ML20140A222
| ML20140A222 | |
| Person / Time | |
|---|---|
| Site: | Waterford  |
| Issue date: | 05/19/2020 |
| From: | NRC/RES/DRA/PRB |
| To: | |
| Littlejohn J (301) 415-0428 | |
| References | |
| LER 382-1995-002 | |
| Download: ML20140A222 (21) | |
Text
Annendix B LER LER No.
No. 382/95-002 382/95-002 Annendix B IB.9 LER No. 382/95-002 Event
Description:
Reactor trip, breaker failure and fire, degraded offsite power, and degraded shutdown cooling Date of Event: June 10, 1995 Plant: Waterford 3 1B.9.1 Event Summary A switchyard lightning arrestor failure caused a trip from 100% power at Waterford 3. Delayed opening of the 4.1 6-ky unit auxiliary transformer (UAT) feeder breaker paralleled the grid with the main generator which was speeding up. The resulting out-of-phase condition caused an overvoltage and fault-level currents that started a fire that damaged cables and switchgear for nonvital Train A. Power was initially lost to Train A safety loads, but was recovered when emergency diesel generator (EDG) A started and loaded. Condenser vacuum was subsequently lost as a result of loss of power to balance of plant Train A equipment and the unexpected bypass of circulating water flow around the condenser. Plant cooldown was delayed when low hydraulic fluid levels prevented proper operation of shutdown cooling (SDC) system isolation valves. The conditional core damage probability (CCDP) estimated for this combined event is 9.1 x 10O. The increase in CCDP over a one-year period because of the unavailability of the SDC isolation valves is 1.7 x 105 The CCDP for the actual transient is 2.5 x 10-5 B1.9.2 Event Description Waterford 3 was operating at 100% power on June 10, 1995. At 0858, a lightning arrestor failed at the Waterford Substation. The resulting grid disturbance caused the sudden pressure relay on Main Transformer A to actuate the main generator lockout relays. This actuation resulted in the trip of the main generator output breaker and exciter field breaker initiation of a fast dead bus transfer, and trip of the main turbine.
The B 6.9-ky and 4.16-kV buses successfully transferred to Startup Transformer (SUT) B. However, during the transfer of 4. 16-kV bus A2 to SUT A, the A2 SUT feeder breaker closed before the A2 UAT breaker opened. The UAT and SUT breakers tripped and power was lost to bus A2.
The reactor tripped on low Departure from Nucleate Boiling Ratio (DNBR) signals, caused by low reactor coolant pump speed. Bus AlI (6.9-ky) deenergized, which tripped two reactor coolant pumps, circulating water pumps, condensate pumps, and condenser air evacuation pumps. Main feedwater (MFW) pump A also tripped, apparently from loss of power to the pump speed pickups.
Vital 4.1 6-ky bus A3 deenergized when power was lost to bus A2. EDG A started and reenergized the required safety-related loads via the load sequencer. Emergency feedwater (EFW) actuated, and within 13 mini both MFW isolation valves had been closed as a result of high steam generator (SG) level.
B.9-1 NUREG/CR-4674, Vol. 23
LER No. 382/95-002 Appendix B Approximately 1 min after the trip, all turbine generator building (TGB) switchgear room fire alarm annunciators actuated. The TGB operator reported heavy smoke coming from the switchgear room 7 mmn later. Two auxiliary operators were directed to set up blowers to help dissipate the smoke, don protective clothing, and enter the switcbgear room to investigate the cause of the smoke.
At 0935 (+37 min), the TGB auxiliary operator reported a fire in the 2A switchgear and in the cables above the switchgear. The fire was caused by the delayed opening of the A2 UAT breaker, which resulted in a voltage across the breaker during opening beyond the breaker's design and a subsequent high-energy fault.
The breaker failed internally and caused the fire (the breaker failure and fire are described in more detail in Additional Event-Related Information).
Upon notification of an actual fire in the switchgear room, the shift supervisor sounded the plant fire alarm (post-event review indicated that the fire alarm should have been sounded when smoke was first detected),
dispatched the fire brigade, and directed the motor-operated disconnect for SUT A to be opened to ensure electrical isolation of the A2 bus. The control room supervisor left the control room to serve as fire brigade leader.
The fire brigade attempted to extinguish the fire using halon, carbon dioxide and dry-chemical fire extingu~ishers. When the fire brigade leader arrived'at the fire scene, he immediately notified the control room to request offsite fire department assistance. The Hahnville Fire Department was contacted at 0941 (+43 min) via 911 for support.
The Hahnville Fire Department arrived on-site 17 min later and recommended that water be used to extinguish the fire. Carbon dioxide and dry chemical extinguishers were being unsuccessfully used by the fire brigade to fight the fire (although experience gained from the 1976 Browns Ferry fire and other fires indicated that the use of water was necessary on large cable fires). The use of water was delayed for an additional 20 mini. (Ref. 2 noted that interviews conducted with plant operators after the event indicated a general reluctance on the part of the operators to apply water to an electrical fire, based on previous training that had emphasized the use of water was a last resort on electrical fires.) The fire was extinguished within 4 min, once water was used.
At 1112 (+2.2 h), condenser vacuum was broken after it had fallen to 0.68 MPa (20 in. Hg). A condenser low vacuum alarm had actuated at 0940 hours0.0109 days <br />0.261 hours <br />0.00155 weeks <br />3.5767e-4 months <br />, shortly after the fire was reported. The loss of vacuum was initially attributed to the unavailability of the two circulating water and condenser air evacuation pumps, resulting from the deenergization of bus AlI at the beginning of the -event, combined with several steamn loads that were still discharging to the condenser, and the operators made a decision not to divert resources from fighting the fire to attempt to recover condenser vacuum. In actuality, when the two circulating water pumps deenergized at 0858 hours0.00993 days <br />0.238 hours <br />0.00142 weeks <br />3.26469e-4 months <br />, their associated motor-operated discharge valves also deenergized and remained open, resulting in a bypass of circulating water flow.
At 1147 (+2.8 h), the main steamn isolation valves were closed and the atmospheric dump valves used for decay heat removal. At 2348 (14.8 h after the event began), EFW was secured, and Condensate Pump B (the operable condensate pump) was used to supply water to Steam Generator B.
B.9-2 NLIREG/CR-4674, Vol.
NUREG/CR-4674, Vol. 23 23 B.9-2
Annendix B Airnendix B LER No.
LER No. 382/95-002 382/95-002 Bly 1257 on June 11, 1996, the plant had been cooled down and depressurized to shutdown cooling entry conditions. At 1311, shutdown cooling suction header isolation valve SI-405B was commnanded open while placing the shutdown cooling system in service. This valve closed after only partially opening and was declared inoperable. The equivalent valve in Train A, SI-405A was then opened. Several hours later, this valve's hydraulic pump was observed to be continually running instead of cycling as designed. Valve SI-405A was also closed and declared inoperable.
A containment entry was made to inspect the two valves, and low hydraulic fluid levels were found in both valve actuator reservoirs. Approximately 3,280 cm' (200 in.?) of hydraulic fluid were added to the reservoir for SI-405B, and the valve operated satisfactorily. Shutdown cooling loop B was placed in service between 1800 and 2400 on June 12, 1996.
When valve SI-405A was tested after fluid had been added to its reservoir, the valve opened slowly.
Additional troubleshooting indicated that the valve's hydraulic pump had been damaged by the continuous operation caused by the low hydraulic fluid level. The pump was replaced and the valve was returned to service shortly after midnight on June 13, 1995. Cooldown to Mode 5 began, with Train A components still powered by EDG A.
18.9.3 Additional Event-Related Information The Waterford 3 fast dead bus transfer scheme consists of automatic or manual transfer of in-house loads from the UATs to the SUTs. During a fast dead bus transfer, the UAT feeder breakers to the AlI and B1 6.9-ky and the A2 and B2 4.16-ky buses are designed to open in five cycles, and the SUT feeder breakers are designed to close in seven cycles, resulting in a two-cycle nominal deadband on the respective buses.
This scheme is a "simultaneous" (simultaneous trip and close signals with no interlock) bus transfer scheme (zero to two-cycle deadband) instead of the "sequential" (the tripping breaker interlocked with the closing breaker) bus transfer (greater than six-cycle deadband) comnmonly used in the United States. The simultaneous bus transfer scheme is used in all Swedish nuclear power plants. To prevent exceeding the fault duty of associated equipment and buses when two sources are in parallel, the Swedish design includes an interlock that limits the time period during which both breakers are permitted to remain closed to less than 0.1 s. The Waterford 3 design does not include the interlock, and both breakers appeared to have remained closed for about 0.3 s during the event.
During the time that the two breakers were simultaneously closed, the A2 bus connected SUT A to the main generator, which then provided power to the grid via the UAT and bus A2. During this time the main generator was rotating faster than the system frequency due to the load rejection. When the UAT breaker opened, the main generator was approaching 180 degrees out of phase with the system (-8 kV across the breaker). The interrupted current was -28,800 A. This overvoltage due to the out-of-phase condition and the overcurrent resulted in an internal breaker failure and the creation of ionizing gases, which caused the fire in the A2 switchgear. A preliminary investigation indicated that the most probable cause for the slow opening time of the UAT breaker was restricted movement of the trip latch roller bearing.
NUREGICR-4674, Vol. 23 B.9-3 NLTREG/CR-4674, Vol. 23
LER No. 382/95-002 Awendix B The amount of damage to the breaker and surrounding equipment indicates that (1) the fault current through the breaker was extremely high and (2) significant arcing occurred for some period of time. The arc chutes and main contacts on all phases were destroyed, and the contact structures, breaker frame, and cubicle were also significantly damaged. The main bus and bus enclosure also appeared to have experienced severe arcing damage.
The fire that resulted from the breaker failure damaged the bus and surrounding cables and components. Two cubicles (the failed breaker was an end cubicle) were heavily damaged, and approximately 3 m (10 ft) of the cable bus duct was destroyed. Cables in approximately 1.5-m-diam (5-ft) column above the breaker had visible fire damage over their entire 3-rn (10-ft) vertical run. At the top of the vertical run, the cables were routed through a horizontal cable tray. Approximately 2.4 mn (8 ft) of cable in the horizontal tray had visible fire damage. General smoke and slight heat damage to the exterior of the remaining cubicles in the A2 bus occurred. In addition, damage included external heat to the jackets of four of the 15 feeder cables from the SUT to the A2 bus, and bum marks on the conduit of the cables that supply 6.9-ky power to the reactor coolant pump IA and 2A motors.
The TGB switchgear room contains both the A and B trains of nonvital switchgear. The ceiling of the room is approximately 7.6 m (25 ft) above the floor; the tops of the switchgear cubicles are approximately 2.1 m (7 ft) high. A 3-rn-high (10-ft) concrete block radiant heat shield, located 1.8 m (6 ft) from the front of each set of cubicles, separates the two trains. The fire did not affect the Train B switchgear or cables.
The TGB switchgear room had an ionization-type fire detection system, with detectors mounted on the ceiling, but no fire suppression system. The fire detection computer recorded the first fire alarm 55 s after the reactor trip. Within 7 s, all 36 fire detectors in the room had alarmed. Twenty-six mini after the trip, the first detector went into "device communication error;" it apparently failed at that time and melted. By 0942
(+44 min), all detectors in the room had apparently failed.
Subsequent to the fire, the licensee found tape over the fire alarm annunciator buzzer located on the fire detection computer in the control room. Because of the tape, the alarm volume was low and nonintrusive.
Due to the alarm panel's placement in the control room, alarm lights were also not readily visible. These factors, combined with the fact that the fire was not declared until after the auxiliary operators entered the switcbgear room and observed it (36 min after the fire alarm annunciators actuated), contributed to the delay in responding to the fire.
Unlike many PWRs, the Waterford primary pressure relief system includes only code safety valves; no power-operated relief valves (PORVs) are incorporated in the design. The lack of PORVs prevents the use of feed-and-bleed for core cooling in the event both main and emergency feedwater systems are unavailable.
If both of these systems were to fail at Waterford, safety-related, secondary-side atmospheric dump valves could be used to depressurize the steam generators to below the shutoff head of the condensate pumps. These pumps could then be used for decay heat removal.
B.9-4 NUREG/CR-4674, Vol.
NUREG/CR-4674, Vol. 23 23 B.9-4
Annendix B LER No. 382/95-002 B1.9.4 Modeling Assumptions The event was modeled both as (1) a reactor trip, loss of main feedwater (caused by the loss of condenser vacuum 2.2 h after the trip), loss of offsite power to Train A safety-related components, and unavailability of SDC isolation valves SI-405A and SI-405B during the cooldown (initiating event assessment) and (2) a long-term unavailability of the SDC isolation valves (condition assessment).
Reactor trip, loss of feedwater, and unavailable SDC isolation valves (initiating event assessment)
The ASP model for Waterford 3 was revised to address the potential failure of the main feedwater isolation valves (MFIVs) to open. These valves were closed because of high SG levels shortly into the event. Failure of these valves to open would prevent use of the auxiliary feedwater (AEW) system and the condensate system for SQ makeup. Short-term ex-control room recovery of EFW (beyond the use of the AEW pumnp),
high-pressure injection (HPI), and the condensate system, had these systems failed, was not considered feasible because significant crew resources were being used to fight the fire.
Redundant shutdown cooling isolation valves SI-405A and SI-405B were both assumed to have failed. This assumption may be conservative for SI-405A because it initially operated. However, the licensee determined that the valve's hydraulic motor was sufficiently damaged to require replacement before the plant cooldown continued.
The ASP models for a transient do not currently address the potential unavailability of offsite power to an individual train, as was observed in this event. During the event, power to safety-related Train A loads was provided by EDG A. The potential failure of the EDG to power Train A was modeled by adding a basic event to the model, EPS-DGN-FC-3AFR, to represent the potential failure of the EDG to start and run following the breaker failure.
The mission time for the initiating event assessment was assumed to be the time from the reactor trip until shutdown cooling was established, -60 h. EDG A continued to supply Train A loads beyond this time.
However, the added risk is considered to be small compared with the risk before shutdown cooling was established. [The Accident Sequence Precursor (ASP) Program addresses shutdown-related events that are considered unusual and'significant. Events such as this one, where one train is powered from its EDG, are not typically selected for analysis.]
The following changes were made to basic events to reflect conditions observed during the event:
Basic event Revised p2robability Description (reason for change)
AFW-TRAIN-FC-ALL 9.8 x 10-3 Nonsafety AEW system fails to provide flow to SGs (revised to reflect extended mission time)
COND-PFS-FC-SYS 7.8 x 10-3 Secondary heat removal using condensate system fails (revised to reflect extended mission time and low probability of initial condensate system failure)
B.9-5 NUREG/CR-4674, Vol. 23
LER No. 382/95-002 Appendix Appendix B B
LER No. 382/95-002 Basic event Revised probability Description (reason for change)
EFW-MDP-FC-A, B 5.0 x 10'~ EFW motor-driven pump train failures (revised to reflect extended mission time)
EFW-PMP-CF-ALL 2.0 x 10'n Common cause failure of EFW pumps (revised to reflect extended mission time)
EFW-TDP-*FC-TDP 4.1 x 10.2 EFW turbine-driven pump train failures (revised to reflect extended mission time)
EFW-XHE-NOREC TRUE Ex-control room resources required for recovery utilized to fight fire EPS-DGN-FC-3AFR 1.4 x 10-' EDG A fails to start and run (revised to reflect extended mission time)
HPI-XHE-NOREC TRUE Ex-control room resources required for recovery utilized to fight fire MFW-SYS-TRIP TRUE MFW system trips (MFW unavailable because of loss of condenser vacuum)
MFW-VLV-CF-MFIV 2.6 x 10'~ Common-cause failure of the MEW isolation valves to open (basic event added to model because these valves affect both the AEW and the condensate systems)
MFW-XHE-NOREC TRUE Operator fails to recover MFW (MFW not recoverable because of loss of vacuum)
RHR-MOV-CF-SUCT TRUE Common-cause failure of residual heat removal (R.HR) suction valves (set to TRUE to reflect the failure of SI-405A and SI-405B)
The mission time for the HPI pumps was not revised to reflect the 60-h mission time. If a transient-induced loss-of-coolant accident (LOCA) had occurred, the modeled plant response would have been accomplished in less than 24 h. With the SDC isolation valves unavailable following a transient-induced (small-break)
LOCA, the operators would have transferred to high-pressure recirculation (HPR) once the refuelingý water storage pool was depleted. This transfer would have occurred -6 h following the LOCA.
The licensee addressed this specific switchgear room fire in the Waterford Individual Plant Examination for External Events (IPEEE) (Ref. 3). In that document the licensee concluded that the fire-while extensive and not suppressed until the cables from the UAT to the switchgear were fully involved-did not cause significant damage outside the plume/ceiling jet. Fire modeling also confirmed that a large TGB switehgear fire would not generate a hot gas layer that could fail cables outside the plume. Because of this, the IPEEE assumed that TGB switchgear fires would only cause damage to one train of offsite power. This assumption was used in NUREG/CR-4674, Vol. 23 B.9-6
ADDendix B LER No. 382/95-002 this analysis as well. A sensitivity analysis, described in the Analysis Results, addresses the potential impact if the fire, or common cause breaker problems, had also resulted in a nonrecoverable loss of offsite power to Train B.
Long-term unavailability of the SDC isolation valves (condition assessment)
The SDC isolation valves were assumed to have been unavailable since the last refueling outage, in the spring of 1994. The longest time period used to assess a condition (unavailability) in the ASP Program is one year, during which the plant is typically assumed to have been at power 70% of the time. In this event, however, Waterford was at power for the full 1I-year period, resulting in an unavailability of 8,760 hours0.0088 days <br />0.211 hours <br />0.00126 weeks <br />2.8918e-4 months <br />. (Because a duration of 8,760 hours0.0088 days <br />0.211 hours <br />0.00126 weeks <br />2.8918e-4 months <br /> is longer than that used in the analysis of a typical long-term condition, the analysis results cannot be directly compared with those of other long-term condition assessments.) This assumption presumes that the loss of hydraulic fluid from the valve actuators occurs during valve operation (not when the valves are inoperative) and that the fluid level during the previous use of the valves was barely acceptable.
If the hydraulic fluid was lost when the valves were in standby, then the analysis duration is overestimated (the valves would then become unavailable at one-half of the duration since last use; this would result in a 50% reduction in the increase in core damage probability caused by the failed valves).
Consistent with the previous assessment, shutdown cooling isolation valves SI-405A and SI-405B were both assumed to be failed. This assumption was reflected by setting basic event RHR-MOV-CF-SUCT to TRUE.
Plant response to all initiators addressed in the ASP model was considered impacted by the unavailability of the SDC isolation valves.
B.9.5 Analysis Results The CCDP estimated for trip, fire and resulting loss-of-offsite power to Train A, loss of feedwater, and unavailability of the SDC isolation valves is 2.5 x 10'. The dominant sequence, highligh~ted on the event tree in Fig. B.9. 1 (transient sequence 19), contributes about 83% to the conditional probability estimate for the initiating event and involves
- the successful reactor trip,
- failure of EFW (including the AEW pump) to provide secondary-side cooling,
- MFW unavailability, and
- failure of the condensate system as an alternate source of cooling water.
The dominant cut sets involve failure to provide an alternate source of water to the EFW pumps following depletion of the condensate storage pool within the 60-h mission time and failure of the condensate system to provide flow to the steam generators (failure to initiate and equipment failure both contribute).
Table B. 9.1 provides the definitions and probabilities for selected basic events for the initiating event assessment. The conditional probabilities associated with the highest probability sequences are shown in Table B.9.2, while Table B.9.3 lists the sequence logic associated with the sequences listed in Table B.9.2.
Table B.9.4 describes the system names associated with the dominant sequences. The minimal cut sets associated with each sequence are shown in Table B.9.5.
B.9-7 NUREG/CR-4674, Vol. 23
LE o. 382/95-002 Annendix B ADDendix B LER No. 382/95-002 The calculation for the reactor trip and fire is sensitive to the assumption that the fire or potential common cause breaker failures would not affect the availability of offsite power to Train B. If the fire could have affected Train B, or if slow breaker opening also resulted in the loss of Train B switchgear (which is believed to be unlikely), then the event could have been more significant. For example, an assumption of a 0.03 probability of nonrecoverable loss of offsite power to Train B (similar to Train A) results in an estimated CCDP of 1.4 x 10' (such an event would be considered important from an ASP standpoint).
The unavailable SDC isolation valves (the condition assessment) result in an overall increase in core damage probability for the assumed 1-year period of 1.7 x 1'over the nominal core damage probability (CDP) estimated for the same period of 8.8 x 10'. This is the sum of the changes to the sequence probabilities (importance) shown in Table B.9.7, which are calculated by subtracting the total CDP sequence value from the total CCDP sequence value for each sequence. The dominant core damage sequence involves
" a small-break LOCA initiating event,
" successful EFW and HPI operation,
" successful depressurization,
" failure of high-pressure recirculation.
For most ASP analyses of conditions (equipment failures over a period of time during which postulated initiating events could have occurred), sequences and cut sets associated with the observed failures dominate the CCDP (the probability of core damage over the unavailability period, given the observed failures). The increase in the CDP because of the failures is essentially the same as the CCDP, and the CCDP can be considered a reasonable measure of the significance of the observed failures.
For this event, however, sequences unrelated to the SDC isolation valves dominate the CCDP estimate. The increase in CDP given the failed SDC isolation valves, 1.7 x 10' is, therefore, a better measure of the significance of the SDC valve problems.
Definitions and probabilities for selected basic events for the condition assessment are shown in Table B.9.6.
The conditional probabilities associated with the highest probability sequences are shown in Table B.9.7.
Table B.9.8 lists the sequence logic associated with the sequences listed in Table B.9.7. Table B.9.9 describes the system names associated with the dominant sequences. Cut sets associated with each sequence are shown in Table B.9. 10.
B.9.6 References
- 1. LER 382/95-002, Rev. 0, "Reactor Trip and Non-Safety Related Switchgear Fire," July 7, 1995.
- 2. NRC Augmented Inspection Team Report 50-382/95-15, July 5, 1995
- 3. Waterford 3 IndividualPlant Examinationfor External Events, July 1995.
B.9-8 NUREG/CR-4674, Vol. Vol. 23 23 B.9-8
Appendix B Appenix No.
BLER382/95-002
~0
- Nl t vt w 0 P. 0 a 0 - vl v :z v !;: v ý R Cl C4 LL LL
'Ii I" -D U III Ii' (0
i~I zuJ
'it
'it Ii~
Fig. B.9. 1. Dominant core damnage sequences for LER No. 382/95-002.
B.9-9 NUREG/CR-4674, Vol. 23
LER No. 382/95-002 Aonendix B Table B.9.1. Definitions and Probabilities for Selected Basic Events for the Initiating Event Assessment for LER 382/95-002 Modified Event Base Current for this name Description probability probability Type event IE-LOOP Loss-of-Offsite Power Initiating 8.6E-006 O.OE+O00 IGNORE No Event IE-SGTR Steam Generator Tube Rupture 1.6E3-006 O.OE+000 IGNORE No Initiating Event ______
IE-SLOCA Small LOCA Initiating Event 1.OE1-006 O.OE+OOO IGNORE No IE-TRANS Transient Initiating Event 6.8E-004 LOE+000 Yes AFW-TRAIN-FC-ALL AFW Pump Train Fails to 8.7E-003 9.8E-003 Yes Provide Flow COND-PFS-FC-SYS Secondary Heat Removal Using 1.5E-002 7.8E-003 Yes Condensate System Fails COND-XH-E-XM Operator Fails to Initiate 1 OE-002 1 OE-002 No Secondary Cooling EFW-MDP-FC-A EFW Motor-Driven Pump A 3.9E-003 3.9E-003 No Failures EFW-MDP-FC-B EFW Motor-Driven Pump B 3.9E-003 5.OE-003 Yes Failures EFW-PM[P-CF-ALL Common-Cause Failure of EFW 1.4E-004 1A.E-004 No Pumps____ __
EFW-TDP-FC-TDP EFW Turbine-Driven Pump 3.6E-002 4.OE-002 Yes Train Failures EFW-XHE-NOREC Operator Fails to Recover EFW 2.6E-001 1.011+000 TRUE Yes System________
EFW-XH-E-XA-CCW Operator Fails to Initiate 1 OE-003 1.0 E-003 No Backup Water Source EPS-DGN-FC-3AFR EDG 3A Fails to Start and Run 0.0E4000 1.4E-O01 NEW Yes HPI-HDV-OC-SUCB Refueling Water Storage Pool 1. E-004 1.4E-004 No (RWSP) Suction Train B Failures HPI-MDP-CF-,OLL Common-Cause Failure of HPI 1 OE-004 1 OE-004 No IMotor-Driven Pumps I______ I_______ I___I_
Vol. 23 B.9-lO NUREG/CR-4674, Vol.
NLTREG/CR-4674, 23 B.9-10
Annendix B LER No. 382/95-002 Table B.9.1. Definitions and Probabilities for Selected Basic Events for the Initiating Event Assessment for LER 382/95-002 Modified Event Base Current for this name Description probability probability Type event HPI-MDP-FC-B HPI Motor-Driven Pump B 3.9E-003 3.9E-003 No Train Failures HPI-MO V-CF-ALL Common-Cause Failure of 5.5E-005 5.5 E-005 No Injection Motor-Operated Valves HPI-XHE-NOREC Operator Fails to Recover the 8.4E-OO1 1.OE-I-OO TRUE Yes HP! System __________
MFW-SYS-TRJP MEW System Trips 2.9E-001 1.OE+OOO TRUE Yes MFW-VLV-CF-MFIV Common-Cause Failure of O.OE+OOO 2.6E-004 NEW Yes MFIVs to Open___ ___ ___
MFW-XHE-NOREC Operator Fails to Recover MEW 3.4E-OO1 1.OE+OOO TRUE Yes PCS-VCF-HW Turbine Bypass Valves / LOE-003 1 OE-003 No Condensate / Circulation Failures PCS-XI-E-XM-CDOWN Operator Fails to Initiate 1 OE-003 1 OE-003 No Cooldown PPR-SRV-CO-TRAN Safety Relief Valves (SRVs) 2.OE-002 2.OE-002 No
____________________Open During Transient PPR-SRV-00-1 SRV I Fails to Reseat 1.6E-002 1.6E-002 No PPR-SRV-00-2 SRV 2 Fails to Reseat 1.6E-002 1.6E-002 No RHR-MOV-CF-SUCT Common-Cause Failure of RHR 1.2E-003 1 OE+OOO TRUE Yes Suction ValvesIIIII NUIREGICR-4674, Vol.23 B.9-11 B.9-1 I NUREG/CR-4674, Vol. 23
Anoendix Anni B LER No. 382/95-002 Table B.9.2. Sequence Conditional Probabilities for' the Initiating Event Assessment for LER 382/95-002 Conditional core Event tree damage Percent name Sequence name probability contribution (CCDP) ___ __
TRANS 19 2.OE-005 82.9 TRANS 18 2.2E-006 9.1 TRANS .24 6.6E-007 '2.6 TRANS 08 4.7E-007 19 4 4 Total (all sequences) 2.5E-005 Table B.9.3. Sequence Logic for Dominant Sequences for the Initiating Event Assessment for LER 382/95-002 Event tree name Sequence name Logic TRANS 19 /RT, EFW, MFW, /SRV-RES, COND TRANS 18 IRT, EFW, MFW, /SRV-RES,
__________/COND, COOLDOWN TRANS 24 /RT, EFW, MFW, SRV-RES, /HPI, COND TRANS 08 IRT, IEFW, SRV, SRV-RES, HPI Vol. 2323 B.9-12 NUREG/CR-4674, Vol. B.9-12
Appendix B Appenix No.
BLER382195-002 Table B.9.4. System Names for the Initiating Event Assessment for LER 382/95-002 System name Logic COND Secondary Heat Removal Using Condensate System Fails COOLDOWN RCS Cooldown to R1HR Pressure Using Turbine-
______________Bypass Valves, etc.
EFW No or Insufficient EFW Flow HPI No or Insufficient HPI System Flow MFW Failure of the Main Feedwater System RT Reactor Fails to Trip During Transient SRV SRVs Open During Transient SRV-RES SRVs Fail to Reseat B.9-13 B.9-13NUREGICR-4674, Vol. 23
A -,1.- 12 LER No. 382/95-002 Table B.9.5. Conditional Cut Sets for Higher Probability Sequences for the Initiating Event Assessment for LER 382/95-002 Cut set Percent Conditional number contribution probabilitys Cut setSb TRANS Sequence 19 2.OE-005 ....
1~~~~... 4.. EF -X E- A-CW M W-XI-I-NO....C.......X
-T IP .........
FWSY .........
2 37.6 7.8E-006 EF'W-XHiE-XA-CCW, EFW-XHE-NOREC, MFW-SYS-TRIP,
_________MFW-XHiE-NOREC, COND-PFSE-FCSY 3 376. 7.8E-006 EFW-PMP-X-CF-A , EFW-XHE-NOREC, MFW-SYS-TRIP, MFW-XHiE-NOREC, COND-XJS-E-XMS 3 5.3 1IAE-006 EPW-PMP-CF-ALL, EPW-XHiE-NOREC, MFW-SYS-TRIP,
_________MFW-XHiE-NOREC, COND-PFS-FC-SYS 51.2 2.6E-007 EFW-XHiE-XA-CCW, EFW-XHE-NOREC, MFW-SYS-TRIP,
___________MFW-XH-E-NOREC, MFW-VLV-CF-MFIV TRANS Sequence 18 2.213-006 .............
1 43.6 1.OE-006 EFW-XH-E-XA-CCW, EFW-XHE-NOREC, MFW-SYS-TRIP,
_________MFW-Xai-E-NOREC, PCS-XHE-XM-CDOWN 2 43.6 1.OE-006 EFW-XHiE-XA-CCW, EF'W-XHiE-NOREC, MFW-SYS-TRIP,
__________MFW-XH-E-NOPEC, PCS-VCF-HW 3 6.1 1.E-007 EFW-PMP-CF-ALL, EFW-XHE-NOREC, MFW-SYS-TRIP.
__________MFW-XHiE-NOREC, PCS-XHE-XM-CDOWN 4 6.1 1A.E-007 EFW-PMP..CF-ALL, EFW-XHE-NOREC, MFW-SYS-TRIP, TRANS Sequence 24 6.6E-007 1 24.1 1.6E-007 EFW-XH-E-XA-CCW, EFW-XE-NOREC, MFW-SYS-TRIP, 2 24.1 1.6E-007 EFW-XI-E-XA-CCW, EFW-XH-E-NOREC, MFW-SYS-TRIP,
__________MFW-XJ-iE-NOREC, PPR-SRV-OO-2, COND-XHE-XM 3 18.8 1.2E-007 EFW-XI-iE-XA-CCW, EFW-XHiE-NOREC, MFW-SYS-TRIP, MPW-XGi-E-NQREC, PPR-SRV-OO-I, COND-PFS-FC-SYS 4 18.8 1.2E-007 EFW-XI-E-XA-CCW, EFW-XHE-NOREC, MFW-SYS-TRIP,
___________ _________MF'W-XHE-NOREC, PPR-SRV-OO-2, COND-PFS-FC-SYS 5 3.4 2.2E-008 EFW-PMP-CF-ALL, EFW-XHE-NOREC, MEW-SYS-TRIP,
_________ _______ MFW-XI-E-NOREC, PPR-SRV-OO- I, COND-XHE-XM rTT.~rr, grin a 14, VOl. 2J B.9-14 I~U1tLtyILK-q~
AUKELYAK-4014, Vol. 23 B.9-14
Appendix B Appenix No._382/95-002 BLER Table B.9.5. Conditional Cut Sets for Higher Probability Sequences for the Initiating Event Assessment for LER 382/95-002 Cut set Percent Conditional number contribution probability' Cut setsh 6 3.4 2.2E-008 EFW-PMP-CF-ALL, EFW-XHE-NOREC, MFW-SYS-TRIP, MFW-XHE-NOREC, PPR-SRV-OO-2, COND-XHE-XM 7 2.6 1.7E-008 EFW-PMP-CF-ALL, EFW-XHE-NOREC, MFW-SYS-TRIP, MFW-XHE-NOREC. PPR-SRV-OO-1, COND-PFS-FC-SYS 8 2.6 1.7E.008 EFW-PMP-CF-ALL, EFW-XHE-NOREC, MFW-SYS-TRIP, MFW-XHE-NOREC, PPR-SRV-OO-2, COND-PFS-FC-SYS TRANS Sequence 08 4.713-007 1.....
1 36.6 1.7E-007 PPR-SRV.CO-TRAN, PPR-SRV-OO-1, EPS-DGN-FC-3AFR, HPI-MDP-FC-B. HPI-XHiE-NOREC 2 36.6 1.7E-007 PPR-SRV-CO-TRAN. PPR-SRV-OO-2. EPS-DGN-FC-3AFR, l-PI-MDP-FC-B, HPI-XHE-NOREC 3 6.7 3.2E-008 PPR-SRV-CO-TRAN, PPR-SRV-OO-I, HPI-MDP-CF-ALL, HPI-XHE-NOREC 4 6.7 3.2E-008 PPR-SRV-CO-TRAN, PPR-SRV-OO-2, HPI-MDP-CF-ALL, HPI-XHE-NOREC 5 3.7 1.7E-008 PPR-SRV-CO-TRAN, PPR-SRV-OO-1, HPI-MDP-CF-ALL.
HPI-XHiE.NOREC 6 3.7 1.7E-008 PPR-SRV.CO-TRAN, PPR-SRV-OO-2, HPI-MDP-CF-ALL, HPI-XHE-NOREC 7 1.3 6.2E-009 PPR-SRV-CO-TRAN. PPR-SRV-OO-1, EPS-DGN-FC-3AFR, HPI-MOV-OC-SUCB. HPI-XHE-NOREC 8 1.3 6.213-009 PPR-SRV-CO-TRAN, PPR-SRV-OO-2, EPS-DGN-FC-3AFR, HPI-MOV.OC-SUJCB, HPI-XHE-NOREC Total (all sequences) J 2.5E-005
'The conditional probability for each cut set is determined by multiplying the probability of the initiating event by the probabilities of the basic events in that minimal cut set. The probabilities for the initiating events and the basic events are also given in Table B.9. 1 b Basic events EFW-XHE-NOREC, MFW-SYS-TRIP, MFW-XHE-NOREC, and RHR-MO V-CF-SUCT are all type TRUE events which are not normally included in the output of fault tree reduction programs. These events have been added to aid in understanding the sequences to potential core damage associated with the event.
NUREG/CR-4674, Vol. 23 B.9-15 B.9-15 NLjREG/CR-4674, Vol. 23
LER No. 382/95-002 Annendix B Table B.9.6. Definitions and Probabilities for Selected Basic Events for the Condition Assessment for LER 382/95-002 Modified Event Base Current for this name Description probability probability Type event HPI-MDP-FC-B3 HPI Motor-Driven Pump-B3 Train 3.9E-003 3.9E-003 No Failures HPR-AOV-CC-SMPA Containment Sump A Failures L.IE-003 1.IE-003 No HPR-AOV-CC-SMPB Containment Sump B Failures 1.1E-003 1.1E-003 No HPR-AOV-CF-SMP Common-Cause Failure of Sump 1 OE-004 1 OE-004 No Air-Operated Valves HPR-HDV-CF-RWSP Common-Cause Failure of the 2.OE-004 2.OE-004 No Isolation Hydraulic Discharge Valves to the RWSP HPR-HDV-00-RWSPA RWSP Train A Isolation Hydraulic 2.OE-003 2.013-003 No
___________________Discharge Valve (HDV) Failures ______
HPR-HDV-00-RWSPB RWSP Train B Isolation HDV 2.013-003 2.011-003 No Failures HPR-SMP-FC-SIJMP Containment Recirculation Sump 5.OE-005 S.OE-OO5 No Failures HPR-XHE-NOREC Operator Fails to Recover the HPR 1.OE+OOO 1.OE+0OO TRUE No System HPR-XHE-NOREC-L Operator Fails to Recover the HPR 1.OE+OOO 1.O11+000 TRUE No
_________________System During a LOOP_____ _____
MSS-VCF-HW-ISOL Ruptured Steam Generator 1 OE-002 1.O11-002 No Isolation Failures MSS-XHE-NOREC Operator Recovery Action for 1.OE-OO 1 1.OE-OO 1 No Steam Generator Isolation PPR-SRV-CO-L SRVs Open During a LOOP 1.6E-001 1.613-001 No PPR-SRV-CO-TRAN SRVs Open During Transient 2.011-002 2.OE-002 No PPR-SRV-00-1 SRV 1 Fails to Reseat 1.6E-002 1.6E-002 No PPR-SRV-00-2 SRV 2 Fails to Reseat 1.6E-002 1.6E-002 No RHR-MOV-CF-SUCT Common-Cause Failure of RH-R 1.213-003 1.OE+OOO TRUE Yes Suction Valves RHR-XHE-NOREC Operator Fails to Recover the RHR 3.413-001 3A4E-001 No
______________System I_______ I__I__I__I NUREG/CR4674, Vol. 23 B.9-16
Annendix B LER No.
LER No. 382/95-002 382/95-002 ADoendix B Table B.9.6. Definitions and Probabilities for Selected Basic Events for the Condition Assessment for LER 382/95-002 Modified Event Base Current for this name Description probability probability Type event RHR-XHE-NOREC-L Operator Fails to Recover the RHR 3.4E-OOI 3.4E-OO1 No I ~~~System During a LOOP III1-IRWSP-REFILL Operator Fails to Refill RWSP I8.5E-003 I8.SE-003 II No B.9-17 B.9-17NUREG/CR-4674, Vol. 23
LER No. 382/95-002 Appendix B Appendix B LER No. 382/95-002 Table B.9.7. Sequence Conditional Probabilities for the Condition Assessment for LER 382/95-002 Conditional Event tree Sequence core damage Core damage Importance Percent name name probability probability (CCDP-CDP) contribution*
_______ ________ (CCDP) (CDP) ______
SLOCA 03 1.1E-006 8.5E-009 1.113-006 65.4 TRANS 05 4.8E-007 3.4E-009 4.8E-007 28.7 LOOP 05 8.2E-008 3.6E-008 4.5E-008 2.6 SGTR 04 4. 1E-008 2.9E-0l10 4. IE-008 2.4 Total (all seuncs 9.113-005 8.9E-005 1.713-005 Percent contribution to the total Importance.
Table B.9.8. Sequence Logic for Dominant Sequences for the Condition Assessment for LER 382/95-002 Event tree name Sequence name Logic SLOCA 03 IRT, /EFW, /HPI, /COOLDOWN, RHR, HPR TRANS 05 IRT, /EFW, SRV, SRV-RES, /HPI,
_________ _________/COOLDOWN, RHR, HPR LOOP 05 IRT-L, /EP, IEFW-L, SRV-L, SRV-RES, /HPI-L, /COOLDOWN, R}IR-L, HPR-L SGTR 04 JRT, /EFW-SGTR, /HPI, /RCS-SG, SGISOL, /RCSCOOL, RHR, RWSPREFIL B.9-18 NUREG/CR-4674, Vol. Vol. 2323 B.9-18
Annendix B LER LER No.
No. 382/95-002 382/95-002 AnDendix B Table B.9.9. System Names for the Condition Assessment for LER 382/95-002 System name Logic COOLDOWN RCS Cooldown to RH-R Pressure Using Turbine-
_______________Bypass Valves, etc.
EFW No or Insufficient EFW Flow EFW-L No or Insufficient EFW Flow During a LOOP EFW-SGTR No or Insufficient EFW Flow During a Steam Generator Tube Rupture Event EP Failure of Both Trains of Emergency Power HPI No or Insufficient HPI System Flow HPI-L No or Insufficient HPI System Flow During a LOOP HPR No or Insufficient HPR Flow HPR-L No or Insufficient HPR Flow During a LOOP RCS-SG Failure to Lower RCS Pressure to Less Than SG Relief-Valve Set Point RCSCOOL Failure to Cooldown RCS to Less Than RCS Pressure RH-R No or Insufficient RH-R System Flow RH-R-L No or Insufficient RH-R System Flow During a LOOP RT Reactor Fails to Trip During a Transient RT-L Reactor Fails to Trip During a LOOP RWSPREFIL Operator Fails to Refill RWSP SGISOL Failure to Isolate Ruptured SG Before RWSP Depletion SRV SRVs Open During a Transient SRV-L SRVs Open During a LOOP SRV-R.ES SRVs Fail to Reseat NUREG/CR-4674, Vol. 23 B.9-I 9 B.9-19 NUREG/CR-4674, Vol. 23
ADDendix B A~ni LER o. 382/95-002 Table B.9.10. Conditional Cut Sets for Higher Probability Sequences for the Condition Assessment for LER 382/95-002 Change in Cut set Percent CCDP Cut sets' number contribution (Importance)tm SLOCA Sequence 03 1.1E-006 ......... ix 1 53.4 6.013-007 RI-R-MOV-CF-SUCT, RHR-XHE-NOREC. HPR-HDV-CF-RWSP, HPR-XHiE-NOREC 2 26.7 3.OE-007 RHR-MOV-.CF-SUCT. RHR-XH-E-NOREC. HPR-AOV-CF-SMP, HPR-XHiE-NOREC 3 13.3 1.513-007 RHR-MOV-CF-SUCT, RHR-XHE-NOREC, HPR-SMP-FC-SUMP, HPR-XHE-NOREC 4 2.0 2.3 E-008 RI-R-MOV-CF-SUCT. RHR-XJ-E-NOREC, HPI-MDP-FC-B, HPR-HDV-OO-RWSPA, HPR-XHiE-NOREC 5 1.1 1.213-008 RJ-R-MOV-CF-SUCT, RHR-XHiE-NOREC, HPI-MDP-FC-B, HPR-AOV-CC-SMPA, HPR-XHE-NOREC 6 1.0 1.1E-008 RHR-MOV-CF-SUCT, RHR-XHE-NQREC, HPR-HDV-OO-RWSPA, HPR-HDV-OO-RWSPB, HPR-XHiE-NQREC TRANS Sequence 05 4.8E..007 .......
1 26.7 .1.2E-007 PPR-SRV-CO-TRAN, PPR-SRV-0O-1, RHR-MO V-CF-SUCT, RHR-XHiE-NOREC, H-PR-HDV-CF-RWSP, HPR-XHE-NOREC 2 26.7 1.2E-007 PPR-SRV-CO-TRAN, PPR-SRV-OO-2, RH-R-MOV-CF-SUCT, RHMR-M-E-NOREC, HPR-HDV-CF-RWSP, HPR-XHiE-NOREC 3 13.3 6.5E-008 PPR-SRV-CO-TRAN, PPR-SRV-OO-1, RHR-MOV-CF-SUCT, RHR-XE-NOREC. HPR-AOV-CF-SMP, HPR-XHiE-NOREC 4 13.3 6.5E-008 PPR-SRV-CO-TRAN, PPR-SRV-OO-2. RHR-MOV-CF-SUCT, RHR-XE-NOREC, HPR-AOV-CF-SMP, HPR-XHiE-NOREC 5 6.6 3.2E-008 PPR-SRV-CO-TRAN, PPR-SRV-OO-1, RHR-MOV-CF-SUCT, R-R-HME-NOREC, HPR-SMP-FC-SUMP. HPR-XHE-NOREC 6' 6.6 3.2E-008 PPR-SRV-CO-TRAN, PPR-SRV-OO-2, RH-R-MOV-CF-SUCT, RHR-XE-NOREC, HPR-SMP-FC-SUMP, HPR-XHE-NOREC 7 1.0 5.1E-009 PPR-SRV-CO-TRAN, PPR-SRV-OO-1, RHR-MOV-CF-SUCT, RHR-XE-NOREC, HPI-MDP-FC-B, HPR-HDV-OO-RWSPA, HPR-XHiE-NOREC 8 1.0 5.I1E-009 PPR-SRV-CO-TRAN, PPR-SRV-OO-2, RHR-MOV-CF-SUCT, RHR-XE-NOREC, HPI-MDP-FC-B, HPR-HDV-OO-RWSPA, HPR-XHiE-NOREC NUREG/CR-4674, Vol. 23 B92 B.9-20
Appendix B No. 382/95-002 Appenix BLER Table B.9.10. Conditional Cut Sets for Higher Probability Sequences for the Condition Assessment for LER 382/95-002 Change in Cut set Percent CCDP Cut setsb number contribution (Importance)'
LOtOP Sequence 05 4.1308 . ..
1 26.7 1.E-008 PPR-SRV-CO-L, PPR-SRV-OO-1, RHR-MOV-CF-SUCT.
________ __________RHR-XH-E-NQREC-L, HPR-HDV-CF-RWSP, HPR-XHE-NOREC-L 2 26.7 1.E-008 PPR-SRV.CO-L, PPR-SRV-OO-2. RHR-IMOV-CF-SUCT, RHR-XHE-NOREC.L. HPR-HDV-CF-RWSP, HPR-XHiE-NOREC-L 3 13.3 6.6E-009 PPR-SRV-CO-L. PPR-SRV-OO-1, RHR-MOV-CF-SUCT, RH-R-XHE-NOREC-L, HPR-AOV-CF-SMP, HPR-XHE-NOREC-L 4 13.3 6.6E-009 PPR-SRV-CO-L. PPR-SRV-OO-2, RI-R-MOV-CF-SUCT,
__________RHIR-XHE-NOREC-L. HPR-AOV-CF-SMP, HPR-XHE-NOREC-L 5 6.6 3.2E-009 PPR-SRV-CO-L. PPR-SRV-0O-1. RHR-MOV-CF-SUCT.,
RHR-XHE-NOREC.L. HPR-SMP-FC.SUMP, HPR-XHE-NOREC-L 6 6.6 3.2E-009 PPR-SRV-CO-L, PPR-SRV4OO-2, RHR-MOV-CF-SUCT.
________ __________RHR-XHE-NOREC-L, HPR-SMP-FC-SUMP, HP-XCHE-NOREC-L 7 1.0 5.113-010 PPR-SRV-CO-L, PPR.SRV-OO-1. RHR-MOV-CF-SIJCT, RHR-XHE-NOREC-L, HPI-MDP-FC-B, HPR-HDV-OO-RWSPA, HPR-XHE-NOREC-L 8 1.0 5.113-0 10 PPR-SRV.CO-L, PPR-SRV-OO-2, RHR-MOV-CF-SUCT, RH-R-XHE-NOREC-L, HPI-MDP-FC-B, HPR-HDV-OO-RWSPA, HPR-XHE--NORF.C-1.
SGTR Sequence 08 4.1E-008 11 99.7 4.1E-008 IMSS-VCF-HW-ISOL, MSS.XHE-NOREC, RHR-MOV-CF-SUCT, IRHR-XE-NOREC, RWSP-REFILL I Total (all sequences) 1.9E-005
'The change in conditional probability (importance) is determined by calculating the conditional probability for the period in which the condition existed and given the condition, and subtracting the conditional probability for the same period but with plant equipment assumed to be operating nominally. The conditional probability for each cut set within a sequence is determined by multiplying the probability that the portion of the sequence that makes the precursor visible (e.g., the system with a failure is demanded) will occur during the duration of the event by the probabilities of the remaining basic events in the minimal cut set. This can be approximated by 1 -c-p, where p is determined by multiplying the expected number of initiators that occur during the duration of the event by the probabilities of the basic events in that minimal cut set. The expected number of initiators is given by It, where X is the frequency of the initiating event (given on a per hour basis),
and it is the duration time of the event (in this case, 8760 h). This approximation is conservative for precursors made visible by the initiating event. The frequencies of interest for this event are: I . = 6.8 xI104/h, X.,,~, = 8.5 x I 0'/h, A.,,,A = 1.0 x 10-6/h. and A.,m = 1.6 x 10-'/h.
bBasic events RH-R-MOV-CF-SUCT is a type TRUE event which is not normally included in the output of fault tree reduction programs.
This event has been added to aid in understanding the sequences to potential core damage associated with the event.
B.9-21 NUREG/CR-4674, Vol. 23