ML20154M587
| ML20154M587 | |
| Person / Time | |
|---|---|
| Site: | Crane  |
| Issue date: | 10/16/1998 |
| From: | Colburn T NRC (Affiliation Not Assigned) |
| To: | Langenbach J GENERAL PUBLIC UTILITIES CORP. |
| References | |
| NUDOCS 9810200340 | |
| Download: ML20154M587 (22) | |
Text
-_ _
.__._.__.___._.-__-.m
~
October 16, 1998 Mr. James W. Langenbach, Vice President and Director, TMI-1 GPU Nuclear, Inc.
P.O. Box 480 Middletown, PA 17057
SUBJECT:
REVIEW OF PRELIMINARY ACCIDENT SEQUENCE PRECURSOR ANALYSIS OF CONDITION AT THREE MILE ISLAND NUCLEAR STATION, UNIT NO.1
Dear Mr. Langenbach:
Enclosed for your information is a copy of the final Accident Sequence Precursor (ASP) analysis of the operational event at the Three Mile Island Nuclear Station, Unit 1 (TMI-1) reported in Licensee Everit Report (LER) Nos. 289/97-007, -008, and -010. This final analysis (Enclosure 1) was prepared by our contractor at the Oak Ridge National Laboratory (ORNL), based on review and evaluation of your comments on the preliminary analysis and comments received from our independent contractor, Sandia National Laboratories (SNL). Enclosure 2 contains our responses to your specific comments. Our review of your comments employed the criteria contained in the material which accompanied the preliminary analysis. The results of the final analysis indicate that this event is a precursor for 1997.
Please contact me at (301) 415-1402 if you have any questions regarding the enclosures. We recognize and appreciate the effort expended by you and your staff in reviewing and providing comments on the preliminary analysis.
Sincerely, Oriainal sianed by Timothy G. Col 6um, Sr. Project Manager Project Directorate 1-3 Division of Reactor Projects - 1/11 Office of Nuclear Reactor Regulation l
Docket No. 50-289
Enclosure:
As stated cc w/ encl: See next page DISTRIBUTION i
Docket File?
OGC b,k;I PUBL!C ~
ACRS PDI-3 r/f CHehl, RI JZwolinski MBoyle TClark '
PReilly, AEOD TColbum DOCUMENT NAME: G:\\colburn\\tmilasp.ltr To receive a copy of this document, indicate in the box:
"C" - Copy without attachment / enclosure "E"-Copywithattachment/knc/osure "N" - No copy 0FFICE P01 3/PM fl[og/ l PDI-3/LA j M, l$ PDh3/0V,$V l
l l
NAME TColburn TClark (/ G V CThomah i
DATE JD / /6 /98 lD / f.T /98
%) / !b /98 OfflCIAL RECORD COPY kn d d
- d. f N h C
-1 9810200340 981016 n?;h) 0 k.ji.:
'D 7 N
f
[tyd PDR ADOCK 05000289 S
PDR 1
l;.
J.Langenbach Three Mile Island Nuclear Station, Unit No.1 cc:
l Michael Ross Robert B. Borsum Director, O&M, TMI B&W Nuclear Technologies GPU Nuclear, Inc.
Suite 525 t
P.O. Box 480 -
1700 Rockville Pike Middletown, PA 17057 Rockville, MD 20852 l
. ' John C. Fomicola William Domsife, Acting Director Director, Planning and Bureau of Radiation Protection Regulatory Affairs Pennsylvania Department of GPU Nuclear, Inc.
Environmental Resources l
100 Interpace Pastway '
P.O. Box 2063 Parsippany, NJ 07054 Harrisburg, PA 17120 Jack S. Wetmore Dr. Judith Johnsrud l
Manager, TMI Regulatory Affairs National Energy Committee GPU Nuclear, Inc.
- P.O. Box 480 433 Orlando Avenue Middletown, PA 17057 State College, PA 16803 Emest L. Blake, Jr., Esquire Peter W. Eselgroth, Region I
' Shaw, Pittman, Potts & Trowbridge U.S. Nuclear Regulatory Commission 2300 N Street, NW.
475 Allendale Road Washington, DC 20037 King of Prussia, PA 19406 Chairman Board of County Commissioners of Dauphin County Dauphin County Courthouse Harrisburg, PA 17120 Chairman Board of Supervisors of Londonderry Township R.D. #1, Geyers Church Road Middletown, PA 17057 Wayne L. Schmidt Senior Resident Inspector (TMI-1)
U.S. Nuclear Regulatory Commission P.O. Box 21g Middletown, PA 17057 Regional Administrator Region l l
U.S. Nuclear Regulatory Commission
' 475 Allendale Road King of Prussia, PA 19406
LER Nos. 289/97-007, -008, -010 LER Nos. 289/97-007,-008, -010 Event
Description:
Failure of both generator output breakers causes a LOOP Date of Event: June 21,1997 Plant: Three Mile Island, Unit 1 Event Summary Three Mile Island, Unit I (TMI 1) was at 100% power when the plant experienced a loss of offsite power (LOOP) after both generator output breakers in the 230-kV substation failed.3 The LOOP resulted in an immediate trip of both the reactor and the turbine; plant computer data indicated that the trip insertion times were excessive for four control rods.2 Both emergency diesel generators (EDGs) staned and loaded as designed. Offsite power was restored within 90 min. The unit was cooled by natural circulation cooling until offsite power and forced cooling were restored. It was subsequently discovered that the pressurizer power-operated relief valve (PORV) was failed closed during this event (see Additional Event-Related Information).8 The estimated conditional core damage probability (CCDP) for this plant-centered LOOP is 9.6 x 104 i
Event Description TMI 1 was at 100% power after almost 617 d of continuous operation. On June 21,1997, the B phase of the 230-kV generator output breaker GBI-02 (Fig.1) developed a fault causing severe overheating and the subsequent ejection of the bushing and conductor from the breaker housing. This resulted in a fault being detected on 230-kV bus 4. The parrilel generator breaker, GBI 12, opened because of the detected fault on 230-kV bus 4. Breaker GBI-12 subsequently suffered a restrike, which damaged the B phase of this breaker, causing a fault on 230-kV bus 8. Automatic breaker action because of both faults isolated electric power to the station, resulting in a LOOP.'
The LOOP caused an immediate reactor trip and turbine trip. The plant computer captured times associated with each control rod reaching the 25% zone reference as the reactor trip occurred. A review of the data showed that four control rods exceeded the trip insertion time limit of 1.66 s for % insenion. Personnel attributed the slow insertion times to reduced clearances in the old-style control rod drive thermal barriers because of the presence of deposits on the internal check valves, between the thermal barrier bushing, and on the leadscrew. All control rods inserted to the % insertion position within 3.0 s. The licensee determined that there would be no adverse effects associated with control rod insertion times as high as 3.0 s (Ref. 2).
Both EDGs started and loaded onto their respective safeguards bus as designed. Nomital loads, including main feedwater, condensate, circulating water, and main condenser vacuum pumps, were not energized. The reactor coolant pumps were also without power. Natural circulation was verified in the reactor coolant system within 19 min following the trip and LOOP. Decay heat removal was established using the emergency feedwater (EFW) system and the steam generator atmospheric dump valves. Offsite power was restored within 90 min 1
LER Nos. 289/97-007, -008, -010 after the breaker failures. After operators established the main condenser heat sink, the reactor coolant pumps were restarted. The reactor coolant system was returned to forced circulation cooling ~9 h after the unit trippec'.'
Additional Event-Related Information TM1 1 has a single PORV installed on the pressurizer that is replaced with a spare PORV during each refueling outage. The licensee discovered that during the previous refueling outage, the PORV was wired incorrectly and was subsequently inoperable for the entire operating cycle. The PORV was failed in the closed position and would not have opened in response to an automatic (2450 psig) or a manual signal.8 The operating cycle completed with a failed PORV encompassed the LOOP event described by Refs. I and 2.
Besides the PORV, there are two safety relief valves connected to the pressurizer with a nominal reliefsetpoint of 2500 psig. The shutoff head of the safety injection pumps is ~2900 psig. Feed-and-bleed operation is possible with an inoperable PORV because the safety relief valves can be lifted with the head established by operating the safety injection pumps.'
TMI 1 has two dedicated EDGs (I A and IB) to supply electric power to engineered safeguards buses ID and IE, respectively, in the event of a LOOP. Additionally, one EDG previously from TMI 2 is available as ar.
alternate ac power source during a station blackout (SBO). The alternate EDG, which is manually started from the control room, can be aligned to either engineered rafeguards bus ID or 1E or the balance-of-plant bus 1C within 10 min following an SBO. Operators must close two breakers and open/ lockout two breakers, and any desired loads must be manually loaded onto the bus selected to be reenergized.'
Modeling Assumptions This event was modeled as a plant-centered LOOP. The probability ofnot recovering offsite mwer in the short term is included in the initiating event probability (IE LOOP). That is, the probability ofa L 00P is 1.0. The probability that offsite power is not recovered in ~30 min is 0.5, based on the data distributions prosided in NUREG-1032, Evaluation ofstation Blackout Accidents atNuclearPowerPlants.' Consequently, IE-LOOP was set to the probability for a plant-centered LOOP assuming operators fail to recover offsite power in the 4
short term (5.0 x 10 ).
The probability of short-term and long-term offsite power recovery for a plant-centered LOOP and the probability of a reactor coolant pump (RCP) seal loss-of-coolant accident (LOCA) following a postulated station blackout were developed based on data distributions contained in NUREG-1032. The RCP seal LOCA models are developed as part of the NUREG-1150 probabilistic risk assessment (PRA) efforts. Both models are described in RevisedLOOP Recovery andPWR SealLOCA Models.' The probabilities for the following basic events are based on these models:
- 1. initiating event-LOOP (IE-LOOP),
- 2. operator fails to recover offsite power within 2 h (OEP-XHE-NOREC-2H),
- 3. operator fails to recover offsite power within 6 h (OEP-XHE-NOREC-6H),
2 f
I
+
i LER Nos. 289/97-007,-008,-010
- 4. operator fails to recover offsite power before battery depletion (OPE-XHE-NOREC-BD),
- 5. operator fails to recover offsite power before RCP seals fail (OPE-XHE-NOREC-SL), and
- 6. RCP seals fail without cooling and injection water (RCS-MDP-LK-SEALS).
De PRA for TMI 1 indicates that an SBO with a concurrent failure of EFW would lead to core damage in approximately 2 h (Ref. 7, Table B.1-11, page B.1-25). This indicates that substantial time is available for the recovery of electric power. Potential recovery actions were modeled (using NUREG-1032) by the addition of a basic event (OEP-XHE-NOREC-SB) under the OP-SBO top event (OP-2H) on the LOOP event tree (Fig. 2). Top event OP-SBO is substituted for the OP-2H top event whenever emergency power (EP) and EFW fail.
The alternate EDG (from TMI 2) was added to the Integrated Reliability and Risk Analysis System (IRRAS) 1 model for TMI 1.
He probability that the alternate EDG fails' to start and run (basic event EPS-DGN-FC-AAC) was set to the same value as the dedicated EDGs (4.2 x 10-2). In addition, because operators must start and load the alternate EDG manually, a basic event was added to reflect the probability that the operator fails to start and load the alternate EDG (basic event EPS-XHE-XM-AAC). Basic event EPS-XHE-XM-AAC was set at 1.0 x 102 in accordance with similar human error probabilities already incorporated in the IRRAS model for TMI. The common-cause failure probability of the emergency power system for the base case was based on two EDGs. This was adjusted based on the availability of three EDGs and was developed based on data distributions contained in INEL-94-0064, Common-Cause Failure Data Collection and Analysis System (Ref. 8, Table 5-8: alpha factor distribution summary - fail to start, CCCG = 3, a33 = 0.0224; and Table 5-11: alpha factor distribution summary - fail to nm, CCCG = 3, a3a = 0.0232). Because a 3 s equivalent to the factor of the multiple Greek letter method used in the IRRAS i
models, the common-cause failure probability of the EDGs (basic event EPS-DGN-CF-ALL) was adjusted from 1.6 x 10 8 based on two EDGs to 9.5 x 10d based on three EDGs.
The slow hsertion offour reactor control rods was not considered in the model. The control rods inserted well within the time (3.0 s) that the licensee calculated to be limiting. Additionally, all but four control rods met l
the % insertion time prescribed by the Technical Specifications.
Because the PORV was inadvertently disabled during the operating cycle that encompassed the LOOP event, the probability that the PORV fails to open on demand (basic event PPR SRV-CC-PORV) was set to ' TRUE" (i.e., will not open). Two additional basic events were added to the IRRAS model to account for the availability of the safety reliefvalves to relieve any pressure buildup (basic events PPR-SRV-CC-1 A and PPR-SRV-CC-1B). The probability that a safety reliefvalve would feil to open when its setpoint was reached was set to the nominal failure rate for the PORV (see Table 1). Additioeally, the operator would only need to verify that the high-pressure injection (HPI) pumps started in a situation that required feed-and-bleed cooling to remove decay heat; no other action regarding the PORV or the safety relief valves is required from the operators. Herefore, the probability that the operator fails to initiate feed-and-bleed cooling (basic event HPI-XHE-XM-HPICL) was seduced from 1.0 x 10 2to 1.0 x 10.
Analysis Results 3
I LER Nos. 289/97-007, -008, -010.
I De CCDP for this event is 9.6 x l'0. De dommant core damage sequence for this event (sequence 26 on Fig.
l 4
- 2) involves a LOOP, e
l a successful reactor trip, a failure of emergency power, a successful initiation of emergency feedwater, I
no challenge to the PORV (failed) or pressurizer safety relief valves, a failure of the reactor coolant pump seals, and a failure to restore electric power before core damage.
His SBO sequence (sequence 26 on Fig. 2) accounts for 85% ofthe total contribution to the CCDP. He next most daminant sequence (sequence 41 on Fig. 2) contributes 11% to the total CCDP. This sequence involves -
an S'30, a failure of the EFW system, and a failure to recover any form of electrical power before the onset of core damage.
All of the most significant sequences involve an SBO. He nominal probability that a PORV is challenged during a LOOP or an SBO is 0.16 and 0.37, respectively, based on actual LOOP and SBO events. However, the PORV failure diminished those sequences where the PORV could potentially have lifted and then failed to rescat. Basic events PPR-SRV-CO-L and PPR-SRV-CO-SBO (defined in Table 1) were set to 5.0 x 10 ' and 5.4 x 10 2, respectively (i.e., the PORV will not open, but the safety valves are challenged) based on Integrated Plant Examination (IPE) data. Because the safety relief valves have a higher set point than the PORV, they may or may not hsve lifted in place of the PORV. However, the safety valves were assumed to lift during feed-and-bleed operation.
Defmitions and probabilities for selected basic events are shown in Table 1. The conditional probabilities associated with the highest probability sequences are shown in Table 2. Table 3 lists the sequence logic associated with the sequences listed in Table 2. Table 4 describes the system names associated with the dommant sequences. Minimal cut sets associated with the dommant sequences are shown in Table 5.
Acronyms CCDP conditional core damag; probability CDP core damage probability EDG emergency diesel generator EFW emergency feedwater system HPI high-pressure injection IPE integrated plant exammation IRRAS Integrated Reliability and Risk Analysis System kV kilo-Volt LOCA loss-of-coolant accident LOOP loss ofoffsite power MOV motor-operated valve 4
LER Nos. 289/97-007,-008, -010 PORV power operated relie'f valve PRA probabilistic risk assessment RCP reactor coolant pump SBO station blackout SGTR steam generator tube rupture SLOCA small loss-ofcoolant accident TMI1 Three Mile Island, Unit 1 TRANS transient event References
- 1. LER 289/97-007, Rev. O, " Generator Output Breaker Failure Resulting in a Loss of Off-Site Power and Reactor Trip," July 21,1997.
- 2. LER 289/97-008, Rev. O, " Control Rod Trip Insertion Times Exceed TS Section 4.7.1.1 Limits," July 21, 1997.
- 3. LER 289/97-010, Rev. O, " Pilot Operated Relief Valve (PORV) Inoperability Due to Being Mis-Wared and Failure to Perform Post-Maintenance Test (PMT) Following Replacement During IIR Refueling Outage," November 12,1997.
- 4. Three Mile Island, Final Safety Analysis Report (Updated nrsion).
S. P. W. Baranowsky, Evaluation ofStation Blackout Accidents at Nuclear Power Plants, NUREG-1032, U. S. Nuclear Regulatory Commission, June 1988.
- 6. RevisedLOOP Recovery andPWR SealLOCA Models, ORNUNRCILTR.-89111, August 1989.
- 7. Three Mile Island Unit 1, Probabilistic Risk Assessment (Level 1), December 1992.
- 8. Marshall and Rasmuson, Common-Cause Failure Data Collection andAnalysis System,1NEL-94/0064, December 1995.
t 5
'l i
LER Nos. 289/97-007, -008, -010 j
---+ I A oux
^
- 8 230-kV bus transformer i
- Unit 2 GBl-12 109102 109202 1B-02 i
1A Mddletown h
500 kV 925102
]
substation Mddetown junction generato,.
1B M
Jockson 4
junction 4
transforners m2 109112 105102 IB-12
- Unit 2 l
i
- 4 230-kVbus 1B oux
,- transformer l
I' l
l Fig.1 Three Mile Island switchyard.
t j
6 i
l.
LER Nos. 289/97-007, -008, -010 1
ll 555585885885585888855858888855858888558888
--......s::::: st:: a unnananas aaa aana na aese E
1il j ggl {
i[li j llii j Ill! !
4 fl f ill 1
1111:
s iIll :
l 11ll :
a 5
l 8I5 h
g I
2 lI s
I a: o i I E[
$i
! k l
'II -
t 8
~
l lt1 i ll1 !
l Fig. 2 Dominant core damage sequence for LER Nos. 289/97-007, -008, -010.
7 l
LER Nos. 289/97-007,-008,-010 Table 1. Definitions and Probabilities for Selected Basic Events for LER Nos. 289/97-007,-008,- 010 Modified Event Base Current for this name Description probability probability Type event E-LOOP Initiating Event-LOOP (Includes 8.6 E406 5.0 E-001 Yes the Probability ofRecovering Offsite Power in the Short Term)
E-SGTR Initiating Event-Steam Generator 1.6 E-006 0.0 E+000 Yes Tube Rupture E-SLOCA Initiating Event-Small Loss-of.
1.0 E-006 0.0 E+000 Yes Coolant Accident (SLOCA)
IE-TRANS Initiating Event-Transient 1.3 E 004 0.0 E+000 Yes (TRANS)
EFW-TDP-FC-TDP EFW Turbine-Driven Pump Fails 3.2 E-002 3.2 E-002 No EFW-XIE-NOREC-EP Operator hils to Recover EFW 3.4 E401 3.4 E-001 No during an SBO EPS-DGN CF-ALL Common-Cause Failure of EDGs 9.5 E 004 9.5 E-004 No EPS-DON FC-1 A lA EDG Fails to Start and Run 4.2 E-002 4.2 E-002 No EPS-DON-FC-1B 1B EDG Fails to Start and Run 4.2 E-002 4.2 E-002 No EPS-DGN-FC-AAC Alternate ac EDO Fails to Start 4.2 E-002 4.2 E-002 NEW No and Run EPS-XIE-NOREC Operator Fails to Recover 8 0 E 001 8.0 E-001 No Emergency Power EPS-XIE XM-AAC Operator Fails to Start or Load 1.0 E402 1.0 E-002 NEW No the Altemate ac EDO OEP-XIE-NOREC-2H Operator Fails to Recover OfTsite 2.2 E-001 1.4 E-001 Yes Power within 2 h OEP-XHE-NOREC-6H Operator Fails to Recover Offsite 6.7 E-002 9.9 E-004 Yes Power within 6 h OEP-XHE-NOREC-BD Operator Fails to Recover OfTsite 2.4 E-002 3.5 E-004 Yes Power before Battery Depletion OEP-XIE-NOREC SB Operator Fails to Recover Electric 2.3 E-001 2.3 E-001 NEW No Power before Core Damage (No Electric Power or EFW)
OEP XIIE.NOREC-SL Operator Fails to Recover Offsite 5.7 E-001 4.8 E-001 Yes Power before RCP Seals Fail 8
l l
l
1 LER Nos. 289/97-007,-008,-010 Table 1. Definitions and Probabilities for Selected Basic Events for LER Nos. 289/97-007, -008, -010 (Continued)
Modified Event Base Current for this name Description probability probability Type event PPR SRV-CC 1A Safety Relief Valve lA Fails to 63 E 003 63 E-003 NEW No Open on Demand PPR-SRV-CC-1B Safety Relief Valve IB Fails to 63 E-003 63 E 003 NEW No Open on Demand PPR-SRV-CC PORY PORV Fails to Open on Demand 63 E-003 1.0 E+000 TRUE Yes PPR-SRV CO-L PORV Fails to Open, but Safety 1.6 E-00I
$.0 E@3 Yes Valves Challenged during a LOOP PPR-SRV-OO-SBO PORV Fails to Open, but Safety 3.7 E-001 5.4 E-003 Yes Valves Challenged during an SBO RCS-MDP-LK-SEALS RCP Seals Fail without Cooling 4.6 E-002 4.0 E-002 Yes andInjection 9
I.
I 1
LER Nos. 289/97-007, -008, -010 Table 2. Sequence Conditional Probabilities for LER Nos. 289/97-007,-008,-010 Conditional Event tree Sequence core damage Percent name number probability contribution (CCDP)
LOOP 26 8.2 E-006 85.0 LOOP 41 1.1 E-006 10.8 LOOP 19 1.5 E-007 1.5 Total (all sequences) 9.6 E-006
',/*-
g 4
Table 3. Sequence Logic for Dominant Sequences for LER Nos. 289/97-007,-008,-010 Event tree name Sequence Logic number LOOP 26
/RT-L, EP, /EFW L, /PORV-SBO, SEALLOCA., OP-SL LOOP 41
/RT-L, EP, c.FW-EP, OP-SBO LOOP 19
/RT-L, EP, /EFW-L, /PORV-SBO,
/SEALL OCA, OP-BD 10 I
l
- l. *.
LER Nos. 289/97-007, -008, -010 1
I l
l l
Table 4. System Names for LER Nos. 289/97-007,-008,-010 System name Logic EFW-EP No or Insufficient EFW Flow during an SBO EFW-L No or Insufficient EFW Flow during a LOOP EP Failure of Both Trains of Emergency Power OP-BD Operator Fails to Recover Off Site Power before Battery Depletion OP-SBO Operator Fails to Restore ac Power before Core Damage Occurs Following an SBO ud Loss of EFW OP-SL Operator Fails to Restore ac Power 1:efore a Reactor Coolant Pump Seal LOCA Occurs PORV-SBO PORV/ Safety Relief Valves Challenged during ar. SBO RT-L Reactor Fails to Trip during a LOOP SEALLOCA Reactor Coolant Pump Seals Fail during a LOOP i
l i
j 11 L
LER Nos. 289/97-007, -008, -010 Table 5. Conditional Cut Sets for Higher Probability Sequences for LER Nos. 289/97-007, -008, -010 Cut set Percent numbe contribution CCDP' Cut sets Lt. > v Sequence 26 8.2 E-006 8 71
?,fA
+
1 91.2 7.5 E-006 EPS-DGN-CF-ALL, EPS-XIE-NOREC, RCS-MDP-LK-SEALS, OEP-XIENOREC-SL 2
7.1 5.8 E-007 EPS-DGN-FC-1 A, EPS-DGN-FC-1 B, EPS-DGN-FC-AAC, EPS-XIE-NOREC, RCS-MDP-LK-SEALS, OEP-XIE-NOREC-SL i
3 1.7 1.4 E-007 EPS-DON-FC-1 A, EPS-DGN-FC-1B, EPS-XIE-XM-AAC, EPS-XIE-NOREC, RCS MDP-LK-SEALS, OEP-XHE-NOREC-SL
~
T m;W-
.~
LOOP Sequence 41 1.1 E-006 1
91.1 9.6 E-007 EPS-DGN-CF-ALL, EPS-XIENOREC, EFW-TDP-FC-TDP, EFW-XIENOREC-EP,OEP XHE-NOREC-SB 2
7.1 7.5 E-008 EPS-DGN-FC-1 A, EPS-DON-FC 1B, EPS-DGN-FC-AAC, EPS-XIE-NOREC, EFW-TDP-FC-TDP, EFW-XHE-NOREC-EP, OEP-XHE-NOREC SB J
3 1.7 1.8 E-008 EPS-DGN-FC-1 A, EPS-DGN-FC-1 B, EPS-XHE-XM-AAC, EPS-AHE-NOREC,EFW-TDP-FC TDP,EFW-XIE-NOREC-EP, 4
i j
OEP-X1E-NOREC-SB
-['?/,_~.
~
~
LOOP Sequence 19 1.5 E-007 4
g I
91.2 1.3 E-007 EPS-DGN-CF-ALL, EPS-XIE-NOREC, OEP-XIENOREC-BD 2
7.1 1.0 E-008 EPS-DGN-FC-1 A, EPS-DGN-FC 1B, EPS-DGN-FC-AAC, EPS-XIE-NOREC, OEP X1E-NOREC-BD 3
1.7 2.5 E-009 EPS-DGN-FC-1 A, EPS-DGN-FC-1B, EPS-XIE XM-AAC, i
EPS-XIE-NOREC, OEP-XIE-NOREC-BD Tote.1 (all sequences) 9.6 E-006
[
_ h ' * ' a;2
/*'
'The conditional probabilit" for each cut set is determined by multiplying the probability of the initiating event by the probabilities of the basic events in that minimal cut set. The probabilities for the initiating events and the basic events are given in Table 1.
12
l L
l.
LER Nos. 289/97-007,-008,-010 l
LER No. 289/97-007, -008', -010 Event
Description:
Failure of both generator output breakers causes a LOOP Date of Event: June 21,1997 Plant: Three Mile Island, Unit 1 Licensee Comments
Reference:
Letter from James W. Langenbach, Vice President and Director, TMI, to U. S. Nuclear Regulatory Commission, "OPU Nuclear Review ofPre*inunary Accident Sequence Precursor Analysis of Operational Event at Three Mile Island Nuclear Station, Unit No.1," May 1, 1998.
Comment la: Page 1, under Event Summary, the fifth sentence states, "The unit wu cooled by natural circulation cooling until offsite power was restored." Tnis sentence should state, "The unit was cooled by natural circulation cooling until offsite power and forced cooling were restored." Per LER 97-009 pages 4 and 5, it took 1.5 h for offsite power to be restored.
Another 7.5 h passed before forced cooling (RC-P-1 A/B/C/D) was restored.
Response la: The proposed editorial change was made. This has no effect on the analysis results, but more accurately reflects the sequence of events depicted in the time line outlined in LER 97-009, pages 4 and 5.
Comment 1b: Page 1, under Event Description, first paragraph, the second sentence states,"On June 21,1997, the B phase of the 230-kV power transformer developed a fault causing severe overheating and the subsequent ejection of the bushing and conductor from the breaker housing of output breaker GBI-02 (Fig.1)." This sentence should state "On June 21,1997, the B phase of the 230-kV generator output breaker GBI-02 (Fig.1) developed a fault causing severe overheating and the subsequent ejection ofthe bushing and conductor from the breaker l
housing." Per LER 97-007, there is no evidence that the fault location was in the power transformer.
Response Ib: The proposed editorial change was made. This has no effect on the analysis results.
1 i
1
I LER Nos. 289/97-007,-008,-010 i
Comment Ic: Page 1, under Event Description, second paragraph, second to the last sentence states, "All control rods insened to % insertion position within 2.2 s." This sentence should state, "All control rods inserted to the % insenion position well within 3.0 s." Per LER 97-008 there is no claim made that at the time of the reactor trip that all control rods inserted to the % position within 2.2 s. The only claim is that retested rods came in at less than 2.2 s. The LER does indicate that the rods did insen to the % position well within 3.0 s at the time of the reactor trip.
1 Response Ic: He sentence was changed to, "All control rods insened to the % insertion position within 3.0 s." LER 97-008 only indicates that rod insertion times were below 3.0 s without quantifying any specific rod drop times during the reactor trip. Therefore, the times were not categorized as being "well below 3.0 s." This has no effect on the analysis results.
l Comment Id: Page 1, under Event Description, third paragraph, second sentence states, "Nomital loads, including circulating water and main condenser vacuum pumps, were not energized." This sentence should state, "Nomital loads, including main feedwater, condensate, circulating water, and main condenser vacuum pumps, were not energized." The more importar t non-vital loads pm MR 97-007 page 2 were omitted from the event description.
j Response Id:
The p~ oposed editorial change was made. This has no effect on the analysis results, but more r
accurately reflects the scope of major loads lost following the LOOP event.
Comment le: Page 2, under Event Description, last paragraph, last sentence states, "After the operators l
established the main condenser heat sink, the reactor coolant pumps were restarted, returning l
the reactor coolant system to forced circulation cooling." This should state, "After the operators established the main condenser heat sink, the reactor coolant pumps were restarted.
Since the natural circulation cooling of the reactor coolant system was stable, the reactor coolant system was not returned to forced circulation cooling until nine hours after the reactor trip."
Response 1e: LER 97-007 does not indicate that the delay was based on the stability of natural circulation cooling. The last two sentences were changed to, "After operators established the main i
condenser heat sink, the reactor coolant pumps were restaned. He reactor coolant system 2
l
1 LER Nos. 289/97-007,-008,-010 t
was returned to forced circulation cooling ~9 h after the unit tripped." This has no effect on the analysis results.
1 Comment 1f: Page 6, Fig.1; change breaker identification from IB-14 to IB-12 perGilbert/
Commonwealth drawing 229-002.
Response If: The proposed figure change was made. This has no effect on the analysis results.
Comment 2a: Page 2, under Additional Event-Related Information, the first and second paragraphs are considered to place too much emphasis on the PORV being inoperable. The reactor coolant system pressure did not approach the PORV set point at any time during the LOOP event.
Therefore, the PORV being inoperable was not a factor during the LOOP event.
Response 2a: The ASP Program deals with the probability that the PORV set point may be reached following any LOOP event or that feed-and-bleed cooling operations may be required if
- emergency feedwater were to fail. In a generic analysis, cut sets would exist in the analysis output indicating that the PORV had opened. However, to correctly model this specific event, the basic event governing the PORV opemng needed to be set to TRUE (would not open).
Some discussion was required to establish the basis for this basic event change. Because these two paragraphs provide essentially all of the information on the inoperable PORV (there is one sentence under Modeling Assumptions), no change in the PORV discussion was made in the analysis.
Comment 2b: Page 2, under Additional Event-Related Information, last paragraph, the second and third sentences state, " Additionally one EDG from TMI 2 is available as an alternate ac power source during a station blackout (SBO). The alternate EDG, which is manually started from the control room, can be aligned to either engineered safeguards bus 1 D or 1E within 10 min following an SBO." These sentences more correctly should state, " Additionally, one EDG previously from TMI 2 is available as an alternate ac pcwcr source during a station blackout (SBO). The alternate EDG, which is manually staned from the control room, can be aligned to either engineered safeguards bus 1D or 1E or balance ofplant (BOP) bus 1C within 10 min following an SBO."
Response 2b: The proposed editorial changes were made. This has no effect on the analysis results.
3
a
.a
+
a u
.a ma-..
.ww
.+..-a.
x-.
r-s,.n u n s
.a n_.
l t
LER Nos. 289/97-007,-008,-010 l
Comment 2c: Page 2, under Additional Event Related Information, last paragraph, last sentence, states,
" Operators must close two breakers and any desired loads must be manually loaded onto the bus selected to be reenergized." His sentence should state, " Operators must close two breaken s and open/ lockout two breakers, and any desired loads must be manually loaded onto the bus selected to be reenergized." Per abnormal procedure 1202-2, the operator must open/ lockout two breakers in addition to closing two breakers to correctly elign the SBO diesel with bus ID or IE.
i Response 2c: The prop > sed editorial changes were made. This has no effect on the analysis results because i
the operstor response was not considered on a breaker by breaker basis. He response was simply assumed to be a procedure-based action with a nominal probability of failure to perform the procedure of 1.0 x 10, which is consistent with similar operator responses.
4 Comment 3a: (1) Page 3, first paragraph should give a reference for the reliability value used for OEP-XHE-NOREC-SB in Table 1 [of the preliminary analysis).
(2) The two events described in Table 1 ofthe preliminary ASP analysis, Er'S-XHE-NOREC (Operator fails to recover emergency power) and OEP-XHE-NOREC-SL (Operator fails to recover offsite power before RCP seals fail), should be replaced by the non-recovery values REA and REC given in Table B.1-12 ofthe Thil IPE [Ref.1]. REA is the nonrecovery factor for SBO sequences in which the Emergency Feedwater (EFW) operates successfully. REC is the nonrecovery factor for SBO sequences in which EFW does not operate successfully.
Both REA and REC were evaluated under the assumption that at least two EDGs are recoverable.
(3) REA and REC were calculated by hionte Carlo simulation techniques as described in Sect. B.I.3.4 of the Thil IPE. Recovery of the Thil 2 EDG was not credited in the simulation. The result of the simulation shows that if EFW is unavailable, the mean time to core uncovery is 3.4 h; 10.3 h if EFW is available. He time interval of 2.1 h to core uncovery mentioned in the IPE was used as input to the STADIC code and was assumed to occur after a loss of all ac power. The STADIC model did not assume that all onsite ac power would fail at time t = 0 when offsite power is lost. In other words, the time to core uncovery was assessed in the IPE (page B.1-16) as the time of onsite power failure, plus 2.1h.
t 4
.g LER Nos. 289/97-007,-008.-010 Response 3a: (1) The text reference to the basic event OEP-XHE-NOREC-SB on page 3 of the analysis was changed to, " Potential recovery actions were modeled (using data from NUREG-1032) by the addition of a basic event (OEP-XHE-NOREC-SB) under the OP-SBO top event (OP 2H) on the LOOP event tree (Fig. 2)."
(2) In the SBO sequences, the probability of a reactor coolant pump seal LOCA and the probability of failing to recover ac power at various points in time are calculated using a convolution approach that recognizes that all probabilities are a function of time. A Weibull 1
distribution is used to predict the LOOP-related paramders applicable for TMI as defined in I
ORN11NRC/LTR-89/11 (Ref. 2). Probabilities associated with the failure to recover ac power and the potential for an RCP seal LOCA are calculated given that ac power was not restored in the short term (30 min). Additionally, the probability for the operator failure to restore emergency power is based on the assumption that the median repair time for an EDG is 4 h, as developed in NUREG-1032. The TMI IPE split fractions, REA and REC, are based on different assumptions concerning LOOP and EDG recovery as a function of time. The j
electric power recovery analysis described in Appendix B.1 to the TMI IPE imbedded the potential for an RG gal loss-of-coolant accident (LOCA) within the calculation of REA and
~
REC, and did not separately address the potential for short-and long-term recovery of ac power. Because basic events EPS XHE-NOREC and OEP-XHE-NOREC-SL in the IRRAS model do not represent the same ecnditional probability that split fractions REA and REC represent, the free substitution ofindividual split fractions from the IPE into the IRRAS model is inappropriate without making further adjustments to the other LOOP-related parameters in the IRRAS model.
(3) The ASP IRRAS models do not currently simulate the potential for a delayed failure of i
EFW. EFW is assumed to asentially hil at event t = 0, and the time to core damage under l
station blackout was assumed to be 2.1 h per Sect. B.I.3.3.3 of the TMI IPE.
1 Comment 3b: In general, the probabilities for failure of restoration of offsite power, onsite emergency power, and reactor coolant pump seals may be reduced from those assumed in the analysis because operators have the following procedures listed below for guidance. Also, the June 21, 1997, event was successful in that offsite power was restored in 90 min, emergency onsite sources started and loaded as designed, and there was no RCP seal damage.
Emergency Procedure 1202-2, Rev. 44," Loss of Station Power,"which was used durmg i
the TMI 1 event, includes steps (3.10 and Attachment 4) for restoring offsite power.
Because of these operator sctions the probability of not restoring offsite power (IE-LOOP) should be lower than 5.0 x 104
[-
i 5
1
_ ~
l L
i LER Nos. 289/97-007,-008,-010 Emergency Procedure 1202 2, Rev. 44, " Loss ofStation Power, which was used during the TM11 event, includes steps (3.11 and Attachment 1) for starting and loading the emergency diesel generators (EDGs), assuming the EDGs did not automatically start and load. In addition, the procedure includes steps (3.12 and Attachment 1) for starting and loading the SBO diesel assuming the Class IE diesel (s) did not automatically start.
Because of these operator actions, the probability of all diesels failing (EPS-DGN-CF-ALL) should be lower than 9.5 x 10d
.. Emergency Procedure 1202, Rev.44, " Loss of Station Power,"which was used during the TM11 event, includes Attachment 2, which may be used to restore reactor coolant pump seals. He restoration would be performed in a controlled manner to limit damage to the seals and pumps ifinjection and intermediate closed cooling water (ICCW) are lost for a long time period. Because of these operator actions, the probability ofRCP seal failure (RCS-MDP-LK-SEALS) should be lower than 4.0 x 10 2, Response 3b: Human response is considered m the numerous system-specific operatornonrecovery probabilities within the TM11RRAS model. The fact that procedural guidance exists is accounted for by die non-recovery probability basic events. The IE-LOOP initiating event represents the probability that ac power is not restored in the short term and is based on historical data gathered on specific categories of LOOP events. The probability of not recovering offsite power in the short term is included in the initiating event probability (IE-LOOP). That is, the probability of a LOOP is 1.0. He probability that offsite power is not recovered in ~30 min is 0.5, based on the data distributions provided in NUREG 1032, Evaluation of Station Blackout Accidents at Nuclear Power Plants.' Consequently, IE-LOOP was set to the probability of failing to recover offsite power in the short term (5.0 x 10 3) following a plant-centered LOOP. The conditional probability that a LOOP is t
not recovered in times greater than 30 min is considered in the calculation ofprobabilities for basic events OEP-XHE NOREC-SB, -SL, and -BD. Hence, the existence of procedural guidance impacts the historical data and subsequently the value calculated for these probabilities.
With respect to the LOOP event at TM1 on June 21,1997, success of specific systems or components does not change the probability that the LOOP could have lasted longer than 90 min and that core damage could occur. Therefore, the original analysis basic event values were not adjusted for the final report based on the existence of numerous emergency procedures.
As noted above, the probability that offsite power is not recovered in ~30 min is 0.5, based on the data distributions provided in NUREG-1032 (Ref. 3). The existence of procedural guidance impacts the historical data and subsequently the value calculated for IE-LOOP. He IPE (Table B.1-5) indicates that the probability that offsite power is not i
I f
6 l
, - +
l f
LER Nos. 289/97-007,-008,-010 recovered in a 30 min is 0.67, which is compatible with the value of 0.5 calculated from the data distributions in NUREG-1032.
l The common-cause failure probability of all three EDGs failing to start and run (EPS-DGN-CF-ALL) is based on data distributions contained in INEL-94-0064, l
Common-Cause Failure Data Collection andAnalysis System (Ref. 4, Table 5-8: alpha l
factor distribution summary - fail to stan, CCCG = 3, a33 = 0.0224; and Table 5-11:
l alpha factor distribution summary - fail to run, CCCG = 3, na = 0.0232]. Because a3 l
is equivalent to the p factor of the multiple Greek letter method used in the IRRAS l
models, the conunon-cause failure probability of the EDGs was adjusted from 1.6 x 10 l
4 based on two EDGs to 9.5 x 10" based on two EDGs and an SBO diesel generator.
(
The probability of an RCP seal LOCA following a postulated SBO event was developed based on data distributions contained in NUREG-1032 and the RCP seal LOCA models that were developed as part of the NUREG-1150 probabilistic risk assessment (PRA) etforts described in Revised LOOP Recovery and PWR Seal LOCA Models.* The probability of an RCP seal failure calculated from this source, assuming power is not t
restored in the short-term (30 min), is 4.0 x 10'2 i
Comment 4:
Based on the variation in the combination of events and modeling e.ssumptions used by the l
NRC in the analysis of the operational event at TMI as described in the preliminary ASP analysis, the estimate of the CCDP of the LOOP was determined to be 9.6 x 10. Using the 4
combination of events and modeling assumptions of the TMl 1 PRA (Level 1) Update, December 1992, " Appendix B - Special Analysis", which gives consideration to both the l.
REA and REC factors, GPU Nuclear estimates the CCDP of the LOOP to be 9.53 x 10 -
4 l
Response 4:
Numerous basic events in the IRRAS model are based on the conditional probability that an ac power source is not reestablished within 30 min. This is the reason, for example, that the initiating event probability (IE-LOOP) is 0.5 although a LOOP actually occurred. The TMl IPE incorporates these time conditional probabilities into split fractions REA and REC.
IE-LOOP would have to be adjusted to 1.0 to accommodr.te the use ofsplit fractions REA and REC Adjusting IE-LOOP would subsequently require numerous other basic events to be I
modified.
l l
As discussed in the response to Comment 3a, the use of a mix of basic event probabilities l
from the TM1 IPE and IRRAS models is not appropriate without accounting for the i
underlying assumptions associated with substituted values. Collapsing the ASP model SBO sequences to two scenarios, one with EFW available and one v.ith EFW failed, and applying -
ac power nonrecovery probabilities equivalent to REA and REC, results in an estimated 4
CCDP of -1.0x 10. This is the CCDP for a " nominal" LOOP using nonrecovery s
7
,__._r
l l
LER Nos. 289/97-007,-008,-010 l
probabilities as described in Appendix B.1 of the TMI I IPE. Because it was not possible to revise REA and REC to reflect the plant-centered nature of the LOOP, it was not possible to l
I directly compare the impact of REA and REC if they were used in the analysis. Since a plant-centered LOOP is more easily recovered than a nominal LOOP, the associated CCDP would be expected to be lower than the estimate for a no:ninal LOOP-typically by a factor of 2-3.
Hence, the plant-centered LOOP at TMI using TMI-developed nonrecovery distributions (from App. B.1 of the TMIIPE) should be in the mid-10 range. The original i
4 I
analysis result, which calculated a CCDP of 9.6 x 10, appears to be a reasonable estimate 4
of the importance of this event.
References:
1
- 1. Three Mile Island Unit 1, Probabilistic Risk Assessment (Level 1), December 1992.
- 2. RevisedLOOP Recovery andPWR SealLOCA Models, ORNLINRCILTR-89111, August 1989.
- 3. P. W. Baranowsky, Evaluation ofStation Blackout Accidents at Nuclear Power Plants, NUREG-l 032, U. S. Nuclear Regulatory Commission, June 1988.
4.
Marshall and Rasmuson, Common-Cause Fallure Data Collection andAnalysis System,1NEL-94/0064, December 1995.
l l
l 8
l