ML20149K402
| ML20149K402 | |
| Person / Time | |
|---|---|
| Site: | Limerick  |
| Issue date: | 05/28/2020 |
| From: | Christopher Hunter NRC/RES/DRA/PRB |
| To: | |
| Littlejohn J (301) 415-0428 | |
| References | |
| LER 1989-013-00 | |
| Download: ML20149K402 (6) | |
Text
B-279 ACCIDENT SEQUENCE PRECURSOR PROGRAM EVENT ANALYSIS LER No:
Event
Description:
Date:
Plant:
353/89-013 Reactor scram with degraded HPCI December 11, 1989 Limerick 2 Summary An incorrectly set generator differential relay caused a turbogenerator trip that resulted in a reactor scram. After the scram, fluctuations in reactor vessel level provided initiation signals to the reactor core isolation cooling system (RCIC) and the high-pressure coolant injection (IJPCI) system. RCIC did not initiate, and LIPCI did not initiate correctly. The core damage probability estimated for the event is 1.5 x 10-5. The relative significance of this event compared with potential events at Limerick 2 is shown below.
-LER 353/89-013 1E-7 1E-6 1E-1E-4 IE-3 1E-2 I
/I I
I L Trip 3 6 0 h Epd[
36I HC LOFW+
L. precursor cutoff
+ RCI d
Event Description While at 98% power, during startup power ascension testing, Limerick Unit 2 experienced a main generator trip. The trip was caused by an incorrectly set generator differential relay and resulted in turbine trip and reactor scram. As expected after a scram resulting from turbine control valve fast closure while at high power, the reactor vessel was subjected to moderate level and pressure transients. Shortly after the scram, vessel level instrumentation momentarily spiked below the in, instrument level, at which point RCIC and HPCI initiate. However, RCIC did not initiate, and HPCI did not correctly initiate. The utility concluded that the short duration of the low level signal (approximately 50 ins) prevented proper RCIC and HPCI initiation. It was believed that RCIC could have initiated had the initiation signal remained present.
B-280 The I-PCI barometric condenser vacuum pump and auxiliary oil pump started, and the turbine steam admission valve opened. The valve that supplies cooling water to the HPCI lube oil cooler and barometric condenser failed to open as did HPCI discharge valves to the feedwater and core spray systems. As a result, HPCI initiated and tripped in this incorrect configuration six times in the next 3 min before operators noticed and shut down the system.
Additional Event-Related Information The following FSAR information is relevant to the assessment of the event:
"FSAR Fig. 7.3-7 indicates that the circuits for the following pumps and valves simultaneously receive the HPCI (one-out-of-two-taken-twice logic) initiation signal:
outboard steam supply isolation valve (F7003), test bypass to CST (17008), redundant shutoff to suppression pool (F07 1), pump discharge (17006), pump discharge (F007), pump suction from CST (F004), steam supply to turbine (Fool), cooling water supply (17059), valve F105, vacuum pump, and auxiliary oil pump.
- Following the logic diagram (FSAR Fig. 7.3-7) the HPCI injection valve (F006) should open automatically (and seal-in) upon receipt of an HPCI initiation signal if the TSV and FO01 are not full closed and when no test switch is in. Plus, there is a seal-in initiation signal until reseat.
- FSAR section 6.3.2.2.1 states "The HPCI controls automatically start the system and bring it to design flow within 30 seconds from receipt of a reactor pressure vessel (RPV) low water level signal...", "If an initiation signal is received after the turbine is shut down, the system restarts automatically.
..", and "HPCI operation automatically actuates the following valves: (a) HPCI pump discharge shutoff valves, (b) HPCI steam supply shutoff valve, (c) HPCI turbine stop valve, (d) HPCI turbine control valves, (e) HPCI steam line drain isolation valve, (f) HPCI test valve, if open, and (g) minimum flow bypass valve."
All of the above verify that when an initiation signal is received (i.e., completion of the one-out-of-two-taken-twice logic for either RPV low water level or high drywell pressure), the HPCI system should start and inject water into the RPV.
ASP Modeling Assumptions and Approach The event has been modeled as a reactor scram with degraded HPCI (local recovery
B-281 assumed possible). To bound the impact of the potentially unavailable RCIC, two calculations were performed, one assuming RCIC was available and the other assuming RCIC was unavailable (with local recovery also assumed possible).
Analysis Results The conditional probability of severe core damage estimated for this event is 1.5 x1-5 assuming both HPCI and RCIC were initially unavailable. The dominant sequence to core damage involves failure of an open SRV to close, failure to recover HPCI, and failure to depressurize using ADS. Note that unavailability of RCIC does not impact this sequence. Unavailability of RCIC impacts the second most dominant sequence (a factor of three lower in probability), which involves failure of high-pressure injection (feedwater, HPCI, RCIC, and CRD pumps) and failure to depressurize using ADS.
Assuming RCIC is initially available reduces the estimated core damage probability to 1.2 x 10 essentially no change in the overall event impact. This is because RCIC availability does not impact the dominant sequence, as described above.
The dominant sequence for this event is highlighted on the following event tree.
B-282 TAS Rx H-C
_ I~RIHIR RHR (SP SEO END lET SHUT FW I
.. CR01.
PC (SDC COOLING NO STATE DON C.AL HPCS ADS
(~RH)
MODE)
MODE)OhE OR CORE DAMAGE OR 12 CORE DAMAGE 0K 13 CORE DAMAGE 14 CORE DAMAGE 15 CORE DAMAGE 16 COREDAMAGE OR 17 CORE DAMAGE OR IS CORE DAMAGE IA CORE DAMAGE 20 CORE DAMAGGE OR OK 21 CORE DAMAGE OR 22 CORE DAMAGE OR OR 23 CORE DAMAGE OK 24 CORE DAMAGE OK 25 CORE DAMAGE OR 26 CORE DAMAG 27 CORE DAMAGE 28 CORE DAMAGE OR Ox 29 CORE DAMAGE OR OK 30 CORE DAMAGE OK 32 CORE DAMAGE OR 32 CORE DAMAGE OR 33 CORE DAMAGE OK 35 CORE DAMAGE OK 36 CORE DAMAGE COREDMG 36 CORE DAMAGE go ATWS Dominant core damage sequence for LER 353/89-013
B-283 CONDITIONAL CORE DAMAGE PROBABILITY CALCULATIONS Event Identifier:
353/89-013 Event
Description:
Reactor scram with degraded NPCI Event Date:
12/11/89 Plant:
Limerick 2 INITIATING EVENT NON-RECOVERABLE INITIATING EVENT PROBABILITIES TRANS SEQUENCE CONDITIONAL PROBABILITY SUMS End State/Initiator
- 1. OE+OG Probability CD TRANS Total ATWS 1.5E-05 1.5SE-OS
- 3. GE-OS
- 3. OE-OS TRANS Total SEQUENCE CONDITIONAL PROBABILITIES (PROBABILITY ORDER)
Sequence 28 trans -rx.shutdown pcs/trans srv.chall/trans.-scram srv.close fw/pcs.trans NPCI srv.ads 20 trans -rx.shutdown pcs/trans srv.chall/trans.-scram -srv.close fw/pcs.trans NPCI RCIC crd srv.ads 11 trans -rx.shutdown pcs/trans srv.chall/trans.-scram -srv.ciose
-fw/pcs.trans rhr(sdc) rhr(spcool)/rhr(sdc) 99 trans rx.shutdown
-* non-recovery credit for edited case SEQUENCE CONDITIONAL PROBABILITIES (SEQUENCE ORDER)
Sequence 11 trans -rx.shutdown pcs/trans srv.chall/trans.-scram -srv.close
-fw/pcs.trans rhr(sdc) rhr(spcooi) /rhr(sdc) 20 trans -rx.shutdown pcs/trans srv.chall/trans.-scram -srv.close fw/pcs.trans NPCI RCIC crd srv.ads 28 trans -rx.shutdown pcs/trans srv.chall/trans.-scram srv.close fw/pcs.trans NPCI srv.ads 99 trans rx.shutdown non-recovery credit for edited case SEQUENCE NODEL:
c:\\asp\\1989\\bwrcseal.cmp BRANCH MODEL:
c:\\asp\\1989\\limrick2.sil PROBABILITY FILE:
c:\\asp\\1989\\bwr~csll.pro No Recovery Limit BRANCH FREQUENCIES/PROBABILITIES Branch System Non-Rec trans 8.2E-04 l.OE+O(
loop 1.6E-0S 5.3E-0:
loca 3.3E-06 S.OE-0 End State CD CD CD Prob 1.1lE-05 3.1E-OE
- 7. 5E-07 N Rec**
- 1. 7E-Ol 1.2E-01
- 7. 5E-07 3.1lE-06
- 1. 1E-05
- 3. GE-OS N Rec**
- 1. GE-0l
- 1. 2E-01
- 1. 7E-01
- 1. GE+OO zov Opr Fail Event Identifier: 353/89-013
B-284 rx. shutdown rx. shutdown/ep pea/trans srv.chall/trans.-scram srv.chall/loop.-scram srv.close emerq. power ep. rec fw/pcs.trans fw/pcs. loca HPCI Branch Model:
1.OF.1 Train 1 Cond Prob:
RCIC Branch Model:
1.OF.1 Train 1 Cond Prob:
crd srv. ads ipcs Ipel (rhr) /lpcs rhr (sdc) rhr(sdc)/-lpci rhr (sdc) /lpci rhr(spcool)/rhr(sdc) rhr (spcool) /-lpc. rhr Csdc) rhr~spcool) /lpci.rhr(sdc) rhrsw 3.OE-05
- 3. 5E-04 1.7E-01 1.OE+00
- 1. OE+00
- 4. 6E-02 1.3E-02
- 4. 9E-02
- 4. 6E-01
- 1. OE+00 2.9E-02 > l.0E+00 2.9E-02 > Failed 6.OE-02 > l.0E+00 6.OE-02 > Failed
- 1. OE-02 3.7E-03 3.0E-03 l.OE-03 2.1E-02
- 2. 0E-02
- 1. OE+00 2.OE-03 2.06-03 9.3E-02 2.06-02
- 1. 06+00
- 1. OE+00
- 1. OE+00
- 1. OE+00 1.OE+00
- 1. 06+00 B.06-01
- 1. OE+00 3.4E6-01 3.4E-01
- 7. OE-01 7.OE-01
- 1. 0E+00 7. IE-01 3.4E6-01
- 7. IE-01 3.4E-01
- 3. 4E-01
- 1. 06+00 3.4E6-01 3.4E-O1
- 1. 06+00 3.4E-01 1.0 6-02 1.OE-02 1.OE-03 1.06-03 1.06-03 2.0E-03
- branch model file
- forced Minarick 0 6-12-1990 0 9:16" 53 Event Identifier: 353/89-013