ML17334B339
| ML17334B339 | |
| Person / Time | |
|---|---|
| Site: | Cook  |
| Issue date: | 12/18/1989 |
| From: | Rosenthal J NRC OFFICE FOR ANALYSIS & EVALUATION OF OPERATIONAL DATA (AEOD) |
| To: | Barrett R, Cunningham M, Haughney C Office of Nuclear Reactor Regulation, NRC OFFICE OF NUCLEAR REGULATORY RESEARCH (RES) |
| References | |
| RTR-NUREG-CR-4674 NUDOCS 8912270382 | |
| Download: ML17334B339 (13) | |
Text
MEt<10RANDUM FOR:
Richard J. Barrett, Chief Risk Applications Branch Division of Radiation Protection and Emergency Preparadness, NRR Charles J.
- Haughney, Chief Events Assessment Branch Division of Operational Events Assessment, NRR Mark A. Cunningham, Chief Probabi listic Risk Analysis Branch Division of Systems
- Research, RES FROM:
Jack E. Rosenthal, Chief Reactor Operations Analysis Branch Division of Safety Programs, AEOD
SUBJECT:
EVALUATION OF AN OPERATING EVENT AT COOK 2 Enclosed for your information and use is an evaluation of the safety significance of an operating event at D. C.
Cook 2 involving a failure of a control room instrumentation distribution (GRID) panel.
The safety significance of this event is stated in terms of the likelihood for core damage given the event.
The conditional core damage likelihood was estimated using methods of the accident sequence precursor (ASP) program.
The ASP program quantitatively estimates the significance of operating events.
The structured and systematic manner of utilizing analytical models to couple elements of accident scenarios enables us to categorize and rank operational events.
The ASP program results for 1987 were published in NUREG/CR-4674 Vol.
7 8 8, and the results for 1988 will be available in NUREG/CR-4674 Vol.
9
& 10, in draft form by December 20, 1989.
It is our intent to quantitatively evaluate and periodically distribute selected individual events, such as the attached GRID failure event.
The attached evaluation is the first of these ASP evaluated events to be distributed.
If you have any questions, please contact myself or Fred Manning (2-4426) 'of my staff.
8912270382 891218 PDR ADOCK 05000316 R
PNU
Enclosure:
As stated Distribution:
Jack E. Rosenthal, Chief Reactor Operations Analysis Branch Division of Safety Programs, AEOD Office for Analysis and Evaluation of Operational Data Centra Fs es ROAB R/F FManning JRosenthal MWi 1 1 iams VBenaroya TNovak JHeltemes BBrady PLam EJordan PDR~
LSpessard HFaul kner MTay1 or ROAB:DSP:AEOD FManning gag 12//g /89 ROAB:DSP.
EOD PLam 12/i3 89 A :
SP:AEOD JRosenthal 12//I/89
II II Il ff I
~
r II P
'I f = II
n
~
~
~
Accident Sequence Precursor Program Event Analysis LER Number:
N/A Event
Description:
Trip due to CRID-IVfailure Date ofEvent:
August 14, 1989 Plant:
D.C. Cook Summary Cook 2 tripped from 100% power as a result of a severe undervoltage on 120 VACvital bus CRID-IV. The undervoltage condition was caused by an SCR failure in the associated inverter. As a result of the undervoltage, all four wide range steam generator level indicators, the condenser steam dumps, the SSPS train B output relays, and other instrumentation was lost. Additional unrelated failures, the smell of smoke from excessive heating of unfused CRID-IVcomponents and extensive relay chattering complicated recovery &om the event.
The overall signficance ofthe event is considered to be low. Auxiliaryfeedwater was available throughout the event for primary-to-secondary heat removal (alternate indication of SG functionality was used until SG level was recovered), and one train ofhigh pressure injection remained available to mitigate the effects of a potential transient induced LOCA. The relative signficance of the event compared to other potential events at Cook is shown below:
D.C. Cook, August 14, 1989 (3.9E-7) 1E-8 lE-7 lE-5 1FA 1F 3 1E-2 Trip LOFW (nominal recovery)
Event -Description L LOOP LOFW (nominal tee) + 1 AFW um Unavail p
p Trip+ 1 AFWTrain Unavail
))
The Unit 2 reactor tripped from 100 percent power at 4:01 p.m. on August 14, 1989, as a result of a problem in an inverter supplying control room instruments.
The trip occurred when operators restored the normal power supply to Control Room Instrumentation Distribution (CRID) panel IV,which had automatically transferred to its alternate power supply 20 minutes earlier.
Upon transfer of'CRID-IV to normal power, the CRID panel experienced severe undervoltage leading to the reactor trip and the loss of numerous instrument indications.
Among the instruments and controls lost were all four wide-range steam generator level
C indicators, condenser steam dumps, Solid State Protection System (SSPS) Train B output relays, and various monitoring functions.
Immediately after the reactor trip, three control rod rod bottom lights failed to illuminate. The turbine stop valve status lights did not indicate the turbine had tripped. Excessive heat horn overcurrent to unfused items resulted in the smell ofsmoke in the control room, and the control room smoke detection circuit alarmed.
Substantial relay chatter was audible in the control room for a considerable time after the trip.
When the turbine (which had tripped) slowed down suKciently, the turning gear motor failed and reports of smoke and damage were received in the control room.
Critical plant parameters were maintained withinnormal post-trip ranges during the transient recovery, with some systems requiring manual operator control. CRID-IVwas transferred to another alternate power supply after about forty-fiveminutes, and restoration of individual instruments and controls was substantially complete within ninety minutes ofthe reactor trip.
The event was caused by failure of'an SCR in the No. 4 inverter twenty minutes before the trip. The particular failure mode resulted in a reduction in inverter output voltage to -84 volts and initiated a transfer to its alternate power supply. High component currents caused by. the reduced voltage resulted in a blown fuse for nuclear instrument channel N-44. This blown fuse was initiallybelieved to have been the cause ofthe inverter transfer. Because ofthe nature ofthe failure, the inverter appeared operable when locally inspected, and permission was given for a transfer back to the normal source. At this point in time, CRID-IVbreakers and fuses opened, and a reactor trip occurred Qom LOOP 4 reactor coolant pump breaker position indication. Subsequently, turbine and main feedwater trip occurred, and AFWinitiated. An event timeline is included in Table 1.
A total of six breakers tripped and a number of fuses were blown as a result of the CRID-IV low voltage condition. In all cases except steam generator (SG) wide range level, redundant instrumentation was available to the operator.
Each SG is provided with one channel ofwide range level indication and all four channels receive power from CRID-IV. Following the reactor trip, and prior to SG level recover by the auxiliary feedwater system, the narrow range SG level went offscale low. The operators knew that wide range level would be lost ifCRID-IVfailed and they used SG pressure, feedwater flow, and steam flow as an indication that the SGs were intact and recovering inventory. Wide range level indication was available, at the Local Shutdown Instrumentation (LSI) panels located in the AuxiliaryBuilding. The LSI panels are provided with a transfer switch which could be used to 'select an'alternate power source.
Lost instruments on CRID-IV, 'audible relay chatter, and the smell of smoke Rom the failed turning gear motor distracted the operators from performing the trip recovery. The chattering
ofrelays and bistables was loud enough to require shouting for communication in the control room. The smoke/burning smells associated with the failures led some operators to suspect fire somewhere in the control room. The shift supervisor had to contend with failed RTD indication and a smoking condensate pump on the other unit (Unit 1).
Although three offour indications of successful reactor trip occurred, which is the rule that the reactor trip should be considered successful, the RO, with permission, initiated emergency boration.
Turbine trip was also not fully confirmed by the principal indications but was verified tripped by other means.
The operators expressed no concern over not having SG level indication. Two offour SG PORVs did not have automatic control due to the CRID-IVfailure.
The RO manually controlled the PORVs as needed in cooldown. The operators were more concerned that an overcooling would lead to SI, since this would be difficultto recover from because ofthe loss ofthe SSPS channel B output relays.
Failure of the rod bottom lights (caused by failure ofbistables to trip) and turning gear motor (believed to be caused by normal end oflifefailure) were unrelated to the loss of CRID-IV.
Event Related Plant Design Information The 120 Vac vital instrument bus system consists offour separate buses which are supplied by four independent 7.5 kVA,single phase static inverters. Two ofthe invmters connect to one of the station batteries, the other two connect to a second station battery.
The static inverter consists of a power switching circuit (inverter) which converts a 250 Vdc input (1E source) to a regulated 120 Vac sinusoidal output. The output of the power switching circuit is applied through a static switch (part ofthe static inverter) which electrically transfers the static inverter cabinet output to its associated CRID.
The normal input to the static switch is Gem the power switching circuit. A second source of power is available Gom a non-1E 120 Vac constant voltage isolation transformer (alternate input). Ifthe static switch fault circuitry detects a loss ofnormal input, load fault or overload condition, the fault circuitrywillinitiate a transfer in < 1/4 cycle to the alternate input.
ASP Modeling Assumptions and Approach This event has been modeled as a loss offeedwater with unavailability of one train of systems initiated by the SSPS.
Redundancy and diversity to instruments lost as well as a sufficient diagnosis of the root cause's location, i.e., CRID No. 4, meant that there were no misleading indications and that the loss of leading indication were easily overcome. Achecklist ofevent significance &om a human reliability standpoint is provided in Table 2.
(Loss of leading indication without redundancy or diversity or misleading indication should be associated with an increased probability of operator failure where such conditions occur in the actual event.
Since neither occurred in this event, the typical trip assumptions are suKcient.)
Because of the loss of SSPS channel B output relays, train B of safety systems were assumed unavailable in cases where these systems would be initiated by the SSPS (transient induced LOCA). Main feedwater was assumed recoverable (non-recovery probability of 0.12). The potential for a LOOP following a trip (with an assumed probability of 0.001) was also considered in the analysis.
A review of components which would have been faulted ifanother CRID had failed was also performed. No other CRID was identified as having a more signficant impact than CRID-IV, and hence the potential failure ofone ofthese other buses was not addressed in the analysis.
Analysis Results The base case analysis results (recoverable loss of feedwater with unavailability ofone train of safety injection for transient induced LOCA) indicate a low significance event ( p(cd) = 3.9E-7, a factor oftwo more significant than an uncomplicated trip). The two dominant sequences for the event are related to loss of main and auxiliary feedwater and failure of bleed and feed, which is typically the dominant transient sequence in a PWR.
The third most dominant
-sequence involves a transient induced LOCA with HPI unavailability.. This indicates that unavailability of'the SSPS output relays did not contribute appreciably to the event.
Postulating a loss of offsite power as a result of the trip (for example, due to grid disturbances), increases the core damage probability estimate to 9.1E-7, still a low significance event.
'able 1
D.C. Cook Event Timeline Event 3:40pm 3'45 3:45 3:55 4'0124 4 0126 4:0126 4:01:2830 4:01:30 4'01 36-38 4:01:52 4:01:55 4:02 4:02 4:03 4:03 4:05
.4:10 415 4:15 4:05-4:15 416 4:20-4:30 4'30 4:30-4:35 4:36 4:46 4 46-5'30 Power range N-44 fuse blows; CRID-IVtransfers to alternative supply; SSPS output relays chatter brieQy N-44 bistables placed in "trip"per TS N~ defused completely CRID-IVcheckout fortransfer to normal power CRID-IVpushbutton actuated to transfer power, reactor tripreactor coolant pump 4 bieaker control rods in3 bottom lights not illuminated; zod, H-8 light came in a few seconds later, leaving 2 failed auxiliary feedwater pump autostarts MFP trip steam generator low levels received all channels operators commence ~
steam generators low-lowlevels main generator output breaker opens normally operator maual turbine (solenoid) trip, followed by manual AMSACtrip steam generator levels offscale low operators verify no SI required, commence ES-0.1 onshift STA reviews Status Trees no emergency indications operator performs emergency boration (pumps already running) by opening boration valve control zoom vent fan started to clear out smell ofsmoke emergency boration secured steam generator narrow-range levels back onscale both souzce range NIs reenergize normally operations in manual contzolletdown/charging Qow; letdown pressure control; CCW to letdown heat exchanger, steam generator PORVs turbine AFWpump secured; RCS cooldown stopped at 535 degrees zeactor and secondary plants stabilized in MODE3 turbine turning gear motor secured zepozted smoking RCS cooldown below 541 degrees to secure RCP 4 RCP 4 stopped due to absence ofpump monitoring instrumentation CRID-IVtransferred to lighting panel power supply CRP-3 restoring normal voltage CRID-IVinstrumentation and contzol loads individuallyrestored
Table 2 Checklist of D.C. Cook Event Significance Item Comment Instrumentation Aspects leading indication lost misleading indications root cause sufficiently known impact ofinstrumentation loss known Other Equipment'ultiplefailures with different effects multiple failures with similar effects safety equipment effects Operator Actions manual turbine tiip emergency boration manual SG PORV control check forfire attend other unit (Unit 1) problems Operator Resources procedures instrumentation simulator training Other Influences noise smoke smell shift interface multiunit conttol rod insertion; turbine trip; SG level none operators knew CIUD-IVwas cause yes yes smoke smell in control room due to CRID-IVfailure; smoke ftom turbine bearing motor 2 SG PORVs loss ofautomatic control; SG level control not indicated directly a confirination action a conservative action feared overcooling onset ofSI confirmed there was not a fir distractions to shift supervisor generally adequate although operator knowledge supplemented instructions all redundant except SG wide range level CRID-IVfailutes simulated but this failure mode was unanticipated Gom chattering ofrelays and bistables led to fire alarm but no fire shift had just begun distractions fromUnit 1
~ o CONDITIONAL CORE DAMAGE PROBABILITY CALCULATIONS Evont Identifier:
n/a Event
Description:
Trip due to CRID-IV failure Evont Dates 08/14/89 Plant:
Cook 2 INITIATING EVENT NON RECOVERABLE INITIATING EVENT PROBABILITIES TRANS SEQUENCE CONDITIONAL PROBABZLITY SUMS 1.0EIOO End State/Initiator Probability TRANS Total 3.9E-07 3.9EW7 TRANS Total 3.4E-OS 3.4E-OS SEQUENCE CONDITIONAL PROBABILITIES (PROBABILITY ORDER) 17 trans 15 trans 12 trans 11 trans
-hpi 16 trans
-rt afw
-rt afw
-zt -afw
-rt -afw
-rt afw Sequence MPW hpi (f/b)
MPW -hpi(f/b) -hpr/-hpi pozv.opon porv.cr.srv.chall porv.cr.srv.zosoat HPZ porv.cz.srv.chall porv.or.srv.zosoat
-HPZ o
MPW -hpi(f/b) hpr/-hpi 18 trans rt
~ s ncn-rocovory credit for edited case SEQUENCE CONDITIONAL PROBABILITIES (SEQUENCE ORDER)
End Stato hpr/
CD Prob 1.3E-07 1.2E-07 1 ~ 1E 07 loSE-08 1 'E-OB 3 'E-05 N Reeve 2 6E-02 3.1E-02 9.2E-03 1.1E-02 3 'E-02 1.2E-01 12 15 16 17 18 trans -rt
-hpi trans -rt trans -rt trans -rt trans -zt trans zt Sequence End State
-afw afw afw afw porv.or.srv.chall porv.cr.srv.reseat HPZ MPW -hpi(i/b) -hpr/-hpi porv.open MPW -hpi(f/b) hpr/-hpi MPW hpi(f/b)
CD CD CD CD ATWS
-afw porv.or.srv.chall pcrv.or.szv.rosoat
-HPZ hpr/
CD Prob 1.5E-OB 1.1E-07 1.2E-07 1 3E-08 1.3E-07 3o4EWS Races 1.1E-02 9.2E-03 3.1E-02
c:hasp%sea)modhpwrbsealocmp BRANCH MODEL:
c:Xasphsoalmodhcook.sll PROBABILITY PILE:
c:Xasphsoalmcdhpwr bsll.pro No Recovery Limit BRANCH PREQUENCIES/PROBABILITIES Branch trans loop loca System 3.4E-04 1.6E-OS
- 2. 4EW6 Non-Roccv loOE400 2 'E-01 4 ~ 3EWI Opr Pail Event Idontifiors n/a
A7
~
crtrt/loop emerg.power afw afw/emerg.power MFM Branch Models 1.OF 1
Train 1
cond Prob:
porv. or. srv. cha1 1 porveor ~ srv ~reseat porv.or.srv.reseat/emerg.power seal. loca ep.rec(sl) eperec Hpz Branch Model:
1.0F.2 Train 1 Cond Probe Train 2 Cond Prob:
hpi(f/b) hpr/-hpi porv.open,
~
branch model file s ~ forced 2.8E-04 O.OE400 2.9E-03 3.8E-04 S.OE-02 2:OE-01 > 1 OEIOO 2.0E-01
> Unavailable
.4.0E-02 3.0E-02 3 'E-02 USE-01 6.9E-01 5 'E-02 1 ~ OE-03 >
1 ~ OE-02 1.0E-02 1.0E-01
> Unavailable loOE-03 1 SE-04 1 OE-02 1.2E-01 1 ~ OE>00 8 OE-01 2.6E-01 3 'E-01 3.4E-01
> 1.2E-01 1.0E%00 1 ~ 1E-02 1 AL OE+00 1 AL OE+00 1.0E+00 1.0E400 84E01
- 8. 4 E-01 1.0E400 1.0E000 1.0E-02 1.0E-03 4 'E-04 Minarick 09-23-1989 12>27<50
)
~
KNent Idontifior: n/a CONDITIONAL CORE DAHACE PROBABILITY CALCULATIONS Event Idantifiers n/a Evont Descriptions Trip due to CRID-ZV failuro (postulated LOOP)
Event Data>
08/14/89 Plants Cook 2 INITIATINGEVENT NON RECOVERABLE INITIATINC EVENT PROBABILITIES 1.0E-03 SEQUENCE CONDITIONAL PROBABILITY SUMS End Stato/Initiator Probability Total 5.2E-07
Sequence 53 54 55 48 LOOP -rt/loop amerg.pcwer
-afw/amarg.powor -pozv.or.srv.chall seal
~ loca ep.zec(sl)
LOOP -rt/loop emerg.power
-afw/amerg.power -porv.or.srv.chall-soal
~ loca ep.zec LOOP -rt/loop amerg.power afw/omorg.powor LOOP -rt/loop emerg.pcwer -afw/smerg.power porv.or.srv.chall-porv.or.srv.zaseatlamerg.power seal. loca op.rac(sl)
End Stato Prob 3.7E-07 8.4E-OB 3.9E-08 1.5E-08 N Roc~~
7.9E-04 7 'E-04 2.7E-04 7.9E-04
~ s non-rocovery credit for edited case SEQUENCE CONDITIONAL PROBABILITIES (SEQUENCE ORDER) 48 53 54 55 Sequence LOOP -rt/loop omerg.power -afw/emerg.power porv.or srv.chall porv.or.szv.reseat/emsrg.power seal. loca ep.rac(sl)
LOOP -zt/loop emerg.power
-afw/amazg.power -porv.or.srv.chall seal.loca op.rec(sl)
LOOP -rt/loop amorg.power -afw/emerg.power -porv.or.srv.chall seal.loca ap.zoc LOOP -rt/loop emerg.power afw/amorg.power End State loSE-08 3 7E-07 8.4E-08 3.9E-OB N Races 7 9E-04 7 'E-04 7 'E-04 2.7E-04
~ ~ non-recovery credit for sditod casa SEQUENCE MODEL<
':Xasphsaalmodhpwrbsaal.cmp BRANCH MODELZ c:Xasphsealmodhcook.sll PROBABIIZTY FILE:
c:Rasp%sea)modhpwr ball.pro No Recovery Limit BRANCH FREQUENCIES/PROBABILITIES Branch trans LOOP Branch Model:
INZTOR System
- 3. 4 E-04 1 6E-05 >
1 6E 05 Non-Recov 1.0Et00 2.4EWZ > 1.0E-03 Opr Fail Event Identifier: n/a
~ Initiator Freql loca r't rt/loop emetgepovet afM afw/emetg.power MFW Branch Model:
1.0F.1 Train 1
Cond Probe porv.or.srv. chall porv.or.srv.reseat potv.or.srv.reseat/emerg.power seal. loca ep.rec(sl) ep.rec Hpz Branch Model:
1.0F.2 Train 1
Cond Prob:
Train 2 Cond Prob:
hpi(f/b) hpr/-hpi porv.open branch model file
~ s forced 1.6E-05 2 'E-06 2.BE&4 O.OEt00 2.9E-03 3.'SE-04 5'E-02 2.0E-01 1 AL OE+00 2.0E-01
> Unavailable 4.0E-02 3.0E-02 3 'E-02 2.5E-01 6.9E-01 5.2E-02 1.0E-03
> 1.0E-02 1.08-02 1.0E-01 > Unavailable 1.0E-03 1.5E-04 1.0E-02 4.3E-01 1.2E-01 1.0Ei00 8'E-01
- 2. 6E-01 3.4E-01 3.4E-01
> 1+2E-01 1.0E+00 1 1E 02 1 OEt00 1 ~ OE400 1.0Et00 1 ~ OE400 8 'E-01 8 4E-01 1.0E+00 1 OEt00 1.0E-02 1.0E-03 4 OE-04 Minarick 11-01-1989 08442534 Event Identifier: n/a
4
~
w)
Fy
~
t>>