ML032960170

Final Accident Sequence Precursor Analysis of August 2000 Operational Event

ML032960170
Person / Time
Site:	Millstone
Issue date:	09/08/2003
From:	Richard Ennis NRC/NRR/DLPM/LPD1
To:	Christian D Dominion Nuclear Connecticut
References
IR-00-011, LER 01-005-00
Download: ML032960170 (14)

Text

SepteTber 8, 2003 Mr. David A. Christian Sr. Vice President and Chief Nuclear Officer Dominion Nuclear Connecticut, Inc.

Innsbrook Technical Center 5000 Dominion Boulevard Glen Allen, VA 23060-6711

SUBJECT:

MILLSTONE POWER STATION, UNIT NO.2-FINAL ACCIDENT SEQUENCE PRECURSOR ANALYSIS OF AUGUST 2000 OPERATIONAL EVENT

Dear Mr. Christian:

Enclosed for your information Is the final Accident Sequence Precursor (ASP) analysis of an operational event which occurred at the Millstone Power Station, Unit No. 2, in August 2000.

The condition was reported by Licensee Event Report No. 2001-005-00, dated July 13, 2001, and documented in U.S. Nuclear Regulatory Commission (NRC) Inspection Report No.

50-336/2000-011, dated October 30, 2000. We prepared the final analysis based on our review and evaluation of your comments on the preliminary analysis, and comments received from the NRC staff. Our responses to your specific comments are included as an attachment to the enclosure. Our review of your comments employed the criteria contained in the material which accompanied the preliminary analysis. The results of the final analysis Indicate that this event is a precursor (i.e., the importance or change In core damage probability Is greater than 1 E-6).

Due to the potential sensitivity of the information described in the enclosed ASP analysis and response to comments, the staff has not made the enclosure publicly available.

Please contact me at 301-415-1420 If you have any questions regarding the enclosure. We recognize and appreciate the effort expended by you and your staff in reviewing comments on the preliminary analysis.

Sincerely,

/RMI Richard B. Ennis, Senior Project Manager, Section 2 Project Directorate I Division of Licensing Project Management Office of Nuclear Reactor Regulation Docket No. 50-336

Enclosure:

As stated (SENSITIVE - NOT FOR PUBLIC DISCLOSURE) cc w/o end: See next page DISTRIBUTION:

Information in this record was deleted PUBLIC JClifford BMcDermott, RGN-I in accordance with the Freedom of Information PDI-2 Reading REnnis MHarper, RES Act, exemptions ;-'

OGC CRaynor DMarksberry, RES FOIA 04

)

3q ACRS JGolla Accession Nos: Letter: ML032400216

Enclosure:

ML0319 OFFICE PDI-2/PM PDI-21LAr PDI-2/SC NAME REnnls-Kt CRaynotl2b-

JCId DATE iL((b.';

q OFFICIAL RECORD COPY A'

150218 Package: ML032400216 I

-s"&

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 Septenber 8, 2003 Mr. David A. Christian Sr. Vice President and Chief Nuclear Officer Dominion Nuclear Connecticut, Inc.

Innsbrook Technical Center 5000 Dominion Boulevard Glen Allen, VA 23060-6711

SUBJECT:

MILLSTONE POWER STATION, UNIT NO.2 - FINAL ACCIDENT SEQUENCE PRECURSOR ANALYSIS OF AUGUST 2000 OPERATIONAL EVENT

Dear Mr. Christian:

Enclosed for your information Is the final Accident Sequence Precursor (ASP) analysis of an operational event which occurred at the Millstone Power Station, Unit No. 2, in August 2000.

The condition was reported by Licensee Event Report No. 2001-005-00, dated July 13, 2001, and documented in U.S. Nuclear Regulatory Commission (NRC) Inspection Report No.

50-336/2000-011, dated October 30, 2000. We prepared the final analysis based on our review and evaluation of your comments on the preliminary analysis, and comments received from the NRC staff. Our responses to your specific comments are included as an attachment to the enclosure. Our review of your comments employed the criteria contained in the material which accompanied the preliminary analysis. The results of the final analysis Indicate that this event is a precursor (i.e., the Importance or change in core damage probability is greater than 1 E-6).

Due to the potential sensitivity of the Information described in the enclosed ASP analysis and response to comments, the staff has not made the enclosure publicly available.

Please contact me at 301-415-1420 if you have any questions regarding the enclosure. We recognize and appreciate the effort expended by you and your staff in reviewing comments on the preliminary analysis.

Sincerely, Richard B. Ennis, Senior Project Manager, Section 2 Project Directorate I Division of Licensing Project Management Office of Nuclear Reactor Regulation Docket No. 50-336

Enclosure:

As stated (SENSITIVE - NOT FOR PUBLIC DISCLOSURE) cc w/o end: See next page

Millstone Power Station Unit 2 cc:

Lillian M. Cuoco, Esquire Senior Counsel Dominion Resources Services, Inc.

Rope Ferry Road Waterford, CT 06385 Edward L. Wilds, Jr., Ph.D.

Director, Division of Radiation Department of Environmental Protection 79 Elm Street Hartford, CT 06106-5127 Regional Administrator, Region I U.S. Nuclear Regulatory Commission 475 Allendale Road King of Prussia, PA 19406 First Selectmen Town of Waterford 15 Rope Ferry Road Waterford, CT 06385 Charles Brinkman, Director Washington Operations Nuclear Services Westinghouse Electric Company 12300 Twinbrook Pkwy, Suite 330 Rockville, MD 20852 Senior Resident Inspector Millstone Power Station c/o U.S. Nuclear Regulatory Commission P.O. Box 513 Niantic, CT 06357 Mr. W. R. Matthews Senior Vice President - Nuclear Operations Dominion Nuclear Connecticut, Inc.

Rope Ferry Road Waterford, CT 06385 Mr. P. J. Parulis Manager - Nuclear Oversight Dominion Nuclear Connecticut, Inc.

Rope Ferry Road Waterford, CT 06385 Mr. J. Alan Price Site Vice President Dominion Nuclear Connecticut, Inc.

Rope Ferry Road Waterford, CT 06385 Mr. John Markowicz Co-Chair Nuclear Energy Advisory Council 9 Susan Terrace Waterford, CT 06385 Mr. Evan W. Woollacott Co-Chair Nuclear Energy Advisory Council 128 Terry's Plain Road Simsbury, CT 06070 Ms. Nancy Burton 147 Cross Highway Redding Ridge, CT 00870 Mr. G. D. Hicks Director - Nuclear Station Safety and Licensing Dominion Nuclear Connecticut, Inc.

Rope Ferry Road Waterford, CT 06385 Mr. S. E. Scace Assistant to the Site Vice President Dominion Nuclear Connecticut, Inc.

Rope Ferry Road Waterford, CT 06385 Mr. Chris L. Funderburk Director, Nuclear Licensing and Operations Support Dominion Resources Services, Inc.

Innsbrook Technical Center 5000 Dominion Boulevard Glen Allen, VA 23060-6711

Millstone Power Station Unit 2 cc:

Mr. A. J. Jordan, Jr.

Director - Nuclear Engineering Dominion Nuclear Connecticut, Inc.

Rope Ferry Road Waterford, CT 06385 Mr. S. P. Sarver Director - Nuclear Station Operations and Maintenance Dominion Nuclear Connecticut, Inc.

Rope Ferry, Road Waterford, CT 06385 Mr. David W. Dodson Licensing Supervisor Dominion Nuclear Connecticut, Inc.

Rope Ferry Road Waterford, CT 06385

Final Precursor Analysis g

r~~'TM_Am Z-

!W04779m

~

19=-.ITI _TMrTi;~

Millstone Unit 2 Failure of the turbine-driven auxiliary feedwater pump during a routine surveillance test Event Date 08/23/00 LER 336/01-005 ACDP = 1.8 x104 July 14, 2003 Condition Summary On August 23, 2000, during a routine surveillance test, while raising the turbine-driven auxiliary feedwater (TDAFW) pump speed from approximately 1400 rpm to Its rated speed of 4400 rpm, the control room noted that the turbine speed would at times not respond to motion of the speed control switch and at other times rise in spurts. Also during the start, a senior reactor operator In the pump room noted that at times the speed control servo motor was turning without any corresponding motion of the turbine governor steam valve. Engineering personnel and the Shift Manager evaluated the condition and concluded that the observed governor valve response was consistent with expected response In that, at certain points, substantial motion of the speed control servo motor Is necessary to cause a perceptible change In governor steam valve position.

The next operation of the TDAFW pump was a regularly scheduled surveillance test performed on September 20, 2000. During the test, the turbine was started and warmed at its minimum operating speed of approximately 1400 rpm. Following the warm-up, control room operators were unable to Increase turbine speed above Its starting speed through operation of the TDAFW pump speed control switch. The discharge pressure of the pump at that speed was less than 200 psig, which was Insufficient pressure for the pump to provide feedwater to the steam generators. (References 1, 2, and 3)

Concurrent with this condition, the IC" High Pressure Safety Injection pump had a low oil level from July 6 to August 3, 2000. Information from the pump vendor Indicated that the as-found oil level would have allowed the pump to operate for an estimated 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br /> before failure.

Because this time to failure exceeds the modeled mission time for high pressure safety Injection of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, this additional condition was not Included In the condition assessment. (Reference 4)

Cause. Following the surveillance test failure, the licensee disassembled the speed control servo motor and the associated coupling. The mechanic performing the disassembly found the self-locking nut loose and the outward bend in the clutch spring sheared off. The spring in the coupling that joined the servo-motor provides remote operation of the governor to the turbine governor. The cause of the spring failure has not been conclusively established.

Condition duration. The licensee contracted with a third party to perform a failure analysis of the TDAFW pump governor spring. The report concluded that the spring failed while the governor speed control was moving in the decreasing direction (i.e., return to standby condition). This would indicate that the TDAFW pump had been Inoperable from August 23, 2000, until It was restored to service on September 20, 2000. The licensee determined that the actual unavailable time was 29 days, 7.25 hours2.893519e-4 days <br />0.00694 hours <br />4.133598e-5 weeks <br />9.5125e-6 months <br /> (Reference 5).

I

Recovery opportunity. Because of the lack of engagement between the manual speed control knob and the governor shaft, the servo motor could not turn the governor shaft.

Reference 2 concluded that this failure mechanism would not readily allow recovery of the pump by local manipulation of the speed control knob.

Analysis Results age S&,,IE 7

Irrfjortancel The risk significance of the TDAFW pump being unavailable Is determined by subtracting the nominal core damage probability from the conditional core damage probability:

Conditional core damage probability (CCDP) = 2.2x104 Nominal core damage probability (CDP) =

-4.3x10 7 Importance (ACDP = CCDP - CDP) =

1.8x1 04 The estimated Importance (CCDP-CDP) for the condition was 1.8x104. This Is an increase of 1.8x1 0-6 over the nominal CDP for the -703-hour period when the TDAFW pump was not available.

The Accident Sequence Precursor Program acceptance threshold is an Importance (ACDP) of 1X10 4.

Dominant sequence A~~~~~IA Results tables The conditional probability of the dominant sequence Is shown In Table 1.

The event tree sequence logic for the dominant sequence Is provided In Table 2a.

The conditional cut sets for the dominant sequence are provided in Table 3.

Modeling Assumptions g Assessment summary

' Since this condition did not Involve an actual Initiating event, the parameter of interest Is the measure of the incremental Increase between the conditional probability for the period In which the condition existed and the nominal probability for the same period but with the condition nonexistent and plant equipment available. This Incremental increase or 'importance' Is determined by subtracting the CDP from the CCDP. This measure Is used to assess the risk significance of hardware unavallabilities especially for those cases where the nominal CDP is high with respect to the Incremental Increase of the conditional probability caused by the hardware unavailability.

2

This event was modeled as an at-power condition assessment with the TDAFW pump unavailable for 703.25 hours2.893519e-4 days <br />0.00694 hours <br />4.133598e-5 weeks <br />9.5125e-6 months <br />. The Rev. 2QA of the Millstone Simplified Plant Analysis Risk (SPAR) model (Reference 6) was used for this assessment. The SPAR Rev. 2QA model Includes event trees for transients (including loss of feedwater and a transfer tree for anticipated transient without scram), loss of offsite power (including a transfer tree for station blackout), small loss-of-coolant accident, and steam generator tube rupture.

These event trees were used in the analysis. The discussion below provides the bases for significant changes to the model.

In addition, this condition was analyzed using the SPAR Rev. 3i model (Reference 7).

The Rev. 3i model Includes development of initiating events not included in the Rev. 2QA model, as well as modeling of the effect of failure of various support systems on important safety systems. The results of this analysis showed the dominant sequence to involve a I (Note: The Rev. 3i model has not been approved for use by the NRC, therefore, significant changes to the model

[e.g., event trees, fault trees, component failure data, human error probabilities] could occur in the approval process.) The events and important component failures In this sequence are:

The sequence that is dominant in the RevQA -mocl 1..quence 23-28) is olesser_

lImprtance In the Rev. 3i xQel -beause

,xA We agree with the results of the Rev. Si model. However, the Rev. 2QA models will continue to be used until the Rev. Si models have been approved by the NRC for use.'

Therefore, the results presented in this report reflect the Rev. 2QA model results, and our estimate of the Importance of this condition is 1.8E-6.

Basic event probability changes Table 4 provides the basic events that were modified to reflect the event condition being analyzed. The bases for these changes are as follows:

Probability of failure of the TDAFWpump (AFW-TDP-FC-TDP). The probability that the pump would fail to start was set to TRUE (failure probability of 1.0) to reflect the failure of the train to provide flow.

Nonrecoveryprobabilities for the auxiliary feedwatersystem. Based on the failure cause (speed control mechanism), thy TDAFW pump was not considered

_recoverable within the time period available (see Table 5).

9Y.

'2

3

Other changes of sequence nonrecoveryprobabilities. The generic sequence nonrecovery probabilities from the SPAR model were reviewed and modified, as necessary, to appropriately reflect the minimum cut sets of the important dominant sequences. Table 4 shows the sequence nonrecovery probabilities for the dominant sequences. Table 5 provides the bases for those probabilities.

Model update The SPAR model for Millstone 2 was updated to account for:

updates of system/component failure probabilities and Initiating event frequencies based on recent operating experience, changes in the reactor coolant pump seal loss-of-coolant accident model (Reference 9), and Bases for these updates are described in the footnotes to Table 4.

References A

1.

LER 336/01-005, Turbine Driven Auxiliary Feedwater Pump Inoperable Without Meeting Action Statement Requirements, August 23, 2001 (ADAMS Accession No. MLOI 2050371).

2.

NRC Inspection Report 50-336/2000-011, 50-423/2000-011, October 30, 2000 (ADAMS Accession No. ML003764492).

3.

EA-00-236, Final Significance Determination for a Whit Finding and Notice of Violation at Millstone 2, NRC Inspection Report No. 05000336/2000-011, December 6, 2000 (ADAMS Accession No. ML003774806).

4.

NRC Inspection Report 50-336/2001-003, March 19, 2001 (ADAMS Accession No. MLO1 0790130).

5.

50-336, B18477, Comments on the Nuclear Regulatory Comission Preliminary Accident Sequence PrecursorAnalysis, Millstone Power Station, Unit 2, August 31, 2001 (ADAMS Accession No. ML012490043).

6.

M. B. Sattison, et al., Simplified Plant Analysis Risk Model for Millstone Unit 2 (ASP PWR G), Revision 2QA, Idaho National Engineering and Environmental Laboratory, Idaho Falls, ID, December 1997.

7.

James K. Knudsen, Standardized Plant Analysis Risk Model for Millstone Unit 2 (ASP PWR G), Revision 31 (Interim), Idaho National Engineering and Environmental Laboratory, Idaho Falls, ID, September 2000.

4

8.

P. W. Baranowsky, Evaluation of Station Blackout Accidents at Nuclear Power Plants, NUREG-1032, U.S. Nuclear Regulatory Commission, Washington, DC, June 1988.

9.

R. G. Neve, et al., CosVBenefit Analysis for Generic Issue 23: Reactor, Coolant Pump Seal Failure, NUREG/CR-5167, U.S. Nuclear Regulatory Commission, Washington, DC, April 1991.

10.

Memorandum from Ashok C. Thadani to William D. Travers, "Closeout of Generic Safety Issue 23: Reactor Coolant Pump Seal Fallure," U.S. Nuclear Regulatory Commission, Washington, DC, November 8, 1999.

11.

F. M. Marshall, et al., Common-Cause Failure Parameter Estimations, NUREG/CR-5497, U.S. Nuclear Regulatory Commission, Washington, DC, October 1998.

12.

G. M. Grant, et al., Reliability Study: Emergency Diesel Generator Power System, 1987-1993, NUREG/CR-5500, Vol. 5, U.S. Nuclear Regulatory Commission, Washington, DC, September 1999.

13.

J. P. Poloskl, et al., Rates of Initiating Events at U.S. Nuclear Power Plants: 1987-1995, NUREGICR-5750, U.S. Nuclear Regulatory Commission, Washington, DC, February 1999.

14.

C. L. Atwood, et al., Evaluation of Loss of Offsite Power Events at Nuclear Power Plants:

1980-1996, NUREG/CR-5496, U.S. Nuclear Regulatory Commission, Washington, DC, November 1998.

5

Table 1. Conditional probabilities associated with the highest probability sequences' Conditional core Event tree Sequence damage probability Core damage probability Importance name no.

(CCDP)

(CDP)

(CCDP - CDP)

LOOP 23-28 1.4E-006 2.3E-008 Total (all sequences)'

2.2E-006 4.3E-007 1.8E-006 Notes:

1. (File name: GEM 336-01-005 11-19-2001 143823.WPD)

2. Total CCDP and CDP includes all sequences (Including those not shown In this table).

3. Importance Is calculated using the total CDP and total CDP from all sequences. Sequence level Importance measures are not additive.

Table 2a. Event tree sequence loqic for dominant sequence Event tree name I Sequence no.

Logic

("7 denotes success; see Table 2b for top event names)

-4.

R

.Y-

'r I

LOOP X

23-28 1

Table 2b. Definitions of fault trees listed In Table 2a' Note:

1. Modifications to other fault trees not listed In this table were made In accordance with guidance provided In Reference 10. The SPAR model was modified to replace the existing reactor coolant pump seal loss of coolant accident (LOCA) model with the Rhodes Model (Reference 9). In order to replace the reactor coolant pump seal LOCA model without modifying the station blackout event tree, top event OP-SL was set to 'False* (basic event OEP-XHE-NOREC-SL). To account for offslte power recovery, the nonrecovery probabilities for offsite power AND emergency diesel generators (EDGs) were added to the sequence-specific nonrecovery probabilities for the reactor coolant pump seal LOCA sequences In the station blackout event tree (see Table 5)... Based on the Rhodes Model, the time available to prevent core damage by high-pressure Injection if reactor coolant Dump seals fall Is 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />.F (see Table 5). Finally, Event Tree Linking Rule Nos. 4 and 5 0)N

~Reference 6, Table 2-1), which are triggered by the success of top event OP-SL, were negated by substituting fault tree HPI for HPI-L In LOOP Sequences 23-11 and 23-23 and HPR for HPR-L In LOOP Sequences 23-06, 23-09, 23-18, and 23-21. High temperature seals were assumed to be Installed on all reactor coolant pumps.

6

Table 3. Conditional cut sets for Seauence 23-28 I

Percent CCDP contribution I

Minimal cut sets' Event Tree: LOOP, Sequence 23-2B 8.4E-007 59.0 3.7E-007 25.9 2.1 E-007 15.0 1.4E-006 Total2 I

k Notes:

1. See Table 4 for definitions and probabilities for the basic events.

2. Total CCDP Includes all cut sets (Including those not shown in this table).

7

Table 4. Definitions and probabilities for modified and dominant basic events Event name Description IFeqrobebility/ I

__~Frequency I Modlfied I~

TRUE 7.5E-004 6.9E-002 6.9E-002 6.9E-002 9.9E-06/hr 8.0E-07/hr YES' YES2 YES3 YES' YES3 YES' YES' 3.4E-07/hr YES' 1.6E-04/hr YES' 8.4E-001 YES" 5.OE-002 YES7 5.0E-002 YES' S.OE-002 YES"

\\

5.0E-002 YES7 5.02-02 YES7 5.0E-002 YES7 I 8.0E-001 YES' FALSE YES' I

2.OE-00t YES' 2.2E&001 YESO Notes:

1.

Basic event was changed to reflect condition being analyzed. TRUE has a failure probability of 1.0.

2.

Base case model was updated using data from NUREGICR-5497, Tables 5-2 and 5-5 (Reference 11).)

L.3r9.

(Reference 6, Figure 1).

3. Qase case model was updated using data from NUREGICR-5500, Vol. 5, Tables C4, C6, and C7 (Reference 12). See note 2 for additional Information.

4.

Base case model was updated using data from NUREG/CR-5750, Table H3 (Reference 13) and NUREG/CR 5496 Table 84 (Reference 14).

5.

Base case model was updated using data from NUREG/CR-5750, Table 3-1 (Reference 13).

6. Basic event was changed to reflect condition being analyzed. Sequence nonrecovery probabilities were modified to reflect the nonrecovery of AFW; see Table 5.

7.

Base case model was updated. See Table 5 for basis.

13. zase case model was updated to reflect the Rhodes Model. (See foot note to Table 2b.)

'_Ey 2 I

Table 5. Basis for the probabilities of sequence-specific recovery actions 8

Seq. no. and basic event Failed systems and recovery times --

Nonrecovery probability Combined failure probability Modification remarks (also see footnotes) 22 LOOP-22-NREC l

23-28 LOOP-23-28-NREC I 1.0 0.84 0.84 TDAFW pump Is nonrecoverable 23-06 LOOP-23-06-NREC 23-09 LOOP-23-09-NREC 23-11 LOOP-23-11-NREC 23-18 LOOP-23-18-NREC 23-21 LOOP-23-21 -NREC 0.8 0.8 TDAFW pump is 1.0 nonrecoverable n/a 0.5 0.05 Include Rhodes reactor 0.1 coolant pump seal LOCA model 0.5 0.05 Include Rhodes reactor 0.1 coolant pump seal LOCA model 0.5 0.05 Include Rhodes reactor 0.1 coolant pump seal LOCA model 0.5 0.05 Include Rhodes reactor 0.1 coolant pump seal LOCA model 0.5 0.05 Include Rhodes reactor 0.1 coolant pump seal LOCA model 0.5 0.05 Include Rhodes reactor 0.1 coolant pump seal LOCA model 23-23 LOOP-23-23-NREC Notes:

1.

K' LW'Y, 9

LER 336/01-005 - Resolution of Comments 1 A letter from Dominion Nuclear Connecticut, Inc. (DNC) to NRC dated August 31, 2001 (Ref.

15), describes DNC's review of and comment on the Preliminary Precursor Analysis of the condition reported In Licensee Event Report (LER) No. 336/01-005. The NRC has reviewed these comments and has made the following changes to the precursor analysis report:

Licensee's comment: A detailed failure analysis of the TDAFW pump determined the actual time of failure of the spring. The actual unavailable hours for the pump were determined to be 703.25 hours2.893519e-4 days <br />0.00694 hours <br />4.133598e-5 weeks <br />9.5125e-6 months <br />.

Response: The NRC agrees with this comment and has revised the analysis to reflect the new condition duration. This change reduces the overall importance; however, it does not reduce the Importance below the ASP program acceptance threshold (ACDP) of 1x104.

In the process of reviewing this analysis, we realized that credit fori fdoup~le-counting was eliminated, resulting in an increase In the overall Importance for this condition. This Increase in Importance was larger than the decrease In Importance from revising the condition duration, resulting In a slight Increase overall In the Importance of this condition.

14