ML19092A159
ML19092A159 | |
Person / Time | |
---|---|
Site: | Clinton ![]() |
Issue date: | 04/03/2019 |
From: | Joel Wiebe Plant Licensing Branch III |
To: | Stoner T Exelon Generation Co |
Wiebe J 415-6606 | |
References | |
Download: ML19092A159 (4) | |
Text
UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 April 3, 2019 Mr. Theodore R. Stoner Site Vice President, Clinton Power Station Exelon Generation Company, LLC 8401 Power Rd.
Clinton, IL 61727
SUBJECT:
TRANSMITTAL OF FINAL CLINTON POWER STATION ACCIDENT SEQUENCE PRECURSOR REPORT (LICENSEE EVENT REPORT 461-2017-010)
Dear Mr. Stoner:
By letter dated February 5, 2018 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML18040A463), Clinton Power Station submitted licensee event report (LER) 461-2017-010, "Division 1 Transformer Failure Leads to Instrument Air Isolation to Containment Requiring a Manual Reactor Scram," to the U.S. Nuclear Regulatory Commission (NRC) staff pursuant to Title 10 of the Code of Federal Regulations Section 50. 73. By letters dated August 3, 2018 (ADAMS Accession No. ML18219A731), and January 17, 2019 (ADAMS Accession No. ML19022A264), Clinton Power Station submitted revision 1 and revision 2 to the LER, respectively. As part of the Accident Sequence Precursor (ASP) Program, the NRC staff reviewed the event to identify potential precursors and to determine the probability of the event leading to a core damage state. The results of the analysis are provided in the enclosure to this letter.
The NRC does not request a formal analysis review in accordance with Regulatory Issue Summary 2006-24, "Revised Review and Transmittal Process for Accident Sequence Precursor Analyses" (ADAMS Accession No. ML060900007), because the analysis resulted in a conditional core damage probability (CCDP) of less than 1 x1Q-4.
Final ASP Analysis Summary. A brief summary of the final ASP analysis, including the results, is provided below.
Division 1 Transformer Failure Leads to Instrument Air Isolation to Containment Requiring a Manual Reactor Scram. This event is documented in LER 461-2017-010-02.
Executive Summary. On December 9, 2017, multiple alarms were received in the Clinton Power Station control room due to the unexpected opening of the 4.16 kilovolt (kV) alternating current (AC) bus '1 A1' breaker (1AP07EJ) , which feeds the division 1 480-volt (V) AC buses.
The loss of division 1 480 V AC power caused the outboard instrument air containment isolation valve to close and resulted in a subsequent loss of containment instrument air. In addition, the loss of the division 1 480 V AC buses resulted in the unavailability of the low-pressure core spray pump, residual heat removal pump 'A', the division 1 emergency diesel generator (EOG)
'A', and normal battery charging to the division 1 batteries. Approximately 4 minutes after the breaker 1AP07EJ opened, the control room operators inserted a manual scram in accordance with procedures for low scram pilot air header pressure and control rod drift annunciator alarms.
T. Stoner Operators performed a reactor cooldown of the reactor by directing steam to the main
- condenser using the main steam bypass valves and auxiliary steam equipment. Due to the loss of containment instrument air, the main steam isolation valves (MSIVs) began to close. In response to the expected closure of the MSIVs, operators aligned the main steam line drains to maintain pressure control. These drains were used in conjunction with the reactor core isolation cooling turbine to continue to cooldown to Mode 4.
According to the risk analysis modeling assumptions used in this ASP analysis, the most likely core damage sequence is reactor transient with a consequential loss of offsite power and postulated failures of the division 2 EOG 'B' result in a subsequent station blackout. Although high-pressure core spray is initially successful, operators fail to recover offsite power within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> resulting in the inability to vent containment, which results in the loss of all injection.
This accident sequence accounts for approximately 17 percent of the CCDP for the event.
Two Green (i.e., very low safety significance) findings were identified for this event. The first finding was associated with the licensee failure to perform corrective action to preclude repetition for a similar transformer failure that occurred in December 2013. The second finding was associated with the licensee failed to follow procedure that would classify three nonsafety-related 4.16 kV and 480 V transformers as operationally critical components.
Summary of Analysis Results. This operational event resulted in a best estimate CCDP of 8x1Q-6. The detailed ASP analysis can be found in the enclosure.
If you have any questions, please contact me at 301-415-6606 or Joel.Wiebe@nrc.gov.
Sincerely, Joel S. Wiebe, Senior Project Manager Plant Licensing Branch Ill Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Docket No. 50-461
Enclosure:
As stated cc: Listserv
ENCLOSURE Final Accident Sequence Precursor Analysis -
Clinton Power Station, Division 1 Transformer Failure Leads to Instrument Air Isolation to Containment Requiring a Manual Reactor Scram (LER 461-2017-010) - Precursor
Final ASP Pro Precursor Clinton Power Division 1 Transformer Failure Leads to Instrument Air Isolation Station to Containment Requiring a Manual Reactor Scram LER: 461-2017-010-02 Event Date: 12/9/2017 CCDP=
IR: 05000461/2017012 General Electric Type 6 Boiling-Water Reactor (BWR) with a Mark Ill Plant Type:
Containment Plant Operating Mode Mode 1 (97% Reactor Power)
(Reactor Power Level):
Analyst: Reviewer: Contributors: Approval Date:
Christopher Hunter Dale Yeilding N/A 3/21/2019 EXECUTIVE
SUMMARY
On December 9, 2017, multiple alarms were received in the Clinton Power Station control room due to the unexpected opening of the 4.16 kilovolt (kV) alternating current (AC) bus '1 A 1' breaker (1AP07EJ), which feeds the division 1 480-volt (V) AC buses. The loss of division 1 480 V AC power caused the outboard instrument air containment isolation valve to close and resulted in a subsequent loss of containment instrument air. In addition, the loss of the division 1 480 V AC buses resulted in the unavailability of the low-pressure core spray (LPCS) pump, residual heat removal (RHR) pump 'A', the division 1 emergency diesel generator (EOG)
'A', normal battery charging to the division 1 batteries. Approximately 4 minutes after the breaker 1AP07EJ opened, the control room operators inserted a manual scram in accordance with procedures for low scram pilot air header pressure and control rod drift annunciator alarms.
Operators performed a reactor cooldown of the reactor by directing steam to the main condenser using the main steam bypass valves and auxiliary steam equipment. Due to the loss of containment instrument air, the main steam isolation valves (MSIVs) began to close. In response to the expected closure of the MSIVs, operators aligned the main steam line (MSL) drains to maintain pressure control. These drains were used in conjunction with the reactor core isolation cooling (RCIC) turbine to continue to cooldown to Mode 4.
According to the risk analysis modeling assumptions used in this accident sequence precursor (ASP) analysis, the mostlikely core damage sequence is reactor transient with a consequential loss of offsite power (LOOP) and postulated failures of the division 2 EOG 'B' result in a subsequent station blackout (SBO). Although high-pressure core spray (HPCS) is initially successful, operators fail to recover offsite power within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> resulting in the inability to vent containment, which results in the loss of all injection. This accident sequence accounts for approximately 17 percent of the conditional core damage probability (CCDP) for the event.
Two Green (i.e., very low safety significance) findings were identified for this event. The first finding was associated with the licensee failure to perform corrective action to preclude repetition for a similar transformer failure that occurred in December 2013. The second finding 1
LER 461-2017-010-02 was associated with the licensee failure to follow procedure that would classify three nonsafety-related 4.16 kV and 480 V transformers as operationally critical components.
EVENT DETAILS Event Description. On December 9, 2017, multiple alarms were received in the Clinton Power Station control room due to the unexpected opening of the 4.16 kV AC bus '1 A 1' breaker (1AP07EJ), which feeds 480-volt (V) AC unit substation '1A' and 480 V AC unit substation '1A.'
The loss of 480 V AC power caused the outboard instrument air containment isolation valve to close and resulted in a subsequent loss of containment instrument air. Approximately 4 minutes after the breaker 1AP07EJ opened, the control room received a low scram pilot air header pressure alarm. Soon after, the control rod drift annunciator alarmed as expected and the control room operators inserted a manual scram in accordance with procedures.
Operators began cooling down the reactor by directing steam to the main condenser using the main steam bypass valves and auxiliary steam equipment. Due to loss of containment instrument air, the inboard MSIVs began to close slowly. Operators lined up the MSL drains to maintain pressure control and continue the cooldown in anticipation of MSIV closure as containment air pressure lowered. The last inboard MSIV indicated full closed about 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> after the instrument air containment isolation valve closed; however, the MSL drain valves remained available to the operators throughout the event. These drains were used in conjunction with the RCIC turbine to continue to cooldown to Mode 4.
This loss of division 1 480 V AC buses resulted in the unavailability of LPCS, RHR pump 'A',
and the division 1 EOG to fulfil their safety function for the complete mission time (i.e., 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />). 1 Normal charging capability to the division 1 batteries was also lost. Additional information is provided in licensee event report (LER) 461-2017-010-02 (Ref. 1) and inspection report (IR) 05000461/2017012 (Ref. 2).
Cause. The unexpected opening of breaker 1AP07EJ was due to a phase-to-ground fault on 480 V transformer 1A. Subsequent vendor testing determined that the ground fault was caused by excessive layer-to-layer design stress within the 4.16 kV transformer winding. This preexisting design defect resulted in the issuance of a 10 CFR Part 21 notification to the NRC.
Additional Event Information. The following event details are provided as additional information about the event. This additional information was not factored in the modeling of this analysis due to the negligible risk impact.
- The RCIC system was declared inoperable because the 480 V AC power was lost to water leg pump and, therefore, operators could not ensure the system was free of voids.
NRC inspectors determined that although the RCIC system was appropriately declared inoperable, the system was available (if necessary) for pressure/inventory control and decay heat removal.
- The isolation of instrument air to containment affected some components in the reactor water cleanup (RWCU) and control rod drive (CRD) systems. The safety-related The division 1 EOG was rendered unable to fulfil its safety function for the complete mission time of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> due to loss 480V AC power to its associated fuel oil transfer pump. The fuel oil transfer pump starts as soon as the level in its associated day tank starts decreasing. Withoutthe fuel oil transfer pump, the day tank only has enough fuel to run the EOG for approximately 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. In addition, the circulating oil and turbo soakback pumps were also unavailable due to the loss of division 1 480 V AC power. However, the loss of these two pumps is not expected to result in a loss of safety function of the EOG.
2
LER 461-2017-010-02 aspects of the RWCU system are typically limited to the containment isolation requirements. The standardized plant analysis risk (SPAR) models typically have limited modeling of the RWCU system and containment isolation; however, their inclusion would not affect the analysis for this initiating event. Therefore, no modeling of RWCU system and its components was needed for this analysis. The CRD system component unavailabilities were limited to the scram pilot air header and did not affect the CRD pumps as a potential source of RCS inventory makeup. The SPAR model only credits CRD makeup from 1 of 2 pumps if RCIC is initially successful. The model does not credit enhanced two-pump flow, which may require instrument air inside containment.
Therefore, no model changes for the CRD system were needed for this analysis.
MODELING SDP Results/Basis for ASP Analysis. The ASP Program performs independent analyses for initiating events. ASP analyses of initiating events account for all failures/degraded conditions and unavailabilities (e.g., equipment out for test/maintenance) that occurred during the event, regardless of licensee performance. 2 Additional LERs were reviewed to determine if concurrent unavailabilities existed during the December 9th event. No windowed events or concurrent degraded operating conditions were identified.
In response to this event, the NRC performed a special inspection per Management Directive 8.3, "NRC Incident Investigation Program." The special inspection (as documented in IR 05000461/2017012 ) revealed two Green (i.e., very low safety significance) findings. The first finding was associated with the licensee failure to perform corrective action to preclude repetition for a similar transformer failure that occurred in December 2013. The second finding was associated with the licensee failing to follow procedure that would classify three nonsafety-related 4.16 kV and 480 V transformers as operationally critical components. Both findings were screened out (i.e., no detailed risk evaluation was performed) using Inspection Manual Chapter 0609, Attachment 4, "Initial Characterization of Findings at Power," and Appendix A, "The Significance Determination Process for Findings at Power." The LER remains open.
Analysis Type. An initiating event analysis was performed using the Clinton Power Station SPAR model, Revision 8.54, modified on December 20, 2017. This event was modeled as a general plant transient with a loss of instrument air to the containment and loss of division 1 480 V AC power.
SPAR Model Modifications. The following modifications were required for this initiating event assessment:
- The base SPAR models provide credit for EDG repair for SBO scenarios; however, the analyst must determine whether credit should be applied given the specific circumstances surrounding the event being analyzed. The probabilities of successful repair of an EDG in the base SPAR models are calculated using the data from the unplanned unavailability mitigating system performance index (MSPI). There are questions on the applicability of this data. First, this repair data is not collected under SBO conditions (e.g., reduced lighting). Second, during postulated SBO scenarios, multiple EDG failures have occurred, thus further complicating troubleshooting activities, 2
ASP analyses also account for any degraded condition(s) identified after the initiating event occurred, if the failure/degradation exposure period(s) overlapped the initiating event date.
3
tER 461-2017-010-02 which would likely increase the time to repair. Given these uncertainties, repair credit for EDG failures is limited to cases where event information supports this credit. Repair credit for postulated failures of the EDGs is not provided in this analysis. 3 The issue of crediting EDG repair is noted as a key modeling uncertainty for this analysis and will be discussed with internal stakeholders to det~rmine if consensus approach can be developed.
- The CVS ( containment venting) fault tree was modified to eliminate duplicative operator actions to initiate containment venting. Specifically, basic events CVS-XHE-XM-VENT1 (operator fails to vent containment through CGP), CVS-XHE-XM-VENT2 (operator fails to vent containment through FC to SFP), and CVS-XHE-XM-VENT3 (operator fails to vent containment through RHR A to FP) were deleted. The operator action to vent containment is already accounted for in the model via basic event CVS-XHE-XM-VENT (operator fails to vent containment). The modified CVS fault tree is shown in Figure B-1 of Appendix B.
- The base model does not explicitly include modeling of the 480 V AC portion of the electrical distribution system. During the event, the 4.16 kV bus '1 A 1' breaker 1AP07EJ, which feeds both division 1 480 V buses (1AP11 E and OAP05E), opened due to a fault on 480 V transformer '1A.' This caused the unavailability of the LPCS pump, RHR pump 'A', and the division 1 EDG. To account for the dependency of these pumps on 480 V AC power, a new basic event ACP-BAC-LP-480V-DIV1 ( 480V division 1 buses are unavailable) was inserted in the LPCS fault tree (under the LCS-MDP-SS subtree),
RHR pump A fault tree (under the RHR-MDPA-SS subtree), and DGA-SS fault tree (under gate DGA-SS8). 4 These modified faults trees are shown in Figure B-2 ,
Figure B-3, and Figure B-4 of Appendix B.
- The loss of division 1 480 V buses also resulted in the loss of normal battery charging for the division 1 batteries. During the event, operators successfully aligned the class 1E swing charger to supply the division 1 batteries. To account for the loss of normal battery charging on the division 1 batteries and the potential for aligning the swing charger, fault tree DCP-125V-1A-LT (Clinton division 1125 VDC power is unavailable) was modified. Specifically, a new 'AND' gate was added under the top gate with the new basic events ACP-BAC-LP-480V-DIV1 and a DCP-XHE-SWINGCHARGER (operators fail to align the swing charger) inserted under this new gate. Basic event DCP-XHE-SWINGCHARGER was set to IGNORE in the base model. This modified fault tree is shown in Figure B-5 of Appendix B.
- The only modeling of instrument air system in the current SPAR model is via house event HE-LOIAS (loss of instrument air system initiating event has occurred), which is used alone or within the IAS ( Clinton instrument air) fault tree. Dependency on the instrument air system is limited in the current SPAR model (e.g., power conversion 3 The applicable EOG recovery basic events: EPS-XHE-XL-NR30M (operator fails to recover emergency diesel in 30 minutes), EPS-XHE-XL-NR02H (operator fails to recover emergency diesel in 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />), EPS-XHE-XL-NR04H (operator fails to recover emergency diesel in 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />), and EPS-XHE-XL-NR 12H ( operator fails to recover emergency diesel in 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />) were set to TRUE in the base SPAR model.
4 The ZT-BAC-LP (AC bus fails to operate) default template was used for this basic event.
4
LER 461-2017-010-02 system, condenser, containment venting, RCIC}. 5
- 6 During the event, the loss instrument air was limited to components/systems inside containment and, therefore, only containment venting and power conversion system were affected. 7 The PCS fault tree assumes that PCS is rendered unavailable given a complete loss of instrument air, which would fail MFW because of lack of makeup to condenser hotwell and render the condenser heat sink unavailable due to the closure of MS IVs. Since instrument air was only lost in containment, feedwater and the condenser heat sink remained available throughout the event and operators were able to align the MSL drains to the condenser, two changes were made to the PCS fault tree. First, the IAS transfer tree and a new basic event PCS-XHE-XM-MSLDRAINS (operators fail to align the MSL drains to the condenser) were added under a new 'AND' gate. Basic event PCS-XHE-XM-MSLDRAINS was set to IGNORE in the base model. The modified PCS fault tree is shown in Figure B-6 of Appendix B. Second, the IAS transfer tree was deleted from the CDS-HW ( Clinton condensate hotwe/1 makeup is unavailable) fault tree.
The modified CD-HW fault trees are shown in Figure B-7 of Appendix B.
- Errors associated with late injection modeling were identified in two event trees, 1SORV
( Clinton transfer - one stuck open SRV) and LOOP-1 ( Clinton transfer - one stuck open SRV). Specifically, transient (TRANS) sequences 65-33 and 67-38-19 incorrectly assumed a failure of late injection. The transfers for these two sequences were changed from LI02 (Clinton late injection fault tree) to LIOO (Clinton late injection fault tree).
Key Modeling Assumptions. The following modeling assumptions were determined to be significant to the modeling of this initiating event assessment:
- The operators manually scrammed the reactor due to low scram header air pressure; therefore, the probability of IE-TRANS (general plant transient initiating event) was set to 1.0. All other initiating event probabilities were set to zero.
- Basic event ACP-BAC-LP-480V-DIV1 was set to TRUE due to the loss of the division 1 480 V AC buses caused by the opening of the 4.16 kV bus 1A 1 breaker 1APO?EJ as result of the transformer fault.
- Basic event HE-LOIAS was set to TRUE to account for the loss of instrument air inside containment. Recovery potential for instrument air to the containment was not credited in this analysis since that portion of the air system was not recovered for over 16 hours1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br /> after initiation of the event.
- The human failure event (HFE) DCP-XHE-SWINGCHARGER was evaluated using SPAR-H (Ref. 3 and Ref. 4); see Appendix C for additional information. The human error probability (HEP) for DCP-XHE-SWINGCHARGER was calculated to be 1x10-2 .
5 The CND (main condenser heat sink) fault tree also has an instrument air system dependency; however, this fault tree is only used in the loss of feedwater event tree. Modeling associated with the condenser is included in the PCS (power conversion system) fault tree for the TRANS (general transient) event tree.
6 The use of house event HE-LOIAS in the RCIC pump modeling in the RCI-SS-LT (RCIC support systems) subtree corresponds to different support system requirements needed for different initiating events and was not intended to model a RCIC system dependency for instrument air. Therefore, this modeling does not need to be modified for this event analysis.
7 In addition to the condensate and feedwater systems, the power conversion system includes modeling of the MSIVs.
5
LER 461-2017-010-02
- The HFE PCS-XHE-XM-MSLDRAINS was evaluated using SPAR-H; see Appendix C for additional information. The HEP for PCS-XHE-XM-MSLDRAINS was calculated to be 1X 10-3 .
ANALYSIS RESULTS CCDP. The conditional CCDP for this analysis is calculated to be 8.3x10~. The ASP Program acceptance threshold is a CCDP of 1x 1o~ or the CCDP equivalent of an uncomplicated reactor trip with a non-recoverable loss of feed water or the condenser heat sink), whichever is greater.
This CCDP equivalent for Clinton Power Station is 2.3x10~. 8 Therefore, this event is a precursor.
Dominant Sequence. The dominant accident sequence is transient sequence 67-40-06 (CCDP = 1.4x 10~). which contributes approximately 17 percent of the total internal events CCDP. The dominant sequences that contribute at least 1.0 percent to the total internal events CCDP are provided in the following table. The dominant sequence is shown graphically in Figure A-1 , Figure A-2, and Figure A-3 and Appendix A.
Sequence CCDP Percentage Description TRANS 67-40-06 1.44x1Q~ 17.40% Successful reactor trip; consequential LOOP occurs; EDGs fail resulting in a SBO; HPCS succeeds; operators fail to recover offsite power in 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />; containment venting fails resulting in a loss of all injection TRANS 67-40-24 1.39x10~ 16.80% Successful reactor trip; consequential LOOP occurs; EDGs fail resulting in a SBO; HPCS fails, but RCIC succeeds; operators successfully shed DC loads; I operators fail to recovery offsite power in 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> TRANS 67-40-30 7.83x10*7 9.50% Successful reactor trip; consequential LOOP occurs; EDGs fail resulting in a SBO; RCIC and HPCS fail; operators fail to recovery offsite power in 30 minutes TRANS 67-35 5.15x10*7 6.20% Successful reactor trip; consequential LOOP occurs; EDGs successfully provide power to safety-related buses; RCIC and HPCS fail; reactor depressurization succeeds; low-pressure injection succeeds; suppression pool cooling and containment spray fails ;
containment venting fails resulting in a loss of all injection TRANS 67-40-31-13 5.06x10*7 6.10% Successful reactor trip; consequential LOOP occurs; EDGs fail resulting in a SBO; recirculation pump seals fail resulting in a small loss-of-coolant accident (SLOCA); RCIC and HPCS fail TRANS 67-40-32-13 4.85x10*7 5.90% Successful reactor trip; consequential LOOP occurs; EDGs fail resulting in a SBO; a stuck-open relief valve results in a SLOCA; RCIC and HPCS fail 8 For BWRs, a loss of condenser heat sink initiating event typically assumes that the condensate system is available to provide a source of low-pressure injection to the reactor.
6
LER 461-2017-010-02 Sequence CCDP Percentage Description TRANS 65-07 4.80x10- 7 5.80% Successful reactor trip; a stuck-open relief valve results in a SLOCA; feedwater succeeds; suppression pool cooling and containment spray fails; containment venting fails resulting in a loss of all injection TRANS 67-13 3.15x1Q-7 3.80% Successful reactor trip; consequential LOOP occurs; EDGs successfully provide power to safety-related buses; HPCS fails, but RCIC succeeds; suppression pool cooling fails; reactor depressurization succeeds; low-pressure injection succeeds; containment spray fails; containment venting fails resulting in a loss of all injection TRANS 67-07 2.87x10-7 3.50% Successful reactor trip; consequential LOOP occurs; EDGs successfully provide power to safety-related buses; RCIC and HPCS succeed; suppression pool cooling and containment spray fails; containment venting fails resulting in a loss of all injection TRANS 63 2.52x10-7 3.10% Successful reactor trip; power conversion system fails; feedwater fails; RCIC and HPCS fail; reactor depressurization succeeds; low-pressure injection fails TRANS 67-40-31-06 1.60x1Q-7 1.90% Successful reactor trip; consequential LOOP occurs; EDGs fail resulting in a SBO; recirculation pump seals fail resulting in a SLOCA; HPCS succeeds; operators fail to recover offsite power in 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />; containment venting fails resulting in a loss of all injection TRANS 67-40-31-09 1.54X1 O-l 1.90% Successful reactor trip; consequential LOOP occurs; EDGs fail resulting in a SBO; recirculation pump seals '
fail resulting in a SLOCA; HPCS fails but RCIC succeeds; operators successfully shed DC loads; operators fail to recovery offsite power in 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> TRANS 67-40-32-06 1.53x1Q-7 1.90% Successful reactor trip; consequential LOOP occurs; EDGs fail resulting in a SBO; a stuck-open relief valve results in a SLOCA; HPCS succeeds; operators fail to recover offsite power in 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />; containment venting fails resulting in a loss of all injection TRANS 67-40-32-09 1.48x1Q-7 1.80% Successful reactor trip; consequential LOOP occurs; EDGs fail resulting in a SBO; a stuck-open relief valve results in a SLOCA; HPCS fails but RCIC succeeds; operators successfully shed DC loads; operators fail to recovery offsite power in 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> TRANS 67-28 1.45X1 O-? 1.80% Successful reactor trip; consequential LOOP occurs; EDGs successfully provide power to safety-related buses; RCIC fails, but HPCS succeeds; suppression pool cooling and containment spray fails; operators fail to recover the power conversion system; containment venting fails resulting in a loss of all injection TRANS 67-37 1.03x1Q-7 1.30% Successful reactor trip; consequential LOOP occurs; EDGs successfully provide power to safety-related buses; RCIC and HPCS fail; operators fail to depressurize the reactors 7
LER 461-2017-010-02 Sequence CCDP Percentage Description TRANS 67-40-28-31 9.81 x1Q-8 1.20% Successful reactor trip; consequential LOOP occurs; EDGs fail resulting in a SBO; RCIC and HPCS fail; operators successfully recovery offsite power in 30 minutes; reactor depressurization succeeds; low-pressure injection fails TRANS 67-38-14 9.42x10-8 1.10% Successful reactor trip; consequential LOOP occurs; EDGs successfully provide power to safety-related buses; a stuck-open relief valve results in a SLOCA; HPCS fails, but RCIC succeeds; low-pressure injection succeeds; suppression pool cooling and containment spray fails; operators fail to align the MSL drains; containment venting fails resulting in a loss of all injection Key Modeling Uncertainties. The base SPAR models provide credit for EDG repair and recovery; however, it is up to the analyst to determine whether credit should be applied given the specific circumstances surrounding the event being analyzed . This ASP analysis does not credit repair of postulated EDG failures. A sensitivity analysis was performed crediting EDG repair of postulated failures of the division 1 EDG using the unplanned unavailability MSPI data.
With this credit applied, the llCDP for the second exposure period decreases from 8.3x1Q-6 to 6.9x 10-6 (a decrease of approximately 17 percent).
Successful equipment operation is treated probabilistically in ASP analyses (i.e., success is not assumed), while observed failures are modeled as such. 9 However, barring any postulated failures, the division 1 EDG would run until the fuel supply in its associated day tank was depleted (approximately 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />). To show the effects of this modeling uncertainty, a sensitivity analysis was performed allowing an additional 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> for operators to recover offsite power during postulated LOOP scenarios. With this credit applied, the llCDP for the second exposure period decreases from 8.3x 10-6 to 6.2x 10-6 (a decrease of approximately 25 percent).
REFERENCES
- 1. Clinton Power Station, "LER 461/17-010 Division 1 Transformer Failure Leads to Instrument Air Isolation to Containment Requiring a Manual Reactor Scram," dated January 17, 2019 (ADAMS Accession No. ML19022A264).
- 2. U.S. Nuclear Regulatory Commission, "ERRATA- Clinton Power Station - NRC Special Inspection Report 05000461/2017012," dated January 29, 2018 (ADAMS Accession No. ML18029A863).
- 3. Idaho National Laboratory, NUREG/CR-6883, "The SPAR-H Human Reliability Analysis Method," August 2005 (ADAMS Accession No. ML051950061 ).
- 4. Idaho National Laboratory, "INUEXT-10-18533, SPAR-H Step-by-Step Guidance,"
May 2011 (ADAMS Accession No. ML112060305).
9 This general modeling technique is called the "failure" memory approach .
8
LER 461-2017-010-02 Appendix A: Key Event Tree I
I I
I I I
- ~
I I I
I
,-o--L-o-- I
.-0--- .------0--
0---
.,, I
- I
- - .------0--
L---o----
)
)
)
)
Figure A-1. Clinton General Transient Event Tree A-1
LER 461-2017-010-02 o-e~- o~ ,- 0----
o-e~- ~
o-e~,0~~ -
. o~ *=
I"'--
- ..,.
- V" Figure A-3. Modified Clinton SBO Event Tree A-3
LER 461-2017-010-02 Appendix B: Modified Fault Trees I
lelTPA116AAEIJII.VQAIIE
~ J I
OPIRA'JtlR FAILS1011M" I
OPIRAlOR FAILS TO lelT CONTUMNTGl\91 S85IIC COITTAitffNT E\tN1' C\S-1 IC6-H:¥ !extl IC6->>£-XH-lelT 11.00E--OJ Ii 0 COOAJlffN1"SPRAYl£AOO! COHTAIIHNT\8111Ni 1l<<ltGi ~lJIIIBIPOOllelT
\BIT PAlli IS 1.111.IIIIIAllf ClMCONIIIU)USJIUG: (CCP) PAlli(VIA FC)ISIJII.VQAIIE C\S-2 cvs-4 C\S-3
~ I
~I I
~
CUNT0N Cl\!SJON I AC POYtB! RIRACOOAitffNTlelTl()V 11 CUNTONINSTRlHNTAIRS"ISTIM I I IOJSEE\ffiT*LOSSOFOFfS!TE 11 CONTIN.Ol.5PLRGElelTVALII: 11 QJNTONllllSIONIACPOMR I JHIIUllelTVALll:FCOl2BFAILS SYSl9I FAIA.T'lm 27AFAILSTOOPEN FAIA.T'lm POYtB!IEHASQCCLRRII) I-FAILS TO OPEN SYS191FAIA.T'IRII: r TOOPEN jACP-<<\fl.15-IAI !&ti jRIR-M>V<C*F027A 1B.16f-041 IJAS leitj 11£,!.Q()f> IFa"'I AOV-CC*IIW68 7.55E-04 ,ACJl;l\'lll6;1AI !Ell ~C-FC012B ]4.59E-04 Ii RIRA CONTAitffNTlelT l()V 28A FAILS TO OPEN CUNTONJl\4SlllNIACl'O'MR S1SIEM FAIA.TlRlf Q CONTIN..Ol.6 PLRGE lelTVALII:
l.ml6AFAILSTOOPEN CUNTON llllSION DAC POYtB!
SYS191FAIA.Tlm COHTlelT l1lV FC007 FAILS TO OPEN IRH!-M>V<C-f028A I I 8.16E-04 IAC:P-41Ml.&1AI I~ C\S-AOV-CC-VR06A l7.55E-04I IAC:P-41M1.&1BI !ext! ~C'6-H:JY<C-FC007 IB.lif-04
-.W. lelTVALII: F099 FAILS TO OPEN Ii 0 Ii COHTIBITl1lV FC008 FAILS TO OPEN C'6-JMl.(C-F099 l4.59E-04 C'IS-l'OV-CC-FC008 JB.16f-04 Mm.JAL lelT VALi!: FC090 FAILS TO OPEN 0 C\S-IMI-CC-FC090 l4.59E-04
-.W. \ffirVALII: Fein FAILS TO OPEN C\S-IMI-CC*FCln l4.59E-04 0
Figure B-1. Modified Containment Venting Fault Tree B-1
LER 461-2017-010-02 LPCS LCS-MDP-SS I I LPCS PUMP ROOM COOLING IS CLINTON DMSION I AC POWER 480V DMSION 1 BUSES ARE UNAVAILABLE SYSTEM FAULTTREE UNAVAILABLE LCS-MDP-SS-1 ACP-4KV8US-1A1 IExt ACP-BAC-LP-480V-D1V1 2.29E-05 CLINTON DMSION I 125 VOC POWER IS UNAVAILABLE OCP-125V-1A-LT IExt Figure B-2. Modified LCS-MDP-55 Fault Tree B-2
LER 461-2017-010-02 CLINTON FAIWRE OF RHR MOP 1A RHR*MDPA-SS I I FAILURE OF ROOM COOLING FOR CLINTON DMSION I AC POWER 480V DIVISION 1 BUSES ARE RHR PUMP A SYSTEM FAULT TREE UNAVAILABLE RHR-MDPA-SS-1 ACP-4KVBUS-1A1 Ext !ACP-BAC-LP-480V-DIV1 !2.29E-05
~---- CLINTON DMSION I 12s voe ( )
POWER IS UNAVAILABLE OCP-125V-1A-LT Ext Figure B-3. Modified RHR-MDPA-55 Fault Tree B-3
LER 461-2017-010-02 DIESEL-GENERATOlffA SUPPORT SYSTEM FALURES DGA-SS l I
~ I I DIESEL GENERATOR 1A SSW SYSTEM FAU..S TO DG1A FALURE OF DG1A HVAC DG1AFUEL OU.. FAILURES ELECTRICAL FAULTS DGN-SSWA DGA-SS-1 Extemal DGA-883 DGA-SSS H D H T
FUEL OIL PUMP 1A FAILS TO START FH~DP-FS-D01A 7.84E-04 FUEL OIL PUMP 1A FAILS TO RUN FHS-MDP-FR-001 A 3 .87E-04 FOPUMPSA,B,C FAIL FROM COMMON CAUSE TO START FHS-MDP-CF-FS 6.23E-06 FO PUMP A,B,C FAIL FROM COMMON CAUSE TO RUN FHS-MDP-CF-FR 2 .90E-06 F0 PUMPS A,B FAIL FROM COMMON CAUSE TO START FHS-MDP-CF-FSAB 1.99E-05 F0 PUMPS A,C FAIL FROM COMMON CAUSE TO START FHS-MDP-CF-FSAC 1.99E-05 480V DIVISION 1 BUSES ARE UNAVAILABLE ACP-BAC-LP-480V-DIV1 2.29E-05 u
Figure B-4. Modified DGA-SS Fault Tree B-4
LER 461-2017-010-02 CUNTON DIVISION I 125 VDC POWER IS UNAVAILABLE DCP-125V-1A-LT I f.*
I LOSS OF DMSION 1 POWER CUNTON DMSION I AC POWER FAILURE OF DIVISION I 125VDC BUS RESULTS IN LOSS OF BATTERY SYSTEM FAULTTREE 1A CHARGING CAPBIUTY DCP-125V-1A-LT-2 .. ACP-4KVBUS-1Al Ext 0CP-B0C-LP-1A I5.21E-06 u DC BATT CHARGERS FAILURE FROM SEISMIC EVENT FAILURE OF DIVISION I 125VDC BATTERY CHARGER 480V DIVISION 1 BUSES ARE Ext DCP-BCH-LP-1A I 6.17E-05 UNAVAILABLE I BATTERY CHARGERS FAIL FROM COMMON CAUSE ACP-BAC-LP-480V-DIV1 I 2.29E-05 OPERATORS FAIL TO ALIGN SWING OCP-BCH-CF-CHRS I2. lOE-07 CHARGER DCP-XHE-XM-SWINGCHARGERI Iqnore Figure B-5. Modified OCP-125V-1A-LT Fault Tree B-5
LER 461-2017-010-02 POWER CONVERSION SYSreM PCS FEEDWATER FAIWRE OF STEAM CONDENSING FUNCTION OF PCS MFW Ext PCS-1 I I I STEAM SYSTEM FAILS MSIVS AND MSl DRAINS ARE CUNTON MAIN CIRCULATING HOUSE EVENT - TOTAL LOSS OF ISOLATED WATER IS UNAVAILABLE CONDENSER HEAT SINK INITIATOR PCS-2 PCS-3 MCW lExt HE-LOCHS I False
~
STEAM LOOP VALVES FAIL TO CLINmN INSTRUMENT AIR SYSTEM
~
r I
OPERATORS FAIL TO ALIGN MSL OPEN/REMAIN OPEN FAULTTREE DRAINS IM<<-MSV-OC-STEAM 17.44E-06 IAS IExt PCS-XHE-XM-MSLDRAINS IIonore TURBINE BYPASS VALVES FAIL TO nD~N OPEN MSS-TBV-CC-BYPAS 3.12E-03 Figure B-6. Modified PCS Fault Tree 8-6
LER 461-2017-010-02 CLINTON CONDENSATE HOlWEU.
MAKEUP IS UNAVAILABLE CDS-HW I
FAIWRE OF HOlWEU. INVENTORY CONDENSATE STORAGE TANK CONDENSATE STORAGE TANK IS FAIWRE FROM SEISMIC EVENT UNAVAILABLE CDS-HW-1 1cos-TNK-EQ x !Ext! 1cos-TNK*FC*CST l6. 26E*061 HOlWEU. LEVEL CONTROL VALVE 2 FAILS FAILURE TO MAINTAIN HOlWEU. INITIATORS WITHOUT STEAM COS-AOV*CC*MKUP2 C
- 11. 55E*04 INVENTORY RETURN TO HOlWEU. HOlWEU. LEVEL CONTROL VALVE 1 FAILS CDS-HW-3 CDS-HW-2 COS-AOV*CC*MKUPl f 7.55E*04f 0
FAIWRE TO CONTROL CD/CB FLOW lWO OR MORE B'WR SRVS FAIL TO HOUSE EVENT* SMALL LOSS*OF*
TOPREVENTEMPTYINGHOTWEU. CLOSE COOLANT ACCIDENT INITIATOR 1rnc:-XHE*XM*HOTWELL I 1.00E-03 --.V-00*2VLVS 2.00E-03 HE-SLOCA I False set to PSA value of O. 067 ONE BWR SRV FAILS TO CLOSE INADVERTENT OPEN RELIEF VALVE (IORV) HAS OCCURRED CDS-TNK*FC-CYMC l6.26E*06 PPR*SRV*OO*lVLV 9.60E*02 HE*IORV I False FAILURE OF CIRCUIT BREAKER HOUSE EVENT* TOTAL LOSS OF 501A TO OPEN (UAT) CONDENSER HEAT SINK INITTATOR ACP-CRB-CC*501A I 2.49E*03 HE-LOCHS I False FAILURE OF CIRCUIT BREAKER 501BTO OPEN (UAT)
ACP*CRB-CC*501B I 2.49E*03 SJAE MIN FLOW TO COND VALVE 1CD039 FAILS TO CLOSE CDS-AOV*CC-039 I 7.SSE-04 Figure B-7. Modified CDS-HW Fault Tree 8-7
LER 461-2017-010-02 Appendix C: Evaluation of Key HFEs Operators swing charger to supply the division 1 batteries.
If normal battery charging capability is lost via the 480 V division 1 AC buses, operators can align the swing charger to prevent a loss of division 1 direct current (DC) power.
Operators successfully align the swing charger to supply the division 1 batteries prior to batter depletion (2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />).
Low DC bus voltage CPS 3503.01 C006, "Class 1E Swing Battery Charger 1DC11 E Feed to Safety-Related DC Bus Checklist" This HFE only contains both diagnosis and action activities.
Multiplier PSF Notes Diagnosis/Action The nominal battery depletion time of the safety-related batteries is 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> without shedding of DC loads. With successful load shedding, the battery life can be extended to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />. In addition, During the event, a loss of division 1 AC loads (as occurred during the event) reduces the depletion rate. The time estimated to align the swing charger is approximately 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. This would leave a maximum of 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> available for diagnosis under the most restrictive scenario (i.e. nominal depletion rate and, low Time Available 1/ 1 bus voltage threshold quickly reached). However, there could be less time. Given this uncertainty, the diagnosis PSF for available time is set to Nominal.
Sufficient time exists to perform the action component of the offsite power recovery; therefore, the action PSF for available time is set to Nominal. See Reference 4 for guidance on apportioning time between the diagnosis and action components of an HFE.
Stress, Complexity, Procedures No event information is available to warrant a change in Experience/Training, 1/ 1 these PSFs (diagnosis or action) from Nominal for this Ergonomics/HM I, HFE.
Fitness for Duty, Work Processes The HEP is calculated using the following SPAR-H formula:
HEP = (Product of Diagnosis PSFs x Nominal Diagnosis HEP) + (Product of Action PSFs x Nominal Action HEP)
- (1 X 0.01) + (1 X 0.001): 1x10-2 Therefore, the human error probability for DCP-XHE-SWINGCHARGER was set to 1 x10-2 .
C-1
LER 461-2017-010-02 Evaluation of PCS-XHE-XM-MSLDRAINS o erators fail to a/i n the MSL drains to the condense
'll;il 1111\IVI I Operators use MSL drains for reactor pressure control.
Description and If the condenser is available, but the MSIVs are closed (or expected to close)
Event Context operators can align the MSL drains to for reactor pressure control.
Operator Action Operators align MSL drains to the main condenser to maintain steam path prior Success Criteria to closure of all MSIVs.
Key Cue(s) MSIV{s) closing or expected closure of MSIVs Procedural EOP-1, "RPV Control" and CPS 4411 .09, "RPV Pressure Control Sources" Guidance Diagnosis/Action This HFE only contains both diagnosis and action activities.
Multiplier PSF Notes Diagnosis/Action During the event, the last inboard MSIV did not close until approximately 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> after instrument air to containment was isolated . The time estimated to align the MSL drain is conservatively estimated to be 30 minutes. This would leave at least 3.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> available for diagnosis. The nominal time for diagnosis is estimated to take 5 minutes.
Since the 3.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> available for diagnosis is greater than Time Available 0.01 I 1 2x nominal time and greater than 30 minutes, the diagnosis PSF for available time is set to Expansive.
Sufficient time exists to perform the action component of the offsite power recovery; therefore, the action PSF for available time is set to Nominal. See Reference 4 for guidance on apportioning time between the diagnosis and action components of an HFE.
Stress, Complexity, Procedures No event information is available to warrant a change in Experience/Training, 1/ 1 these PSFs (diagnosis or action) from Nominal for this Ergonomics/HM I, HFE.
Fitness for Duty, Work Processes The HEP is calculated using the following SPAR-H formula:
HEP = (Product of Diagnosis PSFs x Nominal Diagnosis HEP) + (Product of Action PSFs x Nominal Action HEP)
- (.01 X 0.01) + (1 X 0.001) : 1x10-3 Therefore, the human error probability for PCS-XHE-XM-MSLDRAINS was set to 1x10-3 _
C-2
Package ML19092A162; Letter ML19092A159; ASP Repo rt ML19050A510 OFFICE NRR/D0RL/LPL3/PM NRR/D0RL/LPL3/LA NRR/D0RL/LPL3/PM NAME JWiebe SRohrer JWiebe DATE 04/03/19 04/02/19 04/03/19