ML20021A271

From kanterella
Jump to navigation Jump to search
Final OPC Backfit Analysis Risk Assessment
ML20021A271
Person / Time
Issue date: 01/21/2020
From: Alexander Schwab
NRC/NRR/DRA/APOB
To:
References
Download: ML20021A271 (18)
v • d • e


Text

BACKFIT ANALYSIS RISK ASSESSMENT FOR OPEN PHASE ISOLATION SYSTEM (OPIS)

Prepared by: R/A Date: 1/21/2020 Alex Schwab Reliability and Risk Analyst NRR/DRA/APOB Reviewed by: R/A Date: 12/06/2019 Michelle Kichline Reliability and Risk Analyst NRR/DRA/APOB Approved by: R/A Date: 1/09/2020 Antonios Zoulis Branch Chief NRR/DRA/APOB January 2020

1.0 INTRODUCTION

An open phase condition (OPC) is when there is a loss of one or two of the three phases of the offsite power circuit on the high voltage side of a transformer that connects an offsite power circuit to station transformers and buses. An OPC may be coincident with a high-impedance ground fault, and open phases can also originate at circuit breakers and disconnect switches.

An OPC can cause imbalances in the AC Electrical Distribution system for both safety related and non-safety related electrical systems. Inadequate protection from an OPC may result in station blackout (SBO) conditions. In order to mitigate the consequences associated with an OPC, many nuclear power plants have installed an open phase isolation system (OPIS) which detects an OPC and can automatically isolate an OPC.

The purpose of this paper is to provide a risk estimate of the how much an OPIS reduces risk due to an OPC, and to determine whether this risk reduction crosses the typical Substantial Increase in Safety threshold used in the backfit process of having a change in Core Damage Frequency (CDF) of more than 1 x 10-5/yr. This risk estimate will only evaluate an OPIS that is in automatic actuation mode, since the automatic actuation mode provides the most safety impact, and therefore is bounding in terms of a backfit analysis.

2.0 BACKGROUND

(The Byron Event)

On January 30, 2012, Byron Station, Unit 2 experienced an event in which the 4.16 kV engineered safety feature (ESF) buses were not energized by an operable power source for eight minutes. The event was initiated by a mechanical failure of an electrical insulator in the 345 kV switchyard. The failed insulator caused the loss of one of three electrical phases (Phase C) supplying 345 kV offsite power to the Unit 2 station auxiliary transformers (SATs).

Following the insulator failure, the reactor automatically tripped from full power due to an under-voltage condition on 6.9 kV Buses 258 and 259 that supply power to two of four reactor coolant pumps (RCPs). About 30 seconds after the reactor trip, upon the turbine/generator trip, the power source for 6.9 kV Buses 256 and 257 and 4 kV Buses 243 and 244 automatically fast transferred from the unit auxiliary transformers (UATs) to the SATs as designed. The remaining two RCPs tripped on an over-current condition due to the increased current flow through the A and B phases.

The loss of Phase C, however, did not result in an automatic under-voltage protection signal for either 4.16 kV Engineered Safety Feature Buses 241 or 242 because the under-voltage protection scheme did not provide adequate protection from a single phase loss of either Phase A or C. As a result, all running equipment powered by Buses 241 and 242 had tripped due to the phase imbalance. This included the charging pumps which supply RCP seal injection, the component cooling water (CCW) pumps which supply thermal barrier heat exchanger cooling to the RCP seals, and the essential service water (ESW) pumps. These conditions existed until operators manually tripped (from the main control room) the SAT feeder breakers about eight minutes after the event had initiated. Following the trip of the SAT feeder breakers and isolation of offsite power feeders, both emergency diesel generators (EDGs) automatically started and loaded, supplying power to Buses 241 and 242 as designed. No significant degradation to the RCP seals occurred based on the manual action occurring within the time it would have taken for the RCP seal water volume to deplete (about 13 minutes). Reactor decay heat was removed utilizing the diesel- driven auxiliary feedwater (AFW) pump and steam generator (SG) power operated relief valves (PORVs) while the primary system cooled down in the natural circulation mode of operation. On January 31, 2012, Unit 2 entered Mode 5 (i.e., Cold Shutdown). The licensee completed repairs and the Unit 2 SATs were returned to their normal alignment on January 31, 2012. The Byron Offsite Bus Feed Configuration is shown below in Figure 1.

Figure 1 - The Byron Offsite Bus Feed Configuration 3.0 NRC RESPONSE

  • NRC staff issued the following Generic Communications:

o Bulletin 2012-01, Design Vulnerability in Electric Power System.

o Information Notice (IN) 2012-03, Design Vulnerability in Electric Power System.

  • The NRC Office of Regulatory Research prepared an Accident Sequence Precursor (ASP) analysis for the Byron event (LER: 454/12-001-01, IR: 50-455/12-08) which estimated the risk of this event in terms of conditional core damage probability of 10-4.
  • NRC staff has written a Temporary Inspection (TI) on this issue to verify that licensees have appropriately implemented the Nuclear Energy Institute (NEI) voluntary industry initiative (VII) to address OPC.
  • NEI has addressed this with:

o An approved initiative issued on October 2013.

o A regulatory requirements document issued on March 2014.

  • During a public meeting held on February 20, 2019, NEI indicated that operating experience indicates that the OPIS circuitry may be sensitive to electric plant transients resulting from circuit breaker switching and that there is a potential for spurious actuation of the OPIS that could lead to an inadvertent loss of offsite power.

Therefore, NEI developed Revision 3 to the VII and created a guidance document (NEI 19-02) that enables licensees to use a risk-informed approach to implement the OPIS to provide alarm and indication to the control room operator and rely on operator action to diagnose and respond to the presence of an OPC as opposed to an automatic actuation mode. Revision 3 to the VII was communicated to NRC by NEI in a letter dated June 6, 2019 and NEI 19-02 was provided to the NRC on June 20, 2019. This risk analysis only evaluates the change in risk with the automatic actuation function of OPIS enabled since that is the bounding case in terms of a safety benefit from OPIS.

3.1 Summary of Industry Operating Experience (2001 - 2015)

The following information was obtained from international experience and domestic LER databases on the occurrences of OPC.

Table 1: OPC Operating Experience Date Event Summary 12/19/05 Broken bus bar connector on common 115kV line. Detected by abnormal amperage on line.

11/27/07 Operator rounds noticed broken phase A conductor on 138kV offsite power feed which is in standby while the unit is operating.

1/30/12 Broken insulator on Phase C of 345kV supply to both Station Auxiliary Transformers.

2/28/12 Failed insulator on 345kV standby transformer circuit actuated protective relays.

12/7/15 Operator rounds discovered that Unit 3 transformer CT-3 had one phase disconnected at bushing concurrent with failure of connections to Unit 1 transformer CT-1.

3/1/16 Phase C pole of 345kV circuit breaker did not properly close 11/11/05 400kV Switchyard manipulations revealed a line with a failed phase on its isolator.

8/9/06 Failure of a phase on the main transformer cascading to imbalance of plant operating loads.

5/14/07 Failure of one phase within circuit breaker to 275kV transformer resulted in plant motor loads dropping out.

12/22/12 Arcing of 230kV line to System Service Transformer due to failed line.

5/30/13 Failure of a single pole of a 400kV circuit breaker to open resulted in imbalance.

4/27/14 Fault in 400kV bus coupler circuit breaker. Maintenance induced failure.

For evaluation purposes, domestic plant data were selected to be consistent with the data used in the Standardized Plant Analysis Risk (SPAR) models.

3.2 Estimate of OPC Frequency and Probability A conservative estimate of OPC frequency was developed from industry operating experience data assuming 7 failures in approximately 10.1 years. Taking into account a 92%

availability factor in fleet of approximately 100 plants, the frequency is 7 plants 10.1 years X 0.92 X 100 plants = 7.5 x 10-3 per year A Bayesian update was performed using a Jeffreys non-informative prior, yielding an updated mean failure frequency of 8.1 x 10-3 per year.

3.3 Estimates of Core Damage Frequency Pressurized Water Reactors (PWRs)

Initial estimates of core damage frequency (CDF) were made for plants which were judged to be the most vulnerable to core damage events arising from an OPC. Due to the design of their RCPs, Westinghouse plants with unmodified Westinghouse supplied high temperature seals were assumed to predominate in core damage scenarios. For such plants, the onset of an RCP seal LOCA can start as early as 13 minutes into an OPC-initiated station blackout (SBO) event because seal injection and thermal barrier cooling are lost. However, most Westinghouse plants have already switched to the SHIELD shutdown seal, which allows more time before the onset of an RCP seal LOCA. Other PWR plant designs and Westinghouse plants with other vendors RCP seals, have a lower core damage vulnerability due to longer times to the onset of seal leakage or limited leakage flow rates.

Boiling Water Reactors (BWRs)

Although SBO is the highest contributor to CDF at most BWR plants, many have high pressure steam-driven DC-powered systems, i.e., HPCI and RCIC, which can provide initial injection from the Condensate Storage Tank (CST), a cooler water source, during an SBO.

Analyses Cases Since offsite power feeder configurations vary from plant-to-plant, this evaluation assesses the impact of an OPC on various configuration design types in two generic groupings for domestic plants. Variations on these two groupings were accounted for in these evaluations. The two cases below were evaluated, since having the OPIS in automatic actuation mode (with the additional opportunity for alarm and operator action) was assumed to be a bounding case in terms of showing a substantial increase in safety (in other words, having the system in automatic actuation as opposed to alarm only mode provides more safety impact):

1. No specific OPC detection system.
2. Fully automatic system which will alarm and trip transformer feeder circuit breakers.

3.4 Overall Assumptions In developing the analysis, several overall assumptions were made for all the evaluations:

  • The plant Standardized Plant Analysis Risk (SPAR) model was used with modifications, as discussed below.
  • It was assumed that OPC has not been accounted for in the existing loss of offsite power data and models.
  • The full power internal events model was used. Except for mid-loop refueling operation, it is assumed that operators have a longer period of time following an OPC to provide mitigating measures and strategies during lower power evolutions.
  • No credit for beyond design basis mitigating strategies, e.g., FLEX, are considered.
  • The impact of external events, i.e., plant fire, external flood, seismic, and high winds are not included.
  • In some plant configurations, an OPC would immediately result in a reactor/turbine/generator trip. For these cases, the initiating event is an OPC with the computed estimated frequency of 8.1 x 10-3 per year and is modeled as initiating event IE-OPC in the SPAR model.
  • For plants which have offsite power feeds in a reserve standby state, absent an independent detection/isolation system, the impact of an OPC on the offsite power feed will only be detected after a reactor/turbine/generator trip event has occurred. For these cases, a dimensionless probability of OPC is developed derived from the yearly frequency for a one-year duration, or 8.1 x 10-3. This is modeled in the SPAR model as basic event EPS-PHN-PE-OPC.
  • A conservative worst-case scenario was assumed that a single OPC will occur on the high voltage side of the line feeder to the transformer(s) in order to impact all downstream buses. The location of an OPC requires additional apportionment which would further reduce this probability.
  • It is assumed that procedural changes have been made by licensees regarding interim guidance on detection of and response to an OPC occurrence, once identified.
  • Since the condition has the potential to render safety buses unavailable, SBO is a surrogate for an OPC event. In some plant configurations, the non-safety buses might still be available if fed by another transformer with a diverse high voltage feed. However, the impact would be virtually identical to that of an SBO. The immediate concern being on Westinghouse PWR response to a loss of seal injection and thermal barrier cooling to RCPs.
  • An OPC could result in overcurrent trips on any running pumps. The motor protective devices could also fail to function properly and fail to trip the pump when they should, causing the pumps to be unrecoverable. In order to account for the uncertainty in the ability of operators to reset the trips and the availability of the pumps with an OPC present, it was assumed that all motor driven pumps normally running during plant operation (i.e., one Component Cooling Water pump, one Essential Service Water

pump, and one Charging Pump for a PWR, and one Control Rod Drive pump, one Reactor Building Close Loop Cooling pump, one Turbine Building Close Loop Cooling pump, and one Normal Service Water pump at a BWR) as well as any motor driven pump that comes online due to a plant trip (i.e., Auxiliary Feedwater Motor Driven Pumps for a PWR and Emergency Service Water pumps for a BWR) have a failure probability of 0.1 (roughly 1000 times nominal).

  • Most PWRs have either the Westinghouse Generation III SHIELD shutdown seal or other low leakage seal installed. The most current SPAR models have been updated to reflect this. For the plants that dont yet have low leakage RCP seals, the old seals are still modeled in the SPAR model. However, it is conservatively assumed for all plants that power needs to be restored power within the 13 minutes required by the old seals if the OPC is not recognized, since not all plants currently have the new seals.
  • Offsite power recovery is credited because most plants have low leakage RCP seals, and because after the 13-minute time frame, actions can still be taken to mitigate the consequences of a seal LOCA while attempting power recovery.
  • EDG recovery due to recovery from an OPC was credited. The EDG will automatically start and load on its respective bus when an OPC is detected and isolated. No HRA dependency was assumed between failure to recover EDGs and the diagnosis of an OPC.
  • Recovery attributes reflect the current state of knowledge of the condition given the situational awareness after the Byron event.

3.5 Overall Estimates of Mitigation Human Error Reliability Separate Human Error Probabilities (HEPs) were computed for failure to diagnose an OPC given several cues in the control room and failure to perform necessary response to an OPIS alarm. The SPAR-H Methodology was used in developing the HEPs. The below tables are for diagnosis only. All actions were considered nominal except that the BWR actions with expansive time for diagnosis were also assumed to have expansive time for action.

1. Event EPS-XHE-XE-OPC-PWR is the failure to diagnose an OPC within 13-minutes. The operator must diagnose the OPC and open breakers to isolate the OPC and restore power to the emergency buses via the EDGs. Once diagnosed, it is assumed that operators will take the appropriate action. Therefore, the action was modeled as nominal. After reading the draft Temporary Instruction for the interim enforcement policy, the following performance shaping factors for failure to diagnose have been applied for plants going forward, assuming increased situational awareness:

Table 2: SPAR-H Failure to Diagnose an OPC for PWRs Performance Shaping Factor Value Selected Available time Barely Adequate Stress High Stress Complexity Moderately Complex Experience/Training Nominal Procedures Nominal

Ergonomics Nominal Fitness-for-duty Nominal Work Process Nominal The result is an HEP of 0.401 for EPS-XHE-XE-OPC-PWR.

2. Event EPS-XHE-XE-OPC-BWR is the failure to diagnose an OPC within the battery depletion time of most BWRs and open breakers to isolate the OPC, given successful initial operation of RCIC or HPCI. Most BWRs have a battery depletion time of six hours.

RCIC and HPCI require DC power to successfully operate. This allows for expansive time for the operators to diagnose the OPC and take action to isolate the OPC. Once diagnosed, it is assumed that operators will take appropriate action. Therefore, the action was modeled as nominal except for expansive time. After reading the draft Temporary Instruction for the interim enforcement policy, the following performance shaping factors for failure to diagnose have been applied for plants going forward, assuming increased situational awareness:

Table 3: SPAR-H Failure to Diagnose an OPC for BWRs Performance Shaping Factor Value Selected Available time Expansive Time Stress High Stress Complexity Moderately Complex Experience/Training Nominal Procedures Nominal Ergonomics Nominal Fitness-for-duty Nominal Work Process Nominal The result is an HEP of 4.1 x 10-4 for EPS-XHE-XE-OPC-BWR.

3. Industry has proposed installation of an OPIS which would either alarm or alarm and automatically isolate offsite feeders to the safeguard buses upon detection of an OPC. EPS-XHE-XE-OPIS-PWR and EPS-XHE-XE-OPIS-BWR are modeled as the HEPs for failure of the operators to diagnose the OPIS alarm and its performance shaping factors are developed in the following table, with the available time for the PWR basic event being nominal for time as opposed to the EPS-XHE-XE-OPC-PWR event being barely adequate, since alarm diagnosis is a lot simpler and therefore takes less time. The action performance shaping factors are assumed to be nominal, except for expansive time for BWRs.

Table 4: SPAR-H Failure to Diagnose OPC Alarm for PWRs Performance Shaping Factor Value Selected Available time Nominal Stress Nominal Complexity Nominal Experience/Training Nominal Procedures Nominal Ergonomics Nominal Fitness-for-duty Nominal Work Process Nominal

The result is an HEP of 1.1 x 10-2 for EPS-XHE-XE-OPIS-PWR.

Table 5: SPAR-H Failure to Diagnose OPC Alarm for BWRs Performance Shaping Factor Value Selected Available time Expansive Time Stress Nominal Complexity Nominal Experience/Training Nominal Procedures Nominal Ergonomics Nominal Fitness-for-duty Nominal Work Process Nominal The result is an HEP of 2.1 x 10-4 for EPS-XHE-XE-OPIS-BWR.

Random Hardware Failures If the proposed OPIS is automatic, then it can be assumed that its failure will closely model those of protective relays. That failure is conservatively assumed to be 3.2 x 10-7 per hour, taken from IEEE-5001 for protective relaying. Assuming a one-year mission time, the failure probability (event EPS-RCK-NO-OPIS) is approximately 3 x 10-3. It was also assumed that the failure of the OPIS system to alarm follows the same assumptions, and the failure to alarm event (EPS-RCK-NO-DET) was also assumed to be 3 x 10-3.

3.6 Offsite Power Configurations The following offsite power configuration groups were considered along with plant examples.

Configuration 1: Safety Buses Fed Directly by Offsite Power Full-time Configuration Description In this type of electrical configuration, all safety-related EDG voltage level bus loads are fed full-time from one or more individual start-up or station auxiliary transformer(s). There is a back-up transformer which is in reserve. All non-safety related bus loads are fed from the unit auxiliary transformer which in-turn, is being fed by the main generator. Upon generator trip, all the non-safety buses will be transferred to an individual start-up or the station auxiliary transformer which feeds the safety buses.

Figure 2: Standard Configuration 1 Example

1 Institute of Electrical and Electronics Engineers, Inc.,IEEE-500, Guide to the Collection of Electrical, Electronic, Sensing Component, and Mechanical Equipment Reliability Data for Nuclear Power Generating Stations," 1984.

Evaluation Overview The worst case is the occurrence of an OPC on the high voltage side of the normal offsite power transformer which will impact both safety buses as shown highlighted on Figure 2. The generator will still be initially on line; however, safety bus loads will begin to drop out due to the phase imbalance, resulting in losses of service water, component cooling water, and charging. Therefore, the RCPs will lose seal cooling (thermal barrier cooling and seal injection). It is assumed that operators will procedurally trip the plant in response to this condition.

SPAR Model Changes This is modeled as a condition assessment with the OPC being a standalone initiating event. A new OPC event tree is developed which ultimately transfers into either the switchyard-centered loss of offsite power (LOOP) or SBO event trees depending on diagnosis timing, as shown in Figure 3. The previously estimated frequency of 8.1 x 10-3 per year is applied as the initiating event frequency.

Specific Model Assumptions

  • A single OPC is postulated on the high voltage side of the transformer which will have an impact on all feeders.
  • Since an OPC has the potential to render the safety buses unavailable, an SBO was assumed as a surrogate. The immediate concern for Westinghouse plants is the response to a loss of seal injection and thermal barrier cooling to the RCPs.
  • Timely operator action to manually trip offsite power feeds within 13 minutes was assumed to fail for cases where the OPIS is enabled but fails to function. This assumption was made since the operators would not likely be able to successfully diagnose an OPC without an alarm or indication due to the failure of OPIS, which they would be expecting in the case in which OPIS has been installed.
  • Offsite power and EDG recovery were credited.

11 Figure 3 Configuration 1 OPC Event and Fault Trees OPC OCCURS AT OPIS SYSTEM OPC RECOGNIZED # End State XST2 IN 13 MIN (Phase - CD)

IE-OPC FT-OPIS EDG-13MIN 1 OK 2 INT-LOOPSC 3 INT-SBO OPIS SYSTEM EDG RECOVERY FT-OPIS ATTEMPT WITHIN 13 MIN EDG-13MIN Complement of: PROPOSED RECOVERY OF OPC FAILURE TO DIAGNOSE PROPOSED RECOVERY FT-OPIS0 HE-OPC-REC 0.00E+00 AN OPC IN 13 MINUTES OF OPC EPS-XHE-XE-OPCP 4.00E-01 HE-OPC-REC 1.00E+00 OPERATORS FAIL TO RESPOND TO OPC ALARM EPS-XHE-XE-OPISP 1.10E-02 FAULTS IN AUTOMATIC OPC DETECTION AND ACTUATION SYSTEM EPS-RCK-NO-OPIS 3.00E-03 SPAR Model Evaluation The OPC event tree was developed to model the plant response to an OPC condition while the plant is on line. The following events were evaluated:

  • IE-OPC: The initiating event of an occurrence of an OPC at transformer XST2 estimated at 8.1 x 10-3 per year.
  • FT-OPIS: Fault tree for the unavailability of both OPIS schemes - the alarm only system which requires operator action to isolate the OPC, and the automatic actuation system.
  • EDG-13MIN: Human Error Probability (HEP) of the operations personnel to properly diagnose the OPC in 13 minutes and take appropriate actions before the need to transfer to the SBO event tree. This fault tree is set to fail using the HE-OPC-REC if the OPIS system is enabled but fails. This assumption was made since the operators would not likely be able to successfully diagnose an OPC without an alarm or indication due to the failure of OPIS, which they would be expecting in the case in which OPIS has been installed.

12

  • In order to get the case with OPIS, the model is run normally, with the HE-OPC-REC basic event set to 1, therefore failing EDG-13MIN. In order to get the case without OPIS, a change set is made setting HE-OPC-REC to False, which turns off the OPIS system model since it is combined with the complement to HE-OPC-REC, and turns on the EDG-13MIN system.

Configuration 2: Safety Buses Fed from the Unit Auxiliary Transformer Configuration Description In the type of electrical configuration shown in Figure 4, safety-related EDG 4.16kV bus loads are fed full time from non-safety related buses through double isolation circuit breakers. At each unit, the non-safety related buses are fed from a Unit Station Service Transformer (USST) which is fed by the main generator while at power. Upon generator trip, a fast transfer is made to offsite power feeds from two System Station Service Transformers (SSSTs), each individually powering a non-safety and safety related bus.

Figure 4: Standard Configuration 2 Example

13 Evaluation Overview The worst case is an OPC occurring on the 138kV feeder line when it is supplying power to both SSSTs as shown on Figure 4. During normal operation, all 4.16kV buses are being fed from the main generator via the USST. On a generator trip, a fast transfer will occur, closing in to the feeds from both SSSTs which will propagate the phase imbalance down to the safety related buses. It is assumed that protective relaying on the circuit breakers will not detect the condition allowing the fast transfer to occur. This will produce an SBO condition for all generator trip initiating events. If the 138kV feeder is from another line, it is postulated to result in a single loss of a safety bus.

Figure 5: Potential for a Single OPC Impacting Both Trains in Configuration 2 SPAR Model Changes This is modeled as a condition assessment with susceptibility to all initiating events. The fault trees for each 4.16kV related bus are modified with a failure event which has a probability of 8.1 x 10-3.

Specific Model Assumptions

  • A single OPC is postulated to be on the high voltage side of both SSST transformers which will have an impact on all feeders.
  • An OPC occurring on the 138kV feeder line as shown on Figure 4, has the potential for propagating to both 4.16kV safety buses. All other lines will propagate to one safety bus only. Assuming that all 138kV lines feed evenly and a resultant SBO can occur from an OPC on only one of these lines, a 0.2 split fraction would be applied for this plant to

14 account for the OPC occurring on the line shown in Figure 4. Since some plants could only have 2 other incoming lines, a split fraction of 0.33 will be applied conservatively.

  • Fast transfer of the SSST feeder to the safety buses will be successful despite having an undetected OPC condition.
  • Since an OPC has the potential to render the safety buses unavailable, an SBO was assumed as a worst-case condition surrogate. An immediate concern for most Westinghouse plants is the response to a loss of seal injection and thermal barrier cooling to the RCPs.
  • Generation III SHIELD RCP seals have been incorporated at many Westinghouse PWRs, and the SPAR models have been updated to reflect this for most of the plants who have made this change.
  • A generic initiating event with a frequency of one per year was used to represent the sum of all internal initiating events from transients, special initiators, and LOCAs. An OPC occurring during design-basis accident initiators will have a much lower impact.
  • Timely operator action to manually trip offsite power feeds within 13 minutes was assumed to fail for cases where the OPIS is enabled but fails to function. This assumption was made since the operators would not likely be able to successfully diagnose an OPC without an alarm or indication due to the failure of OPIS, which they would be expecting in the case in which OPIS has been installed.
  • It was conservatively assumed that the OPC will not be detected and corrected by the OPIS until a generator trip with transfer occurs, closing SSST feeder circuit breakers to ultimately feed safety buses.

SPAR Model Evaluation The OPC event tree was developed to model the plant response to an OPC following a generator trip. The following events were evaluated:

  • IE-COMB-IE: The sum of all initiating event frequencies of all internal events. For this evaluation, this was conservatively assumed to be 1 per year.
  • FT-OPC: The probability that an OPC is present prior to the initiating event with a probability of 8.1 x 10-3.
  • FT-OPC-SF: The fraction of time when the chosen 138kV feeder line is the preferred 138kV feeder. A value of 0.33 will be used conservatively.
  • FT-OPIS: Fault tree for the unavailability of both OPIS schemes - the alarm only system which requires operator action to isolate the OPC, and the automatic actuation system.
  • EDG-13MIN: Human Error Probability (HEP) of the operations personnel to properly diagnose the OPC in 13 minutes and take appropriate actions before the need to transfer to the SBO event tree. This fault tree is set to fail using the HE-OPC-REC if the OPIS system is enabled but fails. This assumption was made since the operators would not likely be able to successfully diagnose an OPC without an

15 alarm or indication due to the failure of OPIS, which they would be expecting in the case in which OPIS has been installed.

  • In order to get the case with OPIS, the model is run normally, with the HE-OPC-REC basic event set to 1, therefore failing EDG-13MIN. In order to get the case without OPIS, a change set is made setting HE-OPC-REC to False, which turns off the OPIS system model since it is combined with the complement to HE-OPC-REC and turns on the EDG-13MIN system.

16 Figure 6: Configuration 2 OPC Event and Fault Trees COMBINED OPC CONDITION SF OF OPC ON OPIS SYSTEM OPC RECOGNIZED # End State INITIATING EVENT CRESCENT LINE IN 13 MIN (Phase - CD)

IE-COMB-IE FT-OPC FT-OPC-SF FT-OPIS EDG-13MIN 1 OK SPLIT FRACTION OF OPC FT-OPC FT-OPIS FT-OPC-SF FT-OPIS2 HE-OPC-REC EPS-PHN-PE-OPC OPERATORS FAIL TO RESPOND TO OPC ALARM MIN EPS-XHE-XE-OPIS 2.00E-01 EDG-13MIN FAULTS IN AUTOMATIC OPC SYSTEM EPS-RCK-NO-OPIS AN OPC IN 13 MINUTES EPS-XHE-XE-OPC13 HE-OPC-REC 3.7 Results Table 6 below tabulates the results for a sampling of roughly representative plants. For each plant, its emergency bus feed configuration is tabulated along with estimates of the increase in CDF due to having an OPC without OPIS, the increase in CDF due to having an OPC with a credited OPIS in automatic actuation mode, and its corresponding reduction in CDF due to OPIS.

Preliminary Risk Estimate on the Impact of Open Phase Condition (OPC)

Table 6: Results CDF with OPC CDF with OPC vulnerability CDF due to having OPIS in Configuration vulnerability and no and OPIS in automatic (per automatic Plant installed OPIS (per yr) yr) (per yr)

A 1 1.42 x 10-5 1.26 x 10-5 1.59 x 10-6 B 2 1.11 x 10-5 4.70 x 10-6 6.43 x 10-6 C 2 2.36 x 10-5 7.84 x 10-6 1.58 x 10-5 D 1 9.53 x 10-6 7.81 x 10-6 1.72 x 10-6 E 1 1.52 x 10-5 1.45 x 10-5 6.67 x 10-7 F 2 3.00 x 10-5 6.13 x 10-6 2.38 x 10-5 G 2 1.01 x 10-5 3.53 x 10-6 6.59 x 10-6 H 2 1.56 x 10-5 1.55 x 10-5 6.36 x 10-8

Preliminary Risk Estimate on the Impact of Open Phase Condition (OPC)

What Drives Risk of Core Damage

  • For PWRs, the dominant drivers are various EDG failures resulting in an SBO coupled with failures of RCP seal cooling (seal LOCA), auxiliary feedwater, and non-recovery of EDGs in time to prevent core uncovery.
  • For BWRs, the dominant drivers are various EDG failures resulting in an SBO with failure to recover an EDG before the batteries deplete (which would preclude HPCI/RCIC or isolation condenser operation).

Potential Mitigating Factors and Sources of Uncertainty

  • RCP seal changes. Many licensees who have Westinghouse RCPs, have already changed their seal packages to ones with lower SBO flowrates, i.e., Areva, Flowserve, etc., or have already switched over to the Generation III SHIELD shutdown seal.
  • Uncertainty in the estimation of split fractions related to the location of OPCs in the switchyards. Most of the estimates presented in this paper assume that the OPC will occur at its most vulnerable point with either a probability or frequency estimate derived from industry data regardless of location of the open phase.
  • Uncertainty in the estimation of HEPs for failure to diagnose an OPC.
  • Uncertainty in the specific design of OPIS and accounting for inadvertent actuation of these systems which could have an increase to risk.

4.0 CONCLUSION

S The average contribution to safety due to having an OPIS in automatic for the given sampling of plants is a CDF of 7.08x10-6/yr. Therefore, on average, having the OPIS in automatic does not cross the substantial increase in safety threshold of 1x10-5/yr.

This backfit analysis determined the contribution to safety of having OPIS in automatic mode.

Evaluating OPIS in automatic actuation mode as opposed to alarm only mode bounds the backfit analysis since the OPIS system in alarm only mode would result in less of a contribution to safety than the automatic mode. There were 2 plants within the sampling that were over the threshold (1.58x10-5/yr and 2.38x10-5/yr). However, since there are many conservative assumptions in this assessment (such as the very conservative HEP for identifying the OPC without OPIS, the conservative increase in running pump probabilities, and that FLEX wasnt credited), these results do not challenge the conclusion that the risk reduction due to having an OPIS in automatic actuation mode does not represent a substantial increase in safety as used in the backfit process.

Retrieved from "https://kanterella.com/w/index.php?title=ML20021A271&oldid=2330434"