ML11193A217

Response to Preliminary Accident Precursor Analysis for March 28, 2010 Operational Event

ML11193A217
Person / Time
Site:	Robinson
Issue date:	06/30/2011
From:	Duncan R Progress Energy Carolinas
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
RNP/RA/11-0058
Download: ML11193A217 (36)

Text

9j1Progress Energy Serial: RNP-RA/1 1-0058 JUN 3 0 20118 United States Nuclear Regulatory Commission Attn: Document Control Desk Washington, DC 20555 H. B. ROBINSON STEAM ELECTRIC PLANT, UNIT NO. 2 DOCKET NO. 50-261/LICENSE NO. DPR-23 RESPONSE TO PRELIMINARY ACCIDENT PRECURSOR ANALYSIS FOR MARCH 28, 2010 OPERATIONAL EVENT Ladies and Gentlemen:

By letter dated May 5, 2011, the NRC provided the preliminary results of the Accident Sequence Precursor (ASP) analysis for an operational event that occurred at the H. B.

Robinson Steam Electric Plant (HBRSEP), Unit No.2 on March 28, 2010. The letter requested that HBRSEP, Unit No. 2 complete a review of the preliminary analysis and provide any comments to the NRC within 60 days.

Progress Energy's review and analysis indicates that total Conditional Core Damage Probability (CCDP) = 6.19E-04, which falls below the l x 1OE-03 level identified as a significant precursor classification.

A review of the NRC's ASP preliminary results indicates two specific areas where additional information reduces the risk assessment results of the March 28, 2010 event.

1. The time available to restore Reactor Coolant Pump (RCP) thermal barrier cooling

2. The "Work Process" performance shaping factor used for the long term Human Failure Events (HFEs)

Considering this additional information reduces the overall CCDP. Our basis follows:

The "Time Available" to restore Reactor Coolant Pump (RCP) thermal barrier cooling should be adjusted.

In the NRC ASP analysis, time available to restore RCP thermal barrier cooling was stated as 1 to 2 minutes during the March 28 event. Based upon further analysis and review by Westinghouse, the pump vendor, Operations opening of the Flow Control Valve FCV-626 could have been delayed at least an additional 5.9 minutes without the RCP B seal leakoff temperature exceeding the shutdown temperature and without an adverse reaction to the RCP seals.

Progress Energy Carolinas, Inc.

Robinson Nuclear Plant 3581 West Entrance Road Hartsville, SC 29550 (A

Serial: RNP-RA/1 1-0058 Page 2 of 2 The "Work Process" performance shaping factor used for the long term HFEs should be adjusted.

In the NRC ASP analysis, the "Work Process" performance shaping factor for Low Pressure or High Pressure Recirculation was assigned "Poor" due to the crew performance in the "early portion of the event". Progress Energy's analysis provides justification that "Nominal" is more appropriate for the recirculation HFEs, based on the following:

• Robinson plant specific Modular Accident Analysis Progression thermal hydraulic analysis shows that recirculation would not have occurred for the most bounding case until over 5.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> into the event. This would not be considered "early in the event".

" There is time available after the Emergency Response Organization has been activated and prior to reaching the point where recirculation is required. With the additional organizational support and individuals in place to respond to the event the "Work Process" for these types of HFEs would be assigned a performance shaping factor of "Good" in SPAR-H.

Training and procedures are provided for these very basic HFEs and are less impacted by "Work Process" than other more complex HFEs, where higher cognitive skills are required.

This also is consistent with the approach used by the NRC when evaluating the Phase 3 Significance Determination Process for the Operations Command and Control/Failure to Follow Procedure White Finding from the March 28, 2010 event.

The enclosure to this letter contains detailed information for Progress Energy's review and comments.

No regulatory commitments are made in this letter.

If you have any questions concerning this report, please contact Annette Pope at 910-620-4649.

Sinceey`

Robert J. Duncan, II Vice President, HBRSEP, Unit No. 2 RJD/reb Enclosure c:

V. M. McCree, NRC, Region II B. Mozafari, NRC Project Manager, NRR NRC Resident Inspector

ENCLOSURE Progress Energy's Review Details

Input to Preliminary Accident Sequence Precursor Analysis of March 28, 2010 Event NRC letter (Mozafari to Duncan) of May 5, 2011 provides preliminary results of an accident sequence precursor (ASP) of an operational event that occurred on March 28, 2010 at the H.B.

Robinson Steam Electric Plant, Unit No. 2. A review of these results by the licensee was requested per NRC Regulatory Issue summary 2006-24.

A review of the ASP preliminary results was performed and Progress Energy has two specific areas of where additional information changes the risk assessment results of March 2 8th 2010 event. The additional information affects the results of the Human Failure Event (HFE) analysis for the March 281h 2010 event regarding the time available to restore Reactor Coolant Pump (RCP) thermal barrier cooling. Attachment A provides a "white paper" developed by Progress Energy and reviewed by Westinghouse (see Attachment E) regarding the estimated margin that was available between the time at which FCV-626 was opened to restore RCP B seal cooling via thermal barrier cooling, and the time at which the Number 1 seal leakoff temperature would have exceeded the vendor-recommended shutdown temperature. The second area of additional information for the HFE concerns the "Time Available" performance shaping factor used for the long term HFEs. Both of these comments are discussed below in greater detail. The time available for these HFEs is driven by the plant response to the seal failure of three RCPs. In this scenario Progress Energy analysis indicates that several hours must elapse before the Refueling Water Storage Tank (RWST) is depleted requiring recirculation to be established.

1. Additional Information on RCP Seal Thermal barrier Cooling restoration:

SPAR-H modeled operator action CCW-XHE-FCV626: The attached "white paper" (Attachment A) evaluation performed by Progress Energy (EC 81548) was reviewed by Westinghouse and shows that opening of FCV-626 to re-establish thermal barrier cooling could have been delayed for 5.9 minutes or longer before the seal leak-off temperature would be expected to exceed the special operations limit (i.e. shutdown temperature) of 235°F.

Appendix D of the NRC preliminary ASP letter contains Human Failure Event (HFE) for operator action CCW-XHE-FCV626 (Operators fail to reopen FCV626) and states that only 1-2 minutes was available for operators to diagnose the need to reopen FCV-626 prior to voiding conditions within RCP B. The difference in timing between the Attachment A conclusion and the NRC timing for this HFE being at least 4 minutes beyond were NRC analysis stated failure point. Consequently, the SPAR-H Performance Shaping Factor (PSF) for "Time Available" was set at 10 times nominal with a resulting Human Error Probability (HEP) value of 0.8 determined for the operator action CCW-XHE-FCV626 (Operators fail to reopen FCV626). Based on the attached analysis, the "Time Available" should be set to the nominal value of 1.0 which would result in the HEP for this event being reduced to 0.29 in the SPAR-H analysis.

Page 1

A Progress Energy analysis using the industry standard HRA Calculator (CBDTM/THERP) is provided in Attachment B. The Progress Energy analysis provides a HFE value of 0.12, which is close to the SPAR-H value of 0.29.

Additionally, in comparing the NRC HFE analysis, it is inconsistent in that Time Available performance shaping factor of "Nominal" (multiplier of 1) was selected for the operator action to Trip the Reactor Coolant Pumps (RCP-XHE-XM-TRIP) on page D-3, which is essentially the same time frame as the CCW-XHE-FCV626 action, which used the "Barely adequate" (multiplier of 10).

2. Timing Available to Establish Recirculation on March 28, 2010:

Progress Energy performed timing MAAP 4.05 (Modular Accident Analysis Progression) analysis (Attachment C) for the Refueling Water Storage Tank (RWST) depletion using the industry standard Westinghouse RCP seal failure model for the March 28th event and determined that for the bounding case the operator had approximately 5.6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> until High Pressure/ Low Pressure recirculation would have reached the set-point and approximately 7.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> until recirculation would have to be established (assuming two HPI pumps running).

This bounding analysis, worst case has all three pumps seals fail 30 minutes after loss of seal cooling and seal injection at a rate of 480 gpm (for Normal Operating Pressure (NOP) of 2250 psig). This is the bounding case because the B RCP was tripped at the onset of the event and the Reactor Coolant System has undergone an overcooling event down to the Safety Injection (SI) setpoint, thus the RCP seals were at reduced pressure at the time seal injection was lost, which, per the Westinghouse Owner's Group (WOG) 2000 model, provides approximately two hours until maximum seal leak rate could be reached for the secured (B) RCP. The time for recirculation in a more realistic scenario reflecting the March 2 8th event would have had approximately 7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> to reach the RWST switchover criteria and approximately 9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> to complete establishment of ECCS recirculation. Progress Energy placed the recirculation HFE into the HRA Calculator and, using the method that generated the highest HFE value, which, for this case, is the CBDTM method (Cause-based Decision Tree Method) for the cognitive portion and THERP (Technique for Human Error Rate Prediction) methodology for the execution portion of the HFE, the probability for failure of the operators to establish ECCS recirculation is 4.3E-03. The HRA calculator results are provided in Attachment D for the recirculation analysis due to RCP seal failures.

SPAR-H modeled operator actions HPR-XHE-XM-RECIRC and LPR-XHE-XM-RECIRC In analyzing the overall risk impact of the March 28, 2010 event at Robinson Nuclear Plant, seven Human Failure Events (HFEs) in the SPAR-H model were adjusted from their nominal failure probabilities based on analyst judgment for each action. These adjustments were performed by altering various Performance Shaping Factors (PSFs) for each of the seven HFEs Page 2

such as time available, complexity, procedural guidance, work processes, etc. In all seven HFEs, the Work Processes PSF was doubled from a nominal value of 1 to a degraded value of 2. In Appendix D of the NRC preliminary ASP letter, the basis stated for this adjustment in all seven HFEs is as follows:

"Crew supervisors were distracted from oversight of the plant including the awareness of major plant parameters and failed to properly manage the frequency and duration of crew updates/briefs during the early portion of the event leading to interruption in the implementation of emergency procedures and distraction the operators. Therefore, the PSF for diagnosis work processes is assigned a value of Poor (i.e., x2)." (Emphasis added.)

For two HFEs, HPR-XHE-XM-RECIRC (Operator fails to initiate high-pressure recirculation) and LPR-XHE-XM-RECIRC (Operator fails to initiate low-pressure recirculation), doubling the Work Processes PSF is not appropriate as discussed below.

Although the PSF for timing was reduced in acknowledgement that ample time (at least one hour) is available to align and initiate recirculation during a small-break loss of cooling accident (SLOCA) (such as an RCP Seal LOCA), thermal-hydraulic analyses indicate that the time to reach the RWST level set-point for recirculation during a worst-case RCP seal LOCA is several hours. Given that the B RCP was already stopped at the start of the event and the Reactor Coolant System pressure was reduced (due to the overcooling), the worst case RCP seal LOCA is not likely and thus even more time would be available before this action is required to be performed. Hence, this action should not fall in the time window described as 'the early portion of the event' in the justification for increasing the Work Processes PSF.

Furthermore, a seal LOCA would result in at least an Alert Emergency being declared well before the RWST inventory was depleted. Additional support would then be available from the Emergency Response Organization (ERO)/ Technical Support Center (TSC) staffing with additional Senior Reactor Operator oversight in the Control Room to support the operating crew in making the right decisions in responding to the event, briefing for the known upcoming evolutions, and a potential shift change prior to going to low pressure recirculation.

The operator actions for high pressure recirculation / low pressure recirculation are core tasks in the Licensed Operator Continuing Training program. These tasks address both knowledge and skill components related to these tasks and, based on the Difficulty, Importance, and Frequency determination, are trained on a biennial basis in both classroom and simulator settings.

Additionally, the procedural guidance associated with these tasks is contained in a standard Westinghouse, 2 column format. This would contribute to leaving the "Work Process" performance shaping factor at its nominal value.

A recent RNP NRC analysis associated with the Significance Determination Process (SDP) for the Operations Command and Control/ Failure to Follow Procedure White finding did not adjust the "Work Processes" performance shaping factor for these types of operator actions or those Page 3

actions that were well understood and were basic Emergency Operating Procedures. However, in the NRC preliminary ASP analysis, the High Pressure Recirculation operator action when considering a medium break LOCA was adjusted with a Work Processes performance shaping factor of "Poor" (multiplier of 2) in part due to the short time available during this scenario, but Small LOCAs were retained at "nominal" (multiplier of 1). As discussed above the timing for recirculation for the RCPs seal failure closely follows a small LOCA rather than a Medium LOCA, thus a "nominal" PSF is more appropriate and consistent with previous NRC analysis for these types of HFEs.

From the NRC SDP phase 3 results, "The surrogate for the performance deficiency will be an increase in the WORK PROCESSES human reliability performance shaping factor (PSF) for most licensed operator actions in the main control room following a reactor trip or when a reactor trip should occur. Excluded from PSF alteration will be immediate actions, pre-initiator errors and very basic post-initiator tasks such as Steam Generator Tube Rupture (SGTR) recognition or initiating High or Low Pressure Recirculation with no other complications or distractions." On March 2 8th the timing of High or Low Pressure Recirculation would have occurred after the fire was out, thus the amount of complications or distractions would have been minimal and thus the PSF for Work Process should be at nominal.

Based on the above discussion, the HEP value of 9.OE-3 determined for the operator action LPR-XHE-XM-RECIRC (Operator fails to initiate the LPR) should be reduced to 5.OE-3 in SPAR-H due to the "work processes" multiplier going to a nominal value of 1.0. Similarly, the HEP value of 9.OE-3 determined for the operator action HPR-XHE-XM-RECIRC (Operators fail to initiate high-pressure recirculation) should be reduced to 5.OE-3 in SPAR-H due to the "work processes" multiplier going to a nominal value of 1.0.

Conclusion Utilizing the revised HFE values determined above in the SPAR model cutsets results in the Conditional Core Damage Probability being reduced to 6.19E-04. This resultant CCDP falls below the 1x10-3 level identified as a significant precursor classification.

LOMFW Sequence 02-14-02: CCDP = 5.92E-04 LOMFW Sequence 02-14-06: CCDP = 2.74E-05 Total CCDP = 6.19E-04 Further information regarding this response is available in EC 81505 and EC 81807.

Page 4

Attachment A RCP Thermal Barrier Cooling Restoration Analysis Page 5

RNP B RCP Degraded Seal Cooling Event June 6, 2011 Purt*ose:

The purpose of this document is to estimate the margin that was available between the time at which FCV-626 was opened to restore RCP B seal cooling via thermal barrier cooling, and the time at which the Number 1 seal leakoff temperature would have exceeded the vendor-recommended shutdown temperature. It is important to restore cooling before seal leakoff temperature exceeds the shutdown temperature to avoid potential seal damage and the possibility of increased seal leakage. This document will also demonstrate that the seal cooling transient experienced by RCP B was more severe than that experienced by either RCP A or C and therefore the RCP B margin is bounding for all three RCPs.

Background:

In the event of a degraded RCP seal cooling event, Westinghouse Technical Bulletin TB-04-22 Rev 1 recommends to secure the RCP before the seal temperature reaches the shutdown temperature limit and not to restore seal cooling if the shutdown temperature limit is exceeded. Both of these recommendations were met in the event described below.

RCP seal cooling is accomplished by a combination of cooling media. Seal water injection provided by the Chemical and Volume Control (CVC) System provides a cool, clean source of water in excess of the seal leakage and is injected into an inventory of relatively cool water referred to as the Participative Buffer Volume (PBV), just below the RCP radial bearing. Approximately 3/8 of the injection flow is supplied to the radial bearing and seals and is eventually collected as seal leakoff flow. The other 5/8 flows down past the thermal barrier and into the RCP bowl where it mixes with the normal pump flow volume.

The Component Cooling Water (CCW) System provides flow to two cooling coils in the RCP thermal barrier to maintain the PBV cool. The thermal barrier casing comes in close proximity to the RCP shaft at three locations. All three locations are fitted with labyrinth seals. Pressure differential across the upper most thermal barrier labyrinth seal is used to monitor the direction of flow past the thermal barrier.

Flow is normally downward into the RCP casing, which results in a positive indication of differential pressure. On a loss of seal injection flow, flow reverses and RCS water flows up through the thermal barrier where it is cooled by CCW, and then on up the RCP shaft to cool the radial bearing and seals after which it is collected as seal leakoff flow.

The RCP is designed such that a loss of either seal water injection or thermal barrier cooling will not significantly affect the performance of the seal and will allow ample time to recover the affected source of cooling. On a loss of both of these sources of cooling, the PBV has sufficient inventory to effectively cool the seals for a short period of time.

There is no specific correlation between flow and differential pressure across the labyrinth seals. The configuration of each RCP is unique resulting in a different differential pressure for a given flow rate.

Variables such as differences in injection flow rate, effective orifice size, seal leakoff rate, pump bowl

pressure (back pressure), etc., affect the differential pressure. For the B RCP the labyrinth differential pressure is normally between 25-45 inches of water.

During the event which occurred at RNP on 3/28/2010, CCW flow to all three RCPs was lost when cooling water return valve FCV-626 closed. This occurred at the beginning of the event at approximately 18:52. This closure would have cut off CCW flow to the thermal barrier cooling coils and thereby reduce cooling to the RCP PBV.

At around the same time, CVC System flow indication showed changes which could have impacted seal water injection (see Figure 1). A portion of the CVC System flow supplies RCP seal water injection. Seal water injection flow to each of the three RCPs is provided with local indication only. CVC System flow rate indication was positive and stable while FCV-626 was closed. There were two step changes in CVC System flow rate between the initial time of the event and when FCV-626 reopened at approximately 19:32. CVC flow remained stable after FCV-626 reopened until approximately 19:37 when flow indication became erratic.

The B RCP tripped on undervoltage during the initial event. Based on review of B RCP flow data, pump flow decreased to near zero in approximately 39 seconds. However, the pump shaft would have continued to rotate for some period of time after forward flow ceased due to the flywheel effect.

Normal coast down of the pump takes approximately two minutes. Using vibration data, the Predictive Maintenance engineer was able to compare the coast down from this event to other plant shutdown data and concluded that the coast down time during this event was comparable to other normal shutdowns. The pump motor is equipped with an anti-reverse-rotation device, which prevents the shaft from rotating even though reverse flow was developed through the pump due to continued operation of the A and C RCPs. Therefore, it is concluded that the B RCP was at standstill approximately two minutes after the trip, well before any increase in seal leakoff temperature.

Plots of thermal barrier labyrinth seal differential pressure versus time show that prior to the event, the B RCP differential pressure was approximately 35 inches of water (Figure 1), and the pre-event differential pressures for the A and C RCP were approximately 26 and 55 inches of water respectively (Figure 2). After the initial transient, the B RCP differential pressure dropped 31 inches of water while A and C RCP differential pressures dropped 6 and 8 inches of water respectively.

The seals on all three RCPs were inspected and rebuilt during RFO-26 (spring 2010). None of the seals exhibited damage beyond the expected normal wear. The B RCP seal was specifically inspected for thermal damage since it experienced the thermal transient.

Analysis:

The available data collected and referenced in Figure 1 shows that for some period of time there may have been a loss of effective seal water injection concurrent with a loss of thermal barrier cooling. Due to lack of seal water injection flow transmitters (only local indication is available), it is not possible to determine the seal water injection flow rate during the event. Therefore, it is not possible to determine the length of time that seal water injection may have been lost to the B RCP seal.

The RCP thermal barrier labyrinth seal differential pressure instrumentation is an indirect way of determining positive seal water injection. However, since it is only monitoring a portion of the injection flow (i.e., flow down past the thermal barrier and into the RCS), it cannot be relied upon to definitively determine when or if seal water injection flow was lost to the seals. Even with a negative differential pressure, there could be some seal water injection being provided to cool the seals. A second indirect way of determining the loss of effective seal water injection cooling is by monitoring the seal leakoff and bearing water temperatures.

Figure 1 shows that at approximately 19:19, the B RCP bearing water temperature rise rate increased significantly. Labyrinth seal differential pressure shows a corresponding rate change at this point. These changes indicate that the portion of the PBV below the bearing was being purged by hot RCS water coming from the RCP casing. Therefore, it may be concluded that at this point seal water injection cooling was no longer effective. Since FCV-626 was still closed at this time, it may be concluded that neither seal water injection nor thermal barrier cooling was effective from approximately 19:19 to 19:32 when FCV-626 was reopened (approximately 13 minutes duration).

The data shows that about 40 minutes after the B RCP reached stand still, the seal leakoff temperature exceeded the continuous operation limit of 190'F, and remained above 190°F for a brief period of time (approximately 9 minutes). The data also shows that the maximum seal leakoff temperature (approximately 1960F) did not encroach upon the special operation limit (referred to as the "shutdown temperature" in TB-04-22 Rev 1) of 235°F. The Vendor technical manual (VTMA 728-621-13) and TB 22 Rev 1 state that seal thermal shock can be avoided if cooling is restored before the seal leakoff temperature exceeds 235°F.

The ineffective seal cooling event essentially ended when FCV-626 was opened at 19:32. As can be seen in Figure 1, the seal leakoff and bearing water temperatures peaked, and began to decrease shortly after this point. If FCV-626 had not been reopened at that time, the seal leakoff temperature would have continued to increase. Review of PI data reveals that the rate of rise for the B RCP seal leakoff temperature, just before the temperature was influenced by restoration of thermal barrier cooling and flattened out around 19:35:20, was 12.66°F/min. This temperature rise rate is higher than either the seal leakoff temperature rise rate of 8.17°F/min that was experienced before FCV-626 was opened at 19:32, or the temperature rise rate of 10.220F/min from when FCV-626 was opened until the seal leakoff temperature stopped increasing at 19:35:20. Using the RCP B seal leakoff temperature at 19:35:20 of 193.790F, and a temperature rise of 12.66°F/min, the shutdown temperature of 235°F would be encroached upon at 19:38:30. Therefore, based on this temperature rise rate, the FCV-626 opening time margin was 6.5 minutes (i.e., opening of FCV-626 could have been delayed by up to 6.5 minutes without the RCP B seal leakoff temperature exceeding the shutdown temperature).

To assess how sensitive the FCV-626 opening time margin is to the seal leakoff temperature rise rate, the margin was evaluated using the maximum rise rate for the bearing water temperature (TE128). The bearing will heat up faster since, unlike the seals, it is not significantly influenced by surrounding components that are at a lower temperature. Review of PI data reveals that the maximum rate of bearing water temperature rise over a 30 second interval is 8.0050 F. Using the RCP B seal leakoff

temperature at 19:35:20 of 193.79°F, and a maximum temperature rise of 16.01°F/min, the shutdown temperature of 235'F would be encroached upon at 19:37:54. Therefore the FCV-626 opening time margin for this conservative case was 5.9 minutes (i.e., opening of FCV-626 could have been delayed by up to 5.9 minutes without the RCP B seal leakoff temperature exceeding the shutdown temperature).

In this event, the seal leakoff temperature ramp rate is primarily affected by the leakoff flow rate, the seal injection flow rate, and the remaining PBV. Increased leakoff flow would cause the PBV to be purged more quickly, which could potentially cause an increase in the leakoff temperature ramp rate.

As seen in Figure 1, the seal leakoff flow rate was steady at about 4 gpm throughout the time when the seal leakoff temperature was steadily increasing. Although elevated seal temperature is expected to result in increased seal leakoff flow, the temperature increase being evaluated here is relatively modest (about 450F), and no significant change in leakoff flow is postulated. Recent Westinghouse experience with thermal shock testing indicates that for modest temperature increases, reduced viscosity effects are resisted by thermal roll effects which cause a slight reduction in the seal taper angle. Therefore it is reasonable to conclude that seal leakoff flow would not have negatively impacted the temperature ramp rate in the event that FCV-626 reopening was delayed for 5.9 minutes.

A decrease in the seal injection flow rate could also cause an increase in the leakoff temperature ramp rate because less of the cool water would be available to mix with the hot RCS water coming from the RCP bowl. As described earlier, the thermal barrier labyrinth seal differential pressure is an indirect indication of seal water injection flow. Figure 1 shows that the differential pressure was recovering (becoming less negative) during the period of interest, potentially indicating some recovery of seal injection flow and clearly indicating that less hot RCS water was entering the PBV. Therefore it is reasonable to conclude that seal injection flow would not have negatively impacted the temperature ramp rate in the event that FCV-626 reopening was delayed for 5.9 minutes.

Finally, depletion of the PBV could cause an increase in the leakoff temperature ramp rate, as the average temperature of this volume increases and approaches RCS temperature. Review of the seal leakoff temperature plot indicates that there is mixing of the 550°F RCS inventory and the relatively cool PBV inventory, based on the fact that the leakoff temperature is continuously increasing (as opposed to a step change from cool to hot). Based on the actual seal leakoff flow rate, and assuming that there will be no further increase in the flow rate due to a relatively modest increase in seal leakoff temperature of about 45°F (from 190°F to 235°F), the PBV will not be consumed until approximately 19:38. This duration was determined based on the assumption that rate of PBV inventory depletion is equal to the seal leakoff flow rate. This assumption is conservative since there is mixing between the RCS and PBV and therefore seal leakoff includes RCS inventory as well as PBV inventory. Therefore the PBV will not actually be depleted until sometime after 19:38. The time of 19:38 corresponds closely to 19:38:30, the projected time when the seal leakoff temperature will reach the shutdown limit of 2350F. Based on the relatively modest temperature extrapolation of 45°F, evidence of mixing between the PBV and RCS inventories, and the conservatively-determined PBV depletion time, it is reasonable to postulate that PBV depletion would not have negatively impacted the temperature ramp rate in the event that FCV-626 reopening was delayed for 5.9 minutes.

It is important to note that if seal cooling is restored when seal leakoff temperature is just under 235°F, hotter water that may have already entered the PBV will continue flowing to the seals. Seal leakoff temperatures may continue to rise and temporarily exceed the special operation limit (i.e., shutdown temperature) of 235'F until this hot water is purged or diluted with the cooler water being generated by the re-establishment of thermal barrier cooling. Due to the short duration of this transient, the seal components will not have had an opportunity to heat completely and the cooling transients are not expected to result in unacceptable thermal shock to the seals. Westinghouse TB-04-22 Rev 1 has acknowledged this condition and evaluated it as acceptable.

Finally, even in the event that seal cooling is restored after the shutdown temperature limit is exceeded; increased seal leakage will not necessarily result. WCAP-16396 section 5.4 states: "The behavior of the Westinghouse reactor coolant pump seals following restoration of seal cooling has been investigated through analytical, test and field experience. All of the test and field experience shows that no significant increase in leakage through the seal package occurs after the restoration of seal cooling.

While some damage to the pump shaft and seals has been observed following these events, there has been no evidence of increased seal leakage. However, the analytical basis to support this conclusion has not been thoroughly developed."

The RCP B seal cooling transient was more severe than the seal cooling transient experienced by RCPs A and C. The labyrinth seal differential pressure and seal leakoff temperatures for all three RCPs are plotted on Figures 2 and 3 respectively. The labyrinth seal differential pressure for RCP C remained positive throughout the event, indicating there was no flow of hot RCS water up towards the seal. The labyrinth seal differential pressure for RCP A did become slightly negative for a portion of the event, but to a lesser magnitude, and for a shorter period of time than RCP B. The RCP A and C seal leakoff temperatures gradually increased to maximum values of 150'F and 152 0F, respectively; less than 25'F increase over pre-event values, and substantially less than the RCP B maximum seal leakoff temperature of 196'F. These differential pressure and temperature comparisons demonstrate that the RCP B seal cooling transient was more severe than and bounds the transients experienced by RCPs A and C.

Therefore, the time available to restore thermal barrier cooling to RCPs A and C before exceeding the shutdown temperature of 2350F, would be greater than that determined for RCP B.

==

Conclusion:==

The analysis shows that opening of FCV-626 to reestablish thermal barrier cooling for RCP B could have been delayed for at least 5.9 minutes before the seal leakoff temperature would be expected to exceed the special operations limit (i.e., shutdown temperature) of 2350 F. However, based on Westinghouse analysis, testing and field experience regarding restoration of seal cooling above 235°F, a significant increase in seal leakage would not have occurred even if cooling was restored above this limit.

Therefore, opening of FCV-626 to reestablish thermal barrier cooling for RCP B could have been delayed for significantly more that 5.9 minutes with no substantive increase in seal leakage expected. These conclusions also apply to RCPs A and C since it has been shown that the seal cooling transient experienced by these RCPs was less severe than that experienced by RCP B.

Figure 1 RCP B Parameters PT-128 RCP B LABYRINTH SEAL DP

-TE-129 RCP B SEAL LEAKOFF TEMP and Charging Flow FT-155A RCP B SEAL LEAKOFF FLOW

-TE-128 RCP B BEARING WATER TEMP 5

0 0

-5

-10

- dP in inches water

- Charging flow in gpm 350 300 250 200 150 100 50 0

-15

-20 Mn 7t 00 06 Lr-

-01 N

)

0 00 en N

0) 00 00 0

0)

0)

0)

0) 0

0) 0 0

cO Ob Ob Ob 06 cc Ob Ob Ob Ob cO, 06

(

N N

(N (N

(N N

(N N

(NA N

r-4

Figure 2 Labyrinth Seal dP and Charging Flow PT-125 RCP C LABYRINTH SEAL DP PT-128 RCP B LABYRINTH SEAL DP

=

PT-131 RCP A LABYRINTH SEAL DP FT-122 RCS CHARGING FLOW

- dP in inches water

- Charging flow in gpm 100 80 60 40 20 0

-20 m

00 00 N~

0 LIn

-4 00 N~

r-1 C

00 CN 06 N,

rN CO 00

'N a,

m

-4 00 Nq kD CO 0o

'N m

In CO 00 N

0

'N 00 0

r-4 Ltn 0)

-4 COj N

N

'N CO 00 Na m

06

('N

Figure 3 RCP Seal Leakoff Temperature

-Temps in degrees F

-TE-132 RCP A SEAL LEAKOFF TEMP

-TE-126 RCP C SEAL LEAKOFF TEMP TE-129 RCP B SEAL LEAKOFF TEMP 250 200 150 100 50 0

M r-4 0

-4 00 (N

0 mý oI

)ý 0L r4 Ln Ln Il 7i M

15:

05 00 00 a) 0

)M0

)0)

C) 0 1-1

-4

-4 r-4

-4

-4

-4 "1

r4 o

0 C0 0

0 0

0 0

0 0

00 00 00 00 00 00 00 00 00 00 00 eN C4 (N

C4 (N

(j r4 (N

(N (N

C4 0

.N 0

CO 00 (N

This page intentionally blank

Attachment B HFE Analysis For Thermal Barrier Cooling Restoration 10

OPER-90, Operations fails to reopen FCV-626 Cognitive Method Date Analyst - Reviewer CBDTM/THERP 06/27111 JLM -

Analysis'Fil*e FilebDate FileSize (Bytes),

RobinsonType_COPER-06/27111 1511424 36.HRA HEP Summary Pcop Pexe Total HEP Error Factor Without Recovery 1.2e-01 2.6e-02 With Recovery 1.le-01 1.3e-02 1.2e-01 I*dentification and Definition This operator action has been adjusted to specifically address the RNP event of 3/28/2010.

S.. Assigned Basic Events

Cues andlIndications Initial Cue Recovery Cue Cue/s APP-001-Cl alarm response procedure Device providing alarm is FIC-626 set point 100 gpm Degree of Clarity Poor Procedures and Training Cognitive Procedure APP-001 (Revision: 47)

Cognitive Step Number D1 Cognitive Instruction RCP Therm Bar Cool Wtr low Flow Execution Procedure APP-001 (Revision: 47)

Other Procedure Job Performance Measure Classroom Training None Simulator Training None Notes Manpower Requirements Default Actual Operatiqns:** i Shift Manager 1

0 Shift Supervisor 1

0 STA 1

0 Reactor Operators 2

1 Plant Operators 3

0 Maintenance Mechanics 2

0 Electricians 2

0 I&C Technicians 2

0 Health Physics Technicians 2

0 Chemistry:

Technicians 1

0 F::NP Dependencies (Related Human Interactions)

RNP 11

Key Assumptions Operator Interview Insights Timing Analysis Tsw 18.90 Minutes Tdelay 0.00 Minutes T1/2 13.00 Minutes TM 0.50 Minutes Time available for recovery 5.40 Minutes SPAR-H Available time 18.40 Minutes (cognitive)

SPAR-H Available time 11.80 (execution) ratio Minimum level of dependence HD for recovery Notes Tsw of 18.9 minutes based on loss of all seal injection at 19:19 and 13 minutes later FCV-626 was opened plus 5.9 minutes more available based on Attachment A.

T=0 alarm already in due to FIC 626 contacts made up on FCV 626 closure circuit at onset of event T= 13 operators decide to reopen valve after recognizing that thermal barrier cooling has been lost T= 13.5 minutes operators open valve by turning hand switch.

Cognitive Analysis Pc Failure Mechanism Branch HEP Pca: Availability of Information a

neg.

Pcb: Failure of Attention h

neg.

Pcc: Misread/miscommunicate data a

neg.

Pcd: Information misleading d

1.0e-01 Notes: Adjustments made in this PSF to account for the lack of indications and procedural guidance during the 3/28/2010 event for RCP seal injection. While adequate cues, guidance, and training exist for recovering from a loss of Thermal Barrier cooling as an isolated event, there was inadequate capability to respond to the loss of seal injection in conjunction with the closure of FCV-626.

Furthermore, the closure of FCV-626 for a loss of IB #4 while MCC-6 remains energized (or is lost and reenergized when the B EDG starts on a loss of power to the E-2 bus) had not been recognized or trained on.

Pce: Skip a step in procedure

]

h 1.3e-02 Pd: Misinterpret InstructionsJ a

neg.

P(q: Misinterpret decision logic f

6.0e-03 Notes: Opening FCV-626 as an isolated instance has been trained upon, but there was lack of understanding during the 3/28/10 event that a loss of power to E-2 and subsequent recovery on the B EDG would result in a closure of FCV-626.

Pch: Deliberate violation

]

a neg.

Initial Pc(without recovery credited)J 1.2e-01 Notes 12

Cognitive Complexity Complex Equipment Accessibility Main Control Room: Accessible Cognitive Recovery

,,=

• a -*

u

3.

-U)

?-%

a)

,--)

PCa neg.

aN/A 1.0e+0 PCb neg.

)

N/A 1.0e+0O Pca neg.

W-N/A 1.0e+

PCd 1.0e-01 N/A 1.0e+00 1.0e-01 PCe 1.3e-02 X

N/A HD 5.1e-01 6.6e-03 Pc, neg.

N/A 1.0e+00 Pcd 6.0e-03 N/A 1.0e+00 6.0e-03 Pch neg.

N/A I.Oe+00 Final Pc (with recovery credited) 1.1e-01 Notes No credit for extra crew Execution, Performance Shaping Factors Environment Lighting Normal Heat Normal Radiation

Background

Atmosphere Normal Equipment Accessibility Main Control Room Accessible Stress High Plant Response As No Expected:

Workload:

N/A Performance Shaping N/A Factors:

Notes Execution Complexity Simple 13

'ExecutionjUnrecovered.

Procedure: APP4O0I, Miscellaneous NSS Comnment F'trss>

01ver Step No.

InstructionLComment

.Error' R.

HEP

.Factor.

Ride.

Tye Table Ie Attempt to reopen FCV-626 app-001-D1-EOM I 20-7b I 3

1.3E-3 5

4.2 EOC 20-12 2

3.8E-3 Total Step HEP 2.6e-02 verify valve opened app-001-dl-EOM I 20-7b I 3

1.3E-3 5

4.3 EOC 20-12 2

3.8E-3 Total Step HEP 2.6e-02 Execution Recovered, Critical Recovery Action HEP (Crit)

HEP(Rec)

Dep.

Cond. HEP (Rec)

Total for Step Step No.

Step No.

1 app-001-Attempt to reopen FCV-626 2.6e-02 1.3e-02 D1-4.2 app-001-dl-verify valve opened 2.6e-02 HID 5.1e-01 4.3 Total Unrecovered:

2.6e-02 Total Recovered:

1.3e-02 14

Attachment C MAAP Analysis for RWST Depletion Time 15

MAAP 4.05 Analysis of RNP Recirculation Timing for Seal LOCA MAAP 4.05 was used to determine the event timing of a loss of RCP seal cooling and a subsequent catastrophic seal failure for 2 and 3 RCPs respectively. Three MAAP cases are provided that show variations in number of RCP seal failures and the number of HHSI pumps credited. The variables of interest for these runs is the timing to RWST level at 27%, to entry point for EPP-9, Transfer To Cold Leg Recirculation, and the timing available to establish recirculation flow. A summary of the inputs and results are shown for each case below and a detailed discussion of the MAAP analysis follows.

Variable Case I Case 2 Case 3 Number of RCP LOCAs (480 gpm 2

3 3

per RCP)

Number of HHSI pumps to start 2

2 1

Maximum containment pressure (10 21.4 psia 22.9 psia 19.7 psia psig spray setpoint)

(6.7 psig)

(8.2 psig)

(5.0 psig)

Time to EPP-9 entry 6.7 hrs.

5.6 hrs.

8.8 hrs.

(RWST level = 27%)

Time to injection termination and 8.7 hrs.

7.5 hrs.

10.7 hrs.

HPR initiation (RWST level = 9%)

The MAAP analysis was programmed to address the best estimate prediction of the events on March 2 8th, 2010 if catastrophic RCP seal failure had occurred. During the event, the plant overcooled and an SI was initiated. To mimic this effect in MAAP, the secondary plant is isolated and a cooldown is initiated at time zero. AFW successfully starts following the loss of the secondary plant. Multiple 480 gpm RCP seal LOCAs occur at 30 minutes due to running RCPs after a loss of seal cooling. The cooldown is continued post LOCA as would be directed in EPP-8. During the event, the plant responds as expected. The core remains covered throughout each simulation. The containment pressure does not exceed 10 psig and containment spray is not actuated during the simulations.

RWST depletion rate is affected by several variables. The absence of spray actuation greatly extends the time to enter EPP-9 as the spray pumps do not start to deplete the RWST at a high rate. The next variable that affects the RWST depletion timing is the number of HHSI pumps running. With two SI pumps running, the individual pump flow is lower than if only one pump running due to the operating point on the pump curve that 16

matches the break flow capacity. However, the combined flow rate if two pumps is higher than if only one SI pump were running. Case 2 shows that the resultant higher pressure causes more inventory loss out the break and a faster RWST depletion. Case 3 shows that with one HHSI pump running, the RCS pressure stabilizes at a lower pressure, but flow from the single HHSI pump (and the break flow) is less than that of two pumps, resulting in a slower RWST depletion. The third variable affecting RWST depletion is the break size. If the RCP seal LOCA only occurs on 2 RCPs (Case 1) versus 3 RCPs (Case 2), the time to RWST depletion is increased by over one hour.

Case 3 indicates that low pressure recirculation is a success path versus high pressure recirculation. Sensitivity analyses indicate that either option, low pressure recirculation or high pressure recirculation, is successful for all three cases. During injection, the break size is small enough that RCS pressure remains higher than the RHR pump shutoff head. Based on the specific order of steps in the procedure, HP recirculation will be chosen over LP recirculation based on the higher RCS pressure during injection.

The following plots show the RWST Level for each simulation.

-ZWRWST FT 35.00 LOCA Initiation, Start 2 HHSIPs 30.00 25.00 20.00 15.00

/

27% RWST, Reduce Flow to 1 HHSIP 10.00 59%

RWST, Start HP Recirculation 5.00 0

5 10 15 20 25 30 TIME Figure 1 - RWST Depletion Timing Following 2 RCP Seal LOCAs 17

-ZWRWST FT 35.00 300 LOCA Initiation, Start 2 HHSIPs 25.00 20.00 15.00 10.00 k,

27% RWST, Reduce Flow to 1 HHSIP 10.00 5.00 9% RWST' Start HP Recirculation 0

5 10 15 20 25 30 TIME Figure 2 - RWST Depletion Timing Following 3 RCP Seal LOCAs

-ZWRWST FT 35.00 SLOCA Initiation, Start I HHSI 30.00 25.00 20.00 15.00 2%RWS" 10.00 5.00 0

5 10 15 20 25 30 TIME 18

Figure 2 - Case 3: RWST Depletion Timing Following 3 RCP Seal LOCAs with 1 HHSI pump Injecting.

MAAP Analysis Input Summary:

A summary of the MAAP inputs is provided in this section.

Equipment Setup:

High pressure safety injection - 2 trains available (Case 3 has 1 train)

Low pressure safety injection - 2 trains available Containment spray - 2 trains available Passive SI accumulators - not credited to slow RWST depletion or in SLOCA analysis.

" Charging and seal injection - failed

" Letdown and normal makeup - isolated

• Auxiliary feedwater - available Containment fan coolers - 1 train available (2 CFCs)

Pressurizer sprays and heaters - not credited At Time Zero, Initiating Event Occurs as Follows:

Reactor Trip Loss of FW MSIV Closure

" Initiate a 100°F per hour cooldown using SG PORVs At 30 Minutes Past the IE a LOCA Occurs:

• 480 gpm LOCA on each intermediate leg At 27% RWST Level Injection reduced to 1 HHSI pump

• Containment spray reduced to 1 CS pump if applicable.

At 9% RWST Level

" Stop HHSI pumps

• Stop containment spray pumps if applicable

• Align for piggy back recirculation Start 1 HHSI pump and 1 RHR pump 19

Attachment D HFE Analysis for Recirculation Due to LOCA Caused by Reactor Coolant Pump Seal Failures 20

OPER-01T, Switch over to recirculation following transient LOCA Due to the procedural response for switching over to ECCS recirculation in EPP-9, the HRA for aligning for low pressure recirculation or high pressure recirculation is considered the same because for any accident sequence leading to ECCS recirculation, high pressure recirculation will always be initiated regardless of whether the criteria for establishing low pressure recirculation are met. Also, successful establishment of high pressure recirculation is dependent upon availability of the RHR pump(s) and flowpath since high pressure recirculation is aligned in a 'piggy-back' mode (i.e., the LHSI pumps provide the suction source for the HHSI pumps).

The determination for aligning for low pressure recirculation is made based on whether or not RCS pressure is less than 125 psig (EPP-9, Rev. 33, step 22). If RCS pressure is less than 125 psig (and other conditions, such as adequate ECCS sump level are met), then low pressure recirculation is aligned and, when RWST level subsequently reaches 9%, high pressure recirculation is also initiated. If RCS pressure is greater than 125 psig, then low pressure recirculation is not initiated and, once RWST level reaches 9%, high pressure recirculation is initiated. Thus, the probability for the operator failing to switch over to ECCS recirculation is the same for both high-pressure and low-pressure recirculation.

Cognitive Method Date Analyst - Reviewer CBDTM/THERP 06/27111 EGW - Mike Lloyd Analysis, File File Date File-Size (Bytes)

RobinsonType_C_OPER-06/27111 1511424 36.HRA HEP Summary Pcog Pexe Total HEP Error Factor Without Recovery 1.8e-03 4.7e-02 With Recovery 1.2e-05 4.3e-03 4.3e-03 5

Identification and Definition Transient LOCA occurs. Would be other plant upsets. The break size is not large enough to provide cooling through the break. Need to align for recirculation of sump water for assist in core cooling and maintain RCS inventory. The pressure remains above shut off head of the RHR pumps. Following the injection of the water from the RWST operators need to align for recirculation of sump water for core cooling. The assessment assumes that the recognition of the need to perform the action would take place as the RWST level is dropping and would be made before reaching the RWST level alarm.

This assumes injection phase was successful.

Assigned Basic Events Cues and Indications Initial Cue Level in RWST Recovery Cue Cue/s SI signal, dropping pressurizer level (LI-459A, LI-460, LI-461, LI-462, LI-458), increase in sump level (LI-801 and LI-802 in the control room and on ERFIS, CV Water Level A and B 0.5 FT Key Way Sump Lights), increase in containment pressure (PC-950, PC-951A, PC-952, PC-953A, PC-954, PC-955A), decreasing RWST level (LI-949, LI-970), radiation monitors R2, R7, Condensate measuring alarm (APP-002-E2, HVH Condensate Coll LT-701, LT-702, 21

LT-703 or LT-704), containment temperature (TI-950B),

accumulator levels (LI-920, LI-922, LI-924, LI-926, LI-928, LI-930)

Degree of Clarity Very Good Procedures and Training Cognitive Procedure PATH-1 (Revision: 18)

Cognitive Step Number Step 4 Cognitive Instruction SI Initiated Execution Procedure EPP-9 (Revision: 32)

Other Procedure Job Performance Measure Classroom Training Frequency: biennial Simulator Training Frequency: biennial Notes PATH-1 memorized action in PATH-i, transfer from PATH-1 to EPP-9 at 27% level in RWST.

Training JPM / Simulator / Equipment Walk Downs that evaluate this action - Updated 8-5-09 FSS-SEG-40 24 Months FSS-SEG-63 24 Months FSS-SEG-68 24 Months LOCT-05-1 24 Months Manpower Requirements

'D.efault Actual Operations hShift Manager 1

0 Shift Supervisor 1

0 STA 1

0 Reactor Operators 2

1 i

Plant Operators 3

2 Maintenance',

Mechanics 2

0 Electricians 2

0 I&C Technicians 2

0 Health -Physics Technicians 2

0 Chemistry:

Technicians 1

0 Dependencies (Related Human Interactions)

Key Assumptions Assumes transient LOCA break size is equivalent to small break LOCA size.

Operator Interview Insights Step 3 is check of step 7 while performing evolution Reviewed by Operations and other RNP personnel on 3-10-09 Tinning Analysis Tsw 522.00 Minutes Tdelay 399.60 Minutes T1/2 2.00 Minutes TM 13.50 Minutes 22

Time available for recovery 106.90 Minutes SPAR-H Available time 108.90 Minutes (cognitive)

SPAR-H Available time 8.92 (execution) ratio Minimum level of dependence ZD for recovery Notes Cue response type CP-2 13.5 minute manipulation time from EPP-9-BD.

Delay time of 399.6 minutes and Tsw of 522 minutes based on MAAP analysis for 480 gpm seal LOCA on 2 RCPs.

Coanitive Analvsis Pc Failure Mechanism Branch HEP Pca: Availability of Information a

neg.

Pcb: Failure of Attention I

7.5e-04 P~c: Misread/miscommunicate data a

neg.

Pcd: Information misleading a

neg.

Pce: Skip a step in procedure a

1.0e-03 Pd: Misinterpret Instructions a

neg.

Pc,: Misinterpret decision logic k

neg.

Pch: Deliberate violation a

neg.

Initial Pc(without recovery credited) 1.8e-03 Notes 0

Cognitive Complexity Simple Equipment Accessibility Main Control Room: Accessible Co nitive Recovery n,

n, U. 0, n,)*

c a

C.0

• U a)

-j in 0

Pca neg.

N/A 1.0e+00 Pcb 7.5e-04 X

X X

N/A MD 3.0e-03 2.3e-06 Pc, neg.

N/A 1.0e+00 Pcd neg.

N/A 1.0e+00 Pce 1.0e-03 X

X

-X N/A MD 1.0e-02 1.0e-05 Pcf neg.

N/A 1.0e+00 Pc, neg.

N/A 1.0e+00 Pch neg.

N/A 1.0e+00 Final Pc (with recovery credited) 1.2e-05 Notes 0

Execution Performance Shaping Factors Environment Lighting Normal Heat Normal 23

Radiation

Background

Atmosphere Normal Equipment Accessibility Main Control Room Accessible Stress Low Plant Response As Yes Expected:

Workload:

Low Performance Shaping Optimal Factors:

Notes Per the methodology, Execution Stress value of Low is appropriate when the plant is progressing towards a controlled, stable state. Once it has been determined that a LOCA exists, plant response would be as expected in that SI had already successfully actuated. There is no reason at this point to believe that ECCS recirculation capability does not exist. So a successful end-state is considered likely. Also, 6.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> into the event, workload would be lower and additional staffing should be available.

Execution Complexity I Simple 24

Execution Unrecovered Procedure: EPP-9, Tranfer to Cold Leg Recirculation Comment Stress Over Step No.

Instruction/Comment Error THERP HEP Factor Ride Type Table Item Stop pumps except 1 Sl and 1 CV Spray I

20-7b I 1

4.3E-4 1

5EOCI 20-12I 2

3.8E-3 Total Step HEP 4.2e-03 Close valves

_EOM 20-7b 1

4.3E-4 1

EOC 20-12 2

3.8E-3 Total Step HEP 4.2e-03 Verify closed SI-856A & B 1

EOM I 20-7b I

1 4.3E-4 1

Att 1 Step3 EOC 20-13 1

1.3E-3 Total Step HEP 1.7e-03 Establish CCW flow to RHR heat exchanger EOM I20-7b I1 I4.3E-4 1

10 EOC 20-12 2

3.8E-3 Total Step HEP 4.2e-03 stop running SI and CV pumps EOM I20-7b I1 I4.3E-4 1

12 EOC 20-12 2

3.8E-3 Total Step HEP 4.2e-03 Close RWST DISCH valves 15 EOM I20-7b I1 I4.3E-4 1

EOC 20-12 2

3.8E-3 Total Step HEP 4.2e-03 Verify RWST TO RHR valves CLOSED I

17 EOM 20-7b 1

4.3E-4 1 Total Step HEP 4.3e-04 open CV SUMP TO RHR valves 18 EOM I

0-7b I1 4.3E-4 1

EOC 20-12 2

3.8E-3 25

Total Step HEP 4.2e-03 Check at least one train of CV SUMP TO RHR valves open 19 EOM 20-7b 1

4.3E-4 Total Step HEP 4.3e-04 Check CCW from RHR HX valves open

=I1 1

21 EOM 20-7b 1

4.3E-4 I_

I Total Step HEP 4.3e-04 verify SI and CV pumps stopped To late to serve as check on pump operation - step 12 1

27 EOM 20-7b I1 4.3E-4 Total Step HEP 4.3e-04 Close RWST DISCH valves 28 EOC 20-12 2

3.8E-3 Total Step HEP 4.2e-03 Close RHR HX DISCH valves EOM 20-7b 1

4.3E-4 1

33 EOC 20-12 2

3.8E-3 Total Step HEP 4.2e-03 Check discharge valves closed 2

34 EOM 1 20-7b 2

1.3E-3 I

Total Step HEP 1.3e-03 Check both RHR HX DISCH valves closed 35 EOM 20-7 1

1.3E-3 Total Step HEP 1.3e-03 Open RHR Loop RECIRC valve

_EOM 20-7b 1

4.3E-4 1

36b EOC 20-12 2

3.8E-3 Total Step HEP 4.2e-03 Start RHR pump

__EOM i 20-7b 1

4.3E-4 1

36c EOC 20-12 2

3.8E-3 Total Step HEP 4.2e-03 Start SI pump 1

EOM 20-7b I1 I 4.3E-4 26

EOC 20-12 2

3.8E-3 I

Total Step HEP 4.2e-03 Check RVLIS and TC 38 EOM I

20-7 1

1.3E-3 1

38 EOC 20-11 1

1.3E-3 Total Step HEP 2.6e-03 Execution Recovered Critical Recovery Action HEP (Crit)

HEP (Rec)

Dep.

Cond. HEP (Rec)

Total for Step Step No.

Step No.

5 Stop pumps except 1 Sl and 1 CV Spray 4.2e-03 4.2e-03 7

Close valves 4.2e-03

7. le-06 Att 1 Step 3 Verify closed SI-856A & B 1.7e-03 ZD 1.7e-03 10 Establish CCW flow to RHR heat exchanger 4.2e-03 1.8e-06 21 Check CCW from RHR HX valves open 4.3e-04 ZD 4.3e-04 12 stop running SI and CV pumps 4.2e-03 1.8e-06 27 verify SI and CV pumps stopped 4.3e-04 ZD 4.3e-04 15 Close RWST DISCH valves 4.2e-03 1.8e-06 17 Verify RWST TO RHR valves CLOSED 4.3e-04 ZD 4.3e-04 18 open CV SUMP TO RHR valves 4.2e-03 1.8e-06 19 Check at least one train of CV SUMP TO RHR 4.3e-04 ZD 4.3e-04 valves open 28 Close RWST DISCH valves 4.2e-03 5.5e-06 34 Check discharge valves closed 1.3e-03 ZD 1.3e-03 33 Close RHR HX DISCH valves 4.2e-03 5.5e-06 35 Check both RHR HX DISCH valves closed 1.3e-03 ZD 1.3e-03 36b Open RHR Loop RECIRC valve 4.2e-03 1.1 e-05 38 Check RVLIS and TC 2.6e-03 ZD 2.6e-03 36c Start RHR pump 4.2e-03 1.1 e-05 38 Check RVLIS and TC 2.6e-03 ZD 2.6e-03 37 Start SI pump 4.2e-03 1.1e-05 38 Check RVLIS and TC 2.6e-03 ZD 2.6e-03 Total Unrecovered:

4.7e-02 Total Recovered:

4.3e-03 27

Attachment E Westinghouse Review of RCP Thermal Barrier Cooling Restoration Analysis 28