ML20135G977
| ML20135G977 | |
| Person / Time | |
|---|---|
| Site: | Millstone  |
| Issue date: | 05/14/2020 |
| From: | Christopher Hunter NRC/RES/DRA/PRB |
| To: | |
| Littlejohn J (301) 415-0428 | |
| References | |
| LER 91-009-00 | |
| Download: ML20135G977 (5) | |
Text
B-339 ACCIDENT SEQUENCE PRECURSOR PROGRAM -EVENT ANALYSIS LER No.: 336/91-009 Event
Description:
Both diesel generators unavailable and unit shutdown Date of Event: August 21, 1991 Plant: Millstone 2 Summary Both emergency diesel generators (EDGs) were found to exhibit erratic load control, a result of either a resistance change in the "droop" potentiometers in the electronic governor controls or contaminated oil in the hydraulic actuator units. This second cause would result in EDG inoperability under all circumstances; the first cause would only impact paralleled operation. Assuming, for the purposes of this analysis, that the EDGs would be inoperable following a postulated loss of offsite power (LOOP), a conditional core damage probability of 2.1 x 10- is estimated. The relative significance of the event compared to other postulated events at Millstone 2 is shown below.
LER 336/91-009 IE-7 1E-6 IE-5 IE-4 1E-3 IE-2 L TRE 360 It I +Lk)W AFW LOOP precursor cutoff _.j MMR AFW Event Description On August 21, 1991, with the plant at 90% power and EDG 13U out of service for maintenance, redundant EDG 12U was running loaded and paralleled to offsite power to demonstrate operability. At the end of a 1-h run, the EDG load control became erratic.
EDG 12U output breaker was opened, and the EDG was reparalleled, but erratic speed control caused load swings that prevented reloading. Maintenance on EDG 13U was completed, and its operability was demonstrated within 1-1/2 h.
Troubleshooting continued to determine the cause of the EDG 12U load swings, and operability of EDG 13U continued to be periodically verified. Two days later, during an
B-340 operability run, EDG 13U output breaker opened on a reverse power trip. With both ED~s unavailable, unit shutdown was begun, and cold shutdown was reached the next day.
The failure of both EDGs was caused by erratic operation of each EDG's Woodward Governor EG-A electronic control unit. Two potential causes were identified. The first involves large resistance changes in the EG-A "droop" potentiometer, which can result in large load swings while the EDG is running paralleled to the grid. The "droop" potentiometer is not used when the EDG alone is supplying power to the safety-related buses, and its failure would not affect EDG operability during emergency operation. The second potential cause, which would impact EDG operability under all circumstances, involved contaminated hydraulic oil in the hydraulic actuator unit - foreign material was found when the unit was disassembled.
Additional Event-Related information The Millstone 2 safety-related AC power system consists of two 4. 16-ky buses, each supplied by an EDG rated at 2750 kW continuous duty. Each bus provides power to one service water pump, auxiliary feedwater pump, reactor building closed cooling water pump, high- and low-pressure safety injection pump, containment spray pump, and a 480-VAC emergency bus for lower voltage loads.
ASP Modeling Assumptions and Approach The event has been modeled as a postulated LOOP during a one-half month period. As noted in the event description, it is possible that the EDG problems were caused by a change in resistance in the "droop" potentiometer. If this were the case, at least one EDO would have been available (except for a 1-1/2 h period) given an actual LOOP.
However, since the cause of the EDG problems could not definitely be tied to the "droop" potentiometers and instead could have been caused by contaminated hydraulic oil, it was assumed for the purposes of this analysis that both EDGs were failed and not recoverable.
Analysis Results The estimated conditional core damage probability associated with this event is 2.1 x 10-4 The dominant core damage sequence is a station blackout sequence. This sequence is highlighted on the following event tree and involves failure of emergency power following a postulated LOOP, a reactor coolant pump seal loss-of-coolant accident (LOCA), and failure to recover AC power prior to core uncovery.
B-34 1:
LOOP AT/LOOP EP IAFW SRV SAV SEAL EP REC HPI HPA OR LOCA (LONG) OPEN GSR SEO END CAL RESEAT
_____ CHLLNO STATE OK OK 41 CD 42 CD
___________________________________________OK OK 56 CD 43 CD 44 CD 45 CD OK 46 CD 47 CD 48 CD OK 49 CD 50 CD OK 51 CD 52 CD 53 CD OK 54 CO 55 .CD 40 ATWS Dominant core damage sequence for LER 336/91-009
B-342 CONDITIONAL CORE DAMAGE PROBABILITY CALCULATIONS Event Identifier: 336/91-009 Event
Description:
Both diesel generators unavailable and unit shutdown Event Date: 08/21/91 Plant: Millstone 2 UNAVAILABILITY, DURATION= 360 NON-RECOVERABLE INITIATING EVENT PROBABILITIES LOOP 2 .lE-03 SEQUENCE CONDITIONAL PROBAB3ILITY SUMS End State/Initiator Probability CD LOOP 2 .1E-04 Total 2.1E-04 ATWS LOOP 0. 0E+00 Total 0 .OE+00 SEQUENCE CONDITIONAL PROBABILITIES (PROBABILITY ORDER)
Sequence End State Prob N Rec**
53 loop -rt/loop EMERG.POWER -afw/emerg.power -porv.or.srv.chall CD 9.3E-05 3;3E-01 seal.loca ep.rec(sl) 54 loop -rt/loop EMERG.POWER -afw/emerg.power -porv.or.srv.chall - CD 7.7E-05 3.3E-01 seal.loca ep.rec 55 loop -rt/loop EMERG.PONER afw/emerg.power CD 3.6E-05 l.lE-0l
- non-recovery credit for edited case SEQUENCE CONDITIONAL PROBABILITIES (SEQUENCE ORDl9R)
Sequence End State Prob N Rec**
53 loop -rt/loop EMERG.POWER -afw/emerg.power -porv.or.srv.chsll CD 9.3E-05 3.3E-01 seal.locs ep.rec(sl) 54 loop -rt/loop EMERG.POWER -afw/emerg.power -porv.or.srv.chall - CD 7.7E-05 3.3E-01 seal.locs ep.rec 55 loop -rt/loop E.MERG.POWER afw/emerg.power CD 3.6E-05 l.lE-0l
-* non-recovery credit for edited case Note: For unavailabilities, conditional probability values are differential values which reflect the added risk due to failures associated with an event. Parenthetical values indicate a reduction in risk compared to a similar period without the existing failures.
SEQUENCE MODEL: c:\asp\1989\pwrgseal.cmp BRANCH MODEL: c:\asp\1989\millstn2.sll PROBABILITY FILE: c:\asp\1989\pwr7bsll.pro Event Identifier: 336/91-009
B-343 No Recovery Limit BRANCH FREQUENCIES/PROBABILITIES Branch System Non-Recov Opt Fail trans 4. OE-04 1.0E+00 loop 1.8E-05 3.3E-01 loca 2 .4E-06 4 .3E-01 rt 2.8E-04 1.2E-01 rt/loop 0 .02E+00 1.02+00 EM2RG.POWER 2.9E-03 > 1.02+00 8.02-01 > 1.02+00 Branch Model: l.OF.2 Train 1 Cond Prob: 5.OE-02 > Failed Train 2 Cond Prob: 5.7E-02 > Failed afw 3.82-04 2.6E-01 afw/emerg.power 5.OE-02 3.4E-01 mfw 2.02-01 3.4E-01 porv.or. srv.chall 2.OE-02 1. OE+00 porv.or. srv.reseat 2 .02-02 1.1E-02 porv.or. srv.reseat/emerg.power 2 .OE-02 1.02+00 seal. loca 6.02-02 1. 02+00 ep. rec (31) 7.6E-01 1. 02+00 ep. rec 4 .OE-02 1.02+00 hpi 1. OE-03 8.:4E-01 hpi (f/b) 1.02-03 8.42-01 1.02-02 porV.open 1.OE-02 1.02+00 4 .0E-04 hpr/-hpi 1.5E-04 1.02+00 cs t 2.02-03 3.4E-01
- branch model file
- forced MinaricJ(
05-22-1992 15:28:44 Event Identifier: 336/91-009