ML20135H297
| ML20135H297 | |
| Person / Time | |
|---|---|
| Site: | Oconee  |
| Issue date: | 05/14/2020 |
| From: | Christopher Hunter NRC/RES/DRA/PRB |
| To: | |
| Littlejohn J (301) 415-0428 | |
| References | |
| LER 1991-007-00, LER 1991-009-00 | |
| Download: ML20135H297 (6) | |
Text
B- 157 ACCIDENT SEQUENCE PRECURSOR PROGRAM EVENT ANALYSIS LER No: 287/91-007, 269/91-009 Event
Description:
Reactor trip due to LOFW plus degraded EFW Date of Event: July 3, 1991 Plant: Oconee 3 Summary A loss of condensate flow caused a loss of main feedwater (LOFW) and a reactor. scram.
All three emergency feedwater (EFW) pumps started as required. The EFW flow control valve for one steam generator (SG) did not automatically respond, and manual con'trolI was taken 4 min into the event. Operator errors while restarting the main feedwater (MFW) pumps further degraded the EFW system. Two main steam relief valves, (MS RVs) did not reseat until pressure was reduced to 90% of their actuation setpoints.
The conditional probability of core damage associated with this event is 1.8 x 10-5. The relative significance of the event compared to other postulated events at Oconee 3 is shown below.
LER 287/91-007 1E-8 IE-7 1E-6 IE-SI 1E-4 IE-3 IOF I I. It precursor cutoff _j0 Loop EP Event Description On July 3, 199 1, at 1118 hours0.0129 days <br />0.311 hours <br />0.00185 weeks <br />4.25399e-4 months <br />, while operating at 100% full power, Oconee 3 scrammed as a result of an LOFW. The LOFW was initiated when particles from a degraded seal clogged an instrument air flow path in the master valve controller for the condensate demnineralizer system. This caused five parallel valves to fail closed, blocking all condensate flow. Demineralizer bypass valves did not open to compensate because an operator had failed to return them to automatic control. The loss of condensate flow
B-158 resulted in the trip of condensate booster pumps due to low suction pressure, which then caused a trip of the main feedwater pumps, followed by the reactor scram.
All three EFW pumps started on a low main feedwater pump turbine control oil pressure signal. At 1119 hours0.013 days <br />0.311 hours <br />0.00185 weeks <br />4.257795e-4 months <br />, operators shut down the turbine-driven EFW` pump, after confirming that both motor-driven EFW pumps were operating. As SG level dropped toward the post trip setpoint, it was observed that FDW-3 15, EFW throttle valve to SG A, was not controlling properly in automatic, so manual control was initiated at 1122 hours0.013 days <br />0.312 hours <br />0.00186 weeks <br />4.26921e-4 months <br />. SG level reached a minimum of 21 in. prior to operators taking action to compensate for the failed valve. The valve failed to control in automatic because a normally energized solenoid valve failed to move to its deenergized position. This solenoid valve model had caused earlier problems at Oconee, and a decision was made after this event to replace this and similar valves.
Two MSRVs did not reseat until main steam pressure was reduced to approximately 88%
to 90% of their actuation setpoints, which is slightly lower than desired. Also, the low-flow alarm for cooling water flow to EFW pump B did not clear as expected. An operator was dispatched to check local instrumentation and verified that cooling flow to the pump was acceptable.
After the unit was stabilized at hot shutdown, the operators initiated actions to restart the MFW pumps so that they could be used for SG makeup. This required starting a condensate booster pump in the recirculation mode, which fills the upper storage tank (UST) with water from the hotwell. Water in the UST is then used to makeup to the hotwell as its inventory is used by the MFW pumps. Refilling the UST with water from the hotwell increased its temperature to 170'F. This exceeded a 130'F procedural limit for maximum EFW pump source water temperature. At the time of the event, the operators believed that the 130'F limit only applied while at power, and that a 190OF limit applied while shut down. A subsequent review of the Reactor Trip Recovery Procedure indicated that the 130OF limit also applied for up to 5 h after a trip. With the UST temperature greater than 130'F within the 5-h post-trip period, decay heat removal required two of three EFW pumps instead of one of three.
When the operators added water to the UST from the hotwell, they overfilled the tank, which resulted in water flowing into the normally dry reference leg of the UST level instrumentation and generating a false low-level signal. For -30 min during post-trip recovery, UST level instrumentation indicated that the tank level was less than minimum requirements. During this event the condensate storage tank, which receives overflow from the UST, itself ovefflowed onto the turbine building floor, and operators were able to confirm that the UST was full. The UST serves as the primary source of water for the EFW pumps. If the UST is determined to be unavailable, procedures require the operators to break condenser vacuum and provide EFW from the hotwell, which can*
B- 159 consume substantial personnel resources and time.
Analysis of post-trip data indicated that one of the two EFW pump actuation signals following loss of the MFW pumps, low pump discharge pressure, was not generated during the LOFW. (The EFW pumps actuated on a low MFW pump turbine control oil pressure signal.) Continued operation of the D heater drain pumps maintained MFW pump discharge piping pressure above the low discharge pressure setpoint. This was subsequently determined to be a potential problem on all three Oconee units for all trips in which the heater drain pumps continue to operate.
ASP Modeling Assumptions and Approach The event has been modeled as a potentially recoverable LOFW with one EFW flow control valve unavailable. Because of the high UST temperature, two of three EFW pumps were assumed to be required for success. A revised EFW failure probability given these conditions was calculated as follows:
p(EFW) =[p(MTR PMP 3A) x p(MTR PMP 3B IMTh PMP 3A fails) + p(MTR PMP 3A) x p(TURB PMP) + p(MTR PMP 3B) x p(TURB PMP) +
p(conimon cause)] x p(NON REC) + p(second EFW flow control valve fails) x p(fail to manually control flow from control room) p(EFW) -[0.01 x 0.1 + 0.01 x 0.05 + 0.01 x 0.05 + 0.00028] x 0.26 + 0.1 x 0.04 p(EFW) =4.6 x 10-3 Analysis Results The conditional probability of subsequent core damage estimated for this event is 1.8 x 10-5. The dominant core damage sequence, highlighted on the following event tree, involves a failure to recover from the LOFW, a subsequent failure of EFW, and failure of feed and bleed.
B- 160 PORV/ POWRV/R SEO END TRANS RT AFW MFW SRV ISRV HPI HPR OPORN NO STATE CHAL RESEAT OE OK OK 11 CD 12 CD OK OK OK 13 CD 14 C OK OK 15 CD (1) 16 CD 17 CD is ATWS (1) OK for Class D Dominant core damage sequence for LER 287/91-007
B- 161 CONDITIONAL CORE DAMAGEPROBABILITY CALCULATIONS Event Identifier: 287/91-007 Event
Description:
Reactor trip due to LOFW plus degraded SF91 Event Date: 07/03/91 Plant: Oconee 3 INITIATING EVENT NON-RECOVERABLE INITIATING EVENT PROBABILITIES TRANS 1 .OE+OO SEQUENCE CONDITIONAL PROBABILITY SUMS End State/Initiator Probability CD TEAM S 1.8E-05 Total 1.8BE-OS ATWS TRAMNS 3 .4E-05 Total 3.4E-O5 SEQUENCE CONDITIONAL PROBABILITIES (PROBABILITY ORDER)
Sequence End State P rob N Rec**
17 trans -rt AFM MEW hpi(f/b) CD 1.6SE-OS 2. 9E-01 16 trans -rt AFW MEW -hpi(f/b) hpr/-hpi CD 1 E-OS-0F 3. 4E-01 18 trans rt ATWS 3.4E-05 1.2E-01
- non-recovery credit for edited case SEQUENCE CONDITIONAL PROBABILITIES (SEQUENCE ORDER)
Sequence End State P rob N Rec**
16 trans -rt AFW NEW -hpi (f/b) hpr/-hpi CD 1 .8E-06 3.4E-O1 17 trans -rt AEW MEW hpi(f/b) CD 1 .6E-05 2 .9E-01 18 trans rt ATWS 3 .4E-05 1.2E-01
- non-recovery credit for edited case SEQUENCE MODEL: c:\asp\1989\pwrdseal.cmp, BRANCH MODEL: c:\asp\1989\oconee3.sll PROBAB3ILITY FILE: c:\asp\1989\pwr~bsll.pro No Recovery Limit BRANCH EREOUENCIES/PRONABILITIES Branch System Non-Recov Opt Fail trans 1 .5E-04 1. OE+OO Event Identifier: 287/91-007
B- 162 loop 1. 6E-05 2.4E-01 loca 2.4E~-06 4 .3E-01 rt 2 .8E-04 1.2E-01 rt /loop O.OE+00 1.OE+00 emerg.power 2.9E-03 8.OE-01 AFW 3.8E-04 > 4.6E-03
- 2.6E-01 > 1.OE+00 Branch Model: l.OF.3+ser Train 1 Cond Prob: 2.OE-02 Train 2 Cond Prob: 1. OE-01 Train 3 Cond Prob: 5.OE-02 Serial Component Prob: 2.8 E-04 afw/ernerg.power 5. OE-02 3 .4E-01 MFW 2.OE-01 > l.OE+00 3. 4E-01 Branch Model: l.OF.1 Train 1 Cond Prob: 2.OE-01 > Failed porv.or. srv.chall 8. OE-02 1. OE+00 porv.or. srv.reseat l.OE-02 1.1E-02 porv.or. arv. reseat/ernerg.power 1. 0E-02 1. 0E+00 seal. loca 0 .OE+00 1. OE+00 ep. rec (sl) 0 .OE-400 1. OE+00 ep. rec 4.5E-01 1.OE+00 hpi 3 .OE-04 8 .4E-01 hpi (f/b) 3.OE-04 8 .4E-01 l.OE-02 hpr/-hpi 1.5E-04 1.OE+00 1.OE-03
- branch model file
- forced Minarick 06-08-1992 15:21:25 E~vent Identifier: 287/91-007