ML15014A084

NRC ANO Unit 1 Stator Drop SDP Evaluation

ML15014A084
Person / Time
Site:	Arkansas Nuclear
Issue date:	01/14/2015
From:	Jeffrey Mitman NRC/NRR/DRA
To:
Weerakkody S, NRR/DRA
References
Download: ML15014A084 (22)

Text

Significance Determination Process Evaluation of ANO Unit 1 Stator Drop & Loss of SDC EPRI Configuration g Risk Management g Forum January 14, 2015 Jeff Mitman Senior Reliability and Risk Analyst US NRC Office of Nuclear Reactor Regulation Division of Risk Assessment

Overview

• On March 31st 2013 ANO Unit 1 (ANO1) lost shutdown cooling (SDC) during an outage

- Event was caused by dropping main generator stator (~525 tons)

- Stator drop damaged beyond repair both non-safety 4.16kV safety buses which were normal and only path for offsite power to unit safety buses

- EDG 1 auto started immediately as designed, EDG 2 auto started after short delay (~10 seconds)

• Delay due to outage alignment of DC power, power battery 2 was out of service, service train 2 DC power was being supplied by a train 1 power battery charger

• Cavity was flooded

• 7days into refueling outage

- Time to boil (TTB) ~12 hours

- Time to core un-covery (TTCU) ~ 4.8 days based on licensee calculation 2

Plant Conditions Prior to Event

• Both trains of reactor shutdown cooling (SDC) were in service

• Plant electrical lineup was in a plant shutdown configuration to support maintenance and testing as follows:

- 4160 Volt non-safety bus A2 was de-energized

- Safety y related 4160 Volt Buses A3 and A4 were cross tied and supplied power via Non-safety related 4160 Volt bus A1

- Train 2 (Green) battery D06 disconnected from D02 bus

- D04 battery charger supplied from Swing MCC B56 to provide power to Green train DC bus D02.

• Therefore, train 2 DC was being supplied via train 1 AC and if train 1 AC failed so would train 2 DC (which is required for train 2 EDG to start)

• Both licensees PRA and NRCs SPAR system models modified to reflect these unusual lineups 3

Mitigation Capability Status after Event

• Both emergency EDGs operating

- Note: EDG 2 did not start until EDG 1 started and restored DC control power to EDG 2 (it was delayed by ~10 seconds)

• SBO EDG was unavailable as its cabling into Unit 1 was severed by load drop

• After event initiation, following equipment was available assuming i electrical l t i l power was restored:

t d

- Both LPI/SDC pumps

- All three trains HPI

• Fire water unavailable after load drop due to severance of fire water header - fire water primary source for B5b

• Gravity feed unavailable as water level in BWST was lower than water level in flooded RCS 4

5

Loss of Offsite Power (LOOP) ET LOOP Event Occurs EMERGENCY POWER OPERATOR FAILS TO DIAGNOSIS LOSS OF Recover RHR/SDC Gravity or Forced Feed GRAVITY FEED (without LOW PRESSURE BWST REFILL OPERATOR FAILS TO LATE RECOVERY OF # End State during Mode 6 AVAILABLE RECOVER OFFSITE RHR/DHR BEFORE DURING SHUTDOWN (with AC power) after AC Power) before TAF RECIRCULATION during RECOVER EMERGENCY SDC/DHR COOLIING (Phase - CD)

POWER IN 72 HOURS BOILING (11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br />) before Boiling (11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br />) Loss of SDC/DHR Shutdown DIESEL IN 96 HOURS IE-M6-LOOP IE M6 LOOP EPS OPR-72H OPR 72H LORHR-D LORHR D SDC-REC SDC REC MINJ G-FEED G FEED LPR-SD LPR SD REFILL DGR-96H DGR 96H LTREC 1 OK 2 OK 3 OK 6 Days 4 CD LTREC-6D 4E-4 5 OK 5 Days 6 CD LTREC-5D 7 OK 4 Days 8 CD 9 OK 10 OK 6 Days 11 CD LTREC-6D 2E-5 12 OK 5 Days 13 CD LTREC-5D C

14 OK 4 Days 15 CD Undeveloped Branch as Probability is 0.0 16 OK 0% (Undeveloped branch as given failure) 17 OK 9.15E-3 100%

18 O OK 100 %

4E-2 4 Days 19 CD 8

CCDP Risk Results without Mi i i C Mitigation Credit di LOOP CCDP Results Point Estimate Sequence Using Revised Time to Core Uncovery 4 1.6E-05 6 2.1E-08 8 3 3E 07 3.3E-07 11 1.0E-07 13 4.3E-09 15 7 2E 09 7.2E-09 19 2.4E-04 Total 2.6E-04

• Any releases A l wouldld b be greater t th than 8 ddays after ft shutdown, h td th therefore f no LERF input

• These results are after crediting licensees revised TTB and TTCU 9

Dominant Sequence

• Sequence 19 is the major contributor

- Sequence 4 secondary contributor

• Initiating event occurred (frequency = 1.0)

• Failure of EDGs: ~9E-3 9E 3

• Failure to recovery offsite power: 1.0 (initially no credit for mitigation)

• Failure of gravity feed: 1 1.0 0

- Gravity feed would not work because level in the cavity was higher then level in BWST

• Failure to recover EDGs in four days: ~4E ~4E-2 2

- Based on standard INL analysis of industry data on offsite power recovery event 10

Time/Recovery Considerations

• Shortest time to core uncovery was about 4.8 day

• If EDGs or SDC/DHR fail there was significant time to recover

- These recoveries where explicitly modeled based on well established data and associated models that are built into SAPHIRE

- These recoveries were quantified

• Additionally, other mitigating strategies could and would be tried (e.g., B.5.b)

- Appropriately quantifying these methods is difficult -

quantification was not performed as part of this analysis

- It is NRCs p position that none of current human reliability y analysis (HRA) methods were intended to quantify these types of actions

- If SPAR-H were used ((it was not)) it would yyield results in failure probabilities in range of 0.1 to 0.5 11

Licensee Recovery Approaches

• Proposed three methods to recover power from switchyard to 4160V safety buses

- Cable from startup 1 transformer to bus 1A3

- Cable from alternate SBO diesel generator breaker to bus 1A3

- Cable from Unit 2 non-vital switchgear to bus 1A3

• Proposed single method to recover forced flow makeup capability

- 480V cable between B51 and B21 buses to p power boric acid recirculation pump (P66) and spent fuel pool pump (P40A)

- As there were would be no problems with injection other than lack of electrical power, this looks like power recovery at 480V vs. 4160V

• Even though licensee never fully developed methods - they appear viable

- This is supported by licensees ability to complete cabling between switchyard i h d and d safety f b buses iin 4 4.4 4hhours 12

Licensees Licensee s Recovery Analysis

• Licensee believes that recovery can be modeled using HRA

• Divided human error p probabilities ((HEPs)) into 3 components p

- Cognitive/decision making - used standard HRA (EPRI HRA Calculator) methods

- Execution - used standard HRA methods

- Design development - no standard tools applicable, therefore, used EPRI SHARP1 (TR-101711, 1992)

• Standard resources (in HRA terminology: performance shaping factors) available:

- Time, personnel, cable, cues, etc.

- However, two were not: procedures & training

• Because of lack of p procedures and training g all current HRA would conclude probability of failure is very high

- Human factors (HF) analysis would conclude actions not feasible

• This is why licensee used EPRIs SHARP1 methodology - its only method that allows recovery without procedures and training

- SHARP1 rarely used - not included in EPRIs own HRA Calculator 13

Licensees SHARP1 Analysis of D i Development Design D l

• Structure is from EPRI SHARP1

• Values circled in red are licensees interpretation/implementation of EPRI method 14

Licensees Licensee s Recovery Results Licensees Licensee s Power Recovery FT

• Li Licensees results:

lt 3 3.1E-2 1E 2

• Dominated by SHARP1 results of 3E-2 3E 2

• Identical approach for recovery of forced flow

NRCs Current Regulatory Position on Credit C di ffor R Recovery S Strategies i

• RIS 2008-15 NRC Staff Position on Crediting Mitigating Strategies Implemented in Response to Security Orders in Risk-Informed Licensing Actions & in SDP, ADAMS Ascension ML080630025

• Supplies guidance on when & how to apply credit in SDP

• Incorporation of manual actions actions, special equipment operation operation, or other non-standard actions into risk assessment needs to meet current consensus PRA standards, as endorsed by RG 1.200 guidance

- Manual actions must be included in plant procedures

- Staff be trained to perform actions

• Licensee did not and does not have strategies (equipment, procedures or training) to cover these scenarios

• Therefore, per RIS no credit is warranted

• Previous flooding SDP gave no credit for multi-day scenario

• However given that this is four day sequence is this However, realistic/appropriate?

16

NRC Recovery Probability C

Conclusion l i

• Input: Over 4 days available for recovery, therefore, some credit is warranted

• There is basis for no credit in standard HRA and HF when no procedures and training: RIS 2008-15: Without procedures and training any recovery lacks l k standard t d d assurances and d credibility dibilit

• EPRIs SHARP1 method is stretch

- Only method that credits no procedures and training

- No development since 1992 and apparently no use since then

• NRC believes a ~90% chance of success

- Based on engineering experience and judgment

- Insights from licensees SPARP1 analysis

- Given no procedures & no training

- Adequate supplies and personnel

- 3 to 4 day to complete task with 4 to 5 days time available 17

Flooding Sensitivity Case

• Internal flooding did occur due to fire header rupture

• S Some water did accumulate l iin LPI/SDC/DHR pump vault l

but did not impact pumps

• Added basic event to corresponding system models to add p probability y of losing g train due to flooding g-probabilities of 0.1 and 1.0 were tested Note 1: Model was actually run by setting probability to True 18

Conclusion

• If mitigating strategies were not credited credited, finding was Red

• However, However NRC did credit mitigating strategies despite challenges

• Final Fi l d determination t i ti resulted lt d iin a Y Yellow ll finding 19

Backup Slides Unit 1 20

Electrical Layout Prior to Event Dominant HRA Results Human Mean Mean Total Time Time Error Description Diagnosis Action Mean Needed Available Event HEP HEP HEP Operator Fails to 5

SD-XHE-D-LOSDC Diagnose Loss of SDC 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> 2E-5 n/a 2E-5 minutes before boiling Operator Fails to Recover 30 SD-XHE-XL-LOSDC Loss of SDC before 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> n/a 4E-4 4E-4 minutes Boiling Operator Fails to Inject 30 SD-XHE-XL-MINJ (AC power available) 3 days n/a 2E-5 2E-5 minutes before Level Reaches TAF Operator Fails to Initiate SD-XHE-XL-LPR 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> 4.8 days 2E-5 2E-4 2.2E-4 Low Pressure Recirc Operator Fails to Refill SD-XHE-XM-BWST 10 hour1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> 4.8 days n/a 2E-5 2E-5 BWST during Shutdown Operator Action to Align DCP-XHE-XM-125VDC Panel D11 to 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> 4 hours 2E-3 2E-3 4E-3 DD11D12 Feed 125VDC Panel D21 22