ML19169A279

Final Accident Sequence Precursor Analysis- Pilgrim Nuclear Power Station, Reactor Core Isolation Cooling System Declared Inoperable During Surveillance Testing

ML19169A279
Person / Time
Site:	Pilgrim
Issue date:	08/12/2019
From:	NRC/RES/DRA
To:
C. Hunter
References
LER-293-2019-001
Download: ML19169A279 (8)

Text

Final ASP Program Analysis - Precursor Accident Sequence Precursor Program - Office of Nuclear Regulatory Research Pilgrim Nuclear Power Reactor Core Isolation Cooling System Declared Inoperable Station During Surveillance Testing LER(s): 293-2019-001 Event Date: 1/08/2019 &'3 3x10-6 IR(s): TBD General Electric Type 3 Boiling-Water Reactor (BWR) with a Mark I Plant Type:

Containment Plant Operating Mode Mode 1 (100% Reactor Power)

(Reactor Power Level):

Analyst: Reviewer: &RQWULEXWRUV Approval Date:

Matthew Leech Christopher Hunter N/A 6/21/2019

(;(&87,9(6800$5<

On January 8, 2019, the reactor core isolation cooling (RCIC) pump turbine was started from the main control room for a quarterly surveillance test. During the test run, the turbine did not reach rated flow conditions. Operators identified that flow controller FIC-1340-1 output meter was unexpectedly indicating zero. Operators attempted to change demand by increasing the flow controller setpoint, but no change in output or flow occurred. Operators then manually stopped the RCIC turbine from the main control room and declared the RCIC system inoperable.

Licensee troubleshooting determined that the probable cause of the RCIC pump failure to reach rated flow was flow controller FIC-1340-1 output signal loss. Following replacement of the failed flow controller and successful testing, RCIC was declared operable on January 10th. RCIC was previously run satisfactorily on September 26, 2018.

This accident sequence precursor (ASP) analysis reveals that the most likely core damage scenarios are a loss of feedwater or loss of condenser heat sink with RCIC unavailable and the postulated unavailability of the high-pressure coolant injection (HPCI) and failure of operators to depressurize the reactor. These accident sequences account for approximately 57 percent of the increase in core damage probability (CDP) for the event. The point estimate CDP for this event is 3x10-6 (internal events), which is considered a precursor under the ASP Program. The seismic contribution for this event is CDP of 2x10-7.

To date, no performance deficiency associated with this event has been identified and, therefore, an ASP analysis was performed since a Significance Determination Process (SDP) evaluation was not performed.

1

LER 293-2019-001 (9(17'(7$,/6

Event Description. On January 8, 2019, the RCIC pump turbine was started from the main control room for a quarterly surveillance test. During the test run, the turbine did not reach rated flow conditions. Operators identified that flow controller, FIC-1340-1, output meter was unexpectedly indicating zero. Operators attempted to change demand by increasing the flow controller setpoint, but no change in output or flow occurred. Operators then manually stopped the RCIC turbine from the main control room and declared the RCIC system inoperable.

Licensee troubleshooting determined flow controller FIC-1340-1 output signal failed. Following replacement of the failed flow controller and successful testing, the RCIC system was declared operable on January 10th. Additional information is provided in licensee event report (LER) 293-2019-001 (Ref. 1).

&DXVH Based on troubleshooting and investigation of the condition the licensee determined that the probable cause is output signal loss to the flow controller. All other potential failure causes were eliminated.

02'(/,1*$668037,216

Analysis Type. The Pilgrim standardized plant analysis risk (SPAR) model, Version 8.56 dated April 19, 2019, was used for this condition assessment.

SDP Results/Basis for ASP Analysis. The ASP Program uses SDP results for degraded conditions when available (and applicable). To date, issued inspection reports for Pilgrim Nuclear Power Station do not provide additional information on this event. Discussions with Region 1 staff indicated that no performance deficiency has been identified to date; however, the LER remains open. An independent ASP analysis was performed because there was no performance deficiency identified and the potential risk significance of this event.

A search for additional Pilgrim LERs was performed to determine if any initiating events or additional unavailability existed during the exposure period of RCIC pump. No concurrent degraded conditions were identified; however, on October 5, 2018 a plant trip occured during the RCIC pump exposure period. An initiating event assessment was performed for a reactor trip with the concurrent unavailability of RCIC. The conditional core damage probability (CCDP) for this windowed event is bounded by the plant-specific CCDP of a nonrecoverable loss of condenser heat sink. Therefore, the risk impacts of the October 5th reactor trip are not evaluated further as part of this analysis.

Exposure Period. The exact time of failure of the flow controller is not known and could have occurred any time since the RCIC pump was last successfully operated. For these types of scenarios, Volume 1 (internal events) of the Risk Assessment of Operational Events (or RASP) handbook recommends the exposure time (T) be calculated by dividing time interval from the failure and the last successful operation (t) by 2 and adding the repair time.

= +

2 The RCIC pump failed on January 8th at 9:39 a.m. The last successful operation of the RCIC pump occurred during the previous quarterly surveillance test completed on September 26th at 11:58 a.m. (approximately 2518 hours0.0291 days <br />0.699 hours <br />0.00416 weeks <br />9.58099e-4 months <br />). It took the licensee approximately 40 hours4.62963e-4 days <br />0.0111 hours <br />6.613757e-5 weeks <br />1.522e-5 months <br /> to repair 2

LER 293-2019-001 the failed flow controller and restore the RCIC pump to operable status. However, this period also included a time in which Pilgrim had shut down following a plant trip that occurred on October 5th. After the trip, the plant was placed in cold shutdown mode (i.e., reactor coolant temperature was less than 212)). Since RCIC is only required to be operable when reactor FRRODQWWHPSHUDWXUHLVJUHDWHUWKDQ), the period of 137 hours0.00159 days <br />0.0381 hours <br />2.265212e-4 weeks <br />5.21285e-5 months <br /> in which the plant was in cold shutdown needs to be subtracted from t prior to dividing it by two. Therefore, the exposure time for this analysis was calculated as follows:

(2518 137 )

= + 40 = 1230.5 1 2

Key Modeling Assumptions. The following modeling assumptions were determined to be significant to the modeling of this event:

x Basic event RCI-TDP-FR-P206 (RCIC pump P-206 fails to start) was set to TRUE because the pump was unable to fulfil its safety function due to the failed flow controller.

- The RCIC system function was restored approximately 40 hours4.62963e-4 days <br />0.0111 hours <br />6.613757e-5 weeks <br />1.522e-5 months <br /> after the pump was secured. Core damage is expected to occur approximately 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> for the dominant accident sequences in this analysis and, therefore, repair of the RCIC pump is not credited in this analysis.

x The preliminary results were reviewed to determine if FLEX strategies would affect the risk of this event. In order for FLEX strategies to be successful at Pilgrim, either RCIC or HPCI must be available. The dominant sequences for this event involved both RCIC and HPCI failing. Without either, FLEX cannot be successfully deployed, therefore FLEX strategies were not considered as part of this analysis.

$1$/<6,65(68/76

&'3 7KHSRLQWHVWLPDWH&'3IRUWKLVHYHQWLV3x10-6, which is the sum of all exposure periods. 7KH$633URJUDPDFFHSWDQFHWKUHVKROGLVD&'3RI-6 for degraded conditions.

7KH&'3IRUWKLVHYHQWH[FHHGVWKLVWKUHVKROGWKHUHIRUHWKLVHYHQWLVDSUHFXrsor.

Dominant Sequence. The dominant accident sequence is loss of condenser heat sink sequence 40 &'3 = 1x10-6), which contributes approximately 37 percent of the total internal HYHQWV&'3 The dominant sequences are shown in the table below and graphically in Figure A-1 Appendix A. Accident sequences that contribute at least 1.0 percent to the total LQWHUQDOHYHQWV&'3IRUWKLVDQDO\VLVDUHSURYLGHGLQWKHIROORZLQJWDEOH

Sequence &&'3 &'3 &'3  % Description

-6 -7 -6 LOCHS 40 2.10x10 9.54x10 1.15x10 37% Loss of condenser heat sink initiating event; successful reactor trip; RCIC and HPCI fail; and operators fail to depressurize the reactor 1 The input for risk calculations using the event and condition assessment (ECA) module within SAPHIRE only allows exposure period to be input as integers. Therefore, this analysis used 1231 hours0.0142 days <br />0.342 hours <br />0.00204 weeks <br />4.683955e-4 months <br />.

3

LER 293-2019-001 Sequence &&'3 &'3 &'3  % Description

-6 -7 -7 LOMFW 40 1.13x10 5.15x10 6.17x10 20% Loss of feedwater initiating event; successful reactor trip; RCIC and HPCI fail; and operators fail to depressurize the reactor LODCB-B 45 3.16x10-7 4.76x10-8 2.69x10-7 9% Loss of vital bus B initiating event; successful reactor trip; power conversion system (including feedwater) fails, RCIC, and HPCI fail; condensate fails, reactor depressurization succeeds; low-pressure injection (LPI) fails; and alternate injection fails IORV 47 3.83x10-7 1.31x10-7 2.51x10-7 8% Inadvertent opening of safety relief valve initiating event; successful reactor trip; power conversion system (including feedwater) fails, RCIC, and HPCI fail; and operators fail to depressurize the reactor LOOPSC 25 1.68x10-7 2.83x10-8 1.39x10-7 5% Switchyard-centered loss of offsite power (LOOP) initiating event; successful reactor trip; RCIC and HPCI fail; and operators fail to depressurize the reactor LOOPGR 25 1.38x10-7 2.32x10-8 1.14x10-7 4% Grid-related LOOP initiating event; successful reactor trip; RCIC and HPCI fail; and operators fail to depressurize the reactor LOOPWR 25 7.49x10-8 1.26x10-8 6.22x10-8 2% Weather-related LOOP initiating event; successful reactor trip; RCIC and HPCI fail; and operators fail to depressurize the reactor LOOPSC 28-17 4.93x10-8 7.22x10-9 4.21x10-8 1% Plant-centered LOOP initiating event; successful reactor trip; emergency power fails; RCIC and HPCI fail; and operators fail to recover offsite power LODCB-B 38 4.83x10-8 7.21x10-9 4.10x10-8 1% Loss of vital bus B initiating event; successful reactor trip; power conversion system (including feedwater) fails, RCIC, and HPCI fail; condensate fails, LPI succeeds; suppression pool cooling fails; containment spray fails, power conversion system recovery is not successful; containment venting fails; and long-term low pressure injection fails TRANS 44-25 4.90x10-8 8.27x10-9 4.08x10-8 1% Transient initiating event; consequential LOOP occurs; successful reactor trip; RCIC and HPCI fail; and operators fail to depressurize the reactor LOOPGR 28-17 4.21x10-8 6.19x10-9 3.59x10-8 1% Grid-related LOOP initiating event; successful reactor trip; RCIC and HPCI fail; and operators fail to depressurize the reactor 4

LER 293-2019-001 Sequence &&'3 &'3 &'3  % Description IORV 46 4.15x10-8 6.25x10-8 3.53x10-8 1% Inadvertent opening of safety relief valve initiating event; successful reactor trip; power conversion system (including feedwater) fails, RCIC, and HPCI fail; condensate fails; LPI fails; and alternate injection fails LODC-B 46 2.25x10-7 1.93x10-7 3.26x10-8 1% Loss of vital bus B initiating event; successful reactor trip; power conversion system (including feedwater) fails, RCIC, and HPCI fail; and operators fail to depressurize the reactor Total 1.42x10-5 1.11x10-5 3.07x10-6 8QFHUWDLQWLHV The key modeling uncertainty associated with this analysis is the exposure period. The flow controller failed sometime between the last successful surveillance test on September 26, 2018 and the time of discovery on January 8, 2019 (105 days). There is no additional information available to reduce the uncertainty of when the flow controller failed during this period. A sensitivity analysis, was performed to determine the risk of an upper bound exposure period of 105 days (i.e., assuming that the controller failed directly after the successful test on September 26th test), subtracting the 137 hours0.00159 days <br />0.0381 hours <br />2.265212e-4 weeks <br />5.21285e-5 months <br /> in which RCIC was not required to be operable in service while the plant was in cold shutdown during a forced outage, and adding the 40 hours4.62963e-4 days <br />0.0111 hours <br />6.613757e-5 weeks <br />1.522e-5 months <br /> of repair time. The CDP for this 2421-hour exposure period is 6x10-6.

In addition, a sensitivity evaluation was performed to determine the minimum exposure period required for the CDP to exceed the precursor threshold of 1x10-6. It was determined that a RCIC unavailability of at least 17 days (approximate) is needed to exceed the precursor threshold.

6HLVPLF&RQWULEXWLRQ Historically, independent condition assessments performed as part of the ASP Program only included the risk impact from internal events and did not include the consideration of other hazards such as fires, floods, earthquakes, etc. 2 The reason for the exclusion of the impacts of other hazards in most ASP analyses was due to the lack of modeling capability within the SPAR models. However, seismic hazards modeling was completed for all SPAR models in December 2017. Therefore, seismic hazards are now being evaluated as part of all condition assessments performed by the ASP Program. The seismic contribution for a RCIC unavailability of 1231 hours0.0142 days <br />0.342 hours <br />0.00204 weeks <br />4.683955e-4 months <br /> is CDP of 2x10-7. The following table provides the seismic bin results that contribute at least 1 percent of the total seismic CDP for this analysis.

Seismic Bin &'3 1RWHV2EVHUYDWLRQV

-7 Seismic Event in Bin 3 1.89x10 Dominant scenarios are seismically-induced LOOP and failure of

(>0.5 G) occurs the emergency power system result in a station blackout.

Random and seismic HPCI failures result in core damage.

-8 Seismic Event in Bin 2 1.19x10 Dominant scenarios are seismically-induced LOOP and failure of (0.3-0.5 G) occurs the safety-related batteries result in SBO. The seismically-induced battery failures result in the unavailability of HPCI and subsequent core damage.

727$/ 2.01x10-7 2 Initiating events caused by other hazards (e.g., tornado results in a LOOP) or degradations specific to a hazard (e.g., degraded fire barrier) have been analyzed as part of ASP Program.

5

LER 293-2019-001 5()(5(1&(6

1. Pilgrim Nuclear Power Station, "LER 293/19-001 - Reactor Core Isolation Cooling System Declared Inoperable During Surveillance Testing, dated February 28, 2019 (ADAMS Accession No. ML19064A593).

6

LER 293-2019-001 Appendix A: Key Event Tree LOSS OF REACTOR OFFSITE TWO OR MORE HIGH PRESSURE SUPPRESSION MANUAL REACTOR CONDENSATE LOW PRESS COOLANT ALTERNATE SUPPRESSION CONTAINMENT POWER CONVERSION CONTAINMENT LONG-TERM LOW # End State CONDENSER HEAT SHUTDOWN ELECTRICAL STUCK OPEN SRVS INJECTION POOL COOLING DEPRESS INJECTION (LCS OR INJECTION POOL COOLING SPRAY SYSTEM RECOVERY VENTING PRESS INJECTION (Phase - CD)

POWER LPCI)

IE-LOCHS SINK RPS OEP SRV HPI SPC DEP CDS LPI VA SPC CSS PCSR CVS LI 1 OK 2 OK 3 OK 4 OK 5 OK 6 CD 7 OK 8 OK 9 OK 10 CD LI01 11 OK 12 CD 13 OK 14 OK 15 OK CS1 16 OK 17 CD 18 CD 19 CD 20 OK 21 OK 22 OK 23 OK 24 OK 25 CD 26 OK 27 OK 28 OK 29 OK 30 CD LI01 31 OK 32 CD 33 OK 34 OK 35 OK 36 OK SP1 CS1 37 OK 38 CD 39 CD 40 CD 41 1SORV P1 42 2SORVS P2 43 LOOPPC 44 ATWS 45 CD Figure A-1. Pilgrim /RVVRI&RQGHQVHU+HDW6LQN /2&+6 Event Tree A-1