ML062710037
| ML062710037 | |
| Person / Time | |
|---|---|
| Site: | Hope Creek  |
| Issue date: | 09/26/2006 |
| From: | Demoss G NRC/RES/DRASP/DDOERA/OEGI |
| To: | |
| References | |
| IR-04-013, LER 354-04-010 | |
| Download: ML062710037 (13) | |
Text
Final Precursor Analysis Accident Sequence Precursor Program -- Office of Nuclear Regulatory Research Hope Creek Nuclear Generating Station Manual Reactor Scram Due to Moisture Separator Reheater Drain Line Failure Event Date 10/10/2004 LER 354/04-010-00 IR 05000354/2004013 CCDP = 3.4 x 10-6 September 26, 2006 Event Summary Description. On October 10, 2004 at 17:39 hours a pipe failure occurred in the Moisture Separator Reheater Drain Line of the Hope Creek Nuclear Generating Station. (Reference 1)
The failure was annunciated by the Condenser Off-Gas Trouble Alarm at 17:39 and a Turbine Building Exhaust Radiation Monitoring System Alarm at 17:41. Investigations by plant personnel indicated the presence of steam at the 137' elevation level of the Turbine Building at 17:50 and increasing Condenser Off-Gas Flow at 17:51. A power reduction to 80% power was initiated at 17:59 due to reports of a steam leak in the Turbine Building. The 6A Feedwater Heater Extraction Steam Lines were isolated as the potential source of the steam leak, however, the steam leak continued. At 18:14, the Reactor Recirculation Pumps were reduced to minimum speed and the Reactor Mode Switch was locked in the shutdown position to initiate a Manual SCRAM. Immediately following the SCRAM, a Reactor Water Level 3 (+12.5") SCRAM Signal was received due to the post-trip water level shrinkage in the Reactor Pressure Vessel.
Operators initially began to reduce Reactor Pressure Vessel (RPV) pressure using the Turbine Bypass Valves to allow for use of the Condensate and Feedwater Pumps for RPV makeup.
During the pressure reduction, the B Reactor Water Cleanup (RWCU) System pump tripped.
Due to the continued degradation of condenser vacuum, the Reactor Feedwater Pumps all tripped. At this point, RPV makeup and pressure control was provided by manually initiating the High Pressure Coolant Injection (HPCI) and Reactor Core Isolation Cooling (RCIC) systems. At 18:17 hours, the control room supervisor directed the reactor operator to close the Turbine Bypass Valves. As the bypass valves closed, RPV level decreased to the Level 3 SCRAM setpoint (+12.5") and continued to trend downward. RCIC was manually controlled to restore proper RPV water levels. As the Turbine Bypass Valves continued to close, RPV level continued downward and reached the Level 2 setpoint (-38") on 2 of 4 RPV level indicators (A and B channels). As a result of the Level 2 setpoint being reached, the following additional equipment actuated:
C HPCI autostart and injection (HPCI was already operating in the manual mode)
C RWCU Isolation (closure of MOV BG-HV-F001)
C Reactor Recirculation Sample Line Isolation (closure of MOV BB-SV-4310)
C Drywell Sump Discharge Line Isolation (closure of MOVs HB-HV-F004 and HB-HV-F020)
C The A Channel 1E Breaker load shedding initiated resulting in the trip of the Emergency Air Compressor 10K100, Reactor Building Supply Fan 1BVH300, Reactor Building Exhaust Fan 1CV301, and Radwaste Exhaust Fan OAV305
C The B Channel 1E Breaker load shedding initiated resulting in the trip of the Reactor Building Exhaust Fan 1BVH301, Reactor Building Supply Fan 1CV301, and Radwaste Exhaust Fan OBV305 C
Filtration Recirculation Ventilation System (FRVS) vent fan AV206 started C
FRVS recirculation fans A213, B213,E213, and F213 started C
Drywell Leak Detection System Radiation Monitoring System Isolation (closure of MOVs SK-HV-5018 and SK-HV-4957)
C Torus Water Cleanup System (TWCU) Isolation (closure of MOVs EE-HV-4679, EE-HV-4652, EE-HV-4680, and EE-HV-4681; and trip of TWCU pump OP229)
C Primary Containment Instrument Gas (PCIG) to the Reactor Building suppression chamber vacuum breakers (N2 gas) isolated (closure of MOV KL-HV-5115)
With RCIC injecting into the RPV and water levels trendng upwards, HPCI injection was terminated. Condenser vacuum continued to degrade and operators manually closed the Main Steam Isolation Valves (MSIVs) and Main Steam Line Drain Valves prior to automatic closure on low condenser vacuum. Following MSIV closure, the HPCI was placed in the pressure control mode. While placing the HPCI in the pressure control mode, operators were initially unable to open the HPCI full flow test line MOV. At 18:31 hours, the A and B Residual Heat Removal (RHR) trains were placed in the Suppression Pool Cooling mode. At 18:45 hours, the Reactor Protection System (RPS) SCRAM signal was reset, but at 18:46 hours, RPV level dropped and the RPV Level 3 SCRAM setpoint was again actuated. RCIC flow was manually increased to restore water levels above the RPV Level 3 SCRAM setpoint. Following this, at approximately 18:50 hours the feedwater system was restarted (with flow being provided by the Condensate pumps) with the startup feedwater level control valve set in the automatic mode.
At 20:48 hours the operators commenced a plant cooldown using HPCI, RCIC and Safety/Relief Valves (SRVs). This effort was complicated by repeated trips which occurred in the HPCI barometric vacuum pump, a non-safety support system which maintains a slight vacuum on the HPCI steam discharge line. This lead operators to secure the HPCI system and rely on a combination of SRVs and RCIC to maintain RPV level and depressurize the system.
At approximately 22:03 hours the RPS Level 3 was again reset and feedwater startup level control valve setpoint raised from 25" to 35" (with flow being provided by the Condensate Pumps). The plant reached cold shutdown conditions at 05:09 hours on October 12, 2004.
Cause. The MSR drain line failure occurred where an 8" line enters the condenser. A crack occurred at the toe of the fillet weld of an encapsulation that was used to repair a crack that occurred in 1988. Metallurgical analysis performed on the failed pipe section identified the predominant fracture mode as fatigue. The root cause of the MSR drain line failure was a failed open air operated Moisture Separator Drain Valve 1ACLV-1039A. After this valve failed open, and remained in this state for approximately 25 days (References 1,2), high flow and vibration levels existed through the valve. The initial failure of valve 1ACLV-1039A was caused by a pipe hanger that had become disconnected from a threaded eye nut and came to rest on the instrument tubing tray that supplied instrument air to valve 1ACLV-1039A.
The root cause (References 1,2) of the observed failures of the non-safety-related HPCI barometric pressure vacuum pump was determined to be a maintenance error. A thread sealant was utilized in place of the manufacturers recommended multi-purpose lithium grease lubricant on the pump shaft. A similar pump trip problem was observed on July 6, 2004 but not properly diagnosed and corrected. The exact date at which the improper lubricant was applied is not known. Reference 2 also indicated that the same thread sealant was also
applied to the vacuum pump on the RCIC system - but that it continued to function throughout the October 10, 2004 event without binding up.
Recovery Opportunity.
The HPCI system was manually shutdown because a non-safety-related auxiliary system was not working. HPCI could have be recovered if necessary for providing high pressure RPV makeup. The purpose of the barometric condenser and vacuum pump is to prevent the buildup of condensation in the HPCI turbine steam outlet line. The safety evaluation contained in the Hope Creek Nuclear Generating Station Safety Analysis Report indicates that the HPCI hogging pump or vacuum pump is not safety related and its failure does not prevent operation of the HPCI. (References 2, 3) Operators shut down the HPCI during the event because other high pressure RPV makeup sources were available. In the event RCIC failed, the HPCI could have been restarted and run indefinitely without the vacuum pump in operation.
Recovery of the Main Condenser was not possible. The Main Condenser vacuum degraded continuously throughout the event because of the pipe failure between the MSR and the condenser bay permitted air ingress. Condenser vacuum could not be maintained by the normal air ejector or hogging pump operation (Reference 2) and thus operator recovery of condenser vacuum, and subsequent use of the Main Condenser as a long term heat sink was not possible.
Other Related Conditions or Events During the Condition Period. No other significant overlapping condition was identified for Hope Creek during the interval.
Analysis Results C
Importance The parameter of interest in this evaluation is the conditional probability of core damage (CCDP) for an event involving a transient with subsequent non-recoverable loss of the Main Condenser. The results of an uncertainty assessment on the CCDP are summarized in the following table.
CCDP 5%
Mean 95%
Hope Creek 4.7x10-8 3.4x10-6 1.2x10-5 C
Dominant Sequences The actual event sequence and the dominant accident sequence are shown in Figure A-1 of Appendix A. The actual sequence of events is best characterized by TRAN Sequence 2. There is one dominant accident sequence: TRAN Sequence 10, which accounts for 82% of the CCDP.
The dominant accident sequence involves the transient occurring with successful reactor shutdown, the subsequent loss of the main condenser and feedwater system, successful operation of either HPCI or RCIC, the failure of the suppression pool cooling mode of RHR and containment spray, successful manual depressurization, but successive failure of shutdown cooling, long term power conversion system recovery (which cannot be accomplished due to the vacuum problem), failure of containment venting and failure of late injection. This would result in a core damage sequence with the RPV at reduced pressure but with the suppression pool at elevated temperature and pressure.
C Results Tables The conditional probabilities for the dominant sequences are shown in Table 1.
The event tree sequence logic for the dominant sequences are presented in Table 2a.
Table 2b defines the nomenclature used in Table 2a.
The most important cut sets for the dominant sequences are listed in Table 3a and 3b.
Definitions and probabilities for modified or dominant basic events are provided in Table 4.
Modeling Assumptions C
Analysis Type This event is analyzed as a General Transient event with a subsequent loss of the Main Condenser during the plant cooldown. The sequence was analyzed using the GEM event analysis option.
C Unique Design Features Hope Creek is a standard General Electric Co. BWR-4 with a Mark I Containment. As such it relies on a combination of High Pressure Coolant Injection (HPCI) and Reactor Core Isolation Cooling (RCIC) for high pressure RPV makeup. One unique feature of the Hope Creek BOP design is the use of 4 safety electrical buses powered by 4 separate emergency diesel generators.
C Modeling Assumptions Summary Key modeling assumptions. The key modeling assumptions are listed below and discussed in detail in the following sections. These assumptions are important contributors to the overall risk.
C The barometric vacuum pumps on both the HPCI and RCIC systems are not safety related and their failure will not lead to common cause failure of HPCI and RCIC. The NRC Inspection Report (Reference 2) noted that the incorrect lubricant applied to the HPCI vacuum pump was also applied to the RCIC vacuum pump. Although this would imply a potential common cause failure coupling between the two systems, because the support systems are not
essential to successful HPCI and RCIC operation, no common cause failure adjustment was made to the SPAR Model (Reference 4).
C The HPCI was available, if needed, throughout the transient. The LER noted (Reference 1) that HPCI was manually shutdown by the operators due to repeated trips of the non-safety-related HPCI barometric condenser vacuum pump. This was because there was no need to run both HPCI and RCIC, and that RCIC was fully operable (including all non-safety related support systems).
C The Main Condenser and Feedwater System operated for approximately 38 minutes post-trip and provided RPV makeup and decay heat removal.
During this period operators attempted to get RPV pressure below the level where condensate pumps alone could be used to provide RPV makeup. The continuing degradation in condenser vacuum ultimately lead to tripping of all 3 feedwater pumps and a decision to close the Turbine Bypass Valves and the Main Steam Isolation Valves (MSIVs) before they were closed automatically. The event being analyzed is thus modeled as a General Transient with a subsequent loss of the condenser. To model this scenario, initiating event IE-TRANS and basic event: MSS-MSV-OC-STEAM were set TRUE to reflect a transient with subsequent MSIV closure. All other initiating events were set FALSE.
C Recovery of the Main Condenser was not possible. Condenser vacuum could not be maintained by normal air ejector or hogging pump operation (Reference
- 2) and thus operator recovery of condenser vacuum, and subsequent use of the Main Condenser as a long term heat sink was not possible. To model this non-recoverable situation, basic event: PCS-XHE-XL-LTTRAN was set TRUE.
C Fault Tree Modifications No fault tree, or sequence recovery rules, were changed in this analysis.
C Basic Event Probability Changes Three changes were made to the Base Case SPAR Model (Reference 4) Basic Event probabilities. These are summarized below.
C IE-TRANS was changed from 8.0E-001 to TRUE to model the occurrence of a general transient initiating event. All other initiating event frequencies were set FALSE.
C MSS-MSV-OC-STEAM was changed from 7.2E-006 to TRUE, reflecting a situation that with degrading condenser vacuum MSIVs would close either by operator action (as actually occurred) or when protective limits were reached on low condenser vacuum and an automatic closure actuated.
C PCS-XHE-XL-LTTRAN was changed from 3.4E-001 to TRUE, reflecting the situation where it was not possible to recover the Main Condenser because air ingress from the failed MSR piping caused a loss of condenser vacuum.
C Sensitivity Analyses An importance analysis was conducted on the CCDP results to identify parameters whose values significantly effect the CCDP results. Two importance measures were utilized: Fussel-Vesely and the Risk Increase Ratios (Reference 5). The Fussel-Vesely importance identifies and ranks basic events based on the CCDP sensitivity to small changes. The Risk Increase importance identifies and ranks basic events having the greatest impact on CCDP if the component changes from a nominal failure probability to a failed state. Six basic events were identified in the top 20 list for both importance measures. These basic events are:
Basic Event Description Base Value RHR-XHE-XE-ERROR Operator fails to start/control RHR 5.0E-004 CVS-XHE-XE-HYDR Operator fails to vent containment using hydraulic pump 1.0E-001 CVS-XHE-XE-VENT2 Operator fails to vent containment (dependent) 5.1E-002 CVS-AOV-CC-OUTER Vent Valve GSHV-11541 fails to open 9.0E-004 CVS-AOV-CC-INNER Vent Valve GSHV-4964 fails to open 9.0E-004 CVS-AOV-CC-N2LIN Nitrogen supply line fails 9.0E-004 Sensitivity analyses were performed to determine the effects of uncertainties in these parameters on CCDP results based on best estimate assumptions. The table below provides the results of the sensitivity analyses.
Parameter Modification CCDP RHR-XHE-XE-ERROR Increased by x5 CCDP = 1.4 x 10-5 CVS-XHE-XE-HYDR Not credited (1.0)
CCDP = 2.8 x 10-5 CVS-XHE-XE-VENT2 Increased by x5 CCDP = 1.4 X 10-5 CVS-AOV-CC-OUTER, CVS-AOV-CC-INNER, CVS-AOV-CC-N2LIN Increased by x5 CCDP = 3.6 x 10-6 The overall CCDP result is most sensitive to the first three basic events studied. These events appear in the single dominant accident sequence which accounts for 82% of the CCDP result. The result is thus very sensitive to a modeling assumption related to sequence recovery rules implemented to deal with multiple dependent human error.
Considering the assumptions underlying the analysis, which is a loss of secondary side heat sink, the sensitivity of RHR cooling and containment venting is not surprising.
References
- 1.
James Hutton (PSEG Nuclear LLC), Manual Reactor Scram Due to Moisture Separator Drain Line Failure, LER 354/04-010-00 issued December 9, 2004.
- 2.
Wayne D. Lanning (NRC), HOPE CREEK NUCLEAR GENERATING STATION - NRC SPECIAL INSPECTION TEAM REPORT NO. 05000354/2004013 AND PRELIMINARY WHITE FINDING, issued February 4, 2005.
- 3.
Section 6.3.2.2.1 - High Pressure Coolant Injection System, p. 6.3-14, Hope Creek Nuclear Generating Station - Updated Final Safety Analysis Report (UFSAR), Revision 13, issued November 14, 2003.
- 4.
Idaho National Laboratory, Standardized Plant Analysis Risk Model for Hope Creek (ASP BWR C), Revision 3.21, issued October 28, 2005
- 5.
SAPHIRE TECHNICAL REFERENCE, Systems Analysis Program for Hands-on Integrated Reliability Evaluations (SAPHIRE), Version 7.26, Technical Reference Manual, Idaho National Engineering Laboratory.
Table 1. Conditional core damage probabilities of dominating sequences.
Event tree name Sequence no.
CCDP1 Contribution TRAN 10 2.8 x 10-6 82%
TRAN 35 4.5 x 10-7 13%
Total (all sequences)2 3.4 x 10-6 100%
- 1. Values are point estimates.
- 2. Total CCDP includes all sequences (including those not shown in this table).
Table 2a. Event tree sequence logic for dominant sequence.
Event tree name Sequence no.
Logic
(/ denotes success; see Table 2b for top event names)
TRAN 10
/RPS /SRV PCS /HPI SPC CSS /DEP SDC PCSR CVS LI02 TRAN 35
/RPS /SRV PCS HPI DEP Table 2b. Definitions of top events listed in Table 2a.
Top Event Definition RPS Reactor Protection System is unavailable SRV One or More Safety/Relief Valves fails to close PCS Power Conversion System HPI High Pressure Injection (HPCI and RCIC)
SPC Suppression Pool Cooling Mode of RHR CSS Containment Spray DEP Manual Depressurization SDC Shutdown Cooling PCSR Power Conversion System Recovery CVS Containment Venting LI02 Late Injection is Unavailable (Containment Failure)
Table 3a. Conditional cut sets for the dominant sequences.
CCDP Percent Contribution Minimum Cut Sets (of basic events)
Event Tree:
TRAN Sequence 10 2.6E-005 92.38 RHR-XHE-XE-ERROR CVS-XHE-XE-VENT2 CVS-XHE-XE-HYDR 4.5E-007 1.63 RHR-XHE-XE-ERROR CVS-AOV-CC-OUTER CVS-XHE-XE-HYDR 4.5E-007 1.63 RHR-XHE-XE-ERROR CVS-AOV-CC-N2LIN CVS-XHE-XE-HYDR 4.5E-007 1.63 RHR-XHE-XE-ERROR CVS-AOV-CC-INNER CVS-XHE-XE-HYDR 2.8E-006 100.0 Total (all cutsets)1 Table 3b. Conditional cut sets for the dominant sequences.
CCDP Percent Contribution Minimum Cut Sets (of basic events)
Event Tree:
TRAN Sequence 35 7.0E-008 15.45 ADS-XHE-XE-MDEPR RCI-XHE-XO-ERROR HCI-XHE-XO-ERROR1 4.2E-008 9.27 ADS-XHE-XE-MDEP HCI-TDP-TM-TRAIN RCI-TDP-FS-TRAIN 4.2E-008 9.27 ADS-XHE-XE-MDEP RCI-TDP-TM-TRAIN HCI-TDP-FS-TRAIN 4.5E-007 100.0 Total (all cutsets)1
- 1. Total Importance includes all cutsets (including those not shown in this table).
LER 354/04-010 10 Table 4. Definitions and probabilities for modified or dominant basic events Event Name Description Probability/
Frequency (per hour)
Modified IE-HCI-V-A HPCI ISOLATION VALVE OPENS FALSE YES IE-HCI-V-B HPCI ISOLATION VALVE OPENS FALSE YES IE-IORV INADVERTENT OPEN RELIEF VALV FALSE YES IE-LCS-V-A CORE SPRAY LOOP A ISOLATION FALSE YES IE-LCS-V-B CORE SPRAY LOOP B ISOLATION FALSE YES IE-LLOCA LARGE LOCA INITIATOR FALSE YES IE-LOCHS LOSS OF CONDENSER HEAT SINK FALSE YES IE-LOMFW LOSS OF MAIN FEEDWATER INITI FALSE YES IE-LOOP LOSS OF OFFSITE POWER FALSE YES IE-LOSWS LOSS OF SERVICE WATER SYSTEM FALSE YES IE-MLOCA MEDIUM LOCA INITIATOR FALSE YES IE-RCI-V RCIC ISOLATION VALVE OPENS FALSE YES IE-RHR-V-A RHR LOOP A ISOLATION VALVE O FALSE YES IE-RHR-V-B RHR LOOP B ISOLATION VALVE O FALSE YES IE-RHR-V-C RHR LOOP C ISOLATION VALVE O FALSE YES IE-RHR-V-D RHR LOOP D ISOLATION VALVE O FALSE YES IE-RHR-V-RA RHR LOOP A ISOLATION VALVE O FALSE YES IE-RHR-V-RB RHR LOOP B ISOLATION VALVE O FALSE YES IE-RHR-V-S SDC ISOLATION VALVE OPENS FALSE YES IE-SLOCA SMALL LOCA INITIATING EVENT FALSE YES IE-TRANS TRANSIENT TRUE YES MSS-MSV-OC-STEAM STEAM ISOLATION VALVES FAIL TRUE YES PCS-XHE-XL-LTTRAN OPERATOR FAILS TO RECOVER PC TRUE YES CVS-AOV-CC-INNER VENT VALVE GSHV-4964 FAILS TO OPEN 9.0E-004 CVS-AOV-CC-N2LIN NITROGEN SUPPLY LINE FAILS 9.0E-004 CVS-AOV-CC-OUTER VENT VALVE GSHV-11541 FAILS TO OPEN 9.0E-004 CVS-XHE-XE-HYDR OPERATOR FAILS TO VENT CONTAINMENT USING HYDRAULIC PUMP 1.0E-001 CVS-XHE-XE-VENT2 OPERATOR FAILS TO VENT CONTAINMENT (DEPENDENT 5.1E-002 RHR-XHE-XE-ERROR OPERATOR FAILS TO START/CONTROL RHR 5.0E-004 ADS-XHE-XE-MDEPR OPERATOR FAILS TO DEPRESSURIZE THE REACTOR 5.0E-004 HCI-TDP-FR-TRAIN HPCI PUMP TRAIN FAILS TO RUN GIVEN IT STARTED 5.4E-003
LER 354/04-010 Event Name Description Probability/
Frequency (per hour)
Modified 11 HCI-TDP-FS-TRAIN HPCI PUMP FAILS TO START 7.0E-003 HCI-TDP-TM-TRAIN HPCI TRAIN IS UNAVAILABLE BECAUSE OF MAINTENA 1.2E-002 HCI-XHE-XO-ERROR1 OPERATOR FAILS TO START/CONTROL HPCI INJECTIO 1.4E-001 RCI-TDP-FR-TRAIN RCIC PUMP FAILS TO RUN GIVEN THAT IT STARTED 5.4E-003 RCI-TDP-FS-TRAIN RCIC PUMP FAILS TO START 7.0E-003 RCI-TDP-TM-TRAIN RCIC PUMP TRAIN IS UNAVAILABLE BECAUSE OF MAI 1.2E-002 RCI-XHE-XO-ERROR OPERATOR FAILS TO START/CONTROL RCIC INJECTIO 1.0E-003
LER 354/04-010 12 Appendix A Hope Creek Transient Event Tree Model Showing Dominant Accident Sequence
LER 354/04-010 13 Figure A-1 Transient Event Tree