ML060240394
| ML060240394 | |
| Person / Time | |
|---|---|
| Site: | Peach Bottom  |
| Issue date: | 03/17/2004 |
| From: | Eliezer Goldfeiz NRC/RES/DRAA/OERAB |
| To: | |
| Shared Package | |
| ML060240240 | List: |
| References | |
| LER 2004-001-00 | |
| Download: ML060240394 (20) | |
Text
Final Precursor Analysis Accident Sequence Precursor Program -- Office of Nuclear Regulatory Research Peach Bottom 3 Loss of High Pressure Coolant Injection System Function as a Result of an Inoperable Flow Controller Event Date 3/17/2004 LER 278/04-001
)CDP = 1.6x10-6 August 18, 2005 Event Summary Description. On 3/17/2004, at approximately 12:35 hours, during the performance of a routine quarterly surveillance test for the High Pressure Coolant Injection (HPCI) system, Peach Bottom personnel discovered that the HPCI was inoperable (Reference 1). During performance of the surveillance test, the HPCI turbine could not achieve a speed above 1000 rpm and no significant discharge pressure was observed (e.g.: no flow was delivered).
Cause. The cause of the event was identified to be an inoperability of the HPCI system flow controller (Reference 1).
Condition Duration. The last time the HPCI surveillance test was performed (Reference 1) was on 12/18/2003 implying that the flow controller failed some time in the 90 day interval since the last successful surveillance test. The exact time of the failure of the flow controller is unknown, it is concluded that the HPCI became inoperable due to failure of the flow controller some time between the two surveillance tests. Therefore, the duration is one-half the surveillance period.
Following the detection of the failed flow controller, the flow controller was replaced and HPCI was satisfactorily tested and returned to an operable status on 3/19/04 by 01:45 hours (an additional 37 hours4.282407e-4 days <br />0.0103 hours <br />6.117725e-5 weeks <br />1.40785e-5 months <br /> to restore the HPCI system to operability).
Recovery Opportunity. During the quarterly test interval from 12/18/2003 to 3/17/2004 there were no operational events requiring HPCI. Had there been an event requiring high pressure makeup to the RPV, such makeup could have been provided by the RCIC system. The HPCI turbine driven pump speed controller is a local device on the HPCI turbine which receives control start demand signals from ESF logic and from manual controls in the control room and controls the start up and flow regulation of the turbine driven pump. In the event of failure of this device it is not possible to correct the problem from the control room or manually control the turbine driven pump locally. Therefore: this is a non-recoverable fault.
Other Related Conditions or Events During the Condition Period. No other significant overlapping condition was identified during the quarterly interval. Other similar flow controllers (both HPCI and RCIC) on Units 2 and 3 were evaluated for extent of condition concerns and determined to be operable. As noted in the LER (Reference 1), there was an approximately 5 minute interval where the RCIC controller was also inoperable during the restoration of the HPCI controller. The significance of this additional source of high pressure makeup to the RPV was addressed via a sensitivity study which indicated that the additional risk of the 5 minute RCIC unavailability resulted in a CCDP = 2.5 x 10-9, which is insignificant.
Analysis Results Importance Because this condition did not involve an actual initiating event, the parameter of interest is the measure of the incremental change between the conditional probability of core damage for the period in which the condition existed and the nominal core damage probability obtained with the equipment availability modeled in the Base Case SPAR model. This is obtained by subtracting the Base Case CDP from the CCDP involving an inoperable HPCI system. The base case Peach Bottom 2-3 SPAR Version 3.11 model (Reference 2) projects a CDF = 8.95 x 10-10 /hr, or 7.8 x 10-6 /yr assuming the nominal availability of all mitigating systems modeled. During a condition of the HPCI being totally unavailable, the CDF would rise to: CDF = 2.3 x 10-9 /hr, or 1.99 x 10-5 /yr.
Integrating this over the roughly 1117 hour0.0129 days <br />0.31 hours <br />0.00185 weeks <br />4.250185e-4 months <br /> interval yields the importance.
The importance of the event would thus be:
)CDP = CCDP - CDP = (2.6 x 10-6) - (1.0 x 10-6) = 1.6 x 10-6 CCDP 5%
Mean 95%
Peach Bottom Unit 3 2.2x10-7 2.5x10-6 8.1x10-6 Dominant Sequences The dominant accident sequences which contribute to more than 74.2% of the CCDP are listed in Table 1 and are shown graphically in Figures A-1 through A-6 of Appendix A. All other sequences contribute to less than 5% of the total.
The dominant sequences involve one of two types of accident scenarios. The majority are associated with some type of transient followed by: failure of the power conversion system (PCS), failure of RCIC (which is the only other high pressure RPV makeup system), and the failure to depressurize (DEP). This results in a high pressure core damage scenario.
The other general class of dominant accident sequences involve: failure of the power conversion system, failure of RCIC, but with successful depressurization, followed by failure of all the low pressure RPV makeup options (LPI, the Condensate system, and alternate makeup using sources such as firewater). These scenarios result in low pressure core damage scenarios.
Results Tables The conditional probabilities for the dominant sequences are shown in Table 1.
The event tree sequence logic for the dominant sequences are presented in Table 2a.
Table 2b defines the nomenclature used in Table 2a.
The most important cut sets for the dominant sequences are listed in Tables 3a and 3b.
Definitions and probabilities for modified or dominant basic events are provided in Table 4.
Modeling Assumptions Analysis Type This event is analyzed as a condition event assessment involving the unavailability of the HPCI system for essentially 1/2 of the 90 days between surveillance tests (1080 hours0.0125 days <br />0.3 hours <br />0.00179 weeks <br />4.1094e-4 months <br />) plus the 37 hours4.282407e-4 days <br />0.0103 hours <br />6.117725e-5 weeks <br />1.40785e-5 months <br /> required to repair the controller, or 1117 hours0.0129 days <br />0.31 hours <br />0.00185 weeks <br />4.250185e-4 months <br />.
Unique Design Features Peach Bottom Units 2 and 3 are both standard General Electric BWR-3s with Mark I containments. The BWR-3 design provides two safety-grade high pressure makeup systems: a turbine driven HPCI pump, and a RCIC turbine driven pump. A unique feature of the two unit site is the designed cross-connection capability built into the on-site power system between Peach Bottom Units 2 and 3. The two units each have two emergency diesel generators which can be cross-connected to either unit. This feature is important in assessing the effect of loss of offsite power events.
An additional unique feature is the ability to connect the onsite power system to the Conawingo Dam. This provides an AC power source which is diverse from the diesel generators and takes advantage of the fact that hydroelectric dams (which do not have any thermal heat-up rate limitations) are able to rapidly restart after a grid disturbance and provide power more rapidly than other units on the grid.
Modeling Assumptions Summary Key modeling assumptions. The key modeling assumptions are listed below and discussed in detail in the following sections. These assumptions are important contributors to the overall risk.
The condition duration is assumed to be 1117 hours0.0129 days <br />0.31 hours <br />0.00185 weeks <br />4.250185e-4 months <br />. The exact point at which the HPCI controller unit failed is unknown. Reference 1 states that HPCI was operated for a routine surveillance test on 12/18/03 with no abnormalities noted and the exact time of controller failed between 12/18/03 and 3/17/04 is not known. Reference 1 also states that the failure was discovered on 3/17/04 at approximately 12:35 hours and was returned to service on 3/19/04 by 01:45.
Therefore, it is assumed that the failure period is 1/2 of the duration between the two surveillance tests, or 1080 hours0.0125 days <br />0.3 hours <br />0.00179 weeks <br />4.1094e-4 months <br />, plus the 37 hours4.282407e-4 days <br />0.0103 hours <br />6.117725e-5 weeks <br />1.40785e-5 months <br /> to complete repairs and confirm the replacement controller was functioning, for a total of 1117 hours0.0129 days <br />0.31 hours <br />0.00185 weeks <br />4.250185e-4 months <br />. This was modeled by setting basic event: HCI-TDP-FS-TRAIN to TRUE.
No credit was taken for operator recovery actions to restore HPCI during any operational demand that could have occurred during the period the system was unavailable. Reference 1 states that the HPCI flow controller would not respond properly and that it took 37 hours4.282407e-4 days <br />0.0103 hours <br />6.117725e-5 weeks <br />1.40785e-5 months <br /> to complete repairs and confirm the replacement controller unit was functioning. It is therefore unlikely that the HPCI
pump could have been recovered. This assumption was modeled by setting basic event: HCI-XHE-XL-START to TRUE.
Other assumptions. Other assumptions that have a negligible impact on the results due to relatively low importance include the following:
C During scenarios involving Loss of Offsite Power with subsequent failure of onsite electric supplies, the effect of additional loss of the HPCI and RCIC systems creates scenarios where there is only an hour to recover some means for providing high pressure makeup to the RPV. The critical actions required involve: restoring a connection to normal offsite power supplies - and should this fail attempting to recover one of two failed diesel generators.
Fault Tree Modifications No fault tree modifications were made.
Basic Event Probability Changes Two changes were made to the base case basic event probabilities:
HCI-TDP-FS-TRAIN - representing the probability of the HPCI turbine driven pump failing to start was set TRUE in order to model the failure of the speed controller.
HCI-XHE-XL-START - representing the probability of the operators failing to recover the HPCI pump was set TRUE in order to represent the inability to recover from the specific type of fault that occurred.
Sensitivity Analyses An importance analysis was conducted on the CCDP results to identify parameters whose values significantly effect the resultant predictions for the loss of HPCI condition event. Two importance measures were looked at: Fussel-Vesely and the Risk Increase Ratio. Three basic events and three initiating events were identified in the top 20 list for both importance measures. These basic event and initiating event parameters are:
ADS-XHE-XE-MDEPR Operator failure to manually depressurize the RPV 5.0 x 10-4 LPI-XHE-XM-ERROR Operator failure to control Low Pressure Injection 5.0 x 10-4 ADS-TSW-FT-DC125 Power Transfer Switch fails to transfer 1.5 x 10-4 IE-LODCB Loss of Vital DC Bus Event 2.4 x 10-7/hr.
IE-TRANS General Plant Transient 1.8 x 10-4/hr.
IE-LOACB Loss of Vital AC Bus Event 2.2 x 10-6/hr.
Sensitivity analyses were performed to determine the effects of these uncertainties on results based on best estimate assumptions. The table below provides the results of the sensitivity analyses.
Parameter Modification CDP ADS-XHE-XE-MDEPR Increased by x5 CCDP = 5.6 x 10-6, CDP = 4.6 x 10-6 LPI-XHE-XM-ERROR Increased by x5 CCDP = 4.1 X 10-6, CDP = 3.2 X 10-6 ADS-TSW-FT-DC125 Increased by x5 CCDP = 4.4 X 10-6, CDP = 3.4 X 10-6 IE-LODCB Increased by x5 CCDP = 5.8 x 10-6, CDP =4.8 x 10-6 IE-TRANS Increased by x5 CCDP = 3.1 x 10-6, CDP = 2.1 x 10-5 IE-LOACB Increased by x5 CCDP = 5.3 x 10-6, CDP = 4.3 x 10-6 The results of the sensitivity studies are not surprising based on a review of the dominant cutsets. The failure to manually depressurize event is found in a very large portion of all of the dominant cutsets and the Human Error Probability is one of the lower values possible. Similarly, but not as sensitive, a very large number of dominant cutsets contain the failure to control low pressure injection.
A final sensitivity study was performed to assess the effect of the 5 minute inoperability of the RCIC which occurred while restoring the HPCI. In this study, RCI-TDP-FS-TRAIN was set TRUE and a condition evaluation was performed with a 5 minute duration. The results of this additional sensitivity study indicated that: CCDP = 2.5 x 10-9, hence this additional system inoperability did not play a significant risk during the restoration.
SPAR Model Corrections None.
References 1.
John A. Stone (Exelon Nuclear) to U.S. Nuclear Regulatory Commission, Peach Bottom Atomic Power Station Unit 3, Facility Operating License No. DPR-56, NRC Docket No.
50-278, Licensee Event Report 278/04-001, issued April 30, 2004.
2.
John A. Schroeder (INEEL), Standardized Plant Analysis Risk Model for Peach Bottom 2 & 3 (ASP BWR C), Revision 3.11, December 2004.
Table 1. Conditional core damage probabilities of dominating sequences.
Event tree name Sequence no.
CCDP1 Contribution LODCB 36 6.4 x 10-7 24.6%
LOACB 08 5.4 x 10-7 20.7%
LOCHS 36 3.1 x 10-7 11.9%
LODCB 35 1.6 x 10-7 6.1%
LOMFW 36 1.5 x 10-7 5.8%
LOOP 38-23 1.3 x 10-7 5.0%
Total (all sequences)2 2.6 x 10-6 100%
- 1. Values are point estimates.
- 2. Total CCDP includes all sequences (including those not shown in this table).
Table 2a. Event tree sequence logic for dominating sequences.
Event tree name Sequence no.
Logic
(/ denotes success; see Table 2b for top event names)
LODCB 36
/RPS /SRV PCS HPI DEP LOACB 08
/RPS /SRV PCS / HPI SPC /DEP SDC PCSR CVS LI02 LOCHS 36
/RPS /SRV PCS HPI DEP LODCB 34
/RPS /SRV PCS HPI /DEP CDS LPI VA LOMFW 35
/RPS EPS /SRV /HPI OEP-02H DGR-02H CWG-02H
Table 2b. Definitions of top events listed in Table 2a.
Top Event Definition RPS Reactor Protection System is unavailable SRV One or More Safety/Relief Valves fails to close PCS Power Conversion System is unavailable HPI High Pressure Injection (HPCI and RCIC) is unavailable DEP Manual Depressurization fails SPC Suppression Pool Cooling SDC Shutdown Cooling PCSR Long Term Power Conversion System Recovery CVS Containment Venting LI02 Late Injection CDS Condensate System (alternate RPV makeup) is unavailable LPI Low Pressure Injection (LPCI and Core Spray) is unavailable VA Alternate RPV Injection fails OEP-02H Offsite Power Recovery within 2 Hours DGR-02H Recovery of 1/2 Diesel Generators within 2 Hours CWG-02H Electrical Cross-connection with the Inter-tie from the Conawingo Dam
Table 3a. Conditional cut sets for the dominant sequences.
CCDP Percent Contribution Minimum Cut Sets (of basic events)
Event Tree: LODCB Sequence 36 4.8E-007 74.85 ADS-TSW-FT-DC125 1.7E-007 24.95 ADS-XHE-XE-MDEPR 6.4E-007 100.0 Total (all cutsets)1 CCDP Percent Contribution Minimum Cut Sets (of basic events)
Event Tree: LOACB Sequence 08 4.3E-007 80.65 RHR-XHE-XM-ERROR RBENV PCS-XHE-XL-LTLACB 2.4E-008 4.39 SPC-MOV-CF-INJEC RBENV PCS-XHE-XL-LTLACB 1.8E-008 3.23 RBENV PCS-XHE-XL-LTLACB SPC-MOV-CC-F039B HSW-MDP-TM-TRNC 1.8E-008 3.23 RBENV PCS-XHE-XL-LTLACB SPC-MOV-CC-F034B HSW-MDP-TM-TRNC 6.1E-009 1.13 RBENV PCS-XHE-XL-LTLACB RHR-MDP-TM-TRNC SPC-MOV-CC-F034B 6.1E-009 1.13 RBENV PCS-XHE-XL-LTLACB RHR-MDP-TM-TRNC SPC-MOV-CC-F039B 5.4E-007 100.0 Total (all cutsets)1
- 1. Total Importance includes all cutsets (including those not shown in this table).
LER 278/04-001 10 Table 3a. (Continued) Conditional cut sets for the dominant sequences.
CCDP Percent Contribution Minimum Cut Sets (of basic events)
Event Tree: LOCHS Sequence 36 1.5E-007 49.67 ADS-XHE-XE-MDEPR PCS-XHE-XL-STLCHS RCI-TDP-TM-TRAIN 4.3E-008 13.91 ADS-XHE-XE-MDEPR PCS-XHE-XL-STLCHS RCI-TDP-FS-TRAIN RCI-XHE-XL-START 2.6E-008 8.57 ADS-XHE-XE-MDEPR PCS-XHE-XL-STLCHS RCI-TDP-FR-TRAIN RCI-XHE-XL-RUN 1.5E-008 5.04 ADS-XHE-XE-MDEPR PCS-XHE-XL-STLCHS RCI-RESTART RCI-TDP-FS-RSTRT RCI-XHE-XL-START 1.3E-008 4.14 ADS-XHE-XE-MDEPR PCS-XHE-XL-STLCHS RCI-XHE-XO-ERROR 1.3E-008 4.14 ADS-XHE-XE-MDEPR PCS-XHE-XL-STLCHS RCI-MOV-OO-F018 1.3E-008 4.14 ADS-XHE-XE-MDEPR PCS-XHE-XL-STLCHS RCI-MOV-CC-F039 1.3E-008 4.14 ADS-XHE-XE-MDEPR PCS-XHE-XL-STLCHS RCI-MOV-CC-F041 HCI-XHE-XL-START 1.3E-008 4.14 ADS-XHE-XE-MDEPR PCS-XHE-XL-STLCHS RCI-MOV-CC-INJEC 3.1E-007 100.0 Total (all cutsets)1 CCDP Percent Contribution Minimum Cut Sets (of basic events)
Event Tree: LODCB Sequence 35 1.6E-007 99.83 LPI-XHE-XM-ERROR 1.6E-007 100.0 Total (all cutsets)1
- 1. Total Importance includes all cutsets (including those not shown in this table).
LER 278/04-001 11 Table 3a. (Continued) Conditional cut sets for the dominant sequences.
CCDP Percent Contribution Minimum Cut Sets (of basic events)
Event Tree: LOMFW Sequence 36 7.7E-008 49.67 ADS-XHE-XE-MDEPR PCS-XHE-XL-STLMFW RCI-TDP-TM-TRAIN 2.1E-008 13.91 ADS-XHE-XE-MDEPR PCS-XHE-XL-STLMFW RCI-TDP-FS-TRAIN RCI-XHE-XL-START 1.3E-008 8.57 ADS-XHE-XE-MDEPR PCS-XHE-XL-STLMFW RCI-TDP-FR-TRAIN RCI-XHE-XL-RUN 7.8E-009 5.04 ADS-XHE-XE-MDEPR PCS-XHE-XL-STLMFW RCI-RESTART RCI-TDP-FS-RSTRT RCI-XHE-XL-RSTRT 6.4E-009 4.14 ADS-XHE-XE-MDEPR PCS-XHE-XL-STLMFW RCI-XHE-XO-ERROR 6.4E-009 4.14 ADS-XHE-XE-MDEPR PCS-XHE-XL-STLMFW RCI-MOV-OO-F018 6.4E-009 4.14 S-XHE-XE-MDEPR PCS-XHE-XL-STLMFW RCI-MOV-CC-F039 6.4E-009 4.14 ADS-XHE-XE-MDEPR PCS-XHE-XL-STLMFW RCI-MOV-CC-F041 6.4E-009 4.14 ADS-XHE-XE-MDEPR PCS-XHE-XL-STLMFW RCI-MOV-CC-INJEC 1.5E-007 100.0 Total (all cutsets)1 CCDP Percent Contribution Minimum Cut Sets (of basic events)
Event Tree: LOOP Sequence 38-23 1.1E-007 85.83 EPS-XHE-XM-RCOOL EPS-XHE-XL-NR02H OEP-XHE-XL-NR02H CWG-02H 5.5E-009 4.24 EPS-XHE-XL-NR02H OEP-XHE-XL-NR02H CWG-02H EPS-DGN-CF-RUN 1.3E-007 100.0 Total (all cutsets)1
- 1. Total Importance includes all cutsets (including those not shown in this table).
LER 278/04-001 12 Table 4. Definitions and probabilities for modified and dominant basic events.
Event Name Description Probability/
Frequency (per hour)
Modified ADS-TSW-FT-DC125 POWER TRANSFER SWITCH FAILS TO TRANSFER 1.5E-003 ADS-XHE-XE-MDEPR OPERATOR FAILS TO DEPRESSURIZE THE REACTOR 5.0E-004 CWG-02H CONOWINGO TIE LINE SET UP IN 2 HRS 1.0E-001 EPS-DGN-CF-RUN DIESELS FAIL FROM COMMON CAUSE TO RUN 4.9E-005 EPS-XHE-XL-NR02H OPERATOR FAILS TO RECOVER EMERGENCY DIESEL IN 7.1E-001 EPS-XHE-XM-RCOOL OPERATOR FAILS TO ESTABLISH ROOM COOLING WITH 1.0E-003 HCI-TDP-FS-TRAIN HPCI PUMP FAILS TO START 1.0E+000 YES HCI-XHE-XL-START OPERATOR FAILS TO RECOVER HPCI FAILURE TO STA 1.0E+000 YES HSW-MDP-TM-TRNC HPSW PUMP C IS UNAVAILABLE BECAUSE OF MAINTEN 2.0E-002 LPI-XHE-XM-ERROR OPERATOR FAILS TO CONTROL LOW PRESSURE INJECT 5.0E-004 OEP-XHE-XL-NR02H OPERATOR FAILS TO RECOVER OFFSITE POWER IN 2 3.7E-001 PCS-XHE-XL-LTLACB OPERATORS FAIL TO RECOVER THE POWER CONVERSION 3.4E-001 PCS-XHE-XL-STLCHS OPERATORS FAIL TO RECOVER THE POWER CONVERSION 1.0E+000 PCS-XHE-XL-STLMFW OPERATORS FAIL TO RECOVER THE POWER CONVERSION 1.0E+000 RBENV REACTOR BUILDING ENVIRONMENT CAUSES INJECTION 5.0E-001 RCI-MOV-CC-F039 TORUS SUCTION VALVE 13-39 FAILS TO OPEN 1.0E-003 RCI-MOV-CC-F041 TORUS SUCTION VALVE 13-41 FAILS TO OPEN 1.0E-003 RCI-MOV-CC-INJEC RCIC INJECTION VALVE CAUSES FAILURE TO START 1.0E-003 RCI-MOV-00-F018 CST ISOLATION VALVE 13-18 FAILS TO CLOSE 1.0E-003 RCI-RESTART RESTART OF RCIC IS REQUIRED 2.0E-001
LER 278/04-001 Event Name Description Probability/
Frequency (per hour)
Modified 13 RCI-TDP-FR-TRAIN RCIC PUMP FAILS TO RUN GIVEN THAT IT STARTED 4.1E-003 RCI-TDP-FS-RSTRT RCIC FAILS TO RESTART GIVEN START AND SHORT-T 1.2E-002 RCI-TDP-FS-TRAIN RCIC PUMP FAILS TO START 6.0E-003 RCI-TDP-TM-TRAIN RCIC PUMP TRAIN IS UNAVAILABLE BECAUSE OF MAI 1.2E-002 RCI-XHE-XL-RSTRT OPERATOR FAILS TO RECOVER RCIC FAILURE TO RES 5.0E-001 RCI-XHE-XL-RUN OPERATOR FAILS TO RECOVER RCIC FAILURE TO RUN 5.0E-001 RCI-XHE-XL-START OPERATOR FAILS TO RECOVER RCIC FAILURE TO STA 5.6E-001 RCI-XHE-XM-RCOOL OPERATOR FAILS TO ESTABLISH ROOM COOLING WITH 1.0E-003 RCI-XHE-XO-ERROR OPERATOR FAILS TO START/CONTROL RCIC INJECTIO 1.0E-003 RHR-MDP-TM-TRNC RHR TRAIN C IS UNAVAILABLE BECAUSE OF MAINTEN 7.0E-003 RHR-XHE-XM-ERROR OPERATOR FAILS TO START/CONTROL RHR 5.0E-004 SPC-MOV-CC-F034B SP COOLING INJECT VALVE 10-34B FAILS TO OPEN 1.0E-003 SPC-MOV-CC-F039B SP COOLING INJECT VALVE 10-39B FAILS TO OPEN 1.0E-003 SPC-MOV-CF-INJEC SPC INJECTION VALVES FAIL BY COMMON CAUSE 2.7E-005
LER 278/04-001 14 Appendix A Event Tree Models Showing Dominant Accident Sequences
LER 278/04-001 15 Figure A-1 Loss of DC Bus
LER 278/04-001 16 Figure A-2 Loss of AC Bus
LER 278/04-001 17 Figure A-3 Loss of Condenser Heat Sink Event Tree
LER 278/04-001 18 Figure A-4 Loss of Main Feedwater Event Tree
LER 278/04-001 19 Figure A-5 Loss of Offsite Power Event Tree
LER 278/04-001 20 Figure A-6 Station Blackout Event Tree