ML20135H298

Final ASP Analysis - Oconee 3 (LER 287-97-003)

ML20135H298
Person / Time
Site:	Surry
Issue date:	05/14/2020
From:	Christopher Hunter NRC/RES/DRA/PRB
To:
Littlejohn J (301) 415-0428
References
LER 287-1997-003
Download: ML20135H298 (15)

Text

ADnendix B Annenix BLER No. 287/97-003 B.3 LER No. 287/97-003 Event

Description:

Two high-pressure injection pumps were damaged because of a low water level in the letdown storage tank Date of Event: May 3, 1997 Plant: Oconee 3 B.3.1 Event Summary Following a high-pressure injection (HPI) nozzle weld leak and thermal sleeve failure at Oconee 2, operators began shutting down Oconee 3 on May 1, 1997, so that personnel could inspect the HPI nozzles and thermal sleeves at that unit.' A low water level in the letdown storage tank (LDST), caused by the partial draining of the common reference leg in the tank level instrumentation, resulted in inadequate suction flow to the HPI pumps. Two of the three HPI pumps were damaged. All three HPI pumps were vulnerable to failure if a loss-of-coolant accident (LOCA) had occurred while the reference leg was drained. The estimated conditional core damage probability (CCDP) associated with this event for the 340-h period when the low water level in the reference leg would have impacted HPI pump operability is 5.4 x 10'. This is an increase of 4.3 x 10.6 over the nominal core damage probability (CDP) of 1.1 x 10-6.

B.3.2 Event Description On May 1, 1997, personnel at Oconee 3 started to shut down the reactor to inspect the HPI nozzles and thermal sleeves in response to an HPI nozzle weld leak and failed thermal sleeve at Oconee 2 (Ref. 2) and a reassessment of earlier Unit 3 radiographs that indicated the potential degradation of a Unit 3 thermal sleeve. By the morning of May 3, the decay heat removal (DHR) system had been placed in operation, reactor coolant system (RCS) temperature and pressure were at 115'0C (240' 0F) and 1.9 MPa (270 psig);

respectively, and a slow cooldown [5 0 C/h (lOTF/h)] was in progress. HPI pump 3B was running, and pump 3A was in standby.

At 0913, control room alarm 3SA-2/C-2 indicated that the discharge pressure for the HPI pump was low. The alarm was cleared and then alarmed two more times during the next minute. HPI discharge pressure indicated

-14 MPa (2000 psig). Whiile reactor coolant pump (RCP) seal injection flow indicated normal, the RCP seal injection control valve (3HP-3 1) position was observed to vary, and, in response, the operators placed the valve controller in "manual." At 0915, the 3A HPI pump autostarted on a low RCP seal injection flow signal.

The control room operators stopped the 3A HPI pump within a minute, but when its control switch was placed in "automatic," it again started on low RCP seal injection flow.

The 3A HPI pump motor current was fluctuating at levels above normal (70-120 A), and the 3B pump motor current was about 10 A. The 3A pump was placed in the "run" mode, and the 3B pump was secured. Eight minutes after the initial low HPI discharge pressure alarm, both the RCP seal injection flow and HPI pump discharge pressure indicated low. The operators realigned the HPI pump suction flow path to the borated B.3-1 NUREG/CR-4674, Vol. 26

LE No. 287/97-003 Annendix B ADDendix B LER No. 287/97-003 water storage tank (BWST) by opening suction valve 3HP-24. The water level in the LDST began increasing, and the pump motor current for the 3A HPI pump motor stabilized at 10 A. At 0928, with HPI pump discharge pressure still low and no indication of RCP seal injection flow, operators closed BWST suction valve 3HP-24.

Two minutes later the operators observed that the LDST chart recorder had been indicating a constant level of 1.4 m (55.9 in.) for the last 1.75 b. The operators recognized that the HPI pump problems could be associated with erroneous LDST level indication, although the precise cause and nature of the problems were unknown. At 0931 the 3A HPI pump was secured, and valve 3HP-5 was closed to isolate RCS letdown. It was subsequently discovered that the 3A and 3B HPI pumps had been damaged when they were operated without an adequate suction source. Inadequate suction resulted from a low net positive suction head (NPSH) and possible hydrogen entrainment. The 3A and 3B pumps had operated with inadequate NPSH for about 15 min and 4 min, respectively.

RCS makeup and RCP seal injection were not immediately required, and a decision was made not to start the 3C HPI pump (if pump operation were required, the BWST could have been used as its suction source). A Notice of Unusual Event was declared at 1504 because of the expected delay in restoring RCS normal makeup. At 1515, the water level in the LDST level instrumentation common reference leg was found to be

-.1.2 m (49 in.) instead of its normally filled level of > 2.5 m (100 in). The partially drained reference leg produced a high water level indication for the LDST. At the time that the HPI pumps were damaged, the tank level indicated 1.4 m (56 in.), but the tank was actually empty.

A small amount of boric acid buildup was noted around a test tee cap on the reference leg side of the No. 2 level transmitter. A subsequent laboratory examination concluded that the reference leg leak resulted from either (1) scratches on seating surfaces of the test tee and plug or (2) expansion of the tee nipple, probably from overtightening the cap sometime in the past. The licensee also noted that the reliance of the operators on the LDST low level alarm to cue LDST makeup, instead of LDST status monitoring to determine when makeup was needed, contributed to the HPI pump failures. The LDST low level alarm set point is 1.4 m (55-in.), 2.5 cm (1 in.) below the lowest tank level that could be indicated with the partially drained reference leg.

At -2 130, personnel began to develop procedures to flush, fill, vent, and start the 3C HPI pump without using the LDST. A contingency plan was also developed to support Unit 3 shutdown without any HPI pumps running, if necessary. Following approval of the procedures and contingency plan, the 3C HPI pump was successfully started at -1140 on May 4, 1997, and the Unit 3 cooldown continued.

B.3.3 Additional Event-Related Information The HPI system at Oconee provides both normal RCS makeup and RCP seal injection, as well as HPI for small- and medium-break LOCA mitigation. Dur-ing normal operation, the HPI system "A" header, using either the 3A HPI pump or the 3B HPI pump, supplies RCS makeup and RCP seal injection [-300 L/min (80 gal/min) combined flow]. The LDST is used as a surge tank and normal (nonemergency) suction source for the HPI pumps. During operation, a hydrogen atmosphere is maintained in the LDST to promote oxygen scavenging. The "B" HPI header, supplied by the 3C HPI pump, is for emergency injection only. The HPI NUREG/CR-4674, Vol. 26 B.3-2

AiDDendix B LER No. 287/97-003 pumps effectively share a common suction because the suction cross-connect valves are normally open (Fig.

B.3. 1).

Two channels of level indication are provided for the LDST. The operators can select either channel for display on a control room chart recorder. The level transmitters for the two channels utilize common process piping and a common reference leg that is vented back to the LDST.

Normally, the water level in the LDST ranges between 60 and 80 in. The low LDST level alarm set point is 1.4 m (55 in). When the LDST level is at 2.5 m (100 in.) (full) and the reference leg of the transmitter is full, there is zero differential pressure across the transmitter. This indicates a full tank. When LDST level indicates "0 m (0 in.)", about 2600 L (690 gal) remain in the tank. A continuous fill line, which would have maintained the reference leg filled, was included in the original LDST instrumentation design. The licensee did not consider the fill line to be a part of the instrumentation, and it was isolated at the time of the event.

The HPI pumps are normally isolated from the BWST by motor-operated valves (MOVs) HP-24 and -25.

In the event of a safety system actuation, MOVs HP-24 and -25 open. The elevation head pressure in the BWST will overcome the pressure caused by the LDST level and hydrogen overpressure, opening check valves HP-101 and -102, closing the LDST outlet header check valve HP-97, and providing flow from the BWST to the HPI pumps. As the water level in the BWST drops, the available pressure from the LDST could exceed the available pressure from the BWST, allowing flow from the LDST when its check valve opens.

The hydrogen gas in the LDST could then expand and fill the suction piping, resulting in damage to the HPI pumps. The procedural operating limit curve for LDST hydrogen pressure and volume is intended to ensure that LDST pressure does not exceed available BWST pressure, even as the water level in the BWST is drawn down during a LOCA. [A 1991 operational event at Oconee 1, 2, and 3 involving incorrect LDST hydrogen pressure/volume curves was analyzed as an accident sequence precursor (ASP).']

The HPI pumps at Oconee are 24-stage vertical centrifugal pumps that develop 21 -MPa (3000-psi) discharge pressure with a capacity of about 1900 L/min (500 gal/min) each. The pumps will typically only operate for 1-2 min without an adequate suction source before they are damaged.

Additional information concerning this event is included in an NRC Augmented Inspection Team report.4 B.3.4 Modeling Assumptions If an initiating event involving a loss of RCS inventory occurred while the LDST was almost empty, all three HPJ pumps could have failed as a result of hydrogen gas binding. This analysis assumes that the HPI system was vulnerable to failure as a result of the LDST common reference leg leak between February 22, 1997-when the LDST level instrumentation was calibrated, and May 3, 1997-when the two HPI pumps failed while shutting down. If an initiating event involving a loss of RCS inventory occurred during this time period, the potential for HPI pump failure would depend on the actual water levels that were reached in the LDST and BWST.

The potential effect of a loss of the HPI pumps following an initiating event without RCS inventory loss, such as the May 3, 1997, event when the low water level in the LDST was discovered, was not addressed in this B.3-3 B.3-3NUREG/CR-4674, Vol. 26

LER No. 287/97-003 Appendix 9 Apni analysis. For such an event (or a postulated transient with successful primary relief valve closure, which was also not addressed in this analysis), the limited RCS makeup required could be provided by the safe shutdown facility (SSF) RCS makeup pump if all the HPI pumps were to fail.

This analysis assumed that the LDST reference leg was leaking continually. The LDST reference leg level was assumed to have decreased linearly with time, from 2.5 m (100 in.) (full) on February 22, 1997, to 1.2 m (49 in.) on May 3, 1997. Although the LDST is refilled to compensate for minor RCS leakage and to maintain the water level in the tank within the operational range, the gradual reduction in reference leg level resulted in an effective, albeit unrealized, reduction in tank level. Based on a simplified model of LDST level and pressure as a function of LDST reference leg level during BWST drawdown, the HPI pumps were estimated to be vulnerable to failure during (approximately) the final 20% of the time between February 22 and May 3, or 340 h. During this period, hydrogen gas would enter the pump suction piping and fail the HPI pumps if, following a LOCA, BWST level decreased to near the level at which switchover to high-pressure recirculation was required.

A new branch (HPI-LATE) was added to the event trees used in the ASP analysis to address the potential failure of HPI due to low water level in the LDST late in the injection phase. The fault tree associated with this branch consists of one basic event, LDST-LVL-LQW, that-represents the probability that the water level in the LDST is unacceptably low. This basic event was set to TRUE during the 340-h period when the unacceptably low LDST water level existed. The ASP event trees for transients, loss of offsite power events, small-break LOCAs (SLOCAs), and steam generator tube ruptures (SGTRs) were also enhanced to address the potential use of rapid RCS depressurization and low-pressure injection (LPI) in the event that HPI failed and secondary-side cooling was available by adding branches to address fast depressurization, LPI, and low-pressure recirculation (LPR). The Oconee Individual Plant Examination (IPE) states that following an SLOCA with a loss of HPI, the emergency operating procedures direct the operators to use secondary heat removal systems to depressurize the RCS until LPI flow is greater than 380 L/min (100 gal/min) per header.

The probability of the operators failing to depressurize the RCS and initiating LPI was assumed to be 0.1, consistent with Ref. 5 (pp. 5.7-22). Two operator actions associated with cooldown and depressurization are included in the SLOCA model. PCS-XHE-XM-CDOWN addresses the failure of the operators to cool down and depressurize the unit and initiate the residual heat removal (RI-R) system following a SLOCA. This action is initiated early following the SLOCA. PCS-XHE-XM-FDEPR addresses the failure of the operators to depressurize to LPI pressure following a loss of HPI. In this event, this failure occurs close to the time when sump recirculation must be initiated, 4 to 6 h after the SLOCA. Because of this separation in time between the two actions, they were considered *independentin this analysis.

If the water level in the BWST did not decrease to near the sump switchover level, then HPI pump operability would not be expected to be impacted. This could happen if, instead of proceeding to high-pressure recirculation, the operators successfully cooled down and depressurized the RCS during the injection phase and initiated DHR using the DHR system. This is the preferred response following an SLOCA because it avoids sump recirculation (the ASP models include this potential action). Limited BWST drawdown is expected in this case.a

'This expectation is supported by the limited BWST drawdown that occurred following a 1325 L/mfin (350-gal/nun) reactor coolant pump seal failure in 1980 at Arkansas Nuclear One, Unit I (Ref. 6).

NUREG/CR-4674, Vol. 26 B.34

ADDendix B LER No. 287/97-003 HPI is also required to mitigate a medium-break LOCA (MLOCA) at Oconee (it is not required to mitigate a large-break LOCA). If an MLOCA occurred during the 340-h period when the LDST reference leg level was unacceptably low, the HPI pumps would have failed due to hydrogen entrainment before sump recirculation was initiated. The Oconee IPE (see Ref. 5, pp. 2.3-8 and -9, and Table D.2) notes that the time available before switchover to high-pressure recirculation (90 min) is too short to allow RCS depressurization to the point that LPI and LPR can be used if HPI were to fail early in this event. However, the IPE concluded that HPI failure around the time of switchover to sunmp recirculation could be -mitigated by rapid depressurization to the point that LPR could be used.

The ASP Program typically considers the potential for core damage following four postulated initiating events in pressurized-water reactors: transient, loss of offsite power, SLOCA, and SGTR. Supercomponent-based linked fault tree models are available for each of these postulated initiating events. A linked fault tree model was developed to address the impact of a low water level in the LDST on an MLOCA. Consistent with the Oconee IPE, this model assumed that a reactor trip (RT), one train of HPI, and piggy-back cooling (high-pressure recirculation) are required for core cooling following an MLOCA; failure of HPI late in the injection phase was assumed to be mitigated through the use of rapid depressurization, LPI, and LPR. The fact that the event tree branch success criteria were the same as those used in the Oconee ASP model for an SLOCA allowed the existing fault trees to be used, in conjunction with the event tree shown in Fig. B.3.2, in describing MLOCA accident sequences. The event tree includes the following branches:

Initiating Even t-MLOCA (MILOCA). The frequency of an MLOCA is estimated to be 5.0 x 10~'/year

[8.2 x 10-"/h, assuming the unit is at power 70% of the time (6132 h)], based on a survey of medium-break frequencies performed in support of the analysis of Turkey Point LER No. 25 0/94-005 in the 1994 precursor report (see Appendix H to Ref. 7 for additional information).

Reactor Trip (RT). Failure of the reactor to trip is assumed to result in core damage following an MLOCA.

High-PressureInjection (HPI). Failure of injection using the HPI system results in a loss of short-term RCS makeup and core damage following an MLQCA. Flow from one HPI pump is assumed to provide success.

HPl Fails Late (HPJ-L4TE). Failure of HPI system late in the injection phase results in the loss of RCS makeup and the requirement to rapidly depressurize the RCS to allow the use of LPI and LPR for core cooling. As described previously, this top event specifically addresses the potential failure of HPI due to low LDST level (other late injection phase failures, such as a common-cause failure of the HPI pumps to run, are imbedded within HPI). A failure probability of 1.0 is assumed for this branch when LDST level is unacceptably low.

RCS Fast Depressurizationto LPJ Pressure (FASTDEPR). Given a failure of HPI late in the injection phase, failure to rapidly depressurize the RCS to a pressure that would allow for adequate LPI flow results in a loss of RCS makeup and core damage.

Low Pressure Injection (LM). Failure of LPI following successful RCS depressurization subsequent to a failure of HPI results in the loss of RCS makeup and core damage.

B.3-5 B.3-5NUREG/CR-4674, Vol. 26

ADnendix A~ni B LER No. 287/97-003 Piggy-Back Cooling (PB-COOL). Failure of piggy-back cooling results in a failure of long-term injection and DHR and is assumed to result in core damage. PB-COOL utilizes the DHR pumps, which take suction on the reactor building (RB) sump and provide water via the DHR heat exchangers to the suctions of the HPI pumps. Flow from one HPI pump (supplied by one DHR train) provides PB-COOL success.

Low-Pressure Recirculation (LPR). Failure of LPR following successful RCS depressurization subsequent to a failure of HPI results in a failure of long-term injection and DHR and is assumed to result in core damage.

Like PB-COOL, LPR uses the DHR pumps, which take suction from the RB sump and provide water via the DHR heat exchangers to the RCS.

As with the other ASP linked fault tree models, the MLOCA model was solved using the Saphire computer code to identify combinations of basic events (cut sets) that would result in core damage.

B.3.5 Analysis Results The CCDP estimated for the potential HPI system unavailability because of the leaking LDST common reference leg is 5.4 x 10'. This is an increase of 4.3 x 10 ' over the nominal CDP of 1.1 x 10 ' for the 340-h period. The dominant sequence, highlighted as sequence 6 in Fig. B.3.2, contributes about 66% to the increase in the CCDP and involves

• a postulated MLOCA,

• successful RT,

• initial HPI success,

• failure of HPI late in the injection phase as a result of the low water level in the LDST, and

• failure to depressurize the RCS to allow the use of the LPI system for makeup.

Definitions and probabilities for selected basic events are shown in Table B.3. 1. The conditional probabilities associated with the highest probability sequences are shown in Table B.3.2. Table B.3.3 lists the sequence logic associated with the sequences listed in Table B.3.2. Table B.3.4 describes the system names associated with the dominant sequences. Minimal cut sets associated with the dominant sequences are shown in Table B.3.5.

In addition to an assessment of the effect of a loss of HPI following a potential initiating event at Unit 3, a sensitivity analysis considered the effect if the Unit 3 LDST reference leg leak and the Unit 2 HPI nozzle weld leak (see the analysis of LER No. 270/97-001) had instead occurred at the same unit. As described in the analysis of LER No. 270/97-00 1, subsequent inspections of the thermal sleeve and injection line nozzles at Units 1 and 3 determined that Unit 3 was also affected by nozzle cracking. If the nozzle leak had occurred at Unit 3 at the same time as the low water level in the LDST (or if the low water level in the LDST had occurred at Unit 2 in conjunction with the observed leak), a CCDP of 2.8 x 10' would have been estimated.

B.3.6 References

1. Licensee Event Report 287/97-003, "High Pressure Injection System Inoperable due to Design Deficiency and Improper Work Practices," June 2, 1997.

NUREG/CR-4674, Vol. 26 B.3-6

Annendix B LER No. 287/97-003

2. Licensee Event Report 270/97-001, "Unisolable Reactor Coolant Leak due to Inadequate Surveillance Program," May 21, 1997.

3. J. W. Minarick et al., Precursorsto PotentialSevere Core DamageAccidents: 1991, A Status Report, USNRC Report NUREG/CR-4674, Vol. 16, September 1992, p B-47.

4. NRC Augmented Inspection Team Report 269/97-06, 2 70/9 7-06, 28 7/97-06, May 30, 1997.

5. Oconee. Nuclear Station Units 1, 2, and 3, IPE Submittal Report, Rev. 1, December 1990.

6. W. B. Cottrell et al., Precursors to Potential Severe Core Damage Accidents: 1980-1 981, A Status Report, USNRC Report NUREG/CR-359 1, Vol. 2, February 1984, p. B- 126.

7. R. J. Belles et al., Precursors to Potential Severe Core Damage Accidents: 1994, A Status Report, USNRC Report NUREG/CR-4674, Vol. 21, December 1995.

NUREGICR-4674, Vol. 26 B.3-7 NUREG/CR-4674, Vol. 26

LER No. 287/97-003 Appendix B Figure removed during SUNSI review.

Fig. B.3.1. Flow diagram of the emergency core cooling system at Oconee 3 (Source: Oconee 3 Final Safety Analysis Report).

NUREG/CR-4674, Vol. 26 B.3-8

LER No. 287/97-003 LRN.279-0 Annendi B c0Iw .1 0 x 0 9 LL I-Cop) 0 0 0 0 0 C.) C.)

w (0 (0 z i v- CM CO V to pI- a0 p

4 r

• 2 a:

-j

-j 0

COW 0 COI w Z5 a.

IxUJ a.

COW wi w

W I-0w z

a. 0-w CoW M-0 SCO w I- z 0

0 0

z C.) w z 0

-J Fig. B.3.2. Dominant core damage sequence for LER No. 287/97-003.

NUREGICR-4674, VoL 26 B.3-9 NUREG/CR-4674, Vol'. 26

LER No. 287/97-003 ADDendix B Table B.3.1. Definitions and Probabilities for Selected Basic Events for LER No. 287/97-003 Modified Event Base Current for this name Description probability probability Type event JE-LOOP Initiating Event-Loss of Offsite 2.8 E-006 2.8 E-006 No Power (LOOP)

IE-MLOCA Initiating Event-MLOCA 8.1 E-008 8.1,E-008 NEW Yes IE-SGTR Initiating Event-SGTR 1.3 E-006 1.3 E-006 No IE-SLOCA Initiating Event-SLOCA 6.5 E-007 6.5 E-007 No IE-TRANS Initiating Event-Transient 7.7 E-004 7.7 E-004 No DHR-HTX-CF-ALL Common-Cause Failure of the 5.2 E-004 5.2 E-004 No DHR Heat Exchangers ___________

E-FW-AOV-CF-FCV Common-Cause Failure of the 3.7 E-005 3.7 E-005 No Emergency Feedwater (EFW)

Flow-Control Valves EFW-PMP-CF-ALL Common-Cause Failure of the 1.8 E-004 1.8 E-004 No EFW Pumps EFW-PSF-VF-MDP Failure of the Upper Storage 2.3 E-004 2.3 E-004 No Tank Supply Line to the Motor-Driven Pumps (MDPs)

EFW-PSF-VF-SGA Failure of the Flow Control Path 2.3 E-003 2.3 E-003 No to Steam Generator (SG) A EFW-PSF-VF-SGB Failure of the Flow Control Path 2.4 E-003 2.4 E-003 No to SG B EFW-TDP-FC-TDP Hardware Failures in the EFW 3.2 E-002 3.2 E-002 No Turbine-Driven Pump (TDP)

Train EFW-XHE-MDPSUP Operator Fails to Switch Over 1.0 E-003 1.0 E-003 No the EFW MDPs to the Hotwell EFW-XHE-NOREC Operator Fails to Recover EFW 2.6 E-001 2.6 E-O001 No EFW-XHE-NOTHROT Operator Fails to Throttle EFW 5.0 E-003 5.0 E-003 No Flow EFW-XHE-TDPSUP Operator Fails to Switchover the 5.0 E-002 5.0 E-002 No EFW TDPs to the HotwellII I B.3-10 NUREG/CR-4674, Vol.Vol. 26 26 B.3-10

AnDendix t LER LER No. No. 287/97-003 287/97-003 ADDendix B Table B.3.1 Definitions and Probabilities for Selected Basic Events for LER No. 287/97-003 (continued)

Modified Event Base Current for this name Description probability probability Type event EFW-XHE-THROT-L Operator Fails to Throttle EFW 5.0 E-003 5.0 E-003 No Flow during a LOOP______

LDST-LVL-LOW Low Water Level in the LDST 4.4 E-003 1.0 E+000 TRUE Yes Fails the HPI Pumps _______ __________

LPR-XHE-XM Operator Fails to Initiate LPR 1.0 E-002, 1.0 E-002 No MFW-SYS-TRIP Main Feedwater (MFW) System 2.0 E-00 1 2,0 E-00 1 No

__________________Trips_________________

MFW-XHE-NOREC Operator Fails to Recover MEW 3.4 E-00 1 3.4 E-00 1 No OPE-XHE-NOREC-6H Operator Fails to Recover Offsite 1.6 E-00 1 1.6 E-00 1 No Power within 6 h PCS-VCF-HW Failure of Secondary System 3.0 E-003 3.0 E-003 No Hardware PCS-XHE-XM-CDOWN Operator Fails to Initiate 1.0 E-002 1.0 E-002 No Cooldown PCS-XHE-XM-FDEPR Operator Fails to Initiate Fast 1.0 E-001 1.0 E-001I NEW Yes

_________________Depressurization for LPI PCS-XHE-XO-SEC Operators Fail to Establish 2.0 E-00 1 2.0 E-00 1 No Secondary Cooling____________ ________

PCS-XHE-XO-SECL Operators Fail to Establish 3.4 E-00 1 3.4 E-001 No Secondary Cooling during a LOOP SSF-NO-START SSF Fails to Operate 1 2.0 E-001I 2.0 E-O001 No NIJREG/CR-4674, Vol. 26 B.3-11 B.3-11 NUREG/CR-4674, Vol. 26

ADnendix B LER No. 287/97-003 A~ni Table B.3.2. Sequence Conditional Probabilities for LER No. 287/97-003 Conditional Event tree Sequence core damage Core damage Importance Percent name number probability probability (CCDP-CDP) contribution'

_________(CCDP) (CDP) _____

MLOCA 6 2.9 E-006 1.3 E-008 2.8 E-006 65.6 SLOCA 10 8.9 E-007 3.9 E-009 8.8 E-007 20.4 MLOCA 4 2.7 E-007 1.2 E-009 2.7 E-007 6.2 LOOP 34 2.2 E-007 9.7 E-010 2.2 E-007 5.1 LOOP 39 7.2 E-008 3.1 E-010 7.1 E-008 1.7 SLOCA 33 6.1 E-008 2.7 E-0 1 6.1 E-008 1.4

[ J I TRANS 43 6.0 E-008 2.6 E-0 10 6.0 E-008 1.4 Total (all sequences) 5.4 E-006 1.1 E-006 .3E-006 Percent contribution to the tota importance.

Table B.3.3. Sequence Logic for Dominant Sequences for LER No. 287/97-003 Event tree Sequence Logic name number MLOCA 6 IRT, /HPI, HPI-LATE, FASTDEPR SLOCA 10 IRT, IEFW, /HPI, COOLDOWN, HPI-LATE, FASTDEPR MLOCA 4 /RT, IHPI, HPI-LATE, IFASTDEPR, /LPI, LPR LOOP 34 IRT-L, /EP, EFW-L, IPRVL-RES, 5SF, /OP-6H, IHPI-C-L, SGCOOL, HPI-LATE LOOP 39 IRT-L, /EP, EFW-L, IPRVL-RES, SSF, OP-6H, JHPI-C-L,

_________ ________SGCOOL-L, HPI-LATE SLOCA 33 IRT, EFW, MFW, /SSF, IHPI, HPI-LATE TRANS 43 /RT, EFW, MFW, SSF, IHPI-COOL, SGCOOL, HPI-LATE B.3-12 NUREG/CR-4674, Vol.26 NUREG/CR4674, Vol. 26 B.3-12

ADiDendix B LER No. 287/97-003 LER No. 287/97-003 ApDendix B Table B.3.4. System Names for LER No. 287/97-003 System name Logic COOLDOWN RCS Cooldown to DHR Pressure Using Turbine-Bypass Valves, etc.

EFW` No or Insufficient EFW Flow EFW-L No or Insufficient EFW Flow during a LOOP EP Loss of all Emergency ac Power FASTDEPR RCS Cooldown to LPI Pressure Using Turbine-Bypass Valves, etc.

HPI No or Insufficient HPI System Flow HPI-C-L Failure of HPI Cooling during a LOOP HPI-COOL Failure to Provide HPI Cooling HPI-LATE HPI Fails Late LPI No or Insufficient LPI LPR No or Insufficient LPR MFW Failure of the MFW System OP-6H Operator Fails to Recover Offsite Power Within 6 h PRVL-RES Power-Operated Relief Valves and Block Valves Fail to Reseat

________________(Electric Power Succeeds)

RT Reactor Fails to Trip during Transient RT-L Reactor Fails to Trip during LOOP SGCOOL Failure to Recover Secondary Cooling SGCOOL-L Failure to Recover Secondary Cooling when Offsite Power is Unavailable ISSF ISSF Fails to Operate NI.JREGICR-4674, Vol. 26 B.3-13 NUREG/CR4674, Vol. 26

LER No. 287/97-003 Appendix B Table B.3.5. Conditional Cut Sets for Higher Probability Sequences for LER No. 287/97-003 Cut set Percent number contribution CCDP'I Cut Set Sh MLOCA Sequence 6 2.9 E-006 I1 97.4 2.8 E-006 LDST-LVL-LOW, PCS-XHE-XM-FDEPR I, 2 2.9 8.5 E-008 LDST-LVL-LQW, PCS-VCF-HW SLOC8...0 Sequence... 10 MLOCA Sequence 40 2.7 E-007 . ... ....... .......

1 1 79.0 2.5 E-007 LDST-LVL-LOW, /PCS-VCF-HW,/C-EXMFPR 2 254.8 1.3 E-007 LDST-LVL-LOW. IPCS-VCF-IM-CDW, IPC-XH-XME-FDEPR. P MLOOP Sequence34 2.2 E-007........... ....... .",

q e c 3361S E 0 8K. .LOC. .. ....... . ........... . . . . . . . . ...... .

1 92.0 2.5 E-007 SF-O-SART LDST-LVL-LOW, PSVFH,/C-H-MFEIL TRANS 43 Seuence 6.0 E-00 1 55.2 3.3 E-008 EFWT-PMP-FALL. EFWVC-W./C-XHE-NOE, F-SYS-TRI, MFW-HXE-NOECF S-N-TRTADS-VLLW

........ S......

S......X...H.... ............ ....... ..

2~~ ~9.2..... ~ ~FY.. ~

15.5 W.S.........

~

P EWXH-MPUP . FWXH-OR ............

_______........_ _ _ _ ............ PS- HE XO SE .__ ..........

Vol. 26 B.3-14 NUREGICR-4674, Vol.

NLWG/CR-4674, 26 B.3-14

ADDendix B LER No.No. 287/97-003 287/97-003 ADDendix B LER Table B.3.5. Conditional Cut Sets for Higher Probability Sequences for LER No. 287/97-003 (Continued)

Cut set Percent number contribution CCDP' Cut setSb 3 11.5 6.8 E-009 EFW-AOV-CF-FCV, EFW.XHiE-NOREC, MFW-SYS-TRIP, MFW-XHiE-NOREC, SSF-NO-START, LDST-LVL-LOW, PCS-XHiE-XO-SEC 4 9.9 6.1 E-009 EFW-TDP-FC-TDP, EFW-XH~E-MDPSUP. EFW-)XHE-NOREC.

MFW-SYS-TRIP, MFW-XHE-NOREC, SSF-NO-START, LDST-LVL.LQW, PCS-XHE-XO-SEC 5 3.5 2.1 E-009 EFW-XHiE-TDPSUP, EFW-PSF-VF-MDP, EFW-XCHE-NOREC.

MFW-SYS-TRIP, MFW-XHE-NOREC, SSF-NO-START.

LDST-LVL-LOW, PCS-XGi-E-XO-SEC 6 2.3 1.4 E-009 EFW-TDP-FC-TDP, EFW-PSF-VF-MDP, EFW-XHE-NOREC.

MFW-SYS-TRIP, MFW-XHiE-NOREC, SSF-NO.START.

LDST-LVL.LOW, PCS-XHiE-XO-SEC 7 1.7 1.0 E-009 EFW-PSF-VF-SGA, EFW-PSF-VF-SGB, EFW-XHE-NOREC, MFW-SYS-TRIP, MFW-.XHE.NOREC, SSF-NO-START, L.DqT-L.VIALOW PCSR-XMFW-XO-SEFC Total (all sequences) 5.4 E-006 aThe CCDP is determined by multiplying tbe probability that the portion of the sequence that makes the precursor visible (e.g., the system with a failure is demanded) will occur during the duration of the event by the probabilities of the remaining basic events in the minimal cut set. This can be approximated by 1- e-", where p is determined by multiplying the expected number of initiators that occur during the duration of the event by the probabilities of the basic events in that minimal cut set. The expected number of initiators is given by It, where I is the frequency of the initiating event (given on a per-hour basis), and t is the duration time of the event (340 h). This approximation is conservative for precursors made visible by the initiating event. The frequencies of interest for this event are 8

= 8. 15 x 10- /h, and 1,, = 6.52 x 10'7 Ah. The importance is determined by subtracting the CDP for the same period but with plant equipment assumed to be operating nominally.

bBasic event LDST-LVL-LOW is a type TRUE event. This type of event is not normally included in the output of the fault tree reduction process but has been added to aid in understanding the sequences to potential core damage associated with the event.

B.3-15 B.3-15NIJREGICR-4674, Vol. 26