Text

Final ASP Analysis - Oconee 1, 2, and 3 (LER 269-99-001)
	ML20114E065
Person / Time
Site:	Oconee
Issue date:	05/12/2020
From:	Christopher Hunter; NRC/RES/DRA/PRB
To:	;
	Hunter C (301) 415-1394
References
	LER 269-99-001
	Download: ML20114E065 (42)
	v • d • e

Licensee Event Report (LER) No. 269/99-001 Event

Description:

Postulated high-energy line breaks in turbine building leading to failure of safety-related 4-kV switchgear Event Date: February 24, 1999 Plant: Oconee Nuclear Station, Units 1, 2, and 3 Analysts: Sunil Weerakkody, Erul Chelliah (technical reviewer)

Condition Summary Certain postulated high-energy line breaks (HELBs) in the turbine building could result in the loss of the 4160-volt engineered safeguards switchgear at Oconee Units 1, 2, and 3 (Refs. 1, 2). This analysis assesses the risk significance of postulated breaks in the turbine building.

The change in core damage probabilities associated with this condition over a one-year period for Oconee Units 1, 2, and 3 are 8.2 x 10-6, 5.6 x 10-6, and 5.2 x 10-6 per year, respectively. The nominal core-damage probability of Oconee Units 1,2, and 3 over a one-year period is 2.6x10-5.

The differences in the design in reactor coolant pump seals cause the difference in the change in core damage probability among the units. The reactor coolant pumps at Oconee Unit 1 had seal assemblies manufactured by Westinghouse which consist of O-rings that were not qualified for high temperatures and pressures. The reactor coolant pumps seal assemblies at Oconee Units 2 and 3 are manufactured by Sulzer.1 Condition Description At Oconee Units 1, 2, and 3, the 4160-volt engineered safeguards switchgear is located in the turbine building. There are no barriers which provide separation between the switchgear (see Figure 1). The spatial separation of xx feet is no hindrance to the movement of steam. Furthermore, there are a number of high-energy lines which carry main feedwater and auxiliary steam in the vicinity of the switchgear. A high-energy line failure in these lines could generate enough steam to fail all three trains of switchgear.

Additional Condition-Related Information Figures 2 and 3 show the core damage sequences resulting from a HELB in the turbine building, which disables all three 4-kV switchgear trains of a given unit located in Elevation xxx feet of turbine building. As shown in Figure 8-1 of the UFSAR (Ref. 3), all power supplies to the plant from normal and emergency sources (Offsite supply, Keowee Hydro, Lee station) go through these three 4-KV switchgear cabinets.

The Standby Shutdown Facility, which is common to all three units and which has its own AC and DC power supply from the Standby Shutdown Facility diesel and batteries will not be affected by the postulated HELB. Section 9.6 of the UFSAR (Ref. 3) provides the details of the Standby Shutdown Facility. Power to an auxiliary switchgear located in the auxiliary building will also remain available.

However, manual-local action, which includes establishing connections using cables, is required to use this power source to supply the high-pressure injection pumps. This power source cannot supply power to the emergency feedwater pumps. It can supply power to a station auxiliary service water pump to inject into steam generators.

The loss of all AC power as a result of the loss of all three trains of switchgear generates an ESF signal, trips the reactor, the turbine, the condensate booster pumps, and the hotwell pumps, and fails the main 1

In 2000, the reactor coolant pump Westinghouse seal assemblies for Unit 1 were replaced with seal assemblies manufactured by Sulzer (formally called Bingham).

1

LER No. 269/99-001 feedwater system [See section 10.4.7.1.2 and 10.4.7.1.3 of the UFSAR (Ref. 3)]. Loss of the 4-kV cabinets causes the loss of the motor-driven emergency feedwater pumps. Since the non-safety 250-VDC panel which supports the turbine-driven pump start circuitry is located in the vicinity of the 4-kV switchgear cabinets, that DC supply may fail. Therefore, the turbine-driven emergency feedwater pump may have to be locally-manually started.

The Standby Shutdown Facility provides the shutdown capability in the event of the postulated HELB which fails all three switchgear cabinets. The reactor coolant makeup pump of the Standby Shutdown Facility which is rated at 29 gpm provides reactor coolant pump seal cooling and prevents reactor coolant pump seal failure. There are three reactor coolant makeup pumps (one per each unit). The decay heat removal function will be accomplished by the auxiliary service water pump located in the Standby Shutdown Facility building. There is one auxiliary service water pump which can support all three units.

This pump is powered from the Standby Shutdown Facility diesel. In essence, the mitigation actions of this scenario is identical to the mitigating actions of a station black out event with the exception of the DC power unavailability to the turbine-driven emergency pumps2.

Modeling Details and Key Assumptions

Subset of HELBs that fail the three 4-kV switchgear trains - HELBs can occur inside turbine buildings as a result of breaks in main steam lines, main feedwater lines, and breaks in other lines carrying steam or feedwater between high-pressure heaters, moisture separators, and turbines. A plant walkdown conducted during January 8-10, 2001, led to the conclusion that breaks in approximately 20 percent of main feedwater and breaks in an auxiliary steam system pipe, which is about 200 feet in length, could fail all three switchgear cabinets. Reference 4 provides the basis for this conclusion. Reference 4 is provided as Attachment 2 to this writeup. Section 2 of Attachment 1 provides plant specific experience on HELBs (consequences of three HELBs which occurred at Oconee station). This plant specific experience augments a key conclusion drawn in Reference 4, which states that HELBs that occur in the basement of the turbine building are unlikely to fail all three 4-kV switchgear trains.

Characteristics of the switchgear cabinets considered to select the subset of HELBs that fail the three 4-kV switchgear trains - The three Oconee units received their operating licenses in 1973 (Oconee Units 1 and 2) and 1974 (Oconee Unit 3). Therefore, the 4-kV switchgear cabinets at Oconee are not qualified to the current standards provided by the National Electrical Manufacturers Association (NEMA). To determine the susceptibility of these cabinets to steam or moisture intrusion and the consequential failures, characteristics of the switchgear cabinets were compared against the current standards. Key conclusions derived from this comparison are as follows:

S The switchgear cabinets have adequate protection against rain down of moisture.

S The switchgear cabinets do not have adequate protection against steam or moisture intrusion via ventilation inlets and outlets or via other openings such as unsealed doors.

S The risk from inadvertent actuation of fire sprinklers is negligible.

S Any HELB event that can flood the switchgear cabinets would cause switchgear failure due to steam intrusion into the cabinets.

These conclusions were used to select the subset of HELBs capable of affecting all three 4-kV switchgear trains. Section 3 of Attachment 1 provides detail on the above conclusions.

2 HELBs which fail one or two of the three switchgear trains are of low risk significance compared to the risk significance of those that fail all three switchgear trains. Section 1 of Attachment 1 provides the basis for this conclusion.

2 SENSITIVE - NOT FOR PUBLIC DISCLOSURE

LER No. 269/99-001

Contribution from main feedwater system to the frequency of a HELB - Based on nuclear plant operating experience between 1970-2000, the average frequency of a main feedwater pipe break at a nuclear power plant is approximately 8.3x10-4 per critical-year3. Based on information collected during a plant walkdown conducted during January 8-10, 2001, approximately 20 percent of the breaks in the main feedwater system are capable of failing all three switchgear cabinets. Therefore, the frequency of main feedwater breaks capable of failing switchgear is approximately 1.7x10-4 per critical-year (=20% of 8.3x10-4.) Section 4 in Attachment 1 provides details of this frequency calculation.

Contribution from auxiliary steam lines to the frequency of a HELB - A search of the NRCs LER database [Sequence Coding and Search System (SCSS) (Ref. 5)] identified 22 high-energy line failure events (Refs. 6-27). These events occurred between 1985-1999. Of these, eight events occurred at pressurized water reactors (PWRs) in pipes whose attributes are similar to the attributes of the auxiliary steam lines. Section 5 in Attachment 1 provides summaries of these eight events at PWRs and several other events during which electrical cabinets were affected as a result of high-energy line leaks or breaks. Based on this experience and operating reactor critical-years between 1985-1999 (850 PWR critical-years based on References 28, 29, 30, and 31), the frequency of HELBs inside the turbine building similar to those that may occur in the auxiliary steam lines is 1.0 x 10-2 per critical-year (= 8.5/850).

Based on expert judgement (See Attachment 2 for details), the length of auxiliary steam piping in the vicinity of the switchgear cabinets is approximately 200 feet. This is about 1.8 percent of total piping similar to auxiliary steam pipes per unit. Therefore, the frequency of auxiliary steam line breaks capable of failing switchgear is approximately 1.8 x 10-4 per critical-year [= 0.018 x (1.0 x 10-2)].4 Section 6 in Attachment 1 provides additional details on this frequency calculation.

In consideration of changes to pipe break prevention programs instituted at nuclear plants (e.g.,

erosion/corrosion programs), it was necessary to consider if any observable trends in industry performance could be attributed to programs such as erosion/corrosion, etc.. There were no industry wide trends in overall frequency noted (Refs. 38, 47). There were no known plant-specific design or operational features that would indicate that Oconee was outside (better or worse than) the industry norms.

Frequency of HELBs that fail the three 4-kV switchgear cabinets - The total frequency of a HELB capable of failing all three switchgear cabinets is the sum of the frequency contributions from main feedwater and auxiliary steam pipes. This equates to 3.5 x 10-4 per critical-year

[= (1.7 x 10-4)+(1.8 x 10-4)].

Probability of recovery of switchgear failures due to harsh environment - To recover the equipment, cabinets must be opened and allowed to dry. The dry-out process may take several hours or days.5 Furthermore, considering the amount of energy released from a postulated HELB in the vicinity of the switchgear cabinets, the cabinets may sustain significant damage (including structural damage) rather than simply shorts as a result of the postulated HELB. Therefore, the 3

The calculation implicitly assumes that the main feedwater break frequency at Oconee is equal to the average main feedwater break frequency at nuclear plants. Considering the numbers of main feedwater equipment and general layout of these equipment in the turbine building at Oconee in comparison to the average nuclear power plant, this is a reasonable assumption.

4 The calculation implicitly assumes that the break frequency at Oconee is equal to the average break frequency at pressurized water reactors. Considering the numbers of equipment and general layout of these equipment in the turbine building at Oconee in comparison to the average pressurized water reactor, this is a reasonable assumption.

5 S. Weerakkody (U.S. NRC), meeting with W. Raughley (U.S. NRC).

3 SENSITIVE - NOT FOR PUBLIC DISCLOSURE

LER No. 269/99-001 probability of failure to recover the affected switchgear train during a 24-hour mission time is determined to be 1.0.

Criticality factor (fraction of time the plant is at power) for Oconee Units 1, 2, and 3 - Based on Table H-3 of NUREG/CR-5750 (Ref. 30), the average criticality factors for Oconee Units 1, 2, and 3 for the time period 1987-1995 are 0.87, 0.88, and 0.84, respectively.

Probability of failing to recover seal cooling capability within 10 minutes (event tree top event RCM10M) - Failure of the switchgear trains would fail reactor coolant pump seal cooling. If reactor coolant pump seal cooling could not be established using the Standby Shutdown Facility within about 10 minutes, there is some likelihood of reactor coolant pump seal failure (NUREG/CR-5167, Ref. 31). The probability of failing to recover seal cooling within 10 minutes is approximately 0.27. This probability is dominated by the probability of operator error to establish Standby Shutdown Facility reactor coolant makeup (0.05) and probability of failure of Standby Shutdown Facility support systems (0.16). The bases for these probabilities are provided in Section 7 to Attachment 1.

Probability of failing to recover seal cooling capability within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months (event tree top event RCM2HR) - This event tree top event is used for Oconee Unit 1 only. If reactor coolant pump seal cooling could not be established using the Standby Shutdown Facility within about 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , for seal assemblies whose O-rings are not qualified, there is an additional likelihood of reactor coolant pump seal failure due to O-ring failure (NUREG/CR-5167, Ref. 31). The probability of failing to recover seal cooling within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months is approximately 0.22. This probability is dominated by the probability failure of Standby Shutdown Facility support systems (0.16). The bases for this probability is provided in Section 7 to Attachment 1.

Probability of reactor coolant pump seal failure if seal cooling is not recovered for 10 minutes (event tree top event RCPSEAL) - NUREG/CR-5167 (Ref. 31) provides failure probabilities for Westinghouse reactor coolant pump seal assemblies. If seal cooling is not recovered for 10 minutes, the Rhodes model uses a total reactor coolant pump seal failure probability (in the absence of seal cooling) of 0.22 for Westinghouse reactor coolant pump seal assemblies that use improved O-ring material. Oconee Units 2 and 3 have reactor coolant pump seal assemblies manufactured by Sulzer. Assuming that the Sulzer reactor coolant pump seals are as good as the improved Westinghouse reactor coolant pump seal assemblies, the failure probability of reactor coolant pump seals in the absence of seal cooling is 0.22. 6 Oconee Unit 1 has reactor coolant pump seal assemblies whose O-rings have not been qualified for high pressures and temperatures. For these seal assemblies, based on the Rhodes model (Ref. 31), if seal cooling is unavailable for over 10 minutes, the probability of seal failure is 0.22. If seal cooling is unavailable for over 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , the probability of failure (due to O-ring failure) is 1.0.

Probability of loss of all decay heat removal (event tree top event EFW) - In the event of loss of main feedwater, and loss of the three switchgear trains, the following systems are available to remove decay heat: (a) the turbine-driven emergency feedwater pump (TDEFWP) train and the station auxiliary service water system, (b) emergency feedwater cross-tied from other units, and (c) the auxiliary service water supported by the safe shutdown facility.

6 The GSI-23 closeout memo (Ref. 32) endorses the use of the Rhodes model for non-Westinghouse reactor coolant pump seal assemblies until a standard model is developed, but does not specify which O-ring material is to be used with the Rhodes model. According to the GSI-23 closeout memo, the use of the Rhodes model is acceptable until better models are developed for Sulzer seals. This does not imply that the O-ring material used in Sulzer seals is similar to or qualified to the same standard as the improved Westinghouse O-ring material or that the Rhodes model of the Westinghouse reactor coolant pump seal assembly reflects the actual behavior of the Sulzer reactor coolant pump seal assembly.

4 SENSITIVE - NOT FOR PUBLIC DISCLOSURE

LER No. 269/99-001 The probability of failure of all of the above to provide decay heat removal is approximately 0.016. If Standby Shutdown Facility support systems are available, the emergency feedwater failure probability is approximately 0.012. This probability is dominated by the probability of failure of the turbine-driven emergency feedwater pump and station auxiliary service water pump (0.073),

probability of failure of Standby Shutdown Facility auxiliary service water (0.25) and probability of failure of the cross-tie (0.26), which are redundant to each other. The basis for these probabilities is included as Section 8 to Attachment 1.

Feed-and-bleed cooling (event tree top event F&B) - Feed-and-bleed cooling (following a loss of secondary heat removal) requires the high-pressure injection pumps. One pump is sufficient to establish feed-and-bleed cooling. However, when the three trains of switchgear are lost, all high-pressure injection pumps become unavailable. Even though the licenses procedures direct the operators to recover one high-pressure injection pump with alternate emergency power cables from the station auxiliary service water switchgear, this action is complex and cannot be implemented before core damage due to loss of all decay heat removal (i.e., within 40 minutes). Therefore, the probability of failure to establish feed-and-bleed prior to the onset of core damage is 1.0.

High-pressure injection (event tree top event HPI) - In the event of an reactor coolant pump seal LOCA with secondary heat removal from the emergency feedwater available, the core would uncover in about four hours without any high-pressure injection (Ref. 31). Each Oconee Unit has three high-pressure injection pumps. However, all of them will be unavailable due to the failed switchgear trains. The licensee has a procedure that would allow operators to establish alternate power to one high-pressure injection pump from the station auxiliary service water transformer. The probability of failure to inject using this procedure is 0.04.

Decay heat removal (event tree top event DHR) - Since the postulated high-energy line failure fails AC power to the low-pressure injection pumps, the probability of decay heat removal failure is 1.0.

Piggy-back cooling (event tree top event PB-COOL) - Since the postulated HELB disables all three switchgear trains, the low-pressure injection pumps cannot be powered. Low-pressure injection pumps are essential to perform piggy-back cooling. Therefore, a probability of 1.0 is assumed for this event.

Refilling borated water storage tank (event tree top event BWST) - During events in which power to the 4-kV switchgear cabinets is lost, Oconee units cannot rely on piggy-back cooling or decay heat removal for long-term heat removal. However, based on information provided by the licensee,7 on sequences where high-pressure injection has been recovered within four hours, the borated water storage tank can be refilled to continue injection. The borated water storage tank level high/low setpoint alarm will activate when the tank level reaches 47 feet decreasing. The alarm response procedure directs the operator to procedure OP/1/A/1104/004 (borated water storage tank Operation) for makeup to the borated water storage tank. Multiple methods that use pumps from other units unaffected by the HELB can be used to refill the borated water storage tank. Based on the licensees IPEEE (Ref. 40), the probability of failure for this event is 1.0 x 10-3.

Analysis Results Figures 2 and 3 show the event trees used to quantify sequence frequencies. Table 1 summarizes the frequencies and system failure probabilities used in the calculations. Table 2 provides basic events whose probabilities were adjusted or new basic events created to model the HELB event. Table 3 shows the change in core damage probabilities associated with dominant sequences. Table 4 shows the sequence logic for dominant sequences. Event trees and fault trees generated using the SPAR models (Ref. 33) were used to quantify the sequences.

7 S.D. Weerakkody (U.S. NRC), teleconference with H.D. Brewer (Duke Energy Corporation),

January 24, 2001.

5 SENSITIVE - NOT FOR PUBLIC DISCLOSURE

LER No. 269/99-001 The change in core damage probabilities associated with this condition over a one-year period for Oconee Units 1, 2, and 3 are 8.2 x 10-6, 5.6 x 10-6, and 5.2 x 10-6 per year, respectively. Table 3 shows the change in core damage probabilities associated with dominant sequences. The nominal core damage probability of Oconee Units 1, 2, and 3 over a one-year period is 2.6x10-5 (Ref. 42).

For Oconee Unit 1, approximately 80 percent of the contribution to the change in core damage probability is associated with sequences in which reactor coolant pump seals failed. In comparison, for Oconee Units 2 and 3, due to improved seals, only 28 percent of the contribution is associated with the sequences in which the reactor coolant pump seals failed.

The differences in the design in reactor coolant pump seals cause the difference in the core damage probability among the units. The reactor coolant pumps at Oconee Unit 1 had seal assemblies manufactured by Westinghouse which consist of O-rings that were not qualified for high temperatures and pressures. The reactor coolant pumps at Oconee Units 2 and 3 have reactor coolant pumps whose seals were manufactured by Sulzer.

References

1. U.S. Nuclear Regulatory Commission, NRC Inspection Report Nos. 50-269/99-10, 50-270/99-10, 50-287/99-08, 50-269/99-13, 50-270/99-13, and 50-287/99-13.

2. LER 269/99-001, Emergency Feedwater Outside Design Basis Due to Deficient Documentation, March 26, 1999.

3. Duke Energy Corporation, Updated Final Safety Analysis Report of the Oconee Nuclear Station.

4. Memorandum from Mark A. Cunningham to Patrick W. Baranowsky, Expert Judgement Related to Potential HELB Effects on 4-KV Switchgear at Oconee, January 17, 2001.

5. U.S. Nuclear Regulatory Commission, Sequence Coding and Search System for Licensee Event Reports Users Guide, NUREG/CR-3905, August 1984.

6. LER 305/85-017, Ruptured Excess Steam Vent Line, August 8, 1985.

7. LER 321/86-018, Leaking Valve Causes Level Switch Failure Resulting in Turbine Trip and Reactor Scram, April 20, 1986.

8. LER 287/86-002, Manual Reactor Trip Following a Heater Drain Pipe Rupture, October 17, 1986.

9. LER 244/86-004, Manual Reactor Trip due to Large Steam Leak in Turbine Building, August 28, 1986.

10. LER 366/86-010, Steam Leak Causes Relay Actuation Resulting in Turbine Trip and Reactor Scram, May 23, 1986.

11. LER 255/87-016, Errant Valve Closure Results in Manual Reactor Trip, June 19, 1987.

12. LER 281/86-020, Rev. 2, Reactor Trip and Main Feedwater Pipe Rupture, March 31, 1987.

13. LER 440/87-027, Rev. 1, Loss of Main Condenser Vacuum Results in Manual Reactor Shutdown, July 31, 1987.

14. LER 368/89-006, High Pressure Extraction Steam Line Rupture Due to Pipe Wall Thinning Resulted in a Reactor Trip Caused by High Reactor Coolant System Pressure, May 18, 1989.

6 SENSITIVE - NOT FOR PUBLIC DISCLOSURE

LER No. 269/99-001

15. LER 280/90-003, Rev. 1, Unit 1 LP Heater Drain System Pipe Leak Due to Excessive Pipe Wall Thinning, October 29, 1990.

16. LER 423/90-030, Rev. 2, Manual Reactor Trip Due to Moisture Separator Reheater Piping Line Breaks, June 6, 1991.

17. LER 331/91-001, Manual Scram Shutdown of Plant Due to Steam Leak in the Heater Bay, January 31, 1991.

18. LER 336/91-012, Rev. 1, Manual Reactor Trip Due to Plant Conditions Resulting from a Rupture in the Reheater Drain Tank to High Pressure Feedwater Heater Pipe, January 28, 1993.

19. LER 309/92-007, Erosion/Corrosion Failure of Moisture Separator Reheater Scavenging Vent Piping Elbow, dated September 15, 1992.

20. LER 318/92-007, Manual Trip Caused by Stuck Open 23 Moisture Separator/Reheater Relief Valve, October 27, 1992.

21. LER 328/93-001, Extraction Steam Line Rupture Causes High Generator Output Voltage and Manual Reactor Trip, March 31, 1993.

22. LER 336/95-032, Rev. 2, Manual Reactor Trip Due to Unisolable Secondary Steam Leakage, September 2, 1998.

23. LER 270/96-004, Secondary Drain Line Rupture Results in a Manual Reactor Trip, December 9, 1996.

24. LER 280/97-001, Rev. 1, Shutdown Due to Steam Drain Line Weld Leak, June 10, 1997.

25. LER 482/97-008, Manual Reactor Trip Due to A Steam Leak in A Non-Safety Related Third Stage Extraction Steam Isolation Valve, June 16, 1997.

26. LER 318/98-004, Manual Plant Trip Due to Moisture Separator Reheater Vent Line Rupture, August 24, 1998.

27. LER 483/99-003, Manual Reactor Trip Due to Heater Drain System Pipe Rupture Caused by Flow Accelerated Corrosion, September 10, 1999.

28. U.S. Nuclear Regulatory Commission, Office for Analysis and Evaluation of Operational Data, Annual Report - 1996, NUREG/CR-1272 Vol. 10, December 1997.

29. U.S. Nuclear Regulatory Commission, Office for Analysis and Evaluation of Operational Data, Annual Report - 1997, NUREG/CR-1272 Vol. 11, November 1998.

30. J. P. Poloski, et. al., Rates of Initiating Events at U.S. Nuclear Power Plants: 1987-1995, NUREG/CR-5750, February 1999.

30a F. T. Stetson, et. al., Analysis of Reactor Trips Originating in Balance of Plant Systems, NUREG/CR-5622, September 1990.

31. R. G. Neve, and H.W. Heiselmann, Cost/Benefit Analysis for Generic Issue 23: Reactor Coolant Pump Seal Failure, NUREG/CR-5167, April 1991.

32. Memorandum from Ashok C. Thadani to William D. Travers, Closeout of Generic Safety Issue 23:

Reactor Coolant Pump Seal Failure, U.S. Nuclear Regulatory Commission, November 8, 1999.

7 SENSITIVE - NOT FOR PUBLIC DISCLOSURE

LER No. 269/99-001

33. Idaho National Engineering Laboratory, Simplified Plant Analysis Risk Model for Oconee 1, 2 & 3 (ASP PWR D), Revision 2QA, January 1998.

34. U.S. Nuclear Regulatory Commission, Guidelines on Modeling Common-Cause Failures in Probabilistic Risk Assessment, NUREG/CR-5485, November 1998.

35. U.S. Nuclear Regulatory Commission, Information Notice 82-22, Failures of Turbine Exhaust Lines, July 9, 1982.

36. IEEE 833 Recommended Practice for the Protection of Electric Equipment in Nuclear Power Generating Stations from Water Hazards, 1988.

37. U.S. Nuclear Regulatory Commission, Assessment of Risk Significance Associated With Issues Identified at D.C. Cook Nuclear Power Plant, NUREG-1728, October 2000.

38. K. Jamali, Pipe Failure Study Update, EPRI TR-102266, April 1993.

39. R. Nyman et al., Reliability Attributes of Piping System Components, Framework for Estimating Failure Parameters from Service Data, SKI {Swedish Nuclear Power Inspectorate (SKI) Report 97:

26}, December 1997.

40. Duke Power Company, Oconee Nuclear Station, Units 1 and 2 Docket Nos. 50-269, 50-270, and 50-287, Individual Plant Examination of External Events (IPEEE) Submittal, December 28, 1995.

41. J. C. Byers, et al., Revision of the 1994 ASP HRA Methodology (Draft), INEEL/EXT-99-00041, January 1999.

42. Duke Power Company, Oconee Nuclear Station, Units 1 and 2 Docket Nos. 50-269, 50-270, and 50-287, Individual Plant Examination (IPE), February 13, 1995.

43. J. P. Poloski, et. al., Reliability Study: Auxiliary/Emergency Feedwater System, 1987-1995, NUREG/CR-5500, Vol. 1, August 1998.

44. W.R. McCollum, Jr., Duke Energy, Oconee Nuclear Station, letter to U.S. Nuclear Regulatory Commission, dated July 19, 2001. (ADAMS Accession No. ML0121202810) 8 SENSITIVE - NOT FOR PUBLIC DISCLOSURE

9 Figure removed during SUNSI review.

Figure 1. Simplified layout diagram showing 4-kV switchgear locations in the Oconee turbine building (El. 796+6')

LER No. 269/99-001

Hig h-Energ y Reacto r RCP Seal RCP Seal RCP Seal Emerg ency No PORVs High Pressure Feed & Bleed RCS Decay Heat Pig gy-Back Refill Line Br eak Tr ip Cooling Coolin g Integr ity Feedwater PORVs lift Reseat Injectio n Cooling Cooldo wn Remo val Coo lin g BWST w/i 10 Min w/i 2 Hrs Maintained f or DHRl HEL- TB2 RT RCM10M RCM2 HR RCP-SEAL EFW-HEL PORV-SBO PRVL-RES HPI-HEL F&B COOLDOWN DHR-HEL PB-COOL-HE BWST #

1 OK 2 OK 3 OK 4 OK 5 OK SENSITIVE - NOT FOR PUBLIC DISCLOSURE 6 CD 7 OK 8 OK 9 CD 10 C D 11 O K 12 O K 13 C D 14 C D 15 O K 16 O K 17 O K 18 O K 19 O K 20 C D 10 21 O K 22 O K 23 C D 24 C D 25 O K 26 O K 27 C D 28 C D 29 O K 30 O K 31 O K 32 C D 33 O K 34 O K 35 C D 36 C D 37 C D LER No. 269-99/001 38 O K 39 O K 40 O K 41 C D 42 O K 43 O K 44 O K 45 C D 46 C D 47 C D Figure 2. Event tree for high-energy line break in turbine building at Oconee Unit 1.

H ig h -En e rg y Re a c to r RC P Se a l RC P Se a l Em e rg e n c y No PO RV s H ig h Pre ssu re Fe e d & Ble e d RC S Dec ay Heat Pig g y -Ba c k Re fil l Li ne Bre a k Tri p C o o li n g In te g ri ty Fe e d w a te r PO RV s lift Re se a t In je c ti o n C o o lin g C o o ld o w n Re m o va l C o o l in g BW ST w / i 10 M in M a in ta in e d fo r D H Rl H EL-TB22 3 RT RC M 10 M RC P-SEA L EFW -HEL PO RV -SBO PRVL-RES H PI-HEL F&B C OO LD OW N D HR-HEL PB-C O O L-HE BW ST #

1 OK 2 OK 3 OK 4 OK 5 OK 6 CD SENSITIVE - NOT FOR PUBLIC DISCLOSURE 7 OK 8 OK 9 CD 10 C D 11 OK 12 OK 13 C D 14 C D 15 OK 16 OK 17 OK 18 OK 19 OK 11 20 C D 21 OK 22 OK 23 C D 24 C D 25 OK 26 OK 27 C D 28 C D 29 OK 30 OK 31 OK LER No. 269-99/001 32 C D 33 OK 34 OK 35 C D 36 C D 37 C D 38 C D Figure 3. Event tree for high-energy line break in turbine building at Oconee, Units 2 and 3.

LER No. 269/99-001 Table 1. Failure probabilities of event tree top events, as shown in Figures 2 and 3.

Event Tree Top Failure Event Name Description Probability HEL High-energy line failure capable of affecting all three switchgear 3.5E-4 trains RT Reactor trip 1.2E-6 RCM10M Reactor coolant pump (RCP) seal cooling established within 10 0.27 minutes RCM2HR RCP seal cooling established within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months 0.22 RCP-SEAL RCP seal integrity maintained 0.22 EFW-HEL Emergency feedwater (EFW) for steam generators 0.016 EFW without crediting cross-tie 0.021 EFW when Standby Shutdown Facility support states are 0.012 available PORV-SBO Pressurizer power-operated relief valves (PORVs) do not lift 0.37 during transient PRVL-RES PORVs reseat 0.007 HPI-HEL High pressure injection - when emergency feedwater available 0.04 F&B Feed-and-bleed cooling 1.0 COOLDOWN Reactor coolant system cool down to establish decay heat 0.004 removal DHR-HEL Decay heat removal using low pressure system 1.0 PB-COOL-HE Piggy-back cooling (sump recirculation) 1.0 BWST Refill borated water storage tank to accomplish long-term heat 0.001 removal for RCP seal LOCA 12

LER No. 269/99-001 Table 2: Definitions and probabilities for selected basic events.

Event Name Description Base Current Modified Probability Probability for this event HEL-TB2 Initiating Event-HELB 3.0E-004(note 1) 3.0E-004(note 1) No (per year) 3.1E-004(note 1) 3.1E-004(note 1) 2.9E-004(note 2) 2.9E-004(note 2)

IE-LOOP Initiating Event-LOOP 1.6E-005/hr 0 Yes IE-SLOCA Initiating Event-Small LOCA 1.5E-006/hr 0 Yes IE-SGTR Initiating Event-Transient 3.0E-004/hr 0 Yes IE-TRANS Initiating Event-Steam Generator Tube 1.6E-006/hr 0 Yes Rupture HEP-SSF-RCM Operator fails to establish Standby 0.05 0.05 No(note 6)

Shutdown Facility (SSF) reactor coolant makeup (RCM)

HEP-SSF-RCM- Operator fails to recognize need to 0.025 0.025 No(note 6)

DIAG establish SSF RCM HEP-SSF-RCM2HR Operator fails to establish SSF RCM 0.005 0.005 No(note 6)

HEP-SSF-RCM- Operator fails to recognize need to 0.0025 0.0025 No(note 6)

DIAG-2HR establish SSF RCM RCM-WO-SSF Random failure of SSF RCM 0.06 0.06 No(note 7)

SSF-DGN-FR-SSF SSF diesel fails to run 0.039 0.039 No(note 5)

SSF-DGN-FS-SSF SSF diesel fails to start 0.013 0.013 No(note 5)

SSF-DGN-TM-SSF SSF diesel out due to test or maintenance 0.031 0.031 No(note 5)

SSF-MDP-TM-SSF SSF SW MDP unavailable 0.083 0.083 No(note 5)

RCPSEAL-FAIL reactor coolant pump seal failure 1.0(note 3) 1.0(note 3) No 0.22(note 4) 0.22(note 4)

ACT-TAC-LP-3TC Div 3TC 4-kV bus fails 9.0E-005 TRUE Yes(note 8)

ACT-TAC-LP-3TD Div 3TD 4-kV bus fails 9.0E-005 TRUE Yes(note 8)

ACT-TAC-LP-3TE Div 3TE 4-kV bus fails 9.0E-005 TRUE Yes(note 8)

HEP-XTIE Operator fails to establish emergency not 0.25 Yes(note 6) feedwater cross-tie modeled(note 9)

HEP-XTIE- Operator fails to recognize need to not 0.005 Yes(note 6)

DIAGNOSTIC establish EFWcross-tie modeled(note 9)

HEP-SSF-ASW Operator fails to establish SSF auxiliary 0.005 0.005 No(note 6) service water (ASW)

HEP-SSF-ASW- Operator fails to recognize the need to 0.0025 0.0025 No(note 6)

DIAG establish SSF ASW SSF-ASW- Random failures of SSF ASW 0.1 0.1 No(note 5)

RANDOM 13

LER No. 269/99-001 Event Name Description Base Current Modified Probability Probability for this event HEP-STATION- Operator fails to establish station ASW not 0.0025 No(note 6)

ASW modeled(note 9)

HEP-TDEFWP- Operator fails to recognize need to not 0.005 No(note 6)

DIAG manually start TDEFW pump modeled(note 9)

TDEFWP-HEP Operator fails to manually start TDEFWP not 0.025 No(note 6) modeled(note 9)

TDEFWP Turbine-driven pump fails to start and run not modeled 0.02 Yes(note 10) for 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months (until UST empties)

BWST-REFILL Failure to refill borated water storage tank not modeled 0.001 Yes(note 11)

Notes:

1. This is the product of the HELB (3.5E-004 per critical-year) and the criticality factors (0.87 for Unit 1 and 0.88 for Unit 2).

2. This is the product of the HELB (3.5E-004 per critical-year) and the criticality factors (0.84 for Unit 3).

3. The probability used for Oconee Unit 1 based on Rhodes model (Ref. 31).

4. The probability used for Oconee Units 2 and 3 based on Rhodes model (Ref. 31).

5. SPAR model (Ref. 33). For SSF, Rev. 3i values were used.

6. See Table 1 of Attachment 1 for the basis.

7. Based on Oconee IPE (Ref. 44).

8. All three 4-KV buses fail due to the postulated HELB. Note that when the three 4-kV buses are set to TRUE, HPI, HPI-C (feed and bleed cooling), DHR (decay heat removal), and PB-COOL (piggy back cooling) functions fail with a probability of 1.0. Only the turbine-driven AFW and SSF systems will remain available.

9. In the base case, since three EFW trains and SSF ASW is available, the cross-tie and the station ASW was not credited.

10. Based on AFW reliability study (Ref. 43).

11. Based on Oconee IPEEE tornado analysis (Ref. 40).

14 SENSITIVE - NOT FOR PUBLIC DISCLOSURE

LER No. 269/99-001 Table 3: Change in core damage probability of dominant core-damage sequences.

Change in Core Event Tree Name Sequence Number Damage Probability Percent Contribution Oconee Unit 1 HELB 46 3.0E-006 36.6 HELB 45 2.8E-006 34.2 HELB 14 1.3E-006 15.9 Total (all sequences) 8.2E-006 Oconee Unit 2 HELB 28 2.6E-006 46.4 HELB 14 1.4E-006 25.0 HELB 37 9.6E-007 15.0 HELB 36 8.2E-007 12.9 Total (all sequences) 5.6E-006 Oconee Unit 3 HELB 28 2.6E-006 46.2 HELB 14 1.3E-006 25.0 HELB 37 9.0E-007 15.2 HELB 36 7.7E-007 13.1 Total (all sequences) 5.2E-006 15 SENSITIVE - NOT FOR PUBLIC DISCLOSURE

LER No. 269/99-001 Table 4: Sequence logic for dominant sequences.

For Oconee Units 1 Event Tree Name Sequence Logic number HELB 46 /RT, RCM10M, RCM2HR, EFW-HEL HELB 45 /RT, RCM10M, RCM2HR, /EFW-HEL, HPI-HEL HELB 14 /RT, /RCM10M, EFW-HEL, FB For Oconee Units 2 and 3 Event Tree Name Sequence Logic number HELB 28 /RT, RCM10M, /RCP-SEAL, EFW-HEL, FB HELB 14 /RT, /RCM10M, EFW-HEL, FB HELB 37 /RT, RCM10M, RCP-SEAL, EFW-HEL HELB 36 /RT, RCM10M, RCP-SEAL, /EFW-HEL, HPI-HEL 16 LER No. 269/99-001 Attachment 1 Details of Calculations Section 1: Basis for concluding that high-energy line leaks or breaks which fail one or two of the three switchgear trains are of low risk significance compared to the risk significance of those that fail all three switchgear trains.

The SPAR model (Rev. 2 QA Version)(Ref. 33) for Oconee was used to estimate the CDP for an event in which only one of the three switchgear trains fail. Because of several asymmetries in system dependencies, this CDP varied according to which specific switchgear train failed as a result of the high-energy line failure. However, the maximum CDP given that a 4-kV bus (Division 3 TC AC bus) had failed was 1.6x10-5.

Therefore, even if every high-energy line failure in the turbine building {frequency . 2x10-2/year based on 24 high-energy line breaks and leaks identified using SCSS (Ref. 5) over 1200 reactor-years} failed one switchgear train, the change in CDF (CDF) would be 3.2x10-7 [= (2x10-2) x (1.6x10-5)]. Rev. 2QA version of the SPAR model for Oconee does not credit the capability of the Standby Shutdown Facility.

The Standby Shutdown Facility provides an additional train of systems to mitigate accidents. When the capability of the Standby Shutdown Facility is credited, the CDF is less than 3.2x10-7.

Postulated high-energy line leaks or breaks which affect two of the three switchgear trains are not analyzed since the probability of a high-energy line failure capable of failing two switchgear trains without affecting the third is low compared to the probability of random failure of the third train. (That is, a high-energy line failure that fails two of the three switchgear trains would most likely fail the third switchgear train as well.) The basis for this conclusion is as follows.

All three switchgear trains are of similar design and separated from each other by approximately 15 feet.

None of the switchgear trains are qualified for harsh environments. There are no barriers (e.g., walls) to inhibit progression of steam from one switchgear train to another. Reference 34 (NUREG/CR-5485) identifies diversity (functional, equipment, staff), physical or functional (spatial separation, physical protection, interlocks, administrative control), testing and maintenance policy, and additional redundancy, as defenses against common-cause failure. These defenses are either inapplicable to or do not exist at the 4-kV switchgear cabinets at Oconee. Figure 1 shows that there is no separation (except spatial) between the switchgear. The spatial separation of 15 feet is no hindrance to the movement of steam. Therefore, a high-energy line failure that could generate enough steam to fail two trains of switchgear has a high conditional probability of failing the third switchgear train.

Section 2: Oconee plant specific experience related to HELB events and expert judgement on the pipe sections that could fail switchgear cabinets Since 1982, three HELB events occurred at Oconee. These HELB event are documented in Information Notice 82-22 (Ref. 35), LER 287/86-002 (Oconee 3) (Ref. 8), and LER 270/96-004 (Oconee 2) (Ref. 23).

Information Notice 82-22: The event discussed in Information Notice 82-22 (Ref. 39) occurred on June 28, 1982, at Oconee Unit 2. During this event, while the plant was operating at 95% power, it experienced a four square feet rupture in a 24-inch diameter, long-radius elbow in the feedwater heater extraction line, which is supplied heat from steam from the high-pressure turbine exhaust. The break occurred in the lower elevation (basement) in the turbine building, while the safety-related switchgear cabinets are located in the mezzanine (middle) floor of the turbine building. The steam jet destroyed a non-safety-related electrical load center in the lower elevation of the turbine building. In spite of the relatively large size of the break (four square feet) in this relatively high-energy line (exhaust from high-pressure turbine), none of the 4-kV switchgear cabinets were affected during this event.

LER 287/86-002: The event occurred on September 17, 1986 at Oconee Unit 3. During this event, while the plant was operating at 100% power, it experienced a break in a 10-inch diameter elbow downstream 17 SENSITIVE - NOT FOR PUBLIC DISCLOSURE LER No. 269/99-001 of a heater drain control valve. The break occurred in the lower elevation (basement) in the turbine building, while the safety-related switchgear cabinets are located in the mezzanine (middle) floor of the turbine building. The high moisture content in the area failed 600-volt load control center 3XD. This load center is located in the basement of the turbine building. None of the 4-kV switchgear cabinets were affected during this event.

LER 270/96-004: This event occurred on September 24, 1996 at Oconee Unit 2. While the unit was at 62% power, it experienced a drain pipe rupture due to water hammer on the secondary side of the plant.

The break occurred in the basement of the turbine building. There was no damage to safety-related switchgear cabinets {including the 4-kV switchgear cabinets located in the mezzanine (middle) floor of the turbine building.} The steam release caused burn injuries to seven employees.

Section 3: Key characteristics of the switchgear cabinet design features pertaining to their vulnerability to steam intrusion IEEE 833 (Ref. 36) Recommended practice for the Protection of Electric Equipment in Nuclear Power Generating Stations from Water Hazards, provides information on cabinet design features important to water hazards. During a site-visit conducted from January 8-10, 2001, these design features were compared against conditions found at the 4-kV switchgear cabinets at Oconee.

The switchgear cabinets at Oconee have rain shields on top which extend beyond the front and rear surfaces of the cabinets to prevent water dripping onto the front and rear cabinet surfaces. A lower penetration into the cabinet is under the rain shields. These penetrations appear to have some sealant which would tend to limit water ingress. The rain shields would protect the switchgear from moisture which deposits, condenses, and eventually rains down onto the switchgear after a postulated HELB.

There are ventilation inlets and outlets in the switchgear cabinets. There were no ventilation fans in most of the cabinets. The cables enter the cabinets from the top. The cables are in conduits rather than in cable trays. The penetrations are for conduits and generally appear to have some sealing against water intrusion. There are no water seals on the cabinet doors. Since there are ventilation openings, the quality of penetration seals and absence of gaskets in cabinets doors are irrelevant to the potential for moisture intrusion to the cabinets (i.e., pathways via the ventilation inlets and outlets dominate). In conclusion, the switchgear cabinet features do not prevent moisture intrusion into the cabinets if HELBs occur in the vicinity of the switchgear cabinets.

Unit 1 switchgear cabinets have fire protection system lines above them, but the sprinklers have been removed. No fire protection system lines were over the cabinets of Units 2 or Unit 3. Therefore, risk from inadvertent actuation of fire sprinklers is negligible.

The equipment inside the cabinets is located within few inches of the floor. However, given the large openings in the floor, general flooding is not expected to result in a sufficient water level on the mezzanine floor to adversely affect the switchgear. Any flooding induced failure would need to be by direct impingement. There are no jet impingement barriers to protect the switchgear from the direct effects of any HELB. However, since breaks that could fail all three switchgear cabinets due to flooding are a subset of the HELBs that fail them due to other HELB effects, such as steam intrusion into cabinets, additional calculations are not needed to assess the risk due to floods.

Section 4: Basis for the frequency of main feedwater breaks capable of failing all three switchgear cabinets Pages A A-14 of Volume II of Reference 37 (NUREG-1728) provide the bases to calculate that main feedwater pipe break frequency at a nuclear plant as 1.6x10-3 per critical-year. This was based on two failures (Surry and Indian Point 2) in 1600 critical-years for main feedwater and condensate piping that could be classified as high-energy lines. The operating experience used in NUREG-1728 was updated and applied to the issue at Oconee.

18 SENSITIVE - NOT FOR PUBLIC DISCLOSURE LER No. 269/99-001 The table below provides the summary of total operating critical-years used in NUREG-1728. (The operating experience for years 1998, 1999 and 2000 were estimated and added.)

Time period Critical years Source BWR PWR 1970-1983 164.9 276.6 NUREG/CR-3862: Tables H-3, H-4 1984 15.2 35.5 NUREG/CR-5622: Table C-4 1985 18.4 41.0 NUREG/CR-5622: Table C-4 1986 19.2 43.2 NUREG/CR-5622: Table C-4 1987-1995 230 499 NUREG/CR-5750: Section 3.2.1 1996 29.3 59.7 NUREG/CR-1272, Vol. 10 1997 27.2 53.5 NUREG/CR-1272, Vol. 10 1998 28 57 Estimate based on average of 1996 and 1997 1999 28 57 Estimate based on average of 1996 and 1997 2000 28 57 Estimate based on average of 1996 and 1997 Total 588.2 1179.5 Based on the above table, the total operating experience is approximately for main feedwater pipes in PWRs and BWRs was approximately 1800 critical-years (= 588.2 + 1179.5). The basis for pooling BWR and PWR data is provided in page A-12 of NUREG-1728 (Volume II).

Even though there have been several failures in the main feedwater system between 1970-2000 (Indian Point-2/1973, Maine Yankee, Surry8), only one occurred in a large-bore pipe between the discharge of the main feedwater pumps and the steam generators. Therefore, for this analysis, using the Bayesian update methods with Jeffreys non-informative prior provides a posterior distribution with a mean frequency of 8.3 x 10-4 (= 1.5/1800) per critical-year9.

Based on operating experience in large-bore main feedwater pipes that carry single-phase flow, breaks occur at welds or elbows. The following information was derived from the weld diagrams provided by the licensee during the walkdown which occurred between January 8-10, 2000:

Approximate number of welds in the main feedwater system (between the discharge of main feedwater pumps to the inlet of the feedwater header, without counting welds used to connect small 8

The Surry event, which was included in the frequency calculation in NUREG-1728, was not included here since it occurred at the suction side of main feedwater pumps.

9 In comparison to the above frequency, if pipe failure rate data provided in Tables S-1 and 3-3 in EPRI TR-102266 (Ref. 38) is used, the frequency of a main feedwater line break frequency for large pipes (greater than or equal to 6" in inside diameter) for a B&W plant is approximately 2.45x10-3 per reactor-year . However, this includes both main feedwater and condensate pipes. If a plant has twice as much of HEL condensate pipes compared to main feedwater pipes, then based on EPRI data, the main feedwater break frequency will be 8.2x10-4 per reactor-year.

Assuming a criticality factor of 0.8, this equates to about 1.0x10-3 per critical-year.

19 LER No. 269/99-001 instrument lines to the feedwater system or welds that are used to connect pipes to the anchor) is 300.

Approximate number of welds in main feedwater pipes that can fail the three 4-kV switchgear cabinets is 60.

Approximate number of elbow in the main feedwater system within the system boundary described above is 100.

Approximate number of elbows in main feedwater pipes that can fail the three 4-kV switchgear cabinets is 20.

Based on the above, HELBs at approximately 20% of the welds and elbows of the main feedwater pipes can affect the three 4-kV switchgear cabinets. Therefore, the frequency of main feedwater breaks capable of failing switchgear is approximately 1.7x10-4 per critical-year (=20% of 8.3x10-4.)

Section 5: Actual HELBs in secondary side piping in PWRs whose inside diameter is greater than or equal to 6-inches between 1985-1999 and other leaks or breaks during which either electrical cabinets or fire suppression systems were affected LER 287/86-002: Oconee, Unit 3 On September 17, 1986, Oconee Unit 3 was manually tripped from 100% full power after a pipe rupture in the turbine building. The rupture occurred at a 10-inch elbow downstream of a heater drain control valve in the line that directs heater drain from the 3A first stage reheater drain tank to the 3B1 high-pressure heater. As a result of the steam leak, the 600-volt control center 3XD tripped.

Moisture was assumed to have caused the control center trip. Approximately 13 minutes after the trip, a momentary loss of 3KI essential AC power resulted in several instrument spikes including a signal which caused the PORV to lift for less than two seconds. However, loss of 3KI essential AC power was not attributed to moisture in the building.

LER 244/86-004, Ginna On July 29, 1986, while the reactor was at 100% power, a large leak (four inch diameter hole) occurred in the pipe elbow on the 2A moisture separator reheater drain line to 5B high-pressure feedwater. The break was recognized due to the loud noise in the turbine building. There were no unusual indications in the main control board. The operators manually tripped the reactor and isolated the break by closing the MSIVs.

LER 281/86-020, Surry, Unit 2 A rupture in the feedwater piping on December 9, 1986, caused automatic discharge of the fire protection system (Halon and Cardox) to atmosphere and lengthy response time of the security key-card readers. Both of these were attributed to the steam/water environment.

LER 368/89-006, Arkansas Nuclear One, Unit 2 During this event, a 14-inch high-pressure turbine extraction steam line ruptured. Although there was no fire, firewater automatically actuated in the area of the pipe rupture. Because of the firewater flow and moisture from the ruptured pipe, the nearby control circuits for the main turbine shorted out, causing a turbine trip.

LER 280/90-003, Surry Power Station, Unit 1 On March 23, 1990, a leak developed downstream of the B low-pressure heater drain pump. During this event, the fire protection system (Halon) for Unit 1 and Unit 2 spuriously actuated. The Halon discharge in Unit 1 was suspected to be caused by water entering the Halon system control panel, shorting out control modules. The Halon release in Unit 1 was suspected to have been caused by due to either water entering the control panels or increase in temperature of the Halon bottles.

20 SENSITIVE - NOT FOR PUBLIC DISCLOSURE LER No. 269/99-001 LER 423/90-030, Millstone, Unit 3 On December 31, 1990, two six-inch moisture separator drain line breaks occurred in the turbine building. As a result of the harsh environment created by the pipe breaks, the fire protection sprinkler system actuated, releasing an additional 25,000 gallons of water to the turbine building. As a result of the high-energy line failure, the turbine building lost power. The consequent power loss isolated instrument air to the containment. As a result, normal pressurizer spray flow failed and the letdown flow isolated. The loss of power to the turbine building also caused the loss of power to the plant process computer.

LER 336/91-012, Millstone, Unit 2 On November 6, 1991, an eight-inch diameter pipe containing pressurized, heated water ruptured.

This line serves as a drain line from the first-stage reheater tank 1B to the 1B high-pressure feedwater heater. As a result of the steam in the turbine building, some alarms activated in the control room including the annunciator ground, 125VDC bus 201D ground, main generator field ground, and exciter field breaker trip ground.

LER 328-93-001, Sequoyah Nuclear Power Plant, Unit 2 On March 1, 1993, No. 2 extraction line to the B2 feedwater heater ruptured. Steam escaping from the ruptured pipe flowed into the nearby main generator voltage regulator cubicle. As a result, the voltage output increased from the normal operating value of 24-kV to approximately 27-kV. In addition, several main generator alarms annunciated, indicating exciter rectifier power loss failure, generator exciter field overcurrent, and generator voltage regulator trip.

LER 336/95-032, Millstone, Unit 2 On August 8, 1995, while the plant was at 60% power, the reactor was manually tripped due to a steam leak in the secondary system within the turbine building. The steam leak was caused by a 14-inch vertical rupture in a recirculation line from the discharge of the B heater drain pump to the heater drain tank.

LER 270/96-004, Oconee, Unit 2 On September 24, 1996, while operating at 60% power, Unit 2 experienced a drain pipe rupture on the secondary side of the plant. The release of steam from this break caused burn injuries to seven employees. Operators manually tripped the reactor and isolated the break by closing the main steam supply block valve to the second stage reheat system.

LER 483-99-003, Callaway Plant, Unit 1 On August 11, 1999, a pipe ruptured in a six-inch drain line between the D moisture separator reheater first-stge reheater drain tank and the 6B feedwater heater. Some non-safety- related equipment for components located in the vicinity of the pipe rupture was affected: (a) Steam escaping from the ruptured pipe contacted fire detectors in the immediate area resulting in the actuation of a fire protection system pre-action deluge valve. Since the fusible links did not melt, a discharge did not occur; (b) the plant computer failed approximately 5 minutes into the event due to failure of the computers un-interruptible power supply which was located in the vicinity of the pipe rupture (as a result five radiation monitors failed); (c) The in-service condenser air removal exhaust fan tripped due to high differential pressure on the suction filter resulting from high humidity.

Section 6: Basis for the frequency of auxiliary steam line breaks capable of failing all three switchgear cabinets 21 SENSITIVE - NOT FOR PUBLIC DISCLOSURE LER No. 269/99-001 A search of the NRCs LER database [Sequence Coding and Search System (SCSS) (Ref. 5)] identified 22 high-energy line failure events (Refs. 6-27). These events occurred between 1985-1999. Of these, eight events occurred at PWRs in pipes whose attributes are similar to the attributes10 of the auxiliary steam lines. All HEL pipes (except main steam and main feedwater) whose diameter exceeds 6" and has flow in them while the reactor is in operation are considered similar to the pipes that carry auxiliary steam.

The pipes in auxiliary steam, low-pressure extraction steam, high-pressure extraction steam, drain pipes to and from moisture separators and feedwater heaters are included in this category.

Events which occurred at BWRs were not included in this calculation, since the data showed that they could not be pooled with PWR data (i.e., Between 1985-1999, there was a total of nine failures in piping whose attributes are similar to the attributes of the auxiliary steam pipes. Of these, only one event occurred at a BWR. The other eight events occurred at U.S. PWRs. In spite of the fewer reactor years for BWR by approximately a factor of 2, there is a statistically significant difference between these failure rates.)

Based on 8 failures, approximate U.S. PWR reactor critical-years between 1985-1999 (850 PWR critical-years based on References 28, 29, 30, and 31), the frequency of HELBs inside the turbine building in pipes similar to those that may occur in the auxiliary steam lines is 1.0 x 10-2 per critical-year (= 8.5/850).

It is assumed that the frequency of HELBs of this type at Oconee is similar to that frequency at other PWRs. In estimating this frequency, the Bayesian update method was used with Jeffreys non-informative prior11.

Based on expert judgement (Ref. 4), breaks in approximately 200 feet of auxiliary steam pipes could affect the three switchgear cabinets. Based on information provided by the licensee, there is approximately 11000 feet12 of piping in the auxiliary steam and other HEL system whose pipes have failure rate attributes similar to auxiliary steam.13 The ratio of the pipe lengths is approximately equal to 0.018 (= 200/11000). Therefore, the total length of piping similar to the auxiliary steam line in the vicinity of the switchgear cabinets is approximately 1.8 percent of all pipes in the plant. The frequency of auxiliary team line breaks capable of failing the three 4-kV switchgear cabinets is approximately 1.8 x 10-4 per critical-year [= 0.018 x (1.0 x 10-2)].14 Section 7: Probability of failing to recover seal cooling capability within 10 minutes To recover seal cooling, the operators must establish Standby Shutdown Facility. The probability of failing to establish Standby Shutdown Facility has three components. They are: (a) the probability of 10 Page A-10 of Reference 37 discusses reliability attributes of pipes. These attributes were identified using Reference 39 entitled Reliability Attributes of Piping System Components, Framework for Estimating Failure Parameters from Service Data, SKI {Swedish Nuclear Power Inspectorate (SKI) Report 97: 26}. These attributes are also consistent with the quantifiable reliability attributes identified in the EPRI pipe failure study (Ref. 38).

11 In comparison to the above frequency, if pipe failure rate data provided in Tables S-1 and 3-3 in EPRI TR-102266 (Ref. 38) is used, the frequency of a break in lines similar to auxiliary steam for a B&W plant is approximately 9.7x10-3 per reactor-year. Assuming a criticality factor of 0.8, this equates to about 1.2x10-2 per critical-year.

12 Since the information provided by the licensee was an estimate, it was compared against information provided in Reference 37 (NUREG-1728) and Reference 38 (EPRI pipe failure rate study) to determine whether the approximate length of pipes at Oconee was similar to the approximate length at a typical PWR.

13 S.D. Weerakkody (U.S. NRC), teleconference with T. D. Brown (Duke Energy Corporation),

January 24, 2001.

14 The calculation implicitly assumes that the break frequency at Oconee is equal to the average frequency at pressurized water reactors. Considering the numbers of equipment and general layout of these equipment in the turbine building at Oconee in comparison to the average pressurized water reactor, this is a reasonable assumption.

22 SENSITIVE - NOT FOR PUBLIC DISCLOSURE LER No. 269/99-001 operator failure, (b) the probability of failure to establish the reactor coolant makeup system for seal cooling (excluding the support systems), and (c) the probability of failure of the Standby Shutdown Facility support systems.

The probability of operator failure - action (0.05) - The licensees procedure Standby Shutdown Facility Emergency Operating Procedure (AP 0/A/1700/025) is used to establish Standby Shutdown Facility. The licensee periodically practices this procedure. In the event of loss of cooling to reactor coolant pumps, the procedure requires the operators to establish reactor coolant pump seal cooling within 10 minutes for Oconee Unit 1 and within 20 minutes for Oconee Units 2 and 3. Based on Reference 44, during quarterly time verifications of their procedure, the average time needed to implement this procedure is between 7-8 minutes.

Since the postulated high-energy line leaks or breaks affect all AC power, the probability of failure to diagnose the need to implement the procedure to establish Standby Shutdown Facility is negligible.

Since reactor coolant pump seal cooling must be established within 10 minutes and the operators take 7-8 minutes during quarterly verifications, the time available is approximately equal to time required. Because of multiple failures of critical support systems, the Standby Shutdown Facility is established under extreme stress conditions. Since numerous recovery tasks need to be performed within a relatively short period, the complexity of tasks is moderately high. Due to the large number of time verification drills (Ref. 44), for the purpose of the PSF for training, a high classification was assigned. Therefore, probability of operator error was estimated to be 0.05. Table 1 summarizes the basis for the probability of failure for this human error as well as other human errors used in this analysis.

For the case where, reactor coolant pump seal cooling must be established within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months to avoid O-ring failure (applicable to Oconee Unit 1 only), since time available (2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months ) is much greater than time required (about 10 minutes), both of the probabilities above are reduced by a factor of 10.

The probability of operator failure - diagnostic (0.025) - Within a few minutes after the high-energy line failure, the licensee must recognize the need to enter the procedure Standby Shutdown Facility Emergency Operating Procedure that is used to establish Standby Shutdown Facility.

Because of multiple failures of critical support systems and multiple tasks that need to be performed within a relatively short period, the Standby Shutdown Facility is established under extreme stress conditions. Due to the large number of time verification drills (Ref. 44), for the purpose of the PSF for training, a high classification was assigned.

The probability of failure to establish the reactor coolant makeup system for seal cooling (excluding the support systems) ( 0.06) - The Oconee IPE (Section A.16) (Ref. 42) estimates the probability of failure of the Standby Shutdown Facility to provide reactor coolant makeup seal injection as 9.05 x 10-2. This includes operator error and the mechanical failures. When the operator error is excluded, the failure probability is approximately 0.06.

The probability of failure of the Standby Shutdown Facility support systems (0.16) - Support system failures of have a probability of 0.16 (Ref. 33).

The sum of the above probabilities calculated using a fault tree is approximately 0.27. The sum of the above probabilities for the case where time available is 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , is approximately 0.22.

Section 8: Probability of failing emergency feedwater In the event of loss of main feedwater, and loss of the three switchgear trains, the following systems are available to remove decay heat: (a) the turbine-driven emergency feedwater pump train and the station 23 SENSITIVE - NOT FOR PUBLIC DISCLOSURE LER No. 269/99-001 auxiliary service water system, (b) emergency feedwater cross-tied from other plants, and (c) the auxiliary service water supported by the Standby Shutdown Facility. The probability of failure of all of the above to provide decay heat removal is approximately 0.016. If the support states to Standby Shutdown Facility are available (e.g., Standby Shutdown Facility EDG), then the probability of emergency feedwater failure is 0.011. The basis for these probabilities is discussed below.

(a) Probability of loss of the turbine-driven emergency feedwater pump train and the station auxiliary water system (0.073) - Of the three emergency feedwater trains, two trains are supported by motor-driven pumps. Due to failure of the switchgear trains, these two trains will not be available.

Therefore, only the turbine-driven emergency feedwater train will be available.

The automatic initiation of the TDEFWP is independent of AC power, but requires 250-volt non safety DC power. The DC power runs a TDEFWP DC lube oil pump which supplies oil pressure for automatic opening of the turbine governor valve. The DC power is from a DC switchgear located next to the three 4-kV safety-related switchgears, and thus would likely be lost in this event.

However, the TDEFWP could still be locally-manually started by an operator within about 15 minutes. The TDEFWP is on the lowest level of the turbine building (one level below the 4-kV switchgear) and on the opposite side of the building from the 4-kV switchgear. Therefore, an operator may be able to get to the TDEFWP to manually start it during this high-energy line failure event. Once the TDEFWP was started, its shaft-driven lube oil pump would supply the oil pressure to keep the governor valve open.

Low-pressure service water (LPSW) system provides cooling to the TDEFWP. During this event LPSW fails due to loss of AC power. However, the TDEFWP receives automatic backup cooling from high-pressure service water (HPSW), which during this event would be supplied for some time by gravity flow from the HPSW high tower tank. Also, the licensee has stated that the TDEFWP can operate for 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months without any cooling water. The TDEFWP should have some probability of success in removing decay heat during this event. It would be able to remove decay heat for about one hour [until the upper surge tank (UST) is emptied].

In about one hour, the station auxiliary service water pump could be started to remove decay heat.

AC power to this pump is available from the auxiliary service water switchgear panel located in the auxiliary building. Since the auxiliary service water switchgear panel is independent of the 4-kV switchgear trains, loss of these switchgear trains does not fail the power supply to the auxiliary service water switchgear panel. In light of the above information, the probability of failing to provide decay heat removal using the TDEFWP string is:

[(Probability of failing 250-V DC power due to high-energy line leaks or breaks)x(probability of operator failing to locally manually start TDEFWP within 40 minutes)]

+

(Probability of random failure of TDEFWP to start and run for 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months )

+

(Probability of failure of the station auxiliary service water pump to start and run for 21 hours2.430556e-4 days 0.00583 hours 3.472222e-5 weeks 7.9905e-6 months ).

Since the switchgear supplying power to TDEFWP is located next to the three trains of 4-kV switchgear, this switchgear is assumed to fail with a probability of 1.0.

Based on the human error worksheet for SPAR, the probability of operator failing to locally-manually start the TDEFWP (diagnostic error + action error) is 0.03 (see Table 1 for details.) For this basic event probability, the time available to implement the operator action is adequate, stress conditions are extreme, and tasks are highly complex. (Based on information provided by the licensee,15 15 S.D. Weerakkody (U.S. NRC), Teleconference with H. D. Brewer (Duke Energy Corporation),

August 24, 2000.

24 SENSITIVE - NOT FOR PUBLIC DISCLOSURE LER No. 269/99-001 core damage can be prevented if secondary cooling is established within 40 minutes. By comparison, it is estimated that it would take approximately 15 minutes to manually locally start the TDEFWP.)

Since the TDEFWP is relied upon for only one hour (the UST empties after one hour and the station auxiliary service water continues over the remaining 23 hours2.662037e-4 days 0.00639 hours 3.80291e-5 weeks 8.7515e-6 months ), this probability should be 0.02 (Ref. 43).

The station auxiliary service water system could supply an unlimited amount of lake water for the steam generators. It involves depressurizing a steam generator and takes at least about one hour to get started. At Oconee, if decay heat removal is lost, the steam generators dry out in a few minutes.

However, the licensee has estimated that core damage can be prevented if secondary cooling is established within 40 minutes.16 By comparison, it would take approximately one hour to use the auxiliary service water to inject to the steam generator. Therefore, the station auxiliary service water, on its own, is not credited. However, it is credited together with the TDEFWP (which exhausts the UST supply in approximately one hours) to provide steam generator cooling. Using methods applied in the ASP Program, the probability of this failure is 0.025 (See Table 1 for details.) In comparison to the magnitude of this human error probability, the random mechanical failures of the station auxiliary service water are ignored.

The total probability of emergency feedwater failure using the station auxiliary service water and the turbine-driven emergency feedwater pump is approximately 0.016.

(b) Probability of failing to establish the cross-tie - The emergency feedwater systems of the Oconee units can be cross-connected. However, to cross-tie, the operators must access the floor below the switchgear. Based on a calculation performed by the licensee using the Gothic code,17 the floor below the switchgear would remain accessible during a high-energy line failure on the floor that contains the switchgear. Therefore, the emergency feedwater cross-tie can be established within about 30 minutes.18 Recovering emergency feedwater within about 40 minutes averts damage to the core. Assuming that the probability of failure to diagnose the need to establish emergency feedwater is negligible, the time needed to establish emergency feedwater is approximately equal to time available, extreme stress conditions, and highly complex tasks (e.g., having to climb ladders or scaffolds without fixed lighting, having to use chain operators), based on the SPAR HRA worksheets, the probability of failure for this operator action is 0.25. The probability of the diagnostic error is 0.005. Therefore, total probability of failure is 0.26. In comparison to this human error probability, the probability of other failures (e.g., mechanical failures of pumps failing to start and run) is negligible.

(c) Probability of failing Standby Shutdown Facility auxiliary service water - Based on the SPAR model, the probability of failure to deliver auxiliary service water to the steam generators is 0.1.

Based on the SPAR model, the probability of failures of the support systems is 0.16. To prevent core damage, Standby Shutdown Facility auxiliary service water must be established within approximately 40 minutes (Page A-135 of the Oconee IPE). The licensees procedure Standby Shutdown Facility Emergency Operating Procedure, requires the operators to establish flow to the steam generators using Standby Shutdown Facility auxiliary service water pumps within 14 minutes. Therefore, as shown in Table 1, the failure probability of the operator action is 0.005. The probability of the diagnostic error is 0.0025. Therefore, the total failure probability is 0.26.

16 Ibid. Same discussion.

17 Ibid. Same discussion.

18 Ibid. Same discussion.

25 SENSITIVE - NOT FOR PUBLIC DISCLOSURE LER No. 269/99-001 A fault tree was generated to combine the probabilities of the above three emergency feedwater methods. When this fault tree was used to quantify the combined failure probability of emergency feedwater failure from all three methods above is 0.0054 (before factoring in dependencies between human errors).

The product of the probabilities of alternate methods used to establish emergency feedwater does not produce the overall failure probability of emergency feedwater because of the dependencies among human errors. There are no significant hardware dependencies among the turbine-driven pump, station auxiliary service water, Standby Shutdown Facility auxiliary service water, and cross-tie. However, the dependency among human errors is significant. When the operators attempt to establish emergency feedwater using one method (e.g, Standby Shutdown Facility auxiliary service water), the time that elapses uses up time available to establish alternate methods (e.g., cross-tie) in the event of failure of the first method (Standby Shutdown Facility auxiliary service water).

In sequences in which TDEFWP is successful, the operators spend approximately 15 minutes to start the turbine-driven pumps. However, if the turbine-driven pump failed during its run, since 15 minutes were used to attempt to establish TDEFWP, approximately 25 minutes will be available to recover either the cross-tie (which requires about 30 minutes) or the Standby Shutdown Facility auxiliary service water (which requires about 14 minutes). Therefore, on these sequences only Standby Shutdown Facility auxiliary service water of the two methods is credited. Standby Shutdown Facility auxiliary service water rather than the cross-tie is credited because the initial conditions (temperature/moisture) in the turbine building after the HELB favor it over establishing the cross-tie. When the emergency feedwater failure probability is adjusted to accommodate this dependency by using a Rule against the fault tree, the new emergency feedwater failure probability became 0.016.

One of the emergency feedwater methods (Standby Shutdown Facility auxiliary service water) has a hardware dependency with the reactor coolant makeup function (event tree node RCM10M in Figures 2 and 3). Both of these systems (Standby Shutdown Facility auxiliary service water and Standby Shutdown Facility reactor coolant makeup) rely on the Standby Shutdown Facility support systems. When, the emergency feedwater is adjusted by eliminating cutsets that contain Standby Shutdown Facility support systems, the emergency feedwater failure probability becomes 0.012.

Section 9: Basis for high-pressure injection failure probability The high-pressure injection failure probability consists of random failures of a single train of an high-pressure injection train, cognitive error associated with failing to establish high-pressure injection, and manipulative error associated with establishing high-pressure injection. As demonstrated by the calculation provided below, the human error probability of the manipulative error is 0.025. The probability of the cognitive error is 0.005. using the SPAR 2QA model, the probability of random failures of a single train of the high-pressure injection system is about 0.01. Therefore, the probability of high-pressure injection system failure is 0.04.

According to the guidance used in the ASP Program (Ref. 41), the nominal probability of the manipulative actions is 1 x 10-3.

Performance shaping factors for Available Time - According to the Rhode model (Ref. 31),

approximately four hours is available to establish high-pressure injection. Based on discussions with NRC Region II personnel, the operators may take approximately 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months to establish high-pressure injection. There, a performance shaping factor of 1 is used.

Performance shaping factor for Stress - Based on guidance provided on page B-6 of Reference 41, a high-energy line break which disables all three switchgear cabinets and causes a station blackout could introduce extreme stresses on the operators. Therefore, a performance shaping factor of 5 is used.

26 SENSITIVE - NOT FOR PUBLIC DISCLOSURE LER No. 269/99-001

Performance shaping factor for Complexity - Based on guidance provided on page B-6 of Reference 41, a high-energy line break which disables all three switchgear cabinets and require an high-pressure injection pump is characterized as a highly complex action. Failure of three switchgear cabinets will demand operator action to initiate all mitigating systems. The turbine-driven emergency feedwater pumps must be initiated manually. The reactor coolant pump seal cooling needs to be established within about 10 minutes. Again, manual rather than automatic action are required to establish reactor coolant pump seal cooling. The turbine-driven emergency feedwater pump runs out of suction within approximately an hour, therefore, other actions are needed to continue emergency feedwater. Consequently, establishing high-pressure injection, which also requires multiple operator actions to be performed at different locations, has to be implemented concurrently with other recovery actions. Therefore, a performance shaping factor of 5 is used.

The product of the nominal probability by the three PSFs discussed above yields 0.025

[= 1 x 5 x 5 x (1x10 -3)]

27 SENSITIVE - NOT FOR PUBLIC DISCLOSURE LER No. 269/99-001 Table 1. Summary of human error probabilities.

Error Type Time Time PSF2 for PSF for PSF for PSF for HEP1 available required available stress complexity training (min.) (min.) time level of task Operator fails to establish the reactor coolant makeup system from Standby Shutdown Facility within 10 minutes Diagnostic error 10 few min. 1 5 1 0.5 0.025 Manipulation error 10 7-8 10 5 2 0.5 0.05 Operator fails to establish the reactor coolant makeup system from Standby Shutdown Facility within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Diagnostic error 120 few min. 0.1 5 1 0.5 0.0025 Manipulation error 120 7-8 1 5 2 0.5 0.005 Operator fails locally-manually start the turbine-driven emergency feedwater pump Diagnostic 40 <<40 0.1 5 1 1 0.005 Action 40 15 1 5 5 1 0.025 Operator fails to establish station auxiliary service water before depleting supply from UST to TDEFWP Diagnostic >>60 <<60 0.1 5 1 1 0.005 Action >>60 60 1 5 5 1 0.025 Operator fails to establish emergency feedwater cross-tie from other units Diagnostic 40 <<60 0.1 5 1 1 0.005 Action 40 30 10 5 5 1 0.25 Operator fails to establish Standby Shutdown Facility auxiliary service water prior to core damage Diagnostic >60 0.1 5 1 0.5 0.0025 Action 40 14 1 5 2 0.5 0.005 Operator fails to establish high-pressure injection within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Diagnostic >150 60-120 .1 5 1 1 0.005 Action >150 60-120 1 5 5 1 0.025 1.

The human error probability uses a base value of 1.0 x 10-2 for cognitive error and 1.0 x 10-3 for the action failure probability.

2.

Reference 41 is the source used to determine performance shaping factors (PSFs).

28 SENSITIVE - NOT FOR PUBLIC DISCLOSURE LER No. 269/99-001 ATTACHMENT 2 Memorandum from Mark A. Cunningham to Patrick W. Baranowsky, Expert Judgement Related to Potential HELB Effects on 4-KV Switchgear at Oconee, January 17, 2001 29 LER No. 269/99-001 30 LER No. 269/99-001 31 LER No. 269/99-001 32 LER No. 269/99-001 33 LER No. 269/99-001 34

LER No. 269/99-001 Response to Comments Comments were received from the licensee (Ref. D-3.1) and NRC staff from the Events Assessment, Generic Communications, and Non-Power Reactors Branch (Office of Nuclear Reactor Regulation).

1. Comment from LicenseeReactor coolant pump seal failure probability:

In 1999, the reactor coolant pumps for Oconee Units 2 and 3 had Sulzer seal packages. Duke believes that application of the Rhodes model to these seal packages is overly conservative. Oconee is participating in the Combustion Engineering Owners Group (CEOG) project that provides a specific seal loss-of-coolant accident (LOCA) model for Sulzer seals. This model has been submitted to the NRC for review. Application of this model to the Oconee plant substantially reduces (two orders of magnitude) the likelihood of a seal LOCA. It should be noted that the Westinghouse reactor coolant pumps seals were replaced on Unit 1 in 2000 with Sulzer seal packages. Thus, the current seal failure probability for all three units is substantially less than predicted by the Rhodes model.

Response: The Office of Nuclear Reactor Regulation is in the process of reviewing alternate reactor coolant pumps seal LOCA models submitted by the CEOG and the Westinghouse Owners Group.

Until those reviews are completed, in accordance with the agency technical positions set forth during the closeout of Generic Safety Issue -23 on reactor coolant pumps seals, the Accident Sequence Precursor (ASP) Program will use the Rhodes Model.

We have added a note to the report to recognize the fact that Unit 1's reactor coolant pumps seal packages were replaced with Sulzer seal packages.

2. Comment from LicenseeMain feedwater pipe break frequency:

The data and methods used for the large main feedwater line break were reasonable. The analyst used methods that used a plant specific estimate of the length of piping that could affect critical equipment, and used generic historical data for the type of break of concern. This provides a reasonable estimate for the generic historical failure rate. However, a more detailed review of the operating experience, based on stress levels in piping and actual plant conditions associated with the failures, may reduce the estimated failure probability.

Response: We agree that the pipe stress is one of many attributes that affect the pipe break frequency. If pipe break data bases were structured such that the number of break locations and the years for which they operated could be grouped by stress levels, and the number of breaks grouped by stress levels were available, more accurate break frequencies can be calculated. The comment states that if those stress dependent break frequencies are applied to the Oconee main feedwater system, the estimated failure probability may reduce.

If stress dependent break frequencies are applied to the Oconee main feedwater system, the estimated failure probability may reduce or increase. We do not expect this increase or decrease to be insignificant. This is because (a) a significant portion of the main feedwater pipes (approximately 20%) impose a threat to the switchgear cabinets, (b) there is no known uniqueness of the main 35 SENSITIVE - NOT FOR PUBLIC DISCLOSURE

LER No. 269/99-001 feedwater system at Oconee units so that pipe stresses of the main feedwater system at Oconee is significantly different from the pipe stresses at other nuclear power plants.

3. Comment from LicenseeContribution from auxiliary steam lines to the high-energy line break frequency:

The analyst used a plant specific estimate for the length of piping and historical data for the calculation of auxiliary steam line breaks capable of failing the 4kV switchgear. This results in a plant specific failure rate that is close in value to that calculated by using pipe length break frequencies, such as those described in EPRI TR-102266, Pipe Failure Study Update (Ref. D.3-2). This results in a reasonable estimate for the overall auxiliary steam line break initiating event frequency.

However, a review of the LERs used for the initiating event data shows several of the LERs listed are not applicable to the calculation. The report should be modified to remove these failures from the initiating event calculation. The LERs considered not applicable for the AS line break initiating event calculation include:

LER 280/87-027 - The leak described in the LER was from a condenser access manway, not from piping. The leak caused water to be released from the condenser resulting in a short in a flood panel. This leak was not an high-energy line break event, and is not applicable to piping failure scenarios.

LER 280/90-003 - Per the LER, Section 2.0, Safety Consequences and Implications, In this case, the leak was small, Small leaks should not be added to failure data used to calculate the AS line break initiating event. The final initiating event is assumed to cause major equipment damage, which was not possible with this leak.

LER 318/92-001 - The steam leak was from a 3/4 inch feedwater heater relief valve. There are two issues that make this failure not applicable; a)the failure was through a relief valve, and not through failed piping, and b)the release was from a 3/4 inch line, which is insufficient to cause the type of damage assumed for the auxiliary steam line break initiating event.

Response

LER280/87-027 - We agree that this event is not applicable since pipe failure rate attributes of the condenser access manway is significantly different from the auxiliary steam lines. We did not add this as different source of a high-energy line break which could affect the switchgear since there are no condenser access manways in the vicinity of the switchgear.

LER280/90-003 - Even small leaks may cause significant failures, if the leak sustains for a considerable period (tens of minutes). Operating experience show that small leaks in lines such as auxiliary steam lines can sustain for considerable periods before they are detected and isolated. Therefore, we concluded that this event is applicable.

LER318/92-001 - We agree that this event is not applicable since pipe failure rate attributes of the feedwater heater relief valves are significantly different from the auxiliary steam lines. We did not add this as different source of a high-energy line break which could affect the switchgear since there are no feedwater heater relief valves in the vicinity of the switchgear As a result of this change, the contribution from auxiliary steam lines to the frequency of a high-energy line break changed from 2.2E-04 per critical-year to 1.8E-04 per critical-year.

4. Comment from LicenseeApplication of the Jeffreys noninformative prior distribution:

Since there is data for the initiating event, the use of a 0.5 factor is inappropriate. This type of factor is used when there is little or no prior/industry data available. As discussed in NUREG/CR-5750, 36 SENSITIVE - NOT FOR PUBLIC DISCLOSURE

LER No. 269/99-001 Appendix E, Page E-10, the Jeffreys noninformative prior distribution is "appropriate when very few events have occurred." Since we have more than a few events (at least 7) for this study, the noninformative prior distribution is not appropriate. The auxiliary steam line break estimate should be based solely on the historical data. If a Bayesian approach is desired, the Oconee and non-Oconee data can be separated, with the non-Oconee data used as a prior. However, this would yield a similar result.

Response: When the number of failure events is small, there is not enough information to detect plant-to-plant variability. In this case, we assume that failure rate () or the event frequency, is the same for all plants. Since we have chosen to use Bayesian statistical methods, instead of classical methods, in our parameter estimation, we need a prior distribution. For Poisson data, a useful choice for the prior distribution is the Gamma distribution with parameters 0 and 0. When the Gamma prior is updated with the event data, say f events in T reactor-years, the posterior distribution is also a Gamma distribution with parameters (0 + f) and (0 + T). We must select 0 and 0 to define the prior distribution. Since T is 850 reactor years, we chose to use the Jeffreys prior distribution that has parameters 0 = 0.5 and 0 = 0. We wanted a prior distribution that would not overly influence the data. The mean of the resulting posterior distribution is (0 + f) / (0 + T) which equates to (0.5 +

f)/T, where f/T is the usual classical estimator for . We agree that starting with a prior distribution based on the non-Oconee events would yield a similar answer. However, we feel that the appropriate way was to keep all of the data together and use the noninformative prior.

It is noted here that even if the non-Bayesian methods were used, the difference in the result would have been minimal (8.5/850 = 1.0E-02 and 8/850 = 9.4E-03). This would have resulted in a total main feedwater and auxiliary high-energy line break frequency of 3.4E-04 rather than 3.5E-04.

Therefore, the impact of the change on the analysis is minimal.

5. Comment from LicenseeStandby Shutdown Facility initiation failure probability:

For the Standby Shutdown Facility, reactor coolant makeup is established in less than 10 minutes for Oconee Unit 1 and 20 minutes for Oconee Units 2 and 3 and auxiliary service water in less than 14 minutes. Due to the high probabilistic risk assessment significance and time constraints for this task, operations performs quarterly time verifications for all licensed operators. In 1999, data from one hundred verifications was reviewed and showed a 100% pass rate. From the verifications reviewed, the average time for injecting into the reactor coolant system with the Standby Shutdown Facility reactor coolant makeup system was 7.29 minutes. For the Standby Shutdown Facility auxiliary service water system, the average time to feed the steam generators was 9.38 minutes.

Because of the significant training, the failure probabilities for these activities are too conservative.

Response: In consideration of the additional information provided above with respect to frequent training on plant procedures and the high success rate, we agree that the failure probabilities for these activities need adjustment. In our previous analysis, we had used 1.0 for the performance shaping factor for experience/training. In response to the comment, this performance shaping factor was reduced to 0.5 since the operators are frequently trained on these procedures. This resulted in a change in the human error probability for manipulative action of the Standby Shutdown Facility reactor coolant makeup function from 0.1 to 0.05.

6. Comment from Licensee---Standby Shutdown Facility failure probabilities:

The failure probabilities used for the Standby Shutdown Facility auxiliary service water system and for the reactor coolant makeup system include many failures that would occur later in the accident. This type of run failure would provide additional time for the operators to successfully align alternate systems.

For example, the dominant failure of the Standby Shutdown Facility reactor coolant makeup pump is a run failure of the Standby Shutdown Facility diesel generator. If the Standby Shutdown Facility diesel generator initially works but then fails after several hours of operation, significant additional time would be available for the station personnel to restore seal cooling and if necessary, reactror 37 SENSITIVE - NOT FOR PUBLIC DISCLOSURE

LER No. 269/99-001 coolant system makeup by aligning a high- pressure injection pump to the station auxiliary service water switchgear. Since nearly all sequences are dominated by high human error failure probabilities which result from the performance shaping factor associated with time available, then changing the time available would have a significant effect on the overall frequency of these sequences.

This issue is also important for the loss of steam generator cooling sequences. If the Standby Shutdown Facility auxiliary service water systems work for even a short time, then the operators will use the Standby Shutdown Facility auxiliary service water pump to increase steam generator levels.

As discussed in Section 9, High-Pressure Injection Recovery Capability, Oconee specific RELAP analyses show that this would change the time available to restore a means of Secondary Side Heat Removal (SSHR) from 40 minutes to many hours.

To be more realistic, it is suggested that the Standby Shutdown Facility failures be separated into a fails-to-start failure mode and a fails-to-run failure mode. Then different human error probabilities can be determined for these different sequences.

Response: The only basic event which represented failure to run in the dominant cutsets was SSF-DGN-FR-SSF. This basic event represents the fail-to-run failure mode of the Standby Shutdown Facility diesel. It should be noted that based on NRCs emergency diesel generator reliability study (Ref. D-3.3), the failure rate over the 24-hour exposure time is not constant. The failure rate during the first 1/2 hour can be at least an order of magnitude or greater than during the next 23.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months .

Therefore, if the diesel fails to run, on the average, it would most likely occur after a 1/2 to 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months run.

Consequently, if Standby Shutdown Facility auxiliary service water fails to run due to the failure of Standby Shutdown Facility diesel failing to run, on the average, it would most likely occur after 1/2 to 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months run.

We agree with the comment that a 1/2 to 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months run of Standby Shutdown Facility auxiliary service water will refill the steam generators to some level and provide additional time to recover one of the other emergency feedwater sources such as a cross-tie from units. However, without specific procedures, and in light of the multiple failures and unanalyzed plant conditions, in accordance with ASP Program procedures, these additional recoveries were not credited in this analysis.

Not withstanding the above, we examined the difference in core damage frequency change if one were to assume that failure to run the Standby Shutdown Facility diesel cannot fail Standby Shutdown Facility auxiliary service water (i.e., set the probability of SSF-DGN-FR-SSF to zero). This issue remained an ASP precursor in spite of that change. For Unit 1, the core damage frequency changed from 8.2E-06 to 7.0E-06 and for Units 2 and 3 the core damage frequencies changed to from about 5.2E-06 to 4.5E-06.

7. Comment from LicenseeEmergency feedwater system failure probability:

The ASP analysis assumed that the turbine-driven emergency feedwater pump could be started with high reliability, but then assumed that it would fail with a probability of 1.0 after one hour when it depletes the upper surge tank. This is not correct. Assuming typical upper surge tank levels, the turbine-driven emergency feedwater pump can operate for 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months before completely depleting the upper surge tank. Additionally, credit should be given for operator action to replenish the upper surge tank from other plant systems, or for swapping to the hotwell. Both of these actions are covered in plant procedures and can be reliably accomplished even with a loss of 4160V power.

Response: Due to uncertainties associated with the amount of water available from the upper surge tank due to loss of water through the break, we credited only one hour of upper surge tank inventory.

However, since this inventory provides additional time to recover station auxiliary service water, there is more than adequate time to align the station auxiliary service water system to inject into the steam generators. Therefore, we reduced, the performance shaping factor for aligning the station auxiliary service water from 10 to 1. Consequently, the basic event HEP-STATION-ASW reduced from 0.25 to 0.025.

38 SENSITIVE - NOT FOR PUBLIC DISCLOSURE

LER No. 269/99-001 If this additional time available was not credited, the risk core damage frequency increase would have been about 1.3E-05/year (rather than 8.2E-06) for Unit 1 and about 9.6E-06/year (rather than 5.2E-

06) for Unit 2.

We did not credit other operator actions to replenish upper surge tank from other plant systems, since (a) little or no credit can be given to multiple concurrent recovery actions such as aligning supply from the hotwell, and (b) they have negligible impacts on core damage frequency changes.

8. Comment from LicenseeEmergency feedwater manual cross-tie (from other unit) failure probability:

Previous validation data concludes that the unit can be cross-connected in approximately 17 minutes. The time includes five minutes to recognize the condition and dispatch an operator.

Actual cross-connection of the unit requires 12 minutes. Operators train on this task.

Response: Based on a previous conversation with the licensee we had used 30 minutes as the time to establish the cross-tie. Since only 40 minutes is available to perform the cross-tie in order to avert core damage, we had used a performance shaping factor of 10 for time available to calculate the human error probability. Your validation data indicate that you can perform establish the cross-tie in 17 minutes rather than in 30 minutes. However, considering additional operator burdens during an unanticipated event rather than a planned validation, we decided that the performance shaping factor of 10 is appropriate for this operator action.

9. Comment from Licensee---Station auxiliary service water system availability:

The precursor analysis assumed that the station auxiliary service water system could only be credited in conjunction with the turbine-driven emergency feedwater pump. However, if the turbine-driven emergency feedwater pump fails after an hour or more of operation, emergency feedwater cross-tie, Standby Shutdown Facility auxiliary service water and station auxiliary service water should be credited as additional success paths with at least 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months available for accomplishing these actions following the loss of the turbine-driven emergency feedwater pump (Attachment 2 Case 3). This would also be appropriate for Standby Shutdown Facility auxiliary service water run failures.

Response: Based on the information provided by Duke Energy Corporation, the time required to establish injection to the steam generator from each of the systems as follows:

Turbine-driven emergency feedwater pump 15 minutes Station auxiliary service water (ASW) pump 60 minutes Standby Shutdown Facility ASW 14 minutes Cross-Tie 30 minutes (17 minutes according to Reference D-3.1).

In comparison to the above, the time available to establish steam generator cooling prior to core uncovery is 40 minutes. In fact, the thermal hydraulic analysis provided as Attachment 2 of Reference D-3.1 assumes that injecting to the steam generator begins at 30 minutes. Station auxiliary service water pump cannot be established before 30 minutes. Therefore, station auxiliary service water, by itself cannot be treated as completely redundant system. It can only be credited as a system which can be recovered when one of the other systems fail.

In the ASP analysis, after consultations with the licensee, we chose to credit the station auxiliary service water as a support system to the turbine-driven emergency feedwater system since that system can operate for about one hour.

10. Comment from LicenseeStandby Shutdown Facility manual initiation failure probability:

The choice of performance shaping factor for stress level of 5 for all diagnostic and manipulation errors would correlate to extreme stress. This would only be appropriate if as described in 39 SENSITIVE - NOT FOR PUBLIC DISCLOSURE

LER No. 269/99-001 Reference D-3.5, revision of the 1994 ASP human reliability analysis methodology (Draft),

INEEL/EXT-99-00041, the action was associated with the feeling of threat to ones physical well being or to ones self-esteem or professional status. The conditions present in the control room and in the Standby Shutdown Facility are no different than would occur during training. Therefore, a more appropriate performance shaping factor for stress level would be a factor of 2 as associated with high stress. This would be characterized as multiple instruments and annunciators alarm, unexpectedly, at the same time; loud, continuous noise impacts ability to focus on the task. The use of the performance shaping factor of extreme stress is more appropriate for the actions associated with starting the turbine-driven emergency feedwater pump or emergency feedwater cross-tie.

Although the conditions have been evaluated for an high-energy line break and found to be an acceptable environment for operators to accomplish these actions, there may be a concern about a threat to physical well being due to steam and humidity in the turbine building.

Response: Reference D-3.5 states that extreme stress is a level of disruptive stress in which the performance of most people deteriorate drastically. It goes onto state that extreme stresses are likely to occur when the onset of the stressor is sudden and the stressing situation persists for a long period. Getting into a situation of feeling of threat to ones physical well being is one example of an extreme stress situation. It is not the only situation for extreme stress. In the ASP analyses we have consistently assigned extreme stress levels for events such as station blackouts. Since all three emergency switchgear has failed, the situation is similar to a station blackout.

The postulated high-energy line break in the turbine building is catastrophic event that is expected to fail multiple safety systems and requires significant operator involvement . The likelihood of recovering the switchgear which failed due to steam intrusion within a relative short period is low, i.e.,

the stress situation will likely to persist for several hours. Therefore, we concluded that for quantifying performance shaping factors, extreme stress is a more appropriate classification for this event.

11. Comment from LicenseeStandby Shutdown Facility manual initiation failure probability:

All manipulation errors were assigned a performance shaping factor of 5 for complexity of task.

According to Reference D-3.5, revision of the 1994 ASP human reliability analysis methodology (Draft), INEEL/EXT-99-00041, this would correspond to Highly Complex actions. Highly Complex actions are characterized as Very difficult to perform. Much ambiguity in what needs to be diagnosed or executed. Many variables involved, with concurrent diagnoses or actions. The actions modeled such as starting the turbine-driven emergency feedwater pump, emergency feedwater cross-tie and activating the Standby Shutdown Facility do not fit this description. Instead, a more consistent performance shaping factor for the complexity of these actions would be Normal.

Defined as: Not difficult. Little ambiguity. Single or few variables involved. The only actions that might be considered Highly Complex would be those associated with establishing the station auxiliary service water and establishing high-pressure injection from the auxiliary service water switchgear.

Response: We reviewed the human error in probabilities in light of this comment, and in accordance with the guidance provided in Ref. D-3.5. Since establishing Standby Shutdown Facility auxiliary service water and Standby Shutdown Facility reactor coolant makeup functions are practiced routinely with a 100% success rate, we agree that there is little or no ambiguity associated with performing these two actions and that they are not very difficult to perform. Therefore, for these two operator actions we changed the performance shaping factor for complexity from highly complex to moderately complex.

12. Comment from LicenseeHigh-pressure injection pump non-recovery probability:

Credit should be given for the successful recovery of an high-pressure injection pump aligned to the auxiliary service water switchgear. Even for the conservative case of a large seal LOCA on all four reactor coolant pumps, Oconee specific RELAP5 analyses indicate at least 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months would be available for recovering an high-pressure injection pump (Attachment 2, Case 2). For smaller leakage rates and for run failures of the Standby Shutdown Facility, the time available would increase 40 SENSITIVE - NOT FOR PUBLIC DISCLOSURE

LER No. 269/99-001 to provide even more time to take successful action. Personnel have demonstrated in actual exercises that this action can be accomplished in approximately one hour.

It should be noted that this credit would apply equally to the Units 2 and 3 Bingham Seals and to Unit 1 even before the Westinghouse Pump Seals were replaced with Bingham Seals. As indicated in BNL Technical Report, W6211-08/99, even for the Westinghouse unqualified seals, the probability of O-ring failure is 0.0 for the first two hours. Only after 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months would there be an increased chance of O-ring failure. Therefore, assuming adequate time available, that this is a relatively simple problem to diagnose but complex action to accomplish and assuming high stress, the probability for operators failing to establish high-pressure injection flow should be 0.03.

Response: Based on the findings of the thermal hydraulic analysis which was performed in response to the ASP analysis, we concluded that appropriate credit can be given for recovery of a high-pressure injection pump aligned to the reactor coolant system for some sequences. This credit was given to those sequences where emergency feedwater is available. To enable this recovery, we modified the event tree by delineating sequences on which emergency feedwater is available after an reactor coolant pump seal LOCA.

Since the O-Rings of the Westinghouse seals fail two-hours after loss of seal cooling, even though the estimated initial leak rate for O-ring failures is 300 gpm/pump high-pressure injection recovery was credited for these sequences as well.

13. Comment from LicenseeGeneral comment:

The event summary incorrectly states that the postulated high-energy line in turbine building leading to failure of safety related 4kV switchgear was reported as a condition in License Event Report (LER) 269-99-01 dated 2/24/99. The background section of the LER states that this was a condition identified to the Nuclear Regulatory Commission in the high-energy line break analysis submittals dated 4/25/73 and 6/22/73. Thus, the subject of this ASP evaluation is a design feature of the plant approved by the NRC in the original licensing of the facility and is not a new condition identified by LER 269-99-01.

It also appears that the event summary is stating that the LER is reporting this condition as outside the design basis. Again, this is not an event that the LER is identifying. It was actually provided to the NRC in the high-energy line break analysis, which was submitted in 1973. The NRC evaluated and approved the high-energy line break analysis in a Safety Evaluation dated 7/6/73. Therefore, this is not a condition outside the design basis of the facility, and the basis used to subject this scenario to a precursor analysis is not apparent.

Response: Whether this condition is outside the design basis was not pertinent to the ASP analysis.

Consequently, the ASP Program did not investigate whether this condition is outside the design basis. We identified this condition as a precursor since (a) the risk significance exceeded the threshold for an ASP Precursor, and (b) the licensee had not recognized the risk significance due to lack of separation and protection of the emergency switchgear, during the walkdowns performed in support of Generic Letter 88-20.

We made editorial changes to the section on the Event Summary to reduce the potential for confusion with respect to the design basis.

14. Comment from NRR/REXBHigh-energy line break frequency:

Estimation of conditional core damage probability for the identified issues is significantly driven by what probability of high-energy line breaks is assumed. The ASP analysis focuses on using the percentage length of piping to calculate this probability. More discussion is warranted on the effects of piping diameter on the analysis. The analysis went so far as to measure lengths of susceptible piping to provide a very accurate percentage length. However, the analysis does not discuss the diameters of the susceptible piping at all but indicates that it is similar to other piping that has 41 SENSITIVE - NOT FOR PUBLIC DISCLOSURE

LER No. 269/99-001 historically ruptured. One segment of piping in question carries 100% of main feedwater which is a large diameter pipe. However, the more recent high-energy line break events were generally in smaller lines where two-phase flow was present. In light of this, a better discussion of the uncertainties is warranted.

Response: Even though the effect of pipe diameter on the high-energy line break frequency is not discussed explicitly in the analysis, it was factored into the analysis by using two different pipe break frequencies for the main feedwater pipes and the auxiliary steam pipes. As the comment points out, main feedwater pipes are large diameter pipes which carry single-phase liquid at high pressures and temperatures. For main feedwater pipes we used a frequency of 8.3E-04 per critical-year. This frequency was based on one event in 1800 critical-years. On the contrary, for the auxiliary steam pipes which are of medium size and carry two-phase flow at high temperatures and pressures, we used a frequency of 1.2E-02 per reactor critical-year. This frequency was based on 10 events in medium size pipes in 850 critical-years. Sections 4 and 6 of Attachment 1 of the ASP analysis provided details of these calculations.

References:

D-3.1. W.R. McCollum, Jr., Duke Energy, Oconee Nuclear Station, letter to U.S. Nuclear Regulatory Commission, dated July 19, 2001. (ADAMS Accession No. ML0121202810)

D-3.2 K. Jamali, Pipe Failure Study Update, EPRI TR-102266, April 1993.

D-3.3 G.M. Grant, et. al., Reliability Study: Emergency Diesel Generator Power System, 1987-1993, NUREG/CR-5500, Vol. 5, September 1999.

D-3.4 J. P. Poloski, et. al., Rates of Initiating Events at U.S. Nuclear Power Plants: 1987-1995, NUREG/CR-5750, February 1999.

D-3.5 J. C. Byers, et al., Revision of the 1994 ASP Human Reliability Analysis Methodology (Draft),

INEEL/EXT-99-00041, January 1999.

42 SENSITIVE - NOT FOR PUBLIC DISCLOSURE

ML20114E065

Contents

Text

Description:

Response

References:

Navigation menu