Comparative study of FLEX strategies for Extended Station Blackout (SBO) using PRA

Comparative study of FLEX strategies for Extended Station Blackout (SBO) using PRA

M.G. Shahinoor Islam*, Lim Hak-Kyu

Department of Nuclear Power Plant Engineering

KEPCO International Nuclear Graduate School, Ulsan, Republic of Korea

AbstractThe Fukushima Daiichi Nuclear Power Plant (NPP) accident induced a new challenge to the nuclear society. The extended station blackout (SBO) coping capability can now be evaluated by Diverse and Flexible Coping Strategies (FLEX). The approach is to provide portable equipment to maintain safety functions such as core cooling and containment heat removal functions. The main objective of this paper is to present a comparative study for a small mobile gas turbine generator (GTG) and a large mobile GTG to cope with an extended SBO. In this comparative study, a small mobile GTG is connected to the class 1E dc bus to recover dc power and battery charger when the driven auxiliary feed water (TDAFWP) pumps are unavailable after depletion of the battery. In the same manner, a large mobile GTG is connected to the class 1E ac bus to recover ac power when the TDAFW pumps are unavailable after depletion of the battery. Probabilistic risk assessment (PRA) model of both cases are developed with simplification. Based on the comparative study results, the core damage frequency (CDF) of extended SBO is more effectively reduced by using the small mobile GTG. The opportunity to improve response times, simplify required manual actions, and utilize robust equipment in robust locations can be justified by the small size of a mobile GTG as a mitigating strategy of extended SBO.

Keywords Extended SBO, gas turbine generator (GTG), PRA, FLEX strategies, Core Damage Frequency (CDF)

1. INTRODUCTION

   One of the primary lessons learned from the accident at Fukushima Dai-ichi was the significance of the challenge presented by a loss of safety-related systems following the occurrence of a beyond-design-basis external event [1]. The nuclear safety is assured in all situations with the provision of the basic safety functions: control of reactivity, removal of decay heat to the ultimate heat sink, and confinement of radioactive materials [3]. A station blackout (SBO) is defined in IAEA Safety Guide SSG 34 as a plant condition with complete loss of all alternating current (ac) power from offsite sources, from the main generator and from standby ac power sources important to safety to the essential and nonessential switchgear buses [4].

   The APR1400 is a pressurized water reactor type with two reactor coolant loops which was designed by Korea Hydro and Nuclear Power (KHNP). The reactor has 1400 MWe core output rating. The APR1400 standard design approval was issued by Korean regulatory authority in 2002. The main design philosophy of the APR1400 is the enhancement of safety by using proven technologies and significant experiences gained in design, construction, maintenance, and operation of NPPs, especially OPR1000 units, in South Korea. The APR1400 design is adapted to meet applicable US

   regulatory requirements such as proven technology, constructability, maintainability, and regulatory stabilization.

   In case of APR1400, SBO is the complete loss of alternating current (ac) electric power to Class 1E and non- class 1E switchgear buses. The SBO scenario involves the loss of offsite power (LOOP) concurrent with a turbine trip and failure of the onsite emergency diesel generators (EDGs). During an SBO, non-class 1E alternate alternating current (AAC) DG and batteries will provide power for the set of required shutdown loads to bring the plant to safe shutdown. An AAC DG power is provided for the operation of the motor- driven auxiliary feed water pump (MDAFWP) during an SBO. If AAC DG is not available, the turbine driven auxiliary feed water pump (TDAFWP) will be provided with battery dc power. With procedural load management, the batteries can supply the needed control and instrumentation power for approximately eight (8) hours, and, therefore, lacking any other problems, initial plant cooldown can proceed for about eight hours without restoration of ac power. With loss of all station ac power (Station Blackout), RCP seal cooling water will be lost, the seals will begin to degrade and gross seal leakage on the order of several hundred gpm may occur. Electrical systems have sufficient capability and capacity to provide core cooling and containment integrity in an SBO. But over the 8hours, the loss of the TDAFWP may occur due to the battery depletion. If TDAFW pumps fail to start and deliver feedwater to the steam generators, secondary steam removal through the secondary safety valves or atmospheric dump valves will continue until the steam generator boil dry. Primary pressure will rapidly rise and the POSRVs will open. Cores uncover and, thus, core damage will occur within 1 hour unless power is restored and auxiliary feed water flow is established. This situation is called extended SBO that can occur if beyond-design-basis external event (BDBEE) exceeds the assumptions. In order to address these challenges, diverse and flexible mitigation strategies (FLEX) could be used to enhance their ability to cope with BDBEE conditions. Under the extended SBO, FLEX is efficient measure to protect or mitigate severe accident (see fig.1).

   The objective of this paper is to compare the FLEX strategies for mitigation of an extended SBO scenario. In this paper, one option is a small mobile GTG for recovery of dc power and instrumentation and control to cope with an extended SBO scenario, and the other option is a large mobile GTG for ac power recovery to cope with an extended SBO scenario.

   Fig. 1. Enhancement of FLEX [1]

2. OVERALL FRAMEWORK OF COMPARATIVE STUDY OF FLEX STRATEGIES

   The design and operation of the plant are analyzed in order to identify the sequence of events that can lead to core damage; the core damage frequency is estimated through probabilistic risk assessment (PRA). This section provides an overall framework for a comparative study of FLEX strategies to reduce core damage frequency of an extended SBO scenario. Accident scenarios with a small mobile GTG and a large mobile GTG are developed. In order to compare the results of the two models, the efficiency of mobile gas turbine generators will be verified. The process for an extended SBO of APR1400 analysis uses PRA

   methods: initiating event analysis, event tree, success criteria, fault tree, and quantification analysis. Success criteria are determined by thermal hydraulic analysis or related documents of APR1400. The fault trees and event trees are solved in an integrated manner to quantify core damage frequency (CDF). PRA modeling and quantification are performed by SAREX [17]. In this study, the following factors are considered for an extended SBO mitigation strategy to use a small mobile GTG and a large mobile GTG:

   Nomenclature

   APR1400 advance power reactor 1400 AAC alternate alternating current

   ADV atmospheric dump valve

   AFAS auxiliary feedwater actuation signal AFWST auxiliary feedwater storage tank BDBEE beyond design basis external event CDF core damage frequency

   CBDTM cause-based decision tree method DVI direct vessel injection

   EDG emergency diesel generator ELAP extended loss of ac power

   FLEX diverse and flexible coping strategies GTG gas turbine generator

   HRA human reliability analysis

   I&C instrumentation and control

   IRWST in-containment refueling water storage tank LOOP loss of offsite power

   MDAFWP motor driven auxiliary feedwater pump MSSV main steam safety valve

   NCC natural ciculation cooling NPP nuclear power plant

   PRA probabilistic risk assessment PSF performance shaping factors

   POSRV pilot-operated safety relief valve

   RWT raw water tank

   RCP reactor coolant pump

   RCS reactor coolant system ESBO extended station blackout SG steam generator

   TDAFWP turbine-driven auxiliary feedwater pump THERP technique for human error rate prediction

   • The environmental conditions hinder the deployment, timing, or implementation of the FLEX equipment. These conditions could include the failure of buildings and structures, or the generation of debris that could obstruct access to areas. In this mitigating strategy, the small mobile GTG significantly reduces the time required to alternate paths, deploy of a small mobile GTG, or remove debris. Furthermore, a small mobile GTG minimizes the amount of equipment required to be deployed, improves human factors, and facilitates timely restoration of dc power and vital control and instrumentation power.

   • The function of ac or dc power restoration is maintained by both mobile GTGs. A small mobile GTG can be attached to the connection box of 480 V of mobile generator to recover dc power and instrumentation and control. Also, a large mobile GTG can be connected to the 4.16 KV class 1E safety bus to recover ac power.

   • In order to assure reliability and availability of the FLEX equipment required to meet these capabilities, the program may require that the site has N+ 1 sets of FLEX equipment, where N is the number of units on site. A small mobile GTG can satisfy the requirement of availability due to cost effectiveness; however, a large mobile GTG has sufficient margin. A large mobile GTG with the necessary equipment can be installed, thereby, maintaining power to the ac powered safety key equipment.

   • The availability of time margin to complete necessary actions is an important consideration in the mitigating strategies for equipment. Time to deploy and time to install of a small mobile GTG and a large mobile GTG should be considered.

3. DEVELOPMENT OF ACCIDENT SEQUENCE OF EXTENDED

   SBO EVENT

   The goal of accident sequence modeling with respect to the use of portable equipment is to determine which scenarios could be beneficial from the use of the equipment. Accident sequences are graphically modeled in event trees in a PRA model.

   1. Development of Accident Sequence for Extended SBO by using Small Mobile GTG

      A representative event tree for an extended SBO scenario using a small mobile GTG is shown in fig.2. SBO involves the loss of offsite power (LOOP) concurrent with a turbine trip and failure of the onsite emergency ac power system. During an SBO, a non-class 1E AAC DG with sufficient capacity, capability, and reliability provides power for the set of required

      shutdown loads (non-design-basis accident) to bring the plant to safe shutdown. The AAC DG is started and manually connected to the set of required shutdown equipment within 10 minutes in accordance with regulation. But, under the extended SBO, it is assumed that AAC DG is not available and dc battery is only available, reactor coolant pump (RCP) seals might fail due to loss of seal cooling. The mitigating strategies procedures assume that the TDAFW pump provides feedwater to SG for 8 hours since the TDAFW pump is not available after depletion of battery. A small mobile GTG is connected to the class 1E dc bus to recover dc power for maintaining secondary heat removal. Primary FLEX pump is connected to direct vessel injection (DVI) via SI pump line to inject sufficient borated water to the core due to RCS inventory loss by RCP seal leakage. In addition, a small mobile GTG can supply dc power to essential instrumentation and control (I&C) equipment, and for the operation of the TDAFWPs.

      Fig. 2. Event Tree for an Extended SBO using Small GTG

   2. Development of Accident Sequence for Extended SBO by using Large Mobile GTG

   A representative event tree for an extended SBO scenario using a large mobile GTG is shown in fig. 3. SBO event is initiated by loss of off-site power (LOOP) with concurrent failure of both emergency diesel generators (EDGs). The alternate alternating current (AAC) DG can be used to cope with SBO scenarios. If AAC DG is failed for extended SBO, the TDAFW pump is available for 8 hours to remove decay heat, and keep natural circulation cooling. After depletion of battery, if offsite power or a large mobile GTG is recovered within 8hours, it can provide power for maintaining secondary heat removal, feed and bleed operation and containment heat removal. A large mobile GTG is connected to the class 1E ac bus to recover ac power. Moreover, the reactor coolant pump (RCP) seal integrity may be challenged, because both the seal injection water supply and component cooling water supply to the RCP thermal barrier heat exchanger are lost due to the event of SBO. Primary injection from outside of FLEX pump is considered to connect direct vessel injection via SI pump line to inject borated water to the core. RCS inventory makeup can be provided by primary FLEX pump.

   Fig. 3. Event Tree for an Extended SBO using large GTG

4. MODELING MITIGATING STRATEGIES OF FLEX EQUIPMENT IN THE PRA

   The PRA models for nuclear power plants are designed to model the as-built, as-operated plant. The PRA model allows the analyst to identify potential vulnerabilities and risk insights based on how the plant is built and how the operators respond to initiating events.

   1. Modeling Mitigating strategy of Small Mobile GTG in the PRA

      Station blackout (SBO) affects plant followed by a failure of all permanent on site ac power sources (EDG and AAC). The FLEX equipment credited for this scenario includes a small mobile gas turbine generator (GTG) to recover the dc power. The following assumptions are applied to the example; the plant has two TDAFW pumps. The TDAFW pump is required for the first 8 hours of the scenario to provide sufficient time to deploy the FLEX equipment. A small Mobile GTG is deployed and installed to the connection box of 480 V of mobile generator to recover dc power and instrumentation & control. Cable reel of small mobile GTG will be connected to the connection box of 480 V of mobile generator. The onsite diesel generator (EDG) fuel oil storage tanks are used as the source of fuel for the mobile GTGs. The capacity of the each EDG fuel oil storage tank is designed to allow the mobile GTG to operate at rated power for 7 days. The small mobile GTG requires deployment to the front of EDG room. Moreover, supporting system of small mobile GTG are battery, battery charger, and air cooler. The battery is needed for startup power of mobile GTG. Air cooler will be used for heat removal of equipment.

      In addition, a primary FLEX pump injects the borated water to the reactor vessel via DVI (direct vessel injection). The following assumptions are applied to the example; The TDAFW pump is required for the first 8 hours of the scenario to provide sufficient time to deploy the FLEX equipment. RCS

      inventory makeup is provided by primary FLEX pump. Primary FLEX pump connection is provided into the safety injection system (SIS), downstream of the safety injection pump (SIP) discharge line connection to the direct vessel injection (DVI) nozzle on the reactor vessel (RV) in the RCS. Operators will begin to cool down and depressurize the steam generators. Steam generator atmospheric dump valves may be controlled manually if dc power is not available. Fuel should be supplied from EDG room by portable pump when fuel is depleted. The primary side high-head FLEX pump suction is the IRWST, while the low-head FLEX pump suction is the RWT. Emergency diesel generator fuel oil storage tank is used for refuelling the primary FLEX pump. The transfer pump is used for transferring fuel to the primary FLEX pump.

   2. Modeling Mitigating strategy of large Mobile GTG in the PRA

   The FLEX equipment credited for this scenario includes a large mobile gas turbine generator (GTG) to recover the ac power. The following assumptions are applied to the example; The TDAFW pump for the initial coping phase of an ELAP, during which it maintains a heat sink to dissipate decay heat from the reactor core. A large mobile GTG is connected to the

   4.16 KV class 1E safety bus to recover ac power. Cable reel of large mobile GTG is connected to the 4.16 KV switchgear train A or B. The large mobile GTG is aligned to 4.16 KV 1E class ac bus. Pre-operational check of a large mobile GTG is required before re-energized the bus. The large mobile GTG requires deployment to the front of emergency diesel generator (EDG) room. The large mobile GTG are required to be refueled prior to 24 hours of depletion. The same primary FLEX pump was modelled in both cases as explained in section IV A.

5. HUMAN RELIABILITY ANALYSIS IN PRA Human reliability analysis is an important aspect of PRA

modelling to consider the possibility that the crew could make an error in responding to an initiating event. In order to calculate human error probability (HEP), cognitive portion of human error probability (Pc) and execution portion of human error probability (Pexe) are considered. The cognitive portion is analyzed by cause-based decision tree method (CBDTM), and execution portion is analyzed by technique for human error rate prediction (THERP) method. These methods are suggested by NEI-16-06 [2].

Assessing the probability of failure of a human action includes performing a timing analysis to identify how much time is available to complete the action. This is compared to the time available before successfully completing the action which no longer impacts the sequence of events. The differences in how this is done when considering human actions associated with portable equipment. These include; diagnosis time associated with entering procedures to use portable equipment, potential for debris removal that make the travel path more difficult, transportation and staging of portable equipment, installation of hoses or cables, after staged installation of portable equipment, pre-operational checks, and energized bus from portable equipment. The structure of timing analysis for mobile gas turbine generators is shown in fig.4. In time window analysis, As long as this action is

completed within about 8 hours from the start of the SBO, the steam generators will not overfill or boil dry. It is assumed that after 8 hours the mobile GTG is required. Td= 60 minutes. This is the duration of time it takes to diagnose the situation and begin the deployment of the mitigating strategies equipment, measured from the time of initiating event. Tcog=

8 minutes. This includes the time for operators to receive enough indication, evaluate the written instructions, and take any necessary preparatory actions to begin the deployment actions. Texe= 150 minutes. The validation time provide in the site mobile GTG implementation to deployment, staged installation, the time to pre-operational check, and time to re- power the bus. The time can be increased to account for using spare part due to possible failure of equipment.

TABLE I. THE HUMAN ERROR PROBABILITY (HEP) OF SMALL GTG

AND LARGE GTG

Fig. 4. Structure of timing analysis for mobile gas turbine generators

Detection, diagnosis, and decision making phase of procedure guides are included in the cognitive portion of the human error probability [13]. To facilitate the identification, the Pc is made into failures of the plant information-operator interface and failures of the operator- procedure interface. The Pc process includes identifying clear cues to enter the procedure, clear direction within the procedure on the steps required, and training to be performed. Cognition portion of HEP calculation for a large GTG without recovery and with recovery are shown in table-II and table-III. The analysis of execution portion of human error probability (Pexe) includes aspects such as deployment and staging of portable equipment, installation of hoses or cables, pre-operational checks, and reenergized of bus from portable equipment. Errors of omission and errors of commission with performance shaping factors are considered in each part of instruction (action) [16]. Execution portion of HEP calculation for a large GTG without recovery, and with recovery are shown in table-IV and table-

1. Operators failure to deploy and install a small mobile gas turbine generator (GTG) [2] and a large mobile GTG are shown in table-I.

   TABLE II. COGNITION PORTION OF HEP CALCULATION FOR LARGE GTG

   WITHOUT RECOVERY WITH RECOVERY

   Cognitive analysis
   Pc Failure Mechanism	Branch	HEP
   Pca: Availability of Information	a	N/A
   Pcb: Failure of Attention	h	N/A
   Pcc: Misread/miscommunicate data	a	N/A
   Pcd: Information misleading	a	N/A
   Pce: Skip a step in procedure	e	2.00E-03
   Pcf: Misinterpret Instructions	a	N/A
   Pcg: Misinterpret decision logic	l	N/A
   Pch: Deliberate violation	a	N/A
   Initial Pc (without recovery credited)		2.00E-03

   TABLE III. COGNITION PORTION OF HEP CALCULATION FOR LARGE GTG

   Cognitive Recovery
   	Initial HEP	Dependency level	Multiply by HEP	Final value
   Pca	N/A	N/A
   Pcb	N/A	N/A
   Pcc	N/A	N/A
   Pcd	N/A	N/A
   Pce	2.00E-03	MD	1.45E-01	2.90E-04
   Pcf	N/A	N/A
   Pcg	N/A	N/A
   Pch	N/A	N/A
   Final Pc with recovery				2.90E-04

   TABLE IV. EXECUTION PORTION OF HEP CALCULATION FOR LARGE GTG

   td>

   Instruction (action)

   Execution Uncovered
   procedure		Error type	THERP		HEP	Stres s facto r	Override
   Ste p no.	Tabl e		Item
   01	Deployment and staging of large GTG	EO M	20-7	1	3.0E -03	high
   		EOC	20- 13	1	1.3E -03	high
   		Total step HEP					2.15E-02
   02	After equip. staged installation of GTG	EO M	20-7	2	1.0E -02	high
   		EOC	20- 12	13	1.3E -02	high
   		Total step HEP					1.15E-01
   03	Pre- operational Check of large GTG	EO M	20-7	2	1.0E -02	high
   		EOC	20- 22	9	1.0E -03	high
   		Total step HEP					5.50E-02
   04	Energized bus from large GTG	EO M	20-7	2	1.2E -02	high
   		EOC	20- 12	11	5.0E -03	high
   		Total step HEP					7.50E-02
   		Total HEP					2.66E-01

   WITHOUT RECOVERY

   TABLE V. EXECUTION PORTION OF HEP CALCULATION FOR LARGE GTG WITH RECOVERY

   Execution Recovered
   Step no.	Instruction (Action)	Initial HEP	Dep .	Cond. HEP	Total for step
   01	Deploymen t and staging of large GTG	2.15E-02	MD	1.45E-01	3.11E-03
   02	After equip. staged installation of GTG	1.15E-01	LD	6.24E-02	7.17E-03
   03	Pre- operational Check of large GTG	5.50E-02	MD	1.45E-01	7.97E-03
   04	Energized bus from large GTG	7.50E-02	ZD	6.24E-02	4.68E-03
   	Total Uncovered	2.66E-01	Total Recovered		1.96E-02

2. DATA ANALYSIS OF FLEX STRATEGIES Data analysis is the process of determining the failure

   probabilities for the basic events in the PRA model. There is no failure data available for portable equipment, while there are adequate sources of generic failure rates for permanently- installed equipment at nuclear power plants. However, there is data on similar type of portable equipment in NUREG/CR- 6928. In this study, failure probability of diesel generator and combustion turbine generator are used as failure probability of small mobile gas turbine generator (GTG) and large mobile GTG respectively. The applied data related to mobile GTGs are shown in table-VI.

   TABLE VI. THE FAILURE DATA OF MOBILE GTGS

   Basic Event	Description	Prob.	Data Source
   GTTGL-L-GTG	Large GTG fails to run for 1 hour	5.79E-03	NUREG/CR-6928
   GTTGM-L-GTG	Large GTG unavailable due to maintenance	5.00E-02	NUREG/CR-6928
   GTTGR-L-GTG	Large GTG fail to run	8.49E-03	NUREG/CR-6928
   GTTGS-L-GTG	Large GTG fails to start	5.12E-02	NUREG/CR-6928
   GT-LGTG-REEL	Failure of large GTG cable reel	1.20E-06	NUREG/CR-3263
   GTOPH-S-GTG	Operators fails to provide 1E class dc bus	5.35E-03	NEI-16-06
   GT-GTG- DEPLOY	Failure of small GTG deploy and stage	1.12E-04	NEI-16-06
   GTTGL-S-GTG	small GTG fails to run for 1 hour	3.72E-03	NUREG/CR-6928
   GTTGS-S-GTG	Small GTG fails to start	2.88E-03	NUREG/CR-6928
   GTTGM-S-GTG	Small GTG unavailable due to maintenance	1.34E-03	NUREG/CR-6928
   GTTGR-S-GTG	small GTG fail to run	1.52E-03	NUREG/CR-6928
   GT-SGTG-REEL	Failure of small GTG cable reel	4.00E-08	NUREG/CR-3263

3. RESULTS AND DISCUSSION

   1. Result for extended SBO with small mobile GTG

      The quantification results of significant contributions to CDF are reviewed. The total CDF from extended SBO using a small GTG is 7.05E-07/year. The frequency sequences with small mobile GTG are 4.79E-09/year (ESBO-06) and 1.19E- 11/year (ESBO-13) respectively which include the failure of a small mobile GTG. The core damage frequency contributions for an extended station blackout (SBO) with small mobile GTG-DC core damage sequences are presented in table-VII.

      TABLE VII. CORE DAMAGE FREQUENCY CONTRIBUTIONS FOR EXTENDED STATION BLACKOUT (SBO) WITH MOBILE GTG-DC

      Sequence Number	Sequence	CDF
      ESBO-06	(SBO)(failure of AAC)(successful delivery of feedwater using turbine driven pumps)(RCP Seal intact)(failure of recovery offsite power within 8 hours)(failure of mobile GTG for dc power recovery)	4.79E-09
      ESBO-09	(SBO)(failure of AAC)(successful delivery of feedwater using turbine driven pumps)(RCP Seal leakage)(success of recovery offsite power within 8 hours)(failure of primary injection of RCS inventory by primary FLEX pump)	7.62E-09
      ESBO-12	(SBO)(failure of AAC)(successful delivery of feedwater using turbine driven pumps)(RCP Seal leakage)(failure of recovery offsite power within 8 hours)(success of mobile GTG for dc power recovery)(failure of primary injection of RCS inventory by primary FLEX pump)	1.836E-11
      ESBO-13	(SBO)(failure of AAC)(successful delivery of feedwater using turbine driven pumps)(RCP Seal leakage)(failure of recovery offsite power within 8 hours)(failure of mobile GTG for dc power recovery)	1.19E-11
      ESBO-14	(SBO)(failure of AAC)(failure of delivery of feedwater using turbine driven pumps	6.93E-07
      Total		7.05E-07

   2. Result for Extended SBO with large mobile GTG

   The quantification results are reviewed with significant contributions to CDF. The probability of total CDF from extended SBO using a large GTG is 7.32E-07/year. The frequency sequences with large mobile GTG are 3.87E- 08/year (ESBO-12) and 9.69E-11/year (ESBO-25) which include the failure of a large mobile GTG. The core damage frequency contributions for an extended station blackout (SBO) with large mobile GTG-AC core damage sequences are presented in table-VIII.

   TABLE VIII. CORE DAMAGE FREQUENCY CONTRIBUTIONS FOR EXTENDED STATION BLACKOUT (SBO) WITH MOBILE GTG-AC

   Sequence Number	Sequence	CDF
   SBO-05	(SBO)(failure of AAC)(successful delivery of feedwater using turbine driven pumps)(RCP Seal intact)(success of recovery offsite power within 8 hours)(failure to maintain secondary heat removal)(Safety dep. For bleed OK)(safety injection for feed fails)	6.48E-14
   ESBO-06	(SBO)(failure of AAC)(successful delivery of feedwater using turbine driven pumps)(RCP Seal intact)(success of recovery offsite power within 8 hours) (success of mobile GTG for ac power recovery)(failure to maintain secondary heat removal)(Safety dep. For bleed fails)	1.03E-10
   ESBO-11	(SBO)(failure of AAC)(successful delivery of feedwater using turbine driven pumps)(RCP Seal intact)(failure of recovery offsite power within 8 hours)(failure to maintain secondary heat removal)(Safety dep. For bleed fails)	1.49E-13
   ESBO-12	(SBO)(failure of AAC)(successful delivery of feedwater using turbine driven pumps)(RCP Seal intact)(failure of recovery offsite power within 8 hours)( failure of mobile GTG for ac power recovery)	3.87E-08
   ESBO-25	(SBO)(failure of AAC)(successful delivery of feedwater using turbine driven pumps)(failure of RCP Seal )(failure of recovery offsite power within 8 hours)( failure of mobile GTG for ac power recovery)	9.69E-11
   ESBO-26	(SBO)(failure of AAC)(failure to delivery of feedwater using turbine driven pumps)	6.93E-07
   Total		7.32E-07

4. CONCLUSION

In this comparative study of FLEX strategies, an extended SBO with a small mobile GTG and an extended SBO with a large mobile GTG was modeled and compared. Based on these comparative study results, the CDF of an extended SBO with a small mobile GTG is lower than the CDF of an extended SBO with a large mobile GTG. The frequency sequences of ESBO- 12 and ESBO-25 of an extended SBO with a large GTG is higher than frequency sequences of ESBO-06 and ESBO-13 of an extended SBO with a small GTG. Therefore, the failure probability of a large mobile GTG is higher than a small mobile GTG. The small mobile GTG is relatively more effective, yet the human error probability (HEP) of a small mobile GTG and a large mobile GTG are 5.35E-03 and 1.99E- 02, respectively. Deployment and installation of large mobile GTG may take longer time; plus, maintenance and testing could also increase their unavailability. The NEI-16-06 report was followed for human reliability analysis; however, there is no data based on experience of FLEX equipment. Consequently, lack of FLEX-specific data may impact the results of FLEX strategies. The opportunity to improve response times, simplify human actions, and utilize robust equipment in robust locations can be justified by this small mobile GTG as a mitigating strategy of an extended SBO. For further study, sensitivity analyses should be performed in data analysis and human action analyses. Currently, there is no data of FLEX equipment, and the calculation of human error

probability (HEP) was applied using engineering judgement in some cases, until new guidance is developed.

ACKNOWLEDGMENT

This research was supported by the 2017 Research Fund of the KEPCO International Nuclear Graduate School (KINGS), Republic of Korea.

REFERENCES

1. Nuclear Energy Institute (NEI), Diverse and Flexible Coping Strategies (FLEX) Implementation Guide, NEI 12-06, Rev. 2, December 2015.

2. Nuclear Energy Institute (NEI), "Crediting Mitigating Strategies in Risk-Informed Decision Making, NEI 16-06, Rev. 0, August 2016

3. IAEA, Safety of Nuclear Power Plants: Design, Specific Safety Requirements No. SSR-2/1, International Atomic Energy Agency,

   Vienna, Austria, 2012

4. IAEA Safety Guide SSG 34, Design of Electrical Power Systems for Nuclear Power Plants , IAEA, Vienna, 2016.

5. IAEA safety standard series No SSG-3, Development and application of Level 1 Probabilistic safety assessment for Nuclear Power plants),

   International atomic Energy agency, Vienna, 2010

6. Fukushima Nuclear Accident Analysis Report, Tokyo Electric Power Company, Inc. (2012)

7. Loss of All Alternating Current Power, U.S.NRC Regulation, Title 10 Code of Federal Regulations Part 50, Section 63

8. NUREG 1935 State-of-the-Art Reactor Consequence Analyses (SOARCA) Report,2012

9. NUREG-0800, Chapter 8, Section 8.4, Revision 1, "Station Blackout"

10. APR 1400 DCD-2, Chapter 19, Probabilistic Risk Assessment and Severe Accident Evaluation, Korea Electric Power Corporation & Korea Hydro & Nuclear Power Co., Ltd, Ver. 0, 2014

11. APR1400 Design Control Document, Tier 2, Chapter 6, Electric Power, Korea Electric Power Corporation (KEPCO) and Korea Hydro & Nuclear Power Co., Ltd. (KHNP).

12. Alin Tatu, Taewan Kim, Extending SBO coping capability: An improved auxiliary feedwater system, progress in Nuclear energy 95, 2017, Pages 40-47.

13. EPRI, An approach to the analysis of opretor actions in Probabilistic Risk Assesssment, EPRI TR-100259, June, 1992.

14. NUREG/CR-6890, Reevaluation of Station Blackout Risk at Nuclear Power Plants (Vol. 1, Analysis of Offsite Power Events: 1986 2004),

    U.S. Nuclear Regulatory Commission, Dec. 2005

15. Component Reliability Data Sheets 2015, summary sheet, U.S. Nuclear Regulatory Commission, 2015

16. NUREG/CR-1278, Hand book of human reliability analysis with emphasis on Nuclear Power Plant Applications, August, 1983

17. SAREX Quick Reference Manual Version 1.2 Rev. 1, 2006.