ML20135G967
| ML20135G967 | |
| Person / Time | |
|---|---|
| Site: | Indian Point  |
| Issue date: | 05/14/2020 |
| From: | Christopher Hunter NRC/RES/DRA/PRB |
| To: | |
| Littlejohn J (301) 415-0428 | |
| References | |
| LER 286-1990-005 | |
| Download: ML20135G967 (6) | |
Text
B-184 ACCIDENT SEQUENCE PRECURSOR PROGRAM EVENT ANALYSIS LER No.:
Event
Description:
Date of Event:
Plant:
286/90-005 All diesel generators potentially inoperable August 9, 1990 Indian Point 3 Summary All diesel generators (DGs) were potentially inoperable for 10.6 h because of an unexpected interaction between the jacket water cooling system and the field flash relays.
Following a modification to install a thermostatically-controlled valve in the jacket cooling water system, jacket water pressure would not decrease sufficiently to reset pressure switches used to activate the field flash relays. This resulted in excess current flow through the control power fuses, which caused them to blow. The conditional core damage probability estimated for this event is 3.5 x 10-6. This value is a bounding estimate, since the control power fuses for different diesels were found blown and replaced at different times. The relative significance of this event compared to other postulated events at Indian Point 3 is shown below.
LER 286/90-005 1E-7 1E-6 IE-5 IE-4 1E-3 1E-2 Trip LL 36Oh EP precursor cutoff _J LOFW + 1 360 h AFW KMrRAFW Event Description On August 3, 1990, DG 31 was modified to allow operation at a higher service water temperature limit. Part of the modification consisted of replacing a thermostatically controlled valve in the jacket cooling water system. During preoperational checks prior to post-maintenance testing, the control power fuses were found to be blown. Since there was no evidence of other failures, it was concluded that the fuses failed due to "fatigue," and the fuses were replaced. DG 31 was subjected to a full functional test and
B-185 returned to service at 2045 h on August 3, 1990.
On August 7, 1990, the same modification was performed on DG 32. During post-maintenance testing, the control power fuses for this DG were also found to be blown.
Again, utility personnel concluded the fuses failed due to "fatigue." The fuses were replaced, and the DG was tested and returned to service at 2100 h on August 7, 1990.
On August 9, 1990, at 0502 h, DGs 31 and 32 were tested while DG 33 was out of service to perform the same modification. At 0515 h, control room annunciator "32 EDG Auto Start Defeated" alarmed. The control power fuses for DG 32 were found to be blown. They were replaced and a work request was initiated to investigate the problem with the DG.
Incoming day shift personnel recognized that a problem existed and ran DG 32 at 07 10 h to reverify operability. Restoration of DG 33 was also begun.
During restoration of DG 33, its control power fuses were also found to be blown. At 1100 h on August 9, 1990, a plant shutdown was begun and hot shutdown was entered at 1540 h.
During investigation of the problem on DG 32, it was determined that the generator field flashing relays were energized, with the control circuit drawing approximately 17.5 A.
Normal shutdown current is approximately 2 A; the fuses are rated at 15 A.
The utility concluded that the field flashing relays remained actuated after initial maintenance and after testing because the jacket water pressure switches, used to initiate field flashing on the DGs, did not reset -
a result of the failure of the jacket water system pressure to substantially decay after the DG was stopped once the new thermostatically-controlled. valves were installed in the DG jacket water systems.
A temporary change was made to the DG functional test (3PT-V16) to verify that the jacket water pressure switches reset at the end of a test. All control fuses were replaced, and all DGs were subjected to a full-function surveillance test before returning to power.
Additional Event-Related Information Indian Point 3 utilizes 3 480-V DGs to provide power in the event that offsite power is unavailable. DG 31 supplies safety-related buses 2A and 3A, DG 32 supplies bus 6A, and DG 33 supplies bus 5A. The safety-related buses can be cross-connected through normally open breakers. In addition to the three normal DGs, a separate DG (provided to satisfy Appendix R requirements), can be manually loaded to provide power to safety-
B-186 related components.
The three Indian Point 3 DGs utilize jacket water pressure to actuate the field flashing relays. The DG control scheme uses jacket water pressure as an indication that the engine is up to speed since the jacket water pump is driven by the DG crankshaft.
ASP Modeling Assumptions and Approach This event has been conservatively modeled under the assumption that all DGs were unavailable from 0502h on August 9, 1990, until hot shutdown was reached at 1540 h (10.6 h). This time period does not include the, time before 0502 h during which DG 33 was out of service (this time is not specified in the LER). During this time, DG 31 and DG 32 may have been capable of starting and supplying power if required. DG 31 successfully operated during testing, and the control power fuses for DG 32 were replaced after they failed at 0515 h. However, the failure mode associated with the event does not appear to be well enough understood to be able to predict which DG would have likely operated on the next demand. A non-recovery likelihood of 0.34 (local recovery at the failed equipment) was assigned to the event.
Analysis Results The conditional probability of core damage associated with the event is 3.5 x 10-6. The dominant sequence associated with the event (highlighted on the following event tree),
involves a postulated loss of offsite power (LOOP) during the period the DGs were assumed unavailable, failure to recover emergency power, a reactor coolant pump seal loss-of-coolant accident (LOCA), and failure to recover AC power prior to core uncovery.
B-187 IAW IPORVI IPORV/
I SA PF O
ILOOPRT/LOOP IEP AW SRV S81 L-1CA HPI HPR I.......................
CHALL RESEAT P)NCA I
I OPEN SEG ENO NO)
STATE OK OK 41 Co 42 CD OK OK 43 CD (1) 44 Co 45 CD OK 46 Co 47 Co 48 COD OK 49 Co so Co OK 51 Co 52 Co 53 Co OK 54 CoD 55 Co 40 ATWS (1)0OK for Clas D Dominant core damage sequence for LER 286/90-005
B-188 CONDITIONAL CORE DAMAGE PROBABILITY CALCULATIONS Event Identifier:
286/90-005 Event
Description:
All diesel generators potentially unavailable Event Date:
08/09/90 Plant:
Indian Point 3 UNAVAILABILITY, DURATION-10.6 NON-RECOVERABLE INITIATING EVE14T PROBABILITIES LOOP 5.6E-05 SEQUENCE CONDITIONAL PROBABILITY SUNS End state/Initiator Probability CD LOOP 3.5E-06 Total 3.5E-06 ATWS LOOP 0.OE+0O Total 0.DE+OD SEQUENCE CONDITIONAL PROBABILITIES (PROBABILITY ORDER)
Sequence End State Prob N Rec**
53 loop -rt/loop EMERG.POWER -afw/emerg.power -porv.or.srv.chall CD 2.3E-06 5.7E-02 seal.loca ep.rec(sl) 54 loop -rt/loop EMERG.POWER -afw/emerg.power -porv.or.srv.chall -
CD 7.9E-O7 5.7E-02 seal.loca ep.rec 55 loop -rt/loop EMERG.PDWER afw/emerg.power CD 3.2E-07 2.DE-02 48 loop -rt/loop EMERG.POWER -afw/emerg.power porv.or.srv.chall -
CD 9.2E-08 5.7E-02 porv.or.srv.reseat/emerg.power seal.loca ep.rec(sl)
- non-recovery credit for edited case SEQUENCE CONDITIONAL PROBABILITIES (SEQUENCE ORDER)
Sequence End State Prob N Rec**
48 loop -rt/loop EMERG.POWER -afw/emerg.power porv.or.arv.chall -
CD 9.2E-08 5.7E-02 porv.or.srv.reseat/emerg.power seal.loca ep.rec(sl) 53 loop -rt/loop EMERG.POWER -afw/emerg.power -porv.or.srv.chall CD 2.3E-06 5.7E-02 seal.loca ep.rec(sl) 54 loop -rt/loop ENERG.POWER -afw/emerg.power -porv.or.srv.chall -
CD 7.9E-07 5.7E-02 seal.loca ep.rec 55 loop -rt/loop EMERG.PONER afw/emerg.power CD 3.2E-07 2.0E-02 non-recovery credit for edited case Note:
For unavailabilities, conditional probability values are differential values which reflect the added risk due to failures associated with an event.
Parenthetical values indicate a reduction in risk compared to a similar period without the existing failures.
Event Identifier: 286/90-005
B-189 SEQUENCE MODEL:
BRANCH MODEL:
PROBABILITY FILE:
c :\\asp\\1989\\pwrbseal.cmp c: \\aap\\1989\\indpoint. all c: \\asp\\1989\\pwrbpsll.pro No Recovery Limit BRANCH FREQUENCIES/PROBABILITIES Branch System Non-Recov Opr Fail trans loop loca rt rt/loop, EMERG. POKER Branch Model:
l.OF.3 Train 1 Cond Prob:
Train 2 Cond Prob:
Train 3 Cond Prob:
afw afw/emerg. power mfw porv.or. arv *chal 1 porv.or. srv. reseat parv.or. srv. reseat/emerg.power seal.loca ep. rec (sl) ep. rec hpi hpi (f/b) hpr/-hpi porv.open 4.6E-04 3.1E-05 2.4E-06 2.8E-04 O.OE+OO 5.4E-04 > 1.OE+OO 5.OE-02 5.7E-02
- 1. 9E-01 3.8E-04 5.OE-02 2.OE-Ol 4.OE-02 2.OE-02 2.OE-02 2.1E-01 6.OE-Ol 5.6E-02 3.OE-04 3.OE-04 1.5E-04 1.OE-02
" Failed
" Failed
" Unavailable l.OE+OO 1.7E-01 4.3E-01 1.2E-01 l.0E+00 B.OE-Ol
> 3.4E-01 2.6E-01 3.4E-01 3.4Z-0l 1.OE+OO 1.1E-02 1.OE+00
- 1. OE+OO 1.OE+OO 1.OE+00
- 1. OE-03
- 4. OE-04
- branch model file
- forced Minarick 08-06-1991 17:32:35 Event Identifier: 286/90-005