ML20086P701
| ML20086P701 | |
| Person / Time | |
|---|---|
| Site: | Fort Calhoun  |
| Issue date: | 12/18/1991 |
| From: | Gates W OMAHA PUBLIC POWER DISTRICT |
| To: | NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM) |
| References | |
| LIC-91-328R, NUDOCS 9112270152 | |
| Download: ML20086P701 (5) | |
Text
- _ _ _ _ _ _ _ - - _ _ _ _ _ _
Omaha Public Power District December 18, 1991 144 South 1Gth Street Mall L10-91-328R Omaha, NeNana 68102-2247 402/630 2000 U. S. Nuclear Regulatory Commission ATIN: Document Control Desk Hail Station PI-137 Washington, DC 20555
Reference:
1.
Docket No. 50-285 2.
Letter from NRC (D. L. Wigginton) to OPPD (W. G. Gates), dated November 29, 1991
SUBJECT:
OPPD Review of NRC Lold Shutdown Risk Analysis Gentlemen:
OPPD appreciates the opportunity to comment on the Reference 2 report entitled
" Preliminary " Report on Cold $butdown Risk Assessment fort Calhoun Station, (FCS), Unit 1. Detailed minor comments are contained on the attached marked up pages.
Although most comments are editorial in nature, the following remarks :
de clarification on some of the comments:
1.
Page A-55 of the report, in the " Event Description" section, states the 161 kV system... had been removed, apparently to support maintenance activities." OPPD confirms that the 161 kV system was, in fact, removed for necessary maintenance.
?.
Page A-57 of the report, first paragraph states "... any of three states refueling outage:
mid-loop, normal may be found nine days into a shutdown, or refueling...".
The actual RCS state at the time of the event was partially filled (above mid loop) to support control element assembly uncoupling.
3.
Please note that our review did not focus upon the specific probabilities used in the event tree. However, based upon actual experience in the 1990 Refueling Outage and projections for the 1992 outage, the conditional probability of mid loop operation (pages A 57 and A-59) is less than the report's value of 0.11.
Also, the event "RWT Makeup Initiated Prior to Saturation" is not possible at fort Calhoun since the RWT (SIRWT) level is approximately the same as the mid-loop elevation.
M\\
.n.m m
~
4 y
n w
\\\\
\\ \\l 230P S
~=aP=
i
.s=
U. S. Nuclear Regulatory Commission LIC 91-328R Page 2 If you should have any questions, please contact me.
WO N.
W. G. Cates Olvision Manager Nuclear Operations WGG/sel Attachments c:
LeBoeuf, Lamb, Leiby & MacRae R. D. Martin, NRC Regional Administrator, Region IV D. L. Wiaginton, NRC Senior Project Manager R. P. Mullikin NRC Senior Resident inspector H. Borchert, Olrector Division of Radiological Health, Nebraska Department of Health 1
J
\\
4 r ~; ~,
t....,.
a.-
l s,
.. i \\
L,I d,', i ] \\ r [\\ !
ACCIDENT SEQUENCE PRECURSOR PROGRAM COLD SilUTDOWN AN A LYSIS L E R N o.:
285/90 006 Event
Description:
Loss of offsite power, diesel falls to load automadcally.
Date of Event:
Febmary 26,1990 Plant Fort Calhoun g bd Summary c\\tdcn t
}
During a refueling outage, a spurious relay actuation resulted in n
to Fort Calhoun. One diesel generator (DG) was out of service for m ' tenance, the other staned but was prevented from connecting to its engineered-safety 4eatures-(ESFFbus by a shutdown cooling pump interlock. Operators identified and corrected the problem, and the DG was aligned to restore power to the plant. The conditional probability of core damage estimated for this event is 3.6 x 104. The dominant sequence involves failure to recover AC power or provide altemate RCS makeup from the RYrT prior to core uncovery. The calculated probability is strongly influenced by estimates of falling to rec.over AC power in the long term. These estimates involve substantial uncertainty, and hence the overall core damage prooability estimated for the event also involves substantial uncensinty.
^~
r%
I.l~v l
T jQ 6
,W)
Event Description On Febmary 26,1990, on the ninth da:' of a refueling outage, spurious actuadon of a switchyard breaker backup trip relay opened circuit breakers supplying power to 4160 V buses I Al, l A2, l A3, and 1 A4 from the plant 22 kV system. Normal power supplies to ESF buses I A3 and 1 A4 are from the 161 kV system but these supplies had been removed,4pparently-to support maintenance activities. Emergenegower supplies are provided for bus emergency power source for bus'TA4, DG D1, was out of service for maintenance, so nofpower was available to that bus. The back'up power source for bus TA$ DG D2, staned but was prevented from energizing the bus by an in xk in a low pressure safety injection (LPSI) pump circuit. This resulted in intermption of all Am newer supp!!cs to plant equipment.
Prior to the event, LPSI pump "B" had been placed in service for residual heat removal. The plant L
electrical system is designed f uch that, if a LPSI pump has been manually s:aned and a subsequent loss of offsite power occurs, the LPS! pump breaker cannot be opened automatically and the DG output breaker for the affected train cannot be closed to feed its ESF bus. Thus, while DG D2 staned correctly in response to the undervoltage condition on busTA, the LPSI pump remained tied to the t and the DG could not supply its loads, k
u e\\csfne b,
.q$
A-55
J] l' '_
_, hi h rin I ttJ/ ~.i F
(fdf )
Approximately one minute after the loss of offsite power (LOOP), plant operators opened the LPSI pump breaker and DG D2 energized bus I A3. The pump was then retumed to service for shutdown cooling. Thinten trunutes later, offsite power was restored to bus l A3.
The Licensee Event Repon describing this event is included with this repon as appendix A.
Event.Related Information Current plant procedures 4ppeer o addrestthebe need 'a manually trip an operating RHR pump breaker before anempting to power the bus from its DG. Pp 5 6 of AOP 32 " Loss of 4160 Volt or 480 Volt Bus Power," which illustrates this; Mitis?if t cMTMdtis included 9
edure w9s issutd in 1991. a f!
No'ceduMIryl*uI'danP tJh e[orM*tEnNSYd{ebm
$$I$j*EhI$bhEI5fc@s den d!i$
-e o s't
!E
$1Ss'No$tionMdTisl.1-
-s'[cY>nDrw d iNdEe'a't O d
ASP Modeling Approach and Assumptions Of interest in this event is the ability of plant operators to determine the need to remove loads fmm a deenergized ESF bus before attempting to repower from the emergency DG. This requirement is currently proceduralized and operator actions during the actual event show that the operators did not experience difficulty in repowering the bus.
The probability value used in the ASP program for failure of a single DG to start and supply its loads is 0.05. He likelihood that opers. ors would fail to open the LPSI pump breaker, allowing the DG to feed ESF Inads, is considered to be small in comparison. Derefore, the interlock design feature was not separately modeled.
During shutdown and refueling operations, a loss of AC power will result in loss of shutdown cooling / decay heat removal. The amount of time that decay heat removal can be unavailable before core damage re:ults is a function of a number of variables including core power history, time since shutdown, water level in vessel, heat sinks available, and refueling configuration (head off/on, cavity flooded /not flooded, etc.).
The most limiting case occurs during mid loop operation (reactor coolant drained to level of main I
coolant nozzles) with a high decay heat load (see discussion of Vogtle event, NUREG 1410). With lesser decay heat loads and/or a larger volume of coolant in the reactor coolant system (RCS),
additional time exists for recovery actions. The likelihood of success for such actions has not been well quantified to date. However, it is believed that the increased likelihood of success associated l
with the additional time available when the plant is not in mid loop more than compensates for the higher fraction of time that the plant is in a non mid loop condition, and that the risk associated with mid loop therefore dominates.
l l
A.56
t[jg4y J]37' llhinMn.
i_ _ i In this event, the LOOP occurred early in a refueling outage, when decay he loads co be hoc.4,ul (e.n a
expe d top fairly large. One train of emergency power was out of service,
-UdSge
-statu w EisInodIEf$2MedaY$fvdaY4e, however any of three states may be found nine days into a refueling outage: mid loop, normal shutdown, or refueling (reactor head off and cavity l
filled). As discussed, the first case is believed to dominate risk.
The event was modeled as a loss of offsite power during mid loop operation. The event tree model is shown in Fig.1. Recovery of RHR is not specifically shown, but is assumed to occur within one half hour of recovering power to the safety related buses. This time period reflects the potential need to vent the RHR system if reactor vessel inventory is lost because of boiling.
Branch probabilities were estimated as follows:
- 1. RCS level (mid loop). The likelihood of a LOOP during mid loop operation is estimated to be 0.11, based on NUREG 1410 (pp 6 7). Assuming the occurance of a LOOP is independent of the shutdown RCS status, the likelihood of being in mid loop, given a loss of offsite power occurs during shutdown, is 0.11.
- 2. Emergency power fails. One DG was unavailable prior to the event. Since operator action to trip the operating RHR pump (to allow DG load) is not believed to appreciably impact the overall emergency power reliability, a nominal DG failure probability of 0.05 was assigned to this bmnch.
. 3. Offsite pc Aer recovered prior to saturation. By interpolation of data from NUREG 1410 it was estimated that, in mid loop operation, the RCS coolant inventory would have reatned saturation temperature in approximately 1 h. Recovery of offsite power prior to this time was assumed to prevent core damage. A probability of not recovering offsite power within one hour of 0.25 was used in the analysis. This probability was estimated using the plant-centered LOOP recovery curves in NUREG 1032 by assuming (1) that the observed time to recover offsite power (14 min) represented the median of such recovery actions and (2) that the shape of the plant centered non recovery distributions were representative for this event.
4 RWT makeup initiated prior to saturation. For losses of all AC power of greater than 1 h, makeup from the refueling water tank (RWT) would be required to ensure core cooling and sufficient RCS inventory to allow eventual restoration of shutdown cooling. Successful alignment of makeup water from the RWT was assumed to prevent core damage, as previous investigations (see NUREG 1410, for example) have found that this action can provide adequate inventory and cooling to the RCS for a number of hours, allowing time for additional recovery actions to bring the plant to a nable condition, TSe likelihcod of failing to initiate RCS makeup assumed in the analysis is shown in Fig,2.
A.
u.
_. _ _ _, _ _. _. _. _ _ _. _ _. _.._ __