05000269/LER-2001-001

LER-2001-001,

Event date:
Report date:
Reporting criterion:	10 CFR 50.73(a)(2)(ii)(B), Unanalyzed Condition
2692001001R00 - NRC Website

BACKGROUND

This event is reportable per 10 CFR 50.46(a)(3)(ii), which references 10 CFR 50.73. 10 CFR 50.73(a)(2)(ii)(B) also applies because a system required to meet the single failure criterion does not do so using previous analytical assumptions.

The Oconee Emergency Core Cooling System (ECCS) includes the following systems:

High Pressure Injection (HPI)[EIIS:BG] Low Pressure Injection (LPI) [EIIS:BP] Core Flood (CF) [EIIS:BP] Oconee Technical Specification (TS) 3.5.2 requires three HPI pumps to be operable at power levels above 75% Rated Thermal Power (RTP).

Operation above 75% RTP with only two operable HPI pumps is allowed for up to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. This TS provides an extended (30 day) Allowed Outage Time (AOT) at based, in part, on the ability of the system to perform the necessary safety function with an additional HPI failure. TS 3.5.2 allows credit for a HPI train to be operable if it can be manually aligned within ten minutes.

Preliminary Safety Concern (PSC) Report No. 2-00, initiated by Framatome Technologies Inc. (FTI) on July 28, 2000, identified that a potentially limiting break had not been considered in the small break loss of coolant accident (SBLOCA) analyses spectrum. FTI recognized two separate non-conservatisms in the SBLOCA analyses:

• The core flood (CF) line break with offsite power available was more limiting than the CF line break with loss of offsite power event, but this had not been identified in the previous analysis; and,

• The Reactor Coolant [EIIS:AB] Pump (RCP) flow degradation model under two-phase fluid conditions was not conservative for this application.

FTI had developed a revised ECCS analysis model that addressed those non-conservatisms. One critical assumption of this analysis was the criterion imposed by Generic Letter 83-10(f). An enclosure titled "Resolution of TMI Action Item II.K.3.5" states: "For the purposes of showing compliance with 10 CFR 50.46, operator action to trip the RCPs should be assumed no earlier than two (2) minutes following the onset of reactor conditions corresponding to the RCP trip setpoint." This assumption is significant because it impacts the quantity of RCS inventory lost out the break.

Based on preliminary results, FTI notified the B&W Owners' Group (BWOG) members on September 11, 2000 that Crystal River and TMI-1 analyses using that assumption may not meet 10CFR 50.46 acceptance criteria on Peak Clad Temperature for certain scenarios initiated at full power. Those sites notified the NRC and reported this condition. Reference Licensee Event Reports 2000-003-00 for Crystal River and 2000-004-00 for TMI-1.

This issue was not reportable for Oconee at that time, based on the fact that Oconee has three HPI pumps, all of which receive emergency actuation signals from the Engineered Safeguards [EIIS:JE] system. Even with a single failure, Oconee would have flow from two HPI pumps, and the 2200F limit of 10 CFR 50.46(b) would not be exceeded.

EVENT DESCRIPTION

On January 11, 2001, FTI contacted Duke Power Engineering personnel with additional results of the preliminary analysis of a core flood (CF) line break. Based on these additional preliminary results, FTI concluded that, for an event scenario initiating from 75% power, the maximum peak clad temperature would not meet the 10CFR 50.46 acceptance criteria. The applicable scenario assumes:

1. one (of two) HPI train or one (of three) HPI pump initially out of service 2. initial power level at 75% RTP 3. a CF line Small Break LOCA 4. no Loss of Off-site Power (LOOP) 5. a single failure affecting one additional HPI pump (leaving one HPI pump OPERABLE) 6. the single failure (e.g. loss of an electrical buss) also impacts the LPI pump connected to the undamaged CF line 7. two minute operator action time to trip the RCPs following Loss of Sub-Cooling Margin (LSCM).

Operation at the assumed initial conditions is permitted by TS.

Operation with one HPI pump out of service at permitted by TS for up to 30 days, based, in part, on the ability of the system to perform the required safety function with an additional single failure. Operation at train out of service is permitted for up to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> based, in part on reliance on non-safety equipment. Therefore, the event scenario above is within the Oconee licensing basis.

FTI expected that acceptable results would be obtained for the 75% RTP initial condition either if the assumed two minute operator action time to trip the RCPs was revised to one minute or if the assumed initial power level was revised to At the time Oconee was notified, all Oconee Units were operating with all three HPI pumps available. Engineering personnel initiated a Problem Investigation Process (PIP) and began evaluating the preliminary results communicated by FTI. Operations were informed that an Operability Evaluation was in progress as part of the PIP. Interim guidance was provided to the operators to trip the RCPs within one minute following Loss of Sub-Cooling Margin (LSCM). This guidance was revised to direct the Operators to reduce power to action time condition.

This event was evaluated for reportability under 10CFR 50.72. At 1100 hours0.0127 days <br />0.306 hours <br />0.00182 weeks <br />4.1855e-4 months <br />, on January 17, 2001, Oconee Management conservatively elected to report this condition under 50.72(b)(2)(iii)(D) (a condition that could prevent the fulfillment of a safety function).

The notification was made at 1145 hours0.0133 days <br />0.318 hours <br />0.00189 weeks <br />4.356725e-4 months <br />.

At the time of the 50.72 notification, Unit 1 was operating at 18% Rated Thermal Power (RTP) during start-up following a refueling outage. Units 2 and 3 were operating at 100% RTP. No safety systems or components were out of service that would have contributed to this event.

A review of operating history for the last three years found one occasion, in September, 2000 where the 1B HPI pump was out of service with Unit 1 at 100% RTP for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, then power was reduced to 60% RTP per the existing TS for an additional 82.75 hours8.680556e-4 days <br />0.0208 hours <br />1.240079e-4 weeks <br />2.85375e-5 months <br />. No occasion was found where a HPI train was inoperable such that it could not be manually aligned within ten minutes.

CAUSAL FACTORS

The root cause of this event was Analysis Deficiency for the failure to adequately consider that the CF Line Break with offsite power available could be a limiting event in the SBLOCA spectrum.

Since this decision is historical in nature, a more detailed root cause analysis is not justified.

CORRECTIVE ACTIONS

Immediate:

1. Interim guidance was provided to the Operators to trip the RCPs within one minute of LSCM.

2. An evaluation was initiated to determine a power level less than 75% that would provide assurance that the 10 CFR 50.46 acceptance criteria could be met with only one HPI pump and a two minute RCP trip time.

Subsequent:

1. The interim guidance to Operations was revised to direct the Operators to reduce power to which permits using the extended HPI pump AOT. This guidance has been incorporated into Selected Licensee Commitment 16.6.12.

Planned:

1. When the FTI analyses of the PSC-2-00 concerns are finalized, Oconee will evaluate options and implement appropriate corrective actions.

There are no NRC Commitment items contained in this LER.

SAFETY ANALYSIS

The implications of an actual CF line break event meeting the assumptions of this analysis (i.e., using the SBLOCA analysis of record for the CF line break, with offsite power available, initial operation at tripped at two-minutes following LSCM, and application of the 10 CFR 50 Appendix K required single-failure assumption) are that the upper portion of the fuel would be uncovered resulting in excessive clad temperatures. The Reactor Coolant System would ultimately be vulnerable to fission product release, but the integrity of the containment barrier would not be threatened.

Preliminary analysis indicates that tripping the RCPs at one minute after LSCM will result in Peak Clad Temperatures less than 750F, which meets the 2200F acceptance criteria. Training and procedure validation records were reviewed. On three occasions trip times were recorded during Emergency Operating Procedure (EOP) validations. In these cases, Operators actually tripped the RCPs within 30 seconds (median time 14 seconds) following LSCM.

Therefore, Oconee has reasonable assurance that operator actions would have met the one-minute criterion in the past.

The change in core damage frequency (CDF) associated with the more stringent requirement that the RCPs must be tripped within one minute rather than two minutes has been conservatively estimated to be approximately 2E-10/RY. This represents a very small fraction of the Oconee CDF and is a negligible change.

The CDF evaluation is based on the following inputs:

• The initiating event frequency is assumed to be 5E-06/RY, the pipe rupture frequency from NUREG/CR-5750 for pipe in the size range of the CF line.

• The full 30 day duration of the AOT for an HPI pump out of service is assumed. In fact, the only time period in the past three years that any of the Oconee units have used the extended AOT involved 82.75 hours8.680556e-4 days <br />0.0208 hours <br />1.240079e-4 weeks <br />2.85375e-5 months <br /> of Unit 1 operation at 6096 RTP during September 2000.

• A conservative failure probability for an HPI pump of 0.05 is assumed. LPI flow is not specifically credited in the analysis because a common power failure could impact one HPI pump and the LPI pump connected to the unbroken CF line.

However, a more realistic scenario is that LPI flow would be available and would provide sufficient ECCS flow such that the core would remain covered.

• The median response time for securing the RCPs is 14 seconds based on the available operator response time measurements. A conservative estimate of 0.01 is assumed for the failure probability based on the Human Cognitive Reliability model for a rule based action.

No actual LOCA event or component failure occurred relative to this event. This event did not include a Safety System Functional Failure. Also, this scenario does not apply to any event that involves a LOOP since the RCPs would trip due to the LOOP.

In summary, there was no actual impact on the health and safety of the public due to this event.

ADDITIONAL INFORMATION

There have been no similar events related to 10 CFR 50.46 ECCS analyses within the last three years and no corrective actions from prior events would reasonably be expected to have prevented this event.

There were no releases of radioactive materials, radiation exposures or personnel injuries associated with this event.

This event is not considered reportable under the Equipment Performance and Information Exchange (EPIX) program.