**NRC INSPECTION MANUAL**APOB

INSPECTION MANUAL CHAPTER 0308 ATTACHMENT 3 APPENDIX G

# TECHNICAL BASIS FOR SHUTDOWN OPERATIONS SIGNIFICANCE DETERMINATION PROCESS

# Effective Date:  Upon Issuance

Issue Date: 02/28/05	PAGE 1 	1	0308, Att 3, App G

Table of Contents0308.03G-01	PURPOSE	10308.03G-02	INTRODUCTION	102.01	Model Scope	202.02	Limitations of Shutdown Risk Analysis Model	30308.03G-03	CHARACTERIZATION OF SHUTDOWN OPERATIONS	40308.03G-04	SHUTDOWN INITIATING EVENTS	60308.03G-05	SHUTDOWN INITIATING EVENT FREQUENCIES	70308.03G-06	EVENT TREE MODELS	806.01 	Overview	806.02	Event Tree Success Criteria	1006.03	General Description/Philosophy for Event Trees	1206.03.01	LOLC Event Trees (PWRs Only)	1206.03.02 	LOI Event Trees	1206.03.03	LORHR Event Trees	1306.03.04	LOOP Event Trees	140308.03G-07	HUMAN ERROR PROBABILITIES (HEPs)	1407.01	Basis for HEPs used in the IEL Tables	1407.02	General Discussion for HEPs Used in Worksheets	1507.02.01	BWR HEPs Definitions and Characterizations	1607.02.02 	PWR HEPs Definitions and Characterizations	240308.03G-08	REFERENCES	330308.03G-09	Attachment 1:  Revision History 	Att1-1

Issue Date:  01/11/22	1	0308 Att 3 App G

PURPOSE	

The purpose of this basis document is to provide background information for the probabilistic risk assessment (PRA) models used to develop IMC 0609 Appendix G, Attachment 3 for boiling water reactors (BWRs) and the associated BWR shutdown template, and Attachment 2 for pressurized water reactors (PWRs) and the associated PWR shutdown template.

INTRODUCTION	

Studies conducted from the late 1980s onward indicate that core damage frequencies during shutdown are comparable to risks at-power. Results from EPRI 1003465 (“Low Power and Shutdown Risk Assessment Benchmarking Study”) are reproduced below in Tables 1 and 2.  These tables document shutdown analysis from 2002 and illustrate this insight. The BWR in the EPRI study was a dual unit General Electric BWR 4, and the PWR was a dual unit Westinghouse four-loop plant. US plant availability has increased substantially over the subsequent decades, decreasing the time spent in shutdown. The average refueling outage duration in 2019 was 36 days. In addition, industry has placed additional attention on shutdown risk with the implementation of NUMARC 91-06 (“Guidelines for Industry Actions to Assess Shutdown Management”),10 CFR 50.65(a)(4) (i.e., the maintenance rule) and Generic Letter 8817 (Loss of Decay Heat Removal – 10 CFR 50.54(f)). The risk during outages is not equally distributed, as much of the risk is concentrated early in the outage during periods of comparably low reactor coolant system (RCS) water levels. The IMC shutdown models used in the procedure account for those drivers of shutdown risk, i.e., time after shutdown, water level, and equipment availability. The above insights are also true for new reactor designs (AP1000 Design Certification Document, PRA Results and Insights Chapter 59).

Table 1 Typical BWR Risk Results

Notes: 	1) Baseline configuration has all equipment available.

		2) The actual outage configurations were analyzed with two decay heat removal means available.

		3) From EPRI 1003465, “Low Power and Shutdown Risk Assessment Benchmarking Study,” Table 3-7.

Table 2 Typical PWR Outage Risk Results

Notes: 	1) Baseline configuration has all equipment available.

		2) The actual outage configurations were analyzed with two decay heat removal means available.

		3) The 6” below the flange risk levels are higher than the midloop levels because of slightly different equipment configurations and slightly different outage timings.

		4) From EPRI 1003465, “Low Power and Shutdown Risk Assessment Benchmarking Study,” Table 3-3.

## 02.01	Model Scope

This methodology covers shutdown operations, which begin when the licensee has met the entry conditions for residual heat removal (RHR) or decay heat removal (DHR), and RHR/DHR cooling has been initiated, and end when the licensee is heating up and RHR has been secured.

It focuses on reactor shutdown operations when more than one used fuel assembly (i.e., an assembly that contains fission products and thus decay heat) is in the reactor vessel. This methodology does not apply to a reactor containing no used fuel assemblies nor to the spent fuel pool. During core offloading, shuffling, or reloading the number of used fuel assemblies in the reactor can be less than a full core, thus, the decay heat level in the reactor correspondingly decreased. As the decay heat levels decrease, the time to boil and the time to core uncovery decrease and therefore, the probability of core damage. Thus, if an analysis is required when the number of used bundles in the core has been reduced from a full core compliment, the corresponding risk should also be reduced.

Once the plant’s temperature and pressure are greater than the RHR entry conditions, a severe accident during this configuration is expected to produce a plant response that is bounded by the plant response to full power initiating events. For deficiencies occurring above the RHR entry conditions, the at-power Significance Determination Process (SDP) tools should be used acknowledging: (1) decay heat is less compared to full power, potentially allowing more time for operator recovery (2) some mitigating systems may require manual operation versus automatic operation, and (3) some containment systems may not be required to be operable potentially increasing the likelihood of containment failure. 

This approach does not address positive reactivity insertion issues during shutdown. Examples of these issues include inadvertent control rod withdrawals or boron dilution events (EPRI NSAC-164L, “Guidelines for BWR Reactivity Control during Refueling,” and EPRI NSAC-183, “Risk of PWR Inadvertent Criticality during Shutdown and Refueling,”). Thus, reactivity issues should be referred to headquarters personnel for resolution.

## 02.02	Limitations of Shutdown Risk Analysis Model

Three approaches for shutdown risk analysis are used to evaluate shutdown conditions in this methodology. Two templates were developed - one for a BWR and a second one for a PWR.  For the AP1000, an advanced PWR, a third approach was used. This will be discussed further below. The BWR and PWR templates are simplified tools that generate an orderofmagnitude assessment of the risk significance. They are intended to be conservative with the expectation that a conservative analysis will appropriately screen many if not most situations to Green, and those that do not screen to Green will be given a more comprehensive and realistic evaluation.  However, experience using these methods shows that the templates are not always conservative. Thus, the analyst must approach the task with judgement and deviate from the methods when it is obvious that the methods are not conservative.

The templates were developed for a BWR plant, considering the features of a General Electric BWR 4  Mark I plant and a Westinghouse 4-loop PWR respectively. However, it can be used for different plant classes as long as the analyst considers each system and strategy that can be used to maintain the shutdown key safety functions such as the ability to: maintain/recover decay heat removal, maintain RCS level control, maintain RCS pressure control, and maintain containment closure capability (the key safety function of containment closure applies to PWRs only).

This generic tool could not include plant specific mitigating features because they vary between licensees and outages. Therefore, the analyst must consider the licensee’s outagespecific mitigation capability.

Since the template was developed based on maintaining key shutdown safety functions, this template does not provide any information on system dependencies. The analyst should refer to the plant specific at-power SPAR model and associated material for a better understanding of the plant specific systemdependencies. However, the analyst should consider additional dependencies for additional systems/functions not needed at full power (e.g., alternating current (AC) power for PWR containment closure). In addition, the analyst also has to consider whether a support system is needed for the supported system at shutdown. For example, in a PWR is component cooling water (CCW) required for high pressure injection pump bearing and motor cooling if the pump is pumping relatively cool water (< 120F)?

Because the NRC has a shutdown SPAR model for the AP1000, a template approach for the AP1000 was not necessary. Thus, for the AP1000 the approach for shutdown analysis is similar to the approach found in IMC 0609, Appendix A for at-power issues where the SPAR model is used for screening and detailed analysis.  

In a detailed risk evaluation (DRE) herein referred to as a Phase 3 evaluation, condition issues are assessed by quantifying a degraded condition and subtracting from it the base (i.e., undegraded) quantification. In these Phase 2 evaluations the base, undegraded condition is not quantified. Instead, the degraded quantification is considered to be the final value. This is justified for two reasons. First, this Phase 2 evaluation is intended to be a conservative screening evaluation. Second, during the development of these shutdown worksheets the base configuration risk was considered to be sufficiently small that it could be ignored. 

Likewise, for event analysis where the issue at hand causes the initiation of an event (e.g., a loss of shutdown cooling occurs), this methodology sets the initiating event likelihood (IEL) to zero (0) which is equivalent to setting the initiating event frequency in a traditional PRA to True. Then the method calculates a condition core damage probability (CCDP). As with condition issues discussed in the previous paragraph, no base quantification is subtracted from the calculated CCDP, that is the quantified CCDP is taken as the final result.

During PWR outages there is a widespread understanding that the RCS should never be placed in a configuration where there is a large cold leg opening (e.g., a steam generator cold side primary manway removed, or a cold leg valve disassembled) without the presence of a large hotleg opening (note that openings on the pressurizer are usually not sufficient). This type of configuration is exceedingly risky as a loss of shutdown cooling could lead to rapid RCS pressurization that could eject RCS inventory through the cold leg opening and core uncovery – in a worst case in a matter of minutes after core boiling initiates. Even with this widespread knowledge of the risks involved, the NRC is aware of one planned (but not executed) forced outage. If the analyst encounters this configuration, i.e., a planned or executed outage with a large cold leg opening and no large hotleg opening, a Phase 2 analysis should not be performed, instead a Phase 3 analysis should be conducted by an analyst familiar with the corresponding thermal hydraulic complexities. (NUREG/CR-5820, “Consequences of the Loss of Residual Heat Removal Systems in Pressurized Water Reactors”).

CHARACTERIZATION OF SHUTDOWN OPERATIONS	

The risk significance of an inspection finding at shutdown depends on the plant configuration.  To account for the plant’s changing configuration and decay heat level during shutdown, this PRA model parses an outage into plant operational states (POSs) and time windows (TWs).  The plant response to a loss or interruption of RHR is assumed to remain constant during a given POS. TWs are used to separate POSs occurring early in the outage when decay heat is high from POSs occurring late in the outage when decay heat levels are comparatively low.

Figure 1 (in IMC 0609 Appendix G, Attachments 2 for PWRs and Attachment 3 for BWRs) defines the POSs and time windows. It also illustrates the relationship between the POSs and the modes defined in the Technical Specifications (TSs). We now describe the POSs and TWs are defined as follows:

POS 1 	This POS starts when the RHR and/or decay heat removal (DHR) system is placed in service.

For BWRs the vessel head is on and the RCS is closed such that an extended loss of the DHR function without operator intervention could result in an RCS re-pressurization above the shutoff head for the RHR pumps. This POS typically begins in TS mode hot shutdown and extends into cold shutdown. During this POS the RCS is not vented, thus credit is given for systems requiring steam. Note before core reload an open BWR head vent of four inches is not sufficient to prevent RCS repressurization, thus if this is the plant configuration, the POS 1 worksheets should be utilized.

For PWRs the RCS is closed such that a steam generator(s) could be used for decay heat removal if the secondary side of each steam generator(s) has sufficient inventory to be considered available as a heat sink. The RCS may have a bubble in the pressurizer. This POS ends when the RCS is vented such that the steam generators cannot sustain core heat removal. This POS typically includes Mode 4 (hot shutdown) and portions of Mode 5 (cold shutdown).

POS 2	For BWRs this POS represents the shutdown condition when (1) the vessel head is removed, and the reactor pressure vessel water level is less than the minimum level required for movement of irradiated fuel assemblies within the reactor pressure vessel as defined by TSs OR (2) the vessel head is on; however, a sufficient RCS vent path exists for decay heat removal. This POS typically begins in cold shutdown and extends into the beginning of refueling mode. Note before core reload an open BWR head vent of four inches is not sufficient to prevent RCS repressurization, thus if this is the plant configuration, the POS 1 worksheets should be utilized.

For PWRs this POS starts when the RCS is vented such that: (1) the steam generators cannot sustain core heat removal and (2) a sufficient vent path exists for feed and bleed. This POS includes portions of Mode 5 (cold shutdown) and Mode 6 (refueling). Reduced inventory operations and midloop operations with a vented RCS are subsets of this POS.

Note that an open pressurizer power operated relief valve(s) (PORV) is not sufficient to prevent repressurization before core reloading, thus if this is the plant configuration, the POS 1 worksheets should be utilized. Also note, that issues occurring during vacuum refill of the RCS require use of the PWR POS 1 event trees.

POS 3	This POS represents the shutdown condition when the reactor pressure vessel water level is equal or greater than the minimum level required for movement of irradiated fuel assemblies within the reactor pressure vessel and primary or secondary containment as defined by TSs. This POS occurs during refueling mode (Mode 5 for BWRs and Mode 6 for PWRs).

Early Time Window (TWE)  This time widow represents the time before POS 3 is entered. The decay heat is relatively high. The reactor is either in POS 1 or 2. If the outage being analyzed is not a refueling outage, then this time window is always used.

Late Time Window (TWL) 	This time window represents the time after POS 3 is entered. The decay heat is relatively low. The reactor is either in POS 1 or 2. If the outage being analyzed is not a refueling outage, then this time window is not used.

The above definitions of the POSs and TWs can be used to address different types of plant shutdowns, e.g., refueling outage, planned maintenance outage, and an unplanned outage.  Depending on the type of outage and its duration, the POSs and TWs can be identified from the above list. For example, all POSs and both TWs will apply to a refueling outage. Only POS 1 and TWE may apply to non-refueling outages.

NOTE:	The operator credits in the SDP worksheets are given for TWE. The same worksheets can be used for TWL except the credits for operator response may need to be changed to account for the longer operator response time. Detailed instructions are given in Chapter 6.0 of this appendix.

SHUTDOWN INITIATING EVENTS	

An initiating event at shutdown is defined as an event that causes a loss or interruption of the shutdown cooling function. This template considers the three internal initiators known to dominate internalevent shutdown risk based on the Grand Gulf Shutdown PRA (NUREG/CR6143) and the Surry Shutdown PRA (NUREG/CR-6144). The following are the initiating events considered, with their applicability to the three POSs.

Other initiators may merit discussion and consideration. BWR examples include freeze seal issues on piping that cannot otherwise be isolated from the RCS and issues with reactivity insertion (EPRI NSAC-164L, “Guidelines for BWR Reactivity Control during Refueling”).  Examples in PWRs include: Those events that challenge low-temperature over pressure protection (LTOP), findings that increase the likelihood of a PWR reactivity transient (EPRI NSAC-183, “Risk of PWR Inadvertent Criticality during Shutdown and Refueling”). In Surry Shutdown PRA (NUREG/CR 6144), these two initiators were found to make a smaller contribution to the core damage frequency than the four initiators discussed above. For some inspection findings, their contribution may become significant. Therefore, they will go directly to headquarters for Phase 3 analysis.

SHUTDOWN INITIATING EVENT FREQUENCIES	

Initiating event frequencies were estimated by searching LERs from 1992 to 1998 (Loss of Shutdown Cooling Initiating Events Data Summary (19921998), Jim Houghton, RES, NRC Internal Report) and totaling the number of refueling hours.  This is the source for the IEL found in the tables below and in the corresponding tables of IMC 0609, Appendix G Attachments 2 and 3. A slightly newer source of frequencies can be found in EPRI 1003113 “An Analysis of Loss of Decay Heat Removal Trends and Initiation Event Frequencies, (1989-2000).” However, these frequencies were not considered in the below tables.

One additional insight is worth discussion involves LOOP frequencies. Statistical analysis performed by INL (INL/ExT-19-54699, “An Analysis of Loss-of-Offsite-Power Events 19872018,”) shows that the initiating event frequency is almost an order of magnitude larger for shutdown versus at-power.

Table 3 Initiating Event Likelihoods (IELs) for Condition Findings – BWRs

1. The likelihood ratings are presented in terms of 0, 1, 2, etc. A rating of 0 is comparable to a frequency of 1 per year, a rating of 1 is comparable to a frequency of 1E1 per year, and similarly, a rating of 2 is comparable to a frequency of 1E2 per year.

2. LORHR and LOI are not usually applicable to POS 3.

Table 4 Initiating Event Likelihoods (IELs) for Condition Findings – PWRs

1.	The likelihood ratings are presented in terms of 0, 1, 2, etc. A rating of 0 is comparable to a frequency of 1 per year, a rating of 1 is comparable to a frequency of 1E1 per year, and similarly, a rating of 2 is comparable to a frequency of 1E2 per year.

2.	LORHR and LOI are not usually applicable to POS 3.

3.	LOLC is only applicable to POS 1 and 2.

EVENT TREE MODELS	

## 06.01 	Overview

For each event tree, there is an associated worksheet that defines each top event function in the event tree by:

· Top Event Function  A key safety function that is necessary to restore core cooling given a loss or interruption of the RHR function (e.g., the operator initiates RCS injection before core damage). 

· Success Criteria  The minimum set of equipment that can be used to fulfill the top event function. 

· Instrumentation  The minimum set of instrumentation needed by the operator to fulfill the top event function.

· Equipment Credit  The credit given to the top event function by the analyst based on all available systems able to fulfill the top event function. If temporary equipment is credited, then use IMC 0609 Appendix G, Attachment 3, Table 6 for BWRs and Attachment 2, Table 7 for PWRs.

· Operator Credit  The credit given for the operator to perform the corresponding top event function. The default operator credit for performing the top event assumes that: (1) the success criteria for the top event function has been met, and (2) the minimum set of instrumentation needed by the operator is available and providing reliable indication.  Operator credits were developed using the SPARH methodology (NUREG/CR-6883, *The SPAR-H Human Reliability Analysis Method*).

The analyst must adjust the default operator credits in the worksheets using the following table if: 

· If the referenced instrumentation is missing or misleading, then the operator credit is decreased by two or becomes zero if the operator credit becomes negative.

Referring to the SPARH low power and shutdown (LP/SD) worksheets (contained in NUREG/CR-6883, Appendix B - HRA Worksheets for LP/SD), the performance shaping factor (PSF) level for stress is now considered to be high, and the PSF level for ergonomics is now considered missing/misleading. Using the SPARH worksheets, this condition results in a HEP multiplier of 100. 

· The default time is incorrect and is significantly reduced. If the diagnosis time is less than 20 minutes, OR the time necessary to perform the action is approximately the available time, then the operator credit is decreased by two or becomes zero if the operator credit becomes negative.

Referring to the SPARH LP/SD worksheets, the PSF level for available time for diagnosis becomes barely adequate and has a multiplier of ten. The PSF level for available time for the action portion of the task has a PSF multiplier of 10. 

· If the operator action is complicated by missing equipment, inaccessible equipment, steam or high radiation, or loop seals for pumps that must be vented, then the operator credit is decreased by two or becomes zero if the operator credit becomes negative.

Referring to the SPARH LP/SD worksheets, the PSF level for stress is now considered to be high, and the PSF level for ergonomics is now considered to be missing/misleading.  Using the SPARH LP/SD worksheets, this condition results in a HEP multiplier of 100.

· If the procedure is not complete for the shutdown plant configuration, then the operator credit is decreased by one or becomes zero if the operator credit becomes negative.

Referring to the SPARH LP/SD worksheets, the PSF level for procedures is considered incomplete. The HEP multiplier is assigned a factor of 20.

· Function Credit  The lower of Equipment Credit and Operator Credit.

## 06.02	Event Tree Success Criteria

The Success Criteria for the BWR Shutdown Template is based on the RES Grand Gulf PRA referenced in Table 5.1.1 of NUREG/CR 6143 Vol 2. Part 1A (ML0705306690). For PWRs the success criteria are based on Byron 1 and 2 low power shutdown PRA and is reproduced here: 

Table 5 PWR Success Criteria

## 06.03	General Description/Philosophy for Event Trees

### 06.03.01	LOLC Event Trees (PWRs Only)

The LOLC event trees is defined as (1) the operator overdrains the RCS to reach midloop conditions such that the RHR function is lost, and (2) the operator fails to maintain level control and/or RHR flow control while in midloop such that air is entrained into the RHR system and the RHR function is lost. The LOLC does not require termination of the RCS leak path since it is assumed it will terminate without operator action when level goes to the bottom of the hot leg.  

There is one known exception to this self-termination. If the operator has gone to midloop and created an opening on the cold leg, e.g.., removed a cold leg injection valve, without a sufficiently large hot leg opening to prevent pressurization on loss of decay heat removal, then water can be forcefully expelled out the cold leg opening on by reactor pressurization. Under these conditions, level can go below the bottom of the hot leg. (see NUREG/CR-5820, “Consequences of the Loss of Residual Heat Removal Systems in Pressurized Water Reactors” for a detailed analysis.)

If the event occurs in POS 1, then secondary reflux cooling can be used. Successful RCS injection is required to restore RCS level such that RHR can be recovered and provide for core cooling if SG cooling is not available. Failure to recover RHR before refueling water storage tank (RWST) depletion is assumed to fail recirculation from the sump since the RHR pumps are assumed to also perform the recirculation function. Recovery of RHR does not guarantee available recirculation since the sump may be unavailable due to trash.

### 06.03.02 	LOI Event Trees

In recent years, industry has worked to reduce spurious and therefore, unnecessary isolation of the RHR/DHR system with the design of reducing shutdown risk.  Often these efforts involve modifications that remove the auto isolations.  Sometimes these modifications remove or reduce the ability to isolate valves from the main control room.  If this type of modification has been implemented, analysis of associated events should take those modifications into consideration by potentially reducing the initiating event likelihood and/or increasing the human error probability associated with manually isolation.

BWR POS 1  Head on

The LOI event trees are defined as losses of RCS inventory such that RHR should have automatically isolated on low reactor water level.  Losses through the downcomer can be isolated by the automatic isolation of RHR on low level.  Losses from the bottom head (such as through a breached reactor water cleanup (RWCU) drain line) are not assumed to be isolable for Phase 2 analysis.  For Phase 2 analysis, the break size is assumed not be large enough to adequately remove decay heat, so RCS pressure control is necessary.   Should the operator fail to manually inject early, the possibility of manual high-pressure injection with the SRVs steaming at their safety setpoint is considered.

BWR POS 2  Head off

The LOI event trees are defined as losses of RCS inventory such that RHR should have isolated on low reactor water level.  Losses through the downcomer can be isolated by the automatic isolation of RHR on low level.  Losses from the bottom head (such as through a breached RWCU drain line) are not assumed to be isolable for Phase 2 analysis.

PWR POS 1 and 2

The LOI event trees evaluate losses of RCS inventory that lead to a loss of RHR due to loss of RHR pump suction that do not involve a loss of level control at midloop (LOLC events).  Many of these flow diversions are caused from improper alignment of valves.  This initiator category is considered for all POSs.  In POS 1, since the RCS may be pressurized, a LOI may lead to losses of inventory below the hotleg due to RCS depressurization.  In POS 2, LOI events do not require termination of the RCS leak path since it is assumed to terminate without operation action at the bottom of the hot leg.  If the event occurs in POS 1, then secondary reflux cooling can be used as long as the core is covered.  Successful RCS injection is required to restore RCS level such that RHR can be recovered.  Failure to recover RHR before RWST depletion is assumed to fail recirculation from the sump since the RHR pumps are assumed to also perform the recirculation function.  Recovery of RHR does not guarantee available recirculation since the sump may be unavailable due to trash.

### 06.03.03	LORHR Event Trees

BWR

The LORHR event trees are defined as losses or interruptions of the RHR system due to failures of the RHR system and/or its support systems (such as service water or DC power).  Recovery of RHR must take place before (1) RHR shutoff head is reached in POS 1, or (2) low RCS level is reached in POS 2 when RHR is automatically isolated, else RCS injection is required to prevent core damage.  It is assumed that automatic emergency core cooling via a low-pressure coolant injection (LPCI) train is not available since the LPCI train would have been reconfigured for RHR recovery.

In recent years, industry has worked to reduce spurious and therefore, unnecessary isolation of the RHR/DHR system which are the largest contributor to losses of RHR.  Often these efforts involve modifications that remove the auto isolations.   Sometimes these modifications remove or reduce the ability to isolate valves from the main control room.  If this type of modification has been implemented, analysis of associated events should take those modifications into consideration by potentially reducing the initiating event likelihood and/or increasing the human error probability associated with manually isolation.

PWR

The LORHR event trees evaluate losses of the operating train of RHR that result from failures of the RHR system itself or from failures of the RHR support systems. These failures could also cause failure of the standby RHR system.   The analyst is asked to consider whether RHR can be recovered prior to boiling to account for the possibility of voids being swept into the RHR pumps, necessitating that the RHR pumps be shutdown and vented. Failure to recover RHR before RWST depletion is assumed to fail recirculation from the sump since the RHR pumps are assumed to also perform the recirculation function.  Recovery of RHR does not guarantee available recirculation since the sump may be unavailable due to trash.

### 06.03.04	LOOP Event Trees

The LOOP event trees evaluate losses of offsite power that result in a loss or interruption of the operating train of RHR/DHR.  

BWR

For POS 1, AC independent injection and RCS pressure control is assumed to be sufficient until battery depletion.  Based on the RES Grand Gulf Shutdown PRA (NUREG/CR6143 Vol 2, Part 1, page 849), each ESF battery bank can supply the required DC loads for 11 hours after a loss of AC power if unnecessary loads are shed.

PWR

For POS 1, reflux cooling is considered if sufficient inventory exists until offsite power is recovered.  For POS 2, gravity feed may be credited if design arrangements permit (Note: not all RWSTs are at a sufficient elevation to permit gravity feed).  For most plants’ gravity feed should not be credited after RCS boiling initiates because there is insufficient head in the RWST to overcome the RCS pressure cause by boiling.  However, gravity feed after boiling initiation can be credited if the licensee can show operating procedures, training and calculations considering:

· Pressure drops in the surge line

· Entrained water accumulating in the pressurizer

· RCS vent paths that are restricted (to control loose parts or control off gassing)

HUMAN ERROR PROBABILITIES (HEPs)	

## 07.01	Basis for HEPs used in the IEL Tables

Initiating event likelihood (IEL) tables were created to estimate the new conditional likelihood that a loss of RHR will occur due to the performance deficiency, given the occurrence of the performance deficiency and/or condition.  These tables are found in IMC 0609 Appendix G Attachment 2 for PWRs (Tables 1 through 5) and Attachment 3 for BWRs (Tables 1 through 4).

The following discussion use the BWR Shutdown Template LOI as an example.  The tables for LOI, LORHR and LOLC (PWR only) were constructed using a similar approach.  The first column in each table uses the estimated time to loss of the RHR function for the specific event.  The second column evaluates the availability of key instrumentation that help the operator: (1) diagnose that a potential problem exists with maintaining the RHR function and (2) diagnose how to recover from the potential problem such that an interruption or loss of the RHR function is prevented.

Half of the time from the first column is allocated for the operator to diagnose what is needed to recover RHR allowing half of the time for the operator to perform the specific action needed to recover RHR.  (The factor two was used for Phase 2 modeling simplicity.)  The third and fourth columns determine if, (1) the specific RHR recovery actions can be identified within 1⁄2 time to loss of the RHR function, and (2) if the action to recover RHR can be performed within 1⁄2 time to loss of the RHR function.

This methodology assumes that failure to diagnose (rather than failure to act) dominates the IEL.

The IELs corresponding to 1⁄2 time to loss of the RHR function are taken from NUREG/CR-1278, “Handbook of Human with Emphasis on Reliability Analysis Applications,” Table 12-4, “Nominal Model of estimated HEPs and EFs within time for diagnosis within time T by control room personnel of an abnormal event annunciated closely in time”.  The median joint HEP curve was used assuming the operator had key instrumentation referenced in the IEL tables.

If the operator does not have the key instrumentation referenced in the IEL tables, then the IEL is increased by a factor of 100 based on the SPARH LP/SD worksheets.  If the operator has missing or misleading instrumentation, the PSF multiplier is 50.  This loss of instrumentation will result in the task complexity changing from nominal to moderately complex, resulting in an additional multiplier of 2.

## 07.02	General Discussion for HEPs Used in Worksheets

Because every interruption of the RHR function requires a successful operator response to prevent core damage, operator error is a key contributor to shutdown risk.  Operator error appears in almost every top event/mitigation path in the shutdown event trees.  The SPARH methodology was used to derive the HEPs for this IMC.

In shutdown analysis, as is typical in all HRA, the failure to diagnosis failure probability dominates the action probability.  Therefore, to simplify the modeling for this analysis, the diagnosis probability defines the operator credits used in the worksheets.  The first safety function does not include dependence in the operator credit estimate.  The second and succeeding safety functions include an estimate of dependence.

The inferred definition of diagnosis is any cognitive decision making that is necessary to perform a task.  This definition includes all cognitive tasks ranging from responding to annunciators to recognizing what is necessary for the corresponding action.  The definition of action is any manipulation involved in performing the task.

The analyst must recognize that the impact of various PSFs may overlap each other. For example, if the procedures are poor, the time available to perform an action may be decreased if the operator is following the procedures stepbystep.

The default operator credit referenced in the worksheets is derived in the following sections using the SPARH methodology.

Referring to the SPARH LP/SD worksheets, for each operator credit, the available time was evaluated.  This is defined as the time that the action must be completed (often in terms of several hours) minus the time it takes to perform the action (often in terms of minutes) plus the time it takes to receive the first cue.  The definitions for nominal time, extra time, and expansive time are as defined in the SPAR-H report. 

### 07.02.01	BWR HEPs Definitions and Characterizations

### 07.02.02 	PWR HEPs Definitions and Characterizations 

 REFERENCES

1. APP-GW-GL-022, Revision 1, AP1000 Probabilistic Risk Assessment, Chapter 59 –Results and Insights, ADAMS Accession No. ML030510639.

2. EPRI 1003113 “An Analysis of Loss of Decay Heat Removal Trends and Initiation Event Frequencies, (1989-2000),” 2001.

3. EPRI 1003465, “Low Power and Shutdown Risk Assessment Benchmarking Study,” 2002.

4. EPRI NSAC-164L, “Guidelines for BWR Reactivity Control during Refueling,” 1992.

5. EPRI NSAC-183, “Risk of PWR Inadvertent Criticality during Shutdown and Refueling,” 1992.

6. EPRI 1021176, “An Analysis of Loss of Decay Heat Removal and Loss of Inventory Event Trends (1990–2009),” 2010.

7. Federal Register (dated February 4, 1999, Vol. 64, no. 23).

8. Generic Letter (GL) 88-17, “Loss of Decay Heat Removal – 10 CFR 50.54(f).”

9. Information Notice (IN) 88-36, “Possible Sudden Loss of RCS Inventory During Low Coolant Level Operation.”

10. INL/ExT-19-54699, “An Analysis of Loss-of-Offsite-Power Events 1987-2018,” N. Johnson and Z. Ma, 2019. 

11. NUMARC 91-06, “Guidelines for Industry Actions to Assess Shutdown Management.”

12. NUREG/CR-1278, “Handbook of Human with Emphasis on Reliability Analysis Applications,” 1983.

13. NUREG/CR-5820, “Consequences of the Loss of Residual Heat Removal Systems in Pressurized Water Reactors,” 1992.

14. NUREG/CR-6143, “Evaluation of Potential Severe Accidents during Low Power and Shutdown Operations at Grand Gulf, Unit 1.” 1994.

15. NUREG/CR-6144, “Evaluation of Potential Severe Accidents during Low Power and Shutdown Operations at Surry, Unit 1.” 1994.

16. NUREG/CR-6883, “The SPAR-H Human Reliability Analysis Method,” 2005.

17. SECY-97-168, “Issuance for Public Comment of Proposed Rulemaking Package for Shutdown and Fuel Storage Pool Operation.”

18. Vogtle Units 3 and 4 Updated Final Safety Analysis Report (UFSAR) (ADAMS Accession No. ML19171A078), Chapter 19, Probabilistic Risk Assessment.

# END

Attachment 1:  Revision History for IMC 0308, Attachment 3, Appendix G

Issue Date:  01/11/22	Att1-1	0308 Att 3 App G

# image2.png

# image1.png