ML20112F370: Difference between revisions

From kanterella
Jump to navigation Jump to search
(StriderTol Bot insert)
 
(StriderTol Bot change)
 
Line 16: Line 16:


=Text=
=Text=
{{#Wiki_filter:Final Precursor Analysis Accident Sequence Precursor Program --- Office of Nuclear Regulatory Research Callaway                       Foreign Object Renders the B Essential Service Water Pump Inoperable and Failure of the A Auxiliary Feedwater Pumps Due to Foreign Material in the Condensate Storage Tank Event Date: 2/3/2001           LERs: 483/01-002 and 483/02-001                   CDP = 1x10-5 August 19, 2004 Condition Summary During 2001, two conditions occurred involving foreign material that affected safety-related equipment. In February 2001, a foreign object rendered the B essential service water (ESW) pump inoperable for 132 hours. In December 2001, foreign material from the condensate storage tank (CST) caused failure of the A motor-driven auxiliary feedwater (AFW) pump. The condition, a degraded seal on the tanks floating diaphragm, had existed for some time. Additionally, a component cooling water (CCW) pump was inoperable for 21 days due to improper maintenance.
{{#Wiki_filter:1 Final Precursor Analysis Accident Sequence Precursor Program --- Office of Nuclear Regulatory Research Callaway Foreign Object Renders the B Essential Service Water Pump Inoperable and Failure of the A Auxiliary Feedwater Pumps Due to Foreign Material in the Condensate Storage Tank Event Date: 2/3/2001 LERs: 483/01-002 and 483/02-001 CDP = 1x10-5 August 19, 2004 Condition Summary During 2001, two conditions occurred involving foreign material that affected safety-related equipment. In February 2001, a foreign object rendered the B essential service water (ESW) pump inoperable for 132 hours. In December 2001, foreign material from the condensate storage tank (CST) caused failure of the A motor-driven auxiliary feedwater (AFW) pump. The condition, a degraded seal on the tanks floating diaphragm, had existed for some time. Additionally, a component cooling water (CCW) pump was inoperable for 21 days due to improper maintenance.
Because the time period for AFW condition overlaps the ESW and CCW conditions, a single condition assessment for all three conditions was performed. (See Attachment 1 for a detailed timeline for these events.)
Because the time period for AFW condition overlaps the ESW and CCW conditions, a single condition assessment for all three conditions was performed. (See Attachment 1 for a detailed timeline for these events.)
Event 1- Foreign object renders the B essential service water pump inoperable (LER 483/01-002)
Event 1-Foreign object renders the B essential service water pump inoperable (LER 483/01-002)
On February 14, 2001, the B ESW pump was started to support performance of a surveillance procedure. Upon starting, the pump experienced low discharge pressure and flow. (The pumps flow and discharge pressure were 4 Mlbm/hr at 80 psi vs. its normal flow and discharge pressure of 7 Mlbm/hr at 140 psi.) The pump was secured and declared inoperable, rendering train B ESW inoperable. Had a loss of offsite power or other event requiring ESW system flow occurred while the B ESW pump was inoperable, safety systems supported by train B ESW, including the B emergency diesel generator, would not have been available to perform their safety function (Refs. 1, 2, and 3).
On February 14, 2001, the B ESW pump was started to support performance of a surveillance procedure. Upon starting, the pump experienced low discharge pressure and flow. (The pumps flow and discharge pressure were 4 Mlbm/hr at 80 psi vs. its normal flow and discharge pressure of 7 Mlbm/hr at 140 psi.) The pump was secured and declared inoperable, rendering train B ESW inoperable. Had a loss of offsite power or other event requiring ESW system flow occurred while the B ESW pump was inoperable, safety systems supported by train B ESW, including the B emergency diesel generator, would not have been available to perform their safety function (Refs. 1, 2, and 3).
Cause. Pump inspection revealed a 20-foot-long section of 1.25-inch diameter-reinforced tygon hose wrapped around the rotor assembly in the first stage impeller of the pump casing, blocking a portion of the pumps suction path (Refs. 1, 2, 3, and 4).
Cause. Pump inspection revealed a 20-foot-long section of 1.25-inch diameter-reinforced tygon hose wrapped around the rotor assembly in the first stage impeller of the pump casing, blocking a portion of the pumps suction path (Refs. 1, 2, 3, and 4).
Condition duration. At 2:15 p.m. on February 9, 2001, a leak collection rig was installed on the B ESW prelube tank. The rig consisted of a funnel with a 20-foot-long section of tygon hose attached to the funnel. The tygon hose detached from the funnel, fell into the pump bay, and was subsequently drawn into the pumps intake when the pump started. The hose was removed, and the pump was returned to service at 2:31 a.m. on February 15, 2001. The pump was inoperable for a period of 132 hours (from 2:15 p.m. on February 9, 2001, until 2:31 a.m. on February 15, 2001).
Condition duration. At 2:15 p.m. on February 9, 2001, a leak collection rig was installed on the B ESW prelube tank. The rig consisted of a funnel with a 20-foot-long section of tygon hose attached to the funnel. The tygon hose detached from the funnel, fell into the pump bay, and was subsequently drawn into the pumps intake when the pump started. The hose was removed, and the pump was returned to service at 2:31 a.m. on February 15, 2001. The pump was inoperable for a period of 132 hours (from 2:15 p.m. on February 9, 2001, until 2:31 a.m. on February 15, 2001).
Recovery opportunities. Due to the cause of failure (i.e., tygon hose wrapped around the pump rotor assembly), the B ESW pump could not have been recovered in a timely manner during an accident condition.
Recovery opportunities. Due to the cause of failure (i.e., tygon hose wrapped around the pump rotor assembly), the B ESW pump could not have been recovered in a timely manner during an accident condition.
1


LERs 483/01-002 and 483/02-001 An alternate source of water can be provided to the train B ESW system from either (1) the train A ESW pump, through a cross-connection, or (2) the train B normal service water (NSW) pump, if the pump has electric power and is operating (i.e., offsite power has not been lost).
LERs 483/01-002 and 483/02-001 1 The Accident Sequence Precursor Program limits the conditional assessment of risk to a 1-year period.
2 An alternate source of water can be provided to the train B ESW system from either (1) the train A ESW pump, through a cross-connection, or (2) the train B normal service water (NSW) pump, if the pump has electric power and is operating (i.e., offsite power has not been lost).
To align flow from the train A ESW pump to train B, two locked-closed manual valves must be opened. To align flow from the train B NSW pump to the train B ESW system, operators must override a safety injection signal to the two motor-operated valves isolating the systems and open the valves. Because equipment directly cooled by the train B ESW system or by the train B component cooling water (CCW) system (which is cooled by the train B ESW) could fail before either of these actions could be taken, credit for an alternate source of water was not included in this assessment.
To align flow from the train A ESW pump to train B, two locked-closed manual valves must be opened. To align flow from the train B NSW pump to the train B ESW system, operators must override a safety injection signal to the two motor-operated valves isolating the systems and open the valves. Because equipment directly cooled by the train B ESW system or by the train B component cooling water (CCW) system (which is cooled by the train B ESW) could fail before either of these actions could be taken, credit for an alternate source of water was not included in this assessment.
Event 2- Potential unavailability of the auxiliary feedwater pumps due to foreign material in the CST (LER 483/02-001)
Event 2-Potential unavailability of the auxiliary feedwater pumps due to foreign material in the CST (LER 483/02-001)
On December 3, 2001, both motor-driven AFW pumps were manually started to support a plant shutdown. Both pumps started successfully, but the A pump failed to deliver sufficient pressure or flow. Inspection of the pump revealed that the pump was gas bound due to foreign material from the CST entering the pump. (Refs. 5, 6, 7, and 8).
On December 3, 2001, both motor-driven AFW pumps were manually started to support a plant shutdown. Both pumps started successfully, but the A pump failed to deliver sufficient pressure or flow. Inspection of the pump revealed that the pump was gas bound due to foreign material from the CST entering the pump. (Refs. 5, 6, 7, and 8).
Cause. The cause of the A AFW pump failure was entry of foreign material into the pumps suction. A piece of foam from the CSTs floating diaphragm had entered the AFW suction piping and become lodged in the eye of the A AFW pumps first-stage impeller, where it created a localized low pressure area, causing gases to come out of the solution. The gases created voids in the pumps casing, partially air-binding the remaining stages and rendering the pump incapable of developing sufficient discharge pressure and flow.
Cause. The cause of the A AFW pump failure was entry of foreign material into the pumps suction. A piece of foam from the CSTs floating diaphragm had entered the AFW suction piping and become lodged in the eye of the A AFW pumps first-stage impeller, where it created a localized low pressure area, causing gases to come out of the solution. The gases created voids in the pumps casing, partially air-binding the remaining stages and rendering the pump incapable of developing sufficient discharge pressure and flow.
Line 33: Line 33:
Condition duration. A limited inspection of the CST was performed on October 17, 2000; however, the inspection did not identify degradation of the tanks diaphragm. Therefore, the exact time when portions of the diaphragms foam ring and fabric detached is not known. The time for the condition assessment is 1 year (8,760 hours).1 The period selected for the analysis is from January 27, 2001, to January 26, 2002, the date that degradation of the foam seal ring and foreign material in the CST were discovered.
Condition duration. A limited inspection of the CST was performed on October 17, 2000; however, the inspection did not identify degradation of the tanks diaphragm. Therefore, the exact time when portions of the diaphragms foam ring and fabric detached is not known. The time for the condition assessment is 1 year (8,760 hours).1 The period selected for the analysis is from January 27, 2001, to January 26, 2002, the date that degradation of the foam seal ring and foreign material in the CST were discovered.
Prior to its failure to run on December 3, 2001, the A AFW pump was last tested on October 22, 2001. Because there is uncertainty about when foreign material entered the A AFW pump, this analysis conservatively assumes that the debris was in or near the line that it eventually clogged for the entire period (from October 22, 2001, to December 3, 2001), a total of 42 days (1008 hours).
Prior to its failure to run on December 3, 2001, the A AFW pump was last tested on October 22, 2001. Because there is uncertainty about when foreign material entered the A AFW pump, this analysis conservatively assumes that the debris was in or near the line that it eventually clogged for the entire period (from October 22, 2001, to December 3, 2001), a total of 42 days (1008 hours).
Recovery opportunities. On December 3, 2001, following failure to run the A AFW pump, operators quickly vented the pump. However, the licensee did not declare the pump operable until December 5, 2001, 2 days later.
Recovery opportunities. On December 3, 2001, following failure to run the A AFW pump, operators quickly vented the pump. However, the licensee did not declare the pump operable until December 5, 2001, 2 days later.  
1 The Accident Sequence Precursor Program limits the conditional assessment of risk to a 1-year period.
2


LERs 483/01-002 and 483/02-001 Other conditions, failures, and unavailable equipment. The licensee identified four instances when train A essential equipment was unavailable during the time period when the B ESW pump was inoperable (Ref. 1). They are as follows:
LERs 483/01-002 and 483/02-001 2 Since this condition did not involve an actual initiating event, the parameter of interest is the measure of the incremental increase between the conditional probability for the period in which the condition existed and the nominal probability for the same period but with the condition nonexistent and plant equipment available. This incremental increase or importance is determined by subtracting the CDP from the CCDP. This measure is used to assess the risk significance of hardware unavailabilities, especially for those cases where the nominal CDP is high with respect to the incremental increase of the conditional probability caused by the hardware unavailability.
* For 2 minutes on February 12, 2001, the train A ESW flow to the train A containment coolers was isolated.
3 Other conditions, failures, and unavailable equipment. The licensee identified four instances when train A essential equipment was unavailable during the time period when the B ESW pump was inoperable (Ref. 1). They are as follows:
* For 4 hours and 42 minutes on February 12, 2001, the air conditioning unit for the train A class 1E electrical equipment room was inoperable.
For 2 minutes on February 12, 2001, the train A ESW flow to the train A containment coolers was isolated.
* For 1 hour and 29 minutes on February 13, 2001, train A of the residual heat removal system was inoperable while hydrazine was being added.
For 4 hours and 42 minutes on February 12, 2001, the air conditioning unit for the train A class 1E electrical equipment room was inoperable.
* For 38 minutes on February 13, 2001, the room cooler for the train A safety injection pumps room was inoperable.
For 1 hour and 29 minutes on February 13, 2001, train A of the residual heat removal system was inoperable while hydrazine was being added.
For 38 minutes on February 13, 2001, the room cooler for the train A safety injection pumps room was inoperable.
A review of licensee event reports and inspection reports for 2001 identified other equipment unavailabilities. They are as follows:
A review of licensee event reports and inspection reports for 2001 identified other equipment unavailabilities. They are as follows:
* For less than 4 hours on March 19, 2001, and for about 4.5 hours on June 12, 2001, the turbine-driven AFW pump was inoperable due to a failed steam trap on the turbines steam supply line, while the drain bypass level valve was removed from service for maintenance (Ref. 9).
For less than 4 hours on March 19, 2001, and for about 4.5 hours on June 12, 2001, the turbine-driven AFW pump was inoperable due to a failed steam trap on the turbines steam supply line, while the drain bypass level valve was removed from service for maintenance (Ref. 9).
* For approximately 21 days (from November 15, 2001, until December 5, 2001), the C CCW pump was inoperable due to improper maintenance (failure to add the proper amount of lubricating oil), resulting in the pump suffering a bearing failure (Ref. 5).
For approximately 21 days (from November 15, 2001, until December 5, 2001), the C CCW pump was inoperable due to improper maintenance (failure to add the proper amount of lubricating oil), resulting in the pump suffering a bearing failure (Ref. 5).
Screening runs were made using the Callaway Rev. 3 simplified plant analysis risk (SPAR) model (Ref. 10) to evaluate the risk significance of these equipment unavailabilities. Except for failure of the C CCW pump, none of the equipment unavailabilities significantly contributed to risk. Therefore, only the failure of the C CCW pump was included in the analysis.
Screening runs were made using the Callaway Rev. 3 simplified plant analysis risk (SPAR) model (Ref. 10) to evaluate the risk significance of these equipment unavailabilities. Except for failure of the C CCW pump, none of the equipment unavailabilities significantly contributed to risk. Therefore, only the failure of the C CCW pump was included in the analysis.
Analysis Results
Analysis Results Importance2 The CST seal was assumed to be in a degraded state for the entire 1-year period, increasing the risk of failure for all three of the AFW pumps. The B ESW pump was unavailable for 132 hours of the year duration the C CCW was unavailable for 504 hours, and the A AFW pump was unavailable for 1008 hours. To assess the overall risk significance of these three failures, the analysis was performed in four parts.  
!      Importance2 The CST seal was assumed to be in a degraded state for the entire 1-year period, increasing the risk of failure for all three of the AFW pumps. The B ESW pump was unavailable for 132 hours of the year duration the C CCW was unavailable for 504 hours, and the A AFW pump was unavailable for 1008 hours. To assess the overall risk significance of these three failures, the analysis was performed in four parts.
2 Since this condition did not involve an actual initiating event, the parameter of interest is the measure of the incremental increase between the conditional probability for the period in which the condition existed and the nominal probability for the same period but with the condition nonexistent and plant equipment available. This incremental increase or importance is determined by subtracting the CDP from the CCDP. This measure is used to assess the risk significance of hardware unavailabilities, especially for those cases where the nominal CDP is high with respect to the incremental increase of the conditional probability caused by the hardware unavailability.
3


LERs 483/01-002 and 483/02-001
LERs 483/01-002 and 483/02-001 4
    -  Part 1 (132 hours) reflects the time period when the B ESW pump was inoperable in addition to the increased failure probability of all three AFW pumps due to debris in the CST.
Part 1 (132 hours) reflects the time period when the B ESW pump was inoperable in addition to the increased failure probability of all three AFW pumps due to debris in the CST.
    -    Part 2 (504 hours) reflects the time period when the C CCW and A AFW pumps were both inoperable in addition to the increased failure probability of the B motor-driven AFW pump and the turbine-driven AFW pump due to debris in the CST.
Part 2 (504 hours) reflects the time period when the C CCW and A AFW pumps were both inoperable in addition to the increased failure probability of the B motor-driven AFW pump and the turbine-driven AFW pump due to debris in the CST.
    -  Part 3 (504 hours) reflects the remaining time period when the A AFW pump was inoperable in addition to the increased failure probability of the B motor-driven AFW pump and the turbine-driven AFW pump due to debris in the CST.
Part 3 (504 hours) reflects the remaining time period when the A AFW pump was inoperable in addition to the increased failure probability of the B motor-driven AFW pump and the turbine-driven AFW pump due to debris in the CST.
    -  Part 4 (7620 hours) reflects the remaining time during which there was an increased failure probability of all three AFW pumps due to debris in the CST during the 1-year period at which Callaway was at power operations. (See Attachment 1 for a detailed timeline for this analysis and a description of the time periods for the analysis.) The risk significance is determined by subtracting the nominal core damage probability from the conditional core damage probability:
Part 4 (7620 hours) reflects the remaining time during which there was an increased failure probability of all three AFW pumps due to debris in the CST during the 1-year period at which Callaway was at power operations. (See Attachment 1 for a detailed timeline for this analysis and a description of the time periods for the analysis.) The risk significance is determined by subtracting the nominal core damage probability from the conditional core damage probability:
Part 1     Part 2     Part 3     Part 4       Total Conditional core damage probability     4.4E-06     2.9E-06     2.6E-06     3.0E-05     4.0E-05 (CCDP) - point estimate Nominal core damage probability          4.2E-07     1.6E-06     1.6E-06     2.4E-05     2.8E-05 (CDP) - point estimate Importance (CCDP) - point estimate -    4.0E-06     1.3E-06     1.0E-06     5.6E-06 (CDP) - point estimate Importance (CDP = CCDP - CDP) - point estimate                                           1.2E-05 This is an increase of 1.2E-05 over the nominal CDP for the 1-year period for this condition assessment.
Part 1 Part 2 Part 3 Part 4 Total Conditional core damage probability (CCDP) - point estimate 4.4E-06 2.9E-06 2.6E-06 3.0E-05 4.0E-05 Nominal core damage probability (CDP) - point estimate 4.2E-07 1.6E-06 1.6E-06 2.4E-05 2.8E-05 Importance (CCDP) - point estimate -
(CDP) - point estimate 4.0E-06 1.3E-06 1.0E-06 5.6E-06 Importance (CDP = CCDP - CDP) - point estimate 1.2E-05 This is an increase of 1.2E-05 over the nominal CDP for the 1-year period for this condition assessment.
The Accident Sequence Precursor Program acceptance threshold is an importance (CDP) of 1.0E-06, which these integrated events meet.
The Accident Sequence Precursor Program acceptance threshold is an importance (CDP) of 1.0E-06, which these integrated events meet.
    -  Alternate to Part 1 reflects the time period when only the B ESW pump was inoperable for 132 hours.
Alternate to Part 1 reflects the time period when only the B ESW pump was inoperable for 132 hours.
    -    Alternate to Part 2 reflects the time period when only the C CCW inoperable in addition to the increased for 504 hours.
Alternate to Part 2 reflects the time period when only the C CCW inoperable in addition to the increased for 504 hours.
    -  Alternate to Part 4 reflects the time period when there was an increased failure probability of all three AFW pumps due to debris in the CST during the 1-year (8760 hours) period at which Callaway was at power operations.
Alternate to Part 4 reflects the time period when there was an increased failure probability of all three AFW pumps due to debris in the CST during the 1-year (8760 hours) period at which Callaway was at power operations.  
4


LERs 483/01-002 and 483/02-001 ESW B only         CCW C only         AFW only Conditional core damage probability (CCDP)         4.2E-06           1.8E-06           3.4E-05
LERs 483/01-002 and 483/02-001 5
- point estimate Nominal core damage probability (CDP) -             4.2E-07           1.6E-06           2.8E-05 point estimate Importance (CCDP) - point estimate - (CDP)         4.0E-06           1.6E-07         6.5E-06
ESW B only CCW C only AFW only Conditional core damage probability (CCDP)
- point estimate
- point estimate 4.2E-06 1.8E-06 3.4E-05 Nominal core damage probability (CDP) -
!    Dominant Sequences The dominant core damage sequence is from part 4 of the analysis. The dominant sequence is a transient (TRANS) sequence (Sequence 19), which contributes 15% to the total importance of all four parts. The events and important component failures in Sequence 19 (shown in Figure 1) include:
point estimate 4.2E-07 1.6E-06 2.8E-05 Importance (CCDP) - point estimate - (CDP)
      -    TRANS occurs,
- point estimate 4.0E-06 1.6E-07 6.5E-06 Dominant Sequences The dominant core damage sequence is from part 4 of the analysis. The dominant sequence is a transient (TRANS) sequence (Sequence 19), which contributes 15% to the total importance of all four parts. The events and important component failures in Sequence 19 (shown in Figure 1) include:
      -    reactor shutdown succeeds,
TRANS occurs, reactor shutdown succeeds, AFW fails to provide sufficient flow, main feedwater fails to provide sufficient flow, and high-pressure injection (for feed and bleed) is unavailable.
      -    AFW fails to provide sufficient flow,
Results Tables The conditional probability of the dominant sequences is shown in Table 1.
      -    main feedwater fails to provide sufficient flow, and
The event tree sequence logic for the dominant sequences is provided in Table 2a.
      -    high-pressure injection (for feed and bleed) is unavailable.
Table 2b defines the nomenclature used in Table 2a.
!    Results Tables
The conditional cut sets for the dominant sequences for parts 1, 2, 3, and 4 are provided in Tables 3a, 3b, 3c, and 3d respectively.
      -    The conditional probability of the dominant sequences is shown in Table 1.
Table 4 provides the definitions and probabilities for modified or dominant events.
      -    The event tree sequence logic for the dominant sequences is provided in Table 2a.
Modeling Assumptions Assessment summary This event was modeled as an at-power condition assessment for 1 year. Rev. 3 of the Callaway SPAR model (Ref. 10) was used for this assessment. During the 1-year period, the B ESW pump was inoperable for 132 hours, and the C CCW pump was inoperable for 504 hours. The A AFW pump was inoperable for 1008 hours and was at an increased risk of failure due to foreign material from the CST for the rest of the condition duration. The other AFW pumps were at an increased risk of failure to run due to foreign material from the CST.
      -    Table 2b defines the nomenclature used in Table 2a.
To appropriately model the various component unavailabilities and the degraded seal and foreign material in the CST, the condition assessment was performed in four parts. (See for a detailed timeline for this analysis, a description of equipment downtimes, and time periods for the analysis.) The discussion below provides the bases for the analysis.
      -    The conditional cut sets for the dominant sequences for parts 1, 2, 3, and 4 are provided in Tables 3a, 3b, 3c, and 3d respectively.
For this analysis, the only failure mode of the AFW pumps being considered is a condition where debris is blocking the pump suction. Actual ingestion of debris into the pump internals is assumed not to be a credible failure mode for this condition. Therefore, recovery of a pump
      -    Table 4 provides the definitions and probabilities for modified or dominant events.
Modeling Assumptions
!    Assessment summary This event was modeled as an at-power condition assessment for 1 year. Rev. 3 of the Callaway SPAR model (Ref. 10) was used for this assessment. During the 1-year period, the B ESW pump was inoperable for 132 hours, and the C CCW pump was inoperable for 504 hours. The A AFW pump was inoperable for 1008 hours and was at an increased risk of failure due to foreign material from the CST for the rest of the condition duration. The other AFW pumps were at an increased risk of failure to run due to foreign material from the CST.
To appropriately model the various component unavailabilities and the degraded seal and foreign material in the CST, the condition assessment was performed in four parts. (See Attachment 1 for a detailed timeline for this analysis, a description of equipment downtimes, and time periods for the analysis.) The discussion below provides the bases for the analysis.
For this analysis, the only failure mode of the AFW pumps being considered is a condition where debris is blocking the pump suction. Actual ingestion of debris into the pump internals is assumed not to be a credible failure mode for this condition. Therefore, recovery of a pump 5


LERs 483/01-002 and 483/02-001 from debris blocking the suction is assumed to be entirely recoverable with the recovery action being the venting of an air-bound pump.
LERs 483/01-002 and 483/02-001 6
! Event and Fault Trees Modifications The AFW pumps were at an increased risk for failure due to foreign material from the CST.
from debris blocking the suction is assumed to be entirely recoverable with the recovery action being the venting of an air-bound pump.
Event and Fault Trees Modifications The AFW pumps were at an increased risk for failure due to foreign material from the CST.
This specific failure was not modeled in the AFW pump fault trees in the base SPAR model; therefore, the AFW-A, AFW-B, and AFW-TDP fault trees were updated to include failures due to debris ingestion in addition to the standard mechanical failure probabilities. The updated fault trees are shown in Figures 2 through 4. To properly model the debris ingestion failure, three new basic events were created for each pump. The new events represented (1) the probability that the pump ingests debris, (2) the probability that the pump fails to run due to debris ingestion, and (3) the probability that the operator fails to recover the pumps failure-to-run due to debris ingestion. The description and base values for each of the new events are as follows:
This specific failure was not modeled in the AFW pump fault trees in the base SPAR model; therefore, the AFW-A, AFW-B, and AFW-TDP fault trees were updated to include failures due to debris ingestion in addition to the standard mechanical failure probabilities. The updated fault trees are shown in Figures 2 through 4. To properly model the debris ingestion failure, three new basic events were created for each pump. The new events represented (1) the probability that the pump ingests debris, (2) the probability that the pump fails to run due to debris ingestion, and (3) the probability that the operator fails to recover the pumps failure-to-run due to debris ingestion. The description and base values for each of the new events are as follows:
S   Probability that debris is ingested into AFW MDP A (AFW-MDP-DI-1A). Under normal operating conditions there is no debris in the CST. Therefore, there is no opportunity for AFW MDP A to ingest debris. AFW-MDP-DI-1A was set to FALSE in the base case.
S Probability that debris is ingested into AFW MDP A (AFW-MDP-DI-1A). Under normal operating conditions there is no debris in the CST. Therefore, there is no opportunity for AFW MDP A to ingest debris. AFW-MDP-DI-1A was set to FALSE in the base case.
S   Probability that debris is ingested into AFW MDP B (AFW-MDP-DI-1B). Under normal operating conditions there is no debris in the CST. Therefore, there is no opportunity for AFW MDP B to ingest debris. AFW-MDP-DI-1B was set to FALSE in the base case.
S Probability that debris is ingested into AFW MDP B (AFW-MDP-DI-1B). Under normal operating conditions there is no debris in the CST. Therefore, there is no opportunity for AFW MDP B to ingest debris. AFW-MDP-DI-1B was set to FALSE in the base case.
S   Probability that AFW MDP A fails-to-run due to ingestion of debris (AFW-MDP-FRD-1A). During the event, AFW MDP A failed to provide sufficient pressure because the pump was gas bound due to foreign material from the CST entering the pump suction.
S Probability that AFW MDP A fails-to-run due to ingestion of debris (AFW-MDP-FRD-1A). During the event, AFW MDP A failed to provide sufficient pressure because the pump was gas bound due to foreign material from the CST entering the pump suction.
Therefore, failure is assumed if debris blocks the suction of an AFW MDP. MDP-FRD-1A was set to TRUE in the base case.
Therefore, failure is assumed if debris blocks the suction of an AFW MDP. MDP-FRD-1A was set to TRUE in the base case.
S   Probability that AFW MDP B fails-to-run due to ingestion of debris (AFW-MDP-FRD-1B). During the event, AFW MDP A failed to provide sufficient pressure because the pump was gas bound due to foreign material from the CST entering the pump suction, and since the B AFW pump has the same design and system setup, it is assumed that, given debris ingestion into the pump suction, the B pump would have failed in a similar manner. MDP-FRD-1B was set to TRUE in the base case.
S Probability that AFW MDP B fails-to-run due to ingestion of debris (AFW-MDP-FRD-1B). During the event, AFW MDP A failed to provide sufficient pressure because the pump was gas bound due to foreign material from the CST entering the pump suction, and since the B AFW pump has the same design and system setup, it is assumed that, given debris ingestion into the pump suction, the B pump would have failed in a similar manner. MDP-FRD-1B was set to TRUE in the base case.
S   Probability that debris is ingested into AFW TDP (AFW-TDP-DI). Under normal operating conditions there is no debris in the CST. Therefore, there is no opportunity for AFW MDP B to ingest debris. AFW-TDP-DI was set to FALSE in the base case.
S Probability that debris is ingested into AFW TDP (AFW-TDP-DI). Under normal operating conditions there is no debris in the CST. Therefore, there is no opportunity for AFW MDP B to ingest debris. AFW-TDP-DI was set to FALSE in the base case.
S   Probability that AFW TDP fails-to-run due to ingestion of debris (AFW-TDP-FRD).
S Probability that AFW TDP fails-to-run due to ingestion of debris (AFW-TDP-FRD).
The internal configuration of the TDP is fundamentally different from the internal configuration of the MDPs, and upon analysis of the type and size of the debris, it was determined that the TDP was less susceptible to failure due to debris ingestion as compared to the MDPs. AFW-TDP-FRD was assumed to be 5.0E-02 for the base case.
The internal configuration of the TDP is fundamentally different from the internal configuration of the MDPs, and upon analysis of the type and size of the debris, it was determined that the TDP was less susceptible to failure due to debris ingestion as compared to the MDPs. AFW-TDP-FRD was assumed to be 5.0E-02 for the base case.
S   Operator fails to recover AFW MDP A failure-to-run due to ingestion of debris (AFW-XHE-XL-MDPFRD-1A). For this analysis, the assumed AFW pump failure mode is debris blocking the pump suction, leading to air-binding in the pump. Therefore, the recovery considered in this event is the operator recovery of an air-bound pump. Using the SPAR 6
S Operator fails to recover AFW MDP A failure-to-run due to ingestion of debris (AFW-XHE-XL-MDPFRD-1A). For this analysis, the assumed AFW pump failure mode is debris blocking the pump suction, leading to air-binding in the pump. Therefore, the recovery considered in this event is the operator recovery of an air-bound pump. Using the SPAR


LERs 483/01-002 and 483/02-001 Human Error Model (see Attachment 2) to determine the operator nonrecovery probability, AFW-XHE-XL-MDPFRD-1A was set to 5.0E-2 for the base case.
LERs 483/01-002 and 483/02-001 7
S Operator fails to recover AFW MDP A failure-to-run due to ingestion of debris (dependent value) (AFW-XHE-XL-MDPFRD-1A1). For this analysis, there is an assumed complete dependency between the operator recovery of AFW MDP B and AFW MDP A from debris ingestion failures. Therefore, a project rule was created to substitute the dependent version of AFW-XHE-XL-MDPFRD-1A when it appears in the same cut sets as AFW-XHE-XL-MDP-FRD-1B. Using the SPAR Human Error Model to determine the value of the completely dependent event, AFW-XHE-XL-MDPFRD-1A1 was set to 1.0 for the base case.
Human Error Model (see Attachment 2) to determine the operator nonrecovery probability, AFW-XHE-XL-MDPFRD-1A was set to 5.0E-2 for the base case.
S Operator fails to recover AFW MDP B failure-to-run due to ingestion of debris (AFW-XHE-XL-MDPFRD-1B). For this analysis, the assumed AFW pump failure mode is debris blocking the pump suction, leading to air-binding in the pump. Therefore, the recovery considered in this event is the operator recovery of an air-bound pump. Using the SPAR Human Error Model (see Attachment 2) to determine the operator nonrecovery probability, AFW-XHE-XL-MDPFRD-1B was set to 5.0E-2 for the base case.
S Operator fails to recover AFW MDP A failure-to-run due to ingestion of debris (dependent value) (AFW-XHE-XL-MDPFRD-1A1). For this analysis, there is an assumed complete dependency between the operator recovery of AFW MDP B and AFW MDP A from debris ingestion failures. Therefore, a project rule was created to substitute the dependent version of AFW-XHE-XL-MDPFRD-1A when it appears in the same cut sets as AFW-XHE-XL-MDP-FRD-1B. Using the SPAR Human Error Model to determine the value of the completely dependent event, AFW-XHE-XL-MDPFRD-1A1 was set to 1.0 for the base case.
S Operator fails to recover AFW TDP failure-to-run due to ingestion of debris (AFW-XHE-XL-TDPFRD). For this analysis, the assumed AFW pump failure mode is debris blocking the pump suction, leading to air-binding in the pump. Therefore, the recovery considered in this event is the operator recovery of an air-bound pump. Using the SPAR Human Error Model (see Attachment 2) to determine the operator nonrecovery probability, AFW-XHE-XL-TDPFRD was set to 5.0E-2 for the base case.
S Operator fails to recover AFW MDP B failure-to-run due to ingestion of debris (AFW-XHE-XL-MDPFRD-1B). For this analysis, the assumed AFW pump failure mode is debris blocking the pump suction, leading to air-binding in the pump. Therefore, the recovery considered in this event is the operator recovery of an air-bound pump. Using the SPAR Human Error Model (see Attachment 2) to determine the operator nonrecovery probability, AFW-XHE-XL-MDPFRD-1B was set to 5.0E-2 for the base case.
S Operator fails to recover AFW TDP failure-to-run due to ingestion of debris (dependent value) (AFW-XHE-XL-TDPFRD1). For this analysis, there is an assumed high dependency between the operator recovery of AFW MDP B and AFW TDP from debris ingestion failures. Therefore, a project rule was created to substitute the dependent version of AFW-XHE-XL-TDPFRD when it appears in the same cut sets as AFW-XHE-XL-MDP-FRD-1B. Using the SPAR Human Error Model (see Attachment 2) to determine the value of the highly dependent event, AFW-XHE-XL-TDPFRD1 was set to 5.3E-1 for the base case.
S Operator fails to recover AFW TDP failure-to-run due to ingestion of debris (AFW-XHE-XL-TDPFRD). For this analysis, the assumed AFW pump failure mode is debris blocking the pump suction, leading to air-binding in the pump. Therefore, the recovery considered in this event is the operator recovery of an air-bound pump. Using the SPAR Human Error Model (see Attachment 2) to determine the operator nonrecovery probability, AFW-XHE-XL-TDPFRD was set to 5.0E-2 for the base case.
! Basic Event Probability changes Table 4 provides the basic events that were modified to reflect the event condition being analyzed. The bases for these changes are as follows:
S Operator fails to recover AFW TDP failure-to-run due to ingestion of debris (dependent value) (AFW-XHE-XL-TDPFRD1). For this analysis, there is an assumed high dependency between the operator recovery of AFW MDP B and AFW TDP from debris ingestion failures. Therefore, a project rule was created to substitute the dependent version of AFW-XHE-XL-TDPFRD when it appears in the same cut sets as AFW-XHE-XL-MDP-FRD-1B. Using the SPAR Human Error Model (see Attachment 2) to determine the value of the highly dependent event, AFW-XHE-XL-TDPFRD1 was set to 5.3E-1 for the base case.
S Probability that debris is ingested into AFW MDP A (AFW-MDP-DI-1A). Based on the pump velocity, the size and number of debris particles, and the pumps operation scenarios, the probability of ingestion of debris into AFW MDP B was assumed to be 5.0E-1 for parts 1 and 3 of the condition assessment. During the event, foreign material from the CST was ingested into the suction of AFW MDP A. Therefore, for this analysis, AFW-MDP-DI-1A was set to TRUE for part 2 of the condition assessment.
Basic Event Probability changes Table 4 provides the basic events that were modified to reflect the event condition being analyzed. The bases for these changes are as follows:
S Probability that debris is ingested into AFW MDP B (AFW-MDP-DI-1B). Based on the pump velocity, the size and number of debris particles, and the pumps operation scenarios, the probability of ingestion of debris into AFW MDP B was assumed to be 5.0E-1 for all three parts of the condition assessment.
S Probability that debris is ingested into AFW MDP A (AFW-MDP-DI-1A). Based on the pump velocity, the size and number of debris particles, and the pumps operation scenarios, the probability of ingestion of debris into AFW MDP B was assumed to be 5.0E-1 for parts 1 and 3 of the condition assessment. During the event, foreign material from the CST was ingested into the suction of AFW MDP A. Therefore, for this analysis, AFW-MDP-DI-1A was set to TRUE for part 2 of the condition assessment.
7
S Probability that debris is ingested into AFW MDP B (AFW-MDP-DI-1B). Based on the pump velocity, the size and number of debris particles, and the pumps operation scenarios, the probability of ingestion of debris into AFW MDP B was assumed to be 5.0E-1 for all three parts of the condition assessment.  


LERs 483/01-002 and 483/02-001 S   Probability that debris is ingested into AFW TDP (AFW-TDP-DI). Based on the pump velocity, the size and number of debris particles, and the pumps operation scenarios, the probability of ingestion of debris into AFW TDP A was assumed to be 5.0E-1 for all three parts of the condition assessment.
LERs 483/01-002 and 483/02-001 8
S   Operator fails to recover AFW MDP A failure-to-run due to ingestion of debris (AFW-XHE-XL-MDPFRD-1A). During the event, when A AFW MDP failed to provide sufficient pressure, the operators responded by quickly venting the pump. However, the licensee did not declare the pump operable until 2 days later. Therefore, for this analysis, AFW MDP A is assumed to be unrecovered. AFW-XHE-XL-MDPFRD-1A was set to TRUE for part 2 of the condition assessment. For parts 1 and 3 of the condition assessment, the failure probability for this event was set to its nominal value.
S Probability that debris is ingested into AFW TDP (AFW-TDP-DI). Based on the pump velocity, the size and number of debris particles, and the pumps operation scenarios, the probability of ingestion of debris into AFW TDP A was assumed to be 5.0E-1 for all three parts of the condition assessment.
S   Probability of failure of the motor-driven CCW pump (CCW-MDP-FR-P1C). The C CCW pump was assumed to be inoperable for approximately 21 days (from November 15, 2001, until December 5, 2001). (See Attachment 1 for a detailed description of the timeline and period of inoperability.) This event was set to TRUE for part 2 (504 hours) of the condition assessment. For parts 1 and 3 of the condition assessment, the failure probability for this event was set to its nominal value.
S Operator fails to recover AFW MDP A failure-to-run due to ingestion of debris (AFW-XHE-XL-MDPFRD-1A). During the event, when A AFW MDP failed to provide sufficient pressure, the operators responded by quickly venting the pump. However, the licensee did not declare the pump operable until 2 days later. Therefore, for this analysis, AFW MDP A is assumed to be unrecovered. AFW-XHE-XL-MDPFRD-1A was set to TRUE for part 2 of the condition assessment. For parts 1 and 3 of the condition assessment, the failure probability for this event was set to its nominal value.
S   Probability of failure to run of the B ESW pump (ESW-MDP-FS-1B). The B ESW pump was estimated to be inoperable for a period of 132 hours. (See Attachment 1 for a detailed description of the timeline and period of inoperability.) This event was set to TRUE for part 1 (132 hours) of the condition assessment. For parts 2 and 3 of the condition assessment, the failure probability for this event was set to its nominal value.
S Probability of failure of the motor-driven CCW pump (CCW-MDP-FR-P1C). The C CCW pump was assumed to be inoperable for approximately 21 days (from November 15, 2001, until December 5, 2001). (See Attachment 1 for a detailed description of the timeline and period of inoperability.) This event was set to TRUE for part 2 (504 hours) of the condition assessment. For parts 1 and 3 of the condition assessment, the failure probability for this event was set to its nominal value.
S Probability of failure to run of the B ESW pump (ESW-MDP-FS-1B). The B ESW pump was estimated to be inoperable for a period of 132 hours. (See Attachment 1 for a detailed description of the timeline and period of inoperability.) This event was set to TRUE for part 1 (132 hours) of the condition assessment. For parts 2 and 3 of the condition assessment, the failure probability for this event was set to its nominal value.
Equipment supported by train B ESW includes the B emergency diesel generator; train B of the CCW system; and air conditioning units and room coolers for the control room, the Division B Class 1E switchgear room, the train B safety injection pump room, the train B residual heat removal pump room, the train B centrifugal charging pump room, the train B AFW pump room, and the room for CCW pumps B and D. The train B ESW also serves as the backup water source for the B AFW pump. Had a loss of offsite power (or other event resulting in a safety injection signal) occurred while the train B ESW pump was inoperable, this equipment would not have been available to perform its safety function.
Equipment supported by train B ESW includes the B emergency diesel generator; train B of the CCW system; and air conditioning units and room coolers for the control room, the Division B Class 1E switchgear room, the train B safety injection pump room, the train B residual heat removal pump room, the train B centrifugal charging pump room, the train B AFW pump room, and the room for CCW pumps B and D. The train B ESW also serves as the backup water source for the B AFW pump. Had a loss of offsite power (or other event resulting in a safety injection signal) occurred while the train B ESW pump was inoperable, this equipment would not have been available to perform its safety function.
Except for the Division B Class 1E switchgear, the Rev. 3 SPAR model explicitly models dependency on ESW (for direct cooling or room cooling) for all of this equipment.
Except for the Division B Class 1E switchgear, the Rev. 3 SPAR model explicitly models dependency on ESW (for direct cooling or room cooling) for all of this equipment.
However, because this failure occurred during cold weather months (February 2001), loss of room cooling is assumed to not result in failure of the division 1B ac power 4160 bus (ACP-BAC-LP-NB02).
However, because this failure occurred during cold weather months (February 2001), loss of room cooling is assumed to not result in failure of the division 1B ac power 4160 bus (ACP-BAC-LP-NB02).
! Sensitivity Analysis An additional sensitivity analysis was performed to model the reactor trip coinciding with the failure of the A AFW pump due to debris ingestion and the failure of the CCW MDP P1C. This was analyzed as a TRANS initiating event with the components failed. The CCDP of the initiating event analysis was 1.3E-05.
Sensitivity Analysis An additional sensitivity analysis was performed to model the reactor trip coinciding with the failure of the A AFW pump due to debris ingestion and the failure of the CCW MDP P1C. This was analyzed as a TRANS initiating event with the components failed. The CCDP of the initiating event analysis was 1.3E-05.
8


LERs 483/01-002 and 483/02-001
LERs 483/01-002 and 483/02-001 9
!  Model Update Changes to the Rev. 3 SPAR model for Callaway are as follows:
Model Update Changes to the Rev. 3 SPAR model for Callaway are as follows:
S   The model was updated to incorporate changes in the reactor coolant pump (RCP) seal loss-of-coolant accident model (Refs. 11 and 12). These changes account for the high temperature seals that were installed on all RCPs at the time of these events.
S The model was updated to incorporate changes in the reactor coolant pump (RCP) seal loss-of-coolant accident model (Refs. 11 and 12). These changes account for the high temperature seals that were installed on all RCPs at the time of these events.
S   Failure data for the turbine-driven AFW pump were updated, including the fail-to-run lambda and mission time and the fail-to-start probability.
S Failure data for the turbine-driven AFW pump were updated, including the fail-to-run lambda and mission time and the fail-to-start probability.
S   Failure data for the power-operated relief valves (PORVs) were updated.
S Failure data for the power-operated relief valves (PORVs) were updated.
These updates are independent of the actual events being analyzed. Bases for the updates are described in the footnotes to Table 4.
These updates are independent of the actual events being analyzed. Bases for the updates are described in the footnotes to Table 4.
References
References 1.
: 1. Licensee Event Report 483/01-002, Revision 0, Foreign Object Renders B Essential Service Water Pump Inoperable, event date February 14, 2001 (ADAMS Accession No. ML011070538).
Licensee Event Report 483/01-002, Revision 0, Foreign Object Renders B Essential Service Water Pump Inoperable, event date February 14, 2001 (ADAMS Accession No. ML011070538).
: 2. NRC Inspection Report 05000483/2001-02, April 20, 2001 (ADAMS Accession No. ML01100295).
2.
: 3. NRC Inspection Report 05000483/2001-09, June 22, 2001 (ADAMS Accession No. ML011760446).
NRC Inspection Report 05000483/2001-02, April 20, 2001 (ADAMS Accession No. ML01100295).
: 4. NRC Supplemental Inspection Report 05000483/2002-08, April 23, 2002 (ADAMS Accession No. ML0211400981).
3.
: 5. NRC Inspection Report 05000483/2001-06, January 16, 2002 (ADAMS Accession No. ML0201601760).
NRC Inspection Report 05000483/2001-09, June 22, 2001 (ADAMS Accession No. ML011760446).
: 6. Licensee Event Report 483/02-001, Revision 1, Manual Auxiliary Feedwater Actuation and Subsequent Gas Binding of the A Motor Driven Auxiliary Feedwater Pump, December 3, 2001 (ADAMS Accession No. ML020720446).
4.
: 7. Callaway Public Meeting Inspector Notes, February 27, 2002 (ADAMS Accession No. ML020640016).
NRC Supplemental Inspection Report 05000483/2002-08, April 23, 2002 (ADAMS Accession No. ML0211400981).
: 8. NRC Augmented Inspection Team Report 50-483/02-07, March 21, 2002 (ADAMS Accession No. ML0208181770).
5.
: 9. NRC Inspection Report 05000483/2001-03, July 24, 2001 (ADAMS Accession No. ML012050531).
NRC Inspection Report 05000483/2001-06, January 16, 2002 (ADAMS Accession No. ML0201601760).
: 10. John A. Schroeder and Scott T. Beck, Standardized Plant Analysis Risk Model for Callaway (ASP PWR B), Revision 3.02, November 2003.
6.
9
Licensee Event Report 483/02-001, Revision 1, Manual Auxiliary Feedwater Actuation and Subsequent Gas Binding of the A Motor Driven Auxiliary Feedwater Pump, December 3, 2001 (ADAMS Accession No. ML020720446).
7.
Callaway Public Meeting Inspector Notes, February 27, 2002 (ADAMS Accession No. ML020640016).
8.
NRC Augmented Inspection Team Report 50-483/02-07, March 21, 2002 (ADAMS Accession No. ML0208181770).
9.
NRC Inspection Report 05000483/2001-03, July 24, 2001 (ADAMS Accession No. ML012050531).
10.
John A. Schroeder and Scott T. Beck, Standardized Plant Analysis Risk Model for Callaway (ASP PWR B), Revision 3.02, November 2003.


LERs 483/01-002 and 483/02-001
LERs 483/01-002 and 483/02-001 10 11.
: 11. R. G. Neve, et al., Cost/Benefit Analysis for Generic Issue 23: Reactor Coolant Pump Seal Failure, NUREG/CR-5167, U.S. Nuclear Regulatory Commission, Washington, D.C., April 1991.
R. G. Neve, et al., Cost/Benefit Analysis for Generic Issue 23: Reactor Coolant Pump Seal Failure, NUREG/CR-5167, U.S. Nuclear Regulatory Commission, Washington, D.C., April 1991.
: 12. Memorandum from Ashok C. Thadani to William D. Travers, Closeout of Generic Safety Issue 23: Reactor Coolant Pump Seal Failure, U.S. Nuclear Regulatory Commission, Washington, D.C., November 8, 1999.
12.
: 13. Equipment Performance and Information Exchange System (EPIX), Volume 1 - Instructions for Data Entry, Maintenance Rule and Reliability Information Module, INPO 98-001, Institute of Nuclear Power Operations, February 1998.
Memorandum from Ashok C. Thadani to William D. Travers, Closeout of Generic Safety Issue 23: Reactor Coolant Pump Seal Failure, U.S. Nuclear Regulatory Commission, Washington, D.C., November 8, 1999.
10
13.
Equipment Performance and Information Exchange System (EPIX), Volume 1 - Instructions for Data Entry, Maintenance Rule and Reliability Information Module, INPO 98-001, Institute of Nuclear Power Operations, February 1998.


LERs 483/01-002 and 483/02-001 Table 1. Conditional probabilities associated with the highest probability sequences.
LERs 483/01-002 and 483/02-001 11 Table 1. Conditional probabilities associated with the highest probability sequences.
Conditional core            Core damage Event tree       Sequence               damage                 probability               Importance            Percentage name              no.              probability                 (CDP)               (CCDP - CDP)6             contribution7 (CCDP)
Event tree name Sequence no.
Part 11 LOOP             26-03               2.1E-06                 1.4E-07                   2.0E-06               50.0%
Conditional core damage probability (CCDP)
LOOP             26-16               1.1E-06                 7.5E-08                   1.0E-06               25.0%
Core damage probability (CDP)
Total (all sequences)5                   4.4E-06                 4.2E-07                   4.0E-06 2
Importance (CCDP - CDP)6 Percentage contribution7 Part 11 LOOP 26-03 2.1E-06 1.4E-07 2.0E-06 50.0%
Part 2 TRANS               19                 3.7E-07                 3.1E-09                   3.7E-07               28.4%
LOOP 26-16 1.1E-06 7.5E-08 1.0E-06 25.0%
TRANS               18                 2.8E-07                 4.3E-09                   2.7E-07               21.0%
Total (all sequences)5 4.4E-06 4.2E-07 4.0E-06 Part 22 TRANS 19 3.7E-07 3.1E-09 3.7E-07 28.4%
Total (all sequences)       5 2.9E-06                 1.6E-06                   1.3E-06 3
TRANS 18 2.8E-07 4.3E-09 2.7E-07 21.0%
Part 3 TRANS               19                 3.5E-07                 3.1E-09                   3.5E-07               30.9%
Total (all sequences)5 2.9E-06 1.6E-06 1.3E-06 Part 33 TRANS 19 3.5E-07 3.1E-09 3.5E-07 30.9%
Total (all sequences)5                   2.6E-06                 1.6E-06                   1.0E-06 4
Total (all sequences)5 2.6E-06 1.6E-06 1.0E-06 Part 44 TRANS 19 2.3E-06 4.7E-08 2.2E-06 31.4%
Part 4 TRANS               19                 2.3E-06                 4.7E-08                   2.2E-06               31.4%
LODCB 10 2.1E-06 3.6E-07 1.8E-06 25.7%
LODCB                 10                 2.1E-06                 3.6E-07                   1.8E-06               25.7%
TRANS 18 1.6E-06 6.5E-08 1.5E-06 21.4%
TRANS               18                 1.6E-06                 6.5E-08                   1.5E-06               21.4%
Total (all sequences)5 3.0E-05 2.4E-05 5.6E-06 Total (all sequences)4 Total (all sequences)5 4.0E-05 2.8E-05 1.2E-05 Note:
Total (all sequences)       5 3.0E-05                 2.4E-05                   5.6E-06 Total (all sequences)4 Total (all sequences)5                   4.0E-05                 2.8E-05                   1.2E-05 Note:
1.
: 1. Values for part 1 are point estimates. (File name: GEM 483-02-001 05-04-04 093411 (Part 1).wpd)
Values for part 1 are point estimates. (File name: GEM 483-02-001 05-04-04 093411 (Part 1).wpd) 2.
: 2. Values for part 2 are point estimates. (File name: GEM 483-02-001 06-17-04 115505 (Part 2).wpd)
Values for part 2 are point estimates. (File name: GEM 483-02-001 06-17-04 115505 (Part 2).wpd) 3.
: 3. Values for part 3 are point estimates. (File name: GEM 483-02-001 07-01-04 085209 (Part 3).wpd)
Values for part 3 are point estimates. (File name: GEM 483-02-001 07-01-04 085209 (Part 3).wpd) 4.
: 4. Values for part 4 are point estimates. (File name: GEM 483-02-001 07-01-04 085342 (Part 4).wpd)
Values for part 4 are point estimates. (File name: GEM 483-02-001 07-01-04 085342 (Part 4).wpd) 5.
: 5. Total CCDP and CDP includes all sequences (including those not shown in this table).
Total CCDP and CDP includes all sequences (including those not shown in this table).
: 6. Importance is calculated using the total CCDP and total CDP from all sequences. Sequence level importance measures are not additive.
6.
: 7. Percentage contribution is the ratio of the importance of the sequence in relation to the importance of the part.
Importance is calculated using the total CCDP and total CDP from all sequences. Sequence level importance measures are not additive.
11
7.
Percentage contribution is the ratio of the importance of the sequence in relation to the importance of the part.


LERs 483/01-002 and 483/02-001 Table 2a. Event tree sequence logic for the dominant sequences.
LERs 483/01-002 and 483/02-001 12 Table 2a. Event tree sequence logic for the dominant sequences.
Event tree       Sequence                                         Logic name              no.                   (/ denotes success; see Table 2b for top event names)
Event tree name Sequence no.
TRANS             19           /RPS, AFW, MFW, HPI1 LOOP             26-03         /RPS, EPS, OEP-30M, /AFW3, /PORV4, /RCPSL, OEP-BD LODCB             10           /RPS, AFW, /HPI1, BLEED TRANS             18           /RPS, AFW, MFW. /HPI1, BLEED LOOP             09           /RPS, /EPS, /AFW2, /PORV3, RCPSL3, HPI2 LOOP             26-16         /RPS, EPS, OEP-30M, AFW3 Table 2b. Definitions of fault trees listed in Table 2a.
Logic
AFW               AFW IS UNAVAILABLE AFW2               AFW USING LOOP-FTF FAULT TREE FLAGS AFW3               AFW IS UNAVAILABLE (USING SBO-FTF FAULT TREE FLAGS)
(/ denotes success; see Table 2b for top event names)
BLEED             FAILURE TO PROVIDE BLEED PORTION OF FEED AND BLEED COOLING EPS               EMERGENCY POWER FAILS HPI1               HIGH-PRESSURE INJECTION FAILS HPI2               HPI USING LOOP-FTF FAULT TREE FLAGS MFW               MAIN FEEDWATER IS UNAVAILABLE OEP-30M           OFFSITE POWER RECOVERY WITHIN 30 MINUTES OEP-BD             OFFSITE POWER RECOVERY PRIOR TO BATTERY DEPLETION PORV3             PORVs/SRVs OPEN DURING LOOP PORV4             PORVs/SRVs OPEN DURING STATION BLACKOUT RCPSL             REACTOR COOLANT PUMP SEALS FAIL FROM LACK OF COOLING RCPSL3             RCPSL USING LOOP-FTF FAULT TREE FLAGS RPS               REACTOR PROTECTION SYSTEM FAILS 12
TRANS 19
/RPS, AFW, MFW, HPI1 LOOP 26-03
/RPS, EPS, OEP-30M, /AFW3, /PORV4, /RCPSL, OEP-BD LODCB 10
/RPS, AFW, /HPI1, BLEED TRANS 18
/RPS, AFW, MFW. /HPI1, BLEED LOOP 09
/RPS, /EPS, /AFW2, /PORV3, RCPSL3, HPI2 LOOP 26-16
/RPS, EPS, OEP-30M, AFW3 Table 2b. Definitions of fault trees listed in Table 2a.
AFW AFW IS UNAVAILABLE AFW2 AFW USING LOOP-FTF FAULT TREE FLAGS AFW3 AFW IS UNAVAILABLE (USING SBO-FTF FAULT TREE FLAGS)
BLEED FAILURE TO PROVIDE BLEED PORTION OF FEED AND BLEED COOLING EPS EMERGENCY POWER FAILS HPI1 HIGH-PRESSURE INJECTION FAILS HPI2 HPI USING LOOP-FTF FAULT TREE FLAGS MFW MAIN FEEDWATER IS UNAVAILABLE OEP-30M OFFSITE POWER RECOVERY WITHIN 30 MINUTES OEP-BD OFFSITE POWER RECOVERY PRIOR TO BATTERY DEPLETION PORV3 PORVs/SRVs OPEN DURING LOOP PORV4 PORVs/SRVs OPEN DURING STATION BLACKOUT RCPSL REACTOR COOLANT PUMP SEALS FAIL FROM LACK OF COOLING RCPSL3 RCPSL USING LOOP-FTF FAULT TREE FLAGS RPS REACTOR PROTECTION SYSTEM FAILS


LERs 483/01-002 and 483/02-001 Table 3a. Conditional cut sets for dominant sequences (part 1).
LERs 483/01-002 and 483/02-001 13 Table 3a. Conditional cut sets for dominant sequences (part 1).
Percent CCDP1                contribution                                     Minimal cut sets2 Event Tree: LOOP, Sequence 26-03 6.6E-07                   30.8             OEP-XHE-NOREC-ST                 OEP-XHE-NOREC-BD ESW-MDP-CF-START 5.5E-07                   26.4             OEP-XHE-NOREC-ST                 OEP-XHE-NOREC-BD EPS-DGN-TM-DGA 3.6E-07                   17.0             OEP-XHE-NOREC-ST                 OEP-XHE-NOREC-BD EPS-DGN-FS-DGA 2.1E-06         Total (all cut sets/this sequence)3 Event Tree: LOOP, Sequence 26-16 1.3E-07                   11.8             OEP-XHE-NOREC-ST                 AFW-TDP-FR-PAL02 ESW-MDP-CF-START 1.1E-07                   10.1             OEP-XHE-NOREC-ST                 EPS-DGN-TM-DGA AFW-TDP-FR-PAL02 1.1E-06         Total (all cut sets/this sequence)3 4.0E-06         Total (all cut sets/all sequences)3 Notes:
CCDP1 Percent contribution Minimal cut sets2 Event Tree: LOOP, Sequence 26-03 6.6E-07 30.8 OEP-XHE-NOREC-ST ESW-MDP-CF-START OEP-XHE-NOREC-BD 5.5E-07 26.4 OEP-XHE-NOREC-ST EPS-DGN-TM-DGA OEP-XHE-NOREC-BD 3.6E-07 17.0 OEP-XHE-NOREC-ST EPS-DGN-FS-DGA OEP-XHE-NOREC-BD 2.1E-06 Total (all cut sets/this sequence)3 Event Tree: LOOP, Sequence 26-16 1.3E-07 11.8 OEP-XHE-NOREC-ST ESW-MDP-CF-START AFW-TDP-FR-PAL02 1.1E-07 10.1 OEP-XHE-NOREC-ST AFW-TDP-FR-PAL02 EPS-DGN-TM-DGA 1.1E-06 Total (all cut sets/this sequence)3 4.0E-06 Total (all cut sets/all sequences)3 Notes:
: 1. Values are point estimates.
1.
: 2. See Table 4 for definitions and probabilities for the basic events.
Values are point estimates.
: 3. Totals include all cut sets (including those not shown in this table).
2.
See Table 4 for definitions and probabilities for the basic events.
3.
Totals include all cut sets (including those not shown in this table).
Table 3b. Conditional cut sets for dominant sequences (part 2).
Table 3b. Conditional cut sets for dominant sequences (part 2).
Percent                                       Minimal cut sets2 1
CCDP1 Percent contribution Minimal cut sets2 Event Tree: TRANS, Sequence 19 1.3E-06 13.5 MFW-XHE-ERROR AFW-MDP-DI-1B AFW-TDP-FRD HPI-XHE-XM-FB MFW-SYS-TRIP AFW-XHE-XL-MDPFRD-1B AFW-TDP-DI AFW-XHE-XL-MDPFRD-1B 3.7E-07 Total (all cut sets/this sequence)3 1.3E-06 Total (all cut sets/all sequences)3 Notes:
CCDP                contribution Event Tree: TRANS, Sequence 19 1.3E-06                   13.5             MFW-XHE-ERROR AFW-               MFW-SYS-TRIP MDP-DI-1B                        AFW-XHE-XL-MDPFRD-1B AFW-TDP-FRD                      AFW-TDP-DI HPI-XHE-XM-FB                    AFW-XHE-XL-MDPFRD-1B 3.7E-07         Total (all cut sets/this sequence)3 1.3E-06         Total (all cut sets/all sequences)3 Notes:
1.
: 1. Values are point estimates.
Values are point estimates.
: 2. See Table 4 for definitions and probabilities for the basic events.
2.
: 3. Totals include all cut sets (including those not shown in this table).
See Table 4 for definitions and probabilities for the basic events.
13
3.
Totals include all cut sets (including those not shown in this table).


LERs 483/01-002 and 483/02-001 Table 3c. Conditional cut sets for dominant sequences (part 3).
LERs 483/01-002 and 483/02-001 14 Table 3c. Conditional cut sets for dominant sequences (part 3).
Percent CCDP1                contribution                                     Minimal cut sets2 Event Tree: TRANS, Sequence 19 5.0E-08                   14.5             MFW-XHE-ERROR                     MFW-SYS-TRIP AFW-MDP-DI-1B                     AFW-XHE-XL-MDPFRD-1B AFW-TDP-FRD                      AFW-TDP-DI HPI-XHE-XM-FB1                    AFW-XHE-XL-TDPFRD1 4.6E-08                   13.1             HPI-XHE-XM-FB                     MFW-SYS-UNAVAIL AFW-MDP-DI-1B                     AFW-XHE-XL-MDPFRD-1B AFW-TDP-FRD                      AFW-TDP-DI AFW-XHE-XL-TDPFRD1 3.6E-08                   10.4             MFW-XHE-ERROR                     MFW-SYS-TRIP AFW-TDP-FR-PAL02                 AFW-MDP-DI-1B AFW-XHE-XL-MDPFRD-1B             HPI-XHE-XM-FB1 3.5E-07         Total (all cut sets/this sequence)3 2.6E-06         Total (all cut sets/all sequences)3 Notes:
CCDP1 Percent contribution Minimal cut sets2 Event Tree: TRANS, Sequence 19 5.0E-08 14.5 MFW-XHE-ERROR AFW-MDP-DI-1B AFW-TDP-FRD HPI-XHE-XM-FB1 MFW-SYS-TRIP AFW-XHE-XL-MDPFRD-1B AFW-TDP-DI AFW-XHE-XL-TDPFRD1 4.6E-08 13.1 HPI-XHE-XM-FB AFW-MDP-DI-1B AFW-TDP-FRD AFW-XHE-XL-TDPFRD1 MFW-SYS-UNAVAIL AFW-XHE-XL-MDPFRD-1B AFW-TDP-DI 3.6E-08 10.4 MFW-XHE-ERROR AFW-TDP-FR-PAL02 AFW-XHE-XL-MDPFRD-1B MFW-SYS-TRIP AFW-MDP-DI-1B HPI-XHE-XM-FB1 3.5E-07 Total (all cut sets/this sequence)3 2.6E-06 Total (all cut sets/all sequences)3 Notes:
: 1. Values are point estimates.
1.
: 2. See Table 4 for definitions and probabilities for the basic events.
Values are point estimates.
: 3. Totals include all cut sets (including those not shown in this table).
2.
14
See Table 4 for definitions and probabilities for the basic events.
3.
Totals include all cut sets (including those not shown in this table).


LERs 483/01-002 and 483/02-001 Table 3d. Conditional cut sets for dominant sequences (part 4).
LERs 483/01-002 and 483/02-001 15 Table 3d. Conditional cut sets for dominant sequences (part 4).
Percent CCDP1                contribution                                     Minimal cut sets2 Event Tree: TRANS, Sequence 19 3.8E-07                   16.9             MFW-XHE-ERROR                     MFW-SYS-TRIP AFW-MDP-DI-1A                     AFW-MDP-DI-1B AFW-XHE-XL-MDPFRD-1B              AFW-TDP-FRD AFW-TDP-DI                        HPI-XHE-XM-FB1 AFW-XHE-XL-TDPFRD1                AFW-XHE-XL-MDPFRD-1A1 3.4E-07                   15.3             HPI-XHE-XM-FB                     MFW-SYS-UNAVAIL AFW-MDP-DI-1A                     AFW-MDP-DI-1B AFW-XHE-XL-MDPFRD-1B              AFW-TDP-FRD AFW-TDP-DI                       AFW-XHE-XL-TDPFRD1 AFW-XHE-XL-MDPFRD-1A1 2.7E-07                   12.1             MFW-XHE-ERROR                     MFW-SYS-TRIP AFW-TDP-FR-PAL02                 AFW-MDP-DI-1A AFW-MDP-DI-1B                    AFW-XHE-XL-MDPFRD-1B HPI-XHE-XM-FB1                    AFW-XHE-XL-MDPFRD-1A1 2.5E-07                   10.9             HPI-XHE-XM-FB                     MFW-SYS-UNAVAIL AFW-TDP-FR-PAL02                 AFW-MDP-DI-1A AFW-MDP-DI-1B                     AFW-XHE-XL-MDPFRD-1B AFW-XHE-XL-MDPFRD-1A1 2.3E-06         Total (all cut sets/this sequence)3 Event Tree: LODCB, Sequence 10 6.1E-07                   28.4             AFW-MDP-DI-1B                     AFW-XHE-XL-MDPFRD-1B AFW-TDP-FRD                      AFW-TDP-DI AFW-XHE-XL-TDPFRD1 4.3E-07                   20.3             AFW-TDP-FR-PAL02                 AFW-MDP-DI-1B AFW-XHE-XL-MDPFRD-1B 3.5E-07                   16.3             AFW-TDP-TM-PAL02                 AFW-MDP-DI-1B AFW-XHE-XL-MDPFRD-1B 3.1E-07                   14.7             AFW-TDP-FS-PAL02                 AFW-MDP-DI-1B AFW-XHE-XL-MDPFRD-1B 2.1E-06         Total (all cut sets/this sequence)3 Event Tree: TRANS, Sequence 18 2.2E-07                   13.7             MFW-SYS-UNAVAIL                   AFW-MDP-DI-1A AFW-MDP-DI-1B                    AFW-XHE-XL-MDPFRD-1B AFW-TDP-FRD                      AFW-TDP-DI PPR-SRV-CC-PRV1                  AFW-XHE-XL-TDPFRD1 AFW-XHE-XL-MDPFRD-1A1 2.2E-07                   13.7             MFW-SYS-UNAVAIL                   PPR-SRV-CC-PRV2 AFW-MDP-DI-1A                     AFW-MDP-DI-1B AFW-XHE-XL-MDPFRD-1B              AFW-TDP-FRD AFW-TDP-DI                       AFW-XHE-XL-TDPFRD1 AFW-XHE-XL-MDPFRD-1A1 1.6E-06         Total (all cut sets/this sequence)3 3.0E-05         Total (all cut sets/all sequences)3 Notes:
CCDP1 Percent contribution Minimal cut sets2 Event Tree: TRANS, Sequence 19 3.8E-07 16.9 MFW-XHE-ERROR AFW-MDP-DI-1A AFW-XHE-XL-MDPFRD-1B AFW-TDP-DI AFW-XHE-XL-TDPFRD1 MFW-SYS-TRIP AFW-MDP-DI-1B AFW-TDP-FRD HPI-XHE-XM-FB1 AFW-XHE-XL-MDPFRD-1A1 3.4E-07 15.3 HPI-XHE-XM-FB AFW-MDP-DI-1A AFW-XHE-XL-MDPFRD-1B AFW-TDP-DI AFW-XHE-XL-MDPFRD-1A1 MFW-SYS-UNAVAIL AFW-MDP-DI-1B AFW-TDP-FRD AFW-XHE-XL-TDPFRD1 2.7E-07 12.1 MFW-XHE-ERROR AFW-TDP-FR-PAL02 AFW-MDP-DI-1B HPI-XHE-XM-FB1 MFW-SYS-TRIP AFW-MDP-DI-1A AFW-XHE-XL-MDPFRD-1B AFW-XHE-XL-MDPFRD-1A1 2.5E-07 10.9 HPI-XHE-XM-FB AFW-TDP-FR-PAL02 AFW-MDP-DI-1B AFW-XHE-XL-MDPFRD-1A1 MFW-SYS-UNAVAIL AFW-MDP-DI-1A AFW-XHE-XL-MDPFRD-1B 2.3E-06 Total (all cut sets/this sequence)3 Event Tree: LODCB, Sequence 10 6.1E-07 28.4 AFW-MDP-DI-1B AFW-TDP-FRD AFW-XHE-XL-TDPFRD1 AFW-XHE-XL-MDPFRD-1B AFW-TDP-DI 4.3E-07 20.3 AFW-TDP-FR-PAL02 AFW-XHE-XL-MDPFRD-1B AFW-MDP-DI-1B 3.5E-07 16.3 AFW-TDP-TM-PAL02 AFW-XHE-XL-MDPFRD-1B AFW-MDP-DI-1B 3.1E-07 14.7 AFW-TDP-FS-PAL02 AFW-XHE-XL-MDPFRD-1B AFW-MDP-DI-1B 2.1E-06 Total (all cut sets/this sequence)3 Event Tree: TRANS, Sequence 18 2.2E-07 13.7 MFW-SYS-UNAVAIL AFW-MDP-DI-1B AFW-TDP-FRD PPR-SRV-CC-PRV1 AFW-XHE-XL-MDPFRD-1A1 AFW-MDP-DI-1A AFW-XHE-XL-MDPFRD-1B AFW-TDP-DI AFW-XHE-XL-TDPFRD1 2.2E-07 13.7 MFW-SYS-UNAVAIL AFW-MDP-DI-1A AFW-XHE-XL-MDPFRD-1B AFW-TDP-DI AFW-XHE-XL-MDPFRD-1A1 PPR-SRV-CC-PRV2 AFW-MDP-DI-1B AFW-TDP-FRD AFW-XHE-XL-TDPFRD1 1.6E-06 Total (all cut sets/this sequence)3 3.0E-05 Total (all cut sets/all sequences)3 Notes:
: 1. Values are point estimates.
1.
: 2. See Table 4 for definitions and probabilities for the basic events.
Values are point estimates.
: 3. Totals include all cut sets (including those not shown in this table).
2.
15
See Table 4 for definitions and probabilities for the basic events.
3.
Totals include all cut sets (including those not shown in this table).


LERs 483/01-002 and 483/02-001 Table 4. Definitions and probabilities for modified or dominant basic events.
LERs 483/01-002 and 483/02-001 16 Table 4. Definitions and probabilities for modified or dominant basic events.
Probability/
Event name Description Probability/
Event name                              Description                    frequency   Modified AFW-MDP-DI-1A             DEBRIS INGESTED IN AFW MDP1A                         TRUE       Yes1 AFW-MDP-DI-1B             DEBRIS INGESTED IN AFW MDP1B                         5.0E-001     Yes2 AFW-MDP-FRD-1A           AFW MOTOR-DRIVEN PUMP 1A FAILS TO                     TRUE        Yes2 RUN (DEBRIS)
frequency Modified AFW-MDP-DI-1A DEBRIS INGESTED IN AFW MDP1A TRUE Yes1 AFW-MDP-DI-1B DEBRIS INGESTED IN AFW MDP1B 5.0E-001 Yes2 AFW-MDP-FRD-1A AFW MOTOR-DRIVEN PUMP 1A FAILS TO RUN (DEBRIS)
AFW-MDP-FRD-1B           AFW MOTOR-DRIVEN PUMP 1B FAILS TO                     TRUE        Yes2 RUN (DEBRIS)
TRUE Yes2 AFW-MDP-FRD-1B AFW MOTOR-DRIVEN PUMP 1B FAILS TO RUN (DEBRIS)
AFW-TDP-DI               DEBRIS INGESTED IN AFW TDP                           5.0E-001     Yes2 AFW-TDP-FR-PAL02         TURBINE DRIVEN FEED PUMP PAL02 FAILS                 9.5E-003     Yes3 TO RUN AFW-TDP-FRD               AFW TURBINE-DRIVEN PUMP FAILS TO RUN                 5.0E-002     Yes2 (DEBRIS)
TRUE Yes2 AFW-TDP-DI DEBRIS INGESTED IN AFW TDP 5.0E-001 Yes2 AFW-TDP-FR-PAL02 TURBINE DRIVEN FEED PUMP PAL02 FAILS TO RUN 9.5E-003 Yes3 AFW-TDP-FRD AFW TURBINE-DRIVEN PUMP FAILS TO RUN (DEBRIS) 5.0E-002 Yes2 AFW-TDP-FS-PAL02 TURBINE DRIVEN FEED PUMP PAL02 FAILS TO START 6.8E-003 Yes3 AFW-TDP-TM-PAL02 TURBINE DRIVEN FEED PUMP PAL02 UNAVAILABLE DUE TO TEST AND MAINTENANCE 7.6E-003 No AFW-XHE-XL-MDPFR D-1A OPERATOR FAILS TO RECOVER AFW MDP 1A (DEBRIS INGESTION)
AFW-TDP-FS-PAL02         TURBINE DRIVEN FEED PUMP PAL02 FAILS                 6.8E-003     Yes3 TO START AFW-TDP-TM-PAL02         TURBINE DRIVEN FEED PUMP PAL02                       7.6E-003     No UNAVAILABLE DUE TO TEST AND MAINTENANCE AFW-XHE-XL-MDPFR         OPERATOR FAILS TO RECOVER AFW MDP                     TRUE        Yes1 D-1A                      1A (DEBRIS INGESTION)
TRUE Yes1 AFW-XHE-XL-MDPFR D-1A1 OPERATOR FAILS TO RECOVER AFW MDP 1B (DEBRIS INGESTION) (DEPENDENT) 1.0 Yes4 AFW-XHE-XL-MDPFR D-1B OPERATOR FAILS TO RECOVER AFW MDP 1B (DEBRIS INGESTION) 5.0E-002 Yes4 AFW-XHE-XL-TDPFR D
AFW-XHE-XL-MDPFR         OPERATOR FAILS TO RECOVER AFW MDP                       1.0      Yes4 D-1A1                    1B (DEBRIS INGESTION) (DEPENDENT)
OPERATOR FAILS TO RECOVER AFW TDP (DEBRIS INGESTION) 5.0E-002 Yes4 AFW-XHE-XL-TDPFR D1 OPERATOR FAILS TO RECOVER AFW TDP (DEBRIS INGESTION) (DEPENDENT) 5.3E-001 Yes4 CCW-MDP-CF-RUN CCW PUMPS FAIL FROM COMMON CAUSE TO RUN 1.3E-002 Yes5 CCW-MDP-FR-P1C CCW MDP P1C FAILS TO RUN TRUE Yes6 CVC-MDP-TM-P1C PUMP P1C IS IN TEST OR MAINTENANCE 2.0E-001 No EPS-DGN-FS-DGA DIESEL GENERATOR A FAILS TO START 2.0E-002 No EPS-DGN-TM-DGA DG A UNAVAILABLE DUE TO TEST AND MAINTENANCE 3.1E-002 No EPS-DGN-TM-DGB DG B UNAVAILABLE DUE TO TEST AND MAINTENANCE 3.1E-002 No ESW-MDP-CF-START ESW PUMPS FAIL FROM COMMON CAUSE TO START 3.6E-002 Yes5 ESW-MDP-FS-1B ESW TRAIN B MDP 1B FAILS TO START TRUE Yes7
AFW-XHE-XL-MDPFR         OPERATOR FAILS TO RECOVER AFW MDP                   5.0E-002     Yes4 D-1B                      1B (DEBRIS INGESTION)
AFW-XHE-XL-TDPFR         OPERATOR FAILS TO RECOVER AFW TDP                   5.0E-002     Yes4 D                        (DEBRIS INGESTION)
AFW-XHE-XL-TDPFR         OPERATOR FAILS TO RECOVER AFW TDP                   5.3E-001    Yes4 D1                        (DEBRIS INGESTION) (DEPENDENT)
CCW-MDP-CF-RUN           CCW PUMPS FAIL FROM COMMON CAUSE                     1.3E-002     Yes5 TO RUN CCW-MDP-FR-P1C           CCW MDP P1C FAILS TO RUN                             TRUE       Yes6 CVC-MDP-TM-P1C           PUMP P1C IS IN TEST OR MAINTENANCE                   2.0E-001     No EPS-DGN-FS-DGA           DIESEL GENERATOR A FAILS TO START                   2.0E-002     No EPS-DGN-TM-DGA           DG A UNAVAILABLE DUE TO TEST AND                     3.1E-002     No MAINTENANCE EPS-DGN-TM-DGB           DG B UNAVAILABLE DUE TO TEST AND                     3.1E-002     No MAINTENANCE ESW-MDP-CF-START         ESW PUMPS FAIL FROM COMMON CAUSE                     3.6E-002     Yes5 TO START ESW-MDP-FS-1B             ESW TRAIN B MDP 1B FAILS TO START                     TRUE       Yes7 16


LERs 483/01-002 and 483/02-001 Table 4. Definitions and probabilities for modified or dominant basic events (cont).
LERs 483/01-002 and 483/02-001 17 Table 4. Definitions and probabilities for modified or dominant basic events (cont).
HPI-XHE-XM-FB                   OPERATOR FAILS TO INITIATE FEED AND                 1.0E-002     No BLEED COOLING HPI-XHE-XM-FB1                 OPERATOR FAILS TO INITIATE FEED AND                 6.9E-002     No BLEED COOLING MFW-SYS-TRIP                   MAIN FEEDWATER SYSTEM UNAVAILABLE                   8.0E-001     No GIVEN RX TRIP MFW-SYS-UNAVAIL                 OPERATOR FAILS TO RESTORE MFW FLOW                 2.0E-001     No MFW-XHE-ERROR                   OPERATOR FAILS TO RESTORE MFW FLOW                 4.0E-002     No OEP-XHE-NOREC-BD               OPERATOR FAILS TO RECOVER OFFSITE                   4.9E-002      No POWER BEFORE BATTERY DEPLETION GIVEN THAT POWER IS NOT RECOVERED IN SHORT TERM OEP-XHE-NOREC-SL               OPERATOR FAILS TO RECOVER OFFSITE                   2.4E-002     Yes8 POWER PRIOR TO SEAL LOCA OEP-XHE-NOREC-ST               OPERATOR FAILS TO RECOVER OFFSITE                   5.3E-001     No POWER IN SHORT TERM PPR-SRV-CC-PRV1                 PORV 1 FAILS TO OPEN ON DEMAND                     6.3E-003     No PPR-SRV-CC-PRV2                 PORV 2 FAILS TO OPEN ON DEMAND                     6.3E-003     No PPR-SRV-OO-1                   PORV 1 FAILS TO RECLOSE AFTER                       2.0E-003     Yes9 OPENING PPR-SRV-OO-2                   PORV 2 FAILS TO RECLOSE AFTER                       2.0E-003     Yes9 OPENING RCS-MDP-LK-SEALS               RCP SEALS FAIL W/O COOLING AND                     2.0E-001     Yes8 INJECTION RCS-MDP-LK-SEALS1               RCP SEALS FAIL W/O COOLING AND                     1.9E-001     No INJECTION CCW-MDP-FR-04A01               MOTOR DRIVEN PUMP ALPHA FACTOR 1                   9.72E-01     Yes10 FOR 4 TRAINS CCW-MDP-FR-04A02               MOTOR DRIVEN PUMP ALPHA FACTOR 2                   1.85E-02     Yes10 FOR 4 TRAINS CCW-MDP-FR-04A03               MOTOR DRIVEN PUMP ALPHA FACTOR 3                   7.79E-03     Yes10 FOR 4 TRAINS CCW-MDP-FR-04A04               MOTOR DRIVEN PUMP ALPHA FACTOR 4                   1.36E-03     Yes10 FOR 4 TRAINS CCW-MDP-FS-04A01               MOTOR DRIVEN PUMP ALPHA FACTOR 1                   9.67e-01     Yes10 FOR 4 TRAINS CCW-MDP-FS-04A02               MOTOR DRIVEN PUMP ALPHA FACTOR 2                   1.66E-02     Yes10 FOR 4 TRAINS CCW-MDP-FS-04A03               MOTOR DRIVEN PUMP ALPHA FACTOR 3                   1.35E-02     Yes10 FOR 4 TRAINS CCW-MDP-FS-04A04               MOTOR DRIVEN PUMP ALPHA FACTOR 4                   3.01E-03     Yes10 FOR 4 TRAINS Notes:
HPI-XHE-XM-FB OPERATOR FAILS TO INITIATE FEED AND BLEED COOLING 1.0E-002 No HPI-XHE-XM-FB1 OPERATOR FAILS TO INITIATE FEED AND BLEED COOLING 6.9E-002 No MFW-SYS-TRIP MAIN FEEDWATER SYSTEM UNAVAILABLE GIVEN RX TRIP 8.0E-001 No MFW-SYS-UNAVAIL OPERATOR FAILS TO RESTORE MFW FLOW 2.0E-001 No MFW-XHE-ERROR OPERATOR FAILS TO RESTORE MFW FLOW 4.0E-002 No OEP-XHE-NOREC-BD OPERATOR FAILS TO RECOVER OFFSITE POWER BEFORE BATTERY DEPLETION GIVEN THAT POWER IS NOT RECOVERED IN SHORT TERM 4.9E-002 No OEP-XHE-NOREC-SL OPERATOR FAILS TO RECOVER OFFSITE POWER PRIOR TO SEAL LOCA 2.4E-002 Yes8 OEP-XHE-NOREC-ST OPERATOR FAILS TO RECOVER OFFSITE POWER IN SHORT TERM 5.3E-001 No PPR-SRV-CC-PRV1 PORV 1 FAILS TO OPEN ON DEMAND 6.3E-003 No PPR-SRV-CC-PRV2 PORV 2 FAILS TO OPEN ON DEMAND 6.3E-003 No PPR-SRV-OO-1 PORV 1 FAILS TO RECLOSE AFTER OPENING 2.0E-003 Yes9 PPR-SRV-OO-2 PORV 2 FAILS TO RECLOSE AFTER OPENING 2.0E-003 Yes9 RCS-MDP-LK-SEALS RCP SEALS FAIL W/O COOLING AND INJECTION 2.0E-001 Yes8 RCS-MDP-LK-SEALS1 RCP SEALS FAIL W/O COOLING AND INJECTION 1.9E-001 No CCW-MDP-FR-04A01 MOTOR DRIVEN PUMP ALPHA FACTOR 1 FOR 4 TRAINS 9.72E-01 Yes10 CCW-MDP-FR-04A02 MOTOR DRIVEN PUMP ALPHA FACTOR 2 FOR 4 TRAINS 1.85E-02 Yes10 CCW-MDP-FR-04A03 MOTOR DRIVEN PUMP ALPHA FACTOR 3 FOR 4 TRAINS 7.79E-03 Yes10 CCW-MDP-FR-04A04 MOTOR DRIVEN PUMP ALPHA FACTOR 4 FOR 4 TRAINS 1.36E-03 Yes10 CCW-MDP-FS-04A01 MOTOR DRIVEN PUMP ALPHA FACTOR 1 FOR 4 TRAINS 9.67e-01 Yes10 CCW-MDP-FS-04A02 MOTOR DRIVEN PUMP ALPHA FACTOR 2 FOR 4 TRAINS 1.66E-02 Yes10 CCW-MDP-FS-04A03 MOTOR DRIVEN PUMP ALPHA FACTOR 3 FOR 4 TRAINS 1.35E-02 Yes10 CCW-MDP-FS-04A04 MOTOR DRIVEN PUMP ALPHA FACTOR 4 FOR 4 TRAINS 3.01E-03 Yes10 Notes:
: 1. Basic event changed to reflect event being analyzed (parts 2 and 3).
1.
: 2. Basic event changed to reflect event being analyzed (parts 1 through 4).
Basic event changed to reflect event being analyzed (parts 2 and 3).
17
2.
Basic event changed to reflect event being analyzed (parts 1 through 4).


LERs 483/01-002 and 483/02-001
LERs 483/01-002 and 483/02-001 18 3.
: 3. For the turbine-driven AFW pump, the failure rate for failure to run was updated to 1.19E-03/hr and the mission time was reduced from 24 hours to 8 hours. Additionally, the probability of failure to start was updated to 6.8E-03 per demand, based on guidance provided by INEEL. Failure data based on data covering the period of January 1, 1997, through December 31, 2001, from Ref. 13. Failure data based on unrecovered failures: therefore, operator recovery events associated with recovery of failure to start and failure to run were set to TRUE.
For the turbine-driven AFW pump, the failure rate for failure to run was updated to 1.19E-03/hr and the mission time was reduced from 24 hours to 8 hours. Additionally, the probability of failure to start was updated to 6.8E-03 per demand, based on guidance provided by INEEL. Failure data based on data covering the period of January 1, 1997, through December 31, 2001, from Ref. 13. Failure data based on unrecovered failures: therefore, operator recovery events associated with recovery of failure to start and failure to run were set to TRUE.
: 4. Operator recovery values were determined the SPAR Model Human Error worksheet (see Attachment 2).
4.
: 5. Common-cause probability values automatically calculated by GEMS.
Operator recovery values were determined the SPAR Model Human Error worksheet (see Attachment 2).
: 6. Basic event changed to reflect event being analyzed (part 2).
5.
: 7. Basic event changed to reflect event being analyzed (part 1).
Common-cause probability values automatically calculated by GEMS.
: 8. Model update to incorporate the Rhodes model. Modifications to top events were made in accordance with guidance provided in Refs. 11 and 12. High temperature seals are assumed to be installed on all RCPs. Therefore, RCS-MDP-LK-SEALS was set to 0.20. Based on the Rhodes model, the time available to prevent core damage by restoring ac power and starting high-pressure injection if RCP seals fail is 4 hours (time until core uncovery and battery depletion). To account for increased time to recover electric power, top event OP-SL was updated (basic event OEP-XHE-NOREC-SL).
6.
: 9. NUREG 4550, Vol. 1, Rev 1. Table 8.2.5
Basic event changed to reflect event being analyzed (part 2).
7.
Basic event changed to reflect event being analyzed (part 1).
8.
Model update to incorporate the Rhodes model. Modifications to top events were made in accordance with guidance provided in Refs. 11 and 12. High temperature seals are assumed to be installed on all RCPs. Therefore, RCS-MDP-LK-SEALS was set to 0.20. Based on the Rhodes model, the time available to prevent core damage by restoring ac power and starting high-pressure injection if RCP seals fail is 4 hours (time until core uncovery and battery depletion). To account for increased time to recover electric power, top event OP-SL was updated (basic event OEP-XHE-NOREC-SL).
9.
NUREG 4550, Vol. 1, Rev 1. Table 8.2.5
: 10. The Alpha factors changed from generic values for motor driven pumps to specified Alpha factors that commensurate for CCW pumps type.( http://nrcoe.inel.gov/index.cfm?fuseaction=CCF.showMenu U.S. Nuclear Regulatory Commission Reactor Operating Experience Results and Databases )
: 10. The Alpha factors changed from generic values for motor driven pumps to specified Alpha factors that commensurate for CCW pumps type.( http://nrcoe.inel.gov/index.cfm?fuseaction=CCF.showMenu U.S. Nuclear Regulatory Commission Reactor Operating Experience Results and Databases )
18


LERs 483/01-002 and 483/02-001 TRANSIENT REACTOR  AUXILIARY    MAIN    PORVs      HIGH       BLEED   SECONDARY    RCS  RESIDUAL  HIGH TRIP  FEEDWATER FEEDWATER   ARE    PRESSURE      PATH      COOLING  COOLDOWN  HEAT  PRESSURE CLOSED    INJECTION  ESTABLISHED RECOVERED          REMOVAL  RECIRC IE-TRANS   RPS      AFW        MFW    PORV        HPI      BLEED      SGCOOL  COOLDOWN  RHR      HPR        #    STATE   NOTES 1   OK 2   OK 3   OK 4   CD 5   OK 6   CD 7   CD 8   OK 9   OK 10   OK 11   CD 12   OK PORV1 13   CD 14   CD 15   OK 16   OK 17   CD 18   CD HPI1 19   CD 20 T ATWS TRANS - CALLAW AY TRANSIENT                                                                                                   2001/08/21 Figure 1. Callaway TRANS event tree.
LERs 483/01-002 and 483/02-001 19 HPR HIGH PRESSURE RECIRC RHR RESIDUAL HEAT REMOVAL COOLDOWN RCS COOLDOWN SGCOOL SECONDARY COOLING RECOVERED BLEED BLEED PATH ESTABLISHED HPI HIGH PRESSURE INJECTION PORV PORVs ARE CLOSED MFW MAIN FEEDWATER AFW AUXILIARY FEEDWATER RPS REACTOR TRIP IE-TRANS TRANSIENT STATE NOTES 1
19
OK 2
OK 3
OK 4
CD 5
OK 6
CD 7
CD 8
OK 9
OK 10 OK 11 CD 12 OK 13 CD 14 CD 15 OK 16 OK 17 CD 18 CD 19 CD 20 T ATWS PORV1 HPI1 TRANS - CALLAWAY TRANSIENT 2001/08/21 Figure 1. Callaway TRANS event tree.


LERs 483/01-002 and 483/02-001 AFW MOTOR DRIVEN PUMP TRAIN A IS UNAVAILABLE AFW-MDPA AFW MDP FAILS TO          AFW MDP UNAVAILABLE                      AFW M DP                            CCF OF AFW                            CCF OF AFW                        FAILURE OF                      4160 VAC BUS NB01 IS                  125 VDC POWER RUN                    DUE TO TEST AND                        F AILS TO                          MDPS TO START                          PUMPS TO RUN                    ROOM COOLI NG TO                        UNAVAILABLE                      PANEL DP-NK01 IS M AINTENANCE                            START                                                                                                      AFW MDP A                                                               UNAVAILABLE 1.1E-3                                                                   3.6E-5                              2.3E-5                                                            5                                  45 AFW-MDPA-1                 AFW -M DP-TM -1A                     AF W-M DPA-2                      AFW-MDP-CF-START                       AFW-MDP-CF-RUN                     AFW-MDPA-3                           ACP-NB01                            DCP-NK01 AF W MOTOR-DRIVEN                          OPERATOR FAILS TO PUM P 1A FAILS TO                          RECOVER AFW MDP START                                (FAILS TO START) 1.3E-3                                       2.1E-1 AF W-MDP-FS-1A                          AF W-XHE-XL-MDPFS AFW M DP FAILS TO                                                          AFW MDP FAILS TO                                    ESSENTIAL SERVICE                          AFW MDP A HVAC FAN                       OP FAILS TO RESTORE                            CCF OF AFW MDP RUN DUE TO DEBRIS                                                              RUN DUE TO                                    WATER SYSTEM LOOP A                              FAILS TO RUN                            AFW MDP A HVAC                                ROOM COOLING INGESTION                                                              MECHANI CAL FAILURE                                    IS UNAVAILABLE                                                                        F AN AF TER T&M                              FANS TO RUN 59                                              2.4E-4                                      1.0E-3                                      7. 7E-6 AF W-MDPA-4                                                                  AFW-MDPA-5                                             ESW-A                                AFW-FAN-FR-MDPA                          AFW-XHE-XR-FANM A                            AFW-FAN-CF-RM CFR DEBRIS INGESTED IN  AFW MOTOR-DRIVEN        OPERATOR FAILS TO             AFW MOTOR-DRIVEN                           OPERATOR FAILS TO AFW MDP1A          PUMP 1A FAILS TO       RECOVER AFW MDP 1A            PUMP FAILS TO RUN                         RECOVER AFW M DP RUN (DEBRIS)          (DEBRIS INGESTED)                                                          (FAILS TO RUN)
LERs 483/01-002 and 483/02-001 20 AFW-MDPA 45 DCP-NK01 59 ESW-A 5
AFW MDP A HVAC FAN                         AFW MDP A HVAC                               CCF OF AFW MDP FAI LS TO START                         F AN UNAVAILABLE                              ROOM COOLING DUE TO T&M                                  FANS TO ST ART 0.0E+0                TRUE                    5.0E-2                        7.6E-4                                      7.5E-1 AFW-MDP-DI-1A      AF W-MDP-FRD-1A      AFW-XHE-XL-MDPFRD-1A             AFW-MDP-FR-1A                           AFW-XHE-XL-MDPF R 3.0E-4                                  2.0E-3                                      1.8E-5 AFW -FAN-F S-MDPA                         AFW-FAN-TM-M DPA                            AFW-FAN-CF-RM CF S AFW-MDPA - CALLAW AY AUXILIARY FEEDWATER PUMP PAL01A                                                                                                                                                                                                                 2004/04/29                     Page 15 Figure 2. AFW motor-driven pump A fault tree.
ACP-NB01 1.1E-3 AFW -MDP-TM-1A AFW-MDPA-2 1.3E-3 AFW-MDP-FS-1A 2.1E-1 AFW-XHE-XL-MDPFS AFW-MDPA-5 7.5E-1 AFW-XHE-XL-MDPFR 7.6E-4 AFW-MDP-FR-1A 3.6E-5 AFW-MDP-CF-START 2.3E-5 AFW-MDP-CF-RUN AFW-MDPA-3 3.0E-4 AFW -FAN-FS-MDPA 2.4E-4 AFW-FAN-FR-MDPA 2.0E-3 AFW-FAN-TM-MDPA 1.0E-3 AFW-XHE-XR-FANMA 1.8E-5 AFW-FAN-CF-RMCFS 7.7E-6 AFW-FAN-CF-RMCFR AFW-MDPA-1 AFW-MDPA-4 5.0E-2 AFW-XHE-XL-MDPFRD-1A TRUE AFW-MDP-FRD-1A 0.0E+0 AFW-MDP-DI-1A AFW MOTOR DRIVEN PUMP TRAIN A IS UNAVAILABLE 4160 VAC BUS NB01 IS UNAVAILABLE ESSENTIAL SERVICE WATER SYSTEM LOOP A IS UNAVAILABLE 125 VDC POWER PANEL DP-NK01 IS UNAVAILABLE AFW MDP UNAVAILABLE DUE TO TEST AND MAINTENANCE AFW MDP FAILS TO START AFW MOTOR-DRIVEN PUMP 1A FAILS TO START OPERATOR FAILS TO RECOVER AFW MDP (FAILS TO START)
20
AFW MDP FAILS TO RUN DUE TO MECHANICAL FAILURE AFW MOTOR-DRIVEN PUMP FAILS TO RUN OPERATOR FAILS TO RECOVER AFW MDP (FAILS TO RUN)
CCF OF AFW MDPS TO START CCF OF AFW PUMPS TO RUN FAILURE OF ROOM COOLING TO AFW MDP A AFW MDP A HVAC FAN FAILS TO START AFW MDP A HVAC FAN FAILS TO RUN AFW MDP A HVAC FAN UNAVAILABLE DUE TO T&M OP FAILS TO RESTORE AFW MDP A HVAC FAN AFTER T&M CCF OF AFW MDP ROOM COOLING FANS TO START CCF OF AFW MDP ROOM COOLING FANS TO RUN AFW MDP FAILS TO RUN AFW MDP FAILS TO RUN DUE TO DEBRIS INGESTION AFW MOTOR-DRIVEN PUMP 1A FAILS TO RUN (DEBRIS)
OPERATOR FAILS TO RECOVER AFW MDP 1A (DEBRIS INGESTED)
DEBRIS INGESTED IN AFW MDP1A AFW-MDPA - CALLAWAY AUXILIARY FEEDWATER PUMP PAL01A 2004/04/29 Page 15 Figure 2. AFW motor-driven pump A fault tree.


LERs 483/01-002 and 483/02-001 AFW MOTOR DRIVEN PUMP TRAIN B IS UNAVAILABLE AFW-MDPB AFW M DP                    AFW MDP UNAVAILABLE                      AFW MDP                                                                                                  FAILURE OF                                                          125 VDC POWER CCF OF AF W                            AFW M DP                                                        4160 VAC BUS NB02 I S FAILS TO                      DUE TO TEST AND                        FAILS TO                                                                                              ROOM COOLING TO                                                        PANEL DP-NK04 IS RUN                                                                                                MDPS TO START                        FAILS TO RUN                                                            UNAVAILABLE MAINTENANCE                            START                                                                                                  AFW MDP B                                                           UNAVAILABLE 1.1E-3                                                               3. 6E-5                            2.3E-5                                                          6                                48 AFW-MDPB-1                       AFW-M DP-TM -1B                      AFW -M DPB-2                  AF W-MDP-CF-START                     AF W-MDP-CF -RUN                     AFW-MDPB-3                           ACP-NB02                          DCP-NK04 AFW MOTOR-DRIVEN                          OPERATOR FAILS TO PUMP 1B FAILS TO                        RECOVER AF W MDP START                              (FAILS TO START) 1.3E-3                                  2.1E-1 AFW-MDP-FS-1B                          AFW-XHE-XL-MDPFS AF W MDP FAILS TO                                                                    AF W MDP FAILS TO                        ESSENTIAL SERVICE                          AFW MDP B HVAC FAN                      OP FAILS TO RESTORE                          CCF OF AFW MDP RUN DUE TO                                                                            RUN DUE TO                          WATER SYSTEM LOOP B                            F AILS TO RUN                            AFW MDP B HVAC                            ROOM COOLING DEBRIS INGESTION                                                                    M ECHANICAL FAILURE                          IS UNAVAILABLE                                                                        FAN AFTER T&M                              F ANS TO RUN 60                                              2.4E-4                                    1.0E-3                                    7.7E-6 AFW-MDPB-4                                                                            AFW -M DPB-5                                 ESW-B                                AFW-FAN-FR-MDPB                          AFW -XHE-XR-FANMB                        AFW-FAN-CF -RMCFR DEBRIS INGESTED IN  AFW MOTOR-DRIVEN              OPERATOR FAI LS TO               AFW MOTOR-DRIVEN                         OPERATOR FAILS TO AFW MDP1B        PUM P 1B FAILS TO           RECOVER AFW MDP B                  PUM P FAILS TO RUN                       RECOVER AF W MDP RUN (DEBRIS)                (DEBRIS INGESTED)                                                            (F AILS TO RUN)
LERs 483/01-002 and 483/02-001 21 AFW-MDPB 48 DCP-NK04 60 ESW-B 6
AF W MDP B HVAC FAN                         AFW M DP B HVAC                           CCF OF AF W M DP FAILS TO START                            FAN UNAVAILABLE                           ROOM COOLI NG DUE TO T&M                               FANS TO START 0.0E+0                TRUE                          5.0E-2                            7.6E-4                                  7.5E-1 AFW-MDP-DI-1B      AFW-MDP-F RD-1B            AF W-XHE-XL-MDPFRD-1B                  AFW-MDP-FR-1B                         AFW-XHE-XL-MDPFR 3.0E-4                                    2.0E-3                                    1.8E-5 AFW -F AN-F S-MDPB                        AFW-FAN-TM-MDPB                          AFW-FAN-CF-RM CFS AFW-MDPB - CALLAW AY AUXILIARY FEEDWATER PUMP PAL01B                                                                                                                                                                                                               2004/04/29                   Page 16 Figure 3. AFW motor-driven pump B fault tree.
ACP-NB02 1.1E-3 AFW-MDP-TM-1B AFW -MDPB-2 1.3E-3 AFW-MDP-FS-1B 2.1E-1 AFW-XHE-XL-MDPFS AFW -MDPB-5 7.5E-1 AFW-XHE-XL-MDPFR 7.6E-4 AFW-MDP-FR-1B 3.6E-5 AFW-MDP-CF-START 2.3E-5 AFW-MDP-CF-RUN AFW-MDPB-3 3.0E-4 AFW -FAN-FS-MDPB 2.4E-4 AFW-FAN-FR-MDPB 2.0E-3 AFW-FAN-TM-MDPB 1.0E-3 AFW -XHE-XR-FANMB 1.8E-5 AFW-FAN-CF-RMCFS 7.7E-6 AFW-FAN-CF-RMCFR AFW-MDPB-1 AFW-MDPB-4 5.0E-2 AFW-XHE-XL-MDPFRD-1B TRUE AFW-MDP-FRD-1B 0.0E+0 AFW-MDP-DI-1B AFW MOTOR DRIVEN PUMP TRAIN B IS UNAVAILABLE 4160 VAC BUS NB02 IS UNAVAILABLE ESSENTIAL SERVICE WATER SYSTEM LOOP B IS UNAVAILABLE 125 VDC POWER PANEL DP-NK04 IS UNAVAILABLE AFW MDP UNAVAILABLE DUE TO TEST AND MAINTENANCE AFW MDP FAILS TO START AFW MOTOR-DRIVEN PUMP 1B FAILS TO START OPERATOR FAILS TO RECOVER AFW MDP (FAILS TO START)
21
AFW MDP FAILS TO RUN DUE TO MECHANICAL FAILURE AFW MOTOR-DRIVEN PUMP FAILS TO RUN OPERATOR FAILS TO RECOVER AFW MDP (FAILS TO RUN)
CCF OF AFW MDPS TO START AFW MDP FAILS TO RUN FAILURE OF ROOM COOLING TO AFW MDP B AFW MDP B HVAC FAN FAILS TO START AFW MDP B HVAC FAN FAILS TO RUN AFW MDP B HVAC FAN UNAVAILABLE DUE TO T&M OP FAILS TO RESTORE AFW MDP B HVAC FAN AFTER T&M CCF OF AFW MDP ROOM COOLING FANS TO START CCF OF AFW MDP ROOM COOLING FANS TO RUN AFW MDP FAILS TO RUN AFW MDP FAILS TO RUN DUE TO DEBRIS INGESTION AFW MOTOR-DRIVEN PUMP 1B FAILS TO RUN (DEBRIS)
OPERATOR FAILS TO RECOVER AFW MDP B (DEBRIS INGESTED)
DEBRIS INGESTED IN AFW MDP1B AFW-MDPB - CALLAWAY AUXILIARY FEEDWATER PUMP PAL01B 2004/04/29 Page 16 Figure 3. AFW motor-driven pump B fault tree.


LERs 483/01-002 and 483/02-001 T URBI NE DRIVEN PUM P TRAIN IS UNAVAILABLE AFW-T DP STEAM SUPPLY                  F EED PUM P PAL02                                  PUMP                            125 VDC POWER                                                  AFW TDP F AILS TO IS UNAVAILABL E                    IS IN T EST OR                              FAILS TO ST ART                      PANEL DP-NK02 IS                                                      RUN M AINTENANCE                                                                        UNAVAILABLE 7.6E-3                                                                     46 AF W-TDP-1                   AFW -TDP-T M-PAL02                                AFW-T DP-2                            DCP-NK02                                                      AF W-TDP-3 STEAM                            OPERATO R FAILS TO                      TURBINE DRIVEN                        OPERATOR FAILS T O                          PUMP F AILS TO RUN                                              PUMP FAILS T O RUN SUPPLY VALVES                      RECOVER F AILURE OF                    FEED PUMP PAL02                          RECOVER PUMP                              DUE T O MECHANICAL                                                DUE TO DEBRIS FAIL TO OPEN                          STEAM SUPPLY                          F AI LS TO START                      FAILURE TO ST ART                                FAILURE                                                        INGESTION 1.4E-3                                7.5E-1                                  6.8E-3                                 TRUE AFW-AOV-CC-F TSST                      AF W-XHE-XL-F TSST                    AFW -T DP-F S-PAL0 2                    AF W-XHE-XL-TDPFS                              AFW -TDP-4                                                     AFW -TDP-5 T URBI NE DRIVEN                          OPERATO R FAILS TO  DEBRIS INGESTED IN      AFW TURBINE-DRIVEN      OPERAT OR FAI LS TO F EED PUMP PAL0 2                            RECOVER PUM P          AF W TDP           PUMP F AILS TO RUN    RECOVER THE AFW TDP FAILS T O RUN                            F AILURE TO RUN                                  (DEBRIS)          (DEBRIS INGESTED) 9.5E-3                                    TRUE                0.0E+0                   5.0E-2                5.0E-2 AF W-TDP-FR-PAL02                          AFW -XHE-XL-TDPFR      AF W-TDP-DI            AFW -TDP-F RD        AFW -XHE-XL-TDPFRD AFW-TDP - CALLAWAY AUXILIARY FEEDWATER PUMP PAL02                                                                                                                                                                                             2004/04/29       Page 18 Figure 4. AFW turbine-driven pump fault tree.
LERs 483/01-002 and 483/02-001 22 AFW-TDP-1 1.4E-3 AFW-AOV-CC-FTSST 7.5E-1 AFW-XHE-XL-FTSST AFW-TDP AFW-TDP-2 6.8E-3 AFW -TDP-FS-PAL0 2 TRUE AFW-XHE-XL-TDPFS 9.5E-3 AFW-TDP-FR-PAL02 TRUE AFW -XHE-XL-TDPFR AFW -TDP-4 46 DCP-NK02 7.6E-3 AFW -TDP-TM-PAL02 0.0E+0 AFW-TDP-DI 5.0E-2 AFW -TDP-FRD AFW -TDP-5 AFW-TDP-3 5.0E-2 AFW -XHE-XL-TDPFRD TURBINE DRIVEN FEED PUMP PAL02 FAILS TO START STEAM SUPPLY IS UNAVAILABL E STEAM SUPPLY VALVES FAIL TO OPEN OPERATOR FAILS TO RECOVER FAILURE OF STEAM SUPPLY TURBINE DRIVEN PUMP TRAIN IS UNAVAILABLE TURBINE DRIVEN FEED PUMP PAL0 2 FAILS TO RUN OPERATOR FAILS TO RECOVER PUMP FAILURE TO START OPERATOR FAILS TO RECOVER PUMP FAILURE TO RUN PUMP FAILS TO RUN DUE TO MECHANICAL FAILURE 125 VDC POWER PANEL DP-NK02 IS UNAVAILABLE PUMP FAILS TO START FEED PUMP PAL02 IS IN TEST OR MAINTENANCE DEBRIS INGESTED IN AFW TDP AFW TURBINE-DRIVEN PUMP FAILS TO RUN (DEBRIS)
22
PUMP FAILS TO RUN DUE TO DEBRIS INGESTION AFW TDP FAILS TO RUN OPERATOR FAILS TO RECOVER THE AFW TDP (DEBRIS INGESTED)
AFW-TDP - CALLAWAY AUXILIARY FEEDWATER PUMP PAL02 2004/04/29 Page 18 Figure 4. AFW turbine-driven pump fault tree.


LERs 483/01-002 and 483/02-001 - Timeline for Events in Condition Assessment The time period for the condition assessment is 1 year. The period selected for the analysis is from January 27, 2001, to January 26, 2002, the date that degradation of the foam seal ring and foreign material in the condensate storage tank (CST) were discovered. The following is a timeline for events that occurred during the time period, including (1) failure of the B emergency service water (ESW) pump, as described in LER 483/01-002 (Ref. 1) and (2) failure of A motor-driven auxiliary feedwater (AFW) pump due to foreign material from the CST, as described in LER 483/02-001 (Ref.
LERs 483/01-002 and 483/02-001 23 - Timeline for Events in Condition Assessment The time period for the condition assessment is 1 year. The period selected for the analysis is from January 27, 2001, to January 26, 2002, the date that degradation of the foam seal ring and foreign material in the condensate storage tank (CST) were discovered. The following is a timeline for events that occurred during the time period, including (1) failure of the B emergency service water (ESW) pump, as described in LER 483/01-002 (Ref. 1) and (2) failure of A motor-driven auxiliary feedwater (AFW) pump due to foreign material from the CST, as described in LER 483/02-001 (Ref.
6).
6).
February 9, 2001       At 2:15 p.m., a leak collection rig was installed on the B ESW prelube tank.
February 9, 2001 At 2:15 p.m., a leak collection rig was installed on the B ESW prelube tank.
Tygon hose subsequently detached from the leak collection rig and fell into the suction bay for the B ESW pump, effectively rendering the pump inoperable.
Tygon hose subsequently detached from the leak collection rig and fell into the suction bay for the B ESW pump, effectively rendering the pump inoperable.
February 14, 2001     At 8:51 a.m., the B ESW pump B was manually started, but failed to deliver rated flow and pressure. (The pumps flow and discharge pressure were 4 Mlbm/hr at 80 psi vs. its normal flow and discharge pressure of 7 Mlbm/hr at 140 psi.)
February 14, 2001 At 8:51 a.m., the B ESW pump B was manually started, but failed to deliver rated flow and pressure. (The pumps flow and discharge pressure were 4 Mlbm/hr at 80 psi vs. its normal flow and discharge pressure of 7 Mlbm/hr at 140 psi.)
February 15, 2001     A foreign object (hose) was removed from the B ESW pump and the pump was declared operable at 2:31 a.m.
February 15, 2001 A foreign object (hose) was removed from the B ESW pump and the pump was declared operable at 2:31 a.m.
March 9, 2001         Reactor scram occurs due to loss of both rod drive motor generators. Plant shut down (reactor not critical) for a total of 47 hours.
March 9, 2001 Reactor scram occurs due to loss of both rod drive motor generators. Plant shut down (reactor not critical) for a total of 47 hours.
April 7, 2001         Reactor shut down for refueling outage from April 7, 2001, to May 21, 2001.
April 7, 2001 Reactor shut down for refueling outage from April 7, 2001, to May 21, 2001.
Plant shut down (reactor not critical) for a total of 1,045 hours.
Plant shut down (reactor not critical) for a total of 1,045 hours.
October 22, 2001       Quarterly test of the A AFW pump.
October 22, 2001 Quarterly test of the A AFW pump.
November 15, 2001     Improper maintenance on the C component cooling water (CCW) pump results in the pump being inoperable.
November 15, 2001 Improper maintenance on the C component cooling water (CCW) pump results in the pump being inoperable.
December 3, 2001       During a plant shutdown (to repair generator stator cooling leak), AFW pumps A and B were manually started. Both pumps start, but A pump fails to deliver any flow. Cause not initially known but later discovered to be foam from the CST's floating diaphragm. Plant shut down (reactor not critical) for 77 hours.
December 3, 2001 During a plant shutdown (to repair generator stator cooling leak), AFW pumps A and B were manually started. Both pumps start, but A pump fails to deliver any flow. Cause not initially known but later discovered to be foam from the CST's floating diaphragm. Plant shut down (reactor not critical) for 77 hours.
January 26, 2002       Inspection of the CST identifies foreign material (foam pieces from the tank's floating diaphragm in the tank sump).
January 26, 2002 Inspection of the CST identifies foreign material (foam pieces from the tank's floating diaphragm in the tank sump).
The following describes bases for the durations of the equipment unavailabilities and degraded conditions, based on the above timeline.
The following describes bases for the durations of the equipment unavailabilities and degraded conditions, based on the above timeline.
S     Condition duration for failed B ESW pump. The B ESW pump is assumed to be failed from the time the leak collection rig was installed on the B ESW prelube tank (at 2:15 p.m. on February 9, 2001) until the time when the pump was returned to service (at 2:31 a.m. on February 15, 2001). The pump was assumed inoperable for a period of 132 hours.
S Condition duration for failed B ESW pump. The B ESW pump is assumed to be failed from the time the leak collection rig was installed on the B ESW prelube tank (at 2:15 p.m. on February 9, 2001) until the time when the pump was returned to service (at 2:31 a.m. on February 15, 2001). The pump was assumed inoperable for a period of 132 hours.
23


LERs 483/01-002 and 483/02-001 S     Condition duration for failed A AFW pump. Prior to its failure to run on December 3, 2001, the A AFW pump was last tested on October 22, 2001. The time from the last successful test until its failure is about 42 days. Because there is uncertainty about when foreign material entered the A AFW pump, rendering it inoperable, it is conservatively assumed that the debris was in or near the line that it eventually clogged for the entire interval (from October 22, 2001, to December 3, 2001), a total of 42 days (1008 hours). (The A AFW pump was vented and declared operable on December 5, 2001. The 2-day time period after the A AFW pump failed until it was returned to service is not added to the condition duration because the reactor was being shut down when the pump failed and entered Mode 3 shortly after the pump failed.)
LERs 483/01-002 and 483/02-001 24 S
S     Condition duration for degraded condition of the CST. On January 26, 2002, inspection of the CST revealed damage to a 5-foot section of the diaphragms foam seal ring. Several pieces of foam, a piece of cloth, and four small rubber pads were found in the bottom of the tank. A 25-inch section of foam was hanging from the diaphragm. The material in the bottom of the tank and the degraded portion of the seal ring posed a foreign material risk to the AFW pumps. Prior to the inspection on January 26, 2002, a limited inspection of the tank was performed on October 17, 2000; however, the inspection did not identify degradation of the tanks diaphragm. Therefore, the exact time when portions of the diaphragms foam ring and fabric detached is not known. The degraded condition is assumed to have existed for at least 1 year (8,760 hours).
Condition duration for failed A AFW pump. Prior to its failure to run on December 3, 2001, the A AFW pump was last tested on October 22, 2001. The time from the last successful test until its failure is about 42 days. Because there is uncertainty about when foreign material entered the A AFW pump, rendering it inoperable, it is conservatively assumed that the debris was in or near the line that it eventually clogged for the entire interval (from October 22, 2001, to December 3, 2001), a total of 42 days (1008 hours). (The A AFW pump was vented and declared operable on December 5, 2001. The 2-day time period after the A AFW pump failed until it was returned to service is not added to the condition duration because the reactor was being shut down when the pump failed and entered Mode 3 shortly after the pump failed.)
S     Condition duration for failed C CCW pump. On November 27, 2001, the C CCW pump was started to support planned maintenance of Train B CCW. After about an hour of operation, the pumps drive bearing temperature exceeded the alarm setpoint. The pump was shut down and the A CCW pump (redundant Train A pump) was started. The licensee determined that the high bearing temperature and resultant bearing failure had been caused by a lack of lubricating oil. Preventive maintenance had been performed on the C CCW pump on November 15, 2001. Maintenance personnel had not added the proper amount of oil. The pump was repaired and passed a post-maintenance test on December 5, 2001. The C CCW pump is assumed to be failed from the time of maintenance on November 15, 2001, until it passed testing on December 5, 2001, (a total of 21 days or 504 hours).
S Condition duration for degraded condition of the CST. On January 26, 2002, inspection of the CST revealed damage to a 5-foot section of the diaphragms foam seal ring. Several pieces of foam, a piece of cloth, and four small rubber pads were found in the bottom of the tank. A 25-inch section of foam was hanging from the diaphragm. The material in the bottom of the tank and the degraded portion of the seal ring posed a foreign material risk to the AFW pumps. Prior to the inspection on January 26, 2002, a limited inspection of the tank was performed on October 17, 2000; however, the inspection did not identify degradation of the tanks diaphragm. Therefore, the exact time when portions of the diaphragms foam ring and fabric detached is not known. The degraded condition is assumed to have existed for at least 1 year (8,760 hours).
S Condition duration for failed C CCW pump. On November 27, 2001, the C CCW pump was started to support planned maintenance of Train B CCW. After about an hour of operation, the pumps drive bearing temperature exceeded the alarm setpoint. The pump was shut down and the A CCW pump (redundant Train A pump) was started. The licensee determined that the high bearing temperature and resultant bearing failure had been caused by a lack of lubricating oil. Preventive maintenance had been performed on the C CCW pump on November 15, 2001. Maintenance personnel had not added the proper amount of oil. The pump was repaired and passed a post-maintenance test on December 5, 2001. The C CCW pump is assumed to be failed from the time of maintenance on November 15, 2001, until it passed testing on December 5, 2001, (a total of 21 days or 504 hours).
To appropriately model the various component unavailabilities and the degraded seal and foreign material in the CST, the condition assessment was performed in four parts. The following describes the time period for each of the three parts that make up the 1-year condition assessment.
To appropriately model the various component unavailabilities and the degraded seal and foreign material in the CST, the condition assessment was performed in four parts. The following describes the time period for each of the three parts that make up the 1-year condition assessment.
S     Time period for part 1 of the condition assessment. Part 1 of the condition assessment is 132 hours. This corresponds to the time period from February 9, 2001, to February 15, 2001, when the B ESW pump was unavailable. During this 132-hour time period, (1) the B ESW pump and equipment dependent upon the train B ESW could have failed to perform their safety function and (2) all three of the AFW pumps were operable but at an increased risk of failure due to foreign material in the CST.
S Time period for part 1 of the condition assessment. Part 1 of the condition assessment is 132 hours. This corresponds to the time period from February 9, 2001, to February 15, 2001, when the B ESW pump was unavailable. During this 132-hour time period, (1) the B ESW pump and equipment dependent upon the train B ESW could have failed to perform their safety function and (2) all three of the AFW pumps were operable but at an increased risk of failure due to foreign material in the CST.
S     Time period for part 2 of the condition assessment. Part 2 of the condition assessment is 504 hours. Chronologically, the time period for part 2 is assumed to be from November 11, 2001, to December 3, 2001. During this 504-hour time period, (1) the A AFW pump was unavailable, (2) the B AFW pump and the turbine-driven AFW pump were operable but at an increased risk of failure due to foreign material in the CST, and (3) the C CCW pump was unavailable. (Because the time period when the C CCW pump was unavailable corresponds closely to the time period when the A AFW pump was unavailable, the unavailability of the C CCW pump is included in part 2.)
S Time period for part 2 of the condition assessment. Part 2 of the condition assessment is 504 hours. Chronologically, the time period for part 2 is assumed to be from November 11, 2001, to December 3, 2001. During this 504-hour time period, (1) the A AFW pump was unavailable, (2) the B AFW pump and the turbine-driven AFW pump were operable but at an increased risk of failure due to foreign material in the CST, and (3) the C CCW pump was unavailable. (Because the time period when the C CCW pump was unavailable corresponds closely to the time period when the A AFW pump was unavailable, the unavailability of the C CCW pump is included in part 2.)
24


LERs 483/01-002 and 483/02-001 S Time period for part 3 of the condition assessment. Part 3 of the condition assessment is 504 hours. This corresponds to the remaining time that the A AFW pump was unavailable when the C CCW pump was operable (from October 22 until November 11, 2001).
LERs 483/01-002 and 483/02-001 25 S
Time period for part 3 of the condition assessment. Part 3 of the condition assessment is 504 hours. This corresponds to the remaining time that the A AFW pump was unavailable when the C CCW pump was operable (from October 22 until November 11, 2001).
Additionally, the B AFW pump and the turbine-driven AFW pump were operable but at an increased risk of failure due to foreign material in the CST.
Additionally, the B AFW pump and the turbine-driven AFW pump were operable but at an increased risk of failure due to foreign material in the CST.
S Time period for part 4 of the condition assessment. Part 4 of the condition assessment is 7620 hours. This time period includes the periods during the 1-year condition assessment not covered by parts 1, 2,or 3. During this 7620-hour time period, all three AFW pumps were operable but at an increased risk of failure due to foreign material in the CST.
S Time period for part 4 of the condition assessment. Part 4 of the condition assessment is 7620 hours. This time period includes the periods during the 1-year condition assessment not covered by parts 1, 2,or 3. During this 7620-hour time period, all three AFW pumps were operable but at an increased risk of failure due to foreign material in the CST.
25


LERs 483/01-002 and 483/02-001 - Operator Recovery Modeling SPAR Model Human Error Worksheet (Page 1 of 3)
LERs 483/01-002 and 483/02-001 26 - Operator Recovery Modeling SPAR Model Human Error Worksheet (Page 1 of 3)
Plant: Callaway                             Event Name: NA Task Error
Plant: Callaway Event Name: NA Task Error


== Description:==
== Description:==
Operator fails to recover AFW pump failure-to-run due to ingestion of debris Events: AFW-XHE-XL-MDPFRD-1A, AFW-XHE-XL-MDPFRD-1B, AFW-XHE-XL-TDPFRD Does this task contain a significant amount of diagnosis activity ? YES               NO X If Yes, Use Table 1 below to evaluate the PSFs for the Diagnosis portion of the task before going to Table 2. If No, go directly to Table 2.
Operator fails to recover AFW pump failure-to-run due to ingestion of debris Events: AFW-XHE-XL-MDPFRD-1A, AFW-XHE-XL-MDPFRD-1B, AFW-XHE-XL-TDPFRD Does this task contain a significant amount of diagnosis activity ? YES NO X If Yes, Use Table 1 below to evaluate the PSFs for the Diagnosis portion of the task before going to Table 2. If No, go directly to Table 2.
Table 1. Diagnosis worksheet.
Table 1. Diagnosis worksheet.
Multiplier If non-nominal PSF levels are selected, please for  note specific reasons in this column PSFs            PSF Levels                            Diagnosis
PSFs PSF Levels Multiplier for Diagnosis If non-nominal PSF levels are selected, please note specific reasons in this column
: 1. Available     Inadequate                               1.0a Time            Barely adequate < 20 m                     10 Nominal . 30 m                             1 Extra > 60 m                               0.1 Expansive > 24 h                         0.01
: 1. Available Time Inadequate 1.0a Barely adequate < 20 m 10 Nominal. 30 m 1
: 2. Stress       Extreme                                     5 High                                       2 Nominal                                     1
Extra > 60 m 0.1 Expansive > 24 h 0.01
: 3. Complexity Highly                                         5 Moderately                                 2 Nominal                                     1
: 2. Stress Extreme 5
: 4. Experience/ Low                                         10 Training        Nominal                                     1 High                                     0.5
High 2
: 5. Procedures   Not available                             50 Available, but poor                         5 Nominal                                     1 Diagnostic/symptom oriented               0.5
Nominal 1
: 6. Ergonomics Missing/Misleading                           50 Poor                                       10 Nominal                                     1 Good                                     0.5
: 3. Complexity Highly 5
: 7. Fitness for   Unfit                                     1.0a Duty            Degraded Fitness                           5 Nominal                                     1
Moderately 2
: 8. Work         Poor                                       2 Processes        Nominal                                     1 Good                                     0.8
Nominal 1
: 4. Experience/
Training Low 10 Nominal 1
High 0.5
: 5. Procedures Not available 50 Available, but poor 5
Nominal 1
Diagnostic/symptom oriented 0.5
: 6. Ergonomics Missing/Misleading 50 Poor 10 Nominal 1
Good 0.5
: 7. Fitness for Duty Unfit 1.0a Degraded Fitness 5
Nominal 1
: 8. Work Processes Poor 2
Nominal 1
Good 0.8
: a. Task failure probability is 1.0 regardless of other PSFs.
: a. Task failure probability is 1.0 regardless of other PSFs.
26


LERs 483/01-002 and 483/02-001 SPAR Model Human Error Worksheet (Page 2 of 3)
LERs 483/01-002 and 483/02-001 27 SPAR Model Human Error Worksheet (Page 2 of 3)
Table 2. Action worksheet.
Table 2. Action worksheet.
PSFs             PSF Levels                           Multiplier If non-nominal PSF levels are selected, please for    note specific reasons in this column Action
PSFs PSF Levels Multiplier for Action If non-nominal PSF levels are selected, please note specific reasons in this column
: 1. Available     Inadequate                               1.0a     Recovery of AFW is needed 30 minutes after Time              Time available . time required           10U     failure.
: 1. Available Time Inadequate 1.0a Recovery of AFW is needed 30 minutes after failure.
Nominal                                   1 Available > 5x time required             0.1 Available > 50x time required           0.01
Time available. time required 10U Nominal 1
: 2. Stress         Extreme                                   5U     AFW system is needed to prevent core High                                       2     damage.
Available > 5x time required 0.1 Available > 50x time required 0.01
Nominal                                   1
: 2. Stress Extreme 5U AFW system is needed to prevent core damage.
: 3. Complexity     Highly                                     5 Moderately                                 2 Nominal                                   1U
High 2
: 4. Experience/ Low                                           3 Training          Nominal                                   1U High                                     0.5
Nominal 1
: 5. Procedures     Not available                             50 Available, but poor                       5 Nominal                                   1U
: 3. Complexity Highly 5
: 6. Ergonomics Missing/Misleading                           50 Poor                                     10 Nominal                                   1U Good                                     0.5
Moderately 2
: 7. Fitness for   Unfit                                   1.0a Duty              Degraded Fitness                           5 Nominal                                 1U
Nominal 1U
: 8. Work           Poor                                       2 Processes        Nominal                                 1U Good                                     0.8
: 4. Experience/
Training Low 3
Nominal 1U High 0.5
: 5. Procedures Not available 50 Available, but poor 5
Nominal 1U
: 6. Ergonomics Missing/Misleading 50 Poor 10 Nominal 1U Good 0.5
: 7. Fitness for Duty Unfit 1.0a Degraded Fitness 5
Nominal 1U
: 8. Work Processes Poor 2
Nominal 1U Good 0.8
: a. Task failure probability is 1.0 regardless of other PSFs.
: a. Task failure probability is 1.0 regardless of other PSFs.
Table 3. Task failure probability without formal dependence worksheet.
Table 3. Task failure probability without formal dependence worksheet.
Task       Nom.     Time       Stress     Compl. Exper./   Proced. Ergon. Fitness     Work     Prob.
Task Portion Nom.
Portion    Prob.                                      Train.                                    Process Diag.     1.0E-2                                                                                         na Action     1.0E-3   10         5         1         1         1         1         1           1       5.0E-2 Total                                                                                                     5.0E-2 27
Prob.
Time Stress Compl.
Exper./
Train.
Proced.
Ergon.
Fitness Work Process Prob.
Diag.
1.0E-2 na Action 1.0E-3 10 5
1 1
1 1
1 1
5.0E-2 Total 5.0E-2


LERs 483/01-002 and 483/02-001 SPAR Model Human Error Worksheet (Page 3 of 3)
LERs 483/01-002 and 483/02-001 28 SPAR Model Human Error Worksheet (Page 3 of 3)
For all tasks, except the first task in the sequence, use the table and formulae below to calculate the Task Failure Probability With Formal Dependence.
For all tasks, except the first task in the sequence, use the table and formulae below to calculate the Task Failure Probability With Formal Dependence.
Table 4. Dependency condition worksheet.
Table 4. Dependency condition worksheet.
Condition Crew (same       Location     Time (close       Cues      Dependency      Number of Human Action Number          or        (same or    in time or not (additional or                        Failures Rule different)  different)    close in time)     not additional) 1           s           s               c             -        complete     If this error is the 3rd error in 2            s            s              nc            na          high          the sequence, then the dependency is at least 3           s           s             nc             a       moderate moderate.
Condition Number Crew (same or different)
4            s           d               c             -          high 5           s           d             nc             na       moderate     If this error is the 4th error in 6           s           d             nc             a         low           the sequence, then the 7           d             s               c             -        moderate       dependency is at least high.
Location (same or different)
8          d             s             nc             na         low     This rule may be ignored only if 9           d             s             nc             a         low     there is compelling evidence for 10           d             d               c             -        moderate       less dependence with the 11           d             d             nc             na         low                 previous tasks.
Time (close in time or not close in time)
12           d             d             nc             a         low 13                                                                   zero Using P = Task Failure Probability Without Formal Dependence (calculated on page 2):
Cues (additional or not additional)
For Complete Dependence the probability of failure             = 1.0 For High Dependence the probability of failure                 = (1 + P)/2 For Moderate Dependence the probability of failure             = (1 +6P)/7 For Low Dependence the probability of failure                   = (1 + 19P)/20 UFor Zero Dependence the probability of failure                 = P Task Failure Probability With Formal Dependence = (1 + (                 *       )) /         =
Dependency Number of Human Action Failures Rule 1
s s
c complete If this error is the 3rd error in the sequence, then the dependency is at least moderate.
If this error is the 4th error in the sequence, then the dependency is at least high.
This rule may be ignored only if there is compelling evidence for less dependence with the previous tasks.
2 s
s nc na high 3
s s
nc a
moderate 4
s d
c high 5
s d
nc na moderate 6
s d
nc a
low 7
d s
c moderate 8
d s
nc na low 9
d s
nc a
low 10 d
d c
moderate 11 d
d nc na low 12 d
d nc a
low 13 zero Using P = Task Failure Probability Without Formal Dependence (calculated on page 2):
For Complete Dependence the probability of failure  
= 1.0 For High Dependence the probability of failure  
= (1 + P)/2 For Moderate Dependence the probability of failure  
= (1 +6P)/7 For Low Dependence the probability of failure  
= (1 + 19P)/20 UFor Zero Dependence the probability of failure  
= P Task Failure Probability With Formal Dependence = (1 + ( * )) / =
Additional Notes:
Additional Notes:
28


LERs 483/01-002 and 483/02-001 SPAR Model Human Error Worksheet (Page 1 of 3)
LERs 483/01-002 and 483/02-001 29 SPAR Model Human Error Worksheet (Page 1 of 3)
Plant: Callaway                             Event Name: NA Task Error
Plant: Callaway Event Name: NA Task Error


== Description:==
== Description:==
Operator fails to recover AFW TDP pump failure-to-run due to ingestion of debris (highly dependent value)           Event: AFW-XHE-XL-TDPFRD1 Does this task contain a significant amount of diagnosis activity ? YES               NO     X If Yes, Use Table 1 below to evaluate the PSFs for the Diagnosis portion of the task before going to Table 2. If No, go directly to Table 2.
Operator fails to recover AFW TDP pump failure-to-run due to ingestion of debris (highly dependent value) Event: AFW-XHE-XL-TDPFRD1 Does this task contain a significant amount of diagnosis activity ? YES NO X If Yes, Use Table 1 below to evaluate the PSFs for the Diagnosis portion of the task before going to Table 2. If No, go directly to Table 2.
Table 1. Diagnosis worksheet.
Table 1. Diagnosis worksheet.
Multiplier If non-nominal PSF levels are selected, please for  note specific reasons in this column PSFs            PSF Levels                            Diagnosis
PSFs PSF Levels Multiplier for Diagnosis If non-nominal PSF levels are selected, please note specific reasons in this column
: 1. Available     Inadequate                               1.0a Time            Barely adequate < 20 m                     10 Nominal . 30 m                             1 Extra > 60 m                               0.1 Expansive > 24 h                         0.01
: 1. Available Time Inadequate 1.0a Barely adequate < 20 m 10 Nominal. 30 m 1
: 2. Stress       Extreme                                     5 High                                       2 Nominal                                     1
Extra > 60 m 0.1 Expansive > 24 h 0.01
: 3. Complexity Highly                                         5 Moderately                                 2 Nominal                                     1
: 2. Stress Extreme 5
: 4. Experience/ Low                                         10 Training        Nominal                                     1 High                                     0.5
High 2
: 5. Procedures   Not available                             50 Available, but poor                         5 Nominal                                     1 Diagnostic/symptom oriented               0.5
Nominal 1
: 6. Ergonomics Missing/Misleading                           50 Poor                                       10 Nominal                                     1 Good                                     0.5
: 3. Complexity Highly 5
: 7. Fitness for   Unfit                                     1.0a Duty            Degraded Fitness                           5 Nominal                                     1
Moderately 2
: 8. Work         Poor                                       2 Processes        Nominal                                     1 Good                                     0.8
Nominal 1
: 4. Experience/
Training Low 10 Nominal 1
High 0.5
: 5. Procedures Not available 50 Available, but poor 5
Nominal 1
Diagnostic/symptom oriented 0.5
: 6. Ergonomics Missing/Misleading 50 Poor 10 Nominal 1
Good 0.5
: 7. Fitness for Duty Unfit 1.0a Degraded Fitness 5
Nominal 1
: 8. Work Processes Poor 2
Nominal 1
Good 0.8
: a. Task failure probability is 1.0 regardless of other PSFs.
: a. Task failure probability is 1.0 regardless of other PSFs.
29


LERs 483/01-002 and 483/02-001 SPAR Model Human Error Worksheet (Page 2 of 3)
LERs 483/01-002 and 483/02-001 30 SPAR Model Human Error Worksheet (Page 2 of 3)
Table 2. Action worksheet.
Table 2. Action worksheet.
PSFs             PSF Levels                           Multiplier If non-nominal PSF levels are selected, please for    note specific reasons in this column Action
PSFs PSF Levels Multiplier for Action If non-nominal PSF levels are selected, please note specific reasons in this column
: 1. Available     Inadequate                               1.0a     Recovery of AFW is needed 30 minutes after Time              Time available . time required           10U     failure.
: 1. Available Time Inadequate 1.0a Recovery of AFW is needed 30 minutes after failure.
Nominal                                   1 Available > 5x time required             0.1 Available > 50x time required           0.01
Time available. time required 10U Nominal 1
: 2. Stress         Extreme                                   5U     AFW system is needed to prevent core High                                       2     damage.
Available > 5x time required 0.1 Available > 50x time required 0.01
Nominal                                   1
: 2. Stress Extreme 5U AFW system is needed to prevent core damage.
: 3. Complexity     Highly                                     5 Moderately                                 2 Nominal                                   1U
High 2
: 4. Experience/ Low                                           3 Training          Nominal                                   1U High                                     0.5
Nominal 1
: 5. Procedures     Not available                             50 Available, but poor                       5 Nominal                                   1U
: 3. Complexity Highly 5
: 6. Ergonomics Missing/Misleading                           50 Poor                                     10 Nominal                                   1U Good                                     0.5
Moderately 2
: 7. Fitness for   Unfit                                   1.0a Duty              Degraded Fitness                           5 Nominal                                 1U
Nominal 1U
: 8. Work           Poor                                       2 Processes        Nominal                                 1U Good                                     0.8
: 4. Experience/
Training Low 3
Nominal 1U High 0.5
: 5. Procedures Not available 50 Available, but poor 5
Nominal 1U
: 6. Ergonomics Missing/Misleading 50 Poor 10 Nominal 1U Good 0.5
: 7. Fitness for Duty Unfit 1.0a Degraded Fitness 5
Nominal 1U
: 8. Work Processes Poor 2
Nominal 1U Good 0.8
: a. Task failure probability is 1.0 regardless of other PSFs.
: a. Task failure probability is 1.0 regardless of other PSFs.
Table 3. Task failure probability without formal dependence worksheet.
Table 3. Task failure probability without formal dependence worksheet.
Task       Nom.     Time       Stress     Compl. Exper./   Proced. Ergon. Fitness     Work     Prob.
Task Portion Nom.
Portion    Prob.                                      Train.                                    Process Diag.     1.0E-2                                                                                         na Action     1.0E-3   10         5         1         1         1         1         1           1       5.0E-2 Total                                                                                                     5.0E-2 30
Prob.
Time Stress Compl.
Exper./
Train.
Proced.
Ergon.
Fitness Work Process Prob.
Diag.
1.0E-2 na Action 1.0E-3 10 5
1 1
1 1
1 1
5.0E-2 Total 5.0E-2


LERs 483/01-002 and 483/02-001 SPAR Model Human Error Worksheet (Page 3 of 3)
LERs 483/01-002 and 483/02-001 31 SPAR Model Human Error Worksheet (Page 3 of 3)
For all tasks, except the first task in the sequence, use the table and formulae below to calculate the Task Failure Probability With Formal Dependence.
For all tasks, except the first task in the sequence, use the table and formulae below to calculate the Task Failure Probability With Formal Dependence.
Table 4. Dependency condition worksheet.
Table 4. Dependency condition worksheet.
Condition Crew (same       Location     Time (close       Cues      Dependency      Number of Human Action Number          or        (same or    in time or not (additional or                        Failures Rule different)  different)    close in time)     not additional) 1           s           s               c             -        complete     If this error is the 3rd error in 2            s            s              nc            na          high          the sequence, then the dependency is at least 3           s           s             nc             a       moderate moderate.
Condition Number Crew (same or different)
U4             s           d               c             -          high 5           s           d             nc             na       moderate     If this error is the 4th error in 6           s           d             nc             a         low           the sequence, then the dependency is at least high.
Location (same or different)
7          d             s               c             -        moderate 8           d             s             nc             na         low     This rule may be ignored only if 9           d             s             nc             a         low     there is compelling evidence for 10           d             d               c             -        moderate       less dependence with the previous tasks.
Time (close in time or not close in time)
11           d             d             nc             na         low 12           d             d             nc             a         low 13                                                                   zero Using P = Task Failure Probability Without Formal Dependence (calculated on page 2):
Cues (additional or not additional)
For Complete Dependence the probability of failure             = 1.0 UFor High Dependence the probability of failure                 = (1 + P)/2 For Moderate Dependence the probability of failure             = (1 +6P)/7 For Low Dependence the probability of failure                   = (1 + 19P)/20 For Zero Dependence the probability of failure                 = P Task Failure Probability With Formal Dependence = (1 + 5E-02) / 2 = 5.3E-01 31
Dependency Number of Human Action Failures Rule 1
s s
c complete If this error is the 3rd error in the sequence, then the dependency is at least moderate.
If this error is the 4th error in the sequence, then the dependency is at least high.
This rule may be ignored only if there is compelling evidence for less dependence with the previous tasks.
2 s
s nc na high 3
s s
nc a
moderate U4 s
d c
high 5
s d
nc na moderate 6
s d
nc a
low 7
d s
c moderate 8
d s
nc na low 9
d s
nc a
low 10 d
d c
moderate 11 d
d nc na low 12 d
d nc a
low 13 zero Using P = Task Failure Probability Without Formal Dependence (calculated on page 2):
For Complete Dependence the probability of failure  
= 1.0 UFor High Dependence the probability of failure  
= (1 + P)/2 For Moderate Dependence the probability of failure  
= (1 +6P)/7 For Low Dependence the probability of failure  
= (1 + 19P)/20 For Zero Dependence the probability of failure  
= P Task Failure Probability With Formal Dependence = (1 + 5E-02) / 2 = 5.3E-01  


LERs 483/01-002 and 483/02-001 SPAR Model Human Error Worksheet (Page 1 of 3)
LERs 483/01-002 and 483/02-001 32 SPAR Model Human Error Worksheet (Page 1 of 3)
Plant: Callaway                             Event Name: NA Task Error
Plant: Callaway Event Name: NA Task Error


== Description:==
== Description:==
Operator fails to recover AFW MDP pump failure-to-run due to ingestion of debris (completely dependent value)           Event: AFW-XHE-XL-MDPFRD-1A1 Does this task contain a significant amount of diagnosis activity ? YES               NO     X If Yes, Use Table 1 below to evaluate the PSFs for the Diagnosis portion of the task before going to Table 2. If No, go directly to Table 2.
Operator fails to recover AFW MDP pump failure-to-run due to ingestion of debris (completely dependent value) Event: AFW-XHE-XL-MDPFRD-1A1 Does this task contain a significant amount of diagnosis activity ? YES NO X If Yes, Use Table 1 below to evaluate the PSFs for the Diagnosis portion of the task before going to Table 2. If No, go directly to Table 2.
Table 1. Diagnosis worksheet.
Table 1. Diagnosis worksheet.
Multiplier If non-nominal PSF levels are selected, please for  note specific reasons in this column PSFs            PSF Levels                            Diagnosis
PSFs PSF Levels Multiplier for Diagnosis If non-nominal PSF levels are selected, please note specific reasons in this column
: 1. Available     Inadequate                               1.0a Time            Barely adequate < 20 m                     10 Nominal . 30 m                             1 Extra > 60 m                               0.1 Expansive > 24 h                         0.01
: 1. Available Time Inadequate 1.0a Barely adequate < 20 m 10 Nominal. 30 m 1
: 2. Stress       Extreme                                     5 High                                       2 Nominal                                     1
Extra > 60 m 0.1 Expansive > 24 h 0.01
: 3. Complexity Highly                                         5 Moderately                                 2 Nominal                                     1
: 2. Stress Extreme 5
: 4. Experience/ Low                                         10 Training        Nominal                                     1 High                                     0.5
High 2
: 5. Procedures   Not available                             50 Available, but poor                         5 Nominal                                     1 Diagnostic/symptom oriented               0.5
Nominal 1
: 6. Ergonomics Missing/Misleading                           50 Poor                                       10 Nominal                                     1 Good                                     0.5
: 3. Complexity Highly 5
: 7. Fitness for   Unfit                                     1.0a Duty            Degraded Fitness                           5 Nominal                                     1
Moderately 2
: 8. Work         Poor                                       2 Processes        Nominal                                     1 Good                                     0.8
Nominal 1
: 4. Experience/
Training Low 10 Nominal 1
High 0.5
: 5. Procedures Not available 50 Available, but poor 5
Nominal 1
Diagnostic/symptom oriented 0.5
: 6. Ergonomics Missing/Misleading 50 Poor 10 Nominal 1
Good 0.5
: 7. Fitness for Duty Unfit 1.0a Degraded Fitness 5
Nominal 1
: 8. Work Processes Poor 2
Nominal 1
Good 0.8
: a. Task failure probability is 1.0 regardless of other PSFs.
: a. Task failure probability is 1.0 regardless of other PSFs.
32


LERs 483/01-002 and 483/02-001 SPAR Model Human Error Worksheet (Page 2 of 3)
LERs 483/01-002 and 483/02-001 33 SPAR Model Human Error Worksheet (Page 2 of 3)
Table 2. Action worksheet.
Table 2. Action worksheet.
PSFs             PSF Levels                           Multiplier If non-nominal PSF levels are selected, please for    note specific reasons in this column Action
PSFs PSF Levels Multiplier for Action If non-nominal PSF levels are selected, please note specific reasons in this column
: 1. Available     Inadequate                               1.0a     Recovery of AFW is needed 30 minutes after Time              Time available . time required           10U     failure.
: 1. Available Time Inadequate 1.0a Recovery of AFW is needed 30 minutes after failure.
Nominal                                   1 Available > 5x time required             0.1 Available > 50x time required           0.01
Time available. time required 10U Nominal 1
: 2. Stress         Extreme                                   5U     AFW system is needed to prevent core High                                       2     damage.
Available > 5x time required 0.1 Available > 50x time required 0.01
Nominal                                   1
: 2. Stress Extreme 5U AFW system is needed to prevent core damage.
: 3. Complexity     Highly                                     5 Moderately                                 2 Nominal                                   1U
High 2
: 4. Experience/ Low                                           3 Training          Nominal                                   1U High                                     0.5
Nominal 1
: 5. Procedures     Not available                             50 Available, but poor                       5 Nominal                                   1U
: 3. Complexity Highly 5
: 6. Ergonomics Missing/Misleading                           50 Poor                                     10 Nominal                                   1U Good                                     0.5
Moderately 2
: 7. Fitness for   Unfit                                   1.0a Duty              Degraded Fitness                           5 Nominal                                 1U
Nominal 1U
: 8. Work           Poor                                       2 Processes        Nominal                                 1U Good                                     0.8
: 4. Experience/
Training Low 3
Nominal 1U High 0.5
: 5. Procedures Not available 50 Available, but poor 5
Nominal 1U
: 6. Ergonomics Missing/Misleading 50 Poor 10 Nominal 1U Good 0.5
: 7. Fitness for Duty Unfit 1.0a Degraded Fitness 5
Nominal 1U
: 8. Work Processes Poor 2
Nominal 1U Good 0.8
: a. Task failure probability is 1.0 regardless of other PSFs.
: a. Task failure probability is 1.0 regardless of other PSFs.
Table 3. Task failure probability without formal dependence worksheet.
Table 3. Task failure probability without formal dependence worksheet.
Task       Nom.     Time       Stress     Compl. Exper./   Proced. Ergon. Fitness     Work     Prob.
Task Portion Nom.
Portion    Prob.                                      Train.                                    Process Diag.     1.0E-2                                                                                         na Action     1.0E-3   10         5         1         1         1         1         1           1       5.0E-2 Total                                                                                                     5.0E-2 33
Prob.
Time Stress Compl.
Exper./
Train.
Proced.
Ergon.
Fitness Work Process Prob.
Diag.
1.0E-2 na Action 1.0E-3 10 5
1 1
1 1
1 1
5.0E-2 Total 5.0E-2


LERs 483/01-002 and 483/02-001 SPAR Model Human Error Worksheet (Page 3 of 3)
LERs 483/01-002 and 483/02-001 34 SPAR Model Human Error Worksheet (Page 3 of 3)
For all tasks, except the first task in the sequence, use the table and formulae below to calculate the Task Failure Probability With Formal Dependence.
For all tasks, except the first task in the sequence, use the table and formulae below to calculate the Task Failure Probability With Formal Dependence.
Table 4. Dependency condition worksheet.
Table 4. Dependency condition worksheet.
Condition Crew (same       Location     Time (close       Cues      Dependency      Number of Human Action Number          or        (same or    in time or not (additional or                        Failures Rule different)  different)    close in time)     not additional)
Condition Number Crew (same or different)
U1             s           s               c             -        complete     If this error is the 3rd error in 2            s            s              nc            na          high          the sequence, then the dependency is at least 3           s           s             nc             a       moderate moderate.
Location (same or different)
4            s           d               c             -          high 5           s           d             nc             na       moderate     If this error is the 4th error in 6           s           d             nc             a         low           the sequence, then the dependency is at least high.
Time (close in time or not close in time)
7          d             s               c             -        moderate 8           d             s             nc             na         low     This rule may be ignored only if 9           d             s             nc             a         low     there is compelling evidence for 10           d             d               c             -        moderate       less dependence with the previous tasks.
Cues (additional or not additional)
11           d             d             nc             na         low 12           d             d             nc             a         low 13                                                                   zero Using P = Task Failure Probability Without Formal Dependence (calculated on page 2):
Dependency Number of Human Action Failures Rule U1 s
UFor Complete Dependence the probability of failure             = 1.0 For High Dependence the probability of failure                 = (1 + P)/2 For Moderate Dependence the probability of failure             = (1 +6P)/7 For Low Dependence the probability of failure                   = (1 + 19P)/20 For Zero Dependence the probability of failure                 = P Task Failure Probability With Formal Dependence = 1.0 34}}
s c
complete If this error is the 3rd error in the sequence, then the dependency is at least moderate.
If this error is the 4th error in the sequence, then the dependency is at least high.
This rule may be ignored only if there is compelling evidence for less dependence with the previous tasks.
2 s
s nc na high 3
s s
nc a
moderate 4
s d
c high 5
s d
nc na moderate 6
s d
nc a
low 7
d s
c moderate 8
d s
nc na low 9
d s
nc a
low 10 d
d c
moderate 11 d
d nc na low 12 d
d nc a
low 13 zero Using P = Task Failure Probability Without Formal Dependence (calculated on page 2):
UFor Complete Dependence the probability of failure  
= 1.0 For High Dependence the probability of failure  
= (1 + P)/2 For Moderate Dependence the probability of failure  
= (1 +6P)/7 For Low Dependence the probability of failure  
= (1 + 19P)/20 For Zero Dependence the probability of failure  
= P Task Failure Probability With Formal Dependence = 1.0}}

Latest revision as of 00:51, 13 December 2024

Final ASP Analysis - Callaway (LER 483-02-001)
ML20112F370
Person / Time
Site: Callaway Ameren icon.png
Issue date: 02/03/2001
From: Christopher Hunter
NRC/RES/DRA/PRB
To:
Hunter C (301) 415-1394
References
LER 483/01-002, LER 483/02-001
Download: ML20112F370 (34)
v • d • e


Text

{{#Wiki_filter:1 Final Precursor Analysis Accident Sequence Precursor Program --- Office of Nuclear Regulatory Research Callaway Foreign Object Renders the B Essential Service Water Pump Inoperable and Failure of the A Auxiliary Feedwater Pumps Due to Foreign Material in the Condensate Storage Tank Event Date: 2/3/2001 LERs: 483/01-002 and 483/02-001 CDP = 1x10-5 August 19, 2004 Condition Summary During 2001, two conditions occurred involving foreign material that affected safety-related equipment. In February 2001, a foreign object rendered the B essential service water (ESW) pump inoperable for 132 hours. In December 2001, foreign material from the condensate storage tank (CST) caused failure of the A motor-driven auxiliary feedwater (AFW) pump. The condition, a degraded seal on the tanks floating diaphragm, had existed for some time. Additionally, a component cooling water (CCW) pump was inoperable for 21 days due to improper maintenance. Because the time period for AFW condition overlaps the ESW and CCW conditions, a single condition assessment for all three conditions was performed. (See Attachment 1 for a detailed timeline for these events.) Event 1-Foreign object renders the B essential service water pump inoperable (LER 483/01-002) On February 14, 2001, the B ESW pump was started to support performance of a surveillance procedure. Upon starting, the pump experienced low discharge pressure and flow. (The pumps flow and discharge pressure were 4 Mlbm/hr at 80 psi vs. its normal flow and discharge pressure of 7 Mlbm/hr at 140 psi.) The pump was secured and declared inoperable, rendering train B ESW inoperable. Had a loss of offsite power or other event requiring ESW system flow occurred while the B ESW pump was inoperable, safety systems supported by train B ESW, including the B emergency diesel generator, would not have been available to perform their safety function (Refs. 1, 2, and 3). Cause. Pump inspection revealed a 20-foot-long section of 1.25-inch diameter-reinforced tygon hose wrapped around the rotor assembly in the first stage impeller of the pump casing, blocking a portion of the pumps suction path (Refs. 1, 2, 3, and 4). Condition duration. At 2:15 p.m. on February 9, 2001, a leak collection rig was installed on the B ESW prelube tank. The rig consisted of a funnel with a 20-foot-long section of tygon hose attached to the funnel. The tygon hose detached from the funnel, fell into the pump bay, and was subsequently drawn into the pumps intake when the pump started. The hose was removed, and the pump was returned to service at 2:31 a.m. on February 15, 2001. The pump was inoperable for a period of 132 hours (from 2:15 p.m. on February 9, 2001, until 2:31 a.m. on February 15, 2001). Recovery opportunities. Due to the cause of failure (i.e., tygon hose wrapped around the pump rotor assembly), the B ESW pump could not have been recovered in a timely manner during an accident condition.

LERs 483/01-002 and 483/02-001 1 The Accident Sequence Precursor Program limits the conditional assessment of risk to a 1-year period. 2 An alternate source of water can be provided to the train B ESW system from either (1) the train A ESW pump, through a cross-connection, or (2) the train B normal service water (NSW) pump, if the pump has electric power and is operating (i.e., offsite power has not been lost). To align flow from the train A ESW pump to train B, two locked-closed manual valves must be opened. To align flow from the train B NSW pump to the train B ESW system, operators must override a safety injection signal to the two motor-operated valves isolating the systems and open the valves. Because equipment directly cooled by the train B ESW system or by the train B component cooling water (CCW) system (which is cooled by the train B ESW) could fail before either of these actions could be taken, credit for an alternate source of water was not included in this assessment. Event 2-Potential unavailability of the auxiliary feedwater pumps due to foreign material in the CST (LER 483/02-001) On December 3, 2001, both motor-driven AFW pumps were manually started to support a plant shutdown. Both pumps started successfully, but the A pump failed to deliver sufficient pressure or flow. Inspection of the pump revealed that the pump was gas bound due to foreign material from the CST entering the pump. (Refs. 5, 6, 7, and 8). Cause. The cause of the A AFW pump failure was entry of foreign material into the pumps suction. A piece of foam from the CSTs floating diaphragm had entered the AFW suction piping and become lodged in the eye of the A AFW pumps first-stage impeller, where it created a localized low pressure area, causing gases to come out of the solution. The gases created voids in the pumps casing, partially air-binding the remaining stages and rendering the pump incapable of developing sufficient discharge pressure and flow. On January 26, 2002, inspection of the CST revealed damage to a 5-foot section of the diaphragms foam seal ring. Several pieces of foam, a piece of cloth, and two small rubber pads were found in the tanks sump. Some caulking and two small rubber pads were found on the tanks floor. A 25-inch section of foam was hanging from the diaphragm. Failure of the seal ring on the tanks floating diaphragm was due to low-stress, high-cycle fatigue caused by years of constant nitrogen sparging of the tank (Refs. 6 and 8). Condition duration. A limited inspection of the CST was performed on October 17, 2000; however, the inspection did not identify degradation of the tanks diaphragm. Therefore, the exact time when portions of the diaphragms foam ring and fabric detached is not known. The time for the condition assessment is 1 year (8,760 hours).1 The period selected for the analysis is from January 27, 2001, to January 26, 2002, the date that degradation of the foam seal ring and foreign material in the CST were discovered. Prior to its failure to run on December 3, 2001, the A AFW pump was last tested on October 22, 2001. Because there is uncertainty about when foreign material entered the A AFW pump, this analysis conservatively assumes that the debris was in or near the line that it eventually clogged for the entire period (from October 22, 2001, to December 3, 2001), a total of 42 days (1008 hours). Recovery opportunities. On December 3, 2001, following failure to run the A AFW pump, operators quickly vented the pump. However, the licensee did not declare the pump operable until December 5, 2001, 2 days later.

LERs 483/01-002 and 483/02-001 2 Since this condition did not involve an actual initiating event, the parameter of interest is the measure of the incremental increase between the conditional probability for the period in which the condition existed and the nominal probability for the same period but with the condition nonexistent and plant equipment available. This incremental increase or importance is determined by subtracting the CDP from the CCDP. This measure is used to assess the risk significance of hardware unavailabilities, especially for those cases where the nominal CDP is high with respect to the incremental increase of the conditional probability caused by the hardware unavailability. 3 Other conditions, failures, and unavailable equipment. The licensee identified four instances when train A essential equipment was unavailable during the time period when the B ESW pump was inoperable (Ref. 1). They are as follows: For 2 minutes on February 12, 2001, the train A ESW flow to the train A containment coolers was isolated. For 4 hours and 42 minutes on February 12, 2001, the air conditioning unit for the train A class 1E electrical equipment room was inoperable. For 1 hour and 29 minutes on February 13, 2001, train A of the residual heat removal system was inoperable while hydrazine was being added. For 38 minutes on February 13, 2001, the room cooler for the train A safety injection pumps room was inoperable. A review of licensee event reports and inspection reports for 2001 identified other equipment unavailabilities. They are as follows: For less than 4 hours on March 19, 2001, and for about 4.5 hours on June 12, 2001, the turbine-driven AFW pump was inoperable due to a failed steam trap on the turbines steam supply line, while the drain bypass level valve was removed from service for maintenance (Ref. 9). For approximately 21 days (from November 15, 2001, until December 5, 2001), the C CCW pump was inoperable due to improper maintenance (failure to add the proper amount of lubricating oil), resulting in the pump suffering a bearing failure (Ref. 5). Screening runs were made using the Callaway Rev. 3 simplified plant analysis risk (SPAR) model (Ref. 10) to evaluate the risk significance of these equipment unavailabilities. Except for failure of the C CCW pump, none of the equipment unavailabilities significantly contributed to risk. Therefore, only the failure of the C CCW pump was included in the analysis. Analysis Results Importance2 The CST seal was assumed to be in a degraded state for the entire 1-year period, increasing the risk of failure for all three of the AFW pumps. The B ESW pump was unavailable for 132 hours of the year duration the C CCW was unavailable for 504 hours, and the A AFW pump was unavailable for 1008 hours. To assess the overall risk significance of these three failures, the analysis was performed in four parts.

LERs 483/01-002 and 483/02-001 4 Part 1 (132 hours) reflects the time period when the B ESW pump was inoperable in addition to the increased failure probability of all three AFW pumps due to debris in the CST. Part 2 (504 hours) reflects the time period when the C CCW and A AFW pumps were both inoperable in addition to the increased failure probability of the B motor-driven AFW pump and the turbine-driven AFW pump due to debris in the CST. Part 3 (504 hours) reflects the remaining time period when the A AFW pump was inoperable in addition to the increased failure probability of the B motor-driven AFW pump and the turbine-driven AFW pump due to debris in the CST. Part 4 (7620 hours) reflects the remaining time during which there was an increased failure probability of all three AFW pumps due to debris in the CST during the 1-year period at which Callaway was at power operations. (See Attachment 1 for a detailed timeline for this analysis and a description of the time periods for the analysis.) The risk significance is determined by subtracting the nominal core damage probability from the conditional core damage probability: Part 1 Part 2 Part 3 Part 4 Total Conditional core damage probability (CCDP) - point estimate 4.4E-06 2.9E-06 2.6E-06 3.0E-05 4.0E-05 Nominal core damage probability (CDP) - point estimate 4.2E-07 1.6E-06 1.6E-06 2.4E-05 2.8E-05 Importance (CCDP) - point estimate - (CDP) - point estimate 4.0E-06 1.3E-06 1.0E-06 5.6E-06 Importance (CDP = CCDP - CDP) - point estimate 1.2E-05 This is an increase of 1.2E-05 over the nominal CDP for the 1-year period for this condition assessment. The Accident Sequence Precursor Program acceptance threshold is an importance (CDP) of 1.0E-06, which these integrated events meet. Alternate to Part 1 reflects the time period when only the B ESW pump was inoperable for 132 hours. Alternate to Part 2 reflects the time period when only the C CCW inoperable in addition to the increased for 504 hours. Alternate to Part 4 reflects the time period when there was an increased failure probability of all three AFW pumps due to debris in the CST during the 1-year (8760 hours) period at which Callaway was at power operations.

LERs 483/01-002 and 483/02-001 5 ESW B only CCW C only AFW only Conditional core damage probability (CCDP) - point estimate 4.2E-06 1.8E-06 3.4E-05 Nominal core damage probability (CDP) - point estimate 4.2E-07 1.6E-06 2.8E-05 Importance (CCDP) - point estimate - (CDP) - point estimate 4.0E-06 1.6E-07 6.5E-06 Dominant Sequences The dominant core damage sequence is from part 4 of the analysis. The dominant sequence is a transient (TRANS) sequence (Sequence 19), which contributes 15% to the total importance of all four parts. The events and important component failures in Sequence 19 (shown in Figure 1) include: TRANS occurs, reactor shutdown succeeds, AFW fails to provide sufficient flow, main feedwater fails to provide sufficient flow, and high-pressure injection (for feed and bleed) is unavailable. Results Tables The conditional probability of the dominant sequences is shown in Table 1. The event tree sequence logic for the dominant sequences is provided in Table 2a. Table 2b defines the nomenclature used in Table 2a. The conditional cut sets for the dominant sequences for parts 1, 2, 3, and 4 are provided in Tables 3a, 3b, 3c, and 3d respectively. Table 4 provides the definitions and probabilities for modified or dominant events. Modeling Assumptions Assessment summary This event was modeled as an at-power condition assessment for 1 year. Rev. 3 of the Callaway SPAR model (Ref. 10) was used for this assessment. During the 1-year period, the B ESW pump was inoperable for 132 hours, and the C CCW pump was inoperable for 504 hours. The A AFW pump was inoperable for 1008 hours and was at an increased risk of failure due to foreign material from the CST for the rest of the condition duration. The other AFW pumps were at an increased risk of failure to run due to foreign material from the CST. To appropriately model the various component unavailabilities and the degraded seal and foreign material in the CST, the condition assessment was performed in four parts. (See for a detailed timeline for this analysis, a description of equipment downtimes, and time periods for the analysis.) The discussion below provides the bases for the analysis. For this analysis, the only failure mode of the AFW pumps being considered is a condition where debris is blocking the pump suction. Actual ingestion of debris into the pump internals is assumed not to be a credible failure mode for this condition. Therefore, recovery of a pump

LERs 483/01-002 and 483/02-001 6 from debris blocking the suction is assumed to be entirely recoverable with the recovery action being the venting of an air-bound pump. Event and Fault Trees Modifications The AFW pumps were at an increased risk for failure due to foreign material from the CST. This specific failure was not modeled in the AFW pump fault trees in the base SPAR model; therefore, the AFW-A, AFW-B, and AFW-TDP fault trees were updated to include failures due to debris ingestion in addition to the standard mechanical failure probabilities. The updated fault trees are shown in Figures 2 through 4. To properly model the debris ingestion failure, three new basic events were created for each pump. The new events represented (1) the probability that the pump ingests debris, (2) the probability that the pump fails to run due to debris ingestion, and (3) the probability that the operator fails to recover the pumps failure-to-run due to debris ingestion. The description and base values for each of the new events are as follows: S Probability that debris is ingested into AFW MDP A (AFW-MDP-DI-1A). Under normal operating conditions there is no debris in the CST. Therefore, there is no opportunity for AFW MDP A to ingest debris. AFW-MDP-DI-1A was set to FALSE in the base case. S Probability that debris is ingested into AFW MDP B (AFW-MDP-DI-1B). Under normal operating conditions there is no debris in the CST. Therefore, there is no opportunity for AFW MDP B to ingest debris. AFW-MDP-DI-1B was set to FALSE in the base case. S Probability that AFW MDP A fails-to-run due to ingestion of debris (AFW-MDP-FRD-1A). During the event, AFW MDP A failed to provide sufficient pressure because the pump was gas bound due to foreign material from the CST entering the pump suction. Therefore, failure is assumed if debris blocks the suction of an AFW MDP. MDP-FRD-1A was set to TRUE in the base case. S Probability that AFW MDP B fails-to-run due to ingestion of debris (AFW-MDP-FRD-1B). During the event, AFW MDP A failed to provide sufficient pressure because the pump was gas bound due to foreign material from the CST entering the pump suction, and since the B AFW pump has the same design and system setup, it is assumed that, given debris ingestion into the pump suction, the B pump would have failed in a similar manner. MDP-FRD-1B was set to TRUE in the base case. S Probability that debris is ingested into AFW TDP (AFW-TDP-DI). Under normal operating conditions there is no debris in the CST. Therefore, there is no opportunity for AFW MDP B to ingest debris. AFW-TDP-DI was set to FALSE in the base case. S Probability that AFW TDP fails-to-run due to ingestion of debris (AFW-TDP-FRD). The internal configuration of the TDP is fundamentally different from the internal configuration of the MDPs, and upon analysis of the type and size of the debris, it was determined that the TDP was less susceptible to failure due to debris ingestion as compared to the MDPs. AFW-TDP-FRD was assumed to be 5.0E-02 for the base case. S Operator fails to recover AFW MDP A failure-to-run due to ingestion of debris (AFW-XHE-XL-MDPFRD-1A). For this analysis, the assumed AFW pump failure mode is debris blocking the pump suction, leading to air-binding in the pump. Therefore, the recovery considered in this event is the operator recovery of an air-bound pump. Using the SPAR

LERs 483/01-002 and 483/02-001 7 Human Error Model (see Attachment 2) to determine the operator nonrecovery probability, AFW-XHE-XL-MDPFRD-1A was set to 5.0E-2 for the base case. S Operator fails to recover AFW MDP A failure-to-run due to ingestion of debris (dependent value) (AFW-XHE-XL-MDPFRD-1A1). For this analysis, there is an assumed complete dependency between the operator recovery of AFW MDP B and AFW MDP A from debris ingestion failures. Therefore, a project rule was created to substitute the dependent version of AFW-XHE-XL-MDPFRD-1A when it appears in the same cut sets as AFW-XHE-XL-MDP-FRD-1B. Using the SPAR Human Error Model to determine the value of the completely dependent event, AFW-XHE-XL-MDPFRD-1A1 was set to 1.0 for the base case. S Operator fails to recover AFW MDP B failure-to-run due to ingestion of debris (AFW-XHE-XL-MDPFRD-1B). For this analysis, the assumed AFW pump failure mode is debris blocking the pump suction, leading to air-binding in the pump. Therefore, the recovery considered in this event is the operator recovery of an air-bound pump. Using the SPAR Human Error Model (see Attachment 2) to determine the operator nonrecovery probability, AFW-XHE-XL-MDPFRD-1B was set to 5.0E-2 for the base case. S Operator fails to recover AFW TDP failure-to-run due to ingestion of debris (AFW-XHE-XL-TDPFRD). For this analysis, the assumed AFW pump failure mode is debris blocking the pump suction, leading to air-binding in the pump. Therefore, the recovery considered in this event is the operator recovery of an air-bound pump. Using the SPAR Human Error Model (see Attachment 2) to determine the operator nonrecovery probability, AFW-XHE-XL-TDPFRD was set to 5.0E-2 for the base case. S Operator fails to recover AFW TDP failure-to-run due to ingestion of debris (dependent value) (AFW-XHE-XL-TDPFRD1). For this analysis, there is an assumed high dependency between the operator recovery of AFW MDP B and AFW TDP from debris ingestion failures. Therefore, a project rule was created to substitute the dependent version of AFW-XHE-XL-TDPFRD when it appears in the same cut sets as AFW-XHE-XL-MDP-FRD-1B. Using the SPAR Human Error Model (see Attachment 2) to determine the value of the highly dependent event, AFW-XHE-XL-TDPFRD1 was set to 5.3E-1 for the base case. Basic Event Probability changes Table 4 provides the basic events that were modified to reflect the event condition being analyzed. The bases for these changes are as follows: S Probability that debris is ingested into AFW MDP A (AFW-MDP-DI-1A). Based on the pump velocity, the size and number of debris particles, and the pumps operation scenarios, the probability of ingestion of debris into AFW MDP B was assumed to be 5.0E-1 for parts 1 and 3 of the condition assessment. During the event, foreign material from the CST was ingested into the suction of AFW MDP A. Therefore, for this analysis, AFW-MDP-DI-1A was set to TRUE for part 2 of the condition assessment. S Probability that debris is ingested into AFW MDP B (AFW-MDP-DI-1B). Based on the pump velocity, the size and number of debris particles, and the pumps operation scenarios, the probability of ingestion of debris into AFW MDP B was assumed to be 5.0E-1 for all three parts of the condition assessment.

LERs 483/01-002 and 483/02-001 8 S Probability that debris is ingested into AFW TDP (AFW-TDP-DI). Based on the pump velocity, the size and number of debris particles, and the pumps operation scenarios, the probability of ingestion of debris into AFW TDP A was assumed to be 5.0E-1 for all three parts of the condition assessment. S Operator fails to recover AFW MDP A failure-to-run due to ingestion of debris (AFW-XHE-XL-MDPFRD-1A). During the event, when A AFW MDP failed to provide sufficient pressure, the operators responded by quickly venting the pump. However, the licensee did not declare the pump operable until 2 days later. Therefore, for this analysis, AFW MDP A is assumed to be unrecovered. AFW-XHE-XL-MDPFRD-1A was set to TRUE for part 2 of the condition assessment. For parts 1 and 3 of the condition assessment, the failure probability for this event was set to its nominal value. S Probability of failure of the motor-driven CCW pump (CCW-MDP-FR-P1C). The C CCW pump was assumed to be inoperable for approximately 21 days (from November 15, 2001, until December 5, 2001). (See Attachment 1 for a detailed description of the timeline and period of inoperability.) This event was set to TRUE for part 2 (504 hours) of the condition assessment. For parts 1 and 3 of the condition assessment, the failure probability for this event was set to its nominal value. S Probability of failure to run of the B ESW pump (ESW-MDP-FS-1B). The B ESW pump was estimated to be inoperable for a period of 132 hours. (See Attachment 1 for a detailed description of the timeline and period of inoperability.) This event was set to TRUE for part 1 (132 hours) of the condition assessment. For parts 2 and 3 of the condition assessment, the failure probability for this event was set to its nominal value. Equipment supported by train B ESW includes the B emergency diesel generator; train B of the CCW system; and air conditioning units and room coolers for the control room, the Division B Class 1E switchgear room, the train B safety injection pump room, the train B residual heat removal pump room, the train B centrifugal charging pump room, the train B AFW pump room, and the room for CCW pumps B and D. The train B ESW also serves as the backup water source for the B AFW pump. Had a loss of offsite power (or other event resulting in a safety injection signal) occurred while the train B ESW pump was inoperable, this equipment would not have been available to perform its safety function. Except for the Division B Class 1E switchgear, the Rev. 3 SPAR model explicitly models dependency on ESW (for direct cooling or room cooling) for all of this equipment. However, because this failure occurred during cold weather months (February 2001), loss of room cooling is assumed to not result in failure of the division 1B ac power 4160 bus (ACP-BAC-LP-NB02). Sensitivity Analysis An additional sensitivity analysis was performed to model the reactor trip coinciding with the failure of the A AFW pump due to debris ingestion and the failure of the CCW MDP P1C. This was analyzed as a TRANS initiating event with the components failed. The CCDP of the initiating event analysis was 1.3E-05.

LERs 483/01-002 and 483/02-001 9 Model Update Changes to the Rev. 3 SPAR model for Callaway are as follows: S The model was updated to incorporate changes in the reactor coolant pump (RCP) seal loss-of-coolant accident model (Refs. 11 and 12). These changes account for the high temperature seals that were installed on all RCPs at the time of these events. S Failure data for the turbine-driven AFW pump were updated, including the fail-to-run lambda and mission time and the fail-to-start probability. S Failure data for the power-operated relief valves (PORVs) were updated. These updates are independent of the actual events being analyzed. Bases for the updates are described in the footnotes to Table 4. References 1. Licensee Event Report 483/01-002, Revision 0, Foreign Object Renders B Essential Service Water Pump Inoperable, event date February 14, 2001 (ADAMS Accession No. ML011070538). 2. NRC Inspection Report 05000483/2001-02, April 20, 2001 (ADAMS Accession No. ML01100295). 3. NRC Inspection Report 05000483/2001-09, June 22, 2001 (ADAMS Accession No. ML011760446). 4. NRC Supplemental Inspection Report 05000483/2002-08, April 23, 2002 (ADAMS Accession No. ML0211400981). 5. NRC Inspection Report 05000483/2001-06, January 16, 2002 (ADAMS Accession No. ML0201601760). 6. Licensee Event Report 483/02-001, Revision 1, Manual Auxiliary Feedwater Actuation and Subsequent Gas Binding of the A Motor Driven Auxiliary Feedwater Pump, December 3, 2001 (ADAMS Accession No. ML020720446). 7. Callaway Public Meeting Inspector Notes, February 27, 2002 (ADAMS Accession No. ML020640016). 8. NRC Augmented Inspection Team Report 50-483/02-07, March 21, 2002 (ADAMS Accession No. ML0208181770). 9. NRC Inspection Report 05000483/2001-03, July 24, 2001 (ADAMS Accession No. ML012050531). 10. John A. Schroeder and Scott T. Beck, Standardized Plant Analysis Risk Model for Callaway (ASP PWR B), Revision 3.02, November 2003.

LERs 483/01-002 and 483/02-001 10 11. R. G. Neve, et al., Cost/Benefit Analysis for Generic Issue 23: Reactor Coolant Pump Seal Failure, NUREG/CR-5167, U.S. Nuclear Regulatory Commission, Washington, D.C., April 1991. 12. Memorandum from Ashok C. Thadani to William D. Travers, Closeout of Generic Safety Issue 23: Reactor Coolant Pump Seal Failure, U.S. Nuclear Regulatory Commission, Washington, D.C., November 8, 1999. 13. Equipment Performance and Information Exchange System (EPIX), Volume 1 - Instructions for Data Entry, Maintenance Rule and Reliability Information Module, INPO 98-001, Institute of Nuclear Power Operations, February 1998.

LERs 483/01-002 and 483/02-001 11 Table 1. Conditional probabilities associated with the highest probability sequences. Event tree name Sequence no. Conditional core damage probability (CCDP) Core damage probability (CDP) Importance (CCDP - CDP)6 Percentage contribution7 Part 11 LOOP 26-03 2.1E-06 1.4E-07 2.0E-06 50.0% LOOP 26-16 1.1E-06 7.5E-08 1.0E-06 25.0% Total (all sequences)5 4.4E-06 4.2E-07 4.0E-06 Part 22 TRANS 19 3.7E-07 3.1E-09 3.7E-07 28.4% TRANS 18 2.8E-07 4.3E-09 2.7E-07 21.0% Total (all sequences)5 2.9E-06 1.6E-06 1.3E-06 Part 33 TRANS 19 3.5E-07 3.1E-09 3.5E-07 30.9% Total (all sequences)5 2.6E-06 1.6E-06 1.0E-06 Part 44 TRANS 19 2.3E-06 4.7E-08 2.2E-06 31.4% LODCB 10 2.1E-06 3.6E-07 1.8E-06 25.7% TRANS 18 1.6E-06 6.5E-08 1.5E-06 21.4% Total (all sequences)5 3.0E-05 2.4E-05 5.6E-06 Total (all sequences)4 Total (all sequences)5 4.0E-05 2.8E-05 1.2E-05 Note: 1. Values for part 1 are point estimates. (File name: GEM 483-02-001 05-04-04 093411 (Part 1).wpd) 2. Values for part 2 are point estimates. (File name: GEM 483-02-001 06-17-04 115505 (Part 2).wpd) 3. Values for part 3 are point estimates. (File name: GEM 483-02-001 07-01-04 085209 (Part 3).wpd) 4. Values for part 4 are point estimates. (File name: GEM 483-02-001 07-01-04 085342 (Part 4).wpd) 5. Total CCDP and CDP includes all sequences (including those not shown in this table). 6. Importance is calculated using the total CCDP and total CDP from all sequences. Sequence level importance measures are not additive. 7. Percentage contribution is the ratio of the importance of the sequence in relation to the importance of the part.

LERs 483/01-002 and 483/02-001 12 Table 2a. Event tree sequence logic for the dominant sequences. Event tree name Sequence no. Logic (/ denotes success; see Table 2b for top event names) TRANS 19 /RPS, AFW, MFW, HPI1 LOOP 26-03 /RPS, EPS, OEP-30M, /AFW3, /PORV4, /RCPSL, OEP-BD LODCB 10 /RPS, AFW, /HPI1, BLEED TRANS 18 /RPS, AFW, MFW. /HPI1, BLEED LOOP 09 /RPS, /EPS, /AFW2, /PORV3, RCPSL3, HPI2 LOOP 26-16 /RPS, EPS, OEP-30M, AFW3 Table 2b. Definitions of fault trees listed in Table 2a. AFW AFW IS UNAVAILABLE AFW2 AFW USING LOOP-FTF FAULT TREE FLAGS AFW3 AFW IS UNAVAILABLE (USING SBO-FTF FAULT TREE FLAGS) BLEED FAILURE TO PROVIDE BLEED PORTION OF FEED AND BLEED COOLING EPS EMERGENCY POWER FAILS HPI1 HIGH-PRESSURE INJECTION FAILS HPI2 HPI USING LOOP-FTF FAULT TREE FLAGS MFW MAIN FEEDWATER IS UNAVAILABLE OEP-30M OFFSITE POWER RECOVERY WITHIN 30 MINUTES OEP-BD OFFSITE POWER RECOVERY PRIOR TO BATTERY DEPLETION PORV3 PORVs/SRVs OPEN DURING LOOP PORV4 PORVs/SRVs OPEN DURING STATION BLACKOUT RCPSL REACTOR COOLANT PUMP SEALS FAIL FROM LACK OF COOLING RCPSL3 RCPSL USING LOOP-FTF FAULT TREE FLAGS RPS REACTOR PROTECTION SYSTEM FAILS

LERs 483/01-002 and 483/02-001 13 Table 3a. Conditional cut sets for dominant sequences (part 1). CCDP1 Percent contribution Minimal cut sets2 Event Tree: LOOP, Sequence 26-03 6.6E-07 30.8 OEP-XHE-NOREC-ST ESW-MDP-CF-START OEP-XHE-NOREC-BD 5.5E-07 26.4 OEP-XHE-NOREC-ST EPS-DGN-TM-DGA OEP-XHE-NOREC-BD 3.6E-07 17.0 OEP-XHE-NOREC-ST EPS-DGN-FS-DGA OEP-XHE-NOREC-BD 2.1E-06 Total (all cut sets/this sequence)3 Event Tree: LOOP, Sequence 26-16 1.3E-07 11.8 OEP-XHE-NOREC-ST ESW-MDP-CF-START AFW-TDP-FR-PAL02 1.1E-07 10.1 OEP-XHE-NOREC-ST AFW-TDP-FR-PAL02 EPS-DGN-TM-DGA 1.1E-06 Total (all cut sets/this sequence)3 4.0E-06 Total (all cut sets/all sequences)3 Notes: 1. Values are point estimates. 2. See Table 4 for definitions and probabilities for the basic events. 3. Totals include all cut sets (including those not shown in this table). Table 3b. Conditional cut sets for dominant sequences (part 2). CCDP1 Percent contribution Minimal cut sets2 Event Tree: TRANS, Sequence 19 1.3E-06 13.5 MFW-XHE-ERROR AFW-MDP-DI-1B AFW-TDP-FRD HPI-XHE-XM-FB MFW-SYS-TRIP AFW-XHE-XL-MDPFRD-1B AFW-TDP-DI AFW-XHE-XL-MDPFRD-1B 3.7E-07 Total (all cut sets/this sequence)3 1.3E-06 Total (all cut sets/all sequences)3 Notes: 1. Values are point estimates. 2. See Table 4 for definitions and probabilities for the basic events. 3. Totals include all cut sets (including those not shown in this table).

LERs 483/01-002 and 483/02-001 14 Table 3c. Conditional cut sets for dominant sequences (part 3). CCDP1 Percent contribution Minimal cut sets2 Event Tree: TRANS, Sequence 19 5.0E-08 14.5 MFW-XHE-ERROR AFW-MDP-DI-1B AFW-TDP-FRD HPI-XHE-XM-FB1 MFW-SYS-TRIP AFW-XHE-XL-MDPFRD-1B AFW-TDP-DI AFW-XHE-XL-TDPFRD1 4.6E-08 13.1 HPI-XHE-XM-FB AFW-MDP-DI-1B AFW-TDP-FRD AFW-XHE-XL-TDPFRD1 MFW-SYS-UNAVAIL AFW-XHE-XL-MDPFRD-1B AFW-TDP-DI 3.6E-08 10.4 MFW-XHE-ERROR AFW-TDP-FR-PAL02 AFW-XHE-XL-MDPFRD-1B MFW-SYS-TRIP AFW-MDP-DI-1B HPI-XHE-XM-FB1 3.5E-07 Total (all cut sets/this sequence)3 2.6E-06 Total (all cut sets/all sequences)3 Notes: 1. Values are point estimates. 2. See Table 4 for definitions and probabilities for the basic events. 3. Totals include all cut sets (including those not shown in this table).

LERs 483/01-002 and 483/02-001 15 Table 3d. Conditional cut sets for dominant sequences (part 4). CCDP1 Percent contribution Minimal cut sets2 Event Tree: TRANS, Sequence 19 3.8E-07 16.9 MFW-XHE-ERROR AFW-MDP-DI-1A AFW-XHE-XL-MDPFRD-1B AFW-TDP-DI AFW-XHE-XL-TDPFRD1 MFW-SYS-TRIP AFW-MDP-DI-1B AFW-TDP-FRD HPI-XHE-XM-FB1 AFW-XHE-XL-MDPFRD-1A1 3.4E-07 15.3 HPI-XHE-XM-FB AFW-MDP-DI-1A AFW-XHE-XL-MDPFRD-1B AFW-TDP-DI AFW-XHE-XL-MDPFRD-1A1 MFW-SYS-UNAVAIL AFW-MDP-DI-1B AFW-TDP-FRD AFW-XHE-XL-TDPFRD1 2.7E-07 12.1 MFW-XHE-ERROR AFW-TDP-FR-PAL02 AFW-MDP-DI-1B HPI-XHE-XM-FB1 MFW-SYS-TRIP AFW-MDP-DI-1A AFW-XHE-XL-MDPFRD-1B AFW-XHE-XL-MDPFRD-1A1 2.5E-07 10.9 HPI-XHE-XM-FB AFW-TDP-FR-PAL02 AFW-MDP-DI-1B AFW-XHE-XL-MDPFRD-1A1 MFW-SYS-UNAVAIL AFW-MDP-DI-1A AFW-XHE-XL-MDPFRD-1B 2.3E-06 Total (all cut sets/this sequence)3 Event Tree: LODCB, Sequence 10 6.1E-07 28.4 AFW-MDP-DI-1B AFW-TDP-FRD AFW-XHE-XL-TDPFRD1 AFW-XHE-XL-MDPFRD-1B AFW-TDP-DI 4.3E-07 20.3 AFW-TDP-FR-PAL02 AFW-XHE-XL-MDPFRD-1B AFW-MDP-DI-1B 3.5E-07 16.3 AFW-TDP-TM-PAL02 AFW-XHE-XL-MDPFRD-1B AFW-MDP-DI-1B 3.1E-07 14.7 AFW-TDP-FS-PAL02 AFW-XHE-XL-MDPFRD-1B AFW-MDP-DI-1B 2.1E-06 Total (all cut sets/this sequence)3 Event Tree: TRANS, Sequence 18 2.2E-07 13.7 MFW-SYS-UNAVAIL AFW-MDP-DI-1B AFW-TDP-FRD PPR-SRV-CC-PRV1 AFW-XHE-XL-MDPFRD-1A1 AFW-MDP-DI-1A AFW-XHE-XL-MDPFRD-1B AFW-TDP-DI AFW-XHE-XL-TDPFRD1 2.2E-07 13.7 MFW-SYS-UNAVAIL AFW-MDP-DI-1A AFW-XHE-XL-MDPFRD-1B AFW-TDP-DI AFW-XHE-XL-MDPFRD-1A1 PPR-SRV-CC-PRV2 AFW-MDP-DI-1B AFW-TDP-FRD AFW-XHE-XL-TDPFRD1 1.6E-06 Total (all cut sets/this sequence)3 3.0E-05 Total (all cut sets/all sequences)3 Notes: 1. Values are point estimates. 2. See Table 4 for definitions and probabilities for the basic events. 3. Totals include all cut sets (including those not shown in this table).

LERs 483/01-002 and 483/02-001 16 Table 4. Definitions and probabilities for modified or dominant basic events. Event name Description Probability/ frequency Modified AFW-MDP-DI-1A DEBRIS INGESTED IN AFW MDP1A TRUE Yes1 AFW-MDP-DI-1B DEBRIS INGESTED IN AFW MDP1B 5.0E-001 Yes2 AFW-MDP-FRD-1A AFW MOTOR-DRIVEN PUMP 1A FAILS TO RUN (DEBRIS) TRUE Yes2 AFW-MDP-FRD-1B AFW MOTOR-DRIVEN PUMP 1B FAILS TO RUN (DEBRIS) TRUE Yes2 AFW-TDP-DI DEBRIS INGESTED IN AFW TDP 5.0E-001 Yes2 AFW-TDP-FR-PAL02 TURBINE DRIVEN FEED PUMP PAL02 FAILS TO RUN 9.5E-003 Yes3 AFW-TDP-FRD AFW TURBINE-DRIVEN PUMP FAILS TO RUN (DEBRIS) 5.0E-002 Yes2 AFW-TDP-FS-PAL02 TURBINE DRIVEN FEED PUMP PAL02 FAILS TO START 6.8E-003 Yes3 AFW-TDP-TM-PAL02 TURBINE DRIVEN FEED PUMP PAL02 UNAVAILABLE DUE TO TEST AND MAINTENANCE 7.6E-003 No AFW-XHE-XL-MDPFR D-1A OPERATOR FAILS TO RECOVER AFW MDP 1A (DEBRIS INGESTION) TRUE Yes1 AFW-XHE-XL-MDPFR D-1A1 OPERATOR FAILS TO RECOVER AFW MDP 1B (DEBRIS INGESTION) (DEPENDENT) 1.0 Yes4 AFW-XHE-XL-MDPFR D-1B OPERATOR FAILS TO RECOVER AFW MDP 1B (DEBRIS INGESTION) 5.0E-002 Yes4 AFW-XHE-XL-TDPFR D OPERATOR FAILS TO RECOVER AFW TDP (DEBRIS INGESTION) 5.0E-002 Yes4 AFW-XHE-XL-TDPFR D1 OPERATOR FAILS TO RECOVER AFW TDP (DEBRIS INGESTION) (DEPENDENT) 5.3E-001 Yes4 CCW-MDP-CF-RUN CCW PUMPS FAIL FROM COMMON CAUSE TO RUN 1.3E-002 Yes5 CCW-MDP-FR-P1C CCW MDP P1C FAILS TO RUN TRUE Yes6 CVC-MDP-TM-P1C PUMP P1C IS IN TEST OR MAINTENANCE 2.0E-001 No EPS-DGN-FS-DGA DIESEL GENERATOR A FAILS TO START 2.0E-002 No EPS-DGN-TM-DGA DG A UNAVAILABLE DUE TO TEST AND MAINTENANCE 3.1E-002 No EPS-DGN-TM-DGB DG B UNAVAILABLE DUE TO TEST AND MAINTENANCE 3.1E-002 No ESW-MDP-CF-START ESW PUMPS FAIL FROM COMMON CAUSE TO START 3.6E-002 Yes5 ESW-MDP-FS-1B ESW TRAIN B MDP 1B FAILS TO START TRUE Yes7

LERs 483/01-002 and 483/02-001 17 Table 4. Definitions and probabilities for modified or dominant basic events (cont). HPI-XHE-XM-FB OPERATOR FAILS TO INITIATE FEED AND BLEED COOLING 1.0E-002 No HPI-XHE-XM-FB1 OPERATOR FAILS TO INITIATE FEED AND BLEED COOLING 6.9E-002 No MFW-SYS-TRIP MAIN FEEDWATER SYSTEM UNAVAILABLE GIVEN RX TRIP 8.0E-001 No MFW-SYS-UNAVAIL OPERATOR FAILS TO RESTORE MFW FLOW 2.0E-001 No MFW-XHE-ERROR OPERATOR FAILS TO RESTORE MFW FLOW 4.0E-002 No OEP-XHE-NOREC-BD OPERATOR FAILS TO RECOVER OFFSITE POWER BEFORE BATTERY DEPLETION GIVEN THAT POWER IS NOT RECOVERED IN SHORT TERM 4.9E-002 No OEP-XHE-NOREC-SL OPERATOR FAILS TO RECOVER OFFSITE POWER PRIOR TO SEAL LOCA 2.4E-002 Yes8 OEP-XHE-NOREC-ST OPERATOR FAILS TO RECOVER OFFSITE POWER IN SHORT TERM 5.3E-001 No PPR-SRV-CC-PRV1 PORV 1 FAILS TO OPEN ON DEMAND 6.3E-003 No PPR-SRV-CC-PRV2 PORV 2 FAILS TO OPEN ON DEMAND 6.3E-003 No PPR-SRV-OO-1 PORV 1 FAILS TO RECLOSE AFTER OPENING 2.0E-003 Yes9 PPR-SRV-OO-2 PORV 2 FAILS TO RECLOSE AFTER OPENING 2.0E-003 Yes9 RCS-MDP-LK-SEALS RCP SEALS FAIL W/O COOLING AND INJECTION 2.0E-001 Yes8 RCS-MDP-LK-SEALS1 RCP SEALS FAIL W/O COOLING AND INJECTION 1.9E-001 No CCW-MDP-FR-04A01 MOTOR DRIVEN PUMP ALPHA FACTOR 1 FOR 4 TRAINS 9.72E-01 Yes10 CCW-MDP-FR-04A02 MOTOR DRIVEN PUMP ALPHA FACTOR 2 FOR 4 TRAINS 1.85E-02 Yes10 CCW-MDP-FR-04A03 MOTOR DRIVEN PUMP ALPHA FACTOR 3 FOR 4 TRAINS 7.79E-03 Yes10 CCW-MDP-FR-04A04 MOTOR DRIVEN PUMP ALPHA FACTOR 4 FOR 4 TRAINS 1.36E-03 Yes10 CCW-MDP-FS-04A01 MOTOR DRIVEN PUMP ALPHA FACTOR 1 FOR 4 TRAINS 9.67e-01 Yes10 CCW-MDP-FS-04A02 MOTOR DRIVEN PUMP ALPHA FACTOR 2 FOR 4 TRAINS 1.66E-02 Yes10 CCW-MDP-FS-04A03 MOTOR DRIVEN PUMP ALPHA FACTOR 3 FOR 4 TRAINS 1.35E-02 Yes10 CCW-MDP-FS-04A04 MOTOR DRIVEN PUMP ALPHA FACTOR 4 FOR 4 TRAINS 3.01E-03 Yes10 Notes: 1. Basic event changed to reflect event being analyzed (parts 2 and 3). 2. Basic event changed to reflect event being analyzed (parts 1 through 4).

LERs 483/01-002 and 483/02-001 18 3. For the turbine-driven AFW pump, the failure rate for failure to run was updated to 1.19E-03/hr and the mission time was reduced from 24 hours to 8 hours. Additionally, the probability of failure to start was updated to 6.8E-03 per demand, based on guidance provided by INEEL. Failure data based on data covering the period of January 1, 1997, through December 31, 2001, from Ref. 13. Failure data based on unrecovered failures: therefore, operator recovery events associated with recovery of failure to start and failure to run were set to TRUE. 4. Operator recovery values were determined the SPAR Model Human Error worksheet (see Attachment 2). 5. Common-cause probability values automatically calculated by GEMS. 6. Basic event changed to reflect event being analyzed (part 2). 7. Basic event changed to reflect event being analyzed (part 1). 8. Model update to incorporate the Rhodes model. Modifications to top events were made in accordance with guidance provided in Refs. 11 and 12. High temperature seals are assumed to be installed on all RCPs. Therefore, RCS-MDP-LK-SEALS was set to 0.20. Based on the Rhodes model, the time available to prevent core damage by restoring ac power and starting high-pressure injection if RCP seals fail is 4 hours (time until core uncovery and battery depletion). To account for increased time to recover electric power, top event OP-SL was updated (basic event OEP-XHE-NOREC-SL). 9. NUREG 4550, Vol. 1, Rev 1. Table 8.2.5

10. The Alpha factors changed from generic values for motor driven pumps to specified Alpha factors that commensurate for CCW pumps type.( http://nrcoe.inel.gov/index.cfm?fuseaction=CCF.showMenu U.S. Nuclear Regulatory Commission Reactor Operating Experience Results and Databases )

LERs 483/01-002 and 483/02-001 19 HPR HIGH PRESSURE RECIRC RHR RESIDUAL HEAT REMOVAL COOLDOWN RCS COOLDOWN SGCOOL SECONDARY COOLING RECOVERED BLEED BLEED PATH ESTABLISHED HPI HIGH PRESSURE INJECTION PORV PORVs ARE CLOSED MFW MAIN FEEDWATER AFW AUXILIARY FEEDWATER RPS REACTOR TRIP IE-TRANS TRANSIENT STATE NOTES 1 OK 2 OK 3 OK 4 CD 5 OK 6 CD 7 CD 8 OK 9 OK 10 OK 11 CD 12 OK 13 CD 14 CD 15 OK 16 OK 17 CD 18 CD 19 CD 20 T ATWS PORV1 HPI1 TRANS - CALLAWAY TRANSIENT 2001/08/21 Figure 1. Callaway TRANS event tree.

LERs 483/01-002 and 483/02-001 20 AFW-MDPA 45 DCP-NK01 59 ESW-A 5 ACP-NB01 1.1E-3 AFW -MDP-TM-1A AFW-MDPA-2 1.3E-3 AFW-MDP-FS-1A 2.1E-1 AFW-XHE-XL-MDPFS AFW-MDPA-5 7.5E-1 AFW-XHE-XL-MDPFR 7.6E-4 AFW-MDP-FR-1A 3.6E-5 AFW-MDP-CF-START 2.3E-5 AFW-MDP-CF-RUN AFW-MDPA-3 3.0E-4 AFW -FAN-FS-MDPA 2.4E-4 AFW-FAN-FR-MDPA 2.0E-3 AFW-FAN-TM-MDPA 1.0E-3 AFW-XHE-XR-FANMA 1.8E-5 AFW-FAN-CF-RMCFS 7.7E-6 AFW-FAN-CF-RMCFR AFW-MDPA-1 AFW-MDPA-4 5.0E-2 AFW-XHE-XL-MDPFRD-1A TRUE AFW-MDP-FRD-1A 0.0E+0 AFW-MDP-DI-1A AFW MOTOR DRIVEN PUMP TRAIN A IS UNAVAILABLE 4160 VAC BUS NB01 IS UNAVAILABLE ESSENTIAL SERVICE WATER SYSTEM LOOP A IS UNAVAILABLE 125 VDC POWER PANEL DP-NK01 IS UNAVAILABLE AFW MDP UNAVAILABLE DUE TO TEST AND MAINTENANCE AFW MDP FAILS TO START AFW MOTOR-DRIVEN PUMP 1A FAILS TO START OPERATOR FAILS TO RECOVER AFW MDP (FAILS TO START) AFW MDP FAILS TO RUN DUE TO MECHANICAL FAILURE AFW MOTOR-DRIVEN PUMP FAILS TO RUN OPERATOR FAILS TO RECOVER AFW MDP (FAILS TO RUN) CCF OF AFW MDPS TO START CCF OF AFW PUMPS TO RUN FAILURE OF ROOM COOLING TO AFW MDP A AFW MDP A HVAC FAN FAILS TO START AFW MDP A HVAC FAN FAILS TO RUN AFW MDP A HVAC FAN UNAVAILABLE DUE TO T&M OP FAILS TO RESTORE AFW MDP A HVAC FAN AFTER T&M CCF OF AFW MDP ROOM COOLING FANS TO START CCF OF AFW MDP ROOM COOLING FANS TO RUN AFW MDP FAILS TO RUN AFW MDP FAILS TO RUN DUE TO DEBRIS INGESTION AFW MOTOR-DRIVEN PUMP 1A FAILS TO RUN (DEBRIS) OPERATOR FAILS TO RECOVER AFW MDP 1A (DEBRIS INGESTED) DEBRIS INGESTED IN AFW MDP1A AFW-MDPA - CALLAWAY AUXILIARY FEEDWATER PUMP PAL01A 2004/04/29 Page 15 Figure 2. AFW motor-driven pump A fault tree.

LERs 483/01-002 and 483/02-001 21 AFW-MDPB 48 DCP-NK04 60 ESW-B 6 ACP-NB02 1.1E-3 AFW-MDP-TM-1B AFW -MDPB-2 1.3E-3 AFW-MDP-FS-1B 2.1E-1 AFW-XHE-XL-MDPFS AFW -MDPB-5 7.5E-1 AFW-XHE-XL-MDPFR 7.6E-4 AFW-MDP-FR-1B 3.6E-5 AFW-MDP-CF-START 2.3E-5 AFW-MDP-CF-RUN AFW-MDPB-3 3.0E-4 AFW -FAN-FS-MDPB 2.4E-4 AFW-FAN-FR-MDPB 2.0E-3 AFW-FAN-TM-MDPB 1.0E-3 AFW -XHE-XR-FANMB 1.8E-5 AFW-FAN-CF-RMCFS 7.7E-6 AFW-FAN-CF-RMCFR AFW-MDPB-1 AFW-MDPB-4 5.0E-2 AFW-XHE-XL-MDPFRD-1B TRUE AFW-MDP-FRD-1B 0.0E+0 AFW-MDP-DI-1B AFW MOTOR DRIVEN PUMP TRAIN B IS UNAVAILABLE 4160 VAC BUS NB02 IS UNAVAILABLE ESSENTIAL SERVICE WATER SYSTEM LOOP B IS UNAVAILABLE 125 VDC POWER PANEL DP-NK04 IS UNAVAILABLE AFW MDP UNAVAILABLE DUE TO TEST AND MAINTENANCE AFW MDP FAILS TO START AFW MOTOR-DRIVEN PUMP 1B FAILS TO START OPERATOR FAILS TO RECOVER AFW MDP (FAILS TO START) AFW MDP FAILS TO RUN DUE TO MECHANICAL FAILURE AFW MOTOR-DRIVEN PUMP FAILS TO RUN OPERATOR FAILS TO RECOVER AFW MDP (FAILS TO RUN) CCF OF AFW MDPS TO START AFW MDP FAILS TO RUN FAILURE OF ROOM COOLING TO AFW MDP B AFW MDP B HVAC FAN FAILS TO START AFW MDP B HVAC FAN FAILS TO RUN AFW MDP B HVAC FAN UNAVAILABLE DUE TO T&M OP FAILS TO RESTORE AFW MDP B HVAC FAN AFTER T&M CCF OF AFW MDP ROOM COOLING FANS TO START CCF OF AFW MDP ROOM COOLING FANS TO RUN AFW MDP FAILS TO RUN AFW MDP FAILS TO RUN DUE TO DEBRIS INGESTION AFW MOTOR-DRIVEN PUMP 1B FAILS TO RUN (DEBRIS) OPERATOR FAILS TO RECOVER AFW MDP B (DEBRIS INGESTED) DEBRIS INGESTED IN AFW MDP1B AFW-MDPB - CALLAWAY AUXILIARY FEEDWATER PUMP PAL01B 2004/04/29 Page 16 Figure 3. AFW motor-driven pump B fault tree.

LERs 483/01-002 and 483/02-001 22 AFW-TDP-1 1.4E-3 AFW-AOV-CC-FTSST 7.5E-1 AFW-XHE-XL-FTSST AFW-TDP AFW-TDP-2 6.8E-3 AFW -TDP-FS-PAL0 2 TRUE AFW-XHE-XL-TDPFS 9.5E-3 AFW-TDP-FR-PAL02 TRUE AFW -XHE-XL-TDPFR AFW -TDP-4 46 DCP-NK02 7.6E-3 AFW -TDP-TM-PAL02 0.0E+0 AFW-TDP-DI 5.0E-2 AFW -TDP-FRD AFW -TDP-5 AFW-TDP-3 5.0E-2 AFW -XHE-XL-TDPFRD TURBINE DRIVEN FEED PUMP PAL02 FAILS TO START STEAM SUPPLY IS UNAVAILABL E STEAM SUPPLY VALVES FAIL TO OPEN OPERATOR FAILS TO RECOVER FAILURE OF STEAM SUPPLY TURBINE DRIVEN PUMP TRAIN IS UNAVAILABLE TURBINE DRIVEN FEED PUMP PAL0 2 FAILS TO RUN OPERATOR FAILS TO RECOVER PUMP FAILURE TO START OPERATOR FAILS TO RECOVER PUMP FAILURE TO RUN PUMP FAILS TO RUN DUE TO MECHANICAL FAILURE 125 VDC POWER PANEL DP-NK02 IS UNAVAILABLE PUMP FAILS TO START FEED PUMP PAL02 IS IN TEST OR MAINTENANCE DEBRIS INGESTED IN AFW TDP AFW TURBINE-DRIVEN PUMP FAILS TO RUN (DEBRIS) PUMP FAILS TO RUN DUE TO DEBRIS INGESTION AFW TDP FAILS TO RUN OPERATOR FAILS TO RECOVER THE AFW TDP (DEBRIS INGESTED) AFW-TDP - CALLAWAY AUXILIARY FEEDWATER PUMP PAL02 2004/04/29 Page 18 Figure 4. AFW turbine-driven pump fault tree.

LERs 483/01-002 and 483/02-001 23 - Timeline for Events in Condition Assessment The time period for the condition assessment is 1 year. The period selected for the analysis is from January 27, 2001, to January 26, 2002, the date that degradation of the foam seal ring and foreign material in the condensate storage tank (CST) were discovered. The following is a timeline for events that occurred during the time period, including (1) failure of the B emergency service water (ESW) pump, as described in LER 483/01-002 (Ref. 1) and (2) failure of A motor-driven auxiliary feedwater (AFW) pump due to foreign material from the CST, as described in LER 483/02-001 (Ref. 6). February 9, 2001 At 2:15 p.m., a leak collection rig was installed on the B ESW prelube tank. Tygon hose subsequently detached from the leak collection rig and fell into the suction bay for the B ESW pump, effectively rendering the pump inoperable. February 14, 2001 At 8:51 a.m., the B ESW pump B was manually started, but failed to deliver rated flow and pressure. (The pumps flow and discharge pressure were 4 Mlbm/hr at 80 psi vs. its normal flow and discharge pressure of 7 Mlbm/hr at 140 psi.) February 15, 2001 A foreign object (hose) was removed from the B ESW pump and the pump was declared operable at 2:31 a.m. March 9, 2001 Reactor scram occurs due to loss of both rod drive motor generators. Plant shut down (reactor not critical) for a total of 47 hours. April 7, 2001 Reactor shut down for refueling outage from April 7, 2001, to May 21, 2001. Plant shut down (reactor not critical) for a total of 1,045 hours. October 22, 2001 Quarterly test of the A AFW pump. November 15, 2001 Improper maintenance on the C component cooling water (CCW) pump results in the pump being inoperable. December 3, 2001 During a plant shutdown (to repair generator stator cooling leak), AFW pumps A and B were manually started. Both pumps start, but A pump fails to deliver any flow. Cause not initially known but later discovered to be foam from the CST's floating diaphragm. Plant shut down (reactor not critical) for 77 hours. January 26, 2002 Inspection of the CST identifies foreign material (foam pieces from the tank's floating diaphragm in the tank sump). The following describes bases for the durations of the equipment unavailabilities and degraded conditions, based on the above timeline. S Condition duration for failed B ESW pump. The B ESW pump is assumed to be failed from the time the leak collection rig was installed on the B ESW prelube tank (at 2:15 p.m. on February 9, 2001) until the time when the pump was returned to service (at 2:31 a.m. on February 15, 2001). The pump was assumed inoperable for a period of 132 hours.

LERs 483/01-002 and 483/02-001 24 S Condition duration for failed A AFW pump. Prior to its failure to run on December 3, 2001, the A AFW pump was last tested on October 22, 2001. The time from the last successful test until its failure is about 42 days. Because there is uncertainty about when foreign material entered the A AFW pump, rendering it inoperable, it is conservatively assumed that the debris was in or near the line that it eventually clogged for the entire interval (from October 22, 2001, to December 3, 2001), a total of 42 days (1008 hours). (The A AFW pump was vented and declared operable on December 5, 2001. The 2-day time period after the A AFW pump failed until it was returned to service is not added to the condition duration because the reactor was being shut down when the pump failed and entered Mode 3 shortly after the pump failed.) S Condition duration for degraded condition of the CST. On January 26, 2002, inspection of the CST revealed damage to a 5-foot section of the diaphragms foam seal ring. Several pieces of foam, a piece of cloth, and four small rubber pads were found in the bottom of the tank. A 25-inch section of foam was hanging from the diaphragm. The material in the bottom of the tank and the degraded portion of the seal ring posed a foreign material risk to the AFW pumps. Prior to the inspection on January 26, 2002, a limited inspection of the tank was performed on October 17, 2000; however, the inspection did not identify degradation of the tanks diaphragm. Therefore, the exact time when portions of the diaphragms foam ring and fabric detached is not known. The degraded condition is assumed to have existed for at least 1 year (8,760 hours). S Condition duration for failed C CCW pump. On November 27, 2001, the C CCW pump was started to support planned maintenance of Train B CCW. After about an hour of operation, the pumps drive bearing temperature exceeded the alarm setpoint. The pump was shut down and the A CCW pump (redundant Train A pump) was started. The licensee determined that the high bearing temperature and resultant bearing failure had been caused by a lack of lubricating oil. Preventive maintenance had been performed on the C CCW pump on November 15, 2001. Maintenance personnel had not added the proper amount of oil. The pump was repaired and passed a post-maintenance test on December 5, 2001. The C CCW pump is assumed to be failed from the time of maintenance on November 15, 2001, until it passed testing on December 5, 2001, (a total of 21 days or 504 hours). To appropriately model the various component unavailabilities and the degraded seal and foreign material in the CST, the condition assessment was performed in four parts. The following describes the time period for each of the three parts that make up the 1-year condition assessment. S Time period for part 1 of the condition assessment. Part 1 of the condition assessment is 132 hours. This corresponds to the time period from February 9, 2001, to February 15, 2001, when the B ESW pump was unavailable. During this 132-hour time period, (1) the B ESW pump and equipment dependent upon the train B ESW could have failed to perform their safety function and (2) all three of the AFW pumps were operable but at an increased risk of failure due to foreign material in the CST. S Time period for part 2 of the condition assessment. Part 2 of the condition assessment is 504 hours. Chronologically, the time period for part 2 is assumed to be from November 11, 2001, to December 3, 2001. During this 504-hour time period, (1) the A AFW pump was unavailable, (2) the B AFW pump and the turbine-driven AFW pump were operable but at an increased risk of failure due to foreign material in the CST, and (3) the C CCW pump was unavailable. (Because the time period when the C CCW pump was unavailable corresponds closely to the time period when the A AFW pump was unavailable, the unavailability of the C CCW pump is included in part 2.)

LERs 483/01-002 and 483/02-001 25 S Time period for part 3 of the condition assessment. Part 3 of the condition assessment is 504 hours. This corresponds to the remaining time that the A AFW pump was unavailable when the C CCW pump was operable (from October 22 until November 11, 2001). Additionally, the B AFW pump and the turbine-driven AFW pump were operable but at an increased risk of failure due to foreign material in the CST. S Time period for part 4 of the condition assessment. Part 4 of the condition assessment is 7620 hours. This time period includes the periods during the 1-year condition assessment not covered by parts 1, 2,or 3. During this 7620-hour time period, all three AFW pumps were operable but at an increased risk of failure due to foreign material in the CST.

LERs 483/01-002 and 483/02-001 26 - Operator Recovery Modeling SPAR Model Human Error Worksheet (Page 1 of 3) Plant: Callaway Event Name: NA Task Error

Description:

Operator fails to recover AFW pump failure-to-run due to ingestion of debris Events: AFW-XHE-XL-MDPFRD-1A, AFW-XHE-XL-MDPFRD-1B, AFW-XHE-XL-TDPFRD Does this task contain a significant amount of diagnosis activity ? YES NO X If Yes, Use Table 1 below to evaluate the PSFs for the Diagnosis portion of the task before going to Table 2. If No, go directly to Table 2. Table 1. Diagnosis worksheet. PSFs PSF Levels Multiplier for Diagnosis If non-nominal PSF levels are selected, please note specific reasons in this column

1. Available Time Inadequate 1.0a Barely adequate < 20 m 10 Nominal. 30 m 1

Extra > 60 m 0.1 Expansive > 24 h 0.01

2. Stress Extreme 5

High 2 Nominal 1

3. Complexity Highly 5

Moderately 2 Nominal 1

4. Experience/

Training Low 10 Nominal 1 High 0.5

5. Procedures Not available 50 Available, but poor 5

Nominal 1 Diagnostic/symptom oriented 0.5

6. Ergonomics Missing/Misleading 50 Poor 10 Nominal 1

Good 0.5

7. Fitness for Duty Unfit 1.0a Degraded Fitness 5

Nominal 1

8. Work Processes Poor 2

Nominal 1 Good 0.8

a. Task failure probability is 1.0 regardless of other PSFs.

LERs 483/01-002 and 483/02-001 27 SPAR Model Human Error Worksheet (Page 2 of 3) Table 2. Action worksheet. PSFs PSF Levels Multiplier for Action If non-nominal PSF levels are selected, please note specific reasons in this column

1. Available Time Inadequate 1.0a Recovery of AFW is needed 30 minutes after failure.

Time available. time required 10U Nominal 1 Available > 5x time required 0.1 Available > 50x time required 0.01

2. Stress Extreme 5U AFW system is needed to prevent core damage.

High 2 Nominal 1

3. Complexity Highly 5

Moderately 2 Nominal 1U

4. Experience/

Training Low 3 Nominal 1U High 0.5

5. Procedures Not available 50 Available, but poor 5

Nominal 1U

6. Ergonomics Missing/Misleading 50 Poor 10 Nominal 1U Good 0.5
7. Fitness for Duty Unfit 1.0a Degraded Fitness 5

Nominal 1U

8. Work Processes Poor 2

Nominal 1U Good 0.8

a. Task failure probability is 1.0 regardless of other PSFs.

Table 3. Task failure probability without formal dependence worksheet. Task Portion Nom. Prob. Time Stress Compl. Exper./ Train. Proced. Ergon. Fitness Work Process Prob. Diag. 1.0E-2 na Action 1.0E-3 10 5 1 1 1 1 1 1 5.0E-2 Total 5.0E-2

LERs 483/01-002 and 483/02-001 28 SPAR Model Human Error Worksheet (Page 3 of 3) For all tasks, except the first task in the sequence, use the table and formulae below to calculate the Task Failure Probability With Formal Dependence. Table 4. Dependency condition worksheet. Condition Number Crew (same or different) Location (same or different) Time (close in time or not close in time) Cues (additional or not additional) Dependency Number of Human Action Failures Rule 1 s s c complete If this error is the 3rd error in the sequence, then the dependency is at least moderate. If this error is the 4th error in the sequence, then the dependency is at least high. This rule may be ignored only if there is compelling evidence for less dependence with the previous tasks. 2 s s nc na high 3 s s nc a moderate 4 s d c high 5 s d nc na moderate 6 s d nc a low 7 d s c moderate 8 d s nc na low 9 d s nc a low 10 d d c moderate 11 d d nc na low 12 d d nc a low 13 zero Using P = Task Failure Probability Without Formal Dependence (calculated on page 2): For Complete Dependence the probability of failure = 1.0 For High Dependence the probability of failure = (1 + P)/2 For Moderate Dependence the probability of failure = (1 +6P)/7 For Low Dependence the probability of failure = (1 + 19P)/20 UFor Zero Dependence the probability of failure

P Task Failure Probability With Formal Dependence = (1 + ( * )) /

Additional Notes:

LERs 483/01-002 and 483/02-001 29 SPAR Model Human Error Worksheet (Page 1 of 3) Plant: Callaway Event Name: NA Task Error

Description:

Operator fails to recover AFW TDP pump failure-to-run due to ingestion of debris (highly dependent value) Event: AFW-XHE-XL-TDPFRD1 Does this task contain a significant amount of diagnosis activity ? YES NO X If Yes, Use Table 1 below to evaluate the PSFs for the Diagnosis portion of the task before going to Table 2. If No, go directly to Table 2. Table 1. Diagnosis worksheet. PSFs PSF Levels Multiplier for Diagnosis If non-nominal PSF levels are selected, please note specific reasons in this column

1. Available Time Inadequate 1.0a Barely adequate < 20 m 10 Nominal. 30 m 1

Extra > 60 m 0.1 Expansive > 24 h 0.01

2. Stress Extreme 5

High 2 Nominal 1

3. Complexity Highly 5

Moderately 2 Nominal 1

4. Experience/

Training Low 10 Nominal 1 High 0.5

5. Procedures Not available 50 Available, but poor 5

Nominal 1 Diagnostic/symptom oriented 0.5

6. Ergonomics Missing/Misleading 50 Poor 10 Nominal 1

Good 0.5

7. Fitness for Duty Unfit 1.0a Degraded Fitness 5

Nominal 1

8. Work Processes Poor 2

Nominal 1 Good 0.8

a. Task failure probability is 1.0 regardless of other PSFs.

LERs 483/01-002 and 483/02-001 30 SPAR Model Human Error Worksheet (Page 2 of 3) Table 2. Action worksheet. PSFs PSF Levels Multiplier for Action If non-nominal PSF levels are selected, please note specific reasons in this column

1. Available Time Inadequate 1.0a Recovery of AFW is needed 30 minutes after failure.

Time available. time required 10U Nominal 1 Available > 5x time required 0.1 Available > 50x time required 0.01

2. Stress Extreme 5U AFW system is needed to prevent core damage.

High 2 Nominal 1

3. Complexity Highly 5

Moderately 2 Nominal 1U

4. Experience/

Training Low 3 Nominal 1U High 0.5

5. Procedures Not available 50 Available, but poor 5

Nominal 1U

6. Ergonomics Missing/Misleading 50 Poor 10 Nominal 1U Good 0.5
7. Fitness for Duty Unfit 1.0a Degraded Fitness 5

Nominal 1U

8. Work Processes Poor 2

Nominal 1U Good 0.8

a. Task failure probability is 1.0 regardless of other PSFs.

Table 3. Task failure probability without formal dependence worksheet. Task Portion Nom. Prob. Time Stress Compl. Exper./ Train. Proced. Ergon. Fitness Work Process Prob. Diag. 1.0E-2 na Action 1.0E-3 10 5 1 1 1 1 1 1 5.0E-2 Total 5.0E-2

LERs 483/01-002 and 483/02-001 31 SPAR Model Human Error Worksheet (Page 3 of 3) For all tasks, except the first task in the sequence, use the table and formulae below to calculate the Task Failure Probability With Formal Dependence. Table 4. Dependency condition worksheet. Condition Number Crew (same or different) Location (same or different) Time (close in time or not close in time) Cues (additional or not additional) Dependency Number of Human Action Failures Rule 1 s s c complete If this error is the 3rd error in the sequence, then the dependency is at least moderate. If this error is the 4th error in the sequence, then the dependency is at least high. This rule may be ignored only if there is compelling evidence for less dependence with the previous tasks. 2 s s nc na high 3 s s nc a moderate U4 s d c high 5 s d nc na moderate 6 s d nc a low 7 d s c moderate 8 d s nc na low 9 d s nc a low 10 d d c moderate 11 d d nc na low 12 d d nc a low 13 zero Using P = Task Failure Probability Without Formal Dependence (calculated on page 2): For Complete Dependence the probability of failure = 1.0 UFor High Dependence the probability of failure = (1 + P)/2 For Moderate Dependence the probability of failure = (1 +6P)/7 For Low Dependence the probability of failure = (1 + 19P)/20 For Zero Dependence the probability of failure = P Task Failure Probability With Formal Dependence = (1 + 5E-02) / 2 = 5.3E-01

LERs 483/01-002 and 483/02-001 32 SPAR Model Human Error Worksheet (Page 1 of 3) Plant: Callaway Event Name: NA Task Error

Description:

Operator fails to recover AFW MDP pump failure-to-run due to ingestion of debris (completely dependent value) Event: AFW-XHE-XL-MDPFRD-1A1 Does this task contain a significant amount of diagnosis activity ? YES NO X If Yes, Use Table 1 below to evaluate the PSFs for the Diagnosis portion of the task before going to Table 2. If No, go directly to Table 2. Table 1. Diagnosis worksheet. PSFs PSF Levels Multiplier for Diagnosis If non-nominal PSF levels are selected, please note specific reasons in this column

1. Available Time Inadequate 1.0a Barely adequate < 20 m 10 Nominal. 30 m 1

Extra > 60 m 0.1 Expansive > 24 h 0.01

2. Stress Extreme 5

High 2 Nominal 1

3. Complexity Highly 5

Moderately 2 Nominal 1

4. Experience/

Training Low 10 Nominal 1 High 0.5

5. Procedures Not available 50 Available, but poor 5

Nominal 1 Diagnostic/symptom oriented 0.5

6. Ergonomics Missing/Misleading 50 Poor 10 Nominal 1

Good 0.5

7. Fitness for Duty Unfit 1.0a Degraded Fitness 5

Nominal 1

8. Work Processes Poor 2

Nominal 1 Good 0.8

a. Task failure probability is 1.0 regardless of other PSFs.

LERs 483/01-002 and 483/02-001 33 SPAR Model Human Error Worksheet (Page 2 of 3) Table 2. Action worksheet. PSFs PSF Levels Multiplier for Action If non-nominal PSF levels are selected, please note specific reasons in this column

1. Available Time Inadequate 1.0a Recovery of AFW is needed 30 minutes after failure.

Time available. time required 10U Nominal 1 Available > 5x time required 0.1 Available > 50x time required 0.01

2. Stress Extreme 5U AFW system is needed to prevent core damage.

High 2 Nominal 1

3. Complexity Highly 5

Moderately 2 Nominal 1U

4. Experience/

Training Low 3 Nominal 1U High 0.5

5. Procedures Not available 50 Available, but poor 5

Nominal 1U

6. Ergonomics Missing/Misleading 50 Poor 10 Nominal 1U Good 0.5
7. Fitness for Duty Unfit 1.0a Degraded Fitness 5

Nominal 1U

8. Work Processes Poor 2

Nominal 1U Good 0.8

a. Task failure probability is 1.0 regardless of other PSFs.

Table 3. Task failure probability without formal dependence worksheet. Task Portion Nom. Prob. Time Stress Compl. Exper./ Train. Proced. Ergon. Fitness Work Process Prob. Diag. 1.0E-2 na Action 1.0E-3 10 5 1 1 1 1 1 1 5.0E-2 Total 5.0E-2

LERs 483/01-002 and 483/02-001 34 SPAR Model Human Error Worksheet (Page 3 of 3) For all tasks, except the first task in the sequence, use the table and formulae below to calculate the Task Failure Probability With Formal Dependence. Table 4. Dependency condition worksheet. Condition Number Crew (same or different) Location (same or different) Time (close in time or not close in time) Cues (additional or not additional) Dependency Number of Human Action Failures Rule U1 s s c complete If this error is the 3rd error in the sequence, then the dependency is at least moderate. If this error is the 4th error in the sequence, then the dependency is at least high. This rule may be ignored only if there is compelling evidence for less dependence with the previous tasks. 2 s s nc na high 3 s s nc a moderate 4 s d c high 5 s d nc na moderate 6 s d nc a low 7 d s c moderate 8 d s nc na low 9 d s nc a low 10 d d c moderate 11 d d nc na low 12 d d nc a low 13 zero Using P = Task Failure Probability Without Formal Dependence (calculated on page 2): UFor Complete Dependence the probability of failure = 1.0 For High Dependence the probability of failure = (1 + P)/2 For Moderate Dependence the probability of failure = (1 +6P)/7 For Low Dependence the probability of failure = (1 + 19P)/20 For Zero Dependence the probability of failure = P Task Failure Probability With Formal Dependence = 1.0}}

Retrieved from "https://kanterella.com/w/index.php?title=ML20112F370&oldid=4293748"