ML20149K341
| ML20149K341 | |
| Person / Time | |
|---|---|
| Site: | Fort Calhoun  |
| Issue date: | 05/28/2020 |
| From: | Christopher Hunter NRC/RES/DRA/PRB |
| To: | |
| Littlejohn J (301) 415-0428 | |
| References | |
| LER 1987-025-00 | |
| Download: ML20149K341 (7) | |
Text
B-30 PRECURSOR DESCRIPTION SHEET LER No.: 285/87-025,87-033, 88-010 Event
Description:
Undetected failures from instrument air-water intrusion Date of Event: 7/6/87 Plant: Fort Calhoun EVENT DESCRIPTION Sequence In 1985 the DG room fire system was converted from a water wet-pipe system to a water dry-pipe system to prevent any possibility of freezing pipes during winter operations. Instrument air was supplied to the dry-pipe up to valve FP-513 through two check valves (IA-575, -576) and an air maintenance device intended to hold the valve clapper closed. When the fire system is actuated (in test or for real), the air pressure is rapidly dropped and the valve opens to admit water to the deluge headers. Once opened, the dry-pipe valve must be manually closed.
During testing of the fire system on 7/16/87, the check valves failed.
open from foreign material (unspecified) and the operator failed to pro-perly reset the dry-pipe valve due to inadequate training and proce-dures. The air maintenance device was bypassed. Water then entered the instrument air system since the fire system water pressure was 30 psi higher than the air pressure. The operator saw that the air side/water side pipe pressure gauges were at the fire main pressure and realized that this could only occur if the dry-pipe valve had failed to reset. He closed an isolation valve (FP-514). It was estimated that 10-15 gal of water entered the air system.
Over the next several hours several problems occurred. The DC fuel oil bubbler level gage failed high. The CCW SDC heat exchanger outlet valve opened. The demineralizer water makeup flow controller to the boric acid system had water at its flow control valve.
The dry-pipe check valves were repaired and the dry-pipe valve was properly reset. The instrument air system was blown down to remove the water. Engineers began a study- to see what other corrective actions would be required.
The immediate system blowdown indicated that the water intrusion was confined to the lower two levels of the auxiliary building. No water was found in the turbine building or intake structure. By the end of the day, it was believed that most of the water had been removed from the air system. On July 9, 515 individual components had been. blown down and the safety-related air accumulators had been drained (except for the DC 2 radiator exhaust damper accumulators, which were overlooked). Water was found in <10% of the components. Many valves were also cycled andý tested. Eight components on four risers had some water and were scheduled for rechecking in September.
Event Identifier: 285/87-025,87-033,88-010
B-31 On Sept. 23, during a test, the DC 2 automatically shut down due to high coolant temperature. The radiator exhaust dampers failed to fully open due to the prior water intrusion incident on 7/6/87. The lack of full air flow through the radiator resulted in the high coolant tempera-ture. The pilot orifice valve was found to be blocked by foreign mate-rial, most likely from the interaction of O-ring lubricant and water.
The backup air accumulator for the pilot valve was found to contain 50%
water (2 quarts). Because the problem might exist on DC 1, the damper valves on DG I were fully opened. Water was subsequently found in the accumulator for DG 1.
On April 15, 1988, a further problem due to the water intrusion was discovered. Leak tests were being performed on four check valves upstream of air accumulators on lines feeding the safety injection and refueling water tank (SIRWT) bubbler level control sensors. These bubblers cause ECCS suction to switch to the sump on low tank level. The four check valves were unable to hold a back-pressure. On a loss of instrument air, the bubblers would sense a false low level and switch ECCS suction to the sump. The recirculation actuation signal would also lock out the LPI pumps, which do not have sump recirculation capability.
The sump would not likely have sufficient water level to provide proper suction to the HPI and containment spray pumps, and the pumps would fail.
Corrective Action Procedure changes were made. The bubbler check valves were replaced. The SG air problems were corrected. Other repairs were made.
Plant/Event Data Systems Involved:
Instrument air Fire ECCS Emergency power Components and Failure Modes Involved:
Unauthorized fire water/air line connection in maintenance Water on DC air start system causes test failure Water in instrument air fails sump recirculation isolation valves in test Component Unavailability Duration: 1986 h for EPS 6096 h for recirculation failure Plant Operating Mode: 1 (100%)
Discovery Method: Testing Reactor Age: 14.7 y Plant Type: PWR Event Identifier: 285/87-025,87-033,88-010
B-32 Comments The operating personnel failed to identify all the consequences of the water intrusion into the instrument air system. Their testing of components served by the air system was incomplete, so the DC and recir-culation failures were only detected as they occurred during subsequent safety system surveillance tests.
Air compressors at Fort Calhoun are not automatically loaded on the diesel-backed buses following LOOP (although they can be manually loaded). Loss of IA on LOOP is assumed for the purposes of this analysis.
Two calculations have been provided to assess the impact of this event:
6.2 4]
7.7 x 10-71 Overall core damage probability estimate = 6.2 x 10-4 MODELING CONSIDERATION AND DECISIONS Initiators Modeled and Initiator Nonrecovery Estimate Postulated LOOP Base case nonrecovery Branches Impacted and Branch Nonrecovery Estimate EPS 1.0 Short-term recovery is unlikely HPI, HPR, 1.0 HPI pump failure expected on early B&F transfer of suction to the containment sump on loss of instrument air Plant Models Utilized PWR plant Class G Event Identifier: 285/87-025,87-033,88-010
B-33 CONDITIONAL CORE DAMAGE PROBABILITY CALCULATIONS Event Identifier: 285/87-025,87-033, 88-010 Event
Description:
Undetected failures from IA water intrusion (calc 1)
Event Date: 07/06/87 Plant: Fort Calhoun UNAVAILABILITY, DURATION= 1896 NON-RECOVERABLE INITIATING EVENT PROBABILITIES LOOP 3.4E-03 SEQUENCE CONDITIONAL PROBABILITY SUMS End State/Initiator Probability CD LOOP 6.2E-04 Total 6.2E-04 CV LOOP 1.4E-05 Total 1.4E-05 ATWS LOOP O.OE+O0 Total 0.OE+00 SEQUENCE CONDITIONAL PROBABILITIES (PROBABILITY ORDER)
Sequence End State Prob N Rec**
217 loop -rt/loop EMERG.POWER ep.rec CD 5.7E-04 6.6E-02 216 loop -rt/loop EMERG.POWER -ep.rec afw/emerg.power CD 4.8E-05 1.1E-01 215 loop -rt/loop EMERG.POWER -ep.rec -afw/emerg.power -porv.or.srv CV 1.3E-05 1.1E-01
.chall ss.releas.term 213 loop -rt/loop EMERG.POWER -ep.rec -afw/emerg.power porv.or.srv CV 5.5E-07 1.1E-01
.chall -porv.or.srv.reseat/ermerg.power ss.releas.term
- non-recovery credit for edited case SEQUENCE CONDITIONAL PROBABILITIES (SEQUENCE ORDER)
Sequence End State Prob N Rec**
213 loop -rt/loop EMERG.POWER -ep.rec -afw/emerg.power porv.or.srv CV 5.5E-07 1.1E-Q1
.chall -porv.or.srv.reseat/emerg.power ss.releas.term 215 loop -rt/loop EMERG.POWER -ep.rec -afw/emerg.power -porv.or.srv CV 1.3E-05 1.1E-01
.chall ss.releas.term 216 loop -rt/loop EMERG.POWER -ep.rec afw/emerg.power CD 4.BE-05 1.1E-01 217 loop -rt/loop EMERG.POWER ep.rec CD 5.7E-04 6.6E-02
- non-recovery credit for edited case Note: For unavailabilities, conditional probability values are differential values which reflect the added risk due to failures associated with an event. Parenthetical values indicate a reduction in risk compared to a similar period without the existing failures.
SEQUENCE MODEL: c:\asp\newmodel\pwrgnew.cmp BRANCH MODEL: c:\asp\newmodel\calhoun.new PROBABILITY FILE: c:\asp\newmodel\pwrbnew.pro Event Identifier: 285/87-025,87-033, 88-010
B-34 No Recovery Limit BRANCH FREQUENCIES/PROBABILITIES Branch System Non-Recov Opr Fail trans 4.8E-04 1.0E+00 loop 4.6E-06 3.9E-01 loca 2.4E-06 4.3E-01 rt 2.8E-04 1.2E-01 rt/loop 0.OE+00 1.0E+00 EMERG.POWER 2.9E-03 > 1.OE+00 8.0E-01 > 1.0E+00 Branch Model: l.OF.2 Train 1 Cond Prob: 5.OE-02 > Failed Train 2 Cond Prob: 5.7E-02 > Failed ep.rec 1.0E+00 1.7E-01 afw 3.8E-04 2.6E-01 afw/emerg.power 5.OE-02 3.4E-01 mfw 2.0E-01 3.4E-01 porv.or.srv.chall 4.0E-02 1.0E+00 porv.or.srv.reseat 2.0E-02 1.1E-02 porv.or.srv.reseat/emerg.power 2.0E-02 1.0E+00 ss.releas.term 1.5E-02 3.4E-01 ss.depress 3.6E-02 1.0E+00 cond/mfw 1.0E+00 3.4E-01 1.OE-02 HPI 3.0E-04 > 1.0E+00 8.4E-01 > 1.OE+00
" Branch Model: l.OF.3 Train 1 Cond Prob: 1.0E-02 > Failed Train 2 Cond Prob: 1.0E-01 > Failed Train 3 Cond Prob: 3.0E-01 > Failed HPI (F/B) 3.0E-04 > 1.OE+00 8.4E-01 > 1.0E+00 1.0E-02 Branch Model: 1.OF.3+opr Train 1 Cond Prob: l.OE-02 > Failed Train 2 Cond Prob: l.0E-01 > Failed Train 3 Cond Prob: 3.0E-Ol > Failed porv.open 1.0E-02 1.0E+00 4.OE-04 hpr/-hpi 1.5E-04 1.0E+00 csr 2.0E-03 3.4E-01 branch model file
- forced Minarick 05-16-1989 06:53:41 Event Identifier: 285/87-025,87-033, 88-010
B-35 CONDITIONAL CORE DAMAGE PROBABILITY CALCULATIONS Event Identifier: 285/87-025,87-033, 88-010 Event
Description:
Undetected failures from IA water intrusion (calc 2)
Event Date: 07/06/87 Plant: Fort Calhoun UNAVAILABILITY, DURATION= 4110 NON-RECOVERABLE INITIATING EVENT PROBABILITIES LOOP 7.4E-03 SEQUENCE CONDITIONAL PROBABILITY SUMS End State/Initiator Probability CD LOOP 7.7E-07 Total 7.7E-07 CV LOOP 3.7E-05 Total 3.7E-05 ATWS LOOP 0.OE+00 Total 0.OE+00 SEQUENCE CONDITIONAL PROBABILITIES (PROBABILITY ORDER)
Sequence End State Prob N Rec**
212 loop -rt/loop -emerg.power afw HPI(F/B) CD 7.1E-07 l.OE-01 252 loop -rt/loop -emerg.power -afw porv.or.srv.chall porv.ot.srv. CD 6.4E-08 4.3E-03 reseat HPI 209 loop -rt/loop -emerg.power -afw -porv.or.srv.chall ss.releas.te CV 3.6E-05 1.3E-01 rm HPI 201 loop -rt/loop -emerg.power -afw porv.or.srv.chall -porv.or.srv. CV 1.5E-06 1.3E-01 reseat ss.releas.term HPI
- non-recovery credit for edited case SEQUENCE CONDITIONAL PROBABILITIES (SEQUENCE ORDER)
Sequence End State Prob N Rec*"
201 loop -rt/loop -emerg.power -afw porv.or.srv.chall -porv.or.srv. CV 1.5E-06 1.3E-01 reseat ss.releas.term HPI 252 loop -rt/loop -emerg.power -afw porv.or.srv.chall porv.or.srv. CD 6.4E-08 4.3E-03 reseat HPI 209 loop -rt/loop -emerg.power -afw -porv.or.srv.chall ss.releas.te CV 3.6E-05 1.3E-01 rm HPI 212 loop -rt/loop -emerg.power afw HPI(F/B) CD 7.1E-07 1.OE-01
- non-recovery credit for edited case Note: For unavallabilities, conditional probability values are differential values which reflect the added risk due to failures associated with an event. Parenthetical values indicate a reduction in risk compared to a similar period without the existing failures.
SEQUENCE MODEL: c:\asp\newmodel\pwrgnew.cmp BRANCH MODEL: c:\asp\newmodel\calhoun.new Event Identifier: 285/87-025,87-033, 88-010
B-36 PROBABILITY FILE: c:\asp\newmodel\pwr_bnew.pro No Recovery Limit BRANCH FREQUENCIES/PROBABILITIES Branch System Non-Recov Opr Fail trans 4.8E-04 1.OE+00 loop 4.6E-06 3.9E-01 loca 2.4E-06 4.3E-01 rt 2.8E-04 1.2E-01 rt/loop O.OE+00 1.OE+00 emerg.power 2.9E-03 8.OE-01 ep.rec 1.OE+00 1.7E-01 afw 3.8E-04 2.6E-01 afw/emerg.power 5. OE-02 3.4E-01 mfw 2.OE-01 3.4E-01 porv.or.srv.chall 4. OE-02 1.OE+00 porv.or.srv.reseat 2.OE-02 1.1E-02 porv.or.srv.reseat/emerg.power 2 . OE-02 1.OE+00 ss.releas.term 1. 5E-02 3.4E-01 ss.depress 3.6E-02 1.OE+00 cond/mfw 1.OE+00 3.4 E-01 1.0E-02 HPI 3.OE-04 > 1.0E+00 8.4E-01 > 1.OE+00 Branch Model: 1.OF.3 Train 1 CondProb: 1.OE-02 > Failed Train 2 Cond Prob: 1.OE-01 > Failed Train 3 Cond Prob: 3.OE-01 > Failed HPI(F/B) 3.OE-04 > 1.0E+00 8.4E-01 > 1.OE+00 1.OE-02 Branch Model: l.OF.3+opr Train 1 Cond Prob: 1.OE-02 > Failed Train 2 Cond Prob: 1.OE-01 > Failed Train 3 Cond Prob: 3.OE-01 > Failed porv.open 1.OE-02 1.OE+00 4.OE-04 hpr/-hpi 1.5E-04 1.OE+00 csr 2.OE-03 3.4E-01
- branch model file