ML19028A218
| ML19028A218 | |
| Person / Time | |
|---|---|
| Site: | Peach Bottom  |
| Issue date: | 02/13/2019 |
| From: | Jennifer Tobin Plant Licensing Branch 1 |
| To: | Bryan Hanson Exelon Generation Co, Exelon Nuclear |
| Tobin J, NRR/DORL/LPL1 | |
| References | |
| LER 2018-001-00 | |
| Download: ML19028A218 (4) | |
Text
UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 Mr. Bryan C. Hanson Senior Vice President Exelon Generation Company, LLC President and Chief Nuclear Officer Exelon Nuclear 4300 Winfield Road Warrenville, IL 60555 February 13, 2019
SUBJECT:
TRANSMITTAL OF FINAL PEACH BOTTOM ATOMIC POWER STATION, UNIT 3 - ACCIDENT SEQUENCE PRECURSOR REPORT (LICENSEE EVENT REPORT 278-2018-001)
Dear Mr. Hanson:
By letter dated June 21, 2018 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML18172A260), Peach Bottom Atomic Power Station, Unit 3, submitted Licensee Event Report (LER) 278-2018-001, "Reactor Core Isolation Cooling System Pressure Switch Failure Results in Condition Prohibited by TS [Technical Specifications]," to the U.S. Nuclear Regulatory Commission (NRC) pursuant to Title 10 of the Code of Federal Regulations Section 50. 73. As part of the Accident Sequence Precursor (ASP) Program, the NRC staff reviewed the event to identify potential precursors and to determine the probability of the event leading to a core damage state. The results of the analysis are provided in the enclosure to this letter.
The NRC does not request a formal analysis review in accordance with Regulatory Issue Summary 2006-24, "Revised Review and Transmittal Process for Accident Sequence Precursor Analyses" (ADAMS Accession No. ML060900007), because the analysis resulted in an increase in core damage probability (6CDP) of less than 1x10-4.
Final ASP Analysis Summary. A brief summary of the final ASP analysis, including the results, is provided below.
Reactor Core Isolation Cooling System Pressure Switch Failure Results in Condition Prohibited by Technical Specifications. This event is documented in LER 278-2018-001.
Executive Summary. On April 22, 2018, the reactor core isolation cooling (RCIC) pump turbine tripped approximately 28 seconds after startup during surveillance testing. The pump had failed to reach rated system pressure and flow. Concurrent with the RCIC pump trip, a turbine high exhaust pressure was received. Local exhaust pressure indicated a pressure of approximately 12 pounds per square inch gauge (psig), which is well below the trip setpoint of 50 psig. The RCIC system was declared inoperable, and TS 3.5.3, "RCIC System," Condition A, was entered, which requires RCIC to be restored within 14 days. Licensee troubleshooting determined one of the two pressure switches had failed, resulting in the RCIC turbine trip.
Following replacement of the failed pressure switch and successful testing, the RCIC system was declared operable on April 23, 2018. The licensee determined that corrosion caused by
water intrusion had failed the pressure switch sometime between the last successful surveillance test on January 16, 2018, and the RCIC pump failure on April 22, 2018 (96 days).
Due to the uncertainty of when (during the 96-day period) the pressure switch failed, a 48-day (t/2) exposure period was used in the best estimate analysis for this event.
This ASP analysis reveals that the most likely core damage scenarios are transients that result in a loss of feedwater with RCIC unavailable and the postulated unavailability of the high-pressure coolant injection and failure of operators to depressurize the reactor. These accident sequences account for approximately 100 percent of the ~CDP for the event. The point estimate ~CDP for this event is 3x 10-6 (internal events), which is considered a precursor in the ASP Program. The seismic contribution for 48-day unavailability of RCIC is ~CDP of 3x10-a (approximately 1 percent of the internal events contribution).
To date, no performance deficiency associated with this event has been identified; therefore, an ASP analysis was performed since a Significance Determination Process evaluation was not performed.
Summary of Analysis Results. This operational event resulted in a best estimate ~CDP of 3x1Q-6. The detailed ASP analysis can be found in the enclosure to this letter.
If you have any questions, please contact me at (301) 415-2328 or Jennifer.Tobin@nrc.gov.
Docket No. 50-278
Enclosure:
Final Accident Sequence Precursor Analysis cc: Listserv Sincerely, j,;(i/(10 ~~)
Jennifer C. Tobin, Project Manager Plant Licensing Branch I Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation
Final ASP Program Analysis - Precursor Accident Sequence Precursor Program - Office of Nuclear Regulatory Research Peach Bottom Atomic Reactor Core Isolation Cooling System Pressure Switch Power Station, Unit 3 Failure Results in Condition Prohibited by Technical Specifications LER(s):
278-2018-001 Event Date:
4/22/2018 ACDP=
3x1Q-6 IR(s):
TBD Plant Type:
General Electric Type 4 Boiling-Water Reactor (BWR) with a Mark I Containment Plant Operating Mode Mode 1 ( 100% Reactor Power)
(Reactor Power Level):
Analyst:
Reviewer:
Contributors:
Approval Date:
Christopher Hunter Matt Leech N/A 12/19/2018 EXECUTIVE
SUMMARY
On April 22, 2018, the reactor core isolation cooling (RCIC) pump turbine tripped approximately 28 seconds after startup during surveillance testing. The pump had failed to reach rated system pressure and flow. Concurrent with the RCIC pump trip, a turbine high exhaust pressure was received. Local exhaust pressure indicated a pressure of approximately 12 psig, which is well below the trip set point of 50 psig. The RCIC system was declared inoperable and Technical Specification (TS) 3.5.3 Condition A was entered, which requires RCIC to be restored within 14 days. Licensee troubleshooting determined one of the two pressure switches had failed, resulting in the RCIC turbine trip. Following replacement of the failed pressure switch and successful testing, the RCIC system was declared operable on April 23rd. The licensee determined that corrosion caused by water intrusion had failed the pressure switch sometime between the last successful surveillance test on January 161h and the RCIC pump failure on April 22nd (96 days). Due to the uncertainty of when (during the 96-day period) the pressure switch failed, a 48-day (t/2) exposure period was used in the best estimate analysis for this event.
This accident sequence precursor (ASP) analysis reveals that the most likely core damage scenarios are a transients that result in a loss of feedwater with RCIC unavailable and the postulated unavailability of the high-pressure coolant injection (HPCI} and failure of operators to depressurize the reactor. These accident sequences account for approximately 100 percent of the increase in core damage probability (~CDP) for the event. The point estimate ~CDP for this event is 3x 1 o-s (internal events), which is considered a precursor under the ASP Program. The seismic contribution for 48-day unavailability of RCIC is ~CDP of 3x1Q-8 (approximately one percent of the internal events contribution).
To date, no performance deficiency associated with this event has been identified and, therefore, an ASP analysis was performed since a Significance Determination Process (SDP) evaluation was not performed.
1
EVENT DETAILS F Event Description. On April 22, 2018, the RCIC pump turbine tripped approximately 28 seconds after startup during surveillance testing. The pump had failed to reach rated system pressure and flow. Concurrent with the RCIC pump trip, a turbine high exhaust pressure was received. Local exhaust pressure indicated a pressure of approximately 12 psig, which is well below the trip set point of 50 psig. The RCIC system was declared inoperable and TS 3.5.3 Condition A was entered, which requires RCIC to be restored within 14 days. Licensee troubleshooting determined one of the two pressure switches had failed, resulting in the RCIC turbine trip. Following replacement of the failed pressure switch and successful testing, the RCIC system was declared operable on April 23rd. Additional information is provided in licensee event report (LER) 278-2018-001 (Ref. 1 ).
Cause. Water intrusion within the switch enclosure resulted in corrosion and degradation of the switch internals, causing an electrical short of the pressure switch. A diaphragm normally isolates the switch from the instrument line that contains condensed steam from the RCIC turbine exhaust piping. However, a tear in the diaphragm resulted in a small amount of water entering the switch enclosure.
MODELING ASSUMPTIONS Analysis Type. The Peach Bottom Unit 3 standardized plant analysis risk (SPAR) model, Version 8.51 dated September 28, 2017, was used for this condition assessment. This SPAR model version includes seismic initiating events.
SDP Results/Basis for ASP Analysis. The ASP Program uses SDP results for degraded conditions when available (and applicable). To date, issued inspection reports for Peach Bottom do not provide additional information on this event. Discussions with Region 1 staff indicated that no performance deficiency has been identified to date; however, the LER remains open. An independent ASP analysis was performed given the lack of an identified performance deficiency and the potential risk significance of this event.
A search for additional Peach Bottom Unit 3 LERs was performed to determine if any initiating events or additional unavailabilities existed during the exposure period of RCIC pump. No windowed events or concurrent degraded conditions were identified.
Exposure Period. The licensee determined that corrosion caused by water intrusion had failed the pressure switch sometime between the last successful surveillance test on January 15th and the RCIC pump failure on April 22nd (96 days). The safety function for RCIC was restored on April 22nd, approximately 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> after the pump failure, when the pressure switch was electrically isolated. Due to the uncertainty of when (during the 96-day period) the pressure switch failed, a 48-day (t/2) exposure period was used in the best estimate analysis for this event.
Key Modeling Assumptions. The following modeling assumptions were determined to be significant to the modeling of this event:
Basic event RCI-TDP-FS-TRAIN (RC/C pump fail to start) was set to TRUE due to the pump trip approximately 28 seconds after start up.
2
The RCIC system function was restored approximately 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> after the pump trip when the failed pressure switch was electrically isolated. Core damage is expected to occur approximately 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> for the dominant accident sequences in this analysis and, therefore, recovery of the RCIC pump is not credited in this analysis.
The preliminary results were reviewed to determine if FLEX strategies would affect the risk of this event. The dominant accident scenarios are short-term loss of decay heat removal where electrical power remains available. Because FLEX strategies are currently implemented in extended loss of alternating-current (AC) power scenarios and/or when significant time is available to operators, FLEX strategies were not considered as part of this analysis.
ANALYSIS RESULTS
~CDP. The point estimate L.\\CDP for this event is 2.6x1 Q-6, which is the sum of all exposure periods. The ASP Program acceptance threshold is a L.\\CDP of 1 x 1 Q-6 for degraded conditions.
The L.\\CDP for this event exceeds this threshold; therefore, this event is a precursor.
Dominant Sequence. The dominant accident sequence is loss of condenser heat sink sequence 53 (L.\\CDP = 9.8x1Q-6), which contributes approximately 37 percent of the total internal events L.\\CDP. The dominant sequences are shown in the table below and graphically in Figure A-1 Appendix A. Accident sequences that contribute at least 1.0 percent to the total internal events L.\\CDP for this analysis are provided in the following table.
LOCHS 53 1.16x1Q-6 1.79x1Q-7 9.83x1Q-7 37.2%
Loss of condenser heat sink initiating event; successful reactor trip; RCIC and HPCI fail; and operators fail to depressurize the reactor LOMFW60 6.27x1Q-7 9.61x1Q-8 5.31 x10-7 20.1%
Loss of feedwater initiating event; successful reactor trip; RCIC and HPCI fail; and operators fail to depressurize the reactor TRANS 62 5.26x1Q-7 8.83x1Q-8 4.38x1Q-7 16.6% Transient initiating event; successful reactor trip; power conversion system (including feedwater),
RCIC, and HPCI fail; and operators fail to depressurize the reactor LOACB-E23 62 1.89x1Q-7 2.85x1Q-8 1.6Qx1Q-7 6.1%
Loss of AC bus 'E23' initiating event; successful reactor trip; RCIC and HPCI fail; and operators fail to depressurize the reactor LOOPSC 35 1.42x1Q-7 2.18x1Q-8 1.2Qx1Q-7 4.5%
Switchyard-centered loss of offsite power (LOOP) initiating event; successful reactor trip; RCIC and HPCI fail; and operators fail to depressurize the reactor LOOPGR35 1.17x1Q-7 1.79x1Q-8 9.86x1Q-8 3.7%
Grid-related LOOP initiating event; successful reactor trip; RCIC and HPCI fail; and operators fail to depressurize the reactor LOIAS 65 7.64x1Q-8 1.17x1Q-8 6.47x1Q-8 2.5%
Loss of instrument air initiating event; successful reactor trip; RCIC and HPCI fail; and operators fail to depressurize the reactor LOOPWR35 6.35x1Q-8 9.76x1Q-8 5.37x1Q-8 2.0%
Weather-related LOOP initiating event; successful reactor trip; RCIC and HPCI fail; and operators fail to depressurize the reactor 3
LER 278-2018-001 IORV38 4.87x10-a 7.68x1Q-9 4.1Qx1Q-8 1.6%
Inadvertent opening of safety relief valve initiating event; successful reactor trip; power conversion system (including feedwater), RCIC, and HPCI fail; and operators fail to depressurize the reactor TRANS 66-35 4.16x1Q-8 6.39x10-9 3.52x1Q-8 1.3%
Transient initiating event; consequential LOOP occurs; successful reactor trip; RCIC and HPCI fail; and operators fail to depressurize the reactor LODCB-3B 62 3.29x1Q-8 4.97x1Q-9 2.79x1Q-8 1.1%
Loss of direct-current bus '38' initiating event; successful reactor trip; RCIC and HPCI fail; and operators fail to depressurize the reactor Total 3.26><10-6 6.21 ><10"7 2.64><10-6 Uncertainties. The key modeling uncertainty associated with this analysis is the exposure period. The licensee determined that corrosion caused by water intrusion had failed the pressure switch sometime between the last successful surveillance test on January 16th and the RCIC pump failure on April 22nd (96 days). There is no additional information available to reduce the uncertainty of when the pressure switch failed during this period. When there is no definitive time of failure, the exposure period is calculated as t/2 (i.e., 96 days/2 = 48 days). A sensitivity analysis, performed to determine the risk of an upper bound exposure period of 96 days, results in ab.CDP of 5.3x1Q-6. In addition, a sensitivity evaluation was performed to determine the minimum exposure period required for the b.CDP to exceed the precursor threshold of 1 x1Q-6. It was determined that a RCIC unavailability of at least 19 days is needed to exceed the precursor threshold.
Seismic Contribution. Historically, independent condition assessments performed*as part of the ASP Program only included the risk impact from internal events and did not include the consideration of other hazards such as fires, floods, earthquakes, etc.1 The reason for the exclusion of the impacts of other hazards in most ASP analyses was due to the lack of modeling capability within the SPAR models. However, seismic hazards modeling was completed for all SPAR models in December 2017. Therefore, beginning in 2018, seismic hazards will be evaluated as part of all condition assessments performed by the ASP Program. The seismic contribution for a RCIC unavailability of 48 days is b.CDP of 3x1Q-8* The following table provides the seismic bin results that contribute at least 1 percent of the total seismic b.CDP for this analysis.
Seismic Event in Bin 3
(>0.5 G) occurs Seismic Event in Bin 2 (0.3-0.5 G) occurs
,.6CDP Notes/Observaiioh,s.
2.64x10-s Dominant scenarios are seismically-induced LOOP and small loss-of-coolant accident (SLOCA). Random and seismic HPCI failures along with seismically-induced failures of residual heat removal, low-pressure core spray, and/or service water result in a failure of short-or long-term reactor inventory makeup.
3.33x10*9 Dominant scenarios are seismically-induced LOOP and small LOCA.
Random and seismic HPCI failures along with seismically-induced failures of service water result in a failure of long-term reactor inventory makeup.
1------------+----
TOTAL=
2.98x10-s Initiating events caused by other hazards (e.g., tornado results in a LOOP) or degradations specific to a particular hazard (e.g., degraded fire barrier) have been analyzed as part of ASP Program.
4
LER 278-2018-001 Initial seismic calculations identified the following two issues:
Seismically-induced SLOCA accident sequences were being overestimated due to basic events SLOCA-EQ3 (small LOCA occurs) and SLOCA-EQ2 (small LOCA occurs) not having their process flags set to the appropriate selection. These basic events need to be set to "W" calculation type, which appropriately accounts for the success probabilities.
In most cases, the success terms are assumed have probabilities equal to 1.0, which is an adequate approximation when failure probabilities are small. However, when failure probabilities are larger (i.e., 0.1 or greater), success probabilities can be significantly less than 1.0 and, therefore, need to be appropriately accounted for to prevent over estimation of their core damage frequencies. While for the most part not an issue in internal events modeling, failure probabilities greater than or equal to 0.1 are more common in seismic modeling. This issue will be a focus of future reviews of seismic modeling in ASP analyses.
Evaluation of preliminary cut sets showed that emergency diesel generator (EOG) recovery credit is being incorrectly applied to seismically-induced station blackout (SBO) cut sets. The appropriateness of crediting of recovery using mean-time to repair data for EDGs is an open issue for modeling of both internal and external hazards. In addition, the modeling technique for EOG recovery credit was simplified in a manner that can result in invalid cut sets. For example, EOG recovery is credited in cut sets in which the SBO occurred due to seismically-induced electrical system failures not associated with the EDGs. This issue had a negligible effect on the results for this analysis and, therefore, no modeling changes were made. The issue of crediting EOG repair during seismic sequences in currently being evaluated by NRC and Idaho National Laboratory staff.
REFERENCES
- 1. Peach Bottom Atomic Power Station, "LER 278/18-001 - Reactor Core Isolation Cooling System Pressure Switch Failure Results in Condition Prohibited by TS," dated January 3, 2018 (ADAMS Accession No. ML18172A260).
5
(flllw-CD)
...... I o--o----~lfj I
-~-~
o cer-l :
/
~==:
EJ I
o---e;=a " I
~
o----0--0----~IIJ "
I
,~~I:\\
0----0----0----o-l_
o--C~
~;;'.:_BJ I
~er-llQ "
I o----o----o----o----o--o----0-----:,;:_n I
0--0----0----er-ml I
o----er-EI I
o----o----
~o C-1 "' /
~~',;:_gg.~
I
~er-18 "
I D
o----~P:l I
o------er-11::'J I
~er-rt.I I
..--<J---,
~~ L-<;>;;--i!I I
o----
~~er-G:~
I
~er-~Jzl I
o--o----o----;_ll!'.J I
o----er-1!'. I I
er-F?I I
~o-e;~
~ er-f.~I I
o----Cer-r'.~ I I
o----o--o----0-----:,;:_~~ I I
o----o----0--0----0----o----o----o----er-i'"*J I
1--<J---,o--o----o----o----o--o----0----0--0----o----er-K~ I
'---<.>---,o----o----o----o----o----o----o----0--0----0----er-f~* J o----o'.'.----0----0--0----o----o--o----o----o--o----o----er-~.. I A.~o--o----o----o----o----o----o----o----o----o--o----o----er-m~
11 1
~o-------y--o----o----o----0----0----0----o----o--o----o----er-v.. I I
Figure A-1. Peach Bottom Loss of Condenser Heat Sink (LOCHS) Event Tree A-1
ML19028A218 OFFICE NRR/DORL/LPL 1/PM NRR/DORL/LPL 1/PM NAME JTobin LRonewicz DATE 01/30/2019 01/30/2019 NRR/DORL/LPL 1 /BC JDanna 02/11/2019