ML21035A236
| ML21035A236 | |
| Person / Time | |
|---|---|
| Site: | Cook  |
| Issue date: | 02/08/2021 |
| From: | Christopher Hunter NRC/RES/DRA/PRB |
| To: | |
| Christopher Hunter | |
| References | |
| LER 316-2020-003 | |
| Download: ML21035A236 (7) | |
Text
1 Final ASP Analysis - Precursor Accident Sequence Precursor Program - Office of Nuclear Regulatory Research D.C. Cook Nuclear Plant, Unit 2 Manual Reactor Trip and Automatic Safety Injection Due to Failed Open Pressurizer Spray Valve Event Date: 9/4/2020 LER:
316-2020-003 CCDP =
1x10-5 IR:
TBD Plant Type:
Westinghouse Four-Loop Pressurized Water Reactor (PWR) with a Wet, Ice Condenser Containment Plant Operating Mode (Reactor Power Level):
Mode 1 (92% Reactor Power)
Analyst:
Reviewer:
Completion Date:
Christopher Hunter Mehdi Reisi Fard 2/8/2021 1
EXECUTIVE
SUMMARY
On September 4, 2020, main control room (MCR) operators completed a planned power reduction from 100 percent to 92 percent reactor power in preparation of main turbine valve testing. As reactor coolant system (RCS) pressure reached 2235 psig, one pressurizer spray valve began to close as expected; however, the other spray valve unexpectedly opened fully.
The operators were unable to close the open spray valve and subsequently manually tripped the reactor due to lowering RCS pressure. RCS pressure continued to lower below the safety injection (SI) actuation setpoint resulting in an automatic SI actuation.
All automatic actions in response to the SI signal occurred as expected, includingall control rods fully inserted; all auxiliary feedwater (AFW) pumps started and supplied the steam generators (SGs); all emergency core cooling system (ECCS) components operated as required. In addition, both emergency diesel generators (EDGs) automatically started; however, they remained unloaded because offsite power remained available throughout the event. Decay heat was removed by the steam dump valves and ECCS was manually secured. Due to high RCS pressure as a result of the SI actuation, the pressurizer power-operated relief valves (PORVs) cycled seven times prior to operators securing pressurizer spray and terminating SI.
The cause of the failed pressurizer spray valve was foreign material from the control air supply being stuck in the positioner spool valve.
The mean conditional core damage probability for this event is calculated to be 1x10-5. This accident sequence precursor (ASP) analysis reveals that the most likely core damage sequence is an SI initiating event with AFW successfully providing inventory makeup to the SGs; however, operators fail to terminate SI resulting in a loss-of-coolant accident (LOCA) via the pressurizer relief valves, and high-pressure recirculation failure (dominated by human error). This accident sequence accounts for approximately 84 percent of the total CCDP for this event.
2 EVENT DETAILS 2.1 Event Description On September 4, 2020, MCR operators completed a planned power reduction from 100 percent to 92 percent reactor power in preparation of main turbine valve testing. As RCS pressure
LER 316-2020-003 2
reached 2235 psig, one pressurizer spray valve began to close as expected; however, the other spray valve unexpectedly opened fully. The operators were unable to close the open spray valve and subsequently manually tripped the reactor due to lowering RCS pressure. RCS pressure continued to lower below the SI actuation setpoint resulting in an automatic SI actuation.
All automatic actions in response to the SI signal occurred as expected, includingall control rods fully inserted; all AFW pumps started and supplied the SGs; all ECCS components operated as required. In addition, both EDGs automatically started; however, they remained unloaded because offsite power remained available throughout the event. Decay heat was removed by the steam dump valves and ECCS was manually secured. Due to high RCS pressure as the result of the SI actuation, the pressurizer PORVs cycled seven times prior to operator securing pressurizer spray and terminating SI. Additional information is provided in licensee event report (LER) 316-2020-002, Manual Reactor Trip and Automatic Safety Injection Due to Failed Open Pressurizer Spray Valve, (ADAMS Accession No. ML20311A129.).
2.2 Cause The licensee determined that the cause of the failed pressurizer spray valve was foreign material from the control air supply being stuck in the positioner spool valve.
3 MODELING 3.1 SDP Results/Basis for ASP Analysis The ASP Program performs independent analyses for initiating events. ASP analyses of initiating events account for all failures/degraded conditions and unavailabilities (e.g., equipment out for maintenance) that occurred during the event, regardless of licensee performance.0F1 No windowed events were identified.
3.2 Analysis Type An initiating event analysis was performed using a test/limited use (TLU) standardized plant analysis risk (SPAR) model for D.C. Cook Nuclear Plants 1 and 2 created in December 2020.
This TLU model includes an inadvertent SI actuation event tree to allow the modeling of this event.
3.3 SPAR Model Modifications The following SPAR model modifications were made to support this analysis:
The event tree branch for the ISINJ (inadvertent SI) event tree was modified.
Specifically, the transfers to the SLOCA (small LOCA) event tree were removed and replaced by branching within the parent event tree. These changes eliminate unnecessary queries in the SLOCA event tree. In addition, the OEP (consequential loss of offsite power) top event and transfer to the LOOPPC (plant-centered loss of offsite power) event tree was inserted to account for potential consequential LOOP during the event. The transfer for the failure of the reactor protection system sequence was 1
ASP analyses also account for any degraded condition(s) that were identified after the initiating event occurred if the failure/degradation exposure time(s) overlapped the initiating event date.
LER 316-2020-003 3
changed to the ATWS (anticipated transient without scram) event tree. The modified ISINJ event tree is provided in Figure A-1 of Appendix A.
Basic event PPR-PRV-CO-TRANS (PORVs/SRVs open during transient) was changed to its complement under gate PORV-4 in the PORV (PORVs are closed) fault tree. This change was made to account for the pressurizer safety relief valves not being challenged if the PORVs lift during the SI actuation.
3.4 Analysis Assumptions The following modeling assumptions were determined to be significant to the modeling of this initiating event assessment:
The probability of IE-ISINJ (inadvertent safety injection) was set to 1.0 due to automatic SI actuation. All other initiating event probabilities were set to zero.
Basic event PPR-PRV-CO-TRANS was set to TRUE because the PORVs opened seven times during the event response.
The pressurizer PORVs experience seven demands due to high RCS pressure as a result of the SI actuation. To account for the increased failure of these PORVs to successfully reclose after the opening, the associated failure probabilities were modified using binominal expansion to account for their greater likelihood of failure. Basic event ZT-PRV-OO-PZR-R1 (one pressurizer PORV fails to reclose after scram) was set to 1x10-2.
4 ANALYSIS RESULTS 4.1 Results The mean CCDP for this analysis is calculated to be 1x10-5. The ASP Program threshold for initiating events is a CCDP of 10-6 or the plant-specific CCDP of an uncomplicated reactor trip with a non-recoverable loss of feedwater or the condenser heat sink, whichever is greater. This CCDP equivalent for D.C. Cook Nuclear Plant (Unit 2) is 4x10-7. Therefore, this event is a precursor.
The parameter uncertainty results for this analysis provided below:
Table 1. Parameter Uncertainty Results 5%
Median Pt. Estimate Mean 95%
8.3x10-9 1.3x10-6 1.3x10-5 1.3x10-5 5.4x10-5 4.2 Dominant Sequences1F2 The dominant accident sequence is an inadvertent SI sequence 5 (CDP = 1.1x10-5), which contributes approximately 84 percent of the total CCDP. The sequences that contribute at least 5.0 percent to the total CCDP are provided in the following table. The event tree with the dominant sequence is shown graphically in Figure A-1 of Appendix A.
2 The CCDP in this section is a point estimate.
LER 316-2020-003 4
Table 2. Dominant Sequences Sequence CDP Description ISINJ 5 1.1x10-5 83.9%
SI initiating event with AFW successfully providing inventory makeup to the SGs; however, operators fail to terminate SI resulting in a LOCA via the pressurizer PORVs, and high-pressure recirculation fails (dominated by human error) resulting in core damage ISINJ 3 1.3x10-6 10.1%
SI initiating event with AFW successfully providing inventory makeup to the SGs and operators successfully terminate SI; however, a pressurizer PORV fails to reclose resulting in a continued LOCA; and high-pressure recirculation fails resulting in core damage 4.3 Key Uncertainties A review of the analysis assumptions and results reveal the following key modeling uncertainties:
The dominant contributors to this events CCDP are the human error probabilities (HEPs) associated with two human failure events: HPI-XHE-XM-THRTL (operators fail to terminate SI) and HPI-XHE-XM-RECIRC (operators fail to start/control high-pressure recirculation). While both of these HFEs use industry average HEP values like all SPAR model HFEs, there is greater uncertainty associated with the HEP for HPI-XHE-XM-THRTL because this event has not been evaluated in the same level of detail as recirculation HFEs. The SPAR model HEP for HPI-XHE-XM-THRTL is 2x10-3. To determine if this HEP is reasonable, a reevaluation of this HFE HP was performed using the IDHEAS-ECA methodology that is provided below.
Table 3. Qualitative HFE Information for HPI-XHE-XM-THRTL Name HPI-XHE-XM-THRTL Definition Operators fail to terminate SI Description/
Event Context During this event, the failed pressurizer spray valve resulted in a lowering RCS pressure and subsequent SI actuation. The SI would eventually cause a LOCA via the pressurizer relief valves. Procedures direct operators to secure spray by tripping applicable reactor coolant pumps (RCPs) to secure pressurizer spray and terminate SI once RCS pressure is recovered.
Success Criteria Operators successfully secure pressurizer spray and terminate SI prior to refueling water storage tank (RWST) depletion.
Key Cue(s)
E-0, Step 15b, check pressurizer spray valves closed E-0, Steps 16-18, check RCS intact E-0, Step 20, adequate subcooling, RCS pressure, feed flow, pressurizer level to secure SI Procedural Guidance E-0, Reactor Trip or SI ES-1.1, SI Termination
LER 316-2020-003 5
Table 4. IDHEAS-ECA Evaluation for HPI-XHE-XM-THRTL Critical Task(s)
Operators fail to secure pressurizer spray and terminate SI Performance Influencing Factors (PIFs)
Detection Scenario Familiarity-No impact Task Complexity-No impact The other PIFs were evaluated to not have a significant impact on this HFE.
Understanding Scenario Familiarity-No impact Information Completeness and Reliability-No impact Task Complexity-No impact The other PIFs were evaluated to not have a significant impact on this HFE.
Decisionmaking Scenario Familiarity-No impact Information Completeness and Reliability-No impact Task Complexity-No impact The other PIFs were evaluated to not have a significant impact on this HFE.
Action Scenario Familiarity-No impact Task Complexity-C31: straightforward procedure with many steps The other PIFs were evaluated to not have a significant impact on this HFE.
Inter-Team This cognitive failure mechanism was not evaluated because multiple teams would not be involved.
Time Consideration Pt is negligible because the operators would get to E-0 procedure steps within a few minutes and would have at least a few hours until RWST level decreases to below 30 percent.
Recovery Recovery credit is not provided for this HFE.
Calculated HEP 3x10-3 The IDHEAS evaluation of HPI-XHE-XM-THRTL results in a HEP of 3x10-3, which is only a minor difference from the industry average value used in the SPAR models.
However, a sensitivity analysis show that this small change in the HEP results in a mean CCDP of 1.8x10-5, which is an increase of approximately 38 percent from the best estimate analysis.
No dependency between HFEs is considered in the base SPAR model for this initiating event. Specifically, the dominant cut set, which accounts for approximately 63 percent of the overall CCDP, contains the HFEs HPI-XHE-XM-THRTL and HPI-XHE-XM-RECIRC. Both NUREG/CR-6883, The SPAR H Human Reliability Analysis Method, (ADAMS Accession No. ML051950061) and INL/EXT-10-18533, SPAR-H Step-by-Step Guidance,(ADAMS Accession No. ML112060305) direct that the Technique for Human Error-Rate Prediction (THERP) dependency table should not be directly applied without performing an initial evaluation on whether dependence is likely. Unfortunately, explicit guidance on how to perform this initial evaluation does not currently exist. The analyst determined that there was no strong evidence for considering this key HFE pair as dependent for this analysis because the associated operator actions are associated with different functions that have different cues (RCS pressure, subcooling, pressurizer level versus RWST level) and significant time between actions (at least 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />). Due to the lack of explicit guidance and a widely accepted approach, a sensitivity analysis was performed applying the THERP dependency table, assuming moderate dependence
LER 316-2020-003 6
(i.e., same crew, not close in time, same location, additional cues) for this HFE pair.
This sensitivity results in a mean CCDP of 1.8x10-4, which is nearly a factor of 13 increase from the best estimate analysis.
LER 316-2020-003 A-1 Appendix A: Key Event Tree Figure A-1. Modified D.C. Cook Inadvertent SI Event Tree IE-ISINJ INADVERTENT SAFETY INJECTION RPS REACTOR SHUTDOWN OEP CONSEQUENTIAL LOSS OF OFFSITE POWER LOSC-SDS FS = LOSC-FTF LOSS OF SEAL COOLING &
FAILURE OF SEALS (NOMINAL
& SDS)
AFW AUXILIARY FEEDWATER CSI TERMINATE OR CONTROL SAFETY INJECTION PORV PORVS ARE CLOSED FAB FEED AND BLEED HPR HIGH PRESSURE RECIRCULATION End State (Phase - CD) 1 OK 2
OK 3
CD 4
OK 5
CD 6
OK 7
CD 8
CD 9
OK 10 CD 11 OK 12 CD 13 CD 14 LOOPPC 15 ATWS