IR 05000287/1997003
| ML16139A535 | |
| Person / Time | |
|---|---|
| Site: | Oconee  |
| Issue date: | 10/21/1998 |
| From: | Labarge D NRC (Affiliation Not Assigned) |
| To: | Mccollum W DUKE POWER CO. |
| References | |
| 50-287-97-03, 50-287-97-3, NUDOCS 9810260154 | |
| Download: ML16139A535 (22) | |
Text
SUBJECT:
REVIEW OF PRELIMINARY ACCIDENT SEQUENCE PRECURSOR ANALYSIS OF EVENT AT OCONEE NUCLEAR STATION, UNIT 3
Dear Mr. McCollum:
Enclosed for your information is a copy of the final Accident Sequence Precursor analysis of the operational event at the Oconee Nuclear Plant, Unit 3, reported in Licensee Event Report No. 287/97-003. This final analysis (Enclosure 1) was prepared by our contractor at the Oak Ridge National Laboratory, based on review and evaluation of your comments and comments received from the NRC staff on the preliminary analysis. Enclosure 2 contains our responses to your specific comments. Our review of your comments employed the criteria contained in the material that accompanied the preliminary analysis. The results of the final analysis indicate that this event is a precursor for 1997.
If you have any questions regarding the enclosures, please write or call me at (301) 415-1472.
We recognize and appreciate the effort expended by you and your staff in reviewing and providing comments on the preliminary analysis.
Sincerely, ORIGINAL SIGNED BY:
David E. LaBarge, Senior Project Manager Project Directorate 11-2 Division of Reactor Projects - 1/11 Office of Nuclear Reactor Regulation Docket No. 50-287 Enclosures: As stated (2)
cc w/encls: See next page Distribution:
Docket File DLaBarge PUBLIC L-Berry CW PD 11-2 Rdg.
OGC B. Boger LPlisco, Rll J. Zwolinski COgle, RII H. Berkow ACRS P. O'Reilly, AEOD To receive a copy of this document, indicate in the box: "C" = Copy without attachmentlenclosure
"E" = Copy with 59achmentlenclosure "N" = No copy OFFICE PM:P ILA:PDIl,\\)J D: PRE1Yj2 H
NAME DLa a7cn ILBerry
'
a-,
Iier w/
DATE (/).l/98 0 / It/98/
9/0 8
/98
/
/98
/97
SUBJECT:
REVIEW OF PRELIMINARY ACCIDENT SEQUENCE PRECURSOR ANALYSIS OF EVENT AT OCONEE NUCLEAR STATION, UNIT 3
Dear Mr. McCollum:
Enclosed for your information is a copy of the final Accident Sequence Precursor analysis of the operational event at the Oconee Nuclear Plant, Unit 3, reported in Licensee Event Report No. 287/97-003. This final analysis (Enclosure 1) was prepared by our contractor at the Oak Ridge National Laboratory, based on review and evaluation of your comments and comments received from the NRC staff on the preliminary analysis. Enclosure 2 contains our responses to your specific comments. Our review of your comments employed the criteria contained in the material that accompanied the preliminary analysis. The results of the final analysis indicate that this event is a precursor for 1997.
If you have any questions regarding the enclosures, please write or call me at (301) 415-1472.
We recognize and appreciate the effort expended by you and your staff in reviewing and providing comments on the preliminary analysis.
Sincerely, David E. LaBarge, Senior Project Manager Project Directorate 11-2 Division of Reactor Projects - I/Il Office of Nuclear Reactor Regulation Docket No. 50-287 Enclosures: As stated (2)
cc w/encls: See next page
Oconee Nuclear Station cc:
Mr. Paul R. Newton Mr. J. E. Burchfield Legal Department (PBO5E)
Compliance Manager Duke Energy Corporation Duke Energy Corporation 422 South Church Street Oconee Nuclear Site Charlotte, North Carolina 28201-1006 P. 0. Box 1439 Seneca, South Carolina 29679 J. Michael McGarry, Ill, Esquire Winston and Strawn Ms. Karen E. Long 1400 L Street, NW.
Assistant Attorney General Washington, DC 20005 North Carolina Department of Justice Mr. Rick N. Edwards P. 0. Box 629 Framatome Technologies Raleigh, North Carolina 27602 Suite 525 1700 Rockville Pike L. A. Keller Rockville, Maryland 20852-1631 Manager - Nuclear Regulatory Licensing Manager, LIS Duke Energy Corporation NUS Corporation 526 South Church Street 2650 McCormick Drive, 3rd Floor Charlotte, North Carolina 28201-1006 Clearwater, Florida 34619-1035 Mr. Richard M. Fry, Director Senior Resident Inspector Division of Radiation Protection U. S. Nuclear Regulatory North Carolina Department of Commission Environment, Health, and 7812B Rochester Highway Natural Resources Seneca, South Carolina 29672 3825 Barrett Drive Raleigh, North Carolina 27609-7721 Regional Administrator, Region II U. S. Nuclear Regulatory Commission Mr. Steven P. Shaver Atlanta Federal Center Senior Sales Engineer 61 Forsyth Street, S.W., Suite 23T85 Westinghouse Electric Company Atlanta, Georgia 30303 5929 Carnegie Blvd.
Suite 500 Virgil R. Autry, Director Charlotte, North Carolina 28209 Division of Radioactive Waste Management Bureau of Land and Waste Management Department of Health and Environmental Control 2600 Bull Street Columbia, South-Carolina 29201-1708 County Supervisor of Oconee County Walhalla, South Carolina 29621
LER No. 287/97-003 LER No. 287/97-003 Event Description:
Two high-pressure injection pumps were damaged because of a low water level in the letdown storage tank Date of Event:
May 3, 1997 Plant:
Oconee 3 Event Summary Following a high-pressure injection (HPI) nozzle weld leak and thermal sleeve failure at Oconee 2, operators began shutting down Oconee 3 on May 1, 1997, so that personnel could inspect the HPI nozzles and thermal sleeves at that unit.' A low water level in the letdown storage tank (LDST), caused by the partial draining of the common reference leg in the tank level instrumentation, resulted in inadequate suction flow to the HPI pumps. Two of the three HWI pumps were damaged. All three HPI pumps were vulnerable to failure if a loss of-coolaht accident (LOCA) had occurred while the reference leg was drained. The estimated conditional core damage probability (CCDP) associated with this event for the 340-h period when the low water level in the reference leg would have impacted HPI pump operability is 5.4 x 10'. This is an increase of 4.3 x I0 over the nominal core damage probability (CDP) of 1.1 x 10.
Event Description On May 1, 1997, personnel at Oconee 3 started to shut down the reactor to inspect the HPI nozzles and thermal sleeves in response to an HPI nozzle weld leak and failed thermal sleeve at Oconee 2 (Ref. 2) and a reassessment of earlier Unit 3 radiographs that indicated the potential degradation of a Unit 3 thermal sleeve.
By the morning of May 3, the decay heat removal (DHR) system had been placed in operation, reactor coolant system (RCS) temperature and pressure were at 240'F and 270 psig, respectively, and a slow cooldown (10aF/h) was in progress. HPI pump 3B was running, and pump 3A was in standby.
At 0913, control room alarm 3SA-2/C-2 indicated that the discharge pressure for the HPI pump was low. The alarm was cleared and then alarmed two more times during the next minute. HPI discharge pressure indicated-2000 psig. While reactor coolant pump (RCP) seal injection flow indicated normal, the RCP seal injection control valve (3HP-3 1) position was observed to vary, and, in response, the operators placed the valve controller in "manual." At 0915, the 3A HPI pump autostarted on a low RCP seal injection flow signal. The control room operators stopped the 3A HPI pump within a minute, but when its control switch was placed in
"automatic," it again started on low RCP seal injection flow.
The 3A HPI pump motor current was fluctuating at levels above normal (70-120 A), and the 3B pump motor current was about 10 A. The 3A pump was placed in the "run" mode, and the 3B pump was secured. Eight minutes after the initial low HPI discharge pressure alarm, both the RCP seal injection flow and HPI pump discharge pressure indicated low. The operators realigned the HPI pump suction flow path to the borated water
Enclosure 1
LER No. 287/97-003 storage tank (BWST) by opening suction valve 3HP-24. The water level in the LDST began increasing, and the pump motor current for the 3A HPI pump motor stabilized at 10 A. At 0928, with HPI pump discharge pressure still low and no indication of RCP seal injection flow, operators closed BWST suction valve 3HP-24.
Two minutes later the operators observed that the LDST chart recorder had been indicating a constant level of 55.9-in. for the last 1.75 h. The operators recognized that the HPI pump problems could be associated with erroneous LDST level indication, although the precise cause and nature of the problems were unknown. At 0931 the 3A HPI pump was secured, and valve 3HP-5 was closed to isolate RCS letdown. It was subsequently discovered that the 3A and 3B HPI pumps had been damaged when they were operated without an adequate suction source. Inadequate suction resulted from a low net positive suction head (NPSH) and possible hydrogen entrainment. The 3A and 3B pumps had operated with inadequate NPSH for about 15 min and 4 min, respectively.
RCS makeup and RCP seal injection were not immediately required, and a decision was made not to start the 3C HPI pump (if pump operation were required, the BWST could have been used as its suction source). A Notice of Unusual Event was declared at 1504 because of the expected delay in restoring RCS normal makeup.
At 1515, the water level in the LDST level instrumentation common reference leg was found to be -49 in.
instead of its normally filled level of > 100 in. The partially drained reference leg produced a high water level indication for the LDST. At the time that the HPI pumps were damaged, the tank level indicated 56 in., but the tank was actually empty.
A small amount of boric acid buildup was noted around a test tee cap on the reference leg side of the No. 2 level transmitter. A subsequent laboratory examination concluded that the reference leg leak resulted from either (1) scratches on seating surfaces of the test tee and plug or (2) expansion of the tee nipple, probably from overtightening the cap sometime in the past. The licensee also noted that the reliance of the operators on the LDST low level alarm to cue LDST makeup, instead of LDST status monitoring to determine when makeup was needed, contributed to the HPI pump failures. The LDST low level alarm set point is 55-in., 1 in. below the lowest tank level that could be indicated with the partially drained reference leg.
At -2130, personnel began to develop procedures to flush, fill, vent, and start the 3C HPI pump without using the LDST. A contingency plan was also developed to support Unit 3 shutdown without any HPI pumps running, if necessary. Following approval of the procedures and contingency plan, the 3C HPI pump was successfully started at -1140 on May 4, 1997, and the Unit 3 cooldown continued.
Additional Event-Related Information The HPI system at Oconee provides both normal RCS makeup and RCP seal injection, as well as HPI for small-and medium-break LOCA mitigation. During normal operation, the HPI system "A" header, using either the 3A HPI pump or the 3B HPI pump, supplies RCS makeup and RCP seal injection (-80 gal/min combined flow). The LDST is used as a surge tank and normal (nonemergency) suction source for the HPI pumps. During operation, a hydrogen atmosphere is maintained in the LDST to promote oxygen scavenging.
The "B" HPI header, supplied by the 3C HPI pump, is for emergency injection only. The HPI pumps effectively share a common suction because the suction cross-connect valves are normally open (Fig. 1).
LER No. 287/97-003 Two channels of level indication are provided for the LDST. The operators can select either channel for display on a control room chart recorder. The level transmitters for the two channels utilize common process piping and a common reference leg that is vented back to the LDST.
Normally, the water level in the LDST ranges between 60 and 80 in. The low LDST level alarm set point is 55 in. When the LDST level is at 100 in. (full) and the reference leg of the transmitter is full, there is zero differential pressure across the transmitter. This indicates a full tank. When LDST level indicates "0 in.",
there are about 690 gal remaining in the tank. A continuous fill line, which would have maintained the reference leg filled, was included in the original LDST instrumentation design. The licensee did not consider the fill line to be a part of the instrumentation, and it was isolated at the time of the event.
The HPI pumps are normally isolated from the BWST by motor-operated valves (MOVs) HP-24 and -25. In the event of a safety system actuation, MOVs HP-24 and -25 open. The elevation head pressure in the BWST will overcome the pressure caused by the LDST level and hydrogen overpressure, opening check valves HP 101 and -102, closing the LDST outlet header check valve HP-97, and providing flow from the BWST to the HPI pumps. As the water level in the BWST drops, the available pressure from the LDST could exceed the available pressure from the BWST, allowing flow from the LDST when its check valve opens. The hydrogen gas in the LDST could then expand and fill the suction piping, resulting in damage to the HPI pumps. The procedural operating limit curve for LDST hydrogen pressure and volume is intended to ensure that LDST pressure does not exceed available BWST pressure, even as the water level in the BWST is drawn down during a LOCA.
[A 1991 operational event at Oconee 1, 2, and 3 involving incorrect LDST hydrogen pressure/volume curves was analyzed as an accident sequence precursor (ASP).']
The HPI pumps at Oconee are 24-stage vertical centrifugal pumps that develop 3000-psi discharge pressure with a capacity of about 500 gal/min each. The pumps will typically only operate for 1-2 min without an adequate suction source before they are damaged.
Additional information concerning this event is included in an NRC Augmented Inspection Team report.4 Modeling Assumptions If an initiating event involving a loss of RCS inventory had occurred while the LDST was nearly empty, all three HPI pumps could have failed as a result of hydrogen gas binding. This analysis assumes that the HPI system was vulnerable to failure as a result of the LDST common reference leg leak between February 22, 1997-when the LDST level instrumentation was calibrated, and May 3, 1997-when the two HPI pumps failed while shutting down. If an initiating event involving a loss of RCS inventory had occurred during this time period, the potential for HPI pump failure would have depended on the actual water levels that were reached in the LDST and BWST.
The potential effect of a loss of the HPI pumps following an initiating event without RCS inventory loss, such as the May 3, 1997, event when the low water level in the LDST was discovered was not addressed in this analysis. For such an event (or a postulated transient with successful primary relief valve closure, which was
LER No. 287/97-003 also not addressed in this analysis), the limited RCS makeup required could be provided by the safe shutdown facility (SSF) RCS makeup pump if all the HPI pumps were to fail.
This analysis assumed that the LDST reference leg was leaking continually. The LDST reference leg level was assumed to have decreased linearly with time, from 100 in (full) on February 22, 1997, to 49 in. on May 3, 1997. Although the LDST is refilled to compensate for minor RCS leakage and to maintain the water level in the tank within the operational range, the gradual reduction in reference leg level resulted in an effective, albeit unrealized, reduction in tank level. Based on a simplified model of LDST level and pressure as a function of LDST reference leg level during BWST drawdown, the HPI pumps were estimated to be vulnerable to failure during (approximately) the final 20% of the time between February 22 and May 3, or 340 h. During this period, hydrogen gas would enter the pump suction piping and fail the HPI pumps if, following a LOCA, BWST level decreased to near the level at which switchover to high-pressure recirculation was required.
A new branch (HPI-LATE) was added to the event trees used in the ASP analysis to address the potential failure of HPI due to low water level in the LDST late in the injection phase. The fault tree associated with this branch consists of one basic event, LDST-LVL-LOW, that represents the probability that the water level in the LDST is unacceptably low.
This basic event was set to TRUE during the 340-h period when unacceptably low LDST water level existed. The ASP event trees for transients, loss of offsite power events, small-break LOCAs (SLOCAs), and steam generator tube ruptures (SGTRs) were also enhanced to address the potential use of rapid RCS depressurization and low-pressure injection (LPI) in the event that HPI failed and secondary side cooling was available by adding branches to address fast depressurization, LPI, and low pressure recirculation (LPR). The Oconee Individual Plant Examination (IPE) states that following an SLOCA with a loss of HPI, the emergency operating procedures direct the operators to use secondary heat removal systems to depressurize the RCS until LPI flow is greater than 100 gal/min per header. The probability of the operators failing to depressurize the RCS and initiating LPI was assumed to be 0.1, consistent with Ref. 5 (pp.5.7-22). Two operator actions associated with cooldown and depressurization are included in the SLOCA model. PCS-XHE-XM-CDOWN addresses the failure of the operators to cool down and depressurize the unit and initiate the residual heat removal (RHR) system following a SLOCA. This action is initiated early following the SLOCA. PCS-XHE-XM-FDEPR addresses the failure of the operators to depressurize to LPI pressure following a loss of HPI. In this event, this failure occurs close to the time when sump recirculation must be initiated, 4 to 6 h after the SLOCA. Because of this separation in time between the two actions, they were considered independent in this analysis.
If the water level in the BWST did not decrease to near the sump switchover level, then HPI pump operability would not be expected to be impacted.
This could happen if, instead of proceeding to high-pressure recirculation, the operators successfully cooled down and depressurized the RCS during the injection phase and initiated DHR using the DHR system. This is the preferred response following an SLOCA since it avoids sump recirculation (the ASP models include this potential action). Limited BWST drawdown is expected in this case.'
'This expectation is supported by the limited BWST drawdown that occurred following a 350-gat'min reactor coolant pump seal failure in 1980 at Arkansas Nuclear One, Unit I (Ref. 6).
LER No. 287/97-003 HPI is also required to mitigate a medium-break LOCA (MLOCA) at Oconee (it is not required to mitigate a large-break LOCA). If an MLOCA occurred during the 340-h period when the LDST reference leg level was unacceptably low, the HPI pumps would have failed due to hydrogen entrainment before sump recirculation was initiated. The Oconee IPE (see Ref 5, pp. 2.3-8 and -9, and Table D.2) notes that the time available before switchover to high-pressure recirculation (90 min) is too short to allow RCS depressurization to the point that LPI and LPR can be used if HPI were to fail early in this event. However, the IPE concluded that HPI failure around the time of switchover to sump recirculation could be mitigated by rapid depressurization to the point that LPR could be used.
The ASP Program typically considers the potential for core damage following four postulated initiating events in pressurized-water reactors: transient, loss of offsite power, SLOCA, and SGTR. Supercomponent-based linked fault tree models are available for each of these postulated initiating events. A linked fault tree model was developed to address the impact of a low water level in the LDST on an MLOCA. Consistent with the Oconee IPE, this model assumed that a reactor trip (RT), one train of HPI, and piggy-back cooling (high pressure recirculation) are required for core cooling following an MLOCA; failure of HPI late in the injection phase was assumed to be mitigated through the use of rapid depressurization, LPI, and LPR. The fact that the event tree branch success criteria were the same as those used in the Oconee ASP model for an SLOCA allowed the existing fault trees to be used, in conjunction with the event tree shown in Fig. 2, in describing MLOCA accident sequences. The event tree includes the following branches:
Initiating Event-MLOCA (MLOCA).
The frequency of an MLOCA is estimated to be 5.0 x 10-4/year
[8.2 x 10 /h, assuming the unit is at power 70% of the time (6132 h)], based on a survey of medium-break frequencies performed in support of the analysis of Turkey Point LER No. 250/94-005 in the 1994 precursor report (see Appendix H to Ref. 7 for additional information).
Reactor Trip (RT). Failure of the reactor to trip is assumed to result in core damage following an MLOCA.
High-Pressure Injection (HPI). Failure of injection using the HPI system results in a loss of short-term RCS makeup and core damage following an MLOCA. Flow from one HPI pump is assumed to provide success.
HPI Injection Phase Successful (HPI-LATE). Failure of HPI late in the injection phase results in the loss of RCS makeup and the requirement to rapidly depressurize the RCS to allow the use of LPI and LPR for core cooling. As described previously, this top event specifically addresses the potential failure of HPI due to low LDST level (other late injection phase failures, such as a common-cause failure of the HPI pumps to run, are imbedded within HPI).
A failure probability of 1.0 is assumed for this branch when LDST level is unacceptably low.
RCS Fast Depressurization to LPIPressure (FASTDEPR). Given a failure of HPI late in the injection phase, failure to rapidly depressurize the RCS to a pressure that would allow for adequate LPI flow results in a loss of RCS makeup and core damage.
Low Pressure Injection (LPI). Failure of LPI following successful RCS depressurization subsequent to a failure of HPI results in the loss of RCS makeup and core damage.
LER No. 287/97-003 Piggy-Back Cooling (PB-COOL) Failure of piggy-back cooling results in a failure of long-term injection and DHR and is assumed to result in core damage. PB-COOL utilizes the DHR pumps, which take suction on the reactor building (RB) sump and provide water via the DHR heat exchangers to the suctions of the HPI pumps.
Flow from one HPI pump (supplied by one DHR train) provides PB-COOL success.
Low-Pressure Recirculation (LPR). Failure of LPR following successful RCS depressurization subsequent to a failure of HPI results in a failure of long-term injection and DHR and is assumed to result in core damage.
Like PB-COOL, LPR uses the DHR pumps, which take suction from the RB sump and provide water via the DHR heat exchangers to the RCS.
As with the other ASP linked fault tree models, the MLOCA model was solved using the SAPHIRE computer code to identify combinations of basic events (cut sets) that would result in core damage.
Analysis Results The CCDP estimated for the potential HPI system unavailability because of the leaking LDST common reference leg is 5.4 x 10'. This is an increase of 4.3 x 10 over the nominal CDP of 1.1 x 10 for the 340-h period. The dominant sequence, highlighted as sequence 6 in Fig. 2, contributes about 66% to the increase in the CCDP and involves
a postulated MLOCA,
successful reactor trip,
initial HPI success,
failure of HPI late in the injection phase as a result of the low water level in the LDST, and
failure to depressurize the RCS to allow the use of the LPI system for makeup.
Definitions and probabilities for selected basic events are shown in Table 1. The conditional probabilities associated with the highest probability sequences are shown in Table 2. Table 3 lists the sequence logic associated with the sequences listed in Table 2. Table 4 describes the system names associated with the dominant sequences. Minimal cut sets associated with the dominant sequences are shown in Table 5.
In addition to an assessment of the effect of a loss of HPI following a potential initiating event at Unit 3, a sensitivity analysis considered the effect if the Unit 3 LDST reference leg leak and the Unit 2 HPI injection nozzle weld leak (see the analysis of LERNo. 270/97-001) had instead occurred at the same unit. As described in the analysis of LER No. 270/97-001, subsequent inspections of the thermal sleeve and injection line nozzles at Units 1 and 3 determined that Unit 3 was also affected by nozzle cracking. If the nozzle leak had occurred at Unit 3 at the same time as the low water level in the LDST (or if the low water level in the LDST had occurred at Unit 2 in conjunction with the observed leak), a CCDP of 2.8 x 10 would have been estimated.
Acronyms ASP accident sequence precursor BWST borated water storage tank
LER No. 287/97-003 CCDP conditional core damage probability CDP core damage probability DHR decay heat removal EFW emergency feedwater HPI high-pressure injection IPE Individual Plant Examination LDST letdown storage tank LOCA loss-of-coolant accident LOOP loss of offsite power LPI low-pressure injection LPR low-pressure recirculation MDP motor-driven pump MFW main feedwater MLOCA medium-break loss-of-coolant accident MOVs motor-operated valves NPSH net positive suction head RB reactor building RCP reactor coolant pump RCS reactor coolant system RHR residual heat removal RT reactor trip SG steam generator SGTR steam generator tube rupture SLOCA small-break loss-of-coolant accident SSF safe shutdown facility TDP turbine-driven pump References 1. Licensee Event Report 287/97-003, "High Pressure Injection System Inoperable due to Design Deficiency and Improper Work Practices," June 2, 1997.
2. Licensee Event Report 270/97-001, "Unisolable Reactor Coolant Leak due to Inadequate Surveillance Program," May 21, 1997.
3. J. W. Minarick, et. al., Precursors to Potential Severe Core Damage Accidents: 1991, A Status Report, NUREG/CR-4674, Vol. 16, September 1992, p B-47.
4. NRC Augmented Inspection Team Report 269/97-06, 270/97-06, 287/97-06, May 30, 1997.
5.
Oconee Nuclear Station Units 1, 2, and 3, IPE Submittal Report, Rev. 1, December 1990.
LER No. 287/97-003 6. W. B. Cottrell, et. al., Precursors to Potential Severe Core Damage Accidents: 1980-1981, A Status Report, NUREG/CR-3591, Vol. 2, February 1984, p. B-126.
7. R. J. Belles, et. al., Precursors to Potential Severe Core Damage Accidents: 1994, A Status Report, NUREG/CR-4674, Vol. 21, December 1995.
- LER No. 287/97-003
- II rig CI
Fig. 1. Flow diagram of the emergency core cooling system at Oconee 3 (source: Oconee 3 Final Safety Analysis Report).
- e LER No. 287/97-003
8 6 8 8 8 8 8 Fig. 2. Domninant core damnage sequence for LER No. 287/97-003.
LER No. 287/97-003 Table 1. Definitions and Probabilities for Selected Basic Events for LER No. 287/97-003 Modified Event Base Current for this name Description probability probability Type event IE-LOOP Initiating Event-Loss of Offsite 2.8 E-006 2.8 E-006 No Power (LOOP)
IE-MLOCA Initiating Event-MLOCA 8.1 E-008 8.1 E-008 NEW Yes TE-SGTR Initiating Event-SGTR 1.3 E-006 1.3 E-006 No IE-SLOCA Initiating Event-SLOCA 6.5 E-007 6.5 E-007 No IE-TRANS Initiating Event-Transient 7.7 E-004 7.7 E-004 No DHR-HTX-CF-ALL Common-Cause Failure of the 5.2 E-004 5.2 E-004 No DHR Heat Exchangers EFW-AOV-CF-FCV Common-Cause Failure of the 3.7 E-005 3.7 E-005 No Emergency Feedwater (EFW)
Flow-Control Valves EFW-PMP-CF-ALL Common-Cause Failure of the 1.8 E-004 1.8 E-004 No EFW Pumps EFW-PSF-VF-MDP Failure of the Upper Storage 2.3 E-004 2.3 E-004 No Tank Supply Line to the Motor Driven Pumps (MDPs)
EFW-PSF-VF-SGA Failure of the Flow Control Path 2.3 E-003 2.3 E-003 No to Steam Generator (SG) A EFW-PSF-VF-SGB Failure of the Flow Control Path 2.4 E-003 2.4 E-003 No to SG B EFW-TDP-FC-TDP Hardware Failures in the EFW 3.2 E-002 3.2 E-002 No Turbine-Driven Pump (TDP)
Train EFW-XIHE-MDPSUP Operator Fails to Switch Over the 1.0 E-003 1.0 E-003 No EFW MDPs to the Hotwell EFW-XHE-NOREC Operator Fails to Recover EFW 2.6 E-001 2.6 E-001 No EFW-XHE-NOTHROT Operator Fails to Throttle EFW 5.0 E-003 5.0 E-003 No Flow EFW-XHE-TDPSUP Operator Fails to Switchover the 5.0 E-002 5.0 E-002 No EFW TDPs to the Hotwell
LER No. 287/97-003 Table 1. Definitions and Probabilities for Selected Basic Events for LER No. 287/97-003 (continued)
Modified Event Base Current for this name Description probability.
probability Type event EFW-XIE-THROT-L Operator Fails to Throttle EFW 5.0 E-003 5.0 E-003 No Flow during a LOOP LDST-LVL-LOW Low Water Level in the LDST 4.4 E-003 1.0 E+000 TRUE Yes Fails the HPI Pumps LPR-XHE-XM Operator Fails to Initiate LPR 1.0 E-002 1.0 E-002 No MFW-SYS-TRIP Main Feedwater (MFW) System 2.0 E-001 2,0 E-001 No Trips MFW-XHE-NOREC Operator Fails to Recover MFW 3.4 E-001 3.4 E-001 No OPE-XHIE-NOREC-6H Operator Fails to Recover Offsite 1.6 E-001 1.6 E-001 No Power within 6 h PCS-VCF-HW Failure of Secondary System 3.0 E-003 3.0 E-003 No Hardware PCS-XHE-XM-CDOWN Operator Fails to Initiate 1.0 E-002 1.0 E-002 No Cooldown PCS-XHE-XM-FDEPR Operator Fails to Initiate Fast 1.0 E-00 1 1.0 E-001 NEW Yes Depressurization for LPI PCS-XHE-XO-SEC Operators Fail to Establish 2.0 E-001 2.0 E-001 No Secondary Cooling PCS-XHE-XO-SECL Operators Fail to Establish 3.4 E-001 3.4 E-001 No Secondary Cooling during a LOOP SSF-NO-START SSF Fails to Operate 2.0 E-001 2.0 E-001 No
LER No. 287/97-003 Table 2. Sequence Conditional Probabilities for LER No. 287/97-003 Conditional Event tree Sequence core damage Core damage Importance Percent name number probability probability (CCDP-CDP)
contribution'
(CCDP)
(CDP)
MLOCA
2.9 E-006 1.3 E-008 2.8 E-006 65.6 SLOCA
8.9 E-007 3.9 E-009 8.8 E-007 20.4 MLOCA
2.7 E-007 1.2 E-009 2.7 E-007 6.2 LOOP
2.2 E-007 9.7 E-010 2.2 E-007 5.1 LOOP
7.2 E-008 3.1 E-010 7.1 E-008 1.7 SLOCA
6.1 E-008 2.7 E-010 6.1 E-008 1.4 TRANS
6.0 E-008 2.6 E-010 6.0 E-008 1.4 Total (all sequences)
5.4 E-006 1.1 E-006 4.3 E-006
'Percent contribution to the total importance.
Table 3. Sequence Logic for Dominant Sequences for LER No. 287/97-003 Event tree Sequence Logic name number MLOCA
/RT, /HPI, HPI-LATE, FASTDEPR SLOCA
/RT, /EFW, /HPI, COOLDOWN, HPI-LATE, FASTDEPR MLOCA
/RT, /HI, HPI-LATE, /FASTDEPR, /LPI, LPR LOOP
/RT-L, /EP, EFW-L, /PRVL-RES, SSF, /OP-6H, /HPI-C-L, SGCOOL, HPI-LATE LOOP
/RT-L, /EP, EFW-L, /PRVL-RES, SSF, OP-6H, /HPI-C-L, SGCOOL-L, HPI-LATE SLOCA
/RT, EFW, MFW, /SSF, /HPI, HPI-LATE
LER No. 287/97-003 TRANS
/RT, EFW, MFW, SSF, /HPI-COOL, SGCOOL, HPI LATE Table 4. System Names for LER No. 287/97-003 System name Logic COOLDOWN RCS Cooldown to DHR Pressure Using Turbine-Bypass Valves, etc.
EFW No or Insufficient EFW Flow EFW-L No or Insufficient EFW Flow during a LOOP EP Loss of all Emergency ac Power FASTDEPR RCS Cooldown to LPI Pressure Using Turbine-Bypass Valves, etc.
[PI No or Insufficient [PI System Flow HPI-C-L Failure of HPI Cooling during a LOOP HPI-COOL Failure to Provide [PI Cooling HPI-LATE
[PI Fails Late LPI No or Insufficient LPI LPR No or Insufficient LPR MFW Failure of the MFW System OP-6H Operator Fails to Recover Offsite Power Within 6 h PRVL-RES Power-Operated Relief Valves and Block Valves Fail to Reseat (Electric Power Succeeds)
RT Reactor Fails to Trip during Transient RT-L Reactor Fails to Trip during LOOP SGCOOL Failure to Recover Secondary Cooling SGCOOL-L Failure to Recover Secondary Cooling when Offsite Power is Unavailable SSF SSF Fails to Operate
LER No. 287/97-003 Table 5. Conditional Cut Sets for Higher Probability Sequences for LER No. 287/97-003 Cut set Percent number contribution CCDPa Cut setsb MLOCA Sequence 6 2.9 E-006
97.4 2.8 E-006 LDST-LVL-LOW, PCS-XHE-XM-FDEPR
2.9 8.5 E-008 LDST-LVL-LOW,PCS-VCF-HW SLOCA Sequence 10 8.9 E-007
75.0 6.8 E-007 LDST-LVL-LOW, PCS-VCF-HW
25.0 2.2 E-007 LDST-LVL-LOW, PCS-XHE-XM-CDOWN, PCS-XHE-XM-FDEPR MLOCA Sequence 4 2.7 E-007
92.0 2.5 E-007 LDST-LVL-LOW, /PCS-VCF-HW, /PCS-XHE-XM-FDEPR, LPR-XHE-XM
4.8 1.3 E-008 LDST-LVL-LOW, /PCS-VCF-HW, /PCS-XHE-XM-FDEPR, DHR-HTX-CF-ALL LOOP Sequence 34 2.2 E-007
98.4 2.2 E-007 EFW-XHE-THROT-L, SSF-NO-START, /OEP-XHE-NOREC-6H, I
LDS T-LVL-LOW, PCS-XHE-XO-SEC LOOP Sequence 39 7.2 E-008
98.4 7.1 E-008 EFW-XHE-THROT-L, SSF-NO-START, OEP-XHE-NOREC-6H, LDST-LVL-LOW, PCS-XHE-XO-SECL SLOCA Sequence 33 6.1 E-008
98.4 6.1 E-008 EFW-XHE-NOTHROT, MFW-SYS-TRIP, MEW-XHE-NOREC, I
/SSF-NO-START, LDST-LVL-LOW TRANS Sequence 43 6.0 E-008
55.2 3.3 E-008 EFW-PMP-CF-ALL, EFW-XHE-NOREC, MEW-SYS-TRIP, MFW-XHE-NOREC, SSF-NO-START, LDST-LVL-LOW, PCS-XHE-XO-SEC
15.5 9.2 E-009 EFW-XHE-TDPSUP, EFW-XHE-MDPSUP, EFW-XIHE-NOREC, MFW-SYS-TRIP, MFW-XHE-NOREC, SSF-NO-START, LDST-LVL-LOW, PCS-XHE-XO-SEC
LER No. 287/97-003 Table 5. Conditional Cut Sets for Higher Probability Sequences for LER No. 287/97-003 (Continued)
Cut set Percent number contribution CCDPa Cut setsb
11.5 6.8 E-009 EFW-AOV-CF-FCV, EFW-XIHE-NOREC, MFW-SYS-TRIP, MFW-XHE-NOREC, SSF-NO-START, LDST-LVL-LOW, PCS-XHE-XO-SEC
9.9 6.1 E-009 EFW-TDP-FC-TDP, EFW-XHE-MDPSUP, EFW-XHE-NOREC, MFW-SYS-TRIP, MFW-XHE-NOREC, SSF-NO-START, LDST-LVL-LOW, PCS-XHE-XO-SEC
3.5 2.1 E-009 EFW-XHE-TDPSUP, EFW-PSF-VF-MDP, EFW-XHE-NOREC, MFW-SYS-TRIP, MFW-XHE-NOREC, SSF-NO-START, LDST-LVL-LOW, PCS-XHE-XO-SEC
2.3 1.4 E-009 EFW-TDP-FC-TDP, EFW-PSF-VF-MDP, EFW-XHE-NOREC, MIFW-SYS-TRIP, MFW-XHE-NOREC, SSF-NO-START, LDST-LVL-LOW, PCS-XHE-XO-SEC
1.7 1.0 E-009 EFW-PSF-VF-SGA, EFW-PSF-VF-SGB, EFW-XHE-NOREC, MFW-SYS-TRIP, MFW-XHE-NOREC, SSF-NO-START, LDST-LVL-LOW, PCS-XHE-XO-SEC Total (all sequences)
5.4 E-006 aThe CCDP is determined by multiplying the probability that the portion ofthe sequence that makes the precursor visible (e.g., the system with a failure is demanded) will occur during the duration of the event by the probabilities of the remaining basic events in the minimal cut set. This can be approximated by 1 -e*, where p is determined by multiplying the expected number of initiators that occur during the duration ofthe event by the probabilities ofthe basic events in that minimal cut set. The expected number ofinitiators is given by?'t, where X is the frequency of the initiating event (given on a per-hour basis), and t is the duration time of the event (340 h). This approximation is conservative for precursors made visible by the initiating event. The frequencies of interest for this event are A = 8.15 x 10'/h, and ISLOCA = 6.52 x 10 '/h. The importance is determined by subtracting the CDP for the same period but with plant equipment assumed to be operating nominally.
'Basic event LDST-LVL-LOW is a type TRUE event. This type of event is not normally included in the output of the fault tree reduction process but has been added to aid in understanding the sequences to potential core damage associated with the event.
- g LER No. 287/97-003 LER No. 2 87/97-003 Event Description:
Two high-pressure injection pumps were damaged because of a low water level in the letdown storage tank Date of Event:
May 3, 1997 Plant:
Oconee 3 Licensee Comments Reference:
Letter from W. R. McCollum, Jr., Site Vice President, Oconee Nuclear Site, to U. S. Nuclear Regulatory Commission, "Review of Preliminary Accident Sequence Precursor Analysis of Operational Event at Oconee Nuclear Station - LER No. 287/97-003," May 27, 1998.
Comment 1:
The estimated conditional core damage probability (CCDP) calculated by the Nuclear Regulatory Commission (NRC) for this event (3.3 x 10-') is lower than but in the same range as the value calculated by Duke using the current model of the Oconee probabilistic risk assessment (PRA) (8.8 x 10-').' There are some differences in the way these values were calculated, as addressed below.
Comment la: The fraction of time that was assumed for the high-pressure injection (HPI) pumps to be vulnerable to failure as a result of low letdown storage tank (LDST) level differs between the two analyses. The NRC assumed that for 20% of the time between February 22 and May 3, the LDST level was low enough to cause failure of the HPI pumps had they been needed to mitigate a loss-of-coolant accident (LOCA). This was determined from a simplified model of LDST level and pressure as a function of LDST reference leg level during a draw down of the borated water storage tank (BWST). The Duke analysis simply assumed the HPI system to be vulnerable to failure for 50% of the time between February 22 and May 3.
Response la:
The difference in analysis assumptions is acknowledged. In fact, if the preliminary analysis assumed that the HPI system was vulnerable to failure 50% of the time between February 22 and May 3, the calculated CCDP would be very close to the CCDP calculated by Duke.
Enclosure 2
LER No. 287/97-003 Comment lb: The NRC analysis assumes two separate independent recoveries for small LOCAs,
PCS-XHE-XM-CDOWN, which addresses the failure ofthe operators to depressurize the unit and initiate the residual heat removal (RHR) system prior to HPI failure,
PCS-XHE-XM-FDEPR, which addresses failure to depressurize to low-pressure injection (LPI) system pressure following loss of HPI.
Duke assumed only one potential recovery.
Response 1b:
The difference in the two operator actions is described in the fourth paragraph under Modeling Assumptions. Note that PCS-XHE-XM-CDOWN is not a recovery action; it addresses the potential to cool down and place the unit on decay heat removal (DHR) prior to the need for sump recirculation following a small-break LOCA.
Comment 1c:
Duke assumed that it would be possible to depressurize the primary system and initiate DHR using the LPI system for medium-size LOCAs. This was applied as a "recovery" event for cut sets where both steam generator cooling and the LPI system were available. The NRC did not take credit for this potential recovery.
Response 1c:
The medium-break LOCA model has been revised to address the potential use of fast depressurization, LPI, and low-pressure recirculation if HPI were to fail late in the injection phase. This is consistent with recovery actions included in the Oconee Individual Plant Examination (IPE) report.
Comment 2:
The sensitivity analysis that considers the combined effect of the Unit 3 LDST reference leg leak and the Unit 2 HPI injection nozzle weld leak (LER No. 270/97-00 1) is not appropriate and adds no value to the analysis of the Unit 3 event. As discussed in the Duke letter of February 24, 1998, in response to the Preliminary Accident Sequence Precursor (ASP)
Analysis of LER No. 270/97-001, the precursor treatment of the Oconee 2 HPI injection nozzle leak event is inappropriate. Superimposing this event on another unit's condition introduces additional extrapolations and produces questionable conclusions. Duke suggests that this sensitivity discussion be deleted.
LER No. 287/97-003 Response 2:
The sensitivity analysis has been retained in the analysis of this event. Exploration of the potential impact of a combined event involving an HPI line leak and HPI pump failures is reasonable, considering the timing of the two actual events. The response to comments on the precursor analysis of LER No. 270/97-001 addresses Duke comments on that event.
Comment 3:
In conclusion, the NRC's analysis of the Oconee event reported in LER No. 287/97-003 appears to have several differences from the Duke analysis of the same event. However, these are understandable differences in assumptions, and neither analysis appears to be in error.
Even with these differences, both the NRC and Duke analyses concluded that the CCDP was in the range of 3 x 10' to 8 x 10-' and that the CCDP is above the precursor threshold.
Response 3:
The ASP analysis of LER No. 287/97-003 has been revised as described in the response to Comments 1 and 2. While this has resulted in a decrease in the CCDP estimated for the event from the preliminary analysis, it still satisfies the criteria for a precursor.
3