholders to resolve implementation issues 

raised in this report or by external stakeholders during the review of this report. 

The current results presented include: 

"* Plant-specific RBPIs and their thresholds for 44 plant models; 

"• Assessment of risk coverage provided by potential RBPIs; and 

"• Results of validation and verification. 

In addition, potential candidates for industry-wide trending were identified. 

In addition to the Phase 1 results, this report describes the process for RBPI development. This 

process is intended to lead to a set of RBPIs having the characteristics discussed in Section 1.2 of 

this report. 

The Phase 1 RBPI development includes indicators that are related to the initiating events 

cornerstone, the mitigating systems cornerstone, and the containment portion of the barrier 

integrity cornerstone. This includes assessment of feasibility and development of potential 

indicators for: 

* Initiating events; 

* Unreliability and unavailability performance under the mitigating systems cornerstone; 

* Containment barrier performance; 

* Performance areas involved in scenarios initiated by fire; 

* Performance areas involved in scenarios initiated during shutdown operation. 

Areas that are not amenable to RBPI treatment are assessed for potential for trending at the 

industry level. SECY-01-01 11, titled "Development of an Industry Trends Program for Operating 

Power Reactors" (Ref. 2) describes the intended approach for using industry trend information in 

regulatory applications.

1-1
Potential RBPIs were identified to address fire, shutdown, and containment. However, models 

and information adequate to support a complete assessment of these potential RBPIs were not 

available to this project during this phase. Intermediate results in these areas are presented here in 

order to support ongoing discussions of these areas. 

1.2 Characteristics of RBPIs 

As noted in the White Paper, "performance" refers to the conduct of those activities in design, 

procurement, construction, operation, and maintenance that support achievement of the 

objectives of the cornerstones of safety in the Reactor Oversight Process. 

SECY 99-007, "Recommendations for Reactor Oversight Process Improvements" (Ref. 3), 

Attachment 2, "Technical Framework for Licensee Performance Assessment," lists the key 

attributes of performance within each cornerstone. RBPIs are performance measures that are 

logically related to the risk-significant elements of these key attributes. In this development, 

RBPIs are logically related to elements of risk models. 

The RBPIs developed in this report collectively have the following characteristics: 

" The RBPIs are compatible with, and complementary to, the risk-informed inspection activities 

of the oversight process. 

"- The RBPIs cover all modes of plant operation. 

"* Within each mode, the RBPIs cover risk-important systems, structures, and components 

(SSCs) to the extent practical. 

" The RBPIs are capable of implementation without excessive burdens to licensees or NRC in 

the areas of data collection and quantification. 

" To the extent practical, the RBPIs identify declining performance before performance becomes 

unacceptable, without incorrectly identifying normal variations as degradations (i.e., the RBPIs 

avoid false positive indications and false negative indications). 

" The RBPIs are amenable to establishment of plant-specific thresholds consistent with the 

Reactor Oversight Process (ROP). 

1.3 Organization of Report 

This section is the introduction to the report. Section 2 discusses the RBPI development process 

in accordance with the development steps from the White Paper. Section 3 presents results of the 

process steps discussed in Section 2. The results are organized by internal events at power, 

shutdown events, and external events, because the indicators and thresholds in these areas use 

similar risk models and insights for each cornerstone. Within each area, each safety cornerstone 

is discussed. Section 4 analyzes the extent of risk coverage by the RBPIs. Section 5 discusses 

three aspects of validation and verification of the RBPIs. Section 6 addresses key issues 

affecting RBPI development and implementation.

1-2
2. PROCESS FOR IDENTIFICATION OF RBPIs

2.1 Systematic Process for RBPI Development 

The steps in RBPI development are the following: 

1. Assess the potential risk impact of degraded performance. 

2. Obtain performance data for risk-significant, equipment-related elements. 

3. Identify indicators capable of detecting performance changes in a timely manner. 

4. Identify performance thresholds consistent with the graded approach to performance 

evaluation in SECY 99-007. 

Figure 2.1 shows this RBPI development process. The following discusses each step of the 

flowchart in Figure 2.1. 

Step 1: Assess the potential risk impact of degraded performance 

The processing in this step is shown on Sheet 1 of Figure 2.1. 

A performance attribute is suitable for RBPI consideration if the risk significance of changes in 

performance can be determined using a risk model or risk logic. An example of a performance 

attribute under the mitigating systems cornerstone that is typically modeled is equipment 

performance. Reliability and availability of mitigating systems are typically modeled, and the 

risk impact of performance changes in these areas can be quantified. An example of a 

performance attribute that is not typically modeled is "procedure quality" under the initiating 

events cornerstone. Some PRA models reflect procedure quality as performance shaping factors 

influencing human error probabilities that affect risk, but this kind of modeling is not typical in 

most probabilistic risk assessments (PRAs) or Individual Plant Examinations (IPEs) even for 

mitigating systems. 

The test of risk significance of a performance attribute is whether degraded performance can 

cause changes in mean core damage frequency (CDF) or mean large early release frequency (LERF) that exceed 1 E-6 or 1 E-7, respectively. Development of RBPIs and thresholds under the 

initiating events cornerstone and the mitigating systems cornerstone has been carried out using CDF as the measure of risk significance. Some performance areas under these cornerstones could 

affect LERF, and this could affect determination of associated RBPI thresholds. Assessment of 

this will be completed when integrated CDF/LERF models become available to this project. Development of RBPIs and thresholds for the containment barrier under the barrier integrity 

cornerstone has been initiated based on assessment of published results, using LERF as the 

measure of risk significance. Completion of this development also requires integrated 

CDF/LERF models.

2-1
Figure 2.1 RBPI Development Process 

Sheet I 

Assess Potential Risk Impact of Degraded Performance

Identify risk-significant elements where performance degradation 

could cause significant changes in core damage frequency (CDF) or 

large early release frequency (LERF)

More Risk-Significant 

High Risk Achievement Wot11h, 

Fussell-Vesely Importance, AND 

Variable Performance I Iistory?

Sort into equipment elements and 

other performance elements

Risk-Significant Elements 

Measurable In Equipment-related 

Figures of Merit
Fifzure 2.1 RBPI Development Process 

Sheet 2 

Obtain Performance Data for Risk-Significant, Equipment

Related Elements

Search Deatah These Sources For To Q ese uatfElent FInitiating Data To Quantify Event Frequencies Element Sse eiblt 

Performance: System Reliability 

-Initiating Event Studies Train Reliability / Availability 

-System Studies Component Reliability I 

oEPIX/ RADS Availability 

Configuration Management 

(Functional Availability) 

Adequate Data Yes 

[No further action

Elements and Data 

for Quantification

Rtisk-Significant Elements 

Measurable In Equipment-related 

Figures of Merit
Figure 2.1 RBPI Development Process 

Sheet 3 

Identify Indicators Capable of Detecting Performance Changes In A Timely 

Manner
Fimure 2.1 RBPI Development Process 

Sheet 4 

Identify Performance Thresholds Consistent With A Graded Approach To 

Performance Evaluation from SECY 99-007

System/ Function/ Train/ 

Component Level 

Indicators

Quantify Baseline B l V 

Performance Using SPAR forenicators 

Models & Available Data for Indicators 

Establish Relationship 

Between Performance Threshold 

Changes and ACDF or 

ALERF thresholds Values for

(whichever are more 

limiting)

Indicators

AToý,.
Fi ure 2.1 RBPI Development Process 

Sheet 5 

Outputs of RBPI Development Process 

t Perl 

_::Indicators Reactor Oversight Process Trendin 

Performance Indicators 

Shecet 3 

Threshold Values of Identify Differences 

t.) Indicators in Indicator
Risk significance of performance attributes can be assessed on the basis of "importance 

measures" such as Risk Achievement Worth (RAW), Fussell-Vesely (F-V), and Birnbaum. These 

are measures of the risk significance of an element. The RAW of an element indicates how risk 

might increase if performance degrades, while F-V indicates how much the baseline performance 

contributes to risk. This is discussed further in Appendix A. 

Performance attributes that are not equipment-related are not within the scope of the RBPI 

development. Some human errors, including post-accident response, are examples of this. 

However, other aspects of human performance, such as the conduct of maintenance, affect 

equipment-related figures of merit such as unreliability and unavailability, which are within the 

scope of RBPI development. 

The output from Step 1 is: 

Risk-significant, modeled, and equipment-related elements for which there is potential to 

develop RBPIs 

Step 2: Obtain performance data for risk-significant. equipment-related elements 

This step is illustrated on Sheet 2 of Figure 2.1. 

The output of this step is a set of industry-wide data supporting quantification of the baseline 

performance of each element. For some elements, this will be unreliability/unavailability/failure 

frequency information, including both the number of adverse events (the numerator) and the total 

number of opportunities for the adverse events (operating hours, number of demands, etc.). For 

some elements, it may be the time spent in particular plant configurations that are important to 

risk. 

The output from Step 2 is: 

. Risk-significant, equipment-related elements and data for quantification 

Step 3: Identify indicators capable of detecting performance changes in a timely manner 

This step is shown on Sheet 3 of Figure 2.1. 

This step identifies potential RBPIs to determine whether a high-level indicator (e.g., system/ function performance) in each area is capable of detecting significant performance changes in a 

timely manner, and if not, whether a lower-level indicator (e.g., train/component performance) in 

that area is capable of detecting performance changes in a timely manner. 

In this report, timely detection means that it is unlikely that performance degradation would not 

be detected using data over the most recent 3-year period. It should be noted that the data 

collection interval can vary depending on the type of RBPI, as explained in Section 5.3 and 

Appendix F of this report.

2-7
Even if a high-level indicator can detect performance changes in a timely manner, it will be 

necessary to disaggregate the high-level indicator into lower-level indicators if it is not possible 

to define an appropriate threshold value for the high-level indicator. This is discussed below 

under Step 4, and discussed more fully in Appendix A, Section 2.1.2. 

Risk-significant areas for which it is not practical to detect plant-specific performance changes in 

a timely manner are considered for industry-wide trending. If performance data accumulate at the 

industry level quickly enough to allow trends to be identified in a given area, the area is 

identified for potential industry-wide trending. 

The outputs of this step are the following: 

"* Potential RBPIs at the system/function level 

"• Potential RBPIs at the train/component level 

"* Potential industry-wide trending 

Step 4: Identify performance thresholds consistent with the graded approach to performance 

evaluation in SECY 99-007 

This step is illustrated on Sheet 4 of Figure 2.1. 

The purpose of this step is to determine RBPI baseline values and the changes in each RBPI 

value that correspond to changes in CDF or LERF for the performance bands. 

It is not possible to define an appropriate risk threshold for a high-level indicator if the risk 

significance of its lower level constituents differs significantly. A given net change in 

performance at the higher level can be caused by different sets of performance changes at lower 

levels having different risk impacts. This situation arises when different trains of a given system 

depend on different support systems, and therefore play different roles in different accident 

sequences. It also occurs due to the different impact of CCF on sequence quantification and the 

different impact of potential recovery actions on unavailability and unreliability. For these 

reasons, identification of thresholds for potential RBPIs above the train level needs special care. 

If an appropriate threshold cannot be defined, the potential RBPI must be disaggregated into 

lower level elements for which appropriate thresholds can be defined. This is discussed further in 

Appendix A, Section 2.1.2. 

Some elements under the initiating events cornerstone and mitigating systems cornerstone affect 

LERF as well as CDF. Performance thresholds for the corresponding RBPIs need to be 

determined in light of both kinds of impacts. In this report, thresholds for RBPIs under the 

initiating events and mitigating systems cornerstones reflect only the CDF impact of performance 

changes. Refinement of the RBPI threshold development based on consideration of LERF as well 

as CDF will be undertaken in ongoing work. Complete characterization of the risk significance of 

such elements requires integrated models that are still being developed. 

After the performance thresholds have been identified for an RBPI, the potential for false 

positive indications (false indications of declining performance) and false negative indications

2-8
(failures to identify declining performance) is evaluated as a function of monitoring time interval. 

An RBPI parameter model and an associated monitoring time interval that adequately minimizes 

the probabilities of false indications are determined. 

The outputs of this step are: 

* A parameter definition for each RBPI 

* A set of plant-specific threshold values for each RBPI 

Outputs of RBPI Development Process 

Outputs of the RBPI development process are summarized on Sheet 5 of Figure 2.1. 

The content of the inspection program is related to the coverage provided by the performance indicators. This process develops some RBPIs that are different from the PIs used in the Reactor 

Oversight Process. Therefore, the differences are identified and summarized, and this 

information is evaluated with respect to its implications for the inspection program. 

The following outputs of the RBPI development process are obtained: 

* Plant-specific RBPI parameter definitions, baseline values, and threshold values 

* Performance areas for industry-wide trending 

* Inspection areas that new RBPIs could impact 

2.2 Risk Perspectives Associated With RBPI Development 

The RBPIs are potential improvements to the Reactor Oversight Program (ROP). They are 

intended to allow the NRC (and licensees) to determine when plant-specific performance in areas 

relating to cornerstone objectives is degrading in order to take timely corrective actions. The 

graded approach to regulatory response to changes in licensee performance relies on the principle that agency response is linked to the severity of the changes in performance from a risk 

perspective. The following discusses that principle and its relationship to the RBPI development. 

There are numerous studies estimating the public risks associated with operation of nuclear 

power plants. These vary in scope from Level 1 estimates of core damage frequency (CDF) for 

internal initiators during power operations to Level 3 evaluations of an offsite dose from internal 

and external initiators during both power and shutdown operations. Some useful perspectives 

relating to public risk can be gleaned from this body of work. 

General Risk Insights 

Mean estimates of CDF from Individual Plant Examinations range from low E-6 to mid E-4 per 

year with an average in the mid E-5 range (NUREG-1560, Ref. 4). NUREG-1 150 (Ref. 5) produced similar results. In addition, NUREG-1 150 evaluated the probabilities of early fatalities 

and latent cancer fatalities for the five plants modeled. Other risk studies have done similar

2-9
analyses. Using this information, it is possible to make general comparisons with the 

Quantitative Health Objectives of the Commission's Safety Goal Policy. 

The thresholds in the ROP for Performance Indicators and the Significance Determination 

Process are based on changes in the CDF of approximately E-6, E-5, and E-4 per year. The 

lower thresholds generally represent a fraction of the currently estimated total CDF at a plant. 

The threshold between the yellow and red performance bands is on the same order of magnitude 

as our current estimates of total CDF. Thus, the ROP thresholds represent a graded approach that 

treats larger increases in risk with greater regulatory response. 

The relationship between total CDF and the probability of early fatalities (the more limiting of 

the QHOs) is a function of the particular containment design and operation as well as the 

distribution of population around the plant and the effectiveness of emergency response 

capability. Using worst-case characteristics from the NUREG- 150 (Ref. 5) analysis and 

assuming that the baseline mean total CDF is 1 E-4 per reactor year, the mean frequency of an 

individual early fatality is 2E-8 per year. The QHO for early fatalities is approximately 5E-7 per 

year (a factor of about 25 higher). This QHO is based on the Safety Goal Policy objective that 

early fatalities should be less than 0.1% of (three orders of magnitude, or a factor of 1000, lower 

than) the existing individual accidental death risk. The individual accidental death rate is 

approximately 5E-4 per year. Figure 2.2 displays the CDF values related to early fatality on a 

logarithmic scale. There are two important implications of this perspective on the development 

of RBPIs. 

Specific Implications of General Risk Insights on RBPI Development 

The first important implication is that a large margin exists between the risks associated with 

performance changes at the ROP thresholds and both the QHOs and the existing public risk of 

accidental death. This determines the precision needed to monitor performance parameters and 

quantify the thresholds. Errors in data, models, and/or calculations would have to be large to 

result in approaching either the QHO or the existing individual accidental death risk. 

The second important implication deals with the ability of the RBPIs to detect potential 

degradations in a timely manner so that regulatory actions can be taken before the associated risk 

becomes too large. The ROP red performance band is the "unacceptable" performance area. It is 

approximately equivalent to an increase in CDF of greater than I E-4 per year. This would 

increase the risk of a plant from its baseline to twice its baseline value (assuming the baseline 

was 1E-4). This would still be substantially below the QHO (a factor of 12 instead of 25), 

assuming the worst-case NUREG- 150 (Ref. 5) assumptions and still far below the existing 

individual accidental death risk. 

An inherent implication of monitoring risk attributes is that there is a time delay between the 

onset of a change in performance and the ability of the indication to detect that a change has 

occurred. In this sense, all indicators are "lagging," or at best concurrent with, the performance 

change being monitored. However, in the case of RBPIs, this is not significant, because each 

indicator represents one of many elements of risk, for which there is still a large margin to the

2-10
Figure 2.2 

Margin Between Core Damage Early Fatality Risk, QHOs, and 

Current Overall Accidental Death Risk 

1.00E-03 !..................... ........ . . .. . . . ..... .. ... . . . . . . .... ......... 

i.00E-04 

1.00 E-05 

- I.OOE-06 

° 1.00E-07 

i l.00E-08 

1.OOE-09 

1,0 E-104•:• A4 ', .••t 

1.,- 0E 7 ...... 7 - :-- ,

Early Fatality Risk Early Fatality Risk Early Fatality Risk QHO for Early Current Accidental 

with CDF=I E-6/yr with CDF=I E-5/yr with CDF=I E-4/yr Fatalities Death Risk
agency-stated public health objective. The issue can be addressed by the question, "If 

performance were to degrade instantaneously to be in the red performance band, can this change 

in performance be detected in time to take corrective actions before the accumulation of risk 

becomes unacceptable?" In answering the question, it is important to note two things. 

First, the operating experience does not indicate that the unreliability of equipment or the 

frequency of challenges to the safety equipment is likely to change in that manner. For example, 

in order for the initiating events cornerstone indicator for trips with loss of heat sink to be in the 

red performance band, the frequency of events would have to change from about 1 every 5-10 

years to more than 15 per year. There is no evidence of plants having that kind of performance. 

Under mitigating systems, an emergency diesel generator train unreliability change from a 

nominal performance of 0.04 to about 0.15 per demand is needed to be in the red performance 

band. NUREG/CR-5500, Vol. 5 (Ref. 6), which evaluated EDG train unreliability and trended 

industry unreliability performance based on actual demands (losses of normal power to buses) 

does not indicate any plants with a mean unreliability estimate worse than 0.066. Thus, the 

failure probability would have to more than double to be in the red performance band, and no 

plants exhibit that kind of performance degradation. 

Second, even if these scenarios occurred, the RBPIs have been formulated so that the probability 

of the indication remaining nominal (green zone) while the performance becomes unacceptable 

(red zone) is low. For the two examples given above, the probability of not detecting the 

performance change was essentially zero for loss-of-heat-sink initiators and was less than one 

chance in 300 for EDG unreliability. (Plant-specific probabilities for these conditions are 

contained in the appendices.) 

Assuming that the degradation of a single performance indicator occurred immediately following 

the update of the indicator for the annual performance review and was not evaluated again for a 

year (unlikely since the data updates are expected quarterly), there could be a maximum 

undetected risk addition of 1E-4 to the total CDF for 1 year. It is extremely unlikely that such 

performance would remain undetected beyond that time. 

Performance degradations corresponding to the yellow and white zones constitute a rate of risk 

accumulation that is 10 to 100 times lower than this example. Thus, for these cases, the risk 

accumulation from "lagging" indication would be proportionately less. 

In summary, the potential degradations in plant performance monitored by the ROP represent a 

small portion of the existing individual accidental death risk and have a substantial margin to the 

agency's QHOs. For the events, conditions, and equipment proposed for monitoring in the 

RBPIs, the likelihood of failing to detect significant degradations in performance before they 

pose a significant risk relative to the QHOs or the existing individual accidental death risk is 

small.

2-12
3. RESULTS

The results are organized by internal events at power, shutdown events, and external events, 

because the indicators and thresholds in each of these areas use similar risk models and insights 

for each cornerstone. Within each area, each safety cornerstone is discussed. 

3.1 Results for Internal Events at Full Power 

Risk-based Performance Indicators are chosen to reflect changes in licensee performance that are 

logically related to risk and associated models. They provide performance measures whose 

impact on core damage frequency (CDF) and large early release frequency (LERF) can be 

established through a risk model or risk logic. In developing RBPIs, "performance" refers to 

activities in design, procurement, construction, operation, and maintenance that support 

achievement of the objectives of the cornerstones of safety in the ROP. This section summarizes 

the selection and application of RBPIs at 23 plants. 

3.1.1 Initiating Events Cornerstone 

3.1.1.1 RBPIs 

RBPIs for initiating events were determined through evaluation of the Individual Plant 

Examination (IPE) submittals and the associated IPE Database (Ref. 7). From this database, 

initiators with a conditional core damage probability (CCDP) >_ 1E-6 and a contribution to 

industry-wide CDF > 1% were identified as risk-significant. In accordance with the data analysis 

performed in NUREG/CR-5750 (Ref. 8), three schemes for grouping initiating events were 

considered: industry-wide, pressurized water reactors (PWRs), and boiling water reactors 

(BWRs). The complete list of initiators, their industry CDF contributions, and the plant group to 

which they belong are given in Appendix A. 

The analysis of initiating event data and calculation of initiating event frequencies also relied on 

several data sources. The three data sources used in the selection, and their contribution to the 

analysis, of initiating event RBPIs are described below: 

"* NUREG/CR-5750, "Rates of Initiating Events at U.S. Nuclear Power Plants: 1987-1995" 

(Ref. 8), provided initiating event frequencies calculated for various initiators as well as the 

definitions of initiators and related functional impact groupings. These initiating event 

frequencies were incorporated into SPAR models (Ref. 9) as part of the process of 

establishing plant-specific baseline core damage frequencies. 

"* The Sequence Coding and Search System (SCSS) (Ref. 10) is a database maintained at Oak 

Ridge National Laboratory that provides access to electronic copies of Licensee Event 

Reports (LERs). This database was the source of initiating event data for NUREG/CR-5750 

and will be used to identify trips and scrams used in future calculations of initiating event 

frequencies and RBPI thresholds. 

"* Monthly operating report (MOR) data as tabulated in INEEL database MORP I (Ref. 11) 

provides a source of critical-operating-hour data used in the calculation of initiating event

3-1
frequencies reported in NUREG/CR-5750 and subsequently incorporated into the baseline 

SPAR models (Ref. 9). This database will be used to identify critical hours used in future 

calculations of initiating event frequencies and corresponding RBPI thresholds. 

In addition to being risk-significant, initiating event performance indicators must be capable of 

detecting performance changes in a timely manner. The associated monitoring period must be 

long enough to reduce the probabilities of false negatives and false positives to acceptable levels, 

but no longer. Statistical analyses were performed with the results, including monitoring periods, 

documented in Appendices E and F. Finally, the impacts of changes in frequencies of candidate 

initiating events must be readily quantifiable. Plant-specific baseline models were developed by 

incorporating generic industry data (through 1996) into plant-specific SPAR (Revision 3i) 

(Ref. 9) models. 

Three initiator/initiator groups (general transient, loss of feedwater, loss of heat sink) meeting the 

criteria were selected as candidate initiating event RBPIs. The candidate initiating event RBPIs 

along with representative thresholds are shown in Table 3.1.1 -1. Threshold values were 

calculated using SPAR Revision 3i logic models. There are two thresholds indicated at the 

green/white interface. The 95% value represents the 95th percentile of the industry baseline 

values. The other is based on a ACDF equal to 1E-6. This value is more consistent with the 

current Significance Determination Process (SDP). Appendix A provides details of these 

calculations. This report recommends the use of the ACDF method for determination of the 

green/white interface, the rationale for which is contained in Appendix A. There are three RBPIs 

for each plant for the initiating events cornerstone. Detailed plant-specific threshold information 

for all 23 plants evaluated in this phase is contained in Appendix A. Definitions, data, and 

calculational procedures are provided in Appendix H. 

Table 3.1.1-1 Initiating Event RBPIs

RBPIs & Example Thresholds for BWR 3/4 Plant 18 

Initiator R Baseline Frequency Green/White Green/White White/Yellow Yellow/Red 

Initiator__BPI (NUREG/CR-5750) 95th%ile ACDF=IE-6/yr' ACDF=IE-5/yr' ACDF=IE-4/yra 

General transient (GT) 1.2 / year' 2.2 / year 1.9 / yeara 7.8 / year' 67 / yeara 

Loss of feedwater (LOFW) 6.8E-2 / year? 2.OE-1 /year 3.OE-1 /year? 2.5 / year? 24 / yea? 

Loss of heat sink (LOHS) 2.3E-l /Iyear' 3.lIE-1 / yearj 4.1E-1 /year1 3.4 / year' 3, / yeaa 

RBPIs & Example Thresholds for WE 4-Lp Plant 22 

Initiator RBPI Baseline Frequency Green/White Green/White White/Yellow Yellow/Red 

(NUREG/CR-5750) 95"%ile ACDF=IE-6/Yra ACDF=IE-5/yr? ACDF= I E-4/yr4 

General transient (GT) 9.6E-1 "/year' 1.8 / year 1.8 / yeara 8.8 / year' 78 / year' 

Loss of feedwater (LOFW) 6.8E-2 / yeara 2.OE-1 / year 8.OE-I / year' 7.2 / year 74 /year' 

Loss of heat sink (LOHS) 9.6E-2 / year? 2.6E-1 / year 2.4E-1 / yeara 1.5 / year' 15 / year' 

a. Year refers to a calendar year assumed to include 7000 critical hours. 

3.1.1.2 Industry-Wide Trending 

The RBPI development program also provides industry-wide trending of the initiating events that 

are RBPIs as well as initiating events that are not possible to trend on a plant-specific basis. 

Since more data are available at the industry level, trends emerging at the industry level may be 

apparent before plant-specific changes can be determined. To be selected for trending, the

3-2
candidate initiators must be risk-significant (i.e., contribute >1% to industry-wide CDF) and have 

at least one occurrence since 1987 as recorded in NUREG/CR-5750. 

The loss-of-offsite-power (LOOP) initiator is an example of a performance element that is 

difficult to trend at a plant-specific level yet can be trended at the industry level. The IPE results 

indicate that LOOP is a dominant contributor to risk at U.S. nuclear power plants; however, 

plant-specific performance indicators are not practical because of the excessive period required to 

detect changes in this initiator. 

Thirteen initiating event types/groups meet these conditions and are identified as candidates for 

industry-wide trending. These initiating event types/groups and their respective 

NUREG/CR-5750 category are listed below: 

1. General transients (Q) 

2. Loss of feedwater initiators (P 1) 

3. Loss of heat sink initiators (L) 

4. Loss-of-offsite-power events (B 1) 

5. Steam generator tube rupture (F I) 

6. Small/very small LOCA (GI, G3) 

7. Stuck-open safety/relief valve - BWR (G2) 

8. Loss of vital AC bus (C1, C2) 

9. Loss of vital DC bus (C3) 

10. Loss of instrumentlcontrol air - BWR (D1) 

11. Loss of instrument/control air - PWR (D I) 

12. Internal flood (JI) 

13. Initiators evaluated as accident sequence precursors (ASP) 

The process and rationale for the selection of these initiator types/groups is outlined in more 

detail in Appendix A. An example plot of LOOP initiating events during power operation is 

presented below in Figure 3.1.1-1. General transients, loss of feedwater, and loss of heat sink are 

trended in Table 5.3-6 of this report. Trends associated with the other initiating events are shown 

in Appendix A. 

3.1.1.3 Inspection Areas Covered by New RBPIs 

The RBPIs developed in this report for the initiating events cornerstone were compared with the 

performance indicators in the ROP to identify those RBPIs that are not currently in the ROP. 

The inspection areas that could be impacted by the new initiating event RBPIs were then 

determined. The results are summarized in Table 3.1.1-2.

D,-D)
0.20

0.15 ". 

, 0.10 

C: 

-------- ----------- ----------------- ----

0.00 

1987 1988 1989 1990 1991 1992 1993 1994 1995 1996 1997 1998 

Year G•C 

Figure 3.1.1-1 Time-Dependent Trending of Loss of Offsite Power Initiating Events

0330

Table 3.1.1-2 Summary of Inspection Areas Impacted by New RBPIs for Initiating Events 

Cornerstone 

RBPI Attribute Inspection Area 

- General transient - Equipment performance 71111-12, Maintenance Rule Implementation 

- LOFW 71111.08, Inservice Inspection Activities 

- LOHS 71152, Identification and Resolution of Problems 

- Human performance 71111.14, Personnel Performance During Nonroutine Evolutions 

3.1.2 Mitigating Systems Cornerstone 

This section discusses development of RBPIs that address the mitigating systems cornerstone for 

full-power, internal events. External events and nonpower modes are addressed in other sections. 

3.1.2.1 RBPIs 

The risk sianificance of mitigating systems was determined through analysis of Revision 3i 

SPAR models supplemented by quantification results found in the Individual Plant Examination 

(IPE) submittals and the associated IPE Database (Ref. 7). Specific equipment (i.e., mitigating 

systems and component classes) was identified as risk-significant based on combinations of 

importance measure values calculated from these sources. Plants were grouped so that a given 

set of RBPIs apply to the entire group based on common sets of risk-significant systems. Due to 

the limited number of plants for which SPAR Revision 3i models exist, two distinct plant groups

3)-4
were used (BWR and PWR). Additional plant groups may be developed as more SPAR 

Revision 3i models become available. 

In addition to being risk-significant, candidate mitigating system RBPIs must be capable of 

detecting performance changes in a timely manner. The associated monitoring period must be long enough to reduce the probabilities of false negatives and false positives to acceptable levels, but no longer. Appendices E and F document the statistical analyses and results, including monitoring periods, of these analyses. Finally, the impacts of changes in mitigating system performance must be readily quantifiable. Plant-specific SPAR (Revision 3i) models, baselined 

to 1996 performance, were used to quantify the impact of these changes and to calculate 

corresponding threshold values. 

Once risk-significant mitigating systems were identified, elements within those systems amenable to performance monitoring were selected. Two distinct elements of equipment performance, unreliability and unavailability, were selected to be monitored as RBPIs. In the 

RBPI development, the term "unavailability" is defined as the ratio of time when the component, train, or system was incapable of meeting its risk-significant safety function divided by the total 

time that ability to perform the risk-significant function could be needed. The term "unreliability" is defined as the probability that the component, train, or system would fail to perform its risk- significant safety function (fail to start or fail to run/operate) given that it was 

available to do so. These elements are compatible with divisions identified in SECY 99-007 and 

the Maintenance Rule (10 CFR 50.65 (Ref. 12) and Regulatory Guide 1.160 (Ref. 13)). These 

elements can be applied at any of several levels (i.e., system, train, component). The train level 

was determined to be the best choice and the rationale for selecting this level of monitoring is 

detailed in Appendix A. 

The evaluation of risk-significance also identified several component classes that were important. These were chosen because they can provide plant-wide performance attributes that would 

potentially reflect performance changes due to "cross-cutting" issues before individual system or train indicators. Unreliability was selected to be the RBPI for each of these component classes. 

Component class unreliability indicators are defined in terms of failures corresponding to demands to perform the component's risk-significant safety function. Failures associated with 

design basis functions that do not impact the ability to perform the risk-significant function are 

not included in this calculation. Failures not associated with demands to perform the risk

significant function are treated through unavailability measures for the affected safety system 

trains. 

Mitigating systems and component classes meeting the criteria were selected as candidate 

mitigating system RBPls. Thirteen mitigating system/component class RBPls were identified at each BWR plant (five in current ROP). For PWR plants, 18 mitigating system/component class 

RBPIs were identified (5 in the current ROP). The candidate mitigating systems and component classes are identified in Table 3.1.2-1. Examples of plant-specific thresholds are identified for 

two plants in Tables 3.1.2-2 and 3.1.2-3. Detailed plant-specific threshold information for all 44 

plants evaluated in this phase is contained in Appendix A. Definitions, data, and calculational 

procedures are provided in Appendix H.

3-5
The analysis of mitigating system performance also relies on several data sources. The primary 

data sources used in the selection of, and their contribution to, the analysis of mitigating system 

RBPIs are described below: 

System Reliability Studies (Refs. 14-19) contain failure data for several risk-significant 

mitigating systems. The generic data from these studies were incorporated into the SPAR 

models as part of the process of establishing plant-specific 'baseline' models and associated 

core damage frequencies. The data currently reflected in SPAR models were derived from 

the original system studies; these are currently being updated. In the statistical analysis, 

false-positive/false-negative evaluations did not consider model uncertainty associated with 

the SPAR models. The model uncertainty will be addressed as part of the SPAR model 

verification. 

The Reliability and Availability Database System (RADS) (Ref. 20) will provide 

unreliability and unavailability data and parameter estimation capability for use in periodic 

evaluations of mitigating system performance. It imports data from the Institute of Nuclear 

Power Operations' (INPO) EPIX database (Ref. 21) as well as other established sources such 

as LERs and MORs. 

Table 3.1.2-1 Candidate Mitigating S ystem RBPIs 

BWR RBPI SYSTEMS RBPI Parameter and Level 

Emergency AC power (EPS) Unreliability and unavailability at the train level. 

High-pressure coolant injection systems 

* High-pressure coolant injection (HPCI) Unreliability and unavailability at the train level. 

High-pressure core spray (HPCS) 

High-pressure heat removal systems 

* Isolation condenser (IC) Unreliability and unavailability at the train level. 

* Reactor core isolation cooling (RCIC) 

Residual heat removal (SPC, RHR) Unreliability and unavailability at the train level. 

Service Water (SWS) Unreliability and unavailability at the train level. 

PWR RBPI SYSTEMS 

Auxiliary feedwater (AFW/EFW) 

Motor-driven pump train Unreliability and unavailability at the train level. 

Turbine-driven pump train Unreliability and unavailability at the train level. 

Component cooling water (CCW) Unreliability and unavailability at the train level. 

Emergency AC power (EPS) Unreliability and unavailability at the train level. 

High-pressure injection (HPI) Unreliability and unavailability at the train level. 

Power-operated relief valve (PORV) Unreliability at the system level. 

Residual/decay heat removal (RI-IR) Unreliability and unavailability at the train level. 

Service Water (SWS) Unreliability and unavailability at the train level. 

COMPONENT CLASSES (all plants) 

Air-operated valves (AOVs) Unreliability at the component level. 

Motor-operated valves (MOVs) Unreliability at the component level. 

Motor-driven pumps (MDPs) Unreliability at the component level.

3-6
Table 3.1.2-2 BWR Mitigating System RBPIs

Mitigating Baseline Train Unavailability Green/White Green/White White/Yellow Yellow/Red 

System or Unreliability' 95th %ile ACDF =E-6/yr ACDF =E-5/yr ACDF =lE-4/yr 

Emergency AC (Unreliability) 4.OE-2 9.9E-2 4.2E-2 5.8E-2 1.5E-1 

Power (Unavailability) 9.7E-3 1.9E-2 1.4E-2 4.9E-2 3.9E-1 

Reactor Core (Unreliability) 7.9E-2 1.7E-1 9.1E-2 2.OE- I Not Reached 

Isolation Cooling (Unavailability) 1.3E-2 4.OE-2 2.8E-2 1.7E-1 Not Reached 

Essential Service (Unreliability) 2.5E-2 8.OE-2 2.7E-2 4.2E-2 1.3E-1 

Water (Standby Train Unavail.) 1.9E-2 5.4E-2 2.2E-2 5.6E-2 3.9E-1 

HPCI (Unreliability) 2.4E- I 4.3E-1 2.6E- I 4.6E- I Not Reached 

(Unavailability) 9.7E-3 3.8E-2 8.2E-2 7.3E-1 Not Reached 

Residual Heat (Unreliability) 8.8E-3 2.3E-2 2.OE-2 6.8E-2 2.2E-1 

Removal (Unavailability) 1.OE-2 2.5E-2 1.4E-I Not Reached2 Not Reached2 

AOVs Component Class Unreliability N/A Increase 2.2X Increase 13X Increase 83X 

MOVs Component Class Unreliability N/A Increase 1.7X Increase 7.OX Increase 28X 

MDPs Component Class Unreliability N/A Increase 1.2X Increase 5.1 X Increase 28X 

I. Train unreliability evaluated using the plant-specific SPAR Rev. 3i system fault tree (at the train level).

2. This threshold can be reached if the test and maintenance (T&M) outages associated with this system are not confined to TS allowablecombinations.

Table 3.1.2-3 PWR Mitiigating Svstem RBP~s

3-7

RBPIs & Example Thresholds for BWR 3/4 Plant 18

RBPIs & Example Thresholds for WE 4-Lp Plant 22

Mitigating Baseline Train Unavailability or Green/White Green/White White/Yellow Yellow/Red 

System Unreliability' 95'"%ile ACDF=IE-6/yr ACDF=IE-5/yr ACDF=IE-4/yr 

Auxiliary (MDP Train Unreliability) 8.7E-3 2.1E-2 9.8E-3 1.8E-2 5.4E-2 

Feedwater (TDP Train Unreliability)1.9E-1 3.4E-1 2.0E-1 2.9E-1 Not Reached 

(MDP Train Unavailability) 1. IE-3 2.5E-3 3.7E-3 2.8E-2 2.5E-1 

(TDP Train Unavailability) 4.6E-3 1.8E-2 2.1E-2 1.7E-1 Not Reached 

Component (Unreliability) 1.6E-2 4.7E-2 2.OE-1 6.5E-1 Not Reached 

Cooling Water (Standby Train Unav) 1.1 E-2 4.4E-2 7.8E- I Not Reached Not Reached 

Emergency AC (Unreliability) 4.2E-2 L.OE-1 4.3E-2 5.5E-2 1.3E-1 

Power (Unavailability) 9.7E-3 1.9E-2 1.3E-2 3.9E-2 3.OE-1 

High-Pressure (SI Unreliability) 9.7E-3 2.1E-2 8.8E-1 Not Reached Not Reached 

Injection 

(Includes CVC (SI Unavailability) 4.2E-3 1.6E-2 Not Reached2 Not Reached2 Not Reached2 

trains) (CVC Unreliability) 5.9E-2 1.9E-1 4.3E-1 Not Reached Not Reached 

(CVC Standby Train Unav) 5.4E-2 1.7E-1 Not Reached 2 Not Reached 2 Not Reached 2 

Power-Operated 

Relief Valves (System Unreliability) 3.2E-2 6.8E-2 5.7E-2 2.6E-1 Not Reached 

Residual/Decay (Unreliability) 1.7E-2 3.8E-2 3.8E-2 1.3E-1 4.7E-1 

Heat Removal (Unavailability) 7.3E-3 2.4E-2 9.3E-2 8.8E-1 Not Reached-2 

Service Water (Unreliability) 3.2E-2 9.4E-2 1.3E-l 2.1E-1 3.2E-1 

(Standby Train Unav) 2.7E-2 9.OE-2 Not Reached2 Not Reached-2 Not Reached-2 

AOVs Component Class Unreliability N/A Increase 2.2X Increase 13X Increase 106X

PNVR MitiLyating Svstem RBPls
Table 3.1.2-3 (Continued) 

RBPIs & Example Thresholds for WE 4-Lp Plant 22 

Mitigating Baseline Train Unavailability or Green/White Green/White White/Yellow Yellow/Red 

System Unreliability 95 h%ile ACDF=IE-6/yr ACDF=IE-5/yr ACDF=IE-4/yr 

MOVs Component Class Unreliability N/A Increase 2.4X Increase iX Increase 39X 

MDPs Component Class Unreliability N/A Increase 1.2X Increase 3.2X Increase 16X -----. . .--------------- arcan~n o ; s., .•.,6÷.I ¢1t ta• at thtrain level]

1. Train unreliability evaluated using tme plant-specluic rlAi-. Nxev. .7 system u t he t, i level) 

2. This threshold can be reached if the T&M outages associated with this system are not confined to TS allowable combinations. 

The risk significance of specific performance degradations varies from plant to plant as a result of 

factors such as variation in functional redundancy from plant to plant. As a result, some thresholds 

are not reached at a specific plant because those systems, trains, or components are less risk

significant at that plant, even though they may be more risk-significant at other plants. 

3.1.2.2 Industry-Wide Trending 

In addition to providing plant-specific information, the RBPI development program provides 

industry-wide trending, including trending on risk-significant performance elements that are not 

possible to trend on a plant-specific basis. Since more data are available at the industry level, 

trends emerging at the industry level may be apparent before plant-specific changes can be 

determined.

0.12 

0.10 L_ . 

- 0.08 

.0 L. 

0 0.06 0 

"- 0.04 

0.02 

0.00

1984 1985 1986 1987 1988 1989 1990 1991 1992 1993 1994 1995 

Year GCOO 0465 9 

Figure 3.1.2-1 Time-Dependent Trending of Emergency Diesel Generator Common 

Cause Failure Events

3-8
Candidates for industry-wide trending must be risk-significant and have at least one occurrence 

since 1987. In addition to the RBPIs identified in Table 3.1.2-1, three mitigating systems or 

performance elements meet these conditions and are identified as candidates for industry-wide 

performance trending. Mitigating systems to be trended are: 

* RBPIs from Table 3.1.2-1 

* Common cause failure events for auxiliary feedwater pumps 

* Common cause failure events for emergency diesel generators 

* Common cause failure events for all safety-related systems 

The process and rationale for the selection of the specific mitigating systems and performance 

elements are outlined in more detail in Appendix A. 

3.1.2.3 Inspection Areas Potentially Affected by RBPIs 

The RBPIs developed in this report for the mitigating systems cornerstone were compared with 

the performance indicators in the ROP to identify those RBPIs that are not currently in the ROP.. 

The inspection areas that could be impacted by the new mitigating system RBPIs were then 

determined. The results are summarized in Table 3.1.2-4. 

Table 3.1.2-4 Summary of Inspection Areas Potentially Affected by RBPIs for Mitigating 

Systems Cornerstone 

RBPI Attribute Inspection Area 

Full Power: 

Mitigating Systems (UR) Equipment Performance 71111.04, Equipment Alignment 

71111.12, Maintenance Rule Implementation 

71111.15, Operability Evaluations 

71111.22, Surveillance Testing 

71152, Identification and Resolution of Problems 

Mitigating Systems (UA) Equipment Performance 71111.12, Maintenance Rule Implementation 

Human Performance 71111.14, Personnel Performance During Nonroutine Evolutions 

(Pre-Event) 71152, Identification and Resolution of Problems 

Configuration Control 71111.04, Equipment Alignment 

71111.12, Maintenance Rule Implementation 

71111.13, Maintenance Risk Assessments and Emergent Work Evaluation 

71111.23, Temporary Plant Modifications 

71152, Identification and Resolution of Problems 

3.1.3 Barrier Integrity Cornerstone: Containment Performance 

This section presents RBPI development results that address the containment integrity portion of 

the barrier integrity cornerstone for internal events at full power. The scope of the structures, 

systems, and components related to the containment barrier includes the primary and secondary containment buildings (including personnel airlocks and equipment hatches), primary containment 

penetrations and associated isolation systems, and risk-significant systems and components 

necessary for containment heat removal, pressure control, and degraded core hydrogen control.

3-9
RBPI development for containment integrity uses large early release frequency (LERF) as the 

metric for determining the risk significance of changes in containment performance, conditional 

on CDF performance at the baseline value. Development of the SDP has led to classification of 

kinds of performance elements according to whether they affect both LERF and CDF (Type A), 

only LERF (Type B), or only CDF. In the terminology of the SDP, the present work on 

containment has examined Type B findings. Some containment-related features may affect CDF, 

but assessment of such Type A performance areas is not currently practical because integrated 

CDF/LERF models are not currently available. 

For certain containment types, it has been found that the following factors influence early failure 

of the containment barrier. However, most of these factors affecting LERF involve mechanistic 

phenomena that are not amenable to RBPI development. 

* Containment isolation performance 

"• Direct impingement of core debris on important containment elements 

"* Overpressure due to excessive heat loads from ATWS sequences 

"* RCS pressure at vessel failure 

"• Penetration seal integrity 

"• Suppression pool bypass 

"* Ice condenser performance 

"* Hydrogen ignitor performance 

"* Drywell spray performance 

Many containment barrier mitigation systems affect late containment failure. Treatment of non

LERF risk scenarios is a topic for future discussion with stakeholders (Section 6). The following 

factors influence late failure of the containment barrier (Ref. 4): 

"* Overpressurization due to loss of containment heat removal (sprays, heat exchangers, etc.) 

"• Overpressurization due to core-concrete interactions 

* Venting 

The following potential containment RBPIs have been identified. Each potential indicator is 

applicable to specific containment designs: 

"* Unreliability/unavailability of drywell spray (Mark I BWRs, Mark II BWRs, Mark III BWRs) 

"• Unreliability/unavailability of large containment isolation valves (PWRs, Mark III BWRs) 

(valves isolating paths that connect the containment atmosphere directly to the outside 

atmosphere) 

"* Unreliability/unavailability of hydrogen ignitors (Ice condenser PWRs, Mark III BWRs) 

However, for these potential RBPIs, models and data are not available for formulating baseline 

values and quantifying thresholds. LERF models for setting thresholds are not available for all 

containment types. In addition, the available models are not compatible with the SPAR Revision 3 

models for assessing CDF impacts which are the inputs to the LERF models. Therefore, no 

containment RBPIs are provided.

3-10
Moreover, drywell spray is closely identified with Type A functionality (low-pressure injection and suppression pool cooling), so the RBPI and associated thresholds need to be defined within an 

integrated CDF/LERF perspective (see Section 6.1). Although containment heat removal is not 

generally an important contributor to LERF, in some PWRs it has a role in core damage prevention and in prevention of large early releases. This, too, is a Type A function, and needs to 

be examined within an integrated CDF/LERF perspective. 

When better models and data are obtained, RBPI development will be completed for these 

potential RBPIs. In addition, RBPIs previously analyzed under the initiating events and mitigating systems cornerstones will also be reexamined to determine whether LERF considerations alter the 

findings of Sections 3.1.1 and 3.1.2. 

These RBPIs are not among the performance indicators in the ROP. The inspection areas that 

could be impacted by these RBPIs were determined. The results are summarized in Table 3.1.3-1. 

Table 3.1.3-1 Summary of Inspection Areas Impacted by Potential RBPIs for Containment 

Portion of Barrier Integrity Cornerstone 

RBPI Attribute Inspection Area 

CIV (UR&UA), Design Control 71111.02, Evaluation of Changes, Tests, or Experiments Drywell Spray 71111.17, Permanent Plant Modifications 

(UR&UA), and 71111.23, Temporary Plant Modifications 

Hydrogen Ignitors 71152, Identification and Resolution of Problems (UR&UA) Barrier Performance 71111.12, Maintenance Rule Implementation 

71111.15, Operability Evaluations 

71111.20, Refueling and Outage Activities 

71111.22, Surveillance Testing 

3.2 Results for Shutdown 

The results of the RBPI development process are qualitatively different from fall-power results for 

the following reasons. 

"* Shutdown occupies a much smaller fraction of the year than does full-power operation, so 

shutdown-specific unreliability, unavailability, and frequency metrics accumulate failure 

data much more slowly than do comparable metrics for full power. 

"* Configuration management is a more significant factor in shutdown risk than in full-power 

risk. 

"* Relatively few models for shutdown CDF and LERF are available relative to full power. Therefore, the results presented below are based on risk insights from the representative 

models available (Refs. 22-24).

3-11
3.2.1 Initiating Events Cornerstone

No initiating events accumulate statistics quickly enough to support timely detection of declining 

performance. Therefore, there are no plant-specific initiating event RBPIs for shutdown 

operations. 

However, industry trending of the following events is warranted based on existing shutdown risk 

studies: 

* Loss of offsite power during shutdown 

"* Loss of operating train of RHR due either to local fault or loss of support systems 

"* Loss or diversion of inventory leading to loss of RHR 

"• Loss of level control when entering mid-loop operation leading to loss of RHR (PWR only) 

3.2.2 Mitigating Systems Cornerstone 

Most licensees manage shutdown risk in accordance with NUMARC 91-06, "Guidelines for 

Industry Actions to Assess Shutdown Management" (Ref. 26). They manage defense in depth, 

through configuration control, for key safety functions (decay heat removal, inventory control, 

electrical power availability, reactivity control, and containment). Based on available models and 

data. this subsection develops and illustrates RBPIs that could directly measure licensee 

performance in configuration control by measuring the time the plant spent in risk-significant 

configurations (combinations of equipment unavailabilities and plant conditions with respect to 

decay heat and RCS inventory). 

Because the NUMARC guidance promotes avoidance of risk-significant configurations, 

compliance with the NUMARC guidance will promote good performance as measured by the 

proposed RBPIs. The NUMARC guidance addresses the following two aspects (among others): 

(1) hardware defense in depth, and (2) crew readiness to respond to initiating events within 

available time. Aspect 1 is generally captured in available models, and is reflected in the 

assessment of the risk significance of specific configurations. Aspect 2 is not explicitly treated in 

available models, which do not model a distinction between standard practice and additional 

compensatory operator actions resulting from adherence to 91-06. 

The RBPIs reflect excess time spent in risk-significant configurations during the observation 

period. Four categories of configurations are defined: low, medium, early reduced-inventory 

(vented), and high. These are defined in terms of conditional core damage frequency (CCDF) 

and, in the case of the early reduced-inventory category, operational conditions. The baseline for 

each category (the typical time spent in configurations associated with that category) has been 

determined by examination of representative outage profiles, as discussed in Appendix B. 

Spending time over and above the baseline duration in configurations having relatively high 

CCDF results in core damage probability above the baseline value. The RBPI thresholds follow 

from the relationship: 

Threshold At = ACDP threshold/configuration CCDF,

3-12
where the ACDP thresholds are the standard G/W, W/Y, and Y/R thresholds (1E-6, 1E-5, and 

1E-4), and the configuration CCDF corresponds to the configuration's risk category. As 

explained in Appendix B, all realizable configurations are classified into configuration categories, 

corresponding to CCDF - IE-6/day (low), CCDF - 1E-5/day (medium), and CCDF - 1E-4/day 

(high and early reduced-inventory (vented)). Then, for example, since the medium risk 

configurations are associated with a CCDF of approximately 1E-5 per day, the G/W, W/Y, and 

Y/R thresholds for medium are, respectively,. 1 day above baseline, 1 day above baseline, and 10 

days above baseline. The baselines and thresholds for all three categories are shown in Tables 

3.2.2-1 and 3.2.2-2, rounded in some cases to an even number of days or hours for simplicity. 

Table 3.2.2-1 Baseline and Thresholdg for Time in Risk-Sqignificant C~nnfiouurntionn Indi~ntnrg - PWR•

Configuration Baseline G/W Threshold W/Y Threshold Y/R Threshold 

Category 

Low 20 days 21 days 30 days 120 days 

Medium 2 days 2 days + .08 day (2 hrs) 3 days 12 days 

Early Reduced- 1 day I day 1.08 days 2 days 

Inventory (vented)' (1 day + 2 hrs) 

High 0 0 .08 day (2 hrs) I day 

a. This configuration category assumes that measures are taken to compensate for the risk associated with early 

reduced-inventory operations, as explained in Appendix B. If compensatory measures are not taken, these 

configurations are assigned to the high configuration category. 

Table 3.2.2-2 Baseline and Thresholds for Time in Risk-Significant Configurations Indicators - BWR 

Configuration Baseline G/W Threshold W/Y Threshold Y/R Threshold 

Category 

Low 2 days 3 days 12 days 102 days 

Medium 0.20 day (5 hrs) 0.29 day (7 hrs) I day 10 days 

High 0 0 .08 day (2 hrs) I day 

The configurations are classified in Tables 3.2.2-3 (PWRs) and 3.2.2-4 (BWRs). As explained in 

Appendix B, the risk associated with these configurations has been assessed based on risk insights 

from representative models. Illustrative results are provided for a representative PWR (Ref. 23) 

and a representative BWR (Ref. 25). Risk-significant configurations are characterized by reactor 

coolant system (RCS) conditions, time after shutdown, and a given set of systems or trains being 

unavailable, either for maintenance or as a result of equipment failure. The RBPI for each 

configuration category is the total time spent in configurations assigned to that category during the 

1-year observation period. A blank entry in a cell means that the indicated configuration in that 

plant operating state (POS) has a minimal conditional core damage frequency (CCDF) and time 

spent in that configuration need not be counted. Shaded cells indicate combinations of POS and 

configuration that are not analyzed, either because the configuration violates the POS definition or 

the systems involved play no role in the POS. The intent is that each credible plant configuration

S

3-13
S.........., ... r•• ... D.-• 1, ClQifo,,finn (Rll~d nn n Generic Westinghouse 4-LooD Shutdown PRA Model)

U.

Table 3.2.--3 IYWK Shutdown .onfiguraL iUn a-II '-,I,• ,, ,.. I.... .. .. . ...- 11os Configuration Risk Classification 

No Backup Electrical Power Support Cooling Secondary Emergency Injection Other Trains 

Maintenance RIIR Trains Unavailable Trains Cooling 'Trains Unavailable Unavailable 

Unavailability Trai I Unavailable Trains 

Unavail- Unavail

able able I 

Grioup Mode RC Days RIIR One Two One O~ne One One (All S~s) RWST Two St' Both Two Alt SG AlUOAlS 

EDG Safety- affety- TraI n Train of Suips PORV and and Both 

Shut- Related Related of CCW PORV RWST Sunps 

down AC Bus DC Bus ESW 

Low Inventory Configurations Occurring Very Early (within the first 5 days) in an Outage 

Depressurized RI IR Mode 5 l intact or 2 Low Med I Low Low Low Low l'ow Med I Highi Low Low Med Low High I High 

Cooliiig with Cold isolatable 

Reduced Inventory shiitdowvn 

Dcpressurized RI IR Mode 5 vented < 5 ElRI-V" ERI-V t

, ERI' 

Cooling wiith Cold 

Re duced Inventory Shutdown Representative Configurations Occurring in a Typical Outage 

Pressurized Mode 4 Intact Low Med Low Low Med Low II1]Ifl 

CooIldow I-1lotjJjJj shutdown 

Depressurized RIIR Mode 5 Intact Low Low Low Low Low Low High Hligh High 

Cooldown with Cold 

Norimal Inventory shutdown 

Dcpressurized RI IR Mode 5 Intact or 12 Low Low Low Low Low Med Low Med Low High Higlh High 

Cooling with Cold isolatable 

Reduced Inventory Shutdown I__I__I 

Depressurized RlIR Mode 5 vented 7 Med Med Med Med Iligh Med Med Med High Med Med 

Cooling with Cold 

Reduced Inventory shu~tdowVn_____ 

Depressurized RHRi Modde 5 vented 13 Med Med Med Med Iligh Med Med Med Hi1h1111 

Cooling with Cold 

Reduced Inventory shutdown______ 

Refueling Cavity Mode6 vented 14 Med 

Filled 

Low Inventory Configurations Occurring Late in a Typical Outage 

Depressurized RIIR Mode 5 Vented 24 Low Med Low Med Low Low Low Med High Low Med 

Cooling with Cold 

Reduced Inventory siutdowvn 

Notes: Shaded cells indicate combinations of POS and configuration that are not analyzed, either because the configuration violates the POS definition or the systems 

involved play no role in the POS. 

Blank cells represent configurations whose CCDF < 1.01E-6 per day.
a. In this configuration it is assumed that a makeup pump is available. 

b. This configuration category assumes that measures are taken to compensate for the risk associated with early reduced-inventory operations, as explained in Appendix B. If compensatory measures are not taken, these configurations are assigned to the high configuration category. 

Key: 

Low Low risk configuration 

Med Medium risk configuration 

High High risk configuration 

AC Alternating current power division 

CCW Component cooling water 

DC Direct current power division 

EDG Emergency diesel generator 

ERI-V Early reduced-inventory (vented) 

ESW Emergency service water 

PORV Power-operated relief valve 

RHIR Residual heat removal 

RWST Refueling water storage tank 

SG Steam generator 

SI Safety injection 

(Jt/
"Table 3.2.2-4 BWR Shutdown Configurations Risk Classification (Based on NUREG/CR-6166 Results) 

I l'OS Configuration Risk Classification

'OS 5 Cold slIitd owni Vessel IleadO oil LOW 1VLUMe 

'56 Rfiieliimg Vessel head off 

(level raised to 

steamlinle) 

POS 7 .Reficliig UPPe [Pool filled Low Low Low 

Note: Blank cells indicate combinations of POS and conlfiguration that are not analyzed, either because the configuration violates the POS definition or the systems 

involved play no role in the POS.

KMy:

Low Low Risk Configuration 

Med Medium Risk Configuration 

High High Risk Configuration 

EDG Emergency diesel generator 

BAT Battery 

SSW Standby service water

HPCS LPCS 

SP 

SRV 

CDS 

SDC

High-pressure core spray Low-pressure core spray 

Suppression pool 

Safety relief valve 

Condensate system 

Shutdown cooling
correspond uniquely to one cell of that plant type's table, and that conditional core damage 

frequency (and configuration category) be implied by that cell's characteristics. Appendix H 

provides more detailed calculational guidance. 

A significant fraction of PWR shutdown risk is associated with certain reduced-inventory 

operations. Because of high decay heat, early reduced-inventory operations (reduced-inventory 

operations conducted less than 5 days after shutdown with the RCS vented) have a CCDF that is 

comparable to the high CCDF configurations unless compensatory measures are taken. They are 

the only configurations potentially having high CCDF for which a nonzero baseline is assigned. 

The RBPIs allow credit for a baseline of 1 day in ERI-V conditions provided that the 

compensatory measures of NUMARC 91-06 are in place. Reduced-inventory operations 

conducted later in the shutdown may have medium CCDF, even if standby systems are nominally 

available. The baseline for PWRs reflects the need for PWRs to spend some time in reduced

inventory operations (including some time early in the shutdown). The balance of nominal risk 

from shutdown operation in PWRs derives from lower risk configurations. The threshold 

assignments follow directly from the calculated CCDF associated with the indicated 

configurations. BWR shutdown CDF is generally lower than PWR shutdown CDF; therefore, the 

baseline values are different. 

The proposed RBPIs somewhat resemble condition assessments in that they are capable of 

manifesting a significant change in risk over a relatively short time. Changes in plant 

configuration at shutdown induce potentially large changes in conditional CDF that persist over 

short times (hours, days, or weeks), rather than moderate changes persisting over longer times 

(greater than 1 year) as is typical of full-power PIs. The development of the shutdown RBPIs has 

been carried out in such a way that the risk impact of shutdown performance changes is mapped 

into performance bands consistently with the full-power development. 

Internal and external stakeholder comments indicated that the approach presented above for 

potential shutdown RBPIs is more appropriate for potential application in the SDP process of the 

ROP. Consequently, future use of this effort will concentrate on evaluating the significance of 

shutdown conditions for the SDP. 

The inspection areas that could be impacted by the new RBPIs were determined. The results are 

summarized below in Table 3.2.2-5. 

Table 3.2.2-5 Summary of Inspection Areas Impacted by Potential Shutdown RBPIs for 

Mitigating Systems Cornerstone 

RBPI Attribute Inspection Area 

Time in Configuration Control 71111.04, Equipment Alignment 

HighlMedium/Low/ERI-V 71111.13, Maintenance Risk Assessments and Emergent Work Evaluation 

Configurations 71111.20, Refueling and Outage Activities 

71111.23, Temporary Plant Modifications

3-17
3.2.3 Barrier Integrity Cornerstone: Containment Integrity at Shutdown 

Containment performance at shutdown is affected by one issue that does not pertain to fall-power 

RBPIs, namely, that containment may be open during shutdown and must be reclosed 

expeditiously under certain conditions. 

PWRs 

The analysis documented in NUREG-1449 (Ref. 27) shows that timely closure of PWR 

containment prevents large early release in core damage scenarios initiated at shutdown. 

BWRs With Mark I and Mark II Containments 

The analysis in NUREG-1449 shows that BWR secondary containment alone is not 

expected to prevent large early release in core damage scenarios. This means that a 

change in BWR Mark I and II shutdown CDF equates to a change in LERF if primary 

containment is open. This circumstance is offset by generally lower shutdown CDFs for 

BWRs. 

BWRs With Mark III Containments 

The analysis documented in NUREG/CR-6143 (Ref. 24) shows that timely closure of 

these BWR containments prevents large early release in core damage scenarios initiated 

at shutdown. 

These results suggest possible containment RBPIs analogous to the possible time-in-risk

significant-configurations RBPIs defined above in 3.2.2. These would be defined for the risk

significant configuration categories introduced for the RBPIs defined for mitigating systems. 

Potential RBPI for PWRs and Mark III BWRs 

Time spent in risk-significant configurations with containment not closed and 

preparations for timely closure not complete (with "timely" defined as before boiling if 

the RCS is vented). 

Potential RBPI for Mark I and Mark II BWRs 

Time spent in risk-significant configurations with primary containment not intact and not 

capable of timely closure. 

An increase in time spent in a particular configuration with containment not capable of timely 

closure implies an increase in LERF that is equal to the increase in CDF associated with that 

configuration. Configurations with negligible conditional CDF are therefore associated with 

negligible changes in LERF, but risk-significant configurations contribute directly and 

significantly to LERF if containment is open and timely closure is not provided for.

3-18
Configurations in which only a short time is available to respond to initiating events are also 

generally those in which only a short time is available to effect containment closure. 

NUMARC 91-06 emphasizes (p. 32) the need to maintain capability for closure of containment 

in a time commensurate with plant conditions, with due regard for the availability of power 

(needed for closure) and the potential for adverse environmental conditions. It states (p. 19) that "containment hatches ... should either be closed or capable of being closed prior to core boiling 

following a loss of DHR ..... Core boiling is not the same as core damage, but since personnel 

are expected to evacuate when environmental conditions become adverse (p. 32), it is possible 

that operator actions in containment will become problematic as boiling occurs. 

Based on the above, time spent in risk-significant configurations with containment not capable of 

timely closure would be an indicator that comports with NUMARC 91-06 guidance. However, its 

detailed formulation would need to reflect the availability of needed auxiliaries, the absence of 

physical obstacles to containment closure, and the readiness and availability of personnel to 

effect closure when it is warranted. Data and models are not presently available to quantify these 

indicators. Therefore, neither baselines nor thresholds can be quantified. Quantification of these 

indicators would require, in addition to the time spent in risk-significant configurations, the time 

spent with containment in the indicated state during those risk-significant configurations. 

3.3 Results for External Events (Fire) 

This section provides preliminary RBPI results for fire. Other external events, such as seismic 

and flood, are not included in the scope of Phase 1 RBPI development. 

The results from the Individual Plant Examinations for External Events (IPEEEs) were used to 

assess the risk-significant performance attributes in accordance with the RBPI development 

process flowchart shown in Figure 2.1. In addition, the Fire Protection Risk Significance 

Screening Methodology, used in the current fire significance determination process (Ref. 29), 

was reviewed to supplement the insights of the IPEEE information. The IPEEE results are not 

collated in as comprehensive a way as was done for the IPE program. although draft NUREG

1742 (Ref. 30) does provide a comprehensive summary of the perspectives gleaned from the 

technical reviews of the IPEEE submittals. These studies indicate that fire CDF varies 

significantly among plants. However, fire CDF is generally high enough that some elements of 

fire scenarios are risk-significant compared to risk associated with shutdown or full-power 

internal events. Specifically, NUREG- 1742 states that "... the CDFs from accidents initiated by 

fires are of the same order of magnitude as those from other random internal events for the 

industry taken as a whole." 

The elements of fire-initiated core damage sequences include the following: 

* Occurrence of fire in specific fire area 

* Failure of detection/suppression (automatic and/or manual) systems 

* Fire damage to plant systems/cables in the fire area 

Fire barrier/separation effectiveness

3-19
Failure of post-fire safe shutdown systems (typically normal mitigation systems that are not 

affected by the fire scenario, covered in Section 3.1.2). 

Fire occurrence, including conditions leading up to the fire, is within the scope of the initiating 

events cornerstone. The remaining elements are within the scope of the mitigating systems 

cornerstone. 

3.3.1 Initiating Events Cornerstone 

No RBPIs are identified under the initiating events cornerstone for fire because the occurrence of 

fire events is too infrequent to support timely quantification of changes in plant-specific fire 

frequency. Based on an NRC study of fire events from 1986 to 1994 (Ref. 28), the fire initiating 

event frequencies for these areas range from 6.9E-2/year to 8.5E-4/year. These frequencies (once 

every 14 years or longer on a plant-specific basis) do not allow for timely quantification of 

changes in the fire frequencies. The risk-significant fire areas vary from plant to plant. However, 

the following fire areas are the most common among the list of risk-significant fire areas based 

on the accident sequences identified in the IPEEE for each plant: 

"* Switchgear room 

"* Control room 

"* Cable spreading room 

* Auxiliary building (PWR)/reactor building (BWR) 

• Turbine building 

* Battery room 

• Cable vault/tunnel/chase zones 

• Diesel generator rooms 

However, the occurrence rate of fire events in these areas is sufficient for industry-wide trending. 

The frequencies of occurrence of fire events in the most commonly risk-significant fire areas 

listed above will be used for industry-wide trending. 

3.3.2 Mitigating Systems Cornerstone 

The RBPI development identified fire suppression system unreliability and unavailability as 

potential RBPIs. The risk significance of fire suppression is highly plant-specific and area

specific, but at many plants, the risk significance of fire suppression is such that performance 

degradation in fire suppression could cause changes in CDF that are significant compared to the 

performance thresholds. Monitoring of suppression system unreliability and unavailability could 

provide feasible plant-specific RBPIs. However, although automatic suppression system 

unreliability and unavailability may in fact be risk-significant, the models and data currently 

available are not amenable for use in determining thresholds. Credit for compensatory actions 

would strongly affect RBPI thresholds for fire detection and suppression systems. Unfortunately, 

compensatory actions are not modeled well enough in available models to enable their use for 

threshold determination in the RBPI program.

3-20
3.3.3 Barrier Integrity Cornerstone: Containment Performance 

The IPEEEs typically only provide a qualitative analysis of barrier integrity, with the general 

conclusion that the results of the IPE analysis are unchanged as a result of the fire scenarios. 

Consideration of fire does not lead to any risk-significant LERF scenarios whose containment 

barrier attributes are not already being addressed under the internal events treatment of the 

containment barrier.

3-21
4. ASSESSMENT OF RISK COVERAGE BY RBPIs

The purpose of this section is to show the extent of risk coverage by RBPIs associated with core 

damage sequences, to show which risk-significant contributors are not covered by RBPIs, and to 

indicate briefly why these contributors are not covered by RBPIs. 

How Coverage Is Assessed 

Two approaches to assessment of the extent of RBPI coverage of core damage frequency have 

been applied. 

One approach is based on risk achievement worth (RAW), which measures how quickly CDF 

increases if element performance degrades. Given the baseline CDF and the RAW associated 

with a given element, the magnitude of the CDF increment that could be caused by degradation 

of the element can be determined. This is done for all basic events appearing in the SPAR model, 

and the extent of RBPI coverage is then assessed for each basic event whose failure could cause a 

CDF change greater than 1.OE-6. This assessment is closely related to the method for selecting 

candidate RBPIs in the first place (Section 3). 

In addition, an assessment of RBPI coverage of dominant accident sequences (sequences whose 

frequency contributes most to overall CDF) was performed. Dominant accident sequences are 

examined to determine which contributors to risk are covered by an RBPI. This is similar to a 

Fussell-Vesely importance evaluation. 

Results of Coverage Assessment 

Table 4-1 shows results for two plants, designated BWR 3/4 Plant 18 and Westinghouse four

loop Plant 22 (WE 4-Lp) for the RAW importance-based assessment of coverage, derived from 

SPAR models for these plants. For those events whose failure could lead to an increase in CDF > 

1.0E-6/y, approximately 40% of the events in the SPAR models are part of the RBPIs. The types 

of elements in the other 60% are indicated in Table 4-1. 

Table 4-1 Coverage of Risk-Significant Core Damage Elements from SPAR Models 

Category BWR 3/4 Plant 18 WE 4-Lp Plant 22 

Total number of SPAR model 

elements whose failure can result in 

ACDF _ 1 E-6/y 178 203 

- Initiating events 14 14 

- Mitigating system elements 164 189 

Elements covered by RBPIs 

- Initiating events 3/14 (21%) 3/14 (21%) - Initiating events covered by 3/14 (21%) 4/14 (29%) 

trending 

- Mitigating system elements 70/164 (43%) 72/189 (38%)

4-1
Table 4-1 (Continued) 

Category BWR 3/4 Plant 18 WE 4-Lp Plant 22 

Types of elements not explicitly Batteries Batteries 

covered by RBPIs Check valves Check valves 

Electrical buses Electrical buses 

Heat exchangers Heat exchangers 

Post-event human errors Post-event human errors 

Reactor protection system Reactor protection system 

Strainers Strainers 

Tanks Fans 

Tables 4-2a and b show RBPI coverage of dominant accident sequences at the initiating 

event/system level for the same two plants. The tables are derived from the IPE data base results 

for these plants. Almost all sequences are covered in part by multiple RBPIs. Most of the 

elements that are not covered either are not amenable to RBPI treatment or appear in sequences 

that contribute a relatively small fraction of core damage frequency. Some normally operating 

systems are credited for plant-specific reasons and do not appear in enough plant PRAs to have 

justified generically applicable RBPIs. 

Figures 4-1 a and b show RBPI coverage of initiating events for BWR 3/4 Plant 18 and 

Westinghouse four-loop Plant 22, based on relative contribution to core damage frequency (full

power internal events), derived from the IPE data base for these plants. Similar results for other 

plants are provided in Appendix D. 

Many initiating events occur too infrequently to permit timely quantification of declining 

performance, and RBPIs based on frequency of occurrence of individual initiating events in this 

category are therefore not defined. However, as discussed in Section 3.1.1, initiating events 

contributing more than 1% on average to industry-wide CDF and which includes one or more 

occurrences (industry-wide) since 1987 are included in the industry-wide trending. 

Elements Not Covered by RBPIs 

Five initiating events from the IPE data base information in Tables 4-2a and b were not covered 

by either RBPIs (indicators of event frequency) or trended initiators. Tables 4-2a and b, prepared 

using the IPE data base format, display ATWS events as if ATWS were an initiator. ATWS as 

such is not covered by an RBPI, but initiating events potentially leading to ATWS are covered as 

shown. Medium and large LOCA initiators are not covered because of their very low frequencies. 

Certain support systems whose loss is an initiating event are monitored under the mitigating 

systems cornerstone (service water and component cooling water in PWRs). Although no RBPI 

directly monitors the frequency of total loss of these systems, the corresponding initiating events 

are implicitly monitored at a lower level (the train level rather than the system level).

4-2
Table 4-2a RBPI Coverage of Dominant Full-Power Internal Event Core Damage Sequences - BWR 3/4 Plant 18 (IPE Data

Base Results)

Industry-Wide I I il Trending' ,. 

INITIATOR 

$1 

T-LOOP _ T---------------

T-LOOP 

T-ATWS

System RBPI

AC 

HUM 

HP1 

AC 

RPS

ACCIDENT SEQUENCE FAILURES 

EAC

HUM 

EAC 

CONDA

SEQ 

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

29 

30 

31 

32 

33 

34

CDF 

5.28E-07 

1.60E-07 

2.70E-08 

2,21 E-08 

2.05E-08 

1.80E-08 

1.34E-08 

1.16E-08 

1.1OE-08 

8.96E-09 

8.12E-09 

7.76E-09 

7.59E-09 

7.00E-09 

6.90E-09 

6.72E-09 

6.13E-09 

5.83E-09 

5.77E-09 

5.66E-09 

5.53E-09 

5.43E-09 

5.1OE-09 

5.02E-09 

4.60E-09 

4.46E-09 

4.44E-09 

3,88E-09 

3.83E-09 

3.78E-09 

3.62E-09 

3.46E-09 

3.42E-09 

3.38E-09

RPS 

RPS

CONDA 

CONDA

-" -T_-O-OP -- HPCI(HPCS) RCIC 

A LPCI CS 

P HPCI(HPCS) RCIC 

T-LOOP HPCI(HPCS) RCIC 

HPCI(HPCS) RCIC

1 - - :S2 - HPCI(HPCS) HUM 

A SPC AC 

I T-LOOP I HP1 LPCI 

T-LOOP J LPCI SPC 

T-ATWS RPS HP1 

S1 HPC(HPCS) HUM SPC -T-LO HUM 

T-ATWS RPS HPCI(HPC 

T-LOOP 1 HP1 HUM 

- -L-OP- J7sPc7I HUM

AC

HUM 

AC 

AC

HP1 

SPC 

CS 

AC 

HUM 

HUM 

AC 

HUM 

HUM 

HP1 

HUM 

HP1 

HP1 

SPC

HUM 

CONDA 

AC 

CONDA 

AC 

AC 

MFW

U.)

, _T-LOOP HPCIHPCS) RCIC _ T-LOOP HP1 HUM 

_ T-X ADS DC 

I T-LOOP HPCI(HPCS) RCIC 

T-L-OP HPI LPCl 

T-RX I DC 

T-ATWS RPS LPCI 

T-LOOP SPC HUM 

T-LOOP I HP1 SPC 

--- T-LOOP HP1 SPC 

-T--- "- HP1 HUM

T-ATWS 

T-ATWS

EAC 

HUM 

] AC 

CONDA 

AC 

AC 

HUM 

AC 

HUM 

HUM 

AC 

AC 

HUM 

HUM 

HP]

AC 

HUM

AC 

AC

I T-RX HUM HPCI HPCS) RCIC
Table 4-2a (Continued) 

! sIE RBPId ! ,- Industry--Wde" --

.. . . Trendinq . ..j

iSystem RBPIZ

ACCIDENT SEQUENCE FAILURES 

sPc HUM AC 

HUM AC 

RCIC HP1 HUM 

SPC HUM AC 

RCIC HUM AC 

RCIC HUM

A SPC 

.T-O-O - HP1 LPCI 

I T-LOOP H UM AC .------- f--------- ... HP1 HUM 

-- ---- -6 P ---

T-ATWS RPS CONDA 

F----"--•-- I--S - I HPCI(HPCS) MFW 

I------------- T-LOOP .... | HPCI(HPCS) HP1 

A HUM 

I VT-RX I HPCI(HPCS)j RCIC }

SEQ 

35 

36 

37 

38 

39 

40 

41 

42 

43 

44 

45 

46 

47 

48 

49 

50 

51 

52 

53 

54 

55 

56 

57 

58 

59 

60 

61 

62 

63 

64 

65 

66 

67 

68 

69

CDF 

3.33E-09 

3.33E-09 

2.86E-09 

2.77E-09 

2.63E-09 

2.57E-09 

2.57E-09 

2.42E-09 

2.40E-09 

2.26E-09 

2.21 E-09 

2.16E-09 

2.15E-09 

2.10E-09 

208E-09 

2.05E-09 

1.97E-09 

1.96E-09 

1.90E-09 

1.89E-09 

1.82E-09 

1.79E-09 

1.74E-09 

1.72E-09 

1.70E-09 

1.66E-09 

1.62E-09 

1 50E-09 

1.43E-09 

1.39E-09 

1.38E-09 

1.33E-09 

1. 19E-09 

1.15E-09 

1.14E-09

HP1 

HP1 

HP1 

HUM 

HP1 

RPS 

HP1 

RPS 

HP1

HUM HUM 

LPCI 

LPCI 

AC 

S SPC 

SLC 

SPC 

MFW 

SPC

iI 

I 

II I I HI-'CIIHHU) I

T .. - ..-

i----- -L-OP_,,,

T-ATWS 

...... T-LOP ------ J 

T-ATVWS 

A

HP1 

RPS 

HP1 

RPS 

HUM

LPCI 

RECIRC 

SPC 

MFW

TRX HPCIIHPCS) I RCFC

T-LOOP 

T-ATWS 

I---------------- -__T_-_LOP _ _ -J T-LOOP.__

HP1 

RPS 

HP1 

HUM

HUM 

HUM 

LPCI 

AC

SPC 

AC 

HUM 

HUM 

AC 

MFW 

AC 

SPC 

SPC 

HUM 

CONDA 

AC 

CONDA 

HUM 

MFW

SSPC CONDA 

] HUM 

HUM 

MFW 

AC 

SPc

AC

T-LOOP 

I "T-LOOP 

I T-LOOP 4 

I---------------

T-ATWS 

T-ATWS ! . . T-L -O --- _-

H1

HUM

EAC 

HP1 

AC 

AC 

AC 

HUM 

AC 

HUM 

HUM 

AC 

HP1 

VENT

AC

HUM

AC

HUM

AC

I l-l\z\ 1 ..... \ ..... I I

/1

II TDY I HP(;lItH L• iOlIl,
Table 4-2a (Continued) 

Industry-Wide 1 1 rnB J

System RBPI

INITIATOR ACCIl 

T-LOOP HPCI(HPCS RCIC 

A LPCI CS 

I-oo-P HP1 HUM 

T-LOOP HPCIHPCS) RCIC 

T-LOOP-"- HPI SPC 

T-ATWS RPS MFW 

-- T-LOOP-] HP1 HUM 

HPCI(HPCS) -T-RX RCIC

SEQ 

70 

71 

72 

73 

74 

75 

76 

77 

78 

79 

80 

81 

82 

83 

84 

85 

86 

87 

88 

89 

90 

91 

92 

93 

94 

95 

96 

97 

98 

99 

100 

101 

102

CDF 

1.13E-09 

1.13E-09 

1.13E-09 

1.12E-09 

1.1OE-09 

1.1OE-09 

1.09E-09 

1.05E-09 

1.03E-09 

1.03E-09 

1.03E-09 

1.02E-09 

1.01E-09 

9.90E-10 

9.80E-10 

9.75E-10 

9.53E-10 

9.41E-10 

9.41 E-1 0 

9.18E-10 

9.15E-10 

9.03E-10 

8.85E-10 

8.62E-10 

8.50E-10 

8.16E-10 

8.OOE-10 

7.93E-10 

7.88E-10 

7.55E-10 

7.28E-10 

1.52E-07

S HPCI(HPCS) SPC 

HUM 

HUM 

AC 

LPCI

)ENT SEQUENCE FAILURES 

HP1 HUM 

DC 

AC 

HP1 HUM 

HUM AC 

HP1 COND/ 

AC 

MFW HUM 

HUM AC 

MFW COND/ 

AC NSW 

AC

• I SP- I

HP1 j SPC I AC 

HP1 LPCI SPC 

PFW HUM 

HP1 DWS 

HPI HUM AC

* T-LOOP-__" HPCI(HPCS) RCIC 

AF S+ AC 

T-LOOP . HUM AC 

T-LOOP . HP1 SPC 

T-ATWS RPS CONDA 

j"-:-T--Lic-O13 : HP1 SPC 

T-LOOP HP1 LPCI 

I.. T-LOOP_ __J AC EAC 

_7T-LOOP LPCI CS 

TI.-_----"--- HPCI(HPCS) RCIC I

A

I .. T-LOOP : J 

REMAINDER 

E: Z T-IFL- -

SPC 

HP1 HUM

HP1

DWS 

HUM 

HUM 

CS 

HUM 

HP1

AC 

AC 

HUM 

HUM

AC 

AC 

AC

AC 

HUM

AC

AC 

AC

HUM

T-LOOP-J 

T-ATWS 

[' I----,-T-[------- ; T-LOOP- . 

I T-LOOP ] T-LOOP., 

T-LOOP ] T-LOQP 1 

T-LOOP 

IS2 

I T-LOOP I''--T,---------

HP1 

RPS 

HP1 

HP1 

HP1 

HP1

HUM

AC 

AC

AC

I sPc I
Table 4-2b RBPI Coverage of Dominant Full-Power Internal Event Core Damage Sequences WE 4-Lp Plant 22 (IPE Data

IERBP 

ndustry-Wide -__Trendwnf-j LIysteZBPI

SEQ 

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

29 

30 

31 

32 

33 

34

CDF 

2.14E-05 

1.27E-05 

5.99E-06 

3.98E-06 

3.26E-06 

2.88E-06 

2.56E-06 

2.38E-06 

2.12E-06 

1.90E-06 

1.80E-06 

1.77E-06 

1.69E-06 

1.30E-06 

1.29E-06 

1 22E-06 

1.16E-06 

1, 14E-06 

1.07E-06 

1.06E-06 

9.84E-07 

9.59E-07 

9.51E-07 

8.94E-07 

8.61 E-07 

8.50E-07 

8.46E-07 

7.78E-07 

7,70E-07 

7,37E-07 

7.19E-07 

5.96E-07 

5.95E-07 

5.93E-07

Base Results)

INITIATOR ACCIDENT SEQUENCE FAILURES 

T-CCW HUM CCW 

S2 J HUM 

T-CCW HUM CCW 

T-AC SDAFW HVAC! 

I -------- .. . .. S2HU 2.. . . I HUM 

I--.---ff--.. ~ u 

HUMHU 

T-CCW HUM 

T-CCW HUM CCW 

I -- C HUM HVAC1 

--------------- W 

ST-AC Esw 

.. T-AC HUM CCW 

T-CCW HUM CCW 

i . . --DC---- MDAFW SDAFW HUM 

-------. ----------_-AC _,_. AC EAC 

T-CCWHUM CCW 

I---------------

I---------c TCCW, HUMcw 

-tT-LOP - AC Esw 

--- AC EAC 

-- T- - - ESW 

-- ': s2 H::. UM MHUM

--------- AC 

T-CCW HUM CCW 

1 T-AC,:,_J HVAC1 T-CCW HUM CCW ] 

• T-LMFW I SW
Table 4-2b (Continued) 

Industry-Wide. 

. ,j

SEQ 

35 

36 

37 

38 

39 

40 

41 

42 

43 

44 

45 

46 

47 

48 

49 

50 

51 

52 

53 

54 

55 

56 

57 

58 

59 

60 

61 

62 

63 

64 

65 

66 

67 

68 

69

SSystem RBPI

DENT SEQUENCE FAILURES

MDAFW SDAFW

CDF INITIATOR ACCl 

5.56E-07 TACCW 

5.42E-07 I_ T-A Esw 

5.39E-07 ,_T-LOOP I AC EAC I----------------. 5.34E-07 I T-AC HUM CCW 

5.13E-07 T-LOOP 

5.1OE-07 AACC 

4.99E-07 T-LOOP SDAFW HVAC1 

4.85E-07 T-SGTR LPR HUM 

4.84E-07 T-TT RPS 

4.77E-07 TIFL HVAC1 

4.75E-07 T-CCW HUM COW 

4.75E-07 T-CCW HUM COW 

4.73E-07 T-CCW HUM CCW 

4.52E-07 T__, L _ CCW 

4.32E-07 S2 

4.27E-07 T-RX HVAC1 

4.25E-07 T-LOOP- AC EAC 

4.05E-07 A 

3.86E-07 I T-TT I CCW 

3.66E-07 S1 HUM 

3.64E-07 I------- T-L--P-. - L SDAFW HVAC1 

3.62E-07 T-COW HUM COW 

3.58E-07 T_-IFL, COW 

3.53E-07 I T-MSIV SDAFW HVAC1 

3.47E-07 I T-AC HUM 

3.44E-07 T-RX HUM HVAC1 

3.42E-07 T-RX HUM HVAC1 

3.41E-07 I- T-s-TR Z LPR HUM 

3.39E-07 T-CCW HUM CCW 

3.23E-07 T7-GTR- I LPR HUM 

3.21E-07 ,,, ,T-IFL SDAW HVAC1 

3.14E-07 I T-SGTR HUM 

3.13E-07 I T--- . . cc 

3.12E-07 [ T-LMFW I RPS pp 

3.11E-07 T-lr HUM HVAC1

HUM

HUM
Table 4-2b (Continued) 

IE RB-P 

Industry-Wide .-..... Trendin -

mRBPl

SEQ 

70 

71 

72 

73 

74 

75 

76 

77 

78 

79 

80 

81 

82 

83 

84 

"85 

86 

87 

88 

89 

90 

91 

92 

93 

94 

95 

96 

97 

98 

99 

100 

102 

101

CDF 

3.09E-07 

3.08E-07 

3,06E-07 

2.94E-07 

2.85E-07 

2.83E-07 

2.79E-07 

2.76E-07 

2.73E-07 

2.68E-07 

2.63E-07 

2.63E-07 

2.56E-07 

2.52E-07 

2.40E-07 

2,39E-07 

2.37E-07 

2.37E-07 

2.35E-07 

2.35E-07 

2.33E-07 

2.31E-07 

2.31 E-07 

2 31E-07 

2.31E-07 

2.28E-07 

2 27E-07 

2.25E-07 

2.24E-07 

2.24E-07 

2.23E-07 

6.08E-05 

3.06E-06

T-CCW 

S2 

T-CCW 

T-CCW 

-T-TT 

T-LOOP 

I ... ,S2L._,_ 

T-CCW 

REMAINDER 

T-IFIL-- I------- '----- I

ACCIDENT SEQUENCE FAILURES 

,I 

_/ _ I HUM 

V HUM

AC 

RPS 

HUM 

HUM 

HUM 

HUM 

HUM 

HUM 

HUM 

HUM

HUM 

HUM COW 

HUM
0) 

C 

*0 

C 

I

F'

C,, 

*0 

C

L. 

00 

ýTgo 

W--

00 

00 

C)' 

(0 

co

4-9
Indicators 7% 

1

Areas Not Covered 

43%

Industry-Wide Trending 

50%

Figure 4-lb RBPI Coverage of Dominant Full-Power Internal Event Core Damage Sequences by Initiating Events for 

WE 4-Lp Plant 22
Table 4-3 lists mitigating system elements in Tables 4-2a and b that are not covered by RBPIs, 

with an explanation. 

Table 4-3 Mitigating System Elements That Appear in Dominant Core Damage Sequences 

but Are Not Covered by RBPIs 

WE 4-Lp Plant 22 

Element Reason for No RBPI Post-Accident Human Action Not amenable to PI treatment (timely quantification 

directly from performance data not practical) Steam Generator Safety Valves Not amenable to PI treatment (timely quantification 

directly from performance data not practical) Non-Safety AC Power System Not amenable to PI treatment (timely quantification 

directly from performance data not practical) Heating/Ventilation/Air Conditioning Loss of HVAC with support systems available is not 

risk-significant at most plants Reactor Protection System Not amenable to PI treatment (timely quantification 

directly from performance data not practical) Safety Injection System Accumulators Not amenable to PI treatment (timely quantification 

directly from performance data not practical) 

BWR 3/4 Plant 18 

Element Reason for No RBPI Post-Accident Human Action Not amenable to PI treatment (timely quantification 

directly from performance data not practical) Reactor Protection System Not amenable to PI treatment (timely quantification 

directly from performance data not practical) Non-Safety AC Power System Not amenable to PI treatment (timely quantification 

directly from performance data not practical) Automatic Depressurization Risk-significant performance degradation of ADS 

valves is unlikely Safe Shutdown Makeup Pump Not generically important Low-Pressure Coolant Injection Most hardware shared with Suppression Pool Cooling, which is covered by an RBPI 

Main Feedwater This area is covered by an RBPI under the IE 

cornerstone but appears here as a system mitigating a 

reactor trip initiator. For that specific function the data 

would not accumulate quickly enough to support RBPI 

quantification. Non-Safety DC Not amenable to PI treatment (timely quantification 

directly from performance data not practical) Drywell Spray Most hardware shared with Suppression Pool Cooling, which is covered by an RBPI 

Venting Not amenable to PI treatment (timely quantification 

directly from performance data not practical)

4-11
5. VALIDATION AND VERIFICATION

The White Paper discusses two steps of validation and verification (V&V): step 1 activities 

undertaken as part of the development and testing of RBPIs, and step 2 activities that are an 

ongoing and integral part of the reactor oversight inspection process. The step 1 V&V presented 

in this report covers the following: 

"• Process for RBPI identification 

"* RBPI characteristics 

"* Testing of RBPIs 

5.1 Development of a Systematic Process for RBPI Identification 

Sections 2 and 3 of this report describe the process and results for identifying RBPIs. The 

process for identifying RBPIs is both risk-based and systematic, as indicated by the flowchart in 

Section 2 of this report. Potential RBPIs are identified and then compared with various selection 

criteria to determine whether the RBPIs can be developed. Results for full-power internal events 

from this systematic process are presented in Appendix A for the 30 sites (44 plants) used in the 

V&V testing activity. 

5.2 Assurance That RBPIs Satisfy Specific Characteristics 

Section 1.2 of this report lists six characteristics that RBPIs should have. Each of those 

characteristics is discussed below: 

"* RBPIs should be compatible with, and complementary to, the risk-informed inspection 

activities of the Reactor Oversight Process (ROP). 

The RBPI identification process (flowchart in Section 2 of this report) ensures that RBPIs 

are both compatible with and complementary to inspection activities. Potential RBPIs are 

identified using a process similar to that used for the ROP. RBPIs are compared to 

existing ROP indicators and the potentially affected inspection areas are identified. 

"* RBPIs should cover all modes of plant operation. 

The RBPIs developed in this report cover both full-power and shutdown modes of plant 

operation. 

"* RBPIs should cover risk-important SSCs to the extent practical. 

Risk coverage is discussed in Section 4 of this report. The RBPI development process 

ensures that as much of the risk as feasible is covered by the RBPIs.

5-1
"* RBPIs should be capable of implementation without excessive burdens on licensees or 

NRC in the areas of data collection and quantification. 

Most of the RBPIs identified in this report can be quantified using existing databases as 

indicated in Section 5.3. This report identifies potential RBPIs that would require 

additional data collection effort, for example, the time spent in risk-significant 

configurations during shutdown operations and the unreliability and unavailability of 

containment barrier systems and fire suppression systems. Quantification of RBPI values 

for the 44 plants covered in the V&V testing activity and comparison with plant-specific 

thresholds to determine plant performance (Section 5.3 of this report) requires NRC 

resources, but this process is expected to be automated to the extent possible as the RBPI 

development effort continues. 

"* To the extent practical, RBPIs should identify declining performance before performance 

becomes unacceptable, without incorrectly identifying normal variations as degradations 

(i.e., avoid false-positive indications and false-negative indications). 

The suggested misclassification probability criteria are discussed in Appendix F. In 

general, the RBPIs selected have acceptable false-negative probabilities (less than 5% 

chance of obtaining a green RBPI indication when performance is actually in the red 

performance band). Most of the RBPIs also have acceptable false-positive probabilities 

(less than 20% chance of obtaining a white RBPI indication when performance is actually 

at the RBPI's baseline level). However, many of the unreliability RBPIs have a 

significant chance of obtaining a white RBPI indication when performance is actually at 

the RBPI's baseline level. Therefore, for all unreliability RBPIs, when white band 

performance is indicated, the probability of performance actually being at the RBPI's 

baseline value will also be presented. More details can be found in Appendices E and F. 

"* The RBPIs should be amenable to establishment of plant-specific thresholds consistent with 

the ROP. 

For the RBPIs presented in this report, plant-specific thresholds were developed using the 

SPAR Revision 3i core damage frequency models. Results are described in Appendix A 

of this report. 

5.3 Testing of the RBPIs for Practicality of Calculation and Credibility of 

Results 

The RBPIs for internal events while plants are at power were tested by evaluating plant-specific 

data from 44 plants over the period 1997-1999. Baseline SPAR models including industry

average values reflecting 1996 performance were used. The data collection effort to test the 

RBPIs at 44 plants was accomplished using INPO's EPIX database for unreliability (with RADS 

as the search and quantification software package), ROP data for unavailability, and 

NUREG/CR-5750 for initiating events. The overall data collection process was straightforward, 

although there are areas where data are not presently available (indicated in the tables).

5-2
Definitions, data, and calculational procedures are provided in Appendix H. The constrained, noninformative prior and the recommended data collection intervals were used (1 year for the 

general transient (GT) initiating event and mitigating system unavailabilities, and 3 years for the 

loss of heat sink (LOHS) and loss of feedwater (LOFW) initiators, mitigating system unreliabilities, and component class unreliabilities). This prior and the data collection intervals 

were identified from the statistical analyses (Appendix F) as most appropriate for the RBPIs 

being tested. Results are presented in Tables 5.3-1 through 5.3-4 for the initiating event, 

mitigating system unavailability, mitigating system unreliability, and component class RBPIs. 

For the RBPIs with available data from 1997-1999, approximately 94% of the RBPIs indicate 

green plant performance, with the other 6% indicating white or yellow performance. 

Table 5.3-1 Plant Performance Bands for Initiating Event RBPIs (1999)a, 

1999 

Plant GT b LOHS7 LOFW cd 

BWRs 

BWR 123 Plant 1 3.2E-1/y (G) 9.OE-2/y (G) 5.2E-2/y (G) 

BWR 123 Plant 2 9.6E-l/y (G) 4.7E-1/y (W) 5.3E-2/y (G) BWR 3/4 Plant 1 2.2E+O/y (G) 2.6E-l/y (G) 5.1E-2/y (G) BWR 3/4 Plant 2 3.OE-1/y (G) 8.7E-2/y (G) 5.2E-2/y (G) 

BWR 3/4 Plant 3 1.5E+O/y (G) 8.7E-2/y (G) 5.1E-2/y (G) BWR 3/4 Plant 4 2.3E+O/y (W) 8.9E-2/y (G) 5.2E-2/y (G) 

BWR 3/4 Plant 5 3.OE-1/y (G) 9.2E-2/y (G) 5.3E-2/y (G) 

BWR 3/4 Plant 6 3.4E-1/y (G) 9.1E-2/y (G) 5.2E-2/y (G) BWR 3/4 Plant 8 1.6E+O/y (G) 9.OE-2/y (G) 5.2E-2/y (G) 

BWR 3/4 Plant 11 3.3E-1/y (G) 9.2E-2/y (G) 5.2E-2/y (G) BWR 3/4 Plant 12 9.1gE-/y (G) 2.6E-1/y (W) 5.2E-2/y (W) BWR 3/4 Plant 13 9.7E-1/y (G) 8.8E-2/y (G) 5.1E-2/y (W) BWR 3/4 Plant 15 9.1E-l/y (G) 8.6E-2/y (G) 5.1E-2/y (G) BWR 3/4 Plant 16 3.2E-1/y (G) 8.8E-2/y (G) 5.2E-2/y (G) BWR 3/4 Plant 18 9.4E-1/y (G) 9.8E-2/y (G) 5.5E-2/y (G) BWR 3/4 Plant 19 3.OE-1/y (G) 1.1E-1/y (G) 5.8E-2/y (G) BWR 5/6 Plant 2 3.5E-1/y (G) 2.7E-1/y (G) 5.1E-2/y (G) 

BWR 5/6 Plant 8 3.9E-1/y (G) l.OE-1/y (G) 5.4E-2/y (W) 

PWRs 

B&W Plant 3 2.9E-1/y (G) 5.8E-2/y (G) 5.2E-2/y (G) B&W Plant 4 1.6E+O/y (W) 6.3E-2/y (G) 5.5E-2/y (G) B&W Plant 5 2.8E+O/y (Y) 1.8E-1/y (W) 5.3E-2/y (G) B&W Plant 6 2.8E-1/y (G) 6.OE-2/y (G) 5.4E-2/y (G) B&W Plant 7 3.OE-1/y (G) 5.8E-2/y (G) 5.2E-2/y (G)

5-3
Table 5.3-1 Continued) Plant GT LOHS LOFW 

PWRs 

CE Plant 1 3.2E-1/y (G) 5.9E-2/y (G) 5.2E-2/y (G) 

CE Plant 2 8.8E-1/y (G) 2.9E-1/y (W) 5.2E-2/y (G) 

CE Plant 3 3.2E-1/y (G) 5.9E-2/y (G) 5.2E-2/y (G) 

CE Plant 4 3.OE- 1/y (G) 5.9E-2/y (G) 5.2E-2/y (G) 

CE Plant 5 1.2E+0/y (G) 8.4E-2/y (G) No data (G) 

CE Plant 10 3.1E-1/y (G) 6.OE-2/y (G) 5.3E-2/y (G) 

CE Plant 11 9.2E-1/y (G) 1.8E-1/y (W) 5.3E-2/y (G) 

CE Plant 12 2.1E+0/y (W) 9.OE-2/y (G) 1.6E-1/y (G) 

WE 2-Lp Plant 5 3.1E-1/y (G) 1.8E-1/y (W) 5.3E-2/y (G) 

WE 2-Lp Plant 6 2.8E-1/y (G) 5.9E-2/y (G) 5.4E-2/y (G) 

WE 3-L Plant 5 2.OE+0/y (W) 5.8E-2/y (G) 5.3E-2/y (G) 

WE 3-Lp Plant 10 2.8E-1/y (G) 5.9E-2/y (G) 5.3E-2/y (G) 

WE 3-Lp Plant 11 9.3 E-1 /y (G) 5.7E-2/y (G) 5.1E-2/y (G) 

WE 4-Lp Plant I 2.8E-1/y (G) 5.9E-2/y (G) 5.3E-2/y (G) 

WE 4-Lp Plant 2 2.1E+0/y (W) 5.8E-2/y (G) 5.2E-2/y (G) 

WE 4-Lp Plant 22 2.8E-1/y (G) 5.8E-2/y (G) 1.6E-1/y (G) 

WE 4-Lp Plant 23 2.9E-1/y (G) 5.7E-21y (G) l.5E-1/y (G) 

WE4-L Plant 28 3.1E-/ G 5.SE-2I /G 1.6E-1/y (G) 

a. Plant performance bands are the following: green (G) - ACDF < 1.OE-6/y, white (W) - 1.OE-6/y < 

ACDF <1 .OE-5/y, yellow (Y) - 1.OE-5/y < ACDF <1 .OE-4/y, red (R) - ACDF > I.OE-4/y. 

b. A 1-year data collection interval applies (1999). The 1999 data were obtained from the ROP. 

c. A 3-year data collection interval applies (1997-1999). The 1997 and 1998 data were obtained from 

the initiating events study update, while the 1999 data were obtained from the ROP. 

d. This RBPI is not covered under the ROP, so the results presented in this table include only 1997 and 

1998. (1999 licensee event reports will need to be reviewed to identify scrams that are LOFW, as 

defined in the initiating events study.) 

e. Since the models and data in these tables have not completed formal peer review, plant-specific 

inferences regarding green or nongreen performance from these calculations would be inappropriate.

5-4
Table 5.3-2 Plant Performance Bands for Mitigating Sy stem Unavailability RBPIs (1999)b 

Plant EPS HPI/ AFW/ RHR SwS a CCw a PORV a 

HPCI/ RCIC 

HPCS 

BWRs 

BWR 123 Plant 1 1.7E-2 (G) 1.4E-2 (G) NA 6.2E-2 (G) No data NA NA 

BWR 123 Plant 2 1.5E-2 (G) 1.7E-2 (G) NA 9.5E-3 (G) No data NA NA 

BWR 3/4 Plant 1 6.1E-2 (G) 1.4E-2 (G) 1.9E-2 (G) 7.4E-2 (G) No data NA NA 

BWR 3/4 Plant 2 6.1E-2 (G) 8,4E-3 (G) 3.7E-3 (G) 3.3E-2 (G) No data NA NA 

BWR 3/4 Plant 3 1.5E-2 (G) 4.1E-3 (G) 3.5E-3 (W) 1.6E-2 (G) No data NA NA 

BWR 3/4 Plant 4 1.5E-2 (G) 6.8E-3 (G) 2.1E-2 (G) 2.4E-2 (G) No data NA NA 

BWR 3/4 Plant 5 2.9E-3 (G) 2.E-3 (G) 5.5E-3 (G) 0.OE+0 (G) No data NA NA 

BWR 3/4 Plant 6 1.3E-2 (G) 2.1E-3 (G) 1.OE-2 (G) 8.4E-3 (G) No data NA NA 

BWR 3/4 Plant 8 1.9E-2 (G) 2.8E-2 (G) 5.OE-2 (G) 7.8E-3 (G) No data NA NA 

BWR 3/4 Plant 11 7.4E-3 (G) 1.8E-2 (G) 1.8E-2 (W) 1.2E-2 (G) No data NA NA 

BWR 3/4 Plant 12 7.9E-2 (W) 8.2E-2 (G) 1.8E-2 (G) I.OE-2 (G) No data NA NA 

BWR 3/4 Plant 13 7.1E-2 (W) 1.4E-2 (G) 1.5E-2 (G) 6.5E-3 (G) No data NA NA 

BWR 3/4 Plant 15 1.5E-2 (G) 1.6E-2 (G) 8.6E-3 (G) 9.1E-3 (G) No data NA NA 

BWR 3/4 Plant 16 2.2E-2 (G) 2.1E-2 (G) 7.9E-3 (G) 1.3E-2 (G) No data NA NA 

BWR 3/4 Plant 18 2.1E-2 (W) 4.5E-1 (W) 1.7E-2 (G) 5.4E-3 (G) No data NA NA 

BWR 3/4 Plant 19 1.8E-2 (W) 1.7E-2 (G) 1.8E-2 (G) 7.5E-3 (G) No data NA NA 

BWR 5/6 P'lant 2 3.6E-2 (W) 4.6E-3 (G) 1.5E-2 (G) 4.4E-3 (G) No data NA NA 

BWR 5/6 Plant 8 5.7E-3 (G) 1.7E-2 (G) 1.7E-2 (G) 1.4E-2 (G) No data NA NA 

PWRs 

B&W Plant 3 2.313-2 (G) 3.8E-3 (G) MDP (No data) 9.11E-3 (G) No data No data No data 

TDP (7.8E-3) (G) 

B&W Plant 4 2.3E-2 (G) 5.3E-3 (G) MDP (4.OE-3) (G) 1.8E-2 (G) No data No data NA 

TDP (0.OE+0) (G) 

B&W Plant 5 2.4E-2 (G) 3.0E-3(G) MDP (3,3E-3) (G) 1.4E-2 (G) No data No data NA 

TDP (3.1E-3) (G) 

B&W Plant 6 2.2E-2 (G) 2.5E-3 (G) MDP (6.8E-3) (G) 1.1E-2 (G) No data No data NA 

TDP (8.9E-4) (G) 

B&W Plant 7 2.8E-2 (G) .1E-2 (G) MDP (6.6E-3) (G) 7.2E-2 (W) No data No data No data 

TDP (1.5E-3) (G) 

CE Plant 1 4.0E-3 (G) 1,8E-5 (G) MDP (4.7E-3) (G) 9.5E-3 (G) No data No data No data 

I TDP (6.7E-4) (G) 

CE Plant 2 6.6E-3 (G) 7.2E-3 (G) MDP (0.OE+0) (G) I.OE-2 (G) No data No data No data 

I _TDP (2.9E-3) (G)
Table 5.3-2 (Continued) 

Plant EPS HPI/ AFW/ RHR SWSa ccwa PORv a 

HPCI/ RCIC 

HPCS 

PWRs 

CE Plant 3 7.5E-3 (G) 1.1E-2 (G) MDP (2.4E-3) (G) 1.4E-2 (G) No data No data No data 

TDP (4.5E-3) (G) 

CE Plant 4 9.5E-3 (G) 1.3E-3 (G) MDP (9.8E-4) (G) 2.1E-3 (G) No data No data No data 

TDP (6.2E-3) (G) 

CE Plant 5 1. 1 E-2 (G) 8.3E-3 (G) MDP (4.9E-3) (W) 4.1E-3 (G) No data No data No data 

TDP (6.4E-3) (G) 

CE Plant 10 3.7E-2 (G) 3.6E-3 (G) MDP (2.2E-2) (W) 1.9E-2 (G) No data No data No data 

TDP (8.2E-3 (G) 

CE Plant 11 2. 1 E-2 (G) 1.3E-2 (G) MDP (2.2E-2) (W) 4.OE-3 (G) No data No data No data 

TDP (1.OE-2) (G) 

CE Plant 12 5.1E-3 (G) 7.3E-3 (G) MDP (5.3E-3) (W) 7.1E-3 (G) NA No data No data 

TDP (4.6E-3) (G) 

WE 2-Lp Plant 5 1.3E-2 (G) 1.4E-3 (G) MDP (4.4E-3) (G) 1.6E-2 (G) No data No data No data 

TDP (6.7E-3) (G) 

WE 2-Lp Plant 6 1LOE-2 (G) 1.2E-3 (G) MDP (4.2E-3) (G) 2.6E-3 (G) No data No data No data 

TDP (2.5E-3) (G) 

WE 3-Lp Plant 5 1.5E-2 (G) 1.6E-2 (G) MDP (3.2E-3) (G) 5.9E-3 (G) No data No data No data 

TDP (1.3E-3) (G) 

WE 3-Lp Plant 10 5.2E-2 (G) 1.6E-3 (G) MDP (4.9E-3) (G) 0.OE+0 (G) No data No data No data 

TDP (1.9E-3) (G) 

WE 3-Lp Plant 11 4.5E-2 (G) 7.8E-4 (G) MDP (5.5E-3) (G) 2.1E-3 (G) No data No data No data 

TDP (5.3E-3) (G) 

WE 4-lp Plant 1 3.5E-3 (G) SI 1.1E-3 (G) MDP (3.4E-3) (G) 9.1E-5 (G) No data No data No data 

CVC 5.E-3 (G) TDP (4.3E-2) (Y) 

WE 4-Lp Plant 2 3.3E-3 (G) SI 8.5E-3 (G) MDP (2.4E-3) (G) 8.OE-3 (G) No data No data No data 

CVC 2.1E-2 (G) TDP (1.1E-2) (G) 

WE 4-Lp Plant 10 No data No data MDP (No data) No data NA No data No data 

TDP (No data) 

WE 4-Lp Plant II No data No data MDP (No data) No data No data No data No data 

TDP (No data) 

WE 4-Lp Plant 22 9.6E-3 (G) SI 7.7E-3 (G) MDP (3.8E-3) (W) 4.4E-3 (G) No data No data No data 

CVC 4.5E-2 (G) TDP (1.2E-2) (G) 

WE 4-Lp Plant 23 1.2E-2 (G) SI 4.9E-3 (G) MDP (6.6E-3) (W) 8.2E-3 (G) No data No data No data 

I__ _CVC _ 5.1E-3 (G) TDP (1.7E-2) (G) 

_

b,
a. Unavailability data are not available (not covered by tile ROP) at this time. Eventually, EPIX may contain such data. 

b. Since the models and data in these tables have not completed formal peer review, plant-specific inferences regarding green or nongreen 

performance from these calculations would be inappropriate. 

c. "NA" in a system cell for a given plant indicates that the system does not exist at that plant.
- -. - rQfDm ITniIIhI1Ih flRPI(1007 - 1999c

I ale 5.3-3 Plant Perlormance D sIfull IOI ga ,, %,All .. 

Plant EPS HPI/ AFW/ RHRa SWS CCW PORV 

HPCI/ RCIC 

HPCS 

BWRs 

BWR Plant 123 Plant I < baseline (G)' < baseline (G) < baseline (G) < baseline (G) No datac NA NA 

BWR Plant 123 Plant 2 < baseline (G) < baseline (G) < baseline (G) < baseline (G) No data NA NA 

BWR 3/4 Plant I < baseline (G) < baseline (G) < baseline (G) < baseline (G) No data NA NA 

BWR 3/4 Plant 2 < baseline (G) < baseline (G) < baseline (G) < baseline (G) No data NA NA 

BWR 3/4 Plant 3 < baseline (G) < baseline (G) < baseline (G) < baseline (G) No data NA NA 

BWR 3/4 Plant 4 < baseline (G) < baseline (G) < baseline (G) < baseline (G) No data NA NA 

BWR 3/4 Plant 5 < baseline (G) < baseline (G) < baseline (G) < baseline (G) No data NA NA 

BWR 3/4 Plant 6 < baseline (G) < baseline (G) < baseline (G) < baseline (G) No data NA NA 

BWR 3/4 Plant 8 < baseline (G) < baseline (G) < baseline (G) < baseline (G) No data NA NA 

BWR 3/4 Plant 11 < baseline (G) < baseline (G) < baseline (G) < baseline (G) No data NA NA 

BWR 3/4 Plant 12 < baseline (G) < baseline (G) < baseline (G) < baseline (G) No data NA NA 

BWR 3/4 Plant 13 < baseline (G) < baseline (G) < baseline (G) < baseline (G) No data NA NA 

BWR 3/4 Plant 15 < baseline (G) < baseline (G) < baseline (G) < baseline (G) No data NA NA 

BWR 3/4 Plant 16 < baseline (G) < baseline (G) < baseline (G) < baseline (G) No data NA NA 

BWR 3/4 Plant 18 < baseline (G) < baseline (G) < baseline (G) < baseline (G) No data NA NA 

BWR 3/4 Plant 19 < baseline (G) < baseline (G) 1.1 E- I (W) < baseline (G) No data NA NA 

(0.07)' 

BWR 5/6 Plant 2 < baseline (G) < baseline (G) < baseline (G) < baseline (G) < baseline (G) NA NA 

BWR 5/6 Plant 5 < baseline (G) < baseline (G) < baseline (G) < baseline (G) No data NA NA 

BWR 5/6 Plant 8 < baseline (G) < baseline (G) 1.2E-I(W) < baseline (G) No data NA NA 

(0.05)d 

_ 

MWRs 

B&W Plant 3 < baseline(G) < baseline (G) < baseline (G) < baseline (G) < baseline (G) NA No data 

B&W Plant 4 <baseline(G) <baseline (G) <baseline (G) <baseline (G) <baseline (G) <baseline (G) NA 

B&W Plant 5 < baseline (G) < baseline (G) < baseline (G) < baseline (G) < baseline (G) < baseline (G) NA 

B&W Plant 6 < baseline (G) < baseline (G) < baseline (G) < baseline (G) < baseline (G) < baseline (G) NA 

B&W Plant 7 <baseline (G) <baseline (G) <baseline (G) <baseline (G) <baseline (G) <baseline (G) No data 

CE Plant 1 < baseline (G) < baseline (G) < baseline (G) < baseline (G) < baseline (G) < baseline (C) No data 

CE Plant 2 < baseline (G) < baseline (G) < baseline (G) < baseline (G) No data No data No data 

CE Plant 3 < baseline (G) < baseline (G) < baseline (G) < baseline (G) No data No data No data 

CE Plant 4 < baseline (G) < baseline (G) < baseline (G) < baseline (G) < baseline (G) No data < baseline (G) 

CE Plant 5 < baseline (G) < baseline (G) < baseline (G) No data No data < baseline (G) No data 

CE Plant 10 < baseline (G) < baseline (G) < baseline (G) < baseline (G) < baseline (G) < baseline (G) No data 

CE Plant I I < baseline (G) < baseline (G) < baseline (G) < baseline (G) < baseline (C) < baseline (G) No data

,-il 00

- 1999V
Table 5.3-3 (Continued) Plant EPS HPI/ AFW/ RHRa SWS CCW PORV 

HPCI/ RCIC 

PWRsHPCS 

CE 

WE 

Plant 

2-Lp 

12 

Plant 

< baseline (G) < baseline (G) < baseline (G) < baseline (G) No data < baseline (G) No data 

WE 

5 < baseline (G) < baseline (G) < baseline (G) < baseline (G) No data < baseline (G) <baseline (G) 

WE 

2-Lp 

3-Lp 

Plant 

Plant 

6 < baseline (G) No data < baseline (G) < baseline (G) < baseline (G) No data < baseline (G) 

WE 

5 < baseline (G) < baseline (G) < baseline (G) < baseline (G) < baseline (G) < baseline (G) < baseline (G) 

WE 

3-Lp Plant 6 < baseline (G) < baseline (G) < baseline (G) < baseline (G) < baseline (G) < baseline (G) < baseline (G) 

WE 

3-Lp 

4

Plant 10 < baseline (G) < baseline (G) < baseline (G) < baseline (G) < baseline (G) < baseline (G) < baseline (G) 

WE 

-Lp Plant I < baseline (G) No data < baseline (G) < baseline (G) No data No data No data 

WE 

4-Lp 

4-Lp 

Plant 2 < baseline (G) No data < baseline (G) < baseline (G) No data No data No data 

WE 

Plant 10 < baseline (G) < baseline (G) < baseline (G) < baseline (G) < baseline (G) < baseline (G) < baseline (G) 

WE 

4-Lp Plant 11 < baseline (G) < baseline (G) < baseline (G) < baseline (G) < baseline (G) < baseline (G) < baseline (G) 

WE 

4-Lp Plant 22 < baseline (G) < baseline (G) < baseline (G) < baseline (G) < baseline (G) < baseline (G) < baseline (G) 4-Lp Plant 23 < baseline (G) < baseline (G) 1.6E-2 (MDP) (W) < baseline (G) < baseline (G) < baseline (G) < baseline (G) 

(0.13)d WE 4-Lp Plant 28 < baseline (G) < baseline I I I (G) <baseline (G) < baseline (G) < baseline (G) < baseline (G) < baseline (G) a. Reflects pump data. Valve data still need to be collected and evaluated. b. "< baseline" indicates that there were not enough failures to result in a train unreliability greater than the baseline. c. "No data" indicates that either EPIX has no data on this system or the RADS data load of the EPIX file did not include this system. d. Unreliability RBPIs have the potential for false-positive indications. Therefore, for white indications, the probability of observing this performance if the plant is actually at its baseline (G) is also presented. For example, a 0.25 probability indicates that there is a 25% chance of experiencing the observed performance, even with the plant at baseline. 

e. Since the models and data in these tables have not completed formal peer review, plant-specific inferences regarding green or nongreen performance friom these calculations would be inappropriate. f. "NA" in a system cell for a given plant indicates that the system does not exist at that plant.
Table 5.3-4 Plant Performance Bands for Component Class RBPIs 1997 - 1999)e 

Plant AOV MOV MDP 

BWRs 

BWR 123 Plant I No dataa <baseline (G)b 9.6E-3 (2.6X) 

BWR 123 Plant 2 < baseline (G) < baseline (G) 9.7E-3 (2.6X) 

BWR 3/4 Plant I No data <baseline (G) < baseline (G) 

BWR 3/4 Plant 2 No data < baseline (G) < baseline (G) 

BW R 3/4 Plant 1 N o data 

< baseline (G) 

<baE ln (G) 

BWR 3/4 Plant 1 No data < baseline (G) .bE-3l (G1.X) 

BWR 3/4 Plant 2 No data < baseline (G) <baseline (G) 

BW /4Pan <bseie G <bseie(G) < baseline (G) 

BWR 3/4 Plant 5 No data < baseline (G) <baseline (G) 

BWR 5/4 Plant 6 No sedata )< baseline (G) < baseline (G) 

BW~R 3/4 Plant 82 No data < baseline (G) _< baseline (G) 

BWR 3 /4 Plant I13 No data < baseline__(G) < baseline (G) 

BWR 3/4 Plant 12 No data 3.E- bs e _(1.2) < baseline (G) 

BWR 3/4 Plant 13 No data < baseline (Gj) < baseline (G) 

BWR 3/4 Plant 13 No data<base < baseline (G) <.aein (G) 

BWR 3/4 Plant 14 No data < baseline (G) < baseline (G) 

BWR 5/6 Plant 2 No data < baseline (G) < baseline (G) 

BWR 5/6 Plant 5 No data < baseline (G) < baseline (G) 

BWR 5/6 Plant 8 No data 7.4E-3 (2.5X) (Y)' 6.5E-3 (1 .8X) 

(0.00131) 

PWRs 

B&W Plant 7 < baseline (G) < baseline (G) 8.5E-3_ (2.3X) 

B&W Plant 4 < baseline (G) < baseline (G) < baseline (G) 

B&W Plant 5 <baseline (G) < base3ine (G) < baseline (G) 

B&W Plant 6 < baseline (G) 4.8E-3 (1.6X) < baseline (G) 

B&W Plant 7 3< bas8X) (G)b <baseline (G) 4.5E-3 (1.2X) 

CE Plant I < baseline (G) < baseline (G) < baseline (G) 

CE Plant 2 < baseline (G) 5.2E-3 ( G.7X) < baseline (G) 

CE Plant 3 < baseline (G) < baseline (G) < baseline (G) 

CE Plant 4 32.8E-3 (3.8X) (G) < baseline (G) < baseline(G) 

CE Plant 5 No data < baseline (G) < baseline (G) 

CE Plant 10 < baseline (G) < baseline (G) < baseline (G) 

CE Plant t 6 < baseline (G) < baseline (G) < baseline (G) 

CE Plant 1 52 2.9E-3 (2.9X) (G) 4.5E-3 (1.5X) (W)ý < baseline (G) 

(0.(14)d 

WE 2-Lp Plant 5 < baseline (G) < baseline (G) < baseline (G) 

WE 2-Lp Plant 6 < baseline (G) < baseline (G) < baseline (G) 

WE 4-Lp Plant 5 2IE-3 (1.1X) (G) < baseline (G) < baseline (G) 

WE 3-Lp Plant 10 4.9E-3) (4.9X) (W) < baseline (G) < baseline (G) 

(0.0001) 

WE 3-L Plant 1 < baseline (G) < baseline (G) < baseline (G) 

WE 4-Lp Plant I No data No data < baseline (G) 

WE 4-Lp Plant 2 No data No data < baseline (G) 

WE 4-L Plant 10 < baseline (G) < baseline ) < baseline (G) 

"WE' _Lp Plant I I < baseline (G) < baseline (G) < baseline (G) 

5-10
Table 5.3-4 (Continued) 

Plant AOV MOV MDP 

PWRs 

WE 4-Lp Plant 22 < baseline (G) < baseline (G) < baseline (G) WE 4-Lp Plant 23 < baseline (G) < baseline (G) < baseline (G) WE 4-Lp Plant 28 < baseline (G) < baseline (G) < baseline (G) 

a. "No data" indicates that either EPIX has no data on this component class or the RADS data load of 

the EPIX file did not include this component class. 

b. "< baseline" indicates that there were not enough failures to result in a train unreliability greater than 

the baseline. 

c. The number in parentheses "3.8X" indicates that the unreliability is 3.8 times the baseline. 

d. The component class RBPIs have the potential for false-positive indications. Therefore, for white 

indications, the probability of observing this performance if the plant is actually at its baseline (G) 

value is also presented. 

e. Since the models and data in these tables have not completed formal peer review, plant-specific inferences regarding green or nongreen performance from these calculations would be inappropriate. 

The results in Tables 5.3-1 through 5.3-4 are intended to show that RBPIs can be calculated 

using readily available data and models to produce potential indicators that reflect plant performance in a manner consistent with the current ROP philosophy. These tables clearly show 

that performance data can be used to calculate indicators that fit in the ROP concept. They demonstrate the feasibility of the process, but not necessarily the accuracy of the results. In order 

for these potential indicators to be used in the ROP, implementation issues relating to model 

fidelity and data quality need to be resolved so that there is sufficient alignment among 

stakeholders regarding the accuracy of both the thresholds and the calculated performance 

indicators. 

The risk models and associated baseline performance values should be peer-reviewed by 

stakeholders to ascertain that they reasonably reflect the risk profile for the plants modeled. This 

is required to assure that thresholds derived from the models reasonably represent the risk 

significance of potential performance degradations. Similarly, the data inputs to the indicator 

calculations need to have sufficient accuracy to reasonably represent the risk significance of 

potential performance degradations. The accuracy should be consistent with the nominal 

uncertainties associated with unreliability and risk measurements so that errors in data collection 

do not result in mischaracterizing risk performance as measured by the ROP (i.e., characterizing 

green when actually nongreen or vice versa). 

Since the models and data in these tables have not been formally peer reviewed, plant- specific 

inferences regarding green or nongreen performance from these calculations would be 

inappropriate. The data are presented to demonstrate that the process can be followed to 

produce potential indicators. The accuracy of the RBPI results sufficient for use in NRC 

decisionmaking remains to be determined through the ROP change process. 

Tables 5.3-1 through 5.3-4 show how performance data can be used along with thresholds 

derived from risk models to produce indicators that are consistent with the ROP framework. 

Potential benefits derived from this exercise that relate to the practicality of calculation and 

credibility of results include:

5-11
"* more precise accounting for the risk-significant design features of plants 

"* more plant-specific thresholds 

"* more appropriate accounting for the risk impact of fault exposure time in indicator 

formulation. 

By evaluating indicators at a train level and accounting for diverse design features separately, the 

RBPIs can more precisely account for the risk significance of design features. For example, 

AFW systems in PWRs have turbine-driven, diesel-driven, and/or motor-driven pump trains. 

Turbine-driven or diesel-driven trains have risk significance in station blackout (SBO) sequences 

that motor-driven trains do not. By accounting for these effects separately, rather than combining 

them in a single indicator, RBPIs can more precisely account for risk-significant design features. 

The use of plant-specific models to set thresholds allows the indicators for a plant to more 

closely reflect the risk significance of potential performance degradations. As noted earlier, the 

models used in the RBPI development need to be reviewed by licensees and other external 

stakeholders to determine if they represent a reasonable characterization of the plant risk profile. 

Fault exposure time data collection and analysis is one method of estimating the probability of 

standby components, trains, or systems failing to perform their risk-significant safety function 

when needed. Assessing the probability through analysis of failure and demand counts is another 

method. Both methods produce the same result over a long period of time. However, counting 

fault exposure time over the shorter periods of time typical of the ROP sampling intervals can be 

problematic due to the increased likelihood of false positive and false negative indication. As 

noted in Appendix F, the RBPIs process fault exposure data and failure and demand count data in 

a manner that provides the most timely indication of potential performance degradation without 

undue occurrence of false positive or false negative indications. In addition, the RBPIs account 

for fault exposure time impacts on the risk-significant safety functions which can be different 

from the design basis functions of components, trains, or systems. For example, many systems 

have automatic initiation capabilities as design basis features (without credit for manual 

operation). However, to achieve the risk-significant safety function, either automatic or manual 

actuation is satisfactory. The RBPIs account for this case in the treatment of fault exposure time 

so that risk significance of events resulting in fault exposure time accumulation are more 

appropriately accounted for. 

Testing of the RBPIs also included the monitoring of industry-wide performance. Industry-wide 

trending data are presented in Tables 5.3-5 through 5.3-8. The industry-wide averages were 

determined using only the 44 plants covered in this study, 25 PWRs and 19 BWRs. Statistical 

trending analyses have not been performed yet because only approximately two-fifths of the 

entire industry is represented at present, and 3 years of data are generally not sufficient to discern 

statistically significant trends, unless performance is changing rapidly. However, almost all of 

the yearly industry-wide averages lie below the 9 5th percentile of the distributions of the 1996 

industry-average baselines. (The only exception is the AFW motor-driven pump train UA, where 

the yearly averages range from two to five times the baseline value. In this case the baseline 

value might need to be modified.) Similar to the testing of the RBPIs on a plant-specific basis, 

the industry-wide trending was accomplished using existing databases and software. In general, 

the trending data presented in Table 5.3-5 through 5.3-8 indicate that the values chosen to

5-12
represent 1996 industry-average performance are reasonable, and that industry performance 

during 1997-1999 was comparable to or better than the 1996 baseline. 

INPO's EPIX database, used to support evaluation of mitigating system and component class 

unreliabilities, is relatively new. A review of the data collection effort indicates that 

approximately 40% of the plants considered were missing some data for the four main types of 

systems considered-EPS, HPI/HPCLHPCS, AFW/RCIC, and RHR. In addition, approximately 

50% of the plants did not have data for the other systems considered-SWS, CCW, and PORV. 

Therefore, the EPIX database needs to be improved in this area before all of the proposed RBP~s 

could be implemented. 

Unavailability data for the four main types of systems were obtained from the ROP. However, 

the ROP does not include other systems such as SWS, CCW, and PORV. The industry is 

considering the inclusion of unavailability data for these systems in the EPIX database. The 

addition of unavailability data to EPIX would help to support the RBPI program, especially for 

systems not covered by the ROP. 

Table 5.3-5 Industry Trends for Initiating Event RBPIs (1997 through 1999)

Initiating Event 1996 Baseline 1997 1998 1999 

General transient (GT) 9.6E-1/y (PWRs) 6.7E-1/y 7.4E-1/y 8.5E-1/y 

1.2/y (BWRs) 4.9E-1/y 6.5E-1/y 8.3E-I/y 

Loss of Heat Sink (LOHS) 9.6E-2/y (PWRs) 5.1E-2/y 5.OE-2/y l.1E-l/y 2.3E-1/y (BWRs) 6.5E-2/y 1.1E-1/y 1.1E-1/y 

Loss of Feedwater (LOFW) 6.8E-2/y 4.9E-2/y 1.1E-1/y NA b 

a. The "industry-wide" results are the average of the 44 plants considered in this data review. The 

PWR results are for 25 plants. The BWR results are for 19 plants. 

b. Data not available (without a review of the LERs for 1999). 

Table 5.3-6 Industry Trends for Miti ,ating System Unavailability RBPIs (1997 through 1999) 

Industry-Wide Unavailability 

Mitigating System and Level 1996 Baseline 1997 1998 1999 

EPS (train) 9.7E-3 1.2E-2 1. 1E-2 1.1E-2 

PWRs 

HPI (train) 4.2E-3 4.9E-3 4.3E-3 5.3E-3 

AFW (MDP train) 1.1E-3 5.5E-3 2.8E-3 4.1E-3 

AFW (TDP train) 4.6E-3 4.9E-3 6.4E-3 5.3E-3 

AFW (DDP train) 1.5E-2 6.9E-3 1.7E-3 7.4E-3 

RHR (train) 7.3E-3 9.3E-3 6.1E-3 8.2E-3 

BWRs 

HPCI (train) 9.7E-3 1.3E-2 1.8E-2 4.5E-2 

HPCS (train) 3.4E-3 9.OE-3 3.9E-3 1.OE-2 

RCIC (train) 1.3E-2 9.OE-3 ) 1.6E-2 1.6E-2 

RHR (train) 1.OE-2 l.3E-2 1.5E-2 8.7E-3

5-13

Industrv-Wide Initiating Event Frennencv a
Table 5.3-7 Industry Trends for Mitigating System Unreliability RBPIs (1997 through 19 99) 

Industry-Wide Unreliability' 

Mitigating System and Level 1996 Baseline 1997 1998 1999 

EPS (train) 4.1E-2 1.5E-2 9.3E-3 6.8E-3 

PWRs 

HPI (train) 7.9E-3 6.2E-4 1 .2E-3 4.OE-4 

AFW (MDP train) 7.8E-3 4.1E-3 7.5E-3 4.5E-3 

AFW (TDP train) 2.OE-1 2.6E-2 5.1E-2 7.9E-2 

AFW (DDP train) 5.7E-2 2.7E-2 2.7E-2 5.5E-2 

RHR (train) 1. 1E-2 9b ? ? 

BWRs 

HPCI (train) 4.3E-2 3.OE-2 2.5E-2 3.4E-2 

HPCS (train) 6.8E-2 4.9E-2 3.1E-2 3.1E-2 

RCIC (train) 4.4E-2 2.7E-2 2.2E-2 2.7E-2 

RHR (train) 1.6E-2 ?b . 9 

a. Train unreliability models vary by plant. For the industry-wide trending, the train unreliability was 

simplified to include the pump Fail to Start (FTS) and Fail to Run (FTR) (or EDG FTS, Fail to Load 

and Run (FTLR), and FTR), single-failure valves within the train, and train unavailability (kept at the 

baseline value). A 4-hour mission time was assumed for EDGs, and a 24-hour mission time for all 

other trains. 

b. Valve data still need to be collected to evaluate this properly. 

tr.kl. X2 Q IF ,diver Tr-n-l far Cnmnenent Class RBPIs (1997 through 1999)

U Industry-Wide Unreliability 

Component Class 1996 Baseline 1997 1998 1999 

AOV 1.OE-3 2.6E-3 2.8E-3 1.3E-3 

MOV 3.OE-3 6.5E-4 6.6E-4 3.4E-3 

MDP 3.7E-3 5.7E-4 1.IE-3 7.8E-4 

TDP a 1.0E- 3.4E-2 4.2E-2 3.4E-2

a.

b.

Unreliability includes FTS (baseline of 3.OE-3) and FTR (baseline A. ot _.Ulz-)In ana a mission ume 

of 24 hours). 

TDP is not an RBPI, but is trended at the industry level. Unreliability includes FTS (baseline of 

I.4E-2, which is a weighted average of AFW, HPCI, and RCIC TDPs) and FTR (baseline Xý of 3.7E

3/h, which is a weighted average, and a mission time of 24 hours).

5-14
6. KEY ISSUES AFFECTING RBPI DEVELOPMENT AND 

IMPLEMENTATION 

The following subsections describe issues that have emerged in the course of the development described in this report. This work is part of the development and evolution of performance indicators in the current ROP and is closely coordinated with existing ROP efforts. There are 

several key implementation issues summarized in the executive summary and in this section, including the verification of risk models and data. The potential integration of RBPIs into the 

ROP would follow the guidelines in IMC-0608, "Performance Indicator Program." This would 

include a pilot program prior to the implementation of any or all RBPIs and interaction with 

stakeholders to resolve implementation issues raised in this report or from external stakeholders 

during the review of this report. 

6.1 Program Coordination Issues 

The following specific issues have been considered by the stakeholders: 

"• Are additional RBPIs needed in the ROP? 

"• Is the number of potential new indicators appropriate? 

* Do the data sources for RBPIs exist and have sufficient quality for use in the ROP? 

"• Will additional SPAR Revision 3i models be available for setting plant-specific thresholds 

for all plants? "* Will SPAR LERF models be available for setting thresholds for mitigating and containment 

systems? 

Are any additional performance indicators needed in the ROP? 

Interactions with stakeholders commenting on the White Paper indicated differing views on this 

subject. Industry representatives questioned whether NRC needed to have a broader coverage of 

risk measured in the ROP indicators, especially if it did not result in a corresponding reduction in 

the inspection program. Other external stakeholder comments favored more indicators as well as 

additional inspections. 

The RBPI development program is focused on demonstrating the technical feasibility of 

providing additional objective indicators that cover a broader spectrum of risk-significant plant performance. Future work may identify additional candidates. Any potential new performance indicators will be assessed in a pilot program consistent with the change process described in 

IMC-0608 prior to implementation. 

Subsequent to the closing of the comment period for this report, the agency and industry (through the continuing ROP interactions) have identified several aspects of unreliability and 

unavailability indicators from the RBPI development that will be piloted in 2002 for potential implementation in the ROP. These involve unreliability and unavailability indicators associated 

with the six SSUPIs under the mitigating system cornerstone of the current ROP.

6-1
Is the number of potential new indicators appropriate?/Which of the proposed indicators would 

be most beneficial? 

The RBPI Phase 1 development identified 22 potential indicators for PWRs and 17 potential 

indicators for BWRs. If all of these performance indicators were implemented, they could 

potentially replace 8 (3 initiating event and 5 mitigating system) of 18 existing indicators in 

whole or in part bringing the total number of indicators per plant to about 30. In addition to the 

issue of the appropriate risk scope of ROP indicators (noted above), it will be necessary to assess 

whether potentially expanding the total number of indicators to approximately 30 (approximately 

25 based on currently available data) per plant is reasonable from a logistics/process point of 

view. For example, the criteria that result in plants entering various columns of the Action 

Matrix would have to be reconsidered. Section 6.5 discusses results of preliminary work to 

examine the feasibility of developing indicators at a higher level (system or cornerstone level) by 

combining results of lower level data and models. In follow-on work, higher-level indicators 

may be investigated further. 

Do the data sources for RBPIs exist and have sufficient quality for use in the ROP? 

A significant portion of the RBPIs require access to and use of data from the Equipment 

Performance and Information Exchange (EPIX) system. These data are voluntarily provided by 

industry in response to the Commission decision to forgo the Reliability Data Rule. Full industry 

participation, verification and validation of existing EPIX, and development of guidelines for 

consistent reporting are important to the feasibility of many RBPIs as potential improvements to 

the ROP. 

Performance data are not readily available from EPIX for several of the proposed indicators. The 

NRC is working with industry groups to expand the unreliability data collection in this voluntary 

system to include data that will support evaluation of performance in these areas. 

Data accuracy and licensee burden in this area are recognized as important implementation 

issues, which will be further investigated during the implementation phase using the change 

process in IMC-0608. 

Will SPAR Revision 3i models be used for setting plant-specific thresholds for all plants? 

Approximately 50 Standardized Plant Accident Risk (SPAR) Revision 3i models are currently 

available. Completion of all 70 SPAR Revision 3i models is scheduled for the end of calendar 

year 2002. As more models are made available for use in the RBPI development program, it will 

be possible to determine if plants can be grouped so that a few models can be used to set 

thresholds for all plants or individual models will be needed for each. The RBPI development 

program will continue to use the SPAR Revision 3i models as they are developed. External 

stakeholder comments on the White Paper indicated that peer review by licensees should be 

included in the development of these models. An additional implementation issue relates to 

whether licensees or NRC will calculate the thresholds and indicators as well as whether licensee 

models (meeting as yet to be developed NRC specifications) could be used instead of the SPAR 

models.

6-2
It is yet to be determined whether a plant-specific model will be required to set performance 

thresholds for each plant or a representative model is sufficient for a group of plants. 

Furthermore, it has not been determined whether the calculation for thresholds and indicators 

will be routinely performed by NRC staff using SPAR Revision 3i models, licensees using SPAR 

Revision 3i models, or licensees using their own risk models that meet some specifications 

agreed upon and reviewed by the NRC. These are potential options that will be dealt with 

through IMC-0608. 

Will LERF models be used for setting thresholds for mitigating and containment systems? 

There are a limited number of large early release frequency (LERF) models available to set 

thresholds for performance of systems that impact the integrity of the containment barrier. In 

addition, currently available data are inadequate for establishing performance measures for the 

containment systems. Also, for some systems under the mitigating systems cornerstone, the 

thresholds associated with changes in core damage frequency (CDF) due to performance 

degradations may not be limiting compared to changes in LERF. To assess that condition, LERF 

models that reflect the impact of potential CDF changes are needed. The current plan for 

developing LERF models over the next several years will support limited capability for 

identifying RBPIs or setting plant-specific LERF thresholds. 

6.2 Plant-Specific RBPI Formulation 

Based on risk-significance, some systems warrant RBPI coverage only at certain plants. From a 

risk coverage point of view, it may be desirable to include these systems in RBPI development. 

However, this leads to different numbers of indicators at different plants, and calls for more 

performance data to be collected through EPIX. 

Options: 

Develop RBPIs for all systems satisfying standard criteria, and upgrade the collection of 

performance information to support quantification 

Maintain a generic set of RBPIs that are applicable to specific plant groups and can be 

supported with currently available data and logic models 

Within the partial set of SPAR models available to the Phase 1 development, it was not possible 

to identify groups of plants within PWRs or BWRs to which a specific set of RBPIs would be 

applicable. When a complete set of SPAR models becomes available, another effort will be made 

to identify such plant groups. 

6.3 Selection of Risk Metrics for Use in Assessing Containment Barrier 

Performance 

Large early release frequency (LERF) is one important metric used for assessing the risk 

significance of proposed changes to the licensing basis. However, many significant elements of 

containment barrier performance discussed in SECY 99-007 do not affect either CDF or LERF 

significantly, although they affect late release frequency or other post-accident considerations

6-3
such as worker dose. Currently, the graded approach in SECY 99-007 defines performance bands 

in terms of changes in CDF and LERF. However, if performance bands for large late release 

frequency were derived from the QHOs in the same way that performance bands for LERF are 

derived, then performance thresholds for many of these elements would be implied. 

Quantification of thresholds based on changes in late release frequency would require either 

additional SPAR model development, or formulation of approximate approaches such as those 

being developed as part of the SDP. 

Options: 

"• Use LERF only 

"* Develop models and apply to RBPI development addressing large late release frequency 

(LLRF) 

In follow-on work, the feasibility and usefulness of RBPIs that address LLRF will be 

investigated. 

6.4 Formulation of G/W Threshold In Terms of Performance Percentile 

In some cases, relatively small changes in element performance are capable of causing a 1E-6 

change in CDF. For such elements, placing the G/W threshold at this performance level makes 

false positive indications more likely. An alternative approach is to define the G/W threshold in 

terms of performance relative to the operating fleet. However, at some plants, the 95th percentile 

of system performance corresponds to a ACDF in a white or even yellow performance band. The 

current plan is to continue to apply a ACDF threshold of 1E-6, and address high false positive 

probability on a case-specific basis by supplementing each nongreen RBPI indication with an 

evaluation of the probability of observing that performance, given that the actual performance is 

at the baseline level. 

Options: 

* Continue to use a ACDF threshold of 1E-6, and identify RBPIs with high false positive 

probabilities 

* Use 9 5th percentile 

* Use a different ACDF threshold 

• Use a different percentile 

The current approach is to use a ACDF threshold of IE-6, and identify RBPIs with high false 

positive probabilities. 

6.5 Development of RBPIs at Higher Level 

Because of industry concerns that the number of component/train level RBPIs may be too high, 

some preliminary work was done to assess the potential for reduced sets of higher-level RBPIs. 

Three sets of higher-level RBPIs were considered for at-power, internal events: the cornerstone

6-4
level (initiating events and mitigating systems), the functional level mitigation (initiator types 

with associated mitigating systems), and the functional level mitigation (systems). Each of these 

higher-level RBPIs uses a subset of the component/train level and initiating event RBPIs 

discussed in Section 3 of this report. These concepts were presented to the ACRS (May 10, 2001) 

and discussed with external stakeholders. ACRS and external stakeholder comments on these 

higher-level RBPIs are discussed in Appendix I. 

These higher-level RBPIs were quantified for selected examples from existing data. In these 

cases, performance indications from the higher-level RBPIs tended to be green when the lower

level inputs were green, and white when some of the lower-level inputs were white. These 

examples suggest that indications from higher-level RBPIs will correspond appropriately to the 

inputs, but it is necessary to characterize the behavior of these RBPIs more carefully over the 

range of possible inputs before recommending them for trial. 

Defining RBPIs at higher levels has both potential benefits and potential limitations. A potential 

benefit is the reduced number of RBPIs. However, higher-level RBPIs generally use all of the 

performance data collected for the lower level RBPIs discussed in Section 3. These higher-level 

RBPIs also can balance the impacts of individual lower level RBPIs. For example, a high system 

train unavailability can be balanced by a low train unreliability. This approach is more consistent 

with the Maintenance Rule philosophy, wherein a balance between unreliability and 

unavailability is sought. Also, for higher-level RBPIs, poor performance of one system can 

potentially be balanced by good performance of another system. A limitation of these higher

level RBPIs is that when potentially degraded performance is indicated, further analysis (at a 

lower level) is required to identify the major contributors to the degraded performance. 

Options: 

* Continue to study the potential for developing RBPIs at a higher level 

0 Focus on RBPIs at the lower level outlined in this report (Section 3) 

In follow-on work, we will continue to study the potential for developing RBPIs at a higher level. 

6.6 Issues Related to Shutdown RBPI Development 

SECY 99-007 indicated that a PI would be developed to monitor configuration management at 

shutdown. The development summarized in Section 3.2, and described more fully in Appendix 

B, was aimed at directly monitoring the risk incurred during shutdown by monitoring the time 

spent in risk-significant configurations. Several issues emerged in the course of that development 

as a result of stakeholder interactions. They are summarized and discussed below. 

(1) Operational exigencies drive variations in shutdown risk that are substantially greater than 

the risk changes that are associated with PI thresholds in the ROP. PIs that measure changes 

in shutdown risk therefore capture influences whose relationship to licensee performance in 

configuration management is indirect. This potentially leads to unintended consequences.

6-5
Variations in risk at full power are typically less than variations in risk at shutdown, 

because at full power, variations are limited by the physical conditions at full power 

and by technical specifications. Changes in plant condition that are associated with 

major variations in risk at full power promptly lead to shutdown, automatically or by 

procedure. However, at shutdown, risk can vary more as a function of configuration. 

Review of actual outage experience shows that shutdown risk does vary. As a result, 

even within a representative sample of "normal" outages, the variance around mean 

behavior is large compared to ROP threshold values for ACDF. Moreover, much of 

this variation is driven by operational needs that may relate only indirectly, if at all, to 

licensee performance. 

(2) The risk in certain configurations can be reduced by enhancing licensee readiness to 

respond to initiating events in those configurations. NUMARC 91-06 describes such 

compensatory measures that utilities generally use. The assessment of configuration risk 

significance in Section 3.2 does not account for all such compensatory measures. 

Current licensee practice implicitly takes credit for risk reduction through licensee 

readiness, in that configurations are entered that would be assigned a high conditional 

CDF if not for compensatory measures. Existing risk models do not credit all possible 

compensatory measures. Therefore, the risk calculated for certain configurations may 

be higher than it would be if credit were taken for all compensatory measures. As a 

result, promulgating the baselines and thresholds presented in Section 3.2 for the 

shutdown PIs may not appropriately credit current operational practice. 

(3) Models comparable to SPAR models for full power are not available for shutdown. 

Therefore, a development of plant-specific PI thresholds comparable to that for full power 

is not currently practical. 

Development of the RBPIs for shutdown as discussed in Section 3.2 would likely 

require plant-specific models for two reasons: (1) classifying configurations according 

to risk significance requires plant-specific models, and (2) specification of baselines 

for those RBPIs requires access to a representative sample of outage schedules that 

have been mapped through a risk model to generate representative dwell times in risk

significant configurations. At this time, a complete set of models is not available, and 

even if they were available, a significant effort would be needed to assemble a 

representative sample of outage schedules and propagate them through the appropriate 

models. Before undertaking this, it would be necessary to address the issue regarding 

modeling of all compensatory measures. 

(4) Development of a baseline would require characterizing a nominal outage, based on review 

of a large number of outage schedules and processing them through risk models. 

For reasons mentioned above under (1), defining an applicable baseline for shutdown 

is difficult. The development presented in Section 3.2 established nominal times spent 

in each configuration category. For some activities, such as time spent in mid-loop 

early in an outage, small changes from the nominal produce relatively larger changes

6-6
in risk. Thus, the indicator would be very sensitive to any changes above nominal 

conditions. As there may be times when longer than nominal conditions are necessary, 

the indicator may become a defacto operating limit. 

(5) Because risk changes from configuration management are detectable in short time intervals, 

monitoring shutdown risk has an episodic, SDP character, rather than a longer-term, trending-indicator character. This raises the question whether this development should be 

subsumed in the SDP. 

An approach that may address the above issues is to have the shutdown performance indicators 

formulated to quantify the deviation during each outage from the governing outage plan, and to 

assess separately (by inspection) the merits of the outage plan itself. PI thresholds would be 

exceeded if planned durations of risk-significant configurations were exceeded by significant 

amounts in the actual outages. In effect, the outage plan becomes an outage-specific baseline. 

Configurations could continue to be classified as in Section 3.2, although work would need to be 

done to address the treatment of applicable compensatory measures, and the PI would be defined 

as excess time beyond the outage plan spent in each configuration category. The short threshold 

times associated with risk-significant configurations could be anticipated in the licensee's 

formulation of each outage plan, so that exceedance of scheduled time would signal a 

performance deviation. 

Measuring configuration management relative to an outage plan would alter the priorities in 

model development, and would not require formulating a baseline in terms of "normal" outage behavior based on historical outage plans. This approach more closely comports with guidance in 

NUMARC 91-06, which recommends monitoring of adherence to outage plans as an effective 

way to assess licensee performance. 

Options: 

1. Instead of developing PIs for shutdown, rely entirely on inspection to sample licensee 

performance at shutdown. 

2. Finalize the PIs developed in Section 3.2 now, using generic models. 

3. Obtain plant-specific models, then finalize the PIs developed in Section 3.2. 

4. Develop PIs that measure configuration management relative to outage plan; address outage 

plans themselves through inspection. 

5. Use RBPI concepts to develop a better shutdown SDP process. 

Follow-on work will use RBPI concepts to develop a better shutdown SDP process.

6-7
7. REFERENCES

1. "Development of Risk-Based Performance Indicators: Program Overview," Attachment I 

to SECY-00-146, "Status of Risk-Based Performance Indicator Development and Related 

Initiatives," U.S. Nuclear Regulatory Commission, June 28, 2000. 

2. SECY-01--0 111, "Development of an Industry Trends Program for Operating Power 

Reactors," U.S. Nuclear Regulatory Commission, June 22, 2001. 

3. SECY-99-007, "Recommendations for Reactor Oversight Process Improvements," U.S. 

Nuclear Regulatory Commission, January 8, 1999. 

4. "Individual Plant Examination Program: Perspectives on Reactor Safety and Plant 

Performance," NUREG-1560, Part 1, Final Summary Report, U.S. NRC, 1997. 

5. "Severe Accident Risks: An Assessment for Five U.S. Nuclear Power Plants," 

NUREG-1 150, U.S. NRC, December 1990. 

6. Brownson, D. A., et al., "Reliability Study Update: Emergency Diesel Generator (EDG) 

Power System, 1987 - 1998," NUREG/CR-5500, Vol. 5, (Draft), Idaho National 

Engineering and Environmental Laboratory, December 1999. 

7. Su, T. M., et al., "Individual Plant Examination Database - User's Guide," NUREG-1603, 

U.S. NRC, April 1997. 

8. Poloski, J. P., et al., Rates of Initiating Events at U.S. Nuclear Power Plants: 1987 - 1995, 

NUREG/CR-5750, Idaho National Engineering and Environmental Laboratory, February 

1999. 

9. Long, S. M., P. D. Reilly, E.G. Rodrick, and M. B. Sattison, "Current Status of the 

SAPHIRE Models for ASP Evaluations," Proceedings of the 4th International Conference 

on Probabilistic Safety Assessment and Management (PSAM 4), pp. 1195-1199, September 

13-18, 1998. 

10. "Sequence Coding and Search System for Licensee Event Reports," NUREG/CR-3905, 

Vol. 1-4, Oak Ridge National Laboratory, April 1985. 

11. Idaho National Engineering and Environmental Laboratory (INEEL), MORP 1 Database, 

1998. 

12. 10 CFR 50.65, "Requirements for Monitoring the Effectiveness of Maintenance at Nuclear 

Power Plants." 

13. Regulatory Guide 1.160, "Monitoring the Effectiveness of Maintenance at Nuclear Power 

Plants," U.S. NRC (Draft DG-1051, Proposed Revision 2, published 8/1996).

7-1
14. Grant, G. M., et al., Isolation Condenser System Reliability, 1987-1993, NUREG/CR-5500, 

Vol. 6, U.S. NRC, INEL-95/0478, August 1996. 

15. Poloski, J. P., et al., Reactor Core Isolation Cooling System Reliability, 1987-1993, 

NUREG/CR-5500, Vol. 7, U.S. NRC, AEOD/S97-02, INEL-95/0196, August 1996. 

16. Grant, G. M., et al., High-Pressure Coolant Injection System Performance, 1987-1993, 

NUREG/CR-5500, Vol. 4, U.S. NRC, INEL-94/0158, February 1995. 

17. Grant, G. M., et al., Emergency Diesel Generator Power System Reliability, 1987-1993, 

NUREG/CR-5500, Vol. 5, U.S. NRC, INEL-95-0035, February 1996. 

18. Poloski, J. P., et al., Reliability Study: Auxiliary/Emergency Feedwater System, 1987-1995, 

Idaho National Engineering and Environmental Laboratory, NUREG/CR-5500, Vol. 1, 

INEL/EXT-97/0740, August 1998. 

19. Poloski, J. P., et al., High-Pressure Core Spray System Reliability, 1987-1993, 

NUREG/CR-5500, Vol. 8, U.S. NRC, INEL-95/00133, January 1998. 

20. Reliability and Availability Data base System (RADS), Version 1.0, Critical Design 

Review Document, February 1999. 

21. Equipment Performance and Information Exchange System (EPIX), Volume 1 

Instructions for Data Entry, Maintenance Rule and Reliability Information Module, INPO 

98-001, Institute of Nuclear Power Operations, February 1998. 

22. Thatcher, T. A., et al., "Accident Sequence Precursor Extension to Low Power, Shutdown, 

and External Events Feasibility Study (Sequoyah Model)," Idaho National Engineering and 

Environmental Laboratory, Lockheed Idaho Technologies Company, January 1996. 

23. A Generic Westinghouse 4-Loop Shutdown Model Developed for Use in the Safety 

Monitor Version 2.0 Software, acquired by U.S. NRC from SCIENTECH, Inc. 

24. "Evaluation of Potential Severe Accidents During Low Power and Shutdown Operations at 

Grand Gulf, Unit 1," NUREG/CR-6143, SAND93-2440, Vol. 1, U.S. NRC, July 1995. 

25. "Risk Impact of BWR Technical Specifications Requirements During Shutdown," 

NUREG/CR-6166, SAND93-3998, Sandia National Laboratories, U.S. NRC, October 

1994. 

26. "'Guidelines for Industry Actions to Assess Shutdown Management," NUMARC 91-06, 

NUMARC, December 1991. 

27. "Shutdown and Low-Power Operation at Commercial Nuclear Power Plants in the United 

States," NUREG-1449, U.S. NRC, 1993.

7-2
28. "Special Study - Fire Events - Feedback of U.S. Operating Experience," AEOD/S97-03, 

U.S. NRC, June 1997. 

29. "Determining Potential Risk Significance of Fire Protection and Post-Fire Safe Shutdown 

Inspection Finding," NRC Inspection Manual, Chapter 0609, Appendix F, U.S. NRC, 

February 2001. 

30. "Perspectives Gained from the Individual Plant Examination of External Events (IPEEE) 

Program," Draft NUREG-1742, U.S. NRC, April 2001.

7-3
APPENDIX A

RBPI DETERMINATION FOR INTERNAL EVENTS/ 

FULL POWER ACCIDENT RISK

A-1
Contents

A. 1 Initiating Events Cornerstone..................................... :7 A. 1.1 Assess the Potential Risk Impact of Degraded Performance ........... 7 

A. 1.. I 1 Determine Attributes That Are Risk-Significant and Explicitly 

M odeled ........................................... A. 7 1.2 Obtain Performance Data for Risk-Significant, Equipment-Related 

Elem ents ................................................... 8 A. 1.3 Identify Indicators Capable of Detecting Performance Changes in a 

Tim ely M anner ........ ....... ............................. 9 A. 1.3.1 Industry-wide Trending of Initiating Events ............... 10 A. 1.4 Identify Performance Thresholds Consistent with a Graded Approach to 

Performance Evaluation from SECY 99-007 ...................... 11 

A. 1.5 Inspection Areas Covered by New RBPIs ........................ 17 A.2 Mitigating Systems Cornerstone....................................... 34 

A.2.1 Assess the Potential Risk Impact of Degraded Performance ......... 34 

A.2. 1.1 Determine Attributes That Are Risk-Significant and Explicitly 

M odeled .......................................... 34 A.2.1.2 Determine Monitoring Levels for Each Element ........... 36 A.2.2 Obtain Performance Data for Risk-Significant, Equipment-Related 

Elem ents .................................................. 38 A.2.3 Identify Indicators Capable of Detecting Performance Changes in a 

Tim ely M anner ............................................. 39 A.2.3.1 Treatment of Systems Whose Function Is Monitored under 

Initiating Event RBPIs ............................... 40 A.2.3.2 Industry-wide Trending of Mitigating Systems ........... 40 

A.2.4 Identify Performance Thresholds Consistent with a Graded Approach to 

Performance Evaluation from SECY 99-007 ........... 42 

A.2.5 Inspection Areas Covered by New RBPIs ...... ......... 43 A.3 Barrier Integrity Cornerstone: Containment ......................... 43 

A.3.1 Assess the Potential Risk Impact of Degraded Performance .......... 75 

A.3.2 Obtain Performance Data for Risk-Significant, Equipment-Related 

Elem ents .................................................. 8 0 A.3.3 Identify Indicators Capable of Detecting Performance Changes in a 

Tim ely M anner ............................................. 80 A.3.4 Identify Performance Thresholds Consistent with a Graded Approach to Performance Evaluation from SECY 99-007 ...................... 80 

A.3.5 Inspection Areas Covered by New RBPIs ........................ 81 A.3.6 LERF as the Figure of Merit for Containment Barrier Performance .... 81 

A.3.6.1 The Definition of LERF .............................. 81 

A.3.6.2 The Justification for Using LERF as a Containment Barrier 

M etric ............................................ 8 2 A .4 R eferences ........................................................ 8 3

A-3
Figures

Figure A. 1.3.1-1 Time-dependent Trending of Internal Flood Initiating Events ............ 12 

Figure A. 1.3.1-2 Time-dependent Trending of Annual Initiating Event ASP Index ......... 12 

Figure A. 1.3.1-3 Time-dependent Trending of Loss of Instrument/Control Air (BWR) 

Initiators ..................................................... 13 

Figure A. 1.3.1-4 Time-dependent Trending of Loss of Instrument/Control Air (PWR) 

Initiators ..................................................... 13 

Figure A. 1.3.1-5 Time-dependent Trending of Loss of Offsite Power Initiating Events ..... 14 

Figure A. 1.3.1-6 Time-dependent Trending of Loss of Safety Related Vital AC Bus 

Initiators ..................................................... 14 

Figure A. 1.3.1-7 Time-dependent Trending of Loss of Safety Related Vital DC Bus 

Initiators ..................................................... 15 

Figure A. 1.3.1-8 Time-dependent Trending of Loss of Small/Very Small LOCA Initiators .. 15 

Figure A. 1.3.1-9 Time-dependent Trending of Steam Generator Tube Rupture Initiators .... 16 

Figure A. 1.3.1-10 Time-dependent Trending of Stuck Open Safety/Relief Valve - BWR 

Initiating Event ............................................... 16 

Figure A.2.3.2-1 Time-dependent Trending of CCF Events for Auxiliary Feedwater 

Al

Figure A.2.3.2-2 

Figure A.2.3.2-3

Pumps ................................................ 

Time-dependent Trending of CCF Events for Emergency Diesel 

G enerators ................................................... 41 

Time-dependent Trending of CCF Events for All Systems .............. 42 

Tables

Table A. 1.1.1-1 Modeled Risk-Significant Initiators ................................. 8 

Table A.1.4-1 BWR 123 Plant 1/2 Initiating Events Threshold Summary ................ 18 

Table A. 1.4-2 BWR 3/4 Plant I Initiating Events Threshold Summary .................. 18 

Table A. 1.4-3 BWR 3/4 Plant 2 Initiating Events Threshold Summary .................. 19 

Table A. 1.4-4 BWR 3/4 Plant 3/4 Initiating Events Threshold Summary ................. 19 

Table A. 1.4-5 BWR 3/4 Plant 5 Initiating Events Threshold Summary .................. 20 

Table A. 1.4-6 BWR 3/4 Plant 6 Initiating Events Threshold Summary .................. 20 

Table A.1.4-7 BWR 3/4 Plant 8 Initiating Events Threshold Summary .................. 21 

Table A. 1.4-8 BWR 3/4 Plant 11 Initiating Events Threshold Summary ................. 21 

Table A.1.4-9 BWR 3/4 Plant 12/13 Initiating Events Threshold Summary ............... 22 

Table A.1.4-10 BWR 3/4 Plant 15/16 Initiating Events Threshold Summary .............. 22 

Table A.1.4-11 BWR 3/4 Plant 18/19 Initiating Events Threshold Summary .............. 23 

Table A. 1.4-12 BWR 5/6 Plant 2 Initiating Events Threshold Summary ................. 23 

Table A. 1.4-13 BWR 5/6 Plant 5 Initiating Events Threshold Summary ................. 24 

Table A.1.4-14 BWR 5/6 Plant 8 Initiating Events Threshold Summary ................. 24 

Table A. 1.4-15 B&W Plant 3 Initiating Events Threshold Summary .................... 25 

Table A.1.4-16 B&W Plant 4/5/6 Initiating Events Threshold Summary ................. 25

A-4
Table A.1.4-17 

Table A.1.4-18 

Table A. 1.4-19 

Table A. 1.4-20 

Table A. 1.4-21 

Table A. 1.4-22 

Table A. 1.4-23 

Table A. 1.4-24 

Table A. 1.4-25 

Table A. 1.4-26 

Table A. 1.4-27 

Table A. 1.4-28 

Table A. 1.4-29 

Table A. 1.4-30

B&W Plant 7 Initiating Events Threshold Summary .................... 26 

CE Plant 1 Initiating Events Threshold Summary ...................... 26 

CE Plant 2/3 Initiating Events Threshold Summary ..................... 27 

CE Plant 4 Initiating Events Threshold Summary ...................... 27 

CE Plant 5 Initiating Events Threshold Summary ...................... 28 

CE Plant 10/11 Initiating Events Threshold Summary ................... 28 

CE Plant 12 Initiating Events Threshold Summary ..................... 29 

WE 2-Lp Plant 5/6 Initiating Events Threshold Summary ................ 29 

WE 3-LP Plant 5 Initiating Events Threshold Summary ................. 30 

WE 3-LP Plant 10/11 Initiating Events Threshold Summary .............. 30 

WE 4-Lp Plant 1/2 Initiating Events Threshold Summary ................ 31 

WE 4-LP Plant 10/11 Initiating Events Threshold Summary .............. 31 

WE 4-Lp Plant 22/23 Initiating Events Threshold Summary .............. 32 

WE 4-LP Plant 28 Initiating Events Threshold Summary ................ 32

Table A. 1.5-1 Summary of Inspection Areas Impacted by New RBPIs for Initiating Event 

Cornerstone ..................................................... 33 

Table A.2.1.1-1 Modeled Risk-Significant Mitigating Systems ........................ 35 

Table A.2.1.2-1 Auxiliary Feedwater System Example of the Differing Impacts of Dissimilar 

Trains on CDF ................................................. 37 

Table A.2.1.2-2 Emergency Power System Example of the Differing Impacts of Unavailability 

and Unreliability on CDF ......................................... 37 

Table A.2.1.2-3 Candidate Mitigating System RBPIs and Monitoring Level .............. 38

Table A.2.4-1 

Table A.2.4-2 

Table A.2.4-3 

Table A.2.4-4 

Table A.2.4-5 

Table A.2.4-6 

Table A.2.4-7 

Table A.2.4-8 

Table A.2.4-9 

Table A.2.4-1 0 

Table A.2.4-11 

Table A.2.4-12 

Table A.2.4-13 

Table A.2.4-14 

Table A.2.4-15 

Table A.2.4-16 

Table A.2.4-1 7 

Table A.2.4-18 

Table A.2.4-19 

Table A.2.4-20 

Table A.2.4-21 

Table A.2.4-22 

Table A.2.4-23 

Table A.2.4-24

BWR 123 Plant 1/2 Mitigating Systems Threshold Summary .............. 44 

BWR 3/4 Plant 1 Mitigating Systems Threshold Summary ................ 45 

BWR 3/4 Plant 2 Mitigating Systems Threshold Summary ................ 46 

BWR 3/4 Plant 3/4 Mitigating Systems Threshold Summary .............. 47 

BWR 3/4 Plant 5 Mitigating Systems Threshold Summary ................ 48 

BWR 3/4 Plant 6 Mitigating Systems Threshold Summary ................ 49 

BWR 3/4 Plant 8 Mitigating Systems Threshold Summary ................ 50 

BWR 3/4 Plant 11 Mitigating Systems Threshold Summary ............... 51 

BWR 3/4 Plant 12/13 Mitigating Systems Threshold Summary ............ 52 

BWR 3/4 Plant 15/16 Mitigating Systems Threshold Summary ........... 53 

BWR 3/4 Plant 18/19 Mitigating Systems Threshold Summary ........... 54 

BWR 5/6 Plant 2 Mitigating Systems Threshold Summary ............... 55 

BWR 5/6 Plant 5 Mitigating Systems Threshold Summary ............... 56 

BWR 5/6 Plant 8 Mitigating Systems Threshold Summary ............... 57 

B&W Plant 3 Mitigating Systems Threshold Summary .................. 58 

B&W Plant 4/5/6 Mitigating Systems Threshold Summary ............... 59 

B&W Plant 7 Mitigating Systems Threshold Summary .................. 60 

CE Plant 1 Mitigating Systems Threshold Summary .................... 61 

CE Plant 2/3 Mitigating Systems Threshold Summary .................. 62 

CE Plant 4 Mitigating Systems Threshold Summary .................... 63 

CE Plant 5 Mitigating Systems Threshold Summary .................... 64 

CE Plant 10/11 Mitigating Systems Threshold Summary ................ 65 

CE Plant 12 Mitigating Systems Threshold Summary ................... 66 

WE 2-Lp Plant 5/6 Mitigating Systems Threshold Summary ............. 67 

A-5
Table A.2.4-25 WE 3-LP Plant 5 Mitigating Systems Threshold Summary ............... 68 

Table A.2.4-26 WE 3-LP Plant 10/11 Mitigating Systems Threshold Summary ........... 69 

Table A.2.4-27 WE 4-Lp Plant 1/2 Mitigating Systems Threshold Summary ............. 70 

Table A.2.4-28 WE 4-LP Plant 10/11 Mitigating Systems Threshold Summary ........... 71 

Table A.2.4-29 WE 4-Lp Plant 22/23 Mitigating Systems Threshold Summary ........... 72 

Table A.2.4-30 WE 4-LP Plant 28 Mitigating Systems Threshold Summary .............. 73 

Table A.2.5-1 Summary of Inspection Areas Impacted by New RBPIs for Mitigating System 

Cornerstone ..................................................... 74 

Table A.3.1-1 Assessment of Elements of LERF-Significant Containment Barrier Attributes 

for PWRs with Large-Dry Containments .............................. 76 

Table A.3.1-2 Assessment of Potential Changes in LERF Due to Element Performance 

Changes for PWRS with Large-Dry Containments (Including 

Sub-Atm ospheric) ................................................ 77 

Table A.3.1-3 Assessment of Some Potential Changes in LERF Due to Element Performance 

Changes for PWRs with Ice Condenser Containments .................... 77 

Table A.3.1-4 Assessment of Potential Changes in LERF Due to Element Performance 

Changes for BWRs with Mark I Containments ......................... 78 

Table A.3.1-5 Assessment of Potential Changes in LERF Due to Element Performance 

Changes for BWRs with Mark II Containments ......................... 79 

Table A.3.1-6 Assessment of Potential Changes in LERF Due to Element Performance 

Changes for BWRs with Mark III Containments ........................ 79

Table A.3.5-1 Summary of Inspection Areas Impacted by Potential RBPIs for Containment 

Portion of Barrier Integrity Cornerstone ............................... 81

A-6
Appendix A: RBPI Determination for Internal Events / Full Power 

Accident Risk 

A.1 Initiating Events Cornerstone 

This section discusses development of RBPIs that address the initiating events cornerstone for 

full power, internal events. External events and non-power modes are addressed in other sections. 

Each subsection describes the analyses for the steps from Figure 2.1 of the main report. 

A.1.1 Assess the Potential Risk Impact of Degraded Performance 

The objective of the initiating events cornerstone is to limit the frequency of those events that 

upset plant stability and challenge critical safety functions. Six 'key attributes' that contribute to 

initiating event frequency are identified in SECY 99-007 (Ref. 1). These six attributes consist of 

configuration control, procedure quality, human performance, protection against external factors, 

equipment performance, and design. 

A. 1.1.1 Determine Attributes That Are Risk-Significant and Explicitly Modeled 

Identification of 'risk-significant' or 'risk-based' performance indicators necessitates a means of 

quantifying the impact of that attribute. Initiating events are unique among the cornerstones of 

safety in that their performance is quantified at the cornerstone level rather than at lower level 

quantities (i.e., the attribute level). Since initiating events represent the highest level element of 

risk pertaining to the cornerstone, they are used directly. Risk-significance of initiating events 

was determined through evaluation of the Individual Plant Examination (IPE) submittals and the 

associated IPE Database'. The IPE Database provides a succinct summary of industry-wide IPE 

data including initiator specific conditional core damage probabilities (CCDPs) and core damage 

frequencies (CDF). From this database, initiators with a CCDP > 1E-6 and a contribution to 

industry-wide CDF > 1% were identified as risk-significant. An exception to this rule was made 

for transients. They were included as a candidate RBPI even though the CCDP is less than 1E-6. 

The complete list of risk-significant initiating events is shown below in Table A. 1.1.1-1. 

Initiating events contained in this table are grouped according to the convention used in 

NUREG/CR-5750 (Ref. 2). 

The RBPI white paper (Ref. 3) indicates that RBPI development will be performed in a manner 

to group similar plants so that a given set of RBPIs apply to the entire group. In accordance with 

the data analysis performed in NUREG/CR-5750, only three schemes for grouping initiating 

events were considered; industry-wide, pressurized water reactors (PWRs) and boiling water 

reactors (BWRs). The list of risk-significant initiating events and the plant groups to which they 

are generically applicable are listed in Table A. 1.1.1-1. 

Su, T. M., et al., "Individual Plant Examination Database - User's Guide," NUREG-1603, U.S. NRC, April 1997 

A-7
Table Al.1.I.-I Modeled Risk-Significant Initiators

BWR INITIATOR NUREG/CR- CCDP>IE-6 Industry Timely Detection of 

5750 Initiator CDF' >1% Performance Changes at the 

Plant Level 

Flood J1 YES YES NO (Trending Candidate) 

High Energy Line Breaks K YES NO NO 

Loss of Heat Sink L YES YES YES (Candidate RBPI) 

Loss of Instrument Air DI YES YES(Note 2) NO (Trending Candidate) 

Loss of MFW P1 YES YES YES (Candidate RBPI) 

Loss of Offsite Power B 1 YES YES NO (Trending Candidate) 

Loss of Vital AC Bus Cl YES YES NO (Trending Candidate) 

Loss of Vital 125vdc Bus C3 YES YES NO (Trending Candidate) 

Loss of Service Water El YES YES NO (Note 3) 

Medium LOCA G6 YES YES NO (Note 3) 

Stuck Open Safety / Relief Valve G2, G5 YES YES NO (Trending Candidate) 

Transients Q NO (Note 5) YES YES (Candidate RBPI) 

PWR INITIATOR NUREG/CR- CCDP>IE-6 Industry Timely Detection of 

5750 Initiator CDF' >1% Performance Changes at the 

Plant Level 

Flood (Note 4) J1 YES YES NO (Trending Candidate) 

High Energy Line Breaks K YES NO NO 

Large LOCA G7 YES YES NO (Note 3) 

Loss of Cooling Water 'El YES YES NO (Note 3) 

Loss of Heat Sink L YES YES YES (Candidate RBPI) 

Loss of Instrument Air DI YES YES(Note 2) NO (Trending Candidate) 

Loss of MFW P1 YES YES YES (Candidate RBPI) 

Loss of Offsite Power BI YES YES NO (Trending Candidate) 

Loss of Vital 125vdc Bus C3 YES YES NO (Trending Candidate) 

Loss of Vital AC Bus C1 YES YES NO (Trending Candidate) 

Medium LOCA G6 YES YES NO (Note 3) 

Reactor Coolant Pump Seal LOCA G8 YES YES(Note 6) NO (Note 3) 

Small/Very-Small LOCA G 1, G3 YES YES NO (Trending Candidate) 

Steam Generator Tube Rupture Fl YES YES NO (Trending Candidate) 

Transients Q YES YES YES (Candidate RBPI)

I. The 'Industry CDF' value was extracted from the IPE database. It is the summation of the initiator specitic Cut- contributions 

from all plants modeling that initiator in their IPE. 

2. Several plants did not report CDF contribution by specific initiator but rather combined initiators into groups. In such instances 

initiator specific CDF contributions cannot be determined, however, industry CDF for this initiator is likely > 1%. 

3. To be selected for trending the candidate initiators must be risk-significant and actually occur in the industry (at least one 

occurrence since 1987 as recorded in NUREG/CR-5750). There were no occurrences of these initiators since 1987. 

4. Industry flooding frequency dominated (80%) by single event at Surry 

5. Transient initiators did not meetthe CCDP criteria, however, their high occurrence frequency in conjunction with their nominal 

CCDP give them the ability to effect changes into the white and yellow performance bands. Therefore, transient initiators were 

included in the list of potentially risk-significant initiators. 

6. Most RCP seal LOCAs modeled as consequential events.

A.1.2 Obtain Performance Data for Risk-Significant, Equipment-Related Elements 

The analysis of initiating event data and calculation of initiating event frequencies also relied on 

several data sources. The three data sources used in the selection, and their contribution to the 

analysis, of initiating event RBPIs are described below:

A-8
NUREG/CR-5750, Rates of Initiating Events at U.S. Nuclear Power Plants: 1987 - 1995, 

presents an analysis of initiating event frequencies at U. S. nuclear power plants. This report 

provides two key sets of information essential to the RBPI process. One set of information 

consists of generic initiating event frequencies calculated for various initiators. These initiating 

event frequencies were incorporated into Standardized Plant Analysis Risk (SPAR, Ref. 6) 

models as part of the process of establishing plant-specific baseline core damage frequencies. 

Another set of information extracted from the report includes the definitions of initiators and 

related functional impact groupings. Use of these definitions ensure that initiating event 

frequencies calculated in future updates are comparable with those used in the baseline SPAR 

models. 

The Sequence Coding and Search System (SCSS) is a database maintained at Oak Ridge 

National Laboratory that provides access to full text electronic copies of Licensee Event Reports 

(LERs) dating back to 1980. Per the Code of Federal Regulations 1OCFR50.73, LERs are 

required each time a plant is scrammed. Therefore, LERs present a comprehensive set of data 

addressing plant scrams. Licensee Event Reports (LERs), accessed through the SCSS database, 

comprised the primary source of data used in identification of scrams and trips in 

NUREG/CR-5750. Similarly, this database will be used to identify trips and scrams used in 

future calculations of initiating event frequencies and corresponding RBPI thresholds. 

Advanced features associated with the SCSS database allow screening on various coding 

schemes to greatly reduce the number of LERs that must be manually reviewed. Review by 

experienced engineers is then performed to screen and group the data by functional failures. The 

lag time between the occurrence of the event and its entry into the SCSS database is 

approximately 10 weeks. LERs can also be obtained directly from the NRC in hard copy form 

and reduce this process to approximately eight weeks. 

Monthly Operating Reports (MORs) are summaries of operating experience that are filed with 

the NRC on a monthly basis. These reports contain detailed information on plant operation 

including hours that the reactor was critical and type, duration and cause of shutdowns and power 

reductions. This information is tabulated in various databases maintained at the INEEL. 

Initiating event frequencies reported in NUREG/CR-5750 and subsequently incorporated into the 

SPAR models are reported in terms of per critical hour/year. Therefore, knowledge of plant

specific critical hour data is essential in calculating these values. NUREG/CR-5750 utilized one 

of the INEEL databases built on MOR data (MORP1) as the primary data source used in 

identification of critical hours. Similarly, this database will be used to identify critical hours used 

in future calculations of initiating event frequencies and corresponding RBPI thresholds. 

A.1.3 Identify Indicators Capable of Detecting Performance Changes in a Timely Manner 

In addition to being risk-significant (see Table A. 1.1.1 -1), initiating event performance indicators 

must be capable of detecting performance changes in a timely manner. An initiating event 

performance indicator involves collection of data during some monitoring period, and a decision 

rule, which declares that a plant is in a certain performance band based on observed data. This 

monitoring period must be long enough to reduce the probabilities of false negatives and false 

A-9
positives to acceptable levels, but no longer. When only one type of event is considered, such as 

initiating events, the decision rule is straightforward. It is to estimate the event occurrence rate, 

compare the estimate to the thresholds of the performance bands, and classify the plant 

accordingly. These analyses were performed with the results, including monitoring periods, 

documented in Appendices E and F. 

In accordance with the preceding discussions, three initiating events/groups that met the criteria 

for risk-significance and timely monitoring were selected as candidates to be monitored as 

Initiating Event RBPIs. These initiators consist of Loss of Main Feedwater (LOFW), Loss of 

Heat Sink (LOHS), and General Transients (GT). These initiators met the criteria of risk

significance as outlined in section A. 1.1. Monitoring periods of reasonable length were also 

calculated based on acceptable levels of false positives and negatives. Additionally, changes in 

their frequencies can be readily quantified with the current SPAR models. These three initiator 

categories account for over 90% of all reactor trips. 

The remaining initiators identified in Table A. 1.1.1-1 are not considered good candidates for 

initiating event RBPIs due to the excessive monitoring periods required to yield statistically 

significant trends in performance. However, because of their potential risk-significance, these 

initiators cannot be ignored. These initiators account for a very small fraction of the plant trips 

recorded in the industry yet they are significant contributors to industry risk associated with 

nuclear power plants. For example, Loss-of-Coolant-Accidents are postulated as significant 

contributors to risk yet only five LOCA events are identified between 1987 and 1998. These 

were all 'very-small' LOCAs. There has never been recorded a medium or large LOCA event in 

the U. S. nuclear power industry. While monitoring these events at the plant level is not practical, 

trending them at the industry-wide level may provide important insights. 

A. 1.3.1 Industry-wide Trending of Initiating Events 

The RBPI development program also provides industry-wide trends of the initiating events that 

are RBPIs as well as risk-significant performance elements that are not possible to trend on a 

plant-specific basis. Since more data are available at the industry level, trends emerging at the 

industry level may be apparent before plant-specific changes can be determined. The Loss of 

Offsite Power (LOOP) initiator is an example of a performance element that is difficult to trend 

at a plant-specific level yet will yield valuable information at the industry level. The IPE results 

indicate that LOOP is the dominant contributor to risk at U.S. nuclear power plants, however, 

plant-specific performance indicators are not practicable because of the excessive period required 

to monitor this initiator. 

Initiators evaluated as Accident Sequence Precursors (ASP) will also be trended on an industry

wide basis. ASP events are a set of precursor events screened from the industry that have an 

increased potential for severe core damage. Trending of these events provides a better 

understanding of the risk-significant events occurring at U.S. commercial reactors. The Annual 

ASP Index for initiating events was selected as the figure of merit to trend. This index is based 

on the sum of the CCDPs of at power precursors involving initiating events divided by the 

number of reactor operating years.

A-10
To be selected for trending the candidate initiators must be risk-significant and actually occur in the industry (at least one occurrence since 1987 as recorded in NUREG/CR-5750). Thirteen initiating event types/groups meet these conditions and are identified as candidates for industry wide trending. These initiating event types/groups and their respective NUREG/CR-5750 

category are listed below: 

Internal Flood (J 1) 

General Transients (Q) 

Stuck Open Safety / Relief Valve - BWR (G2) 

Initiators Evaluated as Accident Sequence Precursors (ASP) 

Loss of Feedwater Initiators (P 1) 

Loss of Heat Sink Initiators (L) 

Loss of Instrument/Control Air - BWR (Dl) 

Loss of Instrument/Control Air - PWR (D I) 

Loss of Offsite Power Events (B I) 

Loss of Vital AC Bus (C 1, C2) 

Loss of Vital DC Bus (C3) 

Small/Very Small LOCA (GI, G3) 

Steam Generator Tube Rupture (F 1) 

The Initiating Event RBPIs (General Transients, Loss of Feedwater, and Loss of Heat Sink) are trended in Table 5.3-6 of the main body of the report. Trends associated with non-RBPI events 

are shown below in Figures A.1.3.1-1 and A.1.3.1-10. 

A.1.4 Identify Performance Thresholds Consistent with a Graded Approach to 

Performance Evaluation from SECY 99-007 

A graded approach to identifying performance thresholds is built around four performance bands (green, white, yellow, red) whose boundaries correspond to plant-specific changes in CDF equal to 1 E-6/yr, I E-5/yr and 1 E-4/yr. The two higher level thresholds (ACDF = I E-5/yr and 1 E-4/yr) were set in accordance with acceptance guidelines outlined in Regulatory Guide 174 (Ref. 7). 

SECY 99-007 proposed a lower level threshold determined by choosing a value to no more than 

two significant figures such that about 95% of the plants would have observed data values that would be in the green zone. This process establishes a generic value that is applied to each plant. The weakness of this method is that it depends only on the number of plants with less than acceptable performance but not on how much their performance exceeds the norm (i.e., actual risk). Additionally, due to the large plant-to-plant variability in the importance of systems, this value correlates to changes in CDF in excess of 1 E-5/year at some plants. After considerable 

analysis, the alternative lower level threshold (green/white) of ACDF = 1E-6/yr was chosen. This value is consistent with the order of magnitude decrements associated with the higher level thresholds. It is also consistent with the green/white interval associated with inspection findings evaluated in the Significance Determination Process (SDP).

A-11
0.08 MLE and 90% confidence interval 

Fitted rate 

- ------- 90% confidence band on the rate 

> 0.06 

Ca) 

.•0.04 ",, 

(U 

> 002 

------------------

0.00 . - " 0 67 

1987 1988 1989 1990 1991 1992 1993 1994 1995 1996 1997 1998 

Year GCU 0465 2 

Figure A.1.3.1-1 Time-dependent Trending of Internal Flood Initiating Events 

(Trend is not close to statistically significant, p-value = 0.8)

0.15 

CD 

>' 0.10 

(U3 

C) 

0 

0.05 

.U

0.00

1994 1995 1996 1997 1998 

Year GO 0&58 2 

Figure A.1.3.1-2 Time-dependent Trending of Annual Initiating Event ASP 

Index (The trend is not close to statistically significant, p-value = 0.9)

A-12
0.40

0.)2 

- ", 

D 0.20 

S 0.10 ---------

0.00 __ 

1987 1988 1989 1990 1991 1992 1993 1994 1995 1996 1997 1998 

Year GCOO 005 3 

Figure A.1.3.1-3 Time-dependent Trending of Loss of Instrument/Control Air 

(BWR) Initiators (The trend is statistically very significant, p-value = 0.0016)

0.25 

0.20 

CU 

S0.15 

S0.10 

(

U 0.05 

0.00

1987 1988 1989 1990 1991 1992 1993 1994 1995 1996 1997 1998 

Year GCOO 0465• 

Figure A.1.3.1-4 Time-dependent Trending of Loss of Instrument/Control Air 

(PWR) Initiators (The trend is statistically very significant, p-value = 0.0016)

A-13
0.20 , MLE and 90% confidence interval 

Fitted rate 

"------ 90% confidence band on the rate 

S0.15 

o 0.10 

C'E 

W 0.05 

---------------------------------------

0.00 

1987 1988 1989 1990 1991 1992 1993 1994 1995 1996 1997 1998 

Year GCOo 

Figure A.1.3.1-5 Time-dependent Trending of Loss of Offsite Power Initiating 

Events (When extra-Poisson scatter is accounted for, trend is not statistically 

significant, p-value 0.10) 

0. 15 ~MLE and 90% confidence interval 

Fitted rate 

------. 90% confidence band on the rate 

(U 

ai) >1 

-7 0.10 

C.2 

(0.5 

~ 0.5 ~--- - =-- - - -- -------------

C A I 

--- ---- ------ - -- - ------- ---

0.00 

1987 1988 1989 1990 1991 1992 1993 1994 1995 1996 1997 1998 

Year oCO oWs I 

Figure A.1.3.1-6 Time-dependent Trending of Loss of Safety Related Vital 

AC Bus Initiators (Trend is not close to statistically significant, p-value 

0.9)

A-14

0330
0.08 

0.06 

CO 

S 0.04 

0 

C0 i-, 0.02 

LUl

0.00, -4- ,6 .. •. • : 

1987 1988 1989 1990 1991 1992 1993 1994 1995 1996 1997 1998 

Year GCOO 04655 

Figure A.1.3.1-7 Time-dependent Trending of Loss of Safety Related Vital DC 

Bus Initiators (Trend is not close to statistically significant, p-value = 0.6) 

0.08 

MLE and 90% confidence interval 

Fitted rate 

90% confidence band on the rate 

S0.06" 

0. 

PD 

U.1 a 0.02 --- --- --------- - ---

0.00 "-_

1987 1988 1989 1990 1991 1992 1993 1994 1995 1996 1997 1998 

Year GCOO 0465 

Figure A.1.3.1-8 Time-dependent Trending of Loss of Small/Very Small LOCA 

Initiators (Trend is not statistically significant, p-value = 0.17)

A-15

MLE and 90% confidence interval 

Fitted rate 

90% confidence band on the rate / 

x ss~ ~ . - - --.-...- -
0.12

0.10 

I.m 

0 0.06 

-" 0.04 

w

0.02 

0.00

1987 1988 1989 1990 1991 1992 1993 1994 1995 1996 1997 1998 

Year c-c 04658 

Figure A.1.3.1-9 Time-dependent Trending of Steam Generator Tube Rupture 

Initiators (Trend is not statistically significant, p-value = 0.17)

0.40 

MLE and 90% confidence interval 

Fitted rate - ------- 90% confidence band on the rate 

S0.30 

>, 

,._ 0.20 

40 __ " t- , _ - - --- I.I -------

-- - - -- - - --.- 

S0.10 

1987 1988 1989 1990 1991 1992 1993 1994 1995 1996 1997 1998 

Year o01GA•1064 

Figure A.1.3.1-10 Time-dependent Trending of Stuck Open Safety/Relief Valve 

BWR Initiating Event (Trend is not statistically significant, p-value = 0.16)

A-16

MLE and 90% confidence interval 

Fitted rate - -90% confidence band on the rate

I 4.LJ.==.L
To evaluate changes in performance as well as current thresholds and future performance trends, a fixed reference point (i.e., performance baseline) corresponding to current nominal performance is required. To facilitate plant-specific threshold values, a 'baseline' model was constructed for each plant analyzed in the RBPI program. Plant-specific logic (i.e., the SPAR models) was used to allow plant-specific design and operational characteristics to be credited. These models were 'baselined' to 1996 performance by incorporating appropriate unavailability data from the World Association of Nuclear Operators (WANO, Ref. 8), and reliability data from the system reliability studies (References 9, 10, 11, 12, 13, and 14). (Note: EPIX/RADs (References 15 and 16) will provide the failure data used in future performance trending and was the preferred data source for the baseline models.) In some cases minor modifications to the logic were also made to ensure that the logic structure of the models matched the available data. 

An iterative technique is employed to determine the exact thresholds. The frequency of the initiator is increased until the plant core damage frequency increases by an amount correlating to the performance action bands limits (i.e., IE-6, IE-5, 1E-4). Calculation of the Transient initiating event thresholds is straightforward using this process. Calculation of the LOFW and LOHS initiating event thresholds is obtained in a similar fashion, however, the process is somewhat more complex since they are conditional events within the Transient event tree and do 

not have their own explicit event trees. 

Initiating event RBPIs were selected and their threshold values calculated for 30 sites (44 plants). These sites are comprised of 19 BWR and 25 PWR plants. Detailed threshold information for each analyzed plant is contained in Tables A. 1.4-1 through A. 1.4-30. 

A.1.5 Inspection Areas Covered by New RBPIs 

The RBPIs developed in this report for the initiating events cornerstone were compared with the performance indicators in the ROP to identify those RBPIs that are not currently in the ROP. The inspection areas that could be impacted by the new initiating event RBPIs were then determined. The results are summarized in Table A. 1.5-1.

A-17
Table A.1.4-1 BWR 123 Plant 1/2 Initiating Events Threshold Summary 

BWR 123 Plant 1/2 SPAR 3i (3.7E-9/hr, 2.6E-5/calendar year') 

BWR 123 Plant 1/2 RBPI Baseline (2.9E-9/hr, 2.OE-5/calendar year') 

Initiator Baseline Initiator Frequency Green/White Green/White Threshold Whii 

(NUREG/CR-5750) Threshold (ACDF =I E-6/year) Th 

95•,%ile (ACDF

Transient Initiator 1.2 / calendar year 

Loss of Feedwater 6.8E-2 / calendar year 

Loss of Heat Sink 2.3E-1 / calendar year 3 

1. Calendar year is defined as 7000 critical hours.

-. 1A ,C 1 An.i,~ aIn..l ,. 1,/ -. I n L r / c e r"e-.

.IE-! /c

te/Yellow

reshold 

= I E-5/year)

Yellow/Red Threshold 

(ACDF = 1 E-4/year)

^ I. 1 . I .h:,, I A .,- ,ar R ' / calendar ve r 1 7 / calen dar vear

-",OEP-r /e atie.I , al .. . L7,•a '

•alendar year i * -I / ca en , ya- , """ ... M. ca. ... ye

Table A.1.4-2 BWR 3/4 Plant 1 Initiating Events Threshold Summary 

BWR 3/4 Plant I SPAR 3i (3.5E-10/hr, 2.4E-6/calendar year') 

BWR 3/4 Plant I RBPI BASELINE (3.IE-10/hr, 2.2E-6/calendar year') 

Initiator Baseline Initiator Frequency Green/White Green/White Threshold White/Yellow Yellow/Red Threshold 

(NUREG/CR-5750) Threshold (ACDF =I E-6/year) Threshold (ACDF =I E-4/year) 

95,h%ile I (ACDF =1 E-5/year)

Transient Initiator 1.2 / calendar year 

Loss of Feedwater 6.8E-2 / calendar year 

Loss of 12eat SinkE 2.3-1 / calendar year 

I. Calendar year is defined as 7000 critical hours.

-~~~a tA,. Par 

2.0E-I / c

2 yea, /. _j e•a - .a- ILr I _ JI........ "i"r I • 

a r A. I,- / I ,Aar 7 ' I ....- caendar . year 3-- ca ,, at yea

I. l E I / calenuar year I .ui-i ,• u ý.,, y __,_.. . ..... _..

00 _l-..J ....... A.4VK I / lAnrtr Aa~r I 13 / calendar year "3 / calendar year

*) -i I •¢JIl•t•/"llSllr •l•r..,lll'- I "•/ I I.;tll[•llllal Vlalal

I Wl-'. /Aeal narear I. I calendlarvyear I I / cailendlar yeart

Z•) / catenuar veal- I I

"11 A /n o~n a~r vPnr I •1 / calenuar VI•BI I Val ¢1I.111I I yf ,rl

.•/-/ l•.i:l.IK;llUal )'•,o.l
Table A.1.4-3 BWR 3/4 Plant 2 Initiating Events Threshold Summary 

BWR 3/4 Plant 2 SPAR 3i (5.IE-10/hr, 3.5E-6/calendar year') BWR 3/4 Plant 2 RBPI Baseline (3.8E-10/hr, 2.7E-6/calendar year') Initiator Baseline Initiator Frequency Green/White Green/White White/Yellow Yellow/Red Threshold 

_...._951h%ile 

(NUREG/CR-5750) Threshold Threshold Threshold (ACDF =l E-4/year) (ACDF = I E-6/year) (ACDF = I E-5/year) 

Transient Initiator 1.2 / calendar year 2.2 / calendar year 2.5 / calendar year 14.3 / calendar year 126 / calendar year Loss of Feedwater 6.8E-2 / calendar year 2.OE- I / calendar year 3.6E- I / calendar year 3.5 /calendar year 34 /calendar year Loss of Heat Sink 2.3E-I / calendar year 3. 1E-1 / calendar year 4.8E-1 / calendar year 3.5 / calendar year 33 / calendar year 1. Calendar year is defined as 7000 critical hours. 

Table A.1.4-4 BWR 3/4 Plant 3/4 Initiating Events Threshold Summary 

BWR 3/4 Plant 3/4 SPAR 3i (3.5E-9/hr, 2.4E-5/calendar year') BWR 3/4 Plant 3/4 RBPI Baseline (2.2E-9/hr, 1.5E-5/calendar year') Initiator Baseline Initiator Frequency Green/White Green/White White/Yellow Yellow/Red Threshold (NUREG/CR-5750) Threshold Threshold Threshold (ACDF = 1 E-4/year) 95th%ile (ACDF =I E-6/year) (ACDF =I E-5/year) Transient Initiator 1.2 / calendar year 2.2 / calendar year 1.5 / calendar year 3.7 / calendar year 26 / calendar year Loss of Feedwater 6.8E-2 /calendar year 2.OE-I /calendar year 1.0 E-I /calendar year 7.OE-I /calendar year 6.8 /calendar year Loss of Heat Sink 2.3E-1 /calendaryear 3.E-I /calendaryear 2.OE-I /calendaryear 8.0E-1 /calendaryear 7.1 /calendaryear 1. Calendar year is defined as 7000 critical hours.
....- -.w--' IA rns ',,.+., Thu.asLn1I uumm2rV II-I,A I /I...% E1V IC itA II?4IIE l IhIILIUIIIIlLVII1IINS "ONfl*.'N

BWR 3/4 Plant 5 SPAR 3i (2.OE-9/hr, I.4E-5/calendar year') S... ,• A n~t.. • Y)Dflf D~,I;-, [" ')1t_0/hr 1 SF-A/c~l~ndar vearn1 •

BJW K 3/4' P~lant[.-) R•D pi n n •as, I: ,f) \•.• -,--',,, I, ... ... ...... da ,--" 

BWR Initiator Baseline IE Frequency Green/White Threshold Green/White Threshold White/Yellow Threshold Yellow/Red Threshold 

_NUREG/CR-5750) 951%ile (ACDF =I E-6/year) (ACDF =I E-5/year) (ACDF =I E-4/year) 

Transient Initiator 1.2 / calendar year 2.2 / calendar year 1.5 / calendar year 3.9 / calendar year 28 / calendar year 

Loss of Feedwater 6.8E-2 / calendar year 2.OE- I / calendar year I.4E- I / calendar year 8.0E- I / calendar year 8.0 / calendar year 

Loss of Heat Sink 12.3 E- lI /calendaryear 3.1E-I /calendaryear 3.OE-I /calendarYear 9.6E-1 /calendaryear 8.0 /calendar year 

I, Calendar year is defined as 7000 critical hours. 

Table A.1.4-6 BWR 3/4 Plant 6 Initiating Events Threshold Summary 

BWR 3/4 Plant 6 SPAR 3i (2.8E-9/hr, 2.OE-5/calendar year') 

BWR 3/4 Plant 6 RBPI Baseline (2.4E-9/hr, 1.7E-5/calendar year') 

BWR Initiator Baseline IE Frequency Green/White Threshold Green/White Threshold White/Yellow Threshold Yellow/Red Threshold 

(NUREG/CR-5750) 95C%ile (ACDF =IE-6/year) (ACDF =IE-5/year) (ACDF =1E-4/year) 

Transient Initiator 1.2 / calendar year 2.2 / calendar year 1.5 / calendar year 3.9 / calendar year 30 / calendar year 

Loss of Feedwater 6.8E-2 / calendar year 2.OE-I / calendar year 1I .5E-1 / calendar year 9.6E-I / calendar year 8.8/ calendar year 

Loss of Heat Sink T 2.3 E-I / calendar year 3.1E-1 /calendar year I 3.OE-1 /calendar year 9.4E-I /calendar year 8.0 /calendar year

1. Calendar year is defined as 7000 critical hours.

t'Q

an n aL n L, vqý;Aji + a 9Ph aachahl qm"ma ilLI-• aI Z~ l. ." -,. LPI • u• •6 m -
"Fable A.1.4-7 BWR 3/4 Plant 8 Initiatin• E'vents Thr•hA Q...., 0- !ffEtECl.V

BWR . . .. U- II, J.31 -ui tlen(]ar year_ Initiator Baseline IE Frequency Green/White Threshold Green/White Threshold White/Yellow Threshold Yellow/Red Threshold (NUREG/CR-5750) 95th%ile (ACDF =I E-6/year) (ACDF =I E-5/year) (ACDF =1E-4/year) Transient Initiator 1.2 / calendar year 2.2 / calendar year 3.1 /calendar year 13 /calendar year 113 / calendar year Loss of Feedwater 6.8E-2 / calendar year 2.0E- I / calendar year 2.6E- I / calendar year 2.0/ calendar year 19 / calendar year Loss of Heat Sink 2.3E-1 / calendar year 3.1E-1 / calendar year 4.2E-1 / calendar year 2.1 /calendar year 19 / calendar year 1. Calendar year is defined as 7000 critical hours. 

Table A.1.4-8 BWR 3/4 Plant 11 Initiating Events Threshold Summary 

BWR 3/4 Plant 1 I SPAR 3i (4.9E-9/hr, 3.4E-5/calendar year') BWR Plant I I RBPI Baseline (5.6E-9/hr, 3.9E-5/calendar year') BWR Initiator Baseline IE Frequency Green/White Threshold Green/White Threshold White/Yellow Threshold Yellow/Red Threshold (NUREG/CR-5750) 95h%ile (ACDF =1E-6/year) (ACDF =IE-5/year) (ACDF =1E-4/year) Transient Initiator 1.2 / calendar year 2.2 / calendar year 1.3 / calendar year 2.4 / calendar year 14 / calendar year Loss of Feedwater 6.8E-2 / calendar year 2.0E- / calendar year 1.0E-I /calendar year 4.3E-1 /calendar year 3.8 /calendar year Loss of Heat Sink 2.3E-1 / calendar year 3. 1 E-1 / calendar year 2.6E-I / calendar year 6.OE-I / calendar year 4.0 / calendar year 

IW Oq11t1 ;Iin A~ r.lP A.. 1~1I.~i

BWR 3/4 Plant 8 SPAR 3i (8.7E- I 0/hr, 6.1E-6/calendar year')

--. =,U,-I JVý,"l aI %. HeIII• as• 0U0 critticali hours.
Table A.1.4-9 BWR 3/4 Plant 12/13 Initiating Events Threshold Summary 

BWR 3/4 Plant 12/13 SPAR 3i (4.2E-9/hr, 3.OE-5/calendar year') 

BWR 3/4 Plant 12/13 RBPI Baseline (3.4E-9/hr, 2.4E-5/calendar year') 

Initiator Baseline Initiator Frequency Green/White Green/White White 

(NUREG/CR-5750) Threshold Threshold Thrn 

95th%ile (ACDF =IE-6/,ear) (ACDF =

Transient Initiator 

Loss of Feedwater

1.2 / calendar year 

6.8E-2 / calendar year

'"I I I.-*L

-~ I ,xr~ I ~I I~J I ('alendar vir 2 0 /I~ calendar year L)Ictna ~ L /," ^ 1 . • • •

lYellow Yellow/Red Threshold

/Yellow eshold 

I E-5/year)

Yellow/Red Threshold 

(ACDF =I E-4/year)

-t 'Lq 'S I I catenuar year

.OnI_.,- I / c4alIlluiar - . . yea, 

FI oS,•f Heat Sink j 2.3E-1 / calendar year J3.1E-I / calendar year i.it7-i / caleiUii yu J.Ue.-,, , , -- .----- --. 

1. Calendar year is defined as 7000 critical hours. 

Table A.1.4-10 BWR 3/4 Plant 15/16 Initiating Events Threshold Summary 

BWR 3/4 Plant 15/16 SPAR 3i (5.8E-10/hr, 4.IE-6/calendar year') 

BWR 3/4 Plant 15/16 RBPI Baseline (5.3E-10/hr. 3.7E-6/calendar year') 

BWR Initiator Baseline IE Frequency Green/White Threshold Green/White Threshold White/Yellow Threshold Yellow/Red Threshold 

(NUREG/CR-5750) 95"%ile (ACDF =I E-6/year) (ACDF =I E-5/year) (ACDF =IE-4/year) 

Transient Initiator 1.2 / calendar year 2.2 / calendar year 2.1 / calendar year 10 / calendar year 90 / calendar year 

Loss of Feedwater 6.8E-2 / calendar year 2.OE-1 / calendar year 3. IE-I / calendar year 2.6 / calendar year 25 / calendar year 

ILoss of Heat Sink 2.3 E-1 / calendar year 3.1E-I / calendar year 4.8E-1 / calendar year 2.6/ calendar year 25 / calendar year

1. Calendar year is defined as 7000 critical hours.

r P-1'_ / onl~ndAr yPar 2AE-!I / calendar year 2.0 / calendar year

S. .. . . I I

Z

•' z / calendar vear

1

1 ":t / ¢,•lPndnr vaar 2.0 / calendar year ,9.A / calendar year
Table A.1.4-11 BWR 3/4 Plant 18/19 Initiating Events Threshold Summary 

BWR 3/4 Plant 18/19 SPAR 3i (3.7E-9/hr, 2.6E-5/calendar year') BWR 5/4 Plant 18/19 RBPI Baseline I2.9E-9/hr 2 .0E-5/calendar year) BWR Initiator Baseline IE Frequency Green/White Threshold Green/White Threshold White/Yellow Threshold Yellow/Red Threshold 

(NUREG/CR-5750) 95h%il~e - ACDF=IE-6/year) I ACDF =]E-5/year) ACDF =I E-4/year) 

Transient 

Loss of Feedwater 

Initiator 1 .2 / calendar year 2.2 / calendar year 1.9 / calendar year 7.2 /calendar year 60 /calendar year 

Loss of Heat Sink 

6.8E-2 / calendar year 2.OE-_I /calendar year .2E- I / calendar year 2.5 / calendar yI / calendar year 12.3E•-l / calendar ear / 3.8E-I /calendar ear 1.8 / calendar eear 1. Calendar year 1 / calendar ear is defined as 7000 critical hours. Table A.1.4-12 BWR 5/6 Plant 2 Initiating Events Threshold Summary 

BWR 5/6 Plant 2 SPAR 3i (l.2E-9/hr, 8.6E3-6/calendar year•) 

BWR 5/6 Plant 2 RBPI Baseline (l.E-9/hr, 9.9E-6/calendar year') BWR Initiator Baseline IE Frequency Green/White Threshold JGreen/White Threshold White/Yellow Threshold JYellow/Red Threshold (NRG/R570 95th°%ile (ACDF =IlE-6/year) [(ACDF =IlE-5/vear)---(A'CDF= -4y Transient Initiator 1 2/cl n a ye r 2.2 / cae d ry a . a e d ry a . alendar year 60 / calendar year L "o ~s s o f F e e d w a te r 6 .8 E - / a e d r y a , E.I/ a e d r y a..E -I / a e d r y a .7 / c l n a e r1 / c a e d r y a 

L o ss o f H- eat S in k 2 . 1 - / a e d r y a7 ,1 E a e d r y i I / calear - .13- y e r1 8 / a e d r7er1 -ca len d a r ea 

1.Calendar year is defined as 7000 critical hours.

U,)
Table A.1.4-13 BWR 5/6 Plant 5 Initiating Events Threshold Summary 

BWR 5/6 Plant 5 SPAR 3i (1.5E-9/hr, 1.1E-5/calendar year') 

BWR 5/6 Plant 5 RBPI Baseline (l.2E-9/hr, 8.5E-6/calendar year') 

Initiator Baseline Initiator Frequency Green/White Threshold Green/White Threshold White/Yellow Threshold Yellow/Red 

(NUREG/CR-5750) 95th%ile (ACDF =1E-6/year) (ACDF =I E-5/year) Threshold 

(ACDF =I1 E-4/year) 

Transient Initiator 1.2 / calendar ear 2.2 / calendaqrear 2.3 / calendar ear 12 / calendar ear 106 / calendar year 

Loss of Feedwater 6.8E-2 / calendar year 2.OE-I / calendar year 2.4E-! / calendar year 2,2 / calendar ear 22 / calendar year 

Loss of Hleat Sink 2.3E-1 / calendar • year 3.IE-I / calendar year 5.2E-1 / calend earenar cear _ea 37 / calendar ear 

1. Calendar year is defined as 7000 critical hours. 

Table A.1.4-14 BWR 5/6 Plant 8 Initiating Events Threshold Summary 

BWR 5/6 Plant 8 SPAR 3i (3.7E-9/hr, 2.6E-5/calendar year') 

BWR 5/6 Plant 8 RBPI Baseline (7.9E-9/hr, 5,6E-5/calendar year') 

Initiator Baseline Initiator Frequency Green/White Threshold Green/White Threshold White/Yellow Threshold Yellow/Red Threshold 

(NUREG/CR-5750) 951 l (ACDF =I E-6/ear) (ACDF =IE-5/-ear) (ACDF =I E-4/year) 

Transient Initiator 1.2 calendar year 2 / 1.3 / calendar year 1.5 / calendar ear 3.9 / calendar year 

osof eedwater 6 ,3.901- 

/ calendar year" 

Loss of Feedwater 6.8E-2 /caleda eaO.E1/clna er 40- aedr Ea I.O- / calendar year 7.5 E-1I / calendar year 

Loss of Heat Sink 23E /.5E-I /calendar ear 2.2E- /calendar year 8.6E-l /calendar year 

1. Calendar year is defined as 7000 critical hours.
Table A.1.4-15 B&W Plant 3 Initiating Events Threshold Summary 

B&W Plant 3 SPAR 3i (2.2E-9/hr, 1.6E-5/calendar year') B&W Plant 3 Baseline (2.3E-9/hr, 1.6E-5/calendar year') Initiator Baseline Initiator Frequency Green/White Green/White White/Yellow Yellow/Red Threshold (NUREG/CR-5750) Threshold Threshold Threshold (ACDF =I E-4/year) 95"%ile (ACDF =I E-6/year) (ACDF = 1E-5/year) Transient Initiator 9.6E-1 / calendar year 1.8 / calendar year 2.4 / calendar year 14 / calendar year 134 / calendar year Loss of Feedwater 6.8E-2 / calendar year 2.OE-I / calendar year 2.5 E-I / calendar year 2.4 / calendar year 22 / calendar year Loss of Heat Sink 9.6E-2 /calendar year 2.6E-I / calendar year 1.1E-I /calendar year 5.3E-1 /calendar year 4.7/calendar year 1. Calendar year is defined as 7000 critical hours. 

Table A.1.4-16 B&W Plant 4/5/6 Initiating Events Threshold Summary 

B&W Plant 4/5/6 SPAR 3i (2. 1 E-9/hr, 1.5E-5/calendar year') B&W Plant 4/5/6 RBPI Baseline (2.5E-9/hr, 1.7E-5/calendar year') PWR Initiator Baseline IE Frequency Green/White Threshold Green/White Threshold White/Yellow Threshold Yellow/Red Threshold 

(NUREG/CR-5750) 95"'%ile (ACDF =1E-6/y•ear) (ACDF =1E-5/year) (ACDF =1E-4/year) Transient Initiator 9.6E-1 / calendar year 1.8 / calendar year 1.2 / calendar year 2.7 / calendar year 17 / calendar year Loss of Feedwater 6.8E-2 / calendar year 2.OE- I / calendar year 2.0E- I / calendar year 1.9 / calendar year 17 / calendar year Loss of Heat Sink 9.6E-2 / calendar year 2.6E-1 /calendar year 1.OE-1 /calendar year I 4.OE-! /calendar year 3.4 / calendar year 1. Calendar year is defined as 7000 critical hours.
-. .i, 'i .,h..f4, TIiuhnId uumm2rV

Iahle A.I.4-1 I DO/ M W laU I Ini Iat" mg v. , 0• . . .

B&W Plant 7 SPAR 3i (1 .9E-9/hr, I.4E-5/calendar year') 

D III DIt "7 PH P sl1)1 ne (1 RE-q/hr 1.2E-5/calendar year')

Initiator Baseline Initiator Frequency Green/White Green/White Threshold White/Yellow Yellow/Red Threshold 

(NUREG/CR-5750) Threshold (ACDF =1 E-6/year) Threshold (ACDF =I E-4/year) 

95'0%ile (ACDF =I E-5/year) 

Transient Initiator 9.6E-I / calendar year 1.8 / calendar year 5.4 / calendar year 45 / calendar year 438 / calendar year 

Loss of Feedwater 6.8E-2 / calendar year 2.0E- 1 / calendar year 1.1 / calendar year 10 / calendar year 102 / calendar year 

ILoss of I-feat Sink 9.6E-2 / calendar year 2.6E-1 / calendar year 3.OE-I / calendar year 2.5 / calendar year 24 / calendar year 

I. Calendar year is defined as 7000 critical hours. 

Table A.1.4-18 CE Plant I Initiating Events Threshold Summary 

CE Plant 1 SPAR 3i (4.2E-9/hr, 3.0E-5/calendar year') 

CE Plant I RBPI Baseline (4.2E-9/hr, 3.OE-5/calendar year') 

Initiator Baseline Initiator Frequency Green/White Green/White Threshold White/Yellow Yellow/Red Threshold 

(NUREG/CR-5750) Threshold (ACDF =I E-6/year) Threshold (ACDF =I E-4/year) 

95t1%ile (ACDF =1 E-5/year) 

Transient Initiator 9.6E-1 / calendar year 1.8 / calendar year 3.2 / calendar year 23.0 / calendar year 222 / calendar year 

Loss of Feedwater 6.8E-2 / calendar year 2.OE-I / calendar year 7.3E-I / calendar year 7.2 / calendar year 71.2 / calendar year 

Loss of Hleat Sink 9.6E-2 / calendar year 2.6E-I / calendar year 2.6E-1 / calendar year 2.0 / calendar year 19.2 / calendar year

Calendar year is defined as 7000 critical hours.
Table A.1.4-19 CE Plant 2/3 lnitiating Events Thredhald .•,mm•

PWR Initiator Baseline IE Frequency Green/White Threshold Green/White Threshold White/Yellow Threshold Yellow/Red Threshold 

PWR~~~~~ ~~~ ennito Baeie E- - "" year [ldYelo/d Thesol (NUREG/CR-5750) 95"h%ile (ACDF = 1E-6/year) (ACDF 1E-5/year) (ACDF =I E-4/year) Transient Initiator 9.6E-2 / calendar year 1.8 / calendar year 8.2 / calendar year 72 /calendar year 720 / calendar year Loss of Feedwater 6.8E-2 / calendar year 2.0E- I / calendar year 8.0E- 1 / calendar year 12 / calendar year 120 / calendar year Loss of Heat Sink 9.6E-2 / calendar year 2.6E-1 / calendar year 2.8E-1 / calendar year 2.9 / calendar year 28 / calendar year 1. Calendar year is defined as 7000 critical hours. 

Table A.1.4-20 CE Plant 4 Initiating Events Threshold Summary 

CE Plant 4 SPAR 3i (2.6E-9/hr, 1.8E-5/calendar year') CE Plant 4 RBPI Baseline ,2.2E-9/hr, 1.6E-5/calendar year') PWR Initiator Baseline IE Frequency Green/White Threshold Green/White Threshold White/Yellow Threshold Yellow/Red Threshold (NUREG/CR-5750) 95(h%ile (ACDF =1E-6/year) (ACDF =IE-5/year) (ACDF =1E-4/year) Transient Initiator 9.6E-1 / calendar year 1.8 / calendar year 1.9 / calendar year 9.3 / calendar year 88 / calendar year Loss of Feedwater 6.8E-2 / calendar year 2.OE-1 / calendar year 5.4E-1 / calendar year 4.8 / calendar year 48 / calendar year Loss of Heat Sink 9.6E-2 / calendar year 2.6E- 1 / calendar year 2.0E- I / calendar year 1.1 / calendar year I10 / calendar year 1, Calendar vear ,--.i ik defined a• 7flnn ,-r-tioi;, 5 h'4 ,AU...

CE Plant 2/3 SPAR 3i (2.6E-9/hr, 1.8E-5/calendar year')

t'J

"--~~~~ . llv . . IV ~~" V • llv l IUUIa.

Table A.1.4-19 CE Plant 2/3 Initiating Events Thr,--.hnli IQ----
Table A.1.4-21 CE Plant 5 Initiating Events Threshold Summary 

CE Plant 5 SPAR 3i (4.OE-9/hr, 2.8E-5/calendar year') 

CE Plant 5 RBPI Baseline (2.6E-9/hr, 1.8E-5/calendar year')

IPWR Initiator Baseline IE Frequency 

(NUREG/CR-5750)

Green/White Threshold fl th :I,

Green/White Threshold t(AODF =1 F .-t6/vear•

1 75 - e l . h ii.. r I d I r A 

White/Yellow Threshold (ACDF =1 E-5/vear)

Yellow/Red Threshold I~liow/Red Threshold (ACDF =I E-4/year)

Transient Initiator 9.6E-1 / calendar year L.I / calenuar year I,, ,,' , V_ .". .. ................ ndar .... 

Loss of Feedwater 6.8E-2 / calendar year 2.OE-1 / calendar year 2.3E-I / calendar year 1.8 / calendar year 17 / calendar year 

Loss of Heat Sink 9.6E-2 / calendar year 2.6E-1 / calendar year 1,3E-1 / calendar year 1 4.4E-1 / calendar year 3.6 / calendar year 

1. Calendar year is defined as 7000 critical hours. 

Table A.1.4-22 CE Plant 10/11 Initiating Events Threshold Summary 

CE Plant 10/11 SPAR 3i (7.4E-9/hr, 5.IE-5/calendar year') 

CE Plant 10/11 RBPI Baseline (8.6E-9/hr, 6.OE-5/calendar year') 

Initiator Baseline Initiator Frequency Green/White Green/White White/Yellow Yellow/Red Threshold 

(NUREG/CR-5750) Threshold Threshold Threshold (ACDF =1 E-4/year) 

95th%ile (ACDF =IE-6/year) (ACDF =i E-5/year) 

Transient Initiator 9.6E-1 / calendar year 1.8 / calendar year 1.4/ calendar year 4.2 / calendar year 33 / calendar year 

Loss of Feedwater 6.8E-2 / calendar year 2.OE-I / calendar year 2.2E-1 / calendar year 2.0 / calendar year 20 / calendar year 

Los.o HeatSik 9.6E-2 / calendar year 2.6E-1 / calendar year 1. IE-I / calendar year 5.OE-I / calendar year 4.1 / calendar year

1. Calendar year is defined as 7000 critical hlours. 00

• /•l I __l___J ....... 1 "1 / t~ A,•~ , ,pa r ,a I ! calenoar year Ca}/ IN :l~d a,;~l y%,al
Table A.1.4-23 CE Plant 12 Initiating Events Threshold Summary

CE Plant 12 RBPI Baseline (2.7E-9/hr, 1.9E-5/calendar year') PWR Initiator Baseline IE Frequency Green/White Threshold Green/White Threshold White/Yellow Threshold Yellow/Red Threshold 

(NUREG/CR-5750) 95'h%ile (ACDF =1E-6/year) (ACDF =IE-5/year) (ACDF =1E-4/year) Transient Initiator 9.6E-1 / calendar year 1.8 / calendar year 1.6 / calendar year 7.2 / calendar year 62 / calendar year Loss of Feedwater 6.8E-2 / calendar year - 2.OE-1 / calendar year 4.2E-1 / calendar year 3.7 / calendar year 35 / calendar year Loss of Hleat Sink I 9.6E-2 / calendar year 1 2.6E-1 / calendar year I 1.2E-1 / calendar year 9.6E-1 / calendar year 8.8 / calendar year 

1. Calendar year is defined as 7000 critical hours. 

Table A.1.4-24 WE 2-Lp Plant 5/6 Initiating Events Threshold Summary 

WE 2-Lp Plant 5/6 SPAR 3i (2. 1 E-9/hr, 1.4E-5/calendar year') 

WE 2-Lp Plant 5/6 RBPI Baseline (2. IE-9/hr, 1.5E-5/calendar year') PWR Initiator Baseline IE Frequency Green/White Threshold Green/White Threshold White/Yellow Threshold Yellow/Red Threshold 

(NUREG/CR-5750) 95"'%ile (ACDF =I E-6/year) (ACDF =1E-5/year) (ACDF =1E-4/year) Transient Initiator 9.6E- I / calendar year 1.8 / calendar year 1.4 / calendar year 4.7 / calendar year 38 / calendar year Loss of Feedwater 6.8E-2 / calendar year 2.OE-I / calendar year 4.0E-i / calendar year 3.2 / calendar year 32 / calendar year Loss of Heat Sink 9.6E-2 / calendar year 2.6E-I / calendar year 1.7E-I / calendar year 9.6E-1 / calendar year 8.8 / calendar year

1 alendar year is defined as 7000 critical hours.

CE Plant 12 SPAR 3i (4.OE-9/hr, 2.8E-5/calendar year')
T.LIA 1 XJi LI P PiQn* Ini*itinui fvntThreshold Summary I IEJIL ti.i 11 L-----------

Initiator Baseline Initiator Frequency Green/White Green/White White/Yellow Yellow/Red Threshold 

(NUREG/CR-5750) Threshold Threshold Threshold (ACDF =1 E-4/year) 

95h%ile (ACDF =I E-6/year) (ACDF =I E-5/year) 

Transient Initiator 9.6E-I / calendar year 1.8 / calendar year 1.7 / calendar year 7.9 / calendar year 69 / calendar year 

Loss of Feedwater 6.8E-2 / calendar year 2.OE-1 / calendar year 6.3E-1 / calendar year 6.1 / calendar year 61 / calendar year 

Loss of Heat Sink 9.6E-2 / calendar year 2.6E-1 / calendar year 1.9E-I / calendar year 1.4 / calendar year 13 / calendar year 

1. Calendar year is defined as 7000 critical hours. 

Table A.1.4-26 WE 3-LP Plant 10/11 Initiating Events Threshold Summary 

WE 3-LP PLANT 10/11 SPAR 3i (3.2E-9/hr, 2.3E-5/calendar year') 

WE 3-LP PLANT 10/11 RBPI BASELINE (2.9E-9/hr, 2.IE-5/calendar year') 

Initiator Baseline Initiator Frequency Green/White Green/White White/Yellow Yellow/Red 

(NUREG/CR-5750) Threshold Threshold Threshold Threshold 

95t%ile (ACDF =I E-6/year) (ACDF =I E-5/year) (ACDF =I E-4/year) 

Transient Initiator 9.6E-1 / calendar year 1.8 / calendar year 1.4 / calendar year 5.0 / calendar year 41 / calendar year 

Loss of Feedwater 6.8E-2 / calendar year 2.OE-I / calendar year 3.6E-1 / calendar year 3.5 / calendar year 36 / calendar year 

Loss of Heat Sink 9.6E-2 / calendar year 2.6E-I / calendar year I .4E-1 / calendar year 8.6E-I / calendar year 8.0 / calendar year

1. Calendar year is defined as 7000 critical hours.

WE 3-LP Plant 5 SPAR 3i (6.3E-9/hr, 4.4E-5/calendar year') 11J? IElfl...~C DOM! Dn 1;n (A~ '7P-G/r A 7PA/(lpnd!'I r i-n~r'ý

,>

li J t. I A',l"-• 14 W1W ' 1-1~ P Pqlant F% Initiatingv-- Eve-nts hrsh ........ l ......
Table A.1.4-27 WE 4-Lp Plant 1/2 Initiating Events Threshold Summary

PWR Initiator Baseline IE Frequency Green/White Threshold Green/White Threshold White/Yellow Threshold Yellow/Red Threshold 

(NUREG/CR-5750) 951h%ile (ACDF =1E-6/year) (ACDF =iE-5/year) (ACDF =I E-4/year) Transient Initiator 9.6E-I / calendar year 1.8 / calendar year 1.2 / calendar year 3.2 / calendar year 24 / calendar year Loss of Feedwater 6.8E-2 / calendar year 2.OE-I / calendar year 1.9E-1 / calendar year 2.1 / calendar year 20 /calendar year Loss of Heat Sink 9.6E-2 / calendar year 2.6E-I / calendar year 9calendar alendar year 4.8E- I /calendar vear 4.0 / calendar year 

1. Calendar year is defined as 7000 critical hours. 

Table A.1.4-28 WE 4-LP Plant 10/11 Initiating Events Threshold Summary 

WE 4-LP Plant 10/11 SPAR 3i (3.5E-9/hr, 2.5E-5/calendar year') 

WE 4-LP Plant 10/11 RBPI Baseline (3.6E-9/hr, 2.SE-5/calendar year') Initiator Baseline Initiator Frequency Green/White Green/White White/Yellow Yellow/Red Threshold 

(NUREG/CR-5750) Threshold Threshold Threshold (ACDF = 1E-4/year) 95t%ile (ACDF =I E-6/year) (ACDF =I E-5/year) Transient Initiator 9.6E-1 / calendar year 1.8 / calendar year 1.8 / calendar year 8.0 / calendar year 73 / calendar year Loss of Feedwater 6.8E-2 / calendar year 2.OE-1 / calendar year 6.8E-1 / calendar year 6.4 / calendar year 64 / calendar year Loss of Heat Sink 9.6E-2 / calendar year 2.6E-1 / calendar year 2.IE-1 / calendar year 1.5 / calendar year 14 / calendar year

a.. taiiUial year is l•llllvu as t UUU crilical hours.

WE 4-Lp Plant 1/2 SPAR 3i (1.0E-8/hr, 7.2E-5/calendar year') 

WE 4-LD Plant 1/2 RBPI Baseline (1 I E-8/hr 7 5E-Vc/calndar vpnrlý
t-,)

.I.4-Lp rianti i W 4able 11 t atI Plan 2/I-Li( air, v = . 7/ 

WE 4-Lp Plant 22/23 SPAR 3i (4.7E-9/hr, 3.3E-5/calendar year') 

________________ WE 4-Lp Plant 22/23 RBPI Baseline (4.9E-9/hr, 3.4E-5/c 'endar year')__________ 

PWR Initiator Baseline IE Frequency Green/White Threshold Green/White Threshold White/Yellow Threshold JYellow/Red Threshold 

(NUREG/CR-5750) 95t`%ile (ACDF =I E-6/year) (ACDF =I E-5/year) (ACDF =I E-4/year) 

Transient Initiator 9.6E-l / calendar year 1.8 / calendar year 1.8 / calendar year 8.8 / calendar year 78 / calendar year 

Loss of Feedwater 6.8E-2 / calendar year 2.0E-1 / calendar year 8.0E-I / calendar year 7.2 / calendar year 74 / calendar year 

Loss of Heat Sink 9.6E-2 / calendar year 2.6E-1 / calendar year 2.4E-I / calendar year 1.5 / calendar year 15 / calendar year 

1. Calendar year is defined as 7000 critical hours. 

Table A.1.4-30 WE 4-LP Plant 28 Initiating Events Threshold Summary 

WE 4-LP Plant 28 SPAR 3i (5.OE-9/hr, 3.5E-5/calendar year') 

WE 4-LP Plant 28 RBPI Baseline (3.8E-9/hr, 2.7E-5/calendar year') 

Initiator Baseline Initiator Frequency Green/White Green/White Threshold White/Yellow Yellow/Red Threshold 

(NUREG/CR-5750) Threshold (ACDF =1 E-6/year) Threshold (ACDF =1 E-4/year) 

95th%ile (ACDF =1 E-5/year) 

Transient Initiator 9.6E-1 / calendar year 1.8 / calendar year 2.0 / calendar year 10 / calendar year 93 / calendar year 

Loss of Feedwater 6.8E-2 / calendar year 2.0E-1 / calendar year 1.0 / calendar year 9.9 / calendar year 99 / calendar year 

Loss of Heat Sink 9.6E-2 / calendar year 2.6E-1 / calendar year 2.7E-1 / calendar year 2.1 / calendar year 20/ calendar year 

I. Calendar year is defined as 7000 critical hours.
hle A.1.5-1 Summary of Inspection Areas Impacted by New RBPIs for Initiating Event Cornerstone I. I

Attribute

-f 4 Inspection - Area 

Equipment Performance 

Human Performance

Protection Against 

External Factors

xIurI 

General 

Transient

Tal

71111.12, Maintenance Rule Implementation 

71111.08, Inservice Inspection Activities 

71111.20, Refueling and Outage Activities 

71152, Identification and Resolution of Problems 

71111,14, Personnel Performance During Non-routine Evolutions 

None 

71111.07, Heat Sink Performance

LOFW 

LOHS

i

Inspection Area
A.2 Mitigating Systems Cornerstone

This section discusses development of RBPIs that address the mitigating systems cornerstone for 

full power, internal events. External events and non-power modes are addressed in other sections. 

A.2.1 Assess the Potential Risk Impact of Degraded Performance 

The objective of the mitigating system cornerstone is to ensure adequate performance 

(availability, reliability, and capability) of systems that mitigate initiating events to prevent 

reactor accidents. Six 'key attributes' that contribute to mitigating system performance are 

identified in SECY 99-007 (Ref. 1). These six attributes consist of configuration control, 

procedure quality, human performance, protection against external events, equipment 

performance, and design. 

A.2. 1.1 Determine Attributes That Are Risk-Significant and Explicitly Modeled 

Determination of 'risk-significant' or 'risk-based' performance indicators necessitates a means of 

quantifying the impact of that attribute. However, of the mitigating system attributes listed 

above, only equipment performance and some aspects of human performance (i.e., post initiator 

actions) are explicitly modeled and can be quantified in currently available risk models (IPE and 

SPAR). Potential performance indicators are further reduced by the fact that even though human 

performance is modeled and is shown to be risk-significant, changes in performance are not 

readily measurable. Currently there is no established method of identifying changes in operator 

performance and then feeding this information back into the SPAR models. As a result, 

equipment performance is the only mitigating system attribute that will be evaluated in this 

analysis. 

Risk-significance of modeled mitigating systems was determined through analysis of Revision 3i 

SPAR models supplemented by quantification results found in the Individual Plant Examination 

(IPE) submittals and the associated IPE Database (Ref. 5). Risk-significance of mitigating 

systems was based on importance measures. Importance information resulting from 

quantification of the models was summarized on a plant-specific basis by system/component and 

evaluated for importance to overall plant risk. Importance measure values in accordance with 

those specified in the PSA Applications Guide (Ref. 18) and Regulatory Guide 1.160 

(Maintenance Rule, Ref. 19) were utilized in the determination of risk-significance. A system 

was considered to be risk-significant at the plant level if its system level Fussell-Vesely 

Importance (FV) > 0.05. A system was also considered risk-significant if a component within 

that system yielded-a Risk Achievement Worth (RAW) > 2.0 in conjunction with a component 

level FV > 0.005. Systems that met either of these criteria were considered risk-significant at the 

individual plant level. Support systems identified in the IPE database as contributing in excess of 

five percent to overall core damage frequency were also considered important at the plant level. 

In addition to risk-significant systems, risk-significant component classes were also identified 

using a similar process. The same importance criteria were used to select component class 

indicators, however, the system level Fussell-Vesely Importance values were determined using 

the multi-variable or group function available in SAPHIRE. There are two main benefits for 

A-34
identifying component group RBPIs. The first is that trends and impacts on CDF that might not 

be detected at the individual system level might be picked up at the component group level. The 

second benefit is that the component group RBPIs can be trended across plant groups or the 

entire industry to detect early signs of deteriorating performance. Three component classes were 

identified as risk-significant. These classes include air-operated valves (AOVs), motor-driven 

pumps (MDPs), and motor-operated valves (MOVs). 

The RBPI white paper (Ref. 3) indicates that RBPI development will be performed in a manner 

to group similar plants so that a given set of RBPIs apply to the entire group. This task was 

performed in two steps. The first step was performed prior to determining risk-significance of 

specific systems. In this step all plants were grouped according to similarities in configuration 

and/or design that were expected to result in differences in systems selected as important. This 

step facilitated identification of a preliminary plant grouping based on systems that may be 

important at only a subset of plants having a particular design characteristic. The second step was 

to validate the plant groupings based on actual system importance results obtained from the 

quantified models. Due to the limited number of plants in the pilot program, only two distinct 

plant groups were identified and then validated (BWR and PWR). Additional plant grouping are 

anticipated following evaluation of the remaining plants. Additionally, as more plants are 

evaluated, it is expected that some mitigating system RBPIs may be eliminated from some plant 

groups (e.g., CCW). The list of risk-significant mitigating systems and the plant groups to which 

they are generically applicable are listed in Table A.2.l1.1-1. Systems that are risk-significant at 

only a single plant or a limited number of plants were identified in Tables A.2.4-1 through 

A.2.4-30 as plant-specific inspection candidates. 

Table A.2.1.1-1 Modeled Risk-Significant Mitigating Systems

Plant Group #1 Plant Group #2 Timely Detection of Performance 

(BWR) (PWR) Changes at the Plant Level and 

Availability of Performance Data Auxiliary/Emergency Feedwater X Yes 

Component Cooling Water X Yes' 

Emergency AC Power X X Yes 

High Pressure Coolant Injection X Yes 

Systems (HPCI, HPCS) 

High Pressure Heat Removal X Yes2 

Systems (RCIC, IC) 

High Pressure Safety Injection X Yes 

Main Feedwater X _Yes (As LOFW RBPI) Main Steam/Main Steam Isolation X Yes (As LOFW/LOHS RBPI) Power Conversion System X Yes (As LOHS RBPI) 

Power Operated Relief Valve X Yes' 

Primary Pressure Relief X X No3 

Reactor Protection System X X No' 

Residual/Decay Heat Removal X X Yes 

Service Water (To EDG/RHR) X X Yes 

Risk-Significant Component Classes 

Air-Operated Valves X X Yes 

Motor-Operated Valves X X Yes 

Motor-Driven Pumps X X Yes 

A-35
I Marginal RBPI candidate, may be removed following evaluation of additional plants and/or data. 

2 The Isolation Condenser was provisionally added as a 'Mitigating System' performance indicator at the five 

units that comprise the BWR 1/2/3 class based on importances calculated in original IPE submittals. The 

inclusion of this system as an RBPI will be re-evaluated following completion of Revision 3 SPAR models 

for these plants. 

3 Timely detection of performance at the plant level is not feasible due to sparseness of data. 

4 The Reactor Protection System (RPS) has substantial safety implications if performance degrades 

significantly. However, the RPS is not included as a candidate RBPI due to significant differences between 

the level of detail found in the SPAR 3i logic and level at which failure data is reported in EPIX. The 

current SPAR 3i models through which the RBPI thresholds are calculated have limited detail in the RPS 

system logic. The BWR models contain four hardware events and the PWR models contain three events. 

EPIX contains extensive amounts of failure data associated with dozens of components in the RPS system 

but at a much lower level of detail. Without significant modification to the SPAR 3i RPS logic to 

incorporate lower levels of data, it is not feasible to incorporate updated EPIX failure data into the RPS 

models so that changes in performance can be quantified and tracked. 

A.2.1.2 Determine Monitoring Levels for Each Element 

Performance can be monitored using indicators at different levels, ranging from the function 

level comprising multiple systems down to the level of the individual component failure mode. 

Higher level (e.g., function or system level) indicators have certain positive attributes: they allow 

for more licensee flexibility than lower level indicators, and provide more apparent coverage per 

indicator, resulting in fewer indicators for a given level of apparent coverage than would be 

needed using lower-level indicators. However, in some areas, certain practical considerations 

compel the selection of indicators at a lower level. In these areas, train-level indicators are used. 

Train-level indicators are further broken down into unreliability and unavailability indicators. 

The following discussion addresses the practical considerations that lead to selection of train

level indicators. 

The use of a single indicator above the train level is inappropriate for systems with dissimilar 

trains. Table A.2.1.2-1 illustrates this point with an example of an Auxiliary Feedwater System 

consisting of a diesel-driven pump train and a motor-driven pump train. The dominant accident 

scenarios associated with this plant are associated with LOOP events, especially events in which 

on-site AC power is also lost. If AC motive power is not available, the AC-driven pump train 

performance is moot, and the diesel-driven pump train performance is especially important. This 

argument suggests that changes in CDF due to decreases in AFW system performance are much 

more sensitive to degradation of the diesel driven train performance than to an equivalent change 

in AFW system performance due to degradation of performance of the motor-driven train. This is 

reflected in the values in Table A.2.1.2-1. These differences are due to the mission specific 

nature of the different trains. Therefore, to accurately reflect the risk implications of a given 

change in performance, separate indicators are required for dissimilar trains of a given system. 

For similar reasons, systems that have train specific loads such as emergency AC power lend 

themselves well to train level unavailability indicators. Many service water and component 

cooling water systems also have train specific loads (i.e., lack of a single common header) and 

are better addressed with train level indicators.

A-36
Additionally, failures at the train level are much more frequent than system-level failures of 

multiple-train systems. Thus, the timely detection of performance trends at the train level is 

typically much more feasible than at the system level. 

Table A.2.1.2-1 Auxiliary Feedwater System Example of the Differing Impacts of 

Dissimilar Trains on CDF 

AFW System Top Event Probability 3.7E-4 5.OE-4 1.OE-3 5.OE-3 

(Nominal) 

ACDF Associated with Degradation of ACDF = 0.0/year ACDF = 5.6E-6/year 6CDF = 1.1E-4/year ACDF = 8.7E-4/year 

Diesel-Driven Pump (DDP) Train 

Performance Only. 

ACDF Associated with Degradation of CDF = 0.0/ye ACDF - 3.5E-7/year CDF = 6.7E-6/year ACDF = 5.8E-5/yeai 

Motor-Driven Pump (MDP) Train 

Performance Only _ _ 

Separate indicators for unreliability and unavailability are also appropriate because the 

relationship between system performance and CDF is highly dependent on whether reliability or 

availability is causing the change in system performance. The difference arises because train 

unavailability is somewhat constrained by Technical Specifications, while reliability is not. In the 

calculation of CDF, Technical Specifications are assumed to be followed explicitly, and cutsets 

with disallowed maintenance combinations are eliminated from the CDF cutset tabulations. 

Table A.2.1.2-2 illustrates the results of this process. This table shows that CDF is more sensitive 

to EPS reliability than to EPS availability. 

Another difference between the significance of unavailability changes and unreliability changes 

arises as a result of common cause failure (CCF). As modeled, an increase in a specific train's 

unreliability affects CDF not only through the increased probability of failures of that train, but 

also through the increased probability of common cause failures of redundant trains. 

Unavailability does not behave in the same way; as discussed above, concurrent unavailability of 

redundant trains is limited by technical specifications. 

Therefore, a single train-level performance indicator that combines unreliability and unavailability 

is inadequate to address the risk implications of changing system performance. 

Table A.2.1.2-2 Emergency Power System Example of the Differing Impacts of Unavailability 

and Unreliability on CDF 

Emergency Diesel Generator Top Event 4.6E-2 (Nominal) 5.OE-2 1.OE-1 5.OE- I Probability 

ACDF Generator Associated with Degradation of Diesel ACDF = 0.0/year ACDF = 6.3E-7/year ACDF = 9.1E-6/year ACDF = 7.6E-5/yea Availability {UA) Only 

ACDF Associated with Degradation of ACDF = 0.0/year ACDF = 1.1E-6/year ACDF = 2.4E-5/year CDF = 5.8E-4/year Diesel Generator Reliability (UR) Only I I I _ _I 

Other considerations also support the use of train level unavailability indicators. SECY 99-007 

also identifies reliability and availability as the two specific elements associated with equipment 

performance. Maintenance is normally performed on the train level and is intrinsically 

recognizable as such to plant personnel. This fact is also incorporated in the SPAR models with

A-37
their placement of test and maintenance events at the train level. Additionally, WANO reports 

unavailability at the train level. 

There are some shortcomings in using train level performance indicators. A few system fault 

trees in the SPAR models include common cause failures (CCF) at the system level. Since CCF 

events are often significant contributors to overall system unreliability, system level unreliability 

indicators would more closely mimic actual CDF changes. Finally, non-redundant systems are 

typically best addressed at the system level. For example, the key safety function of PORVs at 

some plants requires success of 2/2 PORVs, so that if either PORV fails, the function fails. 

Table A.2.1.2-3 identifies the risk-significant systems, elements and the level of the associated 

performance indicator. 

Table A.2.1.2-3 Candidate Mitigating System RBPIs and Monitoring Level 

BWR RBPI SYSTEMS RBPI Level 

Emergency AC Power (EPS) Unreliability and unavailability both monitored at the train level. 

High Pressure Coolant Injection Systems Unreliability and unavailability both monitored at the train level. 

• High Pressure Coolant Injection (HPCI) 

• High Pressure Core Spray (HPCS) 

High Pressure Heat Removal Systems Unreliability and unavailability both monitored at the train level. 

• Isolation Condenser (IC) 

* Reactor Core Isolation Cooling (RCIC) 

Residual Heat Removal (SPC, RHR) Unreliability and unavailability both monitored at the train level. 

Service Water (SWS) Unreliability and unavailability both monitored at the train level. 

PWR RBPI SYSTEMS 

Auxiliary Feedwater (AFW/EFW) 

* Motor-driven Pump Train Unreliability and unavailability both monitored at the train level. 

* Turbine-driven Pump Train Unreliability and unavailability both monitored at the train level. 

Component Cooling Water (CCW) Unreliability and unavailility both monitored at the train level. 

Emergency AC Power (EPS) Unreliability and unavailability both monitored at the train level. 

High Pressure Injection (HPI) Unreliability and unavailability both monitored at the train level. 

Power Operated Relief Valve (PORV) Unreliability monitored at the system level. 

Residual/Decay Heat Removal (RHR) Unreliability and unavailability both monitored at the train level. 

Service Water (SWS) Unreliability and unavailability both monitored at the train level. 

COMPONENT CLASSES (all plants) 

Air-Operated Valves (AOVs) Unreliabili monitored at the component level. 

Motor-Operated Valves (MOVs) Unreliability monitored at the component level. 

Motor-Driven Pumps (MDPs) Unreliability monitored at the component level. 

A.2.2 Obtain Performance Data for Risk-Significant, Equipment-Related Elements 

The analysis of mitigating system performance also relies on several data sources. The primary 

data sources used in the selection of, and their contribution to, the analysis of mitigating system 

RBPIs are described below: 

The Equipment Performance and Information Exchange database (EPIX) is an industry

sponsored effort to collect performance information for key components in or affecting risk

significant systems as identified in plant maintenance rule programs. EPIX (Ref. 15) is a 

replacement for the Nuclear Plant Reliability Data System (NPRDS) database. (Data reporting to 

NPRDS stopped at the end of 1996.) All nuclear utilities have submitted some reliability data for 

A-38
entry into EPIX. The current RBPI pilot effort uses EPIX data to support the evaluation of 

mitigating system unreliability RBPIs. 

The Reliability and Availability Data System (RADS) interfaces with established data sources to provide risk analysis capability for use with risk-informed applications and regulations. RADS (Ref. 16) takes this raw failure, demand, and unavailability information, and manipulates it to yield reliability parameters that can be used in PRA analyses. Availability data will also be available in RADS in the near future. RADS reports these data on a component or train level for 

a specified selection of key systems and components. RADS also estimates CCF rates and performs trending analyses. Other uses include monitoring maintenance rule implementation, supporting plant-specific licensing actions, and improving accident sequence precursor analyses. The current RBPI pilot effort uses RADs to screen data to support the evaluation of mitigating 

system unreliability RBPIs. 

System reliability studies (Refs. 9, 10, 11, 12, 13 and 14) have been and are being conducted to systematically evaluate operational data of risk-significant systems at nuclear power plants. The primary objectives of the studies are twofold. The first objective is to estimate system unreliability based on operational data and then to compare the results with data, models, and assumptions used in IPEs. The second is to provide an engineering analysis of the factors affecting system unreliability and to determine any trends or patterns. Other objectives include identification of failure trends over time and generation of baseline performance data from which to compare industry-wide and plant-specific performance. In addition to containing the most 

current data failure available for these systems, the failure data contained in these studies has been extensively analyzed to retain only valid failures and to accurately characterize the nature of those failures. This data was incorporated into the SPAR models as part of the process of establishing plant-specific 'baseline' models and associated core damage frequencies. 

A.2.3 Identify Indicators Capable of Detecting Performance Changes in a Timely Manner 

In addition to being risk-significant (see Table A.2.1.1-1), mitigating system performance indicators must be capable of detecting performance changes in a timely manner. A mitigating system performance indicator involves collection of data during some monitoring period, and a decision rule, which declares that a plant is in a certain performance band based on observed data. This monitoring period must be long enough to reduce the probabilities of false negatives and false positives to acceptable levels, but no longer. Appendices E and F document these 

statistical analyses. 

In accordance with the preceding discussion and the statistical analyses documented in 

Appendices E and F, several mitigating systems/component classes met the criteria for risk significance and timely monitoring and were selected as candidates to be monitored as mitigating system RBPIs. Monitoring periods of reasonable length were also calculated based on acceptable levels of false positives and negatives. Additionally, changes in their frequencies can be readily quantified with the current SPAR models. These systems and component classes are identified in 

Table A.2.1.2-1.

A-39
Some risk-significant systems were considered best monitored as initiating event RBPIs. These 

systems are discussed in Section A.2.3.1. In addition to these systems, one other risk-significant 

system identified in Table A.2.1.1-1 was not considered to be a good candidate for mitigating 

system RBPIs. This system, the primary pressure relief system, was excluded due to the 

sparseness of data and the resulting excessive monitoring periods. It will be consigned to risk

informed baseline inspections. 

A.2.3.1 Treatment of Systems Whose Function Is Monitored under Initiating Event RBPIs 

Main feedwater, power conversion and main steam are risk-significant systems whose functions 

are best monitored under the LOHS and LOFW initiating event RBPIs. Several factors combine 

to prevent these systems from being good mitigating system RBPI candidates and lead to 

monitoring of their performance within the LOHS and LOFW RBPIs. 

First, these systems are continuously operational during normal power operations and function 

with little or no redundancy. This lack of redundancy precludes generating an unavailability 

indicator since there is no standby equipment. Additionally, since there is no standby equipment, 

some types of failure data associated with testing of standby equipment (e.g., failure to start) is 

sparse. Finally, failure of any major component within these systems results in an immediate 

plant trip or shutdown. The impact of these trips and shutdowns is explicitly monitored through 

the LOHS and LOFW RBPIs. 

A.2.3.2 Industry-wide Trending of Mitigating Systems 

Similar to mitigating system RBPIs, candidates for industry-wide trending must also be risk

significant. In addition to the mitigating system RBPIs identified in Table A.2.1.2-1, common 

cause failure (CCF) events were also included as potential candidates for industry-wide trending. 

Analysis of the SPAR model results indicate that CCF events associated with Auxiliary/ 

Emergency Feedwater pumps and emergency diesel generators are significant contributors to 

risk. Since these events do not occur frequently enough to track on a plant-specific basis they 

will be trended industry-wide. Other system specific CCF categories may be added as additional 

plants are evaluated. Finally, CCF events associated with all systems are as a group very risk

significant and will also be trended. The mitigating system industry-wide trending candidates are 

listed below: 

0 All systems and component classes identified in Table 3.1.2.1 as RBPIs 

a Common Cause Failure Events for Auxiliary Feedwater Pumps 

0 Common Cause Failure Events for Emergency Diesel Generators 

• Common Cause Failure Events for All Systems 

The mitigating system RBPIs are trended in Table 5.3-7 of the main body of the report. Trends 

associated with non-RBPI events (Common Cause Failures) are shown below in 

Figures A.2.3.2-1 through A.2.3.2-3.

A-40
0.12

0.10 -- 90% confidence band on the rate 

75 0.08 

0 0.06 

0.04 

0 .0 2 ----------

0.02 • - . . ,. . . ,- .. . . . .. -i .-. , 

0.00 ------------- - - - - - - - -

1984 1985 1986 1987 1988 1989 1990 1991 1992 1993 1994 1995 

Year GCoO •5,11 

Figure A.2.3.2-1 Time-dependent Trending of CCF Events for Auxiliary Feedwater 

Pumps (Trend is not statistically significant, p-value = 0.2.)

0.12 

0.10 I

"a 0.08 

U 

L_ 

0 0.06 

L) 

CO, 

-C 0.04 

w 

0.02 

0.00

1984 1985 1986 1987 1988 1989 1990 1991 1992 1993 1994 1995 

Year GCOO o4s 9 

Figure A.2.3.2-2 Time-dependent Trending of CCF Events for Emergency Diesel 

Generators (Trend is not statistically significant, p-value = 0.3.)

A-41
0.50 0 MLE and 90% confidence interval 

Fitted rate --- 90% confidence band on the rate "-0.40 " 

ca 

.E0.30 U.5 

0 

. 0.20" 

> 

0.10 

0.00 

1984 1985 1986 1987 1988 1989 1990 1991 1992 1993 1994 1995 

Year GC 00465 10 

Figure A.2.3.2-3 Time-dependent Trending of CCF Events for All Systems 

(Trend is statistically very significant, p-value < 0.0001.) 

A.2.4 Identify Performance Thresholds Consistent with a Graded Approach to 

Performance Evaluation from SECY 99-007 

The same graded approach outlined in Section A. 1.4 for Initiating Event RBPI thresholds is also 

used for setting mitigating system RBPI thresholds. This graded approach is built around four 

performance bands (green, white, yellow, red) whose boundaries correspond to plant-specific 

changes in CDF equal to 1E-6/yr, 1E-5/yr and 1E-4/yr. 

Again, the same 'baseline' models defined in Section A. 1.4 and used to identify Initiating Event 

thresholds are also used to identify mitigating system thresholds. An iterative technique was 

once more employed to determine the exact mitigating system thresholds. System specific 

unavailability thresholds were determined by simultaneously increasing all train level test and 

maintenance probabilities (for similar trains) within the subject system until the appropriate 

change in CDF was reached. Unreliability thresholds were determined by simultaneously 

increasing the random failure probabilities of all system specific equipment tracked in EPIX until 

the appropriate change in CDF was reached. For the unreliability calculations, the test and 

maintenance probabilities were kept constant at their baseline values. See Appendix H for more 

details. 

Once the performance action band boundary is reached, the unreliability threshold value is 

calculated by quantifying the fault tree gate that corresponds to that train/system. The 

unavailability threshold is calculated similarly to the unreliability threshold except that only the 

test and maintenance (T&M) events are increased and the value of the T&M event then becomes 

the threshold. "Not Reached" in the threshold summary tables indicates an inability to reach the

A-42
subject performance action band boundary with the train/system failed. In some instances 

(identified with an accompanying footnote), a "Not Reached" corresponding to an unavailability 

threshold indicates an inability to reach the subject performance action band boundary while 

staying within allowable Technical Specification maintenance combinations. 

Mitigating system RBPIs were selected and their threshold values calculated for 30 sites (44 

plants). These sites are comprised of 19 BWR and 25 PWR plants. Detailed threshold 

information for each analyzed plant is contained in Tables A.2.4-1 through A.2.4-30. 

A.2.5 Inspection Areas Covered by New RBPIs 

The RBPIs developed in this report for the mitigating system cornerstone were compared with 

the performance indicators in the ROP to identify those RBPIs that are not currently in the ROP. 

The inspection areas that could be impacted by the new mitigating system RBPIs were then 

determined. The results are summarized in Table A.2.5-1. 

A.3 Barrier Integrity Cornerstone: Containment 

This section presents the background for the preliminary RBPI development results that address 

the containment integrity portion of the barrier integrity cornerstone for full power, internal 

events. The scope of the structures, systems, and components related to the containment barrier 

includes the primary and secondary containment buildings, primary containment penetrations and 

associated isolation systems, and risk-significant systems and components necessary for 

containment heat removal, pressure control, and degraded core hydrogen control. This section is 

focused on the containment barrier itself, and bypass of the containment barrier (for example, by 

steam generator tube rupture) is not considered in this section. 

The section is structured in a manner similar to that for Section A.2, Mitigating Systems 

Cornerstone, and follows the RBPI development process described in the main report. A special 

subsection is added, Section A.3.6, that addresses: 

• The definition of LERF 

* The justification for using LERF 

In discussion of the initiating events cornerstone and the mitigating systems cornerstone, 

emphasis was placed on CDF as the metric for defining the risk significance of changes. In this 

section, LERF is used as the metric for determining the risk significance of changes in 

containment performance. However, the burden of this section is containment integrity, not 

LERF in general. Many influences on LERF need to be addressed under other cornerstones. To 

clarify this point, it is useful to classify hardware and human performance elements according to 

a recent development carried out for the SDP.

A-43
Table A.2.4-1 BWR 123 Plant 1/2 Mitigating Systems Threshold Summary 

BWR 123 Plant 1/2 SPAR 3i (3.7E-9/hr, 2.6E-5/calendar year') 

BWR 123 Plant 1/2 RBPI Baseline (6.9E-l0/hr, 4.8E-6/calendar year') 

System/Component Baseline Train Unavailability Green/White Threshold Green/White Threshold White/Yellow Threshold Yellow/Red Threshold 

and Unreliability 951h%ile (ACDF = I E-6/year) (ACDF =I E-5/year) (ACDF = I E-4/year) 

Emergency AC Power (EPS) (Train Unreliability') 6.OE-2 1.4E-I 4.5E-2 7.6E-2 1.6E-I 

(Train Unavailability) 9.7E-3 6.OE-2 5.5E-2 1.9E- I Not Reached6 

Isolation Condenser3

" (Train Unreliability) 2.1 E-2 6.2E-2 4.8E-2 Not Reached Not Reached 

Diesel Generator Emergency (Train Unreliability2 ) 2.2E-2 7.7E-2 3.4E-2 l.OE-1 3.5E-I 

Service Water (DG ESW) (Standby Train Unavail.) 1.8E-2 7.2E-2 4.2E-2 2.1 E- I Not Reached 

HPCI (HCI) (Train Unreliability2

'

4) 5.3E-2 1.OE-1 4.5E-I Not Reached Not Reached 

(Train Unavailability) 9.7E-3 6. I E-2 3.9E-1 Not Reached Not Reached 

Residual Heat Removal (SPC) (Train Unreliability) i.5E-2 4.1 E-2 2.4E-2 7.2E-2 2.2E- I 

(Train Unavailability) 1.OE-2 9.8E-3 Not Reached6 Not Reached6 Not Reached6 

Containment Cooling Service (Train Unreliability) 2.2E-2 7.7E-2 9. I E-2 3.OE- 1 6.0E- 1 

Water (CSW to RHR HTX's) (Train Unavailability) 1.8E-2 7.7E-2 Not Reached Not Reached Not Reached 

AOVs Component Class Unreliability N/A Increase 40X Not Reached Not Reached 

MOVs 4 Component Class Unreliability N/A Increase 3.3X Increase 9.7X Increase 19X 

MDPs Component Class Unreliability N/A Increase 3.9X Increase 20X Increase 65X

1. 

2. 

3. 

4. 

5. 

6.

Calendar year is defined as 7000 critical hours. 

Total unreliability, includes test and maintenance (TM) contribution. 

TM not modeled in this system. 

HIPCI Injection valve reopening failure was excluded from consideration due to its unique failure mechanism and probability 

Isolation Condenser unavailability not calculated. (page 13, INEL-95/0478) 

This threshold can be reached if the T&M outages associated with this system are not confined to TECH SPEC allowable combinations.
Table A.2.4-2 BWR 3/4 Plant 1 Mitigating Systems Threshold Summary

BWR 3/4 Plant I SPAR 3i (3.5E-10/hr, 2.4E-6/calendar year') 

BWR 3/4 Plant I RBPI Baseline (3. IE-10/hr, 2.2E-6/calendar year')

System/Component Baseline Train Unavailability Green/White Threshold Green/White Threshold White/Yellow Threshold Yellow/Red Threshold 

and Unreliability 951h%ile (ACDF =I E-6/year) (ACDF =1E-5/year) (ACDF =I E-4/year) 

Emergency AC Power (EPS) (Train Unreliability2 ) 4.4E-2 9.6E-2 3.7E-1) 5.2E-1 7. IE-I 

(Train Unavailability) 9.7E-3 6.2E-2 Not Reached' Not Reached' Not Reached' 

Reactor Core Isolation (Train Unreliability2 .4) 8.8E-2 1.7E-1 1.4E-1 5.1E-l Not Reached 

Cooling (RCI) (Train Unavailability) 1.3E-2 6.4E-2 1.6E-1 7.9E-I Not Reached 

Essential/Emergency Service (Train Unreliability2) 2.2E-2 7.4E-2 7.8E-1 Not Reached Not Reached 

Water (ESW to EDGs) (Train Unavailability) 1.8E-2 5.3E-2 Not Reached 6 Not Reached 6 Not Reached 6 

HSW (RHR Service Water) (Train Unreliability2) 2.2E-2 7.2E-2 6.2E-1 8.3E-1 Not Reached 

(Train Unavailability) 1.8-2 8.1 E-2 Not Reached' Not Reached' Not Reached5 

HPCI (HCI) (Train Unreliability2

'

3 ) 2.3E-! 4.4E-1 2.7E-1 5.5E-I Not Reached 

(Train Unavailability) 9.7E-3 6.0E-2 3. IE-I Not Reached Not Reached 

Residual Heat Removal (SPC) (Train Unreliability2) 1.5E-2 3.OE-2 2.3E-I Not Reached Not Reached 

(Train Unavailability) I.OE-2 9.2E-3 Not Reached5 Not Reached' Not Reached5 

AOVs Component Class Unreliability N/A Increase 220X Not Reached Not Reached 

MOVs 3 Component Class Unreliability N/A Increase 3.6X Increase 19X Not Reached 

MDPs Component Class Unreliability N/A Increase 27X Increase 120X Increase 195X

Calendar year is defined as 7000 critical hours. 

Total unreliability, includes test and maintenance (TM) contribution. 

HPCI Injection valve reopening failure was excluded from consideration due to its unique failure mechanism and probability 

RCIC turbine restart failure was excluded from consideration due to its unique failure mechanism and probability. 

This threshold can be reached if the T&M outages associated with this system are not confined to TECH SPEC allowable combinations. 

Thresholds not reached due to redundancy of ESW and HSW from all 3 plants.

I. 

2. 

3. 

4. 

5. 

6.
Table A.2.4-3 BWR 3/4 Plant 2 Mitigating Systems Threshold Summary 

BWR 3/4 Plant 2 SPAR 3i (5. IE-10/hr, 3.5E-6/calendar year') 

BWR 3/4 Plant 2 RBPI Baseline (3.8E-IO/hr, 2.7E-6/calendar year') 

System/Component Baseline Train Unavailability Green/White Threshold Green/White Threshold White/Yellow Threshold Yellow/Red Threshold 

and Unreliability 95'6%ile (ACDF =I E-6/year) (ACDF =I E-5/year) (ACDF =I E-4/year) 

Emergency AC Power (EPS) (Train Unreliability2 ) 4.4E-2 9.6E-2 8.9E-2 2.4E-1 4.9E-1 

(Train Unavailability) 9.7E-3 6.0E-2 4.2E-1 Not Reached5 Not Reached5 

Reactor Core Isolation (Train Unreliability2

'

4) 7.9E-2 1.7E-1 1.2E-1 4.7E-I Not Reached 

Cooling (RCI) (Train Unavailability) l.3E-2 2.9E-2 1.4E-i 7.2E-I Not Reached 

Essential/Emergency Service (Train Unreliability2) 2.2E-2 7.OE-2 7.9E-1 Not Reached Not Reached 

Water (ESW to EDGs) (Train Unavailability) I.8E-2 5.3E-2 Not Reached6 Not Reached6 Not Reached6 

HSW (RHR Service Water) (Train Unreliability2 ) 2.2E-2 7.5E-2 1.2E-I 4.6E-! 7.2E-I 

(Train Unavailability) 1.8E-2 7.6E-2 8.9E-1 Not Reached5 Not Reached5 

HPCI (HCI) (Train Unreliability2

"

3 ) 2.3E-1 4.4E-1 2.7E-1 5.6E-1 Not Reached 

(Train Unavailability) 9.7E-3 5.9E-2 3.2E-1 Not Reached Not Reached 

Residual Heat Removal (Train Unreliability2 ) 1.5E-2 3.0E-2 2.3E-1 7.8E-1 Not Reached 

(SPC) (Train Unavailability) I.OE-2 1.1 E-2 Not Reached' Not Reached5 Not Reached5 

AOVs Component Class Unreliability N/A Increase 210X Not Reached Not Reached 

MOVs3 Component Class Unreliability N/A Increase 8. IX Increase 37X Increase 76X 

MDPs Component Class Unreliability N/A Increase 22X Increase 87X Increase 150X

I . 

2. 

3. 

4. 

5. 

6.

Calendar year is defined as 7000 critical hours. 

Total unreliability, includes test and maintenance (TM) contribution. 

HPCI Injection valve reopening failure was excluded from consideration due to its unique failure mechanism and probability 

RCIC turbine restart failure was excluded from consideration due to its unique failure mechanism and probability. 

This threshold can be reached if the T&M outages associated with this system are not confined to TECH SPEC allowable combinations. 

Thresholds not reached due to redundancy of ESW and HSW from all 3 plants.
Table A.2.4-4 BWR 3/4 Plant 3/4 Mitigating Systems Threshold Summary 

BWR 3/4 Plant 3/4 SPAR 3i (3.5E-9/hr, 2.4E-5/calendar year') BWR 3/4 Plant 3/4 RBPI Baseline (2.2E-9/hr, 1.5E-5/calendar year') System/Component Baseline Train Unavailability Green/White Threshold Green/White Threshold White/Yellow Threshold Yellow/Red Threshold and Unreliability 951h%ile (ACDF =I E-6/year) (ACDF =I E-5/year) (ACDF =1E-4/year) Emergency AC Power (Train Unreliability2

) 3.9E-2 9.7E-2 4. I E-2 5.9E-2 1.4E-1 (EPS) (Train Unavailability) 9.7E-3 5.8E-2 4.2E-2 7.OE-2 3.6E- I 

Reactor Core Isolation (Train Unreliability 2

,

5) 7.9E-2 1.7E- 1 1.7E-1 7.6E-1 Not Reached 

Cooling (RCI) (Train Unavailability) 1.3E-2 2.9E-2 l.8E-I Not Reached Not Reached 

Nuclear Service Water (Train Unreliability 2

) 2.5E-2 7.7E-2 2.7E-3 6.9E-2 8.4E-1 

(NSW to EDGs) (Standby Train Unavail) 1.8E-2 6.8E-2 Not Reached Not Reached Not Reached 

HPCI (HCI) (Train Unreliability2,

4 ) 2.4E- 1 4.4E- 1 2.5E-I 3.7E- 1 7.5E- I (Train Unavailability) 9.7E-3 5.8E-2 2.5E- 1 4.2E- I Not Reached 

Residual Heat Removal (Train Unreliability7

) 5.OE-3 I .3E-2 7.0E-3 2.2E-2 9.6E-2 

(SPC) (Train Unavailability 7

) 2.9E-2 6.3E-2 Not Reached 6 Not Reached 6 Not Reached 6 

AOVs Component Class Unreliability N/A Increase 7.IX Increase 3.7X Increase 126X 

MOVs4 Component Class Unreliability N/A Increase 1. IX Increase i.3X Increase 4.6X 

MDPs Component Class Unreliability N/A Increase 3.1X Increase 17X Increase 57X 1 I fl. I.....In A Ar~I

2. 

3. 

4. 

5. 

6. 

7.

,.al•eLnaI ye;ar 1 UsdellU ina /UUU 0critical flours. 

Total unreliability, includes test and maintenance (TM) contribution. 

TM not modeled in this system. 

HPCI Injection valve reopening failure was excluded from consideration due to its unique failure mechanism and probability RCIC turbine restart failure was excluded from consideration due to its unique failure mechanism and probability. This threshold can be reached if the T&M outages associated with this system are not confined to TECH SPEC allowable combinations. 

RHR train for UA is defined at the heat exchanger (2 pump) level, RHR train for UR is defined at the individual pump level.

--.,
-.. . - . -A rri;r'1/,4 DL...* Thurpghnld uumm2rv aMe L.-4- D VVI1 j lant 1vIza t "' 152 L3: -m 

BWR 3/4 Plant 5 SPAR 3i (2,OE-0/hr, I.4E-5/calendar year') hAlt "/I,4 DI DI~DI f~ellnro ('3 '3F-./hr 1 '•P-S/cale~ndar vear1 )

System/Component Baseline Train Unavailability Green/White Threshold Green/White Threshold White/Yellow Threshold Yellow/Red Threshold 

And Unreliability 9 51h %ile (ACDF =I E-6/year) (ACDF= I E-5/year) (ACDF= I E-4/year) 

Emergency AC (Train Unreliability2) 4.5E-2 2.2E-1 5.OE-2 7.9E-2 2.4E- 1 

Power (Train Unavailabilit!) 9.7E-3 1.9E-2 1.7E-2 8.5E-2 7.2E- I 

Reactor Core (Train Unreliability") 7.9E-2 L.OE-I L.IE-1 3.2E- I Not Reached 

Isolation Cooling' (Train Unavailability) 1.3E-2 4.0E-2 5.OE-2 3.7E-I Not Reached 

Service Water (ESW (Train Unreliability ) 2.3E-2 7.4E-2 2.8E-2 6.6E-2 2.3E-1 

to EDGs and RHR) (Train Unavailabilit') 1.8E-2 5.6E-2 2.6E-2 I.IE-I 8.4E-I 

High-Pressure (Train Unreliability') 2.2E- I 4.2E- I 2.3E-1. 3.0E-1 Not Reached 

Coolant Injection (Train Unavailability,) 9.7E-3 3.8E-2 6.3E-2 5.3E- I Not Reached 

Residual Heat (Train Unreliability23) 5.OE-3 9.9E-3 6.5E-3 1.8E-2 8,6E-2 

Removal (SPC) (Train Unavailability) 1.OE-2 2.5E-2 2.2E-2 1.2E-I Not Reached6 

AOVs Component Class Unreliability N/A Increase 3.OX Increase 19X Increase I 15X 

MOVs 4 Component Class Unreliability N/A Increase I.2X Increase 2.6X Increase 7.3X 

Ps -- -- Component Class Unreliability N/A Increase 1.6X Increase 6.2X Increase 38X

I. Calendar year is defined as 7000 critical hours. (ACVtF is calcuiatea in calendar years). 

2. Total unreliability includes test and maintenance (TM) contribution. 

3. RHR train for UA is defined at the heat exchanger (2 pump) level; RHR train for UR is defined at the individual pump level. 

4. HPCI injection valve reopening failure was excluded from consideration due to its unique failure mechanism and probability. 

5. RCIC turbine restart failure was excluded from consideration due to its unique failure mechanism and probability. 

6. This threshold can be reached if the T&M outages associated with this system are not confined to TECH SPEC allowable combinations. 00

i
Table A.2.4-6 BWR 3/4 Plant 6 Mitigating Systems Threshold Summary 

BWR 3/4 Plant 6 SPAR 3i (2.8E-9/hr, 2 .0E-5/calendar year) System/Component Baseline Train Unavailability BWR 3/4 Plant Green/White 6 RBPI Baseline (2.4E-9/hr, 1.7E-5/calendar year) Threshold Green/White Threshold White/Yellow Threshold Yellow/Red Threshold And Unreliability 951h%ile (ACDF=IE-6/year) (ACDF=IE-5/gear Emergency AC Power (Train Unreliability) (ACDF=IE-4/year) 3.9E-2 2.3E-1 4.5E-2 8.8E-2 2.8E-! (Train Unavailabilit1 9.7E-3 Reactor Core Isolation .(Train Unreliability2.4) 7.9E-2 

.9E-2 2.3E-2 1.5E-I Not Reached' 1.6E-1- 1.7E- I 7.6E- I Not Reached 

Coln 

Essential/Emnergency 

(Train Unavailability 1.3E-2 4.013-2 5.3 E-2 Not Reached--' Not Reached 

Sevc Wae 

(Train Unreliability') 2.5- 8.3E-2 2.713-2 4.413-2 1.613-1 t Ds TanUnviaiiX 

High-Pressure Coolant (Train Unreliability'-') 2.4E5]-I 

.1- 7.713-2 2.3 E-2 5.9E-2 1.6-

1.6 ,13 E o eache 

I n -( e t o H r ~ i n v i a i i . E 33 ,8 1 3- 2 9 .0 1 3- 28 .1 E - 1 N o t R e a c h e d Residual 

SPC, 

Heat Removal (System Unreliability') 1.7E-2 3.2E-2 2.2E-2 6.6E-2 3.0E-I includes SSW) Train Unavailabilit 

AOVs Cor onent Class Unreliability 

.OE-2 2.5E-2 3.9E-2 3.8E-1 Not Reached' N/A MOvs Cornonent Class Unreliabili 

Increase 1.25X Increase 3.5X Increase 17X N/A MDPs Comronent Class Unreliability Increase 1.54X Increase 5.3X Increase 21 X N/A Increase 1.27X Increase 3.5X Increase 17X I. Calendar year is defined as 7000 critical hours. 2. Total unreliability; includes test and maintenance (TM) contribution. 3. 

4. 

HPCI 

RCIC 

Injection valve reopening failure was excluded from consideration due to its unique failure mechanism and probability. 

5. This 

turbine restart failure was excluded from consideration due to its unique failure mechanism and probability. threshold can be reached if the T&M outages associated with this system are not confined to TECH SPEC allowable combinations.
Table A.2.4-7 BWR 3/4 Plant 8 Miti at Systems Threshold Summa' 

BWR 3/4 Plant 8 SPAR 3i (8.7E-10/hr, 6A lendar year) 

BWR 3/4 Plat 8 RBPI Baseline (7.6E10/hr 5.3E-6/calendar ar 

System/Component Baseline Train Unavailability Green/White Threshold Green/White Threshold White/Yellow Threshold Yellow/Red Threshold 

And Unreliabilit 95hile / ACDF =I E-5/ ear (ACDF =IE-4/ear 

Emergency AC Power (Train Unreliability ) 4.5E-2 2.3E-I 6.3E-2 1.7E-! 4.3E-1 

(Train Unavailabilit 9.7E-3 I.9E-2 2E- 3.9E-i.No.eac.e. Not Reached 

Reactor Core Io Cltasn Unreliability-) 7.9E-2 1I.6E-e 12E- I .9 X INcReased 

C oolin . . . (T rain U navailabili 1 3- _2 4.0E-2 6 .4E-2 5.3E-1 ._. • _ N ot R eached 

Essential uervice i abilityie T s ai n mntea e 7.9E-2 2.9E-2 6.9E-2( ) 

2.5cE

E W t s)6 E 2 6.5E-3 5.0E-2 ._. Not R ahe 

High-Pressure Co l n t 2 .E !4 .4E-I 2.7E-1 5 .4E-1 Not Reached 

ln3eRtrin fo U Ta ine Uatlthihet 9Ex ( 3.8E-2 Is-d2Ef I Not Reached Not Reached 

Residual Heat Removal (rei ain rexld w e fm cityo e 5.t1iE-3 duE-2 t 2iE-2 9.18E-2 2.7E-m 

P rTrain Unviaiiy1.0E-2_ 2.5E-2 1.4E-INoRecd'oteah' 

RHR Service Water (Tri U rliability-z.) 7.7E'-2 - 5.5E-2 2. iE- 1 4.7E-1 

(.... Train Unavailabili 18- 7.1E--2 No Rece'NtRahe'NtRahd 

5OVs RCI ote w as s Unreliabili o N/A Increase 3.5X Increase 24bility. 

MOVs b Con onent Class Unreliabil ated N/wsA Increase 2toX TC Increase combinao n ces. 

MD. __~ o n n lass unreliabilit N/ Increas-e""2.0X Increase 9. s 0 

> I .Calendar year is defined as 7000 critical hours. 

,• 2. Total unreliability includes test and maintenance (TM) contribution,.h niiua uplvl S3. 

RHR train for UA is defined at the heat exchanger (2 pump) level; RHR train for UR is defined at teidvda uplvl 

4. HPC! injection valve reopening failure was excluded from consideration due to its unique failure mechanism and probability. 

5. RCIC turbine restart failure was excluded from consideration due to its unique failure mechanism and probability. 

6. This threshold can be reached if the T&M outages associated with this system are not confined to TECH SPEC allowable combinations.
Table A.2.4-8 BWR 3/4 Plant 11 Mitieatine Svstems Threshold Siummarv

BWR 3/4 Plant I I SPAR 3i (4.9E-9/hr, 3.4E-5/calendar year')

AU1I? V/A V1 f I1I DDDI D 1. C irlL.,A' - I' System/Component ___________________________ , ! I I D5II ne •J.UEE-7/IIII, 3.9't--3/calendar year) Baseline Train Unavailability Green/White Threshold Green/White Threshold White/Yellow Threshold Yellow/Red Threshold And Unreliability 951h%ile (ACDF =I E-6/year) (ACDF = 1E-5/year) (ACDF =I E-4/year) Emergency AC Power (Train Unreliability2) 4,6E-2 1,OE-1 5.2E-2 9.2E-2 2.6E-I (Train Unavailability) 9.7E-3 1.9E-2 1.9E-2 I.IE-I 9.5E- I Reactor Core Isolation (Train Unreliability2,

6 ) 7.9E-2 1.8E-1 8.2E-2 L.OE-1 3.2E-l Cooling (Train Unavailability) i.3E-2 4.OE-2 1.6E-2 4.7E-2 3.6E- I Safety Auxiliaries (Train Unreliability ) 3.8E-3 8.8E-3 2.2E-2 1.3E-1 3.8E-1 

Cooling Water (SACs) (Cools EDGs & RHR) (Train Unavailability) N/A3 N/A3 N/A3 N/A3 N/A3 

High-Pressure Coolant (Train Unreliability2 ,-) 2.4E- I 4.4E- I 2.4E- I 2.7E- I 5.4E-1 Injection (HPCI) (Train Unavailability) 9.7E-3 3.8E-2 2.4E-2 3. IE-I 9.9E- I 

Residual Heat Removal (Train Unreliability') 2.2E-2 3.8E-2 3.8E-2 1.3E-1 4.5E-1 (SPC) (Train Unavailabilit!,) L.OE-2 2.5E-2 2.6E-2 1.8E- I Not Reached7 

Station Service Water (Train Unreliability') 3.2E-2 8.5E-2 3.5E-2 5.9E-2 1.6E-I (SSW) (Train Unavailability) 1.8E-2 6.8E-2 2.3E-2 6.5E-2 4.9E-1 AOVs4 

MOVs Component Class Unreliability N/A Increase 1.2X Increase 3.3X Increase 23X 

MDPs 

Component Class Unreliability N/A Increase 1. 1 X Increase 2.2X Increase 8.4X Component Class Unreliability N/A Increase 1.4X Increase 4.OX Increase I 7X I C'nIpndrln - ; Af", J A '7AAA : : I ...

2. 

3. 

4. 

5. 

6. 

7.

, w .• ,t l I , SA. V I 3 U U ( J c ( | i t l . Ia h oU U r i . 

Total unreliability; includes test and maintenance (TM) contribution. 

N/A - T&M events not included in SPAR logic. 

AOVs System do not include failure of the reliefs to re-close. 

HPCI Injection valve reopening failure was excluded from consideration due to its unique failure mechanism and probability. RCIC turbine restart failure was excluded from consideration due to its unique failure mechanism and probability. This threshold can be reached if the T&M outages associated with this system are not confined to TECH SPEC allowable combinations.
laable A.2.4-9 IWK .4r tat l 2/13 Mat gatu , .... . .. BWR 3/4 Plant 12/13 SPAR 3i (4.2E-9/hr, 3.OE-5/calendar year') ...iA n,-, I1/11 DDDI ,i~n, (I' AFl./hr 9 4E-5/calendar year')

System/Component Baseline Train Unavailability Green/White Threshold Green/White Threshold White/Yellow Threshold Yellow/Red Threshold 

and Unreliability 95th %ile (ACDF =I E-6/year) (ACDF =I E-5/year) (ACDF =I E-4/year) 

Emergency AC Power (EPS) (Train Unreliability2) 3.8E-2 9.1E-2 4.3E-2 7.5E-2 2.IE-I 

(Train Unavailability) 9.7E-3 6.2E-2 4.7E-2 L.IE-I 5.9E- I 

Reactor Core Isolation (Train Unreliability2 4) 7.9E-2 1.7E- I 8.6E-2 1.5E-1 6.5E- I 

Cooling (RCI) (Train Unavailability) 1.3E-2 2.9E-2 8.7E-2 1.6E-1 9,0E-1 

Essential/Emergency Service (Train Unreliability2 ) 2.2E-2 7.7E-2 7.6E-2 1.81E-1 3.5E-1 

Water (ESW to EDGs) (Standby Train Unavail.) 1.8E-2 5.6E-2 8.7E-2 2.7E-1 7.4E-I 

IIPCI (HCI) (Train Unreliability2

'

3) 2.3E- 1 4.4E- 1 2.4E- 1 2.7E- I 5.4E-1 

(Train Unavailability) 9.7E-3 5.8E-2 2.4E- 1 2.8E- 1 6.9E- 1 

Residual Heat Removal (SPC) (Train Unreliability6

) 2.1E-2 3.8E-2 3.2E-2 1.LE-I 3.4E-1 

(Train Unavailability) 1.OE-2 9.9E-3 1.7E-I Not Reached' Not Reached' 

AOVs Component Class Unreliability N/A Increase 4.1 X Increase 30X Not Reached 

MOVs Component Class Unreliabilit N/A Increase I.2X Increase 3.OX Increase 9.5X 

1MDPs Component C Class Unreliability N/A Increase 5.5X Increase 28X Increase 80X

I. 

2. 

3. 

4. 

5. 

6.

Calendar year is defined as 7000 critical hours. 

Total unreliability, includes test and maintenance (TM) contribution. 

HPCI Injection valve reopening failure was excluded from consideration due to its unique failure mechanism and probability 

RCIC turbine restart failure was excluded from consideration due to its unique failure mechanism and probability. 

This threshold can be reached if the T&M outages associated with this system are not confined to TECH SPEC allowable combinations. 

RHR train for UA is defined at the heat exchanger (2 pump) level, RHR train for UR is defined at the individual pump level.
Table A.2.4-10 BWR 3/4 Plant 15/16 Mitigating Systems Threshold Summa 

BWR Plant 15/16 SPAR 3i (5.8E-10/hr, 4 .IE-6/calendar year) BWR Plant 15/16 RBPI Baseline (5.3E- I0/hr. 3 System/Component Baseline Train Unavailability Green/White .7E-6/calendar ear') 

And 

Threshold Green/White Threshold White/Yellow Threshold Yellow/Red Threshold Unreliability 95,h%ile Emergency AC Power (Train Unreliability1) 3.9E-2 (ACDF =I E-6/,ear) (ACDF =I E-5/,ear) (ACDF =I E-4/year) 9.5E-2 1.4E-l 3.2E-1 6.7E-1 Train Unavailabilit 9.7E-3 1.9E-2 

Reactor Core Not Reached Not Reached Isolation (Train Unreliability ) 7.9E-2 1.6E-1 2.0E-1 8.5E-I Not Reached Ss (Train 

r ssential/Emergency 1,3E-2 4.0E-2 2.0E-1 Not Reached Not Reached (Train Unreliabliity2) 8.5NA3 2. E-2 n 6.3E-2n 1.53- 3ncEa 1 

Service W ater (to 

EDGs) -(Train Unavailability) 2.0E-3 3 5 7.8E-3 5.8 E- I Not Reached' Not Reached's 

2 hr. . . Coolant il-ue (Train Unreliability; 3. H PCI ITrain Unavailabili 

4.5 E-a1 3.2mE-a1 7.5 E-cI Not Reached 9.7E-3 3.8E-2 2.6E- i nNot NotReached Reached 

Residual Heat Removal (Train Unreliabilt' I2- 2.7E-2 5,713-2 2.3 E-1I 4.7E-1I (C (Train Unydbliy . 8,013-3 Not Reached''' Not Reach'ed-'- NoRecdrHigh Pressure Service (Train Unreliabilitt ) y8.. 5.thi hshl c Train Unavailabil .. 9E-2 2.713-2 1.51-1 4.1 E- I ges asoce d 8.5wt -3 5.8 E-st Not Reachenot cTt ti Realbc 

A s o nn Class Unreliability N/A MOVs Copoen Cls neibiit•- increase 1.7X - Increase 8. 1 Increase 59X Increase 3.5X MDPs Cm netCasUrlaiiyI increase 14X Increase 35X N/A 

I 

Increase 3.4X Increase !17X Iincrease 47X aeda erisdfndas 7000 critical hours. 

2. Total unreliability; includes test and maintenance (TM) contribution. 

4. 

3. HPCI 

RCIC 

Injection valve reopening failure was excluded from consideration due to its unique failure mechanism and probability. 

5. This 

turbine restart failure was excluded from consideration due to its unique failure mechanism and probability. threshold can be reached if the T&M outages associated with this system are not confined to TECH SPEC allowable combinations.
Table A.2.4-11 BWR 3/4 Plant 18/19 Mms Threshold Summa 

BWR 3/4 Plant 18/19 SPAR 3i (3.7E-9/hr, 2.6E-5/calendar year) 

BWR 3/4 Plan 18/19 RBPI Base .9E-9/hr 2.OE-5/calendar eart 

System/Component Baseline Train Unavailability Green/White Threshold Green/White Threshold White/Yellow Threshold Yellow/Red Threshold 

and Unreliabili 951h%ile ) _ACDF=E-6/ear ACDF =1E-5/ear) ACDF= E-4/year 

Emergency AC Power (Train Unreliability') 4.OE-2 9.9E-2 4.2E-2 5.8E-2 1.5E-1 

Train Unavailabilit 9.7E-3 I.9E-2 1.E-2 .9E-2 3.9E-1 

Reactor Core I ai abili 7E- 1.7E- 9.1E-2 2.0E- Not Reached 

Residal Hat Reoval (Train Unreliability -) 7.9E-2 .3

Co (Train Unavailabilit) 1.3E-2 .E-2 2.8E-2 R 1No Not Reached 

Essential/Emergency TraineUntla-- eliabihty) 2.5E-2 8.nE-c 2.7 2c2 4.2E-2 1.3E-1 

Service Water (t(D~Standb • Train Unavail.) 1.9E-2 - E- 2.2E-2• - 5.6E-2 3.9E-1I 

Fligh-Pressure coolant Iri • rlailityl,4) 2.4E-1 4. E- 2.6E-i1 4.613-1 Not Reached 

IicinHPI ITrain Unavailabili!X 9.7E-_3 3 8.2E-2I. .8E-2 -INo ece 

Residual Heat Removal (TanUneibility7 ) 8.813-3 _ 2.3E-2 2.0E-2 68- .E 

(SC)Train Unavailabilit)LO- 2.5E-2 1.4E- I Not Reachd Not ReaceT 

AOSP._..._ Copnent Class Unreliability N/A increase 2.2X " Increase 13X Increase 83X 

IMOVs Cornonent Class Unreliabil N/A Increase 1.7X Increase 7.OX Increase 28X 

1MDPs Cornmonent Class Unreliabili N/A Increase 1.2X Increase 5.IX I Increase 28X 

I. Calendar year is defined as 7000 critical hours. 

2. Total unreliability; includes test and maintenance (TM) contribution. 

3. TM not modeled in this system. 

4. HPCI Injection valve reopening failure was excluded from consideration due to its unique failure mechanism and probability 

5. RCIC turbine restart failure was excluded from consideration due to its unique failure mechanism and probability. 

6. This threshold can be reached if the T&M outages associated with this system are not confined to TECH SPEC allowable combinations. 

7. RHR train for UA is defined at the heat exchanger (2 pump) level; RHR train for UR is defined at the individual pump level.
Table A.2.4-12 BWR 5/6 Plant 2 Mitigating Systems Threshold Summary 

BWR BWR 5/6 Plant 2 SPAR 3i (l.2E-9/hr, 8.6E-6/calendar year') 5/6 Plant 2 RBPI Baseline (i.4E-9/hr, 9.9E-6/calendar year') System/Component Baseline Train Unavailability Green/White Threshold Green/White Threshold White/Yellow Threshold Yellow/Red Threshold 

Emergency AC Power (Train 

And 

Unreliability Unreliability 2 951h %ile (ACDF = I E-6/year) (ACDF = I E-5/ýyear) (ACDF = I E-4/year) ) 4.1E-2 9.9E-2 4.8E-2 9.9E-2 3.7E- I (Train Unavailability) 9.7E-3 1.9E-2 3.2E-2 2.2E- 1 Not Reached 4 

High-Pressure 

Spray 

Core (Train Unreliability') 1.OE-I 1.4E-I 1.5E-I 5.OE-l Not Reached 

Reactor 

(HPCS) 

Core 

(Train Unavailability) 3.4E-3 1.2E-2 6. I E-2 5.4E-1 Not Reached Isolation (Train Unreliability2

Cooling ) 7.9E-2 1.6E-1 1.4E-I 5.7E-I Not Reached 

Residual 

(RCI) 

Heat Removal 

(Train Unavailabilit!) 1.3E-2 4.OE-2 8.3E-2 7.OE-I Not Reached (Train Unreliability') 2.4E-2 4.2E-2 2.9E-2 7. I E-2 3.3 E- I (RHR, 

Standby 

SPC) 

Service Water 

(Train UnavailabiliW) 1.OE-2 2.5E-2 1.5E-2 5.9E-2 4.9E-I (Train Unreliability) !.5E-2 3.0E-2 2.0E-2 5.2E-2 2.2E-1 (SSW) 

AOVs 

(Train Unavailability) 2.OE-3 7.5E-3 2.8E-2 1.4E-1 Not Reached 

MOVs 

Component 

Component 

Class Unreliability N/A Increase I.7X Increase 7.5X Increase 55X 

MDPs 

Class Unreliability N/A Increase I.2X Increase 2.3X Increase 6.9X Component Class Unreliability N/A Increase 1.5X Increase 5.0X Increase 2IX I. Calendar year is defined as 7000 critical hours. 

2. Total unreliability; includes test and maintenance (TM) contribution. 3. This threshold can be reached if the T&M outages associated with this system are not confined to TECH SPEC allowable combinations.
Table A.2.4-13 BWR 5/6 Plant 5 Mitigating Systems Threshold Summary 

BWR 5/6 Plant 5 SPAR 3i (I.5E-9/hr, l. I E-5/calendar year') 

BWR 5/6 Plant 5 RBPI Baseline (1.2E-9/hr, 8.5E-6/calendar year') 

Systeni/Component Baseline Train Unavailability Green/White Threshold Green/White Threshold White/Yellow Threshold Yellow/Red Threshold 

and Unreliability 95th %ile (ACDF =I E-6/.ear) (ACDF =I E-5/year) (ACDF =I E-4/year) 

Emergency AC Power (EPS) (Train Unreliability') 4.9E-2 1.3E-I 6.7E-2 1.5E-1 4,5E-1 

(Train Unavailability) 9.7E-3 6.3E-2 8.5E-2 4. I E-I Not Reached3 

Reactor Core Isolation (Train Unreliability2) 7.9E-2 1.7E-I 1.5E-1 7.9E-2 Not Reached 

Cooling (RCI) (Train Unavailability) 1,3E-2 2.9E-2 1.7E-I 9.6E-1 Not Reached 

Essential/Emergency Service (Train Unreliability') 2.3E-2 7.2E-2 4.5E-2 2,1E-I 5.3E-1 

Water (SWS to EDGs) (Standby Train Unavail.) 1.9E-2 6.2E-2 Not Reached3 Not Reached3 Not Reached3 

HPCS (HCS) (Train Unreliability2 )6.3E-2 1.4E- I. 1E-1 4.2E- 1 Not Reached 

(Train Unavailability) 3.4E-3 10E-2 1IE- 5.4E-1 Not Reached 

Residual Hea"t, Removal (Q• (Train Inreliahilitv')2.TE-2 4.7E-2 3.9E-2 1.0E- 13.3 E- 1 

(Train Unavailability) 10E-2 3.0E-2 5.9E-2 3.5E-1 Not Reached3 

AOVs Comonent Class Unreliability N/A Increase 1.3X Increase 4. 1X Increase 33X 

MOVs Component Class Unreliabili N/A Increase 1.9X Increase 5.8X Increase 17X 

VlDPs Component Class Unreliability N/A Increase 3.9X Increase 21X Increase 80X 

I. Calendar year is defined as 7000 critical hours. 

2. Total unreliability, includes test and maintenance (TM) contribution. 

3. This threshold can be reached if the T&M outages associated with this system are not confined to TECH SPEC allowable combinations.
Table A.2.4-14 BWR 5/6 Plant 8 Mitigating Systems Threshold Summary

BWR 5/6 Plant 8 SPAR 3i (3.7E-9/hr, 2.6E-5/calendar year') 

BWR 5/6 Plant 8 RBPI Baseline (7.9E-9/hr, 5.6E-5/calendar year')

System/Component Baseline Train Unavailability Green/White Threshold Green/White Threshold White/Yellow Threshold Yellow/Red Threshold 

and Unreliability 951h%ile (ACDF =1E-6/year) (ACDF =1E-5/year) (ACDF =1E-4/year) Emergency AC Power (EPS) (Train Unreliability') 4.1E-2 9.6E-2 4.7E-2 9.3E-2 3.3E-1 

(Train Unavailability) 9.7E-3 6.1E-2 6.6E-2 2.8E- I Not Reached3 

Reactor Core Isolation (Train Unreliability2) 7.9E-2 NOTE 6 1.OE- I 2.8E- I Not Reached 

Cooling (RCI) (Train Unavailability) 1.3E-2 2.6E-2 L.OE- 1 3.11E-1 Not Reached 

Essential/Emergency Service (Train Unreliability2

) 7.OE-3 I .5E-2 7.2E-3 9.2E-3 2.6E-2 

Water (SWS to EDGs) (Standby Train Unavail) 2.0E-3 7.OE-3 8.6E-3 2.2E-2 1.5E-1 

HPCS (HCS) (Train Unreliability2 ) 7. I E-2 NOTE 6 7.2E-2 8.7E-2 2.3E-I 

(Train Unavailability) 3.4E-3 7.5E-3 7.2E-2 8.7E-2 2.3E- I 

Residual Heat Removal (Train Unreliability2)2.8E-2 NOTE 7 4.0E-2 8.2E-2 3.4E-1 

(SPC) (Train Unavailability) I.OE-2 8.5E-3 4. I E-2 9.9E-2 6.8E- I 

AOVs Component Class Unreliability N/A Increase 2.4X Increase 14X Increase 109X 

MOVs Component Class Unreliability N/A Increase 1LOX Increase I.4X Increase 4.4X 

MDPs Component Class Unreliability N/A Increase 3.4X Increase 4.2X Increase IOX

I. Calendar year is detined as 7000 critical hours. 

2. Total unreliability, includes test and maintenance (TM) contribution. 

3. This threshold can be reached if the T&M outages associated with this system are not confined to TECH SPEC allowable combinations.

4
Table A.2.4-15 B&W Plant 3 Mitigating Systems Threshold Summary

B&W Plant 3 SPAR 3i (2.2E-9/hr, 1.6E-5/calendar year) flR,,W Plant 1 RRPIq Ra..line (23 •P,-0/hr. 1.6E-5/calendar vear'•

System Baseline'Train Unavailability and Green/White Threshold Green/White Threshold White/Yellow Threshold Yellow/Red Threshold 

Unreliability 951

"%ile (ACDF =I E-6/year) (ACDF =1E-5/year) (ACDF =I E-4/year) 

Auxiliary Feedwater (MDP Train Unreliability') I.8E-2 3.8E-2 2.3E-2 6.7E-2 4.6E-1 

(TDP Train Unreliability') 1.9E-1 3.4E- I 2.2E-1 3.5E- 1 Not Reached 

(MDP Train Unavailability) .lIE-3 2.7E-2 2.3E-2 6.9E-2 Not Reached 

(TDP Train Unavailability) 4.6E-3 2.9E-2 2.2E- 1 4. I E- 1 Not Reached 

Component Cooling (Train Unreliability') 1.6E-2 4.8E-2 2.3E-2 6.6E-2 2.3E-1 

Water (Standby Train Unavail.4 ) 1. 1E-2 4.3E-2 4.9E-2 3.4E- I Not Reached 

Emergency AC Power (Train Unreliability') 4.IE-2 9.7E-2 5.2E-2 1.2E-1 3. IE- 1 

(Train Unavailability) 9.7E-3 6,5E-2 7.3E-2 3.6E-1 Not Reached5 

Chemical and Volume (SI Train Unreliability') 2.2E-1 2,8E-1 5.6E-I Not Reached Not Reached 

Control System (Train Unavailability) 2.OE-I 2.6E-I Not Reached Not Reached Not Reached 

High Pressure (SI Train Unreliability') I.3E-2 1.3E-2 3.5E-2 1.6E-I 5.3E-1 

Injection (SI Train Unavailability) 4.2E-3 3.2E-2 5.4E-2 4,5E-1 Not Reached 

Power Operated Relief (System Unreliability) 6,4E-3 2.3 E-2 13E-2 1.IE-I Not Reached 

Valves (Train Unavailability ) N/A3 N/A' N/A3 N/A3 N/A3 

Residual/Decay Heat (Train Unreliability') 1.2E-2 3.OE-2 1.8E-2 6.9E-2 3,6E-1 

Removal (Train Unavailability) 7.3E-3 2. 1 E-2 7.6E-2 6.6E- 1 Not Reached' 

Service Water 4 (Train Unreliability') 3.3E-2 9.6E-2 4.7E-2 1,6E- I 5.OE-I 

(Train Unavailability) 2.7E-2 8.OE-2 Not Reached5 Not Reached' Not Reached' 

AOVs' Component Class Unreliability N/A Increase 21X Increase 125X Increase 495X 

MOVs Component Class Unreliability N/A Increase 2.2X Increase I IX Increase 47X 

MDPs Component Class Unreliability N/A Increase 3,4X Increase lOX Increase 36X

I Total unreliability, includes T&M 

2. AOV component class does not include failure to re-close of the reliefs. 

3. N/A, T&M events not included in SPAR logic. 

4. The primary SWS load is the RHR HTX. 

5. This threshold can be reached if the T&M outages associated with this system are not confined to TECH SPEC allowable combinations.

00
Table A.2.4-16 B&W Plant 4/5/6 Mitigating Systems Threshold Summary

B&W Plant 4/5/6 SPAR 3i (2.1 E-9/hr, 1.5E-5/calendar year') 

R,&W Plant d/5/6 BP l A l epling (p r% .O/h 1 IV V , I .. IA

System/Component Baseline Train Unavailability and Green/White Threshold Green/White Threshold White/Yellow Threshold Yellow/Red Threshold Unreliability 95"' %ile (ACDF = I E-6/year) (ACDF =I E-5/year) (ACDF =I E-4/year) Emergency (MDP Train Unreliabilit 1.OE-2 2.3E-2 1.6E-2 5.2E-2 1.9E- I Feedwater (TDP Train Unreliability') 2.OE- 1 3.5E-1 2.8E-1 8.9E-1 Not Reached 

(MIDP Train Unavailability) 1. I E-3 2.5E-3 3.OE-2 2.8E-I Not Reached (TDP Train Unavailability) 4.6E-3 1.8E-2 1OE-I 9.9E-1 Not Reached Component Cooling (Train Unreliability3 ) 1.6E-2 5. 1 E-2 Not Reached Not Reached Not Reached System (CCS) (Train Unavailability) 1. 1E-2 4.4E-2 Not Reached Not Reached Not Reached 

Emergency AC (Hydro Train Unreliability') 1. 1 E-3 1 .6E-3 2.4E-3 I.4E-2 1.3E- 1 Power (Hydro Train Unavailability) I.4E-2 TBD5 I.4E-l Not Reached4 Not Reached4 

High Pressure (Train Unreliability3 ) 1.3E-2 2.5E-2 6.OE-2 1.8E-1 5.IE-1 

Injection (HPI) (Train Unavailability) 4.2E-3 1.6E-2 5.5E-I Not Reached Not Reached 

Decay Heat Removal (Train Unreliability') 2.2E-2 5.5E-2 3.OE-2 1.IE-1 4.9E- I (DHR) (Train Unavailabili!y) 7.3E-3 2.4E-2 3.9E-1 Not Reached4 Not Reached5 

Low Pressure Service (Train Unreliability') 3.2E-2 9.2E-2 5.6E-2 1.5E-1 4.5E-I Water LASWI (Standby Train Unavailability) 2.7E-2 1.OE-! 5.4E-I Not Reached Not Reached AOVs Component Class Unreliability N/A Increase 4.5X Increase 25X Increase I 1OX 

MOVs Component Class Unreliability N/A Increase 2.OX Increase 8.7X Increase 30X MDPs Component Class Unreliability N/A Increase I .8X Increase 6.7X Increase 26X

ae t.ar year is dennd as /000 critical uhours. 

2. AOVs does not include failure to re-close of the reliefs. 

3. Total unreliability, includes T&M 

4. This threshold can be reached if the T&M outages associated with this system are not confined to TECH SPEC allowable combinations. 

5. The corresponding unavailability event in the SPAR model does not include a probability distribution.
LIA I A1'7 flZV.I DImnf '7 Mitiuitinu ThrehoId Summary I 41iU t%..9I / t3VV a S.. -. 7 -----------

B5&W tPlant 7I SP'AR.i) (lXE-9/h. r, I2ik -,/calen ary.v r QR.11 P innt "I RBPI• Baseline ( I 8SE-9/hr. 1.2E-5/calendar year

System Baseline Train Unavailability and Green/White Threshold Green/White Threshold White/Yellow Threshold Yellow/Red Threshold 

Unreliability 95th%ile (ACDF =I E-6/year) (ACDF = I E-5/year) (ACDF =I E-4/year) 

Emergency Feedwater (MDP Train Unreliability') 8.6E-3 2.0E-2 2.7E-2 1.2E-1 4.7E-1 

(TDP Train Unreliability') 1.9E-1 3.5E-1 2.5E-1 7.2E-1 Not Reached 

(MDP Train Unavailability) L.IE-3 2.6E-3 4.6E-2 3.8E- 1 Not Reached 

(TDP Train Unavailability) 4.6E-3 3.OE-2 2.4E-1 6.6E-1 Not Reached 

Decay Heat Removal (Train Unreliability) 1.6E-2 4.9E-2 3.3E-2 1.3E-1 4.8E-1 

Closed Cooling (Train Unavailability) L.1E-2 4.OE-2 6.8E-2 5.5E-I Not Reached4 

Decay Heat River (Train Unreliability') 1.9E-2 5. I E-2 L.IE-I 4.4E-i Not Reached 

Water (Train Unavailability) 1.1E-2 3.6E-2 4.3E-1 Not Reached Not Reached 

Emergency AC Power (Train Unreliability') 4.2E-2 L.OE-I 4.8E-2 8.6E-2 2.2E-i 

(Train Unavailability) 9.7E-3 6.3E-2 7.2E-2 3.4E-1 Not Reached4 

High Pressure (SI Train Unreliability') 9.3E-3 2.OE-2 1.2E-1 2.8E-1 5.7E-1 

Injection (SI Train Unavailability) 4.2E-3 3.9E-2 7.4E-I Not Reached Not Reached 

Nuclear Service (Train Unreliability') 3.2E-2 9.2E-2 3.4E-1 7.7E-! Not Reached 

Closed Cooling Water (Train Unavailability) 2.7E-2 8.7E-2 Not Reached4 Not Reached4 Not Reached4 

Nuclear Service River (Train Unreliability') 3.5E-2 8.8E-2 1.2E-1 5.7E-I Not Reached 

Water (Train Unavailability) 2.7E-2 8.4E-2 Not Reached Not Reached Not Reached 

Power Operated Relief (System Unreliability') 6.4E-3 6.3E-3 3.2E-2 2.5E-I Not Reached 

Valves (Train Unavailability ) N/A3 N/A3 N/A' N/A3 N/A3 

Residual Heat (Train Unreliability') 1.2E-2 8.1E-2 1.8E-2 5.9E-2 2.9E-1 

Removal (DHR) (Train Unavailability) 7.3E-3 2.8E-2 6.5E-2 5.4E-1 Not Reached4 

AOVs 2 Component Class Unreliability N/A Increase 72X Increase 237X Increase 497X 

MOVs Component Class Unreliability N/A Increase 1.7X Increase 6,6X Increase 27X 

MMDPs Component Class Unreliability N/A Increase 2.2X Increase 9.1 X Increase 34X

ON,

1. Total unreliabiltty, includes I am 

2. AOV component class does not include failure to re-close of the reliefs. 

3. N/A, T&M events not included in SPAR logic. 

4. This threshold can be reached if the T&M outages associated with this system are not confined to TECH SPEC allowable combinations.

II •lll I'k/..t A ' 117 D kl6 V P1 f 7l~llS xvM it a ti-n. S stem s= -- - .. s .. l .. ......
Table A.2.4-18 CE Plant 1 Mitigating Systems Threshold Summary

CE Plant I SPAR 3i (4.2E-9/hr, 3.OE-5/calendar year) CE Plant 1 RBP! Baseline (4.2E-9/hr_ 3flP-S/calendair vPar3

System Baseline Train Unavailability and Green/White Threshold Green/White Threshold White/Yellow Threshold Yellow/Red Threshold 

Unreliability 951

h %ile (ACDF =I E-6/year) (ACDF =I E-5/year) (ACDF = I E-4/year) Auxiliary Feedwater6.8 (MDP Train Unreliability') 1.8E-2 5.2E-2 2.1E-2 4.7E-2 2.9E-I 

(MDP Train Unavailability) L.OE-2 4.OE-2 2.1E-2 4.9E-2 3.2E-1 Emergency Feedwater (MbP Train Unreliabilit') 8.3E-3 2. I E-2 1.1E-2 3.3E-2 2.3E-1 

(TDP Train Unreliability') 1.9E- I 3.5E-1 2.OE- 1 2.8E- 1 Not Reached 

(MDP Train Unavailability) I.IE-3 2.5E-3 1.1E-2 4.OE-2 3.2E-1 

(TDP Train Unavailability) 4.6E-3 2.7E-2 2.0E- I 2.9E- I Not Reached 

Component Cooling (Train Unreliability) NA 7 NA7 NA 7 NA 7 NA7 

Water7 (Standby Train Unavailability) NA7 NA7 NA 7 NA7 NA7 

Emergency AC Power (Train Unreliability') 4.2E-2 i.2E-2 4.5E-2 6.9E-2 1.6E-! 

(Train Unavailability) 9.7E-3 6.2E-2 5.OE-2 1.2E- 1 8.0E- 1 

High Pressure (SI Train Unreliability') 9.3E-3 2.OE-2 1.7E-2 7.5E-2 2.5E-I 

Injection (SI Train Unavailability) 4.2E-3 4.5E-2 2.9E-2 2. I E-I Not Reached 

Power Operated Relief (System Unreliability') 4.3E-2 4.7E-2 4.9E-2 1.OE-I 5.4E-1 

Valves (Train Unavailability ) N/A 3 N/A3 N/A3 N/A3 N/A3 

Residual Heat (Train Unreliability') 1.3E-2 2.8E-2 1.6E-2 4.8E-2 3.4E-1 

Removal (SDC) (Train Unavailability) 7.3E-3 3.4E-2 Not Reached5 Not Reached5 Not Reached' 

Service Water System4 (Train Unreliability') 3.3E-2 9.7E-2 4.3E-2 L.IE-I 3.5E-1 

(Train Unavailability) 2.7E-2 9.2E-2 Not Reached5 Not Reached5 Not Reached5 

AOVs2 Component Class Unreliability N/A Increase 203X Increase 630X Not Reached 

MOVs Component Class Unreliability N/A Increase 1AX Increase 4.4X Increase 21 X 

MDPs Component Class Unreliability N/A Increase 1.2X Increase 3.3X Increase 21X

I. 

2. 

3. 

4. 

5. 

6. 

7. 

8.

I ota neriU i~lllUilty, I11CIUU•S 1L•IV 

AOV component class does not include failure to re-close of the reliefs. 

N/A, T&M events not included in SPAR logic. 

The primary ESW load is the RHR HTX and the diesel generators. 

This threshold can be reached if the T&M outages associated with this system are not confined to TECH SPEC allowable combinations. 

Aux. Feedwater MDP is a start-up pump. 

CCW does not support RHR or DG's, flagsets on fault trees RCPSL-CCW/SWS result in system failure. 

SG discharge MOV's from both MDP and TDP trains are included in unreliability calculations due to CCF, see basic event EFW-MOV-CF-SGS.

ON
Table A.2.4-19 CE Plant 2/3 Mitigating Systems Threshold Summary

CE Plant 2/3 SPAR 3i (2.6E-9/hr, 1.8E-5/calendar year') r'.~~ n1.. 11) (5 1ffl V 1~Ik k AP IrI,naf4!,~r 1,p~lr'

System/Component Baseline Train Unavailability and Green/White Threshold Green/White Threshold White/Yellow Threshold Yellow/Red Threshold 

Unreliability 951

h%ile (ACDF =1E-6/year) (ACDF =lE-5/year) (ACDF =1E-4/year) 

Emergency (MDP Train Unreliability') 8.OE-3 2.OE-2 1.7E-2 8.8E-2 3.5E- I 

Feedwater (TDP Train Unreliability') l.9E- I 3.5E-1 2.0E-1 3.0E-I 8.0E- 1 

(MDP Train Unavailability) 1. 1 E-3 2.5E-3 3.4E-2 1.9E-1 4.6-1 

(TDP Train Unavailability) 4.6E-3 I.8E-2 2.8E-2 2.3 E-1 Not reached' 

Component Cooling (Train Unreliability4 ) 1.6E-2 5.OE-2 1.6E-1 4.3E-I 9.8E-1 

Water (Standby Train Unavailability) 1. 1 E-2 4.4E-2 Not Reached Not Reached Not Reached 

Emergency AC (Train Unreliability4) 4.2E-2 !.OE-1 5.1E-2 9.2E-2 2.0E- 1 

Power (Train Unavailabilit) 9.7E-3 1.9E-2 2.4E-2 I.IE-l 4.7E-1 

High Pressure (Train Unreliability") 9.2E-3 2.OE-2 1.8E-2 8.9E-2 3.8E- I 

Injection (Train Unavailability) 4.2E-3 1.6E-2 1.5E-2 lIE-I Not reached5 

Power Operated (System Unreliability) 4.4E-2 5.0E-2 5.4E-2 1.4E-1 7.OE-! 

Relief Valves (Train Unavailability) N/A3 NA3 NA3 NA3 NA3 

Salt Water System (System Unreliability') 5.1E-2 1.2E-I 8.1E-2 2.8E-1 8.6E-1 

(Standby Train Unavailability) 2.7E-2 1.0E-1 Not reached5 Not reached5 Not reached5 

Shutdown Cooling (Train Unreliability4 ) i.3E-2 3.4E-2 2.8E-2 1.4E- I Not Reached 

/RHIRLPI (Train Unavailability) 7.3E-3 2.4E-2 4.4E-i Not reached5 Not Reached 

AOVs2 Component Class Unreliability N/A Increase 5.OX Increase 33X Increase 155X 

MOVs Component Class Unreliability N/A Increase 2.4X Increase 13X Increase 60X 

1MDPs Component Class Unreliability N/A Increase 2.7X Increase 14X Increase 47X

1. 

2. 

3. 

4. 

5.

Calendar year is defined as 7000 critical hours. 

AOVs does not include failure to re-close of the reliefs. 

N/A, T&M events not included in SPAR logic. 

Total unreliability, includes T&M 

This threshold can be reached if the T&M outages associated with this system are not confined to TECH SPEC allowable combinations.

w _
Table A.2.4-20 CE Plant 4 Mitigating Systems Threshold Summary 

CE Plant 4 SPAR 3i (2.6E-9/hr, 1.8E-5/calendar year') CE Plant 4 RBPI Baseline (2.2E-9/hr. 1.6E-5/calendar year System/Component Baseline Train Unavailability and Green/White Threshold Green/White Threshold White/Yellow Threshold Yellow/Red Threshold Unreliability 95'6

Emergency %ile (ACDF =I E-6/year) (ACDF= 1E-5/year) (ACDF =I E-4/year) (DDP Train Unreliability2 ) 8.3E-2 1.5E-1 9.8E-2 2.2E- I Not Reached Feedwater (MDP Train Unreliability 2) 8. I E-3 2.OE-2 1.3E-2 4.OE-2 5.4E- I (TDP Train Unreliability') 1.9E-1 3.5E-1 2.3E-1 5.2E- I Not Reached (DDP Train Unavailability) 1.5E-2 3.6E-2 3.4E-2 1.9E-1 Not Reached (MDP Train Unavailability) 1.IE-3 2.5E-3 8.8E-3 8.OE-2 7.8E-1 (TDP Train Unavailability) 4.6E-3 1.8E-2 5.1E-2 4.6E- I Not Reached Component 

Water 

Cooling (Train Unreliability) 1.6E-2 5.2E-2 Not Reached Not Reached Not Reached (Train Unavailabilit ) 1. I E-2 4.4E-2 Not Reached Not Reached Not Reached Emergency AC (Train Unreliabilit) 4.1E-2 9.8E-2 4.6E-2 7.8E-2 2.3E-1 Power (Train Unavailabili!) 9.7E-3 1.9E-2 i.7E-2 8.7E-2 7.8E- I High Pressure (Train Unreliabilit) 9.2E-3 2.1E-2 2.4E-2 1.4E- 1 5. I E- I Injection (Train Unavailability)4.2E-3 1.6E-2 2.6E-2 2.3E-I Not Reached Power Operated (Train Unreliability) 2.2E-3 5.OE-3 3.OE-2 2.]E-1 Not Reached 

Relief Valves (Train Unavailabilitf') N/A4 N/A4 N/A 4 N/A4 

Raw Water Not Reached System (Train Unreliability') 3.2E-2 lIE-I 1.6E-1 5.IE-I 9.8E-1 (RWS) (Standby Train Unavailability) 2.7E-2 8.OE-2 Not Reached Not Reached Not Reached Shutdown (Train Unreliability') 6.7E-3 1.4E-2 

Cooling/RHR I.5E-2 8.4E-2 5.6E- 1 (Train Unavailability) 7.3E-3 2.4E-2 9.5E-! Not Reached6 Not Reached6 AOVs' 

MOVs 

Component Class Unreliability N/A Increase 3.9X Increase 25X Increase 120X 

MDPs 

Component Class Unreliability N/A Increase 3.2X Increase 22X Increase I 15X Component Class Unreliability N/A Increase 1 .7X Increase 8.O( Increase 55X I. Calendar year is defined as 7000 critical h--r.

2, 

3. 

4. 

5. 

6.

Total unreliability, includes T&M 

AOVs does not include failure of the reliefs to re-close. 

N/A - T&M events not included in SPAR logic. 

Multiplier used in determining the associated system thresholds. This threshold can be reached if the T&M outages associated with this system are not confined to TECH SPEC allowable combinations.
Table A.2.4-21 CE Plant 5 Mitigati Systems Threshold Summary 

CE Plant 5 SPAR 3i (4.OE-9/hr, 2.8E-5/calendar year') 

CE Plant 5 RBPI Baseline (2.6E-9/h 1.8E-5/calendar year') 

System/Component Baseline Train Unavailability and Green/White Threshold Green/White Threshold White/Yellow Threshold 

Unreliabilit __ 95-2%ile ACDF=IE-6/year CF E-2ear 

Emergency Feedwater MDP Train Unreliabili. 4. 1. 6E-2 2.9E-2 1.7E-2 2.5E-2 

TDP Train Unreliabili 2.OE-l 3.4E-1 2.2E-I1 4.11E-1 

S d C i Train Unrvilability' 1.IE-3 2.5E-3 3.2E-3 2.2E-2 

RiaHte v Train Unavailabilt 7.3E&3 1.8E-2 3.2E-2 2N8E-1 

Component Cooling (Tas Unreiabi l I.E-2 i 7.8E-2 I3.2E- 1 7.8 E-a 

Water orin UonantlasUliabi1 E-2 i 4NAE-2 Not Reached Not Reached 

Emergency AC Power (Train nelaUnreliabi lity 5.A 1.2E-1 n-2 6.2E-2 iIE

1. C ya is define9,dEas 1.9E-2 5.8E-2 4.9E-1 

H2Ah Prdessure Injection Train Ure iabil 5.9E-2 8.8E-2 3.7E-1 ..(Train Unavailabilt)42- 1.6E-2 2,6E-2 2.213- 1 

. Operated Reliabi , i d41e-s 1,5E-1 3.7E-1 

Valves (Train Unavailabili!, •N/Al NA1A A 

Service Water System (in Uthea iabitd 1.2t-e 8.4h-2 eh8E-I 

6 h acdih c Trae nava ciae wt t 8.5E-2 Not Reached Not Reached 

Shutdown Cooling / (Train Unreliabilt' Z,713-2 5.213-2 3.5E-2 i .0E- 1 

Residual Heat Removal "-'Train Unavailabilt)73- 2.4E-2 5,8E-1 Not Reached'"--" 

TT, Compnnt Class Unreliability_. N/A Increase 1.9X increase 9.0X 

MOVs C.._o~mponent Class Unreliability_. N/A Increase 3. 1IX Increase 20X 

MlDPs C ~ ls nreliabilit N/A increase 1.2X Increase 2.4X 

I1. Calendar year is defined as 7000 critical hours. 

2. AOVS does not include failure to re-close the reliefs. 

3. N/A, T&M events not included in SPAR logic. 

4. Total unreliability, includes T&M 

5. Multiplier used to determine the associated system threshold. 

6. This threshold can be reached if the T&M outages associated with this system are not confined to TECH SPEC allowable combinations.

Yellow/Red Threshold (ACDF =I E-4/year) 

8.5E-2 

Not Reached

2.2E-1 

Not Reached 

1.0 

Not Reached 

2I7E-a Not Reached•'dr 

9.1E-I 

Not Reached'ff7 

Not Reached 

NA' 

3.7E-1 

Not Reached 

Not Reached 

Not Reached 

-increase 43X 

Increase 91 X 

Onrae1X
Table A.2.4-22 CE Plant 10/11 Mitigating Systems Threshold Summary 

CE Plant 10/1I SPAR 3i (7.4E-9/hr, 5.IE-5/calendar year) CE Plant 10/1 1 RBPI Baseline (8.6E-9/hr, 6.0E-5/calendar year) System Baseline Train Unavailability and Green/White Threshold Green/White Threshold White/Yellow Threshold Yellow/Red Threshold Unreliability 951h%ile (ACDF =I E-6/year) (ACDF = I E-5/year) (ACDF =I E-4/year) Auxiliary Feedwater (MDP Train Unreliability') l.IE-2 2.3E-2 1. I E-2 1.5E-2 4.9E-2 

(TDP Train Unreliability') 1.9E- 1 3.4E- 1 2.OE- 1 2.4E- 1 6.4E- 1 (MDP Train Unavailability) 1.1E-3 2.5E-3 1.2E-2 2.1E-2 i.2E-I (TDP Train Unavailability) 4.6E-3 2.6E-2 2.0E- 1 2.5E-1 7.5E- I Component 

Water 

Cooling (Train Unreliability') 3.6E-2 7.2E-2 7.3E-2 2.6E-1 6.5E-1 (Stby Train Unavailability) 1. 1 E-2 4. 1 E-2 Not Reached4 Not Reached4 Not Reached4 

Emergency AC Power (Train Unreliability') 5.5E-2 1.3E-1 5.6E-2 6.4E-2 1.2E-I (Train Unavailability) 9.7E-3 6.0E-2 5.7E-2 6.9E-2 1.8E-1 High Pressure (SI Train Unreliability') 9.7E-3 2.2E-2 2.OE-2 5.913-2 1.8E-1 Injection (SI Train Unavailability) 4.2E-3 3.613-2 8.513-2 7.8E-I Not Reached4 

Residual/Decay 

Removal 

Heat (Train Unreliability') 1.3E-2 3.OE-2 3.1 E-2 8.2E-2 Not Reached (Train Unavailability) 7.3E-3 7.2E-3 6.2E-I Not Reached4 Not Reached4 

Service Water 3 (Train Unreliability') 5.IE-2 1.2E-1 8.4E-2 2.8E- 1 6,613-1 (Train Unavailability) 2.7E-2 8.8E-2 Not Reached4 Not Reached4 Not Reached4 

AOVs 2 Component Class Unreliability N/A Increase 8.OX Increase IOOX Increase 310X MOVs Component Class Unreliability N/A Increase 3.3X Increase 8.9X Increase 14X MDPs Component Class Unreliability N/A Increase 1.05X Increase I.5 X Increase 5.OX 

I. Total unreliability, includes T&M

2. AOV component class does not include failure to re-close of the reliefs. 

3. The primary SWS load is the RHR HTX. The EDG's are self cooled. 4. This threshold can be reached if the T&M outages associated with this system are not confined to TECH SPEC allowable combinations.
Table A.2.4-23 CE Plant 12 Mitigating Systems Threshold Summary 

CE Plant 12 SPAR 3i (4.0E-9/hr, 2.8E-5/calendar year') 

CE Plant 12 RBPI Baseline (2.7E-9/hr, 1.9E-5/calendar vear•) 

System/Component Baseline Train Unavailability and Green/White Threshold Green/White Threshold 

Unreliabilit 951h%ile ACDF =ýlE-6/year) 

Emergency Feedwater (MDP Train Unreliabilit" .IE-3 2.0E-2 9.2E-3 

(TDP Train Unreliability 2.0E-I 3.5E- 1 2.1 E- I 

(MI)P Train Unavailability) 1.1E 2.5E-3 3.3E-3 S.. . ... . . .I o "• 1 /•1•.9

WhiteYello Thehl

White/Yellow Threshold (ACDF =I E-5/year)

I. 'II2- I

Yellow/Red Threshold (ACDF =I E-4/year)

_ I__ _ _ _ _ t -, u:-

I A I-.-Z

Z) I V -Z

(TDP Train Unavailability 4.6E-3 .,.,-, -.. 

Component Cooling (Train Unreliabilit 6OE-2 - 9.5E-2 1.4E-! 5.OE-1 1.0 

Water (Train Unavailability) 4.4E-2 8.8E-2 L.OE-i 6.2E-I Not Reached

Emergency AC Power (Train Unreliability4) 3.8E-2 1.E-I 4.2E-2 7.3E-2 2.2E-I 

(Train Unavailability) 9.7E-3 1.9E-2 i.88E-2 9.3E-2 8.6E-I 

High Pressure Injection (Train Unreliability 1.3E-2 2.5E-2 2.7E-2 1.IE-1 4.5E- I 

(Train Unavailability) 4.213-3 1.6E-2 7.1E-2 6.8E-1 Not Reached' 

Power Operated Relief (System Unreliability) 4.4E-2 4.5E-2 6.7E-2 2.5E-1 Not Reached 

Valves (Train Unavailability) N/A3 NA •NA NA' NA' 

Shutdown Cooling ( (Train Unreliability4) 2.5E-2 4.7E-2 6.5E-2 2.3E- I 6.7E- I 

Residual Heat Removal (Train Unavailability) 7.3E-3 2.4E-2 3.3 E-I Not Reached5 Not Reached' 

Component Class Unreliability N/A Increase 7.5X Increase 65X Not Reached 

M"OVs Coinonent Class Unreliability N/A Increase I.4X Increase 4.5X Increase 22X 

zIncrease 14I 

MDPs Component Class Unreliability N/A Increase 1.2X Increase 2.9X Increase_14X

1. Calendar year is defined as 7000 critical hlours. 

2. AOVs does not include failure to re-close of the reliefs. 

3. N/A, T&M events not included in SPAR logic. 

4. Total unreliability, includes T&M. 

5. This threshold can be reached if the T&M outages associated with this system are not confined to TECH SPEC allowable combinations.

ON

1 0 QQ *1

1 4 V.- I

i XT D t, A

O. O J•'.•-,

INot [•;i.ea Iek

L.4Z rZ.31•- 1 I•IL eak•t..,I 1
Table A.2.4-24 WE 2-Lp Plant 5/6 Mitinating Svstems Thrpeh.1d .Qm ....

111V• W.....( ")I 1 DI•. .k..... i - D n ,U n .\ _ l .IL137fI A. |.u.- I/calenaar year') ; _ , ,• + . . . .

System/Component Baseline Train Unavailability S•• ant -u ./U.rl BIaseiine I1. I E-/I:hr, 1.5E-5/calendar year') and Green/White Threshold Green/White Threshold White/Yellow Threshold Yellow/Red Threshold Unreliability 9 5 Auxiliary Feedwater ih %ile (ACDF = 1E-6/year) (ACDF = I E-5/year) ACDF =I E-4/year) (MDP Train Unreliability5 ) 8.7E-3 2.1E-2 1.2E-2 3.4E-2 5.4E-i (TDP Train Unreliability5 ) 1.9E-l 3.5E-1 2.5E-1 7.6E-I Not Reached (MDP Train Unavailability)L 1IE-3 2.5E-3 8.OE-3 6.6E-2 6.6E-l 

Component Cooling 

(TDP Train Unavailability) 4.6E-3 i.8E-2 7.6E-2 7.0E-i Not Reached 

Water (Unreliability') 64E-2 1.2E- I 9.7E-2 2.7E- l 8.6E- l 

Emergency AC Power 

(Unavailabiliy) 1. 1 E-2 4.4E-2 1. E- I 9.9E- I Not Reached . Unreliabilit 4.OE-2 9.8E-2 5.5E-2 1.3E-1 2.9E-I (Unavailabili!1) 9.7E-3 1.9E-2 1.3E-1 Not Reache-d4

T Not Reached 4 High Pressure Injection (Unreliabilit6) 9.3E-3 2.8E-2 2.6E-2 1.IE-I 4.6E-1 (Unavailability) 4.2E-3 1.6E-2 8.8E-2 8.4E- 1 Not Reached4 Power 

Valves 

Operated Relief (System Unreliability) 3.3E-2 3.4E-2 5.6E-2 2.4E-1 9.9E- 1 (Unavailability) N/Al N/A" N/A' N/A N/A 3 Residual/Decay 

Removal 

Heat (Unreliabilityl) 2.4E-2 4.7E-2 3.2E-2 8.7E-2 3.8E- I 

Service Water 

(Unavailability) 7.3E-3 2.4E-2 6.6E-2 5.8E-I Not Reached (MDP Train Unreliability') 3.2E-2 9.2E-2 5.2E-1 1.0 Not Reached (DDP Train Unreliability') 7.6E-2 2.OE-1 3.0E- 1 9.6E-1 Not Reached 

_ 

(MDP 

(DDP Train 

Train 

Unavailability) 

Unavailability) 2.7E-2 9.OE-2 Not Reached Not Reached Not Reached 5.5E-2 i.7E-1 Not Reached4 Not Reached 4 Not Reached 4 AOVs..2 

MOVs 

Component 

Component 

Class Unreliability N/A Increase 32X Increase 185X Not Reached 

MDPs 

Class Unreliability N/A Increase 1.9X Increase 7.4X Increase 27X Component Class Unreliability N/A Increase I.4X Increase 4.OX Increase 16X 1. Calendar year is defined as 7000 critical hours (ACDF i• ,-•,ckt,4 , I...... ..

ON

2. AOVs does not include failure to re-close of the reliefs. 

3. N/A, T&M events not included in SPAR logic. 4. This threshold can be reached if the T&M outages associated with this system are not confined to TECH SPEC allowable combinations. 5. Total unreliability, includes T&M.

WE2-L Plant VA QDAV 1; ') IV Alt,
Table A.2.4-25 WE 3-LP Plant 5 Mitigating Systems Threshold Summary 

WE 3-LP Plant 5 SPAR 3i (6.3E-9/hr, 4.4E-5/calendar year6) 

WE 3-LP Plant 5 RBPI Baseline (6.7E-9/hr, 4.7E-5/calendar year6) 

System Baseline Train Unavailability and Green/White Threshold Green/White Threshold White 

Unreliability 95t 6%ile (ACDF =1E-6/year) (AC 

Auxiliary Feedwater (MDP Train Unreliability) 9.7E-3 2.2E-2 1.IE-2 

(TDP Train Unreliability') 2.OE-1 3,5E- 1 2.0E-! 

(MDP Train Unavailability) !.I E-3 2.5E-3 1.2E-2 

(TDP Train Unavailabilit) 4.6E-3 6.7E-2 2.0E-1 

Component Cooling (Train Unreliability') 6.1E-2 1.3E-I 9.2E-2 

Water (Sanb Train Unavail.') 1.1E-2 8.9E-2 1.8E-1I 

Emergency AC Power _(Train UnreliabilityJ) 4. 1E-2 1.0E-I 4.3E-2 

(Train Unavailability )9.7E-3 6.2E-2 4.4E-2 

High Pressure (SI Train Unreliability') 9.5E-2 2.2E-1 1.2E-1 

Injection (SI Train Unavailability) 4.2E-3 3.8E-2 2.9E-I 

Power Operated Relief I(ystem Unreliability') 3.9E-2 3.9E-2 6.5E-2 

Valve (Train I Unavailabilitv ) N/A3 N/A3 N/A3

Residual/Decay Heat 

Removal 

Emergency Service 

Water4

(Train Unreliability') 1.9E-2 

(Train Unavailability) 7.3E-3 

(Train Unreliability') 2.5E-2 

(Train Unavailability) 2.0E-2

5 2E-2 5.2E-2 

2.5E-2 

8.7E-2 

7,5E-2

2,913-2 7.1 E-2 

2.6E-2 

3.OE-2

/Yellow Threshold (Yellow/Red Threshold

/Yellow Threshold I ellow/Red Threshold 'DF =IE-5/year) _ (ACDF =IE-4/year)

9 4E-2I

32.E-I

1Not Reached

Not Reached 28-~ I 32ER-2I

286E-1 NoIece - -------

No3 heane

2.613 N

Not eacNtRece ot eacne

6_2E-2

6.4E3-2

2.8E- I t ene

2.8E-1

N/A'

I.IE-I

2.6E- I

2.oE-a

N/A'

8.7E-2 3.1E-1

5.3E- I Not Reached'

3.0E-2 

7.013-2

9.0E-2 

4.7E- I 

Inerea.e 177X

AOVs' Compnent Class Unrlablt N/A Increase 2zncese2 Increae 177 "MOVs Component Class Unreliability N/A Increase I.SX Increase 7.5X Increase 28X 

M DPs C nent Cls neiability_. N/A Increase I. I X Increase 2.2X Increase I I X 

I. Total unreliability, includes T&M 

2. AOV component class does not include failure to re-close of the reliefs. 

3. N/A, T&M events not included in SPAR logic. 

4. The primary ESW load is the RIHR HTX and the diesel generators. 

5. This threshold can be reached if the T&M outages associated with this system are not confined to TECH SPEC allowable combinations. 

6. Calendar year is defined as 7000 critical hours.

> 00

2AE-2 1.2E- I

5.2E-2

6AE-2

1

1.2•-1

2.3 E-1I

2 gE-I

2.6E-1 8.3E-I

Nat Reached

2.8E-1 7.2E-!I
Table A.2.4-26 WE 3-LP Plant 10/11 Mitigating Systems Threshold Summary 

WE 3-LP Plant 10/l1 SPAR 3i (3.2E-9/hr, 2 .3E-5/calendar year 6 WE 3-LP Plant 10/l1 RBPI ) Baseline (2.9E-9/hr, 2.1 E-5/calendar year6 System ) Baseline Train Unavailability and Green/White Threshold Green/White Threshold White/Yellow Threshold Yellow/Red Threshold Unreliability 951

Auxiliary 

h%ile (ACDF = I E-6/,ear) (ACDF =1E-5/year) (ACDF =I E-4/year) Feedwater (MDP Train Unreliability') 8.6E-3 2.1 E-2 1.E-2 2.1E-2 .IE-I (TDP Train Unreliability') 1.9E- 1 3.4E- 1 2.1 E- 1 3.713- 1 Not Reache, (MDP Train Unavailability. LI.E-3 2.4E-3 1. 1 E-2 2.9E-2 2.1l E- I 

(TDP Train Unavailabilit) 4.6E-3 2.9E-2 N 2. E-ached' N• Re8aE-d Not Reached5 Component 

Water 

ooling -(Train Unreliabili' 1.6-2 4.E--2 2.513- 7.4RE-1 Not Reached 

Emergency AC Power 

( Train Unavail.) 1.IE-2 4.61E-2 Not Reached' Not ReachedT - Not Reached' ( ne Unrreliabili 9.7E-2 N4/E-2 4.7E-2 7.E-2 1.7XE-e (Train Unavalblt)97- 6.4E-2 4.813-2 1.2E-1 7.8 E- I 

High 

Injection 

Pressure (Cr Tne Unreliability') NneE-2 TBD 8.23-2 3.3E-a 188 In 3-1 (SI Train Unavailability) 4.2N/-3 3.2na-3 1.2E-X S Otel 9.9E- 1 Not Reached 

Valves Unreliability) 3iE-2 6.8E-2 5.8E-2 2.5-1 Not Reached (Train Unavailaciluity ) N/Ar3 N/A N/the reli 

3.N/, &Mevnt ntinluedinSPR/ogc 

Residual/Decay Heat (Train Unreliability') 1.2EW 2 3.5E-2 9.9E-2 3.5EE- a Removal c Not Reached 

Service Water6 

(Train Unavailabiligs a7.3E-3 4.6wE-2 Not Reachedd -- Not bNot Reachldow Reachedi (Train Unreliability') 1.E-I 2.3E-I Not Reached Not Reached Not Reached AOS Co... 

(Train 

mponent 

Unavailabilty 

Class Unreliabw. 

5.513-2 1.8E-1 Not Reached Not Reached Not Reached N/A Increase 4.7X Increase I100X Not Reached IMOVs 

1MDPs C_..omponent 

Compnent Class Unrelibit N/A Increase 2.0X Increase 8.2X Increase 34X Class Unrelliabili-t... N/A "• Increase 1.2X -increase 2.7X i Increase I11X I1, Total unreliability, includes T&M 

2. AOV component class does not include failure to re-close of the reliefs. 

3. N/A, T&M events not included in SPAR logic. 4. 

5. This 

The primary SWS load is the RHR HTX. SWS is a backup to circ: water. The EDG's are self cooled. threshold can be reached if the T&M outages associated with this system are not confined to TECH SPEC allowable combinations. 6. Calendar year is defined as 7000 critical flours.

ON
Table A.2.4-27 WE 4-Lp Plant 1/2 Mitigatm Systems Threshold Summa 

WE 4-Lp Plant 1/2 SPAR 3 i (1.OE-8/hr, 7.2E-5/calendar year) 

WE 4-L Plant 1/2 RBPI.Baseline 0IE-8/hr 9.8E-5/calendar ar 

System/Component Baseline Train Unavailability and Green/White Threshold Green/White Threshold White/Yellow Threshold Yellow/Red Threshold 

Unreliabilit 95"hile (A) ( = /eACDF =IE-5/year ACDF =IE-4/year 

Auxiliary Feedwater (MDP Trainn UnreliabiliL 8.5E-3 2.OE-2 1.1E-2 3.5E-2 2.7E-I 

DDP Train Unreliabili 2.4E-2 6.2E-2 2.4E-2 2.8E-2 7.3E-2 

(M Trin l• 2.5E-3" 7.4E-3 6.3 E-2 6.013-1 

EeiSv Train Unlabili8.0-3 

5.4E-2 

Component Cooling (T a Unreliabii7E2 3.1E-2 NI5E-I 4.0E-16 8.6E- I 

Water rv bilit' 2.2-2 TBi 

Reached 

E2m'rency labili AC 2.2E-1 4.6E-2 7.3u 

b-2 

2.iE-I 

Poe (Tan Tai nviailt)97- 1.9E-2 -- 1.6E-2 7.3 E-2....E

High Pressure (S-Ibd Tri ý 9.6E.ab 3 _2.2E-2 -- 2.613--"2 1.6E-1....._ Not reached 

Injection (Includes Jclasono ncluabil e i.3E-2 1.0 Not reached Not reached 

CVCS trains) tsn Train unadvaed 1.6E-2 3.0E-2 2,5E- I Not reached 

..ua cCTrCn S raib Unavail.nhe S d TBD'e Not reached Not reached Not reached 

Power Relief Valves Operated can b (Train m relached UnavailabilitY ithe T oga te hh 6.8Em2 4a0E-2 T incnE-e1 6.2E-t N/_A7 / /' / 

Residual/Decay Heat Tri rliability) 1.9E--2 4.9E-2 1.I1E-2 8.4E-2 2.8 E-!1 

> Removal (Train Unavailabilit 7.E-_3 2.4E-2f'" 8.3E-2 4.0E- I NotRecd 

SEssential :Servicee (TanUrlabl A- 1.6E-2 1.513-2 4.8E-2 2. iE- i 

<> Water (._Train Unavailability 5.E3TD 1.5E-1 -- Not Reacher Not Reached 

A s C_.omo-nent Classq Unreliabiiy N/A Increase00OX increase 235X Not Reached 

Increase 1.1XIncrease 36X

M..DPs Comyonent Class Unreliabilit N/A m 3 . nrae3.6X Inces 3 

I1. Calendar year is defined as 7000 critical hours. 

2. Total unreliability, includes T&M. 

3. AOVs component class does not include failure to re-close the reliefs. 

4. N/A, T&M events not included in SPAR logic. 

5. The corresponding unavailability event in the SPAR model does not include a probability distribution. 

6. This threshold can be reached if the T&M outages associated with this system are not confined to TECH SPEC allowable combinations.
Table A.2.4-28 WE 4-LP Plant 10/11 Mitigating Systems Threshold Summary 

WE 4-LP Plant 10/11 SPAR 3i (3.51E-9/hr, 2.5E-5/calendar year6) WE 4-LP Plant 10/11 RBPI Baseline (3.6E-9/hr, 2.5E-5/calendar ear6

) System Baseline Train Unavailability and Green/White Threshold Green/White Threshold White/Yellow Threshold Yellow/Red Threshold Unreliability 95th%ile (ACDF= 1E-6/year) (ACDF =1E-5/year) (ACDF = IE-4/year) Auxiliary Feedwater (MDP Train Unreliability') 8.7E-3 4.6E-4 1.3E-2 4.0E-2 1.6E-! (TDP Train Unreliability') 1.9E- I 3.5E-! 2.3E- I 5,OE- l Not Reached (MDP Train Unavailability) 1. 1E-3 2.4E-3 2. I E-2 i.3E-I Not Reached (TDP Train Unavailability) 4.6E-3 2.9E-2 2.3E-1 5.IE-l Not Reached Component 

Water 

Cooling (Train Unreliability') 1.6E-2 4.8E-2 1.2E-1 3.4E-1 7.9E-I (Standby Train Unavail.') l.IE-2 3.3E-2 Not Reached' Not Reached' Not Reached' Emergency AC Power (Train Unreliability') 3.9E-2 2.0E- 1 4. I E-2 5.9E-2 1.6E- 1 (Train Unavailability) 9.7E-3 6.2E-2 4.4E-2 8.6E-2 5.OE-I Chemical and Volume (CVCS Train Unreliability') 2.OE-l 3.0E-I Not Reached Not Reached Not Reached Control System (CVCS Train Unavailability) 2.OE-I 2.8E-1 Not Reached Not Reached Not Reached 

High Pressure (SI Train Unreliability') 1.6E-2 3. IE-2 3.7E-2 2. 1 E-I 8.7E-1 Injection (SI Train Unavailability) 4.2E-3 2.8E-2 5.3E-2 4.2E-I Not Reached 

Power Operated Relief (System Unreliability') 3.8E-2 3.8E-2 6.3E-2 2.6E-1 Not Reached Valves (Train Unavailability ) N/A3 N/A3 N/A3 N/A3 N/A3 

Residual/Decay 

Removal 

Heat (Train Unreliability') 2.6E-2 5.8E-2 2.513-2 7.3E-2 3.6E--I (Train Unavailability) 7.3E-3 3.OE-2 5.6E-2 3.9E- 1 Not Reached Emergency Service (Train Unreliability') 1.8E-2 4.7E-2 5.9E-2 1.9E-1 4.8E-1 Water' (Train Unavailability) 9.9E-3 3.6E-2 Not Reached5 Not Reached' Not Reached' AOVs 2 

MOVs 

Component Class Unreliability N/A Increase 123X Increase 560X Not Reached 

MDPs 

Component Class Unreliabilit N/A Increase 1.6X Increase 6.6X Increase 50X Component Class Unreliability N/A Increase 1.4X Increase 4.7X Increase 19X 

1. Total unreliahilitv include. T,9,NA

2. 3, 3. 

4, 

5. 

6.

AOV component class does not include failure to re-close of the reliefs. 

N/A, T&M events not included in SPAR logic. 

The primary ESW load is the RHR HTX. 

This threshold can be reached if the T&M outages associated with this system are not confined to TECH SPEC allowable combinations. 

Calendar year is defined as 7000 critical hours.
Table A.2.4-29 WE 4-Lp Plant 22/23 Mitigating Systems Threshold Summary 

WE 4-Lp Plant 22/23 SPAR 3i (4.7E-9/hr, 3.3E-5/calendar year') 

WE 4-Lp Plant 22/23 RBPI Baseline (4.9E-9/hr. 3.4E-5/calendar ear') 

System Baseline Train Unavailability and Green/White Threshold Green/White Threshold White/Yellow Threshold Yellow/Red Threshold 

Unreliability 951h%ile (ACDF =I E-6/year) (ACDF =I E-5/year) (ACDF =I E-4/year) 

Auxiliary Feedwater (MDP Train Unreliability') 8.7E-3 2.1 E-2 9.8E-3 1.8E-2 5.4E-2 

(TDP Train Unreliability' 1.9E-1 3.4E-1 2.OE-i 2.9E- I Not Reached 

(MIPP Train Unavailability) 1. I E-3 2.5E-3 3.7E-3 2.8E-2 2.5E-i 

(TDP Train Unavailability) 4.6E-3 1.8E-2 2.1 E-2 1.7E-I Not Reached 

Component Cooling (Train Unreliability') 1.6E-2 4.7E-2 2.OE- I 6.5E-1 Not Reached 

Water (Standby Train Unavail.) I.IE-2 4AE-2 7.8E-14 Not Reached Not Reached 

Emergency AC Power (Train Unreliability') 4.2E-2 1.OE-l 4.3E-2 5.5E-2 1.3E-1 

(Train Unavailability) 9.7E-3 1.9E-2 1.3E-2 3.9E-2 3.OE-I 

High Pressure (SI Train Unreliability5 ) 9.7E-3 2. I E-2 8.8E-1 Not Reached Not Reached 

Injection (Includes (SI Train Unavailability) 4.2E-3 1.6E-2 Not Reached 6 Not Reached 6 Not Reached 6 

CVCS trains) (CVCS Train Unreliabili 5.9E-2 1.9E-1 4.3E-1 Not Reached Not Reached 

(CVCS Train Unavailability) 5.4E-2 1.7E-1 Not Reached 6 Not reached 6 Not Reached 6 

Power Operated Relief (System Unreliability) 3.2E-2 6.8E-2 5.7E-2 2.6E-I Not Reached 

Valves (Train Unavailability) N/A' N/A N/A' N/A3 N/A3 

Residual/Decay Heat (Train Unreliability') 1.7E-2 3.8E-2 3.8E-2 1.3E-I 4.7E-1 

Removal (Train Unavailability) 7.3E-3 2.4E-2 9.3E-2 8.8E-l Not Reached 6 

Service Water (Train Unreliability') 3.2E-2 9.4E-2 1.3E-1 2.1E-1 3.2E- l 

(Standby Train Unavail.) 2.7E-2 9.0E-2 Not Reached*6 Not Reached 6 Not Reached 6 

AOVs' Component Class Unreliability N/A Increase 2.2X Increase 13X Increase 106X 

MOVs Component Class Unreliability N/A Increase 2.4X Increase I IX Increase 39X 

MDPs Component Class Unreliability N/A Increase 1.2X I Increase 3.2X Increase 16X

I. 

2. 

3. 

4. 

5. 

6.

Calendar year is defined as 7000 critical hours. 

AOV component class does not include failure to re-close of the reliefs. 

N/A, T&M events not included in SPAR logic. 

Two normally running CCW trains with one train in standby. 

Total unreliability, includes T&M. 

This threshold can be reached if the T&M outages associated with this system are not confined to TECH SPEC allowable combinations.
Table A.2.4-30 WE 4-LP Plant 28 Mitigating Systems Threshold Summary 

WE 4-LP Plant 28 SPAR 3i (5.OE-9/hr, 3.5E-5/calendar year6) WE 4-LP Plant 28 RBPI Baseline (3.8E-9/hr, 2.7E-5/calendar year6) System Baseline Train Unavailability and Green/White Threshold Green/White Threshold White/Yellow Threshold Yellow/Red Threshold Unreliability 951h%ile (ACDF = 1E-6/year) (ACDF =1E-5/year) (ACDF =I E-4/year) Auxiliary Feedwater (MDP Train Unreliability') 9.7E-3 2.2E-2 1.5E-2 4.7E-2 1.8E-1 

(TDP Train Unreliability') 1.9E- 1 3.5E- I 2.IE-I 3.5E- I Not Reached 

(MDP Train Unavailability) 1.IE-3 2.5E-3 2.4E-2 1.5E-1 Not Reached (TDP Train Unavailability) 4.6E-3 1.6E-2 2.IE-! 3.6E- I Not Reached 

Component Cooling (Train Unreliability') 1.6E-2 4.8E-2 5.6E-2 3.4E-I Not Reached Water (Standby Train Unavail.4) l.lE-2 4.6E-2 1.3E-1 Not Reached5 Not Reached' 

Emergency AC Power (Train Unreliability') 4. I E-2 L.OE- I 4.3E-2 5.5E-2 1.3E-1 

(Train Unavailability) 9.7E-3 6.3E-2 4.4E-2 7.OE-2 3.3E-I Chemical and Volume (CVCS Train Unreliability') 5.9E-2 1.8E-1 7.4E-I Not Reached Not Reached Control System (CVCS Train Unavailability) 5.4E-2 1.6E-1 Not Reached Not Reached Not Reached 

High Pressure (SI Train Unreliability') 9.4E-3 2. IE-2 4.8E-! Not Reached Not Reached Injection (SI Train Unavailability) 4.2E-3 2.6E-2 Not Reached Not Reached Not Reached 

Power Operated Relief (System Unreliability') 2.OE-2 2. 1 E-2 2.8E-2 1.6E- I Not Reached Valves (Train Unavailability ) N/A3 N/A 3 N/A3 N/A3 N/A3 

Residual/Decay Heat (Train Unreliability') 1.9E-2 5.1E-2 2.6E-2 7.6E-2 3.7E-1 Removal (Train Unavailability) 7.3E-3 2.8E-2 8.4E-2 6.5E-1 Not Reached5 

Essential Raw Cooling (Train Unreliability') 5.IE-2 L.IE-I 8.OE-2 1.6E-1 2.9E-1 Water4 (Train Unavailability) 2.7E-2 9.4E-2 5.3E-I Not Reached5 Not Reached5 

AOVs 2 Component Class Unreliability N/A Increase 4.2X Increase 24X Increase 105X 

MOVs Component Class Unreliability N/A Increase 2.3X Increase I IX Increase 41X MDPs Component Class Unreliability N/A Increase 1.6X Increase 5.8X Increase 23X

2. 

3. 

4. 

5. 

6.

= ".JI.4l U-Sl ~I~IUI.lLy", 55,U I I €,.IKLVI 

AOV component class does not include failure to re-close of the reliefs. 

N/A, T&M events not included in SPAR logic. 

The primary ESW load is the RHR HTX and the diesel generators. This threshold can be reached if the T&M outages associated with this system are not confined to TECH SPEC allowable combinations. 

Calendar year is defined as 7000 critical hours.
Table A.2.5-1 Summary of nspection Areas Impacted by New RBPIs for Mitigating System Cornerstone 

RBPI Attribute Inspection Area 

Full Power: 

Mitigating Systems (UR) Equipment Performance 71111.04, Equipment Alignment 

71 111.12, Maintenance Rule Implementation 

71111.15, Operability Evaluations 

71111.22, Surveillance Testing 

71152, Identification and Resolution of Problems 

Mitigating Systems (UA) Equipment Performance 71111.12, Maintenance Rule Implementation 

Human Performance 71111.14, Personnel Performance During Nonroutine Evolutions 

(Pre-Event) 71152, Identification and Resolution of Problems 

Configuration Control 71111.04, Equipment Alignment 

71111.12, Maintenance Rule Implementation 

71111.13, Maintenance Risk Assessments and Emergent Work Evaluation 

71111.23, Temporary Plant Modifications 

71152, Identification and Resolution of Problems
"* Type A elements are those that have an effect on LERF, at least partly because they have an 

effect on CDF. For example, the change in CDF associated with degradation of a mitigation 

system that plays a role in key accident sequences (transients and SBLOCAs involving high 

RCS pressure) could carry over directly to a change in LERF. 

"* Type B elements are those that have an effect on LERF, but largely independent of CDF. An 

example of this is the containment isolation function, the degradation of which usually has no 

modeled effect on CDF. 

Given a model that comprehensively addresses a Type A element's impact on CDF, its impact on 

LERF can be assessed using a relationship of the form: 

ALERF = (Factor) x (ACDF affecting LERF sequences), 

where "Factor," a number less than 1, is adjusted to reflect the effects on containment failure 

probability of relevant accident sequence characteristics such as RCS pressure. 

For some Type A mitigating systems or initiating events, it may be found that LERF is more 

limiting than CDF for purposes of determining the performance thresholds of RBPIs associated 

with these elements. This has not been assessed so far, due to the lack of integrated CDF/LERF 

models available to this project. 

The present emphasis under the Containment Integrity portion of the Barrier Integrity cornerstone 

is on Type B elements. In ongoing work, Type A elements will be more comprehensively 

assessed, based if necessary on the approximate treatment developed for the SDP. 

A.3.1 Assess the Potential Risk Impact of Degraded Performance 

Unlike the analyses that address initiating events and mitigating systems, there are no functioning 

SPAR models for directly calculating changes to LERF resulting from element performance 

changes. This is a major limitation on proceeding with the RBPI development process. 

Nevertheless, a scoping assessment.has been made, based on the Individual Plant Examination 

(IPE) submittals and the associated IPE Database (Ref. 5), supplemented by the NUREG-1 150 

(Ref. 20) assessments, the review of the IPEs in NUREG-1560 (Ref. 21), and other containment 

analyses. 

General insights were obtained from Refs. 20 and 21. The general assessment of the LERF

significance of Type B elements is summarized for the five containment types in Table A.3.1 -1.

A-75
Table A.3.1-1 Assessment of Elements of LERF-Significant Containment Barrier 

Attributes for PWRs with Large-Dry Containments 

Plant Type Element LERF Significance 

PWRs with Containment Isolation Major 

Large Dry 

Containments 

PWRs with Ice Containment Isolation Major 

Condenser Ice Condenser Function Major 

Containments Hydrogen Ignitors Major 

BWRs with Suppression pool bypass Intermediate 

Mark I Isolation condenser (for some Mark I's) Intermediate 

Containments Drywell spray Intermediate 

Operator actions (drywell spray) Intermediate 

EOPs Not Modeled but 

"Intermediate" 

BWRs with Suppression pool bypass Intermediate 

Mark I Drywell Spray Intermediate 

Containments EOPs Not Modeled but 

"Intermediate" 

BWRs with Containment Isolation Intermediate 

Mark III Suppression pool bypass Intermediate 

Containments Hydrogen Ignitors Intermediate 

I Drywell Spray Intermediate 

Although containment heat removal is not generally considered to be highly significant to LERF, 

it is modeled at some PWRs as playing a role in core damage prevention and in prevention of 

large early releases. This, too, is a Type A function, and needs to be examined within an 

integrated CDF/LERF perspective. Ongoing work (examining all remaining plants) will establish 

whether this function is risk-significant at enough plants to warrant RBPI treatment. 

An examination of selected IPE results tabulated in Ref. 5 has been carried out by determining 

the containment-barrier-related elements affecting particular plant damage states, and using this 

information to try to infer how plant damage state frequency (and therefore release frequency) 

would change if element performance changed. Where this can be quantified, it is presented as a 

worst-case estimate of the change in LERF, i.e., it assumes complete degradation of element 

performance. In some cases, information presented in the IPE Database is not sufficiently 

detailed and explicit to confirm the importance of elements that were described above as 

important to LERF; this is indicated in the tables as an insufficiency of information presented. 

The IPE Database presents results, but was not intended to support requantification exercises of 

this kind. This approach is therefore limited. Nevertheless, some results are obtainable; they are 

provided in Tables A.3.1-2 to A.3.1-6.

A-76
Table A.3.1-2 Assessment of Potential Changes in LERF Due to Element Performance Changes for PWRS with Large-Dry Containments Including Sub-Atmos heric 

Plant Containment Failure Element Maximum 

Mode and Frequency "ALERFt 

ANO-2 Large Bypass 3.78E-7 Containment isolation 3.01 E-5 

Large Isolation 7.82E-7 

Large Early 1.53E-6 

Small Early 1.39E-6 

Late 4.73E-6 RCS depressurization 0* 

None 2.48E-5 

Braidwood Large Bypass 0 Containment isolation 2.66E-5 1&2 Large Isolation 0 

Large Early 0 

Small Early 0 

Late 2.73E-6 

None 2.39E-5 

Wolf Creek Large Bypass 7.3 1E-8 Containment isolation 4.18E-5 

Large Isolation 4.95E-8 

Large Early 3.83E-8 

Small Early 0 

Late 1.37E-6 

None 4.05E-5 

* For cases involving LERF, RCS depressurization is either unavailable, or occurs due to a hot leg or surge line 

break (ref. ANO-2 IPE, Section 4.6.5, and CETs) 

t Maximum ALERF is the change in LERF that would be caused by total failure of the element in question. 

Table A.3.1-3 Assessment of Some Potential Changes in LERF Due to Element Performance Changes for PWRs with Ice Condenser Containments

Plant Containment Failure Element Maximum 

Mode and Frequency ALERF 

Catawba l&2 Large Bypass 1.03E-7 Containment isolation 5.77E-5 

Large Isolation 2.9E-8 

Large Early 3.53E-8 

Small Early 0 

Late 2.72E-5 Ice condenser* (Insufficient 

None 3.05E-5 Information) 

ifl "' ',.".L- 11"O .... ny as 1.. 1 IL-b• .otim n islto.55 ,.,.. •vv Large B~ypass TI I E:-6 Containment isolation 5.5 1E-5 l&2 Large Isolation 6.26E-9 

Large Early 9.25E-7 

Small Early 1.5813-9 Ice condenser* (Insufficient 

Late 1. 13E-6 

None 5.4E-5 Information)

A-77

- __________________ L
Table A.3.1-3 (Continued) 

Plant Containment Failure Element Maximum 

Mode and Frequency ALERF 

McGuire Large Bypass 9.48E-7 Containment Isolation 3.86E-5 

1&2 Large Isolation 1.28E-7 

Large Early 0 

Small Early 8.10E-7 

Late 1.62E-5 Ice condenser* (Insufficient 

None 2.17E-5 Information) 

Sequoyah Large Bypass 7.99E-6 Containment Isolation 1.59E-4 

1&2 Large Isolation 0 

Large Early 2.73E-6 

Small Early 0 

Late 8.32E-5 Ice condenser* (Insufficient 

None 7.60E-5 Information) 

Watts Bar Large Bypass 2.46E-5 Containment Isolation 2.8E-4 

Large Isolation 8.91 E-6 

Large Early 8.14E-6 

Small Early 0 Ice condenser* (Insufficient 

Late 7. 1 E-5 Information) 

None 2.18E-4

* IPE insufficient to determine ALERF

Table A3.1-4 Assessment of Potential Changes in LERF Due to Element Performance

; r,,,- fwlU with Md[rk I Containments

Plant Containment Failure Element Maximum 

Mode and Frequency ALERF 

Peach Bottom Large Bypass 6.64E-9 Drywell spray/ 01 

2&3 Large Isolation 0 flooding systems 

Large Early 2.57E-7 

Small Early 0 

Late 1.40E-6 Suppression pool 02 

None 2.57E-6 bypass 

Quad Cities Large Bypass 6E-10 Drywell spray/ Insufficiently 

1&2 Large Isolation 0 flooding systems Modeled 

Large Early 1.38E-7 

Small Early 3.52E-8 

Late 6.62E-7 Suppression pool Insufficiently 

None 2.53E-7 bypass Modeled 

4... . L . •yii spay I T .... L -" Lh,

Vermont 

Yankee

Large Bypass 

Large Isolation 

Large Early 

Small Early 

Late 

None

4.3E-8 

0 

1.1 lE-6 

0 

9.89E-7 

1. 16E-6

Drywell sprays flooding systems

2. Suppression pool 

bypass

Modeled

Insufficiently 

Modeled

I _______________ I __________

A-78

angv'a
Table A.3.1-4 (Continued)

Note: For some BWR Mark I plants, isolation condenser performance may be a key element, but is not part of 

containment barrier performance 

'Coolant injection to drywell or initiation of containment flooding is important for PDSs where there is low vessel 

pressure 

2For some PDSs, suppression pool bypass typically results in late releases; therefore, ALERF will not increase. For 

other PDSs, if the suppression pool is not bypassed, the release is small early; however, when the suppression pool is 

bypassed, the release is large early. Therefore, for these PDSs, the ALERF can increase by some fraction of the small 

early release when the suppression pool was not bypassed 

Table A.3.1-5 Assessment of Potential Changes in LERF Due to Element Performance 

Changes for BWRs with Mark II Containments 

Plant Containment Failure Element Maximum 

Mode and Frequency ALERF 

Nine Mile Large Bypass 2.79E-8 Suppression pool bypass (Insufficiently 

Point 2 Large Isolation 0 modeled) 

Large Early 1.58E-6 

Small Early 1.08E-6 

Late 2.04E-5 

None 8.30E-6 

WNP 2 Large Bypass 2.98E-8 Suppression pool bypass (Insufficiently 

Large Isolation 2.26E-7 modeled) 

Large Early 4.89E-6 

Small Early 0 

Late 5.30E-6 

None 6.83E-6 

Table A.3.1-6 Assessment of Potential Changes in LERF Due to Element Performance

ges for ISWKs with mark 111 Containments 

Plant Containment Failure Element Maximum 

Mode and Frequency ALERF 

Grand Gulf I Large Bypass 0 Containment isolation 1.05E-6 

Large Isolation 0 

Large Early 5.97E-6 

Small Early 1.36E-6 Suppression pool bypass (Insufficiently 

Late 5.66E-6 modeled) 

None 3.51E-6 

River Bend Large Bypass 0 Containment isolation 1.53E-5 

Large Isolation 4.12E-7 

Large Early 0 

Small Early 4.13E-6 Suppression pool bypass (Insufficiently 

Late 2.14E-6 modeled) 

None 8.98E-6 

Perry 1 Large Bypass 0 Containment isolation 1.1 E-5 

Large Isolation 3.96E-9 

Large Early 2.14E-6 

Small Early 9.1 2E-7 Suppression pool bypass* (Insufficiently 

Late 4.76E-6 modeled) 

None 5.30E-6

*At Perry, suppression pool bypass events (omer than those that involve drywell tailure) have a frequency or 0.

A-79

than
Based on the information summarized in the above tables, it is concluded that performance 

degradation in the following equipment-related elements could cause significant changes in 

LERF: 

0 For Large-Dry PWRs, containment isolation 

* For Ice-Condenser PWRs, in addition to containment isolation, the Ice-Condenser 

function and the Hydrogen Control (ignitor) function (not in table) 

* For Mark-i BWRs, suppression pool bypass, drywell spray, and isolation condenser 

(some Mark-i s) 

o For Mark-2 BWRs, suppression pool bypass 

* For Mark-3 BWRs, suppression pool bypass and containment isolation 

These areas are frequently modeled, but are not reflected in models currently available to this 

project. 

A.3.2 Obtain Performance Data for Risk-Significant, Equipment-Related Elements 

Plant-specific performance data for these elements are not currently available to this project. 

A.3.3 Identify Indicators Capable of Detecting Performance Changes in a Timely Manner 

Although data for the above elements are not available to this project, based on Appendix F and 

on work presented in Sections A. I and A.2, it is judged that essentially passive elements or 

elements that are only infrequently challenged are not amenable to RBPI development. Based on 

this, the following elements have been identified from the LERF-significant elements listed 

above as having the potential to be RBPIs. Each possible indicator is applicable to different 

containment types: 

"* Unreliability / unavailability of drywell spray (Mark I BWRs, Mark II BWRs, Mark III 

BWRs) 

"* Unreliability / unavailability of large containment isolation valves (PWRs, Mark III BWRs) 

(valves isolating paths that connect the containment atmosphere directly to the outside 

atmosphere) 

"• Unreliability / unavailability of hydrogen ignitors (Ice Condenser PWRs, Mark III BWRs) 

A.3.4 Identify Performance Thresholds Consistent with a Graded Approach to 

Performance Evaluation from SECY 99-007 

Although the RBPI development process has established the risk significance of the functions 

identified above in Section A.3.3, models and data available are not sufficient to establish 

baseline performance values and to quantify thresholds. LERF models exist for some PWR large 

dry containments and PWR ice condenser containments, as well as BWR Mark I containments. 

Therefore, BWR Mark II and Mark III containments, as well as some PWR containments, do not 

have LERF models developed for establishing threshold values. In addition, the existing models 

can only link with the older and less complete Revision 2QA SPAR models. Therefore, some

A-80
accident sequences that could affect LERF cannot be propagated through the LERF models 

because they are not included in the Revision 2QA SPAR models. 

Moreover, drywell spray is closely identified with Type A functionality (low pressure injection and suppression pool cooling). This means that RBPIs and thresholds for certain mitigating 

systems and certain containment-related systems need to be evaluated together within an integrated CDF/LERF perspective. Similarly, although containment heat removal is not generally an important contributor to LERF, in some PWRs it has a role in core damage prevention and in prevention of large early releases. This, too, is a Type A function, and needs to be examined 

within an integrated CDF/LERF perspective. 

When applicable models and data are obtained, RBPI development will be completed for these 

potential RBPIs. In addition, RBPIs previously analyzed under the initiating events and 

mitigating systems cornerstones will also be re-examined to determine whether LERF 

considerations alter the findings of Sections A. 1 and A.2. 

A.3.5 Inspection Areas Covered by New RBPIs 

These RBPIs are not among the performance indicators in the ROP. The inspection areas that could be impacted by these RBPIs were determined. The results are summarized in 

Table A.3.5-1. 

Table A.3.5-1 Summary of Inspection Areas Impacted by Potential RBPIs for 

Containment Portion of Barrier Integrity Cornerstone 

RBPI Attribute Inspection Area 

CIV (UR&UA) and Design Control 71111.02, Evaluation of Changes, Tests, or Experiments Drywell Spray 71111.17, Permanent Plant Modifications 

(UR&UA) 71111.23, Temporary Plant Modifications 

71152, Identification and Resolution of Problems 

Barrier Performance 71111.12, Maintenance Rule Implementation 

71111.15, Operability Evaluations 

71111.20, Refueling and Outage Activities 

71111.22, Surveillance Testing 

A.3.6 LERF as the Figure of Merit for Containment Barrier Performance 

A.3.6.1 The Definition of LERF 

Regulatory Guide 1.174 defines LERF as follows: 

"In this context, LERF is being used as a surrogate for the early fatality QHO. It is defined as the frequency of those accidents leading to significant, unmitigated releases from containment in a time frame prior to effective evacuation of the close-in population such that there is a potential for early health effects. Such accidents generally include unscrubbed releases associated with early [containment failure at or shortly after vessel breach, containment bypass events, and loss

A-81
of containment] isolation. This definition is consistent with accident analyses used in the safety 

goal screening criteria discussed in the Commission's regulatory analysis guidelines. An NRC 

contractor's report (Ref. 22) describes a simple screening approach for calculating LERF." 

Definition used in the RBPI Program: 

A number of requirements and constraints peculiar to the RBPI Program contribute to a (slight) 

reformulation of the definition of LERF from that in Regulatory Guide 1.174. These are: 

Since quantitative determinations will be made as part of the RBPI process, it is necessary to 

assume a quantitative value for "large." The large release threshold is defined by 

volatile/semi-volatile fission product releases greater than 2.5% (i.e., the release of iodine, 

cesium, or tellurium greater than 2.5% is considered large). The reason for this choice is 

three-fold: (1) releases at or above this level have been shown to result in early fatalities 

(Ref. 23), thus maintaining consistency with the qualitative definition in Regulatory Guide 

1.1 74; (2) this definition is one of three considered (Ref. 22) (the other two are "... greater 

than 10%" and "all releases, regardless of release magnitude); and (3) this definition allows 

for effective use of the IPE database to determine large-early release sequences and LERF. 

This large release threshold, of course, can be changed if warranted. 

The definition of "early" in the IPEs and the IPE Database is generally consistent with the 

definition of "early" in Regulatory Guide 1.174, that is, "... in a time frame prior to effective 

evacuation of the close-in population such that there is a potential for early health effects." In 

the absence of health effect and evacuation analysis in the IPEs, this definition has been 

translated into a containment failure definition, based on the occurrence of the first 

radiological release from the containment (containment failure) relative to time of failure of 

the reactor vessel. "Early Release," then, is any release before, at, or shortly after (usually a 

few hours) vessel failure. Although the IPEs vary in the demarcation from early to late, that 

is, the specific number of hours after vessel failure, they are sufficiently consistent for the 

purposes here. "Early" as used here is no different from "early" in the IPE Database. 

A.3.6.2 The Justification for Using LERF as a Containment Barrier Metric 

The issue arises as to why LERF is used alone, rather than (or in combination with) a metric that 

includes "late" large releases. In this report, LERF has been used based on its role in risk

informed regulation as described in Regulatory Guide 1.174. It can be argued that the E-4/yr core 

damage frequency (CDF) objective is more limiting than the late release frequency criterion that 

one would derive from the latent fatality QHO, and this argument has been used to justify a focus 

on LERF. 

However, focusing exclusively on LERF as a metric for the containment barrier does not assign 

risk significance to those elements of containment barrier performance discussed in SECY 99

007 that do not affect either CDF or LERF significantly, although they affect late release 

frequency or other post-accident considerations such as worker dose. Moreover, if performance 

bands for large late release frequency were derived from the latent fatality QHO in the same way 

that performance bands for LERF are derived from the early fatality QHO, then performance 

A-82
thresholds for many of these significant elements would be implied, where currently they are not. 

The possibility of considering late releases in near-term RBPI development will be discussed 

with stakeholders. 

A.4 References 

1. SECY-99-007, "Recommendations for Reactor Oversight Process Improvements," U.S. 

Nuclear Regulatory Commission, January 8, 1999. 

2. Poloski, J. P., et al., Rates of Initiating Events at US. Nuclear Power Plants: 1987 

1995, NUREG/CR-5750, Idaho National Engineering and Environmental Laboratory, 

February 1999. 

3. "Development of Risk-Based Performance Indicators: Program Overview," Attachment 1 

to SECY-00-146, "Status of Risk-Based Performance Indicator Development and 

Related Initiatives," U.S. Nuclear Regulatory Commission, June 28, 2000. 

4. Atwood, C. L., et al., Evaluation of Loss of Offsite Power Events at Nuclear Power 

Plants: 1980 - 1996, NUREG/CR-5496, INEEL/EXT-97-00887 (USNRC, 1998). 5. Su, T. M., et al., "Individual Plant Examination Database - User's Guide," NUREG

1603, U.S. NRC, April 1997. 

6. Long, S. M., P. D. Reilly, E.G. Rodrick, and M. B. Sattison, "Current Status of the 

SAPHIRE Models for ASP Evaluations," Proceedings of the 4th International Conference 

on Probabilistic Safety Assessment and Management (PSAM 4), pp. 1195-1199, 

September 13-18, 1998. 

7. U.S. Nuclear Regulatory Commission, An Approach for Using Probabilistic Risk 

Assessment in Risk-Informed Decisions On Plant-Specific Changes to the Licensing 

Basis, Regulator Guide 1.174, July 1998. 

8. World Association of Nuclear Operators (WANO) Performance Indicator Program Utility Data Coordinator Reference Notebook, INPO 96-003, Institute of Nuclear Power 

Operations, September 1996. 

9. Grant, G. M., et al., Isolation Condenser System Reliability, 1987-1993, Idaho National 

Engineering and Environmental Laboratory, INEL-95/0478, August 1996. 

10. Poloski, J. P., et al., Reactor Core Isolation Cooling System Reliability, 1987-1993, Idaho 

National Engineering and Environmental Laboratory, AEOD/S97-02, INEL-95/0196, 

August 1996. 

11. Grant, G. M., et al., High-Pressure Coolant Injection System Performance, 1987-1993, 

Idaho National Engineering and Environmental Laboratory, INEL-94/0158, February 

1995. 

12. Grant, G. M., et al., Emergency Diesel Generator Power System Reliability, 1987-1993, 

Idaho National Engineering and Environmental Laboratory, INEL-95/0035, February 

1996. 

13. Poloski, J. P., et al., Reliability Study: A uxiliary/Emergency Feedwater System, 198 7

1995, Idaho National Engineering and Environmental Laboratory, NUREG/CR-5500, 

Vol. 1, INEL/EXT-97/0740, August 1998. 

14. Poloski, J. P., et al., High-Pressure Core Spray System Reliability, 1987-1993, Idaho 

National Engineering and Environmental Laboratory, INEL-95/00133, January 1998.

A-83
15. Equipment Performance and Information Exchange System (EPIX), Volume 1 

Instructions for Data Entiy, Maintenance Rule and Reliability Information Module, 

INPO 98-001, Institute of Nuclear Power Operations, February 1998. 

16. Reliability and Availability Database System (RADS), Version 1.0, Critical Design 

Review Document, February 1999. 

17. Atwood, C. L., et al., Evaluation of Loss of Offsite Power Events at Nuclear Power 

Plants: 1980 - 1996, NUREG/CR-5496, INEEL/EXT-97-00887 (USNRC, 1998). 

18. EPRI (Electric Power Research Institute), PSA Applications Guide, EPRI TR-105396, 

Final Report, August 1995. 

19. U.S. Nuclear Regulatory Commission, Monitoring the Effectiveness of Maintenance at 

Nuclear Power Plants, Regulatory Guide 1.160, Revision 2, March 1997. 

20. "Severe Accident Risks: An Assessment for Five U.S. Nuclear Power Plants," NUREG

1150, U.S. NRC, December 1990 (including the NUREG/CR-4550 NUREG/CR-4551 

series of support documents). 

21. "Individual Plant Examination Program: Perspectives on Reactor Safety and Plant 

Performance," NUREG-1560, U.S. NRC, December 1997. 

22. Pratt, W. T., et al., "An Approach for Estimating the Frequencies of Various Containment 

Failure Modes and Bypass Events," BNL, NUREG/CR-6595, January 1999. 

23. Hanson, A. L., et al., "Calculations in Support of a Potential Definition of Large 

Release," NUREG/CR-6094, BNL, May 1994.

A-84
APPENDIX B 

RBPI DETERMINATION FOR SHUTDOWN MODES

B-i
Contents

Preface ......................................................... 5 

B. 1 Initiating Events Cornerstone ......................................... 10 

B.-1.1 Assess the Potential Risk Impact of Degraded Performance .......... 10 

B. 1.2 Obtain Performance Data for Risk-Significant, Equipment-Related 

Elem ents .................................................. 15 

B. 1.3 Identify Indicators Capable of Detecting Performance Changes in a Timely 

M anner ..................................... .............. 15 

B. 1.4 Identify Performance Thresholds Consistent with a Graded Approach 

Outlined in SECY 99-007 .................................... 15 

B.2 Mitigating Systems Cornerstone ....................................... 15 

B.2.1 Assess the Potential Risk Impact of Degraded Performance .......... 15 

B.2.2 Obtain Performance Data for Risk-Significant, Equipment-Related 

Elem ents .................................................. 16 

B.2.3 Identify Indicators Capable of Detecting Performance Changes in a Timely 

M anner ................................................... 16 

B.2.4 Identify Performance Thresholds Consistent with a Graded Approach 

Outlined in SECY 99-007 .................................... 28 

B.2.5 Inspection Areas Covered by New RBPIs ........................ 30 

B.3 Barrier Integrity Cornerstone .......................................... 30 

B .4 References ..................... .................................. 32 

Figures 

Figure B-1 Summary of PRA Results for PWRs ..................................... 8 

Tables 

Table B-i Summary of PRA Results for PWRs ..................................... 7 

Table B. 1-1 Time W indow Definitions ........................................... 12 

Table B.1-2 Calculation of Weighted CCDPs for BWR Shutdown Initiators .............. 12 

Table B. 1-3 Generic Initiating Event Frequency Estimates for PWRs ................... 12 

Table B. 1-4 Estimates of CCDPs for Various POS Groups and Time Windows (SPAR 

Generated data; Applicable to PWRs) ....................................... 13 

Table B. 1-5 Calculation of Weighted CCDP for PWR Shutdown Initiators [Weighted by 

Residence Time (RT) in Each POS Group] - Applicable to PWR Plants ............ 14 

Table B.2-1 PWR Shutdown Configuration Conditional CDF (Based on a Generic 

Westinghouse 4-Loop Shutdown PRA Model) ................................ 19

B-3
Table B.2-2 BWR Shutdown Configuration Conditional CDF (Based on NUREG/CR-6166 

R esults) .............................................................. 20 

Table B.2-3 PWR Shutdown Configurations Risk Classification (Based on a Generic 

Westinghouse 4-Loop Shutdown PRA Model) ................................ 21 

Table B.2-4 BWR Shutdown Configurations Risk Classification (Based on NUREG/CR-6166 

R esults) .............................................................. 23 

Table B.2-5 Baseline and Thresholds for Time in Risk-Significant Configurations Indicators 

PW R s ................................................... ............ 29 

Table B.2-6 Baseline and Thresholds for Time in Risk-Significant Configurations Indicators 

B W R s ................................................................ 30 

Table B.2.5-1 Summary of Inspection Areas Impacted by Potential Shutdown RBPIs for 

M itigating Systems Cornerstone ........................................... 30

B-4
Preface

This appendix develops one specific type of possible RBPI, which is based on total time spent in 

risk-significant configurations at shutdown. As seen in the following subsections, there are 

significant difficulties associated with this formulation, deriving partly from the nature of the risk 

contributions at shutdown and partly from the information needs of this particular formulation. 

Based on this, and as a result of internal and external stakeholder comments, it has been decided 

to transfer the development presented in this appendix for mitigating system RBPIs to NRR for 

possible use in the Significance Determination Process for shutdown-related findings. 

The remainder of this preface summarizes key issues affecting the development. 

RBPI Development for Shutdown vs. RBPI Development for Full Power 

The following conditions make RBPI determination for shutdown significantly different from 

RBPI determination for full power operation. 

At shutdown, the risk is strongly dependent on the RCS condition and on the operability 

of mitigating systems. Risk metrics plotted as a function of time exhibit pronounced 

increases and decreases as RCS conditions change and accident mitigating systems are 

removed from service and returned to service. 

Human-induced initiating events are relatively more frequent during shutdown than 

during power operations. 

• The risk is strongly dependent on operator response to initiating events. 

• Configuration management is a more significant factor in shutdown safety than in full 

power safety. 

Shutdown occupies a much smaller fraction of the year than does full power operation, so 

shutdown-specific reliability, availability, and frequency metrics would accumulate 

failure data much more slowly than do comparable metrics for full power. Relatively few models for shutdown CDF and LERF are available compared to model 

availability for full power. 

Model Availability 

Because of lack of plant-specific shutdown PRA models, the RBPI determination process has to 

rely on risk insights gained from the representative models available to this project. Only two 

quantifiable shutdown PRA models were available to this project. 

A draft version of the Sequoyah SPAR model (which is based on the Surry LPSD PRA 

model) (Ref. 1) 

A generic Westinghouse 4-loop shutdown model developed for use in the Safety Monitor 

Version 2.0 software. (Ref. 2) 

The Grand Gulf LPSD PRA model (Ref. 3) was selected as the reference model for BWR plants. The results of this PRA were used to develop thresholds for PIs. This project did not have access 

to a working version of the Grand Gulf PRA model.

B-5
Shutdown PRA Model Insights

Based on the results of the shutdown PRAs for Surry and Grand Gulf, the following factors 

dominate the risk of shutdown. 

Early phase of cold shutdown at PWRs: 

• High decay heat 

• Overpressurization of RHR causing a rupture 

Mid-loop at PWRs 

• High decay heat 

• RCS loops isolated (no steam generator cooling capability) 

* High maintenance unavailabilities and human error probabilities (e.g., over-draining) 

Cold shutdown at PWRs 

• RCS loops isolated 

* High maintenance unavailabilities and human error probabilities 

• Failure of thimble tube seals 

Startup at PWRs 

0 Rapid boron dilution (French reactivity scenario) 

Cold shutdown at BWRs 

• LOCA/diversions 

• Unavailability of safety relief valves (alternative means of core cooling) when the vessel 

head is on 

• High maintenance unavailabilities 

• High human error probabilities when decay heat is high 

• Failure of makeup from the suppression pool for LOCAs 

Difficulties Associated with Defining a Baseline CDF 

Baseline values are a special problem at shutdown compared to full power. At full power, the 

overall configuration is constrained by technical specifications, and with a few typical PRA 

assumptions (technical specifications are not violated, all legal configurations occur with 

probabilities determined by the products of the unavailability of individual elements, decay heat 

is always computed as if the reactor were at the end of a cycle, ...), baseline performance can be 

characterized in a straightforward manner. At shutdown, the plant configuration is much more 

discretionary, and determining baseline risk is therefore less straightforward than at full power. 

Shutdowns vary widely in risk, according to what kinds of operating states are entered, the 

respective dwell times, and what configurations within those states are realized. Early PRAs 

(e.g., Surry and Grand Gulf LPSD studies), in generating average risk values, effectively 

averaged over a broad range of configurational possibilities consistent with operating practices 

that were current at that time. In principle, these studies could be used to assess baseline 

performance, but operating practices have changed significantly since those studies were

B-6
performed, and adopting those risk values as baselines in the current program would not serve 

the aim of maintaining risk at current levels. 

Modem shutdown PRAs (on-line risk monitors) essentially require the input of a specific outage 

schedule (configurations and dwell times), so that outage-specific risk figures of merit can be 

obtained. Determining baseline values from such a model logically requires that either a 

particular outage schedule be designated as "baseline," or a set of outage schedules be taken in 

the aggregate to define "baseline." In this report, a representative outage schedule and a 

representative annual frequency of outage have been assumed (it is assumed that the baseline 

annual risk predicted by the reference PRA model approximates the risk of shutdown for plants 

belonging to the class). 

Baseline Annual CDF for PWRs at Shutdown 

The core damage frequency during a typical outage can vary by several orders of magnitude. The 

cumulative risk caused by the entry into risk-significant configurations (those with relatively high 

conditional CDF or conditional LERF) represents a significant portion of the total average risk. 

The entry into certain RCS vulnerable conditions (e.g., mid-loop operation in PWRs) is 

unavoidable due to the nature of the outage. Also, many equipment maintenance and testing activities are scheduled during shutdown conditions. Because the threshold values can only be 

developed after a realistic baseline yearly CDF is established, an attempt was made to arrive at a 

baseline CDF by surveying shutdown PRAs. The results for PWR plants are shown in Table B-I 

and in Figure B-1. The CDF values reported for PWRs are generally between 1.OE-5 and 1.OE-4. 

The following clarifications are noted: 

In items 1-10, the reported CDFs 

* are predicted using IPE-like PRA models, 

* reflect past shutdown practices (pre-NUMARC initiative, Ref. 10), and 

• are underestimated in some cases because of the scope of the models. 

The CDF reported in items 11-13 

• is either the actual cumulative risk or target risk associated with a recent outage in 

a PWR plant, and 

* reflects present shutdown practices (post-NUMARC initiatives). 

Table B-1 Summary of PRA Results for PWRs 

PRA Study (PWR) CDF (per calendar year) 

1 NSAC-84 (1981) (Quoted in Ref. 4) 1.8E-05 

2 NUREG/CR-5015 (Quoted in Ref. 4) 5.2E-05 

3 Seabrook (Quoted in Ref 4) 4.5E-05 

4 Sequoyah (upper bound for LOCAs only) (Quoted in Ref. 4) 7.5E-05 

5 Safety MonitorTM model for a generic Westinghouse plant 3.1 E-05 

(zero maintenance assumption) (Ref. 2) 

(Assuming two outages every 18 months and 30 days per 

outage)

B-7
Table B-1 (Continued) 

PRA Study (PWR) CDF (per calendar year) 

6 NUREG/CR-6144 (midloop only) (Ref. 5) 5.OE-06 

7 NUREG/CR-6616 (zero maintenance assumption) (Ref. 6) 1.2E-05 

(Assuming two outages every 18 months and 30 days per 

outage) 

8 Sequoyah SPAR model (Ref. 1) 1.OE-04 

(Assuming two outages every 18 months and 30 days per 

outage) 

9 Surry (RES study; cold shutdown only; zero maintenance) 3.2E-06 

(Ref. 7) 

10 Surry (RES study; cold shutdown only; with maintenance) 4.4E-05 

(Ref. 7) 

11 STP (1RE08; projected) (Ref. 8) 5.6E-05 

(Assuming two outages every 18 months) 

12 STP (2RE06) (Ref. 8) 5.3E-05 

(Assuming two outages every 18 months) 

13 STP (1RE07) (Ref. 8) 5.3E-05 

(Assuming two outages every 18 months) 

14 IN 2000-13, Review of Refueling Outage Risk (Table 1, Ref. 1.7E-4 

9) (Assuming two outages every 18 months) range: [2.8E-6, 8.9E-41

1.0E-03 

1.OE-04 

1.OE-05 

S.OE-06

2 3 4 5 6 7 8 9 10 11 12 13 14 15 

PRA Study

Figure B-1 Summary of PRA Results for PWRs

Item 14, derived from IN 2000-13 (Ref. 9), represents a more recent survey of outage risk 

experience. The following PWR shutdown risk information is provided in IN 2000-13: 

With respect to the cumulative risk data, (both predicted and actual) an extremely wide 

range of values were observed with respect to the outage risk. When pooled, the data

B-8

0 1
(associated with the actual risk) for the PWRs showed a cumulative mean core damage 

probability (CDP) of approximately 1.2E-04 for the outage. However, the values ranged from a 

low of 1.5E-06 to a high of 6.6E-04 with a standard deviation of 2.OE-04. (Twelve data points 

were used in the analysis.) These same wide ranges of values were observed with respect to the 

data associated with the predicted cumulative risk. The mean value for the PWR peak risk (in 

units of cdp/hr) was 1.6E-06/hr. As with the cumulative risk data, a wide range of values were 

observed with a high of 5.OE-06/hr, a low of 2.OE-08/hr and a standard deviation of 2.1E-06/hr. 

Elsewhere in IN 2000-13, it is noted that some of the reported variation in the numbers is due to 

differences in assumptions and methods used in different evaluations. However, it is further 

stated that another major source of variation in the risk numbers is variation in the outages 

themselves. A significant factor in PWR outage risk is reduced-inventory operation. According to 

IN 2000-13: 

The majority of the PWR outages which were assessed employed an early "hot" midloop 

or reduced inventory configuration. This was almost exclusively an economic 

consideration in that the early midloop allowed for earlier entry into the steam generators 

to perform the required inspection activities. In order to eliminate the midloop, licensees 

would have been required to delay the steam generator entry until after the reactor vessel 

was defueled. This would have had the net effect of making the steam generator 

inspections "critical path" (i.e., the driving factor for the outage duration) in many 

instances thereby increasing the overall length of the outage. Even with the 

implementation of the early midloop, the steam generator inspection activities constituted 

the critical path for many of the refueling outages which were assessed. For the vast 

majority of the PWR outages, either the steam generator inspections or the actual 

refueling activities themselves constituted the critical path for the outage. 

Midloop configurations contribute significantly to the total CDF, especially those occurring 

before 5 days after reactor shutdown. RBPI development needs to reflect this. 

Baseline Annual CDF for BWRs at Shutdown: 

Relatively little published information is available for BWR shutdown risk. The following results 

are provided in IN 2000-13. 

The data for the BWR plants included only three observations. Additionally, one of the 

BWR units experienced unexpected complications due to fuel integrity issues which 

significantly extended the duration of the outage. Similar to the PWR data, a wide range 

of values existed in the cumulative and peak risk estimates associated with the BWR 

outage observations. Notwithstanding these issues related to data quality, the mean actual 

risk was estimated to be approximately 8.6E-07 with a high and low of 1.7E-06 and 2.OE

08 respectively. The peak risk was estimated at about 1.2E-08/hr with a range of 3.3E

10/hr to 3.1E-08/hr. 

Among the few published studies for BWR shutdown risk is the Grand Gulf study (Ref. 3). The 

annualized CDF indicated by that study is 4E-6 per calendar year. This is approximately a factor

B-9
of two higher than the "high" value quoted above from IN 2000-13. This difference could be due 

to the difference in average CDF as a result of dwell times rather than differences in CCDF. The 

risk information from Ref. 3 will be used to define the BWR baseline for this development. 

B.1 Initiating Events Cornerstone 

B.1.1 Assess the Potential Risk Impact of Degraded Performance 

Many events have the potential to challenge the shutdown cooling function. Examples of 

undesirable and potentially risk-significant events include: 

any unintentional, uncontrolled, undesired, and unexpected reduction of water level' in 

the reactor vessel of greater than 1 foot (a few inches during mid-loop operation in 

PWRs) 

* flow diversions from the reactor vessel, 

* inadvertent drain downs, 

* uncontrolled level perturbations in the reactor vessel. 

The more significant events are those that drain water down to a level close to or below the top of 

the core. But any undesired, uncontrolled, or unexpected draindown is an instance of poor 

performance. The same is true of violations of mode temperature or reactivity parameters. 

Reactor Mode is defined by the technical specifications in terms of temperature and reactivity 

bounds. Mode 6, for example, is k less than .95 and RCS temperature less than 1400F. Mode 5 

eff 

is k less than .99 and RCS temperature less than 2000F. If flow diversions, reactivity changes, 

or 1her events occur causing a heat production/heat removal mismatch, exceeding one of these 

mode parameters may be the first indication of performance problems. 

However, many such events do not qualify as lEs in PRA space because they do not actually lead 

to the loss of RHR. Shutdown PRAs typically do not develop these events logically below the 

level of the initiating event itself. RBPI development is therefore limited to consideration of the 

initiating events for RBPI potential. The statistics that are used to quantify these high level nodes 

may contain information on the causal factors that led to an initiating event, but, in general, these 

lower level factors are not modeled. Therefore, RBPIs cannot be based on events of this kind. 

The following are modeled initiating events that lead to the actual loss of the shutdown cooling 

function and are therefore potentially risk-significant: 

0 Loss of the decay heat removal (LDH) system (loss of RHR or a critical support system) 

. Loss or diversion of inventory (LDI) sufficient to cause loss of RHR 

0 Loss of level control (LLC) when going to mid-loop (PWRs only) sufficient to cause loss 

of RHR 

0 Loss of offsite power (LOP) causing at least momentary loss of RHR 

'Excluding normal water level fluctuations.

B-10
Based on the representative studies cited above, the risk significance of these events has been 

assessed as described below. The risk significance of these events with respect to the CDF metric 

is determined by their frequencies and their conditional core damage probabilities (CCDPs). For 

the above initiating events, the CCDPs were assessed as follows. Results presented below 

establish that all of these initiating events are risk-significant in at least some configurations. 

Assessment of Initiating Event CCDPs 

A 35-day refueling outage each 18 months of operation was assumed. It was further 

assumed that analyzing the time during which the decay heat is removed by the RHR 

system (during mode 4, 5, and 6) could capture the more risk-significant portions of a 

refueling outage. This corresponds to approximately 85% of the assumed outage time 

(29-30 days). 

Non-refueling outages consist of both scheduled outages and unscheduled outages. These 

outages share one characteristic - they vary widely from a few hours in hot standby to 

many days of cold shutdown. The latter may or may not include extended periods with 

the containment and the RCS open, and may sometimes include extended mid-loop 

operation in PWRs. For purposes of the PI analysis, it was judged that the risk of non

refueling outage operation could be estimated by assuming that the refueling outage 

results could be applied to non-refueling outages. An additional 35 days every 18 months 

is assumed for non-refueling outages. 

The assumed refueling outage and maintenance outage times of 35 days every 18 months, 

yields a power operation fraction of 87%. 

The shutdown SPAR model for Sequoyah (the reference model for PWR plants) uses the 

concept of POS groups/time windows to account for the variability in RCS conditions 

and decay heat level. The approximate correspondence between POS groups and 

operating modes of a typical PWR are as follows: 

Pressurized cooldown -- Mode 4: hot shutdown (cooldown with RHR to 2000F); 

Mode 5: cold shutdown (cooldown to ambient temperature); Mode 4: hot 

shutdown (RCS heat-up) 

Depressurized RHR cooling with normal inventory -- Mode 5: cold shutdown 

(reactor inventory is at normal level and RCS is depressurized); Mode 6: refueling 

(draining RCS to midloop before and after refueling) 

Depressurized RHR cooling with reduced inventory -- Mode 5: (mid-loop 

operation and reduced inventory) 

Depressurized RHR cooling with refueling cavity filled ---Mode 6: (refueling) 

The Grand Gulf shutdown PRA model (the reference model for BWR plants) also uses 

the concept of POS groups/time windows to account for the variability in RCS conditions 

and decay heat level. This model is however limited to the analysis of cold shutdown 

only. 

The differences in decay heat level are accommodated by introducing the time windows 

shown below in Table B.1-1.

B-11
Table B.1-1 Time Window Definitions

In Phase 2 of the Grand Gulf study, the annual CDF associated POS 5 (consisting mainly 

of cold shutdown operating condition) is estimated to be 2.1E-6 per reactor year. Based 

on the Phase 1 study, approximately 60% of the CDF occurs in POS 5. To account for the 

risk of the unanalyzed portion of the outage, the CDF of POS 5 was extrapolated linearly. 

This provided an estimate of a total baseline aggregate CDF of 3.5E-6 (2.1E-6/0.6). To 

obtain average conditional core damage probabilities (CCDPs), the hourly rate of each 

class of initiating events was converted to a calendar base rate (using the outage schedule 

defined above). The results are shown in Table B. 1-2. 

Table B.1-2 Calculation of Weighted CCDPs for BWR Shutdown Initiators 

Approximate Aggregate 

POS 5 CDF Yearly CDF 

(Based on Grand (adjusted to account for IE Frequency 1E Frequency Average 

IE Gulf Study) unanalyzed POSs) (per hour) (per year) Baseline CCDP 

LDH 9.9E-08 1.65E-07 6.16E-05 5.72E-02 2.88E-06 

LDI 1.3E-06 2.17E-06 8.74E-06 8.11E-03 2.67E-04 

LOP 7.OE-07 1.17E-06 1.50E-05 1.39E-02 8.38E-05 

Total 2.10E-06 3.50E-06 8.54E-05 7.92E-02 4.41E-05

The PWR SPAR model provided the estimates of the initiating event frequencies on a per 

hour basis (see Table B. 1-3), and the conditional core damage probability (CCDP) for 

various combinations of lEs and time windows (see Table B. 1-4). The data in Table B. 1-4 

along with the assumed refueling outage schedule are used to generate a weighted 

baseline CCDP for each initiator (Table B.1-5 below). The third and fourth columns of 

Table B. 1-5 provide the timing of entry into a POS group in terms of days after shutdown 

(DAS) and the residence time (RT) in the POS group. 

Table B.1-3 Generic Initiating Event Frequency Estimates for PWRs

2The frequency value accounts for the average amount of time that a plant is in the shutdown condition 

during a typical calendar year.

B-12

Frequency

IE Per Reactor Hour Per Calendar Year2 

LDH 8.38E-05 7.78E-02 

LDI 7.20E-05 6.68E-02 

LOP 1.63E-05 1.51E-02 

Total 1-72E-04 1.60E-0 I 

(Time- Related Initiating Events)
Table B.1-3 (Continued) 

Frequency 

Per Demand Per Calendar Year 

(assuming 2 drain downs per year) 

LLC 1.81 E-02 2.41E-02

Table B.1-4 Estimates of CCDPs for Various POS Groups and Time Windows (SPAR 

Generated data; Applicable to PWRs) 

General Mode Characteristic Baseline CCDP 

Mode POS Group Reactor RCS Time LDH LDI LLC LOP 

Inventory Boundary Window 

Mode 4/5 Pressurized RHR Normal Intact window 1 1.24E-03 1.63E-03 NA 5.17E-03 

cooldown window 2 1.04E-03 1.52E-03 5.OOE-03 

window 3 L.OIE-03 1.13E-03 4.92E-03 

window 4 1.04E-04 2.20E-04 2.78E-04 

Mode 5 Depressurized RHR Normal Intact or window 1 5.2 1E-04 7.55E-04 NA 2.43E-03 

cooling with normal vented window 2 3.34E-04 6.52E-04 1.24E-03 

inventory window 3 4.62E-05 2. 10E-04 1. 12E-03 

window 4 4.90E-05 1.92E-04 4.3 IE-04 

Mode 5 Depressurized RHR Reduced Intact or window I 9.92E-04 7.64E-04 7.64E-04 2.12E-03 

cooling with reduced vented window 2 9.69E-04 6.63E-04 6.63E-04 1.26E-03 

inventory window 3 3.32E-05 1.26E-04 1.26E-04 6.12E-04 

window 4 2.23E-05 1.08E-04 1.08E-04 1.99E-04 

Mode 6 Refueling cavity Gravity full Vessel window 1 cannot realistically reach this state 

filled head off window 2 

window 3 time to core 5.60E-043 NA time to core 

w uncovery > 48 uncovery > 48 window 4 hours 5.60E-04 hours

3The reference SPAR model does not handle this POS group. The value for the CCDP is obtained from a 

generic Westinghouse 4-loop shutdown model developed for use in the Safety Monitor Version 2.0 software.

B- 13
Table B.1-5 Calculation of Weighted CCDP for PWR Shutdown Initiators [Weighted by Residence Time (RT) in Each POS 

Group - Aplicable to PWR Plants 

Mode POS Group DAS RT Fraction LDII LDI LLC LOP 

I I~I . . o f T i ff im n n e i n II MI

State

CCDP Duration 

Weighted

CCDP Duration 

Weighted 

SccDP

CCDP CCDP iDuration 

Weighted 

CCDP

Mode 2/3 Low power I0-1 Not analyzed 

cooldown with Ss j ., - t 1n 6,A n - 5 6 213-05 5.17E-03 i 1.78E-04

Mode 4l iPressurized I<HRI. coolouwn 

hot/cold shutdown 

Mode 5 Pressurized RHR cooldown 

cold shutdown 

Mode 5 Depressurized RHIR cooling 

cold shutdown with normal inventory 

Mode 5 Depressurized RHIR cooling 

cold shutdown with reduced inventory 

Mode 6 Depressurized RI-IR cooling 

refueling with normal inventory 

Mode 6 Refueling cavity filled 

refueling 

Mode 6 Depressurized RHIR cooling 

refueling with normal inventory 

Mode 5 Depressurized RHR cooling 

cold shutdown with reduced inventory 

Mode 5 Depressurized RHR cooling 

cold shutdown with normal inventory 

Mode 4 RCS heat-up (similar to 

hot shutdown pressurized RHR cooldown) 

Mode 3/2 RCS heat-up

2-3 

3-5 

5-7 

7-9 

9-19 

19-20 

20-22 

22-27 

27-30 

30-3 5

1 0.03 

2 0.07 

2 0.07 

2 0.07 

10 0.34 

1 0.03 

2 0.07 

5 0.17 

3 0.10

1.2413-03 4.28E-05 

3.3413-04 2.30E-05 

9.6913-04 6.68E-05 

3.34E-04 2.30E-05 

0.00E+00 ! 0.0013+00 

4.621-05 I 1.59E-06 

3.3213-05 2.2913-06 

4.62E-05 O7.9713-06 

1.01F-03 1.04E-04

1.63E-03 5.62E-05 

6.52E-04: 4.50E-05 

6.63E-04;: 4.57E-05 

6.52E-04: 4.50E-05 

5.60E-041 1.93E-04 

2.10E-04:: 7.24E-06 

1.26E-04: 8.69E-06 

2. 10E-04: 3.62E-05 

I 13E-03 1.1713-04

6.6313-04

1.26E-04

5.1713-03 1.7813-04 

1.24E-03 8.55E-05 

1.26E-03 8.69E-05 

1.24E-03 8.5513-05 

0.0013+00 0.0013+00 

1.1213-03 3.86E-05 

6.12E-04 4.22E-05 

1.12E-03 1.93E-04 

4.92E-03 5.09E-04

I ,,Un-UJ 

29 1.00 3.15E-04 III i.avi-uq

i.....a

Not analyzed

I. • U It'.,-Udl

1-2
B.1.2 Obtain Performance Data for Risk-Significant, Equipment-Related Elements 

Previous work has led to the values of initiating event frequency tabulated above. Data for these 

initiating events are forthcoming because their associated reporting requirements are governed by 

the LER rule. 

B.1.3 Identify Indicators Capable of Detecting Performance Changes in a Timely Manner 

The initiating event frequencies tabulated above are too low to indicate plant-specific 

performance changes in a timely manner. Therefore, there are no shutdown-related RBPIs for the 

initiating events cornerstone. 

However, these events occur at an observable rate in the operating fleet. Therefore, these 

initiating events are referred for industry trending. 

B.1.4 Identify Performance Thresholds Consistent with a Graded Approach Outlined in 

SECY 99-007 

No RBPIs were identified, so no performance thresholds were determined. 

B.2 Mitigating Systems Cornerstone 

B.2.1 Assess the Potential Risk Impact of Degraded Performance 

Some equipment that is important at shutdown is also used at full power and is covered by RBPIs 

developed to cover full power operation. In principle, performance thresholds for these items 

should be determined based on change in total CDF resulting from performance degradation, and 

not just the change in full-power, internal-events CDF resulting from performance degradation. 

The following discussion focuses on licensee management of plant configuration during shutdown. Most licensees manage shutdown risk in accordance with Generic Letter 88-17 and 

the NUMARC-91-06 (Ref. 10) directives. These directives are designed to give the licensee 

guidance in maintaining adequate defense in depth during shutdown operations for controlling 

risk. From a risk point of view, defense in depth is maintained if, through configuration control, 

the licensee maintains an adequate mitigating capability consistent with the risk significance of 

the POS. Because technical specifications are relaxed at shutdown, there is a potential for 

entering into vulnerable RCS conditions (e.g., mid-loop in PWRs) without adequate mitigating 

capability. The shutdown PRA models surveyed have identified the unavailability of equipment 

due to maintenance as the dominant cause of loss of mitigation capability. If the duration and 

frequency of risk-significant configurations (configurations in which CCDF is relatively high; defined more explicitly below) are not controlled, the accumulated risk (core damage probability) 

can be significant.

B-15
Maintenance unavailabilities of mitigating systems and human performance responding to the 

initiating event are especially risk-significant elements that are modeled. Accident sequences 

include contributions from conjunctions of train unavailabilities. These conjunctions of 

unavailabilities are the elements of risk-significant configurations. There are many risk

significant configurations that are not covered by TS in Modes 5 and 6. It is possible for a plant 

to be in a risk-significant configuration for significant portions of an outage. 

Equipment performance is also important, but as noted above, most of the equipment involved in 

the mitigation of accidents during shutdown falls within the scope of the RBPIs developed for 

full power operation. Moreover, the reliability characteristics of the mitigating systems are not 

likely to change significantly during shutdown, because the duration of a shutdown is typically 

much shorter than the duration of full power operations. Much of the equipment used only at 

shutdown is not modeled in typical PRAs. Shutdown-specific system-level RBPIs therefore have 

limited potential. 

B.2.2 Obtain Performance Data for Risk-Significant, Equipment-Related Elements 

Performance data for the configuration element consists of a statement of plant configuration 

(availability of mitigating system trains) as a function of time. For a given shutdown, an outage 

plan is a statement of the licensee's intent. The actual configurational data will reflect not only 

equipment trains being taken out for maintenance deliberately, but also trains being unavailable 

due to failure, error, or unplanned over-running of allotted maintenance time. Calculations 

presented below were based on outage schedules considered representative. 

Routine characterization of actual plant configuration would require information collection 

beyond current reporting requirements. 

B.2.3 Identify Indicators Capable of Detecting Performance Changes in a Timely Manner 

A key element of configuration control than can be monitored is the accumulated time spent in 

risk-significant configurations during the observation period. Performance indicators are 

formulated below based on this metric. These performance indicators directly measure the time 

the plant spent in risk-significant configurations (combinations of unavailabilities and plant 

conditions with respect to decay heat and RCS inventory). 

As a result of internal and external stakeholder comments, it has been decided to transfer this 

development to NRR for possible use in the SDP for shutdown-related findings. This 

development is presented here for purposes of illustration. 

Characterization of Risk-Significant Configurations 

In order to quantify PWR CDF conditional on plant configuration (i.e., CCDF), a generic 

Westinghouse safety monitor model was quantified under different configurations that have the 

potential to occur during a typical refueling outage. The results of the evaluation of the risk 

impact of the different preventive maintenance schedules (NUREG/CR-6166, Ref. 11) contain

B-16
the estimates of CCDFs for various shutdown configurations at BWRs. The results are as shown 

in Table B.2-1 for PWRs and Table B.2-2 for BWRs. The "zero-maintenance CDF" values 

shown in each table represent the core damage frequency per day assuming all mitigating systems 

are available. The following observations are made: 

PWRs: 

The most vulnerable RCS condition is when RCS water level is low and secondary 

cooling is unavailable within the first two weeks following shutdown. The daily CCDF 

for this configuration (with zero maintenance assumption) is on the order of lE-4 per day 

up to 42 days after shutdown, and 1E-5 per day 5 or more days after shutdown. Several 

days of residence in this state can incur significant core damage probability. 

BWRs: 

The baseline CDF is highest in POS 5 when the decay heat is still high and the vessel 

head is on. 

The highest daily CCDF calculated was about 5E-5/day. This is about 2E-6/hr. This 

corresponds to two conditions: 

• When the suppression pool is drained in POS 4 or 5. The suppression 

pool provides the suction source for ECCS pumps and acts as a heat sink 

for the removal of decay heat from the core. This condition should 

definitely be captured as a risk-significant configuration. 

* When all safety relief valves are removed from service in POS 4 or 5. The 

SRVs are required for water solid closed loop core cooling following the 

loss of shutdown cooling. 

Definition of the RBPI 

The RBPIs formulated below reflect excess time spent in risk-significant configurations during 

the observation period. Four categories of configurations are defined in terms of conditional core 

damage frequency (CCDF) and, in the case of "Early Reduced-Inventory," operational 

conditions. The baseline for each category (the typical time spent in configurations associated 

with that category) has been determined by examination of representative outage profiles, as 

discussed in the Preface to this appendix. Spending time over and above the baseline duration in 

configurations having relatively high CCDF results in core damage probability above the 

baseline value. 

The configuration category definitions are as follows: 

Negligible CCDF << 1 E-6/day 

Low CCDF- 1E-6/day 

Medium CCDF - lE-5/day 

Early Reduced-Inventory CCDF - 1 E-4/day 

High CCDF- 1E-4/day

B-17
Based on these definitions, realizable configurations can be assigned to these categories based on 

the CCDF and operational conditions associated with the configuration. This is done in Table 

B.2-3 and Table B.2-4 for PWRs and BWRs respectively. 

The BWR results (Tables B.2-2 and B.2-4) are extracted from published results, and details of 

the assumptions underlying those results are not available. For the PWR case, the results 

presented were performed using a generic Westinghouse 4-loop shutdown model acquired by the 

USNRC from SCIENTECH, Inc. This model was developed for use in Safety Monitor Version 

2.0 software. The assumptions used in calculating CCDF for PWR configurations are presented 

below. 

Detailed Assumptions Underlying Calculation of CCDF for PWR Configurations 

Pressurized Cooldown (Mode 4) 

a This mode is hot shutdown. 

0 The RCS temperature is below 2750 F, and the RCS is pressurized. 

0 There is a bubble in the pressurizer. The Safety Monitor model assumes that the reactor is 

normally cooled by SG heat removal in this POS, with SG's supplied by AFW or condensate. 

Although RHR shutdown cooling is possible in this POS, the model does not have a Loss of 

RHR initiating event for this POS. 

* All SGs are supplied with secondary makeup and removing decay heat. 

0 RHR shutdown cooling is available if SG heat removal fails, but may not be the preferred 

option for the operators. If the accident goes too long without restoration of DHR, the 

primary will heat up and pressurize beyond the point at which RHR shutdown cooling can be 

established. 

0 Both RHR loops are operable. 

0 Both DG's are operable. 

0 Both PORV's are operable with block valves open. 

* 3 AFW pumps are operable, with one MD pump operating. 

* All SI signals are disabled. 

• The SI pump breakers are racked out. 

* One charging pump is providing charging flow. The other two charging pumps are racked 

out, but available. 

* All operator errors are set to nominal probabilities. 

Depressurized RHR Cooling with Normal Inventory (Mode 5) 

"* The RCS temperature is less than 200' F, and the RCS is at atmospheric pressure. 

"* The RCS is not vented. 

"* There is a bubble in the pressurizer. 

"* RHR shutdown cooling is operating.

B-18
Table B.2-1 PWR Shutdown Configuration Conditional CDF (Based on a Generic Westinghouse 4-Loop Shutdown PRA Model) 

Representative Configurations Occurring in a Typical Outage 

POS Configuration CDF 

No Backup Electrical Power Support Cooling Secondary Emergency Injection Otber Trains 

Maitenanl RIR Unavail- Train Trains Unavailable Trains Unavailable Cooling Trains Unavailable Unavailable 

Trains 

able Unavail

Group Mode RCS Days Unavailability RI-R One Two One One One Train One Train able RWST Two SI Both Two All SG All SG All SG 

Boundary Afler EDG EDG Safety- Safety- of ESW of CCW (All SGs) Sumps PORV and and and Both Srut- Related Related PORV RWST Sum"ps 

down AC Bus DC Bus 

Pressurized Mode 4 1 lot Intact 4 7.713-08 1.5E-07 8.51:-07 2.4E-05 1.2E-06 3.0E-07 7.4E-07 2.7E-07 7.7E-06 7.92-08 1.3E-06 3.OE-07 

Cooldown shutdown 

Depressurized RHR Mode 5 Cold Intact 8 1.9E-08 2.3E-08 4.1E-08 6.81-07 7.1 E-07 4.3E-08 3.81-07 3.8E-07 1.2E-06 8.8E-07 1.9E-08 1.4E-06 1.6E-06 1.1E-04 1.11E-04 1.IE-04 

Cooldowr Willi shutdown 

Nonral Inventory 

Depressurized RI-JR Mode 5 Cold Intact or 12 3.813-07 6.813-07 4.1E-07 1.21-06 1.9E-06 4.12-07 1.3E-06 1.3E-06 1.2E-05 1.7E-06 3.8E-07 9.2E-06 1.9E-06 1.1E-04 1.1E-04 1.1E-04 

Cooling Willi shutdown isolatable 

Reduced Inventory 

Depressnrized RHR Mode 5 Cold vented 13 1.0E-05 1.5E-05 L.IE-05 1.7E-05 5.8E-05 1.0E-05 1.6E-05 1.61-05 1.1E-04 L.OE-05 1.7E-05 

Cooling wilh slrrtdowr 

Reduced Inventory 

Refrreling Cavity Mode 6 vented 14 3.3E-08 2.2E-07 3.8E-08 2.5E-07 2.7E-07 3.8E-08 2.2E-07 2.2E-07 3.8E-08 3.3E-08 1.2E-05 

Filled 

Depressurized RIIR Mode 5 Cold vcrted 24 3.7E-06 5.313-6 4.OE-06 9.6E-06 I.IE-06 4.01-06 4.0E-06 5.6E-06 1. 1E-4 3.7E-06 9.813-06 

Cooling Witli shutdown 

Reduced lnvenrtory 

Low Inventory Configurations Occurring Early in a Typical Outage 

Depressrn ized RIIR Mode 5 Cold Intact or 2 3.0r-06 5,1E-06 3.013-06 3.61-06 3.613-06 3.52-06 3.0E-06 5.0E-06 1.1E-04 3.0E-06 3.02-06 2.813-05 3.0E-06 1.11E-04 1.11-04 1.3E-04 

Cooling Witlr shutdown isolatable 

Reduced Inventory 

Depressurized RHR Mode 5 Cold vented 2.5 1.11E-04 1.6E-04 I.IE-04 1.2E.04 1.613-04 1.1E-04 1.11E-04 1.61-04 1.11E-04 1.1E-04 1.3E-04 

Cooling with shutdown 

Reduced Irventory 

Depressurized RJIR Mode 5 Cold vented 7 2.4E-05 3.5E-05 2.4E-05 3.3E-05 6.91-05 2.22-05 2.4E-05 3.5E-05 1.1E-04 2.413-05 3.612-05 

Cooling with Shutdown 

RReduced Inventory
Table B.2-2 BWR Shutdown Configuration Conditional CDF (Based on NUREG/CR-6166 Results) 

Description POS 4 POS 5 POS 6 POS 7 

Hot Shutdown Cold Shutdown Refueling Refueling 

(vessel head is on) (with vessel head off and (with vessel head off and 

level raised to steam lines) tipper pool filled) 

Zero Maintenance, Baseline 1.3E-07 3.4E-07 -IE-8 -IE-8 

Emergency Diesel Generator III (dedicated to HPCS) 2.6E-07 4.8E-07 -IE-8 -IE-8 

Condensate System (CDS) 1.1E-07 3.4E-07 -11-8 -IE-8 

Control Rod Drive Train B 1.2E-07 3.51-07 -IE-8 -~IE-8 

Emergency Diesel Generator (EDG) I 4.6E-07 8.51-07 -IE-8 -IE-8 

Emergency Diesel Generator II 4.61-07 8.5E-07 -IE-8 -IE-8 

Standby Service Water Train C (dedicated support system to HPCS) 9.6E-07 1.3E-06 -IE-7 -IE-8 

SuppIession Pool (empty) 2.3E-05 5.5E-05 5.8E-06 1.3E-06 

Residual Heat Removal System Train (RHR) A 1.2E-07 3.5E-07 ~1E-7 -11-8 

Residual Heat Removal System Train C 1.2E-07 3.5E-07 -IE-8 -IE-8 

Standby Service Water (SSW) Train A 4.91-07 1.IE-06 1.2E-07 -11-7 

All Safety Relief Valves (SRV) 4.51-05 5.1E-05 N/A N/A 

)ivision I Battery 4.6E-07 8.5E-07 -1E-8 -11-8 

Division 11 Battery 4.6E-07 8.5E-07 -11-8 -11-8 

)ivision Ill Battery 2.6E-07 4.8E-07 -11-8 -11-8 

High Pressure Core Spray (IIPCS) 9.3E-07 1.2E-06 -1E-7 -12-8 

Low Pressure Core Spray (LPCS) 1.1E-07 3.7E-07 -IE-8 -IE-8 

SSW Train A and HIPCS 6.3E-06 9.76-06 1.21-07 1.1E-06 

SSW Train A and CDS 4.9E-07 1. 1 E-06 1.3E-07 -11-7 

Firewater System (all three pump trains) 1. 1 E-07 3.6E-07 2.9E-07 -11-7 

Firewater Diesel-Driven Pumps 1.1 E-07 3.4E-07 -1E-8 ~lE-8 

EDGs I and 11 6.0E-06 9.1E-06 -11-7 -11-8 

EDGs I and III 1.9E-06 2.1E-06 -12-7 -1E-8 

RHR System Train A and all SRVs 6.81-05 7.4E-05 N/A N/A 

Divisions I and 11 Batteries 6.8E-05 6.9E-05 -11-7 -IE-8 

Shutdown Cooling Train A and the Suppression Pool 2.4E-05 5.8E-05 6.4E-06 1.32-06 

LPCS and HPCS 1.2E-06 1.61-06 -11-8 1.22-07 

I.PCS and RIIR Train A 1.7E-07 7.32-07 -12-7 -1E-7 

SSW Train A and SSW Train C 6.3E-06 9.7E-06 1.4E-07 1. 1 E-06 

RI.I IR Train A and RHIR Train C 3.6E-07 3.8E-07 -IE-7 -11-8

W
Table B.2-3 PWR Shutdown Configurations Risk Classification (Based on a Generic Westinghouse 4-Loop Shutdown PRA Model) 

POS Configuration Risk Classification 

No Backup Electrical Power Support Cooling Secondary Emergency Injection Other Trains 

Maintenance RHR Trains Unavailable Trains Cooling Trains Unavailable Unavailable 

Unavailability Train Unavailable Trains 

Unavail- Unavail

able able 

Group Mode RCS Days RHR One Two One One One One (All SGs) RWST Two SI° Both Two All SG All SG All SG 

Boundary After EDG EDG Safety- Safety- Train Train of Sumps PORV and and and 

Shut- Related Related of CCW PORV RWST Both 

down AC Bus DC Bus ESW Sumips 

Low Inventory Configurations Occurring Very Early (within the first 5 days) in an Outage fDepressuirized RI R Mode 5 Intact or 2 Low Med Low ILow Low Low Low Med High Low Low Med Low High High High 

Cooling with Cold isolatable 

Reduced Inventory shutdown 

Depressurized RHR Mode 5 vented < 5 ERI-V' ERI-Vb ERI-Vb 

Cooling with ColdI 

Reduced Inventory shutdown 

Representative Configurations Occurring in a Typical Outage 

Pressurized Mode 4 Intact 4 Low Med Low Low WH T Med Low 

Cooldown Hot shutdown _ Depressurized RHR Mode 5 Intact 8 Low Low Low Low Low Low Iigh High Iligh 

Cooldown with Cold 

Normal Inventory shutdown 

Depressurized RHR Mode 5 Intact or 12 Low Low Low Low Low Med Low Med d Low Ili High I ligh 1e 

Cooling with Cold isolatahle 

Reduced Inventory shutdown 

Depressurized RIIR ModeS5 vented 7 Med Med Med Med High Med Med Med High Med Med 

Cooling with Cold 

Reduced Inventory shutdown 

Depressurized RIIR Mode 5 vented 13 Med Med Med Med Ligh Med Med Med High Med Med 

Cooling with Cold 

Reduced Inventory shutdown 

Refueling Cavity Mode 6 vented 14 Med 

FilledIII 

Low Inventory Configurations Occurring Late in a Typical Outage 

Depressurized RI-R Mode 5 Vented 24 Low Med Low Med Low Low Low Med High Low Med 

Cooling with Cold 

Reduced Inventory shutdown

tK)
Notes:

a. In this configuration it is assumed that a makeup pump is available. 

b. This configuration category assumes that measures are taken to compensate for the risk associated with early reduced-inventory operations. If compensatory 

measures are not taken, these configurations are assigned to the "High" configuration category. 

Shaded cells correspond to combinations of POS and configuration that are not analyzed, either because the configuration violates the POS definition, or 

because the systems involved play no role in the POS. They include: 

- Mode 4 configurations related to complete unavailability of the secondary cooling systems. This is because it is assumed that in Mode 4 (hot shutdown) 

the heat removal function is performed by the SGs. 

- Mode 5 configurations related to complete/partial unavailability of the secondary cooling systems when the RCS is vented. This is because under vented 

RCS condition, secondary cooling is not possible. 

- Mode 6 configurations related to complete/partial unavailability of the secondary cooling systems. In this mode, secondary cooling is not possible. 

- Mode 5/6 configurations related to unavailability of PORVs when the RCS is vented. PORV operability is inconsequential when the RCS is vented. 

• Blank cells represent configurations whose CCDF < .OE-6 per day. The low CCDF for specific cells is explained below. 

t - Cell <one RHR train is OOS in Mode 4 >: the decay heat removal function is performed by AFW. Cooling by the operable RHR train and feed and bleed 

are credited. 

- Cell <one RHR train is OOS in Mode 5 and RCS is intact or isolatable>: SG heat removal is credited as recovery after RCS heats up. Feed and bleed is 

also credited. 

- Cell <one EDG is OOS in Mode 5 and RCS is intact or isolatable>: SG heat removal is credited as recovery after RCS heats up. 

- Cell <one ESW/CCW train is OOS in Mode 5 and RCS is intact or isolatable>: The equipment OOS affects RHR. SG heat removal, which is unaffected 

by the CCW/ESW outage, is credited as recovery after RCS heats up. 

- Cell <specified equipment OOS in Mode 6 and refueling cavity is flooded>: Continual boiling with water addition to vessel is credited. 

- Cell <2 sumps OOS in Mode 6 and refueling cavity is flooded>: This is a risk-significant configuration (medium ranking) because the long term 

inventory control function is lost following a LOCA. 

- Cell <two SI trains are OOS in Mode 4/5 and RCS is intact or isolatable>: Credit is taken for the isolation of the leak, initial injection by the make-up 

pumps, and secondary cooling via SGs. When the RCS is vented, secondary cooling cannot be established. 

- Cell <PORVs are OOS in Mode 5 and RCS is intact or isolatable and RCS inventory low>: a bleed path cannot be established to support cooling by a 

"feed and spill" method. The worth of the "feed and spill" success path is greater under reduced inventory conditions than under normal-inventory 

conditions. 

KeM: 

Low Low Risk Configuration AFW Auxiliary feed water RHR Residual heat removal 

Med Medium Risk Configuration CCW Component cooling water SG Steam generator 

High High Risk Configuration DC Direct Current power division RWST Refueling water storage tank 

ERI-V Early Reduced-Inventory (vented) EDG Emergency diesel generator SI Safety injection 

AC Alternating Current power division ESW Emergency service water PORV Power-operated relief valve
Table B.2-4 BWR Shutdown Configurations Risk Classification (Based on NUREG/CR-6166 Results) SConfiguration Risk Classification 

No Emergency AC/DC Trains Unavailable Support Cooling Emergency Cooling Other Trains Unavailable Maintenance Unavailability Trains Unavailable Trains Unavailable 

Group Mode RCS Boundary EDG I EDG I EDG I One Two SSW SSW SSWA HPCS LPCS SP SRVs SSW A SSW A RHR A and all SDC A and SP or II and I1 and Ill BAT BAT A C and C and empty all and and CDS SRVs division divisions POS 4 Hot shutdown Intact Low Med HPCS HPCS Low High Low Med Low Low Med Med Med High Med POS S ýCold shutdown Vsessel head on Low Med Low Low High Low Low Med Low Low High HigI Med Low High High POS 6 RFefueling Vessel head off Med Med 

(level raised to steam line) POS 7 Refueling Upper pool filled Low Low Low Low 

Note: Blank cells represent configurations whose CCDF < 1.01E-6 per day.

Key:-

Low Low Risk Configuration 

Med Medium Risk Configuration 

High High Risk Configuration 

EDG Emergency diesel generator 

BAT Battery 

SSW Standby service water

tW

HPCS High pressure core spray 

LPCS Low pressure core spray 

SP Suppression pool 

SRV Safety relief valve 

CDS Condensate system 

SDC Shutdown cooling
"* If RHR fails, SG heat removal, using AFW / condensate, is available. The SG secondary 

sides contain normal inventory. 

"• Both RHR loops are operable. 

"* Both DG's are operable. 

"* Both PORV's are operable with block valves open. 

"• Two motor driven AFW pumps are operable. 

"* All SI signals are disabled. 

"• The SI pump breakers and 1 charging pump breaker are racked out. 

"• One charging pump breaker is racked in, but the charging pump is in standby. 

"* SI and charging are "available" with operator action if required. 

"• No RCP cooling is required. 

"* All operator errors are set to nominal probabilities. 

"* Two trains of AC are operable. 

"• The RCS is at atmospheric pressure. 

"* Pipe break LOCA frequencies are reduced from those that pertain to power operation. 

"* SG tube rupture and steam line break are not postulated. 

"* Inventory diversion from the RCS (in containment) is postulated. 

"* Interfacing LOCA (due to human error) is postulated. 

Depressurized RHR cooling with Reduced inventory (Non-vented RCS in Mode 5) 

"* The RCS temperature is less than 2000 F, and the RCS is at atmospheric pressure. 

"* The RCS is not vented. 

"* The pressurizer is drained. The water level is at midloop of the cold leg. RHR shutdown 

cooling is operating. 

"• If RHR fails, SG heat removal is available through reflux cooling 

"* Both RHR loops are operable. 

"• Both DGs are operable. 

"* Both PORVs are operable with block valves open. 

"* All ESF signals are disabled. 

"* The SI pump breakers and one charging pump breaker are racked out. 

"* One Charging pump breaker is racked in, but the charging pump is in standby. 

"* SI and charging are "available" with operator action if required. 

"* No RCP cooling is required. 

"* Two trains of AC are operable. 

"* Pipe break LOCA frequencies are reduced from those that pertain to power operation. 

"* Inventory diversion from the RCS (in containment) is postulated. 

• Interfacing LOCA (due to human error) is postulated.

B-24
Depressurized RHR cooling with Reduced inventory (Vented RCS in Mode 5) 

"* The RCS temperature is less than 2000 F, and the RCS is at atmospheric pressure. 

"* The RCS is vented. 

"• The pressurizer is drained. The water level in the RCS is at midloop. 

"* RHR shutdown cooling is operating. 

"* If RHR fails, SG heat removal is not available because the RCS is vented. 

"* Both RHR loops are operable. 

"* Both DG's are operable. 

"• The PORV status is inconsequential because the RCS is vented. 

"* Gravity feed from the RWST is available. 

"• All SI signals are disabled. 

"* SI pump and charging pump breakers are racked out. 

"* SI and charging pumps are "available" with operator action if required. 

"* All operator errors are set to nominal probabilities. 

"* Two trains of AC are operable. 

"* The RCS pressure is atmospheric. 

"* Pipe break LOCA frequencies are reduced from those that pertain to power operation. 

"* Inventory diversion from the RCS (in containment) is postulated. 

"* Interfacing LOCA (due to human error) is postulated. 

Refueling (Mode 6) 

0 The RCS temperature is less than 1400 F, and the RCS is at atmospheric pressure. 

• The head is off. 

0 The refueling cavity is full. 

• RHR shutdown cooling is operating. 

0 One RHR loop is operable and operating. 

• Both DG's are operable. 

0 Gravity feed from the RWST is available. 

& All SI signals are disabled. 

* SI pump and charging pump breakers are racked out. 

0 SI and charging pumps are "available" with operator action if required. 

• All operator errors are set to nominal 

0 2 trains of AC are operable. 

* Loss of RHR cooling in this state can not lead to core damage within 24 hrs. Time to boiling 

after loss of RHR is about 15 hours. Time to core damage is greater than 48 hrs. 

• The RCS pressure is atmospheric. 

0 Pipe break LOCA frequencies are reduced from those that pertain to power operation. 

0 Inventory diversion from the RCS (in containment) is postulated. 

& Interfacing LOCA (due to human error) is postulated.

B-25
Interpretation of the Risk Significance of Shutdown Configurations

The POS group in which the accident is postulated to occur determines what systems can be 

credited for mitigation. The potential success paths are determined by the operability of 

mitigating systems at the time of an accident, and by whether the challenge to the RHR function 

is caused by a LOCA or a non-LOCA condition. The following success paths are potentially 

available: 

If the RHR function is lost as a result of a LOCA or a flow diversion: 

1. Leak termination prior to loss of RHR cooling 

2. (Makeup to RCS) AND (Spill if needed) AND (Long term re-circulation) 

If the RHR function is lost as a result of a non-LOCA condition: 

1. RHR restoration - either by repair of the lost train or alignment of the standby train 

2. Secondary cooling 

3. (Forced feed to RCS) AND (Spill) AND (Long term re-circulation) 

4. Gravity feed of the RWST through the RCS if conditions allow. 

The key characteristics of the POS group are the following: 

Water Level 

The water level in the vessel is one of the key attributes of a POS definition. In a 

Westinghouse PWR, the water level can range from mid-loop to 23' above the vessel 

flange. In mid-loop, the time to boil after a loss of RHR cooling can be as short as 10 to 

30 minutes. Time to core uncovery can be as short as 2 hours. In this configuration, the 

loss of RHR is a significant safety challenge. During refueling, when the refueling cavity 

is flooded, the time to boil can be 15 to 30 hours. The time to core uncovery after a loss 

of RHR is 2 to 3 days. In this configuration, the loss of RHR is a less significant safety 

challenge. 

RCS Pressure Boundary 

The status of the RCS pressure boundary affects the methods available for decay heat 

removal. During Modes 4, 5, and 6 the RCS can be intact (with operable relief valves), 

vented, or have the head removed. Heat removal through the steam generators and reflux 

cooling is only available when the RCS is isolatable or intact. RIR shutdown cooling is 

available in all modes. Gravity feed of the RWST (through the RHR lines) is only 

available under certain conditions when a large vent exists. Feed and bleed is available 

when the RCS is intact or when sufficient vent area exists. Avoidance of Low 

Temperature Overpressure (LTOP) is required when the RCS boundary is intact and the

B-26
RCS temperature is less than 2750 F. Charging pumps and SI pumps are usually racked 

out in Mode 4 and 5 if the RCS is not vented. This complicates operator response to 

lowering water level in response to a LOCA, and operator initiation of feed and bleed 

cooling in response to a loss of RHR. 

Decay Heat Level 

Decay heat level is important to accident sequence modeling during shutdown, because it 

determines the time available for mitigation, prior to inventory boil-off. This time affects 

the probability of successful operator action. The decay heat varies as a function of time 

from shutdown, and it depends on whether the reactor contains old fuel waiting to be off

loaded, or new fuel waiting for start-up. Over a complete refueling operation, decay heat 

levels vary by a factor of 6 from 2 days after shutdown to 30 days after shutdown with 

new fuel. Decay heat levels determine the success criteria, and the time for operator 

action. Thus the time at which an accident occurs impacts the effectiveness of mitigating 

functions. 

Based on the above, the CCDF associated with reduced inventory operations soon after shutdown 

is potentially high (> 1 E-4 per day). These configurations are nevertheless entered, but typically 

with compensatory measures in place that serve to reduce the CCDF. This is explained in IN 

2000-13: 

With respect to the time of entry into the midloop configurations, data were collected 

relative to the scheduled as well as the actual time after shutdown before midloop 

conditions were achieved. Additionally, information associated with the estimated time

to-boil while at midloop was collected. As shown in Table 1 [of the IN], the average 

scheduled time after shutdown before entering midloop was about 84 hours with the 

actual value being closer to 93 hours. (The most aggressive schedule planned a midloop 

configuration 68 hours after shutdown.) The average estimated time-to-boil for the 

reduced inventory/midloop configurations was about 15 minutes (assuming a loss of 

shutdown cooling or inventory control) with a high and low estimate of 24 minutes and 9 

minutes respectively. 

Of the PWR outages employing a midloop or reduced inventory configuration, 9 of the 15 

outages did so with a concurrent unavailability of either an emergency diesel generator or 

the performance of significant switchyard maintenance. At least one outage employed a 

midloop configuration with concurrent switchyard and emergency diesel maintenance. 

However, each of the outages prescribed a number of contingencies and other strict 

controls during midloop activities. These controls generally followed the NUMARC 

guidance with respect to protecting trains of equipment, comprehensive pre-evolution 

briefings, establishment of diverse means of level indications, and in some cases, the 

addition of temporary emergency power supplies.

B-27
The calculations presented in Table B.2-3 are based on a model that reflects the impact of decay 

heat, reduced inventory, and most aspects of equipment configuration, but not the compensatory 

measures described above. 

B.2.4 Identify Performance Thresholds Consistent with a Graded Approach Outlined in 

SECY 99-007 

The thresholds for time spent in risk-significant configurations can be developed once the 

baseline risk values are established. The baseline values need to reflect typical times spent in 

risk-significant configurations. As stated in the Preface to this appendix, the baseline at shutdown 

is a strong function of the outage plan, and assignment of a baseline for purposes of this indicator 

requires the characterization of a characteristic shutdown risk profile. 

Some insight into the expected incidence of configurations other than negligible or low can be 

obtained from IN-00013, which examined recent outage experience at selected plants. Where 

licensee risk models were available to analyze the outages, this IN reports the peak risk per hour 

in the outages examined. Based on the reported peak risk per hour, of the three BWR outages 

examined, two entered no non-negligible configurations, and the other entered only "Negligible" 

or "Low." Of the 16 PWR outages examined, 12 were evaluated using quantitative risk models. 

Of these 12, 8 entered configurations that would be considered either "Medium," "High," or 

"ERI-V" within the present classification scheme. According to the IN, most of these PWR 

outages employed an early midloop or reduced-inventory configuration (ERI-V), and many did 

so with a concurrent unavailability of either an emergency diesel generator or the performance of 

significant switchyard maintenance. However, each of the outages prescribed a number of 

contingencies and other strict controls during midloop activities, including such things as 

comprehensive pre-evolution briefings, establishment of diverse means of level indications, and 

addition of temporary emergency power supplies. 

In addition, a BWR outage schedule was and it was found that no risk-significant configuration 

was entered during that outage. 

Accordingly, based on available risk insights, the following assumptions are made: 

PWRs: 

A baseline of 20 days is assigned to "Low" risk configurations. This accounts for a total 

contribution from this category on the order of 2E-5. 

A baseline of 2 days is assigned to "Medium" risk configurations. This corresponds to a 

contribution from this category of approximately 2E-5. An important sub-set of this 

category is mid-loop operations that take place early in the shutdown, but 5 or more days 

after reactor shutdown occurs. 

A baseline of 1 day is assigned to "ERI-V" configurations. These are reduced-inventory 

configurations with the RCS vented, taking place less than 5 days after reactor shutdown 

occurs when decay heat is still relatively high. This baseline corresponds to a contribution

B-28
from this category that could be as high as 1E-4, if compensatory measures are not in 

place. 

A baseline of 0 is assigned to "High" risk configurations. A PWR plant will not 

deliberately enter into any "High" risk configurations, although it may enter ERI-V 

configurations if compensatory measures are in place. 

BWRs: 

A BWR plant does not enter into any high risk category configurations (daily CCDF 

1E-4). 

On average, 50% of the annual CDF of 4E-6 is incurred while in medium risk category 

configurations (CCDF of 1E-5) that typically last less than 6 hours. 

The remaining CDF (2E-6) is incurred while operating in low risk category 

configurations (daily CCDF of 1 E-6). This corresponds to 2 days of stay in low risk 

category configurations. 

Using the assumptions listed above, the threshold values for time spent in each risk category 

configuration are calculated. The results are shown in Table B.2-5 and Table B.2-6. 

The thresholds calculated for "ERI-V" configurations are quantified as if the associated CCDF 

were on the order of 1E-4 per day. These thresholds may be somewhat conservative if the 

compensatory measures taken upon entry into ERI-V are highly effective. However, no 

quantitative model available to this project takes credit for those compensatory measures. This is 

discussed further in Sections 3.2 and 6.6. The possible conservatism in the thresholds has been 

offset to some extent by the choice of 1 day as a baseline for ERI-V configurations. 

Table B.2-5 Baseline and Thresholds for Time in Risk-Significant Configurations 

Indicators - PWRs 

Configuration Baseline GIW Threshold W/Y Threshold Y/R Threshold 

Category 

Low 20 days 21 days 30 days 120 days 

Medium 2 days 2 days +.08 day (2 hrs) 3 days 12 days 

Early Reduced- I day 1 day 1.08 days 2 days 

Inventory (vented)a (1 day + 2 hrs) 

High 0 0 .08 day (2 hrs) 1 day 

a. This configuration category assumes that measures are taken to compensate for the risk associated with early 

reduced-inventory operations. If compensatory measures are not taken, these configurations are assigned to the 

"High" configuration category.

B-29
Table B.2-6 Baseline and Thresholds for Time in Risk-Significant Configurations 

Indicators - BWRs 

Configuration Baseline G/W Threshold W/Y Threshold Y/R Threshold 

Category 

Low 2 days 3 days 12 days 102 days 

Medium 0.20 day (5 hrs) 0.29 day (7 hrs) I day 10 days 

High 0 0 .08 day (2 hrs) 1 day 

B.2.5 Inspection Areas Covered by New RBPIs 

The potential RBPls developed above for shutdown are not currently in the ROP. The inspection 

areas that could be impacted by the new initiating event RBPIs were determined. The results are 

summarized below in Table B.2.5-1. 

Table B.2.5-1 Summary of Inspection Areas Impacted by Potential Shutdown RBPIs for 

Mitigating Systems Cornerstone 

RBPI Attribute Inspection Area 

Time in Configuration Control 71111.04, Equipment Alignment 

High/Medium/Low 71111.13, Maintenance Risk Assessments and Emergent 

Risk-Significant Work Evaluation 

Configurations 71111.20, Refueling and Outage Activities 

71111.23, Temporary Plant Modifications 

B.3 Barrier Integrity Cornerstone 

No quantifiable models of LERF at shutdown were available to this project to support application 

of the full flowchart process presented in Section 2 of the main report. The following discussion 

is based on risk insights summarized below. 

Containment performance at shutdown is affected by one issue that does not enter into 

consideration of full-power RBPIs, namely, that containment may be open during shutdown, and 

needs to be reclosed expeditiously under certain conditions. The situation for specific plant types 

is as follows: 

PWRs: 

Analysis performed in NUREG-1449 shows that timely closure of PWR containment 

prevents large early release in core damage scenarios initiated at shutdown.

B-30
BWRs with Mark-I and Mark-IL Containments:

Analysis performed in NUREG-1449 shows that BWR secondary containment alone is 

not expected to prevent large early release in core damage scenarios. This means that a 

change in BWR Mark-I and -IL shutdown CDF equates to a change in LERF if primary 

containment is open. This circumstance is offset by generally lower shutdown CDFs for 

BWRs. 

BWRs with Mark-III Containments: 

Analysis performed in NUREG/CR-6143 shows that timely closure of these BWR 

containments prevents large early release in core damage scenarios initiated at shutdown. 

This suggests possible containment RBPIs analogous to the possible time-in-risk-significant

configurations RBPIs defined above in Section B.2.2. These would be defined for the risk

significant configuration categories introduced for the RBPIs defined for mitigating systems as 

follows. 

Potential RBPI for PWRs and Mark-III BWRs: 

Time spent in risk-significant configurations with containment not closed and 

preparations for timely closure not complete (timely: before boiling, if RCS is vented) 

Potential RBPI for Mark-I and Mark-Il BWRs: 

Time spent in risk-significant configurations with primary containment not closed and 

not capable of timely closure. 

An increase in time spent in a particular configuration with containment not capable of timely 

closure implies an increase in LERF equal to the CDF associated with that configuration. 

Configurations with negligible conditional CDF are therefore associated with negligible changes 

in LERF (except for changes in CDF that exceed 1.OE-7, which would not be considered 

negligible changes in LERF). However, risk-significant configurations contribute directly and 

significantly to LERF if containment is open and timely closure is not provided for. 

Configurations in which only a short time is available to respond to initiating events are also 

generally those in which only a short time is available to effect containment closure. 

Data and models are not presently available to quantify these indicators. Therefore, neither 

baselines nor thresholds can be quantified. Quantification of these indicators would require the 

following:

B-31
"* the time spent in risk-significant configurations defined in Section B.2.3, 

"* the time spent with containment in the indicated state during those risk-significant 

configurations, and 

"* extension of the treatment in Section B.2.3 to assessment of configurations in which the CDF 

change exceeds 1.OE-7. 

B.4 References 

1. Thatcher, T. A., et al., "Accident Sequence Precursor Extension to Low Power, Shutdown, 

and External Events Feasibility Study (Sequoyah Model)," Idaho National Engineering and 

Environmental Laboratory, Lockheed Idaho Technologies Company, January 1996. 

2. A Generic Westinghouse 4-Loop Shutdown Model Developed for Use in the Safety 

Monitor Version 2.0 Software, acquired by USNRC from SCIENTECH, Inc. 

3. "Evaluation of Potential Severe Accidents During Low Power and Shutdown Operations at 

Grand Gulf, Unit 1," NUREG/CR-6143, SAND93-2440, Vol. 1, U.S. NRC, July 1995. 

4. "Shutdown and Low-Power Operation at Commercial Nuclear Power Plants in the United 

States," NUREG-1449, U.S. NRC, 1993. 

5. "Evaluation of Potential Severe Accidents during Low Power and Shutdown Operations at 

Surry Unit-i," NUREG/CR-6144, U.S. NRC, October 1994. 

6. "Risk Comparison of Scheduling Preventive Maintenance During Shutdown vs. During 

Power Operation for PWRs," NUREG/CR-6616, BNL-NUREG-52549, U.S. NRC, 

December 1998. 

7. T. L. Chu, Private Communication, based on work done for NUREG/CR-6144 (Ref. 5). 

8. "Perspective on Shutdown Issues at STP," Presented to the "Use of Low Power and 

Shutdown Risk in Regulatory Activities Public Workshop," April 27, 1998. 

9. "Review of Refueling Outage Risk," IN 2000-13, U.S. NRC, September 27, 2000. 

10. "Guidelines for Industry Actions to Assess Shutdown Management," NUMARC 91-06, 

NUMARC, December 1991. 

11. "Risk Impact of BWR Technical Specifications Requirements During Shutdown," 

NUREG/CR-6166, SAND93-3998, Sandia National Laboratories, U.S. NRC, October 

1994.

B-32
APPENDIX C

RBPI DETERMINATION FOR EXTERNAL EVENTS 

ACCIDENT RISK

C-1
Contents

C.1 Initiating Events Cornerstone ............................................ 6 

C. 1.1 Assess the Potential Risk Impact of Degraded Performance ................. 6 

C. 1.2 Obtain Performance Data for Risk-Significant, Equipment-Related Elements .. 12 

C. 1.3 Identify Indicators Capable of Detecting Performance Changes in a Timely 

M anner ......................................................... 12 

C. 1.4 Identify Performance Thresholds Consistent with a Graded Approach to 

Performance Evaluation from SECY 99-007 ............................ 12 

C.1.5 Outputs of RBPL Development Process ................................ 12 

C.2 Mitigating Systems Cornerstone ........................................ 12 

C.2.1 Assess the Potential Risk Impact of Degraded Performance ................ 13 

C.2.2 Obtain Performance Data for Risk-Significant, Equipment-Related Elements .. 13 

C.2.3 Identify Indicators Capable of Detecting Performance Changes in a Timely 

M anner ......................................................... 13 

C.2.4 Identify Performance Thresholds Consistent with a Graded Approach to 

Performance Evaluation from SECY 99-007 ............................ 14 

C.2.5 Outputs of RBPI Development Process ................................ 16 

C.3 Barrier Integrity Cornerstone: Containment Performance ..................... 16 

C .4 References ......................................................... 17 

Tables 

Table C-1 Significance of Fire CDF Relative to Internal Events CDF .................... 5 

Table C.I.1-1 Significant Fire Areas for Browns Ferry ................................ 7 

Table C. 1.1-2 Significant Fire Areas for Clinton ..................................... 7 

Table C. 1.1-3 Significant Fire Areas for Davis-Besse ................................. 7 

Table C. 1.1-4 Significant Fire Areas for Dresden 2 .................................. 8 

Table C.1.1-5 Significant Fire Areas for Dresden 3 .................................. 8 

Table C. 1.1-6 Significant Fire Areas for Duane Arnold ............................... 8 

Table C. 1.1-7 Significant Fire Areas for Fort Calhoun ................................ 8 

Table C. 1.1-8 Significant Fire Areas for H.B. Robinson 2 ............................. 9 

Table C. 1.1-9 Significant Fire Areas for Millstone 2 ................................. 9 

Table C.1.1-10 Significant Fire Areas for Monticello ................................. 9 

Table C.1.1-11 Significant Fire Areas for North Anna 1 &2 ........................... 10 

Table C.1.1-12 Significant Fire Areas for Prairie Island .............................. 10 

Table C.1.1-13 Significant Fire Areas for Quad Cities 1 .............................. 10 

Table C.1.1-14 Significant Fire Areas for Sequoyah 1&2 ............................. 11 

Table C. 1.1-15 Significant Fire Areas for Waterford 3 ............................... 11 

Table C.1.1-16 Significant Fire Areas for Washington Nuclear 2 ....................... 11 

Table C.2.4-1 Potential Automatic Suppression System Thresholds for Mitigating Systems 

Cornerstone - External Events (Fire) ................................. 14

C-3
Table C.2.4-2 Significant Post-Fire Safe Shutdown Systems for Mitigating Systems 

Cornerstone - External Events (Fire) ................................. 15 

Table C.2.5-1 Summary of Inspection Areas Impacted by Potential External Event (Fire) 

RBPIs for Mitigating Systems Cornerstone ............................ 16

C-4
Appendix C: RBPI Determination for External Events Accident Risk 

This appendix provides preliminary RBPI results for fire. Other external events, such as seismic 

and flood, are not included in the scope of Phase 1 RBPI development. 

The results from the Individual Plant Examinations for External Events (IPEEE's) were used to 

assess the risk-significant performance attributes in accordance with the RBPI development 

process shown in Figure 2.1. In addition, the Fire Protection Risk Significance Screening 

Methodology, used in the current fire significance determination process (Ref. 1), was reviewed 

to provide additional insights to the use of IPEEE information. The IPEEE results are not 

collated in as comprehensive a way as was done for the IPE program, although draft NUREG

1742 (Ref. 2) does provide a comprehensive summary of the perspectives gleaned from the 

technical reviews of the IPEEE submittals. These studies indicate that fire CDF varies 

significantly among plants. However, fire CDF is generally high enough that some elements of 

fire scenarios are risk-significant compared to risks associated with full power internal events or 

shutdown risk. Specifically, NUREG- 1742 states "... the CDFs from accidents initiated by fires 

are of the same order of magnitude as those from other random internal events for the industry 

taken as a whole." 

The following IPEEE reports were reviewed (Refs. 3 through 17):

Browns Ferry 2

Clinton

Davis-Besse 

Dresden 2&3 

Duane Arnold

Fort Calhoun

H.B. Robinson 2 

Millstone 2 

Monticello 

North Anna 1&2

Prairie Island

Quad Cities 1&2

Sequoyah l&2 

Waterford 3 

Washington Nuclear 2

Table C- I below shows a comparison of fire CDF to internal events CDF for the above plants. 

Table C-1 Significance of Fire CDF Relative to Internal Events CDF 

Plant Fire CDF Internal Events CDF Fire/Internal Events Ratio 

Browns Ferry 2 6.73E-06 4.80E-05 14% 

Clinton 3.26E-06 2.66E-05 12% 

Davis-Besse 1.72E-05 6.60E-05 26% 

Dresden 2 2.04E-04 1.85E-05 1103% 

Dresden 3 2.53E-04 1.85E-05 1368% 

Duane Arnold 1.05E-05 7.84E-06 128% 

Fort Calhoun 2.78E-05 1.36E-05 204% 

H.B. Robinson 2 2.23E-04 3.20E-04 70% 

Millstone 2 6.30E-06 3.42E-05 18% 

Monticello 8.37E-06 2.60E-05 32% 

North Anna 1&2 3.99E-06 7.16E-05 6%

C-5
Table C-1 (Continued) 

Plant Fire CDF Internal Events CDF Fire/Internal Events Ratio 

Prairie Island 6.32E-05 5.OOE-05 126% 

Quad Cities 1 6.60E-05 1.20E-06 5500% 

Quad Cities 2 7.13E-05 1.20E-06 5942% 

Sequoyah 1 &2 1.56E-06 1.70E-04 9% 

Waterford 3 7.04E-06 1.70E-05 41% 

Washington Nuclear 2 1.76E-05 1.75E-05 100% 

NUREG- 1742 states that the IPEEE results appear to confirm the general perception that fire risk 

is more a function of spatial phenomena than it is a function of plant systems design. That is, 

there were no clear patterns relating to fire-induced CDF that could be attributed to differences in 

plant system design features. Therefore, grouping of plants as was done for internal events and 

shutdown is not feasible. 

C.1 Initiating Events Cornerstone 

For the purposes of this analysis, a fire initiating event is defined as the occurrence of a 

potentially significant fire, regardless of its duration or significance, and regardless of whether a 

given event actually causes a plant trip. (By definition, a potentially significant fire has the 

potential to cause a plant trip, if not suppressed.) Detection and suppression are addressed as part 

of the mitigating systems cornerstone. 

C.1.1 Assess the Potential Risk Impact of Degraded Performance 

"Elements" correspond to items that appear in accident sequence descriptions. Under the 

initiating events cornerstone, the only elements appearing in typical models are the initiating 

events themselves. Fire accident sequences are defined by fire areas. In fact, then, "fire" is not the 

initiating event definition: rather, fire in a specific area is the initiating event of a fire CDF 

sequence. Because different areas are associated with different degrees of vulnerability to fire, 

associating thresholds with generic fires would be a poor approximation. 

The risk-significant fire areas vary from plant to plant. However, the following fire areas are the 

most common among the list of risk-significant fire areas based on the accident sequences 

identified in the IPEEE for each plant: 

0 Switchgear Room 

0 Control Room 

0 Cable Spreading Room 

0 Auxiliary Building (PWR)/Reactor Building (BWR) 

0 Turbine Building 

• Battery Room 

* Cable Vault/Tunnel/Chase Zones 

* Diesel Generator Rooms

C-6
The complete list of risk-significant fire areas was created for each IPEEE reviewed and is 

provided in the tables below. A fire area was considered risk-significant if the contribution to the 

total fire CDF was two percent or greater. 

Table C.1.1-1 Significant Fire Areas for Browns Ferry 

Fire Area CDF Percent 

of Total 

Unit 2 Reactor Building, 621' and North Side of 639' 1.07E-06 15.9% 

Turbine Building 7.30E-07 10.8% 

Unit 2 Battery and Battery Board Room 5.53E-07 8.2% 

4kV Shutdown Board Room B 4.97E-07 7.4% 

Control Bay - 593' Elev 4.73E-07 7.0% 

Intake Pump Station 4.72E-07 7.0% 

4kV Shutdown Board Room C and 250V Battery Room 4.51E-07 6.7% 

Cable Spreading Room 4.48E-07 6.7% 

4kV Shutdown Board Room D 4.15E-07 6.2% 

4kV Bus Tie Board Room 3.08E-07 4.6% 

Unit 1 and 2 Diesel Generator Building 2.84E-07 4.2% 

Unit 2 Reactor Building, South 593' Elev. And RHR Hx Rooms 2.78E-07 4.1% 

4kV Shutdown Board Room A and 250V Battery Room 2.54E-07 3.8% 

Total 6.73E-06 

Table C.1.1-2 Significant Fire Areas for Clinton 

Fire Area CDF Percent 

of Total 

Div 1, Div 2, & Div 3 Switchgear Rooms 1.45E-06 44.5% 

Main Control Room 1.20E-06 36.8% 

Screenhouse, General Access and Pipe Tunnel Areas 3.39E-07 10.4% 

Total 3.26E-061 

Table C.1.1-3 Significant Fire Areas for Davis-Besse 

Fire Area CDF Percent 

of Total 

No. 1 Low Voltage Switchgear Rooms 5.90E-06 34.4% 

High Voltage Switchgear Room B 5.18E-06 30.2% 

Control Room 4.31 E-06 25.1% 

High Voltage Switchgear Room A 1.38E-06 8.0% 

Total 1.72E-05 I

C-7
Table C.1.1-4 Significant Fire Areas for Dresden 2 

Fire Area

I I'

4- 1

UnILS /. M -) 1..,UIILLtUJ i•./JviJ - 1 VC. 

Pi ".:, 21t QD-- R, TflC W MY

5

fercent 

of Total

Unit 2 Reactor Building Open Area 545 Elev. 2.34E-05 11.5% 

Unit 2 North Trackway/Switchgear Area 1.57E-05 7.7% 

Units 2 & 3 Turbine Corridor 1.32E-05 6.5% 

Unit 2 Battery Room 1.04E-05 5.1% 

Unit 2 Reactor Building Switchgear Area 9.11E-06 4.5% 

Unit 2 Reactor Building Elev. 545 8.76E-06 4.3% 

Total 2.04E-04 

Table C.1.1-5 Significant Fire Areas for Dresden 3 

Fire Area CDF Percent 

of Total 

Units 2 & 3 SBGT & TBCCW Hx 5.89E-05 23.3% 

Unit 3 West Corridor and Trackway 5.27E-05 20.8% 

Unit 3 Second Floor Reactor Building 5.06E-05 20.0% 

Units 2 & 3 Turbine Corridor 2.15E-05 8.5% 

Unit 3 Reactor Building Switchgear Area 1.78E-05 7.0% 

Units 2 & 3 Cable Tunnel 1.38E-05 5.5% 

Units 2 & 3 Aux. Electric Equipment Room 1.12E-05 4.4% 

1 Y7 13t-0 

Unit 3 Reactor Building Ground Floor 

Units 2 & 3 Mezzanine Floor 

Units 2 & 3 Control Room Backup HVAC 

Total

I 7.27E-06 - I 2.9u/o

5.54E-06j 2.2'/o 5.54E-061

2.53E-041

2.9%

Table C.1.1-6 Significant Fire Areas for Duane Arnold 

Fire Area 

Division I Switchgear Room 

Division II Switchgear Room 

Total

r UJF .-. r Percent 

of Total

5.61E-06 53.3%

I 4.92L-UOI 40. IYo

4.92E-U I

I 1.05E-05

C-8

40./'/G

UJIP

6.16E-05 30.2%

2- i. 5_o ¢

5.87/E-05

7.39E•-06 /-.1•07

7.27E-061

2.2%t

CDF
Table C.1.1-7 (Continued) 

Fire Area CDF Percent 

of Total 

Transformer Yard Area 6.18E-07 2.2% 

Intake Structure 5.96E-07 2.1% 

Group 1 MCC Area 5.66E-07 2.0% 

Total 2.78E-051 

Table C.1.1-8 Significant Fire Areas for H.B. Robinson 2 

Fire Area CDF Percent 

of Total 

Battery Room 7.76E-05 34.7% 

Control Room 4.47E-05 20.0% 

Transformer Yard 3.70E-05 16.6% 

Electric Switchgear/Electrical Equipment Room 2.38E-05 10.7% 

Unit 2 Cable Spreading Room 1.50E-05 6.7% 

Aux. Bldg Hallway 1.24E-05 5.5% 

SW Pump Area 4.38E-06 2.0% 

Total I2.23E-04 

Table C.1.1-9 Significant Fire Areas for Millstone 2 

Fire Area CDF Percent 

of Total 

Auxiliary Building - Area A-i G 1.69E-06 26.8% 

Turbine Building 1.63E-06 25.9% 

Intake Structure - Area I-IA 9.66E-07 15.3% 

Control Room - Main Control Board/ESAS Cabinets 6.57E-07 10.4% 

Auxiliary Building - Area A-12A 5.50E-07 8.7% 

Auxiliary Building - Area A-IB 5.21E-07 8.3% 

Cable Vault - Area A-24 2.83E-07 4.5% 

Total 6.330E-061 

Table C.1.1-10 Significant Fire Areas for Monticello 

Fire Area CDF Percent 

of Total 

Admin Building (Cable Spreading Room) 1.45E-06 17.3% 

Admin Building (Control Room) 1.45E-06 17.3% 

Turbine Building (MCC 142/143 TB Fire Area XII) 1.27E-06 15.2% 

Turbine Building (MCC 133/Feedwater Pump Area) 1.20E-06 14.3% 

Reactor Building (West Side) 5.56E-07 6.6% 

Turbine Building (Lower 4KV Area) 5.03E-07 6.0% 

Emergency Filtration Building (Div. II) 4.05E-07 4.8% 

Admin Building (Battery Rooms 7A & 7B) 3.21E-07 3.8%

C-9
Table C.1.1-10 (Continued) 

Fire Area CDF Percent 

of Total 

Turbine Building (Upper 4 KV Area) 2.47E-07 2.9% 

Reactor Building (NE Comer) 2.18E-07 2.6% 

Total 8.37E-061 

Table C.1.1-11 Significant Fire Areas for North Anna 1&2 

Fire Area CDF Percent 

of Total 

Emergency Switch Gear Room - Instrument Rack Room 2.43E-06 60.8% 

Cable and Vault Tunnel - Control Rod Drive Room 4.39E-07 11.0% 

Emergency Switch Gear Room -1H Room 3.79E-07 9.5% 

Emergency Switch Gear Room -1J Room 3.45E-07 8.6% 

Auxiliary Building B Component Cooling Pumps 1.78E-07 4.5% 

Total 3.99E-061 

Table C.1.1-12 Significant Fire Areas for Prairie Island 

Fire Area CDF Percent 

of Total 

Auxiliary Building Ground Floor Unit 1 2.78E-05 44.0% 

408V Safeguards Switchgear Room (Bus 121) 8.90E-06 14.1% 

Turbine Building Ground and Mezzanine Floor Unit 1 6.44E-06 10.2% 

Relay and Cable Spreading Room Units 1 and 2 3.94E-06 6.2% 

4KV Safeguards Switchgear Room (Bus 15) 3.67E-06 5.8% 

480V Safeguards Switchgear Room (Bus 11l) 2.93E-06 4.6% 

"B" Train Hot Shutdown Panel & Air Comp/AFW Room 2.25E-06 3.6% 

Control Room 1.97E-06 3.1% 

"A" Train Hot Shutdown Panel & Air Comp/AFW Room 1.82E-06 2.9% 

Total 6.32E-051 

Table C.1.1-13 Significant Fire Areas for Quad Cities 1 

Fire Area CDF Percent 

of Total 

Unit 1 Turbine Building Ground Floor (South) 1.98E-05 30.0% 

Main Control Room 9.5 1E-06 14.4% 

Unit 1 Mezzanine Floor (South) 3.72E-06 5.6% 

Auxiliary Transformer 11 3.32E-06 5.0% 

Reserve Auxiliary Transformer 12 3.32E-06 5.0% 

Unit 1 Switchgear Area (North) 2.91E-06 4.4% 

Unit 2 Turbine Building Ground Floor 2.64E-06 4.0% 

Unit 1 Cable Tunnel 2.19E-06 3.3% 

Unit 1/2 Mezzanine Floor (Central) 2.04E-06 3.1%

C-10
Table C.1.1-15 Significant Fire Areas for Waterford 3 

Fire Area

H&V Mechanical Room 

Control Room 

Switchgear Room 

Emergency Diesel Generator B 

Electrical Penetration Area A 

Turbine Generator Building 

Total 

Table C.1.1-16 Significant Fire Areas for Washington Nuclear 2 

Fire Area 

Control Room

iurolne GJenerIatLo uvI J 

Div 2 Battery Room 

Div 1/Div 2 Elec/Battery Room Corridor 

NW Reactor Building 

Turbine Generator Building West 

Div 1 Electrical Equipment Room 

Div 2 Electrical Equipment Room 

Equipment Hatch 

Total

CDF Percent 

of Total 

1.95E-06 27.7% 

1.94E-06 27.6% 

1.48E-06 21.0% 

5.90E-07 8.4% 

4.30E-07 6.1% 

3.17E-07 4.5% 

7.04E-06 

CDF Percent 

of Total 

8.40E-06 47.8% 

2.91E-06 16.6% 

1.48E-06 8.4% 

1.06E-06 6.0% 

7.77E-07 4.4% 

5.91E-07 3.4% 

5.54E-07 3.2% 

4.06E-07 2.3% 

3.77E-07 2.1% 

1.76E-05

C-1I
C.1.2 Obtain Performance Data for Risk-Significant, Equipment-Related Elements 

Since fire initiating events are modeled at the event level, performance data are obtained for the 

initiating events themselves for indicator development. Much of the information on fire initiating 

events comes from an NRC study in 1997 of all fire events from 1986-1994, AEOD/S97-03 

(Ref. 18). 

C.1.3 Identify Indicators Capable of Detecting Performance Changes in a Timely Manner 

Based on these data, the fire initiating event frequencies for these areas range from 6.9E-2 to 

8.5E-4. These frequencies (once every 14 years or more on a plant-specific basis) do not allow 

for timely quantification of changes to the frequencies. Therefore, there were no fire frequency 

RBPIs. For transient combustible fires, lower-lying elements were considered, such as transient 

combustible control. However, modeling at this level is not typically detailed enough to support 

RBPI development. Moreover, data are not currently available to support quantification of 

indicators at this level. 

Fire in a risk-significant area is considered an industry trending indicator. 

C.1.4 Identify Performance Thresholds Consistent with a Graded Approach to 

Performance Evaluation from SECY 99-007 

No RBPIs were identified, so no performance thresholds were identified. 

C.1.5 Outputs of RBPI Development Process 

The frequencies of occurrence of fires in the most commonly risk-significant fire areas listed 

above will be used for industry trending. There is no impact on inspection areas. 

C.2 Mitigating Systems Cornerstone 

Key performance areas for fire include fire detection and suppression systems, installed fire 

barriers, human response, and post-fire safe shutdown systems. 

NUREG-1 742 indicates that most IPEEE submittals concluded that multi-zone fire scenarios are 

not significant CDF contributors. However, a review of other available information indicates that 

the role of physical fire barriers is significant. Although barriers are identified in the IPEEE 

models, failure of barriers is not explicitly modeled by the IPEEE's. Physical failure of fire 

barriers may allow propagation of a fire beyond the initial fire area, but the risk significance of 

this potential, or of leaving fire doors open, is not practical to establish from the information 

available in the IPEEE submittals. 

As defined in the Appendix R Analysis, fire areas are bounded by fire barriers that will withstand 

the fire hazards within the fire area and protect the equipment within the fire area from a fire 

outside the area.

C-12
C.2.1 Assess the Potential Risk Impact of Degraded Performance

Elements of fire-initiated core damage sequences include the following: 

• Occurrence of Fire in Specific Fire Area 

• Failure of Detection/Suppression (automatic and/or manual) 

• Fire Damage to Plant Systems 

• Failure of Post-Fire Safe Shutdown Systems (typically normal mitigation systems that are 

not affected by the fire scenario, covered in Section 3.1.2) 

0 Fire Barrier/Separation Effectiveness 

It is noted for completeness that NUREG- 1742 states that none of the IPEEE submittals 

evaluated the impact of fires on the reactor protection system. That is to say, none of the 

submittals discussed a CDF contribution from ATWS sequences. 

As identified in the initiating events cornerstone for fire, the risk-significant accident sequences 

are defined by fire areas. For the mitigating systems cornerstone, the typical risk-significant fire 

areas are the same as those identified for the initiating events cornerstone, with the same high 

degree of variability from plant to plant. 

The equipment-related elements are the following: 

• Detection (automatic) 

* Suppression (automatic) 

* Safe shutdown systems (including human action) 

It is important to note that the IPEEE's have included detection probabilities in the automatic 

suppression "system" unavailability when automatic suppression is credited in a fire area. Thus, 

it is not possible to separate detection and automatic suppression contributions to fire CDF, as 

modeled, in the IPEEE's. 

C.2.2 Obtain Performance Data for Risk-Significant, Equipment-Related Elements 

Very few data are available for detection and suppression. Generic values are typically used in 

the IPEEE's for these functions, and are the basis for the calculations below. 

Data for post-fire safe shutdown systems are the same as the data used to evaluate those systems' 

performance in non-fire scenarios. 

C.2.3 Identify Indicators Capable of Detecting Performance Changes in a Timely Manner 

For generically significant post-fire safe shutdown systems, RBPIs are already developed to the 

extent practical, as a result of those systems' importance in non-fire scenarios. For detection and 

suppression equipment, the widely used generic data are "unavailability" data, and do not furnish 

the kind of event frequency information needed to establish the practicality of detecting

C-13
performance changes in a timely manner. For purposes of this step, it is tentatively assumed that 

monitoring at the train or channel level (depending on the system) will turn out to be appropriate. 

C.2.4 Identify Performance Thresholds Consistent with a Graded Approach to 

Performance Evaluation from SECY 99-007 

Thresholds for the RBPIs for safe shutdown systems should be quantified in light of the impact 

of performance declines on fire CDF as well as internal events CDF. This is addressed as part of 

the development of internal events RBPIs. 

For automatic suppression systems, performance data are not currently reported. In addition, 

although automatic suppression system reliability and availability may in fact be risk significant, 

development of thresholds based on the information in the IPEEE submittals is not an accurate 

representation of risk information. Credit for compensatory actions would strongly affect RBPI 

thresholds for fire detection and suppression systems. Unfortunately, this area is not modeled 

well enough in available models to address this point adequately within the RBPI program. Thus, 

development of an indicator for automatic suppression systems is not currently feasible. 

However, in the event that performance data and improved modeling of suppression systems do 

become available, typical RBPI thresholds were calculated for several plants based on the 

available information from the IPEEE submittals. These calculations are solely for demonstration 

purposes and should not be viewed as proposed thresholds for the reasons discussed above. 

Table C.2.4-1 Potential Automatic Suppression System Thresholds for Mitigating Systems 

Cornerstone - External Events (Fire) 

Plant Automatic Baseline Thresholds 

Suppression 

System White Yellow Red 

Browns Ferry 2 N/A N/A No automatic suppression credited in 

significant sequences 

Davis-Besse wet pipe 2.OE-02 7.88E-02 6.08E-01 

Duane Arnold N/A N/A No automatic suppression credited 

Fort Calhoun halon 5.OE-02 5.90E-2 1.40E-1 9.47E-1 

wet pipe 2.OE-02 1.27E-1 8.20E-1 

Millstone 2 halon 5.OE-02 8.05E-02 3.55E-01 

wet pipe 2.OE-02 9.06E-02 7.26E-01 

Monticello halon 5.OE-02 8.45E-02 3.95E-01 

wet pipe 2.OE-02 3.67E-02 1.87E-01 

North Anna 1 &2 N/A N/A No automatic suppression credited 

Prairie Island CO, 2.02E-02 5.02E-02 1.42E-01 

wet pipe 5.OE-02 2.52E-02 6.98E-02 5.17E-01 

Quad Cities 1 wet pipe 2.OE-02 6.85E-02 5.05E-0I None

C-14
Table C.2.4-1 (Continued) 

Plant Automatic Baseline Thresholds 

Suppression White Yellow Red 

System 

Quad Cities 2 wet pipe 2.OE-02 2.35E-02 5.46E-02 3.66E-01 

Sequoya~h 1 &2 preaction 5.0E-02 5.65E-02 1.15E-01 6.98E-01 

Waterford preaction 5.0E-02 6.96E-02 2.46E-01 

wet pipe 2.0E-02 9.29E-01-

Washington wet pipe 2.5E-02 1.79E-01-

INuclear2 

Notes: A "-" indicates that the threshold is greater than 1.0. Also, the Clinton, Dresden 2&3 and H.B. Robinson 2 

IPEEE's were reviewed and determine to credit automatic suppression systems, but insufficient information was 

contained in the IPEEE to calculate thresholds. 

Systems credited by each IPEEE in prevention of core damage, given a fire, were identified for 

each risk-significant fire area whenever possible. Based on the information available in the 

IPEEEs, it was not possible to determine the exact contribution to the CCDP due to a given 

system. In fact, some IPEEEs did not even provide enough information to characterize the roles 

played by any post-fire safe shutdown systems. Many, however, did identify the "major" 

contributors to CCDP for each risk significant fire area. For some IPEEEs, enough information is 

presented to allow the use of an IPE or SPAR model, with appropriate fire-damaged equipment 

"removed," to determine the assumed contribution to CCDP of a given system. Currently, the 

information contained in the IPEEEs was only extracted to identify "significant" safe shutdown 

systems and compare these systems to the systems identified during the development of risk

based performance indicators for internal events. Table C.2.4-2 below lists the safe shutdown 

systems identified by each IPEEE. The systems are abbreviated using the IPE database 

standardized abbreviations. Table C.2.4-2 shows that the significant mitigating systems identified 

for post-fire scenarios that are not captured in the internal events indicators are systems that do 

not meet the criteria for development into RBPIs. 

Table C.2.4-2 Significant Post-Fire Safe Shutdown Systems for Mitigating Systems 

Cornerstone - External Events (Fire) 

Plant Fire safe shutdown systems that ARE Fire safe shutdown systems that 

internal events indicators ARE NOT internal events indicators 

Davis-Besse HPI MFW, RPS 

Dresden 2&3 ICS 

H.B. Robinson 2 CCW, MDAFW, PPORV, SDAFW, ACBU 1, BI, DC, EDC 

SW2 

Millstone 2 MDAFW, SDAFW RCPS, RPS 

Monticello EAC, HPCIIHPCS, RCIC, SPC CRDS*, CS*, CTS, LPCI*, MFW, 

SRVS*, VENT (HPV)* 

North Anna 1&2 CCW, CHPI, EAC, ESW, HPI, HPR, ACC, ARI, CSI*, HVAC1*, LPI, LPR, 

MDAFW. PPORV, SDAFW MFW, PSRV. SGA 

C-15
Table C.2.4-2 (Continued) 

Plant Fire safe shutdown systems that ARE Fire safe shutdown systems that 

internal events indicators ARE NOT internal events indicators 

Waterford 3 MDAFW, SDAFW DC 

WNP 2 SPC 

* Indicates systems that have significant potential as an indicator for internal events, but it is currently 

uncertain whether this will be an indicator for the particular plant in question. 

C.2.5 Outputs of RBPI Development Process 

No RBPIs were identified. Many of the systems relied upon to mitigate the effects of a fire are 

already addressed under internal events. In the event that performance data and improved models 

addressing suppression systems do become available, development of an appropriate RBPI will 

be pursued. The inspection areas that could be impacted by this potential RBPI were determined. 

The results are in Table C.2.5-1. 

Table C.2.5-1 Summary of Inspection Areas Impacted by Potential External Event (Fire) 

RBPIs for Mitigating Systems Cornerstone 

RBPI Attribute Inspection Area 

Fire Suppression Protection Against 71111.05, Fire Protection 

System (UR&UA) External Factors 

C.3 Barrier Integrity Cornerstone: Containment Performance 

According to NUREG-1742, the majority of licensees assessed containment performance by 

determining whether a fire can lead to containment bypass, isolation failure, or failure of 

containment heat removal. Only a few performed a more thorough Level 2 PRA assessment. 

Overall, those few licensees that performed a Level 2 fire PRA indicated that their assessments 

did not identify any unique containment failure modes or vulnerabilities to early containment 

failure. One plant identified a new plant damage state (PDS) related to fire-induced core damage, 

which resulted from fire scenarios that required control room evacuation and could result in 

spurious opening of containment isolation valves. Based on a review of approximately 25% of 

the remaining IPEEE submittals, NUREG- 1742 determined that a single fire can neither 

completely destroy the ability to isolate the containment nor fail all of the containment heat 

removal systems. The majority of licensees for the plants reviewed for this report concluded that 

the impact a fire on the containment is within acceptable limits when compared to the impact of 

internal events. Thus, consideration of fire does not lead to any risk-significant LERF scenarios 

whose containment barrier attributes are not already being addressed under the internal events 

treatment of the containment barrier.

C-16
C.4 References 

1. "Determining Potential Risk Significance of Fire Protection and Post-Fire Safe Shutdown 

Inspection Finding," NRC Inspection Manual, Chapter 0609, Appendix F, U.S. NRC, 

February 2001. 

2. "Perspectives Gained from the Individual Plant Examination of External Events (IPEEE) 

Program," Draft NUREG-1742, U.S. NRC, April 2001. 

3. "Browns Ferry Nuclear Plant Individual Plant Examination for External Events (IPEEE)," 

Tennessee Valley Authority, July 1995. 

4. "Clinton Power Station Individual Plant Examination For External Events Final Report," 

Illinois Power, September 1995. 

5. "Individual Plant Examination of External Events for the Davis-Besse Nuclear Power 

Station," The Toledo Edison Company, December 1996. 

6. "Individual Plant Examination of External Events for Severe Accident Vulnerabilities 

Submittal Report, Dresden Nuclear Power Station Units 2 and 3," ComEd, December 30, 

1997. 

7. "Duane Arnold Energy Center Individual Plant Examination of External Events 

(IPEEE)," IES Utilities, November 1995. 

8. "Individual Plant Examination of External Events for Fort Calhoun Station," June 1995. 

9. "Individual Plant Examination of External Events for H.B. Robinson 2," Carolina Power 

& Light Company, June 1995. 

10. "Millstone Unit 2 Individual Plant Examination of External Events," Northeast Utilities 

Services Co., December 1995. 

11. "Monticello Individual Plant Examination of External Events (IPEEE)," Revision 1, 

Northern States Power Co., November 17, 1995. 

12. "North Anna Units 1 and 2 Individual Plant Examination of External Events," April 

1994. 

13. "Prairie Island Individual Plant Examination of External Events (IPEEE)," Revision 1, 

Northern States Power Co., September 1998. 

14. "Quad Cities Individual Plant Examination of External Events (IPEEE) Submittal 

Report," Revision 1, May 25, 1999.

C-17
15. "Sequoyah Nuclear Plant (SQNP) Individual Plant Examination of External Events 

(IPEEE)," Tennessee Valley Authority, June 1995. 

16. "Waterford Individual Plant Examination of External Events," Entergy Operations, Inc., 

July 1995. 

17. "Individual Plant Examination of External Events, Washington Nuclear Plant 2," 

Washington Public Power Supply System, June 1995. 

18. "Special Study - Fire Events - Feedback of U.S. Operating Experience," AEOD/S97-03, 

U.S. NRC, June 1997.

C-18