ML19072A240
| ML19072A240 | |
| Person / Time | |
|---|---|
| Site: | Calvert Cliffs  |
| Issue date: | 10/11/2018 |
| From: | Office of Nuclear Reactor Regulation |
| To: | |
| Matt Leech 415-8312 | |
| References | |
| LER 318-2018-001 | |
| Download: ML19072A240 (6) | |
Text
Final ASP Program Analysis - Reject Accident Sequence Precursor Program - Office of Nuclear Regulatory Research Both Unit 2 Emergency Diesel Generators Inoperable Due to Calvert Cliffs, Unit 2 Depressurization in Common Air Start Headers LER: 318-2018-001 Event Date: 10/11/2018 CDP = 8x10-8 IRs: TBD Plant Type: Combustion Engineering Pressurized-Water Reactor (PWR) with Large, Dry Containment Plant Operating Mode (Reactor Power Level): Mode 1 (100% Reactor Power)
Analyst: Reviewer: Contributors: Approval Date:
Matt Leech Chris Hunter N/A 2/14/2019 EVENT DETAILS Event Description. On October 11, 2018, during a post-maintenance test of the unit 1B emergency diesel generator (EDG), the corresponding air start control valves failed to shut as designed. At 11:03 p.m., air pressure in the common air start headers between the unit 1B EDG and both unit 2 EDGs depressurized to a point that rendered both unit 2 EDGs inoperable and unable to fulfill their safety function. Operators isolated the unit 1B EDG air start control valves, which resulted in starting air pressure returning to normal on both unit 2 EDGs. At 11:33 p.m., pressure was sufficiently restored to the unit 2 EDGs that both EDGs were declared operable. This event resulted in a loss of safety system function of the unit 2 EDGs for approximately 30 minutes. Additional information is provided in licensee event report (LER) 318-2018-001 (Ref. 1).
Additional Information. Calvert Cliffs has four EDGs and one station blackout (SBO) diesel generator. Each unit has two EDGs that automatically provide backup electrical power to a safety related bus. The SBO diesel generator can be manually aligned to any of the four busses as needed. The unit 1B EDG and both unit 2 EDGs are Fairbanks Morse diesels, whereas unit 1A EDG and the SBO diesel generator are Société Alsacienne De Constructions Mecaniques De Mulhouse CM diesels. Each Fairbanks Morse EDG has two independent and redundant air receivers, which supply starting air to the associated EDG through two parallel air start control valves. The air start headers for all three Fairbanks Morse diesels are connected.
The unit 1A EDG and the SBO diesel generator each has their own separate air start systems and were not impacted by this event.
Cause. A diode shorting in the unit 1B EDG air start control circuitry caused two fuses in the circuitry to fail, thus preventing relays from shutting the air start control valves. The failed diode was installed in the air start circuitry during maintenance preceding the post-maintenance test on October 11th to suppress induced voltage observed with the newly installed control relays.
MODELING SDP Results/Basis for ASP Analysis. The Accident Sequence Precursor (ASP) Program uses Significance Determination Process (SDP) results for degraded conditions when available 1
LER 318-2018-001 and applicable. However, no licensee performance deficiency associated with this event has been identified for and, therefore, no SDP evaluation is expected to be completed. An independent ASP analysis was required because both unit 2 safety-related EDGs were unavailable at the same time.
Analysis Type. The Calvert Cliffs Unit 2 standardized plant analysis risk (SPAR) model, Version 8.59, dated December 21, 2018 was used for this condition assessment.
Exposure Period. The unit 2 EDGs were unable to fulfil their safety function on October 11th at 11:03 p.m., when the starting air control valves for the unit 1B EDG did not close after the EDG was started. At 11:33 p.m., starting air pressure was sufficiently recovered to restore the safety function to both unit 2 EDGs. Therefore, the exposure period for this event is approximately 30 minutes. The minimum amount of time that can be selected in the Systems Analysis Programs for Hands-on Integrated Reliability Evaluations (SAPHIRE) event and condition assessment (ECA) module is 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. Given the overall result of this analysis (i.e., it is not a precursor),
further refinement exposure time is not needed.
Key Modeling Assumptions. The following modeling assumptions were determined to be significant to the modeling of this condition assessment:
- Basic events EPS-DGN-FS-2A (diesel generator 2A fails to start) and EPS-DGN-FS-2B (diesel generator 2B fails to start) were set to TRUE due to low starting air causing a loss of safety function to these EDGs.
- Basic event EPS-DGN-TM-1B (diesel generator 1B is unavailable because of maintenance) was set TRUE because the unit 1B EDG was unable to fulfil its safety function due to the low starting air pressure when it was in the process of being restored after maintenance.
- Basic event EPS-DGN-CF-FS1B2AB (common cause failure of Fairbanks Morse diesel generators 1B, 2A & 2B to run) was set to TRUE. This change was performed because preliminary cut set results incorrectly showed this basic event. With the unit 1B and both unit 2 EDGs set to a failed/unavailable state, this common-cause failure (CCF) basic event should not be in cut sets for this analysis. Note that this change does not eliminate CCF potential between the EDGs from this analysis.
- In this event, operators were able to recover starting air pressure to the unit 2 EDGs in approximately 30 minutes. A conservative screening value of 0.1 was used for basic events: EPS-XHE-XL-NR01H (operator fails to recover emergency diesel in 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />),
EPS-XHE-XL-NR04H (operator fails to recover emergency diesel in 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />), and EPS-XHE-XL-NR24H (operator fails to recover emergency diesel in 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />).1 Given the overall result of this analysis (i.e., it is not a precursor), further refinement of the screening value is not needed.
ANALYSIS RESULTS CDP. The increase in core damage probability (CDP) for this analysis is calculated to be 8.1x10-8. The ASP Program acceptance threshold is a CDP of 1x10-6 for degraded conditions; therefore, this event is a not a precursor 1 NUREG-1792, Good Practices for Implementing Human Reliability Analysis, provides that 0.1 is an appropriate screening (i.e., typically conservative) value for most post-initiator HFEs.
2
LER 318-2018-001 Dominant Sequence. The dominant accident sequence is loss of offsite power (LOOP)/SBO sequence 21-33-10 (CDP = 5.6x10-8), which contributes approximately 69 percent of the total internal events CDP. The dominant sequences that contribute at least 1.0 percent to the total internal events CDP are provided in the following table. The dominant sequence is shown graphically in Figures A-1 and A-2 in Appendix A.
Sequencea CDP Percentage Description
-8 LOOP 21-33-10 5.6x10 69% A LOOP initiating event occurs; reactor trip is successful; EDGs fail resulting in a SBO; auxiliary feedwater (AFW) succeeds; battery charging fails; operators fail to recover alternating current (AC) power within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> LOOP 21-30 1.14x10-8 14% A LOOP initiating event occurs; reactor trip is successful; EDGs fail resulting in a SBO; AFW succeeds; battery charging succeeds; operators fail to recover AC power within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> LOOP 21-42 7.56x10-9 9% A LOOP initiating event occurs; reactor trip is successful; EDGs fail resulting in a SBO; AFW fails; operators fail to recover AC power within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> TRANS 15-21-33-10 2.3x10-9 3% A transient occurs; reactor trip is successful; offsite power and EDGs fail; AFW succeeds; battery charging fails; operators fail to recover AC power within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />
- a. The LOOP sequence results are a sum of all four LOOP types (e.g., weather, grid, switchyard, and plant centered) unless otherwise noted.
Seismic Contribution. Historically, independent condition assessments performed as part of the ASP Program only included the risk impact from internal events and did not include the consideration of other hazards such as fires, floods, earthquakes, etc.2 The reason for the exclusion of the impacts of other hazards in most ASP analyses was due to the lack of modeling capability within the SPAR models. However, seismic hazards modeling was completed for all SPAR models in December 2017. Therefore, beginning in 2018, seismic hazards will be evaluated as part of all condition assessments performed by the ASP Program. The seismic contribution for this analysis is CDP of 1.5x10-9. The following table provides the seismic bin results that contribute at least 1 percent of the total seismic CDP for this analysis.
Seismic Bin CDP Notes/Observations Seismic Event in Bin 1 1.1x10-9 Dominant scenarios are seismically-induced LOOP with (0.1-0.3 G) occurs postulated (random) failures of the 1A and SBO EDGs resulting in a SBO. Failure of battery chargers, and operators fail to recover AC power results in core damage.
Seismic Event in Bin 2 3.4x10-10 Dominant scenarios are the same as those from seismic bins 1.
(0.3-0.5 G) occurs Seismic Event in Bin 3 9.9x10-11 Dominant scenarios are the same as those from seismic bins 1.
(0.5-1.0 G) occurs TOTAL = 1.5x10-9 2 Initiating events caused by other hazards (e.g., tornado results in a LOOP) or degradations associated to a specific hazard (e.g., degraded fire barrier) have historically been analyzed as part of ASP Program.
3
LER 318-2018-001 REFERENCES
- 1. Calver Cliffs Nuclear Power Plant, Unit 2, "LER 318/2018/001 - Both Unit 2 Emergency Diesel Generators Inoperable Due to Depressurization in Common Air Start Headers dated January 9, 2019 (ADAMS Accession No. ML19015A019).
4
LER 318-2018-001 Appendix A: Key Event Trees LOSS OF OFFSITE POWER REACTOR PROTECTION EMERGENCY POWER AUXILIARY FEEDWATER PORVS ARE NOT ISOLATED RCP SEAL INTEGRITY HIGH PRESSURE INJECTION ONCE THROUGH COOLING OFFSITE POWER RECOVERY OFFSITE POWER RECOVERY SECONDARY SIDE SHUTDOWN COOLING HIGH PRESSURE RECIRC CONTAINMENT COOLING # End State INITIATOR (GRID-RELATED) SYSTEM FAILS MAINTAINED IN 2 HRS IN 6 HRS COOLDOWN (Phase - CD)
FS = SBO-FTF FS = LOOP-RECOVERY FS = LOSC-FTF FS = LOOP-RECOVERY FS = LOOP-RECOVERY FS = LOOP-RECOVERY FS = LOOP-RECOVERY IE-LOOPGR RPS EPS AFW PORV LOSC HPI OTC OPR-02H OPR-06H SSC SDC HPR CSR 1 OK 2 LOOP-1 LOSC-L 3 OK 4 OK 5 CD 6 CD 7 OK AFW-L 8 CD HPI-L PORV-L 9 CD 10 OK 11 CD HPR-L CSR-L 12 CD HPR-L 13 CD HPI-L 14 OK 15 CD 16 CD 17 OK OTC-L AFW-L 18 CD HPR-L CSR-L 19 CD HPR-L 20 CD OTC-L 21 SBO 22 ATWS 23 CD Figure A-1. Calvert Cliffs LOOP Event Tree A-1
LER 318-2018-001 EMERGENCY POWER AUXILIARY FEEDWATER PORVS ARE CLOSED CONTROLLED BLEEDOFF REACTOR COOLANT RCP SEAL INTEGRITY BATTERIES ARE BEING OFFSITE POWER RECOVERY DIESEL GENERATOR # End State SYSTEM ISOLATED SUBCOOLING MAINTAINED MAINTAINED CHARGED IN 4 HRS RECOVERY IN 4 HRS (Phase - CD)
FS = SBO-FTF FS = SBO-FTF FS = SBO-FTF FS = SBO-FTF EPS AFW-B PORV-B CBO RSUB RCPSI BATT-CHG OPR-04H DGR-04H 1 OK 2 OK 3 CD OPR-24H DGR-24H 4 OK RCPSI01 5 OK 6 SBO-3 7 SBO-1 OPR-01H 8 OK RCPSI01 9 CD OPR-01H DGR-01H 10 OK 11 OK 12 CD OPR-24H DGR-24H 13 OK RCPSI02 14 OK 15 SBO-3 16 SBO-1 OPR-01H 17 OK RCPSI02 18 CD OPR-01H DGR-01H 19 OK 20 OK 21 CD OPR-24H DGR-24H 22 OK RCPSI03 23 OK 24 SBO-3 25 SBO-1 OPR-01H 26 OK RCPSI03 27 CD OPR-01H DGR-01H 28 OK 29 OK 30 CD OPR-24H DGR-24H 31 OK RCPSI04 32 OK 33 SBO-3 34 SBO-1 OPR-01H 35 OK RCPSI04 36 CD OPR-01H DGR-01H 37 SBO-1 OPR-01H 38 OK 39 CD OPR-01H DGR-01H 40 SBO-2 OPR-01H 41 OK 42 CD OPR-01H DGR-01H Figure A-2. Calvert Cliffs SBO Event Tree A-2