ML20161A178
| ML20161A178 | |
| Person / Time | |
|---|---|
| Site: | Zion File:ZionSolutions icon.png |
| Issue date: | 06/09/2020 |
| From: | Christopher Hunter NRC/RES/DRA/PRB |
| To: | |
| Littlejohn J (301) 415-0428 | |
| References | |
| LER 1988-019-00 | |
| Download: ML20161A178 (6) | |
Text
B-106 Accident Sequence Precursor Program Event Analysis LER No:
Event
Description:
Date of Event:
Plant:
295/88-019 Potential for AFW and CCW pump failure to autostart during LOOP due to anti-pump breaker design deficiency October 25, 1988 Zion Unit 1 Summnary The auxiliary feedwater (AFW) pumps (motor-driven only) and component cooling water (CCW) pumps might not start during a loss of offsite power, and the service water (SW) pumps would lock out inl the case of a "degraded grid voltage" condition.
A design deficiency of the anti-pump feature of the AFW and CCW breaker control circuits would lock out the breakers in the "tripped" condition if an actual LOOP occurred.
With a conditional core damage probability estimate of 1.0 x 10-4, the event is considered significant from an ASP standpoint.
The significance of this event compared with other potential events at Zion is shown below.
IE-8 I E-7 LER 295/88-0 19 I E-6 1E-5 E-41E2 1E-3 1 E-2 I
I Trip AFW Unavail (360 hrs)
L EP Unavail (360 hrs)
Trip w/1 AFW Train Unavail Event Description On Oct. 25, 1988, with Unit 1 at 50% power and Unit 2 in refueling, a review was being conducted of the results of procedure TSS-43, which had been performed on Unit 2.
This procedure confirms the availability of emergency power to ESF components by simulating a loss of offsite power and verifying that the diesel generators correctly start and that ESF components are correctly sequenced onto their respective buses.
B-107 During a review of the test results from TSS-43, it was determined that the auxiliary feed pumps and component cooling pumps might not start up on emergency power as required following a LOOP.
This was determined by examining results of the test for ESF bus 248, which supplies power to the OB component cooling (CC) pump.
During the test, offsite power to bus 248 was removed per the procedure.
OA and OB CC pumps were observed to autostart on low CC header pressure.
This occurrence was per system design, because the low-pressure signal to start CC pumps was received by both pumps.
Since an autotrip signal was also present in the OB pump circuit, it subsequently tripped on undervoltage per the test.
To prevent the breakers from cycling on and off when two signals (auto-close and autotrip) are received concurrently, the 4-ky ESF pump breakers have an "anti-pump" feature that inhibits a close signal until the control switch has been placed in the after-trip position.
In this case, the low header pressure signal cleared because the OA pump had, started.
This cleared the-autostart signal and the OB pump started up on EDC power when sequenced on by the blackout sequence timer because the anti-pumping feature had been reset.
On reviewing the test, it was realized that OA pump had started because it was powered from ESF bus 247, which was not being tested.
During an actual station blackout, both CC pumps would receive signals to start on low pressure concurrent with signals to trip on undervoltage and would lock out due to the anti-pump feature.
As designed, this lockout would not clear even after the EDCs came up to speed and voltage and picked up the ESF bus.
It was *further realized that the auxiliary feed pumps also have an anti-pump device.
With the unit at power, however, a LOOP would result in a reactor trip and turbine trip.
Due to the resulting shrink in SC level, this would cause auxiliary feed to receive the start signal on low-low SC level.
In this case the anti-pump feature would prevent the auxiliary feed pumps from starting.
On Oct. 26, 1988, further investigation showed that a similar problem existed on the service water (SW) system.
The SW pumps would success-fully start on a low-pressure autostart signal coincident with a LOOP, but would be locked out by the anti-pump circuit on a second level undervoltage with low-pressure autostart.
It was noted that Tech Specs and PSAR do not require an autostart of the SW pumps from a second level undervoltage signal, so the SW system was always operable per Technical Specifications.
Numerous factors prevented earlier discovery of the deficiency in this design.
Procedures TSS-35 and TSS-43 are performed at hot shutdown.
For this reason, SC level would never shrink during these tests, provid-ing no opportunity for AFW autostart and subsequent lockout due to anti.-pump.
Since these tests are per.formed on a bus by bus basis, a CC or SW autostart signal on system level or pressure would be cleared by
B-108 the pumps on the other ESF busses, which are not being tested.
This prevented occurrences of CC or SW breaker lockout due to anti-pump cir-cuitry during previous tests.
Event-Related Plant Design Information Zion 1 has two half-capacity motor-driven AFW pumps and one full-capacity turbine-driven AFW pump.
The turbine-driven AEW pump was unaffected by the anti-pump deficiency.
There are two full-capacity CCW pumps.
The SW pumps are not required to auto start on an undervoltage condition.
The AFW, COW, and SW motor-driven pumps could all have been manually started once the control panel switches were placed in pull-to-lock.
The anti-pump feature was designed into these systems as part of the original plant design.
The purpose was to protect the ESF pumps and associated breakers in the event of faults or accident conditions.
ASP Modeling Assumptions and Approach The event has been modeled under the assumption that, had a LOOP occurred, the motor-driven AFW pumps and the CCW pumps would not have autostarted, but that they could have been manually started in the con-trol room [p(non-recovery) =0.04]. Unavailability of the CCW pumps was assumed to result in unavailability of HPI and HPR.
Analysis Results The conditional probability of severe core damage estimated for this event is 1.0 x 10-4 during a 1-yr observation period.
This event is considered significant from an ASP standpoint.
The dominant core damage sequence is a postulated LOOP during the 6132-h vulnerability period (p =0.053), with failure of AFW (p = 0.05) and feed and bleed, and failure to recover AFW and COW (p = 0.04).
This sequence is highlighted on the following event tree.
B-109 LOOP RTIOP E
OEPNCG P
HPIR PORV D~~EPI O~HALL RESEAT A(LN)OE SEQ END NO STATE OK OK 41 CD 42 CD OK OK 43 CD 44 CD 4S CD OK 46 CD 47 Go 48 CD OK 49 CD 50 GD OK 51 CO 52 CD 53 CD OK 54 CD 55 CD 40 ATWS Dominant Core Damage Sequence for LER 295/88-019
B-I 10 CONDITIONAL COPE DAMAGE PROBABILITY CALCULATIONS Event Identifier:
2 95/88-019 Event
Description:
Potential AEW and CCM pump auto start failure during LOOP Event Date:
10/25/88 Plant:
Zion 1 UNAVAILABILITY, DURATION= 6132 NDN-RECOVERABLE INITIATIND EVENT PROBABILITIES LOOP 5.3E-02 SEQUENCE CONDITIONAL PROBABILITY SUMS End State/Initiator Probability CD LOOP 2.6E-03 Total 2.6E-03 AIMS LOOP S. 0E+0S Total 0.00+00 SEQUENCE CONDITIONAL PROBABILITIES (PROBABILITY ORDER)
Sequence End State Prob N Recat 45 loop -rt/loop -emerg.power AFW HPI(F/B)
CO 2.5E-03 5.3E-01
-* non-recovery credit for edited case SEQUENCE CONDITIONAL PROBABILITIES (SEQUENCE ORDER)
Sequence End State Prob N Rec**
45 loop -rt/loop -emerg.power AFM NPI(F/B)
CD 2.5E-03 5.3E-01
-* non-recovery credit for edited case Note:
For unavailabilities, conditional probability values are differential values which reflect the added risk due to failures associated with an event.
Parenthetical values indicate a reduction in risk compared to a similar period without the existing failures.
SEQUENCE MODEL:
a:\\sealmod\\pwrbseal.cmp BRANCH MODEL:
a:\\sealmod\\zion.sll PROBABILITY FILE:
a:\\sealmod\\pwr bsll.pro No Recovery Limit BRANCH FREQUENCIES/PROBABILITIES Branch System Ncn-Recov Opr Fail trans 1.5E-04 1.00+00 loop 1.6E-05 5.3E-01 loca 2.4E-06 4.3E-01 rt 2.8E-04 1.2E-01 rI/loop S.SE+SS 1.00+00 emerg.power 5.4E-04 8.00-01 AFM 3.8E-04 > 5.00-02 2.6E-01 > 1.00+00 Branch Model:
l.OF.3i-ser Train 1 Cond Prob:
2.00-02 > Faited Train 2 Cond Prob:
1.00-01 > Failed Train 3 Cond Prob:
5.00-02 Event Identifier: 295/88-019
B-1 II Serial Component Prob:
afwl emerg.power mfw porv.or.srv.chall porv.or.srv. reseat porv.or.srv.reseat/emerg.power SEAL. LOCA Branch Model:
1.OF.1 Train 1 Cond Prob:
ep. rec (si) ep. rec EIPI Branch Model:
l.CF.2 Train 1 Cond Prob:
Train 2 Cond Prob:
HPI (F/B)
Branch Model:
1.CF.2+opr Train 1 Cond Prob:
Train 2 Cond Prob:
HPR/-HPI Branch Model:
1.OF.2+opr Train 1 Cond Prob:
Train 2 Cond Prob:
porv.open
- branch model file
- forced Minarick 11-12-1989 23 : 56:2 9 2.8E-04 5.0OE-02
- 2. OE-01 4.OE-02 2.OE-02 2.06E-02 2.7E-01 > 1.064-00 *
- 2. 7E-01
- 5. 7Z-01
- 3. 1E-02 1.06-03 > 1.OE+00 1.06-02 > Failed 1.06-01 > Failed 1.06-03 > 1.06+00 1.06-02 > Failed 1.0E-01 > Failed 1.5E-04 > 1.06+00 1.06-02 > Failed 1.5E-02 > Failed 1.OE-02 3.4E-01 3.4E-01 1.06+00
- 1. 1E-02
.1.06+00 1.06+00 1.06+00 1.06E+00 8.4E-01 > 1.0E+00 8.4E-01 > 1.06+00
- 1. 0 +00
- 1. 0 +00 1.0E-02
- 1. 0 -03 4.0E-04 Event Identifier: 295/88-019