NUREG/IA-0219 

 International 

 Agreement Report

 

Estimation of Operator Action 

Time Windows by RELAP5/MOD3.3 

Prepared by: 

A. Prošek, B. Mavko, M. Čepin 

Jožef Stefan Institute 

Jamova cesta 39 

SI-1000 Ljubljana, Slovenia 

A. Calvo, NRC Project Manager 

Office of Nuclear Regulatory Research 

U.S. Nuclear Regulatory Commission 

Washington, DC 20555-0001 

December 2009 

 

Prepared as part of 

The Agreement on Research Participation and Technical Exchange 

Under the Thermal-Hydraulic Code Applications and Maintenance Program (CAMP) 

Published by 

U.S. Nuclear Regulatory Commission
AVAILABILITY OF REFERENCE MATERIALS 

IN NRC PUBLICATIONS

NRC Reference Material 

As of November 1999, you may electronically access 

NUREG-series publications and other NRC records at 

NRC=s Public Electronic Reading Room at 

http://www.nrc.gov/reading-rm.html. Publicly released 

records include, to name a few, NUREG-series 

publications; Federal Register notices; applicant, 

licensee, and vendor documents and correspondence; 

NRC correspondence and internal memoranda; 

bulletins and information notices; inspection and 

investigative reports; licensee event reports; and 

Commission papers and their attachments. 

NRC publications in the NUREG series, NRC 

regulations, and Title 10, Energy, in the Code of 

Federal Regulations may also be purchased from one 

of these two sources. 

1. The Superintendent of Documents 

 U.S. Government Printing Office 

 Mail Stop SSOP 

 Washington, DC 20402B0001 

 Internet: bookstore.gpo.gov 

 Telephone: 202-512-1800 

 Fax: 202-512-2250 

2. The National Technical Information Service 

 Springfield, VA 22161B0002 

 www.ntis.gov 

 1B800B553B6847 or, locally, 703B605B6000 

A single copy of each NRC draft report for comment is 

available free, to the extent of supply, upon written 

request as follows: 

Address: Office of the Chief Information Officer, 

 Reproduction and Distribution 

 Services Section 

 U.S. Nuclear Regulatory Commission 

 Washington, DC 20555-0001 

E-mail: DISTRIBUTION@nrc.gov 

Facsimile: 301B415B2289 

Some publications in the NUREG series that are 

posted at NRC=s Web site address 

http://www.nrc.gov/reading-rm/doc-collections/nuregs 

are updated periodically and may differ from the last 

printed version. Although references to material found 

on a Web site bear the date the material was accessed, 

the material available on the date cited may 

subsequently be removed from the site. 

Non-NRC Reference Material

Documents available from public and special technical 

libraries include all open literature items, such as 

books, journal articles, and transactions, Federal 

Register notices, Federal and State legislation, and 

congressional reports. Such documents as theses, 

dissertations, foreign reports and translations, and 

non-NRC conference proceedings may be purchased 

from their sponsoring organization. 

Copies of industry codes and standards used in a 

substantive manner in the NRC regulatory process are 

maintained atC

The NRC Technical Library 

Two White Flint North 

11545 Rockville Pike 

Rockville, MD 20852B2738 

These standards are available in the library for 

reference use by the public. Codes and standards are 

usually copyrighted and may be purchased from the 

originating organization or, if they are American 

National Standards, fromC

American National Standards Institute 

11 West 42nd Street 

New York, NY 10036B8002 

www.ansi.org 

Legally binding regulatory requirements are stated only 

in laws; NRC regulations; licenses, including technical 

specifications; or orders, not in 

NUREG-series publications. The views expressed in 

contractor-prepared publications in this series are not 

necessarily those of the NRC. 

The NUREG series comprises (1) technical and 

administrative reports and books prepared by the staff 

(NUREGBXXXX) or agency contractors 

(NUREG/CRBXXXX), (2) proceedings of conferences 

(NUREG/CPBXXXX), (3) reports resulting from 

international agreements (NUREG/IABXXXX), (4) 

brochures (NUREG/BRBXXXX), and (5) compilations of 

legal decisions and orders of the Commission and 

Atomic and Safety Licensing Boards and of Directors=

decisions under Section 2.206 of NRC=s regulations 

(NUREGB0750). 

212B642B4900 

DISCLAIMER: This report was prepared as an account of work sponsored by an agency of the U.S. Government. 

 Neither the U.S. Government nor any agency thereof, nor any employee, makes any warranty, expressed or 

implied, or assumes any legal liability or responsibility for any third party=s use, or the results of such use, of any 

information, apparatus, product, or process disclosed in this publication, or represents that its use by such third 

party would not infringe privately owned rights. 
NUREG/IA-0219

Estimation of Operator Action Time Windows by 

RELAP5/MOD3.3 

Manuscript Completed: October 2008 

Date Published: November 2009 

Prepared by: A. Prošek, B. Mavko, M. Čepin 

Jožef Stefan Institute 

Jamova cesta 39 

SI-1000 Ljubljana, Slovenia 

A. Calvo, NRC Project Manager 

Prepared for:

Division 

Office 

U.S. Nuclear Regulatory Commission 

Washington, DC 20555-0001

iii 

ABSTRACT

This report presents the results of analyses performed for the updated human reliability 

analysis. The analysis estimates time windows available to perform operator action to satisfy the 

success criteria to prevent core damage. The best-estimate RELAP5/MOD3.3 computer code 

was used. In the past, the conventional probabilistic safety assessment used a conservative 

approach to address this factor. However, the current standard for probabilistic safety 

assessment recommends the use of best-estimate codes. The RELAP5/MOD3.3 best-estimate 

code calculations were performed for three selected cases in which human actions supplement 

safety system actuations: (1) small or medium loss-of-coolant accident requiring a manual start 

of the auxiliary feedwater system, (2) loss of normal feedwater requiring a manual start of the 

auxiliary feedwater system, and (3) a loss-of-coolant accident requiring manual actuation of the 

safety injection signal. The analysis used a qualified RELAP5 input model representing a 

Westinghouse-type, two-loop pressurized water reactor for the calculations. The results of the 

deterministic safety analysis were examined to identify the latest time that an operator could act 

and still satisfy the safety criteria. The results show that the time available to perform operator 

action (i.e., the time window) is greater than the actual time needed to perform the action. The 

difference is considered additional available time for action. The results of human reliability 

analysis show that uncertainty analysis of realistic deterministic safety analysis is needed only 

for significant risk contributors in situations where having additional time available for action 

makes the difference between considering or not considering recovery operator action. 

v 

CONTENTS

Page

Abstract ......................................................................................................................................iii

Abbreviations .............................................................................................................................ix

1. Introduction ...........................................................................................................................1

2. Plant description...................................................................................................................3

3. Input Model Description .......................................................................................................5

3.1 Hydrodynamic Component Description.............................................................................5

3.2 Control and Protection Logic.............................................................................................7

4. Safety Analysis Methodology ..............................................................................................9

4.1 Description of Success Criteria .........................................................................................9

4.2 Scenario Descriptions .......................................................................................................9

5. Results .................................................................................................................................11

5.1 Loss-of-Coolant Accident Calculations with Manual Actuation of Auxiliary Feedwater...11

5.1.1 Loss-of-Coolant Spectrum Calculations for Scenarios with High-Pressure Safety 

Injection Not Available.....................................................................................................11

5.1.2 Calculations for a 2.54-cm Break Size Loss-of-Coolant Accident with Different 

Auxiliary Feedwater Delays.............................................................................................16

5.1.3 Calculations for a 2.54-cm Break Size Loss-of-Coolant Accident with Two 

Operator Actions .............................................................................................................20

5.2 Loss of Feedwater Calculations with Manual Actuation of Auxiliary Feedwater .............26

5.3 Calculations of Loss-of-Coolant Accidents with Manual Actuation of Safety Injection ....31

5.4 Probabilistic Safety Assessment Results ........................................................................33

5.4.1 Model Description................................................................................................33

5.4.2 Base Case Results..............................................................................................34

5.4.3 Sensitivity Results of Selected Examples............................................................34

5.5 Results ............................................................................................................................35

6. Run Statistics ......................................................................................................................37

7. Conclusions.........................................................................................................................39

8. References...........................................................................................................................41
vi 

Figures

Page

1. Krško NPP nodalization scheme..............................................................................................6

2. RCS pressure for a spectrum of LOCA break sizes...............................................................12

3. RCS mass inventory for a spectrum of LOCA break sizes.....................................................12

4. Core cladding temperature for a spectrum of LOCA break sizes...........................................13

5. Core collapsed liquid level for a spectrum of LOCA break sizes............................................13

6. Mass discharged through break for a spectrum of LOCA break sizes...................................14

7. SG1 pressure for a spectrum of LOCA break sizes ...............................................................14

8. SG1 wide-range level for a spectrum of LOCA break sizes ...................................................15

9. Mass discharged through SG1 PORV for a spectrum of LOCA break sizes..........................15

10. RCS pressure for 2.54-cm break size LOCA with AFW start delays ....................................16

11. RCS mass inventory for break size 2.54-cm LOCA with AFW start delays ..........................17

12. Core cladding temperature for 2.54-cm break size LOCA with AFW start delays ................17

13. Core collapsed liquid level for 2.54-cm break size LOCA with AFW start delays .................18

14. SG1 pressure for 2.54-cm break size LOCA with AFW start delays.....................................18

15. SG1 wide-range level for 2.54-cm break size LOCA with AFW start delays.........................19

16. Integrated AFW1 flow for 2.54-cm break size LOCA with AFW start delays ........................19

17. Mass discharged through SG1 PORV for 2.54-cm break size LOCA with AFW start delays20

18. RCS pressure for 2.54-cm break size LOCA with manual opening of SG1 PORV...............22

19. RCS mass inventory for 2.54-cm break size LOCA with manual opening of SG1 PORV.....22

20. Core cladding temperature for 2.54-cm break size LOCA with manual opening of SG1 

PORV..........................................................................................................................................23

21. Core collapsed liquid level for 2.54-cm break size LOCA with manual opening of SG1 PORV 

 ..............................................................................................................................................23

22. SG1 pressure for 2.54-cm break size LOCA with manual opening of SG1 PORV ...............24

23. SG1 wide-range level for 2.54-cm break size LOCA with manual opening of SG1 PORV ...24

24. Integrated AFW1 flow for 2.54-cm break size LOCA with manual opening of SG1 PORV...25

25. Mass discharged through SG1 PORV for 2.54-cm break size LOCA with manual opening of 

SG1 PORV ..................................................................................................................................25

26. Pressurizer pressure for LOFW with manual actuation of AFW............................................27

27. RCS mass inventory for LOFW with manual actuation of AFW ............................................28

28. Cladding temperature at 11/12 height of the core for LOFW with manual actuation of AFW....28

29. Integrated HPSI flow for LOFW with manual actuation of AFW............................................29

30. Integrated pressurizer PORVs flow for LOFW with manual actuation of AFW .....................29

31. SG1 pressure for LOFW with manual actuation of AFW.......................................................30

32. SG1 wide-range level for LOFW with manual actuation of AFW ..........................................30

33. Integrated SG1 PORV flow for LOFW with manual actuation of AFW..................................31

34. Pressurizer pressure for LOCA with manual actuation of SI.................................................32

35. Cladding temperature at 11/12 height of the core for LOCA with manual actuation of SI ......32
vii 

Tables

Page

1. Operator Actions Delay ..........................................................................................................21

2. Sequence of Main Events ......................................................................................................26

3. Parameters for Selected Human Errors .................................................................................33

4. Probabilistic Safety Assessment Results If Recovery Action Considered..............................35

5. Probabilistic Safety Assessment Results If Recovery Action Not Considered .......................35

6. Run Statistics .........................................................................................................................37

ix 

ABBREVIATIONS 

AFW auxiliary feedwater 

cm centimeter 

ECCS emergency core cooling system 

HEP human error probability 

HPSI high-pressure safety injection 

HRA human reliability analysis 

in. inch 

LOCA loss-of-coolant accident 

LOFW loss of feedwater 

LPSI low-pressure safety injection 

m meter 

MAAP Modular Accident Analysis Program 

MFW main feedwater 

min minute 

MPa megapascal 

MWt megawatt thermal 

NPP nuclear power plant 

PORV power-operated relief valve 

PSA probabilistic safety assessment 

PWR pressurized-water reactor 

RCP reactor coolant pump 

RCS reactor coolant system 

RY reactor-year 

s second 

SG steam generator 

SI safety injection 

Ta additional available time for action 

Tp actual time needed to perform the action 

Tw time window of the action 

1 

1. INTRODUCTION

To estimate the time windows of operator actions to satisfy the success criteria, i.e. core cooling 

criteria to prevent core damage in level 1 probabilistic safety assessment (PSA), the 

conventional PSA has used the results of a severe accident code such as the MAAP (Modular 

Accident Analysis Program). However, information obtained with such codes is often too 

conservative to permit a realistic PSA for a risk-informed application. Instead, the PSA standard 

(Ref. 1) recommends the use of a best-estimate code to improve the quality of a PSA. 

Therefore, the aim of this study was to estimate the operator action time windows, which 

satisfies the criteria for core cooling, needed for updated human reliability analysis (HRA) by 

using the RELAP5/MOD3.3 Patch 03 best-estimate computer code (Ref. 2). The specified time 

windows are important for HRA to determine the likelihood of operator actions. The human error 

probability of a specified action is lower if operators have more time to act. In the control room of 

a nuclear power plant, a team of operators works under the supervision of a shift supervisor. If 

operators have more time to act, their colleagues or the shift supervisor may have time to 

observe and correct a possible error. Consideration of correction the error (recovery action) 

causes lower human error probability and may result in human error having a different impact 

on the overall PSA results. The actual times needed to perform the action were assessed on the 

basis of simulator scenarios, while the time windows were identified by deterministic safety 

analysis. In this study, RELAP5/MOD3.3 best-estimate code calculations were performed for 

three selected initiating events: (1) establishing auxiliary feedwater (AFW) in case of a small or 

medium loss-of-coolant accident (LOCA), (2) establishing AFW in case of transient (loss of 

feedwater (LOFW) being the most limiting transient), and (3) manually actuating the safety 

injection (SI) signal in a LOCA. In these events, human actions supplement the safety system 

actuations. The qualified RELAP5 input model representing a Westinghouse-type, two-loop 

pressurized water reactor (PWR) was used for the calculations (Ref. 3). 

Section 2 briefly describes the Krško Nuclear Power Plant (NPP). Section 3 describes the 

RELAP5 input model, and Section 4 presents the scenarios. Section 5 shows the 

RELAP5/MOD3.3 calculations, which are the basis for determining the time windows of operator 

actions. Use of these time windows in HRA reveals how a change in human error probability 

can impact the core damage frequency. The run statistics for calculations are given separately 

in Section 6, while conclusions appear in Section 7. 

3 

2. PLANT DESCRIPTION 

Krško NPP is a Westinghouse two-loop PWR plant with a large dry containment. The plant has 

been in commercial operation since 1983. After its modernization in 2000, the plant fuel cycle 

was gradually prolonged from 12 (Cycle 17) to 18 months (Cycle 21). 

The power rating of the Krško NPP nuclear steam supply system is 2,000 megawatt thermal 

(MWt) (1,882 MWt before the plant modernization and power uprate) composed of 1,994 MWt 

(1,876 MWt before the plant modernization and power uprate) core power output plus 6 MWt of 

reactor coolant pump (RCP) heat input. The nuclear steam supply system consists of a PWR, a 

reactor coolant system (RCS), and associated auxiliary fluid systems. The RCS is arranged as 

two closed reactor coolant loops connected in parallel to the reactor vessel, each containing an 

RCP and a steam generator (SG). An electrically heated pressurizer is connected to one of the 

loops. 

The reactor core is composed of 121 fuel assemblies. Square spacer grid assemblies and the 

upper and lower end fitting assemblies support the fuel rods in fuel assemblies. Each fuel 

assembly is composed of 16x16 rods. Of these, fuel rods use only 235 places; of the 

21 remaining places, 20 are evenly and symmetrically distributed throughout the cross-section 

of the assembly and are provided with thimble tubes, which may be reserved for control rods, 

and one control instrumentation tube for an in-core thimble. 

The RCPs, one per coolant loop, are Westinghouse vertical, single-stage, centrifugal pumps of 

the shaft-seal type. 

The SGs, one per loop, are vertical U-tube units of the Siemens-Framatome steam generator 

type SG 72 W/D4-2, installed during the plant modernization in 2000. They replaced highly 

degraded Westinghouse D-4 steam generators, each having preheating section. 

Engineered safety features are provided to prevent accident propagation or to limit the 

consequences of postulated accidents, which might otherwise lead to damage of the system 

and release of fission products. This plant has the following engineered safety features: 

• containment spray system 

• hydrogen control system 

• emergency core cooling system (ECCS) 

• component cooling water system 

• essential service water system 

• AFW system 

In 2006, the main turbine was replaced to gain additional power from the new SGs. 

5 

3. INPUT MODEL DESCRIPTION

To perform this analysis, Krško NPP has provided the base RELAP5 input model (the so-called 

“master input deck”), which has been used for several analyses, including reference 

calculations for the Krško full-scope simulator verification (Refs. 3, 4, 5). Figure 1 presents the 

scheme of the Krško NPP nodalization for the RELAP5/MOD3.3 code. The analyses were 

performed for uprated power conditions (2,000 MWt) with new SG and Cycle 21 settings, 

corresponding to the plant state after outage and refueling in September 2004. 

The model consists of 469 control volumes, 497 junctions, and 378 heat structures with 

2,107 radial mesh points. In addition, 574 control variables and 405 logical conditions (trips) 

represent the instrumentation, regulation isolation, SI and AFW triggering logic, steamline 

isolation, and other functions. 

3.1 Hydrodynamic Component Description

The numbering scheme relates certain RELAP5 hydrodynamic component numbers to certain 

plant systems and components. In the following, XX indicates numbers between 00 and 99: 

• Hydrodynamic components 0XX represent parts of the primary side without the reactor 

vessel and both loops. 

• Hydrodynamic components 1XX represent the reactor vessel.

• Hydrodynamic components 2XX represent Loop 1. 

• Hydrodynamic components 3XX represent Loop 2. 

• Hydrodynamic components 4XX represent the secondary side (SG1 side). 

• Hydrodynamic components 5XX represent the secondary side (SG2 side). 

• Hydrodynamic components 6XX represent the turbine, steam dump, and AFW piping 

from pumps up to the header. 

• Hydrodynamic components 7XX represent ECCS1. 

• Hydrodynamic components 8XX represent ECCS2. 

• Hydrodynamic components 9XX represent the main feedwater (MFW) and AFW pumps, 

refueling water storage tank, condensate storage tank, containment, atmosphere to 

which discharges steam generator relief and safety valves, and cold leg break model. 

Modeling of the primary side without the reactor vessel and both loops includes the pressurizer 

vessel, pressurizer surge line, pressurizer spray lines and valves, two pressurizer poweroperated relief valves (PORVs) and two pressurizer safety valves, chemical and volume control 

system charging and letdown flow, and RCP seal flow. 
6 

151

171

121

111 0605

04030201

115

01

020304

05

06

07

08

175

107

105

103

101

69

656361

201 203 205 207

51

209

53

01 02 03 04 05 06 07

11

10

09

08

55

257

01 02 03 04

259

265 271 273 275 277 279

313

379 377 375 373 371 365

359

357

353

355

01 02 03 04

551

553555

557

559

561

301 303 305 307 309 311

211

253

255

351

906

905

11

10

09

08

0706

05

04

03

02

01

67

901

902

165

131

171

173

0201

719

718

717

715

713 711

801

811 813

815

817

819

818

02 01

02

01

992

991

993

701

Base deck ID:

branchpipetime dependent volume

pumpaccumulatorjunction orientation

crossflow junctiontime dependent junctionvalve

601

603

605

05

04

03

02

01

604

598

271 371

01 02

04

03

05

02

03 04 05

07

06 80 81

0201

03 04

84

82 83

90

91

96

95

88

93

86

92

912 911

913 914

171

727725723

722

721

720

705 805

820

745

743

746 748

749747

872

882

871 881 861

760 860

857

853

851

757

753751

731

732

740

741

831

832

727

582

584

586

588

592

594

951 953

01

08

01

02

02

01

01

0101

01

02

01

01

01

02

01 02

01

141

03

02

01

131125

02

02

01

02

01

01 02

03

01 02

01 01 01 01 01 01 01

01

01

02 01

01

02 01

02

01 01 01 01

01

703

01 01

01

01

01

01

01

01 02

01 01

750

01

01

01

803

01 01

01

01

01

850

01

01

01

02

01

02

01 01

375 377

01 01

01

01

01

01

01 01 01 01 01 01

01

01

01

01

02

0101

02 01

02

01 01 01 01

xxx junction described at branch xxx

915

804 704

612

611

916

03

145

04

03

02

01

131

05

ACC 1 ACC 2

RCP 2 RCP 1

SG 2

RPV

PRZ

charging

letdown

451

453

455

457

459

461

217

215 245

243

219 241

933

223

225

07

06

0504

03

02

01

227

237

08

429

427

423

415

010203040506

411

213 251

0201

413

484

486

488492494

951 953

482

498

03 04 05

01

01

01

01

02

02

01

01

01

0101

01

02

03

01

01

01

02

01

01 01

01

01

01

01

601

SG 1

05

04

030201

417

421

425

419

02 934

443

447

445

01

01

02

01

01

01

315 345

317 343

319 341

935

323

325

07

06

0504

03

02

01

327

337

08

529

527

523

515

511

513

01

01

01

02

02

01

01

01

01

01

01

02

03

01

01

01

02

01

517

521

525

519

02 936

543 545

547

01

01

02

01

01

01

113

01

01

nekCClrv

458 558

01

02

03 04

013

014

01

02

03 04

021

022 028

027

032

01

02 03 04

025 011

01

07 06 05 04

03

02

01

407 409

930

931

01

07 06 05 04

0302

01

507

233

235

01

0102030405060708

333

335

01

010203040506

07

08

121110090807

121110

09

080706

05

04030201

121110090807060504030201

091011

121314

06

153

01

02

01

07

08

09

10

09

08

0706

01

0203040506

07

08

09

10

0908

07

06

05

04030201

509

475

0706

0504030201

406

474

473

0504030201

472

471500

930

931

575

0706

0504030201

506

574

573

04

03

0201

572

571500

939

938

01

02 03

671

672 01 02 03 673 435

941

940

01

02

681

683

01

02

685

686

695

02 01 03

696

687 02

01

697

02

01

943

942

01

02 03

675

676

677

01 02 03 04

535

01 02 03 04 05 06

07 08

10

09

437

11

01

02 03 04 05

08

07

06

537

01

02

03

01

01

01 01

01

02

945

944

947

946

949

948

978

976

974 972

443

543

437 537

MD AFWpump 01

TD AFWpumpMD AFWpump 02

HPIS

LPIS

MFWheader

MFWheader

674

688

678

698

01

607

606

Figure 1 Krško NPP nodalization scheme 
7 

The reactor vessel consists of the lower downcomer, lower head, lower plenum, core inlet, 

reactor core, core baffle bypass, core outlet, upper plenum, upper head, upper downcomer, and 

guide tubes. 

The primary loop is represented by the hot leg, primary side of the SG, intermediate leg with 

cold leg loop seal, and cold leg, separately for Loop 1 (2XX) and Loop 2 (3XX). Loops are 

symmetrical except for the pressurizer surge line and the chemical and volume control system 

connections layout. The primary side of the SG consists of the inlet and outlet plenum, 

tubesheet, and the U-tube bundle represented by a single pipe. 

The secondary side consists of the SG secondary side (riser, separator and separator pool, 

downcomer, steam dome), main steamline, main steam isolation valves, SG relief and safety 

valves, MFW piping, and AFW piping from the header to the SG. The AFW injects above the SG 

riser. The main steamline No. 1 (4XX) has the same volume as the main steamline No. 2 (5XX), 

but the geometry data differ depending on the pipeline. 

Components numbered 6XX represent the AFW piping from AFW pumps to the AFW header. 

ECCS piping includes high-pressure safety injection (HPSI) pumps, accumulators, and 

low-pressure safety injection (LPSI) pumps. The hydrodynamic components representing HPSI 

and LPSI pumps are time-dependent junctions, while for accumulators the ‘accum’ 

hydrodynamic component was used. The ECCS connects to both cold legs and directly to the 

reactor vessel. 

Components 7XX represent Train 1 of the ECCS plus common lines for reactor vessel injection, 

and Components 8XX represent ECCS Train 2. 

Among the components numbered 9XX, the MFW and AFW pumps are modeled as 

time-dependent junctions that pump water from time-dependent volumes, representing those of 

the condensate storage tank. For AFW pumps, recirculation flow is also modeled. The refueling 

water storage tank is modeled with time-dependent volume, similarly to the modeling of 

containment and atmosphere. The break in the cold leg is modeled with two valves, which 

allows the possibility of modeling a double-ended guillotine break. 

3.2 Control and Protection Logic

To accurately represent the Krško NPP behavior, the model includes many control variables 

and general tables. They represent protection, monitoring, and simplified control systems used 

only during steady-state initialization, as well as main plant control systems: 

• rod control system 

• pressurizer pressure control system 

• pressurizer level control system 

• steam generator level control system 

• steam dump 

The rod control system has been modeled for point kinetics. The present model can be used for 

transient analysis with two options: 
8 

(1) with constant or predefined core power transient as a function of time (including decay 

power calculation) 

(2) with the rod control system in auto or manual mode 

The following plant protection systems are defined using trip logic: 

• reactor trip 

• SI signal 

• turbine trip 

• steamline isolation 

• MFW isolation 

• AFW start 
9 

4. SAFETY ANALYSIS METHODOLOGY 

The RELAP5 input model, described in Section 3, was applied to the selected scenarios, which 

were needed to update the HRA. The latest available RELAP5/MOD3.3 Patch 03 was used for 

the calculations. For the selected scenarios, the analysis determined the time windows for 

operator action. This section first describes the success criteria for determination of the time 

windows. Then, the scenario is described for each of the three selected cases in which human 

actions supplement safety system actuations. The selected cases are (1) a small or medium 

LOCA requiring manual AFW start, (2) LOFW requiring a manual AFW start, and (3) a LOCA 

requiring manual actuation of the SI signal. 

4.1 Description of Success Criteria

Safety analyses include variations of the timing of human action to determine the latest time that 

operators can perform the needed action so that the main plant parameters do not exceed their 

limits. The analysis used the core cooling success criteria as defined in Reference 6. The 

success criteria used in level 1 PSA are the quantified definition of core damage. Given a 

certain sequence and plant response to that sequence, we can assess weather the sequence 

involves core damage by comparing with criteria. It is assumed that if the hottest core fuel/clad 

node temperature in the reactor core exceeds 923 kelvin (K) for more than 30 minutes, or if the 

temperature of the core exceeds 1,348 K, core damage may occur, which may lead to an 

accident state. For overpressurization, the criterion is that primary pressure should not exceed 

18.95 megapascals (MPa). Based on these criteria, the analysis determined the time window for 

operator action. 

4.2 Scenario Descriptions

This section describes the three scenarios needed for an updated HRA. In these scenarios, the 

human actions supplement the safety system actuations. In the first scenario, the human action 

is to establish AFW in the case of a small or medium LOCA when the HPSI system fails. In the 

second scenario, the human action is to establish AFW in the case of an LOFW transient. In the 

third scenario, the human action is to actuate the SI signal in the case of the most limiting 

accident, excluding a large-break LOCA (i.e., for a small or medium LOCA). 

The operator actions considered in the analyses are delayed AFW pump manual start, RCP trip 

according to emergency operating procedure (one HPSI pump running and subcooling below 

14 K), and HPSI pump termination according to emergency operating procedure criteria 

(pressurizer pressure above 13.83 MPa, pressurizer level above 10 percent, and subcooling 

greater than 19 K). 

In the case of a small or medium LOCA in a nuclear power plant when the HPSI system fails, 

one means to cool the reactor is through secondary-side depressurization, provided that the 

AFW system is operating. Normally, the AFW system starts automatically when MFW system is 

lost. If the AFW pumps do not start automatically, operators should intervene. The success 

criterion requires operation of one of three AFW pumps to maintain the flow in order to 

depressurize the primary system below the accumulator injection setpoint at 4.9 MPa. The 
10 

analysis assumed that passive accumulators, as well as LPSI, are available. The parameter 

indicating depressurization is primary pressure, and the parameter indicating core cooling is 

average rod cladding temperature. As larger breaks, after some time, can cause 

depressurization (through the break) in any case where the pressure falls below the 

accumulator injection setpoint pressure, AFW system is not needed for depressurization. 

Therefore, the analysis was performed for a spectrum of break sizes from 1.27 centimeters (cm) 

(0.5 inch (in.)) to 15.24 cm (6 in.) to determine for which break sizes operation of one AFW 

pump is needed to depressurize the primary system below the accumulator injection setpoint. 

For the most critical break in terms of depressurization, the analysis determined the time 

available to start the AFW pump based on the parametric study of varying delays of the AFW 

pump start. The break was located in the cold leg between the RCP and the reactor vessel. 

The most limiting transient requiring operation of the AFW system is LOFW. The success 

criterion is that the capacity of one train of AFW is adequate to remove decay heat, to prevent 

overpressurization of the primary system, and to prevent the uncovering of the core from 

resulting in core heatup. The analysis varied the time when the operator succeeds in starting 

the AFW pump. When the AFW pump starts to inject into the secondary side, cooling of the 

secondary side causes the pressurizer pressure to drop below the pressurizer PORV closure 

setpoint and then below the maximum pressure capacity of the HPSI pump. The HPSI injection 

efficiently prevents further uncovering of the core. 

The third scenario considered was a LOCA without automatic SI signal actuation. This means 

that none of the safety systems, including HPSI, LPSI, and AFW, was assumed to be available. 

The analysis evaluated the whole spectrum of LOCAs, from a break size of 1.91 cm (0.75 in.) to 

15.24 cm (6 in.). 
11 

5. RESULTS

5.1 Loss-of-Coolant Accident Calculations with Manual Actuation of Auxiliary 

Feedwater

5.1.1 Loss-of-Coolant Spectrum Calculations for Scenarios with High-Pressure Safety 

Injection Not Available 

Figures 2 through 9 show the results for a spectrum of break sizes. As Figure 2 shows, breaks 

of 5.08 cm (2 in.) and larger depressurize (through the break), after some time, when the 

pressure falls below the accumulator injection setpoint pressure of 4.93 MPa. In this case, AFW 

system is not needed for depressurization, as evidenced by the SG1 wide-range level shown in 

Figure 8 and the mass released through the SG PORVs shown in Figure 9. After the initial 

decrease in level and the opening of the SG PORVs, the SG1 pressure shown in Figure 7 drops 

below the opening setpoints of the SG PORVs. Therefore, SG1 is not further emptied. The 

trends for SG2 pressure and wide-range level are similar to those for SG1 and are therefore not 

shown. On the other hand, breaks of 2.54 cm (1 in.) equivalent in diameter and smaller require 

depressurization. Because core heatup (Figure 4) occurs earlier for the 2.54-cm (1-in.) break 

than for the 1.91-cm (0.75–in.) and 1.27-cm (0.5–in.) break, the 2.54-cm (1-in.) break was 

identified as the most critical regarding the time available to start AFW pump. Figure 3, which 

shows RCS mass inventory, and Figure 8, which shows the SG1 wide-range level, confirm this 

finding. In the case of the 1.91-cm (0.75-in.) and 1.27-cm (0.5-in.) break, the RCS even 

repressurizes. However, the operator has more time before the RCS inventory is depleted, the 

SGs are dried, and the core is uncovered and heated up. Figure 8 shows that for a break of 

2.54 cm (1 in.) (and smaller), the SGs begin to dry out and their inventory is lost through the SG 

PORVs (Figure 9). To establish cooling by the secondary side, AFW system is needed to fill the 

SG. 
12 

0

4

8

12

16

0 2500 5000 7500 10000

Time (s)

Pressure (MPa)

1.27 cm (0.5")

1.91 cm (0.75")

2.54 cm (1")

5.08 cm (2")

7.62 cm (3")

15.24 cm (6")

Figure 2 RCS pressure for a spectrum of LOCA break sizes 

0

40

80

120

160

0 2500 5000 7500 10000

Time (s)

Mass (ton)

1.27 cm (0.5")

1.91 cm (0.75")

2.54 cm (1")

5.08 cm (2")

7.62 cm (3")

15.24 cm (6")

Figure 3 RCS mass inventory for a spectrum of LOCA break sizes 
13 

0

500

1000

1500

2000

0 2500 5000 7500 10000

Time (s)

Temperature (K)

1.27 cm (0.5")

1.91 cm (0.75")

2.54 cm (1")

5.08 cm (2")

7.62 cm (3")

15.24 cm (6")

1348 K

Figure 4 Core cladding temperature for a spectrum of LOCA break sizes 

0

1

2

3

4

0 2500 5000 7500 10000

Time (s)

Level (m)

1.27 cm (0.5")

1.91 cm (0.75")

2.54 cm (1")

5.08 cm (2")

7.62 cm (3")

15.24 cm (6")

Figure 5 Core collapsed liquid level for a spectrum of LOCA break sizes 
14 

0

200

400

600

800

1000

0 2500 5000 7500 10000

Time (s)

Mass (ton)

1.27 cm (0.5")

1.91 cm (0.75")

2.54 cm (1")

5.08 cm (2")

7.62 cm (3")

15.24 cm (6")

Figure 6 Mass discharged through break for a spectrum of LOCA break sizes 

0

2

4

6

8

0 2500 5000 7500 10000

Time (s)

Pressure (MPa)

1.27 cm (0.5")

1.91 cm (0.75")

2.54 cm (1")

5.08 cm (2")

7.62 cm (3")

15.24 cm (6")

Figure 7 SG1 pressure for a spectrum of LOCA break sizes 
15 

0

20

40

60

80

100

0 2500 5000 7500 10000

Time (s)

Level (%)

1.27 cm (0.5")

1.91 cm (0.75")

2.54 cm (1")

5.08 cm (2")

7.62 cm (3")

15.24 cm (6")

Figure 8 SG1 wide-range level for a spectrum of LOCA break sizes 

0

10

20

30

40

50

0 2500 5000 7500 10000

Time (s)

Mass (ton)

1.27 cm (0.5")

1.91 cm (0.75")

2.54 cm (1")

5.08 cm (2")

7.62 cm (3")

15.24 cm (6")

Figure 9 Mass discharged through SG1 PORV for a spectrum of LOCA break sizes 
16 

5.1.2 Calculations for a 2.54-cm Break Size Loss-of-Coolant Accident with Different 

Auxiliary Feedwater Delays 

To determine the time window available to the operators to start AFW pump, five different 

scenarios were analyzed for a 2.54-cm (1-in.) break using different delays for the AFW pump 

start, as shown in Figures 10 through 17. Figure 10 shows that once AFW pump starts, the RCS 

cannot be depressurized. The RCS mass continuously decreases (Figure 11), and therefore the 

core begins to heat up (Figure 12) as it is uncovered (Figure 13). The secondary pressure 

(Figure 14) is such that the SG PORV is cycling, as can be seen from the stepwise line for mass 

released through the SG1 PORV (Figure 17). Until the AFW pump is started, the SG1 

wide-range level decreases (Figure 15). However, the capacity of the AFW system (Figure 16) 

is sufficient to recover the SG level. After the steam generator level is recovered, the AFW 

pump injected intermittently to recover the mass lost through SG PORV cycling, but the cooling 

with SG PORV cycling is not sufficient to depressurize the primary system and prevent core 

heatup. To speed up the cooling by the secondary side, more steam should be released 

through the SG PORV. This can be achieved by manually fully opening the SG PORV, which is 

explained in the next section. 

0

4

8

12

16

0 2500 5000 7500 10000

Time (s)

Pressure (MPa)

0 min. 20 min.

25 min. 30 min.

35 min.

Figure 10 RCS pressure for 2.54-cm break size LOCA with AFW start delays 
17 

0

40

80

120

160

0 2500 5000 7500 10000

Time (s)

Mass (ton)

0 min. 20 min.

25 min. 30 min.

35 min.

Figure 11 RCS mass inventory for break size 2.54-cm LOCA with AFW start delays 

0

500

1000

1500

2000

0 2500 5000 7500 10000

Time (s)

Temperature (K)

0 min. 20 min.

25 min. 30 min.

35 min.

1348 K

Figure 12 Core cladding temperature for 2.54-cm break size LOCA with AFW start delays 
18 

0

1

2

3

4

0 2500 5000 7500 10000

Time (s)

Level (m)

0 min. 20 min.

25 min. 30 min.

35 min.

Figure 13 Core collapsed liquid level for 2.54-cm break size LOCA with AFW start delays 

0

2

4

6

8

0 2500 5000 7500 10000

Time (s)

Pressure (MPa)

0 min. 20 min.

25 min. 30 min.

35 min.

Figure 14 SG1 pressure for 2.54-cm break size LOCA with AFW start delays 
19 

0

20

40

60

80

100

0 2500 5000 7500 10000

Time (s)

Level (%)

0 min. 20 min.

25 min. 30 min.

35 min.

Figure 15 SG1 wide-range level for 2.54-cm break size LOCA with AFW start delays 

0

10

20

30

40

50

0 2500 5000 7500 10000

Time (s)

Mass (ton)

0 min. 20 min.

25 min. 30 min.

35 min.

Figure 16 Integrated AFW1 flow for 2.54-cm break size LOCA with AFW start delays 
20 

0

10

20

30

40

50

0 2500 5000 7500 10000

Time (s)

Mass (ton)

0 min. 20 min.

25 min. 30 min.

35 min.

Figure 17 Mass discharged through SG1 PORV for 2.54-cm break size LOCA with AFW 

start delays 

5.1.3 Calculations for a 2.54-cm Break Size Loss-of-Coolant Accident with Two Operator 

Actions 

To determine the time window available to the operators to start AFW and open the SG PORV, 

different scenarios were analyzed for a 2.54-cm (1 in.) break, as shown in Table 1. Namely, the 

capacity of the AFW system is such that it fills the SG when the SG PORV is operated 

automatically and AFW injection is terminated. In such cases, the cooling (RCS 

depressurization) would be faster with the SG PORV fully opened manually to enable bleeding 

by the SG PORV and feeding by the AFW system. Figures 18 through 25 show that RCS 

depressurization with the SG PORV fully open is efficient in preventing core heatup, provided 

that the AFW pump maintains sufficient SG inventory. As shown in Figures 18 to 25 for Case A, 

immediate depressurization of the RCS with one SG PORV, without the AFW pump operating, 

results in emptying of the SG in 40 minutes. This means that the time delay for starting the AFW 

system upon manual opening of the SG PORV may be less then 40 minutes. The SG PORVs 

operate automatically in all cases. In Cases B through E, the SG level drops approximately 

linearly and cooling is sufficient as long as the SG is not emptied. This means that SG PORV 

must be opened before the SG is not completely emptied. In Cases A and F, the 

depressurization occurs in the already empty SG, and the core heatup is therefore unavoidable. 

Figure 18 shows that the RCS is depressurized below accumulator injection in approximately 

10 minutes after the SG PORV is manually opened. When accumulators start to inject, the RCS 

mass inventory recovers as shown in Figure 19; therefore the core is not uncovered as shown in 
21 

Figure 21, and core heatup is prevented (Figure 20). Figure 22 shows the SG1 pressure, which 

drops immediately because of the manual opening of the SG1 PORV. At the time of 

depressurization, the AFW pump No.1 starts to inject and the SG1 wide-range level starts to 

increase, as shown in Figure 23. Filling the empty SG with the SG PORV open takes almost 

1 hour. Figure 24 shows the mass injected by the AFW system into SG1, while the other SG 

has no injection and stops emptying when the SG1 PORV is manually opened. Until that time, 

the trend is similar to the SG1 wide-range level. 

Table 1 Operator Actions Delay 

Case Operator Action 

 SG PORV full 

opening delay (min) 

AFW start delay (min) 

A 0 Not available 

B 30 30 

C 50 50 

D 80 80 

E 100 100 

F 120 120 

In Case E, the heatup is very small, while in Case F, the temperature criterion is exceeded. The 

above results indicate that the operators have 100 minutes available to perform RCS 

depressurization. For the selected plant, the preferred path for RCS depressurization is SG 

steam dump valves and then SG PORVs. It is necessary to prevent loss of SG inventory by 

establishing AFW flow. The analysis shows that for RCS depressurization, manual operation of 

SG PORVs is needed in addition to automatic PORV operation. This also follows the severe 

accident management guidelines for the selected plant. 

Operator experience with plant simulators shows that the actual time needed to perform the 

action is 1 to 10 minutes. Thus, the additional time available to perform the action is 90 to 

99 minutes (i.e., the success criteria time minus the actual time to perform the event), which 

gives enough time for possible recovery action. 
22 

0

4

8

12

16

0 2500 5000 7500 10000

Time (s)

Pressure (MPa)

A B

C D

E F

Figure 18 RCS pressure for 2.54-cm break size LOCA with manual opening of SG1 PORV 

0

30

60

90

120

150

0 2500 5000 7500 10000

Time (s)

Mass (ton)

A B

C D

E F

Figure 19 RCS mass inventory for 2.54-cm break size LOCA with manual opening of SG1 

PORV 
23 

0

500

1000

1500

2000

0 2500 5000 7500 10000

Time (s)

Temperature (K)

A B

C D

E F

1348 K

Figure 20 Core cladding temperature for 2.54-cm break size LOCA with manual opening 

of SG1 PORV 

0

1

2

3

4

0 2000 4000 6000 8000 10000

Time (s)

Level (m)

A B

C D

E F

Figure 21 Core collapsed liquid level for 2.54-cm break size LOCA with manual opening 

of SG1 PORV 
24 

0

2

4

6

8

0 2000 4000 6000 8000 10000

Time (s)

Pressure (MPa)

A B

C D

E F

Figure 22 SG1 pressure for 2.54-cm break size LOCA with manual opening of SG1 PORV 

0

20

40

60

80

100

0 2500 5000 7500 10000

Time (s)

Level (%)

A B

C D

E F

Figure 23 SG1 wide-range level for 2.54-cm break size LOCA with manual opening of 

SG1 PORV 
25 

0

20

40

60

80

100

120

0 2000 4000 6000 8000 10000

Time (s)

Mass (ton)

A B

C D

E F

Figure 24 Integrated AFW1 flow for 2.54-cm break size LOCA with manual opening of 

SG1 PORV 

0

20

40

60

80

100

120

0 2000 4000 6000 8000 10000

Time (s)

Mass (ton)

A B

C D

E F

Figure 25 Mass discharged through SG1 PORV for 2.54-cm break size LOCA with 

manual opening of SG1 PORV 
26 

5.2 Loss of Feedwater Calculations with Manual Actuation of Auxiliary 

Feedwater

Table 2 and Figures 26 through 33 show the main results of LOFW calculations with manual 

actuation of the AFW system. Table 2 shows the sequence of main events. The focus of the 

calculations was to define the maximum time window for manually starting the AFW pump. The 

transient begins with the loss of MFW at time 0. Because of the loss of heat sink, the RCS 

average temperature starts to increase at 20 seconds and actuates the steam dump at 

30 seconds. At 53 seconds, the reactor trips on the low-low SG level, which causes turbine trip. 

The RCS temperature drops to no-load value. When the AFW manual start is delayed 

20 minutes, the SI signal is generated because of the low steamline pressure. The reason for 

low steamline pressure is that the SGs are almost empty after 10 minutes, which reduces the 

removal of stored and decay heat. Therefore, at 594 seconds, the RCS average temperature 

begins to increase, thus modulating open the steam dump valves. Because of the increased 

steam dump flow, the secondary-side pressure starts to decrease, which results in the 

generation of an SI signal because of low steamline pressure. The SI signal causes normal 

charging and letdown isolation and main steamline isolation. Because of main steamline 

isolation, the steam dump is lost. The HPSI pump starts to run upon generation of the SI signal. 

However, because of the high primary pressure, the HPSI pumps do not inject before the AFW 

pump starts, which very quickly enables cooling by the SG PORVs. The HPSI pumps are very 

efficient in recovering the RCS mass and pressure; therefore, they are stopped when the SI 

termination criteria are met. The RCPs are tripped when subcooling is lost, and with the HPSI 

pumps running, the criterion for tripping RCPs is fulfilled. 

Table 2 Sequence of Main Events 

Event Time (s) 

Analyzed cases (AFW delay) 20 min 30 min 40 min 50 min 60 min 70 min 

MFW closure 0.1 0.1 0.1 0.1 0.1 0.1 

Reactor trip signal generation 52.9 52.9 52.9 52.9 52.9 52.9 

Turbine trip 52.9 52.9 52.9 52.9 52.9 52.9 

Steam dump discharge 30–617 30–617 30–617 30–617 30–617 30–617 

SI signal generation 616.9 616.9 616.9 616.9 616.9 616.9 

Letdown isolation 617.0 617.0 617.0 617.0 617.0 617.0 

Steamline 1 and 2 isolation 617.0 617.0 617.0 617.0 617.0 617.0 

RCP1 and 2 trip NA 1587.2 1587.2 1587.2 1587.2 1587.2 

AFW1 start (by assumption) 1205 1805 2405 3005 3605 4205 

SG PORV first discharge 1275 1855 2460 3060 3660 4260 

HPSI pump injection start NA 2020 2560 3010 3630 4300 

HPSI termination NA 2450 4585 5594 6512 7372 

Figures 26 through 33 show the important plant and safety variables that are factors in 

determining the time window. Parametric analyses were performed to get information how 

influences the delayed manual start of the AFW No. 1 pump on satisfying acceptance criteria 

described in Section 4.1. 
27 

Figure 26 shows that the RCS is not overpressurized. When one AFW pump starts to inject into 

the secondary side, cooling of the secondary side causes the pressurizer pressure to drop 

below the pressurizer PORV closure setpoint and then below the maximum pressure capacity of 

the HPSI pump. Figure 27 shows the RCS mass inventory. Depletion occurs because of the 

pressurizer PORV discharge, but HPSI pump injection efficiently recovers the RCS mass. When 

the RCS mass is depleted to approximately one-third, the core starts to heat up, as shown in 

Figure 28. The parametric analysis shows that the core heats up significantly when the AFW 

pump start is delayed more than 50 minutes. Figure 29 shows that the HPSI injected mass into 

the RCS, which is approximately balanced with the mass discharged through the pressurizer 

PORVs shown in Figure 30. The operator terminates SI when the criteria are met. Figures 31 

through 33 show the secondary-side parameters for SG1, into which AFW is injected. Figure 31 

shows the SG1 pressure. At turbine trip, the pressure initially increases and then starts to slowly 

drop during steam dump operation. On SI signal generation at 617 seconds, the pressure again 

increases to the SG1 PORV setpoint and then oscillates because of SG1 PORV cycling until the 

flow of AFW is started. Figure 32 shows the SG1 wide-range level. The level starts to increase 

when the AFW flow is established. Figure 33 shows the mass released in the SG1 PORV 

cycling. 

The maximum available time to start the AFW pump according to the success criteria is 

60 minutes. When action is taken faster, benefits are evident. Based on simulator experience 

(Ref. 7), the operator needs from 1 to 10 minutes to start the AFW system. 

6

8

10

12

14

16

18

0 2000 4000 6000 8000 10000

Time (s)

Pressure (MPa)

20 min.

30 min.

40 min.

50 min.

60 min.

70 min.

delayed AFW pump 

Figure 26 Pressurizer pressure for LOFW with manual actuation of AFW 
28 

0

40

80

120

160

0 2000 4000 6000 8000 10000

Time (s)

Mass (t)

20 min.

30 min.

40 min.

50 min.

60 min.

70 min.

HPSI pumps injection 

Figure 27 RCS mass inventory for LOFW with manual actuation of AFW 

400

800

1200

1600

0 2000 4000 6000 8000 10000

Time [s]

Temperature (K)

20 min.

30 min.

40 min.

50 min.

60 min.

70 min.

1348 K

Figure 28 Cladding temperature at 11/12 height of the core for LOFW 

with manual actuation of AFW 
29 

0

20

40

60

80

100

120

0 2000 4000 6000 8000 10000

Time (s)

Mass (t)

20 min.

30 min.

40 min.

50 min.

60 min.

70 min.

Figure 29 Integrated HPSI flow for LOFW with manual actuation of AFW 

0

20

40

60

80

100

120

0 2000 4000 6000 8000 10000

Time (s)

Mass (t) 

20 min.

30 min.

40 min.

50 min.

60 min.

70 min.

Figure 30 Integrated pressurizer PORVs flow for LOFW with manual actuation of AFW 
30 

0

2

4

6

8

10

0 2000 4000 6000 8000 10000

Time (s)

Pressure (MPa)

20 min.

30 min.

40 min.

50 min.

60 min.

70 min.

SI signal generation

Figure 31 SG1 pressure for LOFW with manual actuation of AFW 

0

20

40

60

80

100

0 2000 4000 6000 8000 10000

Time (s)

Level (%)

20 min.

30 min.

40 min.

50 min.

60 min.

70 min.

Figure 32 SG1 wide-range level for LOFW with manual actuation of AFW 
31 

0

20

40

60

80

100

0 2000 4000 6000 8000 10000

Time (s)

Mass (t) 

20 min.

30 min.

40 min.

50 min.

60 min.

70 min.

Figure 33 Integrated SG1 PORV flow for LOFW with manual actuation of AFW 

5.3 Calculations of Loss-of-Coolant Accidents with Manual Actuation of Safety 

Injection

Figures 34 and 35 show the results of LOCA calculations with manual actuation of SI. At breaks 

smaller than 5.08 cm, the RCS was not sufficiently depressurized (Figure 34) to enable 

accumulator injection, while larger breaks depressurize the RCS. Figure 35 shows that the 

temperature criterion 1,348 K is first exceeded for a break of 15.24 cm (Case 6′′), then for a 

break of 10.16 cm (Case 4′′), 7.62 cm (Case 3′′), 1.91 cm (Case 0.75′′), and finally for 5.08 cm 

(Case 2′′). This is because for the 5.08-cm (2-in.) break, the accumulators are sufficient to cool 

the core until they are empty. For breaks larger than 5.08 cm (2 in.), the core begins to 

significantly heat up after the accumulators empty. In general, the larger the break, the faster 

the core uncovers. For the 15.24-cm (6-in.) break, the core starts to heat up at 20 minutes. For 

the 5.08-cm (2-in.) break, the core cladding temperature could exceed the criterion at first peak, 

if uncertainty is considered. When the SI signal is actuated 20 minutes, further core heatup is 

prevented (Case 6′′ SI). This is also true in the case of the 5.08-cm break (Case 2′′ SI). 

Therefore, at least 20 minutes are available for operator action. In this scenario, the treatment of 

uncertainty is unnecessary because the time window is the shortest for the largest break in the 

spectrum. 
32 

0

4

8

12

16

0 2500 5000 7500 10000

Time (s)

Pressure (MPa)

0.75" 1"

2" 3"

4" 6"

2" SI 6" SI

Figure 34 Pressurizer pressure for LOCA with manual actuation of SI 

0

400

800

1200

1600

2000

0 2500 5000 7500 10000

Time (s)

Temperature (K)

0.75" 1"

2" 3"

4" 6"

2" SI 6" SI 1348 K

Figure 35 Cladding temperature at 11/12 height of the core for LOCA with 

manual actuation of SI 
33 

5.4 Probabilistic Safety Assessment Results

Institut “Jožef Stefan” – HRA (IJS-HRA) method (Refs. 8, 9) assumes that if the difference 

between the time window in which the action has to be performed and the actual time needed to 

perform the action is 10 minutes or more, a recovery can be modeled for the investigated action. 

If the additional available time for action is shorter than the determined time interval, recovery is 

not considered. 

Additional available time for action (Ta) is defined as the difference between the time window of 

the action (Tw) and the actual time needed to perform the action (Tp), which is assessed based 

on real simulator scenarios: 

Ta = Tw - Tp. 

The time window of the human action actually represents the success criteria for the action. It 

represents the time interval in which operators must perform the action so that the plant can be 

put in a safer state (i.e., the plant is put into a scenario that leads to a safe state and not to an 

accident state). The actual time needed to perform the action is the realistic time required for an 

operator to perform the action, which can be obtained from simulator experience. 

The specified time windows are important for HRA because the human error probability (HEP) 

of a certain operator action is lower if operators have more time available. In the control room of 

an NPP a team of operators works under the direction of a shift supervisor. If operators have 

10 or more minutes of additional time for action, it can be expected that colleagues or the shift 

supervisor can observe and correct a possible error. Consideration of recovery causes lower 

HEP and may result in a different impact of human error on the overall PSA results. 

5.4.1 Model Description 

The PSA model of an NPP is named as HRA_IH_1 and is used for quantification. The 

characteristics of HRA_IH_1 show that it is a large and detailed model, which includes 

4,748 gates; 1,810 basic events; 16 initiating events and main event trees; 738 fault trees, 

which include 125 human failure fault trees; 57 parameters (failure rate); 418 parameters 

(probability), which include 55 parameters connected with HEP (those 55 parameters are 

obtained from 18 different basic HEP parameters, which are expanded to 55 parameters 

considering different performance shaping factors for basic HEP parameters); 18 groups for 

parameters of human errors; and 117 groups for human error basic events. Table 3 shows 

parameters for selected human actions, which are needed for the decision to consider recovery 

when quantification of HEP is made. 

Table 3 Parameters for Selected Human Errors 

Human Error Tw (min) Tp (min) Ta=Tw-Tp (min)

Manual actuation of AFW at LOCA 100 1–10 90–99 

Manual actuation of AFW at LOFW 60 1–10 50–59 

Manual actuation of SI at LOCA 20 2 18 
34 

5.4.2 Base Case Results 

The results of the PSA include many parameters. Only selected results are mentioned below for 

the analysis with the following features: 

• consideration of internal initiating events 

• third-order approximation 

 

• truncation of 2.7x10-11/reactor-year (RY) (Ref. 10) 

• consideration of recovery for all selected human actions, because additional available 

time for action (i.e., the difference between the time in which operators must perform the 

action so that it meets the success criteria and the actual time needed to perform the 

action) is more than the determined time interval (e.g., 10 minutes) 

The results include the following: 

 

• Core damage frequency of 2.487x10-5/RY. 

• No minimal cut set includes manual actuation of AFW during a LOCA. A minimal cut set 

is a combination of basic events (i.e., component failures, human errors) that may cause 

an undesired state of the system (e.g., an accident state). This means that manual 

actuation of AFW during a LOCA is not a safety-significant event as it is not involved in 

any combination of undesired events. 

• Minimal cut set No. 4 (ranked by contribution to core damage frequency) contributes to 

core damage frequency by 7.136x10-7/RY. It is the highest contributing minimal cut set of 

those that involve manual actuation of AFW during transients. This means that manual 

actuation of AFW during transients is a very safety-significant event. 

• Minimal cut set No. 1358 (ranked by contribution to core damage frequency) contributes 

to core damage frequency by 1.088x10-9/RY. This is the highest contributing minimal cut 

set of those that involve manual actuation of SI during LOCAs. This means that manual 

actuation of SI during LOCAs is not a very safety-significant event. 

• Table 4 presents risk importance factors (i.e., the fractional contribution of considered 

human errors). The table shows that manual actuation of AFW during LOFW contributes 

significantly to the core damage frequency, as indicated by the high fractional 

contribution. The manual actuation of AFW in case of LOCA is not in the list of minimal 

cut sets, so the risk importance factor cannot be calculated (the event is of no safety 

significance). 

5.4.3 Sensitivity Results of Selected Examples 

Sensitivity analysis is performed for each of the selected example actions for a case if recovery 

would not be considered in the quantification of HEP (i.e., if additional available time for action 
35 

would be less than the determined time interval). Table 5 shows the results for selected human 

errors without consideration of recovery. 

Results show that consideration of recovery has a significant impact on the HEP. This is evident 

from a comparison of basic HEPs in Table 4 (in which recovery is considered) and Table 5 (in 

which recovery is not considered). The change of HEP can significantly impact the core damage 

frequency and thus the plant risk, if the affected human error is an important contributor to risk, 

as is the case with manual actuation of AFW in case of transients. For an important human 

error, it is necessary to determine additional time for action accurately as this may have a 

significant impact on the assessment of risk. 

A comparison of results in Table 4 and Table 5 shows that consideration of recovery leads to a 

significant change in risk results. For manual actuation of AFW in a LOCA, the change is 

insignificant, which is expected as the event is not risk important and thus its changes do not 

significantly affect the results. For manual actuation of AFW during transients (LOFW), this 

change is significant, as it nearly doubles the core damage frequency and thus the level of risk. 

For manual actuation of SI in case of a LOCA, the change in risk results is also insignificant. 

Table 4 Probabilistic Safety Assessment Results If Recovery Action Considered 

Human Error Basic HEP Fractional 

Contribution 

Core Damage 

Frequency 

Main Minimal Cut Set 

and Its Contribution 

Manual actuation of 

AFW in LOCA 2.31x10-4 N/A 2.487x10-5 /RY - - 

Manual actuation of 

AFW in LOFW 2.31x10-4 6.93x10-2 2.487x10-5 /RY 4 7.136x10-7 /RY 

Manual actuation of 

SI in LOCA 3.99x10-5 3.01x10-4 2.487x10-5 /RY 1358 1.088x10-9 /RY 

Table 5 Probabilistic Safety Assessment Results If Recovery Action Not Considered 

Human Error 

Basic HEP Fractional 

Contribution

Core Damage 

Frequency 

Main Minimal Cut Set 

and Its Contribution 

Manual actuation of 

AFW in LOCA 2.85x10-3 7.71x10-4 2.494x10-5/RY 7875 8.424x10-11 /RY 

Manual actuation of 

AFW in LOFW 2.85x10-3 4.80x10-1 4.448x10-5/RY 1 8.810x10-6 /RY 

Manual actuation of 

SI in LOCA 4.92x10-3 3.91x10-3 2.496x10-5/RY 190 1.343x10-8 [/RY] 

5.5 Results

The times needed for operators to perform actions were determined on the basis of simulator 

experience (Ref. 7). To start the AFW system, the operator needs from 1 to 10 minutes, while SI 

signal actuation requires 2 minutes. When the time window is large, much additional time is 

available, and the time window does not need to be determined very accurately, even if the 

human factor event is an important contributor to the risk. For example, the time needed to start 
36 

the SI signal is 2 minutes, so operators have an additional 18 minutes to perform this action. 

Considering uncertainties in peak cladding temperatures of 200 K based on previous 

uncertainty evaluations (Ref. 11) and the adiabatic heatup rate for a 15.24-cm (6-in.) break, the 

criterion would be reached 3 minutes earlier than in case with not considering uncertainties. 

Equally important is the uncertainty in the time of reaching maximum temperature, which is 

approximately 2 minutes (Ref. 12). Even considering the uncertainties, the time window is 

sufficient. 

In the case of small- and medium-break LOCAs with the assumption that HPSI is not available, 

depressurization is needed for breaks smaller than 5.08 cm (2 in.). The 5.08-cm (2-in.) break is 

limiting, as for this and larger breaks, the RCS depressurizes by itself. However, when the 

pressure drops below the accumulator injection point, the core is already heated up in the case 

of a 5.08-cm (2-in.) break. Considering the typical cladding temperature uncertainty of the best 

estimate calculation to be 200 K (Ref. 11), the criterion 1,348 K could be exceeded. The 

possibility of recovery action would then be questionable because of the short time window. The 

uncertainty analysis is not necessary, as the contribution of this event to plant risk is 

insignificant. 

Establishing AFW at an LOFW event is a significant contributor to the risk, but the calculated 

time window gives sufficient additional time, even if the HRA uses a conservative time window. 

For the case of a LOCA with delayed SI signal actuation, the analysis shows that the additional 

time available is sufficient. Therefore, uncertainty analysis is not needed even though the event 

is a contributor to risk. 

All these examples show that uncertainty analysis is not needed, because additional time is 

available and/or the event is not a significant contributor to risk, as determined by the PSA. This 

finding indicates that uncertainty analysis may be valuable only for significant risk contributors 

when additional available time is close to the time interval (e.g., 10 minutes) after which 

recovery would not be considered. For the selected examples, this is not the case. When the 

additional available time is not so close to the time after which recovery is not considered, the 

uncertainty of an operator’s action can be estimated in the PSA work scope by considering 

conservative time windows as proposed in Reference 13. 
37 

6. RUN STATISTICS

The scenarios were calculated on a Hewlett-Packard personal computer with Intel Core 2 Quad 

at 2.40 gigahertz under Microsoft Windows XP, Professional Version 2002, Service Pack 3. 

Table 6 shows the run statistics. For all calculations, the number of volumes was 469. In most 

cases, the calculations run faster than real time. The exception are the 2′′ calculations, where 

the reactor kinetics time step was reduced below the minimum value, and thus the time step 

was set to small value. Steady-state calculations for all runs lasted 1,000 seconds and required 

307.4 seconds of CPU and 32,531 steps. Compared to RELAP5/MOD3.3 steady-state 

calculations made in 2005 on a SUN FIRE V880 server (with four UltraSPARC III 

750-megahertz processors, with 16 gigabytes main RAM, running under the SOLARIS 9 

operating system) and requiring 1669.9 seconds, the current calculations ran more than five 

times faster. 

Table 6 Run Statistics 

Calculated Case 

CPU 

Time 

(s) 

Transient 

Time 

(s) 

CPU/Transient 

Time 

Number of Time 

Steps 

 LOCA calculations with manual actuation of manual AFW 

A 1214.2 7840* 0.15 111965 

B 2192.8 10000 0.22 261194 

C 1826.4 10000 0.18 240354 

D 1294.0 10000 0.13 214544 

E 990.4 10000 0.10 197818 

F 691.7 10000 0.07 180859 

 LOFW calculations with manual actuation of AFW 

20 min 3541.0 10000 0.35 323210 

30 min 2274.4 10000 0.23 264772 

40 min 3299.6 10000 0.33 283196 

50 min 3182.7 10000 0.32 310860 

60 min 4683.4 10000 0.47 456030 

70 min 3331.3 10000 0.33 309882 

 LOCA calculations with manual actuation of SI 

0.75" 1645.0 10000 0.16 169956 

1" 1014.9 8276* 0.12 125794 

2" 24422.3 10000 2.44 2333657 

3" 3328.4 5884* 0.57 330534 

4" 2522.1 3813* 0.66 264064 

6" 1763.0 2532* 0.70 213871 

2" SI 64653.6 10000 6.47 6153483 

6" SI 5997.3 10000 0.60 625187 

* Calculation with clad temperature exceeding criterion 

39 

7. CONCLUSIONS

In this study, deterministic safety analyses with RELAP5/MOD3.3 Patch 03 computer code were 

performed as a support to the HRA. Safety analyses were needed to determine the time 

parameters, which were inputs for the HRA within the probabilistic safety assessment. The 

deterministic analyses and results were presented on selected realistic examples representative 

of typical situations. The results of HRA show that consideration of recovery has a significant 

impact on human error probability. Changes in HEP can significantly impact the core damage 

frequency if the affected human error is an important contributor to risk, as it is in one of the 

three example actions. For important human errors, it is necessary to determine the additional 

time for action accurately, as this may have a major effect on the assessment of risk. As implied 

by the HRA, the less time available, the more probable human error becomes. 

This study also shows that uncertainty evaluation of the best-estimate calculation is not needed 

in the cases presented, even though one event is a significant contributor to the risk, because 

the available time is much greater than the time needed to perform the operator action. 

For the LOCA case with manual AFW start, the evaluation of uncertainties would significantly 

change the time window. The reason is that a larger break size is critical, as it implies faster 

evolution of the transient and less time for the operator to act. The uncertainty analysis is not 

needed for the HRA, as the contribution of this event to plant risk is insignificant. 

The results suggest that uncertainty analysis of realistic deterministic safety analysis in support 

of HRA may be needed only for significant risk contributors, when the additional available time 

for action is close to the time limit for considering the possibility of recovery. 

41 

8. REFERENCES

1. American Society of Mechanical Engineers (ASME), “Standard for Probabilistic Risk 

Assessment for Nuclear Power Plant Applications RA-S-2002,” New York, 2002. 

2. U.S. Nuclear Regulatory Commission, “RELAP5/MOD3.3 Code Manual,” 

NUREG/CR-5535/Rev P3, Vols. 1 to 8. Information Systems Laboratories, Inc., 

Rockville, MD, Idaho Falls, ID, prepared for NRC, Washington, DC, 2006. 

3. Prošek, A., I. Parzer, and B. Krajnc, “Simulation of hypothetical small-break loss-ofcoolant accident in modernized nuclear power plant,” Electrotechnical Review, Vol. 71, 

No. 4, 2004. 

4. Parzer, I., B. Mavko, and B. Krajnc, “Simulation of a hypothetical loss-of-feedwater 

accident in a modernized nuclear power plant,” Journal of Mechanical Engineering, 

Vol. 49, No. 9, 2003. 

5. Parzer, I., “Break model comparison in different RELAP5 versions,” Proc. of International 

Conference Nuclear Energy for New Europe 2003, Nuclear Society of Slovenia, 

Portorož, September 8–11, 2003, Ljubljana, Slovenia, 2003. 

6. Prior, R.P., et al., “Best estimate success criteria in the Krsko IPE,” Proc. of the 

PSA/PRA and Severe Accident, Nuclear Society of Slovenia, Ljubljana, Slovenia, 1994. 

7. Prošek, A. and M. Čepin, “Impact of deterministic safety analysis on human reliability 

analysis,” Proc. of the Risk, Quality and Reliability Conference 2007 (RQR 2007), 

VŠB-Technical University of Ostrava, Ostrava, Czech Republic, 2007. 

8. Čepin, M., “Importance of human contribution within the human reliability analysis 

(IJS-HRA),” Journal of Loss Prevention in the Process Industries, Vol. 21, No. 3, 2008. 

9. Čepin, M., “DEPEND-HRA—A method for consideration of dependency in human 

reliability analysis,“ Reliability Engineering and System Safety, Vol. 93, No. 10, 2008. 

10. Čepin, M., “Analysis of truncation limit in probabilistic safety assessment,” Reliability 

Engineering and System Safety, Vol. 87, 2005. 

11. Prošek, A. and B. Mavko, “Evaluating Code Uncertainty—I: Using the CSAU method for 

uncertainty analysis of a two-loop PWR SBLOCA,” Nuclear Technology, Vol. 126. 1999. 

12. Prošek, A. and B. Mavko, “Evaluating Code Uncertainty—II: An optimal statistical 

estimator method to evaluate the uncertainties of calculated time trends,” Nuclear 

Technology, Vol. 126, 1999. 

13. Han, S.J., H.G. Lim, and J.E. Yang, “An estimation of an operator’s action time by using 

the MARS code in a small break LOCA without a HPSI for a PWR,” Nuclear Engineering 

and Design, Vol. 237, 2007.