ML20135G740
| ML20135G740 | |
| Person / Time | |
|---|---|
| Site: | Cook  |
| Issue date: | 05/14/2020 |
| From: | Christopher Hunter NRC/RES/DRA/PRB |
| To: | |
| Littlejohn J (301) 415-0428 | |
| References | |
| LER 315-1995-011 | |
| Download: ML20135G740 (10) | |
Text
Appendix B LER No. 315/95-011 AB.4dx LER No. 315/95-011 Event
Description:
One safety injection pump unavailable for 6 months Date of Event: September 12, 1995 Plant: D. C.Cook, Unit I B.4.1 Event Summary As the result of a surveillance test performed while the unit was shut down in Mode 6, personnel determined that the West Centrifugal Charging Pump (CCP) had been inoperable for about 6 months. The pump was inoperable because a relay calibration had becn performed incorrectly 6 months earlier. The unavailability of the West CCP primarily affects the unit's response to a small-break loss-of-coolant accident (SLOCA) event. The estimated increase in core damage probability (CDP) for this event (i.e., the importance) is 7.7 x 10' above a base probability of core damage (the CDP) for the same period of 2.9 x 1O'.
B.4.2 Event Description On September 12, 1995, the plant was shut down in Mode 6 when the West CCP was started to perform the emergency core cooling system (ECCS) full flow test surveillance. The West CCP provides injection flow on the receipt of a safety injection (SI) signal. After operating at full flow for 7 min, the pump tripped on motor overcurrent. Personnel determined that the pump tripped because the 1-5 1-TAS time overcurrent relay was set incorrectly. It was determined that this relay was last calibrated on March 15, 1995, 180 days before the full-flow test. The West CCP was rendered inoperable for the preceding 6 months.
During the event review, the Instr-umentation and Control (I&C) technicians involved in calibrating the relays demonstrated the way they typically determine the relay pick-up current. Because their technique was incorrect, the relays were miscalibrated. Both I&C technicians involved in the relay calibration were trained and qualified in the D. C. Cook Nuclear Plant relay training program. However, a significant amount of time had elapsed between the end of the training program and the time the 1-5 1-TA8 time overcurrent relay on the West CCP breaker was calibrated incorrectly.
B.4.3 Additional Event-Related Information During normal plant operation, both charging pumps (East and West) are configured for their charging function. One charging pump is sufficient to supply full charging flow and reactor coolant pump seal injection during normal leak-age and normal letdown conditions. A third positive displacement charging pump is available but is not normally used. On receipt of a valid SI signal, the CCPs operate in the high pressure injection (HPI) mode.
D. C. Cook also has a separate SI system. The system, with two pumps operating in parallel, runs in an intermediate pressure injection mode. The two SI pumps deliver flow from the Refueling Water Storage Tank B.4-1 NUREG/CR4674, Vol. 23
LER No. 315/95-011 AwDendix B (RWST) at a maximum injection pressure of approximately 7.6 MPa (1100 psig). The residual heat removal (RHR) pumips can be aligned for recirculation from the containment sump to the suction of either the SI pumps or the CCPs.
The licensee indicated that the East CCP had been inoperable for less than 18 h during the 6-month period that the West CCP was unavailable. Additionally, the emergency diesel generator (EDG) supporting the East CCP was unavailable for less than 50 h during the 6-month period that the West CCP was unavailable.
B.4.4 Modeling Assumptions This event was modeled as a long term (4320 hours0.05 days <br />1.2 hours <br />0.00714 weeks <br />0.00164 months <br />, 180 days x 24 h/day) unavailability of the West CCP.
The event model was broken into three cases based on reported equipment availability. The first case modeled only the West CCP as being unavailable for 4252 hours0.0492 days <br />1.181 hours <br />0.00703 weeks <br />0.00162 months <br />. The second case took into account that the opposite train EDG was periodically unavailable for time periods totaling 50 hours5.787037e-4 days <br />0.0139 hours <br />8.267196e-5 weeks <br />1.9025e-5 months <br /> while the West CCP was unavailable. Finally, the third case accounted for the report that both CCPs were simultaneously unavailable for various maintenance periods totaling 18 hours2.083333e-4 days <br />0.005 hours <br />2.97619e-5 weeks <br />6.849e-6 months <br />.
Loss-of-offsite power (LOOP) sequences are prominent in the second case when only one EDG was available.
LOOP probabilities for short-term and long-term off-site power recovery and the probability of a reactor coolant pump (RCP) seal LOCA following a postulated station blackout were developed based on data distributions contained in NLJREG 1032, Evaluation of Station Blackout Accidents at NuclearPower Plants.
The RCP seal LOCA models were developed as part of the NUREG-1 150 PRA efforts. These probabilities and models are described in Revised LOOP Recovery and PWR Seal LOCA Models, ORNLINRCILTR-8911 1, August 1989.
The CCPs were subject to common-cause failure during this 6-month period resulting from incorrect maintenance practices. Because the success criterion in the Integrated Reliability and Risk Analysis System (IRRAS) model assumes both CCPs are required for success of the CCP portion of the HPI function in response to either an SLOCA or a steam generator tube rupture (SGTR), no changes were required to model the increased potential for common-cause failure. Success of one of the two SI pumps also ensures success of the HPI function in the IRRAS model, independent of the success of the CCPs. This assumption is not as stringent as that of the plant Individual Plant Examination, which is that one of two CCPs and one of two SI pumps are required in response to an SLOCA.
The IRRAS response to an SGTR was modified. Previously, a loss of the HPI function lead directly to core damage. The possibility of lowering RCS pressure below the steam generator safety valve set point within 30 min was allowed following the loss of HPI capability by adding a basic event PCS-XH-E-DEPRES. Based on the operator burden under a short time constraint, a failure probability of 0.1 was assigned to the new basic event, PCS-XHE-DEPRES.
B.4-2 NUREGICR-4674, Vol.
NUREG/CR-4674, Vol. 23 23 B.4-2
ADDendix B LER No. 315/95-011 ADDendix B LER No. 315/95-011 B.4.5 Analysis Results Determining the overall increase in the CDP required determining the increase in the CDP for the three different cases and then summing the cases. The three cases are:
Case I the increase in the CDP due to the long-term unavailability of the West CCP (4252 h).
Case 2 the increase in the CDP from the opposite train EDG being unavailable periodically while the West CCP was unavailable (50 h).
Case 3 the increase in the CDP due to the time that the CCPs were simultaneously unavailable because of various maintenance activities (18 h).
Combining the probability estimates for the three cases results in an overall increase of 7.7 x 10' in the CDP for the 180-day period. This is above a base probability for core damage (the CDP) for the same period of 2.9 x 10'~. Most of the increase (56%) is driven by the long-term unavailability of the West CCP (Case 1).
An additional 44% of the increase in CDP is added by Case 2. The dominant core damage sequence, highlighted as sequence number 6 on the event tree in Fig. B.4. 1, contributes approximately 44% to the combined increase in the CDP estimate for all three modeled cases. Sequence number 6 involves:
- an SLOCA,
- the successful trip of the reactor,
- the successfuil operation of the Auxiliary Feedwater (AFW) system, and
- the failure of the HPI system to provide sufficient cooling flow.
The next most dominant sequence involves a LOOP and contributes approximately 13% to the combined increase in the CDP estimate for all three modeled cases.
The nominal CDP over a 6-month period estimated using the Accident Sequence Precursor (ASP) models for D. C. Cook is approximately 2.9 x 10' The failed West CCP increased this probability by 28% to 3.7 x 10'. This latter value (3.7 x 10--) is the conditional core damage probability (CCDP) for the 6-month period in which the West CCP was inoperable.
For most ASP analyses of conditions (equipment failures over a period of time during which postulated initiating events could have occurred), sequences and cut sets associated with the observed failure dominate the CCDP (i.e., the probability of core damage over the unavailability period, given the observed failures).
The increase in CDP because of the failures is, therefore, essentially the same as the CCDP, and the CCDP can be considered a reasonable measure of the significance of the observed failures. However, for this event, sequences unrelated to the failure of the West CCP dominated the CCDP estimate. The increase in CDP given the West CCP inoperability, 7.7 x 10', is, therefore, a better measure of the significance of the failure of the West CCP.
Definitions and probabilities for selected basic events are shown in Table BA4. 1. The conditional probabilities associated with the highest probability sequences for the condition assessment are shown in Table B.4.2. The sequence logic associated with the sequences listed in Table B.4.2 are given in Table B.4.3. Table BA4. lists B.4-3 NU.REGICR-4674, Vol. 23 B.4-3
LER No. 315/95-011 Avvendix B the system names associated with the dominant sequences for the condition assessment. Minimal cut sets associated with the dominant sequences for the condition assessment are shown in Table B.4.5.
B.4.6 References
- 1. LER 315/95-011, Rev 0, "West Centrifugal Charging Pump Inoperable due to Inability to Meet Design Basis Requirements for Six Months as a Result of Personnel Error During Relay Calibration,"
November 20, 1995.
- 2. Indiana Michigan Power Company, Donald C. Cook Nuclear Plant Individual Plant Examination Summary Report.
- 4. Evaluation of Station Black-out Accidents at Nuclear Power Plants, NUREG- 1032.
- 5. Revised LOOP Recovery andPHI? SealLOCA Models, ORNLJNRC/LTR-89/I 1, August 1989.
NUREG/CR-4674, Vol. 23B.4 B.4-4
Annendix B ADnendix B LER No. 315/95-011 LER No. 315/95-011 AM 012 0000 000-
- N to It WO fa r- a as o - V' V :!: V0 !N t0 !! IR -
IL . . . . . . . . . .
~Ii II' I T-]
III
'ii I'
w w
~Ii 0
Fig. BA4 1. Dominant core damage sequence given a small LOCA for LER 315/95-011.
B.4-5 B.4-5NUREG/CR-4674, Vol. 23
LER No. 315/95-011 ADoendix B Table B.4.. Definitions and Probabilities for Selected Basic Events for LER No. 315/95-011 Modified Event Base Current for this name Description probability probability Type event CVC-MDP-FC-IA Failure of Charging Pump A 9,OE-004 1.OE+OOO TRUE Yes HPI-MDP-CF-ALL HP! Motor-Driven Pump 7.8E-004 7.8E-004 No Common-Cause Failures HPI-MDP-FC-IA HP! Motor-Driven Pump A Fails 3.9E-003 3.913-003 No HPI-MDP-FC-IB HP! Motor-Driven Pump B Fails 3.9E-003 3.9E-003 No HPI-MOV-OC-SUC HP! Serial Component Failures 1A.E-004 1.411-004 No HPI-MOV-00-RWST Failure to Isolate the RWST 3.0E-003 3.OE-003 No From the HP! System_______
HPI-XHE-NOREC Operator Fails to Recover the S.4E-0O1 9.411-001 No HP! System HPR-XHE-NOREC Operator Fails to Recover the 1.013+000 1.OE+O00 No High Pressure Recirculation (HPR) System_____ ______
PCS-XHE-DEPRES Failure to Depressurize the RCS I OE-O001 1.OE3-001 NEW No Within 30 Minutes RHR-MDP-CF-ALL RH-R Pump Common-Cause 4.5E-004 4.5E-004 No Failures RHR-MDP-FC-IA RHR Motor-Driven Pump IA 4.I1E-003 4.111-003 No Fails RHR-MDP-FC-IB RHR Motor-Driven Pump 11B 4. 1E-003 4.1E-003 No Fails RHR-MOV-CC-SIJC! Failure of RI-R Hot Leg Suction 3.OE-003 3.OE-003 No Motor-Operated Valve (MOV) A RHR-MOV-CC-SIJC2 Failure of RH-R Hot Leg Suction 3.011-003 3.OE-003 No MOV B RHR-MOV-00-RWST Failure to Isolate the RWST 3.OE-003 3.011-003 No During RH-R ____
RHR-XHE-NOREC Operator Fails to Recover the I .OE+O000 I .OE+O00 No RHR System___________ ____ _____
B.4-6 NUREG/CR-4674, Vol.Vol. 23 23 B.4-6
LER No. 315195-011 LRN.359-1 Annendix B Table B.4.2. Sequence Conditional Probabilities for LER No. 315/95-011 Conditional Event tree Sequence core damage Core damage Importance Percent name name probability probability (CCDP-CDP) contribution'
_______ _______ (CCDP) (CDP) __________
SLOCA 06 3.3E.006 2.9E-008 3.3E-006 77.2 SGTR 08 5.413-007 4.8E-009 5.4E-007 12.5 SLOCA 03 2.2E-008 2.OE-006 1.5E-007 3.7 Subtotal Case 1 (shown)' 3.3E-005 2.9E-005 4.3E-006 Subtotal Case 2 ' 3.7E006 3.4E-007 3.4E-006 Subtotal Case 3Y 1.413-007 1 1.213-007 1.813-008 Total (all sequences) 3.7E-005 I 2.9E-005 7.7E-006 aCase 1 represents the increase in the core damage probability due to the long-term unavailability of the West CCP (4252 h).
b Case 2 represents the increase in the CDP from the opposite train EDO being unavailable periodically while the West CCP was unavailable (50 h).
C Case 3 represents the increase in the core damage probability due to the time that the CCPs were simultaneously unavailable because of various maintenance activities (18 h).
dPercent contribution to the total importance.
B.4-7 B.4-7NUREGICR-4674, Vol. 23
LER No. 315/95-011 Apni Appendix B Table B.4.3. Sequence Logic for Dominant Sequences for LER No. 315/95-Oil (Case 1 only)
Event tree name Sequence name Logic SLOCA 06 IRT, /AFW, HPI SGTR 08 /RT, /AFW, HPI, RCS-SG-H SLOCA 03 IRT, /AFW, IHPI,
_________ _________/COOLDOWN, RHR, HPR Table B.4.4. System Names for LER No. 315/95-011 (Case 1 only)
System name Logic AFW No or Insufficient AFW Flow COOLDOWN RCS Cooldown to RHR Pressure Using Turbine-Bypass Valves, etc.
HPI No or Insufficient Flow From HPI System HPR No or Insufficient HPR Flow RHR No or Insufficient Flow From RHR System RCS-SG-H Failure to Depressurize the RCS Below the Steam Generator Safety Valve Setpoint Without HPI RT Reactor Fails to Trip During Transient Vol. 23 B.4-8 NUREG/CR-4674, Vol. 23 B.4-8
LER No. 315/95-011 Annendix B LRN.359-1 Table B.4.5. Conditional Cut Sets for Higher Probability Sequences for LER No. 315/95-Oil Cut set Percent Change in no. contribution CCDP Cut sets' (Importance)"
~~ Sequece3......... . . .
SGTRA Sequence 08 53.3E-0067 ...
1 83.1 2.8E-006 CVC-MDP-FC-1A. HPI-MDP-CF-ALL, HPI-XHE-NOREC, 2 14.9 5.013-007 CVC-MDP-FC-1A. HPI-MOV-OC-SUC, HPI-XHE-NOREC, 3 1.6 8.6E-009 CVC-MDP-FC-1A, HPI-MDP-FC-1A, HPJ-MDP-FC-1B, HPR-XHE-NOREC R.......... E-.... .H ......
5 1. 3.6.009 CVC-DP-F-1A.HPIMOV-O-RWT, ......... UC1 Total (alSequences 08 7E-006 ................... .....i::..... ....
......... 6 4 Vol.. 3 B.4-9 NUREG/CR-4674, Vol. 23
LER No. 315/95-011 Appendix B 8The change in conditional probability (importance) is determined by calculating the conditional probability for the period in which the condition existed, and subtracting the conditional probability for the same period but with plant equipment assumed to be operating nominally. The conditional probability for each cut set within a sequence is determined by multiplying the probability that the portion of the sequence that makes the precursor visible (e.g., the system with a failure is demanded) will occur during the duration of the event by the probabilities of the remaining basic events in the minimal cut set. This can be approximated by I - e-', where p is determined by multiplying the expected number of initiators that occur during the duration of the event by the probabilities of the basic events in that minimal cut set. The expected number of initiators is given by At, where A is the frequency of the initiating event (given on a per-hour basis), and t is the duration time of the event. This approximation is conservative for precursors made visible by the initiating event.
The frequencies of interest for this event are:
A~5.3 - I0-'h, I Lop =3.8 x10-6/h,X, 1 1.0 x 10 '/h, andIsc,= 1.6 x 10 '/h.
b Case I represents the increase in the core damage probability due to the long term unavailability of the West CCP (4252 h).
cCase 2 represents the increase in the CDP from the opposite train EDO being unavailable periodically while the West CCP was unavailable (50 h).
d Case 3 represents the increase in the core damage probability due to the time that the CCPs were simultaneously unavailable because of various maintenance activities (18 h).
0 Basic event, CVC-MDP-FC-1A, is a TRUE type event which is not normally included in the output of fault tree reduction programs.
This event has been added to aid in understanding the sequences to potential core damage associated with the event.
NUREG/CR-4674, Vol. 23 B41 B.4-10