ML15224A183

Forwards Preliminary ASP Evaluation of Util LOOP Event Which Occurred 921019

ML15224A183
Person / Time
Site:	Oconee
Issue date:	02/17/1993
From:	Wiens L Office of Nuclear Reactor Regulation
To:	Hampton J DUKE POWER CO.
References
NUDOCS 9302230137
Download: ML15224A183 (24)

Text

Docket Nos. 50-269, 50-270 and 50-287 Mr. J. W. Hampton Vice President, Oconee Site Duke Power Company P. 0. Box 1439.

Seneca, South Carolina 29679

SUBJECT:

PRELIMINARY ACCIDENT SEQUENCE PRECURSOR (ASP) ANALYSIS OF THE OCONEE LOSS OF POWER EVENT Enclosed for your information is a preliminary ASP evaluation of the Oconee Unit 2 Loss of Offsite Power (LOOP) event which occurred October 19, 1992.

Your input on this analysis would be appreciated, particularly regarding the characterization of the plant equipment status and the analysis assumptions.

A copy of the final ASP.evaluation will be sent to you after issuance.

If you have questions regarding this matter, contact me at (301) 504-1495.

Sincerely, Leonard A. Wiens, Project Manager Project Directorate 11-3 Division of Reactor Projects-I/II Office of Nuclear Reactor Regulation

Enclosure:

ASP Evaluation cc w/enclosure:

See next page DISTRIBUTION:

CD tEi3Ii aeJ DMatthews NRC & Local PDRs LWiens PDII-3 R/F LBerry Oconee R/F OGC, 15B18 SVarga ACRS (10), P-135 GLainas EMerschoff, RH OFFICE PDII-3/

PD D

NME L.

BERRW LWIENS:CW DM THEWS DATE 9k/ )193 7/

93

/93 OFFICIAL RECORD COPY FILE NAME:

G:\\OCONEE\\ASPREV 9302230137 930217 PDR ADOCK 05000289 PD_

PDR

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D. C. 20555 Docket Nos. 50-269, 50-270 and 50-287 Mr. J. W. Hampton Vice President, Oconee Site Duke Power Company P. 0. Box 1439 Seneca, South Carolina 29679 Dear Mr;' Hampton.

SUBJECT:

PRELIMINARY ACCIDENT SEQUENCE PRECURSO4 (ASP ANALYSIS QFjHE OCONEE LOSS OF POWER EVENT Enclosed ft your'tnfbrmatfon is a preliminary ASP evaatfeV of theOconee Unit 2 Loss*of Offsite Power (LOOP) event which occurredOctober 19,"1992.

Your input on this analysis would be appreciated, particularly regarding the characterization of the plant equipment status and the analysis assumptions.

A copy of the final ASP evaluation will be sent to you after issuance.

If you have questions regarding this matter, contact me at (301) 504-1495.

Sincer ly, Leonard A. Wiens, Project Manager Project Directorate 11-3 Division of Reactor Projects-I/II Office of Nuclear Reactor Regulation

Enclosure:

ASP Evaluation cc w/enclosure:

See next pag

Mr. J. W. Hampton Duke Power Company Oconee Nuclear Station cc:

Mr. A. V. Carr, Esquire Mr. M. E. Patrick Duke Power Company 422 South Church Street Comp Charlotte, North Carolina 28242-0001 Oconee Nuclear Site P. 0. Box 1439 J. Michael McGarry, III, Esquire Seneca, South Carolina 29619 Winston and Strawn 1400 L Street, NW.

Mr. Alan R. Herdt, Chief Washington, DC 20005 Project Branch #3 U. S. Nuclear Reg;iglatory Commission, Mr. Robert B. Borsum 101 Marietta Street, NW. Site 2900 Babcock & Wilcox Atlanta, Georgia 30323 Nuclear Power Division Suite 525' Ms. Karen:E. Long 1700 Rockville Pike.

Assistant.Attorney General Rockville,.Maryland 20852 North Carolina Department of Justice Manager, LIS P. 0. Box 629 NUS Corporationf Raleigh, North Carol ina-7602 2650 McCormick Drive, 3rd Floor Clearwater, Florida 34619-1035 Mr. G. A. Copp Senior Resident Inspector Licensingr Coa U. S. Nuclear.Regulatory Commission P. 0. Box 1006 Route 2, Box 610 Charlotte, North Carolina 28201-1006 Seneca, South Carolina 29678 Regional Administrator, Region II U. SS.

Nuclear Regulatory Commission 101 Marietta Street, NW.

iutite 292Q Atlanta, Georgia 30323 Mr. Heyward G. Shealy, Chief Bureau of Radiological Health South Carolina DepartmentDtf Health and Environmental Control 2600 Bull Street Columbia, Soutk..Carolina 29201 Office of Intergovernmental -Relations 116 West Jones Street Raleigh, North Carolina 27603 County Supervisor of Oconee County Walhalla, South Carolina 29621

SAIC 275/309 PAGE. oz PRELIMINARY ACCIDBM SEQUENCE PRECURSOR PROGRAM EVENT A.. LYSIS LER No.:

270/92-004 Event

Description:

Lss of offsite power with failed emergency power Date:

October 19, 1992 Plant:

Oconee2 Summary Use of a poorly designed switchyard battery replacement procedure resulted In a lockout of the Oconce 230-kV switchyard, a reactor trip and loss of offsite power (LOOP) at Unit 2, and unavailability of power to the startup transformers for Units I and 3. An operator error at the Keowoo hydro station, the emergency power source for th ree Oconce units, caused a loss of all auxiliary power to both hydro units. Auxiliary power was recovered one-half hour later, when an on-call technician arrived at Keowee. If auxiliary power had not been quickly recoveredr govenor and wicket gate control for the hydro units would have been lost. Problems were alse eaperienced with the emergency feedwater (EFW) system because of water in the turbine-drives pump steam line, instrument air (IA) (which could have resulted in a trip with LOOP on Oconee 1 and 3), the standby shutdown facility (SSF), and numerous unexpected electric power system responses during recovery from the event The emergency power system, turbine-driven EFW pump, and SSP are the primary features available to protect against core damage due to station blackout following a LOOP.

The conditional core damage probability estimated for this event is 3.0 x 10-3. The relative significance of this event compared to other postulated events at Oconee is shown below.

LUR ZT2404 1-7 P4

1.

14 18.3 1M-2 I

I I

I I

I

+a LInoP(ainaloLd34k*

I iAtrREFW p360 h EFW

• nwrgewy powe fM= probdsaity from Keowee d"s, LOOP (nominal) = 2.2E-5 LOFW + 1 MTR EFW - 5.3E-6 360 h EFW a 2.2B-5 360 h EP 5.0E-4 OflF IAAIlADv

JAN 28 '93 16:27 SAIC 275/309 SPAGE.83 PRELIMINARY Event Descriptls On October 19, 1992, Oconee 2 was operating at 100% power. Keowee Hydro Unit 1 (Keowee 1), one of the emergency power sources for the three Oconee units, was supplying power to the grid via the overhead power path (see Fig. 1). Keowee 2 was shutdown and was aligned to provide emergency power via the underground path. Replacement of the 230-kV switchyard batteries was in progress -

battery SY-2 and charger SY-2 were disconnected, switchyard DC buses SY-DC-1 and SY-DC-2 were cross-tied, and charger SY-1 and battery SY-1 were powering both buses (see Fig. 2).

A point had been reached during the battery replacement when charger SY-2 was to be reconnected to its bus and the two buses separated. Ths alignment was allowed by the battery replacement procedure. Once this was done, bus SY-DC-2 would be powered only by its charger. Battery SY-2, which was normally connected to the bus, would remain unconnected. This highly unusual alignment (which can subject a bus to large voltage fluctuations because of battery charger instability) had been used between October 612,1992, when battery SY-1 was replaced, without any complications. The Oconee 1 Unit Supervisor went to the switchyard relay house with several technicians to perform the procedure steps to reconnect the charger and separate the DC buses. He connected the charger to the bus and then, at 2121 hours0.0245 days <br />0.589 hours <br />0.00351 weeks <br />8.070405e-4 months <br />, opened the tie breaker to separate the two switchyard DC buses. Within the next several seconds a switchyard lockout. Oconee 2 trip, Keowee 1 normal trip, and emergency start of both Keowee units occurred. The Unit Supervisor suspected that his actions had initiated the event, and "backed out" of the procedure by reclosing the switchyad DC bus tic breakers and opening the breaker from the SY-2 charger.

The 230-kV switchyard lockout was a result of a voltage transient on switchyard DC bus SY-DC-2 caused by charger SY-2. Bus SY-DC-2 powered the breaker failure circuits for all of the 230-kV switchyard breakers. Breaker failure circuitry is designed to actuate an AR relay and trip adjacent breakers after a time delay if a faulted breaker fails to trip. 71h breaker failure circuitry employed a zener diode as a urge protesar in a design which caused curcat to flow through the breaker AR relay coil when dh anner diode conducted (perfarmed its protecdve ftction). The relays had been identified as susoepdble to spurious operation due to excessive voltages in 1980, but were never modified. ThARs alay fr power circuit breakar (PCB)-24 was the first to actuate on the Yellow 230-kV Bus. t snlay tripped PCB-23 and Initiated a Yellow Bus lockout, which tripped PCBs 9,12,15,18,21,24.27, and 30. A lockout also occurred on the Red Bus, and tripped PCBs-4, 7, 10, 13, 16, 19,22,26, and 28. PCBs-31 and 33 were tagged open to support maintenance and did not trip. All of the PCBs are shown in Fig. 1.

Actuation of the AR relay in PCB-24 also caused an Oconee 2 generator transformer lockout, which resulted in a turbine and reactor tip. With PCBs-26 and 27 open and the reactor tripped, Oconee 2 had no source of offsite power available. The Extenal GridProtecive System sensed the loss of voltage and frequency on the Yellow and Red Buses (which indicated a LOOP and generated a Switchyard Isolation signal. Tis signal tripped PCBs-8, 9 and 17, loadshed Keowee 1, and gave an emergency start signal to both Keowee units. Oconee I and 3 continued to operate.

JAN 28 4 1S:28 SAIC 275/30S PAGE.84g PRELIMINARY but with PCBs17 and 26 open, neither unit would have bad a soome of offaite power it it had tripped. (T1hi alont happened on Unit 1, as described law.)

Keowee 2 emergency started on the Switchyard Isolation signaL Non-essential Oconee 2 loads were shed and Oconee 2 main feeder buses were reenergized via transformer C-4. This provided power to essential loads via the underground power path.

The Keowee operator was in the turbine room when the event began. When he returned to the Keowee control room he observed asitiple aarms but failed to observe an alarm indicating that an emergency start signal existed. He noted that Keowee 1 was operating with no load, concluded that the hydro unit might be in danger of failing, and manually tripped output breaker ACB-i (see Pig. 3). With ACB-1 tripped, the Keowee auxiliary bases IX and 2X anempted to transfer to their alternate power soume, transformer CX (which is powered from Ocone 1 switchgear ITC-4). A bus lockout was received on auxiliary bus 1X (apparently caused by rapid and repeated breaker opeations during the event as a result of dirty and misaligned time-delay relay contacts), which prevented ACB-7 from closing. Bus IX remained deenergized. ACB-failed to close (because of a high resistance on a close permissive contact) and auxiliary bus 2X remained deenergized as well. Loss of these two buses resulted in loss of all auxiliary power to the Keowee units. The Keowee controlroom lights went off, the annunciator panels went dark, and the telephone connection to Oconee and the alarm typer were lost (the computer rmained operable). A Keowee main transformer lockout also occurred, which prevented reclosure of ACB-L At this point, the Keowee operator realized Keowee 2 was starting and that an emergency start had occurred. The Keowee units continued to operate with their control functions supplied by batteries.

Unavailability of Keowee auxiliary power prevented makeup to the hydraulic oil accumulator tanks. These accumulators provide the oil to operate the governor and wicker gates to control turbine speed and generator output. Keowee can operate up to about one hour, depending upon load changes, without auxiliary power before governor and wicket gate control becomes unavailable The Oconee 2 turbinduiven EPW pump started automatically following the LOOP and reactor trip. Within a faw monds EPW flow dropped to zero for 3-5 see, and then returned to normal.

The loss of flow was the result of water in the auxiliary steam supply line to the turbine-driven EFW pump turbiae caused by a faulty steam trap. As the turblae-driven pump picked up flow again, power was restored (Keowee 2 start and load) and both motor-driven BFW pumps started as well.

About one min after the LOOP, alarms were received on Oconee 1 and Oconee 2 Indicating low pressure in the IA system. The Oconee primary IA compressor is powered from the switchyard and lost power when the Red Bus lockout occurred. The backup IA compressor powered from Unit 2 was load-shed and could not automatically start. While two other backup IA compressors (powered from Oconee 1) did start, they were unable to maintain IA prssure. A diesel-powered IA compressor was locally started at Oconce 3 and a loss of IA was averted. A loss of IA would PRF1 IMINARY

JAN 28 '93 16:2S SAIC 275/309 PAGE.8*

PRELIMINARY have caused a o M feedwater controlend loss of control rod duive mchanism cooaling at Ocone 1 and resulted in a ra atit unit. If that had occurred, offsite power would not have been available to Unit 1, either.

Several minutes after the loss of auxiliary power at Keowee, the Keowee operator contacted the Duke System Dispatcher in Charlotte via a dedicated phone line, which was still in service. The dispatcher was requested to call the Keowee on-call technician to conito the site. Ie dispatcher was also able to connect the Goone control room to Keowee via the dispatcher phone line. The Keowee operator discussed the status of Keowee with the Oconee 2 Unit Supervisor (it appears that the Keowee operator did not adequately describe the ramificadons of the lossbf auxiliary power), and the Unit Supervisor Instructed him not to take any action involving Keowee 2, since it was supplying the Oconee 2 main feeder buse4 The Ireowee operator then monitored the operadon of thehydro units and awaited the arrival of the on-call technician-MeaWhl, because of problems at Keowet the Oconee Operations ShigSupervisor and he'dispatcher decided to try to quickly restore the switchyard. The dispatchahad confirmed that there was no indication of faults or breaker acmeraon outside the switchyard, and it was deckled to sidp the lengthy checkout of equipment required by the Loss of Power Abnormal Procedum The on-call technician arrived in the Keowee control room at 2150 hours0.0249 days <br />0.597 hours <br />0.00355 weeks <br />8.18075e-4 months <br />, about 30 min after the event sarted. The most immediate problem was the restoration of auxiliary pfwer so that hydraulic oil for wicket gate and governor control could be made up to the accumulators. The normal oil level in the accuulator sight-glass is 48 in; when the on-call technician arrived, the level in both accumulators was 4-8 in.

Using the Charlottv dispatcher's phone, the Keowee on-call technician, the dispatcher and the Oconee 2 Unit Supervisor decided to attempt to reset the Keowee main transformer lockout and also have personnel at the Lee Steam Station start a combustion turbine and establish a dedicated line from IE to Ocone.* 1h Keowee on-call technician reset the transformer lockout at 2158 hours0.025 days <br />0.599 hours <br />0.00357 weeks <br />8.21119e-4 months <br />. Thlis allowed ACB-1 to close automadcally which, in turn, allowed Keowee 1 (which had been running with a load) o energin the transforme. Tle normalsupply breaker to the Keowe 2X load coolor (ACB-6) then closed, restoring auxiliary power to Keowee 2. Auxiliary power to Keowe 1 was sestod 8 min later, aft resettingi local lockout at breaker ACB.7.

At 2200 houts, the Oconee 1 Unit Supervisor reset the Red and Yellow Bas lockouts from the switchyard. The Red Bus was reenergized from offsite power at 2213 h by closing PCB-10. By 2218 hours0.0257 days <br />0.616 hours <br />0.00367 weeks <br />8.43949e-4 months <br />, power had been restored to the Unit 2 startup transformer from the Red Bus. Some difficulty was experienced with breaker operation because of the existing Switchyard Isolation signal, which had not been cleared. At 2221 hours0.0257 days <br />0.617 hours <br />0.00367 weeks <br />8.450905e-4 months <br />, a dedicated line was available from a Lee combustion turbine.

Both the dispeeher aMd de Unit Supervisor were awam ofpmbles at Kowne 20 Min caitier, during their ir telephone call.

JAN 29 '93 :30 SAIC 275/389 PAGE.96 M

PRELMINARY One result of teleaker operadon associated with not clearing the Switchya d

a Isnladl signal was the repowering of the Yellow Bus from Keowee 1. Because Keowee I was not syachrooked to the grid, a decision was made to shut down Keowee I and repower the Yellow Bus from the Red Bus prior to resorng power to the Oconee 1 and Oconee 3 startup transfouners.

The single emergency start signal to both Keowee units was reset and Keowee I was shut down at 2251 hours0.0261 days <br />0.625 hours <br />0.00372 weeks <br />8.565055e-4 months <br />. The Yellow Bus decuergied as expected, but Keowee 2 tripped also. The Keowee 2 trip was caused by the undervoltage condition on the Yellow Bus combined with the lack of an emergency start signal; logic determined that Keowee 2 was generating to the grid with no output and tripped the unit The logic did not consider that Keowee may be supplying power via the underground feeder. The Keowee 2 trip deenergized the underground feeder, the standby buses, and die Ooanes 2 main feeder buses. After a 31 se tim delay, the standby braeakespped open and,e startup breakera closed to restore power to the main feeder boag.

The deenergizadon of the main feeder buses generated a second Keowee emergency start signal.

Keowee 1 started, but did not close into the Yellow Bus because a Switchyard Isolation Inidation signal was not generated -

the Red Bus was still powered. This response was expdcte&

Keowee 2 did not respond as expected. After the trip, it began to slow down. The emergency start signal initiated a restart prior to resetting a speed switch in the field breaker anti-pump circuit.

The speed switch and and-pump circuit prevented the field from energizing and, therefore, kept the genator frm functioning.

At 0018 hours2.083333e-4 days <br />0.005 hours <br />2.97619e-5 weeks <br />6.849e-6 months <br /> the next mornin& both Keowee units were shut down. By 0024 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, Keowee 2 had slowed down enough to reset the speed switch in the fleld flashing circuit. and had been restarted and realigned to transformer C'F-4. At 0041 hours4.74537e-4 days <br />0.0114 hours <br />6.779101e-5 weeks <br />1.56005e-5 months <br />, PCB-8 was closed and the Yellow Bus was reenergized from the Red Bus. he switchyard was restored to its normal alignment by 0057 hours6.597222e-4 days <br />0.0158 hours <br />9.424603e-5 weeks <br />2.16885e-5 months <br />, which also restored power to the startup transformers for Oconce 1 and 3.

It was subsequently determined that the Oconse SSF was degraded as a result of the event 3SF systems provide a backup supply of wa to the steam generators and a backup source or reactor coolant pump (RCP seal lUjection and teactor coolant makeup sufficient to maintain natural circulation coolag. Normal power to the SSF is fed from Oconee 2 and was lost following the LOOP. The 8F diesel generator was apparently not started to power SSF loads. This deenergized the baey charger in the SSF and resulted in DC and 120 VAC loads being powered from the SSF battery. The potential problems with the SSF were discovered at 0125 hours0.00145 days <br />0.0347 hours <br />2.066799e-4 weeks <br />4.75625e-5 months <br />, 4 h after the event began. Power was restored to de SSF at 0415 hours0.0048 days <br />0.115 hours <br />6.861772e-4 weeks <br />1.579075e-4 months <br />. T condition of the SSF DC and 120 VAC electrical systems was not described. he utility stated that a spare battery was included in the SSF DC power system and could have been aligned if required.

Numerous equipment Inspections, necessary repairs, and procedure modifications took place after the event. A Keowee abnormal procedure was developed to specify operator response following an emergency start. Before this event, no specific procedure existed for verifying or responding to an emergency start of the Keowee units. The Keowee Hydro Station organization was realigned to PPf If lAlNIAUV

JAN 28 '93 16:31 SAIC 25/309 -

aG PRELIMINARY report to the Nucle Generadion Department afw the event It had previously reported to the Hydro Department In addim an Oconee operato was assigned to Keowse to seess wathutandig.

A dedicated phone was installed between the Keowee and Ocone control rooms. Previously, a commercial phone line had been used. Protective logic was revised so that the Keowee units would no longer trip due to undervoltage on the main step-up transformer. A special test was performed to confirm (1) the proper response of Keowee hydro to a simulated switchyad Isolation signal when aligned to the grid and (2) the plementation of an Ocone "live" bus transfer procedure to repower loads from the switchyard. Generally, the Keowee units performed as expected during the test. The Oconee operators had difficulty controlling Keowee 1 while initially tying it to the grid and while paralleling the overhead path to the grid during system restoration after the test, which resulted In Keowee 1 and 2 tripping. In addition, the Keowee operator was unfamiliar with the rssponse required to several annunciators which alarmed during the test.

Additional Event-Related Information All three Oconee units have the same generating capacity (850-MWB net) and similar AC power systems (See Fig.. 1). Output from the Oconee I and 2 generators feed power to the 230-kV switchyard via step-up transformers Ti and T2. The output of Oconee 3 generator feeds the 525 kV switchyard via step-up transformer T3.

t 230-kV and the 525-kV switchyards are divided into two buses designated as the Red Bus and the Yellow Bus. Te switchyards are normally operated with both buses energized through a breakrand-one-half scheme to the grid. The Yellow Bus in the 230-kV switchyard is identified as safety-related. The Keowee hydro station supplies power to the switchyard via an above ground (overhead) path. The overhead path is used to supply power to the Yellow Bus if the grid is lost The operating Ooe units normally provide power to their own auxiliary loads through auxiliary transformers iT, 2T, and 3T. When a unit's gnerator is unavailable, such as following a reactor trip or during outages, electrical power is automatically supplied from the switchyard through its respective stau transformer CF-1, Cr-2, or Cr-3. Though Oconee 3 feeds the 525-kV switchyard, the asoms at power for Its startup transformer is through the 230-kV swilchyard.

The auxiliary power system far each Ocone unit is designed as a dual-train cascading bus system.

There are two 4160 V main feeder buses, MFBI and MFB2, with each supplying power to three 4160 V load buses TC, TD, and TB. Except for the RCPs, all AC is fed ftom these three buses.

The power to MFB1 and MFB2 is supplied by either the unit's auxiliary transformer through the "N" breakers or the startup transformer through the "B" breakers. In addition, MPB1 and MFB2 for each Oconee unit can be energized from the two standby buses (SB1 and SB2), through the "S" breakers. SB1 and SB2 are common to all three Oconee units and can be energized automatically through transformer CT-4, or manually from CT-5. Transformer CT-5 can be supplied from the Le steam station through a dedicated line or from the Central substadon.

JAN 28 '94:31 SAIC 275/399 PAGE.88 PRELIMINARY The Keowee ifye Stadon is located approximately hree-fourths a a mile eas-inortheast of the Ocone Nuclear Station. It consists of two hydroelectric generators rated at 87,500 kVA each, which generate at 13.8 kV. Ts two Keowee hydro units serve the dual funcdons of generaing commercial power to the Duke Power system grid through the Oconee 230-kV switchyard and providing emergency power to the Oconee Station. When a Keowee unit is generating to the grid and an emergency start occurs, it is separated from the 230-kV switchyard and continues to run in standby until needed.

Upon loss of power from an Oconee generating unit and 230-kV switchyard, power is supplied from both Keowee units through two separate and independent paths. One path is a 4000 ft underground 13.8-kV cable feeder to transformer CT-4 which supplies power to the 4160 V standby buses though breakers SKI and SK2. 'IT underground power path is connected at all times to one hydro unit on a predetermined basis by having either ACB*3 or ACB-4 locked closed.

The underground power path and associated transformer are sized to carry fall engineered safeguards auxiliaries of one Oconee unit plus auxiliaries for safe shutdown of the other two units.

If a Keowee unit is to provide power to an Oconee unit through the'underground power path, due to the limited capacity of CT-4, loadshed of non-essential loads from the Oconee units MFBs occurs. Tie second path from Keowee is a 230-kV transmission line through ACB-1 or ACB.2, via the Yellow Bus, to each 0cce= unit's startup transformer.

Keowee auxiliary power (buses lX and 2X) is required for the AC hydraulic oil pumps, along with other loads. These pumps are used to pressurize the air pre-loaded accumulators that provide hydraulic oil pressure to the governor which controls the position (depending on load) of the wicket gates on the Keowee water turbine. The length of time that the Keowee units can run without AC anxiliaries Is limited by the changing load for which the governor must respond. The utility has indicated in several LERs that one hour is the expected maximum time period of Keowee operation without AC auxiliaries.

The normal Kcownc configuration at th timo of the event had ofther Kowoo 1 or 2 available for generation to the grid using the overhead path (via ACE-1 for Keowee I or ACB-2 for Keowee 2).

One unit was also aligned to supply the underground path with emergency power (either ACB-3 or ACB-4 closed).

fth design of the Keowee control circuitry was to provide emergency power to the underground power path fto one unit for all emergency stat situations while providing power to the overhead pah 8m the other unit only if ofaie power was lost.

The Keowee auxiliary buses normally were powered from the overhead path through their respective IX and 2X transformers, the Keowee main step-up transformer, and the 230 kV switchyard. Normal power was supplied to the IX bus through ACB-5 and to the 2X bus through ACB-6 These two load centers also had an alternate power source from the CX transformer that receives power from Oconee I load center ITC Alternate power from the CX transformer for the IX bus was provided via ACB-7 and alternate power for the 2X bus was provided via ACB-8. An automatic transfer scheme would quickly switch these buses to their alternate power supply on loss of normal power. The transfer scheme was designed to be normal DPFI I1IIADV

JAN 29 '93 16:32 SAIC 275/389 PAGE.09(gt PRELIMINARY seeking so if normal power ws restated for about 10 soc, the bus would switch back to the normal supply.

ASP Modeling Assumptions and Approach The event has been modeled as a LOOP at Oconee 2 with failed emergency power and (slightly) degraded emergency feedwater, and as a potential LOOP at Oconee I with failed emergency power if that unit had tripped. Unit 3 appears to have been unaffected by the degraded instrument air system, and was not addressed in the analysis.

Rev of Offsite Power The LOOP was plant-centered. The probability of non-recovery was estimated as described in ORNINRC/LTR-89/1 1. Revised lOP Recovery and PWR Seat LOCA Models, August 1989. For sequences involving the postulated failure of emergency power, long.

term recovery of AC power also considered the potential use of the Lee combustion turbines (p.

ecowry = 0.12) and, in some cases, recovay of the Keowee hydro units, as described below. The potential use of the degraded SSF was not considered In the analysis.

Potential Unit 1 Trip. Unit I would have tripped if instrument air pressure had not bece restored.

Oconee's procedure for loss of IA stipulates the starting of a diesel-driven air compressor on low instrument air pressure, and that was done from Oconee 3 (unaffected by the LOOP) during this event. A probability of 0.1 was assumed for failure to restore instrument air pressure prior to a Unit I reactor trip. If Unit 1 had tripped, it would also have required emergency power from the Keowee hydro units.

Deaed Turbine-Driven B W. Flow from the Oconee 2 turbine-driven EFW pump dropped to zero for 3 - 5 sec shortly after the pump started. The utility stated that this was caused by water accumulation in the auxiliary steam line to the pump turbine, the result of a faulty steam trap.

While the pump remained operable during this event, greater amounts of water could have caused the pump to trip. The failure probability for the turbine-driven EFW pump in the ASP model for Oconee2 was ineasedfom 0.05 to 0.1 to reflect this.

Recvr of KeWeafydra Although Keowee hydro continued to supply power to Unit 2 after auxiliary power was lost, it was assumed in this analysis that the operable Keowee generator would have failed once the supply of hydraulic oil in the accumulator tanks, used for wicket gate positioning, was consumed. When the Keowee on-call technician arved, he was able to quickly reset the locked-out and tripped breakers and restore auxiliary power. However, hydraulic oil was almost depleted at the time he arrived. Because of this, the probability of failing to recover auxiliary power to Keowee prior to loss of hydraulic control oil was assumed to be 0.5. Given auxiliary power was not recovered before hydraulic oil was depleted, Knowee hydro was assumed to be failed, but potentially recoverable in the long term (pn.mwM = 0.34) provided a source of auxiliary power existed. This source was from Oconee 1 via the CX transformer. Therefore, if Oconee 1 tripped and auxiliary power was not recovered prior to loss of hydraulic oil, the failure of Keowee was assumed to be non-recoverable.

Arri 11I41AI A r-lu.

JAN 28 '90 6:33 SAIC 275/309 PAGE.

PRELIMNARY Based an the abv assumptions, the conditional core damage probability for the event was estimated dugh a se of calculations as folows:

Case 1. LOOP at Oconee 2. Trip and LOOP at Oconee I prevented (p - 0.9). Probability of not recovering offsite power In the short term - 0.15 (from ORNI/NRC/LTR-89/1 1). Probability of turbine-driven EFW pump failure = 0.1. Probability of not recovering AC power in the long term

= 0.072 (from ORN1INRCILTR-89/11 with loss of emergency power at -30 min) x 0.12 (failure to provide power from Lee combustion turbines) x 0.34 (failure to recover Keowee hydro after loss of hydraulic oil given auxiliary power available from Oconee 1) = 2.9 x 10*3.

Case 2. LOOP at Oconee 2. Trip and LOOP at Oconee 1 (p = 0.1). Probability of not recovering offaite power in the short term= 0.15. Probability of turbine-driven EFW pump failure (Oconee 2 only) = 0.1.

Probability of not recovering AC power in the long term a 0.072 (from ORNL/NRC/LTR-89/11 with loss of emergency power at -30 min) x 0.12 (failure to provide power from Lee combustion turbines) x 1.0 (failure to recover Keowee hydro after loss of hydraulic oil given auxiliary power not available from Oconee 1) - 8.6 x 10-3.

The results of sensitivity analyses, which considered a greater likelihood of recovering AC power, the potential for continued Keowee operadon, a range of likelihoods for trip of Oconee I and 3, and nominal operation of the EFW system, are described in the next section.

Analysis Results The conditional core damage probability estimated for the event is 3.0 x 10- (0.9 x 2.8 x 10-3 (case 1) + 0.1 x 3.2 x 10-3 (case 2, Oconee 2) + 0.1 x 2.0 x 10-3 (case 2 Oconce 1).

The dominant core damage sequence, highlighted on the following event tree, involves a LOOP on Oconee 2 only with failure to recover emergency power and failure of the degraded turbine-driven EFW pump.

The conditional probability estimate is strongly influenced by assumptions concerning the impending fail= of Keowoo upon los of hydraulic oil, the potential for recovery of Keowee once hydraulic oil is losM and the availability of the LA* combustion turbines as an alternate source of AC power.

Five sensitivity analyses were performed to determine the impact of selected analysis assumptions on the care damage probability estimated for the event. The assumptions and resulting probability estimates follow.

AConditiaPbabiltyI Probability of faillag to provide power from the Lee 2.9 x 10-3 0.97 combustion turbines or the Central Swiwhyard - 0.04 (inusad of 0.12)

PRF IMINAPY

JAN 28 '93 16:34 SAIC 275/399 PGE.!

PRELIMINARY Keowee succoafuly opeaes for one hour (lasead of one-7.7 x 1-0.26 half hour). A probability of non-recovery of 0.125 was estimated, based on an assumed xpoendal non-recovery distribudon with p = 0.5 at 30 min and a minimum on-site arrival time of 15 min.

Keowee 2 operates successfully with hydraulic oil l.5 X I0-0.005 accumulator tanks empty. te utility contended that this would occur as long as there was no significant change in generadng load, and provided a float valve in the bottom of the accumulator tank closed [the base analysis assumed Keowee would fall once hydraulic oil was depleted (- one half hour)].

Probability of falling to recover IA pressure before Oconee 1 3.6 x10-3 1.2 trip a 0.34 (inMead of 0.1)

Probability of filing to recover IA pressure before Oconee 1 2.9 x 10-3 0.97 trip = 0.04 (anstead of 0.1)

Probability of failing to recover IA pressure before Oconee 1 32 x 10'3 1.1 and Oconee 3 trip -0.1 (instead of Oconce I only)

No impact on pump rellability from water In turbinedriven 1.8 x 10-3 0.60 EPW pamp steam line (instead of doubling pump failure probability)

As can be seen from the above cases, different assumptions concerning the iklihood of recovering AC pow ln the long an and the likelihood of a reactor trip fom loss of [A have little impact on the ac a na probability estimated for the event Assuming Keowee could operate for up to an hour whbot auxiliary power reduces the conditional probability by a factor of four - this is to be expecies, considering the dominant sequence. Assuming that the water in die EFW pump steam line had no impact on pump reliability reduces the estimated conditional probability by 40 percent - this is also to be expected, considering the dominant core damage sequence.

A LOOP caused by a similar actuation of breaker failure relays by DC voltage surges occurred at Vermont Yankee on April 23, 1991, during replacement of switchyard batteries (see Precursors to Potential Severe Core Damage Accidentrs: 1991, A Status Report, NUREO/CR-4674. Vol. 16).

The LER reporting the Oconee LOOP noted that the Vermont Yankee event had been evaluated by the Duke Power Operating Experience Program (OEP). That evaluation had concluded that the relay models involved, while similar, were not exactly the same and that the zener diode involved did not exist in the equivalent circuit at Oconee. As a result, the OEP review of the Vermont

JAN 28. 9

35 SAIC 275/389 AGE. 1

-REWMINARY Yankee event that the equivalent portion of the same circuit at Oconce would not fai in the same way Th OEP review did not discover that a different circuit was subject o the same failure mode.

Additional information concerning this event and the post-event Keowee special test is included in NRC Inspection Report Nos. 50-269/92-26. 50-270/92-26, and 50-28792-26.

0CUl I011AAIAn

JAN 29 '93 16:35 SAIC 275/389 PG1

PRELIMINARY Co cc Co OK 47 Co OK 40 AW (1)

OKat am Dorninant

~

~

~

~

~

~~B CoeDCOeSqecefrLR209-0

JAN 29

'93S:3.6 SAIC 275/39PG.4 PRELIMINARY 2309V SWTcYAND Dc FmWE DZSTRXIUTION Ig STE 211E

+

I WA=

CHARM 00A0w Oftvt-S~E R

2.

PR LIIN R

JAN 29 '93 16:36 SAIC.275/399 PAGE. 15*

PRELIMINARY EEo=EB ho STATION AC & DC SYSTnS 003 atS8 U

3m

-rwas Fig. 3 I

R IeAenfv

JAN 29

'93

.37 SI 27/0 PG.I PRELIMINARY rr~

T OW mum+/-

J

+/-.~

ftomA Fig.

1.

P~ri IAIolAD

JAN 28 'S3 16:37.

SAIC 275/30S PAqGE. 1

-~

PRIELIMINARY event Identifiers 270/0*3"#K event Descriptions LOWP asod ein1q powr failuare (ae 1

eveynt Dates I0n/9 plants Oc~fon 2 IWITIMING LVCY MON-RECOVERABIA INI2ZNG EVMI? PRNaMILTIS LOOP1 20 SEOUTJIC CONDITIONAL PRODAILITY SUMS Cnd StatedizaLt Latot Probability Co Total 2.@. -03 LOOP 0.09+

Total0030 sawi= COwoMnoew PRMSII.izz

(?PeOszL:~

goom Leuee end Stato Prob x

e.

55 LO~t -re/looP aEaKEW zaC AW/J01.PM3 Co 2.6P-03

2. GU-02 54 LOP -ct/loop DUM.9OWZR

-Ar*/nERG.P0WE3

-potv.*:.&rv.cft&IL -

CD 1.99-04 7.3c-02 s04.e19ca 3p.R2C

'non-recomery credit for edited case SZQVWCZ CONDITIONAL PROMBAILIU (SEQUfhCE ORDCU Seqweace end State fteb V Ae**

54 LOOP -rt/lao EfMR.?OWR -AFW/ZIMA.'OWSJ

-pory.or.arv.chall cc CO.93-04 7.3L-02.

8641.1oCa 32.REC 55 bor -re/loop aWMa.nouu Arg/Dm.POWCa CD 2.6%-0) 2.S6:42

• nen-recovary credit for ediLted case 3EQUEN IC NOOCLS aas% l3%199 dea.

o BRAMC NOWfLs os ff'UL9Vk 1m@.31 FROASILM ITT L9:

ea%4SpU39%wCurb11.pro fo Recovery Uixi Branch Systems Noa-Uewo 0?

rail trans 2.69-04 1.03.00 event Identifier: 270/92-004 DD171 IIAIKIAflv

JAH 28 S93 J&

8 SAIC 275/309 PAGE. Is, PRELIMINARY LO reach Modml,

=I=&

ZaitUtee "ts 135 o"2.43-00 4.25"t At 233g-0 1.2g"t rtiloop 0.03*00 1.03.0 O30.'0w3 Z.&3-04 V. 1.0300 60 2,3.0"1 Branch models 1.06.24en Train I Cand Probe 2.33 31 Wailed Train 2 Cond Probe 4.7Z-02 2.railed Serial Copee probs 1.43"04 AIW 3.3-Cd

.13-04 2.635"l Branch Models i.ar.Suaor Trine 1 Coed Probe 2.09-C2 Train 2 Coat Probe 1.05-Cl Train 3 Cond Proe 9.015-02 3 1.02-01 Social Ccupaeot Proses

2. 3 4

Branch Modes 1.oV.1 Train 1 COcd Probe 3.09-03 e. 1.03-01 a

2.08-01 3.4"-1 porv-Dr~urv.chuu 2.0"a0 L.03.0 PorT.a.rteoa 1.OZ-02.

1.19-02 p~w~r.sa~ea ay pwr 1.0&-02 1.03.00 aae.Iw0.05400 1.03+00

• p~eef1 ~0.03400 1.09100 RPRC4.5"l0 A. 2.93-03 1.03.0 Branch Models 1.0r.1 Train 1 Coed Probe 4.55-1 3, 2.93-03 h.L

.03-04 6.45401 hpL(1/b) 1.03-04 0.49-01 1.05-02 hpr/-bpi 1.99-041050 1.Oz-oS

• branch modeiL file 6* forced 141narick 01-27-1992 14, 563a20 Event Identifiers 270/92-00 PRFIIMINAPY.

JAN-28

'93 16:39 SAIC 275/309 PRELIMI NARY PG.1 Zvent Idetifiers 270a/2404 Cvont Descriptions LOW.04 mesygsgy poer fallure (caste, 2)

Event Dates 20/10/9m Oconee2 rmnimma2N 3vcul N O-RtCOVEUMLE9 ZI!ZAZMG EVOIT PROBUIL!?13 LOOP SCQUocz CONIIONAL FROWaIrn m~ks end Staealic later ProbabLIlty CD LOOP

.E0 Total

.- 0 LOWP 0.09400 Total 0.0&+00

.swjmC COIUZIZOMAL PPSMZ1AYZS (P~A5ZZT ORDER)

Seqence PFnd State Prob ff Re"&

SS LOOP -rt/loop D43AG.P0W Ar*/CMZf4.P0413 CO Z.CR.03 2.63-02 S4 LO00 -St/Loop Cgmaa.wOWu

-ArW/amao.pOWuA

-purv.oC.SrV.Chall-CD 5.79-04 7.2z-02 aoal.Joca tP.RZC

• O on-recovery credit fee edited case SEQUER CONDIZOMLZ 180UITTZS (SEOUUIC 00033 SQUOUGO Fnd fltAto wrn Roe**

34 L~oO -rt/oap naft.POWM -Mrw/DURO.V0U3

-porv.or.srv.chsLl D

3.7c-04 7.23-02

• eal.looa, C9.R3C 55 LOOP -re/loop inZM.PoMa AVV/i.nOWC CO 2.63-03

2. 63-02

• noa-oovery credit fm editaC em B3om= "usa e~~33w r~e..

PAVS= NOOSP e~a~S9.s~~l PROUDILZTT PILgt 42lawpiqpw bGll -PC*

No ft~awezy Limit

aA3vu FUECIS/PSAZLT1W3 aranch System mon-ascow Opf Pal II trans 2.63-04 i.CCO00 Event Identifier: 270/92-004

JAN.28

'3

9 SAIC 27/0 AE2 PRELIMINARY LW1.48-08 a 1.48-ft 2.48-01 3,IS4 Initiator rzuqa i

lot&

44 4.13-1 it 23-041.22.4 rt/1o 0@.m1020 6M~p.POUU 2.53-04 4.30

.03-01 5.03-01 Breach Hadels 1.0p.3*e6" Train 1 Cand. Probe 2.3"-3 a, failed Train 2 Cond Probe 4.79-02 )o rasied Gai0.1 Compnen Probe 1.4"-4 AM3.63-04 > 4.83-d 2.f1-01 Branch KPod.1

.0t.3*oez Train I 1Coed #rob#

2.03-02 Train 2 Cant Probe 1.03-01 Train 3 Cond Probe S.03-02 D. 1.09-02 Surf.) Cnffp*On~ui Probe 2.42-04 AMVDEjOIM g

5.09-au 3o 1.0o-a 3.49-01 Branch Noal:t 1.0r.1 Train 1 Coed Probe 5.03-02

• 1.09-01 aft 2.03-01 dRa porv.ox.anv.ahalj, 6.03-02 1.09#00 poxv.09.41MV&rSeAIt 1.03-02 1.1"10 Sel.loca 0.03.00 1.03.00 q".mostll 0.09400 1.09+0 31.83 4.5"10 V, S.63-03 1.03.00 Branch "*"Is:

1.0r.1 Train I Coed Probe 4.3"01 V, S. 6"3 hpI.3.03-04 8.48-01 hpilf/bi 3.01C-04 2.49-01 1.09-02' hpu/-bpi 1.53-041.03.06.0=0

• branchb model file finarlok 01-27-1993 Event Zdenslfl..e 270/92-004 DD(71 1 'A I A An%

JAN 28 '93 IS:

39 SAIC 275/309 PAGE.21 PRE LI MINARY Eweat ZdmtLfLer 20cs0 EVeet DeaoxlpLoa: LOW vitb Merge..,

poWQV fAlter. At Gfft0

, ~m EventOa.

10/19/92 P1kLa Oconee I INITIATING EVENT NN-RCCOERABLE INITIATING E'VENT PROBABILITIES LOOP

• LO szQUENC commIToNAL PRo9ABXi Y son Cad Stace/4ZnLtLacox PcobabiLty LOOP q2.C03 Total 2.01-.03 ATNS LOOP 0.03.00 Total.

0.0341 Stanhc CONDOrNAL amommILIUENS (vswsnmrTy rmj NDUS sequence End state rnob Rae 6 55 LOOW -st/Loop 32UM.?oGw aft/mmemq-pt,.

Co 1.39-03 2.61-02 34 LOO /oop D MP.PON3B

-atv/mafire.96ier

-VOav.or.rv.ca.LL CD 7.KO4 1.49-0-2 aeaL.loca 32.330 SO LOOP -ttiloop 049.VWE

-iatw/mr.powjr pome~r.smehaUl cc, 5.9e-0$

7.49-02 porv.og.srv.rse~t/mazq.povec 49 LOOP -rt/loop EmmaP0WE

-aft/emerg.pnv.:

pozv.or.azv.chal CD 5.03-05S 7.4t-02 porv.or.srv.rfeuat/weag.pom-

-ml.boca EU.* NC

• non-recovery credit for edited come SCCUC& CONDITIONAL PROBAILIThES (C3003N33 0003*)

3.uec.end state Prob m Race*

49 1,0O1 -cc/loop in.PJi

-etw/eec.power pomior.azvchall -

CO 9.09-05 7.4c-02 pozeev.a GW.

wesobjme.oum wseel-l..a U9 RI So Loop -cc/loop

• ing.

-afv/e.Vmwr pmzv.or.srv.chall CO

.30 7.4"-2 54 Loop -at/oop.

• .p0W

-lV/maq.Pous

-Poav.or-srv.ehaL Cm

$.K3-04 7.4t-02

$4ea.loca ZP.W S!

Loop -nc/loop inwmwe atv/tivpowea CO 1.3t-03 2.6f-flf

&non-recovery credit fee edftad COS*

MUD=NC Motto:

Ct\\8fP'~1U6\\VwrdmOeJ-cmP BRANCH MODEL:

c:\\&SP\\199oConaelI-Sll PROBABILITY rILE:

c s \\&@p%99\\pwrball -pro event Ydenjfleri 270/92-004 r'~r~I hmai A M

JA14 G ~

f~-'99 VPAGE. 22 PRELI MlNARY trafla 644

.3 LOOP 1.30

.6-5S4-0

.KC Branch Nodall IN1M1 e

.9-1D SsC0 rinJ.iacor raq:

1.43-OS loa 2.43-06

.30 ft/1o 2.83-04 1.23-01 DC/lFOp 0.0340 1.07.400 Brach Modelt 1.01.2*uar

.20 Train I Coad probe 243*-03 30 nueda Tr&Ai 2 Coed Probe 4.7"2C 3o railed seilCmpuaut Probe 1 *4Z-04 aNw 3.63-04 2.63-01 afv/ameq.powee 5.-ft03

.3 afv

.00-14-1.*-3 pocY.rOre.0holl G.O3-0I 1.09+00 PorY-*.Oerv.reeat 1 -03.143 1.1it-"2 poawr. av~reeaui.eq~~v.~ 1.03-09 04 4Ala.oa LOG&.0 1.03400 Scanafh Hode. -1.07.1 1 -.".Ix

.E train I Coed probe 4.*59-012.

0.63 b'ps 3.09-04 0.4u-01 Wp(f/b)

.00-

.30

.30 hr/-hpt 1.3-04 1.030 10O

• branch ig fdle£1 forced 01-27;1:3 171ft15 gvent rdontifieti 270/32-004 PRELIMINARY