ML20058P513

Accident Sequence Precursor Program Event Analysis 424/PNO-IIT-90-02A, Loop,Diesel Generator Failure & 36 Min Interruption of SDC During Mid-Loop Operation

ML20058P513
Person / Time
Site:	Diablo Canyon, Vogtle
Issue date:	04/05/1990
From:	NRC OFFICE FOR ANALYSIS & EVALUATION OF OPERATIONAL DATA (AEOD)
To:
Shared Package
ML20058P504	List: ML20058P502 ML20058P513 ML20058P518 ML20058P522
References
NUDOCS 9008170140
Download: ML20058P513 (10)

Text

.

'.. l

.Trelimin0ry - 4/5S0 ]

ACCIDENT SEQUENCE PRECURSOR PROGRAM EVENT ANALYSIS l l l

Dis analysis is based on preliminary informadon l provided informally shortly after the event and is l subject to revision, i

l I i

Event No.: 424/PNO IIT 90-02A f

! Event

Description:

LOOP, DO failure, and 36 minute interruption of SDC during mid loop ,

operation Date: March 20,1990 r Plant: Vogtle 1 .

Summary: f During a refueling and maintenance outage, while the unit was in mid-loop operation, a truck struck a switchyard tower supporting the 230 kV feeder to unit 1 "A" reserve auxiliary l transformer (RAT). This broke a feeder line and induced a ground fault whereupon protective breaker operation isolated the feed to the 1 A RAT. The IB RAT was tagged out for '

maintenance as was "B" emergency diesel generator (EDG). The "A" EDG started and tripped, leaving the unit without normal or emergency power for 36 minutes until "A" EDO was successfully restaried. The interruption in residual heat removal (RHR) resulted in a reactor  ;

coolant system (RCS) temperature rise from 90*F to 136*F.

The conditional core damage probability point estimate for this event is 9.7E-4. his value is strongly influenced by assumptions conceming battery lifetime, diesel generator recovery, and the operation staff's ability to implement an essentially non-procedurized approach to long term core cooling.

l l

l Event

Description:

l Prior to the event, Unit 2 was operating at 100% power and Unit I was in day 24 of a planned 44 day refueling outage. Power was being supplied to both emergency 4kV buses on Unit I from the "A" RAT as "B" was out of service for maintenance. "B" emergency diesel generator I was also out of service for overhaul and inspection. Non-emergency AC power was being i supplied by backfeed through the main transformer and the unit auxiliary transformers.

B I

900817014o 9oos3s PDR S

ADOCK c5000323 PDC {

.__ _ ____ i

.* Preliminary 4/590

• The reactor coolant system level had been reduced to "mid loop" (centerline of the vessel nozzles) to facilitate maintenance activities. The vessel head was in place, but not tensioned.

Accumulator isolation valve liiV 8808D was being worked on, as was charging system check valve 1 1208 U4 038. The pressurizer manway had been removed. Refueling operations were complete and 1/3 of the core had been replaced with new fuel. The refueling canal was drained and the Refucting Water Storage Tank (RWST) level was 78% (100% is approximately 700,000 gallons). "A" loop of RHR was in service and RCS temperature was approximately l

90*F. "B" RIIR injection valve was closed and out of service.

At about 9:20 a.m., EST, a lubrication and fuel truck in the Unit I switchyard struck a suppon post for the 230 kV feeder to the "A" RAT. One phase of the supply shoned to ground, the supply breaker to the feeder opened, and "A" RAT was deenergized, removing offsite power from both Unit 1 and one of the Unit 2 emergency 4kV buses. Unit 2 tripped and proceeded into a relatively normal shutdown, l A diesel generator automatically staned but promptly tripped for unknown reasons. This left Unit I without AC power to the emergency buses.

Without AC power, residual heat removal was no longer available and the RCS began to heat up. Differing measurements of the heatup rate were obtained, but the most limiting (greatest) heatup rate calculated was approximately 1.3'F per minute. A normal start of EDG "A" was attempted but it tripped on lowjacket water pressure. Vogtle's design does not pennit electrical or RHR crosstic between units, so recovery effon focused on returning the EDG to service. At 9:56 "A" EDG was successfully restarted and emergency AC power war restored to the 1 A emergency bus. This permitted the resumption of RHR to the reactor and the RCS temperature rise was stenuned at 136'F, approximately 36 minutes into the event. The "B" RAT was returned to service approximately 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> later, permitting the restoration of offsite power supply.

Event.Related Information:

core Heatup. Of particular interest in any loss of shutdown cooling event is the amount of time available for action before decay heat would cause damage to the reactor core. For this to occur in a well vented RCS in mid loop operation, the pressure vessel inventory must heat to the saturation temperature and the reactor coolant level must boil down to the top of the core (assumed to result in core damage in ASP calculations). At the time of the event, the RCS was vented through the open pressurizer manway.

Given the plant configuration which existed during this event, a simplified hand calculation indicates 1.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> would be required for the core to heat up to saturation conditiens. An additional 3.2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> would be required to boil off the excess inventory above the reactor core.

Thus, a total time interval of appmximately 4.7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> would be available prior to core damage.

2

.Prellreintry 4/5S0

)

(The Vogtle loss of RHR procedure also provides curves with expected core heatup times. 3 However, these curves predict much shoner heatup times than occurred during this event and

! may have implied an unnecessarily short response time for some actions.)

i flatterv lifetime, The Vogtle FSAR specifies a battery lifetime of 2.75 hours8.680556e-4 days <br />0.0208 hours <br />1.240079e-4 weeks <br />2.85375e-5 months <br />. PRAs typically assume battery lifetime can be extended following a station blackout by shedding less-important loads. When the plant is in cold shutdown, loads are also expected to be less than just after a trip from power. This expectation is supported by an event in 1987 at Wolf Creek (482/87 043, Battery discharge causes ESF actuations at Wolf Creek, October 15,1987, Precursors to PotentialSevere Core Damage Accidents: 1987, A Status Report, NUREGICR-4674, Vol. 8, p. C-80), where two batteries remained operable for approximately 40 hours4.62963e-4 days <br />0.0111 hours <br />6.613757e-5 weeks <br />1.522e-5 months <br /> (each Wolf Creek battery is rated for 3.3 hoars). During the Wolf Creek event, the batteries were presumably off loaded as much as possible in suppon of a 30 hour3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br /> maintenance which preceded the event. Applying the observed battery lifetime to Vogtle, a battery life of greater ,

than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> could be possible.

Once the batteries are depleted, the ability to monitor core status, start the diesel generators, and remotely operate switchgear is lost, and core damage is assumed to occur.

l Sunclemental RCS makeup. Vogtle Abnormal Operating Pmeedure 18019 C, Rev 6 l oss of Residual Heat Removal, identifies three alternate sources of RCS makeup: accumulators (by electrically opening the discharge valves), the charging system, and gravity feed from the RWST. Since both RHR trains were assumed available once AC power was restored, and the Grst two alternate sources require AC power, only the last source, gravity feed from the RWST, was addressed in this analysis. Gravity feed can be accomplished without AC power, since the valves which must be operated (HV 8812A or HV 8812B) are equipped with manual operatars.

l The effectiveness of gravity feed in cooling the core has been assumed in the analysis, although l

this has not been confirmed for the specific openings which existed in the RCS, It has also been assumed that initiating gravity feed any time prior to core uncovery is adequate. Note that gravity feed was employed at Diablo Canyon when RHR was lost for 1.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> during mid -

loop operation (323/87 005 R2, Loss of RHR cooling causes core boiling at Diablo Canyon 2, April lo,1987, Precursors to Potential Severe Core Damage Accidents: 1987, A Status Report, NUREG/CR 4674, Vol. 8, p. C-46).

Once RWST gravity feed is initiated, two possibilities exist. If the RWST is allowed to drain in an uncontrolled manner, then, depending on the relative head between the RTWST and the RCS openings, the entire RWCT could be drained in one or two hours. If draining is initiated 3

,o Prell,rpinary 4/$90

, prior to core boiling, uncontrolled draining could result in less than three or four hours of additional core cooling, if valves which control RWST flow are opened only to the extent required to keep the pressure vessel nozzles flooded, then core cooling should be maintainable well beyond 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. Given successful implementation of RWST gravity feed, a probability of 0.8 was assumed for successfully limiting flow such that at least 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of RCS cooling was available.

Alternate RCS Makeup Actions. The potential use of the positive displacement charging pump (which is apparently powered from a non safety bus but requires cooling water powered from a safety bus) and improvised approaches (such as powering Unit I buses from Unit 2 buses through jumper cables) were also considered during the analysis. However, the potential use of these approaches was not considered to substantially increase the likelihood of recovery from the event.

Analysis Approach:

core Damage Model The core damage model considers the recovery of AC power and the requirement for R( skeup once core boiling begins. Once AC power is recovered, and provided RCS invems.y is adequate, RHR is assumed available to provide core cooling. The following cases were considered:

1. Recovery of AC power prior to core boil (1.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />). In this case, restoration of RHR provides core cooling.

2. Recovery of AC power after core boil but prior to core uncovery (4.7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br />). In this case, both RCS makeup and recovery of AC power must occur. If an RHR pump is started before level is restored to mid loop, then air entrainment in the RHR suction will require the pump to be tripped and the RHR loop vented (20-60 minutes). If battery depletion occurs earlier than this, then AC power recovery and RCS makeup must be provided prior to loss of the batteries.

3. Recovery of AC power after core uncovery but prior to battery depletion. In this case, RCS makeup must be provided before core uncovery and must be maintained until AC power is recovered and RHR is restored.

The event tree model is shown in Fig.1. Three core damage sequences are shown.

Sequence 1 involves a loss of AC power with failure to recover power prior to core boiling.

RWST gravity feed is utilized for RCS makeup in a way such that RWST inventory is preserved, plus unnecessary loads are stripped from the DC buses, thereby maximizing the time available for long term AC power recover. AC power is not recovered, however, and 4

i

)

'Prel ninory 4/5S0 core uncovery (and assumed core damage) occurs. Sequence 2 is similar to sequence 1 except no efforts are made to conserve RWST inventory or battery life. In sequence 3, AC power is ,

also not recovered prior to boiling, and RCS makeup fails. ,

ne careful shedding of unnecessary DC loads plus control of RWST gravity feed (represented by sequence 1)is assumed to increase the overs 11 recovery time to twice the assumed battery lifetime. For this sequence, RWST inventory is assumed adequate for at least 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. For I

sequence 2, gravity feed is assumed to prolong core uncovery for 2.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> (time to drain the RWST plus reheat the RCS inventory), provided the assumed battery lifetime has not been exceeded.

l Batterv Lifetime. To account for the uncertainty in battery lifetime during cold shutdown at l Vogtle, three potential values were assumed in this analysis: 2.75 hours8.680556e-4 days <br />0.0208 hours <br />1.240079e-4 weeks <br />2.85375e-5 months <br /> (the rated battery life),

l 5.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> (twice the rated life), and 8.25 hours2.893519e-4 days <br />0.00694 hours <br />4.133598e-5 weeks <br />9.5125e-6 months <br />. The probability of the three battery lifetimes l

was assumed to be 0.2,0.6 and 0.2, respectively. Carefulload shedding was assumed to extend the initial battery life by a factor of two.

RCS Makeup. The likelihood of failing to imtlate RCS makeup assumed in the analysis is shown in Fig. 2. This curve was developed based on the upper bound joint HEP values shown in Fig. 7,3 2," Nominal Model of Estimated Diagnosis HEPs for a Single Abnormal Event," of Analysis of Core Damage Frequency: Internal Events Muhodology, NUREGICR-4550, Vol.1, Rev.1, with the time after signal skewed by 20 minutes to account for recovery .

out of the control room.

Probability of Not Recovering AC Power. AC power can be recovered by either recovering the single tripped diesel or by recovering offsite power. For this analysis,it was assumed that DG start in the local emergency mode hpassed the fault which initially tripped the DG. A 1

failure to recover probability of 0.1 prior to core boiling was assumed for the DG. In the event that AC power recovery was not effected prior to core boiling, DG repair starting at the time of core boiling was also considesid.

The likelihood of not recovering offsite power was calculated based on curves included in NUREG 1032, Evaluation of Station Blackout Accidents at Nuclear Power Plants. LOOP recovery likelihoods were based on plant class 13, which has the least likelihood of recovery of the three plant classes.

The probability of not recovering offsite power shown on Fig. A.3 of NUREG 1032 was fit to a Weibull distribution. This distribution [pngop (t) = exp( 1.35to.533)] was used to estimate the likelihood of failing to recover offsite power by time t. (The calculated value was additionally constrained to no less than 0.01.) For long term DG repair, the likelihood of failing to repair 1

5

I

,* Prell,minary 4/5#0  !

i was assumed to be exponentially distributed with a mean time to repair of 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> starting at the onset of core boiling [pxgoo (t) = exp( 0.17 (t twa)), t 2 te,oit].

1 These assumptions result in the following estimates for failure to recover AC power:

p(failure to recover AC power prior to core boiling) =

p(failure to recover the DG prior to core boiling) + p(failure to recover offsite power prior to l core boiling) = ,

0.1

• punop (tsoti) = 0.1 ( 9.19 = ,

i 0.019, for thou = 1.5h.

p(failure to recover AC power prior to battery depletion or core uncovery given i offsite power not recovered prior to core boiling) =

p(failure to repair DG)

• p(failure to recover offsite power prior to battery depletion or core uncovery given offsite power not recovered prior to core boiling) = .

PNRDG(I b a) * (PNROP (I b s) / PNROP (thon)) = 0.81

• 0.53 = {

0.43, for t he= 2.75h and t bon= 1.5h. l l

l Branch probabilides based on the above are shown in Fig. 3. This figure was developed from

• Fig. I and includes a branch associated with the three assumed initial battery lifetimes.

Analysis Results: .

The estimated core damage probability associated with the loss of shutdown cooling at Vogtle is 9.9E-4. This value is strongly influenced by assumptions concerning battery lifetime, diesel -

generator recovery, and the operation staff's ability to implement an essentially non-procedurized approach to long term core cooling. '

Substantial uncertainty is also associated with these estimates. The low core decay heat pmvides an extended period of time for AC power recovery, particularly if battery lifetime can be extended and supplemental makeup provided. However, these actions are for the most part not procedurized. This, plus the unavailability of ex control room recovery models, makes the

~

likelihood of implementing such actions very difficult to estimate.

i l

Different assumptions will result in different core damage point estimates, and these can be used to provide information on the range of estimates which could be associated with the event.

If a design battery lifetime of 2.75 h is assumed, with no efforts to extend battery life or conserve RWST inventory, a core damage probability of 8.0E 3 is estimated. Alternately, i optimistic assumptions concerning RAT recovery (for example, a non recovery estimate for 6

-, .,.n . . . . ,. . . , . . . . - , . . , ,,, - , . _ . . . . . , - . . . - .

, ~ . , ,n-.

.

• Prellinin:ry 4/5S0 [

i i -

offsite power of 0.001), results in a core damage probability estimate of 2.4E-4. l The impact of different assumptions concerning time after shutdown, the likelihood of l 4

providing RCS makeup, the likelihood of implementing DC load shedding plus conserving  ;

RWST water, and the recovery of AC power were also explored. The sensitivity of the analysis model to these values was calculated to be:

Revised Core

• Assumotion Damane Probability 4

Event occurs two days after shutdown with no fuel swapped (time 2.8E 3 to boil estimated to be 0,13h, time to uncover estimated to be 1.0h)

RCS makeup totally reliable no appreciable change RWST inventory and battery life conserved 5.3E 4 RWST inventory and battery life not conserved 2.9E 3 RAT and DG recovery based on observed times as mean estimates no appreciable and exponential model change t

1 1

7

?

I

. 'Preliniinory - 4/5SO  ;

v

~ .

l 1

i Loss of AC Pow M AC Power '!

AC Power Conservative Recovered  !

Recovered Makeup Makeup and m,gng Prior to Banery Prior to ProvWd Unnecessary Depletion Shutdown 8 '" "

Cooling

( DC LM End S*4 (mid loop f, StripW State No. .'

operation) ,

l OK i

'I OK i

CD 1 OK' CD 2 ,

CD 3 Fig.1, Core Damage Event Tree for Ims of AC Power During Mid loop Operation at Vogtle 1 ,

4 i

b i

8

~_. - - . .- - . . _ - . - .

. Preliminary 4/5/90 l i

l t

l 'II 1.0 i

0.1 -

[50, 0.01)

O.01 -

[320,0,001) 0.001 -

l l 1 0 10 100 1000 Time (minutes)

Fig.2. Probability of not implementing RCS Makeup l

l 9  !

.',Pretjm l nary 4/5/90 i

l Lou of gpm a Ccswerveive AC Pouer AC Power bcowwed Ma % W ""d A*8*'**d Postulated

% B""Y

% Unneceenary DCLe e Prun to tenery oepleien Shutdown se, t on (RWST L8' SI'ipped Coc4ng g,e  % (banery les (awndetdo tame t* yond Seq.

(mas 4ag End Set-oper i.on) w) Feed) entended) satweten) State No. Pr*

OK OK insel Benery LAe . 2.75 h CD is 2 9E 4 0.2 9.4E 2 (4.0h)

OK 0.2 CD 2a 3 3E 4 0.019 (1.Sh) 0 43 (1.25h)

CD 3a 4.65 6 0.0012 OK OK insal Banery Lee . s s h CD ib 9.1 E 5 1.0 0.6 1.0E 2 (9.Sh)

OK I 0.2 CD 2b 2.1 E 4 0.019 (1.5h) 9.4E 2 (4.0h)

CD 3b 1.4 E 5 0.0012 l OK l

OK treal Banwy CD Ic 1.2E 5 0.2 4.0E 3 ( 15.0h)

OK CD 2c 3 2E 5 0.019 (1. 2 )

4 2E 2 (5.7h )

CD Sc 4 6E 6 0.0012 Total Core g, = 9.9E 4 Probability Fig. 3. Core Damage Event Tree for Loss of AC Power During Mid Loop Operation at Vogtle 1, Including Branch and Sequence Probability Values 10 l

- - , - - - - - - - - ~ - *-