ML20135H306
| ML20135H306 | |
| Person / Time | |
|---|---|
| Site: | Pilgrim |
| Issue date: | 05/14/2020 |
| From: | Christopher Hunter NRC/RES/DRA/PRB |
| To: | |
| Littlejohn J (301) 415-0428 | |
| References | |
| LER 1990-013-00 | |
| Download: ML20135H306 (8) | |
Text
B-197 ACCIDENT SEQUENCE PRECURSOR PROGRAM EVENT ANALYSIS LER Number: 293/90-013 Event
Description:
Scram with RCIC failure; feedwater, HPCI, and RHR problems Event Date: September 2, 1990 Plant: Pilgrim Summary Plant operators initiated a scram when failures in the feedwater control system caused a loss of both manual and automatic control of reactor vessel level. The reactor core isolation cooling (RCIC) system was started to provide vessel makeup, but tripped off repeatedly. Vessel level was then controlled by starting and stopping reactor feedpumps.
The difficulties in controlling level resulted in a high-level isolation and scram, forcing use of safety relief valves (SRVs) for pressure control. The high-pressure coolant injection (HPCI) system was used, with some difficulty, for level and pressure control at various times. While attempting to place the "A" residual heat removal (RHR) system train in service, operators had difficulty opening the shutdown cooling suction isolation valve. When the system was aligned for service and started, "A" RHR pump tripped and the system isolated. It was subsequently re-aligned and successfully placed in service.
The conditional core damage probability estimated for this event is 8.4 x 10-5. The relative significance of this event compared to other postulated events at Pilgrim is shown below:
LR 293/90-013 IE-7 IE-6 1E-5 1E4 E-3 IE-2 III- II I Trip.~ 360 h LI6 hE I HPCI +]LO precursor cutoff _.J RCIC ýw +
FHPC Event Description Moisture intrusion into a junction box caused an electrical short and blew a fuse,
B- 198 deenergizing the feedwater lockup solenoids and the control room feedwater lockup indicating lights. This locked the feedwater regulating valve pneumatic controllers, preventing further manual or automatic operation of the feedwater regulating valves.
Since the lockup lights were deenergized, the operators had no direct indication that a lockup had occurred. Air slowly bled from the valve actuators, and they began to drift in the open direction, causing a gradual reactor vessel level increase.
When operators noticed the level increase, they attempted to manually control level but were unsuccessful. By opening the feedpump minimum flow valves, they were able to stem the increase while they attempted a reset of the feedwater regulating valve lockup.
When it became apparent that they could not recover control of the feedwater regulating valves, they ran power back and initiated a scram.
RCIC was started to provide vessel makeup, but tripped on overspeed. It was reset and restarted only to trip again on overspeed two more times. Subsequent investigation revealed that RCIC tripped initially due to a faulty startup procedure. This procedure, adopted after an earlier event in which the RCIC suction piping was inadvertently pressurized to reactor pressure (see LER 293/89-014), was intended to prevent overpressurization of pump suction piping should the discharge check valve not be seated. The procedure had been tested successfully on the plant simulator, but the simulator did not accurately mirror the performance of the plant.
This procedure called for the steam inlet valve to be opened, the pump to be brought up to speed, and the injection (discharge) valve to be opened when pump pressure equalled reactor pressure. The procedure failed to consider, however, that the RCIC flow controller was located downstream of the pump minimum flow valve. Upon system initiation, the flow controller called for full flow but saw none, since the discharge valve was still closed and all flow was diverted through the minimum flow valve.
Accordingly, it continually increased turbine speed to the overspeed trip setpoint, and a trip occurred.
Difficulty was experienced in relatching the overspeed trip mechanism, resulting in the two additional trips. Among the possible causes mentioned were looseness in the trip linkage, vibration, damage to the latching surface, fouling of the latching surface, and vagueness in the reset procedure.
It was observed during a postevent walkdown of the RCIC system that the suction piping pressure indicator was stuck at a full-scale reading of 100 psig. A review of computer traces indicated that, during one unsuccessful start attempt, the injection valve began to open before the turbine tripped. Afterward, the injection check valve failed to reseat, and
B- 199 the entire system was pressurized to reactor pressure until the injection valve was closed.
No resulting damage was noted.
Initially, operators attempted to control vessel level with the startup feedwater regulating valve, but it experienced a control air leak and failed. They then began regulating vessel level by starting and stopping feedwater pumps. This proved successful but could have stressed the feedwater pump motors. The feedpumps at Pilgrim are driven by 5000 hp electric motors. Typical industry practice prohibits more than one restart of a large electric motor in a 1-h period because motor windings may overheat, and insulation damage will result.
At one point, difficulties with level control resulted in a high vessel level, isolation, and scram. With the main steam isolation valves closed, the operators used SRVs for pressure control. Both loops of RHR were in service for suppression pool cooling.
During the event, HPCI was started but tripped for indeterminate reasons. It automatically restarted and operated for about 2 min to provide vessel makeup. It was later restarted, again tripping once, in the full flow test mode for pressure control. It experienced speed and flow oscillations in automatic control but operated correctly when placed in manual control mode.
Approximately 13 h after scram, operators attempted to place "A" RHR loop in shutdown cooling mode but experienced difficulty in opening the inboard shutdown cooling suction isolation valve. "Open" commands to the valve would not seal in, and the valve would open partially and reclose. About 16 h after scram and 3 h after the first attempt to open the valve, it was opened by holding the control switch in the "open" position until the valve fully opened. "A" RHR pump was started but promptly tripped off, and the system isolated. It is believed that the shutdown cooling piping may not have been completely filled and that water hammer effects induced a high suction pressure signal, resulting in isolation of the system. Nineteen hours after the scram (3.5 h after the system isolation), the system was successfully aligned and placed in service.
Additional Event-Related Information Chronology of events:
September 2, 1990 2153 Electrical short deenergizes feedwater regulating valve lockup solenoids.
2155 Operators observe high reactor water level. They attempt to manually
B-200 control level and to perform a feedwater regulating valve lockup reset.
2158 Operators begin cycling reactor feedpumnp minimum flow valves to control vessel level.
2233 Recirculation pumps are run back and reactor is scrammed. "A" RI{R loop is placed in suppression pool cooling.
2257 (approximately) RCIC is started and trips on overspeed. Two more starts are made, also resulting in overspeed trips. Operators also attempt to make up using reactor feedpumps via the startup feedwater regulating valve. This valve also fails.
2317 (approximately) Operators are controlling reactor level by starting and stopping feedpumps. Level increases to high-level isolation setpoint. Main steam isolation valves close and operators use safety/relief valves to control reactor pressure. "B" loop of suppression pool cooling is placed in service.
September 3, 1990 0017 HPCI is started for vessel makeup. It trips on overspeed, resets, and restarts. After about 2 min, it is secured.
0043 HPCI is started in test mode for pressure control. Again, it trips and resets.
Flow oscillations are noted in automatic control, operators place flow controller in manual.
0201 MSIVs are re-opened.
1115 Operators attempt to align "A" RHR system for shutdown cooling. Inboard SDC suction isolation valve will not stroke open when given an "open"~
signal.
1411 Operators open SDC suction valve by holding control switch in "4open"~
position.
1450 "A" RHR pump started. Pump trips and SDC isolation valves close, apparently due to water hammer effects on the high suction pressure switch.
1733 "A" RI{R pump placed in service for shutdown cooling.
B-201 ASP Modeling Assumptions and Approach The event was modeled as a scram with PCS unavailable, RCIC failed (non-recovery 1.0), HPCI degraded (manual control required), and RHR degraded.
Analysis Results The conditional probability of severe core damage for this event is 8.4 x 1i-5. The dominant sequence for the event involves unavailability of the power conversion system, successful short-term core cooling, and failure to remove heat using RHR and suppression pool cooling in the long term. The dominant sequence for this event is highlighted on the following event tree.
Additional information concerning this event is included in LER 293/90-014 and NRC Region I Special Inspection Report 50-293/90-21 dated October 12, 1990.
B-202 ORT *I CA S". I LMS (SW, C~H No STATE AD ao %HRIA~EIERAW IE TR smut k
DON I CcAC)L HPCS
~E E A OK OGREDAMAGE CK 12 CRE DAMAGE OK L ---- 13 COREDAMAGE OK OK 14 COEDMG OK I CODRE DAMAGE IS COREDAMAGE 17 COREDAMAGE IA CORE DAMAGE 19 COREDAMAGE 20 COREDAMAGE CE 21 COREDAMAGE OK OK 23 COREDAMAGE CE 24 COREDAMAGE CE 25 CORE DAMAGE CE 26 COGREDAMAGE L l27 CORE DAMAGE 28 CORE DAMAGE CE 29 COREDAMAGE CE 30 COREDAMAGE L ---- 31 COREDAMAGE 32 COREDAMAGE CE OK 33 COREDAMAGE CE CE 38 CORE DAMAGE CE 35 COREDAMAGE OK 36 COREDAMAGE 37 COREDAMAGE 36 COREDAMAGE 99 ATWS Dominant core damage sequence for LER 293/90-013
B-203 CONDITIONAL CORE DAMAGE PROBABILITY CALCULATIONS Event Identifier: 293/90-013 Event
Description:
Scram with RCIC failure, feedwater, HPCI and RHER problems Event Date: 09/02/90 Plant: Pilgrim 1 INITIATING EVENT NON-RECOVERABLE INITIATING EVENT PROBABILITIES TRANS l.DE+00 SEQUENCE CONDITIONAL PROBABILITY SUMS End State/Initiator Probability CD TRANS 8.4E-05 Total 8.4E-05 ATWS TRANS 3.OE-05 Total 3.OE-05 SEQUENCE CONDITIONAL PROBABILITIES (PROBABILITY ORDER)
Sequence End State P rob N Rec**
11 trans -rx.shutdown PCS/TRANS srv.chall/trans.-scram -srv.close CD 7 .lE-DS 3.6E-02
-FW/PCS.TRANS RHR(SDC) rhr(spcool) /rhr(sdc) 12 trans -rx.shutdown PCS/TRANS srv.chall/trans.-scram -srv.close CD 9.3E-06 4.7 E-03 FW/PCS.TRANS -NPCI RHR4SDC) rhr(spcool) /rhr(sdc) 99 trans rx.shutdown ATWS 3.DE-D5 1.DE+00
- non-recovery credit for edited case SEQUENCE CONDITIONAL PROBABILITIES (SEQUENCE ORDER)
Sequence End State P rob N Rec**
11 trans -rx.shutdown PCS/TRANS srv.chall/trans.-scram -srv.close CD 7.1E-05 3.6GE-02
-FW/PCS.TRANS RHR(SDC) rhr (spcool) /rhr (sdc) 12 trans -rx.shutdown PCS/TRANS srv.chall/trans.-scram -srv.close CD 9. 3E-06 4.7 E-03 FW/PCS.TRANS -NPCI RHR(SDC) rhr(spcool) /rhr(sdc) 99 trans rx.shutdown ATWS 3.OE-05 1.DE+00
- - non-recovery credit for edited case SEQUENCE MODEL: c: \asp\1989\bwrcseal .cmp BRANCH MODEL: c:\asp\1989\pilgrim.sll PROBABILITY FILE: c:\asp\19B9\bwr-csll.pro No Recovery Limit BRANCN FREQUENCIES/PROBABILITIES Event Identifier: 293/90-013
B-204 Branch System Mon-Recov Opr Fail trans 5.5E-04 1.02+00 loop 2.02-05 4.3E-01 loca 3.3E-06 5.02-01 rx .shutdown 3.02-05 1.02+00 rx. shutdown/ep 3.5E-04 1.02+00 PC S/TRANS 1.7E-01 > 1.02+00 1.02+00 Branch Model: 1.OF.l Train 1 Cond Prob: 1.7E-01 > Unavailable srv.chall/trans .-scram 1 .02+00 1.02+00 srv.chall/loop.-scram 1.02+00 1.02+00 srv. close 1.3E-02 1.02+00 emerg.power 2.9E-03 6.02-01 ep. rec 2.6E-01 1.02+00 FW/PCS .TRANS 2.9E-01 > 1.02+00
- 3.42-01 > 1.2E-01 Branch Model: 1.OF.1 Train 1 Cond Prob: 2.9E-01 fw/pcs .loca 4.02-02 3.42-01 HPCI 2.9E-02 > 1.02+00
- 7.02-01 > 4.02-02 Branch Model: 1.OF.1 Train 1 Cond Prob: 2.9E-02 > Unavailable RCIC 6.02-02 > l.OE+00 7.02-01 > 1.02+00 Branch Model: 1.OF.1 Train 1 Cond Prob: 6.02-02 > Failed crd 1.02-02 1.02+00 1.02-02 srv.ads 3.7E-03 7.1E-01 1.02-02 lpcs 3.02-03 3.4E-01 lpci (rhr) /lpcs 1.02-03 7.1E-01 RHR(SOC) 2.1E-02 > 1.02+00
- 3.42-01 > 1.2E-01 1.02-03 Branch Modal: 1.0F.2+ser+opr Train 1 Cond Prob: 3.OE-03 Train 2 Cond Prob: 3.02-01 Serial Component Prob: 2.02-02 rhr(sdc) /-lpci 2.02-02 3.4E-01 1.02-03 rhr (sdc) /lpci 1.02+00 1.02+00 1.02-03 rhr(spcool) /rhr(sdc) 2.02-03 3.4E-01 rhr(spcool) /-lpci.rhrcsdc) 2.02-03 3.4E-01 rhr(spcool) /lpci.rhr(sdc) 9.3E-02 1.02+00 rhrsw 2.0B-02 3.42-01 2.OE-03
- branch model file
- forced Minarick 08-06-1991 17:31:50 Event Identifier: 293/90-013