ML20147A524
| ML20147A524 | |
| Person / Time | |
|---|---|
| Site: | Cook  |
| Issue date: | 05/26/2020 |
| From: | Christopher Hunter NRC/RES/DRA/PRB |
| To: | |
| Littlejohn J (301) 415-0428 | |
| References | |
| LER 1989-014-00 | |
| Download: ML20147A524 (12) | |
Text
B-105 ACCIDENT SEQUENCE PRECURSOR PROGRAM EVENT ANALYSIS LER No: 316/89-014 Event
Description:
Trip due to CRID-IV failure Date of Event: August 14, 1989 Plant: D.C. Cook Summary Cook 2 tripped from 100% power as a result of a severe undervoltage on 120-V AC vital bus CRID-IV. The undervoltage condition was caused by an SCR failure in the associated inverter. As a result of the undervoltage, all four wide range steam generator level indicators, the condenser steam dumps, the SSPS train B output relays, and other instrumentation were lost. Additional unrelated failures, the smell of smoke from excessive heating of unfused CRID-IV components, and extensive relay chattering complicated recovery from the event.
The core damage probability for the event is conservatively estimated at 9.4 x 10-6.
Auxiliary feedwater was available throughout the event for primary-to- secondary heat removal (alternate indication of SG functionality was used until SG level was recovered),
and one train of high-pressure injection remained available to mitigate the effects of a potential transient-induced LOCA. The relative significance of the event compared with other potential events at Cook is shown below.
L_ precursor cutoff Event Description The Unit 2 reactor tripped from 100% power at 4:01 p.m. on August 14, 1989, as a
B- 106 result of a problem in an inverter supplying control room instruments. The trip occurred when operators restored the normal power supply to control room instrumentation distribution (CRID) panel IV, which had automatically transferred to its alternate power supply 20 min earlier. Upon transfer of CRID-IV to normal power, the CRID panel experienced severe undervoltage leading to the reactor trip and the loss of numerous instrument indications. Among the instruments and controls lost were all four wide-range steam generator level indicators, condenser steam dumps, solid state protection system. (SSPS) train B output relays, and various monitoring functions.
Immediately after the reactor trip, two control rod bottom lights failed to illuminate. The turbine stop valve status lights did not indicate the turbine had tripped. Excessive heat from overcurrent to unfused items resulted in the smell of smoke in the control room, and the control room smoke detection circuit alarmed. Substantial relay chatter was audible in the control room for a considerable time after the trip.
Operators also noted that the speed indication for the turbine-driven AFW pump had failed, a result of a broken tachometer lead unrelated to the CRID-IY failure.
When the turbine (which had tripped) slowed down sufficiently, the turning gear motor failed, and reports of smoke and damage were received in the control room.
Critical plant parameters were maintained within normal post-trip ranges during the transient recovery, with some systems requiring manual operator control. CRTD-IV was transferred to another alternate power supply after about 45 min, and restoration of individual instruments and controls was substantially complete within 90 min of the reactor trip.
The event was caused by failure of an SCR in the No. 4 inverter 20 min before the trip.
The particular failure mode resulted in a reduction in inverter output voltage to -84 V and initiated a transfer to its alternate power supply. High component currents caused by the reduced voltage resulted in a blown fuse for nuclear instrument channel N-44. This blown fuse was initially believed to have been the cause of the inverter transfer. Because of the nature of the failure, the inverter appeared operable when locally inspected, and permission was given for a transfer back to the normal source. At this point in time, CRID-IV breakers and fuses opened, and a reactor trip occurred from LOOP 4 reactor coolant pump breaker position indication. Subsequently, turbine and main feedwater trip occurred, and AFW initiated. An event timeline is included in Table 1.
A total of eight breakers tripped, and a number of fuses were blown as a result of the
B- 107 CRID-IV low voltage condition. In all cases except steam generator (SG) wide range level, redundant instrumentation was available to the operator. Each SG is provided with one channel of wide range level indication, and all four channels receive power from CRID-IV. Following the reactor trip, and prior to SG level recovery by the auxiliary feedwater system, the narrow range SG level went off scale low. The operators knew that wide range level would be lost if CRID-IV failed and they used SG pressure, feedwater flow, and steam flow as an indication that the SGs were intact and recovering inventory. Wide range level indication was available at the local shutdown instrumentation (LSI) panels located in the auxiliary building. The LSI panels are provided with a transfer switch that could be used to select an alternate power source.
Lost instruments on CRID-IV, audible relay chatter, and the smell of smoke from the failed turning gear motor distracted the operators from performing the trip recovery. The chattering of relays and bistables was loud enough to require shouting for communication in the control room. The smoke/burning smells associated with the failures led some operators to suspect fire somewhere in the control room. The shift supervisor had to contend with failed RTD indication and a smoking condensate pump on the other unit (Unit 1).
Although three of four indications of successful reactor trip occurred, which is the rule that the reactor trip should be considered successful, the RO, with permission, initiated emergency boration. Turbine trip was also not fully confirmed by the principal indications but was verified tripped by other means. The operators expressed no concern over not having SG level indication. Two of four SG POR~s did not have automatic control due to the CRID-IV failure. The RO manually controlled the PORVs as needed in cooldown. The operators were more concerned that an overcooling would lead to SI, since this would be difficult to recover from because of the loss of the SSPS channel B output relays.
Failure of the rod bottom lights (caused by failure of bistables to trip) and turning gear motor (believed to be caused by normal end of life failure) were unrelated to the loss of CRID-IV.
Additonal Event-Related Information The 120-V AC vital instrument bus system consists of four separate buses that are supplied by four independent 7.5-ky, single-phase static inverters. Two of the inverters connect to one of the station batteries; the other two connect to a second station battery.
The static inverter consists of a power switching circuit (inverter) that converts a 250-V
B-108 DC input (lE source) to a regulated 120-V AC sinusoidal output. The output of the power switching circuit is applied through a static switch (part of the inverter), which electrically transfers the static inverter cabinet output to its associated CRID.
The normal input to the static switch is from the power switching circuit. A second source of power is available from a non-lE 120-V AC constant voltage isolation transformer (alternate input). If the static switch fault circuitry detects a loss of normal input, load fault, or overload condition, the fault circuitry will initiate a transfer in <1/4 cycle to the alternate input.
ASP Modeling Assumptions and Approach This event has been modeled as a loss of feedwater with unavailability of one train of systems initiated by the SSPS. Redundancy and diversity to instruments lost as well as a sufficient diagnosis of the root cause's location, that is, CRID No. 4, meant that there were no misleading indications and that the loss of leading indication was easily overcome. A checklist of event significance from a human reliability standpoint is provided in Table 2. (Loss of leading indication without redundancy or diversity or misleading indication should be associated with an increased probability of operator failure where such conditions occur in the actual event. Since neither occurred in this event, the typical trip assumptions are sufficient.)
Because of the loss of SSPS channel B output relays, train B of safety systems was assumed unavailable in cases where these systems would be initiated by the SSPS (transient-induced LOCA) . Main feedwater was assumed recoverable following isolation. The potential for a LOOP following a trip (with an assumed probability of 0.00 1) was also considered in the analysis.
A review of components that would have been faulted if another CRID had failed was also performed. No other CRID was identified as having a more significant impact than CRID-IV, and hence the potential failure of one of these other buses was not addressed in the analysis.
Note: additional information concerning this event is available in AIT report 50-315/89025 and 50-316/89025, "D.C. Cook Unit 2 Reactor Trip/Degraded Class 1E Power," August 14, 1989.
B- 109 Analysis Results The base case analysis results (recoverable loss of feedwater with unavailability of one train of safety injection for transient-induced LOCA) indicate a low significance event (p(cd) = 2.8 x 10-7). The dominant sequence for this event involves a transient-induced LOCA with IJPI unavailability. The next two most significant sequences are related to loss of main and auxiliary feedwater and failure of bleed and feed, which is typically the dominant transient sequence in a PWR.
Postulating a loss of offsite power as a result of the trip (e.g., due to grid disturbances) results in a conservative core damage probability estimate of 9.4 x 10-6, assuming the faulted DG cannot be manually started. This is still a low significance event.
B-110 Table 1. D.C. Cook Event Timeline Time Event 3:40 pmn Power range N-44 fuse blows; CRID-IV transfers to alternative supply; SSPS output relays chatter briefly 3:45 N-44 bistables placed in "trip" per TS 3:45 N-44 defused completely 3:55 CRID-IV checkout for transfer to normal power 4:01:24 CRID-IV pushbutton actuated to transfer power; reactor trip - reactor coolant pump 4 breaker 4:01:26 Control rods in - 3 bottom lights not illuminated; rod H-8 light canme in a few seconds later, leaving 2 failed 4:01:26 Auxiliary feedwater pump autostarts - MIFP trip 4:01:28-30 Steam generator low levels received - all channels 4:01:30 Operators commence E4O 4:01:36-38 Steam generators low-low levels 4:01:52 Main generator output breaker opens normally 4:01:55 Operator manual turbine (solenoid) trip, followed by manual AMSAC trip 4:02 Steam generator levels off scale low 4:02 Operators verify no SI required, commence ES-O.1 4:03 Onshift STA reviews Status Trees - no emergency indications 4:03 Operator performs emergency boration (pumps already running) by opening boration valve 4:05 Control room vent fan started to clear out smell of smoke 4:10 Emergency boration secured 4:15 Steam generator narrow-range levels back on scale 4:15 Both source range Nls reenergize normally 4:05-4:15 Operations in manual control - letdown/charging flow; letdown pressure control; CCW to letdown heat exchanger; steam generator PORVs 4:16 Turbine AFW pump secured; RCS cooldown stopped at 535 degrees 4:20-4:30 Reactor and secondary plants stabilized in MODE 3 4:30 Turbine turning gear motor secured - reported smoking 4:30-4:35 RCS cooldown below 541 degrees to secure RCP 4 4:36 RCP 4 stopped due to absence of pump monitoring instrumentation 4:46 CRID-IV transferred to lighting panel power supply CRP-3 restoring normal voltage 4:46-5:30 CRID-IV instrumentation and control loads individually restored
B-1ll Table 2. Checklist of D.C. Cook Event Significance Item Comment Instrumentation Aspects Leading indication lost Control rod insertion; turbine trip; SG level Misleading indications None Root cause sufficiently known Operators knew CRID-IV was cause Impact of instrumentation loss known Yes Other Equipment Multiple failures with different effects Yes Multiple failures with similar effects Smoke smell in control room due to CRID-IV failure; smoke from turbine bearing motor Safety equipment effects 2 SG PORVs loss of automatic control; SG level control not indicated directly Operator Actions Manual turbine trip A confirmation action Emergency boration A conservative action Manual SG PORV control Feared overcooling onset of SI Check for fire Confirmed there was not a fire Attend other unit (Unit 1)problems Distractions to shift supervisor Operator Resources Procedures Generally adequate although operator knowledge supplemented instructions Instrumentation All redundant except SG wide range level Simulator training CRID-IV failures simulated but this failure mode was unanticipated Other Influences Noise From chattering of relays and bistables Smoke smell Led to fire alarm but no fire Shift interface Shift had just begun Multiunit Distractions from Unit 1
B-112 TRANS AFW MFW I PRV/ O HPI IHPR I PORV SEQ NO END STATE CHAL RESEAT OE OK OK 11 C 12 C OK OK OK 13 CO 14 C OK OK 15 CD (1) 16 CO 17 CD 18 ATWS (1) OK for Class D Dominant core damage sequence for LER 3 16/89-014
B-113 CONDITIONAL CORE DAMAGE PROBABILITY CALCULATIONS Event Identifier: 316/89-014 Event
Description:
Trip due to CRID-IV failure Event Date: 08/14/89 Plant: Cook 2 INITIATING EVENT NON-RECOVERABLE INITIATING EVENT PROBABILITIES TRANS 1. OE+00 SEQUENCE CONDITIONAL PROBABILITY SUMS End State/Initiator Probability CD TRANS 2.8E-07 Total 2.8E-07 ATWS TRANS 3.4E-05 Total 3.4E-05 SEQUENCE CONDITIONAL PROBABILITIES (PROBABILITY ORDER)
Sequence End State Prob N Rec**
12 trans -rt -afw porv.or.srv.chall porv.or.srv.reseat HPI CD 1. 1E-07 9. 2E-03 17 trans -rt afw mfw hpi(f/b) CD 7. 6E-08 1. 5E-02 15 trans -rt afw mfw -hpi(f/b) -hpr/-hpi porv.open CD 7. 2E-08 1 . E-02 11 trans -rt -afw porv.or.srv.chall porv.or.srv.reseat -HPI hpr/ CD 1. 5E-08 1 . 1E-02
-hpi 16 trans -rt afw mfw -hpi(f/b) hpr/-hpi CD 8.OE-09 1. 8E-02 18 trans rt ATWS 3.4E-05 1. 2E-01
-* non-recovery credit for edited case SEQUENCE CONDITIONAL PROBABILITIES (SEQUENCE ORDER)
Sequence End State Prob N Rec**
11 trans -rt -afw porv.or.srv.chall porv.or.srv.reseat -HPI hpr/ CD 1. 5E-08 1. 1E-02
-hpi 12 trans -rt -afw porv.or.srv.chall porv.or.srv.reseat HPI CD 1 . 1E-07 9. 2E-03 15 trans -rt afw mfw -hpi(f/b) -hpr/-hpi porv.open CD 7 .2E-08 1 . BE-02 16 trans -rt afw mfw -hpi(f/b) hpr/-hpi CD 8 .OE-09 1 . SE-02 17 trans -rt afw mfw hpi(f/b) CD 7 .6E-08 1 . 5E-02 18 trans rt ATWS 3. 4E-05 1. 2E-01
- non-recovery credit for edited case SEQUENCE MODEL: c:\asp\1989\pwrbseal.cmp BRANCH MODEL: C:\asp\1989\cook.sll PRDBABILITY FILE: c:\asp\1989\pwr~bsll.pro No Recovery Limit BRANCH FREQUENCIES/PROBABILITIES Branch System Non-Recov Opr Fail trans 3.4E-04 1. OE+00 loop 1.6E-05 2.4 E-01 loca 2.4E-06 4. 3E-01 Event Identifier: 316/89-014
B-114 rt 2. 8E-04 1.2E-01 rt/ loop 0.08+00 1.08+00 emerg. power 2.9E-03 8.08-01 afw 3. 8E-04 2. 6E-01 afw/emerg .power 5.0 E-02 3.4 -01 mfw 1. 08+00 7. 0E-02 porv.or.srv.chall 4 .0E-02 1.08E+00 porv.or.srv. reseat 3.08-02 1.18-02 porv.or.srv.reseat/emerg.power 3.08-02 1.08+00 seal. loca 2.5E-01 1.08+00 ep.rec(sl) 6. 9E-01 1.08+00 ep. rec 5.2E8-02 1.08E+00 821 1.08-03 > 1.08-02 8.48-01 Branch Model: l.OF.2 Train 1 Cond Prob: 1.08-02 Train 2 Cond Prmb: 1.08-01 > Unavailable hpi (f/b) 1.08-03 8.48-01 1.08-02 hpr/-hpl 1. 5E-04 1.08+00 1.08-03 porv .open 1.08-02 1.08+00 4.08E-04
- branch model file
- forced Minarick 06-15-1990 08 :40: 50 Event Identifier: 316/89-014
B-115 CONDITIONAL CORE DAMAGE PROBABILITY CALCULATIONS Event Identifier: 316/89-014 Event
Description:
Trip due to CRID-IV failure (postulated LOOP)
Event Date: 08/14/89 Plant: Cook 2 INITIATING EVENT NON-RECOVERABLE INITIATING EVENT PROBABILITIES LOOP 1. OE-03 SEQUENCE CONDITIONAL PROBABILITY SUNS End State/Initiator Probability CD LOOP 9.IE-06 Total 9.1E-06 ATWS LOOP 0. OE+00 Total 0 .OE+00 SEQUENCE CONDITIONAL PROBABILITIES (PROBABILITY ORDER)
Sequence End State Prob N Rec**
53 LOOP -rt/loop EMERG.POWER -afw/emerg.power -porv.or.srv.Chall CD 6.5E-06 7 . 9E-04 seal.loca ep.reC(sl) 54 LOOP -rt/loop EMERG.POWER -afw/emerg.power -porv.or.srv.chall - CD 1. 5E-06 7 . 9E-04 seal.loca ep.rec 55 LOOP -rt/loop EMERG.POWER afw/emerg.power CD 6. 8E-07 2 .7E-04 48 LOOP -rt/loop EMERG.POWER -afw/emerg.power porv.or.srv.Chall - CD 2.6E-07 7 .9E-04 porv.or.srv.reseat/emerq.power seal. loCa ep.reC (si)
- non-recovery credit for edited case SEQUENCE CONDITIONAL PROBABILITIES (SEQUENCE ORDER)
Sequence End State Prob N Rec**
48 LOOP -rt/loop ENERG.POWER -afw/emerg.power porv.or.srv.chall - CD 2.6E-07 7 .9E-04 porv.or.srv.reseat/emerg.power seal.loca ep.rec (sl) 53 LOOP -rt/loop ENERG.POWER -afw/emerg.power -porv.or.srv.chall CD 6.5E-06 7. 9E-04 seal.loca ep.rec(sl) 54 LOOP -rt/loop EMERG.POWER -afw/einerg.power -porv.or.srv.chall - CD 1. 5Z-06 7 . 9E-04 seal.loca ep.rec 55 LOOP -rt/loop ENERG.POWER afw/emerg.power CD 6.8E-07 2 .7E-04
"* non-recovery credit for edited case SEQUENCE MODEL: c:\asp\1989\pwrbseal.cmp BRANCN MO~DEL: c:\asp\1989\cook.sil PROBABILITY FILE: c:\asp\1989\pwr~bsll.pro No Recovery Limit BRANCH FREQUENCIES/PROBABILITIES Branch System Non-Rec:ov Opr Fail trans 3.49-04 1.0E+00 LOOP 1.6E-05 > 1.6E-05 2.4E-01 > 1.OE-03 Branch Model: INITOR Event Identifier: 316/89-014
B-116 Initiator Freq: 1. 6E-05 loca 2.4E-06 4 . 3E-01 rt 2.8 E-04 1.2E-01 rt/loop 0.OE+00 1. OE+00 EMERG. POWER 2.9E-03 > 5.OE-02 8. OE-01 Branch Model: l.OF.2 Train 1 Cond Prob: 5.0 E-02 Train 2 Cond Prob: 5.7R-02 > Unavailable AFW 3.8E-04 > 1.3E-03 2. 6E-01 Branch Model: l.OF.3+ser Train 1 Cond Prob: 2.0 E-02 Train 2 Cond Prob: 1.OE-01 > Unavailable Train 3 Cond Prob: 5.OE-02 Serial Component Prob: 2.8 E-04 afw/emerq .power 5.OE-02 3.4E-Ol mfw 1.0E+00 7. 0E-02 porv.or.srv.chall 4 .OE-02 1. OE+00 porv.or.srv. reseat 3.0E-02 1. IE-02 porv.or.srv. reseat/emerg.power 3.OE-02 1. OE+00 seal. loca 2.5E-01 l.OE-.00 ep.recjsl) 6. 9E-01 l.OE+0O ep. rec 5.2 E-02 1. OE+00 HPI 1.OE-03 > l.OE-02 8.4E-01 Branch Model: l.OF.2 Train 1 Cond Prob: l.OE-02 Train 2 Cond Prob: l.OE-01 > Unavailable HPI (F/B) 1.OE-03 > l.0E-02 8. E-01 1 .OE-02 Branch Model: l.OF.2+opr Train 1 Cond Prob: 1.0 E-02 Train 2 Cond Prob: 1.OE-01 > Unavailable HPR/-HPI 1.5E-04 > l.OE-02 1. OE+D0 1 .OE-03 Branch Model: l.OF.2+opr Train I Cond Prob: l.0E-02 Train 2 Cond Prob: 1.5E-02 > Unavailable porv .open l.OE-02 1 - OE+00 4 .OE-04
- branch model file Sforced Minarick 06-15-1990 08:47:50 Event Identifier: 316/89-014