ML20135G962

Final ASP Analysis - Haddam Neck (LER 213-96-024)

ML20135G962
Person / Time
Site:	Haddam Neck File:Connecticut Yankee Atomic Power Co icon.png
Issue date:	05/14/2020
From:	Christopher Hunter NRC/RES/DRA/PRB
To:
Littlejohn J (301) 415-0428
References
LER 1996-024-00
Download: ML20135G962 (11)

Text

ADoendix B LER No. 213/96-024 B.3 LER No. 2 13/96-024 Event

Description:

After a residual heat removal pump seized, it was determined to have been susceptible to failure since its overhaul in 1987 Date of Event:

September 1, 1996 Plant:

Haddam Neck B.3.1 Event Summary The plant was shut down for a refueling and maintenance outage on July 22, 1996. The plant was in Mode 5 (cold shutdown) on September 1, 1996, when operators attempted to start the B residual heat removal (RHR) pump. The starting ammeter pegged, indicating a locked rotor on the B RHR pump. Operators secured the pump and continued decay heat removal with the A RHR pump.',' It was later determined that because of original manufacturing defects and marginal pump design, the pump had been susceptible to this failure since the previous overhaul in 1987 (Ref. 3). A failure of the B Ri-R pump prior to the current outage would have left the plant more susceptible to core damage following a loss-of-coolant accident (LOCA). The estimated increase in core damage probability (CDP) over a 30-d period for this event (i.e., the importance) is 2.9 x 10-6 above a base probability of core damage (the CDP) for the same period of 4.5 x 10.6.

1B.3.2 Event Description On July 29, 1996, an in-service test (1ST) was conducted on the B RHR pump. The measured vibration levels caused engineers to place the B RHR pump in the "Alert" range, and the IST frequency was changed from quarterly to monthly. On August 19, 1996, the B RHR pump was run in parallel with the A RHR pump to assist in cooling down the primary system in preparation for the low-pressure safety injection (LPSI) surveillance test. The licensee indicated that the final damage to the B RHR pump likely occurred when the pump was secured after 54 min of run time on August 19, 1996.

On August 31, 1996, operators discovered a pin-hole leak from the A RHR heat exchanger inlet valve body.

The A RHR heat exchanger was isolated to stop the leak. This left the A RHR pump to provide decay heat removal via the B RHR heat exchanger. On September 1, 1996, the operating staff decided to start the B RHR pump to allow it to operate with the B R-HR heat exchanger. The operators attempted to start the B RHR pump and observed the motor ampere indication peg off scale high (>400 A) for more than 5 s. The pump was secured. A few minutes later, a second start attempt was made with the same result. A subsequent attempt to rotate the pump shaft manually revealed that the pump shaft was seized. The B RI-R pump was declared out of service at this point.

The RHR pumps are original plant equipment. The last overhaul on the B RHR pump occurred in 1987. The pump failure was determined to have been caused by a combination of a marginal pump design and manufacturing defects in parts replaced during the 1987 overhaul.

An undetected shaft rub displaced a stationary stuffing box bushing, and over time the tack welds holding the stationary bushing in place failed.

This likely resulted in the increased vibration noted in the July 29, 1996 IST. The bushing was then free to B.3-1 B.3-1NUREG/CR-4674, Vol. 25

LER No. 213/96-024 Apni Appendix B move along the shaft and eventually cocked and locked. The locked bushing then heated and bowed the shaft on the subsequent run (August 19, 1996). This bowed shaft allowed for additional shaft rubs that led to the pump rotor being seized after the B RI-R pumnp was stopped. Although the failure of the B RHR pump actually occurred with the plant shut down, the failure was the result of ongoing wear and could have occurred with the plant at power.

B.3.3 Additional Event-Related Information The RH-R heat exchanger inlets are supplied from a common inlet line (Fig. B.3. 1) (Ref. 4). Therefore, decay heat removal with the A RHR pump via the B RI-R heat exchanger was an allowed equipment lineup.

However, the plant Technical Specifications require a second RHR loop to be available in standby in Mode

5. A review of the shutdown-related portions of this event was conducted in a separate analysis associated with licensee event report (LER) 213/96-021 (Ref. 5). This included a situation where the A RHR pump function was threatened by a nitrogen bubble in the core area.

The A RHR pump was last overhauled in 1990. Manufacturing defects similar to the defects that caused the failure of the B RHR pump were assumed to have been eliminated at that time.

B.3.4 Modeling Assumptions It is assumed that the B RI-R pump would have exhibited high vibration during an 1ST prior to actual pump failure. Because the B RHR pump did start and run for 54 min following the 1ST test that established the "Alert" condition, it is assumed that the pump would not have been in a failed condition for more than 30 d if the failure had occurred when the unit was operating at power. The failure of the B RHR pump was actually discovered 13 d after the most recent operation of the pump and over 1 month after the plant had shut down. However, if the failure had occurred when the unit was at power, it is likely that an entire test cycle would pass prior to discovering the failure.

Therefore, the probability that the B RHR pump fails (RHR-MDP-FC-JB) was set to "TRUE" (pump is failed) for a 30-d condition assessment. If the failure mechanism had not resulted in higher vibration being detected during an 1ST run of the B RHR pump, then the failure period of interest could be as long as 90 d. The 90-d case is examined as a sensitivity study.

Likewise, since the failure was a product of wear related to overall run time of the pump, it is reasonable to view the event as a long-term (1 -year) operation with an increased probability of failure of the B RHR pump.

This last situation is also addressed in a sensitivity study.

The probability that the A RHR pump fails (RHR-MDP-FC-IA) was not adjusted from the nominal value (4.1 x 10~) since the pump had been overhauled in 1990.

The licensee indicated that the difficulty experienced by the B RHR pump was corrected on the A RHR pump during that 1990 overhaul period.

Therefore, the common-cause failure probability (RHR-MDP-CF-ALL) was set to "FALSE" (would not occur).

B.3.5 Analysis Results The increase in the CDP over a 30-d period for this event is 2.9 x 10' over the nominal CDP of 4.5 x 10'.

The dominant core damage sequence for the event (sequence 3 on Fig. B.3.2) involves NUREG/CR-4674, Vol. 25

.2 B.3-2

Appendix B a postulated small-break LOCA (SLOCA),

a successful reactor trip, success of the auxiliary f eedwater (AFW) system, success of the high-pressure injection (HPI) system, a successful plant cooldown, failure of the RHR system, and failure of the high-pressure recirculation (HPR) system.

LER No. 213/96-024 This sequence accounts for 90% of the total contribution to the increase in the CDP. Core damage in this sequence depends on losing refueling water storage tank (RWST) inventory, which would take some time.

Failure of RHR and HPR during a SLOCA could be offset by the operator initiating makeup to the RWST.

This is not modeled within the Integrated Reliability and Risk Analysis System (IRRAS) and would tend to mitigate the increase in the CDP for this sequence. Large-break LOCAs, which are not currently directly modeled by IRRAS, would limit the time available to makeup to the RWST prior to the recirculation phase.

Additionally, the RHR system is subject to failure during large-break LOCAs due to deficits in net positive suction head (NPSH) to the RHR pumps.6 Analysis of RHR system failures at Haddam Neck in response to large-break LOCAs and NPSH problems is discussed in the analysis of LER No. 213/96-016 in Sect. 8.2.

Definitions and probabilities for selected basic events are shown in Table 8.3. l. The conditional probabilities associated with the highest probability sequences are shown in Table B.3.2. Table B.3.3 lists the sequence logic associated with the sequences listed in Table B.3.2. Table B.3.4 describes the system names associated with the dominant sequences. Minimal cut sets associated with the dominant sequences are shO\\m in Table B.3.5.

The B RHR pump was placed on a more frequent 1ST interval (30 d) based on high vibration observed during testing. If the pump operation prior to failure did not involve an 1ST or did not reach "Alert" levels, it is possible that the pump failure would not have been discovered for as much as 90 d (2160 h). In this sensitivity analysis, the probability of a common-cause failure of the RHR pumps (RHR-MDP-CF-ALL) was left at "FALSE" (will not occur), based on the overhaul of the A RHR pump in 1990. The increase in the CDP is 8. 7 x l o-6 above the nominal value of 1.4 x l o-5. The order and relative weight of sequences involving an increased CDP are the same as the order and weight that occurred in the 30-d analysis.

For the last year, the B RHR pump has had an increased failure probability associated with its overall run time. If the B RHR pump is IO times more likely to fail due to the manufacturing defect and accumulated run time over the last year (i.e., its failure probability increased to 4.1 x I 0*2), then the increase in the CDP is l. 0 x I 0-6 above the nominal value of 3. 9 x 10*5

• If the B RHR pump is l 00 times more likely to fail over the last year (i.e., its failure probability increased to 4.1 x 10-1), then the estimated increase in the CDP is 1.1 x 10*5. The A RHR pump failure probability was not adjusted, and the common-cause failure probability (RHR-MDP-CF-ALL) was also not adjusted upward because the A RHR pump was assumed not to be susceptible to the same failure mechanism as the B RHR pump. SLOCA sequence 3 accounts for 91 % of the total contribution to the increase in the CDP for this sensitivity study.

B.3-3 NUREG/CR-4674, Vol. 25

LER No. 213/96-024 Appendix B B.3.6 References

1. LER 2 13/96-024, Rev. 0, "'B' Residual Heat Removal Pump Found Inoperable in Mode 5 (Cold Shutdown)," October 22, 1996.

2.

LER 2 13/96-024, Rev. 1, "'B' Residual Heat Removal Pump Found Inoperable in Mode 5 (Cold Shutdown)," March 12, 1997.

3. NRC Integrated Inspection Report No. 50-213/96-08, "NRC Augmented Inspection Team Report -

Haddam Neck," October 3 0, 1996.

4.

Haddanm Neck Plant, Individual Plant Examination.

5. LER 213/96-021, Rev. 0, "Valve Leak-age Results in Nitrogen Intrusion Into RCS During Cold Shutdown," October 11, 1996.

6. LER 213/96-016, "Potential for Inadequate RHR Pump NPSH During Sump Recirculation," August 29, 1996.

NUREG/CR-4674, Vol.25 B.3-4 NUREG/CR-4674, Vol. 25 B.3-4

El NUREG/CR-4674, Vol. 25 Figure removed during SUNSI review.

LER No. 213/96-024 Avvendix B LER No. 2 13/96-024 ApDendix B 0

0z~0 0

0 00 0

0 00 0

0 00 0

0 C-CO 1W U')

(0 P-w h

N!:

t (0

!2-0:

v 0

AlN Aj OR COuJ w

Li O-Fig. B.3.2. Dominant core damage sequence for LER No. 213/96-024.

NUREG/CR-4674, Vol. 25 B.3-6

Ann~nd.v Ti LER No. 213/96-024 Table B.3.1. Definitions and Probabilities for Selected Basic Events for LER No. 213/96-024 Modified Event Base Current for this name Description probability probability Type event IE-LOOP Initiating Event-Loss of Offisite 3.8 E-006 3.8 E-006 No Power (LOOP)

IE-SGTR Initiating Event-Steam Generator 1.6 E-006 1.6 E-006 No Tube Rupture IE-SLOCA Initiating Event-SLOCA 1.0 E-006 1.0 E-006 No IE-TRANS Initiating Event-Transient 5.3 E-004 5.3 E-004 No (TRANS)

EPS-DGN-FC-IA Diesel Generator IA Fails 4.2 E-002 4.2 E-002 No EPS-DGN-FC.IB Diesel Generator IlB Fails 4.2 E-002 4.2 E-002 No HPR-XHE-NOREC Operator Fails to Recover HPR 1.0 E+000 1.0 E+000 No System HPR-XHE-NOREC-L Operator Fails to Recover HPR 1.0 E+000 1.0 E+000 No System During a LOOP OEP-XHE-NOREC-2H Operator Fails to Recover Offsite 2.7 E-00 1 2.7 E-00 I No Power Within 2 h PPR-MOV-00-BLKI Power-Operated Relief Valve 3.3 E-003 3.3 E-003 No (PORV) 1 Block Valve Fails to Close PPR-MOV-OO-BLK2 PORV 2 Block Valve Fails to 3.3 E-003 3.3 E-003 No Close PPR-SRV-CO-L PORVs Open During a LOOP 1.6 E-001 1.6 E-00oI No PPR-SRV-CO-TRAN PORVs Open During a Transient 4.0 E-002 4.0 E-002 No Event PPR-SRV-00-PRVI PORV 1 Fails to Reclose After 3.0 E-002 3.0 E-002 No Opening PPR-SRV-OO-PRV2 PORV 2 Fails to Reclose After 3.0 E-002 3.0 E-002 No Opening PPR-XHE-NOREC Operator Fails to Close Block

1. 1 E-002

1. 1 E-002 No Valves PPR-XHE-NOREC-L Operator Fails to Close Block

1. 1 E-002 1.1 E-002 No Valves During a LOOP 11 B.3-7 NUREG/CR-4674, Vol.25 B.3-7 NUREG/CR4674, Vol. 25

LER No. 213/96-024 Apni Appendix B Table B.3.1. Definitions and Probabilities for Selected Basic Events for LER No. 213/96-024 (Continued)

Modified Event Base Current for this name Description probability probability Type event RHR-MDP-CF-ALL RHR Motor-Driven Pump Fails 4.5 E-004 0.0 E-*000 FALSE Yes Due to Common-CauseII RHR-MDP-FC-IA RHR Pump A Fails 4.1 E-003 4.1 E-003 No RHR-MDP-FC-1B RHR Pump B Fails 4.1 E-003 1.0 E+000 TRUE Yes RHR-XHE-NOREC Operator Fails to Recover RHR 1.0 E+000 1.0 E+000 No

_________I___

System I_______

I_______

I____

NUREG/CR-4674, Vol. 25B.-

B.3-8

Aivendix B LER No. 213/96-024 Appendix B LER No. 2 13/96-024 Table B.3.2. Sequence Conditional Probabilities for LER No. 213/96-024 Conditional Event tree Sequence core damage Core damage Importance Percent name number probability probability (CCDP-CDP) contributiona (CCDP)

(CDP)

SLOCA 03 3.0 E-006 3.8 E-007 2.6 E-006 90.2 LOOP 10 1.4 E-007 2.9 E-009 1.4 E-007 4.9 TRANS 05 5.3 E-008 6.8 E-009 4.6 E-008 1.6 Total (all sequences) J 7.4 E-006 I.5 E-006 J 2.9 E-006

'Percent contribution to the total importance.

Table B.3.3. Sequence Logic for Dominant Sequences for LER No. 2 13/96-024 Event tree name Sequence Logic number SLOCA 03 IRT, IAFW, /HPI, /COOLDOWN, RHR, HPR LOOP 10 IRT-L, /EP, /AFW-L, PORV-L, PRVL-

_____________________RES, OP-2H, /HPI-L, HPR-L TRANS 05

/RT, /AFW, PORV, PORV-RES, /HPI,

____________________/COOLDOWN, RHR, HPR B.3-9 NUREG/CR-4674, Vol. 25 B.3-9 NUREG/CR-4674, Vol. 25

LER No. 213/96-024 AnDendix B LER No. 213/96-024 ADoendax B Table B.3.4. System Names for LER No. 2 13/96-024 System name Logic AFW No or Insufficient AFW Flow AFW-L No or Insufficient AFW Flow During a LOOP COOLDOWN Reactor Coolant System (RCS) Cooldown to RHR Pressure using the Turbine Bypass Valves (TBVs), etc.

EP Failure of Both Trains of Emergency Power HPI No or Insufficient Flow From the HPI System HPI-L No or Insufficient Flow From the HPI System During a LOOP HPR No or Insufficient Flow From the HPR System HPR-L No or Insufficient Flow From the HPR System During a LOOP OP-2H-Operator Fails to Recover Offsite Power Within 2 h POkV PORVs Open During a Transient Event PORV-L PORVs Open During a LOOP PORV-RES PORVs Fail to Reseat PRVL-RES PORVs and Block Valves Fail to Reclose (Emergency Power Succeeds)

RHR No or Insufficient Flow From the RHR System RT Reactor Fails to Trip During a Transient Event RT-L Reactor Fails to Trip During a LOOP NUREG/CR-4674, Vol. 25 B31 B.3-1 0

Appendix B Appenix BLER No. 213/96-024 Table B.3.5. Conditional Cut Sets for Higher Probability Sequences for LER No. 213/96-024

-7 Cut set Percent number IContribution CCDPa

.Cut setSb SLOCA Sequence 03 3.0 E-006 1

1 98.2 3.0 E-006 LOOP Sequence 10 1.4 E-007 IRHR-MDP-FC-lA, RHR-MDP-FC.1 B, RI-IR-XHE-NOREC, IHPR-XHE-NOREC I

I 97.2 1.4 E-007 EPS-DGN-FC-1A, /EPS-DGN-FC-I B, PPR-SRV-CO-L, PPR-SRV-OO-PRV2, OEP-H-E-NOREC-2H RHR-MDP-FC-I B, HPR-XHE-NOREC-L 2

1 111.6 E-009 EPS-DGN-FC-IA, IEPS-DGN-FC-IB, PPR-SRV-CO-L, I

~PPR-SRV-00-PRV 1, PPR-XHE-NOREC-L, I

O0EP-XHE-NOREC-2H. RHR-MDP-FC-I B, J___________HPR-XHE-NOREC-L TRANS Sequence 05 5.3 E-008.....................................

1 38.6 2.1 E-008 PPR-SRV-CO-TRAN, PPR-SRV-OO-PRVI, PPR-XHE-NOREC, RHR-MDP-FC-lA, RHR-MDP-FC-IB, RHR-XHE-NOREC, HPR-XHE-NOREC 2

38.6 2.1 E-008 PPR-SRV-CO-TRAN, PPR-SRV-OO)-PRV2, PPR-XHE-NOREC, RHR-MDP-FC-lIA, RHR-MDP-FC-I B, RHR-XHE-NOREC, HPR-XHE-NOREC 3

10.5 5.6 E-009 PPR-SRV-CO-TRAN, PPR-SRV-OO-PRV1, PPR-MOV-00-BLK 1, RHR-MDP-FC-1A, RHR-MDP-FC-I B, RHR-XHE-NOREC, HPR-XHE-NOREC 4

10.5 5.6 E-009 PPR-SRV-CO-TRAN, PPR-SRV-OO-PRV2, PPR-MOV-OO-BLK2, RHR-MDP-FC-1A, RHR-MDP-FC-I B, RHR-XHE--NOREC-HPR-XHE.-NOREC Total (all sequences) 1 7.4 E-006

'7The CCDP is determined by multiplying the probability that the portion of the sequence that makes the precursor visible (e.g., the system with a failure is demanded) will occur during the duration of the event by the probabilities of the remaining basic events in the minimal cut set. This can be approximated by I - e-p, where p is determined by multiplying the expected number of initiators that occur during the duration of the event by the probabilities of the basic events in that minimal cut set. The expected number of initiators is given by I.t, where X is the frequency of the initiating event (given on a per-hour basis), and t Is the duration time of the event [720 h (24 h/d x 30 d)]J.

This approximation is conservative for precursors made visible by the initiating event. The frequencies of interest for this event are XThANs

5.3xl10-"/h, X [loop = 3.8 x 10 '/h, andX LOA

1.0 x 10' /h. The importance is determnined by subtracting the CDP for the same period but with plant equipment assumed to be operating nominally.

b~asic event RHR-MDP-FC-1I1B is a type TRUE event. This type of event is not normally included in the output of the fault tree reduction process, but has been added to aid in understanding the sequences to potential core damage associated with the event.

B.3-1 I NUREG/CR-4674, Vol. 25