ML20114E063

Final ASP Analysis - Oconee 1, 2, and 3 (LER 269-98-004)

ML20114E063
Person / Time
Site:	Oconee
Issue date:	05/12/2020
From:	Christopher Hunter NRC/RES/DRA/PRB
To:
Hunter C (301) 415-1394
References
LER 1998-004-00, LER 1998-005-00
Download: ML20114E063 (26)

Text

ADoendix B LER No. 269/98-004, -005 3i B LER No. 269/98-004, -005 B.3 LER No. 269/98-004, -005 Event

Description:

Calibration and calculational errors compromise emergency core cooling system transfer to emergency sump Date of Event: February 12, 1998 Plant: Oconee 1, 2, and 3 B.3.1 Event Summary At the Oconee Nuclear Plant, Units 1, 2, and 3 (Oconee 1, 2, and 3), incorrect calibration of the borated water storage tank (BWST) level instruments, failure to address potential errors in reactor building emergency sump (RBES) indicated level, and incorrect estimation of expected RBES level resulted in (1) the potential for emergency core cooling system (ECCS) pump loss of net positive suction pressure (NPSH) and vortexing, and (2) a situation where the emergency operating procedure (EOP) requirements for BWST-to-RBES transfer would never have been met. This would have required ad-hoc operator action to maintain post-loss-of-coolant accident (LOCA) core cooling. The estimated conditional core damage probability (CCDP) associated with these conditions is 2.0 x 10.` at Oconee 1 and 2 and 1.9 x 10` at Oconee 3. This is an increase of 1.7 x 10. at Oconee 1 and 2 and 1.4 x 10. at Oconee 3 over the nominal core damage probability (CDP) in a 1-year period of 1.8 x 10'.

B.3.2 Event Description On February 12, 1998, Oconee I was at 65% power and Oconee 2 and 3 were at 100% power. During an investigation of a Self-Initiated Technical Audit (SITA) issue, personnel at Duke Power determined that the BWST level instruments were miscalibrated by as much as 46 cm (18 in.) lower than assumed in the calculations supporting EOP actions. Because of the calibration error, the indicated water level in the BWST was higher than the actual water level. Consequently, during the drain-down of the BWST following a postulated LOCA, unacceptable ECCS and reactor building spray pump NPSH and vortex formation may occur before the operators, while complying with the EOPs, transfer pump suction from the BWST to the reactor building (RB) sump.'

The BWST level calibration errors occurred when three new level transmitters were installed in 1989, replacing two older pneumatic level instrument trains. The field installation drawings specified that the new transmitters be mounted at elevation "799-1 or below." As a result, the new calibration test tees for each instrument were typically located -0.3 m (1 ft) below the elevation of the impulse line tap into the system, but in the worst case the elevation difference was -0.46 m (1.5 ft), as shown in Fig. B.3.1 and Table B.3.1. (Level transmitters LT 2A and LT 6 are the primary indicators of the water level in the BWST following a LOCA.) A review of the drawings for the original pneumatic instruments indicated an elevation difference of approximately 10 cm (4 in.).

Although the calibration procedure was revised after the new transmitters were installed, the revision did not address the elevation differences. (Current Oconee practice in other instrument calibration procedures is to NUREG/CR-4674, Vol. 27 B.3-1 B.3-I NUREG/CR-4674, Vol. 27

LER No. 269/98-004. -005 Appendix B include a "zero offset" on the calibration data sheet to account for the difference between the instrument test tee and impulse line tap elevations.)

A second potential source of calibration error, the relative height of the calibration test instrument compared to the calibration test tee, was also missing from the calibration procedure. Personnel determined that this error would substantially impact instrument calibration because the calibration test instrument elevation is adjusted to match the elevation of the test tee.

In 1986, a series of instrument error calculations, which addressed the BWST level instruments, were performed to determine the appropriate procedural set points for BWST-to-RBES transfer to satisfy ECCS pump NPSH requirements and to avoid vortexing in the pump suction lines. These calculations assumed that the zero reference elevation for the BWST level instruments was the elevation of the impulse line tap. In January 1988, these calculations were designated OSC-2820, Emergency ProcedureGuidelines Set Points, to document the sources and derivation of numerical values used as EOP set points.

Although these calculations were updated on several occasions after the BWST level instruments were replaced in 1989, the assumed zero reference point was not changed. Therefore, because personnel calibrated the BWST level instruments to the test tee elevation rather than to the impulse line tap elevation, the error between the water level in the BWST assumed in the EOP calculations and the indicated water level differed by 0.30 to 0.46 m (1.0 to 1.5 ft) in the nonconservative direction. This error is a significant fraction of the 1.8-m and 0.6 m (6-ft and 2-ft) BWST level set point action statements included in the EOPs. All BWST level transmitters were recalibrated to address the test tee elevation errors by 0431 on February 13, 1998, the day after the problem was discovered.

One week after the BWST level instrumentation miscalibration was found, personnel identified another problem related to the BWST-to-RBES transfer. The Oconee EOPs at the time of this event required the operators to begin the BWST-to-RBES transfer when the water level in the BWST was less than 1.8 m (6 ft) and the water level in the RBES was greater than 1.2 m (4 ft) (Ref. 2). The failure to consider instrument errors when the EOP minimum RBES level was specified, plus the incorrect calculation of the expected water level in the reactor

-building when the water level in the BWST dropped to 1.8 m (6 ft), resulted in the potential for the indicated water level in the RBES to never reach the 4-ft level required for transfer.

The original 1973 emergency procedure for transferring ECCS pump suction from the BWST to the RBES specified that the transfer should occur upon receipt of the low-low BWST level alarm, then set at 0.9 m (3 ft).

No RBES level requirement was included in the original procedure.

In 1985, the ECCS pump suction transfer procedure was revised to require the water level in the BWST to be less than 1.8 m (6 ft) and the water level in the RBES to be more than 0.6 m (2 ft). The 2-ft RBES level was included as a precaution to ensure an adequate water level in the sump following pipe breaks that occurred outside containment. The RBES level instruments in place at the time had a range of 0 to 0.9 m (0 to 3 ft). Between December 1984 and December 1986, as part of post-Three Mile Island accident upgrades, two wide-range RB water level transmitters were installed at each of the three Oconee units. These instruments provide RBES level indication of 0 to 4.6 m (0 to 15 ft).

NUREG/CR-4674, Vol. 27 B.3-2

Appendix B LER No. 269/98-004. -005 When OSC-2820, Emergency Procedure Guidelines Set Points was issued in January 1988 (as described previously), the results of calculations performed 1-month earlier that addressed the potential error in the new RBES water level instruments were used as inputs in determining the minimum pump NPSH requirements during the recirculation mode. An RBES set point of 1.1 m (3.5 ft) was established to ensure a minimum sump inventory for all accidents (the intent was to confirm that the inventory of water in the BWST had been transferred to the RB rather than to a location outside containment). The supporting analysis for the 1.1 -m (3.5-ft) set point included an allowance of +22 cm (8.8 in.) for instrument error to account for the possibility that the level transmitters might read high, but did not recognize the possibility that the RBES level indication might read low and never reach the EOP set point.

In February 1988, the RBES level instrumentation calculation was revised to address current leakage. This calculation estimated the "worst-case" instrument error to be +22/-53 cm (+8.8/-21 in.)a At the time the calculation was revised, personnel estimated that the water level in the RB would be 163 cm (5.3 ft or 64 in.)

when the water level in the BWST reached 1.8 m (6 ft). Assuming a worst-case instrument error (-53 cm or

-21 in.), the water level in the RBES (109 cm or 43 in.) would be greater than the 107 cm (42 in. or 3.5 ft) water level required for the BWST-to-RBES transfer, but only marginally. In April 1988, the EOP was revised to incorporate the 1.1-n (3.5-ft) minimum RBES water level prior to transfer.

In July 1989, OSC-2820 was revised to require a minimum indicated RBES water level of 1.14 m (3.75 ft) to ensure that minimum NPSH requirements would be met. Because the calculation did not evaluate the potential impact of the RBES level instruments reading low, the fact that the 1.14-m (3.75-ft or 45-in) level [or 5 cm (2 in.)

greater than the 109 cm (43 in.) lowest indicated level considering maximum instrument error) might not be reached was not recognized. The EOPs were not revised to reflect the changes to OSC-2820 at that time.

At the end of May 1994, the EOPs were revised to reflect a higher minimum water level in the RBES before the BWST-to-RBES transfer was made. For instrument readability reasons, the minimum indicated water level in the RBES was established at 1.2 m (4 ft), which met the 1.14-m (3.75-ft) level documented in OSC-2820. Again, this revision failed to consider the potential for the RBES level instruments reading low. Once the EOP change was made, the potential existed for the RBES level to indicate 13 cm (5 in.) below that which was procedurally specified when the operators were expected to begin actions required for transferring ECCS suction from the BWST to the RBES. This is based on an estimated water level in the RBES of 163 cm (64 in.) when the water level in the BWST was at 1.8 m (6 ft).

This problem was further impacted by another calculational error discovered in November 1997 (Ref 3). The calculation of the inventory of water in the RBES (that had previously been used to estimate a water level depth of 163 cm (64 in.) in the RBES when the water level in BWST was at 1.8 m (6 ft)) was found to incorrectly account for the following trapped water volumes that would reduce the expected water level in the RBES following a LOCA:

"* water trapped in the reactor vessel cavity and in the deep end of the fuel transfer canal,

"* water needed to make up for reactor coolant system shrinkage during cooldown, "The worst-case negative instrument error was revised in 1996 to -46.0 cm (- 18.1 in.).

B.3-3 NUREG/CR-4674, Vol. 27

Atnoendix B I FR No 269/98-004 -005 Aoni

• water needed to refill the pressurizer,

• water needed to fill the reactor building spray piping inside containment, and

• water needed to account for the vapor content maintaining containment pressure.

Reference 3 noted that the reactor vessel cavity and the fuel transfer canal could trap a large quantity of water and significantly reduce the inventory in the RBES-thereby reducing the RBES water level. The reactor vessel cavity is the volume between the reactor vessel and the primary shield (Fig. B.3.2). Reactor coolant piping, core flood/decay heat removal piping, and in-core instrument tubing pass through the reactor vessel cavity. In addition, a drain line from the deep end of the fuel transfer canal empties into the cavity. The bottom of the reactor vessel cavity contains a 10-cm (4-in.) line that drains the cavity to the RB normal sump. However, the drain line was covered with a flange that contained a 1.9-cm (3/4-in.) pipe nipple that allowed very limited drainage (this flange was discovered to be missing at Unit 3).

The deep end of the fuel transfer canal could also trap a large quantity of water. Two lines are provided to drain the fuel transfer canal to the RB normal sump. Instead of perforated drain covers, the drain lines contained "basket strainers" that were believed to be much more likely to be blocked by debris, which would prevent the fuel transfer canal from draining. (An additional drain line, located 0.3 m (1 ft) above the bottom of the fuel transfer canal, provides an alternate drain path to the reactor vessel cavity; however, drainage through the reactor vessel cavity was essentially blocked by the 1.9-cm (3/4-in.) restriction discussed previously.) The basket strainers had been installed for as low as reasonably achievable (ALARA) purposes during an outage about 10 years ago and had been allowed to remain during operation without a proper station modification evaluation.

An evaluation considering the effects of water being trapped in the reactor vessel cavity and in the fuel transfer canal concluded that the expected water level in the RBES was 0.936 m (3.07 ft) instead of the 163 cm (64 in.

or 5.3 ft) used in calculations for determining when the water level in the BWST reached 1.8 m (6 ft). This revised value would apply particularly to large- and medium-break LOCAs, when building spray would collect in the fuel transfer canal. Following the removal of the basket strainers and the flange on the reactor cavity drain in November 1997, the expected water level in the RBES was estimated to be -1.4 m (4.5 ft).

In conclusion, three conditions that degraded the potential for BWST-to-RBES transfer were reported in Refs.

I and 3. Incorrectly calibrated BWST level transmitters (1989-1998) could have resulted in ECCS pump loss of NPSH and vortexing when the operators performed the EOP steps required to place a unit on sunmp recirculation following a LOCA. Failure to consider potential RBES level instrument error when developing procedures for the BWST-to-RBES transfer, combined with the incorrect estimation of the expected water level in the RBES (1985-1998), could have resulted in a condition where EOP requirements for initiating BWST-to RBES transfer would not have been met. This would have required ad-hoc operator action to maintain post LOCA cooling.

B.3.3 Additional Event-Related Information The Oconee ECCS (Fig. B.3.3) consists of a high-pressure injection (HPI) and low-pressure injection (LPI) system, as well as a core flood system. The HPI system includes three 24-stage vertical centrifugal pumps that develop 20.7-MPa (3000-psi) discharge pressure with a capacity of 0.032 m 3/s (500 gpm) each. The HPI system N'UREG/CR-4674, Vol. 27 B.3-4

Appendix B LER No. 269/98-004, -005 provides both normal makeup and reactor coolant pump seal injection, as well as makeup to the reactor coolant system (RCS) for small- and medium-break LOCAs. HPI pump A or B is normally in operation; HPI pump C is for emergency use only. The HPI pumps will typically operate for 1-2 min without an adequate suction source before they are damaged.

The Oconee LPI system also includes three pumps. These high-capacity, low head pumps provide RCS makeup for removing decay heat during normal shutdown operations or following a large-break LOCA. When the RCS is not depressurized below the LPI pump shutoff head, the LPI pumps also provide the suction source for the HPI pumps during the recirculation phase following a small- or medium-break LOCA. Two of the LPI pumps are automatically started for LOCA mitigation; the third pump is manually started if required. The LPI pumps are more tolerant of reduced NPSH than the HPI pumps and can operate for greater periods of time with reduced NPSH. [While no information is available concerning the expected Oconee LPI pump performance at reduced NPSH, Ref. 4 provided this information for another low-pressure, high-capacity pump-the containmuent spray pump at Maine Yankee. The manufacturer of that pump indicated that the pump could operate indefinitely at 95% of required NPSH and for 15 min at 75% of required NPSH. The pump manufacturer also stated that similar pumps are routinely operated for 1-3 mim at 50% of required NPSH without sustaining damage.]

The Oconee BWSTs provide 1590 m3 (350,000 gal) for injection when drawn down from the minimum Technical Specification (TS) level [14 m to 1.8 m (46 ft to 6 ft)]. Because the same BWST level channels are used to measure maximum and minimum water level, the BWST level calibration error did not impact the volume of water delivered to the RCS during the injection phase.

B.3.4 Modeling Assumptions This analysis addressed the combined impact of(l) water trapped in the reactor vessel cavity and the fuel transfer canal, (2) the potential for RBES level instruments to indicate low due to instrument error, and (3) incorrectly calibrated BWST level transmitters that increase the probability that the operators would fail to transfer the ECCS pump suctions to the RBES once the inventory in the BWST is depleted. An event-specific model was developed to depict the potential combinations of instrument and operator errors that, following a LOCA or other condition requiring sump recirculation, could result in failure to transfer ECCS pump suction from the BWST to the RBES and result in the unavailability of long-term core cooling. This model, shown in Figs. B.3.4 and B.3.5, was used to estimate the importance of this event. Table B.3.2 provides the definitions and probabilities for the event tree branches. The Oconee Standardized Plant Analysis Risk (SPAR) models developed for use in the Accident Sequence Precursor (ASP) Program were used to determine the nominal CDP in a 1-year period.

The event tree model includes the following branches:

Initiating Event (JE). The initiating events necessary to analyze this event consist of the set of sequences that require sump recirculation. Because of differences in timing, large-, medium- and small-break LOCAs and transients (including a loss of offsite power) that require feed-and-bleed cooling were addressed separately.

Utilizing a 1-year time period (the longest interval analyzed in the ASP Program) and revising the initiating event frequencies to be consistent with historical values,' the probabilities of requiring sump recirculation for the different initiating events were estimated using the Oconee SPAR model. These probabilities are shown in Table B.3.3.

NUREG/CR-4674, Vol.27 B.3-5 NUREG/CR-4674, Vol. 27

LER No. 269/98-004, -005 Appendix B Sump RecirculationRequired (RECIRC). The initiating events of interest represent the set of sequences and their associated probability in a 1-year period that sump recirculation would be required. The probabilities are weighted by 0.1 or 0.9 to reflect the probability that the water level in the BWST will be 14.0 to 14.8 m (46 or 48.5 ft), respectively.

RBES Level _>1.2 m (4 ft) when BWST Level = 1.8 m (6ft) (RBES-OK). Success for this branch implies that the water level in the RBES is at least 1.2 m (4 ft) when the water level in the BWST is drawn down to 1.8 m (6 ft). If the water level in the RB is at least 1.2 m (4 fi) when the water level in the BWST reaches 1.8 m (6 ft), this analysis assumes the operators will begin to transfer the ECCS pump suctions to the RBES as specified in the EOP.2 If the water level in the RB is less than the 1.2 m (4 ft) required by the EOP, the potential exists for the operators to delay transfer until the ECCS pumps are damaged and can no longer be used for core cooling. The probability that the RBES level will not indicate 1.2 m (4 ft) when the water level in the BWST reaches 1.8 m (6 ft) (i.e., when the EOP requires the operators to transfer ECCS pump suction to the RBES) depends on the actual water level in the RB and the RB water level instrument error. These issues are discussed below.

a. Impact of trapped water in reducing expected RBES level. The primary contributors to the reduced RBES inventory reported in Refs. 1 and 3 were associated with the deep end of the fuel transfer canal and the reactor vessel cavity. At Units I and 2, the reactor vessel cavity drain line included a flange with a 1.9-cm (3/4-in.)

pipe nipple that effectively prevented the reactor vessel cavity from draining to the RB sump (Fig. B.3.2).

At Unit 3, the pipe flange was found to be missing. This would have allowed water that entered the Unit 3 reactor vessel cavity to drain into the RB sump.

The deep end of the fuel transfer canal drained to the RB sump through basket strainers at each of the units.

The potential existed for these strainers to become clogged, thereby preventing the fuel transfer canal from draining. However, when the strainers were inspected, they were found to be clean at each unit' and would have allowed the fuel transfer canal to drain to the sump. The water drained from the fuel transfer canal would increase the calculated RB sump level an additional 0.23 to 1.2 m (0.75 to 3.8 ft), for Units 1 and 2.

The missing reactor vessel cavity drain flange at Unit 3 would have allowed that unit's reactor vessel cavity to drain as well, resulting in a calculated RB sump level of 1.4 m (4.5 ft); this is the same as the calculated water level after the basket strainer and reactor vessel drain flange issues were resolved. These sump levels assume the BWST was initially at the TS-required level of 14.0 m (46 ft) and was drained to 1.8 m (6 ft) at the time the ECCS pump suctions were transferred to the RBES. In actuality, the BWST is maintained at a level of 14.8 m (48.5 ft) about 90% of the time, which would increase the water level in the sump at the time operators transfer to the sump.'

b. PotentialRBES level instrument error. The estimated error for the RBES level channels is +22/-46 cm

(+8.8/- 18.1 in.), including current leakage. Based on information provided by personnel at Duke Power following the January 28, 1999, telephone conversation with Nuclear Regulatory Commission (NRC) and ASP program staff, this error is assumed to represent the +/-2o values of an approximately normal distribution. Using this assumption and the expected water levels in the RB described above, the probability "Personal communication, J. W. Minarick (SAIC) and R. L. Oakley (Duke Power), March 1, 1999.

NUREG/CR-4674, Vol. 27 B.3-6

Appendix B LER No. 269/98-004. -005 that both RBES level channels will read less than 1.2 m (4 ft) can be estimated.a Using the +22-cm (+8.8-in.)

and cm (- 18.-in.) values, the mean error (due to current leakage) is calculated to be - 12 cm (-4.7 in.)

and the standard deviation (a) is calculated to be 17 cm (6.7 in.) For Oconee I and 2, with a calculated water level in the RB sump of 116 cm (45.6 in. or 3.8 ft), the probability that an RB level channel will not read 122 cm (48 in. or 4 ft) is estimated to be (D[(48 in - mean level)/o] = (D[(48 - (45.6 - 4.7)) / 6.71 = 0.86, where 0[ 1is the cumulative normal probability distribution. The probability of not exceeding 1.2 m (4 ft) on either channel can be estimated using the independent failure probability (0.86) and the correlation in the errors in the two channels. Unfortunately, essentially no information exists concerning the expected correlation between the two channels. As a surrogate for this information, data developed in conjunction with an NRC reactor protection system reliability study6 was used to estimate a [-factor for the common-cause failure of the two level channels.b The resulting estimate (P3= 0.024) implies a very limited correlation between the two channels. Using this estimate for P3,the probability that the RB water level indicators will not indicate that the level is at least 1.2 m (4 ft) on either channel is estimated to be 0.735. Because of the limited correlation between channels, this compares to a probability of 0.732 if the channels were independent.

The probability (to two significant figures) of not indicating 1.2 m (4 ft) on either RB level channel for initial BWST levels of 14.0 m and 14.8 m (46 ft and 48.5 ft) at a BWST drain-down to 1.8 m (6 ft) (the EOP-specified level to begin transferring ECCS pump suctions to the RBES) is shown in Table B.3.4.

Cold-Leg Break (CLBREAK). Success for this branch implies that the LOCA occurred in one of the cold legs.

Based on information provided in Ref. 1, operator action to open the sump isolation valves will transfer ECCS pump suction to the RBES following a cold-leg break. This is because containment pressure is high enough to overcome the elevation head of the BWST. For a hot-leg break, however, the lower expected containment pressure requires the operators to also isolate the BWST before the ECCS pumps take suction from the RBES.

Closure of the BWST isolation valves occurs later in the transfer sequence and requires additional time. The

.difference in timing is important, primarily for large- and medium-break LOCAs, and therefore cold- and hot-leg breaks must be distinguished in the model. To recognize the greater likelihood of a break in a cold leg because of the greater number of cold leg pipe segments and welds,' this analysis assumes a probability of 0.6 that a LOCA will occur in a cold leg.

"During the January 28, 1999, telephone conversation, personnel at Duke Power stated that the Oconee operators would take action when the first RBES level channel indicated that the water level in the RB was 1.2 m (4 ft). Failure to take action would therefore require failure of both channels to indicate a 1.2-m (4-ft) level.

'Personal communication, J. W. Minarick (SAIC) and D. M. Rasmuson (NRC), March 15, 1999.

"Reference 7 provides a discussion of the factors that influence the likelihood of pipe break.

13.3-7 NUREG/CR-4674, Vol. 27

Appendix B LER No. 269/98-004 -005 RBES = 1.2 m (4ft) at BWSTMinimum Level (RBES-MIN). If transfer to the RBES is delayed, the water level in the BWST will ultimately decrease to the point where the ECC3 pumps are damaged by vortexing or unacceptable NPSH. Success for this branch implies that the water level in the RB reaches 1.2 m (4 ft), satisfying the EOP BWST-to-RBES transfer requirement, in time for the operators to effect RBES transfer before ECCS pump damage occurs. The incorrectly calibrated BWST level transmitters at the three units effectively raised the indicated level at which vortexing would begin. The level at which vortexing is expected to begin was chosen as the BWST level associated with unacceptable LPI pump operation because the impact of vortexing on pump performance is expected to dominate. Based on the information included in Additional Event-Related Information, the impact of the slight reduction in NPSH caused by a 0.3-m (l-ft) reduction in BWST level is expected to be relatively minor. However, once vortexing begins it is expected to completely develop with only a slight additional reduction in the water level in the BWST (see, for example, the description of the loss of residual heat removal capabilities at Diablo Canyon on April 10, 1987, in Ref. 8).

Attachment A to Ref. I indicates that vortexing is expected to begin at a BWST water level of 0.26 m (0.85 ft)

(refer to Fig. B.3. 1). Considering the calibration errors described in Table B.3. 1, vortexing is expected to begin, unknown to the operators, at an indicated BWST level of approximately 0.55 m (1.8 ft) for Units 1 and 2, and 0.70 m (2.3 ft) for Unit 3. To complete the transfer from the BWST to the RBES before vortexing impacts the LPI pumps, the operators must begin the transfer process at an indicated BWST level greater than 0.6 m (2 ft)

(the level specified in the EOP at which the BWST must be isolated).

Based on ECCS flow rates and valve cycle times,° plus additional assumptions concerning initiator-specific flow rates, the time to perform an intermediate EOP step, and unit-specific average BWST calibration errors,' the estimated BWST indicated levels at which the RBES transfer must begin to prevent vortexing are shown in Table B.3.5.

The conditional probabilities that RB water level on both level transmitters is still less than 1.2 in (4 ft) when the BWST reaches the minimum acceptable levels listed in Table B.3.5, given the RBES level indication was less than 1.2 m (4 ft) when the water level in the BWST was 1.8 m (6 ft), were estimated using the same approach as for branch RBES-OK. These conditional probabilities are also included in Table B.3.5.

"Personal communication, J. W.Minarick (SAIC) and B. Abellana (Duke Power), March 10, 1999. For a large-break LOCA, an LPI flow rate of 0.38 m3/s (6000 gpm) (two trains), a building spray flow rate of 0.19 in /s (3000 gpm) (two 3

3 trains), and an HPI flow rate prior to operator termination of 0.088 m /s (1400 gpm) are estimated. Cycle times for the RBES and BWST isolation valves are 70 and -30 s, respectively.

bThe following flow rates were assumed in the analysis at the time of switchover: 0.57 ndIs (9000 gpm) [large-break 3

LOCA (LPI plus building spray)], 0.28 m3/s (4400 gpm) [medium-break LOCA (HPI plus building spray)], and 0.088 m Is (1400 gpm) [small-break LOCA and feed-and-bleed cooling (-WPI)]. For cold leg breaks, the analysis assumed the RBES valves must be opened 50% for the RBES to become the pump suction source. For hot leg breaks, the analysis assumed the BWST isolation valves had to completely close before the sump provided suction flow. In addition, an intermediate step in the EOP requiring building spray throttling was assumed to require I min. The average BWST calibration error was assumed to be -0.30 m (-1.0 ft) for Units 1 and 2 and -0.43 m (- 1.4 ft) for Unit 3.

NUREG/CR-4674, Vol. 27 B.3-8

Appendix B ipI i.BLER No. 269/98-004. -005 OperatorsSwitch to RBESat BWSTMinimum Level (OPS-MIN). Success for this branch implies a decision on the part of the operators to transfer the ECCS pumps to the RBES before pump damage occurs, even though the water level in the RB was less than 1.2 m (4 ft). If the water level in the RB is less than 1.2 m (4 ft) when the water level in the BWST is drawn down to 1.8 m (6 11), the operators will find themselves outside their procedural bases-action to effect transfer to the RBES would technically be a violation of the EOP (Ref. 2) as written at the time the condition was discovered. However, the operators would be aware conceptually of the need to transfer to the sump before the BWST depletes and would know that the procedure required the transfer to be completed by the time the BWST level indicated 0.6 m (2 ft). This knowledge is expected to result in an increasing urgency (initially tempered by the understanding that some minimum RB water level was required for the pumps to operate in the recirculation mode) to transfer the ECCS pumps to the RBES as the water level in the BWST drops, ultimately resulting in such a decision. Degraded ECCS pump performance, if observed, would serve to reinforce the decision to transfer (operator burden, the need for rapid response, plus annunciator noise, particularly following a large- or medium-break LOCA, would be expected to compromise such an observation).

The Technical Support Center (TSC) would be fully operational at the time for small-break LOCAs and would also be expected to reinforce the decision to transfer suction to the RBES.

The probability of not transferring the ECCS pumps cannot be rigorously estimated using contemporary Human Reliability Analysis (HRA) methods because the action is outside the procedure basis and is, in part, ad-hoc. For the purposes of this analysis it was assumed that, without TSC assistance, the operators would not begin to transfer the ECCS pumps to the RBES at an indicated BWST level of 1.8 m (6 fi). However, around an indicated BWST water level of 1.2 m (4 ft), it was assuimed that there was an even chance that the operators would begin transferring the ECCS pumps to the RBES rather than waiting further for indication that the water level in the RB had risen to 1.2 m (4 fi), and that at an indicated level of 0.6 m (2 ft) the operators would likely transfer the pumps to the sump. A value of 0.5 was therefore assigned to the probability that the operators would begin to transfer suction to the RBES at an indicated BWST water level of 1.2 m (4 ft), and a value of 0.1 was assigned to the probability that the operators would begin to transfer at an indicated level of 0.6 m (2 ft). At an indicated water level of 1.8 m (6 ft), a value of 1.0 was assigned to the probability that the operators would begin to transfer to the sump. For small-break LOCAs, the TSC would also be available to aid the operators. A moderate dependency is assumed between the operators and the TSC for a decision at 1.2 m (4 ft) and greater, and a low dependency is assumed for the decision at 0.6 m (2 fIt), resulting in probability estimates of 0.9, 0.3, and 0.01, at 1.8, 1.2, and 0.6 m (6, 4, and 2 ft), respectively.a The probabilities that the operators, with and without support from the TSC, would fail to begin transferring the suction for the ECCS pumps to the RBES by the time the water levels in the BWST were estimated by linearly interpolating between the probabilities estimated for water levels of 0.6, 1.2, and 1.8 m (2, 4, and 6 ft).

Representative operator error probabilities are shown in Table B.3.6.

Substantial uncertainty is associated with the probabilities estimated for this branch. As noted earlier, the operator action being modeled is outside the domain of contemporary HRA methods. This, plus the fact that the impact of errors in procedures have not been considered in simulator exercises, results in very little information

°Small-break LOCAs do not measurably contribute to the significance of this event. Assumptions concerning the probability of operator error following a small-break LOCA have little impact on the analysis results.

B.3-9 NUREG/CR-4674, Vol. 27

Appendix B IV1 N -)AIOQRAflf4 AW Ap0nd05 being available to accurately estimate such probabilities. The estimated probabilities are considered reasonable, considering the state of the art.

OperatorsProceed Without Delay through Procedure (NO-DELAY). If RB water level indicates 1.2 m (4 fi) when the BWST level is 1.8 m (6 ft), the operators are expected to begin transferring the suction for the ECCS pumps to the RBES as required by the EOP. Following a hot leg break, if the operators prolong the transfer and delay isolating the BWST until its indicated level approaches 0.6 m (2 ft) (as allowed by the procedure), the ECCS pumps can also fail from vortexing. Success for this branch implies that the operators proceed expeditiously in transferring the pump suctions to the RBES. A failure probability of 0.1 was utilized for large and medium-break LOCAs, where a delay of a few of minutes is sufficient to initiate vortexing, considering the miscalibrated BWST level transmitters. For small-break LOCAs and feed-and-bleed cooling, because of the slow BWST drain down, only a deliberate decision to delay BWST isolation until a BWST level of-0.6 m (2 ft) is indicated will result in pump damage; a failure probability of 0.01 is assumed in these cases.

Depressurizationto Allow Low-PressureRecirculation (LPR) (DEPRESS). Medium- and small-break LOCAs and feed-and-bleed cooling require HPI for injection success. When the inventory of water in the BWST is depleted, the LPI pumps are used to take suction from the RBES and provide flow, at adequate NPSH, to the HPI pumps. Oconee procedures require the HPI pumps to be lined up in series with the LPI pumps when the water level in the BWST is at 3.0 m (10 ft). The loss of LPI pump flow at the onset of vortexing is expected to cause the HPI pumps to fail, resulting in the need to rapidly depressurize the RCS to allow use of the LPI pumps for injection. Depressurization is possible following a LOCA, provided secondary-side cooling is available (depressurization cannot be used during feed-and-bleed cooling because secondary-side cooling is unavailable).

Consistent with previous precursor analyses of events at Oconee (Ref. 9), the probability of failing to depressurize the RCS to allow use of the LPI pumps for injection was assumed to be 0.1. The probability of failing to depressurize to allow LPR for the initiating events of interest are given in Table B.3.7.

LPR Recovered (LPR-REC). Success for this branch implies that LPR is recovered following an initial failure to transfer, for example, through use of the third LPI pump once transfer is complete. Failure to recover LPR would be highly dependent on the initially faulty assessment that resulted in the failure of the running LPI pumps.

For a large-break LOCA, operator burden (associated with the unusual nature of the instrumentation anomalies in addition to the existence of the large-break LOCA) plus annunciator noise would be expected to delay the operating crew's realization that the LPI pumps had failed and delay diagnosis of the failure and implementation of any recovery strategy until well beyond the time that core uncovery occurs [7 min after loss of LPI (Ref. 1)].

A nonrecovery probability of 1.0 was therefore assumed for LPR-REC following a large-break LOCA.

For a medium-break LOCA, a failure probability of 0.5 was estimated for LPR-REC (this is conditional on the failure of OPS-MIN). This estimate considers the limited time available to recover recirculation cooling [15 min based on the Oconee probabilistic risk assessment (PRA) (Ref. 9) description of recovery event LLPOP3CREC],

the burden imposed by the unusual nature of the failure, and the expected difficulty in analyzing the nature of the Vol.27 lLi-1U NUREG/CR-4674, Vol. 27 B.3-1 0

Appendix B Appndi I IB -nv n '-MN J

failure'. The potential for TSC support during some medium-break LOCAs was considered as a sensitivity analysis. The additional time and TSC support that would be available following a small-break LOCA would improve the likelihood of recovery; a failure probability of 0.1 was used with this initiator. The non-recovery probabilities for LPR for the initiating events of interest are given in Table B.3.8.

B.3.5 Analysis Results The combined CCDP associated with the BWST level transmitter miscalibration and RB water level error over a 1-year period for recirculation-related sequences is 1.7 x 10' for Units 1 and 2, and 1.4 x 106 for Unit 3 (Table 9). Because design and installation errors such as those that comprise this event are not typically addressed in PRAs (their contribution to nominal cut sets is zero), this CCDP is also the increase in the nominal CDP, or importance, for the event. The overall CCDP, considering all sequences, is therefore the estimated CDP for Oconee in a 1-year period (1.8 x 10', based on the ASP models) plus the above increases, or 2.0 x I0- for Units 1 and 2, and 1.9 x 10` for Unit 3.

Although the significance of the event at Units 1 and 2 is slightly greater than at Unit 3 (a result of the higher calculated RB water level at Unit 3), the dominant sequence (6.1 x 10-v) within the subset of recirculation-related sequences involves a medium hot leg break at Unit 3 (sequence 2-4 on Fig. B.3.5). In this sequence, when the water level in the BWST is drawn down to an indicated level of 1.8 m (6 ft) following a postulated medium-break LOCA, the indicated water level in the RB is 1.2 m (4 ft), and the operators would begin transferring the suction for the ECCS pumps to the RBES. However, if the operators delay isolation of the BWST until the water level in the BWST approaches 0.6 m (2 ft), the ECCS pumps would fail as a result of air binding. Depressurization to allow use of the LPI pumps is successful, but the operators fail to recover LPR, resulting in core damage. This sequence is highlighted on the medium-break LOCA event tree shown in Figs. B.3.4 and B.3.5 [which represents the recirculation (PB-COOL) branch in Fig. B.3.4]. The medium-break LOCA model is similar to that developed to support the analysis of LER No. 287/97-003 in Ref. 10 and is described in that analysis. (Sequences associated with the late failure of HPI, which was important in the analysis of LER No. 287/97-003, have been excluded.)

The second most dominant sequence (with a CCDP of 2.9 x 10-') is similar to the dominant sequence but occurs at Units 1 and 2. In addition to medium-break LOCA sequences, large-break LOCA and feed-and-bleed cooling sequences with CCDPs greater than 1.0 x 10' occur at all three units. As can be seen in the Table B.3.9, small break LOCA sequences contribute to a minor extent. All small-break LOCA sequences have CCDPs below 1.0 x I0-.

"See, for example, the analysis of LER 287/97-003 in the 1997 annual precursor report [Precursorsto PotentialSevere Core Damage Accidents: 1997, A Status Report, NUREG/CR-4674, Vol. 26, November 1998 (Ref. 10)]. In this event, two Oconee 3 HPI pumps were damaged during a reactor shutdown as a result of a low water level in the letdown storage tank. After the low HPI pump discharge pressure was observed, over a i 5-min period the operators started and stopped the two pumps and operated associated valves in an attempt to recover HPI pump discharge pressure before recognizing the potential cause of the problem and securing the pumps.

B.3-11 NUREG/CR-4674, Vol. 27

ADoendix 13 T r1D Mn 'iAQIQQffl[1A -nflrAeldx The medium-break LOCA sequences were analyzed with the assumption that the TSC would not be available at the time when transfer to sump recirculation was required. The resulting medium-break LOCA CCDPs, accounting for the unavailability of the TSC, are 9.8 x 10' for Units 1 and 2 and 8.5 x l0` for Unit 3; the overall CCDP for the event is 1.7 x 10' at Units I and 2 and 1.4 x 10' for Unit 3 (Table B.3.9). The estimated time for BWST drawdown following a medium-break LOCA is 90 min at Oconee, and it is possible, at least for some medium-break LOCAs, that the TSC would be operational at the time of sump switchover. This potential was addressed in a sensitivity analysis that assumed the TSC was available when calculating OPS-MIN (Table B.3.6).

The resulting medium-break LOCA CCDPs, accounting for the availability of the TSC, are 6.5 x 10` for Units 1 and 2 and 8.2 x 10' for Unit 3; the overall CCDP for the event reduces to 1.3 x 10' at each unit.

To illustrate the calculational process, definitions and probabilities for the event tree branches associated with the potential loss of sump recirculation at Unit I or 2 following a medium-break LOCA with an initial water level in the BWST of 14.0 and 14.8 m (46.0 and 48.5 ft) are shown in Table B.3. 10. Table B.3.11 lists the sequence logic associated with the core damage sequences. The conditional probabilities for the six recirculation-related core damage sequences are shown in Tables 12 and 13.

B.3.6 References

1. LER 269/98-004, Rev. 1, "ECCS Outside Design Basis Due to Instrument Errors/Deficient Procedures,"

April 7, 1998.

2. Oconee Emergency Operating Procedure EP/l/A/1800/01, "Cooldown Following Large LOCA," CP-601, Revision 18, p 13.

3. LER 269/97-010, Rev. 0, "Inadequate Analysis of ECCS Sump Inventory due to Inadequate Design Analysis," January 8, 1998.

4. NRC Information Notice 96-55, Inadequate Net Positive Suction Headof Emergency Core Cooling and Containment Heat Removal Pumps under Design Basis Accident Conditions,October 22, 1996.

5. Rates ofInitiatingEvents at US NuclearPower Plants: 1987 - 1995, NUREG/CR-5750, February 1999.

6. Westinghouse Reactor ProtectionSystem Unavailability,1984 - 1995, NUREG/CR-5500, Vol. 2, in press.

7. H. M. Thomas, "Pipe and Vessel Failure Probability," Reliability Engineering,2: p 83-124 (1981).

8. Loss of Residual Heat Removal System, NUREG-1269, June 1987, Appendix C, p. 4.

9. Oconee Nuclear Station Units 1, 2 and 3, PE Submittal Report, Rev. 1, December 1990.

10. Precursorsto PotentialSevere Core Damage Accidents: 1997, A Status Report, NUREG/CR-4674, Vol.

26, November 1998.

B.3-12 NUREG/CR-4674, Vol. Vol. 27 27 B.3-12

Figure removed during SUNSI review.

Avvendix B

,I D NIU*l .dI, RS*-

V.* 4 A-A x% pn Figure removed during SUNSI review.

Fig. B.3.2 Interior structures in the reactor building (Source: LER 269/98-010, Rev. 0).

NUREG/CR-4674, Vol. 27 B.3-14

Appendix B I ,lg'.R NIa "*t*qlQRNd'IA _*lZ* P AIN Nn -

-7 -- ._Ik t,4L Figure removed during SUNSI review.

Fig. B.3.3 Flow diagram of the emergency core cooling system at Oconee (Source: Oconee 2 FinalSafety Analysis Report). BWST is borated water storage tank, HPI is high-pressure injection, LDST is letdown storage tank, LPI is low-pressure injection, and RB is reactor building.

B.3-15 NUREG/CR-4674, Vol. 27

TI 2

C 0

00 INITIATING REACTOR HIGH PIGGY EVENT-- TRIP PRESSURE BACK SEQUENCE END MLOCA SYSTEM INJECTION COOLING NO. STATE

-J. IE-MLOCA RT HPI RECIRC 0

0 OK

.=

2 RECIRC 3 CD 4 CD OCONEE, ASP PWR D MLOCA EVENT TREE W

Annendix B LER No. 269/98-004, -005 Appendix B 0 0 0 0 0 0 0 U 0 0 0 0 Mu-S N 4 N C- N N NA a

Mi a

Ua tw COi, MLz 0.

W U) 0 LUU 5

0 O

tol 0 C 0

go z

0 CO

.LU CO be ow LU CO C 0 9CO 6 M

LU LU 0L a* to

'U CD 'U ix z 0

a 0 Q S U, 0

0 L~U Fig. B.3.5 Event tree for failure to transfer the emergency core cooling system pumps to the reactor building emergency sump (RBES). BWST is borated water storage tank.

B.3-17 NUREG/CR-4674, Vol. 27

Aimendix LER No. 269/98-004, -005 LER No. 269/98-004, -005 AnDendil B B

Table B.3.1. BWST Level Transmitter Test Tee - Impulse Line Elevation Errors Elevation error in BWST level transmitters [m (ft)]

Unit LT 2A LT 6 LT 132 Unit 1 -0.234 (-0.77)' -0.308 (- 1.01)8 -0.287 (-0.94)'

Unit 2 -0.296 (-0.97)' -0.335 (-1.10)' -0.329 (-1.08)'

Unit 3 -0.415 (-1.36) -0.427 (-1.40) -0.445 (-1.46)

'NRC staff, ASP program staff, and personnel from Duke Power, teleconference, January 28, 1999.

Table B.3.2. Definitions and Probabilities for Event Tree Branches for LER No. 269/98-004 Branch Failure name Description probability IE- Initiating Event Table B.3.3 RT Reactor Trip 5.5 E-006a HPI High Pressure Injection 2.4 E-004a RECIRC Sump Recirculation Required BWST water level at 14.0 m (46.0 ft) 1.0 E-001 BWST water level at 14.8 m (48.5 ft) 9.0 E-001 RBES-OK RBES Level 2 1.2 in (4 ft) when BWST Level = 1.8 m (6 ft) Table B.3.4 CLBREAK Cold Leg Break 4.0 E-001 RBES-MIN RBES = 1.2 m (4 ft) at BWST Minimum Water Level Table B.3.5 OPS-MIN Operators Switch to RBES at BWST Minimum Water Level Table B.3.6 NO-DELAY Operators Proceed Without Delay through Procedure 1.0 E-001 DEPRESS Depressurization to Allow LPR Table B.3.7 LPR-REC LPR Recovered Table B.3.8

• System failure probability estimated using Oconee ASP model fault trees.

NUREG/CR-4674, Vol. 27 B.3-18

Appendix B A.pen. No. 269/98-004

.LER -0 Table B.3.3. Probability of Requiring Sump Recirculation for the Different Initiating Events During a I-year Period (IE-)

Probability of requiring Initiating event Description sump recirculation IE-LLOCA Large-break LOCA 5.0 E-006 IE-MLOCA Mediunm-break LOCA 4.0 E-005 IE-SLOCA Small-break LOCA 9.2 E-005 IE-F/B Feed-and-bleed (transients) 2.4 E-005 Table B.3.4. Probability that Neither RB Water Level Channel will Indicate 1.2 m (4 ft) (RBES-OK)

Probability that neither RB water Initial BWST level level channel indicates 1.2 m (4 ft) 14.0 m (46 ft) (10% of the time) 0.74 14.8 m (48.5 ft) (90% of the time) 0.55 14.0 m (46 fi) (10% of the time) 0.18 14.8 m (48.5 ft) (90% of the time) 0.064 NUREG/CR-4674, Vol. 27 B.3-19 NUREG/CR-4674, Vol. 27

Appendix B IR No 269/98-004 -005.Ap.endiB Table B.3.5. Minimum Acceptable BWST Levels to Initiate RBES Transfer and Conditional Probability that RB Level Will Not Indicate 1.2 m (4 ft) (RBES-MIN)

Minimum Conditional Conditional acceptable probability that RB probability that RB BWST level to level will not indicate level will not indicate initiate RBES 1.2 m (4 ft) [initial 1.2 m (4 ft) [initial Initiating event Unit transfer [m (ft)] BWST level = 14.8 m BWST level = 14.0 m (48.5 ft)] (46.0 ft)]

Large-break LOCA (cold leg) 1, 2 0.722 (2.37) 0.19 0.62 3 0.844 (2.77) 0.022 0.24 Large-break LOCA (hot leg) 1, 2 1.35 (4.43) 0.39 0.85 3 1.47(4.83) 0.10 0.63 Medium-break LOCA (cold 1,2 0.640 (2.10) 0.17 0.59 leg) 3 0.762 (2.50) 0.018 0.20 Medium-break LOCA (hot 1, 2 0.945 (3.10) 0.25 0.70 leg) 3 1.07 (3.50) 0.038 0.34 Small-break LOCA (cold leg) 1,2 0.61 (2.0)' 0.17 0.58 3 0.710 (2.33) 0.016 0.18 Small-break LOCA (hot leg) 1,2 0.689 (2.25) 0.18 0.61 3 0.808 (2.65) 0.020 0.22 Feed-and-bleed cooling 1, 2 0.689 (2.25) 0.18 0.61 3 0.808 (2.65) 0.020 0.22

'Based on procedure.

27 Vol. 27 B.3-20 NUREG/CR-4674, Vol. B.3-20

Appendix B Appendix B I R No 269/98R-00fd -We,~

Table B.3.6. Probability of Operator Failure to Transfer ECCS Pumps (OPS-MIN)

Minimum acceptable Probability of BWST level to operator error Probability of initiate RBES without TSC operator error Initiating event Unit transfer [m (ft)] support with TSC support Large-break LOCA (cold leg) 1,2 0.722 (2.37) 0.14 0.14 3 0.844 (2.77) 0.20 0.20 Large-break LOCA (hot leg) 1, 2 1.35 (4.43) 0.63 0.63 3 1.47 (4.83) 0.76 0.76 Medium-break LOCA (cold leg) 1, 2 0.640 (2.10) 0.11 0.01 3 0.762 (2.50) 0.16 0.09 Medium-break LOCA (hot leg) 1,2 0.935 (3.10) 0.27 0.17 3 1.07 (3.50) 0.36 0.22 Small-break LOCA (cold leg) 1, 2 0.61 (2.0)a 0.01 0.01 3 0.710 (2.33) 0.023 0.023 Small-break LOCA (hot leg) 1, 2 0.689 (2.25) 0.02 0.02 3 0.808 (2.65) 0.044 0.044 Feed-and-bleed cooling (cold leg) 1, 2 0.689 (2.25) 0.01 0.01 3 0.808 (2.65) 0.23 0.23 Feed-and-bleed cooling (hot leg) 1, 2 0.689 (2.25) 0.02 0.02 3 0.808 (2.65) 0.044 0.044 aBased on procedure.

B.3-21 NIJREG/CR-4674, Vol. 27 NUREG/CR-4674, Vol. 27

Appendix Appnd B LER No. 269/98-004 -005 Table B.3.7. Probability of failing to depressurize to allow LPR (DEPRESS)

Probability of failing to Initiating event depressurize to allow LPR IE-LLOCA 0.0 E+000 IE-MLOCA 1.0 E-001 IE-SLOCA 1.0 E-001 IE-F/B 1.0 E+000 Table B.3.8. Probability of Failure to Recover LPR (LPR-REC)

Probability of failure to Initiating event recover LPR IE-LLOCA 1.0 E+000 IE-MLOCA 5.0 E-001 IE-SLOCA 1.0 E-001 IE-F/B 1.0 E-001 B.3-22 NIJREGICR-4674, Vol. 27 NUREG/CR-4674, Vol. 27 B.3-22

Appendix B Appenix BLER No. 269/98-004. -005 Table B.3.9. Estimated CCDPs from Sequences that Require Recirculation for LER No. 361/98-003 Estimated CCDPs from Sequences that Require Recirculation Initiating Event Unit 1 and Unit 2 Unit 3 Large-break LOCA 4.6 E-007 2.2 E-007 Medium-break LOCA 9.8 E-007 8.5 E-007 Small-break LOCA 6.2 E-008 6.7 E-008 Feed-and-bleed cooling 1.8 E-007 2.4 E-007 Total 1.7 E-006 1.4 E-006 NIJREG/CR-4674, Vol. 27 B.3-23 NUREG/CR-4674, Vol. 27

• 'tt*,,lr* !*.T_ .* NINO £*['tA NN*' Avvendix B TLiT. LrA'.r~u.hU~IOU 1I40. AQW7lO-VUbA, -ACnt ADendix B Table B.3.10. Definitions and Probabilities for Event Tree Branches given a Medium-Break LOCA at Unit 1 or 2 for LER No. 269/98-004 Branch Failure Probability name Description 14.0 m 14.8 m (46.0 ft) (48.5 ft)

BWST level BWST level MLOCA Initiating Event - Medium-Break Loss of Coolant 4,0 E-005 4.0 E-005 Accident RT Reactor Trip 5.5 E-006 5.5 E-006 HPI High Pressure Injection 2.4 E-004 2.4 E-004 RECIRC Sump Recirculation Required 1.0 E-001 9.0 E-001 RBES-OK RBES Level - 1.2 m (4 ft) when BWST Level = 1.8 m 7.4 E-001 5.5 E-001 (6 ft)

CLBREAK Cold Leg Break 4.0 E-001 4.0 E-001 RBES-MIN RBES = 1.2 m (4 ft) at BWST Minimum Water Level 5.9 E-001 1.7 E-001 (Cold-Leg Break)

RBES = 1.2 m (4 ft) at BWST Minimum Water Level 7.0 E-001 2.5 E-001 (Hot-Leg Break)

OPS-MIN Operators Switch to RBES at BWST Minimum Water 1.1 E-00 1 1.1 E-00 1 Level (Cold-Leg Break)

Operators Switch to RBES at BWST Minimum Water 2.7 E-001 2.7 E-001 Level (Hot-Leg Break)

NO-DELAY Operators Proceed Without Delay through Procedure 1.0 E-001 1.0 E-001 DEPRESS Depressurization to Allow LPR 1.0 E-001 1.0 E-001 LPR-REC LPR Recovered 5.0 E-001 5.0 E-001 Vol.27 B.3-24 NUREG/CR-4674, Vol. 27 B.3-24

Appendix B Appenix B ER No 269/98-004 -005~

Table B.3.1 1. Sequence Logic for MLOCA Sequences for LER No. 361/98-003 Sequence Event tree name number Logic MLOCA + RECIRC 2-4 /RT, /HPI, /RBES-OK, CLBREAK, NO-DELAY, /DEPRESS, LPR-REC MLOCA + RECIRC 2-5 /RT, /HPI, /RBES-OK, CLBREAK, NO-DELAY, DEPRESS MLOCA + RECIRC 2-9 /RT, /HPI, RBES-OK, /CLBREAK, RBES-MIN, OPS-MIN,

/DEPRESS, LPR-REC MLOCA + RECIRC 2-10 /RT, /HPI, RBES-OK, /CLBREAK, RBES-MIN, OPS-MIN, DEPRESS MLOCA + RECIRC 2-14 /RT, /HPI, RBES-OK, CLBREAK, RBES-MIN, OPS-MIN,

/DEPRESS, LPR-REC MLOCA + RECIRC 2-15 /RT, /HPI, RBES-OK, CLBREAK, RBES-MIN, OPS-MIN, DEPRESS NIJREG/CR-4674, Vol. 27 B.3-25 B.3-25 NUREG/CR-4674, Vol. 27

I I*ID NI* "9*OlOf*_fl*A _IliNK Appendix B VI D WI, 1jCIQJQ fMA nnrApedi Table B.3.12. lll--:, Sequence Conditional Probabilities for MLOCA for LER No. 361/98-003 1 ,,,. + Awih Inaita RWQT 1 .pvpl nflP4R8 m (48.5 ft+ Onlyi Conditional Event tree Sequence core damage Core damage Importance Percent name number probability probability (CCDP-CDP) contribution (CCDP)" (CDP)b RECIRC 2-4 2.9 E-007 0.0 2.9 E-007 37.7 RECIRC 2-5 6.5 E-008 0.0 6.5 E-008 8.4 RECIRC 2-9 1.0 E-007 0.0 1.0 E-007 13.0 RECIRC 2-10 2.2 E-008 0.0 2.2 E-008 2.9 RECIRC 2-14 2.4 E-007 0.0 2.4 E-007 31.2 2-15 5.3 E-008 0.0 5.3 E-008 6.9 RECIRC Total (all sequences) j 7.7 E-007 0.0 7.7 E-007

'Sequences shown only.

bBecause design and installation errors such as those that comprise this event are not typically addressed in PRA, their contribution to nominal sequences is zero.

Table B.3.13. ril.~;.Sequence Conditional Probabilities for MLOCA for LER No. 361/98-003 1 ,-. "9 wi Initial RW.*T I pv,'l nf 14.0 m (46 ft* Onlv)1 Conditional Event tree Sequence core damage Core damage Importance Percent name number probability probability (CCDP-CDP) contribution (CCDP)" (CDP)b RECIRC 2-4 1.9 E-008 0.0 1.9 E-008 9.2 RECIRC 2-5 4.3 E-009 0.0 4.3 E-009 2.1 RECIRC 2-9 5.1 E-008 0.0 5.1 E-008 24.7 RECIRC 2-10 1.1 E-008 0.0 1.1 E-008 5.3 RECIRC 2-14 9.9 E-008 0.0 9.9 E-008 48.0 2-15 2.2 E-008 0.0 2.2 E-008 10.7 RECIRC Total (all sequences) JF2.1 E-007 0.0 2.1 E-007 "Sequences shown only bBecause design and installation errors such as those that comprise this event are not typically addressed in PRA, their contribution to nominal sequences is zero.

NUREG/CR-4674, Vol. 27 B.3-26