ML20135G748
| ML20135G748 | |
| Person / Time | |
|---|---|
| Site: | FitzPatrick  |
| Issue date: | 05/14/2020 |
| From: | Christopher Hunter NRC/RES/DRA/PRB |
| To: | |
| Littlejohn J (301) 415-0428 | |
| References | |
| LER 333-1991-014 | |
| Download: ML20135G748 (10) | |
Text
B-324 ACCIDENT SEQUENCE PRECURSOR PROGRAM EVENT ANALYSIS LER No.: 333/91-014 Event
Description:
Hydraulic pressure locking of two low-pressure ECCS injection valves Date of Event: August 5, 1991 Plant: Fitzpatrick Summary Following repairs to an outboard low-pressure coolant injection (LPCI) valve, and with the plant shut down, the inboard injection valve failed to open. This failure was the result of hydraulic locking of the valve bonnet. Both the two LPCI and the two core spray (CS) injection valves were determined to be susceptible to this failure mechanism.
Based on leak rate testing results, two of the four valves could fail to open if the reactor vessel was rapidly depressurized as it would be following a large-break loss-of-coolant accident (LOCA). The conditional core damage probability for this event is estimated to be 9.5 x 10-5. The relative significance of the event compared to other postulated events at Fitzpatrick is shown below.
LE3/1-014 I E-7 1E-6 LTRIPI ]Oo IE-5 360 It HPC+ HPCI 1E4 W[L o AD E-3 1E-2 precursor cutoff _.j + RCIC Event Description The plant was shut down on May 7, 1991, to repair valves in both LPCI injection lines.
On July 17, 199 1, following corrective maintenance for valve and actuator problems with the outboard LPCI injection valve, a hydrostatic test of the piping between the inboard (MOV-25B) and outboard (MOV-27B) LPCI injection valves was performed. The hydrostatic test pressure was -2100 psig. Upon completion of the test, the piping between valves was depressurized. A fill and vent of the system was initiated in preparation for returning the loop to service in the shutdown cooling (SDC) mode.
B-325 Approximately 9 to 10 h after the completion of the test, the loop had been filled to the inboard LPCI injection valves. The operators attempted to open the 24-in, flexible wedge gate valve (MOV-25B3) from the control room. The actuator remained energized for approximately 30 s -after which the motor actuator circuit breaker tripped. The normal stroke time for this valve is 120 s.
Utility personnel suspected that the valve failure was the result of hydraulic "pressure locking," where excessive pressure is trapped between the wedges of a flexible wedge gate valve such as MOV-25B3. This valve design is used in both the LPCI and CS injection. lines, rendering these systems susceptible to failure. The hydraulic pressure locking phenomenon is illustrated in Fig. 1.
A second hydrostatic test was performed on July 28, 1991. Instrumentation installed during this test confirmed that hydraulic locking was taking place. During this test, as pressure was increased to 850 psig, the rate of pressurization dropped to zero for approximately 30 min, indicating compression of air in the valve bonnet. Target test pressure of 2100 psig was held for 10 min and released. Thirty minutes after depressurization, operators attempted to open the valve from the control room. The actuator motor line current went to locked-rotor current, and the circuit breaker was manually opened by an electrician monitoring line current. The bonnet was vented through the stem packing gland, and air escaped. Coincident with the bonnet depressurization, valve position indication in the control room changed from closed to intermediate. The valve then stroked normally from the control room.
All four LPCI and CS injection valves were modified, prior to plant start-up, to incorporate a bonnet vent to the high-pressure side of the valve.
Additional Event-Related Information Following the determination that the motor failure was caused by pressure locking of the valve, an analysis was performed by a consultant to the utility to determine the impact on other motor-operated, flexible wedge gate valves. Three scenarios were examined for each of these valves:
- 1) Water trapped in the valve bonnet "expands" as a result of heating during normal plant start-up.
- 2) Water trapped in the valve bonnet "expands" as a result of heating during a postulated high-energy line break.
- 3) One side of the valve is initially pressurized by check valve leakage and then suddenly depressurized as a result of a loss-of-coolant accident (LOCA) or automatic depressurization system (ADS) actuation.
B-326 The analysis performed for the utility indicated that thermally-induced bonnet pressurization (scenarios 1 and 2) did not appear to be a concern. These two scenarios were not addressed in this analysis.
In the RHR and CS systems there are testable check valves between the reactor and the normally closed isolation valves. Leakage past the check valves will eventually place reactor pressure on one side of the flexible wedge disc. The wedge will then flex, allowing reactor pressure into the bonnet. Pressures on the order of 1,000 psig could become trapped in the bonnets of all four low-pressure emergency core cooling system (ECCS) injection valves following vessel depressurization during a LOCA. The utility stated that calculations taking into account the installed actuator size and past Local Leak Rate Test (LLRT) data showed that bonnet pressures in the range of 600 to 700 psig would be sufficient to lock the affected valves shut.
After the valves lock shut, there is a finite period of time before the bonnet pressure decays to a level less than the maximum bonnet pressure the valve actuator can overcome to open the valve. This period of time depends on the leak area of the bonnet, the area of the disk seating surface, the valve size, and the differential pressure across the valve.
Lower bonnet leak rates will result in longer periods that the valve will be locked in the shut position. Considering the time period from LOCA initiation until the low-pressure ECCS injection valves receive their open signal, the analysis estimated that, for the existing valves, the pressure within the bonnets of two out of four valves would have decayed to within the capability of the valve actuator.
ASP Modeling Assumptions and Approach The event was modeled as an unavailability of two of the four LPCI and CS injection paths. Both LPCI valves were assumed to be unavailable. Conditional failure probabilities of 0.3 and 0.5 were assigned to the two potential operable CS injection trains. (Assuming both LPCI trains are initially unavailable results in an event significance estimate that is somewhat higher than assuming one LPCI and one CS train were initially unavailable.)
The unavailability existed since initial criticality. To estimate the relative significance of the event within a 1-yr observation period (the interval between precursor reports), a 1-yr unavailability was utilized in the analysis (6132 h, assuming the plant was critical or at hot shutdown for 70% of the year).
In the analysis, residual heat removal (RHR) SDC was also assumed to be unavailable because of the unavailable LPCI valves. It is possible that the valve bonnets would depressurize prior to the need for these valves to open for RHR (SDC) (typically 6-12 h following scram) in sequences where low-pressure injection was not demanded. If this were the case, such sequences would not be impacted by this event. A sensitivity
B-327 analysis was performed ýto determine the impact- on event significance if RHR (SDC) were available for these sequences.,
Two additional changes were made in model probabilities to reflect the specifics of the event:
" The Accident Sequence Precursor (ASP) models assume that RHR suppression pool (SP) cooling is more likely to fail if LPCI.,and RHR (SDC) are failed. In this event, the SP cooling function should not have been impacted by the failure of the LPCI injection valves. Therefore, the failure probability for SP cooling given unavailability cf LPCI and RHR (SDC) was reduced to 2.0 x 10-3. This value is consistent with values used elsewhere in the model.
" The ASP models also address the potential use of RHR service water (RHRSW) for low-pressure injection, given that LPCI is failed. In this event, the dominant failure mode for LPCI is failure of both injection valves. If these valves fail, RHRSW also fails. A failure probability of 1.0 was assumed in this analysis.
The impact of the valve failures on large-break LOCA sequences was also addressed.
For a large-break LOCA, successful operation of one LPCI train or one CS train, combined with long-term heat removal using the RHR SP cooling mode, was assumed to provide successful mitigation.
The core damage probability contribution from large-break LOCA sequences can therefore be approximated by p(large-break LOCA in 1-yr time period)*
[p(LPCI fails Iobserved valve failures)*
p(CS fails Iobserved valve failures) +
p(RHR SP cooling fails Iobserved valve failures)]
=1.0 x 10- [1.0
- 0.15 + 2.0 x 10-31
=1.5 x 10-5.
A second sensitivity analysis was performed assuming all four ECCS valves were failed.
Analysis Results The conditional core-damage probability for this event is estimated at 9.5 x 10O5 This includes the sequences documented on the calculation sheets included with this analysis, plus the contribution from postulated large-break LOCAs, as described above. The dominant sequence, highlighted on the following event tree, involves a postulated small-break LOCA with failure of high-pressure coolant injection, successful depressurization to allow use of the low-pressure systems, and failure of low-pressure injection (LPD).
B-328 Assuming all four ECCS valves were failed results in an estimated conditional probability of 3.9 x 10-4, a factor of 4 higher than the nominal conditional probability estimated for the event. This small difference is primarily a result of the conditional probabilities assumed for the two CS trains, given the failed LPCI trains.
Assuming RHR(SDC) would not be impacted in sequences where LPI is not demanded (sequences 11, 40, 12, 71, and 21 on the following calculation sheet, plus lower probability sequences) results in an estimated conditional probability of 5.2 x1-5 about half of the nominal conditional probability estimated for the event.
B-329, Attachment 1 IN 92-26" April 2, 1992
.Page 1 of 1 Figure 1. Hydraulic pressure locking phenomenon
B-330 SEQ END (SDC PSMODElo LOCA RxISHT DOWN R
J IILPCI RR RHR RR OEOTHER I RHRSW NO STATE OK OK 71 CORE DAMAGE OK OK 72 CORE DAMAGE OK OK 73 CORE DAMAGE OK 74 CORE DAMAGE OK 75 CORE DAMAGE 76 CORE DAMAGE 77 CORE DAMAGE 96 ATWS Dominant core damage sequence for LER 333/91-014
B-331 CONDITIONAL CORE DAMAGE PROBA13ILITY CALCULATIONS Event Identifier: 333/ 91-014 Event
Description:
Low pressure ECCS valve hydraulically locked (LPCI failed)
Event Date: 08/05/91 Plant: Fitzpatrick UNAVAILABILITY, DURATION= 6132 NON-RECOVERABLE INITIATING EVENT PROBABILITIES TRANS 2 .IE+00 LOOP 3 .6E-02 LOCA 1 .OE-02 SEQUENCE CONDITIONAL PROBABILITY SUMS End State/Initiator Probability CD TRANS 3 .6E-05 LOOP 1.2E-05 LOCA 3 .2E-05 Total 8 .OE-05 ATWS TRANS 0 .OE+00 LOOP 0 .OE+00 LOCA 0 .OE+00 Total 0. OE+00 SEQUENCE CONDITIONAL PROBABILITIES (PROBABILITY ORDER)
Sequence End State Prob N Rec-*
75 boca -rx.shutdown hpci -srv.ads LPCS LPCI(RNR)/LPCS rhr(sdc) CD 3.OE-05 3.5E-01
/lpci -RHR (SPCOOL) /LPCI.RHR (SOC) RHRSW 11 trans -rx.shutdown pcs/trans srv.chall/trans.-scram -srv.close CD 2.7E-05 1.0E-01
-fw/pcs .trans RNR (SOC) rhr (spcool) /rhr (sdc) 40 loop -emerg.power -rx.shutdown srv.chall/loop.-scram -srv.close CD 7.3E-06 4.1E-02
-hpci RHR (SOC) rhr (spcool( /rhr (sdc) 12 trans -rx.shutdown pcs/trans srv.chall/trans.-scram -srv.close CD 5.OE-06 3.9E-02 fw/pcs.trans -hpci RHR(SDC) rhr(spcool)/rhr(sdc) 53 loop -emerg.power -rx.shutdown srv.chall/loop.-scram srv.close CD 3.7E-06 2.5E-01 hpci -srv.ads LPCS -LPCI(RNR)/LPCS rhr(sdc)/lpci -RI4R(SPCOOL)/
LPCI.RHR(SDC) RHRSW 26 trans -rx.shutdown pcs/trans srv.chall/trans.-scrars srv.close CD 2.5E-06 2.4E-01 fw/pcs.trans hpci -srv.ads LPCS LPCI(RHR)/LPCS rhr(sdc)/lpci
-RHR(SPCOOL) /LPCI.RZHR(SDC) RHRSN 71 loca -rx.shutdown -hpci RHR(SDC) rhr(spcool)/rhr(sdc) CD 2.2E-06 5.7E-02 21 trans -rx.shutdown pos/trans srv.chall/trans.-scram srv.close CD l.OE-06 1.OE-01
-fw/pcs.trans RHR(SDC) rhr(spcool)/rhr(sdc)
-* non-recovery credit for edited case SEQUENCE CONDITIONAL PROBABILITIES (SEQUENCE ORDER)
Event Identifier: 333/91-014
B-332 tt Sequence End State Prob N Rec 11 trans -rx.shutdown pcs/trans srv.chall/trans.-scram -srv.close CD 2.7E-05 1.02-01
-fw/pcs.trans RHR(SDC) rhr(spcool)/rhr(sdc) 12 trans -rx.shutdown pcs/trans srv.chali/trans.-scrars -srv.close CD 5.02-06 3.9E-02 fw/pcs.trans -hpci RHR(SDC) rhr(spcool) /rhr(sdc) 21 trans -rx.shutdown pcs/trans srv.chall/trans.-scram srv.close CD 1.02-06 1.02-01
-fw/pcs.trans RHR(SDC) rhr(spcool) /rhr(sdc) 26 trans -rx.shutdown pcs/trans srv.chall/t rans. -scram srv.close CD 2.5E-06 2.4E-01 fw/pcs.trans hpci -srv.ads LPCS LPCI(RHR)/LPCS rhr(sdc)/lpci
-RHR(SPCcflL) /LPCI.RHR(SDC) RHRSW 40 loop -ernerg.power -rx.shutdown srv.chall/loop.-scram -srv.close CD 7.3E-06 4.1E-02
-hpci RHR (SDC) rhr (spcool) /rhr (sdc) 53 loop -emerq.power -rx.shutdown srv.chall/loop.-scram srv.close CD 3.72-06 2.52-01 hpci -srv.ads LPCS LPCI(RHR)/LPCS rhr(sdc)/lpci -RHR(SPCOOL)/
LPCI.RHR(SDC) RHRSW 71 loca -rx.shutdown -hpci RHR(SDC) rhr(spcool)/rhr(sdc) CD 2.22-06 5.72-02 75 loca -rx.shutdown hpci -srv.ads LPCS LPCI(RHR)/LPCS rhr(sdc) CD 3.02-05 3.52-01
/lpci -fRHR(SPCOOL) /LPCI.RHR (SDC) RHRSW
-* non-recovery credit for edited case Note: For unavailabilities, conditional probability values are differential values which reflect the added risk due to failures associated with an event. Parenthetical values indicate a reduction in risk compared to a similar period without the existing failures.
SEQUENCE MODEL: c: \asp\1989\bwrcseal.cmp BRANCH MODEL: c:\asp\1989\fitzpatr.sl1 PROBABILITY FILE: c:\asp\1989\bwr_csll.pro No Recovery Limit BRANCH FR2QUENCI2S/PROBABILITI2S Branch System Non-Recov Opt Fail trans 3.4E-04 1. 02+00 loop 1.62-05 3.6E-01 loca 3.3E-06 5.02-01 rx. shutdown 3.02-0 5 1.02+00 rx. shutdown/ep 3. 5E-04 1.02+00 pcs/trans 1.7Z-01 1.02+00 srv.chall/trans .-scram 1.02+00 1.02+00 srv.chall/loop.-scram 1.02+00 1.02+00 srv.close 3.6E-02 1.OE+00 emerg.power 2. 9E-03 8.02-01 ep. rec 1. 6E-01 1.02+00 fw/pcs .trans 4.6E-01 3.4E-01 fw/pcs .loca 1.02+/-00 3. 4E-01 hpci 2.9E-02 7.02-01 rcic 6.02-02 7.02-01 crd 1.02-02 1.02+00 1.02-02 s rv .ads 3. 7E-03 7.1E-01 1.02-02 LPC S 3.02-03 > 1.5E-01 3.4E-01 > 1.02+/-00 Branch Model: 1.OF.2 Train 1 Cond Prob: 3.02-02 > 3.02-01 Train 2 Cond Prob: 1.02-01 > 5.02-01 LPCI (RHR) /LPCS 1.02-03 > 1.02+00 7.1E-01 > 1.02+00 Branch Model: 1.OF.2 Train 1 Cond Prob: 1.02-02 > Failed Train 2 Cond Prob: 1.02-01 > Failed RHR (SDC) 2.12-02 > 1.0E+00 3.4E-01 1.02-03 Event Identifier: 333/91-014
B-333 Branch Model: l.,OF.2+ser+opr Train 1 Cond Prob: 3.02-03 > Failed Train 2 Cond Prob: 3.02-01 > Failed Serial Component Prob: 2.02-02 rhr (sdc) /-lpci 2.02-02 3.4E-01 1.02-03 rhr(sdc)/lpcl 1.02+00 1.02+00 1.02-03 rhr (spcooi) /rhr(sdc) 2.02-03 3.4E-01 rhr (spcool) /-lpci.rhr(adc) 2. 02-03 3.4E-01 RIIR(SPCOOL) /LPCI.RHR(SDC) 9.3E-02 > 2.02-03 1.02+00 Branch Model: 1.OF.1 Train 1 Cond Prob: 9.3E-02 > 2.02-03 R14RSW 2.02-02 > 1.02+00 3.4E-01 > 1.02+00 2.02-03 Branch Model: l.OF.l+opr Train 1 Cond Prob: 2.02-02 > Failed
- branch model file
- forced Minarick 05-07 -1992 12: 01: 31 Event Identifier: 333191-014