ML071930281

Final ASP Analysis- Millstone (LER 336/06-002)

ML071930281
Person / Time
Site:	Millstone
Issue date:	04/11/2007
From:	NRC/NRR/ADRO/DORL/LPLI-2
To:
Sanders, Carleen, NRR/DORL 415-1603
Shared Package
ML072910721	List: ML071930281 ML072910733
References
IR-06-002, IR-06-005, LER 06-002-00
Download: ML071930281 (9)

Text

1 Final Precursor Analysis Accident Sequence Precursor Program -- Office of Nuclear Regulatory Research Millstone Power Station (Unit 2)

Manual Reactor Trip Due to Trip of Both Feed Pumps Following a Loss of Instrument Air Event Date 02/23/2006 LER 336/06-002; IR 05000336/2006-02;

IR 05000336/2006-05 CCDP= 8x10

-6 April 11, 2007 Event Summary On February 23, 2006, with the plant in Mode 1 and 100% power, a manual reactor trip was initiated following an instrument air (IA) leak that occurred while replacing a pipe clamp on a

two-inch copper IA header in the Turbine Building. An inadequately soldered joint failed on a 1/2-

inch tee connection from a two-inch IA line that resulted in rapidly lowering Instrument Air

pressure that caused the excess flow check valve to shut. Numerous air operated valves

shifted to their loss-of-air position. Feedwater heater high-level dump valves opened causing a

reduction of heater drain flow and a loss of suction pressure to the steam generator feed pumps (SGFP). Both SGFPs tripped and a manual reactor trip was initiated. Non-Vital 120V AC

Regulated AC Panels 'VR11' and 'VR21' shift ed to backup power supplies as expected due to the transfer of station power from the Normal Station Service Transformer (NSST) to the

Reserve Station Service Transformer (RSST) following a reactor trip. The momentary loss of

power to 'VR11' during this transfer resulted in a loss of letdown and indication of pressurizer

power operated relief valves (PORV) and main steam safety valves (MSSV) position changes.

Operators subsequently restored letdown and c onfirmed no actuation of either PORVs or MSSVs had occurred during the event.

Following the reactor trip, control element assembly position display system (CEAPDS) indicated CEA '7' was not fully inserted and the core mimic indicated CEA '44' was not fully

inserted. Upon further review, it was confirmed that both CEA '7' and '44' had fully inserted and

the indication anomalies were due to reed switch indication behavior. Additionally following the

trip, the auxiliary feedwater (AFW) system was automatically actuated but the plant experienced an abnormal cool down to 526 o F in part due to excessive AFW flow to Steam Generator (SG)

'1'. An operator was dispatched to take manual control of the regulating valve at which point

RCS temperature was restored to the normal post-trip band of 530-535 o F. It was subsequently determined that AFW Regulating Valve '1' was incorrectly set. This resulted in the Auxiliary

Feed Regulating Valve '1' going to its failed positi on (i.e., full open). All other safety systems functioned as designed, and the plant was stabilized in Mode 3 at normal operating temperature

and pressure.

More details of the event can be found in the References 1, 2, and 3.

Cause. The cause of this event was determined to be an already weakened solder joint which was disturbed while attempting to repair an incorrectly installed clamp, not designed for IA

piping. This in turn, resulted in a 1/2-inch copper line separating from a tee connection causing a

partial loss of IA in the Turbine Building.

LER 336/06-002 2 Recovery opportunities.

Following the leakage of air from a two-inch instrument air line due to failure of an inadequately soldered joint, maintenance personnel quickly reconnected the air line

and applied a temporary wooden wedge to support the air line (see Reference 2). However, this recovery is not credited in the event assessment because: 1) numerous air operated valves already shifted to their loss-air-failure position; and 2) recovery of air to the secondary systems

in the turbine building, including condensate pumps, requires quite complicated manipulations

outside of the control room taking quite a long time.

Other concurrent or windowed events.

No other significant operating events existed at Millstone 2 according to the LER Search Database.Analysis Results Importance The conditional core damage probability (CCDP), for this event is 8x10-6. The results of an uncertainty assessment on the CCDP are summarized below.

CCDP5%Mean95%Millstone 2 1.2x10-7 7.6x10-6 3.3x10-5 The Accident Sequence Precursor Program acceptance threshold is a CCDP of 1x10

-6 or the CCDP equivalent of an uncomplicated reactor trip with a non-recoverable loss of secondary plant systems (e.g., feedwater and condensate). This CCDP equivalent for

Millstone 2 is 6x10

-6.Dominant Sequences The dominant core damage sequence for this event is Loss of Main Feedwater (LOMFW) Sequence 17. The events and important component failures for LOMFW

Sequence 17 shown in Figure 1 (Appendix A) include: LOMFW initiating event,successful reactor trip,failure of steam generator cooling, and failure of once through cooling.Results TablesThe conditional probabilities for the dominant sequences are shown in Table 1.The event tree sequence logic for the dominant sequences is presented in Table 2a.Table 2b defines the nomenclature used in Table 2a.The most important cut sets for the dominant sequences are listed in Table 3. Definitions and probabilities for modified or dominant basic events are provided in Table 4.

LER 336/06-002 3 Modeling Assumptions Analysis Type The Revision 3-Plus (Change 3.21) of the Millstone 2 Standardized Plant Analysis Risk (SPAR) model (Reference 4) created in October 2005 was used for this assessment.

This event was modeled as an at-power in itiating event assessment for the manual reactor trip due to a trip of both main feedwater pumps following a loss of instrument air

to the turbine building. Modeling Assumptions Summary The key modeling assumptions are listed below. These assumptions are important contributors to the overall risk.

-Recovery of condensate injection availability.

At Millstone 2, a condensate pump can be used for injection to at least one SG when both main and auxiliary

feedwater systems are not available to remove decay heat from the steam generators. However, the condensate system flow path for injection into the steam

generators was lost during the event as a result of loss of instrument air to the

turbine building. For this analysis, it was assumed that the condensate system

could not be recovered within the required time frame to be used for injection into

the SGs because: a)Numerous air operated valves already shifted to their loss-air-failure position which would lengthen and complicate the alignment of the

condensate pump SG injection flow path; andb)The time to initiate condensate system injection is relatively short and would need to be recovered before the operator initiates feed and bleed

operation (i.e., within 1 or 2 hours0.0833 days <br />0.0119 weeks <br />0.00274 months <br />).

-Impact of missing PORV indication on feed and bleed operation.

At Millstone 2, feed and bleed operation using high pressure injection and PORVs is required to

remove decay heat when secondary cooling is needed but fails. Reference 1

points out that the indication of PORV position changes was lost due to a

momentary loss of power to 120VAC Regulated AC panel 'VR11', although the

operators subsequently confirmed no actuation of PORVs had occurred during the

event. The loss of PORV position indications in the control room could have

adverse impact on the manual operation of feed and bleed. The SPAR model human error probability (HEP) for feed and bleed (HPI-XHE-XM-FAB) is estimated

at a value of 0.1 assuming the availability of the PORV position indicators.

However, operators can infer the position of PORVs by alternative indications (e.g.,

temperature gauge downstream of the PORV block valves, integrity of the rupture

discs, etc.) and the PORV position indication was lost only temporarily. Therefore, the best-estimate event assessment was performed without any change to the

HEP of 0.1 for feed and bleed operation despite the temporary loss of the PORV

position indication.

LER 336/06-002 4 -Potential RCS Overcooling due to failure of the AFW Regulating Valve.

Reference 1 indicates that SG AFW Regulating Valve '1' went to its failed position (i.e., full open) allowing excessive flow to the SG '1', which contributed to a greater

than expected, cool down of the RCS. The RCS temperature was restored to the

normal post-trip band by dispatching an operator to take manual control of the

regulating valve. The AFW system fault tree has been modified to include manual

control of AFW flow to SG '1'. Fault Tree Modifications AFW System Fault Tree.

The fault tree was modified to account for operators having totake manual control of AFW flow to SG '1'. Basic event, AFW-XHE-XM-CONTROL, was

added under the 'AND' Gate AFW-2 (see Figure 2). For the base case, this event was

set to IGNORE. Basic Event Changes

-AFW-XHE-XM-CONTROL

. This HEP was set to 1.1x10

-2 based on evaluation using the SPAR-H Method (Reference 5). It was assumed that diagnostic activities

were needed for this event, but the performance shaping factors (PSF) for the

diagnosis and action portions of HEP were set to their nominal values (i.e., set to

1).-CDS-XHE-XM-ERROR

. The HEP was set TRUE because the condensate system was assumed to be unavailable to provide injection into the SG. This

determination was made due to the insufficient time operators would have to

perform this action. See the Modeling Assumptions Summary for further details.

-IE-LOMFW. The initiating event frequency was set 1.0. All other initiating event frequencies were set to zero.

References 1.LER 336/06-002, Revision 00, "Manual Reactor Trip Due to Trip of Both Feed Pumps Following a Loss of Instrument Air," Event Date: February 23, 2006. 2.NRC Inspection Report, "Millstone Power Station - NRC Integrated Inspection Report 05000336/2006002 and 05000423/2006002," May 5, 2006.3.NRC Inspection Report, "Millstone Power Station - NRC Integrated Inspection Report 05000336/2006005 and 05000423/2006005," January 30, 2007.4.Idaho National Engineering and Environmental Laboratory, "Standardized Plant Analysis Risk Model for Millstone 2," Revision 3 Plus (Change 3.21), October 2005.5.Idaho National Engineering and Environmental Laboratory, "The SPAR-H HumanReliability Analysis Method," INEEL/EXT-02-01307, May 2004.

LER 336/06-002 5 Table 1.

Conditional core damage probabilities of dominating sequences.Event treenameSequence no.CCDP 1 ContributionLOMFW177.0E-697.2Total (all sequences) 27.2E-6100 1. Values are point estimates.

2. Total CCDP includes all sequences (including those not shown in this table).

Table 2a.

Event tree sequence logic for dominating sequences

.Event treenameSequence no.Logic ("/" denotes success; see Table 2b for top event names)LOMFW17/RT, SGC, OTC Table 2b.

Definitions of top events listed in Table 2a. Top EventDefinitionRTREACTOR TRIPSGCSECONDARY SIDE COOLDOWNOTCONCE THROUGH COOLING Table 3.

Conditional cut sets for the dominant sequences.

CCDPPercent Contribution Minimum Cut Sets (of basic events)Event Tree: LOMFW, Sequence 173.4E-006 48.21AFW-FCV-CF-ABHPI-XHE-XM-FAB9.0E-007 12.96AFW-AOV-CC-FW43BAFW-XHE-XM-CONTROLHPI-XHE-XM-FAB 2.8E-007 3.97AFW-CKV-CF-SGSHPI-XHE-XM-FAB2.4E-007 3.46 AFW-TNK-FC-CSTHPI-XHE-XM-FAB1.7E-007 2.41 AFW-FCV-CF-AB HPI-MDP-TM-1A 1.7E-007 2.41 AFW-FCV-CF-AB HPI-MDP-TM-1C5.8E-006100Total (all cutsets) 1 1. Total CCDP includes all cutsets (including those not shown in this table).

LER 336/06-002 6 Table 4.

Definitions and probabilities for m odified and dominant basic events.Event NameDescriptionProbability/ Frequency(per year)Modified AFW-AOV-CC-FW43BDISCHARGE TO SG1 AOV 2-FW-43B FAILS9.0E-004NoAFW-CKV-CF-SGSCCF OF STEAM GENERATOR CHECK VALVES2.8E-006No AFW-FCV-CF-ABCOMMON CAUSE FAILURE OF FLOW CONTROL VALVES3.4E-005NoAFW-TNK-FC-CSTAFW CONDENSATE STORAGE TANK FAILURES2.4E-006NoAFW-XHE-XM-CONTROLOPERATORS FAIL TO MANUALLY CONTROL LEVEL OF SG 11.0E-002Yes CDS-XHE-XM-ERROROPERATORS FAIL TO ALIGN CONDENSATE FORDECAY HEAT REMOVALTRUEYesHPI-MDP-TM-1AHPI MDP-P41A UNAVAILABLE DUE TO T & M5.0E-003NoHPI-MDP-TM-1CHPI MDP-P41C UNAVAILABLE DUE TO T & M5.0E-003NoHPI-XHE-XM-FABOPERATOR FAILS TO INITIATE FEED AND BLEED COOLING1.0E-001NoIE-LOMFWLOSS OF MAIN FEEDWATER INITIATING EVENT1.0Yes

11. Set the IE frequency to 1.0. All other initiating event frequencies were set to zero.

LER 336/06-002 7 Appendix A Event Tree and Fault Tree Figures

LER 336/06-002 8CSRCONTAINMENTCOOLINGHPRSUMPRECIRCSDCSHUTDOWNCOOLING SSCSECONDARYSIDECOOLDOWNOTCONCETHROUGHCOOLINGHPIHIGHPRESSUREINJECTIONRCPSLRCP SEALINTEGRITYMAINTAINEDPORVPORVsARECLOSEDSGCSTEAMGENERATORCOOLING RTREACTORTRIPIE-LOMFWLOSS OF FEEDWATER TRANSIENTS

1. ENDSTATE1 OK2 OK3 CD4 CD5 CD6 OK7 OK8 CD9 CD10 OK11 CD 12 CD13 CD14 OK15 CD16 CD17 CD18T ATWSFigure 1. Millstone 2 Loss of Main Feedwater Event Tree (with dominant sequence highlighted).

LER 336/06-002 9AFW2.760E-6AFW-CKV-CF-SGS3.348E-5AFW-FCV-CF-AB2.400E-6AFW-TNK-FC-CSTAFW-1AFW-29.000E-4AFW-AOV-CC-FW43A1.000E-4AFW-CKV-CC-FW12AIGNOREAFW-XHE-XM-CONTROLAFW-4AFW-39.000E-4AFW-AOV-CC-FW43B1.000E-4AFW-CKV-CC-FW12BNO AFW FLOWTO STEAM GENERATORSG1CCF OF STEAMGENERATOR CHECKVALVESNO OR INSUFFICIENTAFW FLOWCOMMON CAUSEFAILURE OF FLOWCONTROL VALVESAFW PUMP TRAINFAILURESDISCHARGE TOSG1 AOV 2-FW-43ADISCHARGE TOSG1 AIR ASSISTEDCHECK VALVE 2-FW-12AOPERATORS FAIL TOMANUALLY CONTROLSG 1 LEVELNO FLOW FROMPUMP TRAINS TOSG1DISCHARGE TOSG1 AOV 2-FW-43BNO AFW FLOWTO STEAM GENERATORSG2DISCHARGE PATHTO SG2 FAILURESAFW CONDENSATESTORAGE TANKFAILURESFigure 2. Modified Millstone 2 AFW Fault Tree (with added basic event circled).