ML17319B035
| ML17319B035 | |
| Person / Time | |
|---|---|
| Site: | Arkansas Nuclear  |
| Issue date: | 01/12/2018 |
| From: | Ian Gifford NRC/RES/DRA/PRB |
| To: | Plant Licensing Branch IV |
| Ian Gifford | |
| Shared Package | |
| ML18009A804 | List: |
| References | |
| LER 313-2017-001 IR 2017002 | |
| Download: ML17319B035 (11) | |
Text
Final ASP Program Analysis - Precursor Accident Sequence Precursor Program - Office of Nuclear Regulatory Research Arkansas Nuclear Automatic Start of an Emergency Diesel Generator Following a One - Unit 1 Partial Loss of Offsite Power due to Severe Weather LER: 313-2017-001 Event Date: 04/26/2017 CCDP= 1x10-5 IR: 05000313/2017002 Plant Type: Pressurized Water Reactor (PWR); Babcock & Wilcox Two-Loop with a Large, Dry Containment Plant Operating Mode (Reactor Power Level): Mode 1 (100% reactor power)
Analyst: Reviewer: Contributors: Approval Date:
Ian Gifford Christopher Hunter N/A 12/06/2017 EXECUTIVE
SUMMARY
On April 26, 2017, at 11:02 a.m., with the Arkansas Nuclear One, Unit 1 (ANO-1) reactor operating at 100 percent rated thermal power and Unit 2 (ANO-2) in the midst of a refueling outage, high winds damaged transmission towers approximately 16 miles away from the site resulting in ground faults. These faults resulted in the opening of switchyard breakers for the 500 kilovolt (kV) lines to the Fort Smith and Mabelvale substations. The 500 kV transmission line to the Pleasant Hill substation was out of service for planned maintenance. The loss of all offsite power to the 500 kV bus resulted in a lock out of the autotransformer connecting the 500 kV and 161 kV buses. The autotransformer lock out caused losses of power to startup transformer (SUT) 1 and SUT 3, which normally supply power to ANO-1 and ANO-2, respectively. Power to the 161 kV bus was maintained through separate transmission lines, resulting in power supply to SUT 2 (the swing transformer). During transfer to the non-preferred power source, SUT 2, many loads powered from buses A1 and A3 were de-energized.
Emergency diesel generator (EDG) 1 started in response to the loss of power to bus A3; however, offsite power was restored to the bus via a successful slow transfer to SUT 2 before the EDG was aligned to bus A3. EDG 2 started and re-energized bus A4 as expected. ANO-1 was stabilized in Mode 3 with emergency feedwater (EFW) pumps supplying the steam generators and maintaining water level at the natural circulation setpoint. Offsite power through the 500 kV transmission lines was restored on May 9th.
This event was modeled as a loss of condenser heat sink initiating event with a partial loss of offsite power. Given the modeling assumptions used in this analysis, the conditional core damage probability (CCDP) was calculated to be 1x10-5, which is a precursor in the Accident Sequence Precursor (ASP) Program. The most likely core damage sequence involves the failure of EFW, and the subsequent failure to initiate feed and bleed cooling. This accident sequence accounts for approximately 94 percent of the event CCDP.
EVENT DETAILS Event Description. On April 26, 2017, at 11:02 a.m., with the ANO-1 reactor operating at 100 percent rated thermal power and ANO-2 in the midst of a refueling outage, high winds damaged transmission towers approximately 16 miles away from the site resulting in ground faults. These faults resulted in the opening of switchyard breakers for the 500 kV lines to the Fort Smith and Mabelvale substations. The 500 kV transmission line to the Pleasant Hill substation was out of service for planned maintenance. The loss of all offsite power to the
LER 313-2017-001 500 kV bus resulted in a lock out of the autotransformer connecting the 500 kV and 161 kV buses. The autotransformer lock out caused losses of power to SUT 1 and SUT 3, which normally supply power to ANO-1 and ANO-2, respectively. Power to the 161 kV bus was maintained through separate transmission lines, resulting in power supply to SUT 2 (the swing transformer).
When the 500 kV switchyard breakers opened, the load rejection was sensed by the main turbine and all governor valves closed. However, without 500 kV power, the generator output breakers did not open and plant loads remained powered from the main generator through the unit auxiliary transformer (UAT). Approximately 8 seconds after the load rejection, operators manually tripped the reactor. The turbine tripped immediately following the manual reactor trip, which caused the UAT to trip.
Following the reactor and turbine trips, the loads for buses A1 and A3 should have automatically undergone fast transfer to the non-preferred power source, SUT 2.1 However, the frequency difference between bus A1 and SUT 2 prevented a fast transfer and many loads powered from buses A1 and A3 were de-energized. EDG 1 started in response to the loss of power to bus A3; however, offsite power was restored to the bus via a successful slow transfer to SUT 2 before the EDG was aligned to bus A3. EDG 2 started and re-energized bus A4 as expected.
ANO-1 was stabilized in Mode 3 with EFW pumps supplying the steam generators and maintaining water level at the natural circulation setpoint. Offsite power through the 500 kV transmission lines was restored on May 9th.
Additional information is provided in licensee event report (LER) 313-2017-001 (Ref. 1) and inspection report (IR) 05000313/2017002 (Ref. 2).
Cause. High wind damage to the 500 kV offsite transmission lines caused ground faults that led to the partial loss of offsite power.
Additional Plant Information. During normal operation of ANO-1, station equipment is supplied from the main generator through the UAT. During startup and shutdown conditions, station equipment is supplied from the offsite utility grid through SUT 1 (preferred) or SUT 2 (non-preferred). Following a turbine generator trip, station loads are designed to automatically fast transfer to SUT 1 or SUT 2 without a loss of power to the plant loads. The UAT and SUT 1 are capable of providing power to all four Unit 1, 4.16 kV buses (A1, A2, A3, and A4). Because SUT 2 is shared between both units, it is only aligned to automatically power buses A1 and A3.
If all normal and offsite power sources are lost, engineered safety feature (ESF) buses A3 and A4 are powered by their respective EDGs. As a final protection in the event of a station blackout, power to the ESF buses can be provided by the alternate AC diesel generator. A simplified electrical diagram is shown in Figure 1.
1 The preferred power source, SUT 1, did not have power due to the autotransformer lock out.
2
LER 313-2017-001 Figure 1. ANO-1 Simplified Electrical Diagram.
Additional Event Information. Approximately 2 seconds after the load rejection, voltage fluctuations caused control rod safety groups 1-4 to drop fully into the core, while regulating groups remained in their partially withdrawn position. The voltage fluctuations were caused by failure to open the generator output breakers following the lead rejection. Control rod regulating groups dropped fully into the core after the manual reactor trip. The premature insertion of control rod safety groups 1-4 was not modeled in this analysis because the rods dropped fully into the core, while the regulating rods remained responsive to a trip signal. Therefore, the reactor protection system was able to fulfill its safety function.
MODELING Basis for ASP Analysis/SDP Results. The ASP Program performs independent analyses for initiating events. ASP analyses of initiating events account for all failures/degraded conditions and unavailabilities (e.g., equipment out for test/maintenance) that occurred during the event, regardless of licensee performance.2 This event is discussed in IR 05000313/2017002; however, the LER remains open. No performance deficiency has been identified to date.
Analysis Type. An initiating event analysis was performed using the Arkansas 1 standardized plant analysis risk (SPAR) test/limited use model, created on September 7, 2017.
2 ASP analyses also account for any degraded condition(s) that were identified after the initiating event occurred if the failure/degradation exposure period(s) overlapped the initiating event date.
3
LER 313-2017-001 SPAR Model Modifications. When the UAT is not supplying station loads, SUT 1 is the preferred power source for buses A1, A2, A3, and A4. SUT 2 provides the non-preferred source when SUT 1 is not available. However, given the shared alignment of SUT 2 between both units, SUT 2 is only aligned to automatically power buses A1 and A3 for ANO-1. The following model modifications were made to address this alignment:
- In the fault tree ACP-1A1 (failure of AC power from the switchgear 1A1), house event HE-LOOP-A (house event: LOOP occurrence) was inserted under the OR gate ACP-A1-4 (failure of AC power from offsite (SUT 1)). This modification is shown in Figure B-1.
- In the fault tree OEP-1A1 (failure of offsite power to switchgear A1), house event HE-LOOP-A was inserted under the OR gate OEP-1A1-5 (failure of AC power from offsite (SUT 1)). This modification is shown in Figure B-2.
- In the fault tree ACP-1A2 (failure of AC power from switchgear A2), house event HE-LOOP-B (house event: LOOP occurrence) was inserted under OR gate ACP-A2-3 (failure of AC power from SUT 1). This modification is shown in Figure B-3.
- In the fault tree OEP-1A2 (failure of offsite power to switchgear A2), house event HE-LOOP-B was inserted under the OR gate OEP-1A2-3 (failure of AC power from SUT 1). This modification is shown in Figure B-4.
Key Modeling Assumptions. The following assumptions were determined to be significant to the modeling of this event:
- This event was modeled as a loss of condenser heat sink initiating event; therefore, the probability of IE-LOCHS (loss of condenser heat sink IE) was set to 1.0. All other initiating event frequencies were set to zero.
No credit was given for recovery of the condenser heat sink, which is potentially conservative. The condenser heat sink, along with main feedwater, were not recovered during the event response.3
- House event HE-LOOP-A (house event: LOOP occurrence) was set to TRUE because offsite power via SUT 1 was unavailable to bus A1.
- House event HE-LOOP-B (house event: LOOP occurrence) was set to TRUE because offsite power via SUT 1 was unavailable to bus A2.
- Basic event RCP-XHE-XM-TRIP (failure to recover seal injection seal cooling or secure RCP) was set to FALSE because power was lost to the reactor coolant pumps during this event.
ANALYSIS RESULTS CCDP. The point estimate CCDP for this event is 1.0x10-5. The ASP Program acceptance threshold is a CCDP of 1x10-6 or the CCDP equivalent of an uncomplicated reactor trip with a non-recoverable loss of feedwater and the condenser heat sink, whichever is greater. This CCDP equivalent for ANO-1 is 9.5x10-6. Therefore, this event is a precursor.
3 Additional information provided by the NRC Region IV staff indicated that, at the time of the event, the operators considered attempting to restore the main condenser as a heat sink; however, operators did not proceed due to risk concerns with starting a circulating water pump with only one transformer (SUT 2) supplying both units.
4
LER 313-2017-001 Dominant Sequence. The dominant accident sequence is loss of condenser heat sink sequence 12 (CCDP = 9.4x10-6) that contributes approximately 94 percent of the total internal events CCDP. Figure A-1 in Appendix A illustrates this sequence. The sequences that contribute to at least 1 percent of the total internal events CCDP are provided in the following table:
Sequence CCDP % Contribution Description Successful reactor trip; offsite power is LOCHS 12 9.42x10-6 94.1%
available; EFW fails; and feed and bleed fails Successful reactor trip; consequential loss of LOCHS 13-15 1.86x10-7 1.9% offsite power occurs; emergency power succeeds; EFW fails; and feed and bleed fails Successful reactor trip; consequential loss of offsite power occurs; emergency power fails; LOCHS 13-16-28-4 1.53x10-7 1.5%
EFW fails; offsite power is recovered within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />; and EFW fails Successful reactor trip; offsite power is available; EFW fails; feed and bleed succeeds; LOCHS 11 1.21x10-7 1.2%
secondary-side cooling is not recovered; and high-pressure recirculation fails REFERENCES
- 1. Arkansas Nuclear One, "LER 313/17-001 - Automatic Start of an Emergency Diesel Generator Due to the Loss of Offsite Power due to Severe Weather, dated June 26, 2017 (ADAMS Accession No. ML17177A314).
- 2. U.S. Nuclear Regulatory Commission, Columbia Generating Station - NRC Inspection Report 05000313/2017002, dated August 3, 2017 (ADAMS Accession No. ML17220A351).
5
LER 313-2017-001 Appendix A: Key Event Tree Figure A-1. Arkansas Nuclear One Loss of Condenser Heat Sink Event Tree A-1
LER 313-2017-001 Appendix B: Modified Fault Trees Figure B-1. Modified ACP-1A1 Fault Tree B-1
LER 313-2017-001 Figure B-2. Modified OEP-1A1 Fault Tree B-2
LER 313-2017-001 Figure B-3. Modified ACP-1A2 Fault Tree B-3
LER 313-2017-001 Figure B-4. Modified OEP-1A2 Fault Tree B-4